@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.21

package/dist/fleet-manager.js

@@ -20,14 +20,14 @@ import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants, closeSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, lstatSync, constants as fsConstants, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { freemem, totalmem, cpus, homedir } from "node:os";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
 import { ProbeWorkerPool } from "./probe-worker-pool.js";
-import { join, dirname, basename, delimiter, isAbsolute, resolve as resolvePath } from "node:path";
+import { join, dirname, basename, delimiter, isAbsolute, relative, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
 import { fleetLabel } from "./fleet-label.js";
@@ -38,6 +38,8 @@ import { readFleetMemory } from "./process-memory.js";
 import { MemoryPressure } from "./memory-pressure.js";
 import { replyDedupText, ReplyDeduper } from "./reply-dedup.js";
 import { isMap, isScalar, parseDocument } from "yaml";
+import { changedOutside, detachForWrite } from "./yaml-shared-nodes.js";
+import { tmuxExecHelper } from "./tmux-exec-helper.js";
 import { kiroLogGate } from "./kiro-log-gate.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -48,6 +50,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -65,14 +68,16 @@ import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
 import { codexMetadataHomes, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./backend/codex-metadata.js";
-import { CLI_ENV_TTL_MS, isModelCompatible, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
+import { CLI_ENV_TTL_MS, isModelCompatible, noteResolvedBinary, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
+import { boardActivity, boardCardLimit, boardToolAction } from "./task-board-tool.js";
+import { TaskBoardWaker } from "./task-board-waker.js";
 import { escapeTelegramHtml, scheduleClock, scheduleRetryLabel } from "./scheduler/retry-label.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, parseCompactCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineModel } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, parseCompactCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineJson, statuslineModel } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -100,7 +105,8 @@ export const TASK_LIST_CAP = 100;
  * #1336: the non-terminal statuses a bare `list` returns by default. `done`
  * and `cancelled` are excluded unless the caller passes `filter_status`.
  */
-export const LIVE_TASK_STATUSES = ["open", "claimed", "blocked"];
+/** Not finished: `review` is done work waiting for the person (the task board), still live. */
+export const LIVE_TASK_STATUSES = ["open", "claimed", "blocked", "review"];
 /**
  * #1336 P2: shared normalization for filter_status across both task handlers
  * and the cap helper. Trims whitespace before dropping empties, so
@@ -134,9 +140,9 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     }
     return tasks;
 }
-import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { handleWebRequest, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
-import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
 import { SeenUsers, resolveMentions } from "./web-mentions.js";
 import { OPERATOR, WebPrefsStore } from "./web-prefs.js";
@@ -158,7 +164,7 @@ import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { parsePoll } from "./reply-polls.js";
 import { isUploadRequest, limitRequestReceive, publicAttachment, sweepOrphanedUploads, UPLOAD_REQUEST_TIMEOUT_MS, uploadLimits, WebFileLedger } from "./web-upload.js";
 import { REPLY_FILES_MAX_BYTES, snapshotReplyFile, sweepReplySnapshots, webFilesDir } from "./web-reply-files.js";
-import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { cardPicture, handleViewRequest, humanCards, identityColors, instanceTeams, isViewPath, personBannerFocus, personIdentityColour, profileIdentities, resolveInstanceIdentity, setPersonBannerFocus, setPersonIdentityColour } from "./view-api.js";
 import { autoIdentityColor } from "./web-identity-color.js";
 import { AppearanceTools } from "./web-appearance-tools.js";
 import { cardVersion, resolveCard } from "./web-card.js";
@@ -178,11 +184,18 @@ import { runOnLoginShell } from "./login-shell.js";
 import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
 import { canonicalCommand, commandSpec, decideCommand, ruleFor } from "./command-table.js";
-import { runVisibilityCommand } from "./cross-instance-notice.js";
+import { crossInstanceVisibility, runVisibilityCommand, xmsgVisibility } from "./cross-instance-notice.js";
+import { SEARCH_RETENTION_DAYS, SearchIndex } from "./search/search-index.js";
+import { chatDoc, taskDoc, xmsgDoc } from "./search/search-docs.js";
+import { WebSettingsTools } from "./web-settings-tools.js";
+import { bindGuestRequest, guestRouteDecision } from "./web-guest-access.js";
+import { GUEST_ROOM_TICK_MS, GuestRoomMembership, guestGroupRooms } from "./web-guest-rooms.js";
+import { Delegations, TrafficLog, trafficItem } from "./fleet-traffic.js";
 import { installedChannel, updateNoticeKey } from "./update-check.js";
 import { resolveInstalledAgend } from "./update-dispatch.js";
 import { resolveUpdateLaunch, openUpdateLog, updateLogPath, watchUpdateLaunch } from "./update-launch.js";
 import { admitProfileLogin, LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
+import { WebBackendLogins, dashboardSignInSupported } from "./web-backend-login.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
@@ -190,7 +203,7 @@ import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { recentChatContext } from "./log-tail.js";
 import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
-import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, inferClassicChannelType, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { KNOWN_BACKENDS, validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
@@ -209,6 +222,7 @@ import { NeedsYouHub } from "./needs-you-hub.js";
 import { WEB_CHAT_NOTICE, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { buildOrgChart } from "./web-org.js";
+import { topMemoryHogs } from "./memory-hogs.js";
 import { GENERAL_POINTING_REFUSALS, SNOWFLAKE, hasPlaceRefs, placeRef, webRoute, webTextLinks, placeSuffix, renderPlaceRefs, stripPlaceRefs, topicUrl, worldPlaceOf } from "./topic-link.js";
 import { CacheService, cacheWindow } from "./cache-service.js";
 import { runWebCommand } from "./web-commands.js";
@@ -220,11 +234,17 @@ import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefu
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
-import { localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
+import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
+import { authorityNow, classifyWebPeer, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
+import { AuthorityStateStore } from "./authority/authority-state.js";
+import { SessionAuthorizations } from "./authority/session-authorizations.js";
+import { SessionAuthorizationRequests } from "./web-session-authorization.js";
+import { GuestLoginCodes, WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
+import { decisionListAnswer } from "./decision-list.js";
 import { CodeRequestLimiter, ReturningDevices } from "./web-returning-device.js";
-import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
+import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, LOOPBACK_HOST_NAMES, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { createPreviewListener, normalizeOrigin, previewAvailability, previewSettings } from "./web-preview.js";
+import { createEffectBootstrap } from "./web-effect-bootstrap.js";
 import { fleetLevelDifferences, fleetLevelSignature, appendedConnections } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
@@ -234,11 +254,11 @@ import { PROVIDER_SECRET_SPECS, providerSecretSpec, providerRegistryEnvKeys, isR
 /** A self-restart is a whole service restart; 120s is the apply budget, not this. */
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
-import { cleanupWatchVerdict, formatRestartProgressCompletion, RESTART_PROGRESS_TERMINAL_TIMEOUT_MS, RestartProgress, } from "./restart-progress.js";
+import { cleanupWatchVerdict, formatRestartProgressCompletion, RestartProgress, } from "./restart-progress.js";
 import { launchFullRestartHelper } from "./full-restart.js";
 import { SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE } from "./service-restart-selection.js";
 import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
@@ -247,6 +267,14 @@ import { SpawnGate } from "./spawn-gate.js";
 import { BackendOutageTracker } from "./backend-outage.js";
 import { canUnlockAdvancedTips, DailyTipScheduler, selectTip, visibleTipLevels, } from "./tips.js";
 import { getTmuxSession } from "./config.js";
+// Closed migration cohort: these 11 names existed immediately before the first
+// managed-skill publisher (a1ac499f; parent e267e684). Never grow this set when
+// adding a bundled skill: its new name is not proof of old AgEnD ownership.
+const PRE_MANIFEST_KIRO_SKILLS = new Set([
+    "backend-providers", "cross-instance-messaging", "fleet-config", "fleet-health",
+    "fleet-restart", "instance-lifecycle", "model-discovery", "multi-channel",
+    "scheduling", "session-management", "tui-effort",
+]);
 export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     if (typeof argsThreadId === "string" && argsThreadId.length > 0) {
         return argsThreadId;
@@ -283,6 +311,41 @@ export function selectLruEvictions(warm, cap, opts) {
  * fleet.yaml. Keep in sync with `uniqueInstanceName` — every name it emits
  * must match here, or a deleted instance's CLI is left running (#1305 P2-3).
  */
+/**
+ * #2163: where `p` really is — symlinks resolved. A path that does not exist yet is resolved through its deepest
+ * existing ancestor (a missing child of a link elsewhere is elsewhere too).
+ */
+function realPathThroughAncestors(p) {
+    const missing = [];
+    let at = resolvePath(p);
+    for (;;) {
+        try {
+            return join(realpathSync(at), ...missing.reverse());
+        }
+        catch { /* not there yet: try its parent */ }
+        try {
+            lstatSync(at);
+            return null;
+        }
+        catch { /* truly absent — not a broken link whose target is unknown */ }
+        const up = dirname(at);
+        if (up === at)
+            return resolvePath(p);
+        missing.push(basename(at));
+        at = up;
+    }
+}
+/**
+ * #2163: whether `dir` is inside AgEnD's own workspaces (<AGEND_HOME>/workspaces/<name>/…), compared after resolving
+ * symlinks on both sides — including a missing folder's existing ancestors — so a link elsewhere is not inside, nor is a broken link.
+ */
+export function insideManagedWorkspaces(dir, agendHome = getAgendHome()) {
+    const root = realPathThroughAncestors(join(agendHome, "workspaces")), real = realPathThroughAncestors(dir);
+    if (root === null || real === null)
+        return false;
+    const rel = relative(root, real);
+    return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
 export function isOrphanInstanceWindowName(name) {
     return /-t\d+$/.test(name) || /^classic-/.test(name);
 }
@@ -504,6 +567,8 @@ function emojiListFilter(opts) {
         withImageUrls: flag(opts.with_image_urls),
     };
 }
+/** #1920: a guest's scope until phase 2 derives one: nothing. */
+const NO_GUEST_SCOPE = new Set();
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -540,6 +605,8 @@ export class FleetManager {
     fleetConfig = null;
     rawFleetConfig = {};
     rawFleetDocument = null;
+    /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
+    fleetDocumentWrites = null;
     savedFleetConfigSnapshot = null;
     adapter = null;
     worlds = new Map();
@@ -604,6 +671,8 @@ export class FleetManager {
     statuslineWatcher;
     dailySummary = null;
     dailyTipScheduler = null;
+    /** The task board's wakes (step 2): an instance hears when someone else changes a card it owns or handed out. */
+    taskBoardWaker = null;
     webhookEmitter = null;
     // Topic icon + auto-archive state
     topicIcons = {};
@@ -732,7 +801,10 @@ export class FleetManager {
     // Adapter restart: prevents re-entrant restart attempts
     adapterRestarting = new Set();
     // Adapter isolation: track state per adapter for retry + visibility
+    /** #2175: this boot's progress message, whose completion may still be owed by its background retry. */
+    startupProgress = null;
     adapterState = new Map();
+    adapterRetryInFlight = new Map();
     /** Web Settings secret rotation is deliberately separate from reconnect
      * recovery: a rotation must build a fresh provider client with the new token,
      * and stale callbacks from the old client must not win. */
@@ -770,10 +842,16 @@ export class FleetManager {
     collabInstances = new Set();
     // Health endpoint
     healthServer = null;
+    /** #2118: independent of HTML preview availability/port; fixed bootstrap only, no effect resources. */
+    effectBootstrap = createEffectBootstrap();
+    /** Fixed trusted document coherence, independent of the HTML preview listener; never a resource grant. */
+    get effectBoot() { return this.effectBootstrap.boot; }
     healthServerDrain = null;
     /** #1306: the preview listener (health_port + 1 by default), and whether it is listening. */
     previewListener = null;
     previewListening = false;
+    /** The preview listener could not open its port: "<port>: <error code>", for the page (#2061 follow-up); null otherwise. */
+    previewListenError = null;
     /** The ports the preview listener was started for, and the inputs it was built from (a reload compares them). */
     previewPorts = null;
     previewInputs = "";
@@ -792,6 +870,9 @@ export class FleetManager {
     /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
     fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
+    /** #1920 §3.2: the background reads of guests' ClassicBot room membership (a minute's tick; reads only what is due). */
+    guestRoomsTimer = null;
+    guestRoomMembership = null;
     outboxPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
@@ -806,6 +887,17 @@ export class FleetManager {
     startedAt = 0;
     stormOpenNotifyTimer = null;
     memoryLogAt = null;
+    /**
+     * #2015: while host memory is elevated or critical, the processes holding the most in the fleet's service and whose
+     * they are (an instance, the fleet, tmux), for the pressure log, /health and the dashboard — never chat (#1712).
+     * Rescanned at most once a minute (async, one at a time); cleared when pressure ends.
+     */
+    memoryTop = null;
+    memoryTopScan = { at: null, inFlight: false, loggedAt: null };
+    /** The scan (a seam for tests: they give it a fake /proc). */
+    memoryHogScan = topMemoryHogs;
+    /** The fleet's own tmux session exists (only then are its panes read: a fleet that never started has none). */
+    tmuxSessionEnsured = false;
     memoryDebugAt = null;
     memoryLogLevel = null;
     /** #1685: the host_memory value the last status frame carried, so a change re-sends the frame. */
@@ -819,6 +911,8 @@ export class FleetManager {
     webChatHistory = new WebChatHistory();
     /** #1565: the web chat history's files (set at fleet start, once the home and the instances are known). */
     webChatStore = null;
+    /** #2293: the dashboard's global search (null: web.search.enabled is false, or the fleet has not started). */
+    searchIndex = null;
     /** Uploaded files and the files the dashboard may fetch back (uploads, reply attachments). */
     // #1937: the upload limits are the config's, read on each use (agend reload applies a change to the next upload).
     webFiles = new WebFileLedger({ limits: () => uploadLimits(this.fleetConfig?.web) });
@@ -978,7 +1072,7 @@ export class FleetManager {
                 this.emitSseEvent("status", this.getUiStatus());
             }
             catch { /* later status carries placements */ } },
-            // A nonmutating own/shared offer is not an appearance write. Only an explicit local-admin click may start it.
+            // A nonmutating own/shared offer is not an appearance write. Only an explicit non-public admin-session click may start it.
             preview: async (instance, id) => {
                 const result = this.effectTrials.offer(instance, id);
                 if (!result.ok)
@@ -986,11 +1080,12 @@ export class FleetManager {
                 const present = this.webChatHistory.list(instance).some(row => row.effectTrial?.offer === result.offer.offer);
                 if (!present && !this.publishEffectTrial(instance, result.offer))
                     return { error: "trial_unavailable" };
-                return { id, status: "offered", expiresAt: result.offer.expiresAt, message: "A trial card is in your web chat. A signed-in local admin can start it; nothing was applied." };
+                return { id, status: "offered", expiresAt: result.offer.expiresAt, message: "A trial card is in your web chat. A signed-in admin outside the public link can start it; nothing was applied." };
             },
             profiles: id => this.effectProfiles.read(id),
             profileSummary: id => this.effectService.profileSummary(id),
             profileSummaries: ids => this.effectService.profileSummaries(ids),
+            playbackSummary: (name, id) => this.effectService.playbackSummary(name, id),
         }));
     }
     appearanceToolsService;
@@ -998,7 +1093,12 @@ export class FleetManager {
     get appearanceTools() {
         return (this.appearanceToolsService ??= new AppearanceTools({
             frame: (name) => (this.getUiStatus().instances.find(i => i.name === name) ?? { name }),
-            theme: (name) => { const r = this.themeStore.get(name); return { theme: r.theme, locked: r.locked, widgets: r.placements.widgets }; },
+            theme: (name) => {
+                const r = this.themeStore.get(name);
+                return { theme: r.theme, locked: r.locked, widgets: r.placements.widgets, ambient: r.placements.ambient,
+                    glyphAsset: (id) => this.themeStore.asset(name, id) };
+            },
+            effects: name => this.themeStore.readable() ? this.themeStore.get(name).placements.effects.map(p => ({ id: p.id, by: p.by, ...(p.params ? { params: p.params } : {}), playback: this.effectService.playbackSummary(name, p.id) })) : [],
             card: (name) => resolveCard(name, humanCards(this.dataDir).get(name), this.themeStore.get(name).theme.card),
             // #1958: the host's identity-colour settings, as the page reads them (an unreadable prefs file: the defaults).
             colorPrefs: () => { try {
@@ -1079,6 +1179,31 @@ export class FleetManager {
     get ownerCss() {
         return (this.ownerCssStore ??= new OwnerCssStore(this.dataDir, this.webPrefs));
     }
+    webSettingsToolsService;
+    /**
+     * #2056: Settings → Web appearance for a tool (General, a coordinator, full) — the page's own stores and checks, and the
+     * page's announcement after a change (web-settings-tools.ts).
+     */
+    get webSettings() {
+        return (this.webSettingsToolsService ??= new WebSettingsTools({
+            prefs: this.webPrefs, ownerCss: this.ownerCss, mods: this.mods, effects: this.effectService,
+            instances: () => [...Object.keys(this.fleetConfig?.instances ?? {}),
+                ...(this.classicChannels?.getAll() ?? []).map((ch) => ch.instanceName).filter((n) => !Object.hasOwn(this.fleetConfig?.instances ?? {}, n))],
+            colour: (name) => personIdentityColour(this.dataDir, name),
+            setColour: (name, patch) => { const w = setPersonIdentityColour(this.dataDir, name, patch); if (w.ok)
+                this.identityChanged(); return w; },
+            bannerFocus: (name) => personBannerFocus(this.dataDir, name),
+            setBannerFocus: (name, focus) => { const w = setPersonBannerFocus(this.dataDir, name, focus); if (w.ok)
+                this.identityChanged(); return w; },
+            placements: (name) => this.themeStore.get(name).placements.effects.map((e) => (typeof e === "string" ? { id: e } : e)),
+            ambient: (name) => Object.fromEntries(Object.entries(this.themeStore.get(name).placements.ambient).flatMap(([k, a]) => a ? [[k, { spec: a.spec, by: a.by }]] : [])),
+            setAmbient: (name, spec, which) => this.webAppearance.humanSetAmbient(name, spec, which),
+            announce: () => { try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { /* the next status frame carries it */ } },
+        }));
+    }
     get webPrefs() {
         // #1664: a favorite must be an instance of this fleet now — fleet.yaml's (own keys) or a ClassicBot room's.
         return (this.webPrefsStore ??= new WebPrefsStore(this.dataDir, {
@@ -1181,6 +1306,7 @@ export class FleetManager {
                     current: () => current() && sessions === this.webSessions && !!this.webToken
                         && sessions.isCurrent(record, tokenEpoch(this.webToken)) && (!exposure || exposure.isCurrent()) };
             }, baseline: () => baselines.read(), snapshot: () => baselines.snapshot(),
+            selfConfirm: (req, id) => this.settingsSelfConfirmation(store, req, id),
             job: async (id) => {
                 const settlement = this.settingsJobSettlements.get(id);
                 if (!settlement)
@@ -1195,6 +1321,86 @@ export class FleetManager {
         this.settingsConfirmation = gate;
         return gate;
     }
+    /**
+     * #2170: a held change confirmed by the request itself — only when ALL hold, else the chat card or the host CLI, as
+     * before:
+     *   - the session is web-verified (#1939: its account confirmed this browser on Discord or Telegram), asked now;
+     *   - the change's effect owners are known and on one platform (settingsChatAuthority — the chat card's own rule), the
+     *     verified account is on that platform and an admin of every one of them;
+     *   - a chat card could have been asked: a connected General on that platform the change does not affect (else the
+     *     change goes to the host CLI, as before) — the General that then hears of it;
+     *   - and, at execution (store.decide asks `current()` again): still web-verified under the same session and account
+     *     (not expired, revoked, signed out or the switch turned off), still those owners' admin, still a General a card
+     *     could go to, the fleet unchanged.
+     * What it rests on: the account's one confirmation of this browser (#1939), kept for the session until it is revoked,
+     * expires or signs out — not a fresh confirmation per Apply. Whoever uses that verified session (a browser left signed
+     * in, its cookie) confirms the same way. A public link never qualifies (evaluateWebAuthority refuses it). General
+     * still hears it: a notice, not a step.
+     */
+    settingsSelfConfirmation(store, req, id) {
+        const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+        if (auth.kind !== "ok")
+            return null;
+        const record = auth.session, gateway = !!gatewayRequestContext(req), peer = classifyWebPeer(req);
+        const verified = () => {
+            const now = this.webAuthority({ session: record, gateway, peer });
+            // A refusal carries no authority (kind "none"); the handle pins the session, and with it its one account.
+            return now.authority.kind === "web-verified" && now.authority.actor && now.authority.session?.handle === record.handle ? now.authority.actor : null;
+        };
+        const actor = verified();
+        if (!actor)
+            return null;
+        const chat = this.settingsChatAuthority(store, id);
+        if (!chat)
+            return null;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const own = channels.filter(ch => (ch.id ?? ch.type) === actor.adapter_id);
+        if (own.length !== 1 || own[0].type !== chat.platform || !chat.admin(actor.user_id))
+            return null;
+        const affected = [...store.affectedConnections(id)]; // read now: a finished change no longer has them
+        if (!this.settingsNoticeGenerals(affected, chat.platform).length)
+            return null;
+        const name = this.webPerson({ adapterId: actor.adapter_id, userId: actor.user_id }).name;
+        return {
+            label: `${name} (web-verified)`,
+            // admin() asks chat.current() too; a General a card could go to must still be there (else the host CLI's).
