@songsid/agend 2.3.4-beta.8 → 2.3.4

package/dist/fleet-manager.js

@@ -3,6 +3,7 @@ import { listKiroV1Sessions, readKiroClassicLinks } from "./backend/kiro-identit
 import { readKiroV1SavedModel } from "./backend/kiro-retired-model.js";
 import { sharedKiroV2StoreLane } from "./backend/kiro-v2-store.js";
 import { SEPARATE_FEATURE_KEYS, hasLegacyOffice, normalizeOfficeStorage } from "./dashboard-permissions.js";
+import { maskSecrets } from "./log-steps.js";
 import { loginNoticeMode, normalizeNoticeDelivery, setNoticeMode } from "./notice-delivery.js";
 import { DEFAULT_REPLY_TRIGGERS } from "./reply-triggers.js";
 import { WorkingRecoveryCoordinator, WORKING_RECOVERY_KIND, buildWorkingRecoveryPrompt } from "./working-recovery.js";
@@ -75,6 +76,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, loadFleetConfigSource, loadRawFleetConfigSource, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG, autoGeneralInstanceConfig } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
+import { deletePlannedTopic, planInstanceTopicDelete, topicDestination, topicMustStay } from "./instance-topic-delete.js";
 import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes, findExecutableIn, resolveBackendBinary } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
@@ -90,6 +92,7 @@ import { formatFleetTime } from "./tz-utils.js";
 import { createAdapter } from "./channel/factory.js";
 import { isWebChannelEcho, WEB_ECHO_PREFIX } from "./web-channel-echo.js";
 import { TelegramAdapter } from "./channel/adapters/telegram.js";
+import { MissedOfflineStore } from "./missed-offline.js";
 import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
@@ -169,6 +172,7 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
 }
 import { handleWebRequest, webPeerOf, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
+import { viewHistory } from "./view-history.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WEB_ECHO_COPIES_MAX, WEB_MIRROR_TIMEOUT_MS, webReactionEmoji, webReactionProblem } from "./web-reactions.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
@@ -201,7 +205,7 @@ import { envFileKeys } from "./token-env-name.js";
 import { discordGeneralChannelId } from "./discord-general.js";
 import { parseEnvText } from "./env-file.js";
 import { isDisallowedIntentsError, isRejectedTokenError } from "./discord-permissions.js";
-import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
+import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, setCapacityLookup, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, checkAuthStatus, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
 import { runOnLoginShell } from "./login-shell.js";
@@ -232,6 +236,8 @@ import { remoteCardAction, remoteCardChoiceLabel, remoteCardOutcomeText, remoteC
 import { recentChatContext } from "./log-tail.js";
 import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
+import { AgentCredentials, agentCredentialPolicy } from "./agent-credentials.js";
+import { writeSecretFile } from "./secret-file.js";
 import { ConfigHistory, ConfigSyntaxError, configIssueText } from "./config-history.js";
 import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, inferClassicChannelType, isSelectableClassicBackend, readClassicLastActivityAt, readClassicRoomNames } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
@@ -290,7 +296,7 @@ import { PROVIDER_SECRET_SPECS, PUBLIC_TUNNEL_SECRET_SPEC, providerSecretSpec, p
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
 import { kiroHome } from "./backend/kiro-kas-store.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile, listConfiguredProfiles } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
@@ -306,6 +312,12 @@ import { BackendOutageTracker } from "./backend-outage.js";
 import { canUnlockAdvancedTips, DailyTipScheduler, selectTip, visibleTipLevels, } from "./tips.js";
 import { getTmuxSession } from "./config.js";
 import { OwnStatusMessages, discordMessageKey } from "./chat-log-ids.js";
+import { PROFILE_TIMELINE_FILE, PROFILE_UNRECORDED, recordProfileLaunch } from "./usage/profile-timeline.js";
+import { readQuotaHistory } from "./usage/quota-history.js";
+import { estimateCapacity } from "./usage/capacity.js";
+import { covered, hourSources } from "./usage-rollup.js";
+import { KEEP_DAYS } from "./cache-ledger.js";
+import { ratesFor } from "./cache-prices.js";
 // Closed migration cohort: these 11 names existed immediately before the first
 // managed-skill publisher (a1ac499f; parent e267e684). Never grow this set when
 // adding a bundled skill: its new name is not proof of old AgEnD ownership.
@@ -457,6 +469,8 @@ const INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
  * while anything real shows signs of life well before the old two minutes.
