openmausbot 0.1.81 → 0.1.83

package/dist-server/server/index.js

@@ -2,7 +2,7 @@
 // (upstream rule): the React app dispatches typed commands over HTTP and
 // folds one SSE event stream; every provider process runs here.
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, rmSync, unlinkSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { rm as removeDirectory } from "node:fs/promises";
 import { createServer } from "node:http";
 import { extname, join } from "node:path";
@@ -16,7 +16,7 @@ import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
 import { approvalModeFor, supportsApprovalMode, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval } from "./auto-approve.js";
+import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
@@ -31,15 +31,17 @@ import { groupTurnCwd } from "./room-cwd.js";
 import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import * as box from "./box.js";
 import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
+import { isEffortLevel } from "../shared/wire.js";
 import { boxCreateRecoverySnapshot, retireDeletedBoxCreate } from "./box-create-idempotency.js";
 import { boxDeletionSnapshot } from "./box-delete-journal.js";
 import { boxAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
-import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
+import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, threadEventLogMaxBytes, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, } from "./config.js";
+import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
@@ -51,7 +53,7 @@ import { entitled } from "./enterprise.js";
 import { HOSTED_CONTRACT_HEADER, HOSTED_CONTRACT_METADATA, HOSTED_CONTRACT_VERSION } from "./hosted-contract.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
 import { blockedTarget, buildNotification } from "./notify.js";
-import { isEffortLevel, isModelVariant, newId, } from "./contracts.js";
+import { isModelVariant, newId, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { decodeGeneratedImage } from "./generated-image.js";
 import { MAX_MCP_SERVERS, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
@@ -67,8 +69,8 @@ import { parseSince, recentWork, recentWorkPrompt, turnOutcomeLine } from "./rec
 const SESSION_READ_MAX_CHARS = 8_000;
 import { promptWithReply, transcriptText } from "./replies.js";
 import { _loadPending, buildDelegationFailurePrompt, buildDelegationRevivalPrompt, DELEGATION_TTL_MS, DelegationWakeBudget, discardDelegations, drainDelegations, expireStaleDelegations, findDelegationReceipt, pendingDelegationInfo, pendingDelegationSnapshot, pendingThreads, queueDelegation, recordDelegationReceipt, releaseDelegationsWaitingOn, summarizeDelegatedActivity } from "./delegations.js";
-import { cancelSteeredMessage, drainSteeredMessages, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreSteeredMessages, } from "./steer-queue.js";
-import { cancelChannelMessage, drainChannelMessages, queuedChannelMessage, queueChannelMessage, restoreChannelMessages, } from "./channel-queue.js";
+import { cancelSteeredMessage, drainSteeredMessages, holdSteeredQueue, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
+import { cancelChannelMessage, drainChannelMessages, holdChannelQueue, queuedChannelMessage, queueChannelMessage, restoreChannelMessages, restoreHeldChannelQueue, resolveHeldReplyTarget, settleHeldChannelQueueHead, } from "./channel-queue.js";
 import { acceptedSendMatch, parseSendId, sendFingerprint, SendSequencer, } from "./send-idempotency.js";
 import { EventBus } from "./harness/bus.js";
 import { ProviderRegistry } from "./harness/registry.js";
@@ -77,10 +79,10 @@ import { selectDefaultModelSelection } from "./default-model-selection.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
 import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
-import { isProjectEmoji, mentionedBots, roomResponders, sectionKey, Store, } from "./store.js";
+import { isProjectEmoji, mentionedBots, roomResponders, sectionKey, Store, toWireTask, } from "./store.js";
 import * as tts from "./tts/index.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
-import { buildRecoveryText, buildTurnContext, engineIsFresh } from "./turn-context.js";
+import { buildRecoveryText, buildTurnContext, engineIsFresh, peerMessageText } from "./turn-context.js";
 import { extractTurnImages } from "./turn-images.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
 import { TurnResources, workspaceResource } from "./turn-resources.js";
@@ -135,6 +137,7 @@ import { createTeamBackup, importTeamBackup } from "./team-backup.js";
 import { MAX_TEAM_BACKUP_BYTES } from "../shared/team-backup.js";
 import { shouldMountLocalComputer } from "./local-routing.js";
 import { autoLocalVmAttachable } from "./container-computer.js";
+import { startAutoVmClaim } from "./auto-vm-claims.js";
 import { modelContextWindow } from "./model-context-window.js";
 import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
@@ -603,6 +606,8 @@ function claimTurnResource(owner, resource) {
 function releaseTurnResources(owner) {
     if (!owner)
         return;
+    if (autoVmClaims.get(owner.threadId)?.owner.generation === owner.generation)
+        autoVmClaims.delete(owner.threadId);
     if (settlingResourceOwners.get(owner.threadId) === owner.generation)
         settlingResourceOwners.delete(owner.threadId);
     turnResources.release(owner);
@@ -616,9 +621,39 @@ function releaseTurnResources(owner) {
         teamComputerTurns.delete(owner.threadId);
     }
 }
-function bindTurnComputer(owner, resource, exclusive = false) {
-    if (exclusive && !claimTurnResource(owner, resource)) {
-        throw Object.assign(new Error("another thread is using this computer — wait for it to finish"), { status: 409, code: "computer_busy" });
+async function bindTurnComputer(owner, resource, exclusive = false) {
+    const active = () => activeInternalGenerationByThread.get(owner.threadId) === owner.generation &&
+        turnResourceOwners.get(owner.threadId)?.generation === owner.generation;
+    let waitingMessage;
+    const deadline = Date.now() + GROUP_GOAL_WAIT_MAX_MS;
+    try {
+        while (true) {
+            if (!active())
+                throw new DirectTurnSetupCancelled("Computer wait cancelled");
+            if (!exclusive || claimTurnResource(owner, resource))
+                break;
+            if (!waitingMessage) {
+                const blocker = turnResources.blocker(resource, owner);
+                const holderBot = blocker && store.botByThread(blocker.threadId);
+                const holderTask = holderBot && blocker && store.taskByThread(holderBot.id, blocker.threadId);
+                const holder = holderBot ? `${holderBot.name}${holderTask?.title ? ` / ${holderTask.title}` : ""}`
+                    : blocker && store.groupByThread(blocker.threadId)?.name;
+                waitingMessage = store.appendMessage(owner.threadId, {
+                    role: "bot", kind: "activity",
+                    tool: { name: `Waiting for computer${holder ? ` — ${holder} is using it` : ""}; will continue automatically` },
+                    ...(holderBot && holderTask ? { threadRef: { botId: holderBot.id, threadId: holderTask.threadId, title: holderTask.title } } : {}),
+                });
+            }
+            if (Date.now() >= deadline)
+                throw new Error("Computer is still busy. Stop the turn using it, then retry.");
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+    }
+    finally {
+        if (waitingMessage)
+            store.patchMessage(owner.threadId, waitingMessage.id, {