+            current: () => !!verified() && chat.admin(actor.user_id) && this.settingsNoticeGenerals(affected, chat.platform).length > 0,
+            done: view => this.settingsWebConfirmedNotice(view, affected, name, chat.platform),
+        };
+    }
+    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    settingsNoticeGenerals(affected, platform) {
+        const excluded = new Set(affected), found = [];
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (!config.general_topic || !this.daemons.get(name))
+                continue;
+            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
+            if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform || this.adapterState.get(adapterId)?.status !== "connected")
+                continue;
+            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
+            if (chatId && topic)
+                found.push({ adapterId, adapter, chatId, topic });
+        }
+        return found;
+    }
+    /**
+     * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
+     * in, plain text, no mentions. Information only: nothing waits on it.
+     */
+    async settingsWebConfirmedNotice(view, affected, who, platform) {
+        const outcome = view.outcome ? view.outcome.message : view.state;
+        const text = `✅ Settings change confirmed from the web by ${who} (web-verified)\nSource: ${view.source}\nRequester: ${view.requested_by}\n${view.summary.join("\n")}\nOutcome: ${outcome}`;
+        for (const { adapterId, adapter, chatId, topic } of this.settingsNoticeGenerals(affected, platform)) {
+            try {
+                await adapter.sendText(chatId, text, { threadId: topic, allowedMentions: { parse: [] } });
+                return;
+            }
+            catch {
+                this.logger.info({ id: view.id, adapterId }, "Settings web-confirmation notice unavailable; trying another General");
+            }
+        }
+        this.logger.info({ id: view.id }, "Settings change confirmed from the web: no General reachable for the notice");
+    }
     /** Exact configured effect owners; this does not depend on prompt location. */
     settingsChatAuthority(store, id) {
         const scope = store.authorityOf(id);
@@ -1349,9 +1555,26 @@ export class FleetManager {
     sseHeartbeatMs = SSE_HEARTBEAT_MS;
     /** The dashboard's login codes. Memory only: a code that outlives the process is a code nobody can prove was not copied. */
     webLoginCodes = null;
+    /**
+     * #1920 step 4: guests' codes, apart from the admins' — one per account, so no guest's `/web` withdraws another's or
+     * an admin's code (#2093 review), at most 32 at once. Local sign-in only for now (audience "local").
+     */
+    webGuestLoginCodes = null;
+    /** #1920 step 4: when each account last got a guest code (monotonic) — one a minute, so `/web` is no DM flood. */
+    guestCodeAskedAt = new Map();
+    /** #2093 review: an account's guest /web in progress — one at a time, so two at once cannot both pass the minute. */
+    guestCodeInFlight = new Set();
+    /**
+     * #2093 review: revokes a guest /web in progress must see — every web session's (`/web revoke` from an admin) bumps
+     * the global count, an account's own bumps its entry — checked before the code is issued and while it is delivered.
+     */
+    guestRevokes = 0;
+    guestAccountRevokes = new Map();
     /** #1570: browsers that may ask the sign-in page for a fresh code, and how often they may. */
     returningDevices = null;
     codeRequestLimiter = new CodeRequestLimiter();
+    /** #1920 step 4b: guests' device code requests, limited apart — guests never use up the admins' fleet-wide budget. */
+    guestCodeRequestLimiter = new CodeRequestLimiter();
     /**
      * Set while a Settings apply job is driving the reconcile. The reconcile
      * stays the single doer; it just says out loud what it is doing to whom, so
@@ -1499,6 +1722,7 @@ export class FleetManager {
                 meta: {
                     chat_id: set.chatId, message_id: messageId, user: by.username, user_id: by.userId, ts,
                     thread_id: set.threadId, adapter_id: inbound.adapterId, source: inbound.source,
+                    ...(web && by.guest ? { web_guest: "1" } : {}), // #1920: "[user:… via web (guest), id:…]", as /ui/send
                     ...reactions.meta,
                 },
             }, by.humanOrigin, button.label)) !== false;
@@ -1519,6 +1743,9 @@ export class FleetManager {
         this.emitSseEvent("message", {
             instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
             click: { label: button.label, of: set.id },
+            // #1920: a platform click is its clicker's; it is the instance's channel's only when its buttons are there (the
+            // same rule as a reply's: a set sent to another topic or a DM is not). A web click is the web's.
+            ...(web ? {} : { from: webChatFrom(set.adapterId, by.userId), ...(this.clickInOwnChannel(set) ? { channel: true } : {}) }),
         });
         return true;
     }
@@ -1569,10 +1796,25 @@ export class FleetManager {
                         : t(`delivery.fleet_${row.state}`, row.targetInstance, row.operationId, row.deliveryId);
                     this.logger.error({ deliveryId: row.deliveryId, operationId: row.operationId, target: row.targetInstance, state: row.state,
                         cause: row.lastError, ...(silent ? { silentSchedule: true } : {}) }, notice);
-                    this.notifyFleetError(notice);
+                    // A self-scheduled silent heartbeat stays log-only, including the
+                    // operator alert; another source still receives the normal notice.
+                    if (!silent || row.sourceInstance !== row.targetInstance)
+                        this.notifyFleetError(notice);
                 }
             }
         });
+        // #1918: the org canvas's traffic — from the row this listener's events already name, never a probe of its own.
+        // The row as it is now (it has already changed when the event comes): its state, not the event's, is the truth.
+        outbox.on("state", (event) => {
+            const row = event.deliveryId ? outbox.get(event.deliveryId) : undefined;
+            if (row)
+                this.publishTraffic(row);
+        });
+        outbox.on("consumed", (event) => {
+            const row = event.deliveryId ? outbox.get(event.deliveryId) : undefined;
+            if (row)
+                this.publishTraffic(row, "consumed");
+        });
         outbox.on("generation_recovered", () => this.scheduleDeliveryOutboxPump());
         this.replyObligationTimer = setInterval(() => measureSyncWork("fleet.replyObligationSweep", () => this.sweepReplyObligations()), REPLY_OBLIGATION_SWEEP_MS);
         this.replyObligationTimer.unref?.();
@@ -1594,6 +1836,52 @@ export class FleetManager {
         });
         this.scheduleDeliveryOutboxPump();
     }
+    /** #1918: cross-instance traffic, as the org canvas draws it (fleet-traffic.ts). */
+    trafficLog = new TrafficLog();
+    delegations = new Delegations();
+    trafficMemo = null;
+    /**
+     * One delivery row's traffic item, kept for the snapshot and sent to the open pages when it is news; and the
+     * delegation it opens or closes (a task and its report), sent as "delegation".
+     */
+    publishTraffic(row, state) {
+        try {
+            const item = trafficItem(row, this.fleetConfig, new Date().toISOString(), state);
+            const news = item ? this.trafficLog.note(item) : null;
+            const work = news ? this.delegations.note(row, news) : [];
+            if (news || work.length)
+                this.trafficMemo = null;
+            if (news)
+                this.emitSseEvent("traffic", news);
+            // Each delegation as its two instances are seen now: one that expires or is pushed out may be older than a change
+            // to their visibility (the incoming row's own item was checked; these can be anyone's).
+            const visible = (name) => crossInstanceVisibility(this.fleetConfig, name) !== "hidden";
+            for (const d of work)
+                if (visible(d.from) && visible(d.to))
+                    this.emitSseEvent("delegation", d);
+        }
+        catch (err) {
+            this.logger.debug({ err }, "traffic: an item was not published");
+        }
+    }
+    /**
+     * GET /ui/traffic: what is in flight now (the outbox's pending rows) and what finished in the last two minutes, at
+     * most TRAFFIC_SNAPSHOT_MAX items. Worked out at most once every two seconds, so the public link's polling (or any
+     * number of pages) costs one indexed read per two seconds. Visibility is applied as of now.
+     */
+    trafficSnapshot() {
+        const nowMs = performance.now();
+        if (this.trafficMemo && nowMs - this.trafficMemo.atMs < 2_000)
+            return this.trafficMemo.value;
+        const now = new Date().toISOString();
+        const pending = (this.deliveryOutbox?.listPending() ?? [])
+            .map((r) => trafficItem(r, this.fleetConfig, r.createdAt ?? now)).filter((i) => i !== null);
+        const visible = (name) => crossInstanceVisibility(this.fleetConfig, name) !== "hidden";
+        const items = this.trafficLog.snapshot(pending).filter((i) => visible(i.from) && visible(i.to));
+        const delegations = this.delegations.snapshot().filter((d) => visible(d.from) && visible(d.to));
+        this.trafficMemo = { atMs: nowMs, value: { now, items, delegations } };
+        return this.trafficMemo.value;
+    }
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input) {
         const outbox = this.deliveryOutbox;
@@ -1606,6 +1894,8 @@ export class FleetManager {
         }
         const sourceKey = `mcp:${input.sourceInstance}:${input.operationId}:${input.targetInstance}:${input.targetSession ?? ""}:${input.kind}`;
         const admitted = outbox.admit({ ...input, sourceDaemonBootId, sourceKey });
+        if (admitted.inserted)
+            this.publishTraffic(admitted.delivery);
         if (admitted.inserted)
             this.logger.info({
                 deliveryId: admitted.delivery.deliveryId,
@@ -1628,10 +1918,18 @@ export class FleetManager {
     queryDurableDeliveryStatus(callerInstance, selector) {
         this.ensureDeliveryOutbox();
         const page = this.deliveryOutbox.queryStatusForInstance(callerInstance, selector);
+        // #1939 §10: a human receipt's authority as it reads now (switch, epoch, loopback_only).
+        const state = page.items.some(item => item.authority) ? this.webAuthorityState() : null;
+        const human = (item) => {
+            if (!item.authority || !state)
+                return item;
+            const authority = authorityNow(item.authority, state);
+            return { ...item, authority, ...(authority.downgraded ? { source_instance: "human:web:unknown" } : {}) };
+        };
         // #1641: a sender that sees only `queued` cannot tell "next in line" from "the target is stuck": say which.
         return {
             ...page,
-            items: page.items.map(item => (item.state === "queued" || item.state === "retry_wait")
+            items: page.items.map(human).map(item => (item.state === "queued" || item.state === "retry_wait")
                 ? { ...item, waiting_reason: this.deliveryWaitingReason(item.target_instance) }
                 : item),
         };
@@ -1979,17 +2277,58 @@ export class FleetManager {
                 this.logger.info({ hostMemory: snapshot }, "Host memory recovered");
             }
             this.memoryLogLevel = snapshot.level;
+            if (this.memoryTop) {
+                this.memoryTop = null;
+                this.memoryTopScan.loggedAt = null;
+                this.emitSseEvent("status", this.getUiStatus());
+            }
             return;
         }
+        if (snapshot.level === "elevated" || snapshot.level === "critical")
+            this.refreshMemoryTop(snapshot);
         if (changed || this.memoryLogAt === null || now - this.memoryLogAt >= 10 * 60_000) {
             this.memoryLogAt = now;
-            this.logger.warn({ hostMemory: snapshot }, snapshot.level === "critical"
+            this.logger.warn({ hostMemory: snapshot, ...(this.memoryTop ? { topProcesses: this.memoryTop.processes } : {}) }, snapshot.level === "critical"
                 ? "Host memory critical — deferring new CLI spawns"
                 : snapshot.level === "elevated" ? "Host memory pressure — slowing new CLI spawns"
                     : "Host memory sample unavailable — slowing new CLI spawns");
         }
         this.memoryLogLevel = snapshot.level;
     }
+    /**
+     * #2015: rescan the largest processes (at most once a minute, one at a time). The first result of an episode, and
+     * then at most every 10 minutes, is logged with the pressure; /health and the dashboard read the latest. Never chat.
+     */
+    refreshMemoryTop(snapshot) {
+        const scan = this.memoryTopScan;
+        const now = performance.now();
+        if (scan.inFlight || (scan.at !== null && now - scan.at < 60_000))
+            return;
+        scan.inFlight = true;
+        scan.at = now;
+        void (async () => {
+            const session = getTmuxSession();
+            const [tmuxServerPid, panes] = this.tmuxSessionEnsured
+                ? await Promise.all([TmuxManager.getServerPid(session), TmuxManager.listPanePids(session)])
+                : [null, []];
+            const processes = await this.memoryHogScan({
+                fleetPid: process.pid, tmuxServerPid, panes,
+                isInstance: name => this.daemons.has(name) || Object.hasOwn(this.fleetConfig?.instances ?? {}, name),
+            }, 3);
+            // Pressure may have ended while the scan ran: nothing is kept then.
+            if (this.shuttingDown || processes.length === 0 || this.hostMemoryIndicator() === null)
+                return;
+            const before = JSON.stringify(this.memoryTop?.processes ?? null);
+            this.memoryTop = { at: new Date().toISOString(), processes };
+            if (scan.loggedAt === null || performance.now() - scan.loggedAt >= 10 * 60_000) {
+                scan.loggedAt = performance.now();
+                this.logger.warn({ hostMemory: snapshot, topProcesses: processes }, "Host memory pressure — largest processes in the fleet");
+            }
+            if (JSON.stringify(processes) !== before)
+                this.emitSseEvent("status", this.getUiStatus());
+        })().catch(err => this.logger.debug({ err }, "Largest-process scan failed"))
+            .finally(() => { scan.inFlight = false; });
+    }
     /** Wire the one fleet-wide storm into notification and recovery surfaces. */
     bindStormWindowEvents() {
         this.stormWindow.on("opened", (snapshot) => {
@@ -2311,6 +2650,7 @@ export class FleetManager {
         this.fleetConfig = loaded;
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.warnAboutRemovedLoginMode(loaded);
+        this.enforceGuestSwitch();
         return this.fleetConfig;
     }
     relayLoginModeWarned = false;
@@ -3436,7 +3776,8 @@ export class FleetManager {
      * for `instance` (#1320 part B). Per entry: the channel's own adapter, no
      * thread, mention suppression on. Returns the number of channels posted
      * to. Failures are per-entry warn-and-continue — a failed echo never fails
-     * the web send. Entries without `web_echo: true` are never touched.
+     * the web send. Only entries classicWebEchoOn admits are touched (#2054: unset follows web.echo_to_channel; an explicit
+     * `web_echo: false` never echoes).
      *
      * Every copy is fenced at start time: an entry whose explicit world is
      * gone is skipped (only legacy adapterId-less entries fall back to the
@@ -3447,6 +3788,15 @@ export class FleetManager {
      * already in flight may still land late — the contract permits that.
      */
     /** `sender` (#1827): the web person's name, as the room log records them ("web-user" when none). */
+    /**
+     * #1920 §5.2: a web message's channel copy was sent — it is now what the channel saw. Kept so (and on disk), and sent
+     * to the guests' streams only: an admin's page already has it, and nothing about it changed for them.
+     */
+    webMessageInChannel(instance, messageId) {
+        const m = this.webChatHistory.markChannel(instance, messageId);
+        if (m)
+            broadcastToGuests(this.sseClients, "message", m, (err) => this.logger.debug({ err }, "SSE client write failed; evicting"));
+    }
     async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK) {
         const guard = this.webChannelEchoGuards.get(instance);
         const handled = new Set();
@@ -3463,7 +3813,7 @@ export class FleetManager {
                 }
             }
             const entry = (this.classicChannels?.getAll() ?? [])
-                .find(candidate => candidate.instanceName === instance && candidate.webEcho === true
+                .find(candidate => candidate.instanceName === instance && classicWebEchoOn(candidate.webEcho, this.fleetConfig?.web?.echo_to_channel)
                 && !handled.has(`${candidate.channelId}#${candidate.adapterId ?? ""}`));
             if (!entry)
                 break;
@@ -3663,12 +4013,31 @@ export class FleetManager {
     }
     /** Evidence-only admission. Bots/system/agent payloads have no trusted origin. */
     humanReceiptPayload(instanceName, payload, origin, originalBody) {
+        // #1939 S3: "via web (verified)" comes only from the receipt written here — never from a caller's meta.
+        const given = payload.meta;
+        if (given && "web_verified" in given) {
+            const { web_verified: _claimed, ...rest } = given;
+            payload = { ...payload, meta: rest };
+        }
         if (!origin || !this.deliveryOutbox)
             return payload;
         const row = this.deliveryOutbox.createHumanReceipt({ targetInstance: instanceName, originalBody,
             origin: { ...origin }, inputKind: String(payload.type), managerBootId: this.managerBootId });
+        // #1939 §7: each ordinary verified web message, for the S1 beta to watch. No text, cookie or session id: the handle.
+        const authority = origin.authority;
+        if (authority?.kind === "web-verified" && authority.actor && authority.session) {
+            try {
+                this.eventLog?.insert(instanceName, "web_authority", { receipt_id: row.receipt_id, session: authority.session.handle,
+                    peer: authority.session.peer, surface: "local", actor: `${authority.actor.adapter_id}:${authority.actor.user_id}`,
+                    input_kind: String(payload.type), outcome: "web-verified", authority_epoch: authority.authority_epoch });
+            }
+            catch (err) {
+                this.logger.warn({ err, instanceName }, "Could not record web authority");
+            }
+        }
+        const verified = origin.platform === "web" && authority?.kind === "web-verified";
         return { ...payload, meta: { ...(payload.meta ?? {}),
-                human_receipt_id: row.receipt_id, verification_id: row.message_id } };
+                human_receipt_id: row.receipt_id, verification_id: row.message_id, ...(verified ? { web_verified: "1" } : {}) } };
     }
     /** Bind at the actual IPC send, after all wake/reconnect waits. No human retry lane. */
     bindHumanReceiptPayload(instanceName, payload) {
@@ -3882,6 +4251,14 @@ export class FleetManager {
             return;
         }
         const scope = door.scope;
+        // #1920 step 4: a non-admin's /web while guest sign-in is on is theirs to sign in as a guest (or revoke their own)
+        // — before the table, which keeps /web for fleet admins. Per account: it touches no instance binding.
+        // Decided synchronously, so an admin's /web still reaches the table with no await after the door (#1399).
+        if (data.command === "dashboard" && this.isGuestWebAsk(adapterId, data.userId)) {
+            await this.guestWebCommand({ adapterId, userId: data.userId, username: data.username,
+                arg: String(data.options?.action ?? "").trim().toLowerCase(), replyHere: text => data.respond(text), replyPrivately: text => data.respond(text) });
+            return;
+        }
         const spec = commandSpec(data.command);
         if (!spec) {
             this.logger.info({ command: data.command, adapterId }, "Slash command is not in the command table");
@@ -4516,6 +4893,22 @@ export class FleetManager {
                 this.logger.warn({ err, name, backend }, "Failed to sync worker skills — continuing startup");
             }
         }
+        else if (kind === "classic") {
+            // #2163: a Classic bot gets only the skills marked `classic` (its own look, the dashboard) — never the fleet's
+            // coordination playbooks (#557 kept those out of end-user bots) — and only into a workspace AgEnD manages: the
+            // room's own folder under <AGEND_HOME>/workspaces/. Anywhere else, nothing is written; `agend-agent skill <name>`
+            // reads any bundled skill on demand.
+            try {
+                const skillsWorkDir = this.resolveKnowledgeWorkDir(config.working_directory, backend, name);
+                if (insideManagedWorkspaces(skillsWorkDir))
+                    measureSyncWork("fleet.classicSkills", () => this.syncRoleSkills(skillsWorkDir, backend, "classic"));
+                else
+                    this.logger.debug({ name, skillsWorkDir }, "Classic workspace is not AgEnD-managed — no skills published");
+            }
+            catch (err) {
+                this.logger.warn({ err, name, backend }, "Failed to sync classic skills — continuing startup");
+            }
+        }
         const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
         const identity = { kind, backend, model: this.resolveInstanceModel(name).display };
         if (receipt) {
@@ -4554,8 +4947,8 @@ export class FleetManager {
     }
     /**
      * Start instances with configurable concurrency and stagger delay.
-     * Instances sharing the same working_directory are serialized within a group
-     * to avoid config file races. Stagger delay is group-to-group, not instance-to-instance.
+     * Instances sharing the same working_directory are serialized to avoid
+     * config file races. Stagger applies between outer lifecycle admissions.
