openmausbot 0.1.84 → 0.1.85

package/dist-server/server/index.js

@@ -2,11 +2,17 @@
 // (upstream rule): the React app dispatches typed commands over HTTP and
 // folds one SSE event stream; every provider process runs here.
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, mkdirSync } from "node:fs";
+import { writeFileAtomic } from "./atomic.js";
 import { rm as removeDirectory } from "node:fs/promises";
 import { createServer } from "node:http";
+import { ToolResults, TOOL_RESULT_MAX_CHARS } from "./tool-results.js";
 import { extname, join } from "node:path";
 import { z } from "zod";
+import { selectReplay, DEFAULT_REBUILD_BYTES, MAX_SUMMARY_BYTES } from "./context-rebuild.js";
+import { draftSummary, foldPoint } from "./compaction-summary.js";
+import { compactBudget, contextWindowFor, shouldCompact } from "./context-budget.js";
+import { autoCompactWindow } from "./drivers/claude.js";
 import { SharedComputers, sharedComputerOperation, sharedComputerRegistration } from "./shared-computers.js";
 import { SharedComputerControl } from "./shared-computer-control.js";
 import { RoomHandoffs } from "./room-handoffs.js";
@@ -19,8 +25,12 @@ import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, is
 import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
+import { providerIconPatchSchema, withInstanceIcon } from "./provider-icon.js";
+import { providerIconError } from "../shared/provider-icon.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
 import * as checkpoints from "./checkpoints.js";
+import { commandReceipt } from "./commands.js";
+import { buildTurnDigest, coverageForDriver, digestPromptLine, renderDigest, toolEvidence } from "./digest.js";
 import { appendDecision, readDecisions, flushDecisionLog } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
@@ -37,10 +47,10 @@ import { boxDeletionSnapshot } from "./box-delete-journal.js";
 import { boxAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
-import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
+import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -70,7 +80,7 @@ import { chiefForBot, INCIDENTS_THREAD_TITLE, IncidentLedger, incidentChip, inci
 const SESSION_READ_MAX_CHARS = 8_000;
 import { promptWithReply, transcriptText } from "./replies.js";
 import { _loadPending, buildDelegationFailurePrompt, buildDelegationRevivalPrompt, DELEGATION_TTL_MS, DelegationWakeBudget, discardDelegations, drainDelegations, expireStaleDelegations, findDelegationReceipt, pendingDelegationInfo, pendingDelegationSnapshot, pendingThreads, queueDelegation, recordDelegationReceipt, releaseDelegationsWaitingOn, summarizeDelegatedActivity } from "./delegations.js";
-import { cancelSteeredMessage, drainSteeredMessages, holdSteeredQueue, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
+import { cancelSteeredMessage, drainSteeredMessages, hasQueuedSteeredMessages, holdSteeredQueue, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
 import { cancelChannelMessage, drainChannelMessages, holdChannelQueue, queuedChannelMessage, queueChannelMessage, restoreChannelMessages, restoreHeldChannelQueue, resolveHeldReplyTarget, settleHeldChannelQueueHead, } from "./channel-queue.js";
 import { acceptedSendMatch, parseSendId, sendFingerprint, SendSequencer, } from "./send-idempotency.js";
 import { EventBus } from "./harness/bus.js";
@@ -80,7 +90,7 @@ import { selectDefaultModelSelection } from "./default-model-selection.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
 import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
-import { isProjectEmoji, mentionedBots, roomResponders, sectionKey, Store, toWireTask, } from "./store.js";
+import { isProjectEmoji, mentionedBots, roomResponders, sectionKey, Store, titleFromLlm, toWireTask, } from "./store.js";
 import * as tts from "./tts/index.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
 import { buildRecoveryText, buildTurnContext, engineIsFresh, peerMessageText } from "./turn-context.js";
@@ -272,6 +282,17 @@ registerEnginesBinDir();
 // still belongs to the person who wrote, and routine or peer turns are
 // told apart before this is consulted.
 const turnTriggers = new Map();
+/** Who a user message is from, when that is someone other than the desktop
+ * owner. Loopback is the owner by design, so it stays unstamped and reads as
+ * the profile name; a paired or signed-in session names the person, by
+ * account email where there is one and otherwise by the device label they
+ * chose while pairing. */
+function messageSender(auth) {
+    if (auth.kind !== "session")
+        return undefined;
+    const name = (auth.session.email ?? auth.session.label ?? "").trim();
+    return name ? { name } : undefined;
+}
 function noteTurnTrigger(threadId, auth) {
     turnTriggers.set(threadId, auth.kind === "session"
         ? { kind: "user", ...(auth.session.email ? { email: auth.session.email } : {}), label: auth.session.label }
@@ -317,7 +338,13 @@ function applyDesktopMutationTokenMessage(raw) {
 const browserCleanup = new BrowserCleanupCoordinator({
     file: join(DATA_DIR, "browser-cleanups.json"),
     send: (request) => {
-        const status = browserEngineStatus();
+        // Cleanup may only run the engine OpenMausBot itself configured or
+        // downloaded. A binary the ambient PATH turned up — on a dev machine, a
+        // global wrapper that shadows the harness PATH and rewrites the session
+        // key — is not that engine: a close through it can fail and wedge the
+        // journal on retries. Without a managed engine no daemon could still
+        // autosave the session, so the erase below can acknowledge directly.
+        const status = browserEngineStatus({ managedOnly: true });
         // Guest sessions are throwaway and never saved, so only the bot's own
         // session and shared profile sessions have state to clear.
         const sessions = request.type === "openmausbot:browser-bot-deleted" && request.botId
@@ -561,6 +588,22 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
         },
     };
 }
+/** Engine lifecycle hooks (item 0.2): a turn-scoped bearer the engine's hook
+ * helper presents on /api/internal/hook. OMB_HOOKS=0 turns the channel off. */
+const hooksEnabled = () => process.env.OMB_HOOKS !== "0";
+function hooksIntegration(botId, threadId, generation) {
+    const token = mintInternalCapability({
+        botId,
+        threadId,
+        generation,
+        depth: 0,
+        kind: "hooks",
+        skillAuthoring: false,
+        createdBots: 0,
+        openedThreads: 0,
+    });
+    return { url: `http://127.0.0.1:${PORT}`, token };
+}
 class DirectTurnSetupCancelled extends Error {
 }
 const directTurnDispatchClaims = new Map();
@@ -821,6 +864,7 @@ function clearDirectTurnDispatch(threadId, claimId) {
     if (directTurnDispatchClaims.get(threadId)?.id === claimId)
         directTurnDispatchClaims.delete(threadId);
 }
+const compactionControllers = new Map();
 function cancelDirectTurnDispatch(botId, expectedThreadId) {
     const threadId = expectedThreadId ?? store.bot(botId)?.threadId;
     if (!threadId)
@@ -829,7 +873,12 @@ function cancelDirectTurnDispatch(botId, expectedThreadId) {
     const claim = directTurnDispatchClaims.get(threadId);
     if (!claim || claim.botId !== botId)
         return null;
+    const compacting = compactionControllers.get(threadId);
+    if (compacting?.generation === claim.id)
+        compacting.controller.abort(new DirectTurnSetupCancelled("context summarization stopped"));
     directTurnDispatchClaims.delete(threadId);
+    if (directTurnGenerationByThread.get(threadId) === claim.id)
+        clearTurnDigestState(threadId);
     // Setup has not called the adapter yet, so there is no provider handshake
     // (and no unknown turn id) to quarantine. Dispatching is the only phase in
     // which a late provider event can exist.
@@ -897,6 +946,7 @@ async function browserIntegration(botId, profile, turn) {
         encryptionKey: browserEngineEncryptionKey(),
         persistent: profile !== "guest",
         env: { ...process.env, PATH: augmentedPath() },
+        attachCdpUrl: browserEngineAttachCdpUrl(cfg) ?? undefined,
     });
     await prepareBrowserSessionState(status.binaryPath, session, { env: spec.env, persistent: profile !== "guest", isCurrent: () => {
             const current = store.bot(botId);
@@ -2183,15 +2233,11 @@ function outstandingAssignmentsPrompt(threadId) {
 const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     validate: (node, parent) => roomHandoffProblem(node, parent) ??
         (parent && store.bot(parent.botId)?.approvePeerComms && !fullAccessForSource(parent.botId, parent.threadId) && !node.approvalGranted ? "Sender now requires peer approval; submit a new approved request" : undefined),
-    // A direct follow-up is owed to one conversation, so it waits for that
-    // conversation, not for the whole bot. Bot-level busy aggregates every
-    // thread — including cards still waiting on the person — so one busy
-    // sibling thread would otherwise starve the owed resume forever while the
-    // UI keeps showing this thread working. Fresh work still queues behind a
-    // busy teammate's whole bot (#1238); an owed resume only needs its own
-    // thread free and a thread slot to admit it.
-    busy: n => !n.groupId && n.status === "resume"
-        ? threadBusy(n.botId, n.threadId) || botAtThreadCapacity(n.botId)
+    // Direct assignments and follow-ups use independent threads. Match direct
+    // turn admission: unrelated work need not block a free thread slot, but
+    // never overlap the addressed thread, exceed capacity, or race a group turn.
+    busy: n => !n.groupId
+        ? threadBusy(n.botId, n.threadId) || botAtThreadCapacity(n.botId) || Boolean(activeGroupTurnForBot(n.botId))
         : Boolean(store.bot(n.botId)?.busy || (n.groupId && store.group(n.groupId) && groupIsWorking(store.group(n.groupId)))),
     changed: (groupIds, directThreadIds) => {
         for (const id of groupIds) {
@@ -2961,7 +3007,7 @@ const turnContext = new Map();
 // unique arguments would let one pathological turn grow the server forever.
 const repeats = new RepeatDetector({ thresholds: [5, 10, 20], maxKeysPerThread: 256 });
 // ── stall watchdog ─────────────────────────────────────────────────────
-// ask_bot has a 4-minute ceiling, while room turns have a separately
+// ask_bot has a short inline wait budget, while room turns have a separately
 // configurable absolute ceiling. The main 1:1 path had none, so a wedged CLI
 // left its bot busy forever. The watchdog stops a turn whose thread has emitted NOTHING for stallMs —
 // activity-based, so an hour-long turn that keeps streaming is never
@@ -2969,7 +3015,7 @@ const repeats = new RepeatDetector({ thresholds: [5, 10, 20], maxKeysPerThread:
 const TURN_STALL_MS = Math.max(60_000, Number(process.env.OMB_TURN_STALL_MS) || 20 * 60_000);
 /** How long ask_bot waits synchronously before the ask is converted into a
  * delegation claim ticket (the peer's turn keeps running either way). */
-const ASK_BOT_TIMEOUT_MS = Math.max(5_000, Number(process.env.OMB_ASK_BOT_TIMEOUT_MS) || 4 * 60_000);
+const ASK_BOT_TIMEOUT_MS = Math.max(5_000, Number(process.env.OMB_ASK_BOT_TIMEOUT_MS) || 15_000);
 // A room waits for a busy teammate instead of dropping them, but never
 // forever: a bot parked on a permission card in another chat is "busy" until
 // a human returns. Past this cap a goal's lead is told the teammate could not
@@ -3101,12 +3147,20 @@ bus.subscribe((event) => {
 // settles — session.exited too, because a turn that died may still have
 // written. Fire-and-forget by construction: endMemoryTurn swallows its own
 // failures and never reaches the fold below.
+// The rows are kept for the digest the fold writes at settle (registration
+// order: this subscriber runs before the fold, so the stash is ready).
+const memoryRowsByThread = new Map();
 bus.subscribe((event) => {
     if (shouldIgnoreProviderEvent(event))
         return;
     if (event.type === "turn.completed" || event.type === "session.exited") {
         runningTurnEngines.delete(event.threadId);
-        endMemoryTurn(event.threadId);
+        const rows = endMemoryTurn(event.threadId);
+        if (rows.length && (store.botByThread(event.threadId) || store.groupByThread(event.threadId))) {
+            memoryRowsByThread.set(event.threadId, rows);
+        }
+        else
+            memoryRowsByThread.delete(event.threadId);
     }
 });
 // One line per finished turn in the bot's daily log (server/recent-work.ts):
@@ -3144,6 +3198,160 @@ bus.subscribe((event) => {
         // a missing note never fails a turn
     }
 });
+// Per-thread state the digest needs from before the turn: when it started,
+// and the checkpoint taken at dispatch (hash + folder) so settle can diff.
+const turnStartedAt = new Map();
+const turnCheckpoints = new Map();
+// The turn a thread is in, from the last event that named one. Not every
+// driver stamps every item with a turnId (ACP fakes, some ACP agents), and
+// a digest can only count activity it can attribute — so an unstamped tool
+// row is attributed to the thread's live turn instead of to nothing.