+                tool: { name: active() && turnResources.owns(resource, owner) ? "Computer available — continuing" : "Computer wait ended", ok: true },
+            });
     }
     turnResourceOwners.set(owner.threadId, owner);
     turnComputerResources.set(owner.threadId, { owner, resource });
@@ -646,6 +681,14 @@ function botAtThreadCapacity(botId) {
 function hasDirectDispatch(botId) {
     return [...directTurnDispatchClaims.values()].some((claim) => claim.botId === botId);
 }
+/** Routine and webhook dispatch shares startTurn's admission preconditions
+ * instead of waiting for whole-bot idleness: a free thread slot and no
+ * active group turn. A group turn blocks scheduled starts the same way it
+ * blocks every other turn kind; it does not consume a capacity slot. */
+function unattendedDispatchState(botId) {
+    const bot = store.bot(botId);
+    return !bot ? "missing" : botAtThreadCapacity(botId) || activeGroupTurnForBot(botId) ? "busy" : "ready";
+}
 function requestedTaskBot(botId, rawThreadId) {
     const profile = store.bot(botId);
     if (!profile)
@@ -1235,7 +1278,9 @@ if (browserCleanupReferencesReconciled)
  * than the desktop window did. Stripped here rather than at each call site
  * so a new broadcast cannot forget. */
 let activeCoordinationForThread = (_threadId) => false;
-const wireTask = ({ resumeCursors: _resumeCursors, lastInstanceId: _lastInstanceId, ...task }) => activeCoordinationForThread(task.threadId) && !task.busy ? { ...task, busy: true, activity: "working" } : task;
+const wireTask = (task) => activeCoordinationForThread(task.threadId) && !task.busy
+    ? { ...toWireTask(task), busy: true, activity: "working" }
+    : toWireTask(task);
 const wireBot = (bot) => {
     const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, ...rest } = bot;
     // An elevated selection is inert until the desktop confirms its exact
@@ -1403,7 +1448,10 @@ async function botOverview(bot) {
  * approval semantics require an implemented provider mapping. The trusted transition enforces
  * this too, but no provider dispatch or later permission callback relies on
  * persistence having been produced exclusively by that route. Delegation
- * uses the receiving bot's grant, never the sender's — see approvalModeForOrigin. */
+ * uses the receiving bot's grant, never the sender's (approvalModeForOrigin) —
+ * with one deliberate exception: a Chief of Staff with Full access makes the
+ * threads it delegates Full too (delegatedFullAccess), so the grant the
+ * person gave the Chief covers the work the Chief hands out. */
 const approvalModeForTurn = (bot, peerInitiated = false) => {
     const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
     if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
@@ -1424,6 +1472,48 @@ function fullAccessForSource(botId, threadId) {
 function peerReviewRequired(bot, threadId) {
     return Boolean(bot.approvePeerComms && !fullAccessForSource(bot.id, threadId));
 }
+/** Full access flows down a Chief of Staff's delegation. The person gave the
+ * Chief Full access so its work runs without prompts; a teammate stopping
+ * that same work to ask defeats the grant — and in practice the person was
+ * answering every one of those cards, all day, for the whole team. So a
+ * teammate a Full-access Chief delegates to runs Full for that work: the
+ * recipient switches, whatever its own level says. The recipient's engine
+ * has to implement Full (supportsApprovalMode); otherwise the work keeps the
+ * recipient's own level, as before. Only a Chief passes access on — an
+ * ordinary bot's delegation still uses the recipient's setting. */
+function delegatedFullAccess(from, fromThreadId, target) {
+    return delegationInheritsFullAccess({
+        senderIsChief: Boolean(from.chiefOfStaff),
+        senderHasFullAccess: fullAccessForSource(from.id, fromThreadId),
+        sameBot: from.id === target.id,
+        recipientDriverKind: registry.cliTarget(target.modelSelection.instanceId)?.driverKind,
+    });
+}
+/** Make a delegated thread Full and say so in it once, so the level the
+ * chip shows and the level the turns run at agree, and the person can see
+ * where the access came from. Idempotent: a pair conversation is reused
+ * across delegations and must not collect a chip per request. */
+function grantDelegatedFullAccess(from, target, threadId) {
+    if (store.taskByThread(target.id, threadId)?.approvalMode === "full")
+        return;
+    store.patchTask(target.id, threadId, { approvalMode: "full", autoApprove: false, alwaysAllow: [] });
+    store.appendMessage(threadId, {
+        role: "bot",
+        kind: "activity",
+        tool: { name: `Full access — delegated by ${from.name}, a Chief of Staff with Full access`, ok: true },
+    });
+}
+/** A room member's level for one turn. Work a Full-access Chief hands out
+ * in a room runs Full for that turn: the room thread is shared, so the
+ * level is not stored on it — it rides the handoff. */
+function roomTurnApprovalMode(bot, orchestration) {
+    const handoff = orchestration?.roomHandoffId ? roomHandoffs.nodes.get(orchestration.roomHandoffId) : undefined;
+    const source = handoff?.parentId ? roomHandoffs.nodes.get(handoff.parentId) : undefined;
+    const from = source ? store.bot(source.botId) : undefined;
+    if (from && source && delegatedFullAccess(from, source.threadId, bot))
+        return "full";
+    return approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId));
+}
 /** Privileged approval-mode transitions are deliberately absent from the
  * loopback HTTP authority model: a bot with shell access can curl that
  * surface itself. Only Electron's private utility-process channel can deliver
@@ -2230,7 +2320,7 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
         await tracked;
         return { ok: result.outcome === "settled", text: result.stopReason || result.replyText || result.outcome || "The addressed agent could not run" };
     },
-});
+}, Date.now, roomHandoffLimits(cfg));
 activeCoordinationForThread = threadId => roomHandoffs.activeDirect(threadId);
 function publicGroupState(group) {
     return { ...group, working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)) };
@@ -2943,10 +3033,12 @@ const watchdog = new TurnWatchdog({
                 groupSpeakers.delete(turn.threadId);
                 store.patchGroup(group.id, { busyBotId: null, unread: true });
             }
+            // A cleared UI busy flag must not strand this finished generation's
+            // computer claim. The generation checks above protect replacements.
+            releaseTurnResources(stalledResourceOwner);
             const currentBot = store.bot(turn.botId);
             if (currentBot?.busy) {
                 stopScreenPoller(currentBot.id, turn.threadId);
-                releaseTurnResources(stalledResourceOwner);
                 if (activeVpsThreads.get(currentBot.id) === turn.threadId)
                     activeVpsThreads.delete(currentBot.id);
                 if (store.taskByThread(currentBot.id, turn.threadId))
@@ -3120,6 +3212,15 @@ const localVmLeases = new LocalVmLeasePool(30 * 60_000);
 const localVmLifecycleBusy = new Set();
 const localVmThreadTargets = new Map();
 const localVmActiveThreads = new Map();
+// Lazy Auto-VM claims (issue #1361): a thread whose auto-resolved Local VM
+// attach deferred the exclusive claim registers here so the first screen
+// tools/call gate can fire it. Dispatch claims eagerly today, so entries
+// exist only as a no-op handoff to the gate.