      * TODO: per-instance startup timeout (existing issue, not introduced here)
      */
     async startInstancesWithConcurrency(entries, topicMode, onReady) {
@@ -4577,15 +4970,30 @@ export class FleetManager {
                 totalInstances: runnableEntries.length,
             }, "Adaptive startup concurrency");
         }
+        const startedAt = performance.now();
+        let active = 0, peakConcurrentStarts = 0, readyInstances = 0;
         await Promise.all(runnableEntries.map(([name, config]) => this.spawnGate.run({
             instanceName: name,
             workingDirectory: config.working_directory,
             reason: "startup",
             stage: "lifecycle",
         }, async () => {
-            if (await this.startInstanceUnattended(name, config, topicMode, "instance"))
-                onReady?.(name);
+            peakConcurrentStarts = Math.max(peakConcurrentStarts, ++active);
+            try {
+                if (await this.startInstanceUnattended(name, config, topicMode, "instance")) {
+                    readyInstances++;
+                    onReady?.(name);
+                }
+            }
+            finally {
+                active--;
+            }
         })));
+        this.logger.info({
+            totalInstances: runnableEntries.length, readyInstances,
+            elapsedSeconds: Math.round((performance.now() - startedAt) / 100) / 10,
+            peakConcurrentStarts,
+        }, "Fleet startup batch completed");
     }
     /**
      * Start from an UNATTENDED path (fleet startup, full restart, config
@@ -5011,34 +5419,18 @@ export class FleetManager {
         return this.adapterState.get(adapterId)?.status === "connected" ? adapter : undefined;
     }
     /** Last-resort completion after RestartProgress could not deliver to its
-     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+     * adopted target (or had no message: a small fleet, a failed first post). It
+     * never wakes a not-ready gateway. #2213: an outage at fleet start no longer
+     * loses it — bounded at startup, then retried in the background once the
+     * adapter is ready again, never posted twice after an uncertain attempt. */
     async sendFleetStartCompletionFallback(chatId, text, threadId) {
         const adapterId = this.getPrimaryAdapterId();
-        const adapter = adapterId ? this.readyProgressAdapter(adapterId) : undefined;
-        if (!adapter) {
-            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because the primary adapter is not ready");
+        if (!adapterId) {
+            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because there is no primary adapter");
             return false;
         }
-        let timer;
-        const timeout = new Promise(resolve => {
-            timer = setTimeout(() => resolve({ status: "timeout" }), RESTART_PROGRESS_TERMINAL_TIMEOUT_MS);
-            timer.unref?.();
-        });
-        const delivery = Promise.resolve()
-            .then(() => adapter.sendText(chatId, text, { threadId }))
-            .then(() => ({ status: "sent" }), err => ({ status: "failed", err }));
-        const result = await Promise.race([delivery, timeout]);
-        if (timer)
-            clearTimeout(timer);
-        if (result.status === "sent")
-            return true;
-        if (result.status === "failed") {
-            this.logger.error({ err: result.err }, "Failed to send fleet start completion fallback");
-        }
-        else {
-            this.logger.error({ timeout_ms: RESTART_PROGRESS_TERMINAL_TIMEOUT_MS }, "Timed out sending fleet start completion fallback");
-        }
-        return false;
+        const poster = new RestartProgress(0, Date.now(), this.logger);
+        return poster.postCompletion({ resolveAdapter: () => this.readyProgressAdapter(adapterId), chatId, threadId }, text);
     }
     async stopInstance(name, transition) {
         this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
@@ -5326,10 +5718,14 @@ export class FleetManager {
                 // #1620: fleet.yaml's web.session.local, read at every check — a Settings save or a reload applies at once
                 // (shortening ends the sessions it now outlives). The public link's policy stays fixed.
                 localPolicy: () => localSessionPolicy(this.fleetConfig?.web?.session?.local),
+                // #1920 §5.4: a guest's, from web.guests.session (never longer than the surface's own).
+                guestPolicy: () => guestSessionPolicy(this.fleetConfig?.web?.guests?.session),
             });
+            this.enforceGuestSwitch(); // #1920: guests off while the fleet was down
         }
         if (!this.returningDevices) {
             this.returningDevices = new ReturningDevices({ dataDir: this.dataDir, onWarn: message => this.logger.warn(message) });
+            this.enforceGuestSwitch(); // #1920: guests' devices too, if guests went off while down
         }
         if (!this.webLoginCodes) {
             this.webLoginCodes = new WebLoginCodes({
@@ -5341,6 +5737,16 @@ export class FleetManager {
                 },
             });
         }
+        if (!this.webGuestLoginCodes) {
+            this.webGuestLoginCodes = new GuestLoginCodes({
+                onEvent: event => {
+                    if (event === "burned")
+                        this.logger.warn("A guest web login code was used up by wrong attempts");
+                    else if (event === "breaker-open")
+                        this.logger.warn("Guest web sign-in paused: too many wrong login codes");
+                },
+            });
+        }
     }
     /**
      * A single-use login code for the dashboard, for a channel only the operator
@@ -5464,6 +5870,7 @@ export class FleetManager {
                 dispatch: (req, res) => this.dispatchWebHttp(req, res, this.fleetConfig?.health_port ?? 19280) }),
             revoke: id => {
                 this.webLoginCodes?.revokeAudience(id);
+                this.webGuestLoginCodes?.revokeAudience(id);
                 const result = this.webSessions?.revokeExposure(id);
                 if (result && !result.durable)
                     this.logger.warn("Public session revocation could not be saved; exposure remains closed");
@@ -5495,6 +5902,24 @@ export class FleetManager {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
+    /**
+     * #1920 §5.5 (step 4b): a guest signing in through the public link — said in the General of the admin who opened it
+     * (who, how many agents), awaited as an admin's public sign-in is, while that link is the open one, its opener still
+     * current, and the account still an admitted guest. A failure refuses the sign-in.
+     */
+    async confirmGuestPublicWebLogin(info, current) {
+        const admitted = () => {
+            const open = this.publicWebLink?.openSignin();
+            return current() && open && open.exposureId === info.exposureId && this.publicOwnerCurrent(open.owner) && this.guestSignInAllowed(info.account) ? open : null;
+        };
+        const open = admitted();
+        if (!open)
+            throw new Error("guest public sign-in unavailable");
+        const adapter = open.owner.binding;
+        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        if (!admitted())
+            throw new Error("guest public sign-in changed");
+    }
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     async dashboardMenu(msg) {
         const id = msg.adapterId;
@@ -5818,16 +6243,197 @@ export class FleetManager {
         this.initializeWebSessions();
         void this.publicWebLink?.close("dashboard revoke");
         this.webLoginCodes.revoke();
+        this.webGuestLoginCodes.revokeAll();
+        this.guestRevokes++; // and every guest /web still on its way
         // #1570: no browser may ask the sign-in page for a code any more.
         const devices = this.returningDevices.revokeAll();
         const sessions = this.webSessions.revokeAll();
-        const result = { count: sessions.count, durable: sessions.durable && devices.durable };
+        // #1939 §10: and every web authority given so far (its receipts read as none).
+        const authority = this.revokeWebAuthority();
+        const result = { count: sessions.count, durable: sessions.durable && devices.durable && authority.durable };
         if (result.durable)
             this.logger.info({ count: result.count, devices: devices.count }, "Web sessions revoked (all)");
         else
             this.logger.warn({ count: result.count }, "Web sessions revoked in memory only — the session file could not be updated or removed");
         return result;
     }
+    /**
+     * #1920 phase 3: Settings → Web sign-ins → Guests — the switches, each connection's access mode and the agents named for
+     * an open one, and every guest account (signed in, with a returning device, or narrowed): who, its platform, what it
+     * reaches now, its sessions and devices, and its narrowing. Ids are the accounts' own (an admin's page).
+     */
+    guestOverview() {
+        this.initializeWebSessions();
+        const cfg = this.fleetConfig?.web?.guests;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const connections = [...this.worlds.entries()].map(([id, w]) => ({ id, type: w.adapter.type, mode: (w.accessManager.getMode() === "open" ? "open" : "allowlist"),
+            named: [...(own(cfg?.open_instances, id) ?? [])] }));
+        const accounts = new Map();
+        for (const a of this.webSessions.guestActivity())
+            accounts.set(`${a.adapterId}\u0000${a.userId}`, a);
+        const devices = this.returningDevices.guestCounts();
+        for (const k of devices.keys())
+            if (!accounts.has(k)) {
+                const [adapterId, userId] = k.split("\u0000");
+                accounts.set(k, { adapterId, userId, sessions: 0, lastSeen: null });
+            }
+        for (const key of Object.keys(cfg?.narrow ?? {})) {
+            const at = key.indexOf(":"), adapterId = key.slice(0, at), userId = key.slice(at + 1), k = `${adapterId}\u0000${userId}`;
+            if (at > 0 && !accounts.has(k))
+                accounts.set(k, { adapterId, userId, sessions: 0, lastSeen: null });
+        }
+        const guests = [...accounts.entries()].map(([k, a]) => {
+            const owner = { adapterId: a.adapterId, userId: a.userId };
+            const badge = this.guestBadge(owner);
+            // `reach`: before narrowing — what Settings offers to narrow to (#2104 review: never an agent it cannot reach).
+            return { ...a, name: badge.name, platform: badge.platform, scope: [...this.guestScope(owner)].sort(), reach: [...this.guestReach(owner)].sort(),
+                devices: devices.get(k) ?? 0, narrow: own(cfg?.narrow, `${a.adapterId}:${a.userId}`) ?? null };
+        }).sort((x, y) => (y.lastSeen ?? -1) - (x.lastSeen ?? -1));
+        return { enabled: cfg?.enabled === true, chat: cfg?.chat !== false, instances: Object.keys(this.fleetConfig?.instances ?? {}).sort(), connections, guests };
+    }
+    /** #1920 phase 3 (the app shell): a guest's chip — its web name, and its connection's platform (discord, telegram). */
+    guestBadge(owner) {
+        return { name: this.webPerson(owner).name, platform: this.worlds.get(owner.adapterId)?.adapter.type ?? owner.adapterId };
+    }
+    /** #1920 step 4: whether a `/web` is a guest's — guest sign-in on, and not from a fleet admin (theirs runs as before). */
+    isGuestWebAsk(adapterId, userId) {
+        return !!adapterId && this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(userId, adapterId);
+    }
+    /** #1920 step 4 (auth-api): a guest code's account may still sign in — guests on, and something in its scope now. */
+    guestSignInAllowed(account) {
+        return this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(account.userId, account.adapterId) && this.guestScope(account).size > 0;
+    }
+    /**
+     * #1920 §5.4: a guest's own `/web revoke` — its sessions and its outstanding code; nobody else's (an admin's revokes
+     * everyone's, as before).
+     */
+    revokeGuestWebSessions(owner) {
+        this.initializeWebSessions();
+        const key = `${owner.adapterId}\u0000${owner.userId}`;
+        this.guestAccountRevokes.set(key, (this.guestAccountRevokes.get(key) ?? 0) + 1); // its /web on its way, too
+        while (this.guestAccountRevokes.size > 4096)
+            this.guestAccountRevokes.delete(this.guestAccountRevokes.keys().next().value);
+        this.webGuestLoginCodes.revokeRecipient(owner);
+        // §5.4: its sessions and its returning devices (no browser of theirs may ask for a code any more).
+        const devices = this.returningDevices.revokeGuest(owner);
+        const ended = this.webSessions.revokeAll(r => r.tier === "guest" && r.owner?.adapterId === owner.adapterId && r.owner.userId === owner.userId);
+        this.logger.info({ adapterId: owner.adapterId, count: ended.count, devices: devices.count, durable: ended.durable && devices.durable }, "Guest web sessions revoked by their account");
+        return { count: ended.count, durable: ended.durable && devices.durable };
+    }
+    /**
+     * #1920 §2.3 (step 4): `/web` from someone who is not a fleet admin, while guest sign-in is on. `revoke` ends their
+     * own guest sessions. Otherwise a guest code (tier guest, bound to this account) goes privately — a DM, else the
+     * slash command's ephemeral answer (`replyPrivately`) — once a minute at most, and only when their scope (from what
+     * they may already use in chat, rooms read at sign-in) holds something. The code itself is never posted where asked.
+     * Callers ask isGuestWebAsk first (synchronously); false here too when it is not a guest's.
+     */
+    async guestWebCommand(ask) {
+        if (!this.isGuestWebAsk(ask.adapterId, ask.userId))
+            return false;
+        const owner = { adapterId: ask.adapterId, userId: ask.userId };
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        if (ask.arg === "revoke") {
+            const ended = this.revokeGuestWebSessions(owner);
+            await say(t(ended.durable ? "web.guest_revoked" : "web.guest_revoked_not_durable", ended.count));
+            return true;
+        }
+        const token = this.webToken;
+        const adapter = this.adapters.get(ask.adapterId);
+        if (this.shuttingDown || !token || !adapter) {
+            await say(t("dashboard.starting"));
+            return true;
+        }
+        const key = `${owner.adapterId}\u0000${owner.userId}`, asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key) || (asked !== undefined && performance.now() - asked < 60_000)) {
+            await say(t("web.guest_wait"));
+            return true;
+        }
+        this.guestCodeInFlight.add(key);
+        try {
+            await this.issueGuestCode(ask, owner, key, adapter, token);
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+        return true;
+    }
+    /** guestWebCommand's issuance, one per account at a time; a revoke made meanwhile (either kind) ends it unissued. */
+    async issueGuestCode(ask, owner, key, adapter, token) {
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const unrevoked = () => this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes;
+        // §3.2: its rooms are read at sign-in (bounded; never longer than the reads' own deadline).
+        await withinBudget(this.refreshGuestRooms(owner, { mode: "force" }), performance.now() + 6_000).catch(() => undefined);
+        if (!unrevoked())
+            return; // revoked while its rooms were read: no code
+        const scope = this.guestScope(owner);
+        if (!scope.size) {
+            const open = this.worlds.get(owner.adapterId)?.accessManager.getMode() === "open";
+            await say(t(open ? "web.guest_not_set_up" : "web.guest_nothing"));
+            return;
+        }
+        this.initializeWebSessions();
+        const codes = this.webGuestLoginCodes;
+        if (codes.pausedForMs() > 0) {
+            await say(t("web.guest_paused"));
+            return;
+        }
+        // §5.5 (step 4b): with the public link open, the code works through it too (an admin opened it; a guest is still a
+        // guest there) — most guests are not on the host's network. Its closing withdraws that audience (revokeAudience).
+        const open = this.publicWebLink?.openSignin() ?? null;
+        // One code per account (a new one replaces only its own); at the cap, refused — never another guest's evicted.
+        const login = codes.issue({ epoch: tokenEpoch(token), audiences: ["local", ...(open ? [open.exposureId] : [])],
+            recipient: { adapterId: owner.adapterId, userId: owner.userId, ...(ask.username ? { username: ask.username } : {}) } });
+        if (!login) {
+            await say(t("web.guest_busy"));
+            return;
+        }
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        while (this.guestCodeAskedAt.size > 256)
+            this.guestCodeAskedAt.delete(this.guestCodeAskedAt.keys().next().value);
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(owner.adapterId) === adapter
+            && unrevoked() && this.guestSignInAllowed(owner);
+        const privateText = `${t("web.guest_intro", scope.size)}\n${this.topicCommands.getDashboardText()}${open ? `\n${t("web.guest_public", open.url)}` : ""}\n${t("dashboard.code", login.display, Math.round(LOGIN_CODE_TTL_MS / 60_000))}`;
+        const deadline = performance.now() + 10_000;
+        try {
+            let byDm = false;
+            try {
+                if (!adapter.sendDirect)
+                    throw new Error("DM unavailable");
+                await withinBudget(adapter.sendDirect(owner.userId, `${privateText}\n${t("dashboard.code_next")}`, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
+                byDm = true;
+            }
+            catch (err) {
+                this.logDashboardDmFailure(err);
+                if (!ask.replyPrivately || !current())
+                    throw err;
+                const id = await withinBudget(ask.replyPrivately(privateText), deadline); // a slash command's answer: ephemeral
+                if (!id)
+                    throw new Error("private delivery unconfirmed");
+            }
+            if (!current())
+                throw new Error("guest no longer admitted");
+            if (byDm) {
+                await this.sendCodeAlone((body, opts) => adapter.sendDirect(owner.userId, body, opts), adapter.type, login.display);
+                if (!current())
+                    throw new Error("guest no longer admitted");
+                await say(t("web.guest_sent"));
+            }
+        }
+        catch (err) {
+            codes.revokeIfCurrent(login.issuanceId); // this flow's code only, never a later one's
+            this.logger.info({ err: err?.message, adapterId: owner.adapterId }, "Guest sign-in code was not delivered privately");
+            if (!unrevoked())
+                return; // revoked meanwhile: the revoke's own answer said so
+            const start = adapter.type === "telegram" ? this.tgStartWebUrl(owner.adapterId) : null;
+            // #1742 for guests (step 4b-3): its START button (a bare /start, or the link's /start web) then asks again, from
+            // the DM — once, within the window.
+            if (adapter.type === "telegram")
+                this.openTgWebStartWindow(owner.adapterId, owner.userId);
+            await say(start ? t("web.guest_dm_failed_link", start) : t("web.guest_dm_failed"));
+        }
+    }
     /** #1570 (auth-api): this browser becomes a returning device of the code's owner. The cookie value, or null. */
     rememberReturningDevice(owner, input) {
         const token = this.webToken;
@@ -5855,6 +6461,12 @@ export class FleetManager {
         if (!token || this.shuttingDown)
             return { kind: "refused" };
         this.initializeWebSessions();
+        // #2095 review: verified before the request's body was read — a revoke (its own, or an admin's) made meanwhile
+        // removed it, and nothing it asks for may then go out.
+        if (!this.returningDevices.current(device, tokenEpoch(token)))
+            return { kind: "refused" };
+        if (device.tier === "guest")
+            return this.requestGuestDeviceCode(device, input, token);
         const paused = this.webLoginCodes.pausedForMs();
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
@@ -5886,7 +6498,7 @@ export class FleetManager {
             this.logger.info({ err: err?.message, adapterId }, "Sign-in code request: the private message could not be sent");
             return { kind: "refused" };
         }
-        if (this.webToken !== token || !this.publicOwnerCurrent(owner)) {
+        if (this.webToken !== token || !this.publicOwnerCurrent(owner) || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
@@ -5894,15 +6506,94 @@ export class FleetManager {
         // Asked again after the follow-up's wait: the owner, the token, shutdown, and a public request's exposure.
         const exposureGone = input.surface === "gateway"
             && (this.publicWebLink?.exposureId !== input.exposureId || this.publicWebLink?.status().state !== "open");
-        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone) {
+        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
         this.logger.info({ adapterId, surface: input.surface }, "Web sign-in code sent privately to a returning device's owner");
         return { kind: "sent" };
     }
+    /**
+     * #1920 step 4b: a guest's returning device asks for a code — a guest code for that account, by DM only, under the
+     * same rules as its /web (guests on, not an admin, something in scope now; one per account and the cap; one flow per
+     * account at a time; a revoke meanwhile ends it), its own limiter, and the guests' breaker. Asked through the public
+     * link: only while that exposure is the open one (its code then works through it alone), as an admin's device.
+     */
+    async requestGuestDeviceCode(device, input, token) {
+        const codes = this.webGuestLoginCodes;
+        const account = { adapterId: device.owner.adapterId, userId: device.owner.userId };
+        const key = `${account.adapterId}\u0000${account.userId}`;
+        const adapter = this.adapters.get(account.adapterId);
+        const viaLink = input.surface === "gateway";
+        const linkOpen = () => !!input.exposureId && this.publicWebLink?.openSignin()?.exposureId === input.exposureId;
+        if ((viaLink ? !linkOpen() : input.exposureId !== undefined) || !adapter?.sendDirect || !this.guestSignInAllowed(account)) {
+            this.logger.info({ adapterId: account.adapterId, surface: input.surface }, "Guest sign-in code request refused");
+            return { kind: "refused" };
+        }
+        const paused = codes.pausedForMs();
+        if (paused > 0)
+            return { kind: "limited", retryAfterMs: paused };
+        const asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key))
+            return { kind: "limited", retryAfterMs: 5_000 };
+        if (asked !== undefined && performance.now() - asked < 60_000)
+            return { kind: "limited", retryAfterMs: 60_000 - (performance.now() - asked) };
+        const admitted = this.guestCodeRequestLimiter.admit(device.idHash);
+        if (!admitted.ok)
+            return { kind: "limited", retryAfterMs: admitted.retryAfterMs };
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(account.adapterId) === adapter
+            && this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes && this.guestSignInAllowed(account)
+            && (!viaLink || linkOpen()) && this.returningDevices.current(device, tokenEpoch(token));
+        const issued = codes.issue({ epoch: tokenEpoch(token), recipient: account, audiences: [viaLink ? input.exposureId : "local"] });
+        if (!issued)
+            return { kind: "limited", retryAfterMs: 60_000 }; // the guests' cap: never someone's evicted
+        this.guestCodeInFlight.add(key);
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        try {
+            const text = t("web.resend_code", issued.display, Math.round(LOGIN_CODE_TTL_MS / 60_000), input.label || t("web.resend_unknown_browser"), t(viaLink ? "web.resend_public" : "web.resend_local"))
+                + "\n" + t("dashboard.code_next");
+            try {
+                await withinBudget(adapter.sendDirect(account.userId, text, { disablePreview: true }), performance.now() + 5_000);
+            }
+            catch (err) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                this.logger.info({ err: err?.message, adapterId: account.adapterId }, "Guest sign-in code request: the private message could not be sent");
+                return { kind: "refused" };
+            }
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            await this.sendCodeAlone((body, opts) => adapter.sendDirect(account.userId, body, opts), adapter.type, issued.display);
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            this.logger.info({ adapterId: account.adapterId }, "Guest sign-in code sent privately to a returning device's account");
+            return { kind: "sent" };
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+    }
+    /** #1920 step 4b (auth-api): this browser becomes a guest's returning device. The cookie value, or null. */
+    rememberGuestDevice(account, input) {
+        const token = this.webToken;
+        if (!token)
+            return null;
+        this.initializeWebSessions();
+        return this.returningDevices.rememberGuest(account, { ...input, tokenEpoch: tokenEpoch(token), webToken: token });
+    }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
+        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
+        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
+        if (info.tier === "guest" && info.owner) {
+            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
+            return;
+        }
         if (this.fleetConfig?.web?.notify_login === false)
             return;
         // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
@@ -6101,11 +6792,17 @@ export class FleetManager {
      * landed mid-edit) must not be cleared or disturbed (Prism b).