  */
 const PROGRESS_MIN_ELAPSED_MS = 30_000;
+/** M-2391: the threshold tick fires this long after it, never a millisecond before (timers can fire early). */
+const PROGRESS_THRESHOLD_MARGIN_MS = 50;
 /** How much of a tool summary the progress line will show before eliding. */
 const PROGRESS_ACTIVITY_MAX_CHARS = 48;
 /**
@@ -916,6 +930,7 @@ export class FleetManager {
     kiroMigrationRuns = new Map();
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
     needsYou = null;
+    missedOfflineStore = null;
     configHistory = null;
     configHistoryTimer = null;
     loadedFleetSource = null;
@@ -1031,6 +1046,9 @@ export class FleetManager {
     discordPresenceEagerPending = false;
     discordPresenceInFlight = null;
     static DISCORD_PRESENCE_REFRESH_MS = 15 * 60_000;
+    /** #3066 §1d: how often a fleet with no Discord bot reads the quota for its history (the user's choice: 30 min). */
+    static QUOTA_BACKGROUND_READ_MS = 30 * 60_000;
+    quotaReadTimer = null;
     /** Days of event/activity history to keep. */
     static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
@@ -2154,6 +2172,22 @@ export class FleetManager {
      * startup-only key at startup. See checkStartupSignatureConsistency(). */
     fleetSignatureMismatch = null;
     healthServerListening = false;
+    agentCredentialsCache;
+    get agentCredentials() {
+        return this.agentCredentialsCache ??= new AgentCredentials(name => agentCredentialPolicy(this.fleetConfig, name, this.isClassicInstance(name)), name => {
+            try {
+                const token = randomBytes(32).toString("hex");
+                const result = writeSecretFile(join(this.getInstanceDir(name), "agent.token"), token);
+                if (!result.ok)
+                    this.logger.error({ name, mode: result.mode, reason: result.reason }, "Agent token file is not owner-only");
+                return token;
+            }
+            catch {
+                this.logger.error({ name }, "Agent credential renewal failed; prior generation remains retired");
+                return null;
+            }
+        });
+    }
     constructor(dataDir) {
         this.dataDir = dataDir;
         FleetManager.signalTarget = this;
@@ -2176,6 +2210,7 @@ export class FleetManager {
         this.topicCommands = new TopicCommands(this);
         this.topicArchiver = new TopicArchiver(this);
         this.statuslineWatcher = new StatuslineWatcher(this);
+        this.missedOfflineStore = new MissedOfflineStore(this.dataDir);
     }
     /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
     replyButtonsCtl = null;
@@ -2534,6 +2569,10 @@ export class FleetManager {
         const daemon = this.daemons.get(name);
         if (daemon?.bootId === daemonBootId)
             this.listenForWorkingState(name, daemon);
+        // #3066 §1d: a Codex launch records the credential profile it runs under, so its usage is told by account.
+        if (daemon?.bootId === daemonBootId && this.backendNameOf(name) === "codex") {
+            void recordProfileLaunch(join(this.getInstanceDir(name), PROFILE_TIMELINE_FILE), this.credentialProfileOf(name, "codex") ?? "default");
+        }
         // #2802: no post-restart notices. The outbox still delivers or fails a row accepted before the restart, and an open
         // request is reminded by the ordinary turn-ended nudge (sweepReplyObligations) once the owner is idle.
         this.scheduleDeliveryOutboxPump();
@@ -3371,6 +3410,7 @@ export class FleetManager {
      * guild channel.
      */
     reregisterClassicChannels() {
+        this.agentCredentialsCache?.observePolicies();
         if (!this.classicChannels)
             return;
         const channels = this.classicChannels.getAll();
@@ -4061,6 +4101,13 @@ export class FleetManager {
             changed: () => this.emitSseEvent("status", this.getUiStatus()),
         });
     }
+    /**
+     * Claude history in the View: an instance's earlier conversation for its View, from the transcript the Log reads —
+     * the View's route applied its own access rules first (view-api.ts); the Log's switch plays no part.
+     */
+    viewHistory(name, q) {
+        return viewHistory((n, rq) => this.log.readBack(n, rq), name, q);
+    }
     /** #1218: GET /ui/steps — an instance's steps, read on demand (null: no such instance). */
     logSteps(name, q) { return this.log.steps(name, q); }
     /**
@@ -8591,6 +8638,9 @@ export class FleetManager {
         if (others.length > 0 || classicAtBoot.length > 0) {
             await this.startInstancesWithConcurrency(others, topicMode, () => startupProgress.markReady(), classicAtBoot);
         }
+        // #3066 §1d (Fable r1): on every fleet — a web-only one (#2910) has no chat connection at all, and is the clearest
+        // case with no Discord bot reading. Each tick decides for itself whether to read (backgroundQuotaRead).
+        this.startQuotaBackgroundReads();
         if (topicMode && (fleet.channel || fleet.channels?.length)) {
             await adapterStartup;
             this.startDiscordUsagePresence();
@@ -8762,6 +8812,178 @@ export class FleetManager {
             this.logger.warn({ health }, "Fleet started with problems — see /health");
         }
     }
+    /**
+     * #3066 §1d (the user: yes, every 30 min): the quota history (usage/quota-history.ts) records only the readings AgEnD
+     * makes. A Discord bot's presence refresh reads every 15 min; without one, nothing reads while nobody looks. So, with no
+     * Discord bot and while some account has a running agent, read every 30 min — the same cached read (its 5-minute TTL
+     * still bounds the vendor calls), recorded like any other.
+     */
+    startQuotaBackgroundReads() {
+        if (this.quotaReadTimer)
+            clearInterval(this.quotaReadTimer);
+        this.quotaReadTimer = setInterval(() => { void this.backgroundQuotaRead(); }, FleetManager.QUOTA_BACKGROUND_READ_MS);
+        this.quotaReadTimer.unref?.();
+        // #3066 §1: the measured capacity, published for the usage reads (get_usage, the page) — refreshed every 10 min.
