@songsid/agend 2.3.0-beta.25 → 2.3.0-beta.27

package/dist/fleet-manager.js

@@ -13,7 +13,9 @@ import { handleWebIconRequest, useAppIconStore } from "./web-icons.js";
 import { AppIconStore } from "./web-app-icon.js";
 import { trackWebServer } from "./web-server-drain.js";
 import { renderPublicLinkProgress, ThrottledMessageEditor } from "./public-link-progress.js";
-import { PublicWebLink, publicLinkSettings } from "./public-web-link.js";
+import { PublicWebLink, publicLinkNamedHostname, publicLinkSettings } from "./public-web-link.js";
+import { PublicLinkAutoOpen } from "./public-link-auto-open.js";
+import { clearPublicLinkOwner, readPublicLinkOwner, writePublicLinkOwner } from "./public-link-owner.js";
 import { PUBLIC_PREVIEW_FRAME_SRC, PUBLIC_PREVIEW_TUNNEL_DIR, PublicPreview, publicPreviewWanted } from "./public-preview.js";
 import { CloudflaredProvider } from "./tunnel/cloudflared.js";
 import { TunnelPurposeLane } from "./tunnel/purpose-lane.js";
@@ -36,6 +38,7 @@ import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, sameUpdateMarker, setUpdateProgressStage, updateMarkerIdentity, updateProgressOperation, updateReceiptOf, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
 import { sdNotify, sdNotifyBlocking, setSdNotifyWarn } from "./sd-notify.js";
+import { StartupMemoryDeadline, fleetStopConcurrency } from "./startup-memory-deadline.js";
 import { readFleetMemory } from "./process-memory.js";
 import { MemoryPressure } from "./memory-pressure.js";
 import { replyDedupText, ReplyDeduper } from "./reply-dedup.js";
@@ -144,7 +147,7 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     }
     return tasks;
 }
-import { handleWebRequest, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { handleWebRequest, webPeerOf, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WEB_ECHO_COPIES_MAX, WEB_MIRROR_TIMEOUT_MS, webReactionEmoji, webReactionProblem } from "./web-reactions.js";
@@ -154,6 +157,7 @@ import { OPERATOR, WebPrefsStore } from "./web-prefs.js";
 import { agendVersion } from "./agent-whats-new.js";
 import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
+import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -213,6 +217,7 @@ import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { KNOWN_BACKENDS, validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
 import { presentationState, interactionSummary, sameInteractionOwner } from "./interaction-observation.js";
+import { idleGateTimeoutLog } from "./idle-gate-log.js";
 import { DEFAULT_STUCK_TIMEOUT_MS, readLastInboundAt } from "./daemon.js";
 import { clearPausedMarker, readPausedAt, readPauseReason, writePausedMarker } from "./pause-marker.js";
 import { readBackgroundWorkEndedMarker } from "./background-work-ended.js";
@@ -235,12 +240,13 @@ import { CompactWatch, launchIdentity } from "./compact-watch.js";
 import { agyLegacyAgentsFile, danglingSymlink, migrateAgyAgentsFile } from "./backend/antigravity.js";
 import { claudeConfigDirFor, claudeProjectKey } from "./backend/claude-code.js";
 import { sharedRolloutIndex } from "./rollout-index.js";
+import { TASK_BOARD_ON_NOTICE, dashboardRefusalIn, taskBoardSwitchedOn } from "./dashboard-permissions.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken, sessionCookieUpgrade } from "./web-auth.js";
-import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
+import { bypassesWebGate, handleAuthRequest, serveGuestRefusedPage, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
 import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { authorityNow, classifyWebPeer, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
+import { authorityNow, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
 import { AuthorityStateStore } from "./authority/authority-state.js";
 import { SessionAuthorizations } from "./authority/session-authorizations.js";
 import { SessionAuthorizationRequests } from "./web-session-authorization.js";
@@ -267,6 +273,7 @@ import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
 import { cleanupWatchVerdict, formatRestartProgressCompletion, RestartProgress, } from "./restart-progress.js";
+import { FleetStartup } from "./fleet-startup.js";
 import { launchFullRestartHelper } from "./full-restart.js";
 import { fullReloadExitCode } from "./service-owner.js";
 import { SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE } from "./service-restart-selection.js";
@@ -671,7 +678,8 @@ export class FleetManager {
     ]);
     logger = createLogger("info");
     /** Report each bundled skill collision once per fleet, across instance starts. */
-    skippedBundledSkills = new Set();
+    /** #2482: per skills directory, the skipped set (names + their content) last said — this process's view of the record. */
+    skippedSkillsSaid = new Map();
     topicCommands;
     // sessionName → instanceName mapping for external sessions
     sessionRegistry = new Map();
@@ -814,6 +822,7 @@ export class FleetManager {
     // Adapter isolation: track state per adapter for retry + visibility
     /** #2175: this boot's progress message, whose completion may still be owed by its background retry. */
     startupProgress = null;
+    startupDashboard = null;
     adapterState = new Map();
     adapterRetryInFlight = new Map();
     /** Web Settings secret rotation is deliberately separate from reconnect
@@ -895,6 +904,7 @@ export class FleetManager {
     /** Days of event/activity history to keep. */
     static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
+    startupMemoryDeadline = null;
     eventLoopWatch = null;
     startedAt = 0;
     stormOpenNotifyTimer = null;
@@ -930,6 +940,28 @@ export class FleetManager {
     webFiles = new WebFileLedger({ limits: () => uploadLimits(this.fleetConfig?.web) });
     /** #1770: per instance, its last web reply still copying its files — the next one is shown after it, in order. */
     webReplyOrder = new Map();
+    /**
+     * #1774: an instance name's reply generation — moved on when a removal of it starts, so replies sent from then on (a
+     * same-name replacement's) are told from the removed instance's. `webChatRemovals`: once a removal succeeded, the
+     * generations and the daemon whose replies are no longer anyone's to show.
+     */
+    webChatGenerations = new Map();
+    webChatRemovals = new Map();
+    /** #1774: a removal under way — its replies' fate waits for its outcome (success: theirs no more; failure: theirs). */
+    webChatRemovalsPending = new Map();
+    webChatGeneration(name) { return this.webChatGenerations.get(name) ?? 0; }
+    /** #1774: who an instance's reply is from, taken when it is sent: the name's generation and its daemon then. */
+    webChatIdentity(name) { return { generation: this.webChatGeneration(name), daemon: this.daemons.get(name) }; }
+    /** #1774: the reply's instance was not removed (a removal that failed changes nothing). */
+    webChatIdentityCurrent(name, id) {
+        const removed = this.webChatRemovals.get(name);
+        return !removed || (id.generation >= removed.below && (removed.daemon === undefined || id.daemon !== removed.daemon));
+    }
+    /** #1774: the removal still deciding this reply's fate (it was sent by what is being removed), or null. */
+    webChatRemovalPending(name, id) {
+        const pending = this.webChatRemovalsPending.get(name);
+        return pending && (id.generation < pending.below || (pending.daemon !== undefined && id.daemon === pending.daemon)) ? pending.done : null;
+    }
     /** #1770: an instance's web-files byte cap (a field, so a test can make it small). */
     webReplyMaxBytes = REPLY_FILES_MAX_BYTES;
     /** #1682: the people seen on inbound messages (id → name), for the web chat's mention pills; bounded, in memory. */
@@ -1015,6 +1047,11 @@ export class FleetManager {
         // r4.1 Q3 (b): the card's limits are read from fleet.yaml at each upload (a change applies without a restart).
         return (this.themeStoreInstance ??= new ThemeStore(this.dataDir, { limits: () => effectiveAppearanceLimits(this.fleetConfig?.web?.appearance).limits, effectsDropped: ids => this.effectLibrary.collectUnreferenced(ids) }));
     }
+    officeStoreInstance;
+    /** Fleet → Org chart → Office: the offices people made (web-offices.json, beside web-themes.json). */
+    get officeStore() { return (this.officeStoreInstance ??= new OfficeStore(this.dataDir)); }
+    /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
+    officeWrites = new OfficeWriteLimiter();
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance() {
         return (this.webAppearanceService ??= new WebAppearance(this.themeStore, () => this.fleetConfig?.web ?? null, () => { try {
@@ -1362,7 +1399,13 @@ export class FleetManager {
         const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
         if (auth.kind !== "ok")
             return null;
-        const record = auth.session, gateway = !!gatewayRequestContext(req), peer = classifyWebPeer(req);
+        // #2453 (§0.2): never over the public link — not even a named-link session that is web-verified there.
+        if (gatewayRequestContext(req))
+            return null;
+        // …and never a change that turns the named-link option on: that one needs a General's card or the host.
+        if (!store.selfConfirmable(id))
+            return null;
+        const record = auth.session, gateway = !!gatewayRequestContext(req), peer = webPeerOf(req);
         const verified = () => {
             const now = this.webAuthority({ session: record, gateway, peer });
             // A refusal carries no authority (kind "none"); the handle pins the session, and with it its one account.
@@ -1629,6 +1672,7 @@ export class FleetManager {
         this.spawnGate = new SpawnGate({
             storm: this.stormWindow,
             memoryPressure: this.memoryPressure,
+            onStartupMemoryWait: () => this.startupMemoryDeadline?.check(),
             concurrency: () => this.spawnConcurrency(),
             staggerMs: () => this.fleetConfig?.defaults?.startup?.stagger_delay_ms ?? 500,
         });
@@ -2674,6 +2718,7 @@ export class FleetManager {
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.warnAboutRemovedLoginMode(loaded);
         this.enforceGuestSwitch();
+        this.observeWebAuthority(); // #2453 review: a reload's web-authority switches are seen at once
         // Child tool/guidance readers must follow this fleet's actual config, including --config.
