@songsid/agend 2.3.4-beta.1 → 2.3.4-beta.10

package/dist/fleet-manager.js

@@ -3,6 +3,7 @@ import { listKiroV1Sessions, readKiroClassicLinks } from "./backend/kiro-identit
 import { readKiroV1SavedModel } from "./backend/kiro-retired-model.js";
 import { sharedKiroV2StoreLane } from "./backend/kiro-v2-store.js";
 import { SEPARATE_FEATURE_KEYS, hasLegacyOffice, normalizeOfficeStorage } from "./dashboard-permissions.js";
+import { maskSecrets } from "./log-steps.js";
 import { loginNoticeMode, normalizeNoticeDelivery, setNoticeMode } from "./notice-delivery.js";
 import { DEFAULT_REPLY_TRIGGERS } from "./reply-triggers.js";
 import { WorkingRecoveryCoordinator, WORKING_RECOVERY_KIND, buildWorkingRecoveryPrompt } from "./working-recovery.js";
@@ -27,6 +28,8 @@ import { clearPublicLinkOwner, readPublicLinkOwner, writePublicLinkOwner } from
 import { PUBLIC_PREVIEW_FRAME_SRC, PUBLIC_PREVIEW_TUNNEL_DIR, PublicPreview, publicPreviewWanted } from "./public-preview.js";
 import { CloudflaredProvider } from "./tunnel/cloudflared.js";
 import { ensureCloudflared } from "./tunnel/cloudflared-install.js";
+import { unattendedInstallCommand, loginShell } from "./unattended-install.js";
+import { InstallStream } from "./install-stream.js";
 import { namedTestLane, runNamedLinkTest } from "./tunnel/named-link-test.js";
 import { daemonTopicMode, isWebOnlyFleetConfig } from "./web-only-fleet.js";
 import { OFFICE_SHARE_TUNNEL_DIR, OfficeShareService } from "./office-share-service.js";
@@ -37,7 +40,7 @@ import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, lstatSync, constants as fsConstants, closeSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, realpathSync, lstatSync, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { freemem, totalmem, homedir } from "node:os";
@@ -54,6 +57,7 @@ import { applyKiroMigration, kiroMigrationPrompt, planKiroMigration } from "./ki
 import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, sameUpdateMarker, setUpdateProgressStage, updateMarkerIdentity, updateProgressOperation, updateReceiptOf, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
+import { startStallReporter } from "./stall-reporter.js";
 import { sdNotify, sdNotifyBlocking, setSdNotifyWarn, startSdWatchdog } from "./sd-notify.js";
 import { StartupMemoryDeadline, fleetStopConcurrency } from "./startup-memory-deadline.js";
 import { readFleetMemory } from "./process-memory.js";
@@ -72,7 +76,8 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, loadFleetConfigSource, loadRawFleetConfigSource, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG, autoGeneralInstanceConfig } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
-import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
+import { deletePlannedTopic, planInstanceTopicDelete, topicDestination, topicMustStay } from "./instance-topic-delete.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes, findExecutableIn, resolveBackendBinary } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -87,6 +92,7 @@ import { formatFleetTime } from "./tz-utils.js";
 import { createAdapter } from "./channel/factory.js";
 import { isWebChannelEcho, WEB_ECHO_PREFIX } from "./web-channel-echo.js";
 import { TelegramAdapter } from "./channel/adapters/telegram.js";
+import { MissedOfflineStore } from "./missed-offline.js";
 import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
@@ -107,7 +113,7 @@ import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
 import { safeHandler } from "./safe-async.js";
 import { RoutingEngine } from "./routing-engine.js";
-import { InstanceLifecycle, SupersededStartError, BACKEND_INSTALLATION_INFO, checkBinaryInstalled, } from "./instance-lifecycle.js";
+import { InstanceLifecycle, SupersededStartError, BACKEND_INSTALLATION_INFO, checkBinaryInstalled, checkBinaryInstalledAsync, } from "./instance-lifecycle.js";
 import { TopicArchiver } from "./topic-archiver.js";
 import { StatuslineWatcher } from "./statusline-watcher.js";
 import { applyInstanceConfigPatch, outboundHandlers } from "./outbound-handlers.js";
@@ -166,6 +172,7 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
 }
 import { handleWebRequest, webPeerOf, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
+import { viewHistory } from "./view-history.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WEB_ECHO_COPIES_MAX, WEB_MIRROR_TIMEOUT_MS, webReactionEmoji, webReactionProblem } from "./web-reactions.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
@@ -198,7 +205,7 @@ import { envFileKeys } from "./token-env-name.js";
 import { discordGeneralChannelId } from "./discord-general.js";
 import { parseEnvText } from "./env-file.js";
 import { isDisallowedIntentsError, isRejectedTokenError } from "./discord-permissions.js";
-import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
+import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, setCapacityLookup, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, checkAuthStatus, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
 import { runOnLoginShell } from "./login-shell.js";
@@ -229,6 +236,8 @@ import { remoteCardAction, remoteCardChoiceLabel, remoteCardOutcomeText, remoteC
 import { recentChatContext } from "./log-tail.js";
 import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
+import { AgentCredentials, agentCredentialPolicy } from "./agent-credentials.js";
+import { writeSecretFile } from "./secret-file.js";
 import { ConfigHistory, ConfigSyntaxError, configIssueText } from "./config-history.js";
 import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, inferClassicChannelType, isSelectableClassicBackend, readClassicLastActivityAt, readClassicRoomNames } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
@@ -287,7 +296,7 @@ import { PROVIDER_SECRET_SPECS, PUBLIC_TUNNEL_SECRET_SPEC, providerSecretSpec, p
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
 import { kiroHome } from "./backend/kiro-kas-store.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile, listConfiguredProfiles } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
@@ -302,6 +311,13 @@ import { SpawnGate } from "./spawn-gate.js";
 import { BackendOutageTracker } from "./backend-outage.js";
 import { canUnlockAdvancedTips, DailyTipScheduler, selectTip, visibleTipLevels, } from "./tips.js";
 import { getTmuxSession } from "./config.js";
+import { OwnStatusMessages, discordMessageKey } from "./chat-log-ids.js";
+import { PROFILE_TIMELINE_FILE, PROFILE_UNRECORDED, recordProfileLaunch } from "./usage/profile-timeline.js";
+import { readQuotaHistory } from "./usage/quota-history.js";
+import { estimateCapacity } from "./usage/capacity.js";
+import { covered, hourSources } from "./usage-rollup.js";
+import { KEEP_DAYS } from "./cache-ledger.js";
+import { ratesFor } from "./cache-prices.js";
 // Closed migration cohort: these 11 names existed immediately before the first
 // managed-skill publisher (a1ac499f; parent e267e684). Never grow this set when
 // adding a bundled skill: its new name is not proof of old AgEnD ownership.
@@ -443,6 +459,8 @@ const CANCEL_BTN_LEDGER_FILE = "cancel-buttons.json";
 const PROGRESS_UPDATE_INTERVAL_MS = 60_000;
 /** Floor between tool-progress-driven bubble edits (Telegram flood safety). */
 const TOOL_PROGRESS_EDIT_MIN_MS = 4_000;
+/** M-2281: how long `/login`'s install window may run before it is stopped. */
+const INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
 /** Elapsed time is only shown once work has clearly outlasted a quick answer. */
 /**
  * Default delay before the button starts showing elapsed time. Configurable via
@@ -451,6 +469,8 @@ const TOOL_PROGRESS_EDIT_MIN_MS = 4_000;
  * while anything real shows signs of life well before the old two minutes.
  */
 const PROGRESS_MIN_ELAPSED_MS = 30_000;
+/** M-2391: the threshold tick fires this long after it, never a millisecond before (timers can fire early). */
+const PROGRESS_THRESHOLD_MARGIN_MS = 50;
 /** How much of a tool summary the progress line will show before eliding. */
 const PROGRESS_ACTIVITY_MAX_CHARS = 48;
 /**
@@ -622,6 +642,14 @@ function emojiListFilter(opts) {
 }
 /** #1920: a guest's scope until phase 2 derives one: nothing. */
 const NO_GUEST_SCOPE = new Set();
+/** #1490 row 27: a restart asked for one lifecycle of an instance after it was stopped, restarted or replaced. */
+export class RestartSupersededError extends Error {
+    /** `shown`: the instance as the chat list names it (shownInstanceName). */
+    constructor(shown) {
+        super(t("restart.superseded", shown));
+        this.name = "RestartSupersededError";
+    }
+}
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -873,6 +901,7 @@ export class FleetManager {
     startupRetryNotices = new Map();
     /** Unsupported-CLI refusals waiting to go out, grouped by reason (#1109). */
     unsupportedCliNotices = new Map();
+    kiroCompatibilityHolds = new Map();
     kiroIncompatNotices = new Map();
     /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
     static STARTUP_RETRY_BACKOFF_MS = [60_000, 5 * 60_000, 15 * 60_000];
@@ -901,6 +930,7 @@ export class FleetManager {
     kiroMigrationRuns = new Map();
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
     needsYou = null;
+    missedOfflineStore = null;
     configHistory = null;
     configHistoryTimer = null;
     loadedFleetSource = null;
@@ -1016,11 +1046,15 @@ export class FleetManager {
     discordPresenceEagerPending = false;
     discordPresenceInFlight = null;
     static DISCORD_PRESENCE_REFRESH_MS = 15 * 60_000;
+    /** #3066 §1d: how often a fleet with no Discord bot reads the quota for its history (the user's choice: 30 min). */
+    static QUOTA_BACKGROUND_READ_MS = 30 * 60_000;
+    quotaReadTimer = null;
     /** Days of event/activity history to keep. */
     static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
     startupMemoryDeadline = null;
     eventLoopWatch = null;
+    stallReporter = null;
     startedAt = 0;
     stormOpenNotifyTimer = null;
     memoryLogAt = null;
@@ -1064,6 +1098,37 @@ export class FleetManager {
     webChatRemovals = new Map();
     /** #1774: a removal under way — its replies' fate waits for its outcome (success: theirs no more; failure: theirs). */
     webChatRemovalsPending = new Map();
+    /**
+     * #1490 row 27: "still the same lifecycle of `name`" — its lifecycle epoch, moved on synchronously by every stop,
+     * restart and removal (the map is never pruned, so a same-name replacement has a later one). Taken when a button
+     * or menu is claimed or offered, asked after every await before acting by name.
