@songsid/agend 2.3.2-beta.5 → 2.3.2-beta.6

package/dist/fleet-manager.js

@@ -1,5 +1,5 @@
 import { hasLegacyOffice, normalizeOfficeStorage } from "./dashboard-permissions.js";
-import { loginNoticeMode, tipNoticeMode, normalizeNoticeDelivery, setNoticeMode } from "./notice-delivery.js";
+import { loginNoticeMode, normalizeNoticeDelivery, setNoticeMode } from "./notice-delivery.js";
 import { DEFAULT_REPLY_TRIGGERS } from "./reply-triggers.js";
 import { WorkingRecoveryCoordinator, WORKING_RECOVERY_KIND, buildWorkingRecoveryPrompt } from "./working-recovery.js";
 import { PUBLIC_TUNNEL_TOKEN_ENV, PUBLIC_TUNNEL_TOKEN_HINT, normalizePublicTunnelToken } from "./public-tunnel-config.js";
@@ -22,6 +22,9 @@ import { PublicLinkAutoOpen } from "./public-link-auto-open.js";
 import { clearPublicLinkOwner, readPublicLinkOwner, writePublicLinkOwner } from "./public-link-owner.js";
 import { PUBLIC_PREVIEW_FRAME_SRC, PUBLIC_PREVIEW_TUNNEL_DIR, PublicPreview, publicPreviewWanted } from "./public-preview.js";
 import { CloudflaredProvider } from "./tunnel/cloudflared.js";
+import { ensureCloudflared } from "./tunnel/cloudflared-install.js";
+import { OFFICE_SHARE_TUNNEL_DIR, OfficeShareService } from "./office-share-service.js";
+import { ALL_OFFICES } from "./office-share.js";
 import { TunnelPurposeLane } from "./tunnel/purpose-lane.js";
 import { ManagedTunnel } from "./tunnel/manager.js";
 import { withinBudget } from "./monotonic-budget.js";
@@ -627,6 +630,7 @@ export class FleetManager {
     workingRecovery = null;
     workingRecoveryTimer = null;
     workingRecoveryCause = "unknown_interruption";
+    workingRecoveryGroup = this.managerBootId;
     recoveryEnabled(name) {
         const own = this.fleetConfig?.instances[name]?.resume_interrupted_work;
         return own ?? this.fleetConfig?.defaults?.resume_interrupted_work ?? true;
@@ -667,7 +671,16 @@ export class FleetManager {
                 const deferredAdvisories = rows.filter(row => row.outcome === "deferred"
                     && (this.daemons.get(row.instance)?.getWorkingRecoveryState?.().background ?? null) === null)
                     .map(row => `${row.instance} (${row.reason})`);
-                store.summary(group, () => outbox.admitSystemNotice(general, `working-recovery-summary:${group}`, `[system:working-recovery-summary] Observed cause: unknown interruption${this.workingRecoveryCause === "unknown_interruption" ? "" : `; prior requested action: ${this.workingRecoveryCause}`}. ${rows.length} interrupted instances; continuation queued ${rows.filter(r => r.outcome === "admitted").length}, excluded ${rows.filter(r => r.outcome === "excluded").length}, still deferred ${rows.filter(r => r.outcome === "deferred").length}. ${rows.filter(r => r.reason === "advisory_background_unknown").length ? `Advisory, background unknown: ${rows.filter(r => r.reason === "advisory_background_unknown").map(r => r.instance).join(", ")}. ` : ""}${deferredAdvisories.length ? `Deferred advisory candidates (background unknown; all other gates still apply): ${deferredAdvisories.join(", ")}. ` : ""}Details are in the Log. Deferred work remains eligible; no action or confirmation is requested.`));
+                const posted = store.summary(group, () => outbox.admitSystemNotice(general, `working-recovery-summary:${group}`, `[system:working-recovery-summary] Observed cause: unknown interruption${this.workingRecoveryCause === "unknown_interruption" ? "" : `; prior requested action: ${this.workingRecoveryCause}`}. ${rows.length} interrupted instances; continuation queued ${rows.filter(r => r.outcome === "admitted").length}, excluded ${rows.filter(r => r.outcome === "excluded").length}, still deferred ${rows.filter(r => r.outcome === "deferred").length}. ${rows.filter(r => r.reason === "advisory_background_unknown").length ? `Advisory, background unknown: ${rows.filter(r => r.reason === "advisory_background_unknown").map(r => r.instance).join(", ")}. ` : ""}${deferredAdvisories.length ? `Deferred advisory candidates (background unknown; all other gates still apply): ${deferredAdvisories.join(", ")}. ` : ""}Details are in the Log. Deferred work remains eligible; no action or confirmation is requested.`));
