@songsid/agend 2.3.4-beta.7 → 2.3.5-alpha.3

package/dist/fleet-manager.js

@@ -1,3 +1,8 @@
+import { buildNativeFleetInstructions } from "./instructions.js";
+import { GENERAL_ROLE_INSTRUCTIONS } from "./general-role.js";
+import { NativePaneRecoveryError } from "./native-pane-recovery.js";
+import { nativePaneToolAvailable, nativePaneToolRefusal } from "./native-pane-tools.js";
+import { windowsAgentsFor } from "./windows-agents.js";
 import { supportsVerifiedKiroMigration, getCachedKiroCliCompatibility, kiroV1DbPath, kiroV2SessionsDir } from "./backend/kiro.js";
 import { listKiroV1Sessions, readKiroClassicLinks } from "./backend/kiro-identity.js";
 import { readKiroV1SavedModel } from "./backend/kiro-retired-model.js";
@@ -9,10 +14,16 @@ import { WorkingRecoveryCoordinator, WORKING_RECOVERY_KIND, buildWorkingRecovery
 import { PUBLIC_TUNNEL_TOKEN_ENV, PUBLIC_TUNNEL_TOKEN_HINT, normalizePublicTunnelToken } from "./public-tunnel-config.js";
 import { humanOwnerObjectId, webHumanOrigin } from "./human-delivery-receipts.js";
 import { SettingsBaselines } from "./settings-baseline.js";
-import { SettingsConfirmationStore, settingsSourceLabel } from "./settings-confirmation.js";
+import { prepareSettingsEffect } from "./settings-effect.js";
+import { settingsDisplay } from "./settings-change.js";
+import { SettingsConfirmationError, SettingsConfirmationStore, settingsSourceLabel } from "./settings-confirmation.js";
 import { SettingsHttpConfirmation } from "./settings-http-confirmation.js";
 import { SettingsControlServer } from "./settings-control.js";
-import { SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileResource, assertSettingsLease, trySettingsLease, waitSettingsLease, settingsUndo, undoSettingsPaths } from "./settings-transaction.js";
+import { SettingsRouteLifetime } from "./settings-route-lifetime.js";
+import { GeneralManagedFileError } from "./runtime-general-protocol.js";
+import { GeneralBindings, generalBindingRevision, parseGeneralSwitchInput, switchGeneralLocation } from "./general-binding.js";
+import { confirmGeneralHostExit } from "./general-host-owner.js";
+import { settingsFingerprint, SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileResource, assertSettingsLease, trySettingsLease, waitSettingsLease, settingsUndo, undoSettingsPaths } from "./settings-transaction.js";
 import { performance } from "node:perf_hooks";
 import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { gatewayRequestContext } from "./web-request-context.js";
@@ -42,7 +53,7 @@ import { ProfileControlServer } from "./profile-control.js";
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, realpathSync, lstatSync, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { freemem, totalmem, homedir } from "node:os";
+import { freemem, totalmem, homedir, hostname } from "node:os";
 import { effectiveCpuCount } from "./cpu-quota.js";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
@@ -84,7 +95,8 @@ import { startEventLoopWatch } from "./event-loop-watch.js";
 import { TmuxManager } from "./tmux-manager.js";
 import { AccessManager } from "./channel/access-manager.js";
 import { IpcClient } from "./channel/ipc-bridge.js";
-import { usesChannelAddress } from "./channel/mcp-tools.js";
+import { NativeDaemonClient } from "./native-daemon-client.js";
+import { usesChannelAddress, TOOLS } from "./channel/mcp-tools.js";
 import { ParkedNotices, PARKED_NOTICE_LEDGER_FILE } from "./parked-notices.js";
 import { formatFleetTime } from "./tz-utils.js";
 import { createAdapter } from "./channel/factory.js";
@@ -94,6 +106,7 @@ import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
 import { codexMetadataHomes, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./backend/codex-metadata.js";
+import { readGrokModelCache } from "./backend/grok-model-cache.js";
 import { CLI_ENV_TTL_MS, isModelCompatible, noteResolvedBinary, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
@@ -168,6 +181,16 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     return tasks;
 }
 import { handleWebRequest, webPeerOf, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { windowsCliEnabled, closeWindowsBridge, inventoryProbed, LOCAL_WINDOWS_CLI_OFF } from "./windows-cli.js";
+import { localWindowsCliEnabled, remoteRuntimeEnabled, setConfiguredRuntimeSwitches, maxAgentsPerMachine } from "./runtime-switches.js";
+import { RuntimeCoordinator } from "./runtime-coordinator.js";
+import { RuntimeWindowsBridge } from "./runtime-windows-bridge.js";
+import { FleetWindowsRuntime } from "./fleet-windows-runtime.js";
+import { NativeMcpSessions } from "./native-mcp.js";
+import { nativeProviderMcpSupported } from "./windows-cli-providers.js";
+import { isWindowsInstance, isNativePaneInstance, isNativeExecInstance, WINDOWS_CONFIG_REFUSED } from "./native-instance-registry.js";
+import { createNativeWindowsInstance, updateNativeWindowsInstance } from "./native-instance-api.js";
+import { NativeInstanceConfigEdit, parseNativeInstanceCreate } from "./native-instance-input.js";
 import { LogService } from "./log-service.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WEB_ECHO_COPIES_MAX, WEB_MIRROR_TIMEOUT_MS, webReactionEmoji, webReactionProblem } from "./web-reactions.js";
@@ -269,6 +292,7 @@ import { bypassesWebGate, handleAuthRequest, serveGuestRefusedPage, serveSigninP
 import { isWebPageNavigation } from "./web-shell-routes.js";
 import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
 import { WebNotices, WEB_NOTICES_FILE } from "./web-notices.js";
+import { isOutsideLinkOwner, OUTSIDE_LINK_OWNER, OUTSIDE_LINK_RETRY_MS, OUTSIDE_OWN_CLOSES, outsideDuration, outsideTimer, TOTP_STEP_SECONDS, WEB_REMOTE_ACCESS_FILE, WebRemoteAccess } from "./web-remote-access.js";
 import { authorityNow, evaluateWebAuthority, HOST_OPERATOR, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
 import { AuthorityStateStore } from "./authority/authority-state.js";
 import { SessionAuthorizations } from "./authority/session-authorizations.js";
@@ -737,6 +761,825 @@ export class FleetManager {
     /** Live view of lifecycle.daemons — used throughout; not deprecated. */
     get daemons() { return this.lifecycle.daemons; }
     fleetConfig = null;
+    fleetWindowsRuntime = null;
+    nativeMcpStore = null;
+    paneManager = null;
+    localPaneRelay = null;
+    openingLocalPane = null;
+    runtimeHub = null;
+    runtimeExecutor = null;
+    runtimeStatusScheduled = false;
+    reconciledRemoteResults = new Set();
+    /** Machine credentials are separate from dashboard sessions and per-turn agent capabilities. */
+    runtimeCoordinator() {
+        if (!remoteRuntimeEnabled())
+            throw new Error("Remote runtimes are not enabled");
+        return this.runtimeHub ??= new RuntimeCoordinator(this.dataDir, {
+            handleMcp: (machineId, runId, body) => this.runtimeWindowsExecutor().mcp(machineId, runId, body),
+            handlePaneMcp: async (machineId, body, current) => (await this.nativePanes()).handle(machineId, body, current),
+            changed: event => {
+                if (event?.type === "machine" && this.runtimeHub?.machine(event.machineId)?.status !== "online") {
+                    for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {}))
+                        if (config.machine_id === event.machineId) {
+                            this.nativeMcpStore?.closeInstance(name);
+                            if (config.general_topic) {
+                                this.cancelPendingDeliveries(name);
+                                this.holdGeneralOldDeliveries(name);
+                            }
+                        }
+                    this.needsYou?.poke();
+                }
+                if (this.runtimeStatusScheduled || this.shuttingDown)
+                    return;
+                this.runtimeStatusScheduled = true;
+                queueMicrotask(() => {
+                    this.runtimeStatusScheduled = false;
+                    if (this.shuttingDown)
+                        return;
+                    try {
+                        this.fleetWindowsRuntime?.importHistory();
+                        for (const snapshot of this.runtimeHub?.tasks() ?? [])
+                            this.reconcileRemoteDelivery(snapshot.machineId, snapshot.task);
+                        this.emitSseEvent("status", this.getUiStatus());
+                        this.scheduleDeliveryOutboxPump();
+                    }
+                    catch (error) {
+                        this.logger.warn({ err: error }, "Runtime status reconciliation failed");
+                    }
+                });
+            },
+        });
+    }
+    runtimeWindowsExecutor() {
+        return this.runtimeExecutor ??= new RuntimeWindowsBridge(this, () => remoteRuntimeEnabled() && !this.shuttingDown ? this.runtimeCoordinator() : null);
+    }
+    /** Per-turn capabilities for native MCP, separate from browser and Linux-agent credentials. */
+    nativeMcpSessions() {
+        return this.nativeMcpStore ??= new NativeMcpSessions(this);
+    }
+    /** The same instance registry and delivery entry point, with a native Windows execution adapter. */
+    nativeInstanceRuntime() {
+        return this.fleetWindowsRuntime ??= new FleetWindowsRuntime({
+            owner: this, fleet: () => this.fleetConfig, save: () => this.saveFleetConfig(), stopping: () => this.shuttingDown, history: this.webChatHistory,
+            openMcp: (instance, requestId, sandbox, stillCurrent) => this.healthServerListening
+                ? this.nativeMcpSessions().grant({ instance, requestId, sandbox, stillCurrent, endpoint: `http://127.0.0.1:${this.fleetConfig?.health_port ?? 19280}/agent` }) : null,
+            warn: (message, error) => this.logger.warn({ err: error }, message),
+            removed: name => this.nativeInstanceRemoved(name),
+            paneCurrent: name => this.daemons.get(name)?.nativePaneCurrent?.() === true,
+            machineAvailable: id => remoteRuntimeEnabled() && this.runtimeCoordinator().machine(id)?.status === "online",
+            validateMachine: (id, cli, sandbox) => {
+                const machine = this.runtimeCoordinator().machine(id);
+                const provider = machine?.inventory?.clis.find(row => row.id === cli && row.runnable && row.supports.resume);
+                if (!machine || machine.status !== "online" || machine.platform !== "win32" || !provider)
+                    throw new Error("Choose an online runtime and an available CLI");
+                if (sandbox === "read-only" && !provider.readOnlySupport)
+                    throw new Error("This runtime CLI cannot enforce read-only execution");
+            },
+            emit: (event, data) => {
+                this.emitSseEvent(event, event === "status" ? this.getUiStatus() : data);
+                if (event === "activity")
+                    this.scheduleDeliveryOutboxPump();
+            },
+        }, { bridge: this.runtimeWindowsExecutor() });
+    }
+    /** Explicit dashboard opt-in, with the same General confirmation and ordinary topic/Daemon routing. */
+    async createNativePaneInstance(profile, channelId, authorized, execution) {
+        const { createNativePane } = await import("./native-pane-create.js");
+        return createNativePane({ fleet: () => this.fleetConfig, runtime: this.nativeInstanceRuntime(),
+            topic: target => {
+                const world = this.worlds.get(target.id), adapter = world?.adapter;
+                if (!world || !adapter?.createTopic || !adapter.deleteTopic)
+                    throw Error("The approved connection cannot create and compensate a topic");
+                const same = () => {
+                    const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+                    const matches = channels.filter(row => (row.id ?? row.type) === target.id);
+                    return !this.shuttingDown && this.worlds.get(target.id) === world && world.adapter === adapter && matches.length === 1 && matches[0].type === target.type && matches[0].group_id === target.group_id;
+                };
+                return { current: same, create: name => adapter.createTopic(name), remove: id => adapter.deleteTopic(id) };
+            },
+            epoch: name => this.lifecycle.epochOf(name),
+            start: async (name, config, current) => {
+                if (!current())
+                    throw Error("Native creation expired before start");
+                await this.startInstance(name, config, true);
+                if (!current())
+                    throw Error("Native creation expired during start");
+                await this.connectIpcToInstance(name);
+                if (!current())
+                    throw Error("Native creation expired during channel connection");
+            },
+            close: (name, config, epoch) => this.lifecycle.runTransition(name, async (transition) => {
+                if (this.fleetConfig?.instances[name] !== config || this.lifecycle.epochOf(name) !== epoch)
+                    return false;
+                await this.stopInstance(name, transition);
+                return this.fleetConfig?.instances[name] === config && this.lifecycle.epochOf(name) === epoch + 1;
+            }),
+            routes: () => { if (this.fleetConfig)
+                this.routing.rebuild(this.fleetConfig); },
+            warn: error => this.logger.warn({ err: error }, "Native creation cleanup is held; retained identity and topic require attention"), }, profile, channelId, () => !this.shuttingDown && authorized(), execution);
+    }
+    /** Admin-only settings path: validate first, then close the exact old launch before changing cold fields. */
+    async updateNativePaneConfig(name, patch, authorized, transaction) {
+        return this.lifecycle.runTransition(name, async (transition) => {
+            const before = this.fleetConfig?.instances[name];
+            if (!isNativePaneInstance(before))
+                throw Error("Persistent Windows instance not found");
+            const runtime = this.nativeInstanceRuntime(), generation = this.explicitStopGeneration.get(name) ?? 0;
+            let expectedGeneration = generation;
+            const current = () => authorized() && !this.shuttingDown && this.fleetConfig?.instances[name] === before
+                && (this.explicitStopGeneration.get(name) ?? 0) === expectedGeneration
+                && (before.machine_id ? remoteRuntimeEnabled() : localWindowsCliEnabled());
+            if (!current())
+                throw Error("Native settings authority expired");
+            runtime.previewUpdate(name, patch);
+            const cold = ["working_directory", "model", "systemPrompt", "native_sandbox"].some(key => Object.hasOwn(patch, key) && (patch[key] ?? "") !== (before[key] ?? ""));
+            const running = this.daemons.get(name);
+            if (cold) {
+                if (running && !running.nativePaneHasExited() && (!await running.nativePauseReady({ current, accepts: () => true, revalidate: async () => current() }) || !running.nativePauseStillReady()))
+                    throw Error("Wait for this Windows agent to be idle before changing its launch settings");
+                if (!current())
+                    throw Error("Native settings authority expired before closing its old pane");
+                await this.stopInstance(name, transition);
+                expectedGeneration = generation + 1;
+                if (!current())
+                    throw Error("Native settings authority expired after closing its old pane");
+                if (runtime.get(name)?.activeId)
+                    throw Error("Native pane exit is unconfirmed; its settings were not changed");
+            }
+            const result = runtime.update(name, patch, current, transaction), next = this.fleetConfig.instances[name];
+            if (cold && running) {
+                if (!authorized() || this.shuttingDown || this.fleetConfig?.instances[name] !== next || (this.explicitStopGeneration.get(name) ?? 0) !== expectedGeneration)
+                    throw Error("Native settings saved; restart authority expired");
+                await this.startInstance(name, next, true, "fleet-topic", false, transition);
+            }
+            return result;
+        });
+    }
+    async localNativePaneEndpoint() {
+        const admit = () => { if (this.shuttingDown || this.localPaneDrain || !localWindowsCliEnabled())
+            throw Error("Local Windows runtime is switched off or draining"); };
+        admit();
+        if (this.localPaneDrain)
+            throw Error("Local Windows runtime cleanup is pending");
+        if (this.localPaneRelay?.online())
+            return this.localPaneRelay;
+        if (this.openingLocalPane)
+            return this.openingLocalPane;
+        const opening = (async () => {
+            const [{ LocalPaneEndpoint }, { launchLocalPaneRelay, localPaneScope }, inventory] = await Promise.all([
+                import("./local-pane-endpoint.js"), import("./local-pane-launcher.js"), this.runtimeWindowsExecutor().probe({ force: false }),
+            ]);
+            admit();
+            this.localPaneRelay?.stop();
+            const relay = await LocalPaneEndpoint.open({ scope: localPaneScope(this.dataDir), admit, maxAgents: maxAgentsPerMachine,
+                diagnostic: text => this.logger.warn({ stderr: text }, "Local Windows pane relay wrote to stderr"),
+                version: provider => inventory.clis.find(row => row.id === provider && row.runnable)?.version ?? null,
+                launch: () => launchLocalPaneRelay(this.dataDir, admit),
+                mcp: async (body, current) => (await this.nativePanes()).handle("local", body, current),
+            });
+            try {
+                admit();
+                this.localPaneRelay = relay;
+                return relay;
+            }
+            catch (error) {
+                relay.stop();
+                throw error;
+            }
+        })();
+        this.openingLocalPane = opening;
+        try {
+            return await opening;
+        }
+        finally {
+            if (this.openingLocalPane === opening)
+                this.openingLocalPane = null;
+        }
+    }
+    /** Persistent ownership is independent of the exec worker's per-turn capabilities. */
+    async nativePanes() {
+        if (this.paneManager)
+            return this.paneManager;
+        const { NativePaneManager } = await import("./native-pane-manager.js");
+        if (this.paneManager)
+            return this.paneManager;
+        const store = windowsAgentsFor(this, this.runtimeWindowsExecutor());
+        const allowed = (name, tool) => nativePaneToolAvailable(tool) && mayUseTool(resolveToolSet(this.fleetConfig?.instances[name], name), tool)
+            && !dashboardRefusalIn(this.fleetConfig, name, tool);
+        return this.paneManager = new NativePaneManager({
+            home: this.dataDir, store, config: name => this.fleetConfig?.instances[name],
+            freshNotice: async (name, provider) => {
+                const message = t(provider === "codex" ? "native_pane.codex_fresh_started" : "native_pane.fresh_started");
+                this.eventLog?.insert(name, "native_pane_fresh_started", {});
+                this.logger.info({ name }, message);
+                await this.notifyInstanceTopic(name, message);
+            },