+const autoVmClaims = new Map();
+/** How long the computer-control gate lets a lazy claim land before it
+ * answers held. A free, ready VM claims in the time of one container
+ * inspect; only a claim queued behind another holder outlives this. */
+const LAZY_VM_CLAIM_GRACE_MS = 5_000;
 /** Local VM targets this process has seen ready or recreatable — at boot, in
  * the inventory, or in a turn. Auto probes the container runtime for a VM
  * only when one of these exists, so an ordinary Auto turn on a machine with
@@ -3223,12 +3324,12 @@ async function attachTeamBox(computer, botId, owner, canMount, remoteAgent) {
         throw new Error("The team computer is being changed; wait for it to finish");
     if (computerControl.snapshot(ownerId).held)
         throw new Error("Release human control of the team computer before starting another turn");
-    bindTurnComputer(owner, `computer:box-bot:${ownerId}`, true);
+    await bindTurnComputer(owner, `computer:box-bot:${ownerId}`, true);
     teamComputerTurns.set(owner.threadId, { owner, computerId: computer.id, botId, remoteAgent });
     let machine = await box.findBox(cfg, ownerId);
     if (!machine)
         throw new Error("The team's Box computer is missing; explicitly create or retry it from the Team map");
-    bindTurnComputer(owner, `computer:box:${machine.id}`, true);
+    await bindTurnComputer(owner, `computer:box:${machine.id}`, true);
     const action = box.boxTurnLifecycleAction({ explicitCloud: true, canMount: true, state: typeof machine.state === "string" ? machine.state : null });
     if (action === "wake")
         machine = await box.readyBox(cfg, ownerId);
@@ -3545,6 +3646,10 @@ function localVmIdleFor(target) {
     return idle;
 }
 function releaseLocalVmThread(threadId) {
+    // Covers lazy claims too (issue #1361): every settle path funnels through
+    // here or through releaseTurnResources, so a turn that ends before its
+    // first screen call leaves no claim slot behind.
+    autoVmClaims.delete(threadId);
     const target = localVmThreadTargets.get(threadId);
     if (!target)
         return;
@@ -4975,6 +5080,17 @@ async function startTurn(botId, text, opts) {
     // branch only — abandoned forks never reach the model
     const skipTranscript = new Set([userMessage.id, ...(opts?.excludeMessageIds ?? [])]);
     const activeMessages = store.activePath(threadId);
+    // This turn's own text carries the addressed request and, when resuming,
+    // every child result as JSON: neither is repeated from the transcript.
+    const coordinationChildren = opts?.coordination?.resumed
+        ? new Set(roomHandoffs.children(opts.coordination.id).map((child) => child.id)) : undefined;
+    for (const m of activeMessages) {
+        if (!opts?.coordination || !m.roomRequest)
+            continue;
+        if ((m.roomRequest.phase === "request" && m.roomRequest.id === opts.coordination.id) ||
+            (m.roomRequest.phase === "result" && coordinationChildren?.has(m.roomRequest.id)))
+            skipTranscript.add(m.id);
+    }
     // A flat reply may deliberately point across a fork in the same thread.
     // Resolve its quote from full storage, while the replay itself remains
     // strictly limited to the selected branch below.
@@ -4985,7 +5101,8 @@ async function startTurn(botId, text, opts) {
         .map((m) => ({
         role: m.role === "user" ? "user" : "assistant",
         text: m.roomRequest?.phase === "result" ? teammateReportContext(m.roomRequest.id, bot.id)
-            : transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"),
+            : m.role !== "user" && m.from ? peerMessageText(m.from.name, transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"))
+                : transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"),
     }));
     // After a rewind (edit / branch switch) the provider's native session
     // still contains the abandoned branch: start a fresh session instead of
@@ -5183,6 +5300,79 @@ async function startTurn(botId, text, opts) {
             let browserCapture = null;
             let computerKind = null;
             let autoVpsProblem = null;
+            /** The Local VM frame capture for the poller and the settled transcript
+             * screenshot. The shared desktop outlives the turn: once another thread
+             * owns it, a capture still in flight would picture ITS work under this
+             * bot's name — live and in the settled frame, which is taken after the
+             * lease is already released. No owner means the desktop is simply
+             * idle: that final frame is ours to keep. */
+            const localVmPreviewFor = (localVmTarget, claimThreadId) => () => {
+                const owner = localVmLeaseFor(localVmTarget).current(localVmOwnerBusy);
+                if (owner && owner.threadId !== claimThreadId) {
+                    throw new Error("the Local VM moved on to another turn");
+                }
+                return containerComputerFrame(undefined, undefined, localVmTarget);
+            };
+            /** The exclusive Local VM claim sequence, verbatim from the old inline
+             * attach path, shared by dispatch (eager) and the first-screen-call
+             * gate (issue #1361). Idempotent per turn: the resource claim and the
+             * lease both re-assert the same owner, so a re-entrant call from the
+             * gate no-ops once dispatch has already claimed. A lazy attach pins
+             * the target it mounted the tools against: the claim must lease that
+             * desktop, not whatever localVmTargetForBot resolves to by the time
+             * the first screen call arrives. */
+            const claimAutoLocalVm = async (claimThreadId, pinnedTarget) => {
+                const localVmTarget = pinnedTarget ?? localVmTargetForBot(bot.id);
+                await bindTurnComputer(resourceOwner, `computer:vm:${localVmTarget.key}`, true);
+                if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key)) {
+                    throw new Error("this Local VM is being started, stopped, or replaced — wait for setup to finish");
+                }
+                // Claim before the first await. The lifecycle route performs its
+                // matching check synchronously, so neither side can enter while the
+                // other is between inspection and mutation.
+                if (!localVmLeaseFor(localVmTarget).claim(claimThreadId, bot.id, localVmOwnerBusy)) {
+                    throw new Error("this Local VM is already being used by another turn — wait for that turn to finish");
+                }
+                localVmThreadTargets.set(claimThreadId, localVmTarget);
+                localVmActiveThreads.set(localVmTarget.key, claimThreadId);
+                localVmIdleFor(localVmTarget).touch();
+                // The lease is held from here. An eager attach that fails below
+                // fails the turn and settle releases it; a lazy claim's rejection is
+                // swallowed into the slot's failed flag and the turn carries on, so
+                // without this the exclusive lease would sit held for the rest of a
+                // turn that never got the VM — the very serialisation #1361 removes.
+                const dropLease = () => {
+                    localVmLeaseFor(localVmTarget).release(claimThreadId);
+                    if (localVmActiveThreads.get(localVmTarget.key) === claimThreadId)
+                        localVmActiveThreads.delete(localVmTarget.key);
+                    localVmThreadTargets.delete(claimThreadId);
+                    // bindTurnComputer above also took the turn-level resource; a
+                    // later turn's exclusive bind queues behind it just the same.
+                    const resource = `computer:vm:${localVmTarget.key}`;
+                    turnResources.releaseOne(resource, resourceOwner);
+                    if (turnComputerResources.get(resourceOwner.threadId)?.resource === resource)
+                        turnComputerResources.delete(resourceOwner.threadId);
+                };
+                let localVm;
+                try {
+                    localVm = await readyLocalVmForTurn(bot.id, localVmTarget);
+                }
+                catch (error) {
+                    dropLease();
+                    throw error;
+                }
+                if (!localVm.ready || !localVm.runtime) {
+                    dropLease();
+                    throw new Error(`${localVm.problem ?? "the Local VM is not ready"} (App Settings → Computers)`);
+                }
+                // Same contract as the Box and VPS branches below: without this the
+                // poller never starts, so the Local VM publishes no `screen` events
+                // and every client that only has the stream (the phone) waits
+                // forever. The web panel hid the gap by polling the screenshot
+                // route itself.
+                previewCapture = localVmPreviewFor(localVmTarget, claimThreadId);
+                return { target: localVmTarget, runtime: localVm.runtime };
+            };
             // Explicit destinations are strict. In particular, Local VM must never
             // fall through to host CUA and accidentally click on the user's Mac.