+     */
+    /** #1490 row 27: an instance as the chat list names it — its display name where it has one, else its name. */
+    shownInstanceName(name) {
+        try {
+            const classic = this.classicChannels?.getAll().find(ch => ch.instanceName === name) ?? null;
+            return resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic, profile: profileIdentities(this.dataDir).get(name) }).display_name || name;
+        }
+        catch {
+            return name;
+        }
+    }
+    lifecyclePin(name) {
+        // Fail closed: a lifecycle that cannot say its epoch holds nothing (and never stops a prompt from being posted).
+        let epoch;
+        try {
+            epoch = this.lifecycle?.epochOf(name);
+        }
+        catch {
+            return () => false;
+        }
+        return () => { try {
+            return !this.shuttingDown && this.lifecycle?.epochOf(name) === epoch;
+        }
+        catch {
+            return false;
+        } };
+    }
     webChatGeneration(name) { return this.webChatGenerations.get(name) ?? 0; }
     /** #1774: who an instance's reply is from, taken when it is sent: the name's generation and its daemon then. */
     webChatIdentity(name) { return { generation: this.webChatGeneration(name), daemon: this.daemons.get(name) }; }
@@ -2107,6 +2172,22 @@ export class FleetManager {
      * startup-only key at startup. See checkStartupSignatureConsistency(). */
     fleetSignatureMismatch = null;
     healthServerListening = false;
+    agentCredentialsCache;
+    get agentCredentials() {
+        return this.agentCredentialsCache ??= new AgentCredentials(name => agentCredentialPolicy(this.fleetConfig, name, this.isClassicInstance(name)), name => {
+            try {
+                const token = randomBytes(32).toString("hex");
+                const result = writeSecretFile(join(this.getInstanceDir(name), "agent.token"), token);
+                if (!result.ok)
+                    this.logger.error({ name, mode: result.mode, reason: result.reason }, "Agent token file is not owner-only");
+                return token;
+            }
+            catch {
+                this.logger.error({ name }, "Agent credential renewal failed; prior generation remains retired");
+                return null;
+            }
+        });
+    }
     constructor(dataDir) {
         this.dataDir = dataDir;
         FleetManager.signalTarget = this;
@@ -2129,6 +2210,7 @@ export class FleetManager {
         this.topicCommands = new TopicCommands(this);
         this.topicArchiver = new TopicArchiver(this);
         this.statuslineWatcher = new StatuslineWatcher(this);
+        this.missedOfflineStore = new MissedOfflineStore(this.dataDir);
     }
     /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
     replyButtonsCtl = null;
@@ -2487,6 +2569,10 @@ export class FleetManager {
         const daemon = this.daemons.get(name);
         if (daemon?.bootId === daemonBootId)
             this.listenForWorkingState(name, daemon);
+        // #3066 §1d: a Codex launch records the credential profile it runs under, so its usage is told by account.
+        if (daemon?.bootId === daemonBootId && this.backendNameOf(name) === "codex") {
+            void recordProfileLaunch(join(this.getInstanceDir(name), PROFILE_TIMELINE_FILE), this.credentialProfileOf(name, "codex") ?? "default");
+        }
         // #2802: no post-restart notices. The outbox still delivers or fails a row accepted before the restart, and an open
         // request is reminded by the ordinary turn-ended nudge (sweepReplyObligations) once the owner is idle.
         this.scheduleDeliveryOutboxPump();
@@ -3324,6 +3410,7 @@ export class FleetManager {
      * guild channel.
      */
     reregisterClassicChannels() {
+        this.agentCredentialsCache?.observePolicies();
         if (!this.classicChannels)
             return;
         const channels = this.classicChannels.getAll();
@@ -4014,6 +4101,13 @@ export class FleetManager {
             changed: () => this.emitSseEvent("status", this.getUiStatus()),
         });
     }
+    /**
+     * Claude history in the View: an instance's earlier conversation for its View, from the transcript the Log reads —
+     * the View's route applied its own access rules first (view-api.ts); the Log's switch plays no part.
+     */
+    viewHistory(name, q) {
+        return viewHistory((n, rq) => this.log.readBack(n, rq), name, q);
+    }
     /** #1218: GET /ui/steps — an instance's steps, read on demand (null: no such instance). */
     logSteps(name, q) { return this.log.steps(name, q); }
     /**
@@ -5636,6 +5730,23 @@ export class FleetManager {
             if (resumePaused)
                 this.lifecycle.markActivitySeedNow(name);
             const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+            // #1490 row 67: off-loop resolve before skill/instruction publication
+            // constructs a backend (resolveKnowledgeWorkDir). Capture stop/lifecycle
+            // ownership first: a Stop during this wait finishes and bumps the epoch,
+            // and the inner lifecycle check would otherwise capture the new epoch and
+            // accept the stale start. Lifecycle start looks up again before its own
+            // createBackend; the probe cache makes that cheap.
+            const epoch = this.lifecycle.epochOf(name);
+            const stopGen = this.explicitStopGeneration.get(name) ?? 0;
+            const resolved = await resolveBackendBinary(backend);
+            execution?.assert();
+            if (this.lifecycle.epochOf(name) !== epoch
+                || (this.explicitStopGeneration.get(name) ?? 0) !== stopGen) {
+                throw new SupersededStartError(name);
+            }
+            const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, resolved ?? binary);
             if (config.general_topic) {
                 this.ensureGeneralInstructions(config.working_directory, backend, name);
             }
@@ -6092,6 +6203,17 @@ export class FleetManager {
         this.queueKiroIncompatNotice(name, err.message);
         return true;
     }
+    /** No pane is needed for a compatibility refusal to remain in Needs you. */
+    setKiroCompatibilityHold(name, message) {
+        const holds = this.kiroCompatibilityHolds ??= new Map();
+        if ((message === null && !holds.has(name)) || (message !== null && holds.get(name)?.message === message))
+            return;
+        if (message === null)
+            holds.delete(name);
+        else
+            holds.set(name, { message, since: Date.now() });
+        this.needsYou?.poke();
+    }
     /**
      * LifecycleContext: a kiro instance the installed kiro-cli cannot run as
      * configured (#1109) — at start, or at a respawn after kiro-cli replaced
@@ -6286,6 +6408,8 @@ export class FleetManager {
     }
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     async restartSingleInstance(name, opts) {
+        if (opts?.ownerCurrent && !opts.ownerCurrent())
+            throw new RestartSupersededError(this.shownInstanceName(name));
         const migration = this.kiroMigrationRuns?.get(name);
         if (migration && migration.token !== opts?.kiroMigration)
             throw new Error(t("kiro_migrate.in_progress"));
@@ -7586,7 +7710,7 @@ export class FleetManager {
             return { kind: "refused" };
         if (device.tier === "guest")
             return this.requestGuestDeviceCode(device, input, token);
-        const paused = this.webLoginCodes.pausedForMs();
+        const paused = this.webLoginCodes.pausedForMs(input.exposureId ?? "local");
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
         const admitted = this.codeRequestLimiter.admit(device.idHash);
@@ -8071,6 +8195,9 @@ export class FleetManager {
         this.watchdogTimer = startSdWatchdog();
         this.eventLoopWatch?.stop();
         this.eventLoopWatch = startEventLoopWatch({ logger: this.logger });
+        // #3009: the event-loop watch runs on the main thread; this one does not, so a stall that never ends is still named.
+        this.stallReporter?.stop();
+        this.stallReporter = startStallReporter({ logFile: join(this.dataDir, "daemon.log") });
         try {
             await this.startAllWithinDeadline(configPath, deadline);
         }
@@ -8084,6 +8211,8 @@ export class FleetManager {
                     this.watchdogTimer = null;
                     this.eventLoopWatch?.stop();
                     this.eventLoopWatch = null;
+                    this.stallReporter?.stop();
+                    this.stallReporter = null;
                 }
             }
         }
@@ -8351,6 +8480,10 @@ export class FleetManager {
             const generalDir = join(getAgendHome(), name);
             mkdirSync(generalDir, { recursive: true, mode: 0o700 });
             const backendName = fleet.defaults.backend ?? "claude-code";
+            const resolved = await resolveBackendBinary(backendName);
+            const binary = BACKEND_INSTALLATION_INFO[backendName]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, resolved ?? binary);
             this.ensureGeneralInstructions(generalDir, backendName, name);
             fleet.instances[name] = autoGeneralInstanceConfig(fleet.defaults, generalDir, need.adapterId); // #2598: its kiro_ui is the fleet's
             generalsCreated = true;
@@ -8505,6 +8638,9 @@ export class FleetManager {
         if (others.length > 0 || classicAtBoot.length > 0) {
             await this.startInstancesWithConcurrency(others, topicMode, () => startupProgress.markReady(), classicAtBoot);
         }
+        // #3066 §1d (Fable r1): on every fleet — a web-only one (#2910) has no chat connection at all, and is the clearest
+        // case with no Discord bot reading. Each tick decides for itself whether to read (backgroundQuotaRead).
+        this.startQuotaBackgroundReads();
         if (topicMode && (fleet.channel || fleet.channels?.length)) {
             await adapterStartup;
             this.startDiscordUsagePresence();
@@ -8676,6 +8812,178 @@ export class FleetManager {
             this.logger.warn({ health }, "Fleet started with problems — see /health");
         }
     }
+    /**
+     * #3066 §1d (the user: yes, every 30 min): the quota history (usage/quota-history.ts) records only the readings AgEnD
+     * makes. A Discord bot's presence refresh reads every 15 min; without one, nothing reads while nobody looks. So, with no
+     * Discord bot and while some account has a running agent, read every 30 min — the same cached read (its 5-minute TTL
+     * still bounds the vendor calls), recorded like any other.