         // Scope the path to its owning data directory so another inherited home's override cannot enable CW.
         process.env.AGEND_FLEET_DATA_DIR = resolvePath(this.dataDir);
@@ -3280,7 +3325,8 @@ export class FleetManager {
     instancePresentation(name) {
         const execution_state = this.getInstanceExecutionState(name);
         const interaction = this.getInstanceInteraction(name);
-        return { state: presentationState(execution_state, interaction), execution_state,
+        const startup_phase = !this.lifecycle.isPaused(name) ? this.startupDashboard?.phase(name) : undefined;
+        return { ...(startup_phase ? { startup_phase } : {}), state: presentationState(execution_state, interaction), execution_state,
             interaction, interaction_summary: interactionSummary(interaction) };
     }
     /**
@@ -3714,7 +3760,9 @@ export class FleetManager {
         if (this.shuttingDown || !this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
             return false;
         if (!idle) {
-            this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
+            // #2482: a busy target is the normal case (its CLI queues the message): INFO; a WARN only for a likely anomaly.
+            const log = idleGateTimeoutLog(instanceName, timeoutMs, this.instanceStateCache.get(instanceName), Date.now());
+            this.logger[log.level](log.fields, log.message);
         }
         const sent = await this.sendWhenConnected(instanceName, payload, deliveryEpoch, stillCurrent);
         if (!sent)
@@ -3832,6 +3880,10 @@ export class FleetManager {
         // #2305: the copies' own message ids, so an instance's reaction to the web message is put on them too.
         if (copies.length)
             this.rememberWebEchoCopies(messageId, copies);
+        // #2281: and where they are, for a later web reply to this message to be a native reply there.
+        const posts = copies.flatMap(c => c.adapterId ? [{ adapterId: c.adapterId, chatId: c.chatId, ...(c.threadId ? { threadId: c.threadId } : {}), messageId: c.messageId }] : []);
+        if (posts.length)
+            this.webChatHistory.addPosts(instance, messageId, posts);
         const m = this.webChatHistory.markChannel(instance, messageId);
         if (m)
             broadcastToGuests(this.sseClients, "message", m, (err) => this.logger.debug({ err }, "SSE client write failed; evicting"));
@@ -3882,7 +3934,11 @@ export class FleetManager {
         return { ok: true, mirrored };
     }
     /** #2305: `copies` collects each room's copy (its message id), for a reaction to the web message. */
-    async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK, copies) {
+    /**
+     * `reply` (#2281): where the message a web reply quotes is on a platform. A room that has it gets the reply as a
+     * native reply to it (`reply.text`: without the quoted line); every other room gets `text`, as before.
+     */
+    async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK, copies, reply) {
         const guard = this.webChannelEchoGuards.get(instance);
         const handled = new Set();
         let posted = 0;
@@ -3912,9 +3968,11 @@ export class FleetManager {
             try {
                 if (!adapter?.sendText)
                     continue;
-                const sent = await adapter.sendText(entry.channelId, text, { format: "text", allowedMentions: { parse: [] } });
+                // A Telegram room is its chat; a Discord room is the guild's channel (an inbound's thread there).
+                const native = reply?.posts.find(p => p.adapterId === adapter.id && (p.chatId === entry.channelId || p.threadId === entry.channelId));
+                const sent = await adapter.sendText(entry.channelId, native ? reply.text : text, { format: "text", allowedMentions: { parse: [] }, ...(native ? { replyTo: native.messageId } : {}) });
                 if (copies && sent && typeof sent.messageId === "string" && sent.messageId)
-                    copies.push({ adapter, chatId: entry.channelId, messageId: sent.messageId });
+                    copies.push({ adapter, adapterId: adapter.id, chatId: entry.channelId, messageId: sent.messageId });
                 ClassicChannelManager.logMessage(instance, sender, text, new Date());
                 posted++;
             }
@@ -4952,7 +5010,7 @@ export class FleetManager {
             return;
         }
         if (this.lifecycle.isPaused(name)) {
-            this.logger.info({ name }, "Persisted paused instance — skipping startup");
+            this.logger.debug({ name }, "Persisted paused instance — skipping startup"); // #2482: every start and reload
             return;
         }
         if (this.lifecycle.daemons.has(name)) {
@@ -4971,66 +5029,92 @@ export class FleetManager {
             this.logger.info({ name }, "Instance already running, skipping");
             return;
         }
-        // An explicit start (CLI/API) begins a fresh idle window; boot and
-        // reconcile starts keep the persisted last-inbound seed (Phase 2a).
-        if (resumePaused)
-            this.lifecycle.markActivitySeedNow(name);
-        const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
-        if (config.general_topic) {
-            this.ensureGeneralInstructions(config.working_directory, backend, name);
-        }
-        else if (kind === "fleet-topic") {
-            // Workers get only role-eligible on-demand skills. Classic instances are
-            // deliberately excluded: their workspace and conversation lifecycle are
-            // managed independently from fleet-topic workers.
-            try {
-                const skillsWorkDir = this.resolveKnowledgeWorkDir(config.working_directory, backend, name);
-                measureSyncWork("fleet.workerSkills", () => this.syncRoleSkills(skillsWorkDir, backend, "worker"));
+        await this.trackStartupInstance(name, async () => {
+            // An explicit start (CLI/API) begins a fresh idle window; boot and
+            // reconcile starts keep the persisted last-inbound seed (Phase 2a).
+            if (resumePaused)
+                this.lifecycle.markActivitySeedNow(name);
+            const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+            if (config.general_topic) {
+                this.ensureGeneralInstructions(config.working_directory, backend, name);
             }
-            catch (err) {
-                // Skill publishing is additive. A read-only or temporarily unavailable
-                // workspace must not turn an otherwise valid worker startup into a
-                // fleet outage.
-                this.logger.warn({ err, name, backend }, "Failed to sync worker skills — continuing startup");
+            else if (kind === "fleet-topic") {
+                // Workers get only role-eligible on-demand skills. Classic instances are
+                // deliberately excluded: their workspace and conversation lifecycle are
+                // managed independently from fleet-topic workers.
+                try {
+                    const skillsWorkDir = this.resolveKnowledgeWorkDir(config.working_directory, backend, name);
+                    measureSyncWork("fleet.workerSkills", () => this.syncRoleSkills(skillsWorkDir, backend, "worker"));
+                }
+                catch (err) {
+                    // Skill publishing is additive. A read-only or temporarily unavailable
+                    // workspace must not turn an otherwise valid worker startup into a
+                    // fleet outage.
+                    this.logger.warn({ err, name, backend }, "Failed to sync worker skills — continuing startup");
+                }
             }
-        }
-        else if (kind === "classic") {
-            // #2163: a Classic bot gets only the skills marked `classic` (its own look, the dashboard) — never the fleet's
-            // coordination playbooks (#557 kept those out of end-user bots) — and only into a workspace AgEnD manages: the
-            // room's own folder under <AGEND_HOME>/workspaces/. Anywhere else, nothing is written; `agend-agent skill <name>`
-            // reads any bundled skill on demand.
-            try {
-                const skillsWorkDir = this.resolveKnowledgeWorkDir(config.working_directory, backend, name);
-                if (insideManagedWorkspaces(skillsWorkDir))
-                    measureSyncWork("fleet.classicSkills", () => this.syncRoleSkills(skillsWorkDir, backend, "classic"));
-                else
-                    this.logger.debug({ name, skillsWorkDir }, "Classic workspace is not AgEnD-managed — no skills published");
+            else if (kind === "classic") {
+                // #2163: a Classic bot gets only the skills marked `classic` (its own look, the dashboard) — never the fleet's
+                // coordination playbooks (#557 kept those out of end-user bots) — and only into a workspace AgEnD manages: the
+                // room's own folder under <AGEND_HOME>/workspaces/. Anywhere else, nothing is written; `agend-agent skill <name>`
+                // reads any bundled skill on demand.
+                try {
+                    const skillsWorkDir = this.resolveKnowledgeWorkDir(config.working_directory, backend, name);
+                    if (insideManagedWorkspaces(skillsWorkDir))
+                        measureSyncWork("fleet.classicSkills", () => this.syncRoleSkills(skillsWorkDir, backend, "classic"));
+                    else
+                        this.logger.debug({ name, skillsWorkDir }, "Classic workspace is not AgEnD-managed — no skills published");
+                }
+                catch (err) {
+                    this.logger.warn({ err, name, backend }, "Failed to sync classic skills — continuing startup");
+                }
             }
-            catch (err) {
-                this.logger.warn({ err, name, backend }, "Failed to sync classic skills — continuing startup");
+            const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
+            const identity = { kind, backend, model: this.resolveInstanceModel(name).display };
+            if (receipt) {
+                await this.lifecycle.start(name, config, topicMode, identity, transition, execution, daemon => {
+                    // Only this transition's actual publication can acquire its replacement.
+                    receipt.daemon = daemon;
+                });
             }
+            else
+                await this.lifecycle.start(name, config, topicMode, identity, transition, execution);
+            execution?.assert();
+            // Only clear a stale process status after a real start succeeded.  Clearing
+            // it before lifecycle.start() can turn a crash-loop daemon's dead pane into
+            // a falsely running instance when lifecycle.start() returns early.
+            this.instanceProcessStatus.delete(name);
+            // Recovery intent belongs to Daemon.start. lifecycle.start can return
+            // before reaching it, so an await here is not proof the marker was read.
