@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.4

package/dist/fleet-manager.js

@@ -48,6 +48,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -65,7 +66,7 @@ import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
 import { codexMetadataHomes, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./backend/codex-metadata.js";
-import { CLI_ENV_TTL_MS, isModelCompatible, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
+import { CLI_ENV_TTL_MS, isModelCompatible, noteResolvedBinary, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
@@ -134,9 +135,9 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     }
     return tasks;
 }
-import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { handleWebRequest, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
-import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
 import { SeenUsers, resolveMentions } from "./web-mentions.js";
 import { OPERATOR, WebPrefsStore } from "./web-prefs.js";
@@ -158,7 +159,7 @@ import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { parsePoll } from "./reply-polls.js";
 import { isUploadRequest, limitRequestReceive, publicAttachment, sweepOrphanedUploads, UPLOAD_REQUEST_TIMEOUT_MS, uploadLimits, WebFileLedger } from "./web-upload.js";
 import { REPLY_FILES_MAX_BYTES, snapshotReplyFile, sweepReplySnapshots, webFilesDir } from "./web-reply-files.js";
-import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, personBannerFocus, personIdentityColour, profileIdentities, resolveInstanceIdentity, setPersonBannerFocus, setPersonIdentityColour } from "./view-api.js";
 import { autoIdentityColor } from "./web-identity-color.js";
 import { AppearanceTools } from "./web-appearance-tools.js";
 import { cardVersion, resolveCard } from "./web-card.js";
@@ -178,7 +179,11 @@ import { runOnLoginShell } from "./login-shell.js";
 import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
 import { canonicalCommand, commandSpec, decideCommand, ruleFor } from "./command-table.js";
-import { runVisibilityCommand } from "./cross-instance-notice.js";
+import { crossInstanceVisibility, runVisibilityCommand } from "./cross-instance-notice.js";
+import { WebSettingsTools } from "./web-settings-tools.js";
+import { bindGuestRequest, guestRouteDecision } from "./web-guest-access.js";
+import { GUEST_ROOM_TICK_MS, GuestRoomMembership, guestGroupRooms } from "./web-guest-rooms.js";
+import { TrafficLog, trafficItem } from "./fleet-traffic.js";
 import { installedChannel, updateNoticeKey } from "./update-check.js";
 import { resolveInstalledAgend } from "./update-dispatch.js";
 import { resolveUpdateLaunch, openUpdateLog, updateLogPath, watchUpdateLaunch } from "./update-launch.js";
@@ -190,7 +195,7 @@ import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { recentChatContext } from "./log-tail.js";
 import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
-import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, inferClassicChannelType, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { KNOWN_BACKENDS, validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
@@ -209,6 +214,7 @@ import { NeedsYouHub } from "./needs-you-hub.js";
 import { WEB_CHAT_NOTICE, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { buildOrgChart } from "./web-org.js";
+import { topMemoryHogs } from "./memory-hogs.js";
 import { GENERAL_POINTING_REFUSALS, SNOWFLAKE, hasPlaceRefs, placeRef, webRoute, webTextLinks, placeSuffix, renderPlaceRefs, stripPlaceRefs, topicUrl, worldPlaceOf } from "./topic-link.js";
 import { CacheService, cacheWindow } from "./cache-service.js";
 import { runWebCommand } from "./web-commands.js";
@@ -220,8 +226,8 @@ import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefu
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
-import { localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
+import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
+import { GuestLoginCodes, WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
 import { CodeRequestLimiter, ReturningDevices } from "./web-returning-device.js";
 import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { createPreviewListener, normalizeOrigin, previewAvailability, previewSettings } from "./web-preview.js";
@@ -234,7 +240,7 @@ import { PROVIDER_SECRET_SPECS, providerSecretSpec, providerRegistryEnvKeys, isR
 /** A self-restart is a whole service restart; 120s is the apply budget, not this. */
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
@@ -504,6 +510,8 @@ function emojiListFilter(opts) {
         withImageUrls: flag(opts.with_image_urls),
     };
 }
+/** #1920: a guest's scope until phase 2 derives one: nothing. */
+const NO_GUEST_SCOPE = new Set();
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -774,6 +782,8 @@ export class FleetManager {
     /** #1306: the preview listener (health_port + 1 by default), and whether it is listening. */
     previewListener = null;
     previewListening = false;
+    /** The preview listener could not open its port: "<port>: <error code>", for the page (#2061 follow-up); null otherwise. */
+    previewListenError = null;
     /** The ports the preview listener was started for, and the inputs it was built from (a reload compares them). */
     previewPorts = null;
     previewInputs = "";
@@ -792,6 +802,9 @@ export class FleetManager {
     /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
     fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
+    /** #1920 §3.2: the background reads of guests' ClassicBot room membership (a minute's tick; reads only what is due). */
+    guestRoomsTimer = null;
+    guestRoomMembership = null;
     outboxPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
@@ -806,6 +819,17 @@ export class FleetManager {
     startedAt = 0;
     stormOpenNotifyTimer = null;
     memoryLogAt = null;
+    /**
+     * #2015: while host memory is elevated or critical, the processes holding the most in the fleet's service and whose
+     * they are (an instance, the fleet, tmux), for the pressure log, /health and the dashboard — never chat (#1712).
+     * Rescanned at most once a minute (async, one at a time); cleared when pressure ends.
+     */
+    memoryTop = null;
+    memoryTopScan = { at: null, inFlight: false, loggedAt: null };
+    /** The scan (a seam for tests: they give it a fake /proc). */
+    memoryHogScan = topMemoryHogs;
+    /** The fleet's own tmux session exists (only then are its panes read: a fleet that never started has none). */
+    tmuxSessionEnsured = false;
     memoryDebugAt = null;
     memoryLogLevel = null;
     /** #1685: the host_memory value the last status frame carried, so a change re-sends the frame. */
@@ -1079,6 +1103,29 @@ export class FleetManager {
     get ownerCss() {
         return (this.ownerCssStore ??= new OwnerCssStore(this.dataDir, this.webPrefs));
     }
+    webSettingsToolsService;
+    /**
+     * #2056: Settings → Web appearance for a tool (General, a coordinator, full) — the page's own stores and checks, and the
+     * page's announcement after a change (web-settings-tools.ts).
+     */
+    get webSettings() {
+        return (this.webSettingsToolsService ??= new WebSettingsTools({
+            prefs: this.webPrefs, ownerCss: this.ownerCss, mods: this.mods, effects: this.effectService,
+            instances: () => [...Object.keys(this.fleetConfig?.instances ?? {}),
+                ...(this.classicChannels?.getAll() ?? []).map((ch) => ch.instanceName).filter((n) => !Object.hasOwn(this.fleetConfig?.instances ?? {}, n))],
+            colour: (name) => personIdentityColour(this.dataDir, name),
+            setColour: (name, patch) => { const w = setPersonIdentityColour(this.dataDir, name, patch); if (w.ok)
+                this.identityChanged(); return w; },
+            bannerFocus: (name) => personBannerFocus(this.dataDir, name),
+            setBannerFocus: (name, focus) => { const w = setPersonBannerFocus(this.dataDir, name, focus); if (w.ok)
+                this.identityChanged(); return w; },
+            placements: (name) => this.themeStore.get(name).placements.effects.map((e) => (typeof e === "string" ? { id: e } : e)),
+            announce: () => { try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { /* the next status frame carries it */ } },
+        }));
+    }
     get webPrefs() {
         // #1664: a favorite must be an instance of this fleet now — fleet.yaml's (own keys) or a ClassicBot room's.
         return (this.webPrefsStore ??= new WebPrefsStore(this.dataDir, {
@@ -1349,9 +1396,26 @@ export class FleetManager {
     sseHeartbeatMs = SSE_HEARTBEAT_MS;
     /** The dashboard's login codes. Memory only: a code that outlives the process is a code nobody can prove was not copied. */
     webLoginCodes = null;
+    /**
+     * #1920 step 4: guests' codes, apart from the admins' — one per account, so no guest's `/web` withdraws another's or
+     * an admin's code (#2093 review), at most 32 at once. Local sign-in only for now (audience "local").
+     */
+    webGuestLoginCodes = null;
+    /** #1920 step 4: when each account last got a guest code (monotonic) — one a minute, so `/web` is no DM flood. */
+    guestCodeAskedAt = new Map();
+    /** #2093 review: an account's guest /web in progress — one at a time, so two at once cannot both pass the minute. */
+    guestCodeInFlight = new Set();
+    /**
+     * #2093 review: revokes a guest /web in progress must see — every web session's (`/web revoke` from an admin) bumps
+     * the global count, an account's own bumps its entry — checked before the code is issued and while it is delivered.
+     */
+    guestRevokes = 0;
+    guestAccountRevokes = new Map();
     /** #1570: browsers that may ask the sign-in page for a fresh code, and how often they may. */
     returningDevices = null;
     codeRequestLimiter = new CodeRequestLimiter();
+    /** #1920 step 4b: guests' device code requests, limited apart — guests never use up the admins' fleet-wide budget. */
+    guestCodeRequestLimiter = new CodeRequestLimiter();
     /**
      * Set while a Settings apply job is driving the reconcile. The reconcile
      * stays the single doer; it just says out loud what it is doing to whom, so
@@ -1499,6 +1563,7 @@ export class FleetManager {
                 meta: {
                     chat_id: set.chatId, message_id: messageId, user: by.username, user_id: by.userId, ts,
                     thread_id: set.threadId, adapter_id: inbound.adapterId, source: inbound.source,
+                    ...(web && by.guest ? { web_guest: "1" } : {}), // #1920: "[user:… via web (guest), id:…]", as /ui/send
                     ...reactions.meta,
                 },
             }, by.humanOrigin, button.label)) !== false;
@@ -1519,6 +1584,9 @@ export class FleetManager {
         this.emitSseEvent("message", {
             instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
             click: { label: button.label, of: set.id },
+            // #1920: a platform click is its clicker's; it is the instance's channel's only when its buttons are there (the
+            // same rule as a reply's: a set sent to another topic or a DM is not). A web click is the web's.