+                if (posted) {
+                    const counts = { interrupted: rows.length, queued: rows.filter(row => row.outcome === "admitted").length,
+                        excluded: rows.filter(row => row.outcome === "excluded").length, deferred: rows.filter(row => row.outcome === "deferred").length };
+                    const requestedAction = this.workingRecoveryCause === "unknown_interruption" ? null : this.workingRecoveryCause;
+                    this.logger.info({ group, ...counts, observedCause: "unknown_interruption", requestedAction }, "Interrupted work recovery summary queued for General");
+                    this.eventLog?.insert(general, "working_state", { reason: "recovery_summary", group, ...counts,
+                        observedCause: "unknown_interruption", requestedAction,
+                        message: `Interrupted work summary queued for General: ${counts.interrupted} interrupted; ${counts.queued} queued, ${counts.excluded} excluded, ${counts.deferred} deferred.` });
+                }
             },
             log: (episode, outcome, reason) => {
                 const requestedAction = this.workingRecoveryCause === "unknown_interruption" ? null : this.workingRecoveryCause;
@@ -1166,6 +1179,51 @@ export class FleetManager {
     officeSkinWrites = new OfficeWriteLimiter(undefined, { perWindow: 10, windowMs: 60_000 });
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     officeWrites = new OfficeWriteLimiter();
+    officeSharesInstance;
+    /**
+     * #2636: Office share links — the live Office view for people outside the fleet, read-only, on a quick tunnel of
+     * their own (a manager and lease of its own: never the fleet's one tunnel lane nor the public link's preview tunnel).
+     */
+    get officeShares() {
+        return (this.officeSharesInstance ??= new OfficeShareService({
+            source: {
+                status: () => this.getUiStatus(),
+                org: () => this.orgChart(),
+                offices: () => this.officeStore.list(),
+                acts: () => this.officeActs.live(),
+                traffic: () => this.trafficSnapshot(),
+                needs: () => this.needsYouItems().map(i => i.instance),
+                hidden: name => crossInstanceVisibility(this.fleetConfig, name) === "hidden",
+                skins: this.officeSkins,
+            },
+            manager: new ManagedTunnel({ dataDir: join(this.dataDir, OFFICE_SHARE_TUNNEL_DIR), log: () => this.logger.warn("Office share tunnel cleanup requires attention") }),
+            ensure: signal => ensureCloudflared({ dataDir: this.dataDir, pinnedOnly: true, signal }),
+            provider: binary => new CloudflaredProvider({ binaryName: binary, protocol: this.fleetConfig?.web?.public_link?.protocol ?? "http2" }),
+            config: () => this.fleetConfig?.web?.office_share,
+            officeExists: id => this.officeStore.list().offices.some(o => o.id === id),
+            ownerCurrent: owner => this.officeShareOwnerCurrent(owner),
+            changed: () => this.emitSseEvent("office_shares", {}),
+            log: (event, detail) => this.logger.info({ event, ...(detail ? { detail } : {}) }, "Office share link"),
+        }));
+    }
+    /**
+     * #2636: a share made or ended — said in General, as a sign-in is (who, which office, for how long; never its URL).
+     * `share` null with `count`: "Revoke all".