+            // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
+            await this.connectIpcToInstance(name);
+            execution?.assert();
+            this.requestDiscordUsagePresenceRefresh();
+        });
+    }
+    /** A boot's observation cannot settle a replacement boot or a newer attempt of the same instance. */
+    async trackStartupInstance(name, start) {
+        const boot = this.startupDashboard;
+        const owner = boot?.begin(name);
+        if (owner)
+            this.publishStartupStatus();
+        let ready = false;
+        try {
+            await start();
+            ready = this.daemons.has(name);
         }
-        const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
-        const identity = { kind, backend, model: this.resolveInstanceModel(name).display };
-        if (receipt) {
-            await this.lifecycle.start(name, config, topicMode, identity, transition, execution, daemon => {
-                // Only this transition's actual publication can acquire its replacement.
-                receipt.daemon = daemon;
-            });
+        finally {
+            if (boot && owner && this.startupDashboard === boot && boot.finish(name, owner, ready))
+                this.publishStartupStatus();
+        }
+    }
+    publishStartupStatus() {
+        try {
+            this.emitSseEvent("status", this.getUiStatus());
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Startup status unavailable; the next status frame retries");
         }
-        else
-            await this.lifecycle.start(name, config, topicMode, identity, transition, execution);
-        execution?.assert();
-        // Only clear a stale process status after a real start succeeded.  Clearing
-        // it before lifecycle.start() can turn a crash-loop daemon's dead pane into
-        // a falsely running instance when lifecycle.start() returns early.
-        this.instanceProcessStatus.delete(name);
-        // Recovery intent belongs to Daemon.start. lifecycle.start can return
-        // before reaching it, so an await here is not proof the marker was read.
-        // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
-        await this.connectIpcToInstance(name);
-        execution?.assert();
-        this.requestDiscordUsagePresenceRefresh();
     }
     /** Recreate a daemon for a marker-only paused instance after an explicit wake/delivery. */
     async startPersistedPausedInstance(name, transition) {
@@ -5972,6 +6056,11 @@ export class FleetManager {
             revoke: id => {
                 this.webLoginCodes?.revokeAudience(id);
                 this.webGuestLoginCodes?.revokeAudience(id);
+                // #2453 (§0.2): the link's sessions end, and the authorizations kept for them go with them (housekeeping: their
+                // handles can never match again).
+                const ended = new Set(this.webSessions?.list(undefined, r => r.exposureId === id).map(r => r.handle) ?? []);
+                if (ended.size)
+                    this.sessionAuthorizationStore()?.prune(a => !ended.has(a.handle));
                 const result = this.webSessions?.revokeExposure(id);
                 if (result && !result.durable)
                     this.logger.warn("Public session revocation could not be saved; exposure remains closed");
@@ -5992,6 +6081,66 @@ export class FleetManager {
             },
         });
     }
+    publicLinkAutoOpen = null;
+    /**
+     * #named-link-ttl: the admin who last opened a named-tunnel link from /web, with the live binding — only while they
+     * still may own one (publicOwnerCurrent: a fleet admin of a live bot, the same General). Else null.
+     */
+    rememberedPublicOwner() {
+        const saved = readPublicLinkOwner(this.dataDir);
+        if (!saved)
+            return null;
+        const owner = { ...saved, binding: this.adapters.get(saved.adapterId) };
+        return this.publicOwnerCurrent(owner) ? owner : null;
+    }
+    /** A named-tunnel link was privately delivered: auto_open reopens it for this owner after a restart. */
+    rememberPublicLinkOwner(owner) {
+        if (!publicLinkNamedHostname(this.fleetConfig?.web))
+            return;
+        try {
+            writePublicLinkOwner(this.dataDir, owner);
+        }
+        catch (err) {
+            this.logger.warn({ err: err?.message }, "Could not remember the public link's owner; auto_open will not reopen it");
+        }
+    }
+    /** Closed on purpose (Close, /web revoke): a restart must not reopen it. The next /web remembers again. */
+    forgetPublicLinkOwner() {
+        try {
+            clearPublicLinkOwner(this.dataDir);
+        }
+        catch (err) {
+            this.logger.warn({ err: err?.message }, "Could not forget the public link's owner");
+        }
+    }
+    /**
+     * #named-link-ttl: `web.public_link.auto_open` — once per start, after the web listener and the chat connections are
+     * up. Opens the named link with nothing posted (sign-in still needs a code from /web or a returning device); a final
+     * failure goes to its owner once, by DM, drawn as a failed /web is.
+     */
+    startPublicLinkAutoOpen() {
+        this.publicLinkAutoOpen?.stop();
+        const runner = this.publicLinkAutoOpen = new PublicLinkAutoOpen({
+            web: () => this.fleetConfig?.web,
+            ready: () => !this.shuttingDown && this.healthServerListening && this.publicLinkAutoOpen === runner,
+            owner: () => this.rememberedPublicOwner(),
+            open: (owner, onProgress) => this.getPublicWebLink().openUnattended(owner, onProgress),
+            notifyFailed: async (owner, last) => {
+                const adapter = owner.binding;
+                if (this.shuttingDown || !adapter?.sendDirect || !this.publicOwnerCurrent(owner))
+                    return;
+                const outcome = t("dashboard.public_auto_failed");
+                try {
+                    await withinBudget(adapter.sendDirect(owner.userId, last ? renderPublicLinkProgress(last, performance.now(), outcome) : outcome, { disablePreview: true }), performance.now() + 5_000);
+                }
+                catch (err) {
+                    this.logDashboardDmFailure(err);
+                }
+            },
+            log: (event, fields) => this.logger.info({ event, ...fields }, "Public web link"),
+        });
+        runner.start();
+    }
     getPublicWebStatus() {
         return this.publicWebLink?.status() ?? { state: "closed" };
     }
@@ -6175,8 +6324,9 @@ export class FleetManager {
         // Show the action before any link exists. TG's Start instructions belong to confirmed DM refusal below.
         const menuText = this.topicCommands.getDashboardMenuText()
             + (publicAllowed ? "\n" + t("dashboard.public_risk") : "")
-            + (status.state !== "closed" ? "\n" + t("dashboard.public_status", status.state, status.remainingSeconds ?? 0)
-                + (status.expiresAt ? t("dashboard.public_until", formatFleetTime(status.expiresAt)) : "") : "");
+            + (status.state === "closed" ? "" : status.noExpiry ? "\n" + t("dashboard.public_status_no_expiry", status.state)
+                : "\n" + t("dashboard.public_status", status.state, status.remainingSeconds ?? 0)
+                    + (status.expiresAt ? t("dashboard.public_until", formatFleetTime(status.expiresAt)) : ""));
         const choices = [{ action: "local", label: t("dashboard.local_signin") },
             ...(publicLinkSettings(this.fleetConfig?.web).allowed ? [{ action: "public", label: t("dashboard.public_open") }] : []),
             ...(status.state !== "closed" ? [{ action: "close", label: t("dashboard.public_close") }] : [])];
@@ -6223,6 +6373,7 @@ export class FleetManager {
             if (!entry.publicExposureId)
                 return true;
             const result = await this.publicWebLink?.close("admin close", entry.publicExposureId);
+            this.forgetPublicLinkOwner();
             if (result?.confirmed === false)
                 data.ack?.(t("dashboard.public_cleanup"));
             await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("dashboard.public_closed"), data.editClicked);
@@ -6253,10 +6404,11 @@ export class FleetManager {
                 return false;
             this.initializeWebSessions();
             const issued = this.webLoginCodes.issue({ epoch: tokenEpoch(token), audience: exposureId, owner });
-            // Only a public link has a link expiry; the code's five-minute lifetime applies to either packet.
+            // Only a public link has a link expiry (null: none — a named tunnel's ttl_minutes 0); the code's five-minute
+            // lifetime applies to either packet.
             const minutes = Math.round(LOGIN_CODE_TTL_MS / 60_000);
             const text = expiresAt !== undefined
-                ? t("dashboard.private_public", url, issued.display, minutes, formatFleetTime(expiresAt))
+                ? t("dashboard.private_public", url, issued.display, minutes, expiresAt === null ? t("dashboard.public_no_expiry") : formatFleetTime(expiresAt))
                 : t("dashboard.private_local", url, issued.display, minutes);
             const deadline = performance.now() + 10_000;
             const direct = owner.binding;
@@ -6319,6 +6471,8 @@ export class FleetManager {
             // Still closes the step editor below and tells the clicker: a throw must not leave the menu refreshing.
             this.logger.warn({ err }, "Dashboard sign-in delivery failed");
         }
+        if (ok && action === "public")
+            this.rememberPublicLinkOwner(owner);
         // Only safe, static words enter General; never link, code or platform error text.
         // #1742: Telegram's failure walks through opening the DM (never a bare /start, which starts a ClassicBot agent),
         // with the "先開私訊 →" button when the bot's username is known; and for a while a bare /start there counts as
@@ -6343,6 +6497,7 @@ export class FleetManager {
     revokeWebSessions() {
         this.initializeWebSessions();
         void this.publicWebLink?.close("dashboard revoke");
+        this.forgetPublicLinkOwner();
         this.webLoginCodes.revoke();
         this.webGuestLoginCodes.revokeAll();
         this.guestRevokes++; // and every guest /web still on its way
@@ -6944,7 +7099,7 @@ export class FleetManager {
         if (this.updateProgressTimer)
             clearInterval(this.updateProgressTimer);
         const tick = async () => {
-            if (this.updateProgressEditRunning)
+            if (this.updateProgressEditRunning || this.shuttingDown)
                 return;
             const marker = readUpdateProgress(this.dataDir);
             if (!marker) {
@@ -6995,6 +7150,11 @@ export class FleetManager {
                     return;
                 }
             }
+            // #2476: from "starting" onward RestartProgress in the NEW process owns this
+            // message (resume → N/M → ✅ finish). A late CLI-stage edit of "installed" is
+            // what made "✅ 安裝完成" land after "啟動中 N/M". Failure still edits here.