      */
     async appendCleanupWarning(target, watch, warning, cleanupCommand) {
-        const text = formatRestartProgressCompletion("update", {
-            ...watch.summary,
-            warningText: warning,
-            warningCommand: cleanupCommand,
-        }, watch.receipt.startedAt);
+        // #2175: one text per outcome, frozen at its first tick. The completion carries elapsed seconds, so a text made
+        // anew each tick would never equal the one already handed over and landed (terminalLanded compares exactly).
+        const key = JSON.stringify([warning, cleanupCommand ?? null]);
+        if (watch.frozen?.key !== key) {
+            watch.frozen = { key, text: formatRestartProgressCompletion("update", {
+                    ...watch.summary,
+                    warningText: warning,
+                    warningCommand: cleanupCommand,
+                }, watch.receipt.startedAt) };
+        }
+        const text = watch.frozen.text;
         const stopWatching = () => {
             this.updateCleanupWatch = null;
             if (this.updateProgressTimer)
@@ -6113,10 +6810,22 @@ export class FleetManager {
             this.updateProgressTimer = null;
         };
         if (text !== this.lastUpdateProgressText) {
-            const adapter = this.adapters.get(target.adapterId);
-            if (!adapter)
-                return; // retry on a later tick
-            await adapter.editMessage(target.chatId, target.messageId, text, target.threadId);
+            // #2175: while the completion is still owed by the background retry, that retry is the message's only
+            // writer — this text (the completion plus the warning) goes to it rather than racing it. Handing it over is not
+            // delivery: the receipt and this watch stay until the retry reports this exact text landed (a later tick).
+            const progress = this.startupProgress;
+            if (progress?.terminalLanded(text)) {
+                // landed through the retry
+            }
+            else if (progress?.replaceTerminalText(text)) {
+                return;
+            }
+            else {
+                const adapter = this.adapters.get(target.adapterId);
+                if (!adapter)
+                    return; // retry on a later tick
+                await adapter.editMessage(target.chatId, target.messageId, text, target.threadId);
+            }
             this.lastUpdateProgressText = text;
         }
         const verdict = cleanupWatchVerdict(readUpdateProgress(this.dataDir), watch.receipt);
@@ -6238,6 +6947,12 @@ export class FleetManager {
             envLease.release();
         }
         this.ensureDeliveryOutbox();
+        // #1956: the spawn helper the fleet's tmux/stty commands are started by (its fork is cheap; the fleet's is not).
+        // Started here and by the fleet's own timer — never by a tool handler — and stopped with the fleet.
+        tmuxExecHelper.reopen();
+        tmuxExecHelper.start();
+        this.tmuxExecHelperTimer ??= setInterval(() => tmuxExecHelper.maintain(), 5_000);
+        this.tmuxExecHelperTimer.unref?.();
         this.rotateFleetLogs();
         const fleet = this.loadConfig(configPath);
         this.slimFleetConfigAtStartup();
@@ -6266,6 +6981,9 @@ export class FleetManager {
         const { getTmuxSocketName: getSocket } = await import("./paths.js");
         TmuxManager.setSocketName(getSocket());
         await TmuxManager.ensureSession(getTmuxSession());
+        this.tmuxSessionEnsured = true;
+        // #2072: what this host can run — probed in the background, published for every picker.
+        this.startAvailabilityRefresh();
         // Pre-flight (advisory, fire-and-forget): warm the per-backend auth cache
         // before instances spawn, so a CLI that comes up on its sign-in screen gets
         // an instant 🔑 verdict instead of decaying into crash/MCP-died noise.
@@ -6331,6 +7049,7 @@ export class FleetManager {
         // #1565: the web chat as it was before this process — the configured instances' only (fleet.yaml and ClassicBot
         // rooms), before the dashboard serves anything; from now on every change is written back (off the loop).
         this.restoreWebChat(fleet);
+        this.startSearchIndex(fleet);
         // Poll classicBot.yaml for external changes every 30s
         this.classicReloadTimer = setInterval(() => {
             // Attributes the synchronous part, up to the reload's first await (#1235).
@@ -6475,7 +7194,9 @@ export class FleetManager {
             };
             this.scheduler = new Scheduler(join(this.dataDir, "scheduler.db"), (schedule, runId, retry) => this.handleScheduleTrigger(schedule, runId, retry), schedulerConfig, (name) => this.fleetConfig?.instances?.[name] != null || !!this.classicChannels?.getAll().some(ch => ch.instanceName === name), (schedule, retry, reason) => this.scheduleRetryDropped(schedule, retry, reason), this.logger);
             this.scheduler.init();
+            this.scheduler.db.onTaskChange = (task) => this.searchIndex?.record(taskDoc(task));
             this.logger.info("Scheduler initialized");
+            this.attachTaskBoard(this.scheduler.db);
             // Tips share the daily-report clock but remain an independent internal
             // job: disabling daily_summary must not disable tips (and vice versa).
             // The callback checks defaults.tips at fire time, so /tips on|off is hot.
@@ -6503,6 +7224,7 @@ export class FleetManager {
         const generals = allEntries.filter(([_, cfg]) => cfg.general_topic);
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
         const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingProgressOperation === "full-restart" ? "reload" : pendingUpdateProgress ? "update" : "restart" });
+        this.startupProgress = startupProgress;
         if (generals.length > 0) {
             for (const [name, cfg] of generals) {
                 try {
@@ -6589,6 +7311,18 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
+        // #2122 §5.5: usage is collected from the start, not from the first time someone opens a report — the same bounded
+        // background passes the cache report uses (16 MB a pass, then every 10 minutes).
+        {
+            const cache = this.cacheServiceFor();
+            cache.start();
+            void cache.kick();
+        }
+        // #1920 §3.2: guests' ClassicBot room membership, read in the background — now, then each key ten minutes after
+        // its answer (a minute after a failed read; the tick only finds what is due). A request only reads the answers.
+        void this.refreshAllGuestRooms();
+        this.guestRoomsTimer = setInterval(() => { void this.refreshAllGuestRooms(); }, GUEST_ROOM_TICK_MS);
+        this.guestRoomsTimer.unref?.();
         // #1335: delivery-outbox.db and Task Board retention. Same once-at-startup
         // + daily-timer pattern; chunked DELETEs so one run cannot hold the loop.
         void this.pruneOutboxAndTasks();
@@ -6689,6 +7423,10 @@ export class FleetManager {
             // operation so an older stop never reports. No pending operation means
             // a plain boot — nothing was stopped by an operation, report nothing.
             const backgroundWorkEndedNames = this.collectBackgroundWorkEndedNames(configuredNames, pendingUpdateProgress?.startedAt ?? null);
+            // #2264: an update whose fleet comes back on another version did not land — say so in its final message (the
+            // version it aimed for, the one running, and the one repair), never just "updated".
+            const aimedAt = pendingProgressOperation === "update" ? pendingUpdateProgress?.progress.version : undefined;
+            const notLanded = aimedAt && agendVersion !== "unknown" && aimedAt !== agendVersion ? t("update.not_landed", aimedAt, agendVersion) : null;
             const completionSummary = {
                 running: started,
                 total,
@@ -6698,7 +7436,7 @@ export class FleetManager {
                 backgroundWorkEndedNames,
                 ...(cleanupOutcome && "render" in cleanupOutcome
                     ? { warningText: cleanupOutcome.render.warning, warningCommand: cleanupOutcome.render.cleanupCommand }
-                    : {}),
+                    : notLanded ? { warningText: notLanded } : {}),
             };
             const progressCompleted = await startupProgress.finish(completionSummary);
             // Armed only after the completion posted: an append racing ahead of it would be overwritten by it.
@@ -6918,48 +7656,109 @@ export class FleetManager {
                 const err = results[i].reason;
                 this.logger.error({ adapterId, err: err?.message ?? err }, "Adapter startup failed — scheduling background retry");
                 this.adapterState.set(adapterId, { status: "retrying", retryCount: 0, lastError: err?.message ?? String(err) });
-                this.scheduleAdapterRetry(adapterId, channelConfigs[i], i === 0 ? fleet : undefined);
+                this.scheduleAdapterRetry(adapterId);
                 // Notify admin via whichever adapter is already up
                 this.notifyAdapterFailure(adapterId, err?.message ?? String(err));
             }
         }
     }
-    /** Exponential backoff retry for a single failed adapter (background, non-blocking). */
-    scheduleAdapterRetry(adapterId, channelConfig, fleet) {
-        const MAX_RETRIES = 10;
+    /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
+    scheduleAdapterRetry(adapterId) {
         const INITIAL_DELAY_MS = 5_000;
         const MAX_DELAY_MS = 5 * 60_000;
         const state = this.adapterState.get(adapterId);
-        if (!state || state.retryCount >= MAX_RETRIES) {
-            if (state) {
-                state.status = "failed";
-                this.logger.error({ adapterId, retries: state.retryCount }, "Adapter retry exhausted — giving up");
-                this.notifyAdapterFailure(adapterId, `Retry exhausted after ${state.retryCount} attempts. Check token/network and restart fleet.`);
-            }
+        if (this.shuttingDown || !state || state.retryTimer || this.adapterRetryInFlight.has(adapterId))
             return;
-        }
-        const delay = Math.min(INITIAL_DELAY_MS * Math.pow(2, state.retryCount), MAX_DELAY_MS);
+        const delay = Math.min(INITIAL_DELAY_MS * Math.pow(2, Math.min(state.retryCount, 6)), MAX_DELAY_MS);
         this.logger.info({ adapterId, attempt: state.retryCount + 1, delay_ms: delay }, "Scheduling adapter retry");
-        state.retryTimer = setTimeout(async () => {
+        const timer = setTimeout(() => {
+            const current = this.adapterState.get(adapterId);
+            if (this.shuttingDown || current?.retryTimer !== timer)
+                return;
+            current.retryTimer = undefined;
+            void this.attemptAdapterRetry(adapterId);
+        }, delay);
+        state.retryTimer = timer;
+        timer.unref?.();
+    }
+    /** One login per connection, shared by the background timer and the operator's Retry now. */
+    attemptAdapterRetry(adapterId) {
+        const pending = this.adapterRetryInFlight.get(adapterId);
+        if (pending)
+            return pending;
+        if (this.shuttingDown || !this.secureConnectionChannel(adapterId))
+            return Promise.resolve();
+        const attempt = Promise.resolve().then(async () => {
+            const channel = this.secureConnectionChannel(adapterId);
+            if (this.shuttingDown || !channel)
+                return;
+            const generation = this.settingsGeneration;
+            const binding = JSON.stringify([channel, this.getPrimaryAdapterId()]);
+            const token = process.env[channel.bot_token_env];
+            const operation = { owner: Symbol("adapter-retry"), assert: () => {
+                    if (this.shuttingDown || generation !== this.settingsGeneration
+                        || JSON.stringify([this.secureConnectionChannel(adapterId), this.getPrimaryAdapterId()]) !== binding
+                        || process.env[channel.bot_token_env] !== token)
+                        throw new Error("adapter retry superseded");
+                } };
+            const state = this.adapterState.get(adapterId) ?? { status: "retrying", retryCount: 0 };
+            state.status = "retrying";
             state.retryCount++;
+            this.adapterState.set(adapterId, state);
             try {
-                if (fleet) {
-                    await this.startSingleAdapter(fleet, channelConfig);
-                }
-                else {
-                    await this.startAdditionalAdapter(channelConfig);
-                }
-                state.status = "connected";
-                state.lastError = undefined;
+                if (this.getPrimaryAdapterId() === adapterId)
+                    await this.startSingleAdapter(this.fleetConfig, channel, undefined, operation);
+                else
+                    await this.startAdditionalAdapter(channel, true, undefined, operation);
+                if (this.shuttingDown || generation !== this.settingsGeneration)
+                    return;
+                if (!this.adapters.has(adapterId))
+                    throw new Error("Adapter token is not configured");
+                // Health events can replace the state object during login. Update its current owner.
+                const current = this.adapterState.get(adapterId);
+                current.status = "connected";
+                current.lastError = undefined;
                 this.logger.info({ adapterId, attempts: state.retryCount }, "Adapter reconnected on retry");
                 this.notifyAdapterRecovery(adapterId, state.retryCount);
             }
             catch (err) {
-                state.lastError = err?.message ?? String(err);
-                this.logger.warn({ adapterId, attempt: state.retryCount, err: state.lastError }, "Adapter retry failed");
-                this.scheduleAdapterRetry(adapterId, channelConfig, fleet);
+                if (this.shuttingDown || generation !== this.settingsGeneration)
+                    return;
+                const current = this.adapterState.get(adapterId);
+                current.status = "retrying";
+                current.lastError = err?.message ?? String(err);
+                this.logger.warn({ adapterId, attempt: state.retryCount, err: current.lastError }, "Adapter retry failed");
             }
-        }, delay);
+        }).finally(() => {
+            if (this.adapterRetryInFlight.get(adapterId) !== attempt)
+                return;
+            this.adapterRetryInFlight.delete(adapterId);
+            const channel = this.secureConnectionChannel(adapterId);
+            if (!this.shuttingDown && channel && this.adapterState.get(adapterId)?.status !== "connected") {
+                this.scheduleAdapterRetry(adapterId);
+            }
+        });
+        this.adapterRetryInFlight.set(adapterId, attempt);
+        return attempt;
+    }
+    retryAdapterNow(adapterId) {
+        if (this.shuttingDown)
+            throw new Error("The fleet is stopping");
+        if (!this.secureConnectionChannel(adapterId))
+            throw new Error("Connection not found");
+        if (this.adapterRetryInFlight.has(adapterId) || this.adapterRestarting.has(adapterId))
+            return { queued: true, already_running: true };
+        const state = this.adapterState.get(adapterId);
+        if (state?.retryTimer) {
+            clearTimeout(state.retryTimer);
+            state.retryTimer = undefined;
+        }
+        const adapter = this.adapters.get(adapterId);
+        if (adapter && this.connectionStatus(adapterId, state, this.worlds.get(adapterId)).status === "connected")
+            return { queued: false };
+        const run = adapter ? this.restartAdapter(adapter, adapterId) : this.attemptAdapterRetry(adapterId);
+        void run.catch(err => this.logger.warn({ adapterId, err }, "Requested adapter retry failed"));
+        return { queued: true };
     }
     /** Notify admin about adapter failure (uses any available adapter). */
     notifyAdapterFailure(adapterId, error) {
@@ -7014,6 +7813,7 @@ export class FleetManager {
                 : snapshot.status === "stopped" ? "failed"
                     : "retrying";
             this.adapterState.set(adapterId, {
+                ...previous,
                 status,
                 retryCount: previous?.retryCount ?? 0,
                 lastError: status === "connected" ? undefined : snapshot.lastReconnectReason ?? previous?.lastError,
@@ -7089,7 +7889,8 @@ export class FleetManager {
             adapters: { total: this.adapterState.size, connected, states, details },
             startupComplete: this.startupComplete,
             memory: readFleetMemory(),
-            hostMemory,
+            hostMemory: this.memoryTop && (hostMemory.level === "elevated" || hostMemory.level === "critical")
+                ? { ...hostMemory, topProcesses: this.memoryTop.processes, topProcessesAt: this.memoryTop.at } : hostMemory,
             problems,
         };
     }
@@ -8240,6 +9041,13 @@ export class FleetManager {
                 if (!isPrivateChat && !cmdMatch && rawText.startsWith("/")) {
                     return; // bare slash in group — ignore silently
                 }
+                // #1920 step 4b-3: /web typed in a ClassicBot room (a group: `/web@ThisBot`) by someone who is not a fleet admin,
+                // while guest sign-in is on: their guest code, privately — as anywhere else. An admin's goes on as before.
+                if (/^\/(?:web|dashboard)(?:\s|$)/i.test(text) && msgAdapter && this.isGuestWebAsk(msg.adapterId, msg.userId)) {
+                    await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username,
+                        arg: text.replace(/^\/(?:web|dashboard)/i, "").trim().toLowerCase(), replyHere: body => msgAdapter.sendText(chatId, body) });
+                    return;
+                }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
                     // #1686: intercept /start web before the ClassicBot admission flow runs.
@@ -8248,15 +9056,21 @@ export class FleetManager {
                     // #1742: a bare /start from a fleet admin whose /web just failed to reach them privately is that /start web
                     // (Telegram's START button sends it bare) — once, within the window; any other bare /start is ClassicBot's.
                     const admin = isPrivateChat && this.isFleetAdmin(msg.userId, msg.adapterId ?? "");
+                    // #1920 step 4b-3: a guest's too (guest sign-in on, not an admin) — its /web reached it no other way.
+                    const guest = isPrivateChat && !admin && this.isGuestWebAsk(msg.adapterId, msg.userId);
                     const webStart = isPrivateChat && (requestedBackend === "web"
-                        || (text === "/start" && admin && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
+                        || (text === "/start" && (admin || guest) && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
                     if (webStart) {
                         if (requestedBackend === "web")
                             this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId);
                         // #1742: the /web menu right here; the code comes to this DM.
                         if (admin)
                             await this.startWebInDm(msg, msgAdapter ?? undefined);
-                        // Non-fleet-admins: /start alone is enough to open the DM channel; no further action.
+                        // A guest: its guest code, here (this DM is where it goes).
+                        else if (guest && msgAdapter)
+                            await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username, arg: "",
+                                replyHere: body => msgAdapter.sendText(chatId, body) });
+                        // Anyone else: /start alone is enough to open the DM channel; no further action.
                         return;
                     }
                     // All new starts, including explicit backend and later chooser callbacks,
@@ -8560,10 +9374,7 @@ export class FleetManager {
                     this.afterUserInboundDelivered(generalInstance, msg);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
-                    this.emitSseEvent("message", {
-                        instance: generalInstance, sender: msg.username, role: "user",
-                        text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-                    });
+                    this.emitPlatformInbound(generalInstance, msg, text ?? "");
                 }
                 catch (err) {
                     this.logger.warn({ err: err.message, instanceName: generalInstance }, "General wake/delivery failed");
@@ -8672,9 +9483,16 @@ export class FleetManager {
         this.afterUserInboundDelivered(instanceName, msg);
         this.logger.info(`${msg.username} → ${instanceName}: ${(text ?? "").slice(0, 100)}`);
         this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), instanceName);
+        this.emitPlatformInbound(instanceName, msg, text ?? "");
+    }
+    /**
+     * A person's platform message as the web chat shows it — the user's own words, as a user (#1306), in the instance's
+     * history (#1565). #1920 §5.2: said in the instance's topic, General or room, so it is that channel's, by that account.
+     */
+    emitPlatformInbound(instance, msg, text) {
         this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            instance, sender: msg.username, role: "user", text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            channel: true, from: webChatFrom(msg.adapterId, msg.userId),
         });
     }
     /** Handle outbound tool calls from a daemon instance */
@@ -8821,6 +9639,16 @@ export class FleetManager {
             respond(null, permitted.message);
             return;
         }
+        // Fleet tools resolve their own targets. A missing chat world must not prevent local
+        // delivery, inspection or receipt lookup; only channel tools need reply routing below.
+        const handler = outboundHandlers.get(tool);
+        if (handler && !usesChannelAddress(tool)) {
+            this.eventLog?.logActivity("tool_call", senderSessionName ?? instanceName, this.summarizeToolCall(tool, args));
+            await handler(this, args, respond, {
+                instanceName, requestId, fleetRequestId, senderSessionName, operationId, sourceDaemonBootId,
+            });
+            return;
+        }
         // A fleet with no chat platform at all is driven from the web dashboard alone: a reply has nowhere
         // else to go, and "retry shortly" would have the agent retry forever. It goes to the web chat.
         const webOnlyReply = tool === "reply" && this.worlds.size === 0 && this.isWebOnlyFleet();
@@ -8976,7 +9804,14 @@ export class FleetManager {
                 // an agent cannot invent it to suppress the normal completion marker.
                 if (!error && result != null && msg.statusOnly !== true) {
                     try {
-                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView);
+                        // #1920 §5.2: shown to the instance's guests only when it landed in the instance's own topic or room.