+     */
+    startQuotaBackgroundReads() {
+        if (this.quotaReadTimer)
+            clearInterval(this.quotaReadTimer);
+        this.quotaReadTimer = setInterval(() => { void this.backgroundQuotaRead(); }, FleetManager.QUOTA_BACKGROUND_READ_MS);
+        this.quotaReadTimer.unref?.();
+        // #3066 §1: the measured capacity, published for the usage reads (get_usage, the page) — refreshed every 10 min.
+        setCapacityLookup((provider, metric) => this.capacityEstimates.get(`${provider}\u0000${metric}`) ?? null);
+        if (this.capacityTimer)
+            clearInterval(this.capacityTimer);
+        void this.refreshCapacity();
+        this.capacityTimer = setInterval(() => { void this.refreshCapacity(); }, FleetManager.CAPACITY_REFRESH_MS);
+        this.capacityTimer.unref?.();
+    }
+    /** #3066 §1: the latest estimates, by `provider\0metric` (what usage-api's lookup reads, synchronously). */
+    capacityEstimates = new Map();
+    capacityTimer = null;
+    static CAPACITY_REFRESH_MS = 10 * 60_000;
+    /**
+     * #3066 §1: estimate each account's weekly 100% from the quota history (§1d) and the usage ledger's hours — both read
+     * asynchronously, the arithmetic small (usage/capacity.ts). An account is its usage provider id ("claude",
+     * "claude:hsinlin", "codex:yanxianchen"): its hours are the ledger sources of that backend under that credential profile
+     * (Codex's "unrecorded" hours are no account's). A per-model weekly ("Sonnet (weekly)") counts only that model's tokens.
+     *
+     * Prism #3073: no estimate rather than a wrong one —
+     * - a window is measured only where the ledger has its hours: kept (31 days) and scanned (`days.coverage`) for every
+     *   instance of the account's backend, and every instance whose hours count for it; the quota history goes back 12 weeks;
+     * - a profile literally named "default", "unknown" or "unrecorded" (configured, on disk, or in the quota history) makes
+     *   those hours ambiguous: neither the host
+     *   account nor the named one is estimated (each would be credited the other's use, or lose its own);
+     * - only a metric the vendor marks per-model (`scope: "model"`) is filtered by model; another named weekly pool
+     *   ("Luna Reserve (weekly)", Antigravity pools) is no model name and is not estimated.
+     */
+    async refreshCapacity() {
+        try {
+            const readings = await readQuotaHistory();
+            const groups = new Map();
+            for (const r of readings) {
+                const k = `${r.provider}\u0000${r.metric}`;
+                (groups.get(k) ?? groups.set(k, []).get(k)).push(r);
+            }
+            if (!groups.size) {
+                this.capacityEstimates = new Map();
+                return 0;
+            }
+            const data = await this.cacheServiceFor().usageData();
+            const now = Date.now(), DAY = 24 * 3_600_000, HOUR = 3_600_000;
+            const keptFrom = now - KEEP_DAYS * DAY + HOUR; // the oldest hour still in every ledger (an hour of margin)
+            // Profiles whose names are also the ledger's own tags: their hours cannot be told from the host's / unattributed.
+            // Any trace of such a profile counts (Prism #3073 r2), not only today's config — a binding removed or switched
+            // leaves its hours in the ledger: configured now, its directory on this host, or its account in the quota history.
+            const RESERVED = new Set(["default", "unknown", PROFILE_UNRECORDED]);
+            const historyProviders = new Set(readings.map((r) => r.provider));
+            const reservedNamed = new Map();
+            const reservedFor = (backend) => {
+                const known = reservedNamed.get(backend);
+                if (known)
+                    return known;
+                const found = new Set(listConfiguredProfiles(this.fleetConfig, backend).filter((n) => RESERVED.has(n)));
+                const base = usageProviderIdForBackend(backend);
+                for (const n of RESERVED) {
+                    if (base && historyProviders.has(`${base}:${n}`))
+                        found.add(n);
+                    if (credentialHomeSpec(backend) && existsSync(credentialProfileHome(this.dataDir, backend, n)))
+                        found.add(n);
+                }
+                return reservedNamed.set(backend, found).get(backend);
+            };
+            // Every instance of a backend may have used any of its accounts (bindings change): an account is measured only
+            // where all of them were scanned (Prism #3073 r2) — one still waiting for its first scan has no hours yet, not none.
+            const daysOfBase = new Map();
+            for (const inst of data.instances) {
+                const base = usageProviderIdForBackend(inst.inst.backend);
+                if (base)
+                    (daysOfBase.get(base) ?? daysOfBase.set(base, []).get(base)).push(inst.days);
+            }
+            // provider id → hour → model key → totals; and the instances whose hours count for it (their scan coverage).
+            const byProvider = new Map();
+            const daysOf = new Map();
+            for (const inst of data.instances) {
+                for (const [hk, hour] of Object.entries(inst.ledger.hours)) {
+                    for (const src of hourSources(hour)) {
+                        const base = usageProviderIdForBackend(src.backend);
+                        if (!base)
+                            continue;
+                        // Ambiguous (a named profile with the tag's name), or no account's: counted for no one, so an account whose
+                        // hours these may be has none — and gets no estimate, never a low one.
+                        if (reservedFor(src.backend).has(src.profile) || src.profile === "unknown" || src.profile === PROFILE_UNRECORDED)
+                            continue;
+                        const provider = src.profile === "default" ? base : `${base}:${src.profile}`;
+                        const list = daysOf.get(provider) ?? daysOf.set(provider, []).get(provider);
+                        if (!list.includes(inst.days))
+                            list.push(inst.days);
+                        const hours = byProvider.get(provider) ?? byProvider.set(provider, new Map()).get(provider);
+                        const into = hours.get(Number(hk)) ?? hours.set(Number(hk), Object.create(null)).get(Number(hk));
+                        for (const [mk, tot] of Object.entries(src.m)) {
+                            const cur = into[mk] ??= [0, 0, 0, 0, 0, 0, 0];
+                            for (let i = 0; i < 7; i++)
+                                cur[i] = (cur[i] ?? 0) + (tot[i] ?? 0);
+                        }
+                    }
+                }
+            }
+            const next = new Map();
+            for (const [key, list] of groups) {
+                const [provider, metric] = key.split("\u0000");
+                // A per-model weekly ("Sonnet (weekly)", the vendor's scope "model"): that model's tokens only. Another named
+                // pool is not a model: no estimate. "Weekly", "Weekly limit": everything.
+                const named = /^(.+) \((?:weekly|monthly|\d+d)\)$/i.exec(metric)?.[1]?.toLowerCase() ?? null;
+                const perModel = list.some((r) => r.scope === "model");
+                if (named && !perModel)
+                    continue;
+                const hours = [];
+                for (const [hour, models] of byProvider.get(provider) ?? []) {
+                    let api = 0, output = 0, all = 0;
+                    for (const [mk, tot] of Object.entries(models)) {
+                        const bar = mk.lastIndexOf("|"), model = mk.slice(0, bar), long = mk.slice(bar + 1) === "1";
+                        if (named && !model.toLowerCase().includes(named))
+                            continue;
+                        const [, uncached, read, w5, w1h, w, out] = tot;
+                        const r = ratesFor(model, long ? Number.MAX_SAFE_INTEGER : 0);
+                        api = api === null || !r ? null : api + (uncached * r.input + read * r.read + w5 * r.write5m + w1h * r.write1h + w * r.write + out * r.output) / 1_000_000;
+                        output += out;
+                        all += uncached + read + w5 + w1h + w + out;
+                    }
+                    if (all > 0)
+                        hours.push({ hour, api, output, all });
+                }
+                const base = provider.split(":")[0];
+                const scanned = [...new Set([...(daysOf.get(provider) ?? []), ...(daysOfBase.get(base) ?? [])])];
+                const available = (from, to) => {
+                    if (from < keptFrom || !scanned.length)
+                        return false;
+                    for (let h = from; h <= to; h += HOUR)
+                        if (!scanned.every((d) => covered(d, h)))
+                            return false;
+                    return true;
+                };
+                const est = estimateCapacity(list, hours, available);
+                if (est)
+                    next.set(key, est);
+            }
+            this.capacityEstimates = next;
+            return next.size;
+        }
+        catch (err) {
+            this.logger.debug({ err }, "capacity estimate refresh failed");
+            return -1;
+        }
+    }
+    /** One background quota read, when nothing else reads (no Discord bot) and an account has a running agent. */
+    async backgroundQuotaRead() {
+        if (this.shuttingDown)
+            return false;
+        if ([...this.adapters.values()].some(a => a.type === "discord" && typeof a.setActivity === "function"))
+            return false;
+        const active = this.getActiveUsageProviderIds();
+        if (active.size === 0)
+            return false;
+        try {
+            await getUsageSnapshot(false, active);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     /** Keep Discord profile activity aligned with the same cached usage source as /usage. */
     startDiscordUsagePresence() {
         if (this.discordPresenceTimer)
@@ -9140,6 +9448,9 @@ export class FleetManager {
                 return;
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
+        // #2940: a deleted message's chat-log line goes (and it is never logged after this).
+        adapter.on("message_deleted", (e) => { if (isCurrentAdapter())
+            this.onPlatformMessageDeleted(e); });
         adapter.on("reaction", safeHandler(async (r) => {
             if (!isCurrentAdapter())
                 return;
@@ -9148,6 +9459,11 @@ export class FleetManager {
         adapter.on("callback_query", safeHandler(async (data) => {
             await this.receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter);
         }, this.logger, "adapter.callback_query"));
+        adapter.on("missed_offline", (ev) => {
+            if (!isCurrentAdapter())
+                return;
+            this.recordMissedOffline(ev);
+        });
         this.bindTopicClosedHandler(adapter, adapterId, "adapter.topic_closed");
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
         adapter.on("slash_command", safeHandler(async (data) => {
@@ -9290,6 +9606,9 @@ export class FleetManager {
                 return;
             await this.handleInboundMessage(msg);
         }, this.logger, `adapter[${adapterId}].message`));
+        // #2940: a deleted message's chat-log line goes (and it is never logged after this).