             // The Local VM attach, shared by explicit "Local VM" and by Auto. Explicit
@@ -5197,6 +5387,7 @@ async function startTurn(botId, text, opts) {
                     throw new Error("this model engine cannot use the Local VM — choose Claude or an ACP engine, or select another computer destination");
                 }
                 const localVmTarget = localVmTargetForBot(bot.id);
+                let lazyReadyVm = null;
                 if (!strict) {
                     // Nothing this process has ever seen for this target, and nobody is
                     // relying on an unattended run: do not pay for a runtime probe.
@@ -5207,43 +5398,50 @@ async function startTurn(botId, text, opts) {
                         return false;
                     if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key))
                         return false;
+                    if (seen.ready && seen.runtime)
+                        lazyReadyVm = { runtime: seen.runtime };
                 }
                 try {
-                    bindTurnComputer(resourceOwner, `computer:vm:${localVmTarget.key}`, true);
-                    if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key)) {
-                        throw new Error("this Local VM is being started, stopped, or replaced — wait for setup to finish");
-                    }
-                    // Claim before the first await. The lifecycle route performs its
-                    // matching check synchronously, so neither side can enter while the
-                    // other is between inspection and mutation.
-                    if (!localVmLeaseFor(localVmTarget).claim(threadId, bot.id, localVmOwnerBusy)) {
-                        throw new Error("this Local VM is already being used by another turn — wait for that turn to finish");
-                    }
-                    localVmThreadTargets.set(threadId, localVmTarget);
-                    localVmActiveThreads.set(localVmTarget.key, threadId);
-                    localVmIdleFor(localVmTarget).touch();
-                    const localVm = await readyLocalVmForTurn(bot.id, localVmTarget);
-                    if (!localVm.ready || !localVm.runtime) {
-                        throw new Error(`${localVm.problem ?? "the Local VM is not ready"} (App Settings → Computers)`);
+                    if (lazyReadyVm) {
+                        // Lazy exclusivity (issue #1361): a VM that is ready right now
+                        // mounts without claiming — screen-less Auto turns never touch
+                        // the lease, and the first screen tools/call fires the claim
+                        // through the computer-control gate. A VM that must be created
+                        // or recreated first keeps the eager claim below: the bridge
+                        // child needs the container to exist, and readyLocalVmForTurn
+                        // is what boots it.
+                        integrations.localComputer = containerComputerMcp(lazyReadyVm.runtime, controlIntegration(bot.id, threadId, dispatchClaimId), localVmTarget);
+                        autoVmClaims.set(threadId, {
+                            owner: resourceOwner,
+                            lazy: true,
+                            claim: async () => {
+                                await claimAutoLocalVm(threadId, localVmTarget);
+                                // The dispatch-site poller start saw a null previewCapture
+                                // (this lazy mount runs before any claim exists), so this
+                                // turn would publish no live `screen` events and settle no
+                                // final computer frame. Restart the poller with the now-live
+                                // computer capture, keeping any browser capture and whether
+                                // this turn already touched its screen. Same still-running
+                                // guard as dispatch: a poller started after its own
+                                // turn.completed would never be torn down.
+                                if (previewCapture && threadBusy(bot.id, threadId)) {
+                                    const touched = screenPollers.get(threadId)?.touched ?? instance.driverKind === "boxAgent";
+                                    stopScreenPoller(bot.id, threadId);
+                                    startScreenPoller(bot.id, threadId, { computer: previewCapture, ...(browserCapture ? { browser: browserCapture } : {}) }, { screenIsTheWork: touched });
+                                }
+                            },
+                        });
+                        return true;
                     }
-                    integrations.localComputer = containerComputerMcp(localVm.runtime, controlIntegration(bot.id, threadId, dispatchClaimId), localVmTarget);
-                    // Same contract as the Box and VPS branches below: without this the
-                    // poller never starts, so the Local VM publishes no `screen` events
-                    // and every client that only has the stream (the phone) waits
-                    // forever. The web panel hid the gap by polling the screenshot
-                    // route itself.
-                    previewCapture = () => {
-                        // The shared desktop outlives the turn. Once another thread owns
-                        // it, a capture still in flight would picture ITS work under this
-                        // bot's name — live and in the settled transcript frame, which is
-                        // taken after the lease is already released. No owner means the
-                        // desktop is simply idle: that final frame is ours to keep.
-                        const owner = localVmLeaseFor(localVmTarget).current(localVmOwnerBusy);
-                        if (owner && owner.threadId !== threadId) {
-                            throw new Error("the Local VM moved on to another turn");
-                        }
-                        return containerComputerFrame(undefined, undefined, localVmTarget);
-                    };
+                    const claimed = await claimAutoLocalVm(threadId);
+                    integrations.localComputer = containerComputerMcp(claimed.runtime, controlIntegration(bot.id, threadId, dispatchClaimId), claimed.target);
+                    // Hand the same claim to the first-screen-call gate. This eager
+                    // path has already claimed, so the gate's fire-once call can only
+                    // re-assert the same owner — a no-op (issue #1361).
+                    autoVmClaims.set(threadId, {
+                        owner: resourceOwner,
+                        claim: async () => { await claimAutoLocalVm(threadId); },
+                    });
                     return true;
                 }
                 catch (error) {
@@ -5263,12 +5461,16 @@ async function startTurn(botId, text, opts) {
                     hostPlatform: process.platform,
                     providerSupportsLocal: mountsLocalComputer,
                 })) {
-                    throw new Error("this model engine cannot control this computer — choose Claude or an ACP engine, or select another destination");
+                    // Name the condition that actually failed: a person told "choose an
+                    // ACP engine" while already on one has nowhere to go.
+                    throw new Error(mountsLocalComputer
+                        ? `local computer control is not available on ${process.platform} — select another destination`
+                        : "this model engine cannot control this computer — choose Claude or an ACP engine, or select another destination");
                 }
                 const cua = readCuaConnection();
                 if (!cua)
                     throw new Error("CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
-                bindTurnComputer(resourceOwner, "computer:host");
+                await bindTurnComputer(resourceOwner, "computer:host");
                 integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId));
                 computerKind = "local";
             }
@@ -5284,7 +5486,7 @@ async function startTurn(botId, text, opts) {
                 if (!unsupported) {
                     // The remote lifecycle and container are shared by this bot. Keep
                     // its explicit computer turns serialized; ordinary threads still run.
