@songsid/agend 2.3.5-alpha.2 → 2.3.5-alpha.4

package/dist/fleet-manager.js

@@ -1,7 +1,9 @@
+import { buildNativeFleetInstructions } from "./instructions.js";
+import { GENERAL_ROLE_INSTRUCTIONS } from "./general-role.js";
 import { NativePaneRecoveryError } from "./native-pane-recovery.js";
 import { nativePaneToolAvailable, nativePaneToolRefusal } from "./native-pane-tools.js";
 import { windowsAgentsFor } from "./windows-agents.js";
-import { buildFleetInstructions } from "./instructions.js";
+import { AgentRuntimeChanges } from "./agent-runtime-change.js";
 import { supportsVerifiedKiroMigration, getCachedKiroCliCompatibility, kiroV1DbPath, kiroV2SessionsDir } from "./backend/kiro.js";
 import { listKiroV1Sessions, readKiroClassicLinks } from "./backend/kiro-identity.js";
 import { readKiroV1SavedModel } from "./backend/kiro-retired-model.js";
@@ -18,6 +20,10 @@ import { settingsDisplay } from "./settings-change.js";
 import { SettingsConfirmationError, SettingsConfirmationStore, settingsSourceLabel } from "./settings-confirmation.js";
 import { SettingsHttpConfirmation } from "./settings-http-confirmation.js";
 import { SettingsControlServer } from "./settings-control.js";
+import { SettingsRouteLifetime } from "./settings-route-lifetime.js";
+import { GeneralManagedFileError } from "./runtime-general-protocol.js";
+import { GeneralBindings, generalBindingRevision, parseGeneralSwitchInput, switchGeneralLocation } from "./general-binding.js";
+import { confirmGeneralHostExit } from "./general-host-owner.js";
 import { settingsFingerprint, SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileResource, assertSettingsLease, trySettingsLease, waitSettingsLease, settingsUndo, undoSettingsPaths } from "./settings-transaction.js";
 import { performance } from "node:perf_hooks";
 import { withSpawnHoldReply } from "./spawn-hold-reply.js";
@@ -33,7 +39,7 @@ import { clearPublicLinkOwner, readPublicLinkOwner, writePublicLinkOwner } from
 import { PUBLIC_PREVIEW_FRAME_SRC, PUBLIC_PREVIEW_TUNNEL_DIR, PublicPreview, publicPreviewWanted } from "./public-preview.js";
 import { CloudflaredProvider } from "./tunnel/cloudflared.js";
 import { ensureCloudflared } from "./tunnel/cloudflared-install.js";
-import { unattendedInstallCommand } from "./unattended-install.js";
+import { unattendedInstallCommand, loginShell } from "./unattended-install.js";
 import { InstallStream } from "./install-stream.js";
 import { namedTestLane, runNamedLinkTest } from "./tunnel/named-link-test.js";
 import { daemonTopicMode, isWebOnlyFleetConfig } from "./web-only-fleet.js";
@@ -45,10 +51,10 @@ import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, lstatSync, constants as fsConstants, closeSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, realpathSync, lstatSync, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { freemem, totalmem, homedir } from "node:os";
+import { freemem, totalmem, homedir, hostname } from "node:os";
 import { effectiveCpuCount } from "./cpu-quota.js";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
@@ -62,6 +68,7 @@ import { applyKiroMigration, kiroMigrationPrompt, planKiroMigration } from "./ki
 import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, sameUpdateMarker, setUpdateProgressStage, updateMarkerIdentity, updateProgressOperation, updateReceiptOf, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
+import { startStallReporter } from "./stall-reporter.js";
 import { sdNotify, sdNotifyBlocking, setSdNotifyWarn, startSdWatchdog } from "./sd-notify.js";
 import { StartupMemoryDeadline, fleetStopConcurrency } from "./startup-memory-deadline.js";
 import { readFleetMemory } from "./process-memory.js";
@@ -80,7 +87,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, loadFleetConfigSource, loadRawFleetConfigSource, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG, autoGeneralInstanceConfig } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
-import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes, findExecutableIn, resolveBackendBinary } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -286,6 +293,7 @@ import { bypassesWebGate, handleAuthRequest, serveGuestRefusedPage, serveSigninP
 import { isWebPageNavigation } from "./web-shell-routes.js";
 import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
 import { WebNotices, WEB_NOTICES_FILE } from "./web-notices.js";
+import { isOutsideLinkOwner, OUTSIDE_LINK_OWNER, OUTSIDE_LINK_RETRY_MS, OUTSIDE_OWN_CLOSES, outsideDuration, outsideTimer, TOTP_STEP_SECONDS, WEB_REMOTE_ACCESS_FILE, WebRemoteAccess } from "./web-remote-access.js";
 import { authorityNow, evaluateWebAuthority, HOST_OPERATOR, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
 import { AuthorityStateStore } from "./authority/authority-state.js";
 import { SessionAuthorizations } from "./authority/session-authorizations.js";
@@ -645,6 +653,14 @@ function emojiListFilter(opts) {
 }
 /** #1920: a guest's scope until phase 2 derives one: nothing. */
 const NO_GUEST_SCOPE = new Set();
+/** #1490 row 27: a restart asked for one lifecycle of an instance after it was stopped, restarted or replaced. */
+export class RestartSupersededError extends Error {
+    /** `shown`: the instance as the chat list names it (shownInstanceName). */
+    constructor(shown) {
+        super(t("restart.superseded", shown));
+        this.name = "RestartSupersededError";
+    }
+}
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -762,11 +778,18 @@ export class FleetManager {
         return this.runtimeHub ??= new RuntimeCoordinator(this.dataDir, {
             handleMcp: (machineId, runId, body) => this.runtimeWindowsExecutor().mcp(machineId, runId, body),
             handlePaneMcp: async (machineId, body, current) => (await this.nativePanes()).handle(machineId, body, current),
+            warn: (fields, message) => this.logger.warn(fields, message),
             changed: event => {
                 if (event?.type === "machine" && this.runtimeHub?.machine(event.machineId)?.status !== "online") {
                     for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {}))
-                        if (config.machine_id === event.machineId)
+                        if (config.machine_id === event.machineId) {
                             this.nativeMcpStore?.closeInstance(name);
+                            if (config.general_topic) {
+                                this.cancelPendingDeliveries(name);
+                                this.holdGeneralOldDeliveries(name);
+                            }
+                        }
+                    this.needsYou?.poke();
                 }
                 if (this.runtimeStatusScheduled || this.shuttingDown)
                     return;
@@ -806,6 +829,8 @@ export class FleetManager {
             removed: name => this.nativeInstanceRemoved(name),
             paneCurrent: name => this.daemons.get(name)?.nativePaneCurrent?.() === true,
             machineAvailable: id => remoteRuntimeEnabled() && this.runtimeCoordinator().machine(id)?.status === "online",
+            machineGeneration: id => this.runtimeCoordinator().machine(id)?.bootId ?? null,
+            paneAvailable: id => this.runtimeCoordinator().machine(id)?.paneProtocol === 1,
             validateMachine: (id, cli, sandbox) => {
                 const machine = this.runtimeCoordinator().machine(id);
                 const provider = machine?.inventory?.clis.find(row => row.id === cli && row.runnable && row.supports.resume);
@@ -821,6 +846,152 @@ export class FleetManager {
             },
         }, { bridge: this.runtimeWindowsExecutor() });
     }
+    agentRuntimeChangeService;
+    agentRuntimeChanges() {
+        if (this.agentRuntimeChangeService)
+            return this.agentRuntimeChangeService;
+        const windowPins = new Map();
+        return this.agentRuntimeChangeService ??= new AgentRuntimeChanges({
+            config: name => Object.hasOwn(this.fleetConfig?.instances ?? {}, name) ? this.fleetConfig.instances[name] : undefined,
+            defaults: () => this.fleetConfig?.defaults,
+            generation: () => [this.managerBootId, this.settingsGeneration],
+            epoch: name => this.lifecycle.epochOf(name),
+            backendState: (name, backend) => !isWindowsInstance(this.fleetConfig?.instances[name]) ? this.backendAvailabilityFor(name).find(row => row.backend === backend)?.state : undefined,
+            transition: (name, run) => this.lifecycle.runTransition(name, async (transition) => {
+                const config = this.fleetConfig?.instances[name];
+                if (!isWindowsInstance(config)) {
+                    const path = join(this.getInstanceDir(name), "window-id");
+                    let pin;
+                    if (existsSync(path)) {
+                        if (statSync(path).size > 128)
+                            throw Error("Invalid saved CLI window identity");
+                        pin = readFileSync(path, "utf8").trim();
+                        if (!/^@\d+$/.test(pin))
+                            throw Error("Invalid saved CLI window identity");
+                    }
+                    else if (this.daemons.has(name))
+                        throw Error("The current CLI window identity is unavailable");
+                    windowPins.set(name, pin);
+                }
+                try {
+                    return await run(async () => {
+                        if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
+                            this.lifecycle.invalidate(name);
+                            this.nativeInstanceRuntime().setPaused(name, true);
+                        }
+                        else
+                            await this.stopInstance(name, transition);
+                    });
+                }
+                finally {
+                    windowPins.delete(name);
+                }
+            }),
+            idle: name => {
+                if (this.shuttingDown || this.lifecycle.hasWorkLease(name) || this.deliveryOutbox?.countForTarget(name, ["queued", "retry_wait", "delivering", "submission_started", "reconciliation_pending", "uncertain"]))
+                    return false;
+                const config = this.fleetConfig?.instances[name];
+                if (!config)
+                    return false;
+                if (isWindowsInstance(config)) {
+                    try {
+                        const agent = this.nativeInstanceRuntime().get(name);
+                        if (!agent || agent.blocked || agent.activeId && !isNativePaneInstance(config))
+                            return false;
+                    }
+                    catch {
+                        return false;
+                    }
+                }
+                if (!this.daemons.has(name) && !isWindowsInstance(config) && existsSync(join(this.getInstanceDir(name), "window-id")))
+                    return false;
+                return !this.daemons.has(name) || this.getInstanceExecutionState(name) === "idle";
+            },
+            prepare: async (name, before, target, current) => {
+                if (!current())
+                    throw Error("Runtime change authority expired");
+                if (isWindowsInstance(before))
+                    this.nativeInstanceRuntime().importHistory(name);
+                if (target.runtime === "windows")
+                    return this.nativeInstanceRuntime().prepareRuntimeChange(name, before, target, current);
+                const sameAccount = !isWindowsInstance(before) && target.backend === (before.backend || this.fleetConfig?.defaults?.backend || "claude-code");
+                const availability = (sameAccount ? this.backendAvailabilityFor(name) : this.backendAvailabilityRows()).find(row => row.backend === target.backend);
+                if (availability && ["not_installed", "not_signed_in", "too_old"].includes(availability.state))
+                    throw Error("Choose an available CLI on the Fleet host");
+                const supplied = target.directory.trim(), cwd = supplied || join(this.dataDir, "workspaces", name);
+                if (!isAbsolute(cwd) || /^[A-Za-z]:[\\/]/.test(cwd) || /[\x00-\x1f]/.test(cwd))
+                    throw Error("Enter an absolute Linux working directory or leave it empty");
+                if (!current())
+                    throw Error("Runtime change authority expired");
+                if (supplied) {
+                    if (!statSync(cwd).isDirectory())
+                        throw Error("The Linux working directory is not a directory");
+                }
+                else
+                    mkdirSync(cwd, { recursive: true, mode: 0o700 });
+                const config = { ...before, runtime: "wsl", working_directory: cwd, backend: target.backend, model: target.model };
+                if (before.backend !== target.backend)
+                    config.model_failover = [];
+                for (const key of ["machine_id", "native_agent_id", "native_adapter", "native_sandbox"])
+                    delete config[key];
+                if (!sameAccount)
+                    delete config.backend_options;
+                return { config, discard: () => { } };
+            },
+            closed: async (name, before) => {
+                if (this.daemons.has(name))
+                    return false;
+                if (isWindowsInstance(before))
+                    return !this.nativeInstanceRuntime().get(name)?.activeId;
+                // An unreadable tmux state is not evidence that the old process exited.