+            if (marker.progress.stage === "starting")
+                return;
             const target = marker.progress.target;
             const adapter = this.adapters.get(target.adapterId) ?? (initialAdapter?.id === target.adapterId ? initialAdapter : undefined);
             if (!adapter)
@@ -7030,11 +7190,46 @@ export class FleetManager {
     }
     /** Start all instances from fleet config */
     async startAll(configPath) {
+        this.startupMemoryDeadline?.stop();
+        const deadline = new StartupMemoryDeadline({
+            current: () => this.startupMemoryDeadline === deadline && !this.shuttingDown,
+            waiting: () => this.spawnGate.isStartupMemoryDeferred(),
+            notify: sdNotify,
+            log: message => this.logger.info(message),
+        });
+        this.startupMemoryDeadline = deadline;
+        // A held first General must not postpone event-loop liveness monitoring.
+        // No independent heartbeat: a genuinely frozen main loop still stops pinging.
+        setSdNotifyWarn((fields, message) => this.logger.warn(fields, message));
+        if (this.watchdogTimer)
+            clearInterval(this.watchdogTimer);
+        this.watchdogTimer = setInterval(() => sdNotify("WATCHDOG=1"), 30_000);
+        this.eventLoopWatch?.stop();
+        this.eventLoopWatch = startEventLoopWatch({ logger: this.logger });
+        try {
+            await this.startAllWithinDeadline(configPath, deadline);
+        }
+        finally {
+            deadline.stop();
+            if (this.startupMemoryDeadline === deadline) {
+                this.startupMemoryDeadline = null;
+                if (!this.startupComplete) {
+                    if (this.watchdogTimer)
+                        clearInterval(this.watchdogTimer);
+                    this.watchdogTimer = null;
+                    this.eventLoopWatch?.stop();
+                    this.eventLoopWatch = null;
+                }
+            }
+        }
+    }
+    async startAllWithinDeadline(configPath, deadline) {
         this.loginWindow.reopen(); // a stopAll → startAll restart must accept login windows again
         this.loginController?.reopen();
         const startupStartedAt = Date.now();
         FleetManager.signalTarget = this;
         this.startupComplete = false;
+        this.startupDashboard = null;
         // Cleared here, not at the end of doStopAll: a stop has an async tail, and
         // anything arriving during it is still part of the stop.
         this.shuttingDown = false;
@@ -7286,7 +7481,7 @@ export class FleetManager {
                 continue;
             this.logger.warn({ adapter: need.adapterId, name }, "No general instance for adapter — auto-creating");
             const generalDir = join(getAgendHome(), name);
-            mkdirSync(generalDir, { recursive: true });
+            mkdirSync(generalDir, { recursive: true, mode: 0o700 });
             const backendName = fleet.defaults.backend ?? "claude-code";
             this.ensureGeneralInstructions(generalDir, backendName, name);
             fleet.instances[name] = {
@@ -7337,6 +7532,13 @@ export class FleetManager {
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
         const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingProgressOperation === "full-restart" ? "reload" : pendingUpdateProgress ? "update" : "restart" });
         this.startupProgress = startupProgress;
+        // Auth, restored chat, Classic roster and the task DB are ready. Listening is not service readiness:
+        // the dashboard observes startup, while /health and READY retain their existing completion boundary.
+        this.startupDashboard = new FleetStartup(this.configuredStartupInstanceNames(fleet, topicMode)
+            .filter(name => !this.lifecycle.isPaused(name)));
+        await this.startHealthServer(fleet.health_port ?? 19280);
+        if (this.shuttingDown)
+            return;
         if (generals.length > 0) {
             for (const [name, cfg] of generals) {
                 try {
@@ -7401,22 +7603,6 @@ export class FleetManager {
                 return startupProgress.start(this.restartProgressTarget());
             });
         }
-        // The systemd watchdog answers exactly one question: is this process still
-        // turning its event loop? Pinging from a timer proves that, and after the
-        // blocking child-process calls were made async it is a meaningful signal —
-        // a deadlocked or frozen fleet stops pinging and systemd restarts it.
-        //
-        // It deliberately does NOT gate on fleet health. "No adapter connected" or
-        // "an instance crashed" must not kill the process: the fleet would be restarted
-        // into the same broken state, and a user who has legitimately stopped every
-        // instance would get a restart loop. Those conditions surface through /health
-        // (which now returns 503) and through the General-topic notifications instead.
-        setSdNotifyWarn((fields, message) => this.logger.warn(fields, message));
-        this.watchdogTimer = setInterval(() => sdNotify("WATCHDOG=1"), 30_000);
-        // #1231: a stalled loop is what turns a slash command into "did not respond";
-        // put each long stall in the log instead of leaving it to be guessed at.
-        this.eventLoopWatch?.stop();
-        this.eventLoopWatch = startEventLoopWatch({ logger: this.logger });
         // EventLog.prune() existed but was never called, so `events` and `activity`
         // grew without bound for the life of the install. Prune once at startup and
         // daily after that; the timer is unref'd so it never holds the loop open.
@@ -7592,9 +7778,9 @@ export class FleetManager {
             }
             // After "fleet ready", so the notice is not the first thing people see of a restart.
             void this.announceWebChatOnce(agendVersion);
+            // #named-link-ttl: a named link with auto_open comes back now — after the web listener and the chat connections.
+            this.startPublicLinkAutoOpen();
         }
-        // Health HTTP endpoint
-        this.startHealthServer(fleet.health_port ?? 19280);
         // #1266: buttons that ended while AgEnD was down (expired, or chosen before a restart) are shown as ended now.
         // #1823: and polls: a deadline that passed meanwhile closes now (results once); an open one's countdown is redrawn.
         void this.replyButtons()?.sweep().catch(err => this.logger.warn({ err }, "Reply-button sweep failed"));
@@ -7611,12 +7797,26 @@ export class FleetManager {
         // A SIGHUP may arrive after the PID/general is available but before the
         // rest of startup finishes. Replay one coalesced reload only after all
         // startup-owned lifecycle work and signal handlers are in place.
+        if (this.shuttingDown || this.startupMemoryDeadline !== deadline)
+            return;
         this.finishStartup(bootUpdateMarker);
+        this.startupDashboard = null;
+        this.publishStartupStatus();
         // Tell systemd we are ready only now. This used to fire right after the
         // generals started — before adapters, classic instances, topic creation and the
         // health server — so `systemctl start` returned success while the fleet was
         // still deaf: no path existed for a user message to arrive.
         sdNotify("READY=1");
+        // #2481: this version runs — the CLI's start-failure banner stops, and this is the version to go back to later.
+        try {
+            const { ownPackage, recordStarted } = await import("./start-failure.js");
+            const version = ownPackage().version;
+            if (version)
+                recordStarted(this.dataDir, version, process.pid, Date.now());
+        }
+        catch (err) {
+            this.logger.debug({ err }, "fleet-started record not written");
+        }
         const health = this.getFleetHealth();
         if (health.status !== "ok") {
             this.logger.warn({ health }, "Fleet started with problems — see /health");
@@ -8035,12 +8235,12 @@ export class FleetManager {
             return;
         }
         const accessDir = join(this.dataDir, "access");
-        mkdirSync(accessDir, { recursive: true });
+        mkdirSync(accessDir, { recursive: true, mode: 0o700 });
         const accessStatePath = join(accessDir, "access.json");
         const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
         this.warnIfAccessModeOverridden(accessManager, accessStatePath);
         const inboxDir = join(this.dataDir, "inbox");
-        mkdirSync(inboxDir, { recursive: true });
+        mkdirSync(inboxDir, { recursive: true, mode: 0o700 });
         const adapterId = channelConfig.id ?? channelConfig.type;
         const adapter = await createAdapter(channelConfig, {
             id: adapterId,
@@ -8186,12 +8386,12 @@ export class FleetManager {
             return;
         }
         const accessDir = join(this.dataDir, "access");
-        mkdirSync(accessDir, { recursive: true });
+        mkdirSync(accessDir, { recursive: true, mode: 0o700 });
         const accessStatePath = join(accessDir, `access-${adapterId}.json`);
         const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
         this.warnIfAccessModeOverridden(accessManager, accessStatePath);
         const inboxDir = join(this.dataDir, "inbox");
-        mkdirSync(inboxDir, { recursive: true });
+        mkdirSync(inboxDir, { recursive: true, mode: 0o700 });
         const adapter = await createAdapter(channelConfig, {
             id: adapterId,
             botToken,
@@ -9623,9 +9823,14 @@ export class FleetManager {
      * history (#1565). #1920 §5.2: said in the instance's topic, General or room, so it is that channel's, by that account.
      */
     emitPlatformInbound(instance, msg, text) {
+        // #2281: where it is on the platform — a web reply to it is then a native reply there. The platform thread it came
+        // from (#1085: a ClassicBot's `threadId` may be its registry key).