-                    bindTurnComputer(resourceOwner, `computer:vps:${vpsSshAlias(cfg)}:${bot.id}`, true);
+                    await bindTurnComputer(resourceOwner, `computer:vps:${vpsSshAlias(cfg)}:${bot.id}`, true);
                     activeVpsThreads.set(bot.id, threadId);
                     let remote;
                     remote = vps.vpsStartsForTurn({ wants, autoStartVps: bot.autoStartVps, automationSource: opts?.automationSource })
@@ -5322,7 +5524,7 @@ async function startTurn(botId, text, opts) {
                 // Explicit cloud turns can provision/wake the same bot's Box. Claim
                 // before any network await so setup itself cannot race another turn.
                 if (wants === "cloud")
-                    bindTurnComputer(resourceOwner, `computer:box-bot:${bot.id}`, true);
+                    await bindTurnComputer(resourceOwner, `computer:box-bot:${bot.id}`, true);
                 if (!mountsCloudComputer && wants === "cloud") {
                     throw new Error("this model engine cannot use computer tools — choose Claude, an ACP engine, or the Computer engine");
                 }
@@ -5366,7 +5568,7 @@ async function startTurn(botId, text, opts) {
                     });
                 }
                 if (b && lifecycle === "attach") {
-                    bindTurnComputer(resourceOwner, `computer:box:${b.id}`, instance.driverKind === "boxAgent");
+                    await bindTurnComputer(resourceOwner, `computer:box:${b.id}`, instance.driverKind === "boxAgent");
                     previewCapture = () => box.screenshotBox(cfg, bot.id, b.id);
                     if (mountsCloudComputer) {
                         integrations.computer = {
@@ -5407,7 +5609,7 @@ async function startTurn(botId, text, opts) {
                 })) {
                 const cua = readCuaConnection();
                 if (cua) {
-                    bindTurnComputer(resourceOwner, "computer:host");
+                    await bindTurnComputer(resourceOwner, "computer:host");
                     integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId));
                     computerKind = "local";
                 }
@@ -5771,6 +5973,8 @@ function routineRunCard(run) {
     };
     if (run.goalStatus)
         card.goalStatus = run.goalStatus;
+    if (run.deferredAt != null && run.status === "queued")
+        card.deferredAt = run.deferredAt;
     if (run.threadId)
         card.executionThreadId = run.threadId;
     if (summary)
@@ -5801,7 +6005,9 @@ function routineRunFallbackText(card) {
                     ? "was cancelled"
                     : card.status === "missed"
                         ? "was missed"
-                        : card.status);
+                        : card.status === "queued" && card.deferredAt != null
+                            ? "deferred: target busy"
+                            : card.status);
     return `Routine “${card.routineName}” ${state}`;
 }
 /** Upsert one durable lifecycle card per run. Replaying the same transition,
@@ -5922,10 +6128,7 @@ routines = new RoutineManager({
     hasPendingDelegations: (threadId) => pendingThreads().includes(threadId) ||
         [...delegationWatch.values()].some((watch) => watch.sourceThreadId === threadId) ||
         pendingDelegationWakes.has(threadId),
-    botState: (botId) => {
-        const bot = store.bot(botId);
-        return !bot ? "missing" : bot.busy ? "busy" : "ready";
-    },
+    botState: unattendedDispatchState,
     goalState: (groupId, coordinatorBotId) => {
         const group = store.group(groupId);
         const coordinator = store.bot(coordinatorBotId);
@@ -6005,6 +6208,17 @@ routines = new RoutineManager({
         const notificationBot = routineSourceOwner(run)?.bot ?? bot;
         notify(buildNotification("routine-failed", notificationBot, routineSourceThread(run) ?? run.threadId ?? bot.threadId, detail));
     },
+    onRunDeferred: (run) => {
+        const bot = store.bot(run.botId);
+        if (!bot)
+            return;
+        const minutes = run.deferredAt != null && run.deferredNoticeAt != null
+            ? Math.max(1, Math.round((run.deferredNoticeAt - run.deferredAt) / 60_000))
+            : null;
+        const detail = `${redactSecretsInText(run.routineName)}: target busy${minutes != null ? ` for ${minutes} minutes` : ""}`;
+        const notificationBot = routineSourceOwner(run)?.bot ?? bot;
+        notify(buildNotification("routine-deferred", notificationBot, routineSourceThread(run) ?? bot.threadId, detail));
+    },
 });
 // The scheduler receipt and room transcript live in separate durable stores.
 // If the process exited between those two writes, prefer the correlated
@@ -6295,12 +6509,6 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
             const acknowledged = await browserCleanup.ensure(committedCleanup);
             requireBrowserCleanupAcknowledged(acknowledged, `Browser data for ${bot.name}`);
         }
-        for (const dir of [EVENTS_DIR, NATIVE_DIR]) {
-            try {
-                unlinkSync(join(dir, `${bot.threadId}.ndjson`));
-            }
-            catch { }
-        }
         return deletionResponse(200, { ok: true });
     }
     finally {
@@ -6609,10 +6817,7 @@ function resolveAndSendProfile(res, args) {
 // ordered behind a busy MAUS and gives webhook runs the same durable receipts.
 const webhooks = new WebhookManager({
     emit: broadcast,
-    botState: (botId) => {
-        const bot = store.bot(botId);
-        return !bot ? "missing" : bot.busy ? "busy" : "ready";
-    },
+    botState: unattendedDispatchState,
     enqueue: (input) => routines.enqueueWebhook(input),
     findRun: (webhookId, deliveryId) => routines.webhookRunReceipt(webhookId, deliveryId),
     cancelQueued: (webhookId, message) => routines.cancelQueuedWebhook(webhookId, message),
@@ -6747,7 +6952,11 @@ setupRetry = 0) {
     }
     revokeInternalCapabilitiesForThread(threadId);
     spoken.add(botId);
-    const preparedApprovalMode = approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId));
+    // Must be the SAME resolver the readiness re-check uses below, or a Chief's
+    // delegated Full elevation makes the two disagree by construction: every
+    // such room turn then reads as "settings changed", retries once, and
+    // settles as busy without ever dispatching.
+    const preparedApprovalMode = roomTurnApprovalMode(bot, orchestration);
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
     const instance = turnInstance(bot);
@@ -6875,7 +7084,7 @@ setupRetry = 0) {
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
         const setupChanged = turnInstance(readyBot) !== instance ||
-            approvalModeForTurn(readyBot, Boolean(orchestration?.roomHandoffId)) !== preparedApprovalMode ||
+            roomTurnApprovalMode(readyBot, orchestration) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
             readyBot.modelSelection.effort !== preparedSelection.effort ||
@@ -7009,7 +7218,7 @@ setupRetry = 0) {
             }
             // A distinct identity fences cleanup even in shared mode on the same room thread.
             const target = { ...localVmTargetForBot(readyBot.id) };
-            bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
+            await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
             if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
                 throw new Error("this Local VM is being started, stopped, or replaced");
             }
@@ -7248,7 +7457,7 @@ setupRetry = 0) {
                 text,
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: approvalModeForTurn(readyBot, Boolean(orchestration?.roomHandoffId)),
+                approvalMode: roomTurnApprovalMode(readyBot, orchestration),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
                 systemVolatile: roomSystem.volatile,
@@ -7449,6 +7658,8 @@ setupRetry = 0) {
     catch (error) {
         if (providerDispatched)
             throw error;
+        if (error instanceof DirectTurnSetupCancelled)
+            return false;
         const isSpendCap = typeof error === "object" && error !== null && error.code === "spend_cap";
         const isVariantError = typeof error === "object" && error !== null && error.code === "unsupported_model_variant";
         if (!roomSpeaker && !isSpendCap && !isVariantError)
@@ -10359,19 +10570,27 @@ const handleRequest = async (req, res) => {
             if (method === "POST" && path === "/api/internal/ask-bot") {
                 const body = await readInternalBody();
                 const fromBotId = internalSender.id;
-                const toBotId = String(body.toBotId ?? "");
+                const toBotRef = String(body.toBotId ?? "");
                 const message = String(body.message ?? "").trim();
                 if (body.depth !== undefined &&
                     (!Number.isInteger(body.depth) || body.depth < 0 || body.depth !== internalCapability.depth)) {
                     return json(res, 403, { error: "the recursion depth does not match this turn" });
                 }
                 const depth = internalCapability.depth;
-                if (!toBotId || !message)
+                if (!toBotRef || !message)
                     return json(res, 400, { error: "toBotId and message required" });
-                if (toBotId === fromBotId)
+                if (toBotRef === fromBotId)
                     return json(res, 400, { error: "a bot cannot message itself" });
                 if (depth >= MAX_COMMS_DEPTH)
                     return json(res, 200, { error: "message chains are limited to one hop" });
+                // A unique reachable teammate name is accepted where an id is
+                // expected; see resolveTeammate for why.