+const liveTurnByThread = new Map();
+function clearTurnDigestState(threadId) {
+    turnStartedAt.delete(threadId);
+    turnCheckpoints.delete(threadId);
+    liveTurnByThread.delete(threadId);
+    memoryRowsByThread.delete(threadId);
+}
+const TOOL_RESULTS_DIR = join(DATA_DIR, "tool-results");
+const TOOL_RESULT_SPILL_MAX = 512 * 1024;
+/** A hook event from the engine (item 0.2). PostToolUse carries the tool's
+ * full result: it is redacted, spilled to a private file, and attached to
+ * the activity row the fold already wrote for that call, which flips the
+ * turn's evidence to "full" for the digest. Idempotent on the tool_use_id
+ * (a re-delivered hook never double-writes). Other events are accepted and
+ * ignored here; item 0.4 gives PreCompact/SessionStart/Stop their meaning. */
+const DIGESTS_AFTER_COMPACTION = 2;
+function ingestEngineHook(capability, body) {
+    const event = body && typeof body === "object" ? body : {};
+    const name = typeof event.event === "string" ? event.event : "";
+    const payload = event.payload && typeof event.payload === "object" ? event.payload : {};
+    const threadId = capability.threadId;
+    const chip = (text) => store.appendMessage(threadId, { role: "bot", kind: "activity", tool: { name: text, ok: true } });
+    // Compaction is a harness event with a record, not something that silently
+    // happens to the model: a chip before, and after it the latest digests go
+    // back in as plain-text context so the compacted session still knows what
+    // its earlier turns DID (the CLI's own summary keeps what was said).
+    if (name === "PreCompact") {
+        const trigger = payload.trigger === "manual" ? "manual" : "auto";
+        chip(`context compaction started (${trigger})`);
+        return { ok: true };
+    }
+    if (name === "SessionStart") {
+        if (payload.source !== "compact")
+            return { ok: true, ignored: `SessionStart ${String(payload.source ?? "")}` };
+        const bot = store.bot(capability.botId);
+        const digests = store.activePath(threadId).filter((m) => m.kind === "digest" && m.digest).slice(-DIGESTS_AFTER_COMPACTION);
+        chip(`context compacted — re-sent the last ${digests.length} digest${digests.length === 1 ? "" : "s"}`);
+        if (!digests.length)
+            return { ok: true };
+        const context = digests.map((m) => digestPromptLine(m.digest, m.from?.name ?? store.bot(m.digest.botId)?.name ?? bot?.name ?? "the bot")).join("\n");
+        return { ok: true, context };
+    }
+    if (name === "Stop")
+        return { ok: true };
+    if (name !== "PostToolUse")
+        return { ok: true, ignored: name || "unknown" };
+    const toolUseId = typeof payload.tool_use_id === "string" ? payload.tool_use_id : "";
+    if (!toolUseId)
+        return { ok: true, ignored: "PostToolUse without tool_use_id" };
+    if (!Object.hasOwn(payload, "tool_response"))
+        return { ok: true, ignored: "hook did not include a tool response" };
+    const response = payload.tool_response;
+    const text = typeof response === "string" ? response : JSON.stringify(response ?? null, null, 2);
+    const turnId = liveTurnByThread.get(threadId);
+    const row = store.activePath(threadId).findLast((m) => m.kind === "activity" && m.turnId === turnId && m.tool?.itemId === toolUseId);
+    if (!turnId || !row?.tool)
+        return { ok: true, ignored: "tool not observed in this turn" };
+    const key = `${threadId}:${turnId}:${toolUseId}`;
+    if (!commandReceipt("hook.ingest", key)) {
+        const dir = join(TOOL_RESULTS_DIR, threadId.replace(/[^\w.-]/g, "_"));
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const safeId = createHash("sha256").update(key).digest("hex");
+        const file = join(dir, `${safeId}.txt`);
+        const redacted = redactSecretsInText(text);
+        const bounded = redacted.length > TOOL_RESULT_SPILL_MAX
+            ? `${redacted.slice(0, TOOL_RESULT_SPILL_MAX)}\n[… ${redacted.length - TOOL_RESULT_SPILL_MAX} more characters omitted]`
+            : redacted;
+        writeFileAtomic(file, bounded, { mode: 0o600 });
+        store.patchMessage(threadId, row.id, { tool: { ...row.tool, fullResult: redacted.length <= TOOL_RESULT_SPILL_MAX } }, { kind: "hook.ingest", key });
+    }
+    return { ok: true };
+}
+/** Persist observed tools and memory immediately. Keep a direct turn's
+ * workspace claimed while its bounded file snapshot settles, then enrich
+ * that same row only if its task and active branch still exist. */
+async function scheduleTurnDigest(input) {
+    const at = Date.now();
+    const startedAt = turnStartedAt.get(input.threadId);
+    turnStartedAt.delete(input.threadId);
+    const checkpoint = turnCheckpoints.get(input.threadId);
+    turnCheckpoints.delete(input.threadId);
+    const memory = memoryRowsByThread.get(input.threadId) ?? [];
+    memoryRowsByThread.delete(input.threadId);
+    try {
+        if (!input.isCurrent())
+            return;
+        const activities = store.activePath(input.threadId);
+        const digest = buildTurnDigest({
+            turnId: input.turnId,
+            botId: input.botId,
+            threadId: input.threadId,
+            at,
+            durationMs: startedAt ? Math.max(0, at - startedAt) : 0,
+            activities,
+            memory,
+            reply: input.reply,
+            ...(input.usage ? { usage: input.usage } : {}),
+            hookCoverage: coverageForDriver(input.driverKind, toolEvidence(activities, input.turnId), activities.some(m => m.kind === "activity" && m.turnId === input.turnId && m.tool?.itemId)),
+        });
+        const message = store.appendMessage(input.threadId, {
+            role: "bot",
+            kind: "digest",
+            text: renderDigest(digest),
+            digest,
+            turnId: input.turnId,
+            ...(input.from ? { from: input.from } : {}),
+        }, { kind: "digest.append", key: `${input.threadId}:${input.turnId}` });
+        // This is derived from the native session's own work, not an unseen
+        // teammate message. Record it alongside that turn's replies so normal
+        // resumes stay delta-only. Other engines still receive it on replay.
+        if (input.instanceId && !input.from) {
+            const handed = store.taskByThread(input.botId, input.threadId)?.handedMessages?.[input.instanceId];
+            if (handed)
+                store.setHandedMessages(input.botId, input.threadId, input.instanceId, recordHanded(handed, store.activePath(input.threadId).filter(isContextMessage).map(row => row.id), [message.id]));
+        }
+        if (!checkpoint)
+            return;
+        const controller = new AbortController();
+        let timer;
+        const capture = async () => {
+            const after = await checkpoints.snapshot(input.botId, checkpoint.cwd, `settle ${input.threadId.slice(0, 8)}`, controller.signal);
+            if (!after || controller.signal.aborted)
+                return null;
+            if (checkpoint.hash === after)
+                return { changed: [], added: [], deleted: [] };
+            return checkpoints.diffStat(input.botId, checkpoint.cwd, checkpoint.hash, after, controller.signal);
+        };
+        let files;
+        try {
+            files = await Promise.race([
+                capture(),
+                new Promise(resolve => { timer = setTimeout(() => { controller.abort(); resolve(null); }, 3_000); }),
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!files || !input.isCurrent() || !store.activePath(input.threadId).some(row => row.id === message.id))
+            return;
+        const withFiles = buildTurnDigest({ ...digest, activities, memory, files });
+        store.patchMessage(input.threadId, message.id, { digest: withFiles, text: renderDigest(withFiles) }, { kind: "digest.files", key: `${input.threadId}:${input.turnId}` });
+    }
+    catch (error) {
+        console.error(`digest: could not record turn ${input.turnId} on ${input.threadId}:`, error instanceof Error ? error.message : error);
+    }
+}
 // Bots currently working with nobody at the keyboard — a webhook turn, or a
 // turn a webhook-driven bot handed to a teammate. Auto mode is a decision
 // someone made for turns they were present for, so these don't inherit it:
@@ -3373,6 +3581,107 @@ async function attachTeamBox(computer, botId, owner, canMount, remoteAgent) {
         capture: () => box.screenshotBox(cfg, ownerId, machine.id),
     };
 }
+/** "Works on: This computer", strict. One mount for a bot thread and a group
+ * chat, so the two cannot drift on what they check or how they fail. */
+async function mountHostComputer(owner, botId, providerSupportsLocal) {
+    if (!shouldMountLocalComputer({ requested: "local", hostPlatform: process.platform, providerSupportsLocal })) {
+        // Name the condition that actually failed: a person told "choose an
+        // ACP engine" while already on one has nowhere to go.
+        throw new Error(providerSupportsLocal
+            ? `local computer control is not available on ${process.platform} — select another destination`
+            : "this model engine cannot control this computer — choose Claude or an ACP engine, or select another destination");
+    }
+    const cua = readCuaConnection();
+    if (!cua)
+        throw new Error("CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
+    await bindTurnComputer(owner, "computer:host");
+    return gatedLocalComputer(cua, controlIntegration(botId, owner.threadId, owner.generation));
+}
+/** The bot's own VPS desktop, mounted into the local agent. The desktop lease
+ * is claimed on the first computer call, through the computer-control gate
+ * (the Local VM's seam, #1361), never at mount: turns that never touch the
+ * computer tools run side by side. `start` may provision or start the
+ * container; without it the VPS is only inspected. The caller has already
+ * recorded the thread with vpsThreadStarted and ends it on a problem. */
+async function mountBotVps(bot, owner, opts) {
+    const vpsResource = `computer:vps:${vpsSshAlias(cfg)}:${bot.id}`;
+    const remote = opts.start
+        ? await vps.vpsComputerAction("provision", cfg, bot.id)
+        : await vps.inspectVpsForAuto(cfg, bot.id);
+    if (!remote?.ready || !remote.sshAlias)
+        return { problem: remote?.problem ?? null };
+    const targetCfg = { ...cfg, vps: { sshAlias: remote.sshAlias } };
+    const vpsMcp = vps.vpsComputerMcp(targetCfg, bot.id, remote.container_id ?? undefined);
+    const vpsControl = controlIntegration(bot.id, owner.threadId, owner.generation);
+    // Live frames only once this turn holds the desktop: a poller on a desktop
+    // another turn is driving would publish that turn's screen as this one's.
+    const vpsCapture = () => vps.vpsComputerScreenshot(targetCfg, bot.id);
+    autoVmClaims.set(owner.threadId, {
+        owner,
+        lazy: true,
+        label: "the VPS computer",
+        claim: async () => {
+            await bindTurnComputer(owner, vpsResource, true);
+            opts.onClaimed(vpsCapture);
+        },
+    });
+    return {
+        integration: {
+            ...vpsMcp,
+            env: { ...vpsMcp.env, OMB_CONTROL_URL: vpsControl.url, OMB_CONTROL_TOKEN: vpsControl.token },
+        },
+    };
+}
+/** The bot's own Box. Explicit Cloud is the consent boundary: it may create a
+ * missing machine and wake an archived one (~8s, and it un-pauses billing);
+ * Auto only attaches a machine that is already running. */
+async function attachBotBox(bot, owner, opts) {
+    // Explicit cloud turns can provision/wake the same bot's Box. Claim before
+    // any network await so setup itself cannot race another turn.
+    if (opts.explicitCloud)
+        await bindTurnComputer(owner, `computer:box-bot:${bot.id}`, true);
+    let b;
+    try {
+        b = await box.findBox(cfg, bot.id);
+    }
+    catch (error) {
+        // Auto may fall through when an optional provider is offline, but a
+        // durable deletion fence must never be mistaken for "no computer".
+        if (opts.explicitCloud || error?.status === 409)
+            throw error;
+        b = null;
+    }
+    const lifecycleOf = (explicitCloud) => box.boxTurnLifecycleAction({
+        explicitCloud,
+        canMount: opts.canMount,
+        state: typeof b?.state === "string" ? b.state : null,
+    });
+    let lifecycle = lifecycleOf(opts.explicitCloud);
+    if (lifecycle === "provision") {
+        broadcast({ kind: "computer", botId: bot.id, state: "provisioning" });
+        await box.provisionBox(cfg, bot.id, bot.name);
+        b = await box.findBox(cfg, bot.id);
+        lifecycle = lifecycleOf(true);
+    }
+    // an archived box answers every action with an error until it resumes —
+    // wake it here, once, instead of letting the agent discover it one failed
+    // tool call at a time.
+    if (lifecycle === "wake") {
+        broadcast({ kind: "computer", botId: bot.id, state: "waking" });
+        b = (await box.readyBox(cfg, bot.id)) ?? b;
+        lifecycle = lifecycleOf(true);
+    }
+    if (!b || lifecycle !== "attach")
+        return null;
+    const machine = b;
+    await bindTurnComputer(owner, `computer:box:${machine.id}`, opts.remoteAgent);
+    return {
+        capture: () => box.screenshotBox(cfg, bot.id, machine.id),
+        integration: opts.canMount
+            ? { kind: "box", boxId: machine.id, token: cfg.box.token, control: controlIntegration(bot.id, owner.threadId, owner.generation) }
+            : null,
+    };
+}
 function managedBoxOwners() {
     return [...store.bots.map((bot) => ({
             botId: bot.id,
@@ -3553,9 +3862,9 @@ function continueComputerSelection(threadId, generation, succeeded) {
     const selection = computerSelectionTurns.get(threadId);
     if (!selection || selection.generation !== generation)
         return false;
-    if (!succeeded || !selection.selected) {
+    if (!succeeded || !selection.selected || hasQueuedSteeredMessages(selection.botId, threadId)) {
         computerSelectionTurns.delete(threadId);
-        return false;
+        return false; // Let ordinary settlement drain the person's newer request.