+                const session = getTmuxSession();
+                if (!await TmuxManager.sessionExistsStrict(session))
+                    return true;
+                const pin = windowPins.get(name);
+                return !(await TmuxManager.listWindowsStrict(session)).some(window => window.name === name || pin && window.id === pin);
+            },
+            fresh: (name, requestId) => {
+                const dir = this.getInstanceDir(name), moved = [];
+                const restore = () => { for (const [source, saved] of moved.reverse())
+                    if (!existsSync(source) && existsSync(saved))
+                        renameSync(saved, source); };
+                try {
+                    for (const file of ["session-id", "session-id.backend"]) {
+                        const source = join(dir, file), saved = join(dir, `${file}.runtime-${requestId}`);
+                        if (existsSync(source)) {
+                            if (existsSync(saved))
+                                throw Error("Session backup already exists");
+                            renameSync(source, saved);
+                            moved.push([source, saved]);
+                        }
+                    }
+                    return restore;
+                }
+                catch (error) {
+                    restore();
+                    throw error;
+                }
+            },
+            save: (name, before, next) => {
+                if (this.fleetConfig?.instances[name] !== before)
+                    throw Error("Agent settings changed before saving Runtime");
+                // Mark the replacement stopped before committing its config. A marker failure must not leave a saved
+                // Windows config referring to a profile the preparation rollback would then remove.
+                writePausedMarker(this.getInstanceDir(name), Date.now(), "operator");
+                const fleet = this.fleetConfig;
+                fleet.instances[name] = next;
+                try {
+                    this.saveFleetConfig();
+                }
+                catch (error) {
+                    fleet.instances[name] = before;
+                    throw error;
+                }
+                // A move deliberately leaves the replacement stopped; its next explicit Start opens the fresh CLI.
+            },
+            changed: name => { this.instanceStateCache.delete(name); this.instanceProcessStatus.delete(name); this.emitSseEvent("status", this.getUiStatus()); },
+        });
+    }
     /** Explicit dashboard opt-in, with the same General confirmation and ordinary topic/Daemon routing. */
     async createNativePaneInstance(profile, channelId, authorized, execution) {
         const { createNativePane } = await import("./native-pane-create.js");
@@ -957,7 +1128,8 @@ export class FleetManager {
                 const now = this.fleetConfig?.instances[name];
                 if (this.shuttingDown || !isNativePaneInstance(now) || now?.native_agent_id !== config.native_agent_id
                     || now?.machine_id !== config.machine_id || now?.working_directory !== config.working_directory || now?.backend !== config.backend
-                    || now?.model !== config.model || now?.native_sandbox !== config.native_sandbox || now?.systemPrompt !== config.systemPrompt || now?.workflow !== config.workflow)
+                    || now?.model !== config.model || now?.native_sandbox !== config.native_sandbox || now?.systemPrompt !== config.systemPrompt || now?.workflow !== config.workflow
+                    || now?.general_topic !== config.general_topic || now?.native_general_binding !== config.native_general_binding)
                     throw Error("Native pane configuration or lifetime changed");
                 if (config.machine_id ? this.remotePaneDrain || !remoteRuntimeEnabled() : this.localPaneDrain || !localWindowsCliEnabled())
                     throw Error("Native runtime is switched off");
@@ -982,10 +1154,10 @@ export class FleetManager {
                     }, subscribe: listener => hub.subscribe(listener),
                     epoch: () => hub.paneTransportEpoch(machineId), version: provider => hub.machine(machineId)?.inventory?.clis.find(row => row.id === provider && row.runnable)?.version ?? null };
             },
-            instructions: (name, config) => buildFleetInstructions({ instanceName: name, workingDirectory: config.working_directory,
+            instructions: (name, config) => buildNativeFleetInstructions({ instanceName: name, workingDirectory: config.working_directory,
                 displayName: config.display_name, description: config.description, customPrompt: config.systemPrompt,
                 workflow: config.workflow, taskBoard: !dashboardRefusalIn(this.fleetConfig, name, "task"),
-                runtimeIdentity: { kind: "fleet-topic", backend: config.backend ?? "codex", model: config.model || "default" } }),
+                runtimeIdentity: { kind: "fleet-topic", backend: config.backend ?? "codex", model: config.model || "default" } }, config.general_topic === true),
             menu: name => TOOLS.filter(tool => allowed(name, tool.name)).map(tool => ({ ...tool })),
             allowed: (name, tool, args) => allowed(name, tool) && !nativePaneToolRefusal(tool, args), published: (name, daemon) => this.daemons.get(name) === daemon,
             invoke: async (daemon, input, current, name) => {
@@ -1010,8 +1182,308 @@ export class FleetManager {
             },
         });
     }
+    /** Prepare only bundled role files; this neither switches General nor starts a provider process. */
+    async prepareWindowsGeneralWorkspace(name, machineId, cli, bindingId, authorized) {
+        const config = this.fleetConfig?.instances[name], hub = this.runtimeCoordinator(), epoch = hub.paneTransportEpoch(machineId);
+        if (!config?.general_topic || !epoch)
+            throw Error("General or its paired runtime is unavailable");
+        const current = () => authorized() && !this.shuttingDown && remoteRuntimeEnabled() && this.runtimeHub === hub
+            && this.fleetConfig?.instances[name] === config && hub.paneTransportEpoch(machineId) === epoch;
+        const [{ loadGeneralKnowledge }, { validateGeneralWorkspaceRequest, validateGeneralWorkspaceReceipt, generalWorkspaceUpgrade }, { assertAuditedNativePaneVersion }] = await Promise.all([
+            import("./runtime-general-workspace.js"), import("./runtime-general-protocol.js"), import("./runtime-pane-native.js"),
+        ]);
+        if (!current())
+            throw Error("General workspace authority expired");
+        assertAuditedNativePaneVersion(cli, hub.machine(machineId)?.inventory?.clis.find(row => row.id === cli && row.runnable)?.version ?? null);
+        const request = validateGeneralWorkspaceRequest({ action: "general-workspace", bindingId, instance: name, cli, packHash: loadGeneralKnowledge(cli).hash });
+        const inventory = await hub.callPane(machineId, { action: "list" }, maxAgentsPerMachine());
+        if (!current())
+            throw Error("General workspace authority expired");
+        if (inventory?.capabilities?.generalWorkspace !== true)
+            throw new NativePaneRecoveryError({ kind: "host-upgrade" });
+        const result = await hub.callPane(machineId, request, maxAgentsPerMachine());
+        if (!current())
+            throw Error("General workspace authority expired");
+        if (generalWorkspaceUpgrade(result, request))
+            throw new NativePaneRecoveryError({ kind: "host-upgrade" });
+        return validateGeneralWorkspaceReceipt(result, request);
+    }
+    generalLocationFlights = new Map();
+    generalAttentionEpisodes = new Map();
+    generalBindings() { return new GeneralBindings(this.dataDir); }
+    generalLocations() {
+        const store = this.generalBindings();
+        return { generals: Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic).map(([name, cfg]) => {
+                const record = store.read(name), machine = cfg.machine_id ? this.runtimeHub?.machine(cfg.machine_id) : null;
+                return { name, displayName: cfg.display_name ?? name, location: isWindowsInstance(cfg) ? "windows" : "host",
+                    machineId: cfg.machine_id ?? null, cli: cfg.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code", model: cfg.model ?? "",
+                    revision: generalBindingRevision(record, cfg), canSwitchBack: !!record && record.active !== "host",
+                    offline: isWindowsInstance(cfg) && (!remoteRuntimeEnabled() || machine?.status !== "online" || !this.runtimeHub?.paneTransportEpoch(cfg.machine_id)),
+                    retryTarget: record?.pending?.phase === "selected" ? (record.pending.to === "host" ? { location: "host" } : (() => { const row = record.windows.find(item => item.id === record.pending.to); return { location: "windows", machineId: row.machineId, cli: row.cli, model: row.config.model ?? "" }; })()) : null,
+                    hold: record?.hold ?? (record?.pending ? record.pending.phase === "selected" ? "start" : "exit" : null), switching: this.generalLocationFlights.has(name) };
+            }), machines: (this.runtimeHub?.listMachines() ?? []).filter(row => row.status !== "pending" && row.status !== "revoked").map(row => ({
+                id: row.id, name: row.name, online: row.status === "online" && !!this.runtimeHub?.paneTransportEpoch(row.id),
+                clis: row.inventory?.clis.filter(cli => cli.runnable && (cli.id === "claude-code" || cli.id === "codex")).map(cli => ({ id: cli.id, version: cli.version })) ?? [],
+            })) };
+    }
+    /** Pure preflight for the confirmation diff and stale-tab refusal; never prepares files or starts a CLI. */
+    previewGeneralLocation(raw) {
+        const input = parseGeneralSwitchInput(raw), cfg = this.fleetConfig?.instances[input.name];
+        if (!cfg?.general_topic || this.shuttingDown)
+            throw Error("General is unavailable");
+        const record = this.generalBindings().read(input.name);
+        if (input.revision !== generalBindingRevision(record, cfg))
+            throw Error("General location changed; read its settings again");
+        const connections = cfg.channel_id ? [cfg.channel_id] : [];
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        if (channels.length && (connections.length !== 1 || channels.filter(row => (row.id ?? row.type) === connections[0]).length !== 1))
+            throw Error("General's connection cannot be resolved");
+        if (input.target.location === "host") {
+            if (!record)
+                throw Error("General's saved host location is unavailable");
+            return { input, connections, summary: [t("general_location.confirm_host"), t("general_location.history")] };
+        }
+        const active = record?.windows.find(row => row.id === record.active);
+        if (!record?.pending && record?.hold !== "start" && active?.machineId === input.target.machineId && active.cli === input.target.cli)
+            throw Error("General already runs at this location");
+        const machine = this.runtimeHub?.machine(input.target.machineId);
+        if (!remoteRuntimeEnabled() || machine?.status !== "online" || !this.runtimeHub?.paneTransportEpoch(machine.id))
+            throw Error(t("general_location.offline"));
+        const provider = input.target.cli;
+        if (!machine.inventory?.clis.some(cli => cli.id === provider && cli.runnable))
+            throw Error("The chosen Windows CLI is unavailable");
+        return { input, connections, summary: [t("general_location.confirm_windows", settingsDisplay(machine.name)), t("general_location.history")] };
+    }
+    /** All entry points, including automatic native recovery, must respect an interrupted binding switch. */
+    assertGeneralBindingStart(name, config) {
+        if (!config.general_topic)
+            return;
+        try {
+            this.generalBindings().assertStart(name, config);
+        }
+        catch (err) {
+            this.logger.warn({ name, err }, "General location start held by its saved binding");
+            this.needsYou?.poke();
+            throw new UnsupportedCliError(t("general_location.exit_unconfirmed"));
+        }
+    }
+    /** Only the Settings replay's confirmed admin can enter; the whole switch owns one lifecycle transition. */
+    async switchGeneralLocation(raw, authorized, execution) {
+        const { input } = this.previewGeneralLocation(raw), name = input.name;
+        return this.lifecycle.runTransition(name, async (transition) => {
+            execution.assert();
+            if (!authorized() || this.generalLocationFlights.has(name))
+                throw Error("General location authority expired or a switch is already running");
+            const token = Symbol(name), generation = this.settingsGeneration;
+            const destinationEpoch = input.target.location === "windows" ? this.runtimeHub?.paneTransportEpoch(input.target.machineId) : null;
+            let expected = this.fleetConfig.instances[name], stopGeneration = this.explicitStopGeneration.get(name) ?? 0, epoch = this.lifecycle.epochOf(name);
+            const hostSnapshot = !isWindowsInstance(expected) ? structuredClone(this.daemons.get(name)?.getConfigSnapshot() ?? expected) : undefined;
+            const current = () => !this.shuttingDown && this.settingsGeneration === generation && authorized()
+                && this.generalLocationFlights.get(name) === token && this.fleetConfig?.instances[name] === expected
+                && (input.target.location !== "windows" || remoteRuntimeEnabled() && !!destinationEpoch && this.runtimeHub?.paneTransportEpoch(input.target.machineId) === destinationEpoch)
+                && (this.explicitStopGeneration.get(name) ?? 0) === stopGeneration && this.lifecycle.epochOf(name) === epoch;
+            const check = () => { if (!current())
+                throw Error("General location switch was superseded"); };
+            this.generalLocationFlights.set(name, token);
+            // Old ephemeral waiters carry this epoch; they cannot wake into the selected conversation.