+        setCapacityLookup((provider, metric) => this.capacityEstimates.get(`${provider}\u0000${metric}`) ?? null);
+        if (this.capacityTimer)
+            clearInterval(this.capacityTimer);
+        void this.refreshCapacity();
+        this.capacityTimer = setInterval(() => { void this.refreshCapacity(); }, FleetManager.CAPACITY_REFRESH_MS);
+        this.capacityTimer.unref?.();
+    }
+    /** #3066 §1: the latest estimates, by `provider\0metric` (what usage-api's lookup reads, synchronously). */
+    capacityEstimates = new Map();
+    capacityTimer = null;
+    static CAPACITY_REFRESH_MS = 10 * 60_000;
+    /**
+     * #3066 §1: estimate each account's weekly 100% from the quota history (§1d) and the usage ledger's hours — both read
+     * asynchronously, the arithmetic small (usage/capacity.ts). An account is its usage provider id ("claude",
+     * "claude:hsinlin", "codex:yanxianchen"): its hours are the ledger sources of that backend under that credential profile
+     * (Codex's "unrecorded" hours are no account's). A per-model weekly ("Sonnet (weekly)") counts only that model's tokens.
+     *
+     * Prism #3073: no estimate rather than a wrong one —
+     * - a window is measured only where the ledger has its hours: kept (31 days) and scanned (`days.coverage`) for every
+     *   instance of the account's backend, and every instance whose hours count for it; the quota history goes back 12 weeks;
+     * - a profile literally named "default", "unknown" or "unrecorded" (configured, on disk, or in the quota history) makes
+     *   those hours ambiguous: neither the host
+     *   account nor the named one is estimated (each would be credited the other's use, or lose its own);
+     * - only a metric the vendor marks per-model (`scope: "model"`) is filtered by model; another named weekly pool
+     *   ("Luna Reserve (weekly)", Antigravity pools) is no model name and is not estimated.
+     */
+    async refreshCapacity() {
+        try {
+            const readings = await readQuotaHistory();
+            const groups = new Map();
+            for (const r of readings) {
+                const k = `${r.provider}\u0000${r.metric}`;
+                (groups.get(k) ?? groups.set(k, []).get(k)).push(r);
+            }
+            if (!groups.size) {
+                this.capacityEstimates = new Map();
+                return 0;
+            }
+            const data = await this.cacheServiceFor().usageData();
+            const now = Date.now(), DAY = 24 * 3_600_000, HOUR = 3_600_000;
+            const keptFrom = now - KEEP_DAYS * DAY + HOUR; // the oldest hour still in every ledger (an hour of margin)
+            // Profiles whose names are also the ledger's own tags: their hours cannot be told from the host's / unattributed.
+            // Any trace of such a profile counts (Prism #3073 r2), not only today's config — a binding removed or switched
+            // leaves its hours in the ledger: configured now, its directory on this host, or its account in the quota history.
+            const RESERVED = new Set(["default", "unknown", PROFILE_UNRECORDED]);
+            const historyProviders = new Set(readings.map((r) => r.provider));
+            const reservedNamed = new Map();
+            const reservedFor = (backend) => {
+                const known = reservedNamed.get(backend);
+                if (known)
+                    return known;
+                const found = new Set(listConfiguredProfiles(this.fleetConfig, backend).filter((n) => RESERVED.has(n)));
+                const base = usageProviderIdForBackend(backend);
+                for (const n of RESERVED) {
+                    if (base && historyProviders.has(`${base}:${n}`))
+                        found.add(n);
+                    if (credentialHomeSpec(backend) && existsSync(credentialProfileHome(this.dataDir, backend, n)))
+                        found.add(n);
+                }
+                return reservedNamed.set(backend, found).get(backend);
+            };
+            // Every instance of a backend may have used any of its accounts (bindings change): an account is measured only
+            // where all of them were scanned (Prism #3073 r2) — one still waiting for its first scan has no hours yet, not none.
+            const daysOfBase = new Map();
+            for (const inst of data.instances) {
+                const base = usageProviderIdForBackend(inst.inst.backend);
+                if (base)
+                    (daysOfBase.get(base) ?? daysOfBase.set(base, []).get(base)).push(inst.days);
+            }
+            // provider id → hour → model key → totals; and the instances whose hours count for it (their scan coverage).
+            const byProvider = new Map();
+            const daysOf = new Map();
+            for (const inst of data.instances) {
+                for (const [hk, hour] of Object.entries(inst.ledger.hours)) {
+                    for (const src of hourSources(hour)) {
+                        const base = usageProviderIdForBackend(src.backend);
+                        if (!base)
+                            continue;
+                        // Ambiguous (a named profile with the tag's name), or no account's: counted for no one, so an account whose
+                        // hours these may be has none — and gets no estimate, never a low one.