     }
     const surface = selection.selected;
     setImmediate(() => {
@@ -3568,8 +3877,10 @@ function continueComputerSelection(threadId, generation, succeeded) {
             return;
         if (store.taskByThread(bot.id, threadId)?.surface !== selection.previousSurface)
             return;
-        if (queuedThreadPosition(bot.id, threadId) !== null)
+        if (hasQueuedSteeredMessages(bot.id, threadId)) {
+            drainQueuedSends();
             return;
+        }
         if (store.activePath(threadId).findLast(message => message.role === "user" && message.kind === "text")?.id !== selection.source.id)
             return;
         store.patchTask(bot.id, threadId, { surface });
@@ -3816,7 +4127,13 @@ bus.subscribe((event) => {
     }
     if (bot)
         handoffs.onEvent(event);
+    if (event.turnId)
+        liveTurnByThread.set(event.threadId, event.turnId);
+    const liveTurnId = event.turnId ?? liveTurnByThread.get(event.threadId);
     switch (event.type) {
+        case "turn.started":
+            turnStartedAt.set(event.threadId, Date.now());
+            break;
         case "session.started":
             if (bot && event.sessionId && event.providerInstanceId) {
                 store.setResumeCursor(bot.id, event.providerInstanceId, event.sessionId, event.threadId);
@@ -3894,7 +4211,9 @@ bus.subscribe((event) => {
                 const message = pushMessage({
                     role: "bot",
                     kind: "activity",
-                    tool: { name, spoken: narrateTool(name) ?? undefined, summary: event.summary, input: event.input },
+                    tool: { name, spoken: narrateTool(name) ?? undefined, summary: event.summary, input: event.input, itemId: event.itemId ?? event.eventId },
+                    // attributed to its turn so the digest can count it
+                    turnId: liveTurnId,
                 });
                 if (event.itemId)
                     toolMessageByItem.set(`${event.threadId}:${event.itemId}`, message.id);
@@ -4149,6 +4468,7 @@ bus.subscribe((event) => {
             }
             const lastReported = turnUsage.get(event.threadId);
             turnUsage.delete(event.threadId);
+            const lastContext = turnContext.get(event.threadId);
             turnContext.delete(event.threadId);
             // group turns run on the room's thread — the speaking bot's task
             // tally is not the right home for a shared room's spend, so only
@@ -4194,8 +4514,6 @@ bus.subscribe((event) => {
                 const tokens = event.usage ?? lastReported;
                 // the context figure: what the last model call's prompt held, with
                 // the window from the driver or, failing that, the model's family
-                const lastContext = turnContext.get(event.threadId);
-                turnContext.delete(event.threadId);
                 const contextModel = store.taskByThread(bot.id, event.threadId)?.modelSelection?.model ?? bot.modelSelection.model;
                 store.addTaskUsage(bot.id, event.threadId, {
                     input: tokens?.input,
@@ -4208,6 +4526,11 @@ bus.subscribe((event) => {
                 // the task and answers "what did we spend, by whom" for a period
                 const settledTask = store.taskByThread(bot.id, event.threadId);
                 const selection = settledTask?.modelSelection ?? bot.modelSelection;
+                // A provider that omitted a context measurement must not reuse a
+                // stale reading from a different model or a pre-compaction session.
+                const measuredSelection = directTurnBots.get(event.threadId)?.modelSelection ?? selection;
+                store.patchTask(bot.id, event.threadId, { lastContextModel: Number.isFinite(lastContext?.tokens) && (lastContext?.tokens ?? 0) > 0
+                        ? `${measuredSelection.instanceId}:${measuredSelection.model}` : undefined });
                 appendUsage(DATA_DIR, {
                     botId: bot.id,
                     botName: bot.name,
@@ -4226,6 +4549,20 @@ bus.subscribe((event) => {
                             : turnTriggers.get(event.threadId) ?? { kind: "owner" },
                 });
                 noteSpend(DATA_DIR, event.cost ?? null);
+                const digestSettled = completedTurnId ? scheduleTurnDigest({
+                    botId: bot.id,
+                    botName: bot.name,
+                    threadId: event.threadId,
+                    turnId: completedTurnId,
+                    driverKind: registry.get(selection.instanceId)?.driverKind,
+                    instanceId: selection.instanceId,
+                    reply,
+                    isCurrent,
+                    ...(tokens ? { usage: { input: tokens.input ?? 0, output: tokens.output ?? 0, ...(typeof tokens.cachedInput === "number" ? { cachedInput: tokens.cachedInput } : {}), costUsd: event.cost ?? null } } : {}),
+                }) : Promise.resolve();
+                if (resourceOwner)
+                    settlingResourceOwners.set(resourceOwner.threadId, resourceOwner.generation);
+                liveTurnByThread.delete(event.threadId);
                 const routineReportThread = routineRun ? routineSourceThread(routineRun) : null;
                 // A routine's result belongs to its reporting thread's unread state.
                 // Its internal execution should not light up the sidebar as well.
@@ -4247,8 +4584,6 @@ bus.subscribe((event) => {
                     notify(buildNotification("done", notificationBot, routineReportThread ?? event.threadId, completionDetail, { avatarUrl: notificationBot.avatarUrl }));
                 }
                 if (screenPollers.has(event.threadId)) {
-                    if (resourceOwner)
-                        settlingResourceOwners.set(resourceOwner.threadId, resourceOwner.generation);
                     // the last live frame becomes a settled inline screen message —
                     // the screenshot-in-chat moment. One fresh capture first, so the
                     // frame shows the turn's END state (the final tool's poke may
@@ -4259,7 +4594,7 @@ bus.subscribe((event) => {
                     // these claims and fails as though another thread owned its folder.
                     const settleLeafId = store.activePath(event.threadId).at(-1)?.id;
                     let timeout;
-                    void Promise.race([
+                    const screenSettled = Promise.race([
                         finalScreenFrame(bot.id, event.threadId),
                         new Promise((resolve) => { timeout = setTimeout(() => resolve(null), SCREEN_SETTLE_TIMEOUT_MS); }),
                     ]).then((frame) => {
@@ -4268,11 +4603,11 @@ bus.subscribe((event) => {
                         }
                     }).catch(() => { }).finally(() => {
                         clearTimeout(timeout);
-                        settleDirectTurn(true);
                     });
+                    void Promise.all([screenSettled, digestSettled]).finally(() => settleDirectTurn(true));
                 }
                 else {
-                    settleDirectTurn();
+                    void digestSettled.finally(() => settleDirectTurn(true));
                 }
             }
             else if (group && speaker) {
@@ -4297,6 +4632,17 @@ bus.subscribe((event) => {
                         : turnTriggers.get(event.threadId) ?? { kind: "owner" },
                 });
                 noteSpend(DATA_DIR, event.cost ?? null);
+                if (completedTurnId) {
+                    void scheduleTurnDigest({
+                        botId: speaker.botId, botName: speaker.name,
+                        threadId: event.threadId, turnId: completedTurnId,
+                        driverKind: selection && registry.get(selection.instanceId)?.driverKind,
+                        reply, from: speaker,
+                        isCurrent: () => store.groupByThread(event.threadId)?.id === group.id,
+                        usage: { input: tokens?.input ?? 0, output: tokens?.output ?? 0, costUsd: event.cost ?? null },
+                    });
+                }
+                liveTurnByThread.delete(event.threadId);
             }
             if (speaker && group?.busyBotId === speaker.botId) {
                 releaseTurnResources(turnResourceOwners.get(event.threadId));
@@ -4387,7 +4733,7 @@ function wakeDelegationSource(source, threadId, targetName, failureReason, routi
     // delegated reply is already in the thread, so nothing is lost, and the
     // source processes it the moment it is free rather than only on a later
     // user nudge.
-    if (threadBusy(source.id, threadId) || activeGroupTurnForBot(source.id)) {
+    if (threadBusy(source.id, threadId) || botAtThreadCapacity(source.id) || activeGroupTurnForBot(source.id)) {
         pendingDelegationWakes.set(threadId, { botId: source.id, targetName, failureReason, routineRunId });
         return;
     }
@@ -4486,7 +4832,10 @@ function drainDelegationWakes() {
             pendingDelegationWakes.delete(threadId);
             continue;
         }
-        if (threadBusy(entry.botId, threadId) || activeGroupTurnForBot(entry.botId))
+        // Completion can precede asynchronous digest/resource settlement. Keep
+        // the wake parked until a slot is actually free; a rejected async start
+        // could otherwise requeue after the last idle-release drain has run.
+        if (threadBusy(entry.botId, threadId) || botAtThreadCapacity(entry.botId) || activeGroupTurnForBot(entry.botId))
             continue;
         pendingDelegationWakes.delete(threadId);
         dispatchDelegationWake(entry.botId, threadId, entry.targetName, entry.failureReason, entry.routineRunId, entry.budgetAcquired);
@@ -4535,7 +4884,96 @@ function markTaskContextExternallyUpdated(bot, threadId) {
 }
 /** Active-branch messages a provider reads as conversation context. */
 function isContextMessage(m) {
-    return Boolean((m.kind === "text" && m.text) || m.roomRequest?.phase === "result");
+    return Boolean((m.kind === "text" && m.text) || (m.kind === "digest" && m.digest) || m.kind === "compaction" || m.roomRequest?.phase === "result");
+}
+function latestCompaction(messages) {
+    const record = messages.findLast(message => message.kind === "compaction" && message.compaction);
+    return record?.compaction ? { ...record.compaction, id: record.id } : undefined;
+}
+function directContext(bot, threadId, messages) {
+    const messagesById = new Map(store.messagesFor(threadId).map(message => [message.id, message]));
+    return messages.filter(isContextMessage).map(m => ({
+        id: m.id, role: m.role === "user" ? "user" : "assistant",
+        text: m.kind === "compaction" ? ""
+            : m.roomRequest?.phase === "result" ? teammateReportContext(m.roomRequest.id, bot.id)
+                : m.kind === "digest" && m.digest ? digestPromptLine(m.digest, m.from?.name ?? bot.name)
+                    : m.peerAsk ? peerMessageText(m.peerAsk.name, m.text ?? "")
+                        : m.role !== "user" && m.from ? peerMessageText(m.from.name, transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"))
+                            : transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"),
+        keep: m.roomRequest?.phase === "result" || Boolean(m.peerAsk) || (m.role !== "user" && Boolean(m.from)),
+        ...(m.steered ? { steered: true } : {}),
+    }));
+}
+/** The existing direct-turn claim owns summarization, including Stop and
+ * thread deletion. A durable record is committed only to its original branch. */
+async function compactConversation(input) {
+    const { bot, threadId, generation, instance, model, excludedIds, manual } = input;
+    const task = store.taskByThread(bot.id, threadId);
+    if (!task || (!manual && cfg.context?.autoCompact === false))
+        return;
+    const messages = store.activePath(threadId);
+    const context = directContext(bot, threadId, messages);
+    const record = latestCompaction(messages);
+    // A retry must apply the existing record before considering another fold.
+    if (!manual && record && record.id !== task.appliedCompactionId)
+        return;
+    if (manual && record?.id === messages.at(-1)?.id && !record?.firstKeptId)
+        return;
+    const selected = selectReplay(context, {
+        budgetBytes: Math.max(1_024, context.reduce((n, entry) => n + Buffer.byteLength(entry.text) + 16, 0) + 4 * MAX_SUMMARY_BYTES + 1_024),
+        maxMessages: Number.MAX_SAFE_INTEGER, excludedIds, compaction: record,
+    });
+    const history = selected.transcript.filter(entry => entry.id);
+    if (!history.length)
+        return;
+    const measurement = task.lastContextModel === `${instance.instanceId}:${model}` && !task.rewound ? task.usage?.context : undefined;
+    const window = contextWindowFor(model, instance.models, measurement?.window);
+    const bytes = history.reduce((n, entry) => n + Buffer.byteLength(entry.text), 0);
+    let floor = task.contextFloor;
+    if (record && record.id === task.appliedCompactionId && floor === undefined && measurement?.tokens) {
+        floor = measurement.tokens;
+        store.patchTask(bot.id, threadId, { contextFloor: floor });
+    }
+    // Use the selected account's launch setting. "auto" and "off" supply no
+    // known numeric boundary; other providers do not inherit Claude's limit.
+    const nativeCompactAt = instance.driverKind === "claudeAgent"
+        ? Number(autoCompactWindow({ ...process.env, ...cfg.instances?.[instance.instanceId]?.environment })) : undefined;
+    if (!manual && !shouldCompact({ contextTokens: measurement?.tokens, estimatedBytes: bytes,
+        budget: compactBudget(window, cfg.context?.compactAt, nativeCompactAt), floor, window, nativeCompactAt }))
+        return;
+    const fold = manual ? { folded: history, firstKeptId: "" } : foldPoint(history);
+    if (!fold)
+        return;
+    const foldedThroughId = manual
+        ? context.findLast(entry => !excludedIds.has(entry.id))?.id
+        : fold.folded.at(-1)?.id;
+    if (!foldedThroughId)
+        return;
+    const prefix = JSON.stringify(messages);
+    const controller = new AbortController();
+    compactionControllers.set(threadId, { generation, controller });
+    try {
+        const summary = await draftSummary(fold.folded, { signal: controller.signal, generateText: instance.generateText?.bind(instance) });
+        if (!directTurnClaimIsCurrent(bot.id, generation, threadId))
+            throw new DirectTurnSetupCancelled("context summarization stopped");
+        controller.signal.throwIfAborted();
+        // Appended teammate results remain after the fold. A changed prefix is
+        // never summarized using stale input, even if the branch tip still exists.