+                        let inChannel = false;
+                        try {
+                            inChannel = outAdapter !== WEB_ONLY_REPLY_SINK
+                                && this.landedInOwnChannel(instanceName, contextAdapterId ?? this.getInstanceAdapterId(instanceName), result);
+                        }
+                        catch { /* not known: not the channel's (fail closed), and the bookkeeping below still runs */ }
+                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView, inChannel);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -9005,19 +9840,14 @@ export class FleetManager {
         if (routeToolCall(outAdapter, tool, args, threadId, respond)) {
             return;
         }
-        // Log tool calls for activity visualization
-        const senderLabel = senderSessionName ?? instanceName;
-        this.eventLog?.logActivity("tool_call", senderLabel, this.summarizeToolCall(tool, args));
-        // Dispatch fleet-specific tools via handler map
-        const handler = outboundHandlers.get(tool);
         if (handler) {
+            this.eventLog?.logActivity("tool_call", senderSessionName ?? instanceName, this.summarizeToolCall(tool, args));
             await handler(this, args, respond, {
                 instanceName, requestId, fleetRequestId, senderSessionName, operationId, sourceDaemonBootId,
             });
         }
-        else {
+        else
             respond(null, `Unknown tool: ${tool}`);
-        }
     }
     /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
     /** No chat platform is configured at all: the web dashboard is the fleet's only surface. */
@@ -9030,7 +9860,35 @@ export class FleetManager {
         return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
     }
     /** Resolves when the reply is in the web chat (#1770: after its files are copied); the caller need not wait. */
-    afterReplyRouted(instanceName, args, senderSessionName, buttons = null) {
+    /**
+     * #1920 §5.2: whether a platform send landed in the instance's own place — its ClassicBot room, or its topic in its
+     * connection's group — so its channel's members saw it. Anything else (another chat, a DM, a context left from General,
+     * an answer without the chat it went to) is not the channel's.
+     */
+    landedInOwnChannel(instance, adapterId, sent) {
+        const s = sent && typeof sent === "object" ? sent : {};
+        if (!adapterId || typeof s.chatId !== "string" || !s.chatId)
+            return false;
+        const roomId = this.classicChannels?.getChannelIdByInstance(instance);
+        if (roomId !== undefined)
+            return (this.classicChannels?.getAdapterIdByInstance(instance) ?? this.getPrimaryAdapterId()) === adapterId && roomId === s.chatId;
+        const cfg = this.fleetConfig?.instances && Object.hasOwn(this.fleetConfig.instances, instance) ? this.fleetConfig.instances[instance] : undefined;
+        const world = this.worlds.get(adapterId);
+        if (!cfg || this.getInstanceAdapterId(instance) !== adapterId || !world?.groupId || s.chatId !== world.groupId)
+            return false;
+        const thread = typeof s.threadId === "string" && s.threadId ? s.threadId : null;
+        return cfg.topic_id == null ? thread === null : thread === String(cfg.topic_id);
+    }
+    /** #1920 §5.2 (#2085 review): a platform click's buttons are in the instance's own place — else not its channel's. */
+    clickInOwnChannel(set) {
+        try {
+            return this.landedInOwnChannel(set.instance, set.adapterId, { chatId: set.chatId, threadId: set.threadId || undefined });
+        }
+        catch {
+            return false;
+        }
+    }
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null, inChannel = false) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -9066,6 +9924,7 @@ export class FleetManager {
                 ts,
                 ...(attachments.length ? { attachments } : {}),
                 ...(buttons ? { buttons } : {}), // #1266
+                ...(inChannel ? { channel: true } : {}), // #1920 §5.2
             });
         };
         const before = this.webReplyOrder.get(instanceName);
@@ -9460,6 +10319,7 @@ export class FleetManager {
         if (type === "fleet_get_web_theme" || type === "fleet_set_web_theme" || type === "fleet_set_web_theme_asset" || type === "fleet_reset_web_theme"
             || type === "fleet_get_web_appearance" || type === "fleet_preview_web_appearance"
             || type === "fleet_set_web_widget" || type === "fleet_remove_web_widget"
+            || type === "fleet_set_web_ambient" || type === "fleet_clear_web_ambient"
             || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod") {
             this.handleWebTheme(name, msg);
             return;
@@ -9574,10 +10434,11 @@ export class FleetManager {
                 }
                 case "fleet_decision_list":
                     db.pruneExpiredDecisions();
-                    result = db.listDecisions(projectRoot, {
+                    // #2152: titles by default; the full text by id, or all of it with full: true.
+                    result = decisionListAnswer(db.listDecisions(projectRoot, {
                         includeArchived: payload.include_archived,
                         tags: payload.tags,
-                    });
+                    }), { id: payload.id, full: payload.full });
                     break;
                 case "fleet_decision_update": {
                     const id = payload.id;
@@ -9770,10 +10631,16 @@ export class FleetManager {
                     created_by: instance,
                 });
             }
-            case "list": return db.listDecisions(projectRoot, {
-                includeArchived: args.includeArchived === true,
-                tags: asStrArr(args.tags),
-            });
+            // #2152: titles by default (agend-agent decision-list); one decision's full text by id (decision-get <id>).
+            // The CLI sends include_archived (snake case, as the MCP tool): both spellings are read.
+            case "list":
+            case "get":
+                if (op === "get" && !asStr(args.id)?.trim())
+                    return { error: "id is required" };
+                return decisionListAnswer(db.listDecisions(projectRoot, {
+                    includeArchived: args.includeArchived === true || args.include_archived === true,
+                    tags: asStrArr(args.tags),
+                }), { id: op === "get" ? asStr(args.id) ?? "" : args.id, full: args.full });
             case "update": {
                 const id = asStr(args.id);
                 if (!id)
@@ -9798,14 +10665,20 @@ export class FleetManager {
             return (v === "low" || v === "normal" || v === "high" || v === "urgent") ? v : undefined;
         };
         const asStatus = (v) => {
-            return (v === "open" || v === "claimed" || v === "done" || v === "blocked" || v === "cancelled") ? v : undefined;
+            return (v === "open" || v === "claimed" || v === "review" || v === "done" || v === "blocked" || v === "cancelled") ? v : undefined;
         };
         // #1336 P2: use the shared normalizer — trims whitespace AND drops empties,
         // so " \t " / [" ","\t"] are treated identically to undefined.
         const asStatusFilter = normalizeStatusFilter;
         // #1336: small write ack — identifying fields only.
         const ack = (t) => ({ id: t.id, status: t.status, updated_at: t.updated_at });
+        // The board's notes for the write (a send-back reason, a comment the assignee had not seen): with the ack when any.
+        const noted = (a) => { const notes = db.board.takeNotes(); return notes.length ? { ...a, notes } : a; };
         try {
+            // The task board's own actions and fields (task-board-tool.ts); the rest is the tool's plain task, below.
+            const onBoard = boardToolAction(db, instance, args);
+            if (onBoard !== undefined)
+                return onBoard;
             switch (action) {
                 case "create": {
                     const title = asStr(args.title);
@@ -9844,24 +10717,24 @@ export class FleetManager {
                     const id = asStr(args.id);
                     if (!id)
                         return { error: "id is required" };
-                    return ack(db.claimTask(db.getTaskByPrefix(id).id, instance));
+                    return noted(ack(db.claimTask(db.getTaskByPrefix(id).id, instance, { kind: "instance", name: instance })));
                 }
                 case "done": {
                     const id = asStr(args.id);
                     if (!id)
                         return { error: "id is required" };
-                    return ack(db.completeTask(db.getTaskByPrefix(id).id, asStr(args.result)));
+                    return noted(ack(db.completeTask(db.getTaskByPrefix(id).id, asStr(args.result), { kind: "instance", name: instance })));
                 }
                 case "update": {
                     const id = asStr(args.id);
                     if (!id)
                         return { error: "id is required" };
-                    return ack(db.updateTask(db.getTaskByPrefix(id).id, {
+                    return noted(ack(db.updateTask(db.getTaskByPrefix(id).id, {
                         status: asStatus(args.status),
                         assignee: asStr(args.assignee),
                         result: asStr(args.result),
                         priority: asPriority(args.priority),
-                    }));
+                    }, { kind: "instance", name: instance })));
                 }
                 default: return { error: `Unknown task action: ${action}` };
             }
@@ -9955,7 +10828,18 @@ export class FleetManager {
         // so " \t " / [" ","\t"] are treated identically to undefined.
         const asStatusFilter = normalizeStatusFilter;
         const ack = (t) => ({ id: t.id, status: t.status, updated_at: t.updated_at });
+        const noted = (a) => { const notes = db.board.takeNotes(); return notes.length ? { ...a, notes } : a; };
         try {
+            // The task board's own actions and fields (task-board-tool.ts); the rest is the tool's plain task, below.
+            const onBoard = boardToolAction(db, meta.instance_name || instanceName, payload);
+            if (onBoard !== undefined) {
+                ipc.send({ type: "fleet_task_response", fleetRequestId, result: onBoard });
+                // The activity log hears of board work as it does of plain tasks.
+                const what = boardActivity(payload);
+                if (what)
+                    this.eventLog?.logActivity("task_update", instanceName, what);
+                return;
+            }
             let result;
             // Full task kept for activity logging; the IPC reply uses the compact ack.
             let logTask;
@@ -9991,12 +10875,12 @@ export class FleetManager {
                     result = db.getTaskByPrefix(payload.id);
                     break;
                 case "claim":
-                    logTask = db.claimTask(db.getTaskByPrefix(payload.id).id, meta.instance_name || instanceName);
-                    result = ack(logTask);
+                    logTask = db.claimTask(db.getTaskByPrefix(payload.id).id, meta.instance_name || instanceName, { kind: "instance", name: meta.instance_name || instanceName });
+                    result = noted(ack(logTask));
                     break;
                 case "done":
-                    logTask = db.completeTask(db.getTaskByPrefix(payload.id).id, payload.result);
-                    result = ack(logTask);
+                    logTask = db.completeTask(db.getTaskByPrefix(payload.id).id, payload.result, { kind: "instance", name: meta.instance_name || instanceName });
+                    result = noted(ack(logTask));
                     break;
                 case "update":
                     logTask = db.updateTask(db.getTaskByPrefix(payload.id).id, {
@@ -10004,8 +10888,8 @@ export class FleetManager {
                         assignee: payload.assignee,
                         result: payload.result,
                         priority: payload.priority,
-                    });
-                    result = ack(logTask);
+                    }, { kind: "instance", name: meta.instance_name || instanceName });
+                    result = noted(ack(logTask));
                     break;
                 default:
                     throw new Error(`Unknown task action: ${action}`);
@@ -10319,6 +11203,7 @@ export class FleetManager {
      */
     saveFleetConfig(explicitPatches = []) {
         this.publicWebLink?.refresh();
+        this.enforceGuestSwitch(); // #1920: a Settings save turning guests off ends their sessions
         if (!this.fleetConfig || !this.configPath)
             return;
         if (!this.savedFleetConfigSnapshot)
@@ -10331,6 +11216,10 @@ export class FleetManager {
             throw new Error(`Refusing to overwrite invalid fleet.yaml: ${this.rawFleetDocument.errors[0].message}`);
         }
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
+        // #2208: what the file says before this save, aliases expanded — every write below is recorded, and anything that
+        // changes outside them (a place sharing a node with one written) refuses the save.
+        const fileBefore = this.rawFleetDocument.toJS({ maxAliasCount: -1 });
+        const writes = this.fleetDocumentWrites = []; // a throw below leaves it to the next save
         this.patchFleetDocument(this.rawFleetDocument, [], this.savedFleetConfigSnapshot, this.fleetConfig);
         // Settings edits are expressed against the raw config, so apply them before
         // canonicalization. A non-identity value equal to its inherited default is
@@ -10341,6 +11230,7 @@ export class FleetManager {
                 // (or a legacy scalar occupies that parent). Removing an override which
                 // is already absent is an idempotent no-op, not a failed Settings save.
                 if (this.rawFleetDocument.hasIn(patch.path)) {
+                    this.writingFleetDocument(this.rawFleetDocument, patch.path);
                     this.rawFleetDocument.deleteIn(patch.path);
                 }
             }
@@ -10352,8 +11242,10 @@ export class FleetManager {
         const rawAfterPatches = this.rawFleetDocument.toJS();
         const redundantPaths = collectRedundantInstanceDefaultPaths(rawAfterPatches);
         for (const path of redundantPaths) {
-            if (this.rawFleetDocument.hasIn(path))
+            if (this.rawFleetDocument.hasIn(path)) {
+                this.writingFleetDocument(this.rawFleetDocument, path);
                 this.rawFleetDocument.deleteIn(path);
+            }
             // Avoid leaving empty operational maps such as `terminal: {}` while
             // preserving the instance mapping itself and all surrounding comments.
             for (let depth = path.length - 1; depth > 2; depth--) {
@@ -10361,9 +11253,14 @@ export class FleetManager {
                 const parent = this.rawFleetDocument.getIn(parentPath, true);
                 if (!isMap(parent) || parent.items.length > 0)
                     break;
+                this.writingFleetDocument(this.rawFleetDocument, parentPath);
                 this.rawFleetDocument.deleteIn(parentPath);
             }
         }
+        this.fleetDocumentWrites = null;
+        const stray = changedOutside(fileBefore, this.rawFleetDocument.toJS({ maxAliasCount: -1 }), writes);
+        if (stray)
+            throw new Error(`Refusing to save fleet.yaml: this change would also change ${stray}, which shares a value with what it edits. Give each its own value in fleet.yaml.`);
         noteSettingsWrite(this.configPath, this.savedFleetConfigSnapshot, this.fleetConfig);
         const output = String(this.rawFleetDocument);
         if (redundantPaths.length > 0)
@@ -10474,11 +11371,15 @@ export class FleetManager {
             // Remove from the end so YAML sequence indexes do not shift underneath us.
             for (let i = before.length - 1; i >= after.length; i--) {
                 const itemPath = [...path, i];
-                if (document.hasIn(itemPath))
+                if (document.hasIn(itemPath)) {
+                    this.writingFleetDocument(document, itemPath);
                     document.deleteIn(itemPath);
+                }
             }
-            for (let i = shared; i < after.length; i++)
+            for (let i = shared; i < after.length; i++) {
+                this.writingFleetDocument(document, [...path, i]);
                 document.setIn([...path, i], after[i]);
+            }
             return;
         }
         const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -10494,6 +11395,7 @@ export class FleetManager {
                 if (isMap(fresh)) {
                     const list = document.createNode([]);
                     list.items.push(fresh.clone());
+                    this.writingFleetDocument(document, ["channels"]);
                     document.setIn(["channels"], list);
                 }
             }
@@ -10515,13 +11417,17 @@ export class FleetManager {
             // Effective config contains inherited objects that may not exist in the
             // raw YAML at all. yaml.deleteIn() is not idempotent for a missing nested
             // parent, so guard it explicitly.
-            if (document.hasIn(path))
+            if (document.hasIn(path)) {
+                this.writingFleetDocument(document, path);
                 document.deleteIn(path);
+            }
         }
         else if (path.length === 0) {
+            this.writingFleetDocument(document, path);
             document.contents = document.createNode(after);
         }
         else {
+            this.writingFleetDocument(document, path);
             const currentNode = document.getIn(path, true);
             if (isScalar(currentNode) && (after === null || typeof after !== "object")) {
                 currentNode.value = after;
@@ -10536,6 +11442,15 @@ export class FleetManager {
             }
         }
     }
+    /**
+     * #2208: before every write to the raw document — the place is unshared first (an alias on the way becomes its own
+     * copy; an anchor's other aliases get theirs), so the write changes that place only; and it is recorded for the
+     * save's check that nothing else changed.
+     */
+    writingFleetDocument(document, path) {
+        detachForWrite(document, path);
+        this.fleetDocumentWrites?.push([...path]);
+    }
     getSettingsConfigPath() { return this.configPath; }
     async removeInstance(name, authorization, execution) {
         if (execution)
@@ -10597,6 +11512,7 @@ export class FleetManager {
         // Its web chat goes with it (only after the removal succeeded): a later instance of the same name
         // must not be shown the old one's conversation, and deleted names must not pile up.
         this.webChatHistory.forget(name);
+        this.searchIndex?.removeInstance(name);
         this.webFiles.forget(name);
         this.compactWatchService?.forget(name);
         // #1664: and it is nobody's favorite any more (every device sees that at its next status frame).
@@ -10808,11 +11724,23 @@ export class FleetManager {
     guildEmojiFetches = new Map();
     // ── #1630: what stands for an instance in the web app, and Discord server emoji in web chat ──
     webImageCaches = null;
+    /** Server emoji whose picture fetch failure was already logged at warn (once each; bounded). */
+    webEmojiFailures = new Set();
     webImageCache(kind) {
         const onError = (key, err) => this.logger.debug({ err: err?.message, key }, "web image fetch failed (kept what was cached)");
+        // A server emoji's picture that cannot be fetched reads `:name:` in web chat (it used to be an empty box, the user's
+        // "tofu"): say why once per emoji, where it can be seen, not on every render (its key is quiet for an hour anyway).
+        const emojiError = (key, err) => {
+            if (this.webEmojiFailures.has(key))
+                return onError(key, err);
+            this.webEmojiFailures.add(key);
+            while (this.webEmojiFailures.size > 512)
+                this.webEmojiFailures.delete(this.webEmojiFailures.values().next().value);
+            this.logger.warn({ err: err?.message, key }, "Discord server emoji picture could not be fetched (web chat shows its :name:)");
+        };
         this.webImageCaches ??= {
             avatars: new WebImageCache({ dir: join(this.dataDir, "cache", "avatars"), onError }),
-            emoji: new WebImageCache({ dir: join(this.dataDir, "cache", "emoji"), onError }),
+            emoji: new WebImageCache({ dir: join(this.dataDir, "cache", "emoji"), onError: emojiError }),
         };
         return this.webImageCaches[kind];
     }
@@ -12342,6 +13270,8 @@ export class FleetManager {
     }
     /** Routes a click to the handler that owns its prefix; false when none does. */
     async dispatchAdapterCallback(data, adapterId, adapter) {
+        if (await this.sessionAuthorizationRequests().handleCallback(data, adapterId))
+            return true; // #1939 S2b
         if (data.callbackData.startsWith(REPLY_BUTTON_PREFIX)) { // #1266
             const buttons = this.replyButtons();
             if (!buttons) {
@@ -12479,7 +13409,7 @@ export class FleetManager {
     cacheInstances() {
         const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
             name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
-            claudeConfigDir: this.claudeConfigDirOf(name),
+            claudeConfigDir: this.claudeConfigDirOf(name), profile: this.usageProfileOf(name, this.backendNameOf(name)),
         }));
         const taken = new Set(fleet.map(i => i.name));
         const classic = (this.classicChannels?.getAll() ?? []).filter(ch => !taken.has(ch.instanceName)).map(ch => ({
@@ -12488,6 +13418,7 @@ export class FleetManager {
             workingDirectory: join(getAgendHome(), "workspaces", ch.instanceName),
             ledgerPath: join(this.getInstanceDir(ch.instanceName), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(ch.instanceName),
+            profile: this.usageProfileOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
         }));
         return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
     }
@@ -12499,6 +13430,45 @@ export class FleetManager {
     cacheReport(window) {
         return this.cacheServiceFor().report(cacheWindow(window));
     }
+    /**
+     * #2122 §5.1: the profile the usage read now is tagged with — the claude profile whose config dir is read ("default"
+     * without one); codex "unrecorded" (its rollouts don't say which login wrote them).
+     */
+    usageProfileOf(name, backend) {
+        if (backend === "claude-code")
+            return this.credentialProfileOf(name, "claude-code") ?? "default";
+        if (backend === "codex")
+            return "unrecorded";
+        return undefined;
+    }
+    /** #2122: the fleet's day boundary zone — defaults.scheduler.default_timezone, else this host's. */
+    usageZone() {
+        return this.fleetConfig?.defaults?.scheduler?.default_timezone?.trim() || Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+    }
+    /**
+     * #2122: the usage report (usage-report.ts) — from the ledgers and rollups as they are now and the delivered-message
+     * counts; never a transcript read. `only`: just that instance (an ordinary agent's own row).
+     */
+    async usageReport(params) {
+        const { buildUsageReport } = await import("./usage-report.js");
+        const data = await this.cacheServiceFor().usageData();
+        const team = new Map();
+        for (const [t, cfg] of Object.entries(this.fleetConfig?.teams ?? {}))
+            for (const m of cfg?.members ?? [])
+                if (!team.has(m))
+                    team.set(m, t);
+        const now = Date.now();
+        this.ensureDeliveryOutbox?.();
+        // Every hour of the kept history: the report places each on a local date and keeps the range's own.
+        const messages = this.deliveryOutbox?.deliveredMessageHours(now - 401 * 86_400_000, now + 3_600_000) ?? [];
+        const keep = (name) => params.only === undefined || name === params.only;
+        return buildUsageReport({
+            now, zone: this.usageZone(), range: params.range, group: params.group, scanning: data.scanning,
+            instances: data.instances.filter(i => keep(i.inst.name)).map(i => ({ name: i.inst.name, backend: i.inst.backend, team: team.get(i.inst.name) ?? null,
+                status: i.status, ...(i.with ? { with: i.with } : {}), ledger: i.ledger, days: i.days })),
+            messages: messages.filter(m => keep(m.instance)),
+        });
+    }
     /** #2001: get_cache_report's — the same report, as last worked out (reused for a minute, until the next pass). */
     cacheReportPublished(window) {
         return this.cacheServiceFor().published(cacheWindow(window));
@@ -12510,7 +13480,9 @@ export class FleetManager {
             claudeKey: claudeProjectKey,
             codexSessionsDir: () => join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions"),
             listRollouts: root => sharedRolloutIndex(root).list(),
+            rolloutsUnreadable: root => sharedRolloutIndex(root).unreadable,
             metaPath: join(this.dataDir, "cache-codex-rollouts.json"),
+            zone: () => this.usageZone(),
             log: (level, msg, extra) => this.logger[level](extra ?? {}, msg),
         });
     }
@@ -12558,6 +13530,7 @@ export class FleetManager {
                 interactionSummary: p.interaction_summary ?? null,
                 pauseReason, pausedAt,
                 crashedAt: crashed ? (this.needsCrashedAt.get(name) ?? null) : null,
+                signIn: pauseReason === "auth" ? this.signInFor(name) : null,
             });
         }
         return out;
@@ -13022,6 +13995,198 @@ export class FleetManager {
     webBackendTokens = new Map();
     /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
     webClearTokens = new Map();
+    /**
+     * #1939 S1: the design's §3 for one web request (authority/web-authority.ts), with this fleet's admins, policy and
+     * token; `instance` once the body has named it. Observe only: receipts record it, no agent acts on it yet.