+        adapter.on("message_deleted", (e) => { if (isCurrentAdapter())
+            this.onPlatformMessageDeleted(e); });
         adapter.on("reaction", safeHandler(async (r) => {
             if (!isCurrentAdapter())
                 return;
@@ -9298,6 +9617,11 @@ export class FleetManager {
         adapter.on("callback_query", safeHandler(async (data) => {
             await this.receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter);
         }, this.logger, `adapter[${adapterId}].callback_query`));
+        adapter.on("missed_offline", (ev) => {
+            if (!isCurrentAdapter())
+                return;
+            this.recordMissedOffline(ev);
+        });
         this.bindTopicClosedHandler(adapter, adapterId, `adapter[${adapterId}].topic_closed`);
         // Slash commands: classic bot + admin commands
         adapter.on("slash_command", safeHandler(async (data) => {
@@ -10034,6 +10358,34 @@ export class FleetManager {
         }
         return true;
     }
+    /** File a Telegram update that was too old to inject; Needs you lists it until Acknowledge. */
+    recordMissedOffline(ev) {
+        if (!this.missedOfflineStore)
+            this.missedOfflineStore = new MissedOfflineStore(this.dataDir);
+        const stub = {
+            source: "telegram", adapterId: ev.adapterId, chatId: ev.chatId, threadId: ev.threadId,
+            messageId: ev.messageId, userId: ev.userId, username: ev.username, text: ev.preview,
+            timestamp: ev.timestamp, isBotMessage: false,
+        };
+        const threadId = this.inboundRouteThreadId(stub);
+        const target = threadId ? this.resolveInboundTarget(stub, threadId) : undefined;
+        let instance = target?.name ?? "";
+        if (!instance) {
+            instance = Object.entries(this.fleetConfig?.instances ?? {}).find(([name, cfg]) => cfg.general_topic && this.getInstanceAdapterId(name) === ev.adapterId)?.[0] ?? "";
+        }
+        const place = [ev.chatTitle, ev.threadId ? `#${ev.threadId}` : ""].filter(Boolean).join(" · ") || ev.chatId;
+        this.missedOfflineStore.add({
+            id: `missed:${ev.adapterId}:${ev.updateId}`,
+            adapterId: ev.adapterId,
+            instance,
+            username: ev.username,
+            place,
+            preview: ev.preview,
+            since: ev.timestamp.getTime(),
+        });
+        this.logger.info({ adapterId: ev.adapterId, updateId: ev.updateId, instance, chatId: ev.chatId, threadId: ev.threadId }, "Telegram message missed while AgEnD was offline — filed for Needs you");
+        this.needsYou?.poke();
+    }
     /**
      * #1085: coincident topic numbers must not route across Telegram groups.
      */
@@ -11657,6 +12009,11 @@ export class FleetManager {
             let result;
             switch (msg.type) {
                 case "fleet_decision_create": {
+                    const supersedes = this.decisionSupersedes("ipc-typed", instanceName, payload.supersedes);
+                    if ("error" in supersedes) {
+                        ipc.send({ type: "fleet_decision_response", fleetRequestId, error: supersedes.error });
+                        return;
+                    }
                     // Prune expired decisions on create
                     db.pruneExpiredDecisions();
                     result = db.createDecision({
@@ -11667,7 +12024,7 @@ export class FleetManager {
                         tags: payload.tags,
                         ttl_days: payload.ttl_days,
                         created_by: instanceName,
-                        supersedes: payload.supersedes,
+                        supersedes: supersedes.id,
                     });
                     break;
                 }
@@ -11844,6 +12201,21 @@ export class FleetManager {
                 return "ok";
         }
     }
+    /**
+     * `post_decision` with `supersedes` changes a decision someone else may have recorded (it stops being active): the
+     * same permission as `update_decision`, asked through the same live check (tool set + dashboard switches), on both
+     * create paths. An empty or absent value supersedes nothing and needs nothing; anything else must be an id.
+     */
+    decisionSupersedes(sink, instanceName, value) {
+        if (value === undefined || value === null || value === "")
+            return { id: undefined };
+        if (typeof value !== "string")
+            return { error: "supersedes must be a decision id" };
+        const permitted = this.checkToolPermission(sink, instanceName, "update_decision");
+        if (!permitted.allowed)
+            return { error: `Superseding a decision needs update_decision. ${permitted.message}` };
+        return { id: value };
+    }
     async handleDecisionCrudHttp(instance, op, args) {
         if (!this.scheduler)
             return { error: "Scheduler not available" };
@@ -11859,16 +12231,24 @@ export class FleetManager {
                 if (!title || !content)
                     return { error: "title and content are required" };
                 const scope = args.scope === "fleet" ? "fleet" : "project";
-                return db.createDecision({
-                    project_root: projectRoot,
-                    scope,
-                    title,
-                    content,
-                    tags: asStrArr(args.tags),
-                    ttl_days: asNum(args.ttl_days),
-                    supersedes: asStr(args.supersedes),
-                    created_by: instance,
-                });
+                const supersedes = this.decisionSupersedes("agent-endpoint", instance, args.supersedes);
+                if ("error" in supersedes)
+                    return { error: supersedes.error };
+                try {
+                    return db.createDecision({
+                        project_root: projectRoot,
+                        scope,
+                        title,
+                        content,
+                        tags: asStrArr(args.tags),
+                        ttl_days: asNum(args.ttl_days),
+                        supersedes: supersedes.id,
+                        created_by: instance,
+                    });
+                }
+                catch (err) {
+                    return { error: err.message }; // a refused predecessor: nothing was inserted
+                }
             }
             // #2152: titles by default (agend-agent decision-list); one decision's full text by id (decision-get <id>).
             // The CLI sends include_archived (snake case, as the MCP tool): both spellings are read.
@@ -12157,16 +12537,89 @@ export class FleetManager {
         }
         return adapter.createTopic(topicName);
     }
-    async deleteForumTopic(topicId, adapterId) {
-        try {
-            const adapter = (adapterId ? this.worlds.get(adapterId)?.adapter : undefined) ?? this.adapter;
-            if (!adapter?.deleteTopic)
-                return;
-            await adapter.deleteTopic(topicId);
-        }
-        catch (err) {
-            this.logger.warn({ err, topicId }, "Failed to delete forum topic during rollback");
-        }
+    /**
+     * Delete an agent and, unless asked not to, its own chat topic (user decision: by default). The topic is planned
+     * before the removal (its id and bot go with the fleet.yaml entry) and deleted through the agent's OWN bot after it;
+     * the outcome is the platform's answer (instance-topic-delete.ts). A topic that cannot go never fails the removal.
+     */
+    async removeInstanceAndTopic(name, authorization, opts) {
+        const plan = opts.deleteTopic ? this.planInstanceTopicDelete(name) : null;
+        if (opts.execution)
+            await this.removeInstance(name, authorization, opts.execution);
+        else
+            await this.removeInstance(name, authorization);
+        // #3055 review (Prism P1): asked again right before the platform call — the fleet as it is NOW, not as planned
+        // before the removal was awaited (a new owner of the topic, or the bot rebuilt).
+        return deletePlannedTopic(plan, this.logger, (p) => {
+            if (this.instanceTopicAdapter(p.adapterId) !== p.adapter)
+                return "the agent's bot changed while it was being deleted, so its topic was left";
+            return topicMustStay(p.destination, this.topicOwnership(), null); // the original is gone: every owner now counts
+        }, { begin: (d) => this.topicDeletionsInFlight.add(d), end: (d) => this.topicDeletionsInFlight.delete(d) });
+    }
+    /** #3055: destinations whose platform deletion is running now; a binding to one waits until it is over. */
+    topicDeletionsInFlight = new Set();
+    /** True while a topic with this id is being deleted on any connection (a new binding of it is refused meanwhile). */
+    isTopicDeletionInFlight(topicId) {
+        const tail = `:${topicId}`;
+        return [...this.topicDeletionsInFlight].some(d => d.endsWith(tail));
+    }
+    /**
+     * #3055 review r2 (Prism P1-3): would this instance config bind a topic whose deletion is running now? Compared by
+     * physical destination, so the same thread number in another Telegram group is not held. Settings asks it at commit.
+     */
+    topicBindingInFlight(inst) {
+        if (this.topicDeletionsInFlight.size === 0 || inst.topic_id == null || inst.topic_id === "")
+            return false;
+        const adapterId = typeof inst.channel_id === "string" && inst.channel_id ? inst.channel_id : this.getPrimaryAdapterId();
+        return this.topicDeletionsInFlight.has(this.destinationFor(adapterId, inst.topic_id));
+    }
+    /** Any topic deletion running now (a connection's group or General may not be re-pointed meanwhile). */
+    topicDeletionPending() { return this.topicDeletionsInFlight.size > 0; }
+    /** The physical destination of `topicId` on the bot `adapterId`. */
+    destinationFor(adapterId, topicId) {
+        const world = adapterId ? this.worlds.get(adapterId) : undefined;
+        const platform = world?.adapter?.type ?? this.getChannelConfig(adapterId)?.type;
+        const groupId = world?.groupId ?? String(this.getChannelConfig(adapterId)?.group_id ?? "");
+        return topicDestination(platform, groupId, adapterId, topicId);
+    }
+    /** The adapter of the bot `adapterId` names — never a substitute for a bot that is not there. */
+    instanceTopicAdapter(adapterId) {
+        return (adapterId ? this.worlds.get(adapterId)?.adapter : this.worlds.size === 0 ? this.adapter ?? undefined : undefined) ?? undefined;
+    }
+    /**
+     * Topic ownership by physical destination (#3055 review, Prism P1): an instance's topic is where its bot's platform
+     * puts it (a Telegram group + thread, a Discord channel), so two bots in one group, or two instances on one
+     * channel, are seen to share it; and every connection's own General is protected, with or without a General agent.