+            admit: (name, config) => {
+                const now = this.fleetConfig?.instances[name];
+                if (this.shuttingDown || !isNativePaneInstance(now) || now?.native_agent_id !== config.native_agent_id
+                    || now?.machine_id !== config.machine_id || now?.working_directory !== config.working_directory || now?.backend !== config.backend
+                    || now?.model !== config.model || now?.native_sandbox !== config.native_sandbox || now?.systemPrompt !== config.systemPrompt || now?.workflow !== config.workflow
+                    || now?.general_topic !== config.general_topic || now?.native_general_binding !== config.native_general_binding)
+                    throw Error("Native pane configuration or lifetime changed");
+                if (config.machine_id ? this.remotePaneDrain || !remoteRuntimeEnabled() : this.localPaneDrain || !localWindowsCliEnabled())
+                    throw Error("Native runtime is switched off");
+            },
+            endpoint: async (agent, cleanup = false) => {
+                if (!agent.machineId) {
+                    if (!cleanup)
+                        return this.localNativePaneEndpoint();
+                    if (!this.localPaneRelay)
+                        throw Error("Local cleanup transport is unavailable; pane remains reserved");
+                    return this.localPaneRelay;
+                }
+                const hub = cleanup ? this.runtimeHub : this.runtimeCoordinator(), machineId = agent.machineId;
+                if (!hub)
+                    throw Error("Remote cleanup transport is unavailable; pane remains reserved");
+                const draining = () => !!this.remotePaneDrain;
+                return { machineId, online: () => !this.shuttingDown && (draining() || remoteRuntimeEnabled()) && this.runtimeHub === hub && hub.machine(machineId)?.status === "online",
+                    call: request => {
+                        if (this.runtimeHub !== hub || !(draining() || remoteRuntimeEnabled()) || draining() && request.action !== "snapshot" && request.action !== "close")
+                            return Promise.reject(Error("Remote pane transport only permits owned cleanup"));
+                        return hub.callPane(machineId, request, maxAgentsPerMachine());
+                    }, subscribe: listener => hub.subscribe(listener),
+                    epoch: () => hub.paneTransportEpoch(machineId), version: provider => hub.machine(machineId)?.inventory?.clis.find(row => row.id === provider && row.runnable)?.version ?? null };
+            },
+            instructions: (name, config) => buildNativeFleetInstructions({ instanceName: name, workingDirectory: config.working_directory,
+                displayName: config.display_name, description: config.description, customPrompt: config.systemPrompt,
+                workflow: config.workflow, taskBoard: !dashboardRefusalIn(this.fleetConfig, name, "task"),
+                runtimeIdentity: { kind: "fleet-topic", backend: config.backend ?? "codex", model: config.model || "default" } }, config.general_topic === true),
+            menu: name => TOOLS.filter(tool => allowed(name, tool.name)).map(tool => ({ ...tool })),
+            allowed: (name, tool, args) => allowed(name, tool) && !nativePaneToolRefusal(tool, args), published: (name, daemon) => this.daemons.get(name) === daemon,
+            invoke: async (daemon, input, current, name) => {
+                if (input.tool === "list_models") {
+                    const { ListModelsArgs } = await import("./outbound-schemas.js");
+                    const parsed = ListModelsArgs.safeParse(input.args);
+                    if (!parsed.success || !current())
+                        return { result: null, error: "Invalid native model request or expired owner" };
+                    const target = parsed.data.instance_name ?? name;
+                    if (!isWindowsInstance(this.fleetConfig?.instances[target]))
+                        return { result: null, error: "Native panes can only read Windows runtime model inventories" };
+                    return { result: await this.listModelCatalog({ instanceName: target }) };
+                }
+                const ops = { list_instances: "list", describe_instance: "describe", task: "task", send_to_instance: "send",
+                    delegate_task: "delegate", request_information: "ask", report_result: "report", delivery_status: "delivery-status" };
+                const { nativeAgentAdmissionContext } = await import("./native-agent-admission.js");
+                const { dispatchAgentOperation } = await import("./agent-endpoint.js");
+                return daemon.handlePaneToolCall(input, { current, allowed: tool => allowed(name, tool),
+                    dispatch: (tool, args) => ops[tool] ? dispatchAgentOperation(nativeAgentAdmissionContext(this, {
+                        instance: name, current: () => current() && allowed(name, tool), taskAllowed: () => current() && allowed(name, "task"),
+                    }), name, ops[tool], args, input.operationId) : undefined });
+            },
+        });
+    }
+    /** Prepare only bundled role files; this neither switches General nor starts a provider process. */
+    async prepareWindowsGeneralWorkspace(name, machineId, cli, bindingId, authorized) {
+        const config = this.fleetConfig?.instances[name], hub = this.runtimeCoordinator(), epoch = hub.paneTransportEpoch(machineId);
+        if (!config?.general_topic || !epoch)
+            throw Error("General or its paired runtime is unavailable");
+        const current = () => authorized() && !this.shuttingDown && remoteRuntimeEnabled() && this.runtimeHub === hub
+            && this.fleetConfig?.instances[name] === config && hub.paneTransportEpoch(machineId) === epoch;
+        const [{ loadGeneralKnowledge }, { validateGeneralWorkspaceRequest, validateGeneralWorkspaceReceipt, generalWorkspaceUpgrade }, { assertAuditedNativePaneVersion }] = await Promise.all([
+            import("./runtime-general-workspace.js"), import("./runtime-general-protocol.js"), import("./runtime-pane-native.js"),
+        ]);
+        if (!current())
+            throw Error("General workspace authority expired");
+        assertAuditedNativePaneVersion(cli, hub.machine(machineId)?.inventory?.clis.find(row => row.id === cli && row.runnable)?.version ?? null);
+        const request = validateGeneralWorkspaceRequest({ action: "general-workspace", bindingId, instance: name, cli, packHash: loadGeneralKnowledge(cli).hash });
+        const inventory = await hub.callPane(machineId, { action: "list" }, maxAgentsPerMachine());
+        if (!current())
+            throw Error("General workspace authority expired");
+        if (inventory?.capabilities?.generalWorkspace !== true)
+            throw new NativePaneRecoveryError({ kind: "host-upgrade" });
+        const result = await hub.callPane(machineId, request, maxAgentsPerMachine());
+        if (!current())
+            throw Error("General workspace authority expired");
+        if (generalWorkspaceUpgrade(result, request))
+            throw new NativePaneRecoveryError({ kind: "host-upgrade" });
+        return validateGeneralWorkspaceReceipt(result, request);
+    }
+    generalLocationFlights = new Map();
+    generalAttentionEpisodes = new Map();
+    generalBindings() { return new GeneralBindings(this.dataDir); }
+    generalLocations() {
+        const store = this.generalBindings();
+        return { generals: Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic).map(([name, cfg]) => {
+                const record = store.read(name), machine = cfg.machine_id ? this.runtimeHub?.machine(cfg.machine_id) : null;
+                return { name, displayName: cfg.display_name ?? name, location: isWindowsInstance(cfg) ? "windows" : "host",
+                    machineId: cfg.machine_id ?? null, cli: cfg.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code", model: cfg.model ?? "",
+                    revision: generalBindingRevision(record, cfg), canSwitchBack: !!record && record.active !== "host",
+                    offline: isWindowsInstance(cfg) && (!remoteRuntimeEnabled() || machine?.status !== "online" || !this.runtimeHub?.paneTransportEpoch(cfg.machine_id)),
+                    retryTarget: record?.pending?.phase === "selected" ? (record.pending.to === "host" ? { location: "host" } : (() => { const row = record.windows.find(item => item.id === record.pending.to); return { location: "windows", machineId: row.machineId, cli: row.cli, model: row.config.model ?? "" }; })()) : null,
+                    hold: record?.hold ?? (record?.pending ? record.pending.phase === "selected" ? "start" : "exit" : null), switching: this.generalLocationFlights.has(name) };
+            }), machines: (this.runtimeHub?.listMachines() ?? []).filter(row => row.status !== "pending" && row.status !== "revoked").map(row => ({
+                id: row.id, name: row.name, online: row.status === "online" && !!this.runtimeHub?.paneTransportEpoch(row.id),
+                clis: row.inventory?.clis.filter(cli => cli.runnable && (cli.id === "claude-code" || cli.id === "codex")).map(cli => ({ id: cli.id, version: cli.version })) ?? [],
+            })) };
+    }
+    /** Pure preflight for the confirmation diff and stale-tab refusal; never prepares files or starts a CLI. */
+    previewGeneralLocation(raw) {
+        const input = parseGeneralSwitchInput(raw), cfg = this.fleetConfig?.instances[input.name];
+        if (!cfg?.general_topic || this.shuttingDown)
+            throw Error("General is unavailable");
+        const record = this.generalBindings().read(input.name);
+        if (input.revision !== generalBindingRevision(record, cfg))
+            throw Error("General location changed; read its settings again");
+        const connections = cfg.channel_id ? [cfg.channel_id] : [];
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        if (channels.length && (connections.length !== 1 || channels.filter(row => (row.id ?? row.type) === connections[0]).length !== 1))
+            throw Error("General's connection cannot be resolved");
+        if (input.target.location === "host") {
+            if (!record)
+                throw Error("General's saved host location is unavailable");
+            return { input, connections, summary: [t("general_location.confirm_host"), t("general_location.history")] };
+        }
+        const active = record?.windows.find(row => row.id === record.active);
+        if (!record?.pending && record?.hold !== "start" && active?.machineId === input.target.machineId && active.cli === input.target.cli)
+            throw Error("General already runs at this location");
+        const machine = this.runtimeHub?.machine(input.target.machineId);
+        if (!remoteRuntimeEnabled() || machine?.status !== "online" || !this.runtimeHub?.paneTransportEpoch(machine.id))
+            throw Error(t("general_location.offline"));
+        const provider = input.target.cli;
+        if (!machine.inventory?.clis.some(cli => cli.id === provider && cli.runnable))
+            throw Error("The chosen Windows CLI is unavailable");
+        return { input, connections, summary: [t("general_location.confirm_windows", settingsDisplay(machine.name)), t("general_location.history")] };
+    }
+    /** All entry points, including automatic native recovery, must respect an interrupted binding switch. */
+    assertGeneralBindingStart(name, config) {
+        if (!config.general_topic)
+            return;
+        try {
+            this.generalBindings().assertStart(name, config);
+        }
+        catch (err) {
+            this.logger.warn({ name, err }, "General location start held by its saved binding");
+            this.needsYou?.poke();
+            throw new UnsupportedCliError(t("general_location.exit_unconfirmed"));
+        }
+    }
+    /** Only the Settings replay's confirmed admin can enter; the whole switch owns one lifecycle transition. */
+    async switchGeneralLocation(raw, authorized, execution) {
+        const { input } = this.previewGeneralLocation(raw), name = input.name;
+        return this.lifecycle.runTransition(name, async (transition) => {
+            execution.assert();
+            if (!authorized() || this.generalLocationFlights.has(name))
+                throw Error("General location authority expired or a switch is already running");
+            const token = Symbol(name), generation = this.settingsGeneration;
+            const destinationEpoch = input.target.location === "windows" ? this.runtimeHub?.paneTransportEpoch(input.target.machineId) : null;
+            let expected = this.fleetConfig.instances[name], stopGeneration = this.explicitStopGeneration.get(name) ?? 0, epoch = this.lifecycle.epochOf(name);
+            const hostSnapshot = !isWindowsInstance(expected) ? structuredClone(this.daemons.get(name)?.getConfigSnapshot() ?? expected) : undefined;
+            const current = () => !this.shuttingDown && this.settingsGeneration === generation && authorized()
+                && this.generalLocationFlights.get(name) === token && this.fleetConfig?.instances[name] === expected
+                && (input.target.location !== "windows" || remoteRuntimeEnabled() && !!destinationEpoch && this.runtimeHub?.paneTransportEpoch(input.target.machineId) === destinationEpoch)
+                && (this.explicitStopGeneration.get(name) ?? 0) === stopGeneration && this.lifecycle.epochOf(name) === epoch;
+            const check = () => { if (!current())
+                throw Error("General location switch was superseded"); };
+            this.generalLocationFlights.set(name, token);
+            // Old ephemeral waiters carry this epoch; they cannot wake into the selected conversation.
+            this.cancelPendingDeliveries(name);
+            let lease = null;
+            try {
+                lease = await waitSettingsLease([settingsFileResource(this.getSettingsConfigPath()), `general:${this.dataDir}:${name}`], () => current() && execution.current(), performance.now() + execution.remainingMs, execution.owner);
+                const store = this.generalBindings();
+                const result = await switchGeneralLocation({ store, current: () => expected, assert: check,
+                    prepare: async (target, retained) => {
+                        if (target.location !== "windows")
+                            return null;
+                        const old = retained.windows.find(row => row.machineId === target.machineId && row.cli === target.cli);
+                        const id = old?.id ?? randomUUID(), agentId = old?.agentId ?? randomUUID();
+                        const publication = await this.prepareWindowsGeneralWorkspace(name, target.machineId, target.cli, id, () => current() && execution.current());
+                        check();
+                        execution.assert();
+                        const config = { ...structuredClone(expected), runtime: "windows", machine_id: target.machineId,
+                            native_adapter: "pane", native_agent_id: agentId, native_general_binding: id, native_sandbox: "workspace-write",
+                            backend: target.cli, model: target.model, working_directory: publication.cwd, systemPrompt: "", agent_mode: "cli" };
+                        // Host credentials, shell hooks and provider-specific options never become Windows launch configuration.
+                        for (const key of ["backend_options", "credential_profile", "pre_task_command"])
+                            delete config[key];
+                        windowsAgentsFor(this, this.runtimeWindowsExecutor()).ensureGeneralBinding({ id: agentId, instance: name, machineId: target.machineId,
+                            cli: target.cli, cwd: publication.cwd, name: (expected.display_name ?? name).slice(0, 64), model: target.model, instructions: "", description: expected.description ?? "" }, () => current() && execution.current());
+                        return { id, agentId, machineId: target.machineId, cli: target.cli, config };
+                    },
+                    idle: async () => {
+                        check();
+                        const daemon = this.daemons.get(name);
+                        return !daemon || daemon.getInstanceStateSnapshot().state === "idle" && daemon.getWorkingRecoveryState().idle
+                            && daemon.getInteractionSnapshot().phase === "clear" && !this.lifecycle.hasWorkLease(name)
+                            && Date.now() - (this.lastDeliveryAt.get(name) ?? 0) >= 2000;
+                    },
+                    hostSnapshot: () => hostSnapshot,
+                    capture: async () => {
+                        if (isWindowsInstance(expected))
+                            return undefined;
+                        const daemon = this.daemons.get(name);
+                        if (!daemon)
+                            throw Error(t("general_location.exit_unconfirmed"));
+                        const owner = await daemon.generalHostOwner();
+                        check();
+                        execution.assert();
+                        return owner;
+                    },
+                    stop: async (owner) => {
+                        check();
+                        const stopping = this.stopInstance(name, transition);
+                        stopGeneration++;
+                        epoch++;
+                        await stopping;
+                        check();
+                        if (isWindowsInstance(expected)) {
+                            const profile = windowsAgentsFor(this, this.runtimeWindowsExecutor()).get(expected.native_agent_id);
+                            if (profile.activeId || profile.paneLaunchId)
+                                throw Error(t("general_location.exit_unconfirmed"));
+                            execution.mutate(() => this.holdGeneralOldDeliveries(name));
+                            return undefined;
+                        }
+                        if (!owner || !await confirmGeneralHostExit(owner, getTmuxSession()))
+                            throw Error(t("general_location.exit_unconfirmed"));
+                        check();
+                        execution.mutate(() => this.holdGeneralOldDeliveries(name));
+                        return owner.pin;
+                    },
+                    save: next => {
+                        check();
+                        const previous = expected;
+                        try {
+                            this.fleetConfig.instances[name] = next;
+                            this.saveFleetConfig([{ path: ["instances", name], value: next }]);
+                            expected = next;
+                            this.routing.rebuild(this.fleetConfig);
+                        }
+                        catch (err) {
+                            this.fleetConfig.instances[name] = previous;
+                            throw err;
+                        }
+                    },
+                    start: async () => {
+                        check();
+                        if (!execution.completed)
+                            throw Error("General's selected binding has no committed approval");
+                        // The committed receipt permits only this selected startup. Live authority still fences every awaited spawn boundary.