+     */
+    webAuthority(input) {
+        const state = this.webAuthorityState();
+        return evaluateWebAuthority({
+            session: input.session, gateway: input.gateway, peer: input.peer,
+            tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            ...(input.instance !== undefined ? { target: { adapterId: this.getInstanceAdapterId(input.instance) } } : {}),
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            authorization: input.session ? this.sessionAuthorizationStore()?.get(input.session.handle) ?? null : null,
+            policy: { ...webAuthorityPolicy(this.fleetConfig?.web), enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now: Date.now(),
+        });
+    }
+    sessionAuthorizations = null;
+    sessionAuthorizationStore() {
+        if (!this.dataDir)
+            return null;
+        this.sessionAuthorizations ??= new SessionAuthorizations(join(this.dataDir, "web-authorizations.json"), this.logger);
+        return this.sessionAuthorizations;
+    }
+    /**
+     * #1939 §0: record that a session's account has authorized it — called only once that account has confirmed on Discord
+     * or Telegram (S2b). The session must qualify now (§3, as a message from it would be judged); then every message,
+     * click, /steer and /btw from it is web-verified until max_session_hours after now, the session ends, or a revocation.
+     * Ones no longer worth keeping (their session gone, an old epoch, run out) are dropped on the way.
+     */
+    authorizeWebSession(session, peer, gateway) {
+        const store = this.sessionAuthorizationStore();
+        const state = this.webAuthorityState(), now = Date.now(), policy = webAuthorityPolicy(this.fleetConfig?.web);
+        if (!store || !session.owner)
+            return { ok: false, refusal: !store ? "disabled" : "no_account" };
+        const check = evaluateWebAuthority({
+            session, gateway, peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            authorization: { handle: session.handle, owner: session.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch },
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now,
+        });
+        if (check.refusal)
+            return { ok: false, refusal: check.refusal };
+        const live = new Set(this.webSessions?.list(undefined, () => true).map(r => r.handle) ?? []);
+        store.prune(a => a.epoch === state.epoch && now <= Math.min(a.until, a.authorizedAt + policy.maxSessionMs) && live.has(a.handle));
+        return { ok: true, ...store.authorize(session.handle, session.owner, now, state.epoch, now + policy.maxSessionMs) };
+    }
+    authorityStateStore = null;
+    /**
+     * #1939 §10: the switch, "Only this computer can authorize" and the revocation epoch in force for the configuration as
+     * it is now (a change since last seen moves the epoch first; authority-state.ts). No data directory: off.
+     */
+    webAuthorityState() {
+        if (!this.dataDir)
+            return { enabled: false, loopbackOnly: true, epoch: 0 };
+        this.authorityStateStore ??= new AuthorityStateStore(join(this.dataDir, "web-authority.json"), this.logger, undefined, undefined, () => { this.ensureDeliveryOutbox?.(); return this.deliveryOutbox?.maxWebAuthorityEpoch() ?? 0; });
+        return this.authorityStateStore.current(this.fleetConfig?.web?.verified_authority);
+    }
+    /**
+     * #1939 S2a: Settings → Web → Web authority — the state in force (the switch counts as off while its state cannot be
+     * written), what fleet.yaml says, the hosts that make the dashboard reachable from elsewhere (the warning while
+     * loopback_only is off), and the sessions authorized now (§0): each one's device, account, and when it runs out.
+     */
+    webAuthorityOverview() {
+        const configured = this.fleetConfig?.web?.verified_authority ?? {};
+        const lanHosts = (this.fleetConfig?.web?.allowed_hosts ?? []).filter(h => { const name = hostnameOf(String(h)); return name !== null && !LOOPBACK_HOST_NAMES.includes(name); });
+        const state = this.webAuthorityState(), maxMs = webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs, now = Date.now();
+        const sessions = new Map((this.webSessions?.list(undefined, () => true) ?? []).map(r => [r.handle, r]));
+        const authorized = state.enabled ? (this.sessionAuthorizationStore()?.list() ?? [])
+            .filter(a => a.epoch === state.epoch && sessions.has(a.handle) && now <= Math.min(a.until, a.authorizedAt + maxMs))
+            .map(a => ({ handle: a.handle, label: sessions.get(a.handle).label, account: `${a.owner.adapterId}:${a.owner.userId}`, authorizedAt: a.authorizedAt,
+            until: Math.min(a.until, a.authorizedAt + maxMs, sessions.get(a.handle).absoluteExpiry) })) : [];
+        return { state, configured, hours: VERIFIED_SESSION_HOURS, lanHosts, authorized };
+    }
+    authorizationRequests = null;
+    /**
+     * #1939 S2b (§0.1): "Authorize this browser" — the Confirm card in the account's DM. Confirm runs §3 again at the tap
+     * (authorizeWebSession on the session read again by its handle); Not me signs the session out.
+     */
+    sessionAuthorizationRequests() {
+        if (this.authorizationRequests)
+            return this.authorizationRequests;
+        const adapterOf = (adapterId) => this.adapters.get(adapterId) ?? this.worlds.get(adapterId)?.adapter;
+        // The host's clock, with its zone: the person may read the DM on a phone in another one.
+        const when = (ms) => new Date(ms).toLocaleString(undefined, { timeZoneName: "short" });
+        const where = (peer) => t(peer === "loopback" ? "web_auth.peer_loopback" : "web_auth.peer_lan");
+        return this.authorizationRequests = new SessionAuthorizationRequests({
+            now: () => performance.now(), wallNow: () => Date.now(),
+            maxSessionMs: () => webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs,
+            sendDirect: async (owner, text, choices) => {
+                const adapter = adapterOf(owner.adapterId);
+                if (!adapter?.sendDirect)
+                    return null;
+                const sent = await adapter.sendDirect(owner.userId, text, { choices, allowedMentions: { parse: [] } });
+                return sent?.messageId ? { chatId: sent.chatId, messageId: sent.messageId } : null;
+            },
+            sendGeneralHint: async (owner, text) => {
+                const adapter = adapterOf(owner.adapterId), general = this.findGeneralInstance(owner.adapterId);
+                const topic = general ? this.fleetConfig?.instances[general]?.topic_id : undefined;
+                const group = general ? this.getGroupIdForInstance(general) : undefined;
+                if (adapter && group)
+                    await adapter.sendText(String(group), text, { ...(topic != null ? { threadId: String(topic) } : {}), allowedMentions: { parse: [] } });
+            },
+            editCard: async (owner, at, text, choices) => {
+                const adapter = adapterOf(owner.adapterId);
+                if (!adapter)
+                    return;
+                if (!choices.length && adapter.editMessageRemoveButtons) {
+                    await adapter.editMessageRemoveButtons(at.chatId, at.messageId, text);
+                    return;
+                }
+                await adapter.editMessage(at.chatId, at.messageId, text);
+                if (adapter.replaceMessageButtons)
+                    await adapter.replaceMessageButtons(at.chatId, at.messageId, choices);
+            },
+            authorize: (handle, peer) => {
+                const record = this.webSessions?.findByHandle(handle);
+                if (!record)
+                    return { ok: false, refusal: "session_gone" };
+                const r = this.authorizeWebSession(record, peer, false);
+                // What the card says: the end of the authorization, or the session's own end when that comes first.
+                return r.ok ? { ok: true, until: Math.min(r.authorization.until, record.absoluteExpiry) } : { ok: false, refusal: r.refusal };
+            },
+            signOut: (handle) => {
+                this.webSessions?.revokeByHandle(handle);
+                this.sessionAuthorizationStore()?.prune(a => a.handle !== handle);
+            },
+            event: (type, payload) => { try {
+                this.eventLog?.insert("web", type, payload);
+            }
+            catch { /* the event log is best effort */ } },
+            text: {
+                ask: (c) => t("web_auth.card_ask", c.label, where(c.peer), when(c.askedAt), when(c.until)),
+                confirmed: (c) => t("web_auth.card_confirmed", c.label, where(c.peer), when(c.until)),
+                denied: (c) => t("web_auth.card_denied", c.label),
+                expired: (c) => t("web_auth.card_expired", c.label),
+                refused: (c) => t("web_auth.card_refused", c.label, t(`web_auth.refusal_${c.refusal}`)),
+                revoked: (c) => t("web_auth.card_revoked", c.label),
+                ended: (c) => t("web_auth.card_ended", c.label),
+                generalHint: () => t("web_auth.general_hint"),
+                confirmLabel: () => t("web_auth.confirm"),
+                notMeLabel: () => t("web_auth.not_me"),
+                notYours: () => t("web_auth.not_yours"),
+            },
+            log: this.logger,
+        });
+    }
+    /** #1939 S2b: the web session asks to be authorized (the request judged by §3 first — as it will be again at the tap). */
+    async requestSessionAuthorization(input) {
+        const s = input.session;
+        const gate = this.webAuthorityQualifies(input);
+        if (gate)
+            return { ok: false, refusal: gate };
+        return this.sessionAuthorizationRequests().ask({ handle: s.handle, owner: s.owner, label: s.label, peer: input.peer, sessionEnd: s.absoluteExpiry });
+    }
+    /**
+     * #1939 §3 without the authorization: would this request's session qualify to be authorized? null: yes; otherwise the
+     * first check it fails (for the app to say why it can't be authorized here).
+     */
+    webAuthorityQualifies(input) {
+        const s = input.session, state = this.webAuthorityState(), now = Date.now(), policy = webAuthorityPolicy(this.fleetConfig?.web);
+        const r = evaluateWebAuthority({
+            session: s, gateway: input.gateway, peer: input.peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            authorization: s?.owner ? { handle: s.handle, owner: s.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch } : null,
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now,
+        });
+        return r.refusal;
+    }
+    /** #1939 S2b: what the app shows for this browser — verified (until when), a card pending, or why not. */
+    webSessionAuthorization(input) {
+        const s = input.session;
+        const verdict = this.webAuthority(input);
+        if (!verdict.refusal && verdict.authority.session) {
+            const a = this.sessionAuthorizationStore()?.get(s.handle);
+            const max = webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs;
+            if (a)
+                return { state: "verified", until: Math.min(a.until, a.authorizedAt + max, s.absoluteExpiry) };
+        }
+        const pending = s ? this.sessionAuthorizationRequests().pending(s.handle) : null;
+        if (pending)
+            return { state: "pending", expiresInMs: pending.expiresInMs };
+        return { state: "none", reason: this.webAuthorityQualifies(input) ?? (verdict.refusal ?? "not_authorized") };
+    }
+    /** #1939 §10: revoke every web authority given so far (receipts read as none), without signing anyone out. */
+    revokeWebAuthority() {
+        this.webAuthorityState(); // any switch change first, then this revocation
+        const result = this.authorityStateStore?.revoke() ?? { epoch: 0, durable: false };
+        if (result.durable)
+            this.logger.info({ epoch: result.epoch }, "Web authority revoked");
+        else
+            this.logger.warn({ epoch: result.epoch }, "Web authority revoked in memory only — web authority stays off until its state can be written; a restart before then undoes this revocation");
+        return result;
+    }
     /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
     webCommand(input, opts) {
         const webMeta = (instance) => {
@@ -13030,15 +14195,16 @@ export class FleetManager {
                 // #1827: a /steer or /btw reaches the agent as the web person who wrote it.
                 chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(),
                 username: opts.person?.name ?? WEB_NAME_FALLBACK, userId: opts.person?.userId ?? WEB_NAME_FALLBACK,
-                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true),
+                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true, opts.authority),
             };
         };
         const choicesFromCache = (instance) => {
-            const cached = this.readCliEnv(this.backendNameForInstance(instance)); // the cached catalog only: never a probe here
+            const backend = this.backendNameForInstance(instance);
+            const cached = this.readCliEnv(backend, this.catalogProfile(backend, instance)); // the cached catalog only: never a probe here
             if (!cached?.models.length)
                 return null;
             const current = this.resolveInstanceModel(instance).model;
-            return { current, options: cached.models.map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
+            return { current, options: this.withCurrentModel(cached.models, current).map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
         };
         return runWebCommand({
             // Own entries only: a name like "__proto__" or "constructor" must not be found on the prototype (#1476 review).
@@ -13075,7 +14241,7 @@ export class FleetManager {
                 const current = this.resolveInstanceEffort(instance).effort;
                 return { current, options: levels.map(l => ({ id: l, label: this.effortChoiceLabel(l, current) })) };
             },
-            backendStep: async (instance, args) => {
+            backendStep: async (instance, args, stepOpts) => {
                 const refusal = this.backendCommandRefusal(instance);
                 if (refusal)
                     return { error: refusal };
@@ -13085,7 +14251,13 @@ export class FleetManager {
                     return step.noop ? { text: step.text } : { error: step.text };
                 if (step.kind === "choose") {
                     const id = (token) => joinBackendArgs([...step.args, token]);
-                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label })) } };
+                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => {
+                                // #2233: the web offers Sign in beside it, so its reason is no longer "use /login".
+                                // Not over the public link: Sign in is refused there, so the choice keeps its "(use /login)" (#2262 review).
+                                const signIn = c.signIn && !stepOpts?.publicLink && dashboardSignInSupported(c.signIn) ? c.signIn : null;
+                                const disabled = signIn ? t("backend.reason_not_signed_in_web") : c.disabled;
+                                return { id: id(c.token), label: signIn ? `${c.token} — ${disabled}` : c.label, ...(disabled ? { disabled } : {}), ...(signIn ? { signIn } : {}) };
+                            }) } };
                 }
                 const now = performance.now();
                 for (const [k, v] of this.webBackendTokens)
@@ -14223,7 +15395,12 @@ export class FleetManager {
                 fleetConfig: () => this.fleetConfig,
                 isFleetAdmin: (userId, adapterId) => this.isFleetAdmin(userId, adapterId),
                 eventLog: () => this.eventLog,
-                recoverBackendInstances: (backend, profile) => this.recoverBackendInstances(backend, undefined, profile ?? null),
+                recoverBackendInstances: (backend, profile) => {
+                    // #2072: a sign-in just finished — the pickers learn it now, not at the next pass.
+                    if (!profile)
+                        void this.backendAvailability.refresh([backend], { force: true });
+                    return this.recoverBackendInstances(backend, undefined, profile ?? null);
+                },
                 claimWindow: backend => this.loginWindow.tryClaim("web", backend),
                 releaseWindow: claim => { this.loginWindow.release(claim); },
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
@@ -14244,6 +15421,86 @@ export class FleetManager {
         }
         return this.loginController;
     }
+    /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
+    webBackendLoginsInstance = null;
+    get webBackendLogins() {
+        this.webBackendLoginsInstance ??= new WebBackendLogins({
+            isLocalAdmin: handle => this.isLocalAdminSession(handle),
+            start: (backend, chat, opts) => this.startWebDashboardLogin(backend, chat, opts),
+            accessToken: sink => this.loginController?.webAccessToken(sink) ?? null,
+            isActiveFor: sink => this.loginController?.isActiveFor(sink) ?? false,
+            cancelFor: sink => this.loginController?.cancelFor(sink) ?? Promise.resolve(false),
+            cancel: () => this.cancelLoginSession(),
+            notice: ({ shown, label, handle }) => this.notifyFleetError(t("login.web_dashboard_notice", shown, label, handle.slice(0, 8))),
+            // No details in the event: each page reads its own view (GET /ui/backend-login), as its session may see it.
+            changed: () => broadcastSseEvent(this.sseClients, "backend_login", {}, err => this.logger.debug({ err }, "backend_login event failed")),
+        });
+        return this.webBackendLoginsInstance;
+    }
+    /** #2233: the login a paused-for-sign-in instance needs, when the dashboard can sign it in. */
+    signInFor(name) {
+        const backend = this.backendNameForInstance(name);
+        const profile = this.credentialProfileOf(name, backend);
+        return dashboardSignInSupported(backend, profile) ? { backend, ...(profile ? { profile } : {}) } : null;
+    }
+    /**
+     * #2233: Settings → Agents' sign-in list — every backend's default login as the availability snapshot has it, then
+     * each credential profile an agent uses (its own login state, read offline).
+     */
+    backendSignInTargets() {
+        const out = [];
+        for (const row of this.backendAvailabilityRows()) {
+            const flow = LOGIN_FLOWS[row.backend];
+            const install = BACKEND_INSTALLATION_INFO[row.backend]?.install;
+            out.push({
+                // Not installed or too old: signing in would not help — the row says how to install (or update) it instead.
+                backend: row.backend, state: row.state, signIn: row.state !== "not_installed" && row.state !== "too_old" && dashboardSignInSupported(row.backend),
+                ...(flow?.remoteLogin === "unsupported" ? { hostCommand: flow.command } : {}),
+                ...(row.state === "not_installed" && install ? { install } : {}),
+                ...(row.state === "too_old" && install ? { update: install } : {}),
+            });
+        }
+        const seen = new Set();
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {}).sort()) {
+            const backend = this.backendNameForInstance(name);
+            const profile = this.credentialProfileOf(name, backend);
+            if (!profile || seen.has(`${backend}\0${profile}`))
+                continue;
+            seen.add(`${backend}\0${profile}`);
+            let login = "unknown";
+            try {
+                login = credentialProfileLogin(this.dataDir, backend, profile).state;
+            }
+            catch { /* unknown */ }
+            const signIn = dashboardSignInSupported(backend, profile);
+            const hostCommand = signIn ? null : credentialProfileLoginCommand(this.dataDir, backend, profile);
+            out.push({ backend, profile, state: login === "logged-in" ? "usable" : login === "signed-out" ? "not_signed_in" : "unknown", signIn,
+                ...(hostCommand ? { hostCommand } : {}) });
+        }
+        return out;
+    }
+    /** #2233: the session with this handle is live, admin, local and of the current dashboard token. */
+    isLocalAdminSession(handle) {
+        const sessions = this.webSessions, token = this.webToken;
+        const record = sessions?.findByHandle(handle);
+        return !!record && !!token && record.tier === "admin" && record.surface === "local" && sessions.isCurrent(record, tokenEpoch(token));
+    }
+    /**
+     * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
+     * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
+     */
+    startWebDashboardLogin(backendArg, chat, opts) {
+        const wanted = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        if (isRemovedBackend(wanted))
+            return Promise.resolve(removedBackendMessage(wanted));
+        const info = BACKEND_INSTALLATION_INFO[wanted];
+        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !this.isCliInstalled(wanted)) {
+            return Promise.resolve(t("login.web_dashboard_not_installed", wanted, info.install));
+        }
+        if (!opts.skipAuthCheck)
+            this.recordLoginFlow(wanted, "login", chat.userId);
+        return this.webLogin.start(backendArg, chat, opts);
+    }
     /**
      * Post the backend chooser for a bare `/login`. Caller enforces admin.
      * Returns why the chooser could not be posted, for the caller to tell the
@@ -14742,6 +15999,8 @@ export class FleetManager {
                 // binary the same way, so a binary only a login shell could see was
                 // installed, reported as verified, and then offered nowhere.
                 this.adoptBinaryDirectory(installedAt, backend);
+                // #2072: an install just finished — the pickers learn it now, not at the next pass.
+                void this.backendAvailability.refresh([backend], { force: true });
                 if (!LOGIN_FLOWS[backend]) {
                     this.installHandoff = null;
                     await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
@@ -14884,6 +16143,36 @@ export class FleetManager {
         const failure = await this.promptLoginBackends(chat);
         await data.respond(failure ?? t("login.chooser_posted"));
     }
+    /** #2293: whose cross-instance messages search leaves out now (web-api /ui/search). */
+    searchVisibility() { return xmsgVisibility(this.fleetConfig); }
+    /** #2293: a cross-instance message for the search index (outbound-handlers, after it was admitted). */
+    indexCrossInstance(record) {
+        this.searchIndex?.record(xmsgDoc(record));
+    }
+    /**
+     * #2293: the global search index, at fleet start — after the web chat is restored (the backfill reads it). Its worker
+     * owns search.db; see search-index.ts. Off with web.search.enabled: false.