+        const thread = msg.transportThreadId ?? msg.threadId;
+        const posts = msg.adapterId && msg.chatId && msg.messageId
+            ? [{ adapterId: msg.adapterId, chatId: msg.chatId, ...(thread && thread !== msg.chatId ? { threadId: thread } : {}), messageId: msg.messageId }] : undefined;
         this.emitSseEvent("message", {
             instance, sender: msg.username, role: "user", text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-            channel: true, from: webChatFrom(msg.adapterId, msg.userId),
+            channel: true, from: webChatFrom(msg.adapterId, msg.userId), ...(posts ? { posts } : {}),
         });
     }
     /** Handle outbound tool calls from a daemon instance */
@@ -9735,6 +9940,13 @@ export class FleetManager {
             this.logger.warn({ sink, instance: instanceName, profile, tool, enforced: true }, "tool-permissions: refused");
             return { allowed: false, message: toolRefusedMessage(profile, tool) };
         }
+        // The person's dashboard switches (dashboard-permissions.ts), on top of the profile, as configured now.
+        // Its own switches, else the defaults' — a ClassicBot identity has no instances entry and runs on the defaults (#2391 review).
+        const switchedOff = dashboardRefusalIn(this.fleetConfig, instanceName, tool);
+        if (switchedOff) {
+            this.logger.warn({ sink, instance: instanceName, profile, tool, enforced: true, dashboard: true }, "tool-permissions: refused");
+            return { allowed: false, message: switchedOff };
+        }
         this.logger.debug({ sink, instance: instanceName, profile, tool, enforced: true }, "tool-permissions: allowed");
         return { allowed: true, message: "" };
     }
@@ -9742,6 +9954,9 @@ export class FleetManager {
         this.touchActivity(instanceName);
         this.setTopicIcon(instanceName, "green");
         const tool = msg.tool;
+        // #1774: who sends this — taken before anything here awaits (sticker checks, the platform send): a reply that waits
+        // must never be read as a same-name replacement's (removed and re-registered meanwhile).
+        const sentBy = tool === "reply" ? this.webChatIdentity(instanceName) : undefined;
         const args = (msg.args ?? {});
         const requestId = msg.requestId;
         const fleetRequestId = msg.fleetRequestId;
@@ -9921,6 +10136,7 @@ export class FleetManager {
                     args.text = `${String(args.text)}\n\n${replyButtonsFallbackText(parsedButtons.buttons)}`;
                 }
             }
+            const replyIdentity = sentBy; // #1774: taken at the handler's entry
             const original = respond;
             const respondAndRecord = (result, error) => {
                 let buttonsView = null;
@@ -9952,12 +10168,13 @@ export class FleetManager {
                     try {
                         // #1920 §5.2: shown to the instance's guests only when it landed in the instance's own topic or room.
                         let inChannel = false;
+                        const replyAdapterId = contextAdapterId ?? this.getInstanceAdapterId(instanceName);
                         try {
                             inChannel = outAdapter !== WEB_ONLY_REPLY_SINK
-                                && this.landedInOwnChannel(instanceName, contextAdapterId ?? this.getInstanceAdapterId(instanceName), result);
+                                && this.landedInOwnChannel(instanceName, replyAdapterId, result);
                         }
                         catch { /* not known: not the channel's (fail closed), and the bookkeeping below still runs */ }
-                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView, inChannel);
+                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView, inChannel, replyAdapterId ? { adapterId: replyAdapterId, result } : undefined, replyIdentity);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -10034,7 +10251,12 @@ export class FleetManager {
             return false;
         }
     }
-    afterReplyRouted(instanceName, args, senderSessionName, buttons = null, inChannel = false) {
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null, inChannel = false, sentAs, identity = this.webChatIdentity(instanceName)) {
+        // #2281: where the reply is, when it landed in the instance's own place — a web reply to it is then a native reply
+        // there. A reply elsewhere (another chat, the web-only sink) records none.
+        const sent = (sentAs?.result && typeof sentAs.result === "object" ? sentAs.result : {});
+        const post = inChannel && sentAs && typeof sent.messageId === "string" && typeof sent.chatId === "string"
+            ? { adapterId: sentAs.adapterId, chatId: sent.chatId, ...(typeof sent.threadId === "string" && sent.threadId ? { threadId: sent.threadId } : {}), messageId: sent.messageId } : undefined;
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -10061,7 +10283,16 @@ export class FleetManager {
         // copies are done, and an instance's replies wait for the one before them: they reach the chat in order.
         const replyFiles = Array.isArray(args.files) ? args.files.filter((f) => typeof f === "string") : [];
         const ts = new Date().toISOString();
-        const show = (attachments) => {
+        // #1774: the instance this reply is for — removed while its files were being copied (a same-name replacement
+        // registered meanwhile included), the reply is no longer its to show: no chat made again, none of the new one's
+        // touched, and the copies made for it go. A replacement's own replies are its own.
+        // Its identity was taken when the reply was sent (identity), never re-read after the platform answered.
+        const current = () => this.webChatIdentityCurrent(instanceName, identity);
+        const show = (attachments, reserved) => {
+            if (!current()) {
+                this.webFiles.dropServed(attachments.map(a => a.id));
+                return;
+            }
             // The one place a delivered agent reply reaches the web chat: the server marks it `agent` (#1306) — the only
             // role that may get HTML preview cards. Never inferred from the sender name or the text.
             this.emitSseEvent("message", {
@@ -10071,18 +10302,25 @@ export class FleetManager {
                 ...(attachments.length ? { attachments } : {}),
                 ...(buttons ? { buttons } : {}), // #1266
                 ...(inChannel ? { channel: true } : {}), // #1920 §5.2
+                ...(post ? { posts: [post] } : {}), // #2281
+                ...(reserved !== undefined ? { reserved } : {}), // #1774
             });
         };
         const before = this.webReplyOrder.get(instanceName);
-        if (!replyFiles.length && !before) {
+        // #1774: a removal of this instance still going decides whether a reply sent before it began is shown — it waits.
+        const removal = this.webChatRemovalPending(instanceName, identity);
+        if (!replyFiles.length && !before && !removal) {
             show([]);
             return Promise.resolve();
         }
+        // #1774: its place in the chat is now — a person's message sent while the files are copied comes after it.
+        const reserved = this.webChatHistory.reserve();
         const done = (before ?? Promise.resolve())
-            .then(() => this.webReplyAttachments(instanceName, replyFiles))
+            .then(() => this.webReplyAttachments(instanceName, replyFiles, current))
+            .then(async (attachments) => { await this.webChatRemovalPending(instanceName, identity); return attachments; })
             .catch((err) => { this.logger.warn({ err, instanceName }, "Reply files could not be prepared for the web chat"); return []; })
             .then((attachments) => { try {
-            show(attachments);
+            show(attachments, reserved);
         }
         catch (err) {
             this.logger.warn({ err, instanceName }, "Reply could not be shown in the web chat");
@@ -10097,11 +10335,13 @@ export class FleetManager {
      * the copy. One the copy refuses (a symlink, not a regular file, over 50 MB, a state file, missing) is not shown;
      * one that could not be copied (I/O) is served from the agent's own path, as before — until the fleet restarts.
      */
-    async webReplyAttachments(instanceName, paths) {
+    async webReplyAttachments(instanceName, paths, current = () => true) {
         const home = getAgendHome();
         const dir = webFilesDir(home, instanceName);
         const out = [];
         for (const path of paths) {
+            if (!current())
+                break; // #1774: removed meanwhile — copy no more for it
             const id = randomBytes(16).toString("hex");
             const got = dir ? await snapshotReplyFile(path, dir, id, { stateDir: home, maxDirBytes: this.webReplyMaxBytes }) : null;
             if (got && "evicted" in got && got.evicted.length)
@@ -11353,6 +11593,7 @@ export class FleetManager {
     saveFleetConfig(explicitPatches = []) {
         this.publicWebLink?.refresh();
         this.enforceGuestSwitch(); // #1920: a Settings save turning guests off ends their sessions
+        this.observeWebAuthority(); // #2453 review: so is a web-authority switch (off is always seen)
         if (!this.fleetConfig || !this.configPath)
             return;
         if (!this.savedFleetConfigSnapshot)
@@ -11643,10 +11884,27 @@ export class FleetManager {
         // Capture instance dir BEFORE lifecycle.remove, which deletes the instance
         // from fleetConfig. (The backend would be unresolvable afterwards.)
         const instanceDirToClean = this.getInstanceDir(name);
-        if (execution)
-            await this.lifecycle.remove(name, authorization, execution, transition);
-        else
-            await this.lifecycle.remove(name, authorization);
+        // #1774: replies sent from here on are a later instance's (a replacement registered while this one goes); the ones
+        // sent before wait for the outcome before they are shown.
+        const removedBelow = this.webChatGeneration(name) + 1, removedDaemon = this.daemons.get(name);
+        this.webChatGenerations.set(name, removedBelow);
+        let settleRemoval;
+        const removalPending = { below: removedBelow, ...(removedDaemon !== undefined ? { daemon: removedDaemon } : {}), done: new Promise(r => { settleRemoval = r; }) };
+        this.webChatRemovalsPending.set(name, removalPending);
+        try {
+            if (execution)
+                await this.lifecycle.remove(name, authorization, execution, transition);
+            else
+                await this.lifecycle.remove(name, authorization);
+            // #1774: removed — its replies still copying their files are no one's to show, replaced or not (a failed removal
+            // throws above: its replies stay its own).
+            this.webChatRemovals.set(name, { below: removedBelow, ...(removedDaemon !== undefined ? { daemon: removedDaemon } : {}) });
+        }
+        finally {
+            if (this.webChatRemovalsPending.get(name) === removalPending)
+                this.webChatRemovalsPending.delete(name);
+            settleRemoval();
+        }
         // A later same-name registration owns its files and caches.
         // Own keys only: an instance named "constructor" is removed as any other (its inherited namesake is not a
         // re-registration) — #1677 review.