+            ...(web ? {} : { from: webChatFrom(set.adapterId, by.userId), ...(this.clickInOwnChannel(set) ? { channel: true } : {}) }),
         });
         return true;
     }
@@ -1573,6 +1641,18 @@ export class FleetManager {
                 }
             }
         });
+        // #1918: the org canvas's traffic — from the row this listener's events already name, never a probe of its own.
+        // The row as it is now (it has already changed when the event comes): its state, not the event's, is the truth.
+        outbox.on("state", (event) => {
+            const row = event.deliveryId ? outbox.get(event.deliveryId) : undefined;
+            if (row)
+                this.publishTraffic(row);
+        });
+        outbox.on("consumed", (event) => {
+            const row = event.deliveryId ? outbox.get(event.deliveryId) : undefined;
+            if (row)
+                this.publishTraffic(row, "consumed");
+        });
         outbox.on("generation_recovered", () => this.scheduleDeliveryOutboxPump());
         this.replyObligationTimer = setInterval(() => measureSyncWork("fleet.replyObligationSweep", () => this.sweepReplyObligations()), REPLY_OBLIGATION_SWEEP_MS);
         this.replyObligationTimer.unref?.();
@@ -1594,6 +1674,40 @@ export class FleetManager {
         });
         this.scheduleDeliveryOutboxPump();
     }
+    /** #1918: cross-instance traffic, as the org canvas draws it (fleet-traffic.ts). */
+    trafficLog = new TrafficLog();
+    trafficMemo = null;
+    /** One delivery row's traffic item, kept for the snapshot and sent to the open pages when it is news. */
+    publishTraffic(row, state) {
+        try {
+            const item = trafficItem(row, this.fleetConfig, new Date().toISOString(), state);
+            const news = item ? this.trafficLog.note(item) : null;
+            if (news) {
+                this.trafficMemo = null;
+                this.emitSseEvent("traffic", news);
+            }
+        }
+        catch (err) {
+            this.logger.debug({ err }, "traffic: an item was not published");
+        }
+    }
+    /**
+     * GET /ui/traffic: what is in flight now (the outbox's pending rows) and what finished in the last two minutes, at
+     * most TRAFFIC_SNAPSHOT_MAX items. Worked out at most once every two seconds, so the public link's polling (or any
+     * number of pages) costs one indexed read per two seconds. Visibility is applied as of now.
+     */
+    trafficSnapshot() {
+        const nowMs = performance.now();
+        if (this.trafficMemo && nowMs - this.trafficMemo.atMs < 2_000)
+            return this.trafficMemo.value;
+        const now = new Date().toISOString();
+        const pending = (this.deliveryOutbox?.listPending() ?? [])
+            .map((r) => trafficItem(r, this.fleetConfig, r.createdAt ?? now)).filter((i) => i !== null);
+        const visible = (name) => crossInstanceVisibility(this.fleetConfig, name) !== "hidden";
+        const items = this.trafficLog.snapshot(pending).filter((i) => visible(i.from) && visible(i.to));
+        this.trafficMemo = { atMs: nowMs, value: { now, items } };
+        return this.trafficMemo.value;
+    }
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input) {
         const outbox = this.deliveryOutbox;
@@ -1606,6 +1720,8 @@ export class FleetManager {
         }
         const sourceKey = `mcp:${input.sourceInstance}:${input.operationId}:${input.targetInstance}:${input.targetSession ?? ""}:${input.kind}`;
         const admitted = outbox.admit({ ...input, sourceDaemonBootId, sourceKey });
+        if (admitted.inserted)
+            this.publishTraffic(admitted.delivery);
         if (admitted.inserted)
             this.logger.info({
                 deliveryId: admitted.delivery.deliveryId,
@@ -1979,17 +2095,58 @@ export class FleetManager {
                 this.logger.info({ hostMemory: snapshot }, "Host memory recovered");
             }
             this.memoryLogLevel = snapshot.level;
+            if (this.memoryTop) {
+                this.memoryTop = null;
+                this.memoryTopScan.loggedAt = null;
+                this.emitSseEvent("status", this.getUiStatus());
+            }
             return;
         }
+        if (snapshot.level === "elevated" || snapshot.level === "critical")
+            this.refreshMemoryTop(snapshot);
         if (changed || this.memoryLogAt === null || now - this.memoryLogAt >= 10 * 60_000) {
             this.memoryLogAt = now;
-            this.logger.warn({ hostMemory: snapshot }, snapshot.level === "critical"
+            this.logger.warn({ hostMemory: snapshot, ...(this.memoryTop ? { topProcesses: this.memoryTop.processes } : {}) }, snapshot.level === "critical"
                 ? "Host memory critical — deferring new CLI spawns"
                 : snapshot.level === "elevated" ? "Host memory pressure — slowing new CLI spawns"
                     : "Host memory sample unavailable — slowing new CLI spawns");
         }
         this.memoryLogLevel = snapshot.level;
     }
+    /**
+     * #2015: rescan the largest processes (at most once a minute, one at a time). The first result of an episode, and
+     * then at most every 10 minutes, is logged with the pressure; /health and the dashboard read the latest. Never chat.
+     */
+    refreshMemoryTop(snapshot) {
+        const scan = this.memoryTopScan;
+        const now = performance.now();
+        if (scan.inFlight || (scan.at !== null && now - scan.at < 60_000))
+            return;
+        scan.inFlight = true;
+        scan.at = now;
+        void (async () => {
+            const session = getTmuxSession();
+            const [tmuxServerPid, panes] = this.tmuxSessionEnsured
+                ? await Promise.all([TmuxManager.getServerPid(session), TmuxManager.listPanePids(session)])
+                : [null, []];
+            const processes = await this.memoryHogScan({
+                fleetPid: process.pid, tmuxServerPid, panes,
+                isInstance: name => this.daemons.has(name) || Object.hasOwn(this.fleetConfig?.instances ?? {}, name),
+            }, 3);
+            // Pressure may have ended while the scan ran: nothing is kept then.
+            if (this.shuttingDown || processes.length === 0 || this.hostMemoryIndicator() === null)
+                return;
+            const before = JSON.stringify(this.memoryTop?.processes ?? null);
+            this.memoryTop = { at: new Date().toISOString(), processes };
+            if (scan.loggedAt === null || performance.now() - scan.loggedAt >= 10 * 60_000) {
+                scan.loggedAt = performance.now();
+                this.logger.warn({ hostMemory: snapshot, topProcesses: processes }, "Host memory pressure — largest processes in the fleet");
+            }
+            if (JSON.stringify(processes) !== before)
+                this.emitSseEvent("status", this.getUiStatus());
+        })().catch(err => this.logger.debug({ err }, "Largest-process scan failed"))
+            .finally(() => { scan.inFlight = false; });
+    }
     /** Wire the one fleet-wide storm into notification and recovery surfaces. */
     bindStormWindowEvents() {
         this.stormWindow.on("opened", (snapshot) => {
@@ -2311,6 +2468,7 @@ export class FleetManager {
         this.fleetConfig = loaded;
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.warnAboutRemovedLoginMode(loaded);
+        this.enforceGuestSwitch();
         return this.fleetConfig;
     }
     relayLoginModeWarned = false;
@@ -3436,7 +3594,8 @@ export class FleetManager {
      * for `instance` (#1320 part B). Per entry: the channel's own adapter, no
      * thread, mention suppression on. Returns the number of channels posted
      * to. Failures are per-entry warn-and-continue — a failed echo never fails
-     * the web send. Entries without `web_echo: true` are never touched.
+     * the web send. Only entries classicWebEchoOn admits are touched (#2054: unset follows web.echo_to_channel; an explicit
+     * `web_echo: false` never echoes).
      *
      * Every copy is fenced at start time: an entry whose explicit world is
      * gone is skipped (only legacy adapterId-less entries fall back to the
@@ -3447,6 +3606,15 @@ export class FleetManager {
      * already in flight may still land late — the contract permits that.
      */
     /** `sender` (#1827): the web person's name, as the room log records them ("web-user" when none). */
+    /**
+     * #1920 §5.2: a web message's channel copy was sent — it is now what the channel saw. Kept so (and on disk), and sent
+     * to the guests' streams only: an admin's page already has it, and nothing about it changed for them.
+     */
+    webMessageInChannel(instance, messageId) {
+        const m = this.webChatHistory.markChannel(instance, messageId);
+        if (m)
+            broadcastToGuests(this.sseClients, "message", m, (err) => this.logger.debug({ err }, "SSE client write failed; evicting"));
+    }
     async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK) {
         const guard = this.webChannelEchoGuards.get(instance);
         const handled = new Set();
@@ -3463,7 +3631,7 @@ export class FleetManager {
                 }
             }
             const entry = (this.classicChannels?.getAll() ?? [])
-                .find(candidate => candidate.instanceName === instance && candidate.webEcho === true
+                .find(candidate => candidate.instanceName === instance && classicWebEchoOn(candidate.webEcho, this.fleetConfig?.web?.echo_to_channel)
                 && !handled.has(`${candidate.channelId}#${candidate.adapterId ?? ""}`));
             if (!entry)
                 break;
@@ -3882,6 +4050,14 @@ export class FleetManager {
             return;
         }
         const scope = door.scope;
+        // #1920 step 4: a non-admin's /web while guest sign-in is on is theirs to sign in as a guest (or revoke their own)
+        // — before the table, which keeps /web for fleet admins. Per account: it touches no instance binding.