+        if (prefix !== JSON.stringify(store.activePath(threadId).slice(0, messages.length))) {
+            if (manual)
+                throw new Error("the conversation changed during summarization — please retry");
+            return;
+        }
+        store.appendMessage(threadId, {
+            role: "bot", kind: "compaction",
+            compaction: { summary, firstKeptId: fold.firstKeptId, foldedThroughId,
+                tokensBefore: measurement?.tokens ?? Math.ceil(bytes / 4), by: manual ? "person" : "harness" },
+        }, { kind: "compaction.append", key: `${threadId}:${messages.at(-1)?.id}:${fold.firstKeptId}` });
+    }
+    finally {
+        if (compactionControllers.get(threadId)?.generation === generation)
+            compactionControllers.delete(threadId);
+    }
 }
 const handoffs = new Handoffs({
     order: (threadId) => store.activePath(threadId).filter(isContextMessage).map((m) => m.id),
@@ -4899,7 +5337,7 @@ function drainQueuedSends() {
 }
 /** Keep a person's words off the transcript until a direct-thread slot is
  * available. Reuse the existing cancellable, idempotent composer queue. */
-async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId) {
+async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender) {
     const capacity = botAtThreadCapacity(botId);
     if (capacity || threadBusy(botId, threadId) || parksBehindCoordination(botId, threadId)) {
         const reason = capacity ? "capacity" : undefined;
@@ -4911,7 +5349,7 @@ async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId)
         });
         return { ok: true, queued: true, queueId: queued.id, threadId, reason };
     }
-    const message = await startTurn(botId, text, { threadId, replyTo, sendId });
+    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender });
     return { ok: true, threadId, message };
 }
 /** How many start_thread calls one turn may make. Same spirit as the
@@ -5072,6 +5510,41 @@ async function finalScreenFrame(_botId, threadId) {
     settledScreenHashes.set(threadId, screenFrameHash(frame.png));
     return frame;
 }
+/** A short title for a fresh thread, from the provider's cheap one-shot
+ * (generateText — Haiku on Claude, the chat completion endpoint's text
+ * path on OpenAI-compatible engines). Null whenever that call cannot run,
+ * runs long, or answers with something that is not a plain short title;
+ * the caller keeps the snippet it already applied. */
+async function generateThreadTitle(provider, text) {
+    const prompt = [
+        "Name the conversation that begins with the message below.",
+        "Reply with only a short title: 3 to 6 words, plain text, no quotes, no trailing period.",
+        "Message:",
+        text.trim().slice(0, 1_500),
+    ].join("\n");
+    const expiry = new AbortController();
+    let timer;
+    try {
+        // the race caps the wait; the signal aborts the provider call itself,
+        // which every generateText driver that can honor it does
+        const reply = await Promise.race([
+            provider.generateText(prompt, { signal: expiry.signal }),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    expiry.abort();
+                    reject(new Error("thread title timed out"));
+                }, 10_000);
+            }),
+        ]);
+        return titleFromLlm(reply);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 // ── turn dispatch (upstream ProviderCommandReactor, miniature) ──────────
 async function startTurn(botId, text, opts) {
     workspaceMaintenance.assertAvailable();
@@ -5170,7 +5643,23 @@ async function startTurn(botId, text, opts) {
         clearInternalTurn(threadId);
     // a task takes its name from the first thing you asked it to do
     if (resolvedImages.text.trim() && !opts?.cardContinuation) {
-        store.titleTaskFromFirstMessage(bot.id, resolvedImages.text, threadId);
+        const titled = store.titleTaskFromFirstMessage(bot.id, resolvedImages.text, threadId);
+        // The snippet is only the fallback name. A cheap one-shot may trade it
+        // for a title a person would have typed, but never on a peer-opened
+        // row: adoption recognises those by the exact title their assignment
+        // gave them (openingRequestTitle), and a generated one would break the
+        // comparison it renames under. Everywhere else, the swap happens only
+        // while the row still carries the snippet — a rename by the person or
+        // by adoption has already broken that equality by then.
+        const snippet = titled?.title;
+        if (titled && snippet && !titled.openedBy?.botId && llmThreadTitlesEnabled(cfg) && instance.generateText) {
+            void generateThreadTitle(instance, resolvedImages.text)
+                .then((title) => {
+                if (title)
+                    store.retitleTask(bot.id, threadId, snippet, title);
+            })
+                .catch(() => undefined);
+        }
     }
     console.error(`[omb-turn] bot=${botId} text=${JSON.stringify(resolvedImages.text.slice(0, 70))} images=${turnImages.length} depth=${commsDepth} card=${Boolean(opts?.cardContinuation)}`);
     const instanceId = instance.instanceId;
@@ -5208,6 +5697,7 @@ async function startTurn(botId, text, opts) {
                 replyToId: opts?.replyTo?.id,
                 sendId: opts?.sendId,
                 peerAsk: opts?.peerAsk,
+                sender: opts?.sender,
             });
     }
     // A card continuation neither starts nor ends the person's ask: it
@@ -5224,148 +5714,7 @@ async function startTurn(botId, text, opts) {
             personAskAt.delete(threadId);
         }
     }
-    // transcript for API-backed drivers: settled text turns on the ACTIVE
-    // branch only — abandoned forks never reach the model
-    const skipTranscript = new Set([userMessage.id, ...(opts?.excludeMessageIds ?? [])]);
-    const activeMessages = store.activePath(threadId);
-    // This turn's own text carries the addressed request and, when resuming,
-    // every child result as JSON: neither is repeated from the transcript.
-    const coordinationChildren = opts?.coordination?.resumed
-        ? new Set(roomHandoffs.children(opts.coordination.id).map((child) => child.id)) : undefined;
-    for (const m of activeMessages) {
-        if (!opts?.coordination || !m.roomRequest)
-            continue;
-        if ((m.roomRequest.phase === "request" && m.roomRequest.id === opts.coordination.id) ||
-            (m.roomRequest.phase === "result" && coordinationChildren?.has(m.roomRequest.id)))
-            skipTranscript.add(m.id);
-    }
-    // A flat reply may deliberately point across a fork in the same thread.
-    // Resolve its quote from full storage, while the replay itself remains
-    // strictly limited to the selected branch below.
-    const messagesById = new Map(store.messagesFor(threadId).map((message) => [message.id, message]));
-    const context = activeMessages.filter(isContextMessage).map((m) => ({
-        id: m.id,
-        role: m.role === "user" ? "user" : "assistant",
-        text: m.roomRequest?.phase === "result" ? teammateReportContext(m.roomRequest.id, bot.id)
-            : m.role !== "user" && m.from ? peerMessageText(m.from.name, transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"))
-                : transcriptText(m, messagesById, cfg.profile?.name?.trim() || "User"),
-        keep: m.roomRequest?.phase === "result" || (m.role !== "user" && Boolean(m.from)),
-        ...(m.steered ? { steered: true } : {}),
-    }));
-    const contextOrder = context.map((m) => m.id);
-    const replayable = context.filter((m) => !skipTranscript.has(m.id));
-    const transcript = replayable.slice(-40).map((m) => ({ role: m.role, text: m.text }));
-    // After a rewind (edit / branch switch) the provider's native session
-    // still contains the abandoned branch: start a fresh session instead of
-    // resuming, and for cursor-resuming drivers replay the surviving path
-    // inline (transcript-replay drivers get it via transcript). The flag is
-    // cleared only once the turn is actually dispatched — clearing it here
-    // would cost the next attempt its history if this dispatch fails.
-    const rewound = Boolean(task.rewound);
-    // A fresh engine — the user switched this bot's model mid-thread — has no
-    // current session here either, so it gets the same replay. Distinct from
-    // rewound: the OTHER instances' cursors are left alone (a rewind wipes
-    // them all), and "fresh" is decided by who ran the last turn, not by
-    // whether we hold a cursor — see engineIsFresh.
-    const externalContextMarker = isExternalContextMarker(task.lastInstanceId)
-        ? task.lastInstanceId
-        : undefined;
-    const fresh = !rewound &&
-        !externalContextMarker &&
-        engineIsFresh({ instanceId, lastInstanceId: task.lastInstanceId, resumeCursors: task.resumeCursors, transcript });
-    // An engine that records what its session was handed resumes it with only
-    // the context messages outside that record. A record of another session
-    // (the one it replaced) or one that no longer lines up with the branch is
-    // not trusted: the session is rebuilt by the same replay as any other.
-    const strictResume = instance.adapter.capabilities.strictResume === true;
-    const cursor = task.resumeCursors[instanceId];
-    const handed = strictResume && !rewound && !fresh && !externalContextMarker && cursor !== undefined
-        ? task.handedMessages?.[instanceId] : undefined;
-    const unseen = handed && handedStateUsable(handed, cursor, contextOrder) ? unseenMessages(replayable, contextOrder, handed) : undefined;
-    // A teammate's result or reply: without records this turn would replay.
-    const externalUpdate = Boolean(opts?.coordination?.resumed || unseen?.some((m) => m.keep));
-    // What a resumed session keeps from its launch: the standing instructions
-    // (tools, servers and — for Claude — the model are passed on every launch),
-    // plus whatever this engine can only set when a session starts. Codex's
-    // thread/resume sends no model selection, and an effort it is not sent stays
-    // at the thread's last value, so both belong to the session there. An
-    // external update that finds any of it changed since the session started
-    // gets the fresh session and replay it always got, rather than a resume.
-    const persistentConfig = [bot.name, bot.title, bot.description, sectionContextSystemPrompt(bot.section),
-        ...(instance.driverKind === "codex" ? [model, effort ?? null] : [])];
-    const sessionConfig = (soul) => createHash("sha256").update(JSON.stringify([...persistentConfig, soul])).digest("hex").slice(0, 16);
-    const plannedConfig = sessionConfig(bot.soul);
-    // Agent-tool gate shared by skill authoring, the /setup turn-text rewrite,
-    // the setup prompt block, and the peer-comms integration below: a driver
-    // that never mounts agent tools (or a turn already at the comms-depth cap)
-    // must not be steered into — or told about — tools it cannot call.
     const agentsMounted = (commsDepth < MAX_COMMS_DEPTH || Boolean(opts?.coordination)) && instance.adapter.capabilities.agentsMcp === true;
-    const skillAuthoring = skillAuthoringEnabled(cfg) && agentsMounted;
-    // Setup mode's turn-text rewrite (parseSetupCommand/expandSetupTurnText)
-    // must not run ahead of a system prompt that can't explain it: a driver
-    // without agent tools sees the user's literal "/setup ..." message. The
-    // gate on whether the coaching block itself is active — setupModeActive,
-    // which also depends on the bot's soul/description — is decided below,
-    // from the same bot snapshot the prompt's soul is built from.
-    const setupText = agentsMounted ? expandSetupTurnText(providerText) : providerText;
-    const userTurnText = promptWithReply(skillAuthoring ? expandLearnTurnText(setupText) : setupText, opts?.replyTo, cfg.profile?.name?.trim() || "User");
-    // Decided again at dispatch when setup outlasted a soul edit (config).
-    const decideContext = (config) => {
-        const handedStale = Boolean(handed && (!unseen || (externalUpdate && handed.config !== config)));
-        const { block: unseenBlock, placed } = unseen && !handedStale ? renderUnseen(unseen) : { block: "", placed: [] };
-        const { turnText: contextTurnText, resume } = buildTurnContext({
-            text: userTurnText,
-            transcript,
-            rewound,
-            fresh,
-            externallyUpdated: Boolean(externalContextMarker) || handedStale,
-            replaysNatively: instance.driverKind === "grok",
-        });
-        // Snapshot the cursor alongside the context decision. An external result
-        // can arrive during async computer/setup work and clear the task cursor;
-        // this already-built turn must either keep its old session or replay on the
-        // following turn, never start a blank session with no transcript.
-        const resumeCursor = resume ? task.resumeCursors[instanceId] : undefined;
-        // A cursor the provider no longer honours must not brick the thread: the
-        // driver may fall back to ONE fresh session, and this is what it sends
-        // there, so the new session is not blank (server/resume-recovery.ts). A
-        // turn carrying an external update gets the replay it would have had.
-        const recoveryIsReplay = resumeCursor !== undefined && externalUpdate && transcript.length > 0;
-        const recoveryText = resumeCursor === undefined ? undefined : recoveryIsReplay
-            ? buildTurnContext({ text: userTurnText, transcript, rewound: false, fresh: false, externallyUpdated: true, replaysNatively: false }).turnText
-            : buildRecoveryText({ text: userTurnText, transcript });
-        // What this turn puts in front of the provider, for each session it can end
-        // up in (server/delta-context.ts). buildTurnContext prepends a replay only
-        // when it replays, so a changed text means the transcript was sent.
-        const carried = [...skipTranscript];
-        const windowIds = replayable.slice(-40).map((m) => m.id);
-        return {
-            turnText: withUnseenMessages(unseenBlock, contextTurnText),
-            resumeCursor, recoveryText, recoveryIsReplay,
-            handoff: strictResume ? {
-                botId: bot.id, instanceId, config, resumeCursor: typeof resumeCursor === "string" ? resumeCursor : undefined,
-                started: sessionStart(contextOrder, contextTurnText !== userTurnText ? windowIds : [], carried),
-                recovery: sessionStart(contextOrder, recoveryText !== undefined ? windowIds : [], carried),
-                resumed: sessionStart(contextOrder, [], [...placed, ...carried]),
-                placed, carried, own: [userMessage.id, ...(opts?.excludeMessageIds ?? [])],
-            } : undefined,
-        };
-    };
-    let dispatchContext = decideContext(plannedConfig);
-    const persona = [
-        `You are ${bot.name}, a personal bot in OpenMausBot.`,
-        bot.title && `Role: ${bot.title}.`,
-        bot.description && `About: ${bot.description}`,
-    ]
-        .filter(Boolean)
-        .join(" ");
-    // The SOUL.md mirror is checked here, at dispatch, and only reported:
-    // the prompt below reads bot.soul, never the file.