@@ -12342,7 +12600,7 @@ export class FleetManager {
     /** A preview under the inbox, named by a hash of the id (a Telegram file_id is long), pruned after a day. */
     storeStickerPreview(id, picture) {
         const dir = join(this.dataDir, "inbox", "sticker-previews");
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
         const now = Date.now();
         for (const name of readdirSync(dir)) {
             try {
@@ -12408,7 +12666,7 @@ export class FleetManager {
         if (!/^\d{15,25}$/.test(id))
             throw new Error("not a Discord emoji id");
         const dir = join(this.dataDir, "inbox", "emoji-previews");
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
         const now = Date.now();
         for (const name of readdirSync(dir)) {
             try {
@@ -13043,7 +13301,7 @@ export class FleetManager {
         const board = this.scheduler?.db.board;
         if (!board)
             return;
-        const read = board.summaryRead(since.toISOString(), until.toISOString());
+        const read = board.summaryRead(since.toISOString(), until.toISOString(), this.dispatcherGone);
         const projects = board.listProjects(true);
         const stats = board.projectStats();
         const names = new Map(projects.map((p) => [p.id, p.name]));
@@ -13823,9 +14081,9 @@ export class FleetManager {
         return classic ? { chatId: classic } : null;
     }
     /**
-     * #2352: the instance whose own channel lists a waiting card — the instance that handed it out, else its project's
-     * lead — when that channel can be used now (a fleet instance of a live world, with a topic or room). undefined: its
-     * assignee's world's General, as before.
+     * #2352: the instance whose own channel lists a waiting card — its project's lead — when that channel can be used now
+     * (a fleet instance of a live world, with a topic or room). undefined: its assignee's world's General, as before.
+     * #2434: only a card the person handed out waits for them, so the instance that handed one out is never its lane.
      */
     needsYouLane(card, leads) {
         const usable = (name) => {
@@ -13834,9 +14092,6 @@ export class FleetManager {
             const world = this.getInstanceAdapterId(name);
             return world !== undefined && this.worlds.has(world) && this.instanceChannelTarget(name) !== null;
         };
-        const dispatcher = card.dispatcher?.kind === "instance" && card.dispatcher.name !== card.assignee ? card.dispatcher.name : null;
-        if (dispatcher)
-            return usable(dispatcher) ? dispatcher : undefined;
         const lead = card.projectId != null ? leads.get(card.projectId) : null;
         return usable(lead) ? lead : undefined;
     }
@@ -13844,12 +14099,24 @@ export class FleetManager {
      * #2355 review: where a card's Needs you buttons belong now — read from the board and the fleet at the moment of a click
      * or a reply, never from the last render. null: it no longer waits for the person.
      */
+    /**
+     * #2425 follow-up: an instance that handed out a card and is no longer in the fleet — neither a configured instance nor
+     * a ClassicBot identity (deleted). Its blocked and in-review cards fall back to the person (Needs you, the summary).
+     * Not known before the config and the ClassicBot rooms are loaded: then no one is gone (a live dispatcher's cards never
+     * flash into the person's list at startup).
+     */
+    dispatcherGone = (name) => {
+        const instances = this.fleetConfig?.instances, classic = this.classicChannels;
+        if (!instances || !classic)
+            return false;
+        return !Object.hasOwn(instances, name) && !classic.getAll().some((ch) => ch.instanceName === name);
+    };
     needsYouRoute(code) {
         const board = this.scheduler?.db.board;
         const card = board?.findCard(code);
         // #2425 (Fable): the same rule as the list — a button rendered before the fix (or before the opt-in went off) for a
         // card that no longer waits for the person answers "no longer waits".
-        if (!board || !card || this.fleetConfig?.needs_you?.task_board !== true || !waitsForPerson(card))
+        if (!board || !card || this.fleetConfig?.needs_you?.task_board !== true || !waitsForPerson(card, this.dispatcherGone))
             return null;
         const leads = new Map(board.listProjects(true).map((p) => [p.id, p.leadInstance]));
         const lane = this.needsYouLane(card, leads);
@@ -13857,7 +14124,7 @@ export class FleetManager {
     }
     /**
      * #2246 step 3: the task board's cards that wait for the person, for Needs you — under each card's assignee, listed in
-     * its lane's channel (#2352: the instance that handed it out, else the project's lead), else in General.
+     * its lane's channel (#2352: its project's lead; #2434: never the instance that handed it out), else in General.
      */
     needsYouTaskItems() {
         // #2425: the task board's cards join Needs you only when the fleet asks for them (needs_you.task_board, off by
@@ -13869,7 +14136,7 @@ export class FleetManager {
         if (!board)
             return [];
         const leads = new Map(board.listProjects(true).map((p) => [p.id, p.leadInstance]));
-        return board.waitingForPerson().map(({ card, since }) => {
+        return board.waitingForPerson(this.dispatcherGone).map(({ card, since }) => {
             const gap = card.status === "review" ? wrapUpGap(card) : null;
             const lane = this.needsYouLane(card, leads);
             return {
@@ -14304,7 +14571,7 @@ export class FleetManager {
             ...(input.instance !== undefined ? { target: { adapterId: this.getInstanceAdapterId(input.instance) } } : {}),
             isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
             authorization: input.session ? this.sessionAuthorizationStore()?.get(input.session.handle) ?? null : null,
-            policy: { ...webAuthorityPolicy(this.fleetConfig?.web), enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now: Date.now(),
+            policy: { ...webAuthorityPolicy(this.fleetConfig?.web), enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink }, epoch: state.epoch, now: Date.now(),
         });
     }
     sessionAuthorizations = null;
@@ -14329,7 +14596,7 @@ export class FleetManager {
             session, gateway, peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
             isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
             authorization: { handle: session.handle, owner: session.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch },
-            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now,
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink }, epoch: state.epoch, now,
         });
         if (check.refusal)
             return { ok: false, refusal: check.refusal };
@@ -14344,9 +14611,30 @@ export class FleetManager {
      */
     webAuthorityState() {
         if (!this.dataDir)
-            return { enabled: false, loopbackOnly: true, epoch: 0 };
+            return { enabled: false, loopbackOnly: true, namedLink: false, epoch: 0 };
         this.authorityStateStore ??= new AuthorityStateStore(join(this.dataDir, "web-authority.json"), this.logger, undefined, undefined, () => { this.ensureDeliveryOutbox?.(); return this.deliveryOutbox?.maxWebAuthorityEpoch() ?? 0; });
-        return this.authorityStateStore.current(this.fleetConfig?.web?.verified_authority);
+        const state = this.authorityStateStore.current(this.fleetConfig?.web?.verified_authority);
+        // #2453 (§0.2): the named-link option seen going off — the authority of every session over the link ends now, for
+        // good: their authorizations go (a later "on" can never bring one back without its account's Confirm).
+        if (state.namedLinkClosed)
+            this.sessionAuthorizationStore()?.prune(a => this.webSessions?.findByHandle(a.handle)?.surface === "local");
+        return state;
+    }
+    /**
+     * #2453 review: the web-authority state read on every configuration change (a Settings save, the host's confirm, a
+     * reload) — so a switch turned off and on again between two requests is still seen off: its epoch moves, and the
+     * named-link sessions' authorizations are dropped. Reads that only happen on a request would miss it.
+     */
+    observeWebAuthority() {
+        // Only once the state is in use: any authorization was given through a read that made it (and a first read at
+        // start-up still sees what changed while the fleet was down). Nothing new is opened during a load.
+        try {
+            if (this.dataDir && this.authorityStateStore)
+                this.webAuthorityState();
+        }
+        catch (err) {
+            this.logger.warn({ err: err?.message }, "Web authority state could not be read after a configuration change");
+        }
     }
     /**
      * #1939 S2a: Settings → Web → Web authority — the state in force (the switch counts as off while its state cannot be
@@ -14361,8 +14649,10 @@ export class FleetManager {
         const authorized = state.enabled ? (this.sessionAuthorizationStore()?.list() ?? [])
             .filter(a => a.epoch === state.epoch && sessions.has(a.handle) && now <= Math.min(a.until, a.authorizedAt + maxMs))
             .map(a => ({ handle: a.handle, label: sessions.get(a.handle).label, account: `${a.owner.adapterId}:${a.owner.userId}`, authorizedAt: a.authorizedAt,
-            until: Math.min(a.until, a.authorizedAt + maxMs, sessions.get(a.handle).absoluteExpiry) })) : [];
-        return { state, configured, hours: VERIFIED_SESSION_HOURS, lanHosts, authorized };
+            until: Math.min(a.until, a.authorizedAt + maxMs, sessions.get(a.handle).absoluteExpiry),
+            ...(sessions.get(a.handle).surface === "gateway" ? { named: true } : {}) })) : [];
+        const host = this.fleetConfig?.web?.public_link?.hostname;
+        return { state, configured, hours: VERIFIED_SESSION_HOURS, lanHosts, authorized, namedHost: typeof host === "string" && host ? host : null };
     }
     authorizationRequests = null;
     /**
@@ -14375,7 +14665,9 @@ export class FleetManager {
         const adapterOf = (adapterId) => this.adapters.get(adapterId) ?? this.worlds.get(adapterId)?.adapter;
         // The host's clock, with its zone: the person may read the DM on a phone in another one.
         const when = (ms) => new Date(ms).toLocaleString(undefined, { timeZoneName: "short" });
-        const where = (peer) => t(peer === "loopback" ? "web_auth.peer_loopback" : "web_auth.peer_lan");
+        const where = (peer) => peer === "named_link"
+            ? t("web_auth.peer_named_link", String(this.fleetConfig?.web?.public_link?.hostname ?? "?")) // §0.2: the internet
+            : t(peer === "loopback" ? "web_auth.peer_loopback" : "web_auth.peer_lan");
         return this.authorizationRequests = new SessionAuthorizationRequests({
             now: () => performance.now(), wallNow: () => Date.now(),
             maxSessionMs: () => webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs,
@@ -14409,7 +14701,8 @@ export class FleetManager {
                 const record = this.webSessions?.findByHandle(handle);
                 if (!record)
                     return { ok: false, refusal: "session_gone" };
-                const r = this.authorizeWebSession(record, peer, false);
+                // §0.2: a named-link session is judged as the gateway request it is (its exposure still the current one).