+        // Decided synchronously, so an admin's /web still reaches the table with no await after the door (#1399).
+        if (data.command === "dashboard" && this.isGuestWebAsk(adapterId, data.userId)) {
+            await this.guestWebCommand({ adapterId, userId: data.userId, username: data.username,
+                arg: String(data.options?.action ?? "").trim().toLowerCase(), replyHere: text => data.respond(text), replyPrivately: text => data.respond(text) });
+            return;
+        }
         const spec = commandSpec(data.command);
         if (!spec) {
             this.logger.info({ command: data.command, adapterId }, "Slash command is not in the command table");
@@ -5326,10 +5502,14 @@ export class FleetManager {
                 // #1620: fleet.yaml's web.session.local, read at every check — a Settings save or a reload applies at once
                 // (shortening ends the sessions it now outlives). The public link's policy stays fixed.
                 localPolicy: () => localSessionPolicy(this.fleetConfig?.web?.session?.local),
+                // #1920 §5.4: a guest's, from web.guests.session (never longer than the surface's own).
+                guestPolicy: () => guestSessionPolicy(this.fleetConfig?.web?.guests?.session),
             });
+            this.enforceGuestSwitch(); // #1920: guests off while the fleet was down
         }
         if (!this.returningDevices) {
             this.returningDevices = new ReturningDevices({ dataDir: this.dataDir, onWarn: message => this.logger.warn(message) });
+            this.enforceGuestSwitch(); // #1920: guests' devices too, if guests went off while down
         }
         if (!this.webLoginCodes) {
             this.webLoginCodes = new WebLoginCodes({
@@ -5341,6 +5521,16 @@ export class FleetManager {
                 },
             });
         }
+        if (!this.webGuestLoginCodes) {
+            this.webGuestLoginCodes = new GuestLoginCodes({
+                onEvent: event => {
+                    if (event === "burned")
+                        this.logger.warn("A guest web login code was used up by wrong attempts");
+                    else if (event === "breaker-open")
+                        this.logger.warn("Guest web sign-in paused: too many wrong login codes");
+                },
+            });
+        }
     }
     /**
      * A single-use login code for the dashboard, for a channel only the operator
@@ -5464,6 +5654,7 @@ export class FleetManager {
                 dispatch: (req, res) => this.dispatchWebHttp(req, res, this.fleetConfig?.health_port ?? 19280) }),
             revoke: id => {
                 this.webLoginCodes?.revokeAudience(id);
+                this.webGuestLoginCodes?.revokeAudience(id);
                 const result = this.webSessions?.revokeExposure(id);
                 if (result && !result.durable)
                     this.logger.warn("Public session revocation could not be saved; exposure remains closed");
@@ -5495,6 +5686,24 @@ export class FleetManager {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
+    /**
+     * #1920 §5.5 (step 4b): a guest signing in through the public link — said in the General of the admin who opened it
+     * (who, how many agents), awaited as an admin's public sign-in is, while that link is the open one, its opener still
+     * current, and the account still an admitted guest. A failure refuses the sign-in.
+     */
+    async confirmGuestPublicWebLogin(info, current) {
+        const admitted = () => {
+            const open = this.publicWebLink?.openSignin();
+            return current() && open && open.exposureId === info.exposureId && this.publicOwnerCurrent(open.owner) && this.guestSignInAllowed(info.account) ? open : null;
+        };
+        const open = admitted();
+        if (!open)
+            throw new Error("guest public sign-in unavailable");
+        const adapter = open.owner.binding;
+        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        if (!admitted())
+            throw new Error("guest public sign-in changed");
+    }
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     async dashboardMenu(msg) {
         const id = msg.adapterId;
@@ -5818,6 +6027,8 @@ export class FleetManager {
         this.initializeWebSessions();
         void this.publicWebLink?.close("dashboard revoke");
         this.webLoginCodes.revoke();
+        this.webGuestLoginCodes.revokeAll();
+        this.guestRevokes++; // and every guest /web still on its way
         // #1570: no browser may ask the sign-in page for a code any more.
         const devices = this.returningDevices.revokeAll();
         const sessions = this.webSessions.revokeAll();
@@ -5828,6 +6039,145 @@ export class FleetManager {
             this.logger.warn({ count: result.count }, "Web sessions revoked in memory only — the session file could not be updated or removed");
         return result;
     }
+    /** #1920 step 4: whether a `/web` is a guest's — guest sign-in on, and not from a fleet admin (theirs runs as before). */
+    isGuestWebAsk(adapterId, userId) {
+        return !!adapterId && this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(userId, adapterId);
+    }
+    /** #1920 step 4 (auth-api): a guest code's account may still sign in — guests on, and something in its scope now. */
+    guestSignInAllowed(account) {
+        return this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(account.userId, account.adapterId) && this.guestScope(account).size > 0;
+    }
+    /**
+     * #1920 §5.4: a guest's own `/web revoke` — its sessions and its outstanding code; nobody else's (an admin's revokes
+     * everyone's, as before).
+     */
+    revokeGuestWebSessions(owner) {
+        this.initializeWebSessions();
+        const key = `${owner.adapterId}\u0000${owner.userId}`;
+        this.guestAccountRevokes.set(key, (this.guestAccountRevokes.get(key) ?? 0) + 1); // its /web on its way, too
+        while (this.guestAccountRevokes.size > 4096)
+            this.guestAccountRevokes.delete(this.guestAccountRevokes.keys().next().value);
+        this.webGuestLoginCodes.revokeRecipient(owner);
+        // §5.4: its sessions and its returning devices (no browser of theirs may ask for a code any more).
+        const devices = this.returningDevices.revokeGuest(owner);
+        const ended = this.webSessions.revokeAll(r => r.tier === "guest" && r.owner?.adapterId === owner.adapterId && r.owner.userId === owner.userId);
+        this.logger.info({ adapterId: owner.adapterId, count: ended.count, devices: devices.count, durable: ended.durable && devices.durable }, "Guest web sessions revoked by their account");
+        return { count: ended.count, durable: ended.durable && devices.durable };
+    }
+    /**
+     * #1920 §2.3 (step 4): `/web` from someone who is not a fleet admin, while guest sign-in is on. `revoke` ends their
+     * own guest sessions. Otherwise a guest code (tier guest, bound to this account) goes privately — a DM, else the
+     * slash command's ephemeral answer (`replyPrivately`) — once a minute at most, and only when their scope (from what
+     * they may already use in chat, rooms read at sign-in) holds something. The code itself is never posted where asked.
+     * Callers ask isGuestWebAsk first (synchronously); false here too when it is not a guest's.
+     */
+    async guestWebCommand(ask) {
+        if (!this.isGuestWebAsk(ask.adapterId, ask.userId))
+            return false;
+        const owner = { adapterId: ask.adapterId, userId: ask.userId };
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        if (ask.arg === "revoke") {
+            const ended = this.revokeGuestWebSessions(owner);
+            await say(t(ended.durable ? "web.guest_revoked" : "web.guest_revoked_not_durable", ended.count));
+            return true;
+        }
+        const token = this.webToken;
+        const adapter = this.adapters.get(ask.adapterId);
+        if (this.shuttingDown || !token || !adapter) {
+            await say(t("dashboard.starting"));
+            return true;
+        }
+        const key = `${owner.adapterId}\u0000${owner.userId}`, asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key) || (asked !== undefined && performance.now() - asked < 60_000)) {
+            await say(t("web.guest_wait"));
+            return true;
+        }
+        this.guestCodeInFlight.add(key);
+        try {
+            await this.issueGuestCode(ask, owner, key, adapter, token);
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+        return true;
+    }
+    /** guestWebCommand's issuance, one per account at a time; a revoke made meanwhile (either kind) ends it unissued. */
+    async issueGuestCode(ask, owner, key, adapter, token) {
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const unrevoked = () => this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes;
+        // §3.2: its rooms are read at sign-in (bounded; never longer than the reads' own deadline).
+        await withinBudget(this.refreshGuestRooms(owner, { mode: "force" }), performance.now() + 6_000).catch(() => undefined);
+        if (!unrevoked())
+            return; // revoked while its rooms were read: no code
+        const scope = this.guestScope(owner);
+        if (!scope.size) {
+            const open = this.worlds.get(owner.adapterId)?.accessManager.getMode() === "open";
+            await say(t(open ? "web.guest_not_set_up" : "web.guest_nothing"));
+            return;
+        }
+        this.initializeWebSessions();
+        const codes = this.webGuestLoginCodes;
+        if (codes.pausedForMs() > 0) {
+            await say(t("web.guest_paused"));
+            return;
+        }
+        // §5.5 (step 4b): with the public link open, the code works through it too (an admin opened it; a guest is still a
+        // guest there) — most guests are not on the host's network. Its closing withdraws that audience (revokeAudience).
+        const open = this.publicWebLink?.openSignin() ?? null;
+        // One code per account (a new one replaces only its own); at the cap, refused — never another guest's evicted.