+            this.cancelPendingDeliveries(name);
+            let lease = null;
+            try {
+                lease = await waitSettingsLease([settingsFileResource(this.getSettingsConfigPath()), `general:${this.dataDir}:${name}`], () => current() && execution.current(), performance.now() + execution.remainingMs, execution.owner);
+                const store = this.generalBindings();
+                const result = await switchGeneralLocation({ store, current: () => expected, assert: check,
+                    prepare: async (target, retained) => {
+                        if (target.location !== "windows")
+                            return null;
+                        const old = retained.windows.find(row => row.machineId === target.machineId && row.cli === target.cli);
+                        const id = old?.id ?? randomUUID(), agentId = old?.agentId ?? randomUUID();
+                        const publication = await this.prepareWindowsGeneralWorkspace(name, target.machineId, target.cli, id, () => current() && execution.current());
+                        check();
+                        execution.assert();
+                        const config = { ...structuredClone(expected), runtime: "windows", machine_id: target.machineId,
+                            native_adapter: "pane", native_agent_id: agentId, native_general_binding: id, native_sandbox: "workspace-write",
+                            backend: target.cli, model: target.model, working_directory: publication.cwd, systemPrompt: "", agent_mode: "cli" };
+                        // Host credentials, shell hooks and provider-specific options never become Windows launch configuration.
+                        for (const key of ["backend_options", "credential_profile", "pre_task_command"])
+                            delete config[key];
+                        windowsAgentsFor(this, this.runtimeWindowsExecutor()).ensureGeneralBinding({ id: agentId, instance: name, machineId: target.machineId,
+                            cli: target.cli, cwd: publication.cwd, name: (expected.display_name ?? name).slice(0, 64), model: target.model, instructions: "", description: expected.description ?? "" }, () => current() && execution.current());
+                        return { id, agentId, machineId: target.machineId, cli: target.cli, config };
+                    },
+                    idle: async () => {
+                        check();
+                        const daemon = this.daemons.get(name);
+                        return !daemon || daemon.getInstanceStateSnapshot().state === "idle" && daemon.getWorkingRecoveryState().idle
+                            && daemon.getInteractionSnapshot().phase === "clear" && !this.lifecycle.hasWorkLease(name)
+                            && Date.now() - (this.lastDeliveryAt.get(name) ?? 0) >= 2000;
+                    },
+                    hostSnapshot: () => hostSnapshot,
+                    capture: async () => {
+                        if (isWindowsInstance(expected))
+                            return undefined;
+                        const daemon = this.daemons.get(name);
+                        if (!daemon)
+                            throw Error(t("general_location.exit_unconfirmed"));
+                        const owner = await daemon.generalHostOwner();
+                        check();
+                        execution.assert();
+                        return owner;
+                    },
+                    stop: async (owner) => {
+                        check();
+                        const stopping = this.stopInstance(name, transition);
+                        stopGeneration++;
+                        epoch++;
+                        await stopping;
+                        check();
+                        if (isWindowsInstance(expected)) {
+                            const profile = windowsAgentsFor(this, this.runtimeWindowsExecutor()).get(expected.native_agent_id);
+                            if (profile.activeId || profile.paneLaunchId)
+                                throw Error(t("general_location.exit_unconfirmed"));
+                            execution.mutate(() => this.holdGeneralOldDeliveries(name));
+                            return undefined;
+                        }
+                        if (!owner || !await confirmGeneralHostExit(owner, getTmuxSession()))
+                            throw Error(t("general_location.exit_unconfirmed"));
+                        check();
+                        execution.mutate(() => this.holdGeneralOldDeliveries(name));
+                        return owner.pin;
+                    },
+                    save: next => {
+                        check();
+                        const previous = expected;
+                        try {
+                            this.fleetConfig.instances[name] = next;
+                            this.saveFleetConfig([{ path: ["instances", name], value: next }]);
+                            expected = next;
+                            this.routing.rebuild(this.fleetConfig);
+                        }
+                        catch (err) {
+                            this.fleetConfig.instances[name] = previous;
+                            throw err;
+                        }
+                    },
+                    start: async () => {
+                        check();
+                        if (!execution.completed)
+                            throw Error("General's selected binding has no committed approval");
+                        // The committed receipt permits only this selected startup. Live authority still fences every awaited spawn boundary.
+                        const startup = new SettingsExecution({ current: () => current() && execution.completed && execution.remainingMs > 0,
+                            snapshot: () => this.fleetConfig });
+                        try {
+                            await this.startInstance(name, expected, true, "fleet-topic", false, transition, startup);
+                        }
+                        finally {
+                            startup.close();
+                        }
+                        check();
+                        const daemon = this.daemons.get(name);
+                        if (!daemon || daemon.getProcessStatus() !== "running" || isNativePaneInstance(expected) && !daemon.nativePaneCurrent())
+                            throw Error(t("general_location.start_failed"));
+                        await this.connectIpcToInstance(name);
+                        check();
+                    },
+                    notify: (kind, err) => {
+                        const message = t(kind === "exit" ? "general_location.exit_unconfirmed" : kind === "start" ? "general_location.start_failed" : "general_location.complete", isWindowsInstance(expected) ? this.runtimeHub?.machine(expected.machine_id)?.name ?? t("general_location.windows") : t("general_location.host"));
+                        this.eventLog?.insert(name, "general_location", { phase: kind, message });
+                        if (err)
+                            this.logger.warn({ name, phase: kind, err }, message);
+                        else
+                            this.logger.info({ name, phase: kind }, message);
+                        this.needsYou?.poke();
+                        this.emitSseEvent("status", this.getUiStatus());
+                        this.notifyInstanceTopic(name, message);
+                    },
+                }, input, execution);
+                return { ...result, message: result.started ? t("general_location.complete", isWindowsInstance(expected)
+                        ? this.runtimeHub?.machine(expected.machine_id)?.name ?? t("general_location.windows") : t("general_location.host")) : t("general_location.start_failed") };
+            }
+            finally {
+                lease?.release();
+                if (this.generalLocationFlights.get(name) === token)
+                    this.generalLocationFlights.delete(name);
+                this.needsYou?.poke();
+            }
+        });
+    }
+    /** An offline PC or a confirmed binding boundary holds old waiting input; it never becomes another conversation's queue. */
+    holdGeneralOldDeliveries(name) {
+        const outbox = this.deliveryOutbox;
+        if (!outbox)
+            return;
+        for (const row of outbox.listPending().filter(row => row.targetInstance === name)) {
+            if (row.state !== "submission_started")
+                outbox.failBeforeBegin(row.deliveryId, t("general_location.input_not_replayed"));
+            else if (row.targetDaemonBootId) {
+                outbox.markTargetReconciliationPending(name, row.targetDaemonBootId);
+                if (!outbox.reconcileAttempt(row.deliveryId, row.targetDaemonBootId, row.attemptNo, "uncertain", t("general_location.input_not_replayed")))
+                    throw Error("General's old delivery could not be held");
+            }
+            else
+                throw Error("General's old delivery has no confirmed owner");
+        }
+        this.needsYou?.poke();
+    }
+    generalLocationDeliveryHold(name) {
+        const config = this.fleetConfig?.instances[name];
+        if (!config?.general_topic)
+            return null;
+        if (this.generalLocationFlights?.has(name))
+            return t("general_location.exit_unconfirmed");
+        let record;
+        try {
+            record = this.generalBindings().read(name);
+        }
+        catch {
+            return t("general_location.start_failed");
+        }
+        if (record?.pending || record?.hold)
+            return t(record.pending?.phase === "selected" || record.hold === "start" ? "general_location.start_failed" : "general_location.exit_unconfirmed");
+        if (isWindowsInstance(config) && config.machine_id && (!remoteRuntimeEnabled() || this.runtimeHub?.machine(config.machine_id)?.status !== "online" || !this.runtimeHub?.paneTransportEpoch(config.machine_id)))
+            return t("general_location.offline");
+        return null;
+    }
+    generalLocationAttention(name) {
+        const cfg = this.fleetConfig?.instances[name];
+        if (!cfg?.general_topic)
+            return null;
+        const detail = this.generalLocationDeliveryHold(name);
+        if (!detail) {
+            this.generalAttentionEpisodes.delete(name);
+            return null;
+        }
+        let record = null;
+        try {
+            record = this.generalBindings().read(name);
+        }
+        catch { /* a corrupt journal is a visible hold too */ }
+        const offline = !record?.pending && !record?.hold && isWindowsInstance(cfg) && detail === t("general_location.offline");
+        const key = record?.pending?.id ?? `${record?.revision ?? "unknown"}:${offline ? "offline" : "hold"}`;
+        let episode = this.generalAttentionEpisodes.get(name);
+        if (!episode || episode.key !== key) {
+            episode = { key, since: record?.pending?.at ?? Date.now() };
+            this.generalAttentionEpisodes.set(name, episode);
+        }
+        return { ...episode, detail, offline };
+    }
     async nativePaneFor(name, config, assertCurrent) {
-        return (await this.nativePanes()).prepare(name, config, assertCurrent);
+        try {
+            return await (await this.nativePanes()).prepare(name, config, assertCurrent);
+        }
+        catch (err) {
+            if (config.general_topic && err instanceof GeneralManagedFileError) {
+                assertCurrent();
+                const store = this.generalBindings(), record = store.read(name);
+                if (record && record.active === config.native_general_binding) {
+                    record.hold = "start";
+                    store.write(record);
+                }
+                this.logger.warn({ name, managedFile: err.file }, t("general_location.start_failed"));
+                this.needsYou?.poke();
+                throw new UnsupportedCliError(t("general_location.start_failed"));
+            }
+            throw err;
+        }
     }
     async recoverNativePane(name, launchId, authorized) {
         const config = this.fleetConfig?.instances[name];
@@ -1556,6 +2028,7 @@ export class FleetManager {
     watchdogTimer = null;
     startupMemoryDeadline = null;
     eventLoopWatch = null;
+    stallReporter = null;
     startedAt = 0;
     stormOpenNotifyTimer = null;
     memoryLogAt = null;
@@ -1599,6 +2072,37 @@ export class FleetManager {
     webChatRemovals = new Map();
     /** #1774: a removal under way — its replies' fate waits for its outcome (success: theirs no more; failure: theirs). */
     webChatRemovalsPending = new Map();
+    /**
+     * #1490 row 27: "still the same lifecycle of `name`" — its lifecycle epoch, moved on synchronously by every stop,
+     * restart and removal (the map is never pruned, so a same-name replacement has a later one). Taken when a button
+     * or menu is claimed or offered, asked after every await before acting by name.