+     */
+    topicOwnership() {
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const destinationOf = (n) => {
+            const cfg = this.fleetConfig?.instances?.[n];
+            if (!cfg || cfg.topic_id == null || cfg.topic_id === "")
+                return null;
+            return this.destinationFor(this.getInstanceAdapterId(n), cfg.topic_id);
+        };
+        const generalDestinations = () => {
+            const out = new Set();
+            for (const ch of channels) {
+                const id = ch.id ?? ch.type;
+                const groupId = this.worlds.get(id)?.groupId ?? (ch.group_id != null ? String(ch.group_id) : undefined);
+                if (ch.type === "telegram")
+                    out.add(topicDestination("telegram", groupId, id, 1));
+                if (ch.type === "discord") {
+                    const gcid = discordGeneralChannelId(ch);
+                    if (gcid)
+                        out.add(topicDestination("discord", groupId, id, gcid));
+                }
+            }
+            return out;
+        };
+        return { instances: this.fleetConfig?.instances, destinationOf, generalDestinations };
+    }
+    /** What deleting `name`'s topic would act on: its own bot only — a bot that is not there is never substituted. */
+    planInstanceTopicDelete(name) {
+        const adapterId = this.getInstanceAdapterId(name);
+        return planInstanceTopicDelete({ name, adapterId, adapter: this.instanceTopicAdapter(adapterId), ...this.topicOwnership() });
     }
     getForumTopicDeleter(adapterId) {
         const adapter = (adapterId ? this.worlds.get(adapterId)?.adapter : undefined) ?? this.adapter;
@@ -12567,6 +13020,7 @@ export class FleetManager {
             Object.assign(current, resolved);
         }
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        this.agentCredentialsCache?.observePolicies();
         this.refreshSavedDashboardPermissions();
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
     }
@@ -12855,6 +13309,9 @@ export class FleetManager {
                 await this.lifecycle.remove(name, authorization, execution, transition);
             else
                 await this.lifecycle.remove(name, authorization);
+            // #1490 row 27: its hang/exit offers were for the instance now gone (stopInstance clears them; removal stops
+            // through the lifecycle directly). The offers' own lifecycle pins refuse them too.
+            this.clearNoncePromptsForInstance(name);
             // #1774: removed — its replies still copying their files are no one's to show, replaced or not (a failed removal
             // throws above: its replies stay its own).
             this.webChatRemovals.set(name, { below: removedBelow, ...(removedDaemon !== undefined ? { daemon: removedDaemon } : {}) });
@@ -14529,6 +14986,7 @@ export class FleetManager {
             threadId: opts.threadId,
             expiredText: opts.expiredText,
             createdAt: Date.now(),
+            lifecycleCurrent: this.lifecyclePin(opts.instanceName),
             ...opts.extra,
         };
         entry.timer = setTimeout(() => {
@@ -14880,6 +15338,7 @@ export class FleetManager {
         const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
             name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(name), profile: this.usageProfileOf(name, this.backendNameOf(name)),
+            ...(this.backendNameOf(name) === "codex" ? { profileTimelinePath: join(this.getInstanceDir(name), PROFILE_TIMELINE_FILE) } : {}),
             kiroDbPath: this.kiroDbPathOf(name, this.backendNameOf(name)),
         }));
         const taken = new Set(fleet.map(i => i.name));
@@ -14891,6 +15350,9 @@ export class FleetManager {
             claudeConfigDir: this.claudeConfigDirOf(ch.instanceName),
             profile: this.usageProfileOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
             kiroDbPath: this.kiroDbPathOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
+            // #3066 §1d (Fable r1 #2): a ClassicBot Codex room records its launches too (onDaemonReady) — read them the same way.
+            ...((this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend) === "codex"
+                ? { profileTimelinePath: join(this.getInstanceDir(ch.instanceName), PROFILE_TIMELINE_FILE) } : {}),
         }));
         return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
     }
@@ -15051,7 +15513,8 @@ export class FleetManager {
             out.push({
                 name, state: p.state ?? undefined,
                 interaction: p.interaction ? { kind: p.interaction.kind, owner: wait?.owner ?? null, episode: p.interaction.episode, since: p.interaction.since } : null,
-                interactionSummary: p.interaction_summary ?? null,
+                interactionSummary: p.interaction?.kind === "kiro_choice" ? t("kiro3.running") : p.interaction_summary ?? null,
+                kiroCompatibility: this.kiroCompatibilityHolds?.get(name),
                 pauseReason, pausedAt,
                 crashedAt: crashed ? (this.needsCrashedAt.get(name) ?? null) : null,
                 signIn: pauseReason === "auth" ? this.signInFor(name) : null,
@@ -15127,6 +15590,10 @@ export class FleetManager {
                     throw new Error("the delivery outbox is not open");
                 return this.deliveryOutbox.acknowledge(deliveryId, by);
             },
+            missedOffline: () => (this.missedOfflineStore?.list(Date.now()) ?? []).map(m => ({
+                id: m.id, instance: m.instance, owner: m.adapterId, username: m.username, place: m.place, preview: m.preview, since: m.since,
+            })),
+            acknowledgeMissed: (id, by) => this.missedOfflineStore?.acknowledge(id, by) ?? false,
             tasks: () => this.needsYouTaskItems(),
             backendSignIns: () => this.needsYouBackendSignIns(),
             configIssues: () => (this.configHistory?.currentIssues() ?? []).map(issue => ({
@@ -15841,8 +16308,9 @@ export class FleetManager {
                 return r.ok ? { ok: true, until: Math.min(r.authorization.until, record.absoluteExpiry) } : { ok: false, refusal: r.refusal };
             },
             signOut: (handle) => {
-                this.webSessions?.revokeByHandle(handle);
-                this.sessionAuthorizationStore()?.prune(a => a.handle !== handle);
+                const session = this.webSessions?.revokeByHandle(handle) ?? { found: false, durable: true };
+                const authorization = this.sessionAuthorizationStore()?.prune(a => a.handle !== handle) ?? { dropped: 0, durable: true };
+                return { durable: session.durable, authorizationDurable: authorization.durable };
             },
             event: (type, payload) => { try {
                 this.eventLog?.insert("web", type, payload);
@@ -15855,6 +16323,7 @@ export class FleetManager {
                 expired: (c) => t("web_auth.card_expired", c.label),
                 refused: (c) => t("web_auth.card_refused", c.label, t(`web_auth.refusal_${c.refusal}`)),
                 revoked: (c) => t("web_auth.card_revoked", c.label),
+                notSaved: (c) => t("web_auth.card_not_saved", c.label),
                 ended: (c) => t("web_auth.card_ended", c.label),
                 generalHint: () => t("web_auth.general_hint"),
                 confirmLabel: () => t("web_auth.confirm"),
@@ -16242,21 +16711,27 @@ export class FleetManager {
         if (claimed === "consumed")
             return true;
         const { entry: pending, action } = claimed;
+        // #1490 row 27: the lifecycle the button was offered for — a replacement since (removal does not clear prompts) is stale.
+        const current = pending.lifecycleCurrent ?? this.lifecyclePin(pending.instanceName);
         this.eventLog?.insert(pending.instanceName, oom ? "session_oom_action" : "normal_exit_action", { action, userId: data.userId });
         if (action === "ignore") {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("exit.ignored", pending.instanceName));
             return true;
         }
+        if (!current()) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("restart.superseded", this.shownInstanceName(pending.instanceName)));
+            return true;
+        }
         await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("exit.restarting", pending.instanceName));
         try {
-            await this.restartSingleInstance(pending.instanceName, { explicit: true, ...(oom ? { freshStart: action === "fresh", sessionOomRetry: pending.sessionOomRetry,
+            await this.restartSingleInstance(pending.instanceName, { explicit: true, ownerCurrent: current, ...(oom ? { freshStart: action === "fresh", sessionOomRetry: pending.sessionOomRetry,
                     ...(pending.confirmationCurrent ? { recoveryCurrent: pending.confirmationCurrent } : {}) } : {}) });
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("exit.restarted", pending.instanceName), pending.threadId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             this.logger.error({ err, instanceName: pending.instanceName }, "Normal-exit restart failed");
-            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("exit.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show normal-exit restart error"));
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, err instanceof RestartSupersededError ? message : t("exit.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show normal-exit restart error"));
         }
         return true;
     }
@@ -16769,7 +17244,14 @@ export class FleetManager {
             return;
         }
         const publication = this.beginCancelButtonPublication(instanceName, correlationId);
-        const initialProgressText = FleetManager.progressText(0, null, 1, this.progressPrefixFor(instanceName, 0, 1));
+        // M-2391: a re-post below a reply (preserveProgress) continues the same turn — its elapsed time continues from
+        // the live bubble's start, as its tool list does. Restarting it at 0 meant an agent replying more often than the
+        // threshold never showed elapsed time at all. A fresh turn (no preserve) starts at 0 as before.
+        const carriedStart = preserveProgress ? this.liveButtonStart(instanceName) : undefined;
+        const carriedMs = carriedStart !== undefined ? Math.max(0, Date.now() - carriedStart) : 0;
+        const initialProgressText = carriedStart !== undefined && carriedMs >= this.progressMinElapsedMs()
+            ? FleetManager.progressText(carriedMs, null, this.progressMinElapsedMs(), this.progressPrefixFor(instanceName, carriedMs))
+            : FleetManager.progressText(0, null, 1, this.progressPrefixFor(instanceName, 0, 1));
         try {
             const sent = await adapter.notifyAlert(chatId, {
                 type: "cancel",
@@ -16778,6 +17260,9 @@ export class FleetManager {
                 choices: [{ id: `cancel:${instanceName}`, label: t("cancel.button") }],
             }, threadId ? { threadId } : undefined);
             publication.inFlight = false;
+            // #2940: a status bubble of ours — never a chat-log line, for any bot of this fleet in the room; one a sibling
+            // already logged (its gateway event can come before this answer) is taken out again.
+            this.noteOwnStatusMessage(adapter, sent);
             const entry = {
                 instanceName,
                 adapterId,
@@ -16789,7 +17274,7 @@ export class FleetManager {
                 // Elapsed time is measured from when this button was posted — i.e. from
                 // when the work was handed over — not from the pane's working transition,
                 // which resets if the CLI blips idle mid-turn.