+     */
+    officeShareNotice(event, who, share, count) {
+        const office = !share ? "" : share.office === ALL_OFFICES ? t("office_share.all") : this.officeStore.list().offices.find(o => o.id === share.office)?.name ?? share.office;
+        const minutes = share ? Math.round((share.expiresAt - share.createdAt) / 60_000) : 0;
+        const text = event === "created" ? t("office_share.created_notice", who, office, minutes < 60 ? `${minutes} min` : `${Math.round(minutes / 60)} h`)
+            : share ? t("office_share.revoked_notice", who, office) : t("office_share.revoked_all_notice", who, count);
+        this.notifyFleetError(text, { throttle: false });
+    }
+    /** A share's owner: a person (`person:<adapter>:<user>`) still a fleet admin there; the host's own admin session stays. */
+    officeShareOwnerCurrent(owner) {
+        const m = /^person:([^:]+):(.+)$/.exec(owner);
+        if (!m)
+            return owner === "admin-session";
+        return this.hasFleetAdmins(m[1]) && this.isFleetAdmin(m[2], m[1]);
+    }
     officeActsInstance;
     /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
     get officeActs() {
@@ -2352,7 +2410,7 @@ export class FleetManager {
             if (reason === "cancelled")
                 outbox.workingRecovery.cancel(name, observation.configuration, observation.sessionId);
             if (entry.prior)
-                outbox.workingRecovery.discover(name, entry.prior);
+                outbox.workingRecovery.discover(name, entry.prior, this.workingRecoveryGroup);
             const state = entry.current.observation.executionState ?? "unknown";
             const counts = { tasks: entry.current.references.filter(r => r.kind === "task").length,
                 owed: entry.current.references.filter(r => r.kind === "owed").length,
@@ -2876,8 +2934,9 @@ export class FleetManager {
         // the next tunnel and says so, it does not block the fleet.
         this.announceToolPermissionsChange();
         this.tightenInstanceDirectories();
-        // #1723: the public link's preview tunnel keeps its own lease beside it; a leftover one is reaped the same way.
-        for (const leaseDir of [this.dataDir, join(this.dataDir, PUBLIC_PREVIEW_TUNNEL_DIR)]) {
+        // #1723: the public link's preview tunnel keeps its own lease beside it; a leftover one is reaped the same way (and
+        // #2636's Office share tunnel's).
+        for (const leaseDir of [this.dataDir, join(this.dataDir, PUBLIC_PREVIEW_TUNNEL_DIR), join(this.dataDir, OFFICE_SHARE_TUNNEL_DIR)]) {
             void reapStaleTunnel(leaseDir)
                 .then(outcome => {
                 if (outcome.kind === "manual")
@@ -5531,36 +5590,40 @@ export class FleetManager {
      * config file races. Stagger applies between outer lifecycle admissions.
      * TODO: per-instance startup timeout (existing issue, not introduced here)
      */
-    async startInstancesWithConcurrency(entries, topicMode, onReady) {
+    async startInstancesWithConcurrency(entries, topicMode, onReady, classic = []) {
         // Persisted pauses are intentionally preserved across fleet restarts. Filter
         // them before grouping/staggering: startInstance() retains its own guard as
         // a final backstop, but putting a no-op entry in this queue still consumes a
         // full stagger slot for every distinct working directory.
         const runnableEntries = entries.filter(([name]) => !this.lifecycle.isPaused(name));
+        // ClassicBot rooms queue with the fleet instances, at the same pressure pacing (#2642 follow-up): they used to start
+        // only after the whole fleet, the chat connections, topics and icons. A name the fleet also configures is the fleet's.