+                        if (reservedFor(src.backend).has(src.profile) || src.profile === "unknown" || src.profile === PROFILE_UNRECORDED)
+                            continue;
+                        const provider = src.profile === "default" ? base : `${base}:${src.profile}`;
+                        const list = daysOf.get(provider) ?? daysOf.set(provider, []).get(provider);
+                        if (!list.includes(inst.days))
+                            list.push(inst.days);
+                        const hours = byProvider.get(provider) ?? byProvider.set(provider, new Map()).get(provider);
+                        const into = hours.get(Number(hk)) ?? hours.set(Number(hk), Object.create(null)).get(Number(hk));
+                        for (const [mk, tot] of Object.entries(src.m)) {
+                            const cur = into[mk] ??= [0, 0, 0, 0, 0, 0, 0];
+                            for (let i = 0; i < 7; i++)
+                                cur[i] = (cur[i] ?? 0) + (tot[i] ?? 0);
+                        }
+                    }
+                }
+            }
+            const next = new Map();
+            for (const [key, list] of groups) {
+                const [provider, metric] = key.split("\u0000");
+                // A per-model weekly ("Sonnet (weekly)", the vendor's scope "model"): that model's tokens only. Another named
+                // pool is not a model: no estimate. "Weekly", "Weekly limit": everything.
+                const named = /^(.+) \((?:weekly|monthly|\d+d)\)$/i.exec(metric)?.[1]?.toLowerCase() ?? null;
+                const perModel = list.some((r) => r.scope === "model");
+                if (named && !perModel)
+                    continue;
+                const hours = [];
+                for (const [hour, models] of byProvider.get(provider) ?? []) {
+                    let api = 0, output = 0, all = 0;
+                    for (const [mk, tot] of Object.entries(models)) {
+                        const bar = mk.lastIndexOf("|"), model = mk.slice(0, bar), long = mk.slice(bar + 1) === "1";
+                        if (named && !model.toLowerCase().includes(named))
+                            continue;
+                        const [, uncached, read, w5, w1h, w, out] = tot;
+                        const r = ratesFor(model, long ? Number.MAX_SAFE_INTEGER : 0);
+                        api = api === null || !r ? null : api + (uncached * r.input + read * r.read + w5 * r.write5m + w1h * r.write1h + w * r.write + out * r.output) / 1_000_000;
+                        output += out;
+                        all += uncached + read + w5 + w1h + w + out;
+                    }
+                    if (all > 0)
+                        hours.push({ hour, api, output, all });
+                }
+                const base = provider.split(":")[0];
+                const scanned = [...new Set([...(daysOf.get(provider) ?? []), ...(daysOfBase.get(base) ?? [])])];
+                const available = (from, to) => {
+                    if (from < keptFrom || !scanned.length)
+                        return false;
+                    for (let h = from; h <= to; h += HOUR)
+                        if (!scanned.every((d) => covered(d, h)))
+                            return false;
+                    return true;
+                };
+                const est = estimateCapacity(list, hours, available);
+                if (est)
+                    next.set(key, est);
+            }
+            this.capacityEstimates = next;
+            return next.size;
+        }
+        catch (err) {
+            this.logger.debug({ err }, "capacity estimate refresh failed");
+            return -1;
+        }
+    }
+    /** One background quota read, when nothing else reads (no Discord bot) and an account has a running agent. */
+    async backgroundQuotaRead() {
+        if (this.shuttingDown)
+            return false;
+        if ([...this.adapters.values()].some(a => a.type === "discord" && typeof a.setActivity === "function"))
+            return false;
+        const active = this.getActiveUsageProviderIds();
+        if (active.size === 0)
+            return false;
+        try {
+            await getUsageSnapshot(false, active);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     /** Keep Discord profile activity aligned with the same cached usage source as /usage. */
     startDiscordUsagePresence() {
         if (this.discordPresenceTimer)
@@ -9237,6 +9459,11 @@ export class FleetManager {
         adapter.on("callback_query", safeHandler(async (data) => {
             await this.receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter);
         }, this.logger, "adapter.callback_query"));
+        adapter.on("missed_offline", (ev) => {
+            if (!isCurrentAdapter())
+                return;
+            this.recordMissedOffline(ev);
+        });
         this.bindTopicClosedHandler(adapter, adapterId, "adapter.topic_closed");
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
         adapter.on("slash_command", safeHandler(async (data) => {
@@ -9390,6 +9617,11 @@ export class FleetManager {
         adapter.on("callback_query", safeHandler(async (data) => {
             await this.receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter);
         }, this.logger, `adapter[${adapterId}].callback_query`));
+        adapter.on("missed_offline", (ev) => {
+            if (!isCurrentAdapter())
+                return;
+            this.recordMissedOffline(ev);
+        });
         this.bindTopicClosedHandler(adapter, adapterId, `adapter[${adapterId}].topic_closed`);
         // Slash commands: classic bot + admin commands
         adapter.on("slash_command", safeHandler(async (data) => {
@@ -10126,6 +10358,34 @@ export class FleetManager {
         }
         return true;
     }
+    /** File a Telegram update that was too old to inject; Needs you lists it until Acknowledge. */
+    recordMissedOffline(ev) {
+        if (!this.missedOfflineStore)
+            this.missedOfflineStore = new MissedOfflineStore(this.dataDir);
+        const stub = {
+            source: "telegram", adapterId: ev.adapterId, chatId: ev.chatId, threadId: ev.threadId,
+            messageId: ev.messageId, userId: ev.userId, username: ev.username, text: ev.preview,
+            timestamp: ev.timestamp, isBotMessage: false,
+        };
+        const threadId = this.inboundRouteThreadId(stub);
+        const target = threadId ? this.resolveInboundTarget(stub, threadId) : undefined;
+        let instance = target?.name ?? "";
+        if (!instance) {
+            instance = Object.entries(this.fleetConfig?.instances ?? {}).find(([name, cfg]) => cfg.general_topic && this.getInstanceAdapterId(name) === ev.adapterId)?.[0] ?? "";
+        }
+        const place = [ev.chatTitle, ev.threadId ? `#${ev.threadId}` : ""].filter(Boolean).join(" · ") || ev.chatId;
+        this.missedOfflineStore.add({
+            id: `missed:${ev.adapterId}:${ev.updateId}`,
+            adapterId: ev.adapterId,
+            instance,
+            username: ev.username,
+            place,
+            preview: ev.preview,
+            since: ev.timestamp.getTime(),
+        });
+        this.logger.info({ adapterId: ev.adapterId, updateId: ev.updateId, instance, chatId: ev.chatId, threadId: ev.threadId }, "Telegram message missed while AgEnD was offline — filed for Needs you");
+        this.needsYou?.poke();
+    }
     /**
      * #1085: coincident topic numbers must not route across Telegram groups.