+     */
+    /** #1490 row 27: an instance as the chat list names it — its display name where it has one, else its name. */
+    shownInstanceName(name) {
+        try {
+            const classic = this.classicChannels?.getAll().find(ch => ch.instanceName === name) ?? null;
+            return resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic, profile: profileIdentities(this.dataDir).get(name) }).display_name || name;
+        }
+        catch {
+            return name;
+        }
+    }
+    lifecyclePin(name) {
+        // Fail closed: a lifecycle that cannot say its epoch holds nothing (and never stops a prompt from being posted).
+        let epoch;
+        try {
+            epoch = this.lifecycle?.epochOf(name);
+        }
+        catch {
+            return () => false;
+        }
+        return () => { try {
+            return !this.shuttingDown && this.lifecycle?.epochOf(name) === epoch;
+        }
+        catch {
+            return false;
+        } };
+    }
     webChatGeneration(name) { return this.webChatGenerations.get(name) ?? 0; }
     /** #1774: who an instance's reply is from, taken when it is sent: the name's generation and its daemon then. */
     webChatIdentity(name) { return { generation: this.webChatGeneration(name), daemon: this.daemons.get(name) }; }
@@ -2085,6 +2589,7 @@ export class FleetManager {
         const current = () => !this.shuttingDown && this.settingsGeneration === generation;
         const baselines = this.settingsBaselineReader = new SettingsBaselines({ dataDir: this.dataDir, configPath: () => this.configPath,
             config: () => this.fleetConfig, current: () => [this.settingsGeneration, this.settingsRuntimeRevision, this.shuttingDown],
+            generalLocation: input => this.previewGeneralLocation(input),
             proof: (kind, target, id, binding, key) => {
                 const map = kind === "provider" ? this.providerSecretChallenges : kind === "binding" ? this.connectionBindingChallenges : this.connectionSecretChallenges;
                 const proof = map.get(id);
@@ -2129,6 +2634,7 @@ export class FleetManager {
                         && sessions.isCurrent(record, tokenEpoch(this.webToken)) && (!exposure || exposure.isCurrent()) };
             }, baseline: () => baselines.read(), snapshot: () => baselines.snapshot(),
             selfConfirm: (req, id) => this.settingsSelfConfirmation(store, req, id),
+            directAgentCreation: true,
             job: async (id) => {
                 const settlement = this.settingsJobSettlements.get(id);
                 if (!settlement)
@@ -2163,8 +2669,10 @@ export class FleetManager {
         const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
         if (auth.kind !== "ok")
             return null;
-        // #2453 (§0.2): never over the public link — not even a named-link session that is web-verified there.
-        if (gatewayRequestContext(req))
+        // #2453 (§0.2): never over the public link — not even a named-link session that is web-verified there. #3008: except
+        // this computer's admin signed in from outside (the authenticator's code, over the link connections from outside
+        // opened): the web-only fleet's owner, judged below by the same authority as here (hostOperator).
+        if (gatewayRequestContext(req) && auth.session.remote !== "totp")
             return null;
         // …and never a change that turns the named-link option on: that one needs a General's card or the host.
         if (!store.selfConfirmable(id))
@@ -2197,13 +2705,16 @@ export class FleetManager {
         if (own.length !== 1 || own[0].type !== chat.platform || !chat.admin(actor.user_id))
             return null;
         const affected = [...store.affectedConnections(id)]; // read now: a finished change no longer has them
-        if (!this.settingsNoticeGenerals(affected, chat.platform).length)
+        const destinations = this.settingsNoticeGenerals(affected, chat.platform);
+        if (!destinations.length)
             return null;
         const name = this.webPerson({ adapterId: actor.adapter_id, userId: actor.user_id }).name;
         return {
             label: t("settings_confirm.web_verified_label", name),
             // admin() asks chat.current() too; a General a card could go to must still be there (else the host CLI's).
-            current: () => !!verified() && chat.admin(actor.user_id) && this.settingsNoticeGenerals(affected, chat.platform).length > 0,
+            current: () => !!verified() && chat.admin(actor.user_id) && destinations.some(route => route.current()),
+            followStop: async (name, begin) => { const route = destinations.find(item => item.current()); if (!route)
+                throw Error("Settings route expired"); await route.followStop(name, begin); },
             done: view => this.settingsWebConfirmedNotice(view, affected, name, chat.platform),
         };
     }
@@ -2223,27 +2734,10 @@ export class FleetManager {
      */
     agentProposalsRev = 0;
     agentProposalOwner(req) {
-        if (!this.isWebOnlyFleet() || gatewayRequestContext(req))
-            return null;
-        const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
-        if (auth.kind !== "ok")
-            return null;
-        // Each check twice over: here, and in the authority itself (it refuses the public link and a chat fleet's session).
-        // #2997 review (Prism P2): asked of the LIVE session each time — the request's own cookie authenticated again, the
-        // same handle — never a record captured at the click: a sign-out, an expiry or a revocation while the request is
-        // being applied fences it.
-        const handle = auth.session.handle, peer = webPeerOf(req), gateway = !!gatewayRequestContext(req);
-        const owner = () => {
-            if (!this.isWebOnlyFleet())
-                return false;
-            const live = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
-            if (live.kind !== "ok" || live.session.handle !== handle)
-                return false;
-            const now = this.webAuthority({ session: live.session, gateway, peer });
-            const a = now.authority.kind === "web-verified" && now.authority.session?.handle === handle ? now.authority.actor : null;
-            return !!a && a.adapter_id === HOST_OPERATOR.adapterId && a.user_id === HOST_OPERATOR.userId;
-        };
-        return owner() ? { label: t("settings_confirm.host_operator_label"), current: owner } : null;
+        // #3008: this computer's admin here, or signed in from outside (over the link connections from outside opened) —
+        // asked of the LIVE session each time (#2997 review): a sign-out, an expiry, a revocation or the switch going off
+        // while the request is applied fences it.
+        return this.liveOwner(req, { hostOnly: false });
     }
     /** alpha.2: the agents' requests waiting for this web-only fleet's owner, or null when the reader is not that owner. */
     webAgentProposals(req) {
@@ -2277,20 +2771,31 @@ export class FleetManager {
             return { status, body: { error: code, message: t(code === "admin_required" ? "settings_confirm.web_owner_required" : "settings_confirm.no_longer_pending"), view: store.inspect(id) } };
         }
     }
-    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    /** A confirmation belongs to the server route/lifetime, not the availability of General's model. */
+    settingsGeneralRoute(name, platform, excluded) {
+        const config = this.fleetConfig?.instances[name];
+        if (!config?.general_topic || this.shuttingDown || this.ipcStoppingInstances.has(name))
+            return null;
+        const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
+        if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform)
+            return null;
+        const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
+        if (!chatId || !topic)
+            return null;
+        const route = () => !this.shuttingDown && this.fleetConfig?.instances[name]?.general_topic === true
+            && this.adapterState.get(adapterId)?.status === "connected"
+            && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
+            && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic;
+        const lifetime = new SettingsRouteLifetime(name, route, () => this.lifecycle.epochOf(name), () => this.ipcStoppingInstances.has(name));
+        return lifetime.current() ? { adapterId, adapter, chatId, topic, current: lifetime.current, followStop: lifetime.followStop.bind(lifetime) } : null;
+    }
+    /** Connected, same-platform, unaffected server routes can post cards even while the model is offline. */
     settingsNoticeGenerals(affected, platform) {
-        const excluded = new Set(affected), found = [];
-        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            if (!config.general_topic || !this.daemons.get(name))
-                continue;
-            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
-            if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform || this.adapterState.get(adapterId)?.status !== "connected")
-                continue;
-            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
-            if (chatId && topic)
-                found.push({ adapterId, adapter, chatId, topic });
-        }
-        return found;
+        const excluded = new Set(affected);
+        return Object.keys(this.fleetConfig?.instances ?? {}).flatMap(name => {
+            const route = this.settingsGeneralRoute(name, platform, excluded);
+            return route ? [route] : [];
+        });
     }
     /**
      * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
@@ -2470,25 +2975,15 @@ export class FleetManager {
             return;
         }
         const excluded = new Set(store.affectedConnections(view.id));
-        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            if (!config.general_topic)
-                continue;
-            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
-            const general = this.daemons.get(name);
-            if (!adapterId || !adapter || !general || excluded.has(adapterId) || adapter.type !== authority.platform)
-                continue;
-            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
-            if (!chatId || !topic)
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+            const route = this.settingsGeneralRoute(name, authority.platform, excluded);
+            if (!route)
                 continue;
+            const { adapterId, adapter, chatId, topic } = route;
             let retired = false, attached = false;
             const postingDeadline = performance.now() + Math.min(5000, view.remaining_ms);
-            const current = () => !retired && (attached || performance.now() < postingDeadline) && !this.shuttingDown && this.settingsGeneration === generation
-                && this.fleetConfig?.instances[name]?.general_topic === true
-                && this.daemons.get(name) === general && !this.ipcStoppingInstances.has(name)
-                && this.adapterState.get(adapterId)?.status === "connected"
-                && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
-                && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic
-                && authority.current();
+            const current = () => !retired && (attached || performance.now() < postingDeadline) && this.settingsGeneration === generation
+                && route.current() && authority.current();
             if (!current())
                 continue;
             try {
@@ -2498,7 +2993,7 @@ export class FleetManager {
                         t("settings_confirm.requester", view.requested_by), ...view.summary].join("\n"),
                     choices: [{ action: "confirm", label: t("settings_confirm.confirm_button") }, { action: "reject", label: t("settings_confirm.reject_button") }],
                     expiredText: t("settings_confirm.no_longer_pending"), timeoutMs: view.remaining_ms,
-                    extra: { pendingChangeId: view.id, confirmationCurrent: current, confirmationAdmin: userId => current() && authority.admin(userId) },
+                    extra: { pendingChangeId: view.id, confirmationCurrent: current, confirmationAdmin: userId => current() && authority.admin(userId), confirmationStop: route.followStop },
                 });
                 void posted.then(nonce => {
                     if (!retired)
@@ -2766,6 +3261,7 @@ export class FleetManager {
         try {
             const view = await this.settingsGate().store.decide(entry.pendingChangeId, action, {
                 label: t("settings_confirm.admin_label", data.userId ?? ""),
+                followStop: entry.confirmationStop,
                 current: () => entry.confirmationCurrent?.() === true && this.getAdapterForInstance(entry.instanceName) === entry.adapter
                     && !!data.userId && entry.confirmationAdmin?.(data.userId) === true,
             });
@@ -3140,6 +3636,9 @@ export class FleetManager {
     }
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input) {
+        const bindingHold = this.generalLocationDeliveryHold(input.targetInstance);
+        if (bindingHold)
+            throw Error(bindingHold);
         const outbox = this.deliveryOutbox;
         if (!outbox)
             throw new Error("Durable delivery store is unavailable");
@@ -3179,7 +3678,7 @@ export class FleetManager {
         const human = (item) => {
             if (!item.authority || !state)
                 return item;
-            const authority = authorityNow(item.authority, state);
+            const authority = this.receiptAuthorityNow(item.authority, state);
             return { ...item, authority, ...(authority.downgraded ? { source_instance: "human:web:unknown" } : {}) };
         };
         // #1641: a sender that sees only `queued` cannot tell "next in line" from "the target is stuck": say which.