+                const resolvedTo = resolveTeammate(store.bots, internalSender, toBotRef);
+                if ("error" in resolvedTo)
+                    return json(res, 404, { error: `no such bot: ${resolvedTo.error}` });
+                if (resolvedTo.id === fromBotId)
+                    return json(res, 400, { error: "a bot cannot message itself" });
+                const toBotId = resolvedTo.id;
                 const target = store.bot(toBotId);
                 if (!target)
                     return json(res, 404, { error: "no such bot" });
@@ -10574,7 +10793,7 @@ const handleRequest = async (req, res) => {
             }
             if (method === "POST" && path === "/api/internal/delegate-bot") {
                 const body = await readInternalBody();
-                const toBotId = String(body.toBotId ?? "");
+                const toBotRef = String(body.toBotId ?? "");
                 const message = String(body.message ?? "").trim();
                 const reason = typeof body.reason === "string" && body.reason.trim() ? body.reason.trim() : undefined;
                 if (body.depth !== undefined &&
@@ -10582,9 +10801,13 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: "the recursion depth does not match this turn" });
                 }
                 const depth = internalCapability.depth;
-                if (!toBotId || !message)
+                if (!toBotRef || !message)
                     return json(res, 400, { error: "toBotId and message required" });
                 const from = internalSender;
+                const resolvedTo = resolveTeammate(store.bots, from, toBotRef);
+                if ("error" in resolvedTo)
+                    return json(res, 404, { error: `no such bot: ${resolvedTo.error}` });
+                const toBotId = resolvedTo.id;
                 const target = store.bot(toBotId);
                 if (!target)
                     return json(res, 404, { error: "no such bot" });
@@ -10655,11 +10878,35 @@ const handleRequest = async (req, res) => {
                     const destination = groupId ? store.group(groupId) : undefined;
                     if (groupId && !destination)
                         return json(res, 404, { error: "No such room; use list_room_targets." });
-                    const targets = parsed.data.botIds.map(botId => ({ groupId: destination?.id,
+                    // A slot may carry a teammate's name instead of its id — the
+                    // roster shows both, list_bots shows both, and a Chief reading its
+                    // prompt reaches for the name. A unique reachable name resolves;
+                    // anything else is refused with the id or name the caller sent
+                    // and the way to the real ids (peer-roster.ts).
+                    const botIds = [];
+                    for (const raw of parsed.data.botIds) {
+                        const resolved = resolveTeammate(store.bots, internalSender, raw);
+                        if ("error" in resolved)
+                            return json(res, 403, { error: resolved.error });
+                        botIds.push(resolved.id);
+                    }
+                    if (new Set(botIds).size !== botIds.length)
+                        return json(res, 400, { error: "bot_ids name the same teammate twice — send each teammate once" });
+                    const targets = botIds.map(botId => ({ groupId: destination?.id,
                         threadId: destination ? destination.id === source?.id ? address.threadId : destination.threadId : store.bot(botId)?.threadId ?? "", botId,
                     }));
                     for (const target of targets) {
-                        const eligibility = target.botId === internalSender.id ? "Choose a teammate, not yourself" : roomHandoffProblem(target, address);
+                        // roomHandoffProblem's "no longer exists" is written for a route
+                        // that was valid and went away. Here the id is the model's own
+                        // argument — usually a display name dropped into a bot_ids slot —
+                        // so say which id failed and where the real ones are, instead of
+                        // telling the model a teammate it can still reach is gone. Only
+                        // the id the caller sent is echoed back, never a bot's name.
+                        const addressed = store.bot(target.botId);
+                        const eligibility = target.botId === internalSender.id ? "Choose a teammate, not yourself"
+                            : !addressed ? `No bot with id "${target.botId}" — call list_bots and copy the exact id from the result`
+                                : addressed.hidden ? `The bot with id "${target.botId}" is no longer available — call list_bots for the ones you can reach`
+                                    : roomHandoffProblem(target, address);
                         if (eligibility)
                             return json(res, 403, { error: eligibility });
                     }
@@ -10695,6 +10942,9 @@ const handleRequest = async (req, res) => {
                                 target.threadId = resolved.task.threadId;
                                 if (resolved.created)
                                     createdThread = resolved.task.threadId;
+                                if (delegatedFullAccess(internalSender, internalCapability.threadId, store.bot(target.botId))) {
+                                    grantDelegatedFullAccess(internalSender, store.bot(target.botId), target.threadId);
+                                }
                             }
                             const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "");
                             // A re-dispatched request_key is answered by the request it
@@ -10963,6 +11213,8 @@ const handleRequest = async (req, res) => {
                 const task = store.createTask(target.id, title, false, projectId, { botId: from.id, name: from.name, at: Date.now() });
                 if (!task)
                     return json(res, 500, { error: "couldn't create that thread" });
+                if (delegatedFullAccess(from, fromThreadId, target))
+                    grantDelegatedFullAccess(from, target, task.threadId);
                 const queued = queueDelegation(commsBus, from, { toBotId: target.id, message, depth, targetThreadId: task.threadId }, MAX_COMMS_DEPTH, fromThreadId);
                 if (queued.result !== "ok" || !queued.id) {
                     // nothing will ever run there: take the row back before the person
@@ -11209,6 +11461,48 @@ const handleRequest = async (req, res) => {
                     return json(res, 404, { error: "no such bot" });
                 if (method === "GET") {
                     const snapshot = botComputerControlSnapshot(botId, internalCapability.teamComputerId);
+                    const slot = autoVmClaims.get(internalCapability.threadId);
+                    const lazyClaim = slot && slot.owner.generation === internalCapability.generation ? slot : undefined;
+                    if (!snapshot.held && lazyClaim?.lazy && !lazyClaim.begin) {
+                        // First screen tools/call on a lazily-attached Auto VM (issue
+                        // #1361): fire the exclusive claim — once — and give it a moment
+                        // to land. A free, ready VM claims in the time of one container
+                        // inspect, so this call then proceeds with an honest answer;
+                        // only a claim still queued behind another holder answers held
+                        // below, and then the contention text is true. Keyed on the
+                        // slot, never on the thread's turn-computer entry: a bind this
+                        // turn abandoned earlier (a VPS that turned out to be asleep)
+                        // must not hide the unclaimed VM and let the call through.
+                        startAutoVmClaim(autoVmClaims, internalCapability.threadId, internalCapability.generation);
+                        await Promise.race([
+                            lazyClaim.begin ?? Promise.resolve(),
+                            new Promise((resolve) => setTimeout(resolve, LAZY_VM_CLAIM_GRACE_MS)),
+                        ]);
+                    }
+                    if (!snapshot.held && lazyClaim?.failed === true) {
+                        // A rejected lazy claim (gate finding F1, issue #1361): the
+                        // computer MCP mounted at dispatch is still live, and the claim
+                        // may even have left a turn-computer entry behind (it can reject
+                        // after bindTurnComputer succeeded — lease lost to a person,
+                        // lifecycle busy, boot failure). Either way this turn owns no
+                        // usable VM, so keep refusing every screen call for the rest of
+                        // the generation; the bridge must never forward one onto a VM
+                        // this turn never claimed. Turn settle GC clears the slot. Say
+                        // why, and say not to retry: the contention text would send the
+                        // model into a screenshot loop against a claim that cannot land.