+        const fleetNames = new Set(entries.map(([name]) => name));
+        const runnableClassic = classic.filter(ch => !this.lifecycle.isPaused(ch.instanceName) && !fleetNames.has(ch.instanceName));
         const pausedCount = entries.length - runnableEntries.length;
         if (pausedCount > 0) {
             this.logger.info({ pausedCount }, "Paused instances excluded from startup queue");
         }
-        if (runnableEntries.length === 0)
+        if (runnableEntries.length === 0 && runnableClassic.length === 0)
             return;
         if (this.fleetConfig?.defaults?.startup?.concurrency == null) {
             this.logger.info({
                 concurrency: this.spawnConcurrency(),
                 freeMemMB: Math.round(freemem() / (1024 * 1024)),
-                totalInstances: runnableEntries.length,
+                totalInstances: runnableEntries.length + runnableClassic.length,
             }, "Adaptive startup concurrency");
         }
         const startedAt = performance.now();
         let active = 0, peakConcurrentStarts = 0, readyInstances = 0;
-        await Promise.all(runnableEntries.map(([name, config]) => this.spawnGate.run({
+        const admit = (name, workingDirectory, start) => this.spawnGate.run({
             instanceName: name,
-            workingDirectory: config.working_directory,
+            workingDirectory,
             reason: "startup",
             stage: "lifecycle",
         }, async () => {
             peakConcurrentStarts = Math.max(peakConcurrentStarts, ++active);
             try {
-                if (await this.startInstanceUnattended(name, config, topicMode, "instance")) {
+                if (await start()) {
                     readyInstances++;
                     onReady?.(name);
                 }
@@ -5568,9 +5631,13 @@ export class FleetManager {
             finally {
                 active--;
             }
-        })));
+        });
+        await Promise.all([
+            ...runnableEntries.map(([name, config]) => admit(name, config.working_directory, () => this.startInstanceUnattended(name, config, topicMode, "instance"))),
+            ...runnableClassic.map(ch => admit(ch.instanceName, join(getAgendHome(), "workspaces", ch.instanceName), () => this.startClassicInstanceUnattended(ch, "classic instance"))),
+        ]);
         this.logger.info({
-            totalInstances: runnableEntries.length, readyInstances,
+            totalInstances: runnableEntries.length + runnableClassic.length, classicInstances: runnableClassic.length, readyInstances,
             elapsedSeconds: Math.round((performance.now() - startedAt) / 100) / 10,
             peakConcurrentStarts,
         }, "Fleet startup batch completed");
@@ -6581,33 +6648,11 @@ export class FleetManager {
     getPublicWebStatus() {
         return this.publicWebLink?.status() ?? { state: "closed" };
     }
-    /** Notices use the first explicit admin of the owning connection; never a guest/paired account. */
-    noticeAdmin(adapterId) {
-        return this.adminListOf(adapterId)?.find(id => id.length > 0);
-    }
-    /** Best-effort private delivery. The caller retains its existing topic fallback and authority fences. */
-    async tryNoticeDm(adapter, userId, text) {
-        if (!userId || !adapter?.sendDirect)
-            return false;
-        try {
-            await withinBudget(adapter.sendDirect(userId, text, { disablePreview: true }), performance.now() + 2_000);
-            return true;
-        }
-        catch {
-            this.logger.info({ adapterId: adapter.id }, "Fleet notice DM failed; falling back to the topic");
-            return false;
-        }
-    }
     async confirmPublicWebLogin(info, current) {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner unavailable");
         const adapter = info.owner.binding;
-        const text = t("web.public_login_notice", info.label, info.handle.slice(0, 8));
-        if (loginNoticeMode(this.fleetConfig?.web) !== "dm" || !await this.tryNoticeDm(adapter, info.owner.userId, text)) {
-            if (!current() || !this.publicOwnerCurrent(info.owner))
-                throw new Error("public owner changed");
-            await adapter.sendText(info.owner.chatId, text, { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
-        }
+        await adapter.sendText(info.owner.chatId, t("web.public_login_notice", info.label, info.handle.slice(0, 8)), { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
@@ -6625,12 +6670,7 @@ export class FleetManager {
         if (!open)
             throw new Error("guest public sign-in unavailable");
         const adapter = open.owner.binding;
-        const text = t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8));
-        if (loginNoticeMode(this.fleetConfig?.web) !== "dm" || !await this.tryNoticeDm(adapter, open.owner.userId, text)) {
-            if (!admitted())
-                throw new Error("guest public sign-in changed");
-            await adapter.sendText(open.owner.chatId, text, { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
-        }
+        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
         if (!admitted())
             throw new Error("guest public sign-in changed");
     }
@@ -7468,26 +7508,18 @@ export class FleetManager {
     }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
-        // Keep the existing false policy: guest and public-link security notices remain mandatory.