@@ -3208,6 +3707,8 @@ export class FleetManager {
         return this.daemons.get(target)?.notAcceptingReason?.() ?? null;
     }
     getDaemonBootId(instanceName) {
+        if (this.generalLocationDeliveryHold(instanceName))
+            return undefined;
         if (isNativeExecInstance(this.fleetConfig?.instances[instanceName])) {
             return !this.shuttingDown && windowsCliEnabled() && this.nativeMcpStore?.hasActive(instanceName) ? this.managerBootId : undefined;
         }
@@ -3219,8 +3720,22 @@ export class FleetManager {
     /** Called after a replacement Daemon object is installed in lifecycle.daemons. */
     onDaemonReady(name, daemonBootId) {
         const daemon = this.daemons.get(name);
-        if (daemon?.bootId === daemonBootId)
+        if (daemon?.bootId === daemonBootId) {
             this.listenForWorkingState(name, daemon);
+            const cfg = this.fleetConfig?.instances[name];
+            if (cfg?.general_topic && !this.generalLocationFlights.has(name) && daemon.getProcessStatus() === "running"
+                && (!isNativePaneInstance(cfg) || daemon.nativePaneCurrent())) {
+                try {
+                    if (this.generalBindings().completeSelected(name, cfg)) {
+                        this.needsYou?.poke();
+                        this.logger.info({ name }, "General location's selected start receipt settled after recovery");
+                    }
+                }
+                catch (err) {
+                    this.logger.warn({ name, err }, "General location start receipt remains held");
+                }
+            }
+        }
         // #2802: no post-restart notices. The outbox still delivers or fails a row accepted before the restart, and an open
         // request is reminded by the ordinary turn-ended nudge (sweepReplyObligations) once the owner is idle.
         this.scheduleDeliveryOutboxPump();
@@ -5698,6 +6213,8 @@ export class FleetManager {
     }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
+        if (this.generalLocationDeliveryHold(instanceName))
+            return false;
         if (isNativeExecInstance(this.fleetConfig?.instances[instanceName])) {
             return this.nativeInstanceRuntime().deliver(instanceName, payload, { stillCurrent: options.stillCurrent,
                 ...(options.authorityCurrent ? { authorityCurrent: options.authorityCurrent } : {}) });
@@ -6526,7 +7043,26 @@ export class FleetManager {
             if (resumePaused)
                 this.lifecycle.markActivitySeedNow(name);
             const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
-            if (!isWindowsInstance(config) && config.general_topic) {
+            // #1490 row 67 (main): off-loop resolve before skill/instruction publication
+            // constructs a backend (resolveKnowledgeWorkDir). Capture stop/lifecycle
+            // ownership first: a Stop during this wait finishes and bumps the epoch,
+            // and the inner lifecycle check would otherwise capture the new epoch and
+            // accept the stale start. Lifecycle start looks up again before its own
+            // createBackend; the probe cache makes that cheap. (alpha: a native Windows
+            // agent's CLI is on that PC — nothing to resolve on this one.)
+            const epoch = this.lifecycle.epochOf(name);
+            const stopGen = this.explicitStopGeneration.get(name) ?? 0;
+            const windows = isWindowsInstance(config);
+            const resolved = windows ? null : await resolveBackendBinary(backend);
+            execution?.assert();
+            if (this.lifecycle.epochOf(name) !== epoch
+                || (this.explicitStopGeneration.get(name) ?? 0) !== stopGen) {
+                throw new SupersededStartError(name);
+            }
+            const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
+            if (binary && !windows)
+                noteResolvedBinary(binary, resolved ?? binary);
+            if (!windows && config.general_topic) {
                 this.ensureGeneralInstructions(config.working_directory, backend, name);
             }
             else if (!isWindowsInstance(config) && kind === "fleet-topic") {
@@ -7184,6 +7720,8 @@ export class FleetManager {
     }
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     async restartSingleInstance(name, opts) {
+        if (opts?.ownerCurrent && !opts.ownerCurrent())
+            throw new RestartSupersededError(this.shownInstanceName(name));
         if (isNativeExecInstance(this.fleetConfig?.instances[name])) {
             const runtime = this.nativeInstanceRuntime();
             if (runtime.get(name)?.blocked)
@@ -7552,6 +8090,9 @@ export class FleetManager {
             log: () => this.logger.warn("Managed tunnel cleanup requires attention") }));
     }
     publicOwnerCurrent(owner) {
+        // #3008: the outside link is this computer's admin's — while "Allow connections from outside" is on, web-only.
+        if (isOutsideLinkOwner(owner))
+            return !this.shuttingDown && this.outsideOn();
         if (this.shuttingDown || !this.hasFleetAdmins(owner.adapterId) || !this.isFleetAdmin(owner.userId, owner.adapterId))
             return false;
         const configured = (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).find(ch => (ch.id ?? ch.type) === owner.adapterId);
@@ -7641,7 +8182,11 @@ export class FleetManager {
     }
     getPublicWebLink() {
         this.initializeWebSessions();
-        return this.publicWebLink ??= new PublicWebLink({
+        return this.publicWebLink ??= new PublicWebLink(this.publicWebLinkDeps());
+    }
+    /** The public link's wiring to this fleet (a test builds one with the tunnel itself stubbed: `ensure`, `provider`). */
+    publicWebLinkDeps() {
+        return {
             dataDir: this.dataDir, web: () => this.fleetConfig?.web,
             permitted: owner => this.publicOwnerCurrent(owner),
             reserve: id => this.getTunnelLane().reserve("dashboard", id),
@@ -7674,7 +8219,9 @@ export class FleetManager {
                 if (world && world.adapter === owner.binding)
                     void world.adapter.sendText(owner.chatId, t("dashboard.public_cleanup"), { threadId: owner.threadId }).catch(() => { });
             },
-        });
+            onClose: (owner, reason) => { if (isOutsideLinkOwner(owner))
+                this.outsideLinkClosed(reason); },
+        };
     }
     publicLinkAutoOpen = null;
     /**
@@ -8494,7 +9041,7 @@ export class FleetManager {
             return { kind: "refused" };
         if (device.tier === "guest")
             return this.requestGuestDeviceCode(device, input, token);
-        const paused = this.webLoginCodes.pausedForMs();
+        const paused = this.webLoginCodes.pausedForMs(input.exposureId ?? "local");
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
         const admitted = this.codeRequestLimiter.admit(device.idHash);
@@ -8979,6 +9526,9 @@ export class FleetManager {
         this.watchdogTimer = startSdWatchdog();
         this.eventLoopWatch?.stop();
         this.eventLoopWatch = startEventLoopWatch({ logger: this.logger });
+        // #3009: the event-loop watch runs on the main thread; this one does not, so a stall that never ends is still named.
+        this.stallReporter?.stop();
+        this.stallReporter = startStallReporter({ logFile: join(this.dataDir, "daemon.log") });
         try {
             await this.startAllWithinDeadline(configPath, deadline);
         }
@@ -8992,6 +9542,8 @@ export class FleetManager {
                     this.watchdogTimer = null;
                     this.eventLoopWatch?.stop();
                     this.eventLoopWatch = null;
+                    this.stallReporter?.stop();
+                    this.stallReporter = null;
                 }
             }
         }
@@ -9263,6 +9815,10 @@ export class FleetManager {
             const generalDir = join(getAgendHome(), name);
             mkdirSync(generalDir, { recursive: true, mode: 0o700 });
             const backendName = fleet.defaults.backend ?? "claude-code";
+            const resolved = await resolveBackendBinary(backendName);
+            const binary = BACKEND_INSTALLATION_INFO[backendName]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, resolved ?? binary);
             this.ensureGeneralInstructions(generalDir, backendName, name);
             fleet.instances[name] = autoGeneralInstanceConfig(fleet.defaults, generalDir, need.adapterId); // #2598: its kiro_ui is the fleet's
             generalsCreated = true;
@@ -9542,6 +10098,10 @@ export class FleetManager {
             // #named-link-ttl: a named link with auto_open comes back now — after the web listener and the chat connections.
             this.startPublicLinkAutoOpen();
         }
+        // #3008: connections from outside were on when the fleet stopped: the link opens again (its address is new for a
+        // quick link — Settings shows it on this computer).
+        if (this.outsideOn())
+            this.openOutsideLink([0, ...OUTSIDE_LINK_RETRY_MS]);
         // #1266: buttons that ended while AgEnD was down (expired, or chosen before a restart) are shown as ended now.
         // #1823: and polls: a deadline that passed meanwhile closes now (results once); an open one's countdown is redrawn.
         void this.replyButtons()?.sweep().catch(err => this.logger.warn({ err }, "Reply-button sweep failed"));
@@ -11475,6 +12035,12 @@ export class FleetManager {
                 if (msg.adapterId)
                     this.bindInstanceAdapter(generalInstance, msg.adapterId, true);
                 const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+                const locationHold = this.generalLocationDeliveryHold(generalInstance);
+                if (locationHold) {
+                    await inboundAdapter.sendText(msg.chatId, locationHold, { threadId: msg.threadId || undefined });
+                    this.needsYou?.poke();
+                    return;
+                }
                 // React immediately — before any other API calls — through the status
                 // path, which tracks Telegram slot ownership and Discord status adds.
                 if (msg.chatId && msg.messageId) {
@@ -11562,6 +12128,13 @@ export class FleetManager {
         if (instanceConfig?.general_topic && await this.topicCommands.handleGeneralCommand(msg, instanceName)) {
             return;
         }
+        const locationHold = this.generalLocationDeliveryHold(instanceName);
+        if (locationHold) {
+            const adapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+            await adapter.sendText(msg.chatId, locationHold, { threadId: msg.threadId || undefined });
+            this.needsYou?.poke();
+            return;
+        }
         // Bind instance to the adapter that delivered this message
         if (msg.adapterId)
             this.bindInstanceAdapter(instanceName, msg.adapterId, true);
@@ -13811,6 +14384,9 @@ export class FleetManager {
                 await this.lifecycle.remove(name, authorization, execution, transition);
             else
                 await this.lifecycle.remove(name, authorization);
+            // #1490 row 27: its hang/exit offers were for the instance now gone (stopInstance clears them; removal stops
+            // through the lifecycle directly). The offers' own lifecycle pins refuse them too.
+            this.clearNoncePromptsForInstance(name);
             // #1774: removed — its replies still copying their files are no one's to show, replaced or not (a failed removal
             // throws above: its replies stay its own).
             this.webChatRemovals.set(name, { below: removedBelow, ...(removedDaemon !== undefined ? { daemon: removedDaemon } : {}) });
@@ -15491,6 +16067,7 @@ export class FleetManager {
             threadId: opts.threadId,
             expiredText: opts.expiredText,
             createdAt: Date.now(),
+            lifecycleCurrent: this.lifecyclePin(opts.instanceName),
             ...opts.extra,
         };
         entry.timer = setTimeout(() => {
@@ -16021,6 +16598,7 @@ export class FleetManager {
                 signIn: pauseReason === "auth" ? this.signInFor(name) : null,
                 usageHold: this.daemons.get(name)?.usageHold?.() ?? null,
                 nativeDeliveryHold: this.daemons.get(name)?.nativeDeliveryHold?.() ?? null,
+                generalLocation: this.generalLocationAttention(name),
                 paneRecovery: (() => {
                     const config = this.fleetConfig?.instances[name];
                     if (!isNativePaneInstance(config) || !config.native_agent_id)
@@ -16634,7 +17212,7 @@ export class FleetManager {
             isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
             authorization: input.session ? this.sessionAuthorizationStore()?.get(input.session.handle) ?? null : null,
             policy: { ...webAuthorityPolicy(this.fleetConfig?.web), enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink, quickLink: state.quickLink }, epoch: state.epoch, now: Date.now(),
-            hostOperator: this.isWebOnlyFleet(),
+            hostOperator: this.isWebOnlyFleet(), outside: this.outsideLink(),
         });
     }
     sessionAuthorizations = null;
@@ -16694,6 +17272,269 @@ export class FleetManager {
         const { durable } = store.authorize(session.handle, HOST_OPERATOR, now, state.epoch, now + policy.maxSessionMs, peer);
         this.logger.info({ handle: session.handle, durable }, "Host web session authorized (this computer's admin)");
     }
+    // ── #3008: connections from outside (a web-only fleet; decision 28c2d3a3 rule 3, the user's simplified form) ──
+    webRemoteAccessState = null;
+    /** The authenticator, the outside switch and the wrong-code limiter (web-remote-access.json), read on first use. */
+    webRemoteAccess() {
+        if (!this.dataDir)
+            return null;
+        this.webRemoteAccessState ??= new WebRemoteAccess(join(this.dataDir, WEB_REMOTE_ACCESS_FILE), this.logger);
+        return this.webRemoteAccessState;
+    }
+    /** "Allow connections from outside" is on (an app set up) and this is a web-only fleet. */
+    outsideOn() {
+        return this.isWebOnlyFleet() && (this.webRemoteAccess()?.outside ?? false);
+    }
+    /** The link connections from outside opened, while it is open and still theirs: its exposure. Else null. */
+    outsideLink() {
+        if (!this.outsideOn())
+            return null;
+        const open = this.publicWebLink?.openSignin();
+        return open && isOutsideLinkOwner(open.owner) ? { exposureId: open.exposureId } : null;
+    }
+    /**
+     * The request's live session, asked again each time `current()` is called (its own cookie authenticated anew, the same
+     * handle): this web-only fleet's owner — this computer's admin, on this computer (`hostOnly`), or also signed in from
+     * outside — and web-verified now. Null when it is not (a guest, a LAN session, a chat fleet's admin, nobody).