+                        return json(res, 200, {
+                            held: true, helpOpen: false,
+                            blockedReason: `This turn could not claim the Local VM${lazyClaim.failure ? ` (${lazyClaim.failure})` : ""}. This call was not performed. Do not retry computer work in this turn; tell the person what you could not do.`,
+                        });
+                    }
+                    if (!snapshot.held && lazyClaim?.lazy && lazyClaim.begin && !lazyClaim.claimed) {
+                        // The claim fired and is still waiting on the exclusive bind:
+                        // another turn genuinely holds this desktop right now.
+                        return json(res, 200, {
+                            held: true, helpOpen: false,
+                            blockedReason: "Another thread is using this computer. This call was not performed. Pause computer work until that thread finishes, then take a fresh screenshot before acting.",
+                        });
+                    }
                     const computer = turnComputerResources.get(internalCapability.threadId);
                     if (!snapshot.held && computer && computer.owner.generation === internalCapability.generation &&
                         !claimTurnResource(computer.owner, computer.resource)) {
@@ -12518,14 +12812,6 @@ const handleRequest = async (req, res) => {
             routines.disableForGroup(group.id);
             store.deleteGroup(group.id);
             rejectDeletedThreadSkillStages(stagedSkillCleanups);
-            for (const threadId of threadIds) {
-                for (const dir of [EVENTS_DIR, NATIVE_DIR]) {
-                    try {
-                        unlinkSync(join(dir, `${threadId}.ndjson`));
-                    }
-                    catch { }
-                }
-            }
             return json(res, 200, { ok: true });
         }
         m = path.match(/^\/api\/groups\/([\w-]+)\/messages$/);
@@ -12633,6 +12919,112 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 200, { ok: true });
         }
+        // Steer a queued room message into the RUNNING room turn (no interrupt).
+        // Only the head steers — room queues drain one item at a time — and the
+        // engine that receives it is the thread's live speaker. A room whose
+        // running driver cannot steer keeps its queue, exactly like an incapable
+        // 1:1 engine; this never ends the running turn.
+        m = path.match(/^\/api\/groups\/([\w-]+)\/queue\/([\w-]+)\/steer$/);
+        if (m && method === "POST") {
+            const body = await readBody(req);
+            if (body !== null && (typeof body !== "object" || Array.isArray(body))) {
+                return json(res, 400, { error: "body must be a JSON object" });
+            }
+            const threadId = typeof body?.threadId === "string" ? body.threadId : undefined;
+            if (threadId !== undefined && !/^[\w-]+$/.test(threadId)) {
+                return json(res, 400, { error: "threadId must be a task id" });
+            }
+            const group = store.group(m[1]);
+            if (!group)
+                return json(res, 404, { error: "no such room" });
+            const targetThreadId = threadId ?? group.threadId;
+            const ownsThread = group.dm
+                ? group.threadId === targetThreadId
+                : Boolean(store.groupTaskByThread(group.id, targetThreadId));
+            if (!ownsThread) {
+                return json(res, 409, { error: "the channel switched tasks before it could receive the message" });
+            }
+            noteTurnTrigger(targetThreadId, auth);
+            const current = store.group(group.id);
+            if (!current)
+                return json(res, 404, { error: "no such room" });
+            // Which engine owns the running room turn on this thread? The same
+            // resolution the room's own Stop uses: the live speaker, else the busy
+            // bot on the channel's main thread.
+            const speakerBotId = groupSpeakers.get(targetThreadId)?.botId ??
+                (targetThreadId === current.threadId ? current.busyBotId : undefined);
+            const speaker = speakerBotId ? store.bot(speakerBotId) : undefined;
+            const instance = speaker ? runningTurnInstance(speaker, targetThreadId) : undefined;
+            // Lift the queue atomically: the room settling can drain it as the
+            // next follow-up, or this request can steer its head into the live
+            // turn — never both for the same words.
+            const held = holdChannelQueue(current.id, targetThreadId, m[2]);
+            if (!held)
+                return json(res, 404, { error: "no such queued message" });
+            if (!speaker || !instance?.adapter.capabilities.queueing || !instance.adapter.steer) {
+                restoreHeldChannelQueue(held);
+                return json(res, 200, { ok: true, queued: true, threadId: targetThreadId });
+            }
+            const [head] = held.items;
+            if (!head || head.id !== m[2]) {
+                restoreHeldChannelQueue(held);
+                return json(res, 409, { error: "only the first queued message can steer" });
+            }
+            // A reply target that cannot be resolved restores the held queue
+            // before the request fails — the room's normal drain keeps the head.
+            const replyTo = resolveHeldReplyTarget(held, resolveReplyTarget);
+            const steered = await instance.adapter
+                .steer(targetThreadId, promptWithReply(head.text, replyTo, cfg.profile?.name?.trim() || "User"))
+                .catch(() => "indeterminate");
+            // The steer was awaited adapter work: re-read every ownership
+            // invariant before writing anything, exactly like the 1:1 path. A
+            // speaker change, a channel switch, or a settled room restores the
+            // queue instead of recording words the new turn never saw.
+            const after = store.group(current.id);
+            const afterSpeakerBotId = after
+                ? groupSpeakers.get(targetThreadId)?.botId ??
+                    (targetThreadId === after.threadId ? after.busyBotId : undefined)
+                : undefined;
+            // "indeterminate" (timeout after delivery, lost transport, a settle
+            // race) never restores: the words may already be folded into the turn
+            // that was live when they were sent, and replaying them into a new
+            // turn would run them twice. Record them once — even under a new
+            // speaker — and settle the head.
+            const delivered = steered !== "refused";
+            if (after && delivered && (steered === "indeterminate" || afterSpeakerBotId === speakerBotId)) {
+                const message = store.appendMessage(targetThreadId, {
+                    role: "user",
+                    kind: "text",
+                    text: head.text,
+                    replyToId: head.replyToId,
+                    sendId: head.sendId,
+                    channelMode: head.mode,
+                    queueId: head.id,
+                    via: head.via,
+                    steered: true,
+                });
+                settleHeldChannelQueueHead(held);
+                return json(res, 200, {
+                    ok: true,
+                    steered: true,
+                    threadId: targetThreadId,
+                    messages: [message],
+                    queueIds: [head.id],
+                });
+            }
+            if (steered === "indeterminate" && !after) {
+                // The room vanished while the answer was lost: settle the head so a
+                // restart cannot replay words the dead turn may already have run.
+                settleHeldChannelQueueHead(held);
+                return json(res, 404, { error: "no such room" });
+            }
+            restoreHeldChannelQueue(held);
+            // The room may have settled while the steer was refused; a queue that
+            // is now drainable must not strand behind a missed settle.