+        const login = codes.issue({ epoch: tokenEpoch(token), audiences: ["local", ...(open ? [open.exposureId] : [])],
+            recipient: { adapterId: owner.adapterId, userId: owner.userId, ...(ask.username ? { username: ask.username } : {}) } });
+        if (!login) {
+            await say(t("web.guest_busy"));
+            return;
+        }
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        while (this.guestCodeAskedAt.size > 256)
+            this.guestCodeAskedAt.delete(this.guestCodeAskedAt.keys().next().value);
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(owner.adapterId) === adapter
+            && unrevoked() && this.guestSignInAllowed(owner);
+        const privateText = `${t("web.guest_intro", scope.size)}\n${this.topicCommands.getDashboardText()}${open ? `\n${t("web.guest_public", open.url)}` : ""}\n${t("dashboard.code", login.display, Math.round(LOGIN_CODE_TTL_MS / 60_000))}`;
+        const deadline = performance.now() + 10_000;
+        try {
+            let byDm = false;
+            try {
+                if (!adapter.sendDirect)
+                    throw new Error("DM unavailable");
+                await withinBudget(adapter.sendDirect(owner.userId, `${privateText}\n${t("dashboard.code_next")}`, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
+                byDm = true;
+            }
+            catch (err) {
+                this.logDashboardDmFailure(err);
+                if (!ask.replyPrivately || !current())
+                    throw err;
+                const id = await withinBudget(ask.replyPrivately(privateText), deadline); // a slash command's answer: ephemeral
+                if (!id)
+                    throw new Error("private delivery unconfirmed");
+            }
+            if (!current())
+                throw new Error("guest no longer admitted");
+            if (byDm) {
+                await this.sendCodeAlone((body, opts) => adapter.sendDirect(owner.userId, body, opts), adapter.type, login.display);
+                if (!current())
+                    throw new Error("guest no longer admitted");
+                await say(t("web.guest_sent"));
+            }
+        }
+        catch (err) {
+            codes.revokeIfCurrent(login.issuanceId); // this flow's code only, never a later one's
+            this.logger.info({ err: err?.message, adapterId: owner.adapterId }, "Guest sign-in code was not delivered privately");
+            if (!unrevoked())
+                return; // revoked meanwhile: the revoke's own answer said so
+            const start = adapter.type === "telegram" ? this.tgStartWebUrl(owner.adapterId) : null;
+            // #1742 for guests (step 4b-3): its START button (a bare /start, or the link's /start web) then asks again, from
+            // the DM — once, within the window.
+            if (adapter.type === "telegram")
+                this.openTgWebStartWindow(owner.adapterId, owner.userId);
+            await say(start ? t("web.guest_dm_failed_link", start) : t("web.guest_dm_failed"));
+        }
+    }
     /** #1570 (auth-api): this browser becomes a returning device of the code's owner. The cookie value, or null. */
     rememberReturningDevice(owner, input) {
         const token = this.webToken;
@@ -5855,6 +6205,12 @@ export class FleetManager {
         if (!token || this.shuttingDown)
             return { kind: "refused" };
         this.initializeWebSessions();
+        // #2095 review: verified before the request's body was read — a revoke (its own, or an admin's) made meanwhile
+        // removed it, and nothing it asks for may then go out.
+        if (!this.returningDevices.current(device, tokenEpoch(token)))
+            return { kind: "refused" };
+        if (device.tier === "guest")
+            return this.requestGuestDeviceCode(device, input, token);
         const paused = this.webLoginCodes.pausedForMs();
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
@@ -5886,7 +6242,7 @@ export class FleetManager {
             this.logger.info({ err: err?.message, adapterId }, "Sign-in code request: the private message could not be sent");
             return { kind: "refused" };
         }
-        if (this.webToken !== token || !this.publicOwnerCurrent(owner)) {
+        if (this.webToken !== token || !this.publicOwnerCurrent(owner) || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
@@ -5894,15 +6250,94 @@ export class FleetManager {
         // Asked again after the follow-up's wait: the owner, the token, shutdown, and a public request's exposure.
         const exposureGone = input.surface === "gateway"
             && (this.publicWebLink?.exposureId !== input.exposureId || this.publicWebLink?.status().state !== "open");
-        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone) {
+        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
         this.logger.info({ adapterId, surface: input.surface }, "Web sign-in code sent privately to a returning device's owner");
         return { kind: "sent" };
     }
+    /**
+     * #1920 step 4b: a guest's returning device asks for a code — a guest code for that account, by DM only, under the
+     * same rules as its /web (guests on, not an admin, something in scope now; one per account and the cap; one flow per
+     * account at a time; a revoke meanwhile ends it), its own limiter, and the guests' breaker. Asked through the public
+     * link: only while that exposure is the open one (its code then works through it alone), as an admin's device.
+     */
+    async requestGuestDeviceCode(device, input, token) {
+        const codes = this.webGuestLoginCodes;
+        const account = { adapterId: device.owner.adapterId, userId: device.owner.userId };
+        const key = `${account.adapterId}\u0000${account.userId}`;
+        const adapter = this.adapters.get(account.adapterId);
+        const viaLink = input.surface === "gateway";
+        const linkOpen = () => !!input.exposureId && this.publicWebLink?.openSignin()?.exposureId === input.exposureId;
+        if ((viaLink ? !linkOpen() : input.exposureId !== undefined) || !adapter?.sendDirect || !this.guestSignInAllowed(account)) {
+            this.logger.info({ adapterId: account.adapterId, surface: input.surface }, "Guest sign-in code request refused");
+            return { kind: "refused" };
+        }
+        const paused = codes.pausedForMs();
+        if (paused > 0)
+            return { kind: "limited", retryAfterMs: paused };
+        const asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key))
+            return { kind: "limited", retryAfterMs: 5_000 };
+        if (asked !== undefined && performance.now() - asked < 60_000)
+            return { kind: "limited", retryAfterMs: 60_000 - (performance.now() - asked) };
+        const admitted = this.guestCodeRequestLimiter.admit(device.idHash);
+        if (!admitted.ok)
+            return { kind: "limited", retryAfterMs: admitted.retryAfterMs };
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(account.adapterId) === adapter
+            && this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes && this.guestSignInAllowed(account)
+            && (!viaLink || linkOpen()) && this.returningDevices.current(device, tokenEpoch(token));
+        const issued = codes.issue({ epoch: tokenEpoch(token), recipient: account, audiences: [viaLink ? input.exposureId : "local"] });
+        if (!issued)
+            return { kind: "limited", retryAfterMs: 60_000 }; // the guests' cap: never someone's evicted
+        this.guestCodeInFlight.add(key);
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        try {
+            const text = t("web.resend_code", issued.display, Math.round(LOGIN_CODE_TTL_MS / 60_000), input.label || t("web.resend_unknown_browser"), t(viaLink ? "web.resend_public" : "web.resend_local"))
+                + "\n" + t("dashboard.code_next");
+            try {
+                await withinBudget(adapter.sendDirect(account.userId, text, { disablePreview: true }), performance.now() + 5_000);
+            }
+            catch (err) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                this.logger.info({ err: err?.message, adapterId: account.adapterId }, "Guest sign-in code request: the private message could not be sent");
+                return { kind: "refused" };
+            }
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            await this.sendCodeAlone((body, opts) => adapter.sendDirect(account.userId, body, opts), adapter.type, issued.display);
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            this.logger.info({ adapterId: account.adapterId }, "Guest sign-in code sent privately to a returning device's account");
+            return { kind: "sent" };
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+    }
+    /** #1920 step 4b (auth-api): this browser becomes a guest's returning device. The cookie value, or null. */
+    rememberGuestDevice(account, input) {
+        const token = this.webToken;
+        if (!token)
+            return null;
+        this.initializeWebSessions();
+        return this.returningDevices.rememberGuest(account, { ...input, tokenEpoch: tokenEpoch(token), webToken: token });
+    }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
+        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
+        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
+        if (info.tier === "guest" && info.owner) {
+            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
+            return;
+        }
         if (this.fleetConfig?.web?.notify_login === false)
             return;
         // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
@@ -6266,6 +6701,9 @@ export class FleetManager {
         const { getTmuxSocketName: getSocket } = await import("./paths.js");
         TmuxManager.setSocketName(getSocket());
         await TmuxManager.ensureSession(getTmuxSession());
+        this.tmuxSessionEnsured = true;
+        // #2072: what this host can run — probed in the background, published for every picker.
+        this.startAvailabilityRefresh();
         // Pre-flight (advisory, fire-and-forget): warm the per-backend auth cache
         // before instances spawn, so a CLI that comes up on its sign-in screen gets
         // an instant 🔑 verdict instead of decaying into crash/MCP-died noise.
@@ -6589,6 +7027,11 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
+        // #1920 §3.2: guests' ClassicBot room membership, read in the background — now, then each key ten minutes after
+        // its answer (a minute after a failed read; the tick only finds what is due). A request only reads the answers.
+        void this.refreshAllGuestRooms();
+        this.guestRoomsTimer = setInterval(() => { void this.refreshAllGuestRooms(); }, GUEST_ROOM_TICK_MS);
+        this.guestRoomsTimer.unref?.();
         // #1335: delivery-outbox.db and Task Board retention. Same once-at-startup
         // + daily-timer pattern; chunked DELETEs so one run cannot hold the loop.
         void this.pruneOutboxAndTasks();
@@ -7089,7 +7532,8 @@ export class FleetManager {
             adapters: { total: this.adapterState.size, connected, states, details },
             startupComplete: this.startupComplete,
             memory: readFleetMemory(),
-            hostMemory,
+            hostMemory: this.memoryTop && (hostMemory.level === "elevated" || hostMemory.level === "critical")
+                ? { ...hostMemory, topProcesses: this.memoryTop.processes, topProcessesAt: this.memoryTop.at } : hostMemory,
             problems,
         };
     }
@@ -8240,6 +8684,13 @@ export class FleetManager {
                 if (!isPrivateChat && !cmdMatch && rawText.startsWith("/")) {
                     return; // bare slash in group — ignore silently
                 }
+                // #1920 step 4b-3: /web typed in a ClassicBot room (a group: `/web@ThisBot`) by someone who is not a fleet admin,
+                // while guest sign-in is on: their guest code, privately — as anywhere else. An admin's goes on as before.