+     */
+    liveOwner(req, opts) {
+        if (!this.isWebOnlyFleet())
+            return null;
+        if (opts.hostOnly && gatewayRequestContext(req))
+            return null;
+        const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+        if (auth.kind !== "ok")
+            return null;
+        const handle = auth.session.handle, peer = webPeerOf(req), gateway = !!gatewayRequestContext(req);
+        const owner = () => {
+            if (!this.isWebOnlyFleet())
+                return false;
+            const live = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+            if (live.kind !== "ok" || live.session.handle !== handle)
+                return false;
+            if (opts.hostOnly && (live.session.host !== true || peer !== "loopback"))
+                return false;
+            const now = this.webAuthority({ session: live.session, gateway, peer });
+            const a = now.authority.kind === "web-verified" && now.authority.session?.handle === handle ? now.authority.actor : null;
+            return !!a && a.adapter_id === HOST_OPERATOR.adapterId && a.user_id === HOST_OPERATOR.userId;
+        };
+        return owner() ? { label: t("settings_confirm.host_operator_label"), handle, current: owner } : null;
+    }
+    /** Every session signed in from outside ends (and the authorizations kept for them). */
+    endOutsideSessions() {
+        const ended = new Set(this.webSessions?.list(undefined, r => r.remote === "totp").map(r => r.handle) ?? []);
+        if (!ended.size)
+            return;
+        this.sessionAuthorizationStore()?.prune(a => !ended.has(a.handle));
+        const result = this.webSessions?.revokeAll(r => r.remote === "totp");
+        if (result && !result.durable)
+            this.logger.warn("Outside sessions ended, but that could not be saved");
+        this.logger.info({ count: ended.size }, "Sessions signed in from outside ended");
+    }
+    /**
+     * #1939 §10 / #3008: a stored receipt's authority as it reads now — the web authority state, and for this computer's
+     * admin from outside the switch and the last revocation of remote authority (Prism P2 2).
+     */
+    receiptAuthorityNow(stored, state = this.webAuthorityState()) {
+        return authorityNow(stored, { ...state, outside: this.outsideOn(), outsideHandles: this.webRemoteAccess()?.admitted ?? new Set() });
+    }
+    /** #3008 (the sign-in page): this exposure is the outside link, open now. */
+    isOutsideLink(exposureId) {
+        return this.outsideLink()?.exposureId === exposureId;
+    }
+    /** What Settings shows: set up or not, the switch, a wait in force, the link — its address only to this computer. */
+    webOutsideStatus(req) {
+        const store = this.webRemoteAccess(), status = store?.status();
+        const here = !!this.liveOwner(req, { hostOnly: true });
+        const open = this.outsideOn() ? this.publicWebLink?.openSignin() : null;
+        const mine = !!open && isOutsideLinkOwner(open.owner);
+        const linkStatus = this.outsideOn() ? this.getPublicWebStatus() : null;
+        return { webOnly: this.isWebOnlyFleet(), here, enrolled: !!status?.enrolled, enrolledAt: status?.enrolledAt ?? null,
+            outside: this.outsideOn(), pausedForMs: status?.pausedForMs ?? 0,
+            link: linkStatus && linkStatus.state !== "closed" ? { ...linkStatus, ...(here && mine ? { url: open.url } : {}), quick: !publicLinkNamedHostname(this.fleetConfig?.web) } : null };
+    }
+    /** Set up (or set up again): a new secret, shown once to this computer's admin. Null: not them. */
+    webOutsideBeginEnrollment(req) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store)
+            return null;
+        return store.beginEnrollment(owner.handle, hostname() || "fleet");
+    }
+    /** The new app's first code: on "ok" it replaces the old one, whose sessions from outside end. */
+    webOutsideConfirmEnrollment(req, code) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store || !owner.current())
+            return "not_here";
+        const had = store.enrolled;
+        const r = store.confirmEnrollment(owner.handle, code);
+        if (r === "ok") {
+            this.logger.info({ again: had }, "Authenticator app set up for connections from outside");
+            if (had)
+                this.endOutsideSessions();
+        }
+        return r;
+    }
+    /** Forget the app: the switch goes off, the link closes, every session from outside ends. */
+    webOutsideRemove(req) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store || !owner.current())
+            return "not_here";
+        // #3008 review (Prism P2 1): shut at once whatever the disk says; say so when it could not be saved (retried).
+        const saved = store.remove();
+        this.closeOutsideLink("outside removed");
+        this.logger.info({ saved }, "Authenticator app removed; connections from outside off");
+        return saved ? "ok" : "unsaved";
+    }
+    /** The switch. On: needs an app set up; the link opens. Off: it closes and every session from outside ends. */
+    webOutsideSwitch(req, on) {
+        const owner = this.liveOwner(req, { hostOnly: true }), store = this.webRemoteAccess();
+        if (!owner || !store || !owner.current())
+            return "not_here";
+        if (on && !publicLinkSettings(this.fleetConfig?.web).allowed)
+            return "not_allowed";
+        const r = store.setOutside(on);
+        if (r === "not_enrolled")
+            return r;
+        this.logger.info({ on, saved: r === "ok" }, "Connections from outside switched");
+        // #3008 review (Prism P2 1): Off shuts at once even when it could not be saved (the store retries); On opens only
+        // once saved — a switch the disk does not hold would not survive a restart.
+        if (!on)
+            this.closeOutsideLink("outside off");
+        else if (r === "ok")
+            this.openOutsideLink([0, ...OUTSIDE_LINK_RETRY_MS]);
+        return r;
+    }
+    outsideAttempt = null;
+    outsideOpening = false;
+    /**
+     * Open the outside link: an attempt after each delay in turn until one opens (#3008 B: twice more at most — the quick
+     * link's address service limits how often it may be asked). Every attempt asks again: the switch still on, the fleet
+     * running. A final failure: one Notice; the switch stays on, so the next start tries again.
+     */
+    openOutsideLink(delays) {
+        this.outsideAttempt?.cancel();
+        this.outsideAttempt = null;
+        const attempt = (n) => {
+            this.outsideAttempt = null;
+            if (this.shuttingDown || !this.outsideOn() || this.outsideOpening)
+                return;
+            this.outsideOpening = true;
+            // alpha CI 4abe58cd: an On right after an Off finds the old link still closing (its tunnel stopping): wait for that
+            // close, then open — never "busy" and a 30 s retry. The switch is asked again after the wait by openUnattended
+            // itself (permitted → publicOwnerCurrent: the fleet running, the switch on): an Off meanwhile opens nothing.
+            const link = this.getPublicWebLink();
+            void link.whenClosed().then(() => link.openUnattended(OUTSIDE_LINK_OWNER))
+                .catch(() => "failed").then(outcome => {
+                this.outsideOpening = false;
+                if (outcome === "opened") {
+                    this.logger.info({ attempt: n + 1 }, "Outside link opened");
+                    return;
+                }
+                if (outcome === "busy" && this.outsideLink())
+                    return; // already open (ours)
+                if (this.shuttingDown || !this.outsideOn())
+                    return;
+                if (n + 1 < delays.length) {
+                    this.outsideAttempt = outsideTimer(() => attempt(n + 1), delays[n + 1]);
+                    return;
+                }
+                this.logger.warn({ attempts: n + 1 }, "Outside link could not be opened; giving up until the next start or switch");
+                this.recordWebNotice("fleet", t("outside.notice_ended", t("outside.reason_failed")));
+            });
+        };
+        this.outsideAttempt = outsideTimer(() => attempt(0), delays[0] ?? 0);
+    }
+    closeOutsideLink(reason) {
+        this.outsideAttempt?.cancel();
+        this.outsideAttempt = null;
+        const open = this.publicWebLink?.openSignin();
+        if (this.publicWebLink && (!open || isOutsideLinkOwner(open.owner)))
+            void this.publicWebLink.close(reason);
+        this.endOutsideSessions();
+    }
+    /** PublicWebLink.onClose for the outside link: what closed it decides what happens next (#3008 B). */
+    outsideLinkClosed(reason) {
+        if (this.shuttingDown || OUTSIDE_OWN_CLOSES.has(reason) || !this.outsideOn())
+            return;
+        // #3008 review (Prism P2 3): expiry first — its lifetime counts from the opening request, so it can run out while the
+        // opening is still under way: the switch goes off then too, and that attempt's end (outsideOn false) retries nothing.
+        if (reason === "expired") {
+            // Its lifetime ran out: the switch goes off (only this computer turns it on again — a session from outside can't).
+            this.outsideAttempt?.cancel();
+            this.outsideAttempt = null;
+            if (this.webRemoteAccess()?.setOutside(false) === "unsaved")
+                this.logger.warn("Outside link expired; the switch's Off could not be saved yet (retried)");
+            this.endOutsideSessions();
+            this.logger.info("Outside link expired; connections from outside off");
+            this.recordWebNotice("fleet", t("outside.notice_ended", t("outside.reason_expired")));
+            return;
+        }
+        if (this.outsideOpening)
+            return; // that attempt's own failure: its retry
+        // Dropped (the tunnel exited, the gateway failed, the configuration changed): reopened up to twice.
+        this.logger.info({ reason }, "Outside link closed; reopening");
+        this.openOutsideLink(OUTSIDE_LINK_RETRY_MS);
+    }
+    /**
+     * #3008 (auth-api POST /auth/totp): a sign-in through the outside link with the authenticator's code. "ok": the caller
+     * makes the session (SessionRecord.remote) and then calls authorizeOutsideSession. Each wrong code counts; a wait that
+     * starts is a Notice; a code that matches a step just outside the window logs how far this clock seems to be off.
+     */
+    outsideSignIn(exposureId, code) {
+        const link = this.outsideLink(), store = this.webRemoteAccess();
+        if (!link || !store || !exposureId || link.exposureId !== exposureId)
+            return { kind: "closed" };
+        const v = store.verify(code);
+        if (v.kind === "ok")
+            return { kind: "ok" };
+        if (v.kind === "paused")
+            return v;
+        if (v.kind === "not_enrolled")
+            return { kind: "closed" };
+        if (v.kind === "unavailable")
+            return v;
+        if (v.skewSteps !== null)
+            this.logger.warn({ offsetSeconds: v.skewSteps * TOTP_STEP_SECONDS }, "A wrong authenticator code matched a nearby time step: this computer's clock may be off");
+        if (v.paused) {
+            this.logger.warn({ waitMs: v.retryAfterMs }, "Sign-in from outside paused after wrong codes");
+            this.recordWebNotice("fleet", t("outside.notice_paused", outsideDuration(v.retryAfterMs), v.wrong));
+            return { kind: "paused", retryAfterMs: v.retryAfterMs };
+        }
+        return { kind: "wrong" };
+    }
+    /**
+     * #3008: a session just made by outsideSignIn's "ok" is this computer's admin for its authorization's life. False: it
+     * could not be admitted (its handle not saved, #3015 review r3) — the caller ends it.