+            if (after && !groupIsWorking(after))
+                drainQueuedChannelSends();
+            return json(res, 200, { ok: true, queued: true, threadId: targetThreadId });
+        }
         m = path.match(/^\/api\/groups\/([\w-]+)\/interrupt$/);
         if (m && method === "POST") {
             const group = store.group(m[1]);
@@ -14006,7 +14398,7 @@ const handleRequest = async (req, res) => {
                 // existing server-side queue records it atomically for the next turn.
                 if (currentAtStart.busy) {
                     const instance = runningTurnInstance(currentAtStart, threadId);
-                    let steered = false;
+                    let steered = "refused";
                     // A live text steer has no image side channel. Keep an attachment
                     // message intact for the next ordinary turn, where central image
                     // admission can hand it to the provider natively.
@@ -14014,7 +14406,7 @@ const handleRequest = async (req, res) => {
                     if (!carriesImages && !computerSelectionTurns.get(threadId)?.selected && instance?.adapter.capabilities.queueing && instance.adapter.steer) {
                         steered = await instance.adapter
                             .steer(threadId, promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"))
-                            .catch(() => false);
+                            .catch(() => "indeterminate");
                     }
                     // steer() is awaited adapter work. The turn can settle, the task can
                     // switch, or the whole bot can be deleted before its acknowledgement
@@ -14028,10 +14420,15 @@ const handleRequest = async (req, res) => {
                     if (!store.taskByThread(bot.id, threadId)) {
                         throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
                     }
-                    if (steered) {
-                        if (!current.busy) {
+                    const delivered = steered !== "refused";
+                    if (delivered) {
+                        if (steered === "steered" && !current.busy) {
                             throw Object.assign(new Error("the running turn ended before the steered message could be recorded"), { status: 409 });
                         }
+                        // "indeterminate" falls through to the same record: the words
+                        // may already be folded into a turn whose acknowledgement was
+                        // lost, and handing them back for a resend could run them
+                        // twice. Recording them once is the honest outcome.
                         // A person steering a webhook turn is present, and auto mode may
                         // follow them again. But this route is also reachable from the
                         // bot's own shell on a headless server (loopback is the owner
@@ -14077,6 +14474,77 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 200, { ok: true });
         }
+        // Steer a queued message into the RUNNING turn (no interrupt). Engines
+        // without a live steer keep the queue; this never ends the current turn.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/queue\/([\w-]+)\/steer$/);
+        if (m && method === "POST") {
+            const body = await readBody(req);
+            requirePinnedClientThread(m[1], body?.threadId);
+            const bot = requestedTaskBot(m[1], body?.threadId);
+            noteTurnTrigger(bot.threadId, auth);
+            // Lift the whole queue atomically: a settle racing this request can
+            // drain it as a follow-up, or this request can steer it into the live
+            // turn — never both for the same words.
+            const held = holdSteeredQueue(bot.id, bot.threadId, m[2]);
+            if (!held)
+                return json(res, 404, { error: "no such queued message" });
+            // A live steer has no image side channel. Attachment words wait for a
+            // real turn where central admission can hand the images to the engine.
+            if (held.items.some((item) => extractTurnImages(item.text).images.length > 0)) {
+                restoreHeldSteeredQueue(held);
+                return json(res, 200, { ok: true, queued: true, threadId: bot.threadId });
+            }
+            const currentAtStart = store.projectBotForTask(bot.id, bot.threadId);
+            const instance = currentAtStart?.busy ? runningTurnInstance(currentAtStart, bot.threadId) : undefined;
+            const prompt = held.items.map((item) => item.prompt).join("\n\n");
+            let steered = "refused";
+            if (currentAtStart?.busy && instance?.adapter.capabilities.queueing && instance.adapter.steer) {
+                steered = await instance.adapter
+                    .steer(bot.threadId, prompt)
+                    .catch(() => "indeterminate");
+            }
+            // The steer was awaited adapter work: re-read every ownership
+            // invariant before writing anything, exactly like the live-send path.
+            const current = store.projectBotForTask(bot.id, bot.threadId);
+            // "indeterminate" never restores: the words may already be folded into
+            // the turn that was live when they were sent, and replaying them into
+            // a fresh follow-up turn would run them twice. Record them whenever
+            // the destination still exists, busy or not.
+            if ((steered === "steered" && current?.busy ||
+                steered === "indeterminate" && current) &&
+                store.taskByThread(bot.id, bot.threadId)) {
+                if (auth.kind === "session" || DESKTOP_MANAGED)
+                    clearUnattended(bot.threadId);
+                const messages = held.items.map((item) => store.appendMessage(bot.threadId, {
+                    role: "user",
+                    kind: "text",
+                    text: item.text,
+                    replyToId: item.replyToId,
+                    sendId: item.sendId,
+                    queueId: item.messageId,
+                    peerAsk: item.peerAsk,
+                    steered: true,
+                }));
+                const queueIds = held.items.map((item) => item.messageId);
+                settleHeldSteeredQueue(held);
+                return json(res, 200, { ok: true, steered: true, threadId: bot.threadId, messages, queueIds });
+            }
+            if (steered === "indeterminate") {
+                // No destination is left: settle so a restart cannot replay words a
+                // dead turn may already have run.
+                settleHeldSteeredQueue(held);
+                if (!store.taskByThread(bot.id, bot.threadId)) {
+                    throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
+                }
+                throw Object.assign(new Error("no such bot"), { status: 404 });
+            }
+            restoreHeldSteeredQueue(held);
+            // The turn may have settled while the steer was refused; a queue that
+            // is now drainable must not strand behind a missed settle.
+            if (current && !current.busy)
+                drainQueuedSends();
+            return json(res, 200, { ok: true, queued: true, threadId: bot.threadId });
+        }
         // edit a user message → fork the conversation there and rerun the turn.
         // Rewinding a live thread is refused, exactly like switching versions
         // below: interrupting mid-flight and branching under the dying turn is
@@ -16415,6 +16883,37 @@ try {
 catch (error) {
     console.warn(`attachments: startup partial cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
 }
+// #1280: retention for per-thread event logs. Off unless configured, and
+// even then it only removes log files — transcripts, thread records, and
+// workspace state stay untouched. A thread qualifies only when its newest
+// close or archive stamp is older than the window and it is not busy,
+// unread, or carrying an open direct handoff.
+const THREAD_LOG_RETENTION_SWEEP_MS = 24 * 60 * 60 * 1000;
+function sweepThreadEventLogsNow() {
+    const retentionDays = threadEventLogRetentionDays(cfg);
+    if (retentionDays === null)
+        return;
+    const candidates = store.bots.flatMap((bot) => (bot.tasks ?? []).map((task) => ({
+        threadId: task.threadId,
+        closedAt: task.closedBy?.at ?? null,
+        archivedAt: task.archivedAt ?? null,
+        unread: task.unread === true,
+        busy: threadBusy(bot.id, task.threadId),
+        openDirectHandoff: roomHandoffs.activeDirect(task.threadId),
+    })));
+    const swept = sweepThreadEventLogs(candidates, retentionDays);
+    if (swept > 0)
+        console.log(`[retention] removed event logs for ${swept} idle thread(s) past ${retentionDays} day(s)`);
+}
+try {
+    sweepThreadEventLogsNow();
+}
+catch (error) {
+    console.warn(`thread event log retention sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+}
+// A days-scale window needs no tighter cadence; unref so the timer never
+// holds the process open.
+setInterval(sweepThreadEventLogsNow, THREAD_LOG_RETENTION_SWEEP_MS).unref();
 // A dispatch claim is deliberately committed before transcript/provider work.
 // If we died after that point, its outcome is unknown: recover the user's words
 // and a review notice, never hand them to a model for a second execution.