-        const guest = info.tier === "guest" && info.owner;
-        if (!guest && this.fleetConfig?.web?.notify_login === false)
-            return;
-        const text = guest
-            ? t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8))
-            : t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8));
-        if (loginNoticeMode(this.fleetConfig?.web) === "dm") {
-            const adapterId = info.owner?.adapterId;
-            const adapter = adapterId ? this.adapters.get(adapterId) : undefined;
-            // A local guest's own account must never receive the admin's security notice.
-            const userId = guest ? (adapterId ? this.noticeAdmin(adapterId) : undefined)
-                : info.owner && this.isFleetAdmin(info.owner.userId, adapterId) ? info.owner.userId : undefined;
-            void this.tryNoticeDm(adapter, userId, text).then(sent => { if (!sent)
-                this.notifyFleetError(text); })
-                .catch(() => this.logger.warn("Web sign-in notice could not be delivered"));
+        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
+        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
+        if (info.tier === "guest" && info.owner) {
+            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
             return;
         }
-        // Exactly the old topic path, including the session-handle throttle key.
-        this.notifyFleetError(text);
+        // Never by DM (hmsg-3b8ac2af: Telegram cannot DM a user who has not started the bot); a legacy "dm" reads as on.
+        if (!loginNoticeMode(this.fleetConfig?.web))
+            return;
+        // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
+        // sign-in from the same kind of browser is exactly the one the operator most needs to hear about.
+        this.notifyFleetError(t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8)));
     }
     getDashboardAccess() {
         return { ready: this.healthServerListening, token: this.webToken };
@@ -8265,9 +8297,11 @@ export class FleetManager {
             this.rotateAllInstanceLogs();
         }, 24 * 60 * 60_000);
         this.logRotateTimer.unref?.();
-        // Phase 2: Start remaining instances with staggered concurrency
-        if (others.length > 0) {
-            await this.startInstancesWithConcurrency(others, topicMode, () => startupProgress.markReady());
+        // Phase 2: Start remaining instances, and the ClassicBot rooms with them, with staggered concurrency. A room needs no
+        // chat connection to spawn: its open-list is set above (reregisterClassicChannels) and inbound queues until it is up.
+        const classicAtBoot = topicMode && (fleet.channel || fleet.channels?.length) ? this.classicChannels?.getAll() ?? [] : [];
+        if (others.length > 0 || classicAtBoot.length > 0) {
+            await this.startInstancesWithConcurrency(others, topicMode, () => startupProgress.markReady(), classicAtBoot);
         }
         if (topicMode && (fleet.channel || fleet.channels?.length)) {
             await adapterStartup;
@@ -8309,22 +8343,7 @@ export class FleetManager {
             // IPC is already wired by startInstancesWithConcurrency → startInstance →
             // connectIpcToInstance. The previous 3s sleep + connectToInstances loop
             // was redundant.
-            // Start classic channel instances (parallel, concurrency 3)
-            if (this.classicChannels) {
-                const fleetBackend = this.fleetConfig?.defaults?.backend;
-                const channels = this.classicChannels.getAll()
-                    .filter(ch => !this.lifecycle.isPaused(ch.instanceName));
-                const concurrency = 3;
-                let idx = 0;
-                while (idx < channels.length) {
-                    const batch = channels.slice(idx, idx + concurrency);
-                    await Promise.allSettled(batch.map(async (ch) => {
-                        if (await this.startClassicInstanceUnattended(ch, "classic instance"))
-                            startupProgress.markReady();
-                    }));
-                    idx += concurrency;
-                }
-            }
+            // The ClassicBot rooms started in Phase 2, with the fleet.
             for (const name of Object.keys(fleet.instances)) {
                 this.startStatuslineWatcher(name);
             }
@@ -8591,24 +8610,42 @@ export class FleetManager {
         if (channelConfigs.length === 0)
             return;
         // Start ALL adapters in parallel — any single failure doesn't block others.