-                startedAt: Date.now(),
+                startedAt: carriedStart ?? Date.now(),
                 // Matches the text notifyAlert just posted, so the first 60s tick does
                 // not re-edit identical text — which put a "(edited)" mark on Discord
                 // with nothing visibly changed.
@@ -16912,14 +17397,16 @@ export class FleetManager {
      * Make a tool summary safe to paste into a channel message.
      *
      * The text is agent-controlled (it is built from tool inputs — file paths,
-     * shell commands), so it gets flattened to one line, capped, and stripped of
-     * the two Discord mass-mention triggers. Neither channel renders it with a
-     * parse mode, so no markup escaping is needed beyond that.
+     * shell commands), so it gets flattened to one line, secrets masked, capped,
+     * and stripped of the two Discord mass-mention triggers. Masking comes BEFORE
+     * the cap: a cap can cut a mask's context but must never be what hides (or
+     * fails to hide) a secret. Neither channel renders it with a parse mode, so no
+     * markup escaping is needed beyond that.
      */
     static sanitizeActivity(activity) {
         if (!activity)
             return null;
-        const flat = activity.replace(/\s+/g, " ").replace(/@(everyone|here)/g, "@​$1").trim();
+        const flat = maskSecrets(activity.replace(/\s+/g, " ")).replace(/@(everyone|here)/g, "@​$1").trim();
         if (!flat)
             return null;
         return flat.length > PROGRESS_ACTIVITY_MAX_CHARS
@@ -17038,6 +17525,12 @@ export class FleetManager {
         }
         return PROGRESS_MIN_ELAPSED_MS;
     }
+    /** M-2391: when the instance's live (not retiring) bubble started — the current turn's start — or undefined. */
+    liveButtonStart(instanceName) {
+        const starts = [...this.cancelButtons.values()].filter((e) => e.instanceName === instanceName && !e.retiring && typeof e.startedAt === "number")
+            .map((e) => e.startedAt);
+        return starts.length ? Math.min(...starts) : undefined;
+    }
     startProgressTicker(entry) {
         const tick = () => this.refreshBubble(entry);
         entry.progressTimer = setInterval(tick, PROGRESS_UPDATE_INTERVAL_MS);
@@ -17047,7 +17540,9 @@ export class FleetManager {
         // one additional edit per turn that lives past the threshold.
         const firstAt = this.progressMinElapsedMs() - (Date.now() - (entry.startedAt ?? Date.now()));
         if (firstAt > 0 && firstAt < PROGRESS_UPDATE_INTERVAL_MS) {
-            const firstTick = setTimeout(tick, firstAt);
+            // M-2391: a little past the threshold — a timer can fire a millisecond before Date.now() reaches it, which
+            // rendered the unchanged "處理中…" text and skipped the edit until the next 60 s interval.
+            const firstTick = setTimeout(tick, firstAt + PROGRESS_THRESHOLD_MARGIN_MS);
             firstTick.unref?.();
         }
     }
@@ -17365,7 +17860,10 @@ export class FleetManager {
         return this.browserBackendSignInsInstance ??= new BrowserBackendSignIns({
             dataDir: this.dataDir, lock: this.loginWindow,
             current: owner => this.browserSignInOwnerCurrent(owner),
-            installed: async () => ONBOARDING_BACKENDS.filter(backend => this.isCliInstalled(backend)),
+            installed: async () => {
+                const found = await Promise.all(ONBOARDING_BACKENDS.map(async (backend) => (await this.isCliInstalledOffLoop(backend)) ? backend : null));
+                return found.filter((backend) => backend !== null);
+            },
             checkAuth: backend => checkAuthStatus(LOGIN_FLOWS[backend].authCheck),
             checkConsoleAuth: () => checkAuthStatus(LOGIN_FLOWS.antigravity.authCheck),
             transport: () => createStructuredSignInTransport(),
@@ -17469,13 +17967,13 @@ export class FleetManager {
      * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
      * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
      */
-    startWebDashboardLogin(backendArg, chat, opts) {
+    async startWebDashboardLogin(backendArg, chat, opts) {
         const wanted = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
         if (isRemovedBackend(wanted))
-            return Promise.resolve(removedBackendMessage(wanted));
+            return removedBackendMessage(wanted);
         const info = BACKEND_INSTALLATION_INFO[wanted];
-        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !this.isCliInstalled(wanted)) {
-            return Promise.resolve(t("login.web_dashboard_not_installed", wanted, info.install));
+        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !(await this.isCliInstalledOffLoop(wanted))) {
+            return t("login.web_dashboard_not_installed", wanted, info.install);
         }
         if (!opts.skipAuthCheck)
             this.recordLoginFlow(wanted, "login", chat.userId);
@@ -17523,8 +18021,10 @@ export class FleetManager {
                 ? removedBackendMessage(backend)
                 : !installed.has(backend)
                     ? (BACKEND_INSTALLATION_INFO[backend] ? t("login.install_by_name", backend) : t("login.install_on_host", backend))
+                    // #2981: one short line in the bare /login list — the full refusal (why, and what to run) is `/login <it>`'s;
+                    // a bare /login used to post Antigravity's whole paragraph to someone who never asked about it.
                     : flow?.remoteLogin === "unsupported"
-                        ? t("login.remote_unsupported_agent_cli", backend, flow.command)
+                        ? t("login.host_only", flow.command)
                         : backend === "opencode" ? t("login.unsupported", backend) : t("login.no_remote_flow", backend)}`).join("\n");
             await chat.adapter.sendText(chat.chatId, guidance, { threadId: chat.threadId })
                 .catch(err => this.logger.warn({ err }, "Failed to post unsupported login guidance"));
@@ -17703,7 +18203,8 @@ export class FleetManager {
                 return admitted.refusal;
             opts = { ...opts, profile: admitted.profile };
         }
-        if (BACKEND_INSTALLATION_INFO[wanted] && !this.isCliInstalled(wanted)) {
+        // M-2281: asked off the fleet loop — this runs on a chat click.
+        if (BACKEND_INSTALLATION_INFO[wanted] && !(await this.isCliInstalledOffLoop(wanted))) {
             const flow = LOGIN_FLOWS[wanted];
             this.recordLoginFlow(wanted, flow && flow.remoteLogin !== "unsupported" ? "install_then_login" : "install_only", chat.userId);
             return opts.profile !== undefined
@@ -17928,6 +18429,8 @@ export class FleetManager {
     // installer, judge by exit code, verify the binary on a fresh login shell,
     // then sign in (the hand-off below).
     activeInstall = null;
+    /** M-2281: how long `/login`'s install window may run (a field so a smoke can shorten it). */
+    installTimeoutMs = INSTALL_TIMEOUT_MS;
     /** An install that succeeded, between its success line and the sign-in it hands over to (#1131). */
     installHandoff = null;
     /** Start a CLI install session. Caller enforces admin. */
@@ -17936,11 +18439,13 @@ export class FleetManager {
         const info = BACKEND_INSTALLATION_INFO[backend];
         if (!info)
             return t("install.unsupported", backendArg);
-        if (checkBinaryInstalled(info.binary))
-            return t("install.already", backend, info.binary);
         // Reserve the fleet-wide window before the first await (shared with web
         // login). Owned by this method until the session is published.
         const claim = this.loginWindow.tryClaim("install", backend);
+        if (claim && await checkBinaryInstalledAsync(info.binary)) {
+            this.loginWindow.release(claim);
+            return t("install.already", backend, info.binary);
+        }
         if (!claim)
             return this.loginWindow.busyMessage();
         let tmux;
@@ -17960,16 +18465,44 @@ export class FleetManager {
         // A synthetic flow: success is decided by the installer's exit code
         // (LoginSession treats a clean exit as success), never by pane text. The
         // session only judges that verdict; it does not read the output for URLs or prompts.
+        // M-2281 (#2980): no terminal to ask on, low priority, stoppable as a whole, the user's own $SHELL — see
+        // unattended-install.ts. A prompt nobody can answer fails at once instead of waiting out the timeout.
+        const shell = (await loginShell()) ?? null;
+        if (!this.loginWindow.isCurrent(claim)) {
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
+        }
         const flow = {
             backend,
-            command: info.unattended ?? info.install,
+            command: unattendedInstallCommand(info.unattended ?? info.install, shell),
             successPattern: /$^/,
-            timeoutMs: 10 * 60 * 1000,
+            timeoutMs: this.installTimeoutMs,
         };
+        // M-2281: the installer's output, live, in the chat that asked — no page shows this window.
+        // Telegram gets its own <pre> (its markdown conversion keeps a fence as literal backticks); others a fenced block.
+        const frameStyle = chat.adapter.type === "telegram" ? "html" : "markdown";
+        const stream = new InstallStream({
+            send: text => chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId, allowedMentions: { parse: [] } }),
+            edit: (messageId, text) => chat.adapter.editMessage(chat.chatId, messageId, text, chat.threadId, { format: frameStyle }),
+            warn: (message, err) => this.logger.debug({ backend, err: err?.message ?? String(err) }, message),
+        }, t("install.stream_running", backend), undefined, undefined, frameStyle);
+        const minutes = String(Math.max(1, Math.round(this.installTimeoutMs / 60_000)));
         const session = new LoginSession(flow, tmux, {
+            onProgress: pane => stream.update(pane),
             onDone: async ({ ok, detail, cleanupFailed }) => {
                 this.activeInstall = null;
                 this.loginWindow.release(claim);
+                // Between the install ending and the sign-in starting there is no
+                // session to cancel; this hand-off is what `/login cancel` stops — armed
+                // before the first await here, so a cancel during any of them counts.
+                const handoff = ok ? { backend, cancelled: false } : null;
+                if (handoff)
+                    this.installHandoff = handoff;
+                // The live view's last frame first, so the result line below follows the output it is about.