-    {
-        const drift = checkSoulDrift(bot.id, bot.soul ?? "", bot.soulHash ?? "");
-        if (drift.drift !== Boolean(bot.soulDrift))
-            store.patchBot(bot.id, { soulDrift: drift.drift });
-    }
     // busy flips immediately so the composer locks; the dispatch itself runs
     // in the background — box provisioning can take ~90s and must never
     // hang the HTTP request
@@ -5379,8 +5728,6 @@ async function startTurn(botId, text, opts) {
     // follow-ups: any normal turn may ask teammates to coordinate work.
     directFollowupSettlers.set(dispatchClaimId, { threadId, settle: opts?.onTurnSettled });
     directTurnDispatchClaims.set(threadId, { id: dispatchClaimId, botId, threadId, phase: "setup" });
-    if (dispatchContext.handoff)
-        handoffs.begin(threadId, dispatchClaimId, dispatchContext.handoff);
     directTurnBots.set(threadId, bot);
     beginInternalCapabilityGeneration(threadId, dispatchClaimId);
     if (!opts?.computerSelectionContinuation && !opts?.cardContinuation && !opts?.automationSource && !opts?.unattended &&
@@ -5404,6 +5751,161 @@ async function startTurn(botId, text, opts) {
     turnContext.delete(threadId);
     void (async () => {
         try {
+            await compactConversation({ bot, threadId, generation: dispatchClaimId, instance, model,
+                excludedIds: new Set([userMessage.id, ...(opts?.excludeMessageIds ?? [])]), manual: opts?.compactOnly === true });
+            if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId))
+                throw new DirectTurnSetupCancelled("turn stopped during context setup");
+            if (opts?.compactOnly) {
+                clearDirectTurnDispatch(threadId, dispatchClaimId);
+                revokeInternalCapabilityGeneration(threadId, dispatchClaimId);
+                settleDirectFollowup(dispatchClaimId);
+                releaseTurnResources(resourceOwner);
+                store.setTaskActivity(bot.id, threadId, "idle");
+                directTurnBots.delete(threadId);
+                retryDelegationsWaitingOn(bot.id);
+                drainQueuedSends();
+                drainConnectorResumes();
+                drainSecretResumes();
+                drainTeamSetupResumes();
+                drainDelegationWakes();
+                return;
+            }
+            // Keep the full branch order for delivery bookkeeping, but select actual
+            // replay entries by bytes. A compacted prefix is represented by its record.
+            const skipTranscript = new Set([userMessage.id, ...(opts?.excludeMessageIds ?? [])]);
+            const activeMessages = store.activePath(threadId);
+            const coordinationChildren = opts?.coordination?.resumed
+                ? new Set(roomHandoffs.children(opts.coordination.id).map((child) => child.id)) : undefined;
+            for (const m of activeMessages) {
+                if (!opts?.coordination || !m.roomRequest)
+                    continue;
+                if ((m.roomRequest.phase === "request" && m.roomRequest.id === opts.coordination.id) ||
+                    (m.roomRequest.phase === "result" && coordinationChildren?.has(m.roomRequest.id)))
+                    skipTranscript.add(m.id);
+            }
+            const context = directContext(bot, threadId, activeMessages);
+            const contextOrder = context.map(m => m.id);
+            const replayable = context.filter(m => !skipTranscript.has(m.id));
+            const record = latestCompaction(activeMessages);
+            const selection = selectReplay(context, { budgetBytes: cfg.context?.rebuildBytes ?? DEFAULT_REBUILD_BYTES, excludedIds: skipTranscript, compaction: record });
+            const transcript = selection.transcript.map(({ role, text }) => ({ role, text }));
+            const contextReset = selection.compacted > 0 && record?.id !== task.appliedCompactionId;
+            // The record is durable even if a crash occurs before this bookkeeping.
+            // A retry then sees the unapplied record again and rebuilds safely.
+            if (contextReset)
+                store.patchTask(bot.id, threadId, { resumeCursors: {} });
+            // After a rewind (edit / branch switch) the provider's native session
+            // still contains the abandoned branch: start a fresh session instead of
+            // resuming, and for cursor-resuming drivers replay the surviving path
+            // inline (transcript-replay drivers get it via transcript). The flag is
+            // cleared only once the turn is actually dispatched — clearing it here
+            // would cost the next attempt its history if this dispatch fails.
+            const rewound = Boolean(task.rewound);
+            // A fresh engine — the user switched this bot's model mid-thread — has no
+            // current session here either, so it gets the same replay. Distinct from
+            // rewound: the OTHER instances' cursors are left alone (a rewind wipes
+            // them all), and "fresh" is decided by who ran the last turn, not by
+            // whether we hold a cursor — see engineIsFresh.
+            const externalContextMarker = isExternalContextMarker(task.lastInstanceId)
+                ? task.lastInstanceId
+                : undefined;
+            const fresh = !rewound &&
+                !externalContextMarker &&
+                engineIsFresh({ instanceId, lastInstanceId: task.lastInstanceId, resumeCursors: task.resumeCursors, transcript: replayable });
+            // An engine that records what its session was handed resumes it with only
+            // the context messages outside that record. A record of another session
+            // (the one it replaced) or one that no longer lines up with the branch is
+            // not trusted: the session is rebuilt by the same replay as any other.
+            const strictResume = instance.adapter.capabilities.strictResume === true;
+            const cursor = task.resumeCursors[instanceId];
+            const handed = strictResume && !rewound && !contextReset && !fresh && !externalContextMarker && cursor !== undefined
+                ? task.handedMessages?.[instanceId] : undefined;
+            const unseen = handed && handedStateUsable(handed, cursor, contextOrder) ? unseenMessages(replayable, contextOrder, handed) : undefined;
+            // A teammate's result or reply: without records this turn would replay.
+            const externalUpdate = Boolean(opts?.coordination?.resumed || unseen?.some((m) => m.keep));
+            // What a resumed session keeps from its launch: the standing instructions
+            // (tools, servers and — for Claude — the model are passed on every launch),
+            // plus whatever this engine can only set when a session starts. Codex's
+            // thread/resume sends no model selection, and an effort it is not sent stays
+            // at the thread's last value, so both belong to the session there. An
+            // external update that finds any of it changed since the session started
+            // gets the fresh session and replay it always got, rather than a resume.
+            const persistentConfig = [bot.name, bot.title, bot.description, sectionContextSystemPrompt(bot.section),
+                ...(instance.driverKind === "codex" ? [model, effort ?? null] : [])];
+            const sessionConfig = (soul) => createHash("sha256").update(JSON.stringify([...persistentConfig, soul])).digest("hex").slice(0, 16);
+            const plannedConfig = sessionConfig(bot.soul);
+            // Agent-tool gate shared by skill authoring, the /setup turn-text rewrite,
+            // the setup prompt block, and the peer-comms integration below: a driver
+            // that never mounts agent tools (or a turn already at the comms-depth cap)
+            // must not be steered into — or told about — tools it cannot call.
+            const skillAuthoring = skillAuthoringEnabled(cfg) && agentsMounted;
+            // Setup mode's turn-text rewrite (parseSetupCommand/expandSetupTurnText)
+            // must not run ahead of a system prompt that can't explain it: a driver
+            // without agent tools sees the user's literal "/setup ..." message. The
+            // gate on whether the coaching block itself is active — setupModeActive,
+            // which also depends on the bot's soul/description — is decided below,
+            // from the same bot snapshot the prompt's soul is built from.
+            const setupText = agentsMounted ? expandSetupTurnText(providerText) : providerText;
+            const userTurnText = promptWithReply(skillAuthoring ? expandLearnTurnText(setupText) : setupText, opts?.replyTo, cfg.profile?.name?.trim() || "User");
+            // Decided again at dispatch when setup outlasted a soul edit (config).
+            const decideContext = (config) => {
+                const handedStale = Boolean(handed && (!unseen || (externalUpdate && handed.config !== config)));
+                const { block: unseenBlock, placed } = unseen && !handedStale ? renderUnseen(unseen) : { block: "", placed: [] };
+                const { turnText: contextTurnText, resume } = buildTurnContext({
+                    text: userTurnText,
+                    transcript,
+                    rewound,
+                    fresh: fresh || contextReset,
+                    externallyUpdated: Boolean(externalContextMarker) || handedStale,
+                    replaysNatively: instance.driverKind === "grok",
+                });
+                // Snapshot the cursor alongside the context decision. An external result
+                // can arrive during async computer/setup work and clear the task cursor;
+                // this already-built turn must either keep its old session or replay on the
+                // following turn, never start a blank session with no transcript.
+                const resumeCursor = resume ? task.resumeCursors[instanceId] : undefined;
+                // A cursor the provider no longer honours must not brick the thread: the
+                // driver may fall back to ONE fresh session, and this is what it sends
+                // there, so the new session is not blank (server/resume-recovery.ts). A
+                // turn carrying an external update gets the replay it would have had.
+                const recoveryIsReplay = resumeCursor !== undefined && externalUpdate && transcript.length > 0;
+                const recoveryText = resumeCursor === undefined ? undefined : recoveryIsReplay
+                    ? buildTurnContext({ text: userTurnText, transcript, rewound: false, fresh: false, externallyUpdated: true, replaysNatively: false }).turnText
+                    : buildRecoveryText({ text: userTurnText, transcript });
+                // What this turn puts in front of the provider, for each session it can end
+                // up in (server/delta-context.ts). buildTurnContext prepends a replay only
+                // when it replays, so a changed text means the transcript was sent.
+                const carried = [...skipTranscript];
+                const windowIds = selection.representedIds;
+                return {
+                    turnText: withUnseenMessages(unseenBlock, contextTurnText),
+                    resumeCursor, sessionReset: !resume, recoveryText, recoveryIsReplay,
+                    handoff: strictResume ? {
+                        botId: bot.id, instanceId, config, resumeCursor: typeof resumeCursor === "string" ? resumeCursor : undefined,
+                        started: sessionStart(contextOrder, contextTurnText !== userTurnText ? windowIds : [], carried),
+                        recovery: sessionStart(contextOrder, recoveryText !== undefined ? windowIds : [], carried),
+                        resumed: sessionStart(contextOrder, [], [...placed, ...carried]),
+                        placed, carried, own: [userMessage.id, ...(opts?.excludeMessageIds ?? [])],
+                    } : undefined,
+                };
+            };
+            let dispatchContext = decideContext(plannedConfig);
+            const persona = [
+                `You are ${bot.name}, a personal bot in OpenMausBot.`,
+                bot.title && `Role: ${bot.title}.`,
+                bot.description && `About: ${bot.description}`,
+            ]
+                .filter(Boolean)
+                .join(" ");
+            // The SOUL.md mirror is checked here, at dispatch, and only reported:
+            // the prompt below reads bot.soul, never the file.
+            {
+                const drift = checkSoulDrift(bot.id, bot.soul ?? "", bot.soulHash ?? "");
+                if (drift.drift !== Boolean(bot.soulDrift))
+                    store.patchBot(bot.id, { soulDrift: drift.drift });
+            }
+            if (dispatchContext.handoff)
+                handoffs.begin(threadId, dispatchClaimId, dispatchContext.handoff);
             const integrations = {};
             let browser = null;
             const selectedSkills = selectBundledSkills(providerText, [
@@ -5567,6 +6069,15 @@ async function startTurn(botId, text, opts) {
                     dropLease();
                     throw new Error(`${localVm.problem ?? "the Local VM is not ready"} (App Settings → Computers)`);
                 }
+                // The readiness walk can wait minutes for the desktop, and the group
+                // path re-validates its lease afterwards; the direct path needs the
+                // same guard so a turn never attaches MCP to a desktop another turn
+                // now owns.
+                const owner = localVmLeaseFor(localVmTarget).current(localVmOwnerBusy);
+                if (owner?.threadId !== claimThreadId || owner.botId !== bot.id) {
+                    dropLease();
+                    throw new Error("the Local VM lease expired while preparing the turn");
+                }
                 // Same contract as the Box and VPS branches below: without this the
                 // poller never starts, so the Local VM publishes no `screen` events
                 // and every client that only has the stream (the phone) waits
@@ -5660,22 +6171,7 @@ async function startTurn(botId, text, opts) {
                     computerKind = "vm";
             }
             else if (wants === "local") {
-                if (!shouldMountLocalComputer({
-                    requested: "local",
-                    hostPlatform: process.platform,
-                    providerSupportsLocal: mountsLocalComputer,
-                })) {
-                    // Name the condition that actually failed: a person told "choose an
-                    // ACP engine" while already on one has nowhere to go.
-                    throw new Error(mountsLocalComputer
-                        ? `local computer control is not available on ${process.platform} — select another destination`
-                        : "this model engine cannot control this computer — choose Claude or an ACP engine, or select another destination");
-                }
-                const cua = readCuaConnection();
-                if (!cua)
-                    throw new Error("CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
-                await bindTurnComputer(resourceOwner, "computer:host");
-                integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId));
+                integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
                 computerKind = "local";
             }
             // A VPS is a local-agent computer mount, never a remote agent runner.
@@ -5697,47 +6193,30 @@ async function startTurn(botId, text, opts) {
                     // — or fails after 30 minutes behind — its own long-running task.
                     // Container lifecycle (provision, start) is serialized by the
                     // runner's per-container lock, not by this turn.