+                if (/^\/(?:web|dashboard)(?:\s|$)/i.test(text) && msgAdapter && this.isGuestWebAsk(msg.adapterId, msg.userId)) {
+                    await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username,
+                        arg: text.replace(/^\/(?:web|dashboard)/i, "").trim().toLowerCase(), replyHere: body => msgAdapter.sendText(chatId, body) });
+                    return;
+                }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
                     // #1686: intercept /start web before the ClassicBot admission flow runs.
@@ -8248,15 +8699,21 @@ export class FleetManager {
                     // #1742: a bare /start from a fleet admin whose /web just failed to reach them privately is that /start web
                     // (Telegram's START button sends it bare) — once, within the window; any other bare /start is ClassicBot's.
                     const admin = isPrivateChat && this.isFleetAdmin(msg.userId, msg.adapterId ?? "");
+                    // #1920 step 4b-3: a guest's too (guest sign-in on, not an admin) — its /web reached it no other way.
+                    const guest = isPrivateChat && !admin && this.isGuestWebAsk(msg.adapterId, msg.userId);
                     const webStart = isPrivateChat && (requestedBackend === "web"
-                        || (text === "/start" && admin && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
+                        || (text === "/start" && (admin || guest) && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
                     if (webStart) {
                         if (requestedBackend === "web")
                             this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId);
                         // #1742: the /web menu right here; the code comes to this DM.
                         if (admin)
                             await this.startWebInDm(msg, msgAdapter ?? undefined);
-                        // Non-fleet-admins: /start alone is enough to open the DM channel; no further action.
+                        // A guest: its guest code, here (this DM is where it goes).
+                        else if (guest && msgAdapter)
+                            await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username, arg: "",
+                                replyHere: body => msgAdapter.sendText(chatId, body) });
+                        // Anyone else: /start alone is enough to open the DM channel; no further action.
                         return;
                     }
                     // All new starts, including explicit backend and later chooser callbacks,
@@ -8560,10 +9017,7 @@ export class FleetManager {
                     this.afterUserInboundDelivered(generalInstance, msg);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
-                    this.emitSseEvent("message", {
-                        instance: generalInstance, sender: msg.username, role: "user",
-                        text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-                    });
+                    this.emitPlatformInbound(generalInstance, msg, text ?? "");
                 }
                 catch (err) {
                     this.logger.warn({ err: err.message, instanceName: generalInstance }, "General wake/delivery failed");
@@ -8672,9 +9126,16 @@ export class FleetManager {
         this.afterUserInboundDelivered(instanceName, msg);
         this.logger.info(`${msg.username} → ${instanceName}: ${(text ?? "").slice(0, 100)}`);
         this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), instanceName);
+        this.emitPlatformInbound(instanceName, msg, text ?? "");
+    }
+    /**
+     * A person's platform message as the web chat shows it — the user's own words, as a user (#1306), in the instance's
+     * history (#1565). #1920 §5.2: said in the instance's topic, General or room, so it is that channel's, by that account.
+     */
+    emitPlatformInbound(instance, msg, text) {
         this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            instance, sender: msg.username, role: "user", text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            channel: true, from: webChatFrom(msg.adapterId, msg.userId),
         });
     }
     /** Handle outbound tool calls from a daemon instance */
@@ -8976,7 +9437,14 @@ export class FleetManager {
                 // an agent cannot invent it to suppress the normal completion marker.
                 if (!error && result != null && msg.statusOnly !== true) {
                     try {
-                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView);
+                        // #1920 §5.2: shown to the instance's guests only when it landed in the instance's own topic or room.
+                        let inChannel = false;
+                        try {
+                            inChannel = outAdapter !== WEB_ONLY_REPLY_SINK
+                                && this.landedInOwnChannel(instanceName, contextAdapterId ?? this.getInstanceAdapterId(instanceName), result);
+                        }
+                        catch { /* not known: not the channel's (fail closed), and the bookkeeping below still runs */ }
+                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView, inChannel);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -9030,7 +9498,35 @@ export class FleetManager {
         return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
     }
     /** Resolves when the reply is in the web chat (#1770: after its files are copied); the caller need not wait. */
-    afterReplyRouted(instanceName, args, senderSessionName, buttons = null) {
+    /**
+     * #1920 §5.2: whether a platform send landed in the instance's own place — its ClassicBot room, or its topic in its
+     * connection's group — so its channel's members saw it. Anything else (another chat, a DM, a context left from General,
+     * an answer without the chat it went to) is not the channel's.
+     */
+    landedInOwnChannel(instance, adapterId, sent) {
+        const s = sent && typeof sent === "object" ? sent : {};
+        if (!adapterId || typeof s.chatId !== "string" || !s.chatId)
+            return false;
+        const roomId = this.classicChannels?.getChannelIdByInstance(instance);
+        if (roomId !== undefined)
+            return (this.classicChannels?.getAdapterIdByInstance(instance) ?? this.getPrimaryAdapterId()) === adapterId && roomId === s.chatId;
+        const cfg = this.fleetConfig?.instances && Object.hasOwn(this.fleetConfig.instances, instance) ? this.fleetConfig.instances[instance] : undefined;
+        const world = this.worlds.get(adapterId);
+        if (!cfg || this.getInstanceAdapterId(instance) !== adapterId || !world?.groupId || s.chatId !== world.groupId)
+            return false;
+        const thread = typeof s.threadId === "string" && s.threadId ? s.threadId : null;
+        return cfg.topic_id == null ? thread === null : thread === String(cfg.topic_id);
+    }
+    /** #1920 §5.2 (#2085 review): a platform click's buttons are in the instance's own place — else not its channel's. */
+    clickInOwnChannel(set) {
+        try {
+            return this.landedInOwnChannel(set.instance, set.adapterId, { chatId: set.chatId, threadId: set.threadId || undefined });
+        }
+        catch {
+            return false;
+        }
+    }
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null, inChannel = false) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -9066,6 +9562,7 @@ export class FleetManager {
                 ts,
                 ...(attachments.length ? { attachments } : {}),
                 ...(buttons ? { buttons } : {}), // #1266
+                ...(inChannel ? { channel: true } : {}), // #1920 §5.2
             });
         };
         const before = this.webReplyOrder.get(instanceName);
@@ -10319,6 +10816,7 @@ export class FleetManager {
      */
     saveFleetConfig(explicitPatches = []) {
         this.publicWebLink?.refresh();
+        this.enforceGuestSwitch(); // #1920: a Settings save turning guests off ends their sessions
         if (!this.fleetConfig || !this.configPath)
             return;
         if (!this.savedFleetConfigSnapshot)
@@ -13034,11 +13532,12 @@ export class FleetManager {
             };
         };
         const choicesFromCache = (instance) => {
-            const cached = this.readCliEnv(this.backendNameForInstance(instance)); // the cached catalog only: never a probe here
+            const backend = this.backendNameForInstance(instance);
+            const cached = this.readCliEnv(backend, this.catalogProfile(backend, instance)); // the cached catalog only: never a probe here
             if (!cached?.models.length)
                 return null;
             const current = this.resolveInstanceModel(instance).model;
-            return { current, options: cached.models.map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
+            return { current, options: this.withCurrentModel(cached.models, current).map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
         };
         return runWebCommand({
             // Own entries only: a name like "__proto__" or "constructor" must not be found on the prototype (#1476 review).
@@ -13085,7 +13584,7 @@ export class FleetManager {
                     return step.noop ? { text: step.text } : { error: step.text };
                 if (step.kind === "choose") {
                     const id = (token) => joinBackendArgs([...step.args, token]);
-                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label })) } };
+                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label, ...(c.disabled ? { disabled: c.disabled } : {}) })) } };
                 }
                 const now = performance.now();
                 for (const [k, v] of this.webBackendTokens)
@@ -14223,7 +14722,12 @@ export class FleetManager {
                 fleetConfig: () => this.fleetConfig,
                 isFleetAdmin: (userId, adapterId) => this.isFleetAdmin(userId, adapterId),
                 eventLog: () => this.eventLog,
-                recoverBackendInstances: (backend, profile) => this.recoverBackendInstances(backend, undefined, profile ?? null),
+                recoverBackendInstances: (backend, profile) => {
+                    // #2072: a sign-in just finished — the pickers learn it now, not at the next pass.
+                    if (!profile)
+                        void this.backendAvailability.refresh([backend], { force: true });
+                    return this.recoverBackendInstances(backend, undefined, profile ?? null);
+                },
                 claimWindow: backend => this.loginWindow.tryClaim("web", backend),
                 releaseWindow: claim => { this.loginWindow.release(claim); },
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
@@ -14742,6 +15246,8 @@ export class FleetManager {
                 // binary the same way, so a binary only a login shell could see was
                 // installed, reported as verified, and then offered nowhere.
                 this.adoptBinaryDirectory(installedAt, backend);
+                // #2072: an install just finished — the pickers learn it now, not at the next pass.
+                void this.backendAvailability.refresh([backend], { force: true });
                 if (!LOGIN_FLOWS[backend]) {
                     this.installHandoff = null;
                     await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
@@ -14976,6 +15482,8 @@ export class FleetManager {
                 buttons: m.buttons,
                 click: m.click,
                 links: m.links,
+                channel: m.channel,
+                from: m.from,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
             // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
@@ -15776,10 +16284,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
         // #1592: the web chat shows what was asked, as for every other inbound — the user's own words (no chat-log
         // context), as a user (#1306: never a role read from text), in the room's history (#1565).