-        const results = await Promise.allSettled(channelConfigs.map((cfg, i) => i === 0
+        const settled = channelConfigs.map(() => false);
+        // Each connection is recorded (connected, or retrying with its retry scheduled) as its own login settles.
+        const recorded = channelConfigs.map((cfg, i) => (i === 0
             ? this.startSingleAdapter(fleet, cfg)
-            : this.startAdditionalAdapter(cfg)));
-        // Track state + schedule background retry for failures.
-        for (let i = 0; i < channelConfigs.length; i++) {
-            const adapterId = channelConfigs[i].id ?? channelConfigs[i].type;
-            if (results[i].status === "fulfilled") {
-                this.adapterState.set(adapterId, { status: "connected", retryCount: 0 });
-            }
-            else {
-                const err = results[i].reason;
-                this.logger.error({ adapterId, err: err?.message ?? err }, "Adapter startup failed — scheduling background retry");
-                this.adapterState.set(adapterId, { status: "retrying", retryCount: 0, lastError: err?.message ?? String(err) });
-                this.scheduleAdapterRetry(adapterId);
-                // Notify admin via whichever adapter is already up
-                this.notifyAdapterFailure(adapterId, err?.message ?? String(err));
-            }
+            : this.startAdditionalAdapter(cfg)).then(() => ({ status: "fulfilled" }), (reason) => ({ status: "rejected", reason }))
+            .then(result => { settled[i] = true; this.recordAdapterStartup(cfg, result); })
+            .catch(err => this.logger.error({ err }, "Recording a chat connection's startup failed")));
+        // #2642: bounded. Startup continues past a connection still logging in after this long (ClassicBot instances,
+        // READY); that connection is recorded, or retried, when its login settles, and joins the fleet as it would anyway.
+        let timer;
+        const inTime = await Promise.race([
+            Promise.all(recorded).then(() => true),
+            new Promise(resolve => { timer = setTimeout(() => resolve(false), FleetManager.ADAPTER_STARTUP_WAIT_MS); timer.unref?.(); }),
+        ]).finally(() => clearTimeout(timer));
+        if (!inTime) {
+            this.logger.warn({
+                pending: channelConfigs.filter((_, i) => !settled[i]).map(cfg => cfg.id ?? cfg.type),
+                waitedMs: FleetManager.ADAPTER_STARTUP_WAIT_MS,
+            }, "Chat connection still connecting — fleet startup continues without waiting for it");
+        }
+    }
+    /** How long fleet startup waits for its chat connections before it continues without the slow ones (#2642). */
+    static ADAPTER_STARTUP_WAIT_MS = 60_000;
+    /** Track a connection's startup outcome; a failure gets the background retry. */
+    recordAdapterStartup(cfg, result) {
+        const adapterId = cfg.id ?? cfg.type;
+        if (result.status === "fulfilled") {
+            this.adapterState.set(adapterId, { status: "connected", retryCount: 0 });
+            return;
         }
+        const err = result.reason;
+        this.logger.error({ adapterId, err: err?.message ?? err }, "Adapter startup failed — scheduling background retry");
+        this.adapterState.set(adapterId, { status: "retrying", retryCount: 0, lastError: err?.message ?? String(err) });
+        this.scheduleAdapterRetry(adapterId);
+        // Notify admin via whichever adapter is already up
+        this.notifyAdapterFailure(adapterId, err?.message ?? String(err));
     }
     /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
     scheduleAdapterRetry(adapterId) {
@@ -12249,10 +12286,11 @@ export class FleetManager {
                 const { office, ...dashboard } = patch.value;
                 return [{ ...patch, value: dashboard }, { path: [...path.slice(0, -1), "office_access"], value: office, remove: office === null }];
             }
+            // #2581's DM choice was withdrawn: an old string is just "on", posted in the topic, and its route is dropped.