      */
@@ -11749,6 +12009,11 @@ export class FleetManager {
             let result;
             switch (msg.type) {
                 case "fleet_decision_create": {
+                    const supersedes = this.decisionSupersedes("ipc-typed", instanceName, payload.supersedes);
+                    if ("error" in supersedes) {
+                        ipc.send({ type: "fleet_decision_response", fleetRequestId, error: supersedes.error });
+                        return;
+                    }
                     // Prune expired decisions on create
                     db.pruneExpiredDecisions();
                     result = db.createDecision({
@@ -11759,7 +12024,7 @@ export class FleetManager {
                         tags: payload.tags,
                         ttl_days: payload.ttl_days,
                         created_by: instanceName,
-                        supersedes: payload.supersedes,
+                        supersedes: supersedes.id,
                     });
                     break;
                 }
@@ -11936,6 +12201,21 @@ export class FleetManager {
                 return "ok";
         }
     }
+    /**
+     * `post_decision` with `supersedes` changes a decision someone else may have recorded (it stops being active): the
+     * same permission as `update_decision`, asked through the same live check (tool set + dashboard switches), on both
+     * create paths. An empty or absent value supersedes nothing and needs nothing; anything else must be an id.
+     */
+    decisionSupersedes(sink, instanceName, value) {
+        if (value === undefined || value === null || value === "")
+            return { id: undefined };
+        if (typeof value !== "string")
+            return { error: "supersedes must be a decision id" };
+        const permitted = this.checkToolPermission(sink, instanceName, "update_decision");
+        if (!permitted.allowed)
+            return { error: `Superseding a decision needs update_decision. ${permitted.message}` };
+        return { id: value };
+    }
     async handleDecisionCrudHttp(instance, op, args) {
         if (!this.scheduler)
             return { error: "Scheduler not available" };
@@ -11951,16 +12231,24 @@ export class FleetManager {
                 if (!title || !content)
                     return { error: "title and content are required" };
                 const scope = args.scope === "fleet" ? "fleet" : "project";
-                return db.createDecision({
-                    project_root: projectRoot,
-                    scope,
-                    title,
-                    content,
-                    tags: asStrArr(args.tags),
-                    ttl_days: asNum(args.ttl_days),
-                    supersedes: asStr(args.supersedes),
-                    created_by: instance,
-                });
+                const supersedes = this.decisionSupersedes("agent-endpoint", instance, args.supersedes);
+                if ("error" in supersedes)
+                    return { error: supersedes.error };
+                try {
+                    return db.createDecision({
+                        project_root: projectRoot,
+                        scope,
+                        title,
+                        content,
+                        tags: asStrArr(args.tags),
+                        ttl_days: asNum(args.ttl_days),
+                        supersedes: supersedes.id,
+                        created_by: instance,
+                    });
+                }
+                catch (err) {
+                    return { error: err.message }; // a refused predecessor: nothing was inserted
+                }
             }
             // #2152: titles by default (agend-agent decision-list); one decision's full text by id (decision-get <id>).
             // The CLI sends include_archived (snake case, as the MCP tool): both spellings are read.
@@ -12249,16 +12537,89 @@ export class FleetManager {
         }
         return adapter.createTopic(topicName);
     }
-    async deleteForumTopic(topicId, adapterId) {
-        try {
-            const adapter = (adapterId ? this.worlds.get(adapterId)?.adapter : undefined) ?? this.adapter;
-            if (!adapter?.deleteTopic)
-                return;
-            await adapter.deleteTopic(topicId);
-        }
-        catch (err) {
-            this.logger.warn({ err, topicId }, "Failed to delete forum topic during rollback");
-        }
+    /**
+     * Delete an agent and, unless asked not to, its own chat topic (user decision: by default). The topic is planned
+     * before the removal (its id and bot go with the fleet.yaml entry) and deleted through the agent's OWN bot after it;
+     * the outcome is the platform's answer (instance-topic-delete.ts). A topic that cannot go never fails the removal.