-                    const vpsResource = `computer:vps:${vpsSshAlias(cfg)}:${bot.id}`;
                     vpsThreadStarted(bot.id, threadId);
-                    let remote;
-                    remote = vps.vpsStartsForTurn({ wants, autoStartVps: bot.autoStartVps, automationSource: opts?.automationSource })
-                        ? await vps.vpsComputerAction("provision", cfg, bot.id)
-                        : await vps.inspectVpsForAuto(cfg, bot.id);
-                    if (remote?.ready && remote.sshAlias) {
-                        const targetCfg = { ...cfg, vps: { sshAlias: remote.sshAlias } };
-                        const vpsMcp = vps.vpsComputerMcp(targetCfg, bot.id, remote.container_id ?? undefined);
-                        const vpsControl = controlIntegration(bot.id, threadId, dispatchClaimId);
-                        integrations.localComputer = {
-                            ...vpsMcp,
-                            env: { ...vpsMcp.env, OMB_CONTROL_URL: vpsControl.url, OMB_CONTROL_TOKEN: vpsControl.token },
-                        };
+                    const mounted = await mountBotVps(bot, resourceOwner, {
+                        start: vps.vpsStartsForTurn({ wants, autoStartVps: bot.autoStartVps, automationSource: opts?.automationSource }),
+                        // The claim restarts the poller with the capture, the way the
+                        // Local VM's lazy claim does.
+                        onClaimed: (vpsCapture) => {
+                            previewCapture = vpsCapture;
+                            if (threadBusy(bot.id, threadId)) {
+                                const touched = screenPollers.get(threadId)?.touched ?? false;
+                                stopScreenPoller(bot.id, threadId);
+                                startScreenPoller(bot.id, threadId, { computer: vpsCapture, ...(browserCapture ? { browser: browserCapture } : {}) }, { screenIsTheWork: touched });
+                            }
+                        },
+                    });
+                    if ("integration" in mounted) {
+                        integrations.localComputer = mounted.integration;
                         computerKind = "vps";
-                        // Live frames only once this turn holds the desktop: a poller on
-                        // a desktop another turn is driving would publish that turn's
-                        // screen as this one's. The claim restarts the poller with the
-                        // capture, the way the Local VM's lazy claim does.
-                        const vpsCapture = () => vps.vpsComputerScreenshot(targetCfg, bot.id);
-                        autoVmClaims.set(threadId, {
-                            owner: resourceOwner,
-                            lazy: true,
-                            label: "the VPS computer",
-                            claim: async () => {
-                                await bindTurnComputer(resourceOwner, vpsResource, true);
-                                previewCapture = vpsCapture;
-                                if (threadBusy(bot.id, threadId)) {
-                                    const touched = screenPollers.get(threadId)?.touched ?? false;
-                                    stopScreenPoller(bot.id, threadId);
-                                    startScreenPoller(bot.id, threadId, { computer: vpsCapture, ...(browserCapture ? { browser: browserCapture } : {}) }, { screenIsTheWork: touched });
-                                }
-                            },
-                        });
                     }
                     else {
                         vpsThreadEnded(bot.id, threadId);
                         if (wants === "cloud") {
-                            throw new Error(remote?.problem ?? "the VPS computer could not be created or reached");
+                            throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
                         }
-                        autoVpsProblem = remote?.problem ?? "the VPS computer could not be reached";
+                        autoVpsProblem = mounted.problem ?? "the VPS computer could not be reached";
                     }
                 }
             }
@@ -5750,62 +6229,15 @@ async function startTurn(botId, text, opts) {
                 computerKind = "box";
             }
             if (!teamComputer && mountsCloudComputer && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && box.boxConfigured(cfg)) {
-                // Explicit cloud turns can provision/wake the same bot's Box. Claim
-                // before any network await so setup itself cannot race another turn.
-                if (wants === "cloud")
-                    await bindTurnComputer(resourceOwner, `computer:box-bot:${bot.id}`, true);
-                if (!mountsCloudComputer && wants === "cloud") {
-                    throw new Error("this model engine cannot use computer tools — choose Claude, an ACP engine, or the Computer engine");
-                }
-                let b;
-                try {
-                    b = await box.findBox(cfg, bot.id);
-                }
-                catch (error) {
-                    // Auto may fall through when an optional provider is offline, but a
-                    // durable deletion fence must never be mistaken for "no computer".
-                    if (wants === "cloud" || error?.status === 409)
-                        throw error;
-                    b = null;
-                }
-                let lifecycle = box.boxTurnLifecycleAction({
+                const attached = await attachBotBox(bot, resourceOwner, {
                     explicitCloud: wants === "cloud",
                     canMount: mountsCloudComputer,
-                    state: typeof b?.state === "string" ? b.state : null,
+                    remoteAgent: instance.driverKind === "boxAgent",
                 });
-                if (lifecycle === "provision") {
-                    broadcast({ kind: "computer", botId: bot.id, state: "provisioning" });
-                    await box.provisionBox(cfg, bot.id, bot.name);
-                    b = await box.findBox(cfg, bot.id);
-                    lifecycle = box.boxTurnLifecycleAction({
-                        explicitCloud: true,
-                        canMount: mountsCloudComputer,
-                        state: typeof b?.state === "string" ? b.state : null,
-                    });
-                }
-                // an archived box answers every action with an error until it
-                // resumes — wake it here, once, instead of letting the agent
-                // discover it one failed tool call at a time. Explicit Cloud is the
-                // consent boundary for the resume (~8s, and it un-pauses billing).
-                if (lifecycle === "wake") {
-                    broadcast({ kind: "computer", botId: bot.id, state: "waking" });
-                    b = (await box.readyBox(cfg, bot.id)) ?? b;
-                    lifecycle = box.boxTurnLifecycleAction({
-                        explicitCloud: true,
-                        canMount: mountsCloudComputer,
-                        state: typeof b?.state === "string" ? b.state : null,
-                    });
-                }
-                if (b && lifecycle === "attach") {
-                    await bindTurnComputer(resourceOwner, `computer:box:${b.id}`, instance.driverKind === "boxAgent");
-                    previewCapture = () => box.screenshotBox(cfg, bot.id, b.id);
-                    if (mountsCloudComputer) {
-                        integrations.computer = {
-                            kind: "box",
-                            boxId: b.id,
-                            token: cfg.box.token,
-                            control: controlIntegration(bot.id, threadId, dispatchClaimId),
-                        };
+                if (attached) {
+                    previewCapture = attached.capture;
+                    if (attached.integration) {
+                        integrations.computer = attached.integration;
                         computerKind = "box";
                     }
                 }
@@ -5877,6 +6309,9 @@ async function startTurn(botId, text, opts) {
                 const ownThreadCreation = boundedCoordination && !opts?.coordination && Boolean(origin && !origin.peerAsk);
                 integrations.agents = agentsIntegration(bot.id, threadId, commsDepth, skillAuthoring, dispatchClaimId, opts?.coordination?.id, boundedCoordination, ownThreadCreation);
             }
+            if (instance.adapter.capabilities.hooks === true && hooksEnabled()) {
+                integrations.hooks = hooksIntegration(bot.id, threadId, dispatchClaimId);
+            }
             // @mentions in the user's message (the composer's tagging UI) become
             // an explicit coordination nudge. The agent still chooses the matching
             // peer tool, so the harness stays the single owner of turns/permissions.
@@ -5903,8 +6338,16 @@ async function startTurn(botId, text, opts) {
             // the engine cannot edit the project until the snapshot has settled.
             // snapshot() absorbs failures, so checkpointing may delay but never fail
             // a turn.
-            if (checkpointCwd)
-                await checkpoints.snapshot(bot.id, checkpointCwd, `turn ${threadId.slice(0, 8)}`);
+            if (checkpointCwd) {
+                const before = await checkpoints.snapshot(bot.id, checkpointCwd, `turn ${threadId.slice(0, 8)}`);
+                if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId)) {
+                    throw new DirectTurnSetupCancelled("turn stopped during checkpoint");
+                }
+                if (before)
+                    turnCheckpoints.set(threadId, { cwd: checkpointCwd, hash: before });
+                else
+                    turnCheckpoints.delete(threadId);
+            }
             if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId)) {
                 throw new DirectTurnSetupCancelled("turn stopped before dispatch");
             }
@@ -5944,7 +6387,15 @@ async function startTurn(botId, text, opts) {
                 if (browser) {
                     const frame = { binaryPath: browser.spec.command, env: browser.spec.env };
                     const session = browser.session;
-                    browserCapture = () => browserRuntime.withAgentAction(session, () => agentBrowserFrame(frame));
+                    // The preview shares the profile with tool calls: claim the same
+                    // exclusive browser:<session> resource the tools/call path claims,
+                    // and skip the frame while another thread holds it.
+                    browserCapture = async () => {
+                        const owner = turnResourceOwners.get(threadId);
+                        if (!owner || !claimTurnResource(owner, `browser:${session}`))
+                            throw new Error("another thread is using this browser");
+                        return browserRuntime.withAgentAction(session, () => agentBrowserFrame(frame));
+                    };
                 }
             }
             // An Auto conversation remembers where its first turn landed, so later
@@ -6016,9 +6467,21 @@ async function startTurn(botId, text, opts) {
             ]);
             runningTurnEngines.set(threadId, instance);
             // The prompt carries the soul as saved now. If it changed during setup,
-            // decide again from what is actually sent.
+            // decide again from what is actually sent — except on a continuation
+            // wake inside an automation run, where a delegated result is reviving
+            // its source unattended. That turn runs
+            // as the resume it planned (the new soul reaches the session through
+            // system-prompt refresh), so its record keeps the config of the session
+            // it resumed. The next dispatch then sees that stored config differ
+            // from the soul saved now and gives the source the fresh session and
+            // replay a soul change owes it. Re-deciding here instead would start a
+            // new session whose record already carries the new soul, and the
+            // following wake would resume it — a session started under the old soul
+            // must never survive a soul change by laundering its record. A
+            // person-facing delegated return still re-decides here: that turn is
+            // the one the person watches.
             const dispatchedConfig = sessionConfig(liveBot?.soul ?? bot.soul);
-            if (strictResume && dispatchedConfig !== plannedConfig)
+            if (strictResume && !(opts?.cardContinuation && continuingRoutine) && dispatchedConfig !== plannedConfig)
                 dispatchContext = decideContext(dispatchedConfig);
             // Before sendTurn: an adapter may emit the whole turn before it resolves.
             handoffs.dispatching(threadId, dispatchClaimId, dispatchContext.handoff);
@@ -6036,6 +6499,7 @@ async function startTurn(botId, text, opts) {
                 // the active task's own session — another task's cursor would
                 // resume the wrong conversation and defeat the context bubble
                 resumeCursor: dispatchContext.resumeCursor,
+                sessionReset: dispatchContext.sessionReset,
                 ...(dispatchContext.recoveryText !== undefined ? { recoveryText: dispatchContext.recoveryText } : {}),
                 ...(dispatchContext.recoveryIsReplay ? { recoveryIsReplay: true } : {}),
                 transcript,
@@ -6066,6 +6530,8 @@ async function startTurn(botId, text, opts) {
             // dispatched: the rewind is spent, and the old cursors are dead
             if (rewound)
                 store.patchTask(bot.id, threadId, { rewound: false, resumeCursors: {} });
+            if (contextReset && record)
+                store.patchTask(bot.id, threadId, { appliedCompactionId: record.id, contextFloor: undefined });
             // and this engine now owns the thread's most recent turn
             // Consume exactly the external-update generation this turn replayed.
             // If a newer delegated result landed during setup, its unique marker
@@ -6106,6 +6572,7 @@ async function startTurn(botId, text, opts) {
             const ownsLatestGeneration = directTurnGenerationByThread.get(threadId) === dispatchClaimId;
             releaseTurnResources(resourceOwner);
             if (ownsLatestGeneration) {
+                clearTurnDigestState(threadId);
                 releaseLocalVmThread(threadId);
                 vpsThreadEnded(bot.id, threadId);
                 watchdog.settle(threadId);
@@ -6507,7 +6974,7 @@ async function cloudRoutineReadiness() {
     if (!box.boxConfigured(cfg)) {
         return {
             ready: false,
-            reason: "Cloud VM needs a working Box API key in App Settings before this routine can run.",
+            reason: 'The Box-hosted agent needs a working Box API key. For the bot’s existing model and configured computer, including a self-hosted VPS, set run_on="maus" instead. Do not request a Box key unless the user actually wants the Box-hosted agent.',
         };
     }
     const instance = registry.instances().find((candidate) => candidate.driverKind === "boxAgent");
@@ -6702,6 +7169,7 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
             // staged provider images into a message, so dispose them here.
             for (const task of store.tasks(bot.id)) {
                 purgeGeneratedImagesForThread(task.threadId);
+                clearTurnDigestState(task.threadId);
                 settleDirectFollowup(directTurnGenerationByThread.get(task.threadId));
                 directTurnGenerationByThread.delete(task.threadId);
                 directTurnBots.delete(task.threadId);
@@ -6930,6 +7398,10 @@ const agentRoutine = (routine, latestRun) => {
         instructions: safeInstructions.slice(0, 2_000),
         instructionsTruncated: safeInstructions.length > 2_000,
         continuity: routine.continuity === true,
+        overlap: routine.overlap ?? "skip",
+        skippedRuns: routine.skippedRuns ?? 0,
+        lastSkippedAt: routineTimestamp(routine.lastSkippedAt),
+        failureStreak: routine.failureStreak ?? 0,
         enabled: routine.enabled,
         runOn: routine.runOn,
         durationMinutes: routine.durationMinutes,
@@ -7063,6 +7535,13 @@ const webhooks = new WebhookManager({
     findRun: (webhookId, deliveryId) => routines.webhookRunReceipt(webhookId, deliveryId),
     cancelQueued: (webhookId, message) => routines.cancelQueuedWebhook(webhookId, message),
     pendingRuns: (webhookId) => routines.activeWebhookRunCount(webhookId),
+    // delivery:"post" webhooks land in the bot's main chat as the bot's own message.