             if (patch.path.join(".") === "web.notify_login" && patch.value === "dm")
-                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "login"], value: "dm" }];
+                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "login"], remove: true }];
             if (patch.path.join(".") === "defaults.tips" && patch.value === "dm")
-                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "tips"], value: "dm" }];
+                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "tips"], remove: true }];
             return [patch];
         });
         // Re-read immediately before patching so an unrelated concurrent/manual
@@ -12408,12 +12446,13 @@ export class FleetManager {
     }
     /** One-time upgrade migration; invalid YAML is never rewritten. */
     migrateNoticeDeliveryStorage() {
-        if (this.fleetConfig && this.configPath && (this.fleetConfig.web?.notify_login === "dm" || this.fleetConfig.defaults.tips === "dm")
+        if (this.fleetConfig && this.configPath && (this.fleetConfig.web?.notify_login === "dm" || this.fleetConfig.defaults.tips === "dm"
+            || this.fleetConfig.web?.notice_delivery !== undefined)
             && validateFleetConfig(this.rawFleetConfig).valid) {
             try {
                 this.writeFleetConfigBackup(readFileSync(this.configPath, "utf8"));
                 this.saveFleetConfig();
-                this.logger.info("Stored DM notice routing with downgrade-safe boolean fields");
+                this.logger.info("Notices no longer go by DM: stored them as topic booleans and dropped the old DM routing");
             }
             catch (err) {
                 this.logger.warn({ err }, "Could not migrate DM notice routing; keeping the original file");
@@ -15073,14 +15112,14 @@ export class FleetManager {
         }
     }
     /** Post one fresh nonce-armed tip in a known General channel. */
-    async promptTip(generalName, adapter, chatId, threadId, directUserId) {
+    async promptTip(generalName, adapter, chatId, threadId) {
         const state = this.readTipState();
         if (!state)
             return "unavailable";
         if (!state.advancedUnlocked
             && visibleTipLevels(true).has("advanced")
             && canUnlockAdvancedTips(state.dismissed)) {
-            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId, directUserId)
+            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId)
                 ? "posted"
                 : "unavailable";
         }
@@ -15096,7 +15135,6 @@ export class FleetManager {
             chatId,
             threadId,
             message: this.formatTip(tip),
-            ...(directUserId ? { deliver: (choices) => withinBudget(adapter.sendDirect(directUserId, this.formatTip(tip), { choices, disablePreview: true }), performance.now() + 5_000) } : {}),
             choices: [
                 { action: "dismiss", label: t("tips.dismiss") },
                 { action: "confused", label: t("tips.confused") },
@@ -15108,7 +15146,7 @@ export class FleetManager {
         });
         return nonce ? "posted" : "unavailable";
     }
-    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId, directUserId) {
+    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId) {
         const nonce = await this.postNonceButtonPrompt({
             prefix: TIP_UNLOCK_CALLBACK_PREFIX,
             alertType: "tip",
@@ -15118,7 +15156,6 @@ export class FleetManager {
             chatId,
             threadId,
             message: t("tips.advanced.unlock_prompt"),
-            ...(directUserId ? { deliver: (choices) => withinBudget(adapter.sendDirect(directUserId, t("tips.advanced.unlock_prompt"), { choices, disablePreview: true }), performance.now() + 5_000) } : {}),
             choices: [{ action: "unlock", label: t("tips.advanced.unlock") }],
             expiredText: t("tips.advanced.expired"),
             // No allowAnyUser: unlocking changes a persistent setting, which typed and slash `/tips advanced on` reserve for a
@@ -15138,15 +15175,6 @@ export class FleetManager {
         const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
         if (!adapter || !chatId)
             return;
-        if (this.fleetConfig && tipNoticeMode(this.fleetConfig) === "dm" && adapter.sendDirect) {
-            const userId = this.noticeAdmin(adapter.id);
-            if (userId) {
-                const result = await this.promptTip(generalName, adapter, userId, undefined, userId);
-                if (result !== "unavailable")
-                    return;
-                // The failed prompt disarmed its nonce; a new topic prompt is safe.