+                await stream.finish(ok ? t("install.stream_ok", backend)
+                    : detail === "timeout" ? t("install.stream_timeout", backend, minutes)
+                        : detail === "cancelled" ? t("install.stream_cancelled", backend)
+                            : t("install.stream_failed", backend)).catch(() => { });
                 if (cleanupFailed) {
                     await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
                 }
@@ -17977,18 +18510,17 @@ export class FleetManager {
                     // A cancel is user-initiated — the cancel command's own reply already
                     // said so; a second message here would be a duplicate.
                     if (detail !== "cancelled") {
-                        await chat.adapter.sendText(chat.chatId, t("install.failed", backend, detail), { threadId: chat.threadId }).catch(() => { });
+                        await chat.adapter.sendText(chat.chatId, detail === "timeout" ? t("install.timeout", backend, minutes) : t("install.failed", backend, detail), { threadId: chat.threadId }).catch(() => { });
                     }
                     return;
                 }
-                // Between the install ending and the sign-in starting there is no
-                // session to cancel; this hand-off is what `/login cancel` stops — from
-                // here on, as the login-shell lookup below is an await.
-                const handoff = { backend, cancelled: false };
-                this.installHandoff = handoff;
+                if (!handoff || handoff.cancelled || this.installHandoff !== handoff)
+                    return;
                 // The installer may only have added the binary to a profile PATH; a
                 // fresh login shell sees that, the fleet process's PATH may not.
-                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? this.locateInInstallerBinDirs(info);
+                // #3009 (leader, cid-3017-3029-overlap): both lookups off the fleet's main thread — the login shell's own check,
+                // then the installer's own directories through backend-availability's check (a killable child tests each one).
+                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? (await this.locateInstalledBackend(backend));
                 if (handoff.cancelled || this.installHandoff !== handoff)
                     return;
                 if (!installedAt) {
@@ -18058,6 +18590,11 @@ export class FleetManager {
         const info = BACKEND_INSTALLATION_INFO[backend];
         return !!info && checkBinaryInstalled(info.binary);
     }
+    /** M-2281: isCliInstalled without holding the fleet loop (a chat click's path: `which` on a slow PATH can take seconds). */
+    async isCliInstalledOffLoop(backend) {
+        const info = BACKEND_INSTALLATION_INFO[backend];
+        return !!info && await checkBinaryInstalledAsync(info.binary);
+    }
     /** Abort the active install (`/login cancel`) and remove its window. */
     async cancelInstallSession() {
         if (!this.activeInstall)
@@ -18075,38 +18612,27 @@ export class FleetManager {
      */
     async locateBinaryOnLoginShell(binary) {
         try {
-            const result = await runOnLoginShell(`command -v ${binary}`);
+            // #3009: the executable-file check runs inside the same login shell (a killable child), never as accessSync/statSync
+            // on the fleet's thread — a path on a filesystem that stopped answering held the whole fleet there.
+            const result = await runOnLoginShell(`p=$(command -v ${binary}) && [ -f "$p" ] && [ -x "$p" ] && printf '%s\n' "$p"`);
             if (result.status !== 0)
                 return null;
             const path = result.stdout.trim().split("\n").pop()?.trim() ?? "";
-            if (!isAbsolute(path))
-                return null;
-            accessSync(path, fsConstants.X_OK);
-            return statSync(path).isFile() ? path : null;
+            return isAbsolute(path) ? path : null;
         }
         catch {
             return null;
         }
     }
     /**
-     * #1092: the binary in one of the directories its own installer installs to,
-     * when no login shell can see it (the installer recorded its PATH in an
-     * interactive-only rc file). The same executable-file check as the login
-     * shell lookup; a symlink to an executable counts, as codex's launcher is one.
+     * #1092: the binary in one of the directories its own installer installs to, when no login shell can see it (the
+     * installer recorded its PATH in an interactive-only rc file) — only those directories (#1092). #3009: through
+     * backend-availability's install-directory check (the one resolveBackendBinary uses): one killable child, never
+     * accessSync/statSync on the fleet's thread. An executable file counts, a symlink to one too (codex's launcher is one).
      */
-    locateInInstallerBinDirs(info) {
-        for (const dir of info.binDirs?.(process.env, homedir()) ?? []) {
-            if (!isAbsolute(dir))
-                continue;
-            const path = join(dir, info.binary);
-            try {
-                accessSync(path, fsConstants.X_OK);
-                if (statSync(path).isFile())
-                    return path;
-            }
-            catch { /* not there */ }
-        }
-        return null;
+    async locateInstalledBackend(backend) {
+        const info = BACKEND_INSTALLATION_INFO[backend];
+        return info ? (await findExecutableIn(info.binary, info.binDirs?.(process.env, homedir()) ?? [])) ?? null : null;
     }
     /** Put an installed binary's directory on the fleet's PATH (#1059), once. */
     adoptBinaryDirectory(binaryPath, backend) {
@@ -18422,20 +18948,26 @@ export class FleetManager {
         if (claimed === "consumed")
             return true;
         const { entry: pending, action } = claimed;
+        // #1490 row 27: the lifecycle the button was offered for — a replacement since (removal does not clear prompts) is stale.
+        const current = pending.lifecycleCurrent ?? this.lifecyclePin(pending.instanceName);
         this.eventLog?.insert(pending.instanceName, "hang_action", { action, userId: data.userId });
         if (action === "wait") {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("hang.waiting", pending.instanceName));
             return true;
         }
+        if (!current()) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("restart.superseded", this.shownInstanceName(pending.instanceName)));
+            return true;
+        }
         await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("hang.restarting", pending.instanceName));
         try {
-            await this.restartSingleInstance(pending.instanceName, { explicit: true });
+            await this.restartSingleInstance(pending.instanceName, { explicit: true, ownerCurrent: current });
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("hang.restarted", pending.instanceName), pending.threadId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             this.logger.error({ err, instanceName: pending.instanceName }, "Hang force-restart failed");
-            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("hang.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show hang restart error"));
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, err instanceof RestartSupersededError ? message : t("hang.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show hang restart error"));
         }
         return true;
     }
@@ -18511,6 +19043,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     resolveKnowledgeWorkDir(workDir, backend, instanceName) {
         // Backend resolution may create/normalize the real cwd. Instructions and
         // skills must land where the CLI actually runs, not an assumed path.
+        // Caller pins resolveBackendBinary first so createBackend does not `which`.
         try {
             const resolved = createBackend(backend, join(getAgendHome(), "cli-env"))
                 .resolveWorkingDirectory?.(workDir, instanceName);
@@ -18889,6 +19422,45 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         await adapter.sendText(msg.chatId, t("cmd.not_a_command"), { threadId: msg.threadId });
         return true;
     }
+    /** #2940: this fleet's own status bubbles and the messages the platform said were deleted (ids, never text). */
+    ownStatusMessages = new OwnStatusMessages();
+    /**
+     * #2940: a status bubble of ours was posted: never logged, and a line already logged for it (by a sibling bot) goes.
+     * Discord only (#2943 review: the only platform where our bots see each other's posts), keyed by channel and id.
+     */
+    noteOwnStatusMessage(adapter, sent) {
+        if (adapter.type !== "discord")
+            return;
+        const key = discordMessageKey(sent.threadId ?? sent.chatId, sent.messageId);
+        if (!key)
+            return;
+        this.ownStatusMessages.addStatus(key);
+        const removed = ClassicChannelManager.loggedLines.remove(key);
+        if (removed)
+            this.logger.debug({ key, removed }, "A status bubble logged before its id was known was taken out of the chat log");
+    }
+    /** #2940: Discord says a message was deleted — its chat-log line goes, and it is never logged after this. */
+    onPlatformMessageDeleted(e) {
+        const key = discordMessageKey(e?.channelId, e?.messageId);
+        if (!key)
+            return;
+        this.ownStatusMessages.markDeleted(key);
+        const removed = ClassicChannelManager.loggedLines.remove(key);
+        if (removed)
+            this.logger.debug({ key, removed }, "A deleted message was taken out of the chat log");
+    }
+    /** #2940: the key a Discord message's chat-log line is kept under (none for another platform: nothing is tracked). */
+    chatLogKey(msg) {
+        return msg.source === "discord" ? discordMessageKey(msg.threadId ?? msg.chatId, msg.messageId) : undefined;
+    }
+    /** #2940: whether `msg` must not enter the chat log (only its key is looked at; the debug trail names keys, not text). */
+    chatLogExcludes(instanceName, msg) {
+        const key = this.chatLogKey(msg);
+        if (!this.ownStatusMessages.excluded(key))
+            return false;
+        this.logger.debug({ instanceName, key }, "Not logged: a status bubble of this fleet, or a deleted message");
+        return true;
+    }
     /** Handle a message in a classic channel: log it, forward only /chat messages */
     async handleClassicChannelMessage(instanceName, msg) {
         const text = msg.text ?? "";
@@ -18932,7 +19504,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 : (msg.attachments?.length
                     ? ` [${msg.attachments.map(a => `${a.kind === "photo" ? "📷" : "📎"} ${a.filename || a.kind}`).join(", ")}]`
                     : "");
-            ClassicChannelManager.logMessage(instanceName, msg.username, text + collabAttachTag, msg.timestamp, msg.replyToText);
+            // #2940: one of this fleet's own status bubbles (any bot's), or a message already deleted, never enters the log.
+            if (this.chatLogExcludes(instanceName, msg))
+                return;
+            ClassicChannelManager.logMessage(instanceName, msg.username, text + collabAttachTag, msg.timestamp, msg.replyToText, this.chatLogKey(msg));
             this.logger.info({ instanceName, user: msg.username, textLen: text.length, attachments: msg.attachments?.length ?? 0, source: msg.source }, "Collab mode message");
             // Check for @mention trigger: must be exact <@BOT_USER_ID>, not @everyone/@here.