+     */
+    authorizeOutsideSession(session, peer, label) {
+        const store = this.sessionAuthorizationStore(), link = this.outsideLink();
+        if (!store || session.remote !== "totp" || session.owner || !link || session.exposureId !== link.exposureId)
+            return false;
+        if (!this.webRemoteAccess()?.admit(session.handle)) {
+            this.logger.warn({ handle: session.handle }, "Session from outside not admitted: it could not be saved");
+            return false;
+        }
+        const state = this.webAuthorityState(), now = Date.now(), policy = webAuthorityPolicy(this.fleetConfig?.web);
+        const check = evaluateWebAuthority({
+            session, gateway: true, peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            isAdmin: () => false,
+            authorization: { handle: session.handle, owner: HOST_OPERATOR, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch },
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink, quickLink: state.quickLink }, epoch: state.epoch, now,
+            hostOperator: true, outside: link,
+        });
+        if (check.refusal) {
+            this.logger.info({ handle: session.handle, refusal: check.refusal }, "Session from outside not authorized");
+            return false;
+        }
+        {
+            const live = new Set(this.webSessions?.list(undefined, () => true).map(r => r.handle) ?? []);
+            store.prune(a => a.epoch === state.epoch && now <= Math.min(a.until, a.authorizedAt + policy.maxSessionMs) && live.has(a.handle));
+            const { durable } = store.authorize(session.handle, HOST_OPERATOR, now, state.epoch, now + policy.maxSessionMs, peer);
+            this.logger.info({ handle: session.handle, durable }, "Session from outside authorized (this computer's admin)");
+        }
+        this.recordWebNotice("fleet", t("outside.notice_signed_in", label));
+        return true;
+    }
     authorityStateStore = null;
     /**
      * #1939 §10: the switch, "Only this computer can authorize" and the revocation epoch in force for the configuration as
@@ -16714,6 +17555,10 @@ export class FleetManager {
                     return true;
                 if (session.surface === "local")
                     return false;
+                // #3008 review (Prism P2 4): signed in from outside with the authenticator's code — its opt-in is the outside
+                // switch, not these options (the authority judges it so): it keeps its authorization.
+                if (session.remote === "totp")
+                    return false;
                 const peer = a.peer ?? "named_link";
                 return (!!state.namedLinkClosed && peer === "named_link") || (!!state.quickLinkClosed && peer === "quick_link");
             };
@@ -16863,7 +17708,7 @@ export class FleetManager {
             authorization: s?.owner ? { handle: s.handle, owner: s.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch } : null,
             policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly, namedLink: state.namedLink, quickLink: state.quickLink }, epoch: state.epoch, now,
             // #2910 D1: a host operator's session is never asked about (no account to ask): only a sign-in authorizes it.
-            hostOperator: this.isWebOnlyFleet(),
+            hostOperator: this.isWebOnlyFleet(), outside: this.outsideLink(),
         });
         return r.refusal;
     }
@@ -17221,21 +18066,27 @@ export class FleetManager {
         if (claimed === "consumed")
             return true;
         const { entry: pending, action } = claimed;
+        // #1490 row 27: the lifecycle the button was offered for — a replacement since (removal does not clear prompts) is stale.
+        const current = pending.lifecycleCurrent ?? this.lifecyclePin(pending.instanceName);
         this.eventLog?.insert(pending.instanceName, oom ? "session_oom_action" : "normal_exit_action", { action, userId: data.userId });
         if (action === "ignore") {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("exit.ignored", pending.instanceName));
             return true;
         }
+        if (!current()) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("restart.superseded", this.shownInstanceName(pending.instanceName)));
+            return true;
+        }
         await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("exit.restarting", pending.instanceName));
         try {
-            await this.restartSingleInstance(pending.instanceName, { explicit: true, ...(oom ? { freshStart: action === "fresh", sessionOomRetry: pending.sessionOomRetry,
+            await this.restartSingleInstance(pending.instanceName, { explicit: true, ownerCurrent: current, ...(oom ? { freshStart: action === "fresh", sessionOomRetry: pending.sessionOomRetry,
                     ...(pending.confirmationCurrent ? { recoveryCurrent: pending.confirmationCurrent } : {}) } : {}) });
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("exit.restarted", pending.instanceName), pending.threadId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             this.logger.error({ err, instanceName: pending.instanceName }, "Normal-exit restart failed");
-            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("exit.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show normal-exit restart error"));
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, err instanceof RestartSupersededError ? message : t("exit.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show normal-exit restart error"));
         }
         return true;
     }
@@ -18357,7 +19208,10 @@ export class FleetManager {
         return this.browserBackendSignInsInstance ??= new BrowserBackendSignIns({
             dataDir: this.dataDir, lock: this.loginWindow,
             current: owner => this.browserSignInOwnerCurrent(owner),
-            installed: async () => ONBOARDING_BACKENDS.filter(backend => this.isCliInstalled(backend)),
+            installed: async () => {
+                const found = await Promise.all(ONBOARDING_BACKENDS.map(async (backend) => (await this.isCliInstalledOffLoop(backend)) ? backend : null));
+                return found.filter((backend) => backend !== null);
+            },
             checkAuth: backend => checkAuthStatus(LOGIN_FLOWS[backend].authCheck),
             checkConsoleAuth: () => checkAuthStatus(LOGIN_FLOWS.antigravity.authCheck),
             transport: () => createStructuredSignInTransport(),
@@ -18461,13 +19315,13 @@ export class FleetManager {
      * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
      * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
      */
-    startWebDashboardLogin(backendArg, chat, opts) {
+    async startWebDashboardLogin(backendArg, chat, opts) {
         const wanted = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
         if (isRemovedBackend(wanted))
-            return Promise.resolve(removedBackendMessage(wanted));
+            return removedBackendMessage(wanted);
         const info = BACKEND_INSTALLATION_INFO[wanted];
-        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !this.isCliInstalled(wanted)) {
-            return Promise.resolve(t("login.web_dashboard_not_installed", wanted, info.install));
+        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !(await this.isCliInstalledOffLoop(wanted))) {
+            return t("login.web_dashboard_not_installed", wanted, info.install);
         }
         if (!opts.skipAuthCheck)
             this.recordLoginFlow(wanted, "login", chat.userId);
@@ -18515,8 +19369,10 @@ export class FleetManager {
                 ? removedBackendMessage(backend)
                 : !installed.has(backend)
                     ? (BACKEND_INSTALLATION_INFO[backend] ? t("login.install_by_name", backend) : t("login.install_on_host", backend))
+                    // #2981: one short line in the bare /login list — the full refusal (why, and what to run) is `/login <it>`'s;
+                    // a bare /login used to post Antigravity's whole paragraph to someone who never asked about it.
                     : flow?.remoteLogin === "unsupported"
-                        ? t("login.remote_unsupported_agent_cli", backend, flow.command)
+                        ? t("login.host_only", flow.command)
                         : backend === "opencode" ? t("login.unsupported", backend) : t("login.no_remote_flow", backend)}`).join("\n");
             await chat.adapter.sendText(chat.chatId, guidance, { threadId: chat.threadId })
                 .catch(err => this.logger.warn({ err }, "Failed to post unsupported login guidance"));
@@ -18959,9 +19815,14 @@ export class FleetManager {
         // session only judges that verdict; it does not read the output for URLs or prompts.
         // M-2281 (#2980): no terminal to ask on, low priority, stoppable as a whole, the user's own $SHELL — see
         // unattended-install.ts. A prompt nobody can answer fails at once instead of waiting out the timeout.
+        const shell = (await loginShell()) ?? null;
+        if (!this.loginWindow.isCurrent(claim)) {
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
+        }
         const flow = {
             backend,
-            command: unattendedInstallCommand(info.unattended ?? info.install),
+            command: unattendedInstallCommand(info.unattended ?? info.install, shell),
             successPattern: /$^/,
             timeoutMs: this.installTimeoutMs,
         };
@@ -19005,7 +19866,9 @@ export class FleetManager {
                     return;
                 // The installer may only have added the binary to a profile PATH; a
                 // fresh login shell sees that, the fleet process's PATH may not.
-                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? this.locateInInstallerBinDirs(info);
+                // #3009 (leader, cid-3017-3029-overlap): both lookups off the fleet's main thread — the login shell's own check,
+                // then the installer's own directories through backend-availability's check (a killable child tests each one).
+                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? (await this.locateInstalledBackend(backend));
                 if (handoff.cancelled || this.installHandoff !== handoff)
                     return;
                 if (!installedAt) {
@@ -19097,38 +19960,27 @@ export class FleetManager {
      */
     async locateBinaryOnLoginShell(binary) {
         try {
-            const result = await runOnLoginShell(`command -v ${binary}`);
+            // #3009: the executable-file check runs inside the same login shell (a killable child), never as accessSync/statSync
+            // on the fleet's thread — a path on a filesystem that stopped answering held the whole fleet there.
+            const result = await runOnLoginShell(`p=$(command -v ${binary}) && [ -f "$p" ] && [ -x "$p" ] && printf '%s\n' "$p"`);
             if (result.status !== 0)
                 return null;
             const path = result.stdout.trim().split("\n").pop()?.trim() ?? "";
-            if (!isAbsolute(path))
-                return null;
-            accessSync(path, fsConstants.X_OK);
-            return statSync(path).isFile() ? path : null;
+            return isAbsolute(path) ? path : null;
         }
         catch {
             return null;
         }
     }
     /**
-     * #1092: the binary in one of the directories its own installer installs to,
-     * when no login shell can see it (the installer recorded its PATH in an
-     * interactive-only rc file). The same executable-file check as the login
-     * shell lookup; a symlink to an executable counts, as codex's launcher is one.
+     * #1092: the binary in one of the directories its own installer installs to, when no login shell can see it (the
+     * installer recorded its PATH in an interactive-only rc file) — only those directories (#1092). #3009: through
+     * backend-availability's install-directory check (the one resolveBackendBinary uses): one killable child, never
+     * accessSync/statSync on the fleet's thread. An executable file counts, a symlink to one too (codex's launcher is one).
      */
-    locateInInstallerBinDirs(info) {
-        for (const dir of info.binDirs?.(process.env, homedir()) ?? []) {
-            if (!isAbsolute(dir))
-                continue;
-            const path = join(dir, info.binary);
-            try {
-                accessSync(path, fsConstants.X_OK);
-                if (statSync(path).isFile())
-                    return path;
-            }
-            catch { /* not there */ }
-        }
-        return null;
+    async locateInstalledBackend(backend) {
+        const info = BACKEND_INSTALLATION_INFO[backend];
+        return info ? (await findExecutableIn(info.binary, info.binDirs?.(process.env, homedir()) ?? [])) ?? null : null;
     }
     /** Put an installed binary's directory on the fleet's PATH (#1059), once. */
     adoptBinaryDirectory(binaryPath, backend) {
@@ -19444,20 +20296,26 @@ export class FleetManager {
         if (claimed === "consumed")
             return true;
         const { entry: pending, action } = claimed;
+        // #1490 row 27: the lifecycle the button was offered for — a replacement since (removal does not clear prompts) is stale.