-        this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-        });
+        this.emitPlatformInbound(instanceName, msg, text);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
     /** #1690: our own runtime switches awaiting the daemon's outcome, by id. */
@@ -15817,7 +16322,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** #1806: null on a switch INTO claude-code — the configured model then belongs to the backend being left. */
     configured = this.fleetConfig?.instances[instanceName]?.model ?? this.fleetConfig?.defaults?.model) {
         const aliases = ["default", "sonnet", "opus", "haiku", "opusplan", "Fable"];
-        const api = (this.readCliEnv("claude-code")?.apiModels ?? []).map(m => m.id);
+        const api = (this.readCliEnv("claude-code", this.catalogProfile("claude-code", instanceName))?.apiModels ?? []).map(m => m.id);
         const lower = model.trim().toLowerCase();
         const bare = lower.replace(/\[1m\]$/, "");
         const known = aliases.some(a => a.toLowerCase() === bare)
@@ -15845,13 +16350,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             : undefined;
         return classic ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
     }
-    cliEnvPath(backend) {
-        return join(getAgendHome(), "cli-env", `${backend.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+    /**
+     * #2072: a catalog is the account's, so a credential profile has its own. Only claude-code's probe reads an account
+     * catalog through a profile's login (its `GET /v1/models` with the profile's token); other backends' probes read the
+     * process environment, so their catalog stays the backend's own.
+     */
+    catalogProfile(backend, instanceName) {
+        return backend === "claude-code" && instanceName ? this.credentialProfileOf(instanceName, backend) : null;
+    }
+    cliEnvPath(backend, profile = null) {
+        const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "_");
+        return join(getAgendHome(), "cli-env", profile ? `${safe(backend)}@${safe(profile)}.json` : `${safe(backend)}.json`);
     }
-    /** Read the cached CLI env for a backend, or null if missing/stale/unparseable. */
-    readCliEnv(backend) {
+    /** Read the cached CLI env for a backend (a credential profile's own, when given), or null if missing/stale/unparseable. */
+    readCliEnv(backend, profile = null) {
         try {
-            const env = JSON.parse(readFileSync(this.cliEnvPath(backend), "utf-8"));
+            const env = JSON.parse(readFileSync(this.cliEnvPath(backend, profile), "utf-8"));
             if (typeof env?.probedAt === "number" && Date.now() - env.probedAt < CLI_ENV_TTL_MS)
                 return env;
         }
@@ -15894,10 +16408,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * previous list, never stall the command that asked for it.
      */
     async probeBackendBounded(backend, opts = {}) {
-        // #725: single-flight per backend. Explicit vendor refreshes remain a
+        // #725: single-flight per backend (#2072: per backend and credential profile). Explicit vendor refreshes remain a
         // separate flight from an ordinary probe, while sysinfo can join either.
-        const regularFlight = this.pendingCliEnvProbes.get(backend);
-        const vendorFlight = this.pendingVendorCliEnvProbes.get(backend);
+        const profile = opts.profile ?? null;
+        const key = profile ? `${backend}@${profile}` : backend;
+        const regularFlight = this.pendingCliEnvProbes.get(key);
+        const vendorFlight = this.pendingVendorCliEnvProbes.get(key);
         if (opts.refreshVendorCatalog && vendorFlight)
             return vendorFlight;
         if (!opts.refreshVendorCatalog && (vendorFlight || regularFlight))
@@ -15908,25 +16424,26 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const epoch = this.cliEnvProbeEpoch;
         const input = {
             mode: "env", backend, instanceDir,
-            config: { workingDirectory: "", instanceDir, instanceName: `probe-${backend}`, mcpServers: {} },
+            config: { workingDirectory: "", instanceDir, instanceName: `probe-${backend}`, mcpServers: {},
+                ...(profile ? { credentialStoreHome: credentialProfileStoreHome(getAgendHome(), backend, profile) } : {}) },
             refreshVendorCatalog: opts.refreshVendorCatalog === true,
         };
-        const bounded = this.runBackendProbeWorker(`global:${backend}`, input).then(probed => {
+        const bounded = this.runBackendProbeWorker(`global:${key}`, input).then(probed => {
             if (!probed || Array.isArray(probed) || this.shuttingDown || epoch !== this.cliEnvProbeEpoch)
                 return null;
             try {
-                return this.persistCliEnvProbeResult(backend, probed);
+                return this.persistCliEnvProbeResult(backend, probed, profile);
             }
             catch (err) {
-                this.logger.warn({ backend, err }, "CLI env cache write failed");
+                this.logger.warn({ backend, profile, err }, "CLI env cache write failed");
                 return null;
             }
         }).finally(() => {
             const flights = opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes;
-            if (flights.get(backend) === bounded)
-                flights.delete(backend);
+            if (flights.get(key) === bounded)
+                flights.delete(key);
         });
-        (opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes).set(backend, bounded);
+        (opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes).set(key, bounded);
         return bounded;
     }
     stopCliEnvProbes() {
@@ -16041,12 +16558,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     modelDisplayForInstance(instanceName) {
         return this.resolveInstanceModel(instanceName).display;
     }
+    /**
+     * #2072: the model an instance runs is always among its choices — one its CLI's catalog does not list (an older
+     * name, a custom provider's, a typed one) is shown first, marked, so the menu never hides what is running.
+     */
+    withCurrentModel(options, currentModel) {
+        if (!currentModel || currentModel === "default" || options.some(o => o.id === currentModel))
+            return options;
+        return [{ id: currentModel, label: currentModel, description: t("model.not_listed") }, ...options];
+    }
     modelChoiceLabel(option, currentModel) {
         const label = option.description ? `${option.label} — ${option.description}` : option.label;
         return option.id === currentModel ? `✓ ${label}` : label;
     }
     /** Preserve the existing cache merge rules for worker probes. */
-    persistCliEnvProbeResult(backend, probed) {
+    persistCliEnvProbeResult(backend, probed, profile = null) {
         const env = { backend, probedAt: Date.now(), ...probed };
         // An empty result must never overwrite a catalog we already have. Some
         // probes hit the network (`agy models` fetches, 5s cap), so a slow moment
@@ -16055,14 +16581,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // antigravity cache replaced by an empty one. Keep the known models and
         // let the fresher currentModel/version through.
         if (!env.models?.length) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.models?.length)
                 env.models = previous.models;
         }
         // Same protection for the extended catalog: one offline moment must not
         // blank a good account list for the whole cache TTL.
         if (!env.apiModels?.length) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.apiModels?.length)
                 env.apiModels = previous.apiModels;
         }
@@ -16070,12 +16596,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // keeps the cached levels only for that same binary: both versions known and equal, cache still valid. A help
         // that was read and lists none ([]) is an answer and is written as is, so the fallback applies.
         if (env.effortLevels === undefined) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.effortLevels && previous.version && env.version && previous.version === env.version) {
                 env.effortLevels = previous.effortLevels;
             }
         }
-        const path = this.cliEnvPath(backend);
+        const path = this.cliEnvPath(backend, profile);
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, JSON.stringify(env, null, 2));
         return env;
@@ -16097,6 +16623,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // indefinitely — each is wrapped by CLI_ENV_PROBE_DEADLINE_MS.
         for (const b of backends)
             void this.probeBackendBounded(b);
+        // #2072: each Claude credential profile in use has its own account catalog. Only fleet.yaml's agents are walked
+        // here; a ClassicBot room on a profile is probed on its first /model (catalogProfile knows rooms too).
+        const profiles = new Set();
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+            if (this.backendNameForInstance(name) !== "claude-code")
+                continue;
+            const profile = this.catalogProfile("claude-code", name);
+            if (profile)
+                profiles.add(profile);
+        }
+        for (const profile of profiles)
+            void this.probeBackendBounded("claude-code", { profile });
     }
     /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
     async getModelOptions(instanceName, refresh = false, onLiveProbe) {
@@ -16110,7 +16648,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      */
     async getModelOptionsWithSource(instanceName, opts = {}) {
         const backendName = this.backendNameForInstance(instanceName);
-        const cached = this.readCliEnv(backendName);
+        const profile = this.catalogProfile(backendName, instanceName);
+        const cached = this.readCliEnv(backendName, profile);
         if (!opts.refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached)) {
             return { models: cached.models, source: "cache" };
         }
@@ -16121,7 +16660,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // Stale, missing, or a forced refresh → probe live (also refreshes the cache).
         // A newly released model is invisible until this runs, which is why staleness
         // triggers it rather than waiting for the 24h hard expiry or a cold start.
-        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog });
+        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog, profile });
         if (env?.models.length)
             return { models: env.models, source: "live" };
         // Probe failed or timed out: the previous list is still the best answer.
@@ -16136,7 +16675,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     modelMenuChoices(instanceName, nonce, options, currentModel) {
         const isClaude = this.backendNameForInstance(instanceName) === "claude-code";
         const choices = [{ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__refresh__`, label: t("model.refresh") }];
-        for (const o of options.slice(0, isClaude ? 23 : 24)) {
+        for (const o of this.withCurrentModel(options, currentModel).slice(0, isClaude ? 23 : 24)) {
             choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`, label: this.modelChoiceLabel(o, currentModel) });
         }
         if (isClaude)
@@ -16543,16 +17082,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
     }
     /** Cached-or-live account catalog behind "/model → more models" (claude). */
-    async claudeApiModelOptions() {
-        const cached = this.readCliEnv("claude-code");
+    async claudeApiModelOptions(instanceName) {
+        // #2072: the account behind THIS instance — its credential profile's catalog, else the default login's.