+                        const startup = new SettingsExecution({ current: () => current() && execution.completed && execution.remainingMs > 0,
+                            snapshot: () => this.fleetConfig });
+                        try {
+                            await this.startInstance(name, expected, true, "fleet-topic", false, transition, startup);
+                        }
+                        finally {
+                            startup.close();
+                        }
+                        check();
+                        const daemon = this.daemons.get(name);
+                        if (!daemon || daemon.getProcessStatus() !== "running" || isNativePaneInstance(expected) && !daemon.nativePaneCurrent())
+                            throw Error(t("general_location.start_failed"));
+                        await this.connectIpcToInstance(name);
+                        check();
+                    },
+                    notify: (kind, err) => {
+                        const message = t(kind === "exit" ? "general_location.exit_unconfirmed" : kind === "start" ? "general_location.start_failed" : "general_location.complete", isWindowsInstance(expected) ? this.runtimeHub?.machine(expected.machine_id)?.name ?? t("general_location.windows") : t("general_location.host"));
+                        this.eventLog?.insert(name, "general_location", { phase: kind, message });
+                        if (err)
+                            this.logger.warn({ name, phase: kind, err }, message);
+                        else
+                            this.logger.info({ name, phase: kind }, message);
+                        this.needsYou?.poke();
+                        this.emitSseEvent("status", this.getUiStatus());
+                        this.notifyInstanceTopic(name, message);
+                    },
+                }, input, execution);
+                return { ...result, message: result.started ? t("general_location.complete", isWindowsInstance(expected)
+                        ? this.runtimeHub?.machine(expected.machine_id)?.name ?? t("general_location.windows") : t("general_location.host")) : t("general_location.start_failed") };
+            }
+            finally {
+                lease?.release();
+                if (this.generalLocationFlights.get(name) === token)
+                    this.generalLocationFlights.delete(name);
+                this.needsYou?.poke();
+            }
+        });
+    }
+    /** An offline PC or a confirmed binding boundary holds old waiting input; it never becomes another conversation's queue. */
+    holdGeneralOldDeliveries(name) {
+        const outbox = this.deliveryOutbox;
+        if (!outbox)
+            return;
+        for (const row of outbox.listPending().filter(row => row.targetInstance === name)) {
+            if (row.state !== "submission_started")
+                outbox.failBeforeBegin(row.deliveryId, t("general_location.input_not_replayed"));
+            else if (row.targetDaemonBootId) {
+                outbox.markTargetReconciliationPending(name, row.targetDaemonBootId);
+                if (!outbox.reconcileAttempt(row.deliveryId, row.targetDaemonBootId, row.attemptNo, "uncertain", t("general_location.input_not_replayed")))
+                    throw Error("General's old delivery could not be held");
+            }
+            else
+                throw Error("General's old delivery has no confirmed owner");
+        }
+        this.needsYou?.poke();
+    }
+    generalLocationDeliveryHold(name) {
+        const config = this.fleetConfig?.instances[name];
+        if (!config?.general_topic)
+            return null;
+        if (this.generalLocationFlights?.has(name))
+            return t("general_location.exit_unconfirmed");
+        let record;
+        try {
+            record = this.generalBindings().read(name);
+        }
+        catch {
+            return t("general_location.start_failed");
+        }
+        if (record?.pending || record?.hold)
+            return t(record.pending?.phase === "selected" || record.hold === "start" ? "general_location.start_failed" : "general_location.exit_unconfirmed");
+        if (isWindowsInstance(config) && config.machine_id && (!remoteRuntimeEnabled() || this.runtimeHub?.machine(config.machine_id)?.status !== "online" || !this.runtimeHub?.paneTransportEpoch(config.machine_id)))
+            return t("general_location.offline");
+        return null;
+    }
+    generalLocationAttention(name) {
+        const cfg = this.fleetConfig?.instances[name];
+        if (!cfg?.general_topic)
+            return null;
+        const detail = this.generalLocationDeliveryHold(name);
+        if (!detail) {
+            this.generalAttentionEpisodes.delete(name);
+            return null;
+        }
+        let record = null;
+        try {
+            record = this.generalBindings().read(name);
+        }
+        catch { /* a corrupt journal is a visible hold too */ }
+        const offline = !record?.pending && !record?.hold && isWindowsInstance(cfg) && detail === t("general_location.offline");
+        const key = record?.pending?.id ?? `${record?.revision ?? "unknown"}:${offline ? "offline" : "hold"}`;
+        let episode = this.generalAttentionEpisodes.get(name);
+        if (!episode || episode.key !== key) {
+            episode = { key, since: record?.pending?.at ?? Date.now() };
+            this.generalAttentionEpisodes.set(name, episode);
+        }
+        return { ...episode, detail, offline };
+    }
+    async nativePaneFor(name, config, assertCurrent) {
+        try {
+            return await (await this.nativePanes()).prepare(name, config, assertCurrent);
+        }
+        catch (err) {
+            if (config.general_topic && err instanceof GeneralManagedFileError) {
+                assertCurrent();
+                const store = this.generalBindings(), record = store.read(name);
+                if (record && record.active === config.native_general_binding) {
+                    record.hold = "start";
+                    store.write(record);
+                }
+                this.logger.warn({ name, managedFile: err.file }, t("general_location.start_failed"));
+                this.needsYou?.poke();
+                throw new UnsupportedCliError(t("general_location.start_failed"));
+            }
+            throw err;
+        }
+    }
+    async recoverNativePane(name, launchId, authorized) {
+        const config = this.fleetConfig?.instances[name];
+        if (!isNativePaneInstance(config))
+            throw Error("Persistent Windows pane is not configured");
+        const generation = this.explicitStopGeneration.get(name) ?? 0;
+        await this.lifecycle.runTransition(name, async (transition) => {
+            const current = () => { if (!authorized() || this.shuttingDown || this.fleetConfig?.instances[name] !== config || (this.explicitStopGeneration.get(name) ?? 0) !== generation)
+                throw Error(t("native_pane.authority_expired")); };
+            current();
+            if (this.daemons.get(name)?.nativePaneCurrent())
+                throw Error(t("native_pane.still_running"));
+            this.cancelStartupRetry(name);
+            this.lifecycle.cancelNativeRecovery(name);
+            await (await this.nativePanes()).recover(name, config, launchId, true, current);
+            current();
+            // The host supplied a positive exit before ordinary lifecycle cleanup. No signal or input is required.
+            await this.lifecycle.stop(name, transition);
+            current();
+            this.instanceProcessStatus.set(name, "stopped");
+            this.eventLog?.insert(name, "native_pane_recovered", { launchId, confirmedStopped: true });
+            this.logger.info({ name, launchId }, "Windows saved pane recovered by an administrator; waiting for Start");
+            this.emitSseEvent("status", this.getUiStatus());
+        });
+    }
+    holdNativePaneRecovery(name, error) {
+        if (!(error instanceof NativePaneRecoveryError))
+            return false;
+        this.instanceProcessStatus.set(name, "stopped");
+        this.logger.warn({ name, recovery: error.recovery }, error.message);
+        this.eventLog?.insert(name, "native_pane_recovery_needed", { ...error.recovery });
+        this.needsYou?.poke();
+        this.emitSseEvent("status", this.getUiStatus());
+        return true;
+    }
+    async startFreshNativePane(name, launchId, sessionId, authorized) {
+        const config = this.fleetConfig?.instances[name];
+        if (!isNativePaneInstance(config))
+            throw Error("Persistent Windows pane is not configured");
+        const generation = this.explicitStopGeneration.get(name) ?? 0;
+        await this.lifecycle.runTransition(name, async (transition) => {
+            const current = () => { if (!authorized() || this.shuttingDown || this.fleetConfig?.instances[name] !== config || (this.explicitStopGeneration.get(name) ?? 0) !== generation)
+                throw Error(t("native_pane.authority_expired")); };
+            current();
+            const held = windowsAgentsFor(this, this.runtimeWindowsExecutor()).get(config.native_agent_id).paneRecovery;
+            if (held?.kind !== "session-unconfirmed" || held.launchId !== launchId || (held.sessionId ?? null) !== sessionId)
+                throw Error(t("native_pane.changed"));
+            if (this.daemons.get(name)?.nativePaneCurrent())
+                throw Error(t("native_pane.still_running"));
+            this.cancelStartupRetry(name);
+            this.lifecycle.cancelNativeRecovery(name);
+            await this.lifecycle.stop(name, transition);
+            current();
+            try {
+                await (await this.nativePanes()).startFresh(name, config, launchId, sessionId, current);
+                current();
+            }
+            catch (error) {
+                current();
+                this.needsYou?.poke();
+                this.emitSseEvent("status", this.getUiStatus());
+                throw error;
+            }
+            this.eventLog?.insert(name, "native_pane_new_conversation", { launchId, sessionId });
+            await this.startInstance(name, config, true, "fleet-topic", true, transition);
+            current();
+            this.needsYou?.poke();
+            this.emitSseEvent("status", this.getUiStatus());
+        });
+    }
+    nativePanePinnedSession(name) {
+        const config = this.fleetConfig?.instances[name];
+        if (!isNativePaneInstance(config) || !config.native_agent_id)
+            return null;
+        const agent = windowsAgentsFor(this, this.runtimeWindowsExecutor()).get(config.native_agent_id);
+        return agent.fleet_instance === name && agent.machineId === config.machine_id ? agent.threadId ?? null : null;
+    }
+    onNativePaneRecoverySettled(name) {
+        if (this.daemons.get(name)?.nativePaneCurrent())
+            this.instanceProcessStatus.delete(name);
+        this.onAttentionChanged(name);
+        this.scheduleDeliveryOutboxPump();
+    }
+    setNativePanePaused(name, paused) {
+        const id = this.fleetConfig?.instances[name]?.native_agent_id;
+        if (!id)
+            throw Error("Native profile is missing");
+        windowsAgentsFor(this, this.runtimeWindowsExecutor()).setPaused(id, paused);
+    }
+    async closeRetainedNativePane(name) {
+        const config = this.fleetConfig?.instances[name];
+        if (!config)
+            throw Error("Native instance configuration is missing");
+        await (await this.nativePanes()).closeRetained(name, config, () => { if (this.shuttingDown)
+            throw Error("Fleet is stopping"); });
+    }
+    async reconcileNativePaneBeforeStart(name, daemon) {
+        const outbox = this.deliveryOutbox;
+        if (!outbox)
+            return true;
+        const epoch = this.lifecycle.epochOf(name);
+        return daemon.reconcileNativeDeliveries(outbox, () => !this.shuttingDown && this.lifecycle.epochOf(name) === epoch);
+    }
+    /** M-2255: the Windows runtimes' switches the fleet's own state reflects (null until the start-up has applied them). */
+    runtimeEffects = null;
+    runtimeEffectsScheduled = false;
+    localPaneDrain = null;
+    remotePaneDrain = null;
+    /** Revoke admissions synchronously; keep the captured transport only long enough for exact owned closes. */
+    drainNativeRuntime(remote) {
+        const existing = remote ? this.remotePaneDrain : this.localPaneDrain;
+        if (existing)
+            return existing;
+        const hub = this.runtimeHub, relay = this.localPaneRelay;
+        if (!remote)
+            relay?.beginCleanup();
+        const targets = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, config]) => isWindowsInstance(config) && !!config.machine_id === remote);
+        for (const [name, config] of targets) {
+            this.nativeMcpStore?.closeInstance(name);
+            if (isNativePaneInstance(config)) {
+                this.lifecycle.cancelNativeRecovery(name);
+                this.lifecycle.invalidate(name);
+                this.daemons.get(name)?.fenceDeliveryWritesForStop();
+            }
+        }
+        const run = Promise.resolve().then(async () => {
+            const results = await Promise.allSettled(targets.filter(([, config]) => isNativePaneInstance(config)).map(([name]) => this.stopInstance(name)));
+            results.forEach((result, index) => { if (result.status === "rejected")
+                this.logger.warn({ err: result.reason, remote, index }, "Windows pane cleanup unconfirmed; its reservation is retained"); });
+            try {
+                if (remote)
+                    await hub?.shutdownPaneHosts();
+                else
+                    await relay?.shutdownHost();
+            }
+            catch (error) {
+                this.logger.warn({ err: error, remote }, "Windows pane host shutdown unconfirmed; owned state is retained");
+            }
+        }).finally(() => {
+            if (remote) {
+                hub?.close();
+                if (this.runtimeHub === hub)
+                    this.runtimeHub = null;
+            }
+            else {
+                relay?.stop();
+                if (this.localPaneRelay === relay)
+                    this.localPaneRelay = null;
+                closeWindowsBridge(this);
+            }
+        });
+        if (remote)
+            this.remotePaneDrain = run;
+        else
+            this.localPaneDrain = run;
+        void run.finally(() => {
+            if (remote) {
+                if (this.remotePaneDrain === run)
+                    this.remotePaneDrain = null;
+            }
+            else if (this.localPaneDrain === run)
+                this.localPaneDrain = null;
+            if (!this.shuttingDown && (remote ? remoteRuntimeEnabled() : localWindowsCliEnabled())) {
+                this.initializeNativeInstances();
+                this.initializeNativeInstances(true);
+            }
+            try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { }
+        }).catch(error => this.logger.warn({ err: error }, "Windows runtime cleanup failed; retained ownership requires reconciliation"));
+        return run;
+    }
+    /**
+     * M-2255: Settings → Runtime's switches (fleet.yaml `runtimes`, or their environment override) in force — set each time
+     * the configuration in force changes (a load, a save, a reload's rollback), next to the web authority's. Every gate reads
+     * them at once; what the fleet itself holds (paired computers' connections, this PC's Windows process, agents' tool
+     * sessions) follows just after, outside the save that changed them (applyRuntimeSwitches): no restart is needed.
+     */
+    observeRuntimeSwitches() {
+        setConfiguredRuntimeSwitches(this.fleetConfig?.runtimes);
+        if (!this.runtimeEffects || this.runtimeEffectsScheduled)
+            return;
+        this.runtimeEffectsScheduled = true;
+        queueMicrotask(() => { this.runtimeEffectsScheduled = false; this.applyRuntimeSwitches(); });
+    }
+    /**
+     * Turned off: what it allowed ends now — the paired computers' connections (their agents show as offline) or this PC's
+     * Windows process (a turn in progress is cancelled, as when the fleet stops), and those agents' tool sessions.
+     * Turned on: the Windows agents are registered and their chat history read, as at start-up.
+     */
+    applyRuntimeSwitches() {
+        const was = this.runtimeEffects;
+        if (!was || this.shuttingDown)
+            return;
+        const now = { windows_cli: localWindowsCliEnabled(), remote_runtime: remoteRuntimeEnabled() };
+        if (was.windows_cli === now.windows_cli && was.remote_runtime === now.remote_runtime)
+            return;
+        this.runtimeEffects = now;
+        try {
+            if (was.remote_runtime && !now.remote_runtime) {
+                void this.drainNativeRuntime(true);
+            }
+            if (was.windows_cli && !now.windows_cli) {
+                void this.drainNativeRuntime(false);
+            }
+            if (!was.windows_cli && !was.remote_runtime && !this.localPaneDrain && !this.remotePaneDrain) {
+                this.initializeNativeInstances();
+                this.initializeNativeInstances(true);
+            }
+            this.logger.info({ windows_cli: now.windows_cli, remote_runtime: now.remote_runtime }, "Windows runtime switches applied");
+        }
+        catch (error) {
+            this.logger.warn({ err: error }, "Windows runtime switches could not be applied in full");
+        }
+        try {
+            this.emitSseEvent("status", this.getUiStatus());
+        }
+        catch { /* the next status frame carries it */ }
+    }
+    /** An unavailable opt-in runtime must not prevent the Linux fleet from starting or restoring its own history. */
+    initializeNativeInstances(history = false) {
+        if (!windowsCliEnabled())
+            return;
+        try {
+            const runtime = this.nativeInstanceRuntime();
+            if (history)
+                runtime.importHistory();
+            else
+                runtime.register();
+        }
+        catch (error) {
+            this.logger.warn({ err: error }, "Windows runtime state could not be loaded; affected native instances remain unavailable");
+        }
+    }
+    /** Native CLIs are headless: the manager owns the durable delivery generation instead of a tmux daemon. */
+    deliveryBootId(name) {
+        const config = this.fleetConfig?.instances[name];
+        if (isNativeExecInstance(config)) {
+            if (!this.nativeInstanceRuntime().available(name))
+                return null;
+            const machine = config.machine_id ? this.runtimeCoordinator().machine(config.machine_id) : null;
+            return machine ? `runtime:${machine.id}:${machine.bootId ?? machine.generation}` : this.managerBootId;
+        }
+        return this.daemons.get(name)?.bootId ?? null;
+    }
     rawFleetConfig = {};
     rawFleetDocument = null;
     /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
@@ -1536,6 +2379,8 @@ export class FleetManager {
      * authorizing revoked links and cookies until the fleet restarted.
      */
     settingsGeneration = 0;
+    /** #2942: the settings baseline the agent-requested Windows changes are checked against (set with the gate). */
+    settingsBaselineReader = null;
     settingsRuntimeRevision = 0;
     settingsConfirmation = null;
     settingsControl = null;
@@ -1592,8 +2437,9 @@ export class FleetManager {
             return this.settingsConfirmation;
         const generation = this.settingsGeneration;
         const current = () => !this.shuttingDown && this.settingsGeneration === generation;
-        const baselines = new SettingsBaselines({ dataDir: this.dataDir, configPath: () => this.configPath,
+        const baselines = this.settingsBaselineReader = new SettingsBaselines({ dataDir: this.dataDir, configPath: () => this.configPath,
             config: () => this.fleetConfig, current: () => [this.settingsGeneration, this.settingsRuntimeRevision, this.shuttingDown],
+            generalLocation: input => this.previewGeneralLocation(input),
             proof: (kind, target, id, binding, key) => {
                 const map = kind === "provider" ? this.providerSecretChallenges : kind === "binding" ? this.connectionBindingChallenges : this.connectionSecretChallenges;
                 const proof = map.get(id);
@@ -1614,6 +2460,17 @@ export class FleetManager {
         const store = new SettingsConfirmationStore({
             audit: (event, fields) => this.logger.info({ event: `settings_confirmation.${event}`, ...fields }, "Settings confirmation audit"),
             notify: view => view.state === "pending" ? this.promptSettingsChange(store, view) : Promise.resolve(),
+            // alpha.2 (M-2300): an agent's request came, was decided or ran out — the open pages read the list again (a ping
+            // with nothing in it: only a web-only fleet's verified owner may read it, GET /ui/agent-proposals).
+            changed: view => {
+                if (view.source !== "agent_request")
+                    return;
+                this.agentProposalsRev++;
+                broadcastSseEvent(this.sseClients, "agent_proposals", {}, err => this.logger.debug({ err }, "agent_proposals event failed"));
+                // …and a status frame with the new revision: a tab from before the upgrade (its stream knows no `agent_proposals`)
+                // applies status frames, and a polling page reads the same frame at its next /ui/poll.
+                this.emitSseEvent("status", this.getUiStatus());
+            },
         });
         const gate = new SettingsHttpConfirmation(store, {
             principal: req => {
@@ -1661,8 +2518,10 @@ export class FleetManager {
         const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
         if (auth.kind !== "ok")
             return null;
-        // #2453 (§0.2): never over the public link — not even a named-link session that is web-verified there.
-        if (gatewayRequestContext(req))
+        // #2453 (§0.2): never over the public link — not even a named-link session that is web-verified there. #3008: except
+        // this computer's admin signed in from outside (the authenticator's code, over the link connections from outside
+        // opened): the web-only fleet's owner, judged below by the same authority as here (hostOperator).
+        if (gatewayRequestContext(req) && auth.session.remote !== "totp")
             return null;
         // …and never a change that turns the named-link option on: that one needs a General's card or the host.
         if (!store.selfConfirmable(id))
@@ -1695,30 +2554,97 @@ export class FleetManager {
         if (own.length !== 1 || own[0].type !== chat.platform || !chat.admin(actor.user_id))
             return null;
         const affected = [...store.affectedConnections(id)]; // read now: a finished change no longer has them
-        if (!this.settingsNoticeGenerals(affected, chat.platform).length)
+        const destinations = this.settingsNoticeGenerals(affected, chat.platform);
+        if (!destinations.length)
             return null;
         const name = this.webPerson({ adapterId: actor.adapter_id, userId: actor.user_id }).name;
         return {
             label: t("settings_confirm.web_verified_label", name),
             // admin() asks chat.current() too; a General a card could go to must still be there (else the host CLI's).