+     */
+    async removeInstanceAndTopic(name, authorization, opts) {
+        const plan = opts.deleteTopic ? this.planInstanceTopicDelete(name) : null;
+        if (opts.execution)
+            await this.removeInstance(name, authorization, opts.execution);
+        else
+            await this.removeInstance(name, authorization);
+        // #3055 review (Prism P1): asked again right before the platform call — the fleet as it is NOW, not as planned
+        // before the removal was awaited (a new owner of the topic, or the bot rebuilt).
+        return deletePlannedTopic(plan, this.logger, (p) => {
+            if (this.instanceTopicAdapter(p.adapterId) !== p.adapter)
+                return "the agent's bot changed while it was being deleted, so its topic was left";
+            return topicMustStay(p.destination, this.topicOwnership(), null); // the original is gone: every owner now counts
+        }, { begin: (d) => this.topicDeletionsInFlight.add(d), end: (d) => this.topicDeletionsInFlight.delete(d) });
+    }
+    /** #3055: destinations whose platform deletion is running now; a binding to one waits until it is over. */
+    topicDeletionsInFlight = new Set();
+    /** True while a topic with this id is being deleted on any connection (a new binding of it is refused meanwhile). */
+    isTopicDeletionInFlight(topicId) {
+        const tail = `:${topicId}`;
+        return [...this.topicDeletionsInFlight].some(d => d.endsWith(tail));
+    }
+    /**
+     * #3055 review r2 (Prism P1-3): would this instance config bind a topic whose deletion is running now? Compared by
+     * physical destination, so the same thread number in another Telegram group is not held. Settings asks it at commit.
+     */
+    topicBindingInFlight(inst) {
+        if (this.topicDeletionsInFlight.size === 0 || inst.topic_id == null || inst.topic_id === "")
+            return false;
+        const adapterId = typeof inst.channel_id === "string" && inst.channel_id ? inst.channel_id : this.getPrimaryAdapterId();
+        return this.topicDeletionsInFlight.has(this.destinationFor(adapterId, inst.topic_id));
+    }
+    /** Any topic deletion running now (a connection's group or General may not be re-pointed meanwhile). */
+    topicDeletionPending() { return this.topicDeletionsInFlight.size > 0; }
+    /** The physical destination of `topicId` on the bot `adapterId`. */
+    destinationFor(adapterId, topicId) {
+        const world = adapterId ? this.worlds.get(adapterId) : undefined;
+        const platform = world?.adapter?.type ?? this.getChannelConfig(adapterId)?.type;
+        const groupId = world?.groupId ?? String(this.getChannelConfig(adapterId)?.group_id ?? "");
+        return topicDestination(platform, groupId, adapterId, topicId);
+    }
+    /** The adapter of the bot `adapterId` names — never a substitute for a bot that is not there. */
+    instanceTopicAdapter(adapterId) {
+        return (adapterId ? this.worlds.get(adapterId)?.adapter : this.worlds.size === 0 ? this.adapter ?? undefined : undefined) ?? undefined;
+    }
+    /**
+     * Topic ownership by physical destination (#3055 review, Prism P1): an instance's topic is where its bot's platform
+     * puts it (a Telegram group + thread, a Discord channel), so two bots in one group, or two instances on one
+     * channel, are seen to share it; and every connection's own General is protected, with or without a General agent.
+     */
+    topicOwnership() {
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const destinationOf = (n) => {
+            const cfg = this.fleetConfig?.instances?.[n];
+            if (!cfg || cfg.topic_id == null || cfg.topic_id === "")
+                return null;
+            return this.destinationFor(this.getInstanceAdapterId(n), cfg.topic_id);
+        };
+        const generalDestinations = () => {
+            const out = new Set();
+            for (const ch of channels) {
+                const id = ch.id ?? ch.type;
+                const groupId = this.worlds.get(id)?.groupId ?? (ch.group_id != null ? String(ch.group_id) : undefined);
+                if (ch.type === "telegram")
+                    out.add(topicDestination("telegram", groupId, id, 1));
+                if (ch.type === "discord") {
+                    const gcid = discordGeneralChannelId(ch);
+                    if (gcid)
+                        out.add(topicDestination("discord", groupId, id, gcid));
+                }
+            }
+            return out;
+        };
+        return { instances: this.fleetConfig?.instances, destinationOf, generalDestinations };
+    }
+    /** What deleting `name`'s topic would act on: its own bot only — a bot that is not there is never substituted. */
+    planInstanceTopicDelete(name) {
+        const adapterId = this.getInstanceAdapterId(name);
+        return planInstanceTopicDelete({ name, adapterId, adapter: this.instanceTopicAdapter(adapterId), ...this.topicOwnership() });
     }
     getForumTopicDeleter(adapterId) {
         const adapter = (adapterId ? this.worlds.get(adapterId)?.adapter : undefined) ?? this.adapter;
@@ -12659,6 +13020,7 @@ export class FleetManager {
             Object.assign(current, resolved);
         }
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        this.agentCredentialsCache?.observePolicies();
         this.refreshSavedDashboardPermissions();
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
     }
@@ -14976,6 +15338,7 @@ export class FleetManager {
         const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
             name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(name), profile: this.usageProfileOf(name, this.backendNameOf(name)),
+            ...(this.backendNameOf(name) === "codex" ? { profileTimelinePath: join(this.getInstanceDir(name), PROFILE_TIMELINE_FILE) } : {}),
             kiroDbPath: this.kiroDbPathOf(name, this.backendNameOf(name)),
         }));
         const taken = new Set(fleet.map(i => i.name));
@@ -14987,6 +15350,9 @@ export class FleetManager {
             claudeConfigDir: this.claudeConfigDirOf(ch.instanceName),
             profile: this.usageProfileOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
             kiroDbPath: this.kiroDbPathOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
+            // #3066 §1d (Fable r1 #2): a ClassicBot Codex room records its launches too (onDaemonReady) — read them the same way.