+        const profile = this.catalogProfile("claude-code", instanceName);
+        const cached = this.readCliEnv("claude-code", profile);
         if (cached?.apiModels?.length)
             return cached.apiModels;
-        const env = await this.probeBackendBounded("claude-code");
+        const env = await this.probeBackendBounded("claude-code", { profile });
         return env?.apiModels ?? [];
     }
     /** Replace a consumed "/model" menu with the full account catalog tier. */
     async expandClaudeModelMenu(pending) {
-        const expanded = await this.claudeApiModelOptions();
+        const expanded = await this.claudeApiModelOptions(pending.instanceName);
         if (!expanded.length) {
             await pending.respond(t("model.more_unavailable")).catch(() => { });
             return;
@@ -16980,7 +17521,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return {
             currentBackend: (name) => this.backendNameForInstance(name),
             currentDisplay: (name) => `${this.backendNameForInstance(name)} · ${this.resolveInstanceModel(name).display}`,
-            installedBackends: () => KNOWN_BACKENDS.filter(b => b !== "mock" && this.backendInstalledHere(b)),
+            availability: () => this.backendAvailabilityFor(instanceName),
             models: (backend) => this.backendModelOptions(backend, opts),
             // #1808: the same rule update_instance_config's switch applies (backendModelVerdict).
             modelKnown: (backend, model) => this.backendModelVerdict(instanceName, backend, model).ok,
@@ -17079,10 +17620,76 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // kiro-cli gates its own --effort by version at launch (a quiet console note otherwise); muse always passes it.
         return () => true;
     }
-    /** Installed the way the launch finds a CLI (resolveBinary): on PATH or in a known install directory. */
-    backendInstalledHere(backend) {
-        const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
-        return !!binary && resolveBinary(binary) !== binary;
+    /**
+     * #2072: what this host can run, from the published availability snapshot (backend-availability.ts). Read only: a
+     * handler never starts a probe, not even in the background — launch, the timer, and /login install or sign-in do.
+     */
+    backendAvailabilityRows() {
+        return this.backendAvailability.snapshot();
+    }
+    /**
+     * #2072 part 3: the models a Settings field offers for `backend` — the cached catalog (an instance's own credential
+     * profile's, when it is named and has one), claude's account catalog included. Read only: never a probe.
+     */
+    modelCatalogFor(backend, instance) {
+        if (!KNOWN_BACKENDS.includes(backend) || backend === "mock")
+            return [];
+        const own = instance && Object.prototype.hasOwnProperty.call(this.fleetConfig?.instances ?? {}, instance) ? instance
+            : instance && this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? instance : null;
+        const env = this.readCliEnv(backend, this.catalogProfile(backend, own));
+        const seen = new Set(), out = [];
+        for (const m of [...(env?.models ?? []), ...(env?.apiModels ?? [])])
+            if (!seen.has(m.id)) {
+                seen.add(m.id);
+                out.push(m);
+            }
+        return out;
+    }
+    /**
+     * #2072 (#2078 review): the snapshot as THIS instance would see it. Its sign-in on a backend is its own credential
+     * profile's when it has one there — the host's default login says nothing about it. A profile's login is a file check
+     * (credentialProfileLogin), no process.
+     */
+    backendAvailabilityFor(instanceName) {
+        return this.backendAvailabilityRows().map(row => {
+            const profile = this.credentialProfileOf(instanceName, row.backend);
+            if (!profile || (row.state !== "usable" && row.state !== "not_signed_in" && row.state !== "unknown") || !row.path)
+                return row;
+            let login = "unknown";
+            try {
+                login = credentialProfileLogin(this.dataDir, row.backend, profile).state;
+            }
+            catch { /* unknown */ }
+            // Signed in there: usable for this instance. Signed out (or unknown): the host's default login says nothing about
+            // it, so no "not signed in" claim from it — update_instance_config's profile gate refuses a signed-out profile
+            // when applied, naming the profile and the command that signs it in.
+            if (login === "logged-in")
+                return { ...row, auth: "valid", state: "usable" };
+            return row.state === "not_signed_in" ? { ...row, auth: "unknown", state: "unknown" } : row;
+        });
+    }
+    /** The probes the snapshot runs (tests replace them: no CLI, no account, no network). */
+    availabilityProbes = hostAvailabilityProbes;
+    availabilityStore = null;
+    availabilityTimer = null;
+    get backendAvailability() {
+        return this.availabilityStore ??= new BackendAvailabilityStore(KNOWN_BACKENDS.filter(b => b !== "mock" && !!BACKEND_INSTALLATION_INFO[b]), this.availabilityProbes, { onChange: () => this.noteAvailabilityPaths() });
+    }
+    /** A launch need not look the binary up again (a synchronous `which` on the loop) when the snapshot found it. */
+    noteAvailabilityPaths() {
+        for (const row of this.availabilityStore?.snapshot() ?? []) {
+            const binary = BACKEND_INSTALLATION_INFO[row.backend]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, row.state === "not_installed" ? null : row.path);
+        }
+    }
+    /** Probe now and then every AVAILABILITY_STALE_MS; a pass that finds nothing changed starts no CLI. */
+    startAvailabilityRefresh() {
+        void this.backendAvailability.refresh();
+        if (this.availabilityTimer)
+            clearInterval(this.availabilityTimer);
+        this.availabilityTimer = setInterval(() => { void this.backendAvailability.refresh(); }, AVAILABILITY_STALE_MS);
+        this.availabilityTimer.unref?.();
     }
     /** The models `/model` would offer on a backend: the cached CLI env, else (live) a bounded probe. Never throws. */
     async backendModelOptions(backend, opts) {
@@ -17424,9 +18031,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         return undefined;
     }
+    /** #2072: from the published snapshot (no `which` on the loop); not checked yet counts as installed (no false alarm). */
     isBackendInstalled(backend) {
-        const installation = BACKEND_INSTALLATION_INFO[backend];
-        return !!installation && checkBinaryInstalled(installation.binary);
+        if (!BACKEND_INSTALLATION_INFO[backend])
+            return false;
+        return this.backendAvailability.get(backend)?.state !== "not_installed";
     }
     getMissingBackendWarning(backend) {
         if (!backend)
@@ -17764,6 +18373,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.eventLogPruneTimer);
             this.eventLogPruneTimer = null;
         }
+        if (this.guestRoomsTimer) {
+            clearInterval(this.guestRoomsTimer);
+            this.guestRoomsTimer = null;
+        }
         this.logService?.unwatchAll(); // #1218: a Log's watch timers end with the fleet
         this.compactWatchService?.stopAll();
         if (this.outboxPruneTimer) {
@@ -17863,6 +18476,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.adapters.clear();
         this.controlClient?.stop();
         this.controlClient = null;
+        if (this.availabilityTimer) {
+            clearInterval(this.availabilityTimer);
+            this.availabilityTimer = null;
+        }
         if (this.healthServer) {
             this.healthServerListening = false;
             const server = this.healthServer;
@@ -19847,6 +20464,147 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.rejectedHostsLogged.add(name);
         this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
     }
+    /**
+     * #1920 §3: the instances a guest session may see — derived on every request from the account's chat access, never
+     * stored; nothing while `web.guests.enabled` is not true.
+     * - Its connection's fleet topics and General (what it may talk to in chat): when that connection's access lets the
+     *   account in (AccessManager.isAllowed — allowed_users or paired). An `open` connection lets everyone in, so it gives
+     *   only the instances an admin named for its guests (`web.guests.open_instances`; the user's decision: least
+     *   privilege, as an open group has no list of people).
+     * - A Telegram private ClassicBot room that is the account's own (its chat id is the user id).
+     * - A ClassicBot group or guild room on its connection: only while its membership is verified (§3.2 — a "member"
+     *   answer read in the background, at most 15 minutes old; unknown, failed or stale hides it).
+     * - Then an admin's narrowing (`web.guests.narrow`), which only takes away.
+     * A fleet admin is not a guest: an admin outside the connection's access gets nothing here (admins sign in as admins).
+     */
+    guestScope(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        if (!owner || guests?.enabled !== true)
+            return NO_GUEST_SCOPE;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const scope = new Set();
+        const world = this.worlds.get(owner.adapterId);
+        if (world && world.accessManager.isAllowed(owner.userId)) {
+            const named = world.accessManager.getMode() === "open" ? new Set(own(guests.open_instances, owner.adapterId) ?? []) : null;
+            for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+                if (this.getInstanceAdapterId(name) !== owner.adapterId || this.isClassicInstance(name))
+                    continue;
+                if (!named || named.has(name))
+                    scope.add(name);
+            }
+        }
+        const rooms = this.classicChannels?.getAll() ?? [];
+        for (const room of rooms) {
+            if (this.isOwnPrivateRoom(owner, room))
+                scope.add(room.instanceName);
+        }
+        const members = this.guestRooms();
+        for (const room of guestGroupRooms(rooms, owner)) {
+            if (members.verified(room, owner.userId))
+                scope.add(room.instance);
+        }
+        const narrow = own(guests.narrow, `${owner.adapterId}:${owner.userId}`);
+        if (narrow) {
+            const keep = new Set(narrow);
+            for (const name of [...scope])
+                if (!keep.has(name))
+                    scope.delete(name);
+        }
+        return scope.size ? scope : NO_GUEST_SCOPE;
+    }
+    /**
+     * #1920 §3.5: a guest session still admitted — current, with something in scope. A scope that became empty (guest
+     * sign-in off, the account removed from the connection's access, everything narrowed away) ends the session here,
+     * so the next request and the open stream find it gone.
+     */
+    guestStillAdmitted(record) {
+        return this.guestAdmission(record) === "ok";
+    }
+    /**
+     * The same, with a third answer (§3.2): "pending" — nothing in scope now, but a room's membership is not read yet
+     * (a restart, a room just created). The request is refused and the session kept; its read starts in the background.