-            }
-        }
         const result = await this.promptTip(generalName, adapter, chatId, topicId != null ? String(topicId) : undefined);
         if (result === "unavailable") {
             this.logger.warn({ generalName }, "Daily tip could not be posted");
@@ -20723,8 +20751,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** Signal-handler continuation, after successful graceful shutdown only. */
     noteRequestedShutdown() {
         const progress = readUpdateProgress(this.dataDir)?.progress;
-        const update = progress && updateProgressOperation(progress) === "update"
-            && ["installed", "stopping", "starting"].includes(progress.stage);
+        // Host CLI updates carry a generic marker with no chat progress target.
+        const update = progress ? updateProgressOperation(progress) === "update"
+            && ["installed", "stopping", "starting"].includes(progress.stage) : isUpdateInProgress(this.dataDir);
         this.recordWorkingRestartIntent(update ? "update" : "manual_restart");
     }
     recordWorkingRestartIntent(cause) {
@@ -20784,6 +20813,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const settingsControlStopped = settingsControl?.close();
         this.publicLinkAutoOpen?.stop();
         const publicStopped = this.publicWebLink?.close("fleet shutdown");
+        const sharesStopped = this.officeSharesInstance?.close(); // #2636: every Office share ends, and its tunnel
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
         const needsStopped = this.stopNeedsYou();
@@ -20822,6 +20852,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).
         await publicStopped;
+        await sharesStopped?.catch(() => { });
         await profileStopped;
         await needsStopped;
         await settingsControlStopped;
@@ -22724,6 +22755,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.info("No instances to restart");
             return;
         }
+        this.workingRecoveryGroup = randomUUID();
         this.recordWorkingRestartIntent("manual_restart");
         this.workingRecovery?.reset();
         this.logger.info(`Graceful restart: waiting for ${instanceNames.length} instances to idle...`);
@@ -22799,29 +22831,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         // General is ready again; now its topic can own the live progress message.
         await restartProgress.start(progressTarget);
-        if (restartOthers.length > 0) {
-            await this.startInstancesWithConcurrency(restartOthers, topicMode, () => restartProgress.markReady());
+        // The ClassicBot rooms (killed during orphan cleanup) restart with the fleet instances, in the same queue; their
+        // open-lists are refreshed first so a room's inbound is never dropped while it starts.
+        const restartClassic = topicMode ? this.classicChannels?.getAll() ?? [] : [];
+        if (restartClassic.length > 0)
+            this.reregisterClassicChannels();
+        if (restartOthers.length > 0 || restartClassic.length > 0) {
+            await this.startInstancesWithConcurrency(restartOthers, topicMode, () => restartProgress.markReady(), restartClassic);
         }
         if (topicMode) {
             this.routing.rebuild(this.fleetConfig);
             this.reregisterClassicChannels();
             // startInstance already calls connectIpcToInstance, no need for connectToInstances here
-            // Restart classic channel instances (killed during orphan cleanup)
-            if (this.classicChannels) {
-                const fleetBackend = this.fleetConfig?.defaults?.backend;
-                const channels = this.classicChannels.getAll()
-                    .filter(ch => !this.lifecycle.isPaused(ch.instanceName));
-                const concurrency = 3;
-                let idx = 0;
-                while (idx < channels.length) {
-                    const batch = channels.slice(idx, idx + concurrency);
-                    await Promise.allSettled(batch.map(async (ch) => {
-                        if (await this.startClassicInstanceUnattended(ch, "classic instance"))
-                            restartProgress.markReady();
-                    }));
-                    idx += concurrency;
-                }
-            }
             for (const name of Object.keys(fleet.instances)) {
                 this.startStatuslineWatcher(name);
             }