+        const current = pending.lifecycleCurrent ?? this.lifecyclePin(pending.instanceName);
         this.eventLog?.insert(pending.instanceName, "hang_action", { action, userId: data.userId });
         if (action === "wait") {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("hang.waiting", pending.instanceName));
             return true;
         }
+        if (!current()) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("restart.superseded", this.shownInstanceName(pending.instanceName)));
+            return true;
+        }
         await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("hang.restarting", pending.instanceName));
         try {
-            await this.restartSingleInstance(pending.instanceName, { explicit: true });
+            await this.restartSingleInstance(pending.instanceName, { explicit: true, ownerCurrent: current });
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("hang.restarted", pending.instanceName), pending.threadId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             this.logger.error({ err, instanceName: pending.instanceName }, "Hang force-restart failed");
-            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("hang.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show hang restart error"));
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, err instanceof RestartSupersededError ? message : t("hang.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show hang restart error"));
         }
         return true;
     }
@@ -19475,36 +20333,7 @@ export class FleetManager {
         "antigravity": ".agents/AGENTS.md",
         "mock": "CLAUDE.md",
     };
-    static GENERAL_INSTRUCTIONS = `# Fleet Coordinator
-
-You are the fleet coordinator — the central entry point for this AgEnD fleet.
-You route tasks, manage instances, enforce policies, and synthesize results.
-Do NOT modify project files directly — delegate file changes to the project's instance.
-You CAN write code snippets, explain code, and answer technical questions directly.
-
-## Task Routing
-
-- **Handle directly**: no file/exec access needed, answerable from knowledge, ≤2 reasoning steps (Q&A, translation, status queries, code snippets).
-- **Delegate to 1 instance**: scoped to one project/repo, needs file access or execution.
-- **Coordinate multiple**: spans repos, outputs feed each other, or parallel helps (max 3 per task).
-
-Instance discovery: start with list_instances(); follow the guidance in its response. Prefer reuse; never duplicate a running instance.
-
-## Reply Contract
-
-Every final response to the user contains: the result (the actual answer or deliverable) and gaps (anything incomplete — omit if none). Summarize instance reports; omit internal coordination noise.
-
-## After Restart
-
-BEFORE processing any new messages: 1. list_instances() 2. list_teams() 3. list_decisions(). Only then handle requests.
-
-## Playbooks (on-demand skills)
-
-Detailed procedures live in your skills — consult them when the situation comes up rather than from memory:
-- **delegation-playbook** — delegation protocol, loop prevention, parallel vs sequential, result/failure handling, team management, instance configuration tips.
-- **development-workflow** — the fleet-wide code-change policy you enforce when delegating code tasks.
-Plus the operational skills (fleet-health, instance-lifecycle, scheduling, session-management, …).
-`;
+    static GENERAL_INSTRUCTIONS = GENERAL_ROLE_INSTRUCTIONS;
     /** Ensure the general instance has its project instructions file + knowledge */
     ensureGeneralInstructions(workDir, backendName, instanceName) {
         measureSyncWork("fleet.generalInstructions", () => this.ensureGeneralInstructionsSync(workDir, backendName, instanceName));
@@ -19533,6 +20362,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     resolveKnowledgeWorkDir(workDir, backend, instanceName) {
         // Backend resolution may create/normalize the real cwd. Instructions and
         // skills must land where the CLI actually runs, not an assumed path.
+        // Caller pins resolveBackendBinary first so createBackend does not `which`.
         try {
             const resolved = createBackend(backend, join(getAgendHome(), "cli-env"))
                 .resolveWorkingDirectory?.(workDir, instanceName);
@@ -20878,7 +21708,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }));
         const timer = setTimeout(() => this.pendingEffortSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
+        this.pendingEffortSelects.set(nonce, { instanceName: name, instanceCurrent: this.lifecyclePin(name), userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
         try {
             await data.respondChoices(t("effort.menu", this.effortMenuHeader(name)), choices);
         }
@@ -20913,7 +21743,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingEffortSelects.set(nonce, { instanceName, instanceCurrent: this.lifecyclePin(instanceName), userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("effort.menu", this.effortMenuHeader(instanceName)), choices, { threadId });
             const pending = this.pendingEffortSelects.get(nonce);
@@ -20938,6 +21768,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingEffortSelects.get(match[1]);
         if (!pending)
             return true;
+        // #1490 row 27: the menu was for one lifecycle of the instance; stopped, restarted or replaced since, it is stale.
+        if (!pending.instanceCurrent()) {
+            this.pendingEffortSelects.delete(match[1]);
+            clearTimeout(pending.timer);
+            data.ack?.(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName)));
+            await pending.respond(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))).catch(() => { });
+            return true;
+        }
         // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
         // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
@@ -20980,17 +21818,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             let result;
             try {
                 // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
-                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
-                    ? await withSpawnHoldReply(async (text) => {
-                        if (pending.adapter && pending.adapterChatId) {
-                            if (progressMsgId)
-                                await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                result = !pending.instanceCurrent() ? t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))
+                    : this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                        ? await withSpawnHoldReply(async (text) => {
+                            if (pending.adapter && pending.adapterChatId) {
+                                if (progressMsgId)
+                                    await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                                else
+                                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+                            }
                             else
-                                await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
-                        }
-                        else
-                            await pending.respond(text);
-                    }, () => this.applyEffort(pending.instanceName, level)) : t("menu.click_stale");
+                                await pending.respond(text);
+                        }, () => this.applyEffort(pending.instanceName, level, { current: pending.instanceCurrent })) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
@@ -21047,7 +21886,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const choices = this.modelMenuChoices(name, nonce, options, currentModel);
         const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
+        this.pendingModelSelects.set(nonce, { instanceName: name, instanceCurrent: this.lifecyclePin(name), model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
         try {
             await data.respondChoices(t("model.menu", `**${currentDisplay}**`), choices);
         }
@@ -21083,7 +21922,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingModelSelects.set(nonce, { instanceName, instanceCurrent: this.lifecyclePin(instanceName), model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("model.menu", currentDisplay), choices, { threadId });
             const pending = this.pendingModelSelects.get(nonce);
@@ -21256,6 +22095,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingModelSelects.get(match[1]);
         if (!pending)
             return true;
+        // #1490 row 27: the menu was for one lifecycle of the instance; stopped, restarted or replaced since, it is stale.
+        if (!pending.instanceCurrent()) {
+            this.pendingModelSelects.delete(match[1]);
+            clearTimeout(pending.timer);
+            data.ack?.(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName)));
+            await pending.respond(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))).catch(() => { });
+            return true;
+        }
         // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
         // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
@@ -21316,17 +22163,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             let result;
             try {
                 // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
-                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
-                    ? await withSpawnHoldReply(async (text) => {
-                        if (pending.adapter && pending.adapterChatId) {
-                            if (progressMsgId)
-                                await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                result = !pending.instanceCurrent() ? t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))
+                    : this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                        ? await withSpawnHoldReply(async (text) => {
+                            if (pending.adapter && pending.adapterChatId) {
+                                if (progressMsgId)
+                                    await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                                else
+                                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+                            }
                             else
-                                await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
-                        }
-                        else
-                            await pending.respond(text);
-                    }, () => this.applyModel(pending.instanceName, model)) : t("menu.click_stale");
+                                await pending.respond(text);
+                        }, () => this.applyModel(pending.instanceName, model, { current: pending.instanceCurrent })) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
@@ -21423,7 +22271,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * restart backends only read it at launch, so it is persisted and the
      * instance respawns.
      */
-    async applyEffort(instanceName, requested) {
+    async applyEffort(instanceName, requested, opts) {
+        // #1490 row 27 (main): a menu's choice is for the lifecycle it was offered to — asked first and fenced into the restart.
+        if (opts?.current && !opts.current())
+            return t("menu.instance_replaced", this.shownInstanceName(instanceName));
         if (isWindowsInstance(this.fleetConfig?.instances[instanceName]))
             return t("effort.unsupported", this.backendNameForInstance(instanceName));
         const level = requested.trim().toLowerCase();
@@ -21460,10 +22311,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pasteRawToClassicInstance(instanceName, `/effort ${applied}`);
             return `${warn}${t("effort.runtime_success", instanceName, applied)}`;
         }
-        await this.restartSingleInstance(instanceName);
+        await this.restartSingleInstance(instanceName, { ownerCurrent: opts?.current });
         return `${warn}${t("effort.restart_success", instanceName, applied)}`;
     }
-    async applyModel(instanceName, model) {
+    async applyModel(instanceName, model, opts) {
+        // #1490 row 27: a menu's choice is for the lifecycle it was offered to — asked first, after the runtime switch's
+        // await, and fenced into the restart.
+        if (opts?.current && !opts.current())
+            return t("menu.instance_replaced", this.shownInstanceName(instanceName));
         // Reject model names with newlines or control characters: they would be
         // persisted to fleet.yaml and pasted raw into the CLI (P3 from #1490 audit).
         if (/[\x00-\x1f\x7f]/.test(model)) {
@@ -21503,6 +22358,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // #1690: claude-code's runtime switch reports what it came to; the model is saved unless claude was told No.
         if (strategy === "runtime" && backendName === "claude-code") {
             const result = await this.runRuntimeModelSwitch(instanceName, model);
+            if (opts?.current && !opts.current())
+                return t("menu.instance_replaced", this.shownInstanceName(instanceName));
             if (result.outcome === "mismatch")
                 return `${warn}${t("model.switch_mismatch", instanceName, result.shown, model)}`;
             if (result.outcome === "not_sent")
@@ -21523,7 +22380,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
             return `${warn}${t("model.runtime_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
         }
-        await this.restartSingleInstance(instanceName);
+        await this.restartSingleInstance(instanceName, { ownerCurrent: opts?.current });
         return `${warn}${t("model.restart_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
     }
     /** Save an instance's model (fleet.yaml, or its ClassicBot channel). False when neither holds it. */
@@ -22464,6 +23321,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const settingsControlStopped = settingsControl?.close();
         this.publicLinkAutoOpen?.stop();
         const publicStopped = this.publicWebLink?.close("fleet shutdown");
+        this.webRemoteAccessState?.close(); // #3008: an unsaved switch gets its last write
         const sharesStopped = this.officeSharesInstance?.close(); // #2636: every Office share ends, and its tunnel
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
@@ -22502,6 +23360,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         this.eventLoopWatch?.stop();
         this.eventLoopWatch = null;
+        this.stallReporter?.stop();
+        this.stallReporter = null;
         // A login/install window is a dedicated tmux server with its own TTL
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).
@@ -24963,7 +25823,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     if (decision.reason === "no-credential" && req.method === "GET"
                         && String(req.headers.accept ?? "").includes("text/html")
                         && isWebPageNavigation(requestPath)) {
-                        serveSigninPage(res, 401, { webOnly: this.isWebOnlyFleet() });
+                        const link = gatewayRequestContext(req);
+                        serveSigninPage(res, 401, { webOnly: this.isWebOnlyFleet(), outside: !!link && this.isOutsideLink(link.exposureId) });
                         return;
                     }
                     res.writeHead(decision.status);
@@ -25618,6 +26479,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             return {
                 name,
+                general_topic: nativeConfig?.general_topic === true,
                 ...(isNativePaneInstance(nativeConfig) ? { runtime: "windows", native_adapter: "pane", native_agent_id: nativeConfig.native_agent_id,
                     ...(() => {
                         try {
@@ -25655,6 +26517,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 role: identity.role || undefined,
                 tags: identity.tags,
                 teams: instanceTeams(this.fleetConfig?.teams, name), // #2172: the sidebar groups a team's members under it
+                // #3008 G2: a web-only fleet's General (the agent its owner ticked) — the sidebar pins it first.
+                ...(this.isWebOnlyFleet() && this.fleetConfig?.instances[name]?.general_topic === true ? { general: true } : {}),
                 last_reply: this.webChatHistory.lastAgentReply(name) ?? undefined, // #2179: its last reply to a person (ISO)
                 // #2855: its last reply that reached the channel — the only reply time a guest's sidebar gets (guestStatus).
                 last_reply_channel: this.webChatHistory.lastAgentReply(name, { channel: true }) ?? undefined,