+                const r = this.authorizeWebSession(record, peer, peer === "named_link");
                 // What the card says: the end of the authorization, or the session's own end when that comes first.
                 return r.ok ? { ok: true, until: Math.min(r.authorization.until, record.absoluteExpiry) } : { ok: false, refusal: r.refusal };
             },
@@ -14455,7 +14748,7 @@ export class FleetManager {
             session: s, gateway: input.gateway, peer: input.peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
             isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
             authorization: s?.owner ? { handle: s.handle, owner: s.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch } : null,
-            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now,
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink }, epoch: state.epoch, now,
         });
         return r.refusal;
     }
@@ -15211,7 +15504,7 @@ export class FleetManager {
                 }
             }
             this.persistCancelButtons();
-            this.logger.info({ instanceName, messageId: sent.messageId }, "Cancel button sent");
+            this.logger.debug({ instanceName, messageId: sent.messageId }, "Cancel button sent"); // #2482: per-turn bookkeeping
             // Retirement is normally edge-triggered, but the edge (or an explicit
             // reply/cancel clear) may have happened while notifyAlert was in flight.
             // Reconcile the level after publication so a late button cannot resurrect
@@ -15477,7 +15770,8 @@ export class FleetManager {
         this.deleteButtonMessage(entry)
             .then(() => {
             this.discardButton(entry);
-            this.logger.info({ instanceName: entry.instanceName, messageId: entry.messageId, historyPreserved: Boolean(entry.toolProgress) }, "Cancel button retired");
+            this.logger.debug(// #2482: per-turn bookkeeping
+            { instanceName: entry.instanceName, messageId: entry.messageId, historyPreserved: Boolean(entry.toolProgress) }, "Cancel button retired");
         })
             .catch((err) => this.scheduleButtonRetry(entry, err));
     }
@@ -16566,8 +16860,12 @@ export class FleetManager {
                 from: m.from,
                 replyTo: m.replyTo,
                 cards: m.cards,
+                posts: m.posts, // #2281: kept beside the row, never broadcast (not a row field)
+                reserved: m.reserved, // #1774: an agent reply's place, taken when it was sent
             });
-            broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
+            // A sending page's own id for its pending bubble rides on the live copy only: never recorded, never replayed.
+            const clientId = typeof data.clientId === "string" ? data.clientId : "";
+            broadcastSseEvent(this.sseClients, event, clientId ? { ...recorded, clientId } : recorded, onError, this.webChatHistory.cursorOf(recorded));
             this.searchIndex?.record(chatDoc(recorded));
             // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
             if (recorded.role === "agent")
@@ -16603,7 +16901,8 @@ export class FleetManager {
                 if (this.fleetConfig?.needs_you?.live_message === false)
                     return false;
                 const card = db.board.findCard(uuid);
-                if (!card)
+                // #2434: only while it waits for the person — a card that does not is in no Needs you, so no buttons anywhere.
+                if (!card || !waitsForPerson(card, this.dispatcherGone))
                     return false;
                 const leads = new Map(db.board.listProjects(true).map((p) => [p.id, p.leadInstance]));
                 return this.needsYouLane(card, leads) === instance;
@@ -16952,6 +17251,47 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * migration exception is the pre-manifest Kiro General layout explicitly
      * selected by adoptLegacyUnmanaged.
      */
+    /**
+     * #2482: the user's own skills that shadow bundled ones, said once per directory and change — not once per name on
+     * every start (11 lines a start on the host). The record (`skipped-skills.json` in the AgEnD home) keeps what was said
+     * across restarts; a new name or an edited SKILL.md is said again.
+     */
+    reportSkippedSkills(destSkills, names) {
+        const signature = names.map(name => {
+            let content = "";
+            try {
+                content = readFileSync(join(destSkills, name, "SKILL.md"), "utf-8");
+            }
+            catch { /* gone: its name alone */ }
+            return `${name}:${createHash("sha256").update(content).digest("hex").slice(0, 16)}`;
+        }).join(",");
+        if (this.skippedSkillsSaid.get(destSkills) === signature)
+            return;
+        this.skippedSkillsSaid.set(destSkills, signature);
+        const path = join(this.dataDir, "skipped-skills.json");
+        // Only a log's memory: whatever is in the file (missing, corrupt, any other shape) never stands in the sync's way
+        // (#2493 review) — a record that cannot be read is no record, and the warning is said.
+        const record = Object.create(null);
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                for (const [key, value] of Object.entries(parsed))
+                    if (typeof value === "string")
+                        record[key] = value;
+            }
+        }
+        catch { /* none yet, or unreadable */ }
+        if (Object.hasOwn(record, destSkills) && record[destSkills] === signature) {
+            this.logger.debug({ skills: names, destSkills }, "Skipping bundled skills — unchanged since it was last said");
+            return;
+        }
+        record[destSkills] = signature;
+        try {
+            writeFileSync(path, JSON.stringify(record) + "\n");
+        }
+        catch { /* said this time; said again next start */ }
+        this.logger.warn({ skills: names, destSkills }, "Skipping bundled skills — skills of these names exist but were not published by AgEnD");
+    }
     syncManagedSkills(destSkills, srcSkills, role, adoptLegacyUnmanaged = false, confined) {
         if (!existsSync(srcSkills))
             return;
@@ -17001,16 +17341,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return role === "general" || roles.includes(role);
         });
         const managed = [];
+        const skipped = [];
         for (const name of eligible) {
             const destDir = join(destSkills, name);
             const dest = join(destDir, "SKILL.md");
             const isOurs = previouslyManaged.includes(name) || !existsSync(destDir);
             if (!isOurs) {
-                // The user's skill still wins on every sync; only the warning is deduped.
-                if (!this.skippedBundledSkills.has(name)) {
-                    this.skippedBundledSkills.add(name);
-                    this.logger.warn({ skill: name, destSkills }, "Skipping bundled skill — a skill of this name exists but was not published by AgEnD");
-                }
+                // The user's skill still wins on every sync; only the warning is deduped (#2482: one line per directory, and
+                // only when what is skipped there changed since it was last said — across restarts too).
+                skipped.push(name);
                 continue;
             }
             managed.push(name);
@@ -17025,6 +17364,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             mkdirSync(destDir, { recursive: true });
             writeFileSync(dest, newContent);
         }
+        if (skipped.length)
+            this.reportSkippedSkills(destSkills, skipped);
         // Remove managed skills that are no longer bundled OR no longer eligible
         // for this role. This makes a shared → general-only metadata change take
         // effect on the next worker startup instead of leaving stale capability.
@@ -17356,7 +17697,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             try {
                 const tmpPath = await dlAdapter.downloadAttachment(att.fileId);
                 const inboxDir = join(getAgendHome(), "workspaces", instanceName, "inbox");
-                mkdirSync(inboxDir, { recursive: true });
+                mkdirSync(inboxDir, { recursive: true, mode: 0o700 });
                 const dest = join(inboxDir, basename(tmpPath));
                 // Copy to destination — failure means this attachment is skipped
                 try {
@@ -17768,7 +18109,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }
         const path = this.cliEnvPath(backend, profile);
-        mkdirSync(dirname(path), { recursive: true });
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
         writeFileSync(path, JSON.stringify(env, null, 2));
         return env;
     }
@@ -19467,19 +19808,43 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     tmuxExecHelperTimer = null;
     stopAllInFlight = null;
+    /** Stops release memory. Reassess between batches without waiting for recovery. */
+    async stopInstancesInBatches(entries, stop) {
+        let index = 0;
+        while (index < entries.length) {
+            // Linux procfs can still be read after the periodic sampler is stopped.
+            // Do not revive a stopped Darwin probe/worker just to size a quit batch;
+            // its full shutdown uses the conservative batch size instead.