             // Each bot matches ONLY its own id. A secondary bot must NOT fall back to the
@@ -19033,7 +19608,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const attachmentTag = saved ? ` [${saved.kind === "photo" ? "📷" : "📎"} saved: ${saved.paths.join(", ")}]`
             : msg.attachments?.length ? ` [${msg.attachments.map(a => `📎 ${a.kind}${a.filename ? `: ${a.filename}` : ""}`).join(", ")}]`
                 : "";
-        ClassicChannelManager.logMessage(instanceName, msg.username, text + attachmentTag, msg.timestamp, msg.replyToText);
+        // #2940: likewise in a room without collab (a bot's message reaches here only through a /chat text command).
+        if (!this.chatLogExcludes(instanceName, msg))
+            ClassicChannelManager.logMessage(instanceName, msg.username, text + attachmentTag, msg.timestamp, msg.replyToText, this.chatLogKey(msg));
         // Bare attachment without /chat: save + log only, don't trigger agent
         if (!isChat) {
             const reactAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
@@ -19789,7 +20366,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }));
         const timer = setTimeout(() => this.pendingEffortSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
+        this.pendingEffortSelects.set(nonce, { instanceName: name, instanceCurrent: this.lifecyclePin(name), userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
         try {
             await data.respondChoices(t("effort.menu", this.effortMenuHeader(name)), choices);
         }
@@ -19824,7 +20401,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingEffortSelects.set(nonce, { instanceName, instanceCurrent: this.lifecyclePin(instanceName), userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("effort.menu", this.effortMenuHeader(instanceName)), choices, { threadId });
             const pending = this.pendingEffortSelects.get(nonce);
@@ -19849,6 +20426,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingEffortSelects.get(match[1]);
         if (!pending)
             return true;
+        // #1490 row 27: the menu was for one lifecycle of the instance; stopped, restarted or replaced since, it is stale.
+        if (!pending.instanceCurrent()) {
+            this.pendingEffortSelects.delete(match[1]);
+            clearTimeout(pending.timer);
+            data.ack?.(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName)));
+            await pending.respond(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))).catch(() => { });
+            return true;
+        }
         // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
         // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
@@ -19891,17 +20476,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             let result;
             try {
                 // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
-                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
-                    ? await withSpawnHoldReply(async (text) => {
-                        if (pending.adapter && pending.adapterChatId) {
-                            if (progressMsgId)
-                                await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                result = !pending.instanceCurrent() ? t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))
+                    : this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                        ? await withSpawnHoldReply(async (text) => {
+                            if (pending.adapter && pending.adapterChatId) {
+                                if (progressMsgId)
+                                    await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                                else
+                                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+                            }
                             else
-                                await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
-                        }
-                        else
-                            await pending.respond(text);
-                    }, () => this.applyEffort(pending.instanceName, level)) : t("menu.click_stale");
+                                await pending.respond(text);
+                        }, () => this.applyEffort(pending.instanceName, level, { current: pending.instanceCurrent })) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
@@ -19958,7 +20544,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const choices = this.modelMenuChoices(name, nonce, options, currentModel);
         const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
+        this.pendingModelSelects.set(nonce, { instanceName: name, instanceCurrent: this.lifecyclePin(name), model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
         try {
             await data.respondChoices(t("model.menu", `**${currentDisplay}**`), choices);
         }
@@ -19994,7 +20580,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingModelSelects.set(nonce, { instanceName, instanceCurrent: this.lifecyclePin(instanceName), model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("model.menu", currentDisplay), choices, { threadId });
             const pending = this.pendingModelSelects.get(nonce);
@@ -20167,6 +20753,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingModelSelects.get(match[1]);
         if (!pending)
             return true;
+        // #1490 row 27: the menu was for one lifecycle of the instance; stopped, restarted or replaced since, it is stale.
+        if (!pending.instanceCurrent()) {
+            this.pendingModelSelects.delete(match[1]);
+            clearTimeout(pending.timer);
+            data.ack?.(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName)));
+            await pending.respond(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))).catch(() => { });
+            return true;
+        }
         // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
         // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
@@ -20227,17 +20821,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             let result;
             try {
                 // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
-                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
-                    ? await withSpawnHoldReply(async (text) => {
-                        if (pending.adapter && pending.adapterChatId) {
-                            if (progressMsgId)
-                                await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                result = !pending.instanceCurrent() ? t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))
+                    : this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                        ? await withSpawnHoldReply(async (text) => {
+                            if (pending.adapter && pending.adapterChatId) {
+                                if (progressMsgId)
+                                    await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                                else
+                                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+                            }
                             else
-                                await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
-                        }
-                        else
-                            await pending.respond(text);
-                    }, () => this.applyModel(pending.instanceName, model)) : t("menu.click_stale");
+                                await pending.respond(text);
+                        }, () => this.applyModel(pending.instanceName, model, { current: pending.instanceCurrent })) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
@@ -20330,7 +20925,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * restart backends only read it at launch, so it is persisted and the
      * instance respawns.
      */
-    async applyEffort(instanceName, requested) {
+    async applyEffort(instanceName, requested, opts) {
+        // #1490 row 27: a menu's choice is for the lifecycle it was offered to — asked first and fenced into the restart.
+        if (opts?.current && !opts.current())
+            return t("menu.instance_replaced", this.shownInstanceName(instanceName));
         const level = requested.trim().toLowerCase();
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "unsupported";
@@ -20365,10 +20963,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pasteRawToClassicInstance(instanceName, `/effort ${applied}`);
             return `${warn}${t("effort.runtime_success", instanceName, applied)}`;
         }
-        await this.restartSingleInstance(instanceName);
+        await this.restartSingleInstance(instanceName, { ownerCurrent: opts?.current });
         return `${warn}${t("effort.restart_success", instanceName, applied)}`;
     }
-    async applyModel(instanceName, model) {
+    async applyModel(instanceName, model, opts) {
+        // #1490 row 27: a menu's choice is for the lifecycle it was offered to — asked first, after the runtime switch's
+        // await, and fenced into the restart.
+        if (opts?.current && !opts.current())
+            return t("menu.instance_replaced", this.shownInstanceName(instanceName));
         // Reject model names with newlines or control characters: they would be
         // persisted to fleet.yaml and pasted raw into the CLI (P3 from #1490 audit).
         if (/[\x00-\x1f\x7f]/.test(model)) {
@@ -20394,6 +20996,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // #1690: claude-code's runtime switch reports what it came to; the model is saved unless claude was told No.
         if (strategy === "runtime" && backendName === "claude-code") {
             const result = await this.runRuntimeModelSwitch(instanceName, model);
+            if (opts?.current && !opts.current())
+                return t("menu.instance_replaced", this.shownInstanceName(instanceName));
             if (result.outcome === "mismatch")
                 return `${warn}${t("model.switch_mismatch", instanceName, result.shown, model)}`;
             if (result.outcome === "not_sent")
@@ -20414,7 +21018,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
             return `${warn}${t("model.runtime_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
         }
-        await this.restartSingleInstance(instanceName);
+        await this.restartSingleInstance(instanceName, { ownerCurrent: opts?.current });
         return `${warn}${t("model.restart_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
     }
     /** Save an instance's model (fleet.yaml, or its ClassicBot channel). False when neither holds it. */
@@ -21293,6 +21897,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // because we asked it to. Set synchronously — doStopAll runs to its first
         // await in the same tick as the signal handler, so no event can slip in.
         this.shuttingDown = true;
+        // Stop receive admission before the first await or any instance shutdown; outbound
+        // adapters remain available below to retire notices and pending prompts.
+        for (const state of this.adapterState.values()) {
+            if (state.retryTimer) {
+                clearTimeout(state.retryTimer);
+                state.retryTimer = undefined;
+            }
+        }
+        const inboundStopped = Promise.all([...this.adapters.values()].map(async (adapter) => {
+            try {
+                await adapter.stopReceiving?.();
+            }
+            catch (err) {
+                this.logger.warn({ adapterId: adapter.id, err }, "Adapter receive stop failed; inbound remains fenced");
+            }
+        }));
         this.workingRecovery?.reset();
         if (this.workingRecoveryTimer)
             clearInterval(this.workingRecoveryTimer);
@@ -21347,9 +21967,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         this.eventLoopWatch?.stop();
         this.eventLoopWatch = null;
+        this.stallReporter?.stop();
+        this.stallReporter = null;
         // A login/install window is a dedicated tmux server with its own TTL
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).
+        await inboundStopped;
         await publicStopped;
         await sharesStopped?.catch(() => { });
         await profileStopped;
@@ -21360,13 +21983,6 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         await this.cpuProfileControl?.close();
         this.cpuProfileControl = null;
         await this.shutdownLoginWindows();
-        // Cancel adapter retry timers
-        for (const state of this.adapterState.values()) {
-            if (state.retryTimer) {
-                clearTimeout(state.retryTimer);
-                state.retryTimer = undefined;
-            }
-        }
         this.clearStatuslineWatchers();
         this.costGuard?.stop();
         this.dailySummary?.stop();
@@ -21404,6 +22020,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.discordPresenceTimer);
             this.discordPresenceTimer = null;
         }
+        if (this.quotaReadTimer) {
+            clearInterval(this.quotaReadTimer);
+            this.quotaReadTimer = null;
+        }
+        if (this.capacityTimer) {
+            clearInterval(this.capacityTimer);
+            this.capacityTimer = null;
+        }
+        setCapacityLookup(null);
         if (this.discordPresenceEagerTimer) {
             clearTimeout(this.discordPresenceEagerTimer);
             this.discordPresenceEagerTimer = null;
@@ -21708,6 +22333,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // mark every row done and tell the user "changes applied".
             return { rejected: why };
         }
+        this.agentCredentialsCache?.observePolicies();
         if (this.loadedFleetSource)
             this.getConfigHistory().accepted("fleet.yaml", this.configPath, this.loadedFleetSource);
         this.migrateOfficeStorage();
@@ -22608,6 +23234,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     async runConnectionBindingApply(job, binding, execution) {
         try {
+            // #3055 review r2: a connection is not re-pointed while one of its topics is being deleted (nothing is changed).
+            if (this.topicDeletionPending())
+                throw new Error("a topic deletion is running; try again in a moment");
             await this.rebuildAdapterForBinding(job.connectionId, binding, execution);
             job.result = "applied";
         }