+     */
+    guestAdmission(record) {
+        if (!this.webSessions || !this.webToken || !this.webSessions.isCurrent(record, tokenEpoch(this.webToken)))
+            return "gone";
+        const owner = record.owner;
+        if (this.guestScope(owner).size)
+            return "ok";
+        if (owner && this.fleetConfig?.web?.guests?.enabled === true) {
+            const members = this.guestRooms(), rooms = guestGroupRooms(this.classicChannels?.getAll() ?? [], owner);
+            if (rooms.some((room) => members.pending(room, owner.userId))) {
+                void this.refreshGuestRooms(owner, { mode: "triggered" }); // rate-limited per room (30 s), single-flight
+                return "pending";
+            }
+        }
+        this.enforceGuestSwitch();
+        const ended = this.webSessions.revokeByHandle(record.handle);
+        if (ended.found)
+            this.logger.info({ adapterId: record.owner?.adapterId, durable: ended.durable }, "Guest web session ended: nothing left in its scope");
+        return "gone";
+    }
+    /** #1920 §3.2: the membership answers; the read goes to the room's own connection, never waits past its deadline. */
+    guestRooms() {
+        this.guestRoomMembership ??= new GuestRoomMembership({
+            now: () => performance.now(),
+            read: (room, userId) => {
+                const adapter = this.worlds.get(room.adapterId)?.adapter;
+                return room.kind === "telegram" ? adapter?.isGroupMember?.(room.channelId, userId) : adapter?.canViewChannel?.(room.channelId, userId);
+            },
+            // Said once per key while its reads keep failing (no user id: the room and connection are what an admin fixes).
+            onPersistentFailure: (room, failures) => this.logger.warn({ adapterId: room.adapterId, instance: room.instance, failures }, "Guest room membership keeps failing to read (the bot may lack the permission, or was removed); retrying with backoff up to 10 minutes"),
+            onRecovered: (room) => this.logger.info({ adapterId: room.adapterId, instance: room.instance }, "Guest room membership reads again"),
+        });
+        return this.guestRoomMembership;
+    }
+    /** #1920 §3.2: read this guest's rooms that are due (GuestRoomMembership.refresh says when each mode reads). */
+    async refreshGuestRooms(owner, opts = {}) {
+        if (this.fleetConfig?.web?.guests?.enabled !== true)
+            return;
+        try {
+            await this.guestRooms().refresh(owner, guestGroupRooms(this.classicChannels?.getAll() ?? [], owner), opts);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message }, "Guest room membership could not be read");
+        }
+    }
+    /** Every account with a live guest session, one after another (the guest caps bound them); one pass at a time. */
+    async refreshAllGuestRooms() {
+        if (this.guestRoomsPass || this.fleetConfig?.web?.guests?.enabled !== true || !this.webSessions)
+            return;
+        this.guestRoomsPass = true;
+        try {
+            for (const owner of this.webSessions.guestOwners())
+                await this.refreshGuestRooms(owner);
+        }
+        finally {
+            this.guestRoomsPass = false;
+        }
+    }
+    guestRoomsPass = false;
+    /**
+     * #1920 §3.5: guest sign-in turned off ends every guest session — checked when the configuration is read or saved
+     * and when the sessions are opened, so turning it back on never revives one.
+     */
+    enforceGuestSwitch() {
+        if (this.fleetConfig?.web?.guests?.enabled === true || !this.webSessions)
+            return;
+        const ended = this.webSessions.revokeAll((r) => r.tier === "guest");
+        if (ended.count)
+            this.logger.info({ count: ended.count, durable: ended.durable }, "Guest web sign-in is off: every guest session ended");
+        // #1920 step 4b: and every guest's returning device — turning it back on lets no old browser ask for a code.
+        const devices = this.returningDevices?.revokeGuest();
+        if (devices?.count)
+            this.logger.info({ count: devices.count, durable: devices.durable }, "Guest web sign-in is off: every guest's returning device forgotten");
+    }
+    /** #1920 §5.2: whether this instance is the account's own Telegram private ClassicBot room (its chat id is the user id). */
+    guestOwnRoom(owner, instance) {
+        return (this.classicChannels?.getAll() ?? []).some((room) => room.instanceName === instance && this.isOwnPrivateRoom(owner, room));
+    }
+    /** A private room's chat id is its one user's id (a group's is negative, so never equal); Telegram only. */
+    isOwnPrivateRoom(owner, room) {
+        return room.adapterId === owner.adapterId && room.channelId === owner.userId && inferClassicChannelType(room.channelId) === "telegram";
+    }
     /** Shared handler dispatcher; gateway admission is enforced by its separate listener. */
     dispatchWebHttp(req, res, port, closing = false) {
         try {
@@ -19907,6 +20665,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     res.end(JSON.stringify({ error: decision.message }));
                     return;
                 }
+                // #1920: a guest reaches only GUEST_ROUTES, within the scope derived for it now — default deny, before any
+                // handler, on this listener and the public link's gateway alike (both come through here).
+                if (decision.via === "session" && decision.session.tier === "guest") {
+                    const owner = decision.session.owner;
+                    const admitted = decision.session;
+                    const admission = this.guestAdmission(admitted);
+                    if (admission === "pending") {
+                        // §3.2: a room's membership is being read — try again shortly; the session stays.
+                        res.writeHead(503, { "Retry-After": "5" });
+                        res.end(JSON.stringify({ error: "guest_scope_pending" }));
+                        return;
+                    }
+                    if (admission === "gone") {
+                        res.writeHead(401);
+                        res.end(JSON.stringify({ error: "guest_scope_empty" }));
+                        return;
+                    }
+                    const verdict = guestRouteDecision(req.method ?? "GET", parsedUrl, this.guestScope(owner));
+                    if (verdict.kind === "deny") {
+                        res.writeHead(verdict.status);
+                        res.end(JSON.stringify({ error: verdict.error }));
+                        return;
+                    }
+                    // Phase 1b: the handlers that answer per recipient (the stream, the poll, a file) know it is a guest's, and
+                    // ask its scope anew each time; an emptied scope ends the session (and closes its stream).
+                    bindGuestRequest(req, { owner, scope: () => this.guestScope(owner), current: () => this.guestStillAdmitted(admitted),
+                        // #1920 §5.2: its own Telegram private room shows it everything; the kept messages place ticks and buttons.
+                        ownRoom: (instance) => this.guestOwnRoom(owner, instance),
+                        // §3.2: a stream that connects reads its rooms again (in the background; at most once a minute).
+                        streamOpened: () => { void this.refreshGuestRooms(owner, { mode: "force" }); },
+                        history: () => this.webChatHistory,
+                        // #1920 §5.1: guests chat unless the host made them read-only (web.guests.chat: false).
+                        chat: () => this.fleetConfig?.web?.guests?.chat !== false });
+                }
             }
             if (req.method === "GET" && req.url === "/health") {
                 const health = this.getFleetHealth();
@@ -20297,6 +21089,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.warn({ code: err.code, port: settings.port }, "Preview listener unavailable; HTML previews are off");
             this.previewListening = false;
             this.previewListener = null;
+            this.previewListenError = `${settings.port}: ${err.code ?? err.message}`;
         });
         // An optional listener never takes the fleet down: a port Node refuses outright throws here, synchronously.
         try {
@@ -20307,6 +21100,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.warn({ err: err.message, port: settings.port }, "Preview listener cannot listen; HTML previews are off");
             this.previewListening = false;
             this.previewListener = null;
+            this.previewListenError = `${settings.port}: ${err.code ?? err.message}`;
         }
     }
     /** What a reload may change hot: web.preview, and the dashboard names (the shim's allow-list and frame-ancestors). */
@@ -20327,6 +21121,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     stopPreviewListener() {
         this.previewListening = false;
+        this.previewListenError = null;
         this.previewListener?.close();
         this.previewListener = null;
     }
@@ -20334,10 +21129,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     previewForUi(hostHeader, secure) {
         const listener = this.previewListening ? this.previewListener : null;
         const decided = previewAvailability(listener ? listener.settings : null, hostHeader, secure, listener ? listener.origins : undefined);
+        // Previews are on, but no listener answers: say why — its port could not be opened (the error, never "turned off"),
+        // or it is not listening yet.
         if (!listener && this.fleetConfig?.web?.preview !== false)
-            decided.reason = "Previews are not available on this fleet right now.";
+            Object.assign(decided, this.previewNotListening());
         return { ...decided, boot: listener ? listener.bootId : null };
     }
+    previewNotListening() {
+        const failed = this.previewListenError;
+        return failed
+            ? { code: "listenFailed", detail: failed, reason: `Previews are unavailable: the fleet could not open its preview port (${failed}). Another program may be using it — set web.preview_port, then restart AgEnD.` }
+            : { code: "notListening", reason: "Previews are not available on this fleet right now." };
+    }
     /**
      * #1723: for one page of the public link (exposure `exposureId`, at `dashboardOrigin`): its own preview tunnel's
      * origin once up, "starting" until then, why it failed if it did — or a configured web.preview_origin, used instead.
@@ -20352,8 +21155,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const configured = typeof web?.preview_origin === "string" ? normalizeOrigin(web.preview_origin) : null;
         if (configured) {
             const listener = this.previewListening ? this.previewListener : null;
-            if (!listener)
-                return off("publicLink", "Previews are not available on this fleet right now.");
+            if (!listener) {
+                const why = this.previewNotListening();
+                return off(why.code, why.reason, why.detail ? { detail: why.detail } : {});
+            }
             if (!configured.startsWith("https:"))
                 return off("needHttps", "Previews need an https web.preview_origin when the dashboard is reached over https.");
             return { dashboardOrigin, previewOrigin: configured, reason: null, code: null, boot: listener.bootId, frameSrc: `${configured}/frame` };
@@ -20493,6 +21298,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // #1685: host memory pressure while it slows or holds new agents (the dashboard's indicator; macOS elevated is
             // shown here rather than in chat). null when normal, unknown or advisory.
             host_memory: this.hostMemoryIndicator(),
+            // #2015: the largest processes while it lasts (name, pid, RSS, and whose: an instance, the fleet or tmux).
+            ...(this.hostMemoryIndicator() && this.memoryTop ? { host_memory_top: this.memoryTop.processes } : {}),
         };
     }
 }