+            const level = this.memoryPressure.platform === "darwin"
+                ? this.shuttingDown ? "elevated" : this.memoryPressure.snapshot().level
+                : this.memoryPressure.sample().level;
+            const size = fleetStopConcurrency(entries.length, level);
+            const batch = entries.slice(index, index + size);
+            index += batch.length;
+            await Promise.allSettled(batch.map(stop));
+        }
+    }
     async doStopAll() {
+        this.startupMemoryDeadline?.stop();
+        this.startupMemoryDeadline = null;
         this.startupComplete = false;
+        this.startupDashboard = null;
         this.reloadPending = false;
         // Before anything is stopped: everything that dies from here on dies
         // because we asked it to. Set synchronously — doStopAll runs to its first
         // await in the same tick as the signal handler, so no event can slip in.
         this.shuttingDown = true;
+        if (this.updateProgressTimer) {
+            clearInterval(this.updateProgressTimer);
+            this.updateProgressTimer = null;
+        }
         this.settingsGeneration++;
         this.settingsConfirmation?.store.close();
         this.settingsConfirmation = null;
         const settingsControl = this.settingsControl;
         this.settingsControl = null;
         const settingsControlStopped = settingsControl?.close();
+        this.publicLinkAutoOpen?.stop();
         const publicStopped = this.publicWebLink?.close("fleet shutdown");
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
@@ -19630,21 +19995,17 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // tmux ops, while small fleets stay conservative to avoid overwhelming the
         // tmux server.
         const entries = [...this.daemons.entries()];
-        const STOP_CONCURRENCY = entries.length > 30 ? 15 : entries.length >= 10 ? 10 : 5;
         for (const [name] of entries)
             this.ipcStoppingInstances.add(name);
-        for (let i = 0; i < entries.length; i += STOP_CONCURRENCY) {
-            const batch = entries.slice(i, i + STOP_CONCURRENCY);
-            await Promise.all(batch.map(async ([name, daemon]) => {
-                try {
-                    await daemon.stop();
-                }
-                catch (err) {
-                    this.logger.warn({ name, err }, "Stop failed");
-                }
-                this.daemons.delete(name);
-            }));
-        }
+        await this.stopInstancesInBatches(entries, async ([name, daemon]) => {
+            try {
+                await daemon.stop();
+            }
+            catch (err) {
+                this.logger.warn({ name, err }, "Stop failed");
+            }
+            this.daemons.delete(name);
+        });
         // Close IPC clients in parallel — serial close over a large fleet adds
         // noticeable latency.
         await Promise.all([...this.instanceIpcClients.values()].map(ipc => Promise.resolve(ipc.close()).catch(() => { })));
@@ -19855,6 +20216,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.rawFleetConfig = previousRawConfig;
             this.rawFleetDocument = previousRawDocument;
             this.savedFleetConfigSnapshot = previousSavedSnapshot;
+            this.observeWebAuthority(); // #2453 review: the configuration back in force is the one seen
             this.logger.error({
                 oldCount,
                 newCount,
@@ -19953,8 +20315,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // so an old/new diff alone can miss the live daemon's stale value.
         for (const [name, config] of Object.entries(newInstances)) {
             if (!this.daemons.has(name)) {
-                // New instance — startInstance already calls connectIpcToInstance
-                this.logger.info({ name }, "New instance in config — starting");
+                // New instance — startInstance already calls connectIpcToInstance. #2482: a paused one is not started (startInstance
+                // returns at its pause); say so, quietly, instead of "starting" on every reload.
+                if (this.lifecycle.isPaused(name))
+                    this.logger.debug({ name }, "Paused instance in config — not started");
+                else
+                    this.logger.info({ name }, "New instance in config — starting");
                 observe?.(name, "restart", "running");
                 await this.startInstanceUnattended(name, config, topicMode, "new instance");
                 observe?.(name, "restart", "done");
@@ -19963,6 +20329,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 const daemon = this.daemons.get(name);
                 const runtimeConfig = daemon.getConfigSnapshot?.() ?? oldConfig.instances[name];
                 const change = classifyInstanceChange(runtimeConfig, config);
+                // (b) The person switched its task board on: tell it (its tool list shows the `task` tool at once).
+                if (taskBoardSwitchedOn(runtimeConfig.dashboard, config.dashboard)) {
+                    this.admitTaskBoardNotice(name, TASK_BOARD_ON_NOTICE, `task-board-on:${name}:${Date.now()}`);
+                }
                 if (change === "restart") {
                     this.logger.info({ name }, "Instance config changed — restarting");
                     observe?.(name, "restart", "running");
@@ -21436,7 +21806,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await ipc.close();
         }
         this.instanceIpcClients.clear();
-        await Promise.allSettled(instanceNames.map(name => this.stopInstance(name)));
+        await this.stopInstancesInBatches(instanceNames, name => this.stopInstance(name));
         // Kill remaining orphan windows to prevent stale state on restart
         try {
             const agendNames = new Set(instanceNames);
@@ -21757,6 +22127,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (this.guestScope(owner).size)
             return "ok";
         if (owner && this.fleetConfig?.web?.guests?.enabled === true) {
+            // Before adapters initialize, topic scope is unknown, not revoked. Keep the returning cookie but grant no
+            // request until its configured world exists. Removed connections and initialized denied access stay final.
+            const channels = this.fleetConfig.channels ?? (this.fleetConfig.channel ? [this.fleetConfig.channel] : []);
+            if (this.startupDashboard && !this.worlds.has(owner.adapterId)
+                && channels.some(channel => (channel.id ?? channel.type) === owner.adapterId))
+                return "pending";
             const members = this.guestRooms(), rooms = guestGroupRooms(this.classicChannels?.getAll() ?? [], owner);
             if (rooms.some((room) => members.pending(room, owner.userId))) {
                 void this.refreshGuestRooms(owner, { mode: "triggered" }); // rate-limited per room (30 s), single-flight
@@ -21855,7 +22231,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 res.end(JSON.stringify({ error: WEB_HOST_REJECTED_MESSAGE }));
                 return;
             }
-            if (closing) {
+            if (closing || this.shuttingDown) {
                 res.writeHead(503, { Connection: "close", "Retry-After": "10" });
                 res.end(JSON.stringify({ error: "fleet stopping" }));
                 return;
@@ -21903,6 +22279,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 // #1920: a guest reaches only GUEST_ROUTES, within the scope derived for it now — default deny, before any
                 // handler, on this listener and the public link's gateway alike (both come through here).
                 if (decision.via === "session" && decision.session.tier === "guest") {
+                    // A browser opening a page gets a page in its language, not the JSON an API caller gets (#2399 smoke).
+                    const navigating = req.method === "GET" && String(req.headers.accept ?? "").includes("text/html") && isWebPageNavigation(requestPath);
                     const owner = decision.session.owner;
                     const admitted = decision.session;
                     const admission = this.guestAdmission(admitted);
@@ -21913,12 +22291,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                         return;
                     }
                     if (admission === "gone") {
+                        if (navigating) {
+                            serveGuestRefusedPage(res, 401, "ended");
+                            return;
+                        }
                         res.writeHead(401);
                         res.end(JSON.stringify({ error: "guest_scope_empty" }));
                         return;
                     }
                     const verdict = guestRouteDecision(req.method ?? "GET", parsedUrl, this.guestScope(owner));
                     if (verdict.kind === "deny") {
+                        if (navigating) {
+                            serveGuestRefusedPage(res, verdict.status, "members");
+                            return;
+                        }
                         res.writeHead(verdict.status);
                         res.end(JSON.stringify({ error: verdict.error }));
                         return;
@@ -21951,6 +22337,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 res.end(JSON.stringify(health));
                 return;
             }
+            // Threat: lifecycle/config/chat writes racing boot-owned starts and reconciliation. Reads stay live;
+            // authentication keeps its own checks so a browser can sign in or sign out while agents start.
+            if (this.startupDashboard && !["GET", "HEAD", "OPTIONS"].includes(req.method ?? "GET")
+                && !requestPath.startsWith("/auth/")) {
+                res.writeHead(503, { "Retry-After": "2", "Cache-Control": "no-store", Connection: "close" });
+                res.end(JSON.stringify({ code: "fleet_starting", error: t("fleet.starting_retry") }));
+                return;
+            }
             if (req.method === "GET" && req.url === "/status") {
                 const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => {
                     const statusFile = join(this.getInstanceDir(name), "statusline.json");
@@ -22221,6 +22615,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
     }
     startHealthServer(port) {
+        let settled;
+        const listening = new Promise(resolve => { settled = resolve; });
         this.startedAt = Date.now();
         this.healthServerListening = false;
         this.healthPortRetried = false;
@@ -22235,6 +22631,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const drain = trackWebServer(server);
         this.healthServer = server;
         this.healthServerDrain = drain;
+        server.once("close", settled);
         const markListening = (afterTakeover = false) => {
             this.healthServerListening = true;
             this.logger.info({ port }, afterTakeover
@@ -22248,6 +22645,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // #1306: the preview listener starts once the web listener is bound — its frame-ancestors name the real port.
             const bound = this.healthServer?.address();
             this.startPreviewListener(port, bound && typeof bound === "object" ? bound.port : port);
+            settled();
         };
         this.healthServer.on("error", (err) => {
             this.healthServerListening = false;
@@ -22255,6 +22653,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 if (this.healthPortRetried) {
                     this.logger.error({ err, port }, "Health port still in use after takeover — dashboard disabled");
                     this.notifyFleetError(t("dashboard.port_in_use", port));
+                    settled();
                     return;
                 }
                 this.healthPortRetried = true;
@@ -22290,16 +22689,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     this.logger.debug({ err }, "Old fleet process kill skipped (already gone or no permission)");
                 }
                 setTimeout(() => {
-                    if (!this.healthServer)
+                    if (this.healthServer !== server || this.shuttingDown) {
+                        settled();
                         return;
-                    this.healthServer.listen(port, "127.0.0.1", () => markListening(true));
+                    }
+                    server.listen(port, "127.0.0.1", () => markListening(true));
                 }, 1500);
                 return;
             }
             this.logger.error({ err, port }, "Health server error");
             this.notifyFleetError(t("dashboard.server_failed", err.message));
+            settled();
         });
         this.healthServer.listen(port, "127.0.0.1", () => markListening());
+        return listening;
     }
     /**
      * #1306: the preview listener, beside the web listener and closed with it. When it cannot listen (the port is
@@ -22528,6 +22931,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return {
             canvas_worker: this.canvasWorkerEnabled(),
             instances,
+            startup: this.startupDashboard?.snapshot() ?? null,
             publicLink: this.getPublicWebStatus(),
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
             // #1519 P7: how many chat connections are configured — 0 is a web-only fleet, which gets the first-run card.