-            current: () => !!verified() && chat.admin(actor.user_id) && this.settingsNoticeGenerals(affected, chat.platform).length > 0,
+            current: () => !!verified() && chat.admin(actor.user_id) && destinations.some(route => route.current()),
+            followStop: async (name, begin) => { const route = destinations.find(item => item.current()); if (!route)
+                throw Error("Settings route expired"); await route.followStop(name, begin); },
             done: view => this.settingsWebConfirmedNotice(view, affected, name, chat.platform),
         };
     }
-    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
-    settingsNoticeGenerals(affected, platform) {
-        const excluded = new Set(affected), found = [];
-        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            if (!config.general_topic || !this.daemons.get(name))
-                continue;
-            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
-            if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform || this.adapterState.get(adapterId)?.status !== "connected")
-                continue;
-            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
-            if (chatId && topic)
-                found.push({ adapterId, adapter, chatId, topic });
+    /**
+     * alpha.2 (M-2300; #2973's agent requests, junsion's §6): on a fleet with no chat connection there is no General to
+     * post an agent's Windows request in — it waited for `agend settings confirm` on the host. Its owner (decision
+     * 28c2d3a3: the `agend web --code` session on this computer, web-verified) now sees and decides it from the web's
+     * Needs you. The authority is asked from the request each time, and again at execution by the store (`current`):
+     * still that owner now (this computer, not revoked, signed out or run out), still a fleet with no chat connection,
+     * never over the public link. Anyone else — a guest, a LAN or public-link session, a chat-connected fleet's admin —
+     * gets nothing (a chat fleet keeps General's card as its way).
+     */
+    /**
+     * #2997 review (Prism P2): how many times an agent's request came or was decided — in a web-only fleet's status frame,
+     * so a page that never hears the stream's ping (one polling /ui/poll, one reconnecting, a tab from before the upgrade)
+     * reads the list again when it moves. A count, nothing more.
+     */
+    agentProposalsRev = 0;
+    agentProposalOwner(req) {
+        // #3008: this computer's admin here, or signed in from outside (over the link connections from outside opened) —
+        // asked of the LIVE session each time (#2997 review): a sign-out, an expiry, a revocation or the switch going off
+        // while the request is applied fences it.
+        return this.liveOwner(req, { hostOnly: false });
+    }
+    /** alpha.2: the agents' requests waiting for this web-only fleet's owner, or null when the reader is not that owner. */
+    webAgentProposals(req) {
+        if (!this.agentProposalOwner(req))
+            return null;
+        return this.settingsGate().store.listBySource("agent_request");
+    }
+    /**
+     * alpha.2: the owner's Approve or Reject of an agent's request. The store claims it before its first await (a second
+     * click, from here or the host, finds it no longer pending) and asks the owner, the request (its fleet generation and
+     * Windows switch) and the target machine again before and while it runs the same creation code the web uses. The
+     * answer is always the request as it now stands: applied (with the new agent's name), rejected, expired, stale or
+     * failed (with its reason), or already decided.
+     */
+    async webDecideAgentProposal(req, id, decision) {
+        const owner = this.agentProposalOwner(req);
+        if (!owner)
+            return { status: 403, body: { error: "owner_required", message: t("settings_confirm.web_owner_required") } };
+        const store = this.settingsGate().store, before = store.inspect(id);
+        if (!before || before.source !== "agent_request")
+            return { status: 404, body: { error: "not_found", message: t("settings_confirm.no_longer_pending") } };
+        try {
+            const view = await store.decide(id, decision, { ...owner, via: "web" });
+            this.logger.info({ id, decision, state: view.state }, "Agent request decided from the web by this computer's admin");
+            return { status: 200, body: { view, agent: agentNameOf(view) } };
+        }
+        catch (err) {
+            const code = err instanceof SettingsConfirmationError ? err.code : "decide_failed";
+            const status = err instanceof SettingsConfirmationError ? err.status : 500;
+            // Already decided (a double click, the host's command), run out or withdrawn: say what it is now.
+            return { status, body: { error: code, message: t(code === "admin_required" ? "settings_confirm.web_owner_required" : "settings_confirm.no_longer_pending"), view: store.inspect(id) } };
         }
-        return found;
+    }
+    /** A confirmation belongs to the server route/lifetime, not the availability of General's model. */
+    settingsGeneralRoute(name, platform, excluded) {
+        const config = this.fleetConfig?.instances[name];
+        if (!config?.general_topic || this.shuttingDown || this.ipcStoppingInstances.has(name))
+            return null;
+        const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
+        if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform)
+            return null;
+        const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
+        if (!chatId || !topic)
+            return null;
+        const route = () => !this.shuttingDown && this.fleetConfig?.instances[name]?.general_topic === true
+            && this.adapterState.get(adapterId)?.status === "connected"
+            && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
+            && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic;
+        const lifetime = new SettingsRouteLifetime(name, route, () => this.lifecycle.epochOf(name), () => this.ipcStoppingInstances.has(name));
+        return lifetime.current() ? { adapterId, adapter, chatId, topic, current: lifetime.current, followStop: lifetime.followStop.bind(lifetime) } : null;
+    }
+    /** Connected, same-platform, unaffected server routes can post cards even while the model is offline. */
+    settingsNoticeGenerals(affected, platform) {
+        const excluded = new Set(affected);
+        return Object.keys(this.fleetConfig?.instances ?? {}).flatMap(name => {
+            const route = this.settingsGeneralRoute(name, platform, excluded);
+            return route ? [route] : [];
+        });
     }
     /**
      * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
@@ -1777,6 +2703,119 @@ export class FleetManager {
         return { platform, current, admin: userId => current() && !!userId
                 && identities.every(owner => this.isFleetAdmin(userId, owner.id)) };
     }
+    /**
+     * #2942: a Windows create or settings change an AGENT asked for. Nothing is created or written here: it becomes a
+     * pending settings change whose General card a fleet admin must confirm (promptSettingsChange — the same admin rule
+     * as every card). Its apply runs the same creation/patch code the web uses, inside the store's SettingsExecution, with
+     * the confirming admin, the Windows switch and the target machine asked again at that moment.
+     */
+    async proposeAgentWindowsChange(input) {
+        const gate = this.settingsGate(), baselines = this.settingsBaselineReader;
+        if (!baselines || !this.fleetConfig)
+            throw new Error("Fleet configuration is unavailable");
+        const generation = this.settingsGeneration, machineId = input.machineId;
+        const switchOn = () => machineId ? remoteRuntimeEnabled() : localWindowsCliEnabled();
+        const online = () => !machineId || (remoteRuntimeEnabled() && this.runtimeCoordinator().machine(machineId)?.status === "online");
+        if (!switchOn())
+            throw new Error(machineId ? "Remote runtime is not enabled" : LOCAL_WINDOWS_CLI_OFF);
+        const baseline = await baselines.read(), snapshot = settingsFingerprint(baselines.snapshot());
+        const { view } = gate.store.propose({ session: `agent:${input.requester}`, key: `agent-windows:${input.key}`,
+            requestFingerprint: input.fingerprint, fingerprint: input.fingerprint, section: "channel", requestedBy: input.requester,
+            source: "agent_request", summary: input.summary, bytes: input.bytes, authority: input.authority, affectedConnections: [],
+            current: () => !this.shuttingDown && this.settingsGeneration === generation && switchOn(),
+            snapshot: () => baselines.snapshot(),
+            unchanged: async () => (await baselines.read()).fingerprint === baseline.fingerprint && settingsFingerprint(baselines.snapshot()) === snapshot,
+            // The store's own fence (this confirming admin, the session, the state) plus the switch and machine now.
+            apply: async (actorCurrent, execution) => {
+                execution.assert();
+                // alpha.2 polish: a paired machine whose CLI inventory has not arrived yet (just paired) is asked for its own
+                // report first (it runs on that PC), so the creation validates against what is installed there — never a refusal
+                // that only a manual Refresh would undo. Its answer or failure changes nothing else; the fence is asked again.
+                if (machineId && online() && !inventoryProbed(this.runtimeCoordinator().machine(machineId)?.inventory)) {
+                    // `force`: the runner's cached answer on a fresh profile is the placeholder itself (#3005 rig recheck).
+                    try {
+                        await this.runtimeCoordinator().call(machineId, "probe", { force: true });
+                    }
+                    catch { /* validation says what is missing */ }
+                    execution.assert();
+                }
+                return input.apply(() => actorCurrent() && online(), execution);
+            } });
+        return view;
+    }
+    /** #2942: create_instance with runtime "windows" from an agent: validated like the web, then held for General. */
+    async requestWindowsCreate(requester, rawArgs) {
+        const cfg = this.fleetConfig;
+        if (!cfg)
+            throw new Error("Fleet configuration is unavailable");
+        let parsed;
+        try {
+            parsed = parseNativeInstanceCreate(rawArgs);
+        }
+        catch {
+            throw new Error("Invalid Windows agent request: check the directory, sandbox, backend and model");
+        }
+        // The web's own projection: the same validation, topic target and diff the admin's dashboard confirmation shows.
+        let diff;
+        try {
+            diff = prepareSettingsEffect("POST", "/ui/instances", rawArgs, { config: cfg, classic: {} }).diff;
+        }
+        catch {
+            throw new Error("Invalid Windows agent request: its topic connection is not one this fleet can use");
+        }
+        if (!diff)
+            throw new Error("Invalid Windows agent request");
+        return this.proposeAgentWindowsChange({ requester, key: diff.fingerprint, fingerprint: diff.fingerprint, summary: diff.summary,
+            machineId: parsed.input.machineId, bytes: JSON.stringify(rawArgs).length,
+            // The General card is the confirmation for an agent's request, whatever the requested connection (a topic or none).
+            authority: { connections: diff.authority?.connections ?? [], primaryGeneral: true, unknown: false },
+            apply: (allowed, execution) => createNativeWindowsInstance(this, parsed, allowed, execution) });
+    }
+    /** #2942: update_instance_config on a Windows agent: only the fields the web editor allows, held for General. */
+    async requestWindowsConfig(requester, name, patch) {
+        const inst = this.fleetConfig?.instances[name];
+        if (!isWindowsInstance(inst))
+            throw new Error("Windows agent not found");
+        let edit;
+        try {
+            edit = NativeInstanceConfigEdit.parse(patch);
+        }
+        catch {
+            throw new Error("Invalid Windows agent settings: display_name, description and model only");
+        }
+        const before = { display_name: inst.display_name ?? "", description: inst.description ?? "", model: inst.model ?? "" };
+        const changed = Object.keys(edit).filter(key => edit[key] !== before[key]);
+        if (!changed.length)
+            throw new Error("Nothing to change: these settings already have these values");
+        const summary = changed.map(key => `${name} ${key}: ${settingsDisplay(before[key])} → ${settingsDisplay(edit[key])}`);
+        const machineId = typeof inst.machine_id === "string" ? inst.machine_id : undefined;
+        // #2973 review (Prism P1): a persistent pane is bound to a chat connection; changing it (a model change restarts it)
+        // needs that connection's admins as well as the primary General's, exactly as its creation did. An instance whose
+        // binding names no single configured connection is refused (fail closed), never confirmed by the General alone.
+        const connections = [];
+        if (isNativePaneInstance(inst) || inst.channel_id !== undefined) {
+            const bound = inst.channel_id, channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+            if (typeof bound !== "string" || channels.filter(ch => (ch.id ?? ch.type) === bound).length !== 1)
+                throw new Error("This Windows agent's chat connection cannot be resolved; change its settings in the web dashboard");
+            connections.push(bound);
+        }
+        return this.proposeAgentWindowsChange({ requester, key: `${name}:${settingsFingerprint(edit)}`, fingerprint: settingsFingerprint([name, edit]),
+            summary, machineId, bytes: JSON.stringify(edit).length, authority: { connections, primaryGeneral: true, unknown: false },
+            // #2973 review (Prism P2): the update may wait for its lifecycle turn; if the agent is rebound meanwhile (B → C), the
+            // approval for B must not stop or change it on C. Pin the approved target and require the execution's snapshot to be
+            // unchanged before every pre-commit effect; the post-commit restart keeps its own (refreshed) checks.
+            apply: (allowed, execution) => {
+                const pinned = { channel: inst.channel_id, machine: inst.machine_id, adapter: inst.native_adapter, runtime: inst.runtime };
+                const sameTarget = () => {
+                    const now = this.fleetConfig?.instances[name];
+                    return !!now && now.channel_id === pinned.channel && now.machine_id === pinned.machine && now.native_adapter === pinned.adapter && now.runtime === pinned.runtime;
+                };
+                // Before the commit: the exact target and an unchanged snapshot. After runtime.update completes the transaction,
+                // current() is false by design; the committed operation's restart receipt then needs the same actor, target and
+                // switch checks plus `completed` — a completed execution can never authorize another write (mutate refuses).
+                return updateNativeWindowsInstance(this, name, edit, () => allowed() && sameTarget() && (execution.completed || execution.current()), execution);
+            } });
+    }
     async promptSettingsChange(store, view) {
         const generation = this.settingsGeneration;
         const authority = this.settingsChatAuthority(store, view.id);
@@ -1785,25 +2824,15 @@ export class FleetManager {
             return;
         }
         const excluded = new Set(store.affectedConnections(view.id));
-        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            if (!config.general_topic)
-                continue;
-            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
-            const general = this.daemons.get(name);
-            if (!adapterId || !adapter || !general || excluded.has(adapterId) || adapter.type !== authority.platform)
-                continue;
-            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
-            if (!chatId || !topic)
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+            const route = this.settingsGeneralRoute(name, authority.platform, excluded);
+            if (!route)
                 continue;
+            const { adapterId, adapter, chatId, topic } = route;
             let retired = false, attached = false;
             const postingDeadline = performance.now() + Math.min(5000, view.remaining_ms);
-            const current = () => !retired && (attached || performance.now() < postingDeadline) && !this.shuttingDown && this.settingsGeneration === generation
-                && this.fleetConfig?.instances[name]?.general_topic === true
-                && this.daemons.get(name) === general && !this.ipcStoppingInstances.has(name)
-                && this.adapterState.get(adapterId)?.status === "connected"
-                && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
-                && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic
-                && authority.current();
+            const current = () => !retired && (attached || performance.now() < postingDeadline) && this.settingsGeneration === generation
+                && route.current() && authority.current();
             if (!current())
                 continue;
             try {
@@ -1813,7 +2842,7 @@ export class FleetManager {
                         t("settings_confirm.requester", view.requested_by), ...view.summary].join("\n"),
                     choices: [{ action: "confirm", label: t("settings_confirm.confirm_button") }, { action: "reject", label: t("settings_confirm.reject_button") }],
                     expiredText: t("settings_confirm.no_longer_pending"), timeoutMs: view.remaining_ms,
-                    extra: { pendingChangeId: view.id, confirmationCurrent: current, confirmationAdmin: userId => current() && authority.admin(userId) },
+                    extra: { pendingChangeId: view.id, confirmationCurrent: current, confirmationAdmin: userId => current() && authority.admin(userId), confirmationStop: route.followStop },
                 });
                 void posted.then(nonce => {
                     if (!retired)
@@ -2081,6 +3110,7 @@ export class FleetManager {
         try {
             const view = await this.settingsGate().store.decide(entry.pendingChangeId, action, {
                 label: t("settings_confirm.admin_label", data.userId ?? ""),
+                followStop: entry.confirmationStop,
                 current: () => entry.confirmationCurrent?.() === true && this.getAdapterForInstance(entry.instanceName) === entry.adapter
                     && !!data.userId && entry.confirmationAdmin?.(data.userId) === true,
             });
@@ -2455,12 +3485,15 @@ export class FleetManager {
     }
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input) {
+        const bindingHold = this.generalLocationDeliveryHold(input.targetInstance);
+        if (bindingHold)
+            throw Error(bindingHold);
         const outbox = this.deliveryOutbox;
         if (!outbox)
             throw new Error("Durable delivery store is unavailable");
-        const source = this.daemons.get(input.sourceInstance);
-        const sourceDaemonBootId = input.sourceDaemonBootId ?? source?.bootId;
-        if (!source || !sourceDaemonBootId || source.bootId !== sourceDaemonBootId) {
+        const currentSourceBootId = this.getDaemonBootId(input.sourceInstance);
+        const sourceDaemonBootId = input.sourceDaemonBootId ?? currentSourceBootId;
+        if (!currentSourceBootId || !sourceDaemonBootId || currentSourceBootId !== sourceDaemonBootId) {
             throw new Error("Source daemon generation is no longer current; outcome is unknown");
         }
         const sourceKey = `mcp:${input.sourceInstance}:${input.operationId}:${input.targetInstance}:${input.targetSession ?? ""}:${input.kind}`;
@@ -2494,7 +3527,7 @@ export class FleetManager {
         const human = (item) => {
             if (!item.authority || !state)
                 return item;
-            const authority = authorityNow(item.authority, state);
+            const authority = this.receiptAuthorityNow(item.authority, state);
             return { ...item, authority, ...(authority.downgraded ? { source_instance: "human:web:unknown" } : {}) };
         };
         // #1641: a sender that sees only `queued` cannot tell "next in line" from "the target is stuck": say which.
@@ -2523,6 +3556,11 @@ export class FleetManager {
         return this.daemons.get(target)?.notAcceptingReason?.() ?? null;
     }
     getDaemonBootId(instanceName) {
+        if (this.generalLocationDeliveryHold(instanceName))
+            return undefined;
+        if (isNativeExecInstance(this.fleetConfig?.instances[instanceName])) {
+            return !this.shuttingDown && windowsCliEnabled() && this.nativeMcpStore?.hasActive(instanceName) ? this.managerBootId : undefined;
+        }
         return this.daemons.get(instanceName)?.bootId;
     }
     markDurableResponseDelivered(sourceInstance, operationId) {
@@ -2531,8 +3569,22 @@ export class FleetManager {
     /** Called after a replacement Daemon object is installed in lifecycle.daemons. */
     onDaemonReady(name, daemonBootId) {
         const daemon = this.daemons.get(name);
-        if (daemon?.bootId === daemonBootId)
+        if (daemon?.bootId === daemonBootId) {
             this.listenForWorkingState(name, daemon);
+            const cfg = this.fleetConfig?.instances[name];
+            if (cfg?.general_topic && !this.generalLocationFlights.has(name) && daemon.getProcessStatus() === "running"
+                && (!isNativePaneInstance(cfg) || daemon.nativePaneCurrent())) {
+                try {
+                    if (this.generalBindings().completeSelected(name, cfg)) {
+                        this.needsYou?.poke();
+                        this.logger.info({ name }, "General location's selected start receipt settled after recovery");
+                    }
+                }
+                catch (err) {
+                    this.logger.warn({ name, err }, "General location start receipt remains held");
+                }
+            }
+        }
         // #2802: no post-restart notices. The outbox still delivers or fails a row accepted before the restart, and an open
         // request is reminded by the ordinary turn-ended nudge (sweepReplyObligations) once the owner is idle.
         this.scheduleDeliveryOutboxPump();
@@ -2676,6 +3728,15 @@ export class FleetManager {
         this.deliveryPumpRunning = true;
         this.deliveryPumpScheduled = false;
         try {
+            // Native workers have no resident daemon to wake. Pending durable work resumes their logical instance;
+            // the Windows bridge still owns the single physical execution slot.