+     */
+    startSearchIndex(fleet) {
+        const config = fleet.web?.search;
+        if (config?.enabled === false || this.searchIndex)
+            return;
+        const history = this.webChatHistory;
+        this.searchIndex = new SearchIndex({
+            path: join(this.dataDir, "search.db"),
+            retentionDays: config?.retention_days ?? SEARCH_RETENTION_DAYS,
+            outboxPath: join(this.dataDir, "delivery-outbox.db"),
+            schedulerPath: join(this.dataDir, "scheduler.db"),
+            chatDocs: function* () { for (const name of history.instances())
+                for (const m of history.list(name)) {
+                    const doc = chatDoc(m);
+                    if (doc)
+                        yield doc;
+                } },
+            log: (level, msg) => this.logger[level](msg),
+        });
+        this.searchIndex.start();
+    }
     queueMirrorMessage(text) {
         const mirrorTopicId = this.fleetConfig?.channel?.mirror_topic_id;
         if (mirrorTopicId == null || !this.adapter)
@@ -14976,8 +16265,12 @@ export class FleetManager {
                 buttons: m.buttons,
                 click: m.click,
                 links: m.links,
+                channel: m.channel,
+                from: m.from,
+                replyTo: m.replyTo,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
+            this.searchIndex?.record(chatDoc(recorded));
             // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
             if (recorded.role === "agent")
                 broadcastSseEvent(this.sseClients, "agent_reply_live", { v: 1, boot: recorded.boot, id: recorded.id, instance: recorded.instance }, onError);
@@ -14990,6 +16283,38 @@ export class FleetManager {
         }
         broadcastSseEvent(this.sseClients, event, data, onError);
     }
+    /**
+     * The task board's live side: every committed change goes to the open pages (never to a guest) — the board's new
+     * revision and the card numbers it touched; not who touched them (the page does not need it, and a public-link page
+     * must not learn a hidden instance's name from it). Its news goes to the instances whose cards someone else changed:
+     * one "[Task board]" notice per instance, gathered for 10 s, held by the delivery outbox until it is taken
+     * (task-board-waker.ts).
+     */
+    attachTaskBoard(db) {
+        this.taskBoardWaker?.stop();
+        // #2303: each instance's cards at once, read at every claim (a fleet.yaml edit applies to the next one).
+        db.board.setCardLimit((name) => boardCardLimit(this.fleetConfig, name));
+        const waker = this.taskBoardWaker = new TaskBoardWaker({
+            deliver: (instance, message, key) => this.admitTaskBoardNotice(instance, message, key),
+            isInstance: (name) => this.fleetConfig?.instances?.[name] != null,
+            holds: (wake) => db.board.wakeHolds(wake),
+            card: (uuid) => db.board.findCard(uuid),
+            log: (level, message, extra) => this.logger[level](extra ?? {}, message),
+        });
+        db.board.onChange(({ rev, ids, projects, wakes }) => {
+            this.emitSseEvent("tasks", { rev, ids, projects });
+            waker.note(wakes);
+        });
+    }
+    /** A task board notice, as AgEnD's own (not a person's words): through the delivery outbox, held until delivered. */
+    admitTaskBoardNotice(instance, message, key) {
+        this.ensureDeliveryOutbox();
+        const outbox = this.deliveryOutbox;
+        if (!outbox)
+            return false;
+        outbox.admitSystemNotice(instance, key, message, new Date());
+        return true;
+    }
     listClaimedTasks(assignee) {
         try {
             return this.scheduler?.db.listTasks({ assignee, status: "claimed" }) ?? [];
@@ -15205,7 +16530,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // can keep those copies current; other backends never had unmanaged
         // AgEnD-published skills and must retain the normal user-ownership guard.
         const adoptLegacyUnmanaged = backend === "kiro-cli" && role === "general";
-        this.syncManagedSkills(join(workDir, ...skillSegments), join(root, "skills"), role, adoptLegacyUnmanaged);
+        this.syncManagedSkills(join(workDir, ...skillSegments), join(root, "skills"), role, adoptLegacyUnmanaged, 
+        // #2163: a Classic bot's skills folder (or a skill in it) may be a link out of its workspace; every path is
+        // checked where it really lands, just before it is written.
+        role === "classic" ? (path) => insideManagedWorkspaces(path) : undefined);
         this.logger.debug({ workDir, backend, role }, "Synced role-based bundled skills");
     }
     /**
@@ -15291,11 +16619,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * migration exception is the pre-manifest Kiro General layout explicitly
      * selected by adoptLegacyUnmanaged.
      */
-    syncManagedSkills(destSkills, srcSkills, role, adoptLegacyUnmanaged = false) {
+    syncManagedSkills(destSkills, srcSkills, role, adoptLegacyUnmanaged = false, confined) {
         if (!existsSync(srcSkills))
             return;
+        const refuse = (path) => {
+            if (!confined || confined(path))
+                return false;
+            this.logger.warn({ path, destSkills }, "Not publishing skills — the path leads out of the managed workspace");
+            return true;
+        };
+        if (refuse(destSkills))
+            return;
         mkdirSync(destSkills, { recursive: true });
         const manifestPath = join(destSkills, ".agend-managed-skills.json");
+        // Its ownership claims decide what is replaced or removed below: one that lives elsewhere is never believed.
+        if (refuse(manifestPath))
+            return;
         const hadManifest = existsSync(manifestPath);
         let previouslyManaged = [];
         try {
@@ -15308,25 +16647,25 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             .filter(name => existsSync(join(srcSkills, name, "SKILL.md")))
             .sort();
         // Pre-manifest Kiro General copied bundled skills directly into
-        // .kiro/skills. If every existing skill is still a bundled name, this is
-        // the unambiguous legacy layout: adopt it once, update it below, and write
-        // the ownership manifest. Any extra skill name keeps the directory fully
+        // .kiro/skills. If every existing skill is still bundled AND belongs to
+        // the closed pre-manifest cohort, adopt it once, update it below, and
+        // write the ownership manifest. Any extra skill name keeps the directory fully
         // on the user-owned/collision path.
         if (!hadManifest && adoptLegacyUnmanaged) {
             const existing = readdirSync(destSkills, { withFileTypes: true })
                 .filter(entry => entry.isDirectory() && existsSync(join(destSkills, entry.name, "SKILL.md")))
                 .map(entry => entry.name)
                 .sort();
-            if (existing.length > 0 && existing.every(name => bundled.includes(name))) {
+            if (existing.length > 0 && existing.every(name => bundled.includes(name) && PRE_MANIFEST_KIRO_SKILLS.has(name))) {
                 previouslyManaged = existing;
                 this.logger.info({ skills: existing, destSkills }, "Adopted legacy AgEnD skills into managed ownership");
             }
         }
         const eligible = bundled.filter(name => {
             const roles = this.readManagedSkillRoles(join(srcSkills, name, "SKILL.md"));
-            // General is the coordinator and receives both coordinator and worker
-            // playbooks. Workers receive only skills explicitly marked for workers.
-            return role === "general" || roles.includes("worker");
+            // General is the coordinator and receives every playbook. Workers and Classic bots receive only skills
+            // explicitly marked for their role (#2163).
+            return role === "general" || roles.includes(role);
         });
         const managed = [];
         for (const name of eligible) {
@@ -15343,6 +16682,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             managed.push(name);
             const newContent = readFileSync(join(srcSkills, name, "SKILL.md"), "utf-8");
+            if (refuse(dest))
+                continue;
             try {
                 if (existsSync(dest) && readFileSync(dest, "utf-8") === newContent)
                     continue;
@@ -15389,9 +16730,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             if (!Array.isArray(frontmatter.roles))
                 throw new Error("roles must be an array");
             const roles = [...new Set(frontmatter.roles)]
-                .filter((value) => value === "general" || value === "worker");
+                .filter((value) => value === "general" || value === "worker" || value === "classic");
             if (roles.length !== frontmatter.roles.length || roles.length === 0) {
-                throw new Error("roles must contain only general and/or worker");
+                throw new Error("roles must contain only general, worker and/or classic");
             }
             return roles;
         }
@@ -15776,10 +17117,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
         // #1592: the web chat shows what was asked, as for every other inbound — the user's own words (no chat-log
         // context), as a user (#1306: never a role read from text), in the room's history (#1565).
-        this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-        });
+        this.emitPlatformInbound(instanceName, msg, text);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
     /** #1690: our own runtime switches awaiting the daemon's outcome, by id. */
@@ -15817,7 +17155,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** #1806: null on a switch INTO claude-code — the configured model then belongs to the backend being left. */
     configured = this.fleetConfig?.instances[instanceName]?.model ?? this.fleetConfig?.defaults?.model) {
         const aliases = ["default", "sonnet", "opus", "haiku", "opusplan", "Fable"];
-        const api = (this.readCliEnv("claude-code")?.apiModels ?? []).map(m => m.id);
+        const api = (this.readCliEnv("claude-code", this.catalogProfile("claude-code", instanceName))?.apiModels ?? []).map(m => m.id);
         const lower = model.trim().toLowerCase();
         const bare = lower.replace(/\[1m\]$/, "");
         const known = aliases.some(a => a.toLowerCase() === bare)
@@ -15845,13 +17183,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             : undefined;
         return classic ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
     }
-    cliEnvPath(backend) {
-        return join(getAgendHome(), "cli-env", `${backend.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+    /**
+     * #2072: a catalog is the account's, so a credential profile has its own. Only claude-code's probe reads an account
+     * catalog through a profile's login (its `GET /v1/models` with the profile's token); other backends' probes read the
+     * process environment, so their catalog stays the backend's own.
+     */
+    catalogProfile(backend, instanceName) {
+        return backend === "claude-code" && instanceName ? this.credentialProfileOf(instanceName, backend) : null;
+    }
+    cliEnvPath(backend, profile = null) {
+        const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "_");
+        return join(getAgendHome(), "cli-env", profile ? `${safe(backend)}@${safe(profile)}.json` : `${safe(backend)}.json`);
     }
-    /** Read the cached CLI env for a backend, or null if missing/stale/unparseable. */
-    readCliEnv(backend) {
+    /** Read the cached CLI env for a backend (a credential profile's own, when given), or null if missing/stale/unparseable. */
+    readCliEnv(backend, profile = null) {
         try {
-            const env = JSON.parse(readFileSync(this.cliEnvPath(backend), "utf-8"));
+            const env = JSON.parse(readFileSync(this.cliEnvPath(backend, profile), "utf-8"));
             if (typeof env?.probedAt === "number" && Date.now() - env.probedAt < CLI_ENV_TTL_MS)
                 return env;
         }
@@ -15894,10 +17241,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * previous list, never stall the command that asked for it.
      */
     async probeBackendBounded(backend, opts = {}) {
-        // #725: single-flight per backend. Explicit vendor refreshes remain a
+        // #725: single-flight per backend (#2072: per backend and credential profile). Explicit vendor refreshes remain a
         // separate flight from an ordinary probe, while sysinfo can join either.
-        const regularFlight = this.pendingCliEnvProbes.get(backend);
-        const vendorFlight = this.pendingVendorCliEnvProbes.get(backend);
+        const profile = opts.profile ?? null;
+        const key = profile ? `${backend}@${profile}` : backend;
+        const regularFlight = this.pendingCliEnvProbes.get(key);
+        const vendorFlight = this.pendingVendorCliEnvProbes.get(key);
         if (opts.refreshVendorCatalog && vendorFlight)
             return vendorFlight;
         if (!opts.refreshVendorCatalog && (vendorFlight || regularFlight))
@@ -15908,25 +17257,26 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const epoch = this.cliEnvProbeEpoch;
         const input = {
             mode: "env", backend, instanceDir,
-            config: { workingDirectory: "", instanceDir, instanceName: `probe-${backend}`, mcpServers: {} },
+            config: { workingDirectory: "", instanceDir, instanceName: `probe-${backend}`, mcpServers: {},
+                ...(profile ? { credentialStoreHome: credentialProfileStoreHome(getAgendHome(), backend, profile) } : {}) },
             refreshVendorCatalog: opts.refreshVendorCatalog === true,
         };
-        const bounded = this.runBackendProbeWorker(`global:${backend}`, input).then(probed => {
+        const bounded = this.runBackendProbeWorker(`global:${key}`, input).then(probed => {
             if (!probed || Array.isArray(probed) || this.shuttingDown || epoch !== this.cliEnvProbeEpoch)
                 return null;
             try {
-                return this.persistCliEnvProbeResult(backend, probed);
+                return this.persistCliEnvProbeResult(backend, probed, profile);
             }
             catch (err) {
-                this.logger.warn({ backend, err }, "CLI env cache write failed");
+                this.logger.warn({ backend, profile, err }, "CLI env cache write failed");
                 return null;
             }
         }).finally(() => {
             const flights = opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes;
-            if (flights.get(backend) === bounded)
-                flights.delete(backend);
+            if (flights.get(key) === bounded)
+                flights.delete(key);
         });
-        (opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes).set(backend, bounded);
+        (opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes).set(key, bounded);
         return bounded;
     }
     stopCliEnvProbes() {
@@ -16041,12 +17391,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     modelDisplayForInstance(instanceName) {
         return this.resolveInstanceModel(instanceName).display;
     }
+    /**
+     * #2072: the model an instance runs is always among its choices — one its CLI's catalog does not list (an older
+     * name, a custom provider's, a typed one) is shown first, marked, so the menu never hides what is running.
+     */
+    withCurrentModel(options, currentModel) {
+        if (!currentModel || currentModel === "default" || options.some(o => o.id === currentModel))
+            return options;
+        return [{ id: currentModel, label: currentModel, description: t("model.not_listed") }, ...options];
+    }
     modelChoiceLabel(option, currentModel) {
         const label = option.description ? `${option.label} — ${option.description}` : option.label;
         return option.id === currentModel ? `✓ ${label}` : label;
     }
     /** Preserve the existing cache merge rules for worker probes. */
-    persistCliEnvProbeResult(backend, probed) {
+    persistCliEnvProbeResult(backend, probed, profile = null) {
         const env = { backend, probedAt: Date.now(), ...probed };
         // An empty result must never overwrite a catalog we already have. Some
         // probes hit the network (`agy models` fetches, 5s cap), so a slow moment
@@ -16055,14 +17414,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // antigravity cache replaced by an empty one. Keep the known models and
         // let the fresher currentModel/version through.
         if (!env.models?.length) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.models?.length)
                 env.models = previous.models;
         }
         // Same protection for the extended catalog: one offline moment must not
         // blank a good account list for the whole cache TTL.
         if (!env.apiModels?.length) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.apiModels?.length)
                 env.apiModels = previous.apiModels;
         }
@@ -16070,12 +17429,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // keeps the cached levels only for that same binary: both versions known and equal, cache still valid. A help
         // that was read and lists none ([]) is an answer and is written as is, so the fallback applies.
         if (env.effortLevels === undefined) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.effortLevels && previous.version && env.version && previous.version === env.version) {
                 env.effortLevels = previous.effortLevels;
             }
         }
-        const path = this.cliEnvPath(backend);
+        const path = this.cliEnvPath(backend, profile);
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, JSON.stringify(env, null, 2));
         return env;
@@ -16097,6 +17456,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // indefinitely — each is wrapped by CLI_ENV_PROBE_DEADLINE_MS.
         for (const b of backends)
             void this.probeBackendBounded(b);
+        // #2072: each Claude credential profile in use has its own account catalog. Only fleet.yaml's agents are walked
+        // here; a ClassicBot room on a profile is probed on its first /model (catalogProfile knows rooms too).
+        const profiles = new Set();
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+            if (this.backendNameForInstance(name) !== "claude-code")
+                continue;
+            const profile = this.catalogProfile("claude-code", name);
+            if (profile)
+                profiles.add(profile);
+        }
+        for (const profile of profiles)
+            void this.probeBackendBounded("claude-code", { profile });
     }
     /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
     async getModelOptions(instanceName, refresh = false, onLiveProbe) {
@@ -16110,7 +17481,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      */
     async getModelOptionsWithSource(instanceName, opts = {}) {
         const backendName = this.backendNameForInstance(instanceName);
-        const cached = this.readCliEnv(backendName);
+        const profile = this.catalogProfile(backendName, instanceName);
+        const cached = this.readCliEnv(backendName, profile);
         if (!opts.refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached)) {
             return { models: cached.models, source: "cache" };
         }
@@ -16121,7 +17493,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // Stale, missing, or a forced refresh → probe live (also refreshes the cache).
         // A newly released model is invisible until this runs, which is why staleness
         // triggers it rather than waiting for the 24h hard expiry or a cold start.
-        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog });
+        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog, profile });
         if (env?.models.length)
             return { models: env.models, source: "live" };
         // Probe failed or timed out: the previous list is still the best answer.
@@ -16136,7 +17508,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     modelMenuChoices(instanceName, nonce, options, currentModel) {
         const isClaude = this.backendNameForInstance(instanceName) === "claude-code";
         const choices = [{ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__refresh__`, label: t("model.refresh") }];
-        for (const o of options.slice(0, isClaude ? 23 : 24)) {
+        for (const o of this.withCurrentModel(options, currentModel).slice(0, isClaude ? 23 : 24)) {
             choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`, label: this.modelChoiceLabel(o, currentModel) });
         }
         if (isClaude)
@@ -16543,16 +17915,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
     }
     /** Cached-or-live account catalog behind "/model → more models" (claude). */
-    async claudeApiModelOptions() {
-        const cached = this.readCliEnv("claude-code");
+    async claudeApiModelOptions(instanceName) {
+        // #2072: the account behind THIS instance — its credential profile's catalog, else the default login's.
+        const profile = this.catalogProfile("claude-code", instanceName);
+        const cached = this.readCliEnv("claude-code", profile);
         if (cached?.apiModels?.length)
             return cached.apiModels;
-        const env = await this.probeBackendBounded("claude-code");
+        const env = await this.probeBackendBounded("claude-code", { profile });
         return env?.apiModels ?? [];
     }
     /** Replace a consumed "/model" menu with the full account catalog tier. */
     async expandClaudeModelMenu(pending) {
-        const expanded = await this.claudeApiModelOptions();
+        const expanded = await this.claudeApiModelOptions(pending.instanceName);
         if (!expanded.length) {
             await pending.respond(t("model.more_unavailable")).catch(() => { });
             return;
@@ -16980,7 +18354,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return {
             currentBackend: (name) => this.backendNameForInstance(name),
             currentDisplay: (name) => `${this.backendNameForInstance(name)} · ${this.resolveInstanceModel(name).display}`,
-            installedBackends: () => KNOWN_BACKENDS.filter(b => b !== "mock" && this.backendInstalledHere(b)),
+            availability: () => this.backendAvailabilityFor(instanceName),
             models: (backend) => this.backendModelOptions(backend, opts),
             // #1808: the same rule update_instance_config's switch applies (backendModelVerdict).
             modelKnown: (backend, model) => this.backendModelVerdict(instanceName, backend, model).ok,
@@ -17079,10 +18453,76 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // kiro-cli gates its own --effort by version at launch (a quiet console note otherwise); muse always passes it.
         return () => true;
     }
-    /** Installed the way the launch finds a CLI (resolveBinary): on PATH or in a known install directory. */
-    backendInstalledHere(backend) {
-        const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
-        return !!binary && resolveBinary(binary) !== binary;
+    /**
+     * #2072: what this host can run, from the published availability snapshot (backend-availability.ts). Read only: a
+     * handler never starts a probe, not even in the background — launch, the timer, and /login install or sign-in do.
+     */
+    backendAvailabilityRows() {
+        return this.backendAvailability.snapshot();
+    }
+    /**
+     * #2072 part 3: the models a Settings field offers for `backend` — the cached catalog (an instance's own credential
+     * profile's, when it is named and has one), claude's account catalog included. Read only: never a probe.
+     */
+    modelCatalogFor(backend, instance) {
+        if (!KNOWN_BACKENDS.includes(backend) || backend === "mock")
+            return [];
+        const own = instance && Object.prototype.hasOwnProperty.call(this.fleetConfig?.instances ?? {}, instance) ? instance
+            : instance && this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? instance : null;
+        const env = this.readCliEnv(backend, this.catalogProfile(backend, own));
+        const seen = new Set(), out = [];
+        for (const m of [...(env?.models ?? []), ...(env?.apiModels ?? [])])
+            if (!seen.has(m.id)) {
+                seen.add(m.id);
+                out.push(m);
+            }
+        return out;
+    }
+    /**
+     * #2072 (#2078 review): the snapshot as THIS instance would see it. Its sign-in on a backend is its own credential
+     * profile's when it has one there — the host's default login says nothing about it. A profile's login is a file check
+     * (credentialProfileLogin), no process.
+     */
+    backendAvailabilityFor(instanceName) {
+        return this.backendAvailabilityRows().map(row => {
+            const profile = this.credentialProfileOf(instanceName, row.backend);
+            if (!profile || (row.state !== "usable" && row.state !== "not_signed_in" && row.state !== "unknown") || !row.path)
+                return row;
+            let login = "unknown";
+            try {
+                login = credentialProfileLogin(this.dataDir, row.backend, profile).state;
+            }
+            catch { /* unknown */ }
+            // Signed in there: usable for this instance. Signed out (or unknown): the host's default login says nothing about
+            // it, so no "not signed in" claim from it — update_instance_config's profile gate refuses a signed-out profile
+            // when applied, naming the profile and the command that signs it in.