+    post: (botId, text) => {
+        const bot = store.bot(botId);
+        if (!bot)
+            return;
+        store.appendMessage(bot.threadId, { role: "bot", kind: "text", text });
+    },
 });
 let webhookIngress = null;
 let webhookIngressError = null;
@@ -7113,9 +7592,12 @@ function serializeRoomContext(threadId, userName, textOverride, readerBotId) {
     const messages = store.messagesFor(threadId);
     const messagesById = new Map(messages.map((message) => [message.id, message]));
     return messages
-        .filter((m) => (m.kind === "text" && m.text) || m.roomRequest?.phase === "result")
+        .filter((m) => (m.kind === "text" && m.text) || (m.kind === "digest" && m.digest) || m.roomRequest?.phase === "result")
         .slice(-GROUP_CONTEXT_MESSAGES)
         .map((m) => {
+        if (m.kind === "digest" && m.digest) {
+            return digestPromptLine(m.digest, m.from ? peerName(m.from.name) : "a bot");
+        }
         if (m.roomRequest?.phase === "result") {
             // Keep the chat receipt small without erasing the report from later
             // turns. Resolve from the existing bounded store and recheck access.
@@ -7125,8 +7607,9 @@ function serializeRoomContext(threadId, userName, textOverride, readerBotId) {
         // a bot's name is quoted on the speaker line, so it gets one line; a
         // user line that came through the API says so, since the reader would
         // otherwise take it for the person typing
+        const person = m.sender?.name ?? userName;
         const speaker = m.role === "user"
-            ? m.via === "api" ? `${userName} (sent through the local API, not typed)` : userName
+            ? m.via === "api" ? `${person} (sent through the local API, not typed)` : person
             : m.from ? peerName(m.from.name) : "Bot";
         const line = `${speaker}: ${transcriptText(rendered, messagesById, userName)}`;
         // A room reply is the room talking. A post_to_room message is another
@@ -7246,10 +7729,25 @@ setupRetry = 0) {
     let retainRoomVmLease = false;
     let roomSpeaker;
     let providerDispatched = false;
+    // The speaker's own This computer / Cloud mount, and what it must give back.
+    let roomComputerKind = null;
+    let roomVpsBotId = null;
+    let roomScreenBotId = null;
     const releaseRoomVmLease = () => {
         if (roomVmTarget && localVmThreadTargets.get(threadId) === roomVmTarget)
             releaseLocalVmThread(threadId);
         roomVmTarget = null;
+        // Only while this turn still owns the thread: a replacement speaker's
+        // poller and VPS record are its own to end.
+        const currentOwner = turnResourceOwners.get(threadId);
+        if (!currentOwner || currentOwner.generation === resourceOwner.generation) {
+            if (roomScreenBotId)
+                stopScreenPoller(roomScreenBotId, threadId);
+            if (roomVpsBotId)
+                vpsThreadEnded(roomVpsBotId, threadId);
+        }
+        roomScreenBotId = null;
+        roomVpsBotId = null;
         releaseTurnResources(resourceOwner);
     };
     let roomHandoffSourceSucceeded = false;
@@ -7267,6 +7765,9 @@ setupRetry = 0) {
         if ((hop < MAX_COMMS_DEPTH || orchestration?.roomHandoffId) && instance.adapter.capabilities.agentsMcp === true) {
             integrations.agents = agentsIntegration(bot.id, threadId, hop, skillAuthoring, internalGeneration, orchestration?.roomHandoffId, !orchestration || Boolean(orchestration.roomHandoffId));
         }
+        if (instance.adapter.capabilities.hooks === true && hooksEnabled()) {
+            integrations.hooks = hooksIntegration(bot.id, threadId, internalGeneration);
+        }
         const latestUser = [...store.activePath(threadId)].reverse().find((message) => message.role === "user" && message.kind === "text" && message.text);
         const resolvedLatestImages = latestUser?.text && !cardContinuation
             ? extractTurnImages(latestUser.text)
@@ -7420,11 +7921,10 @@ setupRetry = 0) {
                 readyBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true,
         });
-        // Channels currently mount a team Box or a Local VM. Do not let an
-        // explicitly selected, unsupported destination become a tool-free turn
-        // that can claim to have acted on that screen.
-        if (!roomTeamComputer && (roomPlan.computer === "cloud" || roomPlan.computer === "local")) {
-            throw new Error("This computer destination is not available in channels yet — open a bot thread to work on it, or use a Local VM, team computer, or Browser here");
+        // The Computer engine runs on the Box; this computer has no tools it can
+        // reach, exactly as a bot thread refuses it.
+        if (roomPlan.computer === "local" && instance.driverKind === "boxAgent") {
+            throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
         }
         // One place per room turn as well: a team computer reached on Auto means
         // no separate built-in browser.
@@ -7451,6 +7951,56 @@ setupRetry = 0) {
             integrations.computer = attached.integration;
             startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: instance.driverKind === "boxAgent" });
         }
+        // The speaker's own explicit place, mounted exactly as its bot thread
+        // mounts it. A channel has no conversation pin and no Auto fallback here:
+        // only a destination the person chose reaches a desktop.
+        const roomSetupIsCurrent = () => !isCancelled?.() &&
+            groupSpeakers.get(threadId) === roomSpeaker &&
+            activeInternalGenerationByThread.get(threadId) === internalGeneration;
+        if (!roomTeamComputer && roomPlan.computer === "local") {
+            integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
+            if (!roomSetupIsCurrent())
+                return false;
+            roomComputerKind = "local";
+        }
+        if (!roomTeamComputer && roomPlan.computer === "cloud") {
+            if (turnProvider(readyBot) === "vps") {
+                const unsupported = vps.vpsDriverError(instance.driverKind, instance.adapter.capabilities.computerMcp === true);
+                if (unsupported)
+                    throw new Error(unsupported);
+                vpsThreadStarted(readyBot.id, threadId);
+                roomVpsBotId = readyBot.id;
+                const mounted = await mountBotVps(readyBot, resourceOwner, {
+                    start: true,
+                    onClaimed: (capture) => {
+                        if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
+                            roomScreenBotId = readyBot.id;
+                            startScreenPoller(readyBot.id, threadId, { computer: capture });
+                        }
+                    },
+                });
+                if (!roomSetupIsCurrent())
+                    return false;
+                if (!("integration" in mounted))
+                    throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
+                integrations.localComputer = mounted.integration;
+                roomComputerKind = "vps";
+            }
+            else {
+                if (!box.boxConfigured(cfg))
+                    throw new Error("Cloud box is not configured — add a Box API key or choose Local VM");
+                const remoteAgent = instance.driverKind === "boxAgent";
+                const attached = await attachBotBox(readyBot, resourceOwner, { explicitCloud: true, canMount: remoteAgent, remoteAgent });
+                if (!roomSetupIsCurrent())
+                    return false;
+                if (!attached?.integration)
+                    throw new Error("the cloud computer could not be created or reached");
+                integrations.computer = attached.integration;
+                roomScreenBotId = readyBot.id;
+                startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
+                roomComputerKind = "box";
+            }
+        }
         // Room and Goal turns use the speaker's desktop, never the coordinator's.
         // Claim the same lease as direct turns before asynchronous VM setup.
         if (readyBot.computer === "vm") {
@@ -7577,9 +8127,9 @@ setupRetry = 0) {
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
             { id: "files", label: "File locations", text: workspace ? workspaceLocationsPrompt(bot.id, cwd, readyBot.cwd) : "" },
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
-            { id: "computer", label: "Computer", text: computerPrompt(roomTeamComputer ? instance.driverKind === "boxAgent" ? "box-agent" : "box" : roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
+            { id: "computer", label: "Computer", text: computerPrompt(roomTeamComputer || roomComputerKind === "box" ? instance.driverKind === "boxAgent" ? "box-agent" : "box" : roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : roomComputerKind) },
             { id: "team-computer", label: "Team computer", text: teamComputerPrompt(roomTeamComputer) },
-            { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : null, browser: Boolean(integrations.browser) }, { note: roomPlan.note }) },
+            { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : surfaceOfComputerKind(roomComputerKind), browser: Boolean(integrations.browser) }, { note: roomPlan.note }) },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
             { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
@@ -8226,9 +8776,10 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
         channelMode,
         queueId,
         via: options.via,
+        sender: options.sender,
     });
-    if (!group.dm)
-        store.titleGroupTaskFromFirstMessage(group.id, text, threadId);
+    const titled = group.dm ? null : store.titleGroupTaskFromFirstMessage(group.id, text, threadId);
+    const snippet = titled?.title;
     const archived = members.filter((member) => member.hidden);
     const mentionedArchived = mentionedBots(text, archived.map(({ name }) => ({ name })))[0];
     if (mentionedArchived) {
@@ -8273,6 +8824,23 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
         }
         return message;
     }
+    // The snippet is only the fallback name here too. The member about to
+    // answer supplies the same cheap one-shot the bot path uses, and the
+    // swap lands only while the row still carries the snippet — a rename by
+    // the person always wins. Channel tasks carry no peer provenance (no
+    // assignment opens them), and a member whose engine offers no text
+    // one-shot simply keeps the snippet.
+    const titleBot = goalCoordinator ?? responders[0];
+    const titleInstance = registry.get(titleBot.modelSelection.instanceId);
+    const titleText = extractTurnImages(text).text;
+    if (titled && snippet && titleText.trim() && llmThreadTitlesEnabled(cfg) && titleInstance?.generateText) {
+        void generateThreadTitle(titleInstance, titleText)
+            .then((title) => {
+            if (title)
+                store.retitleGroupTask(group.id, threadId, snippet, title);
+        })
+            .catch(() => undefined);
+    }
     const operation = beginGroupTurnOperation(groupId, threadId, goalCoordinator ? [] : responders.map((responder) => responder.id));
     if (goalCoordinator) {
         const runId = options.goalRunId?.trim() || `goal-${Date.now().toString(36)}-${randomUUID()}`;
@@ -9203,30 +9771,51 @@ async function localVmPayload(target) {
  * refuses.
  */
 async function readyLocalVmForTurn(botId, target, isCurrent = () => true) {
-    let status = await containerComputerStatus(undefined, undefined, target);
-    noteLocalVmSeen(target, status);
-    if (!isCurrent())
-        return status;
-    if (status.ready || !localVmRecreatableOnDemand(status))
-        return status;
-    if (target.key !== SHARED_LOCAL_VM_TARGET.key) {
-        const count = await existingPerBotLocalVmCount(status.runtime);
-        if (!isCurrent() || count >= localVmMaxInstances(cfg))
-            return status;
-    }
-    broadcast({ kind: "computer", botId, state: "provisioning" });
     localVmLifecycleBusy.add(target.key);
-    localVmProvisionBusy = true;
+    // Fence this target, and the cross-target capacity decision for creates,
+    // before the first await — the same synchronous-fence-then-count shape
+    // the panel route uses — so two concurrent turns cannot both pass the
+    // per-bot limit between count and create.
+    const ownsProvision = !localVmProvisionBusy;
+    if (ownsProvision)
+        localVmProvisionBusy = true;
+    let status;
     try {
-        status = await containerComputerAction("run", undefined, undefined, target);
-    }
-    catch {
-        // Keep the inspected status: its `problem` names the real obstacle, which
-        // is more use to the person than "podman run exited non-zero".
-        return status;
+        status = await containerComputerStatus(undefined, undefined, target);
+        noteLocalVmSeen(target, status);
+        if (!isCurrent())
+            return status;
+        if (status.ready || !localVmRecreatableOnDemand(status))
+            return status;
+        // Another creation is already mid-flight and its container is not yet
+        // visible to a count, so the safe answer is the inspected status —
+        // exactly what the over-cap path below returns.
+        if (!ownsProvision)
+            return status;
+        if (target.key !== SHARED_LOCAL_VM_TARGET.key) {
+            const count = await existingPerBotLocalVmCount(status.runtime);
+            if (!isCurrent() || count >= localVmMaxInstances(cfg))
+                return status;
+        }
+        broadcast({ kind: "computer", botId, state: "provisioning" });
+        try {
+            status = await containerComputerAction("run", undefined, undefined, target);
+        }
+        catch {
+            // Keep the inspected status: its `problem` names the real obstacle,
+            // which is more use to the person than "podman run exited non-zero".
+            // `run` can throw after the container exists, so arm the idle
+            // backstop anyway — expiry defers while the target is busy and its
+            // remove step no-ops unless a fresh probe sees a running container.
+            // The problem text stays as inspected: cheaply telling a half-created
+            // container from none here would need another container probe.