+            for (const target of new Set(outbox.listPending().map(row => row.targetInstance))) {
+                if (isNativeExecInstance(this.fleetConfig?.instances[target])) {
+                    const runtime = this.nativeInstanceRuntime(), agent = runtime.get(target);
+                    if (agent?.paused && !agent.blocked)
+                        runtime.setPaused(target, false);
+                }
+            }
             outbox.expireStale(undefined, undefined, target => {
                 const failure = this.wakeCoordinator?.wakeFailure(target);
                 return failure ? `target could not be woken (${failure})` : undefined;
@@ -2688,7 +3749,7 @@ export class FleetManager {
                 // Phase 2c: a lane a queue worker owns is never claimed here.
                 target => this.queueWorkers.has(target) || this.isInstanceRestarting(target) || this.wakeCoordinator?.blocksClaim(target)
                     ? null
-                    : this.daemons.get(target)?.bootId ?? null, this.activeDurableTargets, row => this.recoveryDeliveryEligible(row));
+                    : this.deliveryBootId(target), this.activeDurableTargets, row => this.recoveryDeliveryEligible(row));
                 if (!claimed)
                     break;
                 this.activeDurableTargets.add(claimed.targetInstance);
@@ -2749,7 +3810,7 @@ export class FleetManager {
             wanted: () => this.deliveryWorkerMode(target) === "on",
             available: () => !this.shuttingDown && this.deliveryOutbox?.isOpen === true,
             blocked: () => this.isInstanceRestarting(target) || this.wakeCoordinator?.blocksClaim(target) === true,
-            daemonBootId: () => this.daemons.get(target)?.bootId ?? null,
+            daemonBootId: () => this.deliveryBootId(target),
             claim: bootId => this.deliveryOutbox?.claimNext(this.managerBootId, candidate => candidate === target ? bootId : null, new Set(), row => this.recoveryDeliveryEligible(row)),
             tryAcquireBudget: () => {
                 if (this.activeDurableTargets.size >= 8)
@@ -2780,6 +3841,10 @@ export class FleetManager {
         const outbox = this.deliveryOutbox;
         if (!outbox)
             return;
+        if (isNativeExecInstance(this.fleetConfig?.instances[claimed.targetInstance])) {
+            await this.dispatchNativeDurableDelivery(claimed);
+            return;
+        }
         const target = claimed.targetInstance;
         const attempt = claimed.attemptNo;
         const payload = { ...claimed.payload };
@@ -2861,6 +3926,85 @@ export class FleetManager {
         }
         await laneReleased;
     }
+    /** The ordinary durable lane, with provider completion proof instead of terminal/IPC submission proof. */
+    async dispatchNativeDurableDelivery(claimed) {
+        const outbox = this.deliveryOutbox;
+        if (!outbox)
+            return;
+        const { deliveryId, targetDaemonBootId, attemptNo, targetInstance: target } = claimed;
+        let begun = false;
+        try {
+            if (["raw_paste", "steer"].includes(claimed.kind)) {
+                if (outbox.begin(deliveryId, targetDaemonBootId, attemptNo) === "begun")
+                    outbox.complete(deliveryId, targetDaemonBootId, attemptNo, "failed", "Windows runtime does not support terminal input or steering");
+                return;
+            }
+            const meta = claimed.payload.meta && typeof claimed.payload.meta === "object" ? claimed.payload.meta : {};
+            const task = await this.nativeInstanceRuntime().execute(target, { ...claimed.payload, requestId: deliveryId, meta: { ...meta, from_instance: claimed.sourceInstance, correlation_id: claimed.correlationId } }, {
+                stillCurrent: () => !this.shuttingDown,
+                beforeStart: () => { if (outbox.begin(deliveryId, targetDaemonBootId, attemptNo) !== "begun")
+                    throw new Error("Windows delivery attempt is no longer current"); begun = true; },
+            });
+            const outcome = task.outcomeConfirmed === false ? "uncertain" : task.status === "completed" ? "delivered" : "failed";
+            outbox.complete(deliveryId, targetDaemonBootId, attemptNo, outcome, task.error || task.status);
+            // Return a requested peer report when the provider did not explicitly report it through scoped MCP.
+            if (meta.requires_reply === "true" && claimed.correlationId && !task.reportedCorrelationIds?.includes(claimed.correlationId) && this.fleetConfig?.instances[claimed.sourceInstance]) {
+                const text = (task.status === "completed" ? task.output : `Windows task ${task.status}: ${task.error || task.output}`).slice(0, 8000);
+                outbox.admit({ sourceKey: `native-result:${deliveryId}`, operationId: `native-result:${deliveryId}`, sourceInstance: target, sourceDaemonBootId: this.managerBootId,
+                    targetInstance: claimed.sourceInstance, kind: "fleet_inbound", correlationId: claimed.correlationId,
+                    payload: { type: "fleet_inbound", content: text || "Windows task completed without text output", meta: { from_instance: target, correlation_id: claimed.correlationId, requires_reply: "false", source: "native_runtime" } } });
+                this.scheduleDeliveryOutboxPump();
+            }
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (begun)
+                outbox.complete(deliveryId, targetDaemonBootId, attemptNo, "uncertain", reason);
+            else
+                outbox.retryBeforeBegin(deliveryId, targetDaemonBootId, attemptNo, reason, 5000);
+            this.logger.warn({ target, deliveryId, err: reason }, "Windows durable delivery did not complete");
+        }
+    }
+    /** A runtime's persisted completion can outlive this manager. Resolve its original delivery fence, never send
+     * the prompt again, and reconstruct a missing peer report using the same durable operation ID. */
+    reconcileRemoteDelivery(machineId, task) {
+        const outbox = this.deliveryOutbox;
+        if (!outbox?.isOpen || !task.finishedAt || task.outcomeConfirmed !== true || !["completed", "failed", "cancelled"].includes(task.status))
+            return;
+        const key = `${task.id}:${task.finishedAt}:${task.status}`;
+        if (this.reconciledRemoteResults.has(key))
+            return;
+        const row = outbox.get(task.id);
+        if (!row || !isNativeExecInstance(this.fleetConfig?.instances[row.targetInstance]) || this.fleetConfig?.instances[row.targetInstance]?.machine_id !== machineId
+            || !row.targetDaemonBootId || this.activeDurableTargets.has(row.targetInstance))
+            return;
+        if (row.state === "submission_started" || row.state === "reconciliation_pending") {
+            if (!outbox.complete(row.deliveryId, row.targetDaemonBootId, row.attemptNo, task.status === "completed" ? "delivered" : "failed", task.error || "Runtime completion recovered after reconnect"))
+                return;
+        }
+        else if (row.state === "uncertain" && task.status === "completed") {
+            if (outbox.markConsumed(row.deliveryId, row.targetDaemonBootId, row.attemptNo, "turn", "Paired runtime journal confirmed this exact execution completed") === "ignored")
+                return;
+        }
+        else if (row.state !== "delivered" && row.state !== "failed")
+            return;
+        const meta = row.payload.meta && typeof row.payload.meta === "object" ? row.payload.meta : {};
+        if (meta.requires_reply !== "true" || !row.correlationId || !this.fleetConfig?.instances[row.sourceInstance]) {
+            this.reconciledRemoteResults.add(key);
+            return;
+        }
+        const reports = outbox.queryStatusForInstance(row.targetInstance, { correlationId: row.correlationId, limit: 100 }).items;
+        if (reports.some(report => report.source_instance === row.targetInstance && report.target_instance === row.sourceInstance
+            && report.kind === "report" && !["failed", "cancelled"].includes(report.state))) {
+            this.reconciledRemoteResults.add(key);
+            return;
+        }
+        const text = (task.status === "completed" ? task.output : `Windows task ${task.status}: ${task.error || task.output}`).slice(0, 8000);
+        outbox.admit({ sourceKey: `native-result:${row.deliveryId}`, operationId: `native-result:${row.deliveryId}`, sourceInstance: row.targetInstance, sourceDaemonBootId: this.managerBootId,
+            targetInstance: row.sourceInstance, kind: "fleet_inbound", correlationId: row.correlationId,
+            payload: { type: "fleet_inbound", content: text || "Windows task completed without text output", meta: { from_instance: row.targetInstance, correlation_id: row.correlationId, requires_reply: "false", source: "native_runtime" } } });
+        this.reconciledRemoteResults.add(key);
+    }
     async waitForDurableLaneRelease(claimed) {
         const outbox = this.deliveryOutbox;
         if (!outbox)
@@ -3317,6 +4461,7 @@ export class FleetManager {
         this.warnAboutRemovedLoginMode(loaded);
         this.enforceGuestSwitch();
         this.observeWebAuthority(); // #2453 review: a reload's web-authority switches are seen at once
+        this.observeRuntimeSwitches(); // M-2255: so are the Windows runtimes' switches
         // Child tool/guidance readers must follow this fleet's actual config, including --config.
         // Scope the path to its owning data directory so another inherited home's override cannot enable CW.
         process.env.AGEND_FLEET_DATA_DIR = resolvePath(this.dataDir);
@@ -3745,6 +4890,8 @@ export class FleetManager {
     }
     /** Get the adapter bound to an instance, falling back to primary adapter */
     getAdapterForInstance(name) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name]))
+            return null;
         const worldId = this.getInstanceAdapterId(name);
         if (worldId)
             return this.worlds.get(worldId)?.adapter ?? this.adapter;
@@ -3807,6 +4954,8 @@ export class FleetManager {
     }
     /** Get the group_id for an instance's bound adapter */
     getGroupIdForInstance(name) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name]))
+            return "";
         const adapterId = this.getInstanceAdapterId(name);
         const world = adapterId ? this.worlds.get(adapterId) : undefined;
         return world?.groupId ?? String(this.getChannelConfig(adapterId)?.group_id ?? "");
@@ -3843,6 +4992,8 @@ export class FleetManager {
      */
     getInstanceAdapterId(name) {
         const cfg = this.fleetConfig?.instances[name];
+        if (isNativeExecInstance(cfg))
+            return undefined;
         if (cfg)
             return cfg.channel_id ?? this.getPrimaryAdapterId();
         if (this.classicChannels?.getChannelIdByInstance(name) !== undefined) {
@@ -3870,9 +5021,32 @@ export class FleetManager {
         this.instanceWorldBinding.set(name, adapterId);
     }
     getInstanceStatus(name) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+            try {
+                return this.nativeInstanceRuntime().status(name);
+            }
+            catch {
+                return "crashed";
+            }
+        }
         if (this.lifecycle.isPaused(name))
             return "paused";
         const daemon = this.lifecycle.daemons.get(name);
+        if (isNativePaneInstance(this.fleetConfig?.instances[name])) {
+            const config = this.fleetConfig.instances[name];
+            if (config.machine_id ? !remoteRuntimeEnabled() : !localWindowsCliEnabled())
+                return "stopped";
+            if (daemon) {
+                const native = daemon, status = native.getProcessStatus?.() ?? "crashed";
+                return status === "running" && native.nativePaneCurrent?.() !== true ? "crashed" : status;
+            }
+            try {
+                return this.nativeInstanceRuntime().get(name)?.activeId ? "crashed" : "stopped";
+            }
+            catch {
+                return "crashed";
+            }
+        }
         const processStatus = this.instanceProcessStatus.get(name);
         // IPC can be disconnected during a respawn, so the event which announces
         // the new live pane may be missed.  The in-process daemon is authoritative
@@ -3906,6 +5080,14 @@ export class FleetManager {
         }
     }
     getInstanceExecutionState(name) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+            try {
+                return this.nativeInstanceRuntime().execution(name);
+            }
+            catch {
+                return null;
+            }
+        }
         if (this.lifecycle.isPaused(name))
             return null;
         // Process status wins over a stale pane snapshot. A dead remain-on-exit pane
@@ -3916,6 +5098,8 @@ export class FleetManager {
     }
     /** Pure read of the single daemon-owned observation; no probe/capture or second tracker. */
     getInstanceInteraction(name) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name]))
+            return null;
         if (this.lifecycle.isPaused(name) || this.instanceProcessStatus.has(name))
             return null;
         const daemon = this.lifecycle.daemons.get(name);
@@ -4003,6 +5187,8 @@ export class FleetManager {
                 bindings.push([name, backend, profile]);
         };
         for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (isWindowsInstance(config))
+                continue; // Windows sign-ins and usage do not belong to the Linux account.
             // loadFleetConfig() has already merged the fleet default into each row.
             const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
             add(name, backend, instanceCredentialProfile(config, this.fleetConfig?.defaults, backend));
@@ -4609,6 +5795,8 @@ export class FleetManager {
      * id is no platform message, and the echo is the fleet's own post. The web send calls this on the echo's lane.
      */
     startWebChatProgress(instanceName) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[instanceName]))
+            return Promise.resolve();
         if (this.shuttingDown)
             return Promise.resolve();
         return this.sendCancelButton(instanceName);
@@ -4874,6 +6062,12 @@ export class FleetManager {
     }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
+        if (this.generalLocationDeliveryHold(instanceName))
+            return false;
+        if (isNativeExecInstance(this.fleetConfig?.instances[instanceName])) {
+            return this.nativeInstanceRuntime().deliver(instanceName, payload, { stillCurrent: options.stillCurrent,
+                ...(options.authorityCurrent ? { authorityCurrent: options.authorityCurrent } : {}) });
+        }
         const deliveryEpoch = this.getDeliveryEpoch(instanceName);
         const deliveryPayload = { ...payload, delivery_epoch: deliveryEpoch };
         const meta = payload.meta && typeof payload.meta === "object"
@@ -5431,6 +6625,10 @@ export class FleetManager {
      * slot admission and joins any wake already in flight for the target.
      */
     async explicitWake(name, timeoutMs = 30_000, retryStoppedSession = false) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+            this.nativeInstanceRuntime().setPaused(name, false);
+            return;
+        }
         if (this.sessionOomStopped(name)) {
             if (!retryStoppedSession)
                 throw new SessionOomStoppedError(false, readSessionOomStop(this.getInstanceDir(name)));
@@ -5455,6 +6653,10 @@ export class FleetManager {
             .sort((a, b) => (readLastInboundAt(this.getInstanceDir(a)) ?? 0) - (readLastInboundAt(this.getInstanceDir(b)) ?? 0))[0];
     }
     async changeInstancePauseState(name, action) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+            this.nativeInstanceRuntime().setPaused(name, action === "pause");
+            return action === "pause" ? "paused" : "awake";
+        }
         if (action === "wake") {
             await this.explicitWake(name, 30_000, true);
             this.enforceWarmCap(name); // manual wake still respects the fleet warm cap
@@ -5632,6 +6834,14 @@ export class FleetManager {
     resumePaused = false, 
     /** Phase 2a: the caller's transition, for a start made from inside a restart or wake. */
     transition, execution, kiroMigration) {
+        if (isNativeExecInstance(config)) {
+            execution?.assert();
+            if (!windowsCliEnabled())
+                throw new Error("Windows runtime is disabled");
+            if (resumePaused)
+                this.nativeInstanceRuntime().setPaused(name, false);
+            return;
+        }
         const migration = this.kiroMigrationRuns?.get(name);
         if (migration && migration.token !== kiroMigration)
             throw new Error(t("kiro_migrate.in_progress"));
@@ -5682,27 +6892,29 @@ export class FleetManager {
             if (resumePaused)
                 this.lifecycle.markActivitySeedNow(name);
             const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
-            // #1490 row 67: off-loop resolve before skill/instruction publication
+            // #1490 row 67 (main): off-loop resolve before skill/instruction publication
             // constructs a backend (resolveKnowledgeWorkDir). Capture stop/lifecycle
             // ownership first: a Stop during this wait finishes and bumps the epoch,
             // and the inner lifecycle check would otherwise capture the new epoch and
             // accept the stale start. Lifecycle start looks up again before its own
-            // createBackend; the probe cache makes that cheap.
+            // createBackend; the probe cache makes that cheap. (alpha: a native Windows
+            // agent's CLI is on that PC — nothing to resolve on this one.)
             const epoch = this.lifecycle.epochOf(name);
             const stopGen = this.explicitStopGeneration.get(name) ?? 0;
-            const resolved = await resolveBackendBinary(backend);
+            const windows = isWindowsInstance(config);
+            const resolved = windows ? null : await resolveBackendBinary(backend);
             execution?.assert();
             if (this.lifecycle.epochOf(name) !== epoch
                 || (this.explicitStopGeneration.get(name) ?? 0) !== stopGen) {
                 throw new SupersededStartError(name);
             }
             const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
-            if (binary)
+            if (binary && !windows)
                 noteResolvedBinary(binary, resolved ?? binary);
-            if (config.general_topic) {
+            if (!windows && config.general_topic) {
                 this.ensureGeneralInstructions(config.working_directory, backend, name);
             }
-            else if (kind === "fleet-topic") {
+            else if (!isWindowsInstance(config) && kind === "fleet-topic") {
                 // Workers get only role-eligible on-demand skills. Classic instances are
                 // deliberately excluded: their workspace and conversation lifecycle are
                 // managed independently from fleet-topic workers.
@@ -5717,7 +6929,7 @@ export class FleetManager {
                     this.logger.warn({ err, name, backend }, "Failed to sync worker skills — continuing startup");
                 }
             }
-            else if (kind === "classic") {
+            else if (!isWindowsInstance(config) && kind === "classic") {
                 // #2163: a Classic bot gets only the skills marked `classic` (its own look, the dashboard) — never the fleet's
                 // coordination playbooks (#557 kept those out of end-user bots) — and only into a workspace AgEnD manages: the
                 // room's own folder under <AGEND_HOME>/workspaces/. Anywhere else, nothing is written; `agend-agent skill <name>`
@@ -5734,7 +6946,7 @@ export class FleetManager {
                 }
             }
             const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
-            const identity = { kind, backend, model: this.resolveInstanceModel(name).display };
+            const identity = { kind, backend, model: isWindowsInstance(config) ? config.model || "default" : this.resolveInstanceModel(name).display };
             if (receipt) {
                 await this.lifecycle.start(name, config, topicMode, identity, transition, execution, daemon => {
                     // Only this transition's actual publication can acquire its replacement.
@@ -5804,7 +7016,7 @@ export class FleetManager {
         // them before grouping/staggering: startInstance() retains its own guard as
         // a final backstop, but putting a no-op entry in this queue still consumes a
         // full stagger slot for every distinct working directory.