+            if (login === "logged-in")
+                return { ...row, auth: "valid", state: "usable" };
+            return row.state === "not_signed_in" ? { ...row, auth: "unknown", state: "unknown" } : row;
+        });
+    }
+    /** The probes the snapshot runs (tests replace them: no CLI, no account, no network). */
+    availabilityProbes = hostAvailabilityProbes;
+    availabilityStore = null;
+    availabilityTimer = null;
+    get backendAvailability() {
+        return this.availabilityStore ??= new BackendAvailabilityStore(KNOWN_BACKENDS.filter(b => b !== "mock" && !!BACKEND_INSTALLATION_INFO[b]), this.availabilityProbes, { onChange: () => this.noteAvailabilityPaths() });
+    }
+    /** A launch need not look the binary up again (a synchronous `which` on the loop) when the snapshot found it. */
+    noteAvailabilityPaths() {
+        for (const row of this.availabilityStore?.snapshot() ?? []) {
+            const binary = BACKEND_INSTALLATION_INFO[row.backend]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, row.state === "not_installed" ? null : row.path);
+        }
+    }
+    /** Probe now and then every AVAILABILITY_STALE_MS; a pass that finds nothing changed starts no CLI. */
+    startAvailabilityRefresh() {
+        void this.backendAvailability.refresh();
+        if (this.availabilityTimer)
+            clearInterval(this.availabilityTimer);
+        this.availabilityTimer = setInterval(() => { void this.backendAvailability.refresh(); }, AVAILABILITY_STALE_MS);
+        this.availabilityTimer.unref?.();
     }
     /** The models `/model` would offer on a backend: the cached CLI env, else (live) a bounded probe. Never throws. */
     async backendModelOptions(backend, opts) {
@@ -17424,9 +18864,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         return undefined;
     }
+    /** #2072: from the published snapshot (no `which` on the loop); not checked yet counts as installed (no false alarm). */
     isBackendInstalled(backend) {
-        const installation = BACKEND_INSTALLATION_INFO[backend];
-        return !!installation && checkBinaryInstalled(installation.binary);
+        if (!BACKEND_INSTALLATION_INFO[backend])
+            return false;
+        return this.backendAvailability.get(backend)?.state !== "not_installed";
     }
     getMissingBackendWarning(backend) {
         if (!backend)
@@ -17679,9 +19121,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * settles, so a later genuine stop (after a restart) still does the work.
      */
     stopAll() {
-        this.stopAllInFlight ??= this.doStopAll().finally(() => { this.stopAllInFlight = null; });
+        this.stopAllInFlight ??= this.doStopAll().finally(() => {
+            this.stopAllInFlight = null;
+            // #1956: after the stop's own tmux work; anything later goes direct. A later startAll starts it again.
+            if (this.tmuxExecHelperTimer) {
+                clearInterval(this.tmuxExecHelperTimer);
+                this.tmuxExecHelperTimer = null;
+            }
+            tmuxExecHelper.stop();
+        });
         return this.stopAllInFlight;
     }
+    tmuxExecHelperTimer = null;
     stopAllInFlight = null;
     async doStopAll() {
         this.startupComplete = false;
@@ -17764,6 +19215,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.eventLogPruneTimer);
             this.eventLogPruneTimer = null;
         }
+        if (this.guestRoomsTimer) {
+            clearInterval(this.guestRoomsTimer);
+            this.guestRoomsTimer = null;
+        }
         this.logService?.unwatchAll(); // #1218: a Log's watch timers end with the fleet
         this.compactWatchService?.stopAll();
         if (this.outboxPruneTimer) {
@@ -17829,7 +19284,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // this is the last moment the prompts can be collapsed.
         await this.retirePendingNoncePrompts();
         this.topicArchiver.stop();
+        this.taskBoardWaker?.stop();
         this.scheduler?.shutdown();
+        // What it was sent is written first (bounded: search-index.ts close()).
+        const search = this.searchIndex;
+        this.searchIndex = null;
+        await search?.close();
         // Stop instances in parallel batches to avoid long sequential waits.
         // Concurrency scales with fleet size — larger fleets tolerate more parallel
         // tmux ops, while small fleets stay conservative to avoid overwhelming the
@@ -17863,6 +19323,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.adapters.clear();
         this.controlClient?.stop();
         this.controlClient = null;
+        if (this.availabilityTimer) {
+            clearInterval(this.availabilityTimer);
+            this.availabilityTimer = null;
+        }
         if (this.healthServer) {
             this.healthServerListening = false;
             const server = this.healthServer;
@@ -19428,7 +20892,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 all = false;
                 const message = err?.message ?? String(err);
                 this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: message });
-                this.scheduleAdapterRetry(id, channel);
+                this.scheduleAdapterRetry(id);
             }
         }
         this.classicChannels?.configureAdapters(this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []));
@@ -19847,6 +21311,159 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.rejectedHostsLogged.add(name);
         this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
     }
+    /**
+     * #1920 §3: the instances a guest session may see — derived on every request from the account's chat access, never
+     * stored; nothing while `web.guests.enabled` is not true.
+     * - Its connection's fleet topics and General (what it may talk to in chat): when that connection's access lets the
+     *   account in (AccessManager.isAllowed — allowed_users or paired). An `open` connection lets everyone in, so it gives
+     *   only the instances an admin named for its guests (`web.guests.open_instances`; the user's decision: least
+     *   privilege, as an open group has no list of people).
+     * - A Telegram private ClassicBot room that is the account's own (its chat id is the user id).
+     * - A ClassicBot group or guild room on its connection: only while its membership is verified (§3.2 — a "member"
+     *   answer read in the background, at most 15 minutes old; unknown, failed or stale hides it).
+     * - Then an admin's narrowing (`web.guests.narrow`), which only takes away.
+     * A fleet admin is not a guest: an admin outside the connection's access gets nothing here (admins sign in as admins).
+     */
+    guestScope(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        if (!owner || guests?.enabled !== true)
+            return NO_GUEST_SCOPE;
+        const scope = new Set(this.guestReach(owner));
+        const narrow = guests.narrow && Object.hasOwn(guests.narrow, `${owner.adapterId}:${owner.userId}`) ? guests.narrow[`${owner.adapterId}:${owner.userId}`] : undefined;
+        if (narrow) {
+            const keep = new Set(narrow);
+            for (const name of [...scope])
+                if (!keep.has(name))
+                    scope.delete(name);
+        }
+        return scope.size ? scope : NO_GUEST_SCOPE;
+    }
+    /**
+     * #1920 (#2104 review): what an account reaches before an admin's narrowing — its connection's topics (an open one's
+     * named agents), its own Telegram private room, its verified group rooms. Narrowing can only take from this set, so it
+     * is what Settings offers to narrow to. Empty while guest sign-in is off.
+     */
+    guestReach(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        const scope = new Set();
+        if (guests?.enabled !== true)
+            return scope;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const world = this.worlds.get(owner.adapterId);
+        if (world && world.accessManager.isAllowed(owner.userId)) {
+            const named = world.accessManager.getMode() === "open" ? new Set(own(guests.open_instances, owner.adapterId) ?? []) : null;
+            for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+                if (this.getInstanceAdapterId(name) !== owner.adapterId || this.isClassicInstance(name))
+                    continue;
+                if (!named || named.has(name))
+                    scope.add(name);
+            }
+        }
+        const rooms = this.classicChannels?.getAll() ?? [];
+        for (const room of rooms) {
+            if (this.isOwnPrivateRoom(owner, room))
+                scope.add(room.instanceName);
+        }
+        const members = this.guestRooms();
+        for (const room of guestGroupRooms(rooms, owner)) {
+            if (members.verified(room, owner.userId))
+                scope.add(room.instance);
+        }
+        return scope;
+    }
+    /**
+     * #1920 §3.5: a guest session still admitted — current, with something in scope. A scope that became empty (guest
+     * sign-in off, the account removed from the connection's access, everything narrowed away) ends the session here,
+     * so the next request and the open stream find it gone.
+     */
+    guestStillAdmitted(record) {
+        return this.guestAdmission(record) === "ok";
+    }
+    /**
+     * The same, with a third answer (§3.2): "pending" — nothing in scope now, but a room's membership is not read yet
+     * (a restart, a room just created). The request is refused and the session kept; its read starts in the background.
+     */
+    guestAdmission(record) {
+        if (!this.webSessions || !this.webToken || !this.webSessions.isCurrent(record, tokenEpoch(this.webToken)))
+            return "gone";
+        const owner = record.owner;
+        if (this.guestScope(owner).size)
+            return "ok";
+        if (owner && this.fleetConfig?.web?.guests?.enabled === true) {
+            const members = this.guestRooms(), rooms = guestGroupRooms(this.classicChannels?.getAll() ?? [], owner);
+            if (rooms.some((room) => members.pending(room, owner.userId))) {
+                void this.refreshGuestRooms(owner, { mode: "triggered" }); // rate-limited per room (30 s), single-flight
+                return "pending";
+            }
+        }
+        this.enforceGuestSwitch();
+        const ended = this.webSessions.revokeByHandle(record.handle);
+        if (ended.found)
+            this.logger.info({ adapterId: record.owner?.adapterId, durable: ended.durable }, "Guest web session ended: nothing left in its scope");
+        return "gone";
+    }
+    /** #1920 §3.2: the membership answers; the read goes to the room's own connection, never waits past its deadline. */
+    guestRooms() {
+        this.guestRoomMembership ??= new GuestRoomMembership({
+            now: () => performance.now(),
+            read: (room, userId) => {
+                const adapter = this.worlds.get(room.adapterId)?.adapter;
+                return room.kind === "telegram" ? adapter?.isGroupMember?.(room.channelId, userId) : adapter?.canViewChannel?.(room.channelId, userId);
+            },
+            // Said once per key while its reads keep failing (no user id: the room and connection are what an admin fixes).
+            onPersistentFailure: (room, failures) => this.logger.warn({ adapterId: room.adapterId, instance: room.instance, failures }, "Guest room membership keeps failing to read (the bot may lack the permission, or was removed); retrying with backoff up to 10 minutes"),
+            onRecovered: (room) => this.logger.info({ adapterId: room.adapterId, instance: room.instance }, "Guest room membership reads again"),
+        });
+        return this.guestRoomMembership;
+    }
+    /** #1920 §3.2: read this guest's rooms that are due (GuestRoomMembership.refresh says when each mode reads). */
+    async refreshGuestRooms(owner, opts = {}) {
+        if (this.fleetConfig?.web?.guests?.enabled !== true)
+            return;
+        try {
+            await this.guestRooms().refresh(owner, guestGroupRooms(this.classicChannels?.getAll() ?? [], owner), opts);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message }, "Guest room membership could not be read");
+        }
+    }
+    /** Every account with a live guest session, one after another (the guest caps bound them); one pass at a time. */
+    async refreshAllGuestRooms() {
+        if (this.guestRoomsPass || this.fleetConfig?.web?.guests?.enabled !== true || !this.webSessions)
+            return;
+        this.guestRoomsPass = true;
+        try {
+            for (const owner of this.webSessions.guestOwners())
+                await this.refreshGuestRooms(owner);
+        }
+        finally {
+            this.guestRoomsPass = false;
+        }
+    }
+    guestRoomsPass = false;
+    /**
+     * #1920 §3.5: guest sign-in turned off ends every guest session — checked when the configuration is read or saved
+     * and when the sessions are opened, so turning it back on never revives one.
+     */
+    enforceGuestSwitch() {
+        if (this.fleetConfig?.web?.guests?.enabled === true || !this.webSessions)
+            return;
+        const ended = this.webSessions.revokeAll((r) => r.tier === "guest");
+        if (ended.count)
+            this.logger.info({ count: ended.count, durable: ended.durable }, "Guest web sign-in is off: every guest session ended");
+        // #1920 step 4b: and every guest's returning device — turning it back on lets no old browser ask for a code.
+        const devices = this.returningDevices?.revokeGuest();
+        if (devices?.count)
+            this.logger.info({ count: devices.count, durable: devices.durable }, "Guest web sign-in is off: every guest's returning device forgotten");
+    }
+    /** #1920 §5.2: whether this instance is the account's own Telegram private ClassicBot room (its chat id is the user id). */
+    guestOwnRoom(owner, instance) {
+        return (this.classicChannels?.getAll() ?? []).some((room) => room.instanceName === instance && this.isOwnPrivateRoom(owner, room));
+    }
+    /** A private room's chat id is its one user's id (a group's is negative, so never equal); Telegram only. */
+    isOwnPrivateRoom(owner, room) {
+        return room.adapterId === owner.adapterId && room.channelId === owner.userId && inferClassicChannelType(room.channelId) === "telegram";
+    }
     /** Shared handler dispatcher; gateway admission is enforced by its separate listener. */
     dispatchWebHttp(req, res, port, closing = false) {
         try {
@@ -19877,6 +21494,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return;
             }
             const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
+            if (this.effectBootstrap.handle(req, res))
+                return;
             // Branding is public, after Host admission: automatic favicon requests
             // must not become noisy web-token 401s in the browser console.
             if (handleWebIconRequest(req, res, requestPath))
@@ -19907,6 +21526,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     res.end(JSON.stringify({ error: decision.message }));
                     return;
                 }
+                // #1920: a guest reaches only GUEST_ROUTES, within the scope derived for it now — default deny, before any
+                // handler, on this listener and the public link's gateway alike (both come through here).
+                if (decision.via === "session" && decision.session.tier === "guest") {
+                    const owner = decision.session.owner;
+                    const admitted = decision.session;
+                    const admission = this.guestAdmission(admitted);
+                    if (admission === "pending") {
+                        // §3.2: a room's membership is being read — try again shortly; the session stays.
+                        res.writeHead(503, { "Retry-After": "5" });
+                        res.end(JSON.stringify({ error: "guest_scope_pending" }));
+                        return;
+                    }
+                    if (admission === "gone") {
+                        res.writeHead(401);
+                        res.end(JSON.stringify({ error: "guest_scope_empty" }));
+                        return;
+                    }
+                    const verdict = guestRouteDecision(req.method ?? "GET", parsedUrl, this.guestScope(owner));
+                    if (verdict.kind === "deny") {
+                        res.writeHead(verdict.status);
+                        res.end(JSON.stringify({ error: verdict.error }));
+                        return;
+                    }
+                    // Phase 1b: the handlers that answer per recipient (the stream, the poll, a file) know it is a guest's, and
+                    // ask its scope anew each time; an emptied scope ends the session (and closes its stream).
+                    bindGuestRequest(req, { owner, scope: () => this.guestScope(owner), current: () => this.guestStillAdmitted(admitted),
+                        // #1920 §5.2: its own Telegram private room shows it everything; the kept messages place ticks and buttons.
+                        ownRoom: (instance) => this.guestOwnRoom(owner, instance),
+                        // §3.2: a stream that connects reads its rooms again (in the background; at most once a minute).
+                        streamOpened: () => { void this.refreshGuestRooms(owner, { mode: "force" }); },
+                        history: () => this.webChatHistory,
+                        // #1920 §5.1: guests chat unless the host made them read-only (web.guests.chat: false).
+                        chat: () => this.fleetConfig?.web?.guests?.chat !== false });
+                }
             }
             if (req.method === "GET" && req.url === "/health") {
                 const health = this.getFleetHealth();
@@ -20297,6 +21950,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.warn({ code: err.code, port: settings.port }, "Preview listener unavailable; HTML previews are off");
             this.previewListening = false;
             this.previewListener = null;
+            this.previewListenError = `${settings.port}: ${err.code ?? err.message}`;
         });
         // An optional listener never takes the fleet down: a port Node refuses outright throws here, synchronously.
         try {
@@ -20307,6 +21961,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.warn({ err: err.message, port: settings.port }, "Preview listener cannot listen; HTML previews are off");
             this.previewListening = false;
             this.previewListener = null;
+            this.previewListenError = `${settings.port}: ${err.code ?? err.message}`;
         }
     }
     /** What a reload may change hot: web.preview, and the dashboard names (the shim's allow-list and frame-ancestors). */
@@ -20327,6 +21982,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     stopPreviewListener() {
         this.previewListening = false;
+        this.previewListenError = null;
         this.previewListener?.close();
         this.previewListener = null;
     }
@@ -20334,10 +21990,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     previewForUi(hostHeader, secure) {
         const listener = this.previewListening ? this.previewListener : null;
         const decided = previewAvailability(listener ? listener.settings : null, hostHeader, secure, listener ? listener.origins : undefined);
+        // Previews are on, but no listener answers: say why — its port could not be opened (the error, never "turned off"),
+        // or it is not listening yet.
         if (!listener && this.fleetConfig?.web?.preview !== false)
-            decided.reason = "Previews are not available on this fleet right now.";
+            Object.assign(decided, this.previewNotListening());
         return { ...decided, boot: listener ? listener.bootId : null };
     }
+    previewNotListening() {
+        const failed = this.previewListenError;
+        return failed
+            ? { code: "listenFailed", detail: failed, reason: `Previews are unavailable: the fleet could not open its preview port (${failed}). Another program may be using it — set web.preview_port, then restart AgEnD.` }
+            : { code: "notListening", reason: "Previews are not available on this fleet right now." };
+    }
     /**
      * #1723: for one page of the public link (exposure `exposureId`, at `dashboardOrigin`): its own preview tunnel's
      * origin once up, "starting" until then, why it failed if it did — or a configured web.preview_origin, used instead.
@@ -20352,8 +22016,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const configured = typeof web?.preview_origin === "string" ? normalizeOrigin(web.preview_origin) : null;
         if (configured) {
             const listener = this.previewListening ? this.previewListener : null;
-            if (!listener)
-                return off("publicLink", "Previews are not available on this fleet right now.");
+            if (!listener) {
+                const why = this.previewNotListening();
+                return off(why.code, why.reason, why.detail ? { detail: why.detail } : {});
+            }
             if (!configured.startsWith("https:"))
                 return off("needHttps", "Previews need an https web.preview_origin when the dashboard is reached over https.");
             return { dashboardOrigin, previewOrigin: configured, reason: null, code: null, boot: listener.bootId, frameSrc: `${configured}/frame` };
@@ -20397,15 +22063,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.debug({ err }, "bots unreadable (getUiStatus)");
         }
         const instances = names.map(name => {
-            const statusFile = join(this.getInstanceDir(name), "statusline.json");
-            let cost = 0;
-            try {
-                const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                cost = data.cost?.total_cost_usd ?? 0;
-            }
-            catch (err) {
-                this.logger.debug({ err, name }, "statusline.json read failed (getUiStatus)");
-            }
+            // #1956: read once for this instance; its cost, context and model come from it.
+            const statusline = readStatuslineJson(this.dataDir, name);
+            const cost = statusline?.cost?.total_cost_usd ?? 0;
             // Align with /ctx: statusline for claude-code, pane scrape for kiro/grok/codex.
             const classic = classicOnly.includes(name);
             const backend = classic
@@ -20413,14 +22073,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 : (this.fleetConfig?.instances[name]?.backend
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
-            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name) });
+            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name), statusline });
             // context_pct: null when unavailable, not 0
             const context_pct = context ?? null;
             // Model: Only Claude Code has live statusline; others use the effective resolver.
-            // readStatuslineModel provides the /ctx-aligned display_name+id combo for Claude.
+            // statuslineModel gives the /ctx-aligned display_name+id combo for Claude (readStatuslineModel's rule).
             // Non-Claude backends must NOT read statusline.json model (may be stale from previous Claude run).
             const resolved = this.resolveInstanceModel(name);
-            const liveModel = backend === "claude-code" ? readStatuslineModel(this.dataDir, name) : null;
+            const liveModel = backend === "claude-code" ? statuslineModel(statusline) : null;
             // Display value: live model for Claude, resolved.display for others (includes "auto (default)" for Kiro)
             const model = liveModel ?? resolved.display;
             // model_source: "live" when Claude statusline succeeded, else the resolver's source
@@ -20457,6 +22117,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 catch {
                     return {};
                 } })(),
+                // #2118: only this Chat's placement content; guest projection drops global revisions.
+                effect_chat_v: createHash("sha256").update(JSON.stringify(this.themeStore.get(name).placements.effects)).digest("hex").slice(0, 32),
                 // #1958: the identity colour's tiers (the page resolves them: the agent's only while it shows agents' themes).
                 color: { ...(colors.get(name)?.color ? { person: colors.get(name).color } : {}), ...(image.agentColor ? { agent: image.agentColor } : {}),
                     ...(image.roleColor ? { role: image.roleColor } : {}), auto: autoIdentityColor(name) },
@@ -20465,6 +22127,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 description: identity.description || undefined,
                 role: identity.role || undefined,
                 tags: identity.tags,
+                teams: instanceTeams(this.fleetConfig?.teams, name), // #2172: the sidebar groups a team's members under it
+                last_reply: this.webChatHistory.lastAgentReply(name) ?? undefined, // #2179: its last reply to a person (ISO)
                 status: this.getInstanceStatus(name),
                 // `state` (presentation: may be awaiting_input) and `execution_state` (working / idle / stuck, or null —
                 // what the dashboard's activity events carry) come from instancePresentation (#1212).
@@ -20493,6 +22157,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // #1685: host memory pressure while it slows or holds new agents (the dashboard's indicator; macOS elevated is
             // shown here rather than in chat). null when normal, unknown or advisory.
             host_memory: this.hostMemoryIndicator(),
+            // #2015: the largest processes while it lasts (name, pid, RSS, and whose: an instance, the fleet or tmux).
+            ...(this.hostMemoryIndicator() && this.memoryTop ? { host_memory_top: this.memoryTop.processes } : {}),
         };
     }
 }