+            ...((this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend) === "codex"
+                ? { profileTimelinePath: join(this.getInstanceDir(ch.instanceName), PROFILE_TIMELINE_FILE) } : {}),
         }));
         return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
     }
@@ -15224,6 +15590,10 @@ export class FleetManager {
                     throw new Error("the delivery outbox is not open");
                 return this.deliveryOutbox.acknowledge(deliveryId, by);
             },
+            missedOffline: () => (this.missedOfflineStore?.list(Date.now()) ?? []).map(m => ({
+                id: m.id, instance: m.instance, owner: m.adapterId, username: m.username, place: m.place, preview: m.preview, since: m.since,
+            })),
+            acknowledgeMissed: (id, by) => this.missedOfflineStore?.acknowledge(id, by) ?? false,
             tasks: () => this.needsYouTaskItems(),
             backendSignIns: () => this.needsYouBackendSignIns(),
             configIssues: () => (this.configHistory?.currentIssues() ?? []).map(issue => ({
@@ -15938,8 +16308,9 @@ export class FleetManager {
                 return r.ok ? { ok: true, until: Math.min(r.authorization.until, record.absoluteExpiry) } : { ok: false, refusal: r.refusal };
             },
             signOut: (handle) => {
-                this.webSessions?.revokeByHandle(handle);
-                this.sessionAuthorizationStore()?.prune(a => a.handle !== handle);
+                const session = this.webSessions?.revokeByHandle(handle) ?? { found: false, durable: true };
+                const authorization = this.sessionAuthorizationStore()?.prune(a => a.handle !== handle) ?? { dropped: 0, durable: true };
+                return { durable: session.durable, authorizationDurable: authorization.durable };
             },
             event: (type, payload) => { try {
                 this.eventLog?.insert("web", type, payload);
@@ -15952,6 +16323,7 @@ export class FleetManager {
                 expired: (c) => t("web_auth.card_expired", c.label),
                 refused: (c) => t("web_auth.card_refused", c.label, t(`web_auth.refusal_${c.refusal}`)),
                 revoked: (c) => t("web_auth.card_revoked", c.label),
+                notSaved: (c) => t("web_auth.card_not_saved", c.label),
                 ended: (c) => t("web_auth.card_ended", c.label),
                 generalHint: () => t("web_auth.general_hint"),
                 confirmLabel: () => t("web_auth.confirm"),
@@ -16872,7 +17244,14 @@ export class FleetManager {
             return;
         }
         const publication = this.beginCancelButtonPublication(instanceName, correlationId);
-        const initialProgressText = FleetManager.progressText(0, null, 1, this.progressPrefixFor(instanceName, 0, 1));
+        // M-2391: a re-post below a reply (preserveProgress) continues the same turn — its elapsed time continues from
+        // the live bubble's start, as its tool list does. Restarting it at 0 meant an agent replying more often than the
+        // threshold never showed elapsed time at all. A fresh turn (no preserve) starts at 0 as before.
+        const carriedStart = preserveProgress ? this.liveButtonStart(instanceName) : undefined;
+        const carriedMs = carriedStart !== undefined ? Math.max(0, Date.now() - carriedStart) : 0;
+        const initialProgressText = carriedStart !== undefined && carriedMs >= this.progressMinElapsedMs()
+            ? FleetManager.progressText(carriedMs, null, this.progressMinElapsedMs(), this.progressPrefixFor(instanceName, carriedMs))
+            : FleetManager.progressText(0, null, 1, this.progressPrefixFor(instanceName, 0, 1));
         try {
             const sent = await adapter.notifyAlert(chatId, {
                 type: "cancel",
@@ -16895,7 +17274,7 @@ export class FleetManager {
                 // Elapsed time is measured from when this button was posted — i.e. from
                 // when the work was handed over — not from the pane's working transition,
                 // which resets if the CLI blips idle mid-turn.
-                startedAt: Date.now(),
+                startedAt: carriedStart ?? Date.now(),
                 // Matches the text notifyAlert just posted, so the first 60s tick does
                 // not re-edit identical text — which put a "(edited)" mark on Discord
                 // with nothing visibly changed.
@@ -17018,14 +17397,16 @@ export class FleetManager {
      * Make a tool summary safe to paste into a channel message.
      *
      * The text is agent-controlled (it is built from tool inputs — file paths,
-     * shell commands), so it gets flattened to one line, capped, and stripped of
-     * the two Discord mass-mention triggers. Neither channel renders it with a
-     * parse mode, so no markup escaping is needed beyond that.