+            localVmIdleFor(target).touch();
+            return status;
+        }
     }
     finally {
-        localVmProvisionBusy = false;
+        if (ownsProvision)
+            localVmProvisionBusy = false;
         localVmLifecycleBusy.delete(target.key);
     }
     localVmIdleFor(target).touch();
@@ -9368,22 +9957,23 @@ function persistMcpServers(next) {
 async function describeInstances() {
     const configs = instanceConfigs(cfg);
     return (await registry.describe()).map((instance) => {
+        const entry = configs[instance.instanceId];
+        const described = entry?.icon ? { ...instance, icon: entry.icon } : instance;
         if (managedDesktop.owns(instance.instanceId))
             return {
-                ...instance, readOnly: true, managed: managedDesktop.info(instance.instanceId),
+                ...described, readOnly: true, managed: managedDesktop.info(instance.instanceId),
                 install: undefined, authentication: undefined, cli: undefined, cliCandidates: [],
             };
-        const entry = configs[instance.instanceId];
         if (entry?.driver !== "claudeAgent")
-            return instance;
+            return described;
         try {
             const claudeAccount = claudeAccountInfo(instance.instanceId, entry, instance.cli ?? instance.cliDefault ?? "claude");
-            return { ...instance, claudeAccount, install: { ...instance.install, signInCommand: claudeAccount.signInCommand } };
+            return { ...described, claudeAccount, install: { ...instance.install, signInCommand: claudeAccount.signInCommand } };
         }
         catch {
             // A malformed saved config remains a repairable shadow, never takes
             // the model picker down or offers a login for the wrong directory.
-            return { ...instance, install: { ...instance.install, signInCommand: undefined } };
+            return { ...described, install: { ...instance.install, signInCommand: undefined } };
         }
     });
 }
@@ -9703,6 +10293,7 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
         },
     }, keepLocked),
 });
+const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
     try {
@@ -10023,10 +10614,12 @@ const handleRequest = async (req, res) => {
             const body = await readBody(req, 1024);
             if (!sharedComputersEnabled(cfg))
                 return json(res, 404, { error: `no route: ${method} ${path}` });
-            if (!z.string().uuid().safeParse(body?.id).success || !["acquire", "release"].includes(body?.action))
+            if (!z.string().uuid().safeParse(body?.id).success || !["acquire", "release", "renew"].includes(body?.action))
                 return json(res, 400, { error: "Invalid computer lease" });
             if (body.action === "release")
                 sharedComputerControl.release(body.id);
+            else if (body.action === "renew")
+                sharedComputerControl.renew(body.id);
             else
                 sharedComputerControl.acquire(body.id);
             return json(res, 200, { ok: true });
@@ -10128,13 +10721,15 @@ const handleRequest = async (req, res) => {
             if (!internalSender) {
                 return json(res, 401, { error: "unauthorized" });
             }
-            const requiredCapabilityKind = path === "/api/internal/browser/mcp"
-                ? "browser"
-                : path.startsWith("/api/internal/connectors/")
-                    ? "connectors"
-                    : path === "/api/internal/computer-control"
-                        ? "computer"
-                        : "agents";
+            const requiredCapabilityKind = path === "/api/internal/hook"
+                ? "hooks"
+                : path === "/api/internal/browser/mcp"
+                    ? "browser"
+                    : path.startsWith("/api/internal/connectors/")
+                        ? "connectors"
+                        : path === "/api/internal/computer-control"
+                            ? "computer"
+                            : "agents";
             if (internalCapability.kind !== requiredCapabilityKind) {
                 return json(res, 403, { error: "this internal capability cannot access that service" });
             }
@@ -10226,6 +10821,27 @@ const handleRequest = async (req, res) => {
                 return json(res, 200, { status: "pending", surface: option.surface,
                     message: `End this turn now without using the previous computer tools. OpenMausBot will continue the original request on ${option.label} with a fresh tool connection.` });
             }
+            if (method === "POST" && path === "/api/internal/hook") {
+                const body = await readInternalBody();
+                return json(res, 200, ingestEngineHook(internalCapability, body));
+            }
+            if (method === "POST" && path === "/api/internal/tool-result") {
+                const body = await readInternalBody();
+                if (!body || typeof body.text !== "string" || !body.text || body.text.length > TOOL_RESULT_MAX_CHARS ||
+                    (body.truncated !== undefined && typeof body.truncated !== "boolean")) {
+                    return json(res, 400, { error: "Expected bounded text and an optional truncated boolean." });
+                }
+                return json(res, 201, toolResults.save(internalCapability, body.text, body.truncated));
+            }
+            if (method === "GET" && path === "/api/internal/tool-result") {
+                const id = url.searchParams.get("id") ?? "";
+                const offset = Number(url.searchParams.get("offset") ?? "0");
+                if (!/^r-[0-9a-f-]{36}$/.test(id) || !Number.isSafeInteger(offset) || offset < 0) {
+                    return json(res, 400, { error: "Expected a saved result id and a non-negative integer offset." });
+                }
+                const result = toolResults.read(internalCapability, id, offset);
+                return result ? json(res, 200, result) : json(res, 404, { error: "Saved result unavailable in this bot's conversation, expired, or offset out of range. Do not repeat an action to retrieve its output." });
+            }
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
                 const result = updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText }, { source: memorySource() });
@@ -10469,7 +11085,7 @@ const handleRequest = async (req, res) => {
                             return json(res, 404, { error: "no bot with that id — call list_bots and copy the exact id from the result" });
                         }
                         if (!canReachPeer(from, target)) {
-                            return json(res, 403, { error: "that bot belongs to a different section" });
+                            return json(res, 403, { error: `that bot belongs to a different section or is unavailable. ${PEER_ACCESS_HELP}` });
                         }
                         forBot = { botId: target.id, name: target.name };
                     }
@@ -10840,13 +11456,13 @@ const handleRequest = async (req, res) => {
                 // hard refusal — every peer turn has an accountable sender.
                 const from = internalSender;
                 if (!canAccessTeam(from, target.section) || target.hidden) {
-                    return json(res, 403, { error: "that bot belongs to a different section" });
+                    return json(res, 403, { error: `that bot belongs to a different section or is unavailable. ${PEER_ACCESS_HELP}` });
                 }
                 // The sender's allow-list, when it has one. Checked here rather than
                 // trusted from the roster: the tool call carries a bot id, and an id
                 // the model held from an earlier turn must not outlive the grant.
                 if (!peerAllowed(from, target.id)) {
-                    return json(res, 403, { error: "that bot is not on this bot's allowed peers — call list_bots for the ones you can reach" });
+                    return json(res, 403, { error: `that bot is not on this bot's allowed peers. ${PEER_ACCESS_HELP}` });
                 }
                 const fromThreadId = internalCapability.threadId;
                 // Rooms are conversations too. The task-only lookup here refused every
@@ -11098,10 +11714,10 @@ const handleRequest = async (req, res) => {
                 if (!target)
                     return json(res, 404, { error: "no such bot" });
                 if (!canAccessTeam(from, target.section) || target.hidden) {
-                    return json(res, 403, { error: "that bot belongs to a different section" });
+                    return json(res, 403, { error: `that bot belongs to a different section or is unavailable. ${PEER_ACCESS_HELP}` });
                 }
                 if (!peerAllowed(from, target.id)) {
-                    return json(res, 403, { error: "that bot is not on this bot's allowed peers — call list_bots for the ones you can reach" });
+                    return json(res, 403, { error: `that bot is not on this bot's allowed peers. ${PEER_ACCESS_HELP}` });
                 }
                 const fromThreadId = internalCapability.threadId;
                 if (!connectorThread(from.id, fromThreadId)) {
@@ -11491,10 +12107,10 @@ const handleRequest = async (req, res) => {
                     return json(res, 200, { error: "thread chains are limited to one hop — open the thread on yourself, or do this one here" });
                 }
                 if (!canAccessTeam(from, target.section) || target.hidden) {
-                    return json(res, 403, { error: "that bot belongs to a different section" });
+                    return json(res, 403, { error: `that bot belongs to a different section or is unavailable. ${PEER_ACCESS_HELP}` });
                 }
                 if (!peerAllowed(from, target.id)) {
-                    return json(res, 403, { error: "that bot is not on this bot's allowed peers — call list_bots for the ones you can reach" });
+                    return json(res, 403, { error: `that bot is not on this bot's allowed peers. ${PEER_ACCESS_HELP}` });
                 }
                 const task = store.createTask(target.id, title, false, projectId, { botId: from.id, name: from.name, at: Date.now() });
                 if (!task)
@@ -12257,8 +12873,8 @@ const handleRequest = async (req, res) => {
             return res.end(bytes);
         }
         // Download one local file only when this exact stored message grants it:
-        // a bot must render a Markdown link to it, while a user message must carry
-        // the exact standalone attachment tag written by the composer. The bot
+        // a bot must render a Markdown link or carry a generated-image attachment,
+        // while a user message must carry the standalone composer tag. The bot
         // branch derives conversation/workspace roots; the user branch is limited
         // to OpenMausBot's private attachment directory. This is deliberately not
         // a general path reader.
@@ -12276,7 +12892,7 @@ const handleRequest = async (req, res) => {
             const message = store.messagesFor(threadId).find((candidate) => candidate.id === m[2]);
             if (!message)
                 return json(res, 404, { error: "no such message" });
-            if (message.kind !== "text" || !message.text) {
+            if (message.kind !== "text") {
                 return json(res, 403, { error: "that message does not share this file" });
             }
             const body = method === "POST" ? await readBody(req) : null;
@@ -12286,20 +12902,27 @@ const handleRequest = async (req, res) => {
             }
             const href = method === "POST"
                 ? (typeof body.path === "string" ? body.path : "")
-                : messageImageTargetAt(message.text, Number(rawReference));
+                : messageImageTargetAt(message.text ?? "", Number(rawReference));
             if (!href)
                 return json(res, 400, { error: "path is required" });
+            // Generated image paths are durable capabilities on this exact message.
+            // They do not grant access to arbitrary workspace files or Markdown refs.
+            const generatedImage = method === "POST" && message.role === "bot" &&
+                message.attachments?.some((attachment) => attachment.kind === "image" && attachment.path === href) === true;
             let roots;
             let downloadName;
-            if (message.role === "user") {
-                downloadName = messageAttachmentName(message.text, href) ?? undefined;
+            if (generatedImage) {
+                roots = [ATTACHMENTS_DIR];
+            }
+            else if (message.role === "user") {
+                downloadName = messageAttachmentName(message.text ?? "", href) ?? undefined;
                 if (!downloadName) {
                     return json(res, 403, { error: "that message does not share this file" });
                 }
                 roots = [ATTACHMENTS_DIR];
             }
             else {
-                if (!messageReferencesFile(message.text, href)) {
+                if (!messageReferencesFile(message.text ?? "", href)) {
                     return json(res, 403, { error: "that bot message does not link to this file" });
                 }
                 const senderId = directBot?.id ?? message.from?.botId;
@@ -12328,7 +12951,7 @@ const handleRequest = async (req, res) => {
                 });
             }
             const file = await openMessageFile(href, roots);
-            if (streamsMessageImage && !file.mime.startsWith("image/")) {
+            if ((streamsMessageImage || generatedImage) && !file.mime.startsWith("image/")) {
                 await file.handle.close();
                 return json(res, 415, { error: "only images can be previewed here" });
             }
@@ -12563,8 +13186,9 @@ const handleRequest = async (req, res) => {
             const userName = cfg.profile?.name?.trim() || "User";
             const lines = [`# ${title}`, ""];
             for (const msg of messages) {
+                const sentBy = msg.sender?.name ?? userName;
                 const who = msg.role === "user"
-                    ? msg.via === "api" ? `${userName} (via the local API)` : userName
+                    ? msg.via === "api" ? `${sentBy} (via the local API)` : sentBy
                     : (msg.from?.name ?? bot?.name ?? "Bot");
                 if (msg.kind === "text" && msg.text)
                     lines.push(`**${who}:**`, "", msg.text, "");
@@ -12852,6 +13476,7 @@ const handleRequest = async (req, res) => {
                         schedule: routine.schedule,
                         durationMinutes: routine.durationMinutes,
                         ...(routine.timeoutMinutes === undefined ? {} : { timeoutMinutes: routine.timeoutMinutes }),
+                        ...(routine.overlap ? { overlap: routine.overlap } : {}),
                     });
                     createdRoutineIds.push(created.id);
                 }
@@ -13006,14 +13631,35 @@ const handleRequest = async (req, res) => {
             if (channelTaskSwitchBlocked(group, m[2])) {
                 return json(res, 409, { error: "this channel is working or waiting on you in another task" });
             }
+            // Parsed before the switch: a rejected parameter must not leave the
+            // channel pointing at another thread.
+            const requestedMessages = url.searchParams.get("messages");
+            const switchLimit = pageSize(requestedMessages);
+            if (switchLimit === null)
+                return json(res, 400, { error: "messages must be a non-negative whole number" });
             const switched = store.switchGroupTask(group.id, m[2]);
             if (!switched)
                 return json(res, 404, { error: "no such channel task" });
-            const fresh = groupWithThread(switched);
-            broadcast({ kind: "group", group: fresh });
-            const responseGroup = url.searchParams.get("messages") === "0"
-                ? { ...publicGroupState(switched), tasks: store.groupTasks(switched.id) }
-                : fresh;
+            const switchedSettings = { ...publicGroupState(switched), tasks: store.groupTasks(switched.id) };
+            // The frame says the channel moved; it is not a transcript delivery.
+            // A long room's whole history over SSE is the payload `?messages=`
+            // exists to avoid, and it would also overwrite a bounded snapshot on
+            // every other client. One default page is enough to render the switch;
+            // anything earlier pages back through /api/threads/:id/messages.
+            broadcast({
+                kind: "group",
+                group: { ...switchedSettings, ...messagePage(switched.threadId, DEFAULT_PAGE) },
+            });