-        const runnableEntries = entries.filter(([name]) => !this.lifecycle.isPaused(name));
+        const runnableEntries = entries.filter(([name, config]) => !isNativeExecInstance(config) && !this.lifecycle.isPaused(name));
         // ClassicBot rooms queue with the fleet instances, at the same pressure pacing (#2642 follow-up): they used to start
         // only after the whole fleet, the chat connections, topics and icons. A name the fleet also configures is the fleet's.
         const fleetNames = new Set(entries.map(([name]) => name));
@@ -5870,6 +7082,8 @@ export class FleetManager {
                 return false;
             if (err instanceof SessionOomStoppedError)
                 await this.notifySessionOomStop(name);
+            if (this.holdNativePaneRecovery(name, err))
+                return false;
             if (this.stopOnUnsupportedCli(name, err, what))
                 return false;
             this.logger.error({ err, name }, `Failed to start ${what}`);
@@ -6011,6 +7225,8 @@ export class FleetManager {
             if (err instanceof SupersededStartError)
                 return;
             // An earlier attempt could not tell (unknown probe); this one could.
+            if (this.holdNativePaneRecovery(name, err))
+                return;
             if (this.stopOnUnsupportedCli(name, err, "instance"))
                 return;
             this.logger.error({ err, name, attempt: attempt + 1 }, "Automatic startup retry failed");
@@ -6261,7 +7477,7 @@ export class FleetManager {
         return count;
     }
     configuredStartupInstanceNames(fleet, includeClassic) {
-        const names = new Set(Object.keys(fleet.instances));
+        const names = new Set(Object.entries(fleet.instances).filter(([, config]) => !isNativeExecInstance(config)).map(([name]) => name));
         if (includeClassic) {
             for (const channel of this.classicChannels?.getAll() ?? [])
                 names.add(channel.instanceName);
@@ -6312,6 +7528,10 @@ export class FleetManager {
         return poster.postCompletion({ resolveAdapter: () => this.readyProgressAdapter(adapterId), chatId, threadId }, text);
     }
     async stopInstance(name, transition) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+            this.nativeInstanceRuntime().setPaused(name, true);
+            return { backgroundWorkEnded: false };
+        }
         this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
         this.cancelStartupRetry(name);
         this.failoverActive.delete(name);
@@ -6351,6 +7571,16 @@ export class FleetManager {
     async restartSingleInstance(name, opts) {
         if (opts?.ownerCurrent && !opts.ownerCurrent())
             throw new RestartSupersededError(this.shownInstanceName(name));
+        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+            const runtime = this.nativeInstanceRuntime();
+            if (runtime.get(name)?.blocked)
+                throw new Error("Verify the disconnected Windows process stopped and recover this agent before restarting");
+            runtime.cancel(name);
+            runtime.setPaused(name, false);
+            return;
+        }
+        if (opts?.explicit && isNativePaneInstance(this.fleetConfig?.instances[name]))
+            this.lifecycle.resetNativeCrashBudget(name);
         const migration = this.kiroMigrationRuns?.get(name);
         if (migration && migration.token !== opts?.kiroMigration)
             throw new Error(t("kiro_migrate.in_progress"));
@@ -6414,7 +7644,7 @@ export class FleetManager {
         return run;
     }
     isInstanceRestarting(name) {
-        return this.restartsInFlight.has(name) || this.kiroMigrationRuns?.has(name) === true;
+        return this.restartsInFlight.has(name) || this.kiroMigrationRuns?.has(name) === true || this.lifecycle?.nativeRecoveryPending?.(name) === true;
     }
     /** InstanceLifecycleContext: an explicit wake joins the restart in flight. */
     restartInFlight(name) {
@@ -6709,6 +7939,9 @@ export class FleetManager {
             log: () => this.logger.warn("Managed tunnel cleanup requires attention") }));
     }
     publicOwnerCurrent(owner) {
+        // #3008: the outside link is this computer's admin's — while "Allow connections from outside" is on, web-only.
+        if (isOutsideLinkOwner(owner))
+            return !this.shuttingDown && this.outsideOn();
         if (this.shuttingDown || !this.hasFleetAdmins(owner.adapterId) || !this.isFleetAdmin(owner.userId, owner.adapterId))
             return false;
         const configured = (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).find(ch => (ch.id ?? ch.type) === owner.adapterId);
@@ -6798,7 +8031,11 @@ export class FleetManager {
     }
     getPublicWebLink() {
         this.initializeWebSessions();
-        return this.publicWebLink ??= new PublicWebLink({
+        return this.publicWebLink ??= new PublicWebLink(this.publicWebLinkDeps());
+    }
+    /** The public link's wiring to this fleet (a test builds one with the tunnel itself stubbed: `ensure`, `provider`). */
+    publicWebLinkDeps() {
+        return {
             dataDir: this.dataDir, web: () => this.fleetConfig?.web,
             permitted: owner => this.publicOwnerCurrent(owner),
             reserve: id => this.getTunnelLane().reserve("dashboard", id),
@@ -6831,7 +8068,9 @@ export class FleetManager {
                 if (world && world.adapter === owner.binding)
                     void world.adapter.sendText(owner.chatId, t("dashboard.public_cleanup"), { threadId: owner.threadId }).catch(() => { });
             },
-        });
+            onClose: (owner, reason) => { if (isOutsideLinkOwner(owner))
+                this.outsideLinkClosed(reason); },
+        };
     }
     publicLinkAutoOpen = null;
     /**
@@ -8190,6 +9429,9 @@ export class FleetManager {
         const fleet = this.loadConfig(configPath, { startup: true });
         this.slimFleetConfigAtStartup();
         this.logConfigWarningsAtStartup();
+        this.initializeNativeInstances();
+        // M-2255: from here on a change to the Windows runtimes' switches applies live (observeRuntimeSwitches).
+        this.runtimeEffects = { windows_cli: localWindowsCliEnabled(), remote_runtime: remoteRuntimeEnabled() };
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
         // #1737 review: the marker this boot adopts — the startup clear may only ever clear this one.
         const bootUpdateMarker = updateMarkerIdentity(this.dataDir);
@@ -8221,7 +9463,7 @@ export class FleetManager {
         // Pre-flight (advisory, fire-and-forget): warm the per-backend auth cache
         // before instances spawn, so a CLI that comes up on its sign-in screen gets
         // an instant 🔑 verdict instead of decaying into crash/MCP-died noise.
-        this.lifecycle.primeAuthVerification(Object.values(fleet.instances).map(config => {
+        this.lifecycle.primeAuthVerification(Object.values(fleet.instances).filter(config => !isWindowsInstance(config)).map(config => {
             const backend = config.backend ?? fleet.defaults?.backend ?? "claude-code";
             // #1699 follow-up: each instance's own login — a profile is probed with its own environment.
             return { backend, profile: credentialHomeSpec(backend) ? instanceCredentialProfile(config, fleet.defaults, backend) : null };
@@ -8283,6 +9525,7 @@ export class FleetManager {
         // #1565: the web chat as it was before this process — the configured instances' only (fleet.yaml and ClassicBot
         // rooms), before the dashboard serves anything; from now on every change is written back (off the loop).
         this.restoreWebChat(fleet);
+        this.initializeNativeInstances(true);
         this.startSearchIndex(fleet);
         // Parse-only source monitoring; it does not apply hand-edited Fleet settings.
         this.configHistoryTimer = setInterval(() => this.configHistory?.check(), 1_000);
@@ -8465,7 +9708,7 @@ export class FleetManager {
             }
         }
         // Phase 1: Start general instances first and wait for them
-        const allEntries = Object.entries(fleet.instances);
+        const allEntries = Object.entries(fleet.instances).filter(([, config]) => !isNativeExecInstance(config));
         const generals = allEntries.filter(([_, cfg]) => cfg.general_topic);
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
         const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingProgressOperation === "full-restart" ? "reload" : pendingUpdateProgress ? "update" : "restart" });
@@ -8704,6 +9947,10 @@ export class FleetManager {
             // #named-link-ttl: a named link with auto_open comes back now — after the web listener and the chat connections.
             this.startPublicLinkAutoOpen();
         }
+        // #3008: connections from outside were on when the fleet stopped: the link opens again (its address is new for a
+        // quick link — Settings shows it on this computer).
+        if (this.outsideOn())
+            this.openOutsideLink([0, ...OUTSIDE_LINK_RETRY_MS]);
         // #1266: buttons that ended while AgEnD was down (expired, or chosen before a restart) are shown as ended now.
         // #1823: and polls: a deadline that passed meanwhile closes now (results once); an open one's countdown is redrawn.
         void this.replyButtons()?.sweep().catch(err => this.logger.warn({ err }, "Reply-button sweep failed"));
@@ -9467,10 +10714,14 @@ export class FleetManager {
                 }
             }
         }
+        const daemon = this.daemons.get(name);
+        const native = daemon?.usesNativePane?.();
         const sockPath = join(this.getInstanceDir(name), "channel.sock");
-        if (!existsSync(sockPath))
+        if (!native && !existsSync(sockPath))
             return;
-        const ipc = new IpcClient(sockPath);
+        const ipc = native
+            ? new NativeDaemonClient(daemon, () => this.daemons.get(name) === daemon && (!this.instanceIpcClients.has(name) || this.instanceIpcClients.get(name) === ipc))
+            : new IpcClient(sockPath);
         try {
             await ipc.connect();
             this.instanceIpcClients.set(name, ipc);
@@ -9586,7 +10837,7 @@ export class FleetManager {
             // connected, so seed the cache instead of waiting for another transition.
             ipc.send({ type: "query_instance_state", requestId: `fleet-state-${Date.now()}` });
             this.logger.debug({ name }, "Connected to instance IPC");
-            if (!this.statuslineWatcher.has(name)) {
+            if (!native && !this.statuslineWatcher.has(name)) {
                 this.statuslineWatcher.watch(name);
             }
             // Auto-reconnect on disconnect (unless intentionally stopping)
@@ -10633,6 +11884,12 @@ export class FleetManager {
                 if (msg.adapterId)
                     this.bindInstanceAdapter(generalInstance, msg.adapterId, true);
                 const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+                const locationHold = this.generalLocationDeliveryHold(generalInstance);
+                if (locationHold) {
+                    await inboundAdapter.sendText(msg.chatId, locationHold, { threadId: msg.threadId || undefined });
+                    this.needsYou?.poke();
+                    return;
+                }
                 // React immediately — before any other API calls — through the status
                 // path, which tracks Telegram slot ownership and Discord status adds.
                 if (msg.chatId && msg.messageId) {
@@ -10720,6 +11977,13 @@ export class FleetManager {
         if (instanceConfig?.general_topic && await this.topicCommands.handleGeneralCommand(msg, instanceName)) {
             return;
         }
+        const locationHold = this.generalLocationDeliveryHold(instanceName);
+        if (locationHold) {
+            const adapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+            await adapter.sendText(msg.chatId, locationHold, { threadId: msg.threadId || undefined });
+            this.needsYou?.poke();
+            return;
+        }
         // Bind instance to the adapter that delivered this message
         if (msg.adapterId)
             this.bindInstanceAdapter(instanceName, msg.adapterId, true);
@@ -12649,6 +13913,7 @@ export class FleetManager {
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.refreshSavedDashboardPermissions();
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
+        this.observeRuntimeSwitches(); // M-2255: a saved Windows runtime switch applies now
     }
     /** A permission tightening is effective when its save returns, independently of the later apply job or IPC. */
     refreshSavedDashboardPermissions() {
@@ -12882,10 +14147,43 @@ export class FleetManager {
     }
     getSettingsConfigPath() { return this.configPath; }
     async removeInstance(name, authorization, execution) {
+        if (isWindowsInstance(this.fleetConfig?.instances[name])) {
+            execution?.assert();
+            assertExplicitInstanceRemoval(authorization);
+            if (isNativePaneInstance(this.fleetConfig?.instances[name])) {
+                await this.stopInstance(name);
+                execution?.assert();
+            }
+            this.nativeInstanceRuntime().remove(name, () => !this.shuttingDown && (!execution || execution.current()), execution);
+            return;
+        }
         if (execution)
             return this.lifecycle.runTransition(name, transition => this.removeInstanceOwned(name, authorization, execution, transition));
         return this.removeInstanceOwned(name, authorization);
     }
+    /** Shared instance metadata goes with a native identity; its Windows workspace and provider sessions stay intact. */
+    nativeInstanceRemoved(name) {
+        const clean = (what, run) => { try {
+            run();
+        }
+        catch (error) {
+            this.logger.warn({ name, err: error }, `Native instance ${what} cleanup failed`);
+        } };
+        clean("delivery", () => { this.cancelPendingDeliveries(name); });
+        forgetInstanceContext(name);
+        clean("schedules", () => { for (const schedule of this.scheduler?.list(name) ?? [])
+            this.scheduler.delete(schedule.id); });
+        this.lastActivity.delete(name);
+        this.lastInboundUser.delete(name);
+        this.rateLimitWarnedAt.delete(name);
+        this.lastInboundMsg.delete(name);
+        clean("history", () => this.webChatHistory.forget(name));
+        clean("search", () => this.searchIndex?.removeInstance(name));
+        clean("files", () => this.webFiles.forget(name));
+        clean("compact", () => this.compactWatchService?.forget(name));
+        clean("preferences", () => this.webPrefs.forgetInstance(name));
+        clean("appearance", () => { this.themeStore.forget(name); this.webAppearance.forget(name); this.appearanceTools.forget(name); this.mods.forgetInstance(name); this.officeActsInstance?.forget(name); this.officePackToolsInstance?.forget(name); });
+    }
     async removeInstanceOwned(name, authorization, execution, transition) {
         execution?.assert();
         assertExplicitInstanceRemoval(authorization);
@@ -13011,6 +14309,8 @@ export class FleetManager {
         execution?.complete();
     }
     startStatuslineWatcher(name) {
+        if (isWindowsInstance(this.fleetConfig?.instances[name]))
+            return;
         if (this.lifecycle.isPaused(name))
             return;
         this.statuslineWatcher.watch(name);
@@ -14459,6 +15759,10 @@ export class FleetManager {
      * would have to make this async and change every caller.
      */
     notifyInstanceTopic(instanceName, text, extraOpts) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[instanceName])) {
+            this.emitSseEvent("message", { instance: instanceName, role: "status", sender: "AgEnD", text, ts: new Date().toISOString() });
+            return true;
+        }
         // #2910 D2: a web-only fleet has no topics: what the agent's topic would have been told is a Notice about it.
         if (this.webOnlyPromptPlace())
             return this.recordWebNotice("instance", text, instanceName);
@@ -14939,6 +16243,8 @@ export class FleetManager {
      * (also for a backend that has no profiles, where the option is ignored).
      */
     credentialProfileOf(name, backend) {
+        if (isWindowsInstance(this.fleetConfig?.instances[name]))
+            return null;
         if (!credentialHomeSpec(backend))
             return null;
         const cfg = this.fleetConfig?.instances?.[name];
@@ -14961,7 +16267,7 @@ export class FleetManager {
     }
     /** The instances the cache analysis reads: fleet.yaml's, then the ClassicBot rooms (their workspace under the AgEnD home, their own backend). */
     cacheInstances() {
-        const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
+        const fleet = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => !isWindowsInstance(cfg)).map(([name, cfg]) => ({
             name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(name), profile: this.usageProfileOf(name, this.backendNameOf(name)),
             kiroDbPath: this.kiroDbPathOf(name, this.backendNameOf(name)),
@@ -15140,6 +16446,20 @@ export class FleetManager {
                 crashedAt: crashed ? (this.needsCrashedAt.get(name) ?? null) : null,
                 signIn: pauseReason === "auth" ? this.signInFor(name) : null,
                 usageHold: this.daemons.get(name)?.usageHold?.() ?? null,
+                nativeDeliveryHold: this.daemons.get(name)?.nativeDeliveryHold?.() ?? null,
+                generalLocation: this.generalLocationAttention(name),
+                paneRecovery: (() => {
+                    const config = this.fleetConfig?.instances[name];
+                    if (!isNativePaneInstance(config) || !config.native_agent_id)
+                        return null;
+                    try {
+                        const profile = windowsAgentsFor(this, this.runtimeWindowsExecutor()).get(config.native_agent_id);
+                        return profile.paneRecovery ? { key: `${profile.paneRecovery.kind}:${profile.paneRecovery.launchId ?? "-"}`, detail: new NativePaneRecoveryError(profile.paneRecovery).message, since: profile.paneRecoveryAt ?? profile.createdAt } : null;
+                    }
+                    catch {
+                        return null;
+                    }
+                })(),
             });
         }
         return out;
@@ -15195,6 +16515,8 @@ export class FleetManager {
                 const target = this.fleetNoticeTarget(world);
                 return target ? { chatId: target.chatId, ...(target.opts.threadId !== undefined ? { threadId: String(target.opts.threadId) } : {}) } : null;
             },
+            // The name the web page shows for the instance (its View alias, else its own name), never the raw id alone.
+            instanceName: instance => resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[instance], profile: profileIdentities(this.dataDir).get(instance) }).display_name || instance,
             instanceTopic: instance => {
                 const topic = this.fleetConfig?.instances[instance]?.topic_id;
                 if (topic != null)
@@ -15739,7 +17061,7 @@ export class FleetManager {
             isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
             authorization: input.session ? this.sessionAuthorizationStore()?.get(input.session.handle) ?? null : null,
             policy: { ...webAuthorityPolicy(this.fleetConfig?.web), enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink, quickLink: state.quickLink }, epoch: state.epoch, now: Date.now(),
-            hostOperator: this.isWebOnlyFleet(),
+            hostOperator: this.isWebOnlyFleet(), outside: this.outsideLink(),
         });
     }
     sessionAuthorizations = null;
@@ -15799,6 +17121,264 @@ export class FleetManager {
         const { durable } = store.authorize(session.handle, HOST_OPERATOR, now, state.epoch, now + policy.maxSessionMs, peer);
         this.logger.info({ handle: session.handle, durable }, "Host web session authorized (this computer's admin)");
     }
+    // ── #3008: connections from outside (a web-only fleet; decision 28c2d3a3 rule 3, the user's simplified form) ──
+    webRemoteAccessState = null;
+    /** The authenticator, the outside switch and the wrong-code limiter (web-remote-access.json), read on first use. */
+    webRemoteAccess() {
+        if (!this.dataDir)
+            return null;
+        this.webRemoteAccessState ??= new WebRemoteAccess(join(this.dataDir, WEB_REMOTE_ACCESS_FILE), this.logger);
+        return this.webRemoteAccessState;
+    }
+    /** "Allow connections from outside" is on (an app set up) and this is a web-only fleet. */
+    outsideOn() {
+        return this.isWebOnlyFleet() && (this.webRemoteAccess()?.outside ?? false);
+    }
+    /** The link connections from outside opened, while it is open and still theirs: its exposure. Else null. */
+    outsideLink() {
+        if (!this.outsideOn())
+            return null;
+        const open = this.publicWebLink?.openSignin();
+        return open && isOutsideLinkOwner(open.owner) ? { exposureId: open.exposureId } : null;
+    }
+    /**
+     * The request's live session, asked again each time `current()` is called (its own cookie authenticated anew, the same
+     * handle): this web-only fleet's owner — this computer's admin, on this computer (`hostOnly`), or also signed in from
+     * outside — and web-verified now. Null when it is not (a guest, a LAN session, a chat fleet's admin, nobody).
+     */
+    liveOwner(req, opts) {
+        if (!this.isWebOnlyFleet())
+            return null;
+        if (opts.hostOnly && gatewayRequestContext(req))
+            return null;
+        const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+        if (auth.kind !== "ok")
+            return null;
+        const handle = auth.session.handle, peer = webPeerOf(req), gateway = !!gatewayRequestContext(req);
+        const owner = () => {
+            if (!this.isWebOnlyFleet())
+                return false;
+            const live = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+            if (live.kind !== "ok" || live.session.handle !== handle)
+                return false;
+            if (opts.hostOnly && (live.session.host !== true || peer !== "loopback"))
+                return false;
+            const now = this.webAuthority({ session: live.session, gateway, peer });
+            const a = now.authority.kind === "web-verified" && now.authority.session?.handle === handle ? now.authority.actor : null;
+            return !!a && a.adapter_id === HOST_OPERATOR.adapterId && a.user_id === HOST_OPERATOR.userId;
+        };
+        return owner() ? { label: t("settings_confirm.host_operator_label"), handle, current: owner } : null;
+    }
+    /** Every session signed in from outside ends (and the authorizations kept for them). */
+    endOutsideSessions() {
+        const ended = new Set(this.webSessions?.list(undefined, r => r.remote === "totp").map(r => r.handle) ?? []);
+        if (!ended.size)
+            return;
+        this.sessionAuthorizationStore()?.prune(a => !ended.has(a.handle));
+        const result = this.webSessions?.revokeAll(r => r.remote === "totp");
+        if (result && !result.durable)
+            this.logger.warn("Outside sessions ended, but that could not be saved");
+        this.logger.info({ count: ended.size }, "Sessions signed in from outside ended");
+    }
+    /**
+     * #1939 §10 / #3008: a stored receipt's authority as it reads now — the web authority state, and for this computer's
+     * admin from outside the switch and the last revocation of remote authority (Prism P2 2).
+     */
+    receiptAuthorityNow(stored, state = this.webAuthorityState()) {
+        return authorityNow(stored, { ...state, outside: this.outsideOn(), outsideHandles: this.webRemoteAccess()?.admitted ?? new Set() });
+    }
+    /** #3008 (the sign-in page): this exposure is the outside link, open now. */
+    isOutsideLink(exposureId) {
+        return this.outsideLink()?.exposureId === exposureId;
+    }
+    /** What Settings shows: set up or not, the switch, a wait in force, the link — its address only to this computer. */
+    webOutsideStatus(req) {
+        const store = this.webRemoteAccess(), status = store?.status();
+        const here = !!this.liveOwner(req, { hostOnly: true });
+        const open = this.outsideOn() ? this.publicWebLink?.openSignin() : null;
+        const mine = !!open && isOutsideLinkOwner(open.owner);
+        const linkStatus = this.outsideOn() ? this.getPublicWebStatus() : null;
+        return { webOnly: this.isWebOnlyFleet(), here, enrolled: !!status?.enrolled, enrolledAt: status?.enrolledAt ?? null,
+            outside: this.outsideOn(), pausedForMs: status?.pausedForMs ?? 0,
+            link: linkStatus && linkStatus.state !== "closed" ? { ...linkStatus, ...(here && mine ? { url: open.url } : {}), quick: !publicLinkNamedHostname(this.fleetConfig?.web) } : null };
+    }
+    /** Set up (or set up again): a new secret, shown once to this computer's admin. Null: not them. */
+    webOutsideBeginEnrollment(req) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store)
+            return null;
+        return store.beginEnrollment(owner.handle, hostname() || "fleet");
+    }
+    /** The new app's first code: on "ok" it replaces the old one, whose sessions from outside end. */
+    webOutsideConfirmEnrollment(req, code) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store || !owner.current())
+            return "not_here";
+        const had = store.enrolled;
+        const r = store.confirmEnrollment(owner.handle, code);
+        if (r === "ok") {
+            this.logger.info({ again: had }, "Authenticator app set up for connections from outside");
+            if (had)
+                this.endOutsideSessions();
+        }
+        return r;
+    }
+    /** Forget the app: the switch goes off, the link closes, every session from outside ends. */
+    webOutsideRemove(req) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store || !owner.current())
+            return "not_here";
+        // #3008 review (Prism P2 1): shut at once whatever the disk says; say so when it could not be saved (retried).
+        const saved = store.remove();
+        this.closeOutsideLink("outside removed");
+        this.logger.info({ saved }, "Authenticator app removed; connections from outside off");
+        return saved ? "ok" : "unsaved";
+    }
+    /** The switch. On: needs an app set up; the link opens. Off: it closes and every session from outside ends. */
+    webOutsideSwitch(req, on) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store || !owner.current())
+            return "not_here";
+        if (on && !publicLinkSettings(this.fleetConfig?.web).allowed)
+            return "not_allowed";
+        const r = store.setOutside(on);
+        if (r === "not_enrolled")
+            return r;
+        this.logger.info({ on, saved: r === "ok" }, "Connections from outside switched");
+        // #3008 review (Prism P2 1): Off shuts at once even when it could not be saved (the store retries); On opens only
+        // once saved — a switch the disk does not hold would not survive a restart.
+        if (!on)
+            this.closeOutsideLink("outside off");
+        else if (r === "ok")
+            this.openOutsideLink([0, ...OUTSIDE_LINK_RETRY_MS]);
+        return r;
+    }
+    outsideAttempt = null;
+    outsideOpening = false;
+    /**
+     * Open the outside link: an attempt after each delay in turn until one opens (#3008 B: twice more at most — the quick
+     * link's address service limits how often it may be asked). Every attempt asks again: the switch still on, the fleet
+     * running. A final failure: one Notice; the switch stays on, so the next start tries again.
+     */
+    openOutsideLink(delays) {
+        this.outsideAttempt?.cancel();
+        this.outsideAttempt = null;
+        const attempt = (n) => {
+            this.outsideAttempt = null;
+            if (this.shuttingDown || !this.outsideOn() || this.outsideOpening)
+                return;
+            this.outsideOpening = true;
+            void this.getPublicWebLink().openUnattended(OUTSIDE_LINK_OWNER).catch(() => "failed").then(outcome => {
+                this.outsideOpening = false;
+                if (outcome === "opened") {
+                    this.logger.info({ attempt: n + 1 }, "Outside link opened");
+                    return;
+                }
+                if (outcome === "busy" && this.outsideLink())
+                    return; // already open (ours)
+                if (this.shuttingDown || !this.outsideOn())
+                    return;
+                if (n + 1 < delays.length) {
+                    this.outsideAttempt = outsideTimer(() => attempt(n + 1), delays[n + 1]);
+                    return;
+                }
+                this.logger.warn({ attempts: n + 1 }, "Outside link could not be opened; giving up until the next start or switch");
+                this.recordWebNotice("fleet", t("outside.notice_ended", t("outside.reason_failed")));
+            });
+        };
+        this.outsideAttempt = outsideTimer(() => attempt(0), delays[0] ?? 0);
+    }
+    closeOutsideLink(reason) {
+        this.outsideAttempt?.cancel();
+        this.outsideAttempt = null;
+        const open = this.publicWebLink?.openSignin();
+        if (this.publicWebLink && (!open || isOutsideLinkOwner(open.owner)))
+            void this.publicWebLink.close(reason);
+        this.endOutsideSessions();
+    }
+    /** PublicWebLink.onClose for the outside link: what closed it decides what happens next (#3008 B). */
+    outsideLinkClosed(reason) {
+        if (this.shuttingDown || OUTSIDE_OWN_CLOSES.has(reason) || !this.outsideOn())
+            return;
+        // #3008 review (Prism P2 3): expiry first — its lifetime counts from the opening request, so it can run out while the
+        // opening is still under way: the switch goes off then too, and that attempt's end (outsideOn false) retries nothing.
+        if (reason === "expired") {
+            // Its lifetime ran out: the switch goes off (only this computer turns it on again — a session from outside can't).
+            this.outsideAttempt?.cancel();
+            this.outsideAttempt = null;
+            if (this.webRemoteAccess()?.setOutside(false) === "unsaved")
+                this.logger.warn("Outside link expired; the switch's Off could not be saved yet (retried)");
+            this.endOutsideSessions();
+            this.logger.info("Outside link expired; connections from outside off");
+            this.recordWebNotice("fleet", t("outside.notice_ended", t("outside.reason_expired")));
+            return;
+        }
+        if (this.outsideOpening)
+            return; // that attempt's own failure: its retry
+        // Dropped (the tunnel exited, the gateway failed, the configuration changed): reopened up to twice.
+        this.logger.info({ reason }, "Outside link closed; reopening");
+        this.openOutsideLink(OUTSIDE_LINK_RETRY_MS);
+    }
+    /**
+     * #3008 (auth-api POST /auth/totp): a sign-in through the outside link with the authenticator's code. "ok": the caller
+     * makes the session (SessionRecord.remote) and then calls authorizeOutsideSession. Each wrong code counts; a wait that
+     * starts is a Notice; a code that matches a step just outside the window logs how far this clock seems to be off.
+     */
+    outsideSignIn(exposureId, code) {
+        const link = this.outsideLink(), store = this.webRemoteAccess();
+        if (!link || !store || !exposureId || link.exposureId !== exposureId)
+            return { kind: "closed" };
+        const v = store.verify(code);
+        if (v.kind === "ok")
+            return { kind: "ok" };
+        if (v.kind === "paused")
+            return v;
+        if (v.kind === "not_enrolled")
+            return { kind: "closed" };
+        if (v.kind === "unavailable")
+            return v;
+        if (v.skewSteps !== null)
+            this.logger.warn({ offsetSeconds: v.skewSteps * TOTP_STEP_SECONDS }, "A wrong authenticator code matched a nearby time step: this computer's clock may be off");
+        if (v.paused) {
+            this.logger.warn({ waitMs: v.retryAfterMs }, "Sign-in from outside paused after wrong codes");
+            this.recordWebNotice("fleet", t("outside.notice_paused", outsideDuration(v.retryAfterMs), v.wrong));
+            return { kind: "paused", retryAfterMs: v.retryAfterMs };
+        }
+        return { kind: "wrong" };
+    }
+    /**
+     * #3008: a session just made by outsideSignIn's "ok" is this computer's admin for its authorization's life. False: it
+     * could not be admitted (its handle not saved, #3015 review r3) — the caller ends it.
+     */
+    authorizeOutsideSession(session, peer, label) {
+        const store = this.sessionAuthorizationStore(), link = this.outsideLink();
+        if (!store || session.remote !== "totp" || session.owner || !link || session.exposureId !== link.exposureId)
+            return false;
+        if (!this.webRemoteAccess()?.admit(session.handle)) {
+            this.logger.warn({ handle: session.handle }, "Session from outside not admitted: it could not be saved");
+            return false;
+        }
+        const state = this.webAuthorityState(), now = Date.now(), policy = webAuthorityPolicy(this.fleetConfig?.web);
+        const check = evaluateWebAuthority({
+            session, gateway: true, peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            isAdmin: () => false,
+            authorization: { handle: session.handle, owner: HOST_OPERATOR, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch },
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink, quickLink: state.quickLink }, epoch: state.epoch, now,
+            hostOperator: true, outside: link,
+        });
+        if (check.refusal) {
+            this.logger.info({ handle: session.handle, refusal: check.refusal }, "Session from outside not authorized");
+            return false;
+        }
+        {
+            const live = new Set(this.webSessions?.list(undefined, () => true).map(r => r.handle) ?? []);
+            store.prune(a => a.epoch === state.epoch && now <= Math.min(a.until, a.authorizedAt + policy.maxSessionMs) && live.has(a.handle));
+            const { durable } = store.authorize(session.handle, HOST_OPERATOR, now, state.epoch, now + policy.maxSessionMs, peer);
+            this.logger.info({ handle: session.handle, durable }, "Session from outside authorized (this computer's admin)");
+        }
+        this.recordWebNotice("fleet", t("outside.notice_signed_in", label));
+        return true;
+    }
     authorityStateStore = null;
     /**
      * #1939 §10: the switch, "Only this computer can authorize" and the revocation epoch in force for the configuration as
@@ -15819,6 +17399,10 @@ export class FleetManager {
                     return true;
                 if (session.surface === "local")
                     return false;
+                // #3008 review (Prism P2 4): signed in from outside with the authenticator's code — its opt-in is the outside
+                // switch, not these options (the authority judges it so): it keeps its authorization.
+                if (session.remote === "totp")
+                    return false;
                 const peer = a.peer ?? "named_link";
                 return (!!state.namedLinkClosed && peer === "named_link") || (!!state.quickLinkClosed && peer === "quick_link");
             };
@@ -15968,7 +17552,7 @@ export class FleetManager {
             authorization: s?.owner ? { handle: s.handle, owner: s.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch } : null,
             policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink, quickLink: state.quickLink }, epoch: state.epoch, now,
             // #2910 D1: a host operator's session is never asked about (no account to ask): only a sign-in authorizes it.
-            hostOperator: this.isWebOnlyFleet(),
+            hostOperator: this.isWebOnlyFleet(), outside: this.outsideLink(),
         });
         return r.refusal;
     }
@@ -16834,6 +18418,8 @@ export class FleetManager {
         publication.retirePending = true;
     }
     async sendCancelButton(instanceName, correlationId, preserveProgress = false) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[instanceName]))
+            return;
         // Post first, retire after (see the tail of this method). Retiring up front
         // meant that from the delete until the new message came back — a chat API
         // round trip, and every reply goes through here — the instance had NO live
@@ -17366,6 +18952,14 @@ export class FleetManager {
     }
     /** Interrupt an instance's current generation (cancel button / /cancel). */
     cancelInstance(instanceName) {
+        if (isNativeExecInstance(this.fleetConfig?.instances[instanceName])) {
+            this.cancelPendingDeliveries(instanceName);
+            const cancelled = this.nativeInstanceRuntime().cancel(instanceName);
+            this.lastInboundMsg.delete(instanceName);
+            for (const message of this.webChatHistory.cancelPending(instanceName))
+                this.emitSseEvent("delivery", { instance: instanceName, messageId: message.messageId, delivery: message.delivery });
+            return cancelled !== null;
+        }
         const daemon = this.daemons.get(instanceName);
         if (!daemon)
             return false;
@@ -18583,36 +20177,7 @@ export class FleetManager {
         "antigravity": ".agents/AGENTS.md",
         "mock": "CLAUDE.md",
     };
-    static GENERAL_INSTRUCTIONS = `# Fleet Coordinator
-
-You are the fleet coordinator — the central entry point for this AgEnD fleet.
-You route tasks, manage instances, enforce policies, and synthesize results.
-Do NOT modify project files directly — delegate file changes to the project's instance.
-You CAN write code snippets, explain code, and answer technical questions directly.
-
-## Task Routing
-
-- **Handle directly**: no file/exec access needed, answerable from knowledge, ≤2 reasoning steps (Q&A, translation, status queries, code snippets).
-- **Delegate to 1 instance**: scoped to one project/repo, needs file access or execution.
-- **Coordinate multiple**: spans repos, outputs feed each other, or parallel helps (max 3 per task).
-
-Instance discovery: start with list_instances(); follow the guidance in its response. Prefer reuse; never duplicate a running instance.
-
-## Reply Contract
-
-Every final response to the user contains: the result (the actual answer or deliverable) and gaps (anything incomplete — omit if none). Summarize instance reports; omit internal coordination noise.
-
-## After Restart
-
-BEFORE processing any new messages: 1. list_instances() 2. list_teams() 3. list_decisions(). Only then handle requests.
-
-## Playbooks (on-demand skills)
-
-Detailed procedures live in your skills — consult them when the situation comes up rather than from memory:
-- **delegation-playbook** — delegation protocol, loop prevention, parallel vs sequential, result/failure handling, team management, instance configuration tips.
-- **development-workflow** — the fleet-wide code-change policy you enforce when delegating code tasks.
-Plus the operational skills (fleet-health, instance-lifecycle, scheduling, session-management, …).
-`;
+    static GENERAL_INSTRUCTIONS = GENERAL_ROLE_INSTRUCTIONS;
     /** Ensure the general instance has its project instructions file + knowledge */
     ensureGeneralInstructions(workDir, backendName, instanceName) {
         measureSyncWork("fleet.generalInstructions", () => this.ensureGeneralInstructionsSync(workDir, backendName, instanceName));
@@ -19634,6 +21199,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     : model,
         });
         const fleetInstance = this.fleetConfig?.instances[instanceName];
+        if (isWindowsInstance(fleetInstance))
+            return fleetInstance.model?.trim() ? done(fleetInstance.model.trim(), "instance") : done("default", "unresolved", "this CLI does not report a default");
         if (fleetInstance) {
             if (fleetInstance.model?.trim())
                 return done(fleetInstance.model.trim(), "instance");
@@ -19715,7 +21282,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (this.fleetConfig?.defaults?.backend)
             backends.add(this.fleetConfig.defaults.backend);
         for (const inst of Object.values(this.fleetConfig?.instances ?? {}))
-            if (inst.backend)
+            if (!isWindowsInstance(inst) && inst.backend)
                 backends.add(inst.backend);
         for (const ch of this.classicChannels?.getAll() ?? [])
             if (ch.backend)
@@ -19730,6 +21297,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // here; a ClassicBot room on a profile is probed on its first /model (catalogProfile knows rooms too).
         const profiles = new Set();
         for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+            if (isWindowsInstance(this.fleetConfig?.instances[name]))
+                continue;
             if (this.backendNameForInstance(name) !== "claude-code")
                 continue;
             const profile = this.catalogProfile("claude-code", name);
@@ -19750,6 +21319,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * instead of presenting an old list as a fresh one.
      */
     async getModelOptionsWithSource(instanceName, opts = {}) {
+        if (isWindowsInstance(this.fleetConfig?.instances[instanceName]))
+            return { models: (await this.listModelCatalog({ instanceName })).models, source: "cache" };
         const backendName = this.backendNameForInstance(instanceName);
         const profile = this.catalogProfile(backendName, instanceName);
         const cached = this.readCliEnv(backendName, profile);
@@ -19805,6 +21376,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      */
     async listModelCatalog(opts = {}) {
         const { instanceName } = opts;
+        if (instanceName && isWindowsInstance(this.fleetConfig?.instances[instanceName])) {
+            const config = this.fleetConfig.instances[instanceName], backend = config.backend ?? "codex";
+            // Detection is admin-owned. A read never launches a provider or falls back to this host's account.
+            let inventory = null;
+            try {
+                inventory = await this.runtimeWindowsExecutor().probe({ force: false, machineId: config.machine_id });
+            }
+            catch { /* offline remains unavailable */ }
+            const row = inventory?.clis.find(value => value.id === backend);
+            return { backend, scope: "instance", instance: instanceName, current_model: config.model || null,
+                models: (row?.models ?? []).map(value => ({ id: value.id, label: value.name ?? value.id, ...(value.description ? { description: value.description } : {}) })),
+                source: row?.models?.length ? "cache" : "fallback",
+                ...(inventory?.probedAt ? { probed_at: new Date(inventory.probedAt).toISOString() } : {}),
+                note: "Windows runtime's last detected inventory; no coordinator account or live probe is used." };
+        }
         if (instanceName) {
             const backend = this.backendNameForInstance(instanceName);
             const resolved = this.resolveInstanceModel(instanceName);
@@ -19840,6 +21426,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** Ask a backend for its catalog using ONE instance's real config. Never throws. */
     async instanceScopedModels(instanceName, backend) {
+        if (isWindowsInstance(this.fleetConfig?.instances[instanceName]))
+            return [];
         try {
             const inst = this.fleetConfig?.instances?.[instanceName];
             const instanceDir = this.getInstanceDir(instanceName);
@@ -20477,6 +22065,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** The instance's backend's effort metadata; agy's levels are its model's (#1825), the one the instance runs. */
     instanceEffortMetadata(instanceName) {
+        if (isWindowsInstance(this.fleetConfig?.instances[instanceName]))
+            return { strategy: "unsupported", levels: [] };
         const backend = this.backendNameForInstance(instanceName);
         let model = null;
         if (backend === "antigravity") {
@@ -20487,6 +22077,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** Configured effort for an instance: per-instance, else fleet default, else none. */
     resolveInstanceEffort(instanceName) {
+        if (isWindowsInstance(this.fleetConfig?.instances[instanceName]))
+            return { effort: null, source: "unset" };
         const own = this.fleetConfig?.instances[instanceName]?.effort;
         if (own)
             return { effort: own, source: "instance" };
@@ -20524,9 +22116,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * instance respawns.
      */
     async applyEffort(instanceName, requested, opts) {
-        // #1490 row 27: a menu's choice is for the lifecycle it was offered to — asked first and fenced into the restart.
+        // #1490 row 27 (main): a menu's choice is for the lifecycle it was offered to — asked first and fenced into the restart.
         if (opts?.current && !opts.current())
             return t("menu.instance_replaced", this.shownInstanceName(instanceName));
+        if (isWindowsInstance(this.fleetConfig?.instances[instanceName]))
+            return t("effort.unsupported", this.backendNameForInstance(instanceName));
         const level = requested.trim().toLowerCase();
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "unsupported";
@@ -20574,6 +22168,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (/[\x00-\x1f\x7f]/.test(model)) {
             return t("model.invalid_chars");
         }
+        const native = this.fleetConfig?.instances[instanceName];
+        if (isWindowsInstance(native)) {
+            if (!isNativePaneInstance(native))
+                return WINDOWS_CONFIG_REFUSED;
+            const catalog = await this.listModelCatalog({ instanceName });
+            if (!catalog.models.some(row => row.id === model))
+                return t("model.unknown_name", model, catalog.models.map(row => row.id).join(", "));
+            const id = native.native_agent_id, machine = native.machine_id;
+            await this.updateNativePaneConfig(instanceName, { model }, () => {
+                const now = this.fleetConfig?.instances[instanceName];
+                return isNativePaneInstance(now) && now.native_agent_id === id && now.machine_id === machine;
+            });
+            return t("model.restart_success", instanceName, model);
+        }
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "restart";
         try {
@@ -20762,6 +22370,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * profile's, when it is named and has one), claude's account catalog included. Read only: never a probe.
      */
     modelCatalogFor(backend, instance) {
+        if (instance && isWindowsInstance(this.fleetConfig?.instances[instance]))
+            return [];
         if (!KNOWN_BACKENDS.includes(backend) || backend === "mock")
             return [];
         const own = instance && Object.prototype.hasOwnProperty.call(this.fleetConfig?.instances ?? {}, instance) ? instance
@@ -20775,6 +22385,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         return out;
     }
+    /** Host-default fallback only: Grok has no modeled profile home. Never construct a backend or start a probe. */
+    async cliModelCatalogFor(backend, instance) {
+        if (backend !== "grok")
+            return [];
+        const fleet = this.fleetConfig;
+        const configured = instance && Object.prototype.hasOwnProperty.call(fleet?.instances ?? {}, instance) ? fleet.instances[instance] : undefined;
+        const classic = this.classicChannels;
+        const room = instance && !configured ? classic?.getAll().find(channel => channel.instanceName === instance) : undefined;
+        if (instance && !configured && !room)
+            return [];
+        const daemon = room ? this.daemons.get(instance) : undefined;
+        const grokHome = process.env.GROK_HOME?.trim() || join(homedir(), ".grok");
+        const stillHostDefault = () => {
+            if (this.fleetConfig !== fleet || (process.env.GROK_HOME?.trim() || join(homedir(), ".grok")) !== grokHome)
+                return false;
+            if (configured && (isWindowsInstance(configured) || !Object.prototype.hasOwnProperty.call(fleet?.instances ?? {}, instance) || fleet.instances[instance] !== configured))
+                return false;
+            if (room && (this.classicChannels !== classic || classic?.getAll().find(channel => channel.instanceName === instance) !== room || this.daemons.get(instance) !== daemon))
+                return false;
+            // The ordinary profile helpers deliberately ignore Grok: it has no credential-home mapping yet.
+            // Check raw declarations, including invalid ones, rather than mistaking them for the host login.
+            const defaults = fleet?.defaults?.backend_options;
+            const profiles = configured
+                ? [configured.backend_options?.grok?.credential_profile, defaults?.grok?.credential_profile]
+                : room
+                    ? [mergeBackendOptions(defaults, room.backendOptions)?.grok?.credential_profile, daemon?.getConfigSnapshot?.().backend_options?.grok?.credential_profile]
+                    : [defaults?.grok?.credential_profile];
+            return profiles.every(profile => profile === undefined || profile === null || profile === "");
+        };
+        if (!stillHostDefault())
+            return [];
+        const models = await readGrokModelCache(grokHome);
+        return stillHostDefault() ? models : [];
+    }
     /**
      * #2072 (#2078 review): the snapshot as THIS instance would see it. Its sign-in on a backend is its own credential
      * profile's when it has one there — the host's default login says nothing about it. A profile's login is a file check
@@ -21433,6 +23077,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * settles, so a later genuine stop (after a restart) still does the work.
      */
     stopAll() {
+        this.lifecycle.cancelNativeRecovery?.();
+        this.nativeMcpStore?.closeAll();
+        this.runtimeExecutor?.close();
+        this.runtimeExecutor = null;
+        this.fleetWindowsRuntime = null;
+        this.runtimeHub?.close();
+        this.runtimeHub = null;
+        this.localPaneRelay?.stop();
+        this.localPaneRelay = null;
+        closeWindowsBridge(this);
         this.stopAllInFlight ??= this.doStopAll().finally(() => {
             // #1956: after the stop's own tmux work; anything later goes direct. A later startAll starts it again.
             if (this.tmuxExecHelperTimer) {
@@ -21511,6 +23165,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const settingsControlStopped = settingsControl?.close();
         this.publicLinkAutoOpen?.stop();
         const publicStopped = this.publicWebLink?.close("fleet shutdown");
+        this.webRemoteAccessState?.close(); // #3008: an unsaved switch gets its last write
         const sharesStopped = this.officeSharesInstance?.close(); // #2636: every Office share ends, and its tunnel
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
@@ -21893,6 +23548,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.savedFleetConfigSnapshot = previousSavedSnapshot;
             this.loadedFleetSource = previousSource;
             this.observeWebAuthority(); // #2453 review: the configuration back in force is the one seen
+            this.observeRuntimeSwitches(); // M-2255: and the Windows runtimes' switches
             this.logger.error({
                 oldCount,
                 newCount,
@@ -23528,7 +25184,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const topicMode = daemonTopicMode(fleet);
         const restartProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), restartStartedAt, this.logger);
         // Phase 1: generals first
-        const restartEntries = Object.entries(fleet.instances);
+        const restartEntries = Object.entries(fleet.instances).filter(([, config]) => !isNativeExecInstance(config));
         const restartGenerals = restartEntries.filter(([_, cfg]) => cfg.general_topic);
         const restartOthers = restartEntries.filter(([_, cfg]) => !cfg.general_topic);
         for (const [name, cfg] of restartGenerals) {
@@ -23982,6 +25638,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return;
             }
             const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
+            if (remoteRuntimeEnabled() && !gatewayRequestContext(req)
+                && this.runtimeCoordinator().handlePublicRequest(req, res, new URL(req.url ?? "/", `http://localhost:${port}`)))
+                return;
             // Branding is public, after Host admission: automatic favicon requests
             // must not become noisy web-token 401s in the browser console.
             // #2308: the icon routes and the pages' icon links follow the app icon set in Settings.
@@ -24008,7 +25667,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     if (decision.reason === "no-credential" && req.method === "GET"
                         && String(req.headers.accept ?? "").includes("text/html")
                         && isWebPageNavigation(requestPath)) {
-                        serveSigninPage(res, 401, { webOnly: this.isWebOnlyFleet() });
+                        const link = gatewayRequestContext(req);
+                        serveSigninPage(res, 401, { webOnly: this.isWebOnlyFleet(), outside: !!link && this.isOutsideLink(link.exposureId) });
                         return;
                     }
                     res.writeHead(decision.status);
@@ -24365,6 +26025,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (!this.webToken || !this.webSessions)
             this.initializeWebAuthTokens();
         const server = createServer((req, res) => this.dispatchWebHttp(req, res, port, drain.closing));
+        server.on("upgrade", (req, socket, head) => {
+            if (!this.shuttingDown && remoteRuntimeEnabled() && isHostAllowed(req.headers.host, allowedHostNames(this.fleetConfig))
+                && this.runtimeCoordinator().handleUpgrade(req, socket, head))
+                return;
+            socket.destroy();
+        });
         // #1937: Node's default (300 s to receive a request) would cut a large upload on a slow link. The listener allows
         // more; the upload route keeps its own clocks (no byte for a minute, or 30 minutes in all), and every other request
         // keeps the old 300 s (limitRequestReceive in dispatchWebHttp).
@@ -24589,9 +26255,36 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.debug({ err }, "bots unreadable (getUiStatus)");
         }
         const instances = names.map(name => {
+            const nativeConfig = this.fleetConfig?.instances[name];
+            if (isNativeExecInstance(nativeConfig)) {
+                let runtime = null;
+                let agent = null;
+                try {
+                    runtime = this.nativeInstanceRuntime();
+                    agent = runtime.get(name);
+                }
+                catch { /* A damaged native profile is a crashed native row, never a Linux spawn. */ }
+                const display_name = nativeConfig.display_name || agent?.name || name;
+                const backend = nativeConfig.backend || agent?.cli || "codex";
+                return { name, display_name, description: nativeConfig.description || undefined, tags: nativeConfig.tags || [],
+                    teams: instanceTeams(this.fleetConfig?.teams, name), runtime: "windows", native_agent_id: nativeConfig.native_agent_id,
+                    ...(nativeConfig.machine_id ? { machine_id: nativeConfig.machine_id, machine_name: this.runtimeHub?.machine(nativeConfig.machine_id)?.name,
+                        machine_status: this.runtimeHub?.machine(nativeConfig.machine_id)?.status ?? "offline" } : {}),
+                    native_blocked: !agent || agent.blocked === true,
+                    native_busy: runtime?.busy(name) ?? false,
+                    backend,
+                    model: nativeConfig.model || "default", model_source: nativeConfig.model ? "instance" : "cli-default",
+                    status: agent && runtime ? runtime.status(name) : "crashed", state: agent && runtime ? runtime.execution(name) : null, execution_state: agent && runtime ? runtime.execution(name) : null,
+                    interaction: null, interaction_summary: null, context_pct: null, cost: null,
+                    last_reply: this.webChatHistory.lastAgentReply(name) ?? undefined,
+                    avatar: avatarFor({ name, displayName: display_name }),
+                    capabilities: { chat: true, settings: true, pause: true, cancel: true, teams: true, schedules: true, delegation: true, mcp: nativeProviderMcpSupported(backend), channels: false, terminal: false, attachments: false, usage: false, send_while_busy: false },
+                    ...(!agent ? { runtime_error: "Windows profile is missing or invalid; restore its saved conversation before using this instance" }
+                        : agent.blocked ? { runtime_error: "Windows process outcome is unknown; verify it stopped before recovery" } : {}) };
+            }
             // #1956: read once for this instance; its cost, context and model come from it.
-            const statusline = readStatuslineJson(this.dataDir, name);
-            const cost = statusline?.cost?.total_cost_usd ?? 0;
+            const statusline = isNativePaneInstance(nativeConfig) ? undefined : readStatuslineJson(this.dataDir, name);
+            const cost = isNativePaneInstance(nativeConfig) ? null : statusline?.cost?.total_cost_usd ?? 0;
             // Align with /ctx: statusline for claude-code, pane scrape for kiro/grok/codex.
             const classic = classicOnly.includes(name);
             const backend = classic
@@ -24599,7 +26292,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 : (this.fleetConfig?.instances[name]?.backend
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
-            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name), statusline });
+            const { context } = isNativePaneInstance(nativeConfig) ? { context: null } : resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name), statusline });
             // context_pct: null when unavailable, not 0
             const context_pct = context ?? null;
             // Model: Only Claude Code has live statusline; others use the effective resolver.
@@ -24630,6 +26323,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             return {
                 name,
+                general_topic: nativeConfig?.general_topic === true,
+                ...(isNativePaneInstance(nativeConfig) ? { runtime: "windows", native_adapter: "pane", native_agent_id: nativeConfig.native_agent_id,
+                    ...(() => {
+                        try {
+                            const profile = this.nativeInstanceRuntime().get(name), bound = this.daemons.get(name);
+                            return { native_recovery: profile?.paneRecovery ?? (profile?.paneLaunchId && bound?.usesNativePane?.() && !bound.nativePaneCurrent()
+                                    ? { kind: "exit-unconfirmed", launchId: profile.paneLaunchId } : null) };
+                        }
+                        catch {
+                            return { native_recovery: null };
+                        }
+                    })(),
+                    capabilities: { chat: true, settings: true, pause: true, cancel: true, teams: true, schedules: true, delegation: true, mcp: true,
+                        commands: true, effort: false, log: true, details: true, channels: false, terminal: false, attachments: false, usage: false, send_while_busy: true },
+                    ...(nativeConfig.machine_id ? { machine_id: nativeConfig.machine_id, machine_name: this.runtimeHub?.machine(nativeConfig.machine_id)?.name,
+                        machine_status: this.runtimeHub?.machine(nativeConfig.machine_id)?.status ?? "offline" } : {}) } : {}),
                 display_name: identity.display_name || undefined,
                 avatar: image.avatar,
                 ...(image.accent ? { accent: image.accent } : {}),
@@ -24652,6 +26361,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 role: identity.role || undefined,
                 tags: identity.tags,
                 teams: instanceTeams(this.fleetConfig?.teams, name), // #2172: the sidebar groups a team's members under it
+                // #3008 G2: a web-only fleet's General (the agent its owner ticked) — the sidebar pins it first.
+                ...(this.isWebOnlyFleet() && this.fleetConfig?.instances[name]?.general_topic === true ? { general: true } : {}),
                 last_reply: this.webChatHistory.lastAgentReply(name) ?? undefined, // #2179: its last reply to a person (ISO)
                 // #2855: its last reply that reached the channel — the only reply time a guest's sidebar gets (guestStatus).
                 last_reply_channel: this.webChatHistory.lastAgentReply(name, { channel: true }) ?? undefined,
@@ -24681,6 +26392,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
             // #1519 P7: how many chat connections are configured — 0 is a web-only fleet, which gets the first-run card.
             connections: (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).length,
+            windows_cli: localWindowsCliEnabled(),
             // #1665: the host preferences' revision — a page that has another re-reads /ui/prefs (no values in this frame).
             prefs_rev: this.webPrefs.rev(),
             // #1629: the themes' revision — the page re-reads GET /ui/themes when it moves.
@@ -24690,6 +26402,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             host_memory: this.hostMemoryIndicator(),
             // #2910 D2: a web-only fleet's newest Notice — a polling page (no SSE `notice`) reads the list again when it moves.
             ...(this.webOnlyPromptPlace() ? { notices_newest: this.webNoticeStore()?.newest() ?? 0 } : {}),
+            // alpha.2 (M-2300, #2997 review): agents' requests changed — the owner's page reads GET /ui/agent-proposals again.
+            ...(this.isWebOnlyFleet() ? { agent_proposals_rev: this.agentProposalsRev } : {}),
             // #2015: the largest processes while it lasts (name, pid, RSS, and whose: an instance, the fleet or tmux).
             ...(this.hostMemoryIndicator() && this.memoryTop ? { host_memory_top: this.memoryTop.processes } : {}),
         };
@@ -25132,4 +26846,12 @@ load();
 </script>
 </body>
 </html>`;
+/** alpha.2 (M-2300): the agent an applied Windows request created (its name, for the page's "Open chat"), or null. */
+export function agentNameOf(view) {
+    const r = view.state === "applied" ? view.outcome?.result : null;
+    if (!r || typeof r !== "object")
+        return null;
+    const o = r, name = o.name ?? o.instance_name ?? (o.agent && typeof o.agent === "object" ? o.agent.name : undefined);
+    return typeof name === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name) ? name : null;
+}
 //# sourceMappingURL=fleet-manager.js.map