+     * shell commands), so it gets flattened to one line, secrets masked, capped,
+     * and stripped of the two Discord mass-mention triggers. Masking comes BEFORE
+     * the cap: a cap can cut a mask's context but must never be what hides (or
+     * fails to hide) a secret. Neither channel renders it with a parse mode, so no
+     * markup escaping is needed beyond that.
      */
     static sanitizeActivity(activity) {
         if (!activity)
             return null;
-        const flat = activity.replace(/\s+/g, " ").replace(/@(everyone|here)/g, "@​$1").trim();
+        const flat = maskSecrets(activity.replace(/\s+/g, " ")).replace(/@(everyone|here)/g, "@​$1").trim();
         if (!flat)
             return null;
         return flat.length > PROGRESS_ACTIVITY_MAX_CHARS
@@ -17144,6 +17525,12 @@ export class FleetManager {
         }
         return PROGRESS_MIN_ELAPSED_MS;
     }
+    /** M-2391: when the instance's live (not retiring) bubble started — the current turn's start — or undefined. */
+    liveButtonStart(instanceName) {
+        const starts = [...this.cancelButtons.values()].filter((e) => e.instanceName === instanceName && !e.retiring && typeof e.startedAt === "number")
+            .map((e) => e.startedAt);
+        return starts.length ? Math.min(...starts) : undefined;
+    }
     startProgressTicker(entry) {
         const tick = () => this.refreshBubble(entry);
         entry.progressTimer = setInterval(tick, PROGRESS_UPDATE_INTERVAL_MS);
@@ -17153,7 +17540,9 @@ export class FleetManager {
         // one additional edit per turn that lives past the threshold.
         const firstAt = this.progressMinElapsedMs() - (Date.now() - (entry.startedAt ?? Date.now()));
         if (firstAt > 0 && firstAt < PROGRESS_UPDATE_INTERVAL_MS) {
-            const firstTick = setTimeout(tick, firstAt);
+            // M-2391: a little past the threshold — a timer can fire a millisecond before Date.now() reaches it, which
+            // rendered the unchanged "處理中…" text and skipped the edit until the next 60 s interval.
+            const firstTick = setTimeout(tick, firstAt + PROGRESS_THRESHOLD_MARGIN_MS);
             firstTick.unref?.();
         }
     }
@@ -21508,6 +21897,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // because we asked it to. Set synchronously — doStopAll runs to its first
         // await in the same tick as the signal handler, so no event can slip in.
         this.shuttingDown = true;
+        // Stop receive admission before the first await or any instance shutdown; outbound
+        // adapters remain available below to retire notices and pending prompts.
+        for (const state of this.adapterState.values()) {
+            if (state.retryTimer) {
+                clearTimeout(state.retryTimer);
+                state.retryTimer = undefined;
+            }
+        }
+        const inboundStopped = Promise.all([...this.adapters.values()].map(async (adapter) => {
+            try {
+                await adapter.stopReceiving?.();
+            }
+            catch (err) {
+                this.logger.warn({ adapterId: adapter.id, err }, "Adapter receive stop failed; inbound remains fenced");
+            }
+        }));
         this.workingRecovery?.reset();
         if (this.workingRecoveryTimer)
             clearInterval(this.workingRecoveryTimer);
@@ -21567,6 +21972,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // A login/install window is a dedicated tmux server with its own TTL
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).
+        await inboundStopped;
         await publicStopped;
         await sharesStopped?.catch(() => { });
         await profileStopped;
@@ -21577,13 +21983,6 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         await this.cpuProfileControl?.close();
         this.cpuProfileControl = null;
         await this.shutdownLoginWindows();
-        // Cancel adapter retry timers
-        for (const state of this.adapterState.values()) {
-            if (state.retryTimer) {
-                clearTimeout(state.retryTimer);
-                state.retryTimer = undefined;
-            }
-        }
         this.clearStatuslineWatchers();
         this.costGuard?.stop();
         this.dailySummary?.stop();
@@ -21621,6 +22020,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.discordPresenceTimer);
             this.discordPresenceTimer = null;
         }
+        if (this.quotaReadTimer) {
+            clearInterval(this.quotaReadTimer);
+            this.quotaReadTimer = null;
+        }
+        if (this.capacityTimer) {
+            clearInterval(this.capacityTimer);
+            this.capacityTimer = null;
+        }
+        setCapacityLookup(null);
         if (this.discordPresenceEagerTimer) {
             clearTimeout(this.discordPresenceEagerTimer);
             this.discordPresenceEagerTimer = null;
@@ -21925,6 +22333,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // mark every row done and tell the user "changes applied".
             return { rejected: why };
         }
+        this.agentCredentialsCache?.observePolicies();
         if (this.loadedFleetSource)
             this.getConfigHistory().accepted("fleet.yaml", this.configPath, this.loadedFleetSource);
         this.migrateOfficeStorage();
@@ -22825,6 +23234,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     async runConnectionBindingApply(job, binding, execution) {
         try {
+            // #3055 review r2: a connection is not re-pointed while one of its topics is being deleted (nothing is changed).
+            if (this.topicDeletionPending())
+                throw new Error("a topic deletion is running; try again in a moment");
             await this.rebuildAdapterForBinding(job.connectionId, binding, execution);
             job.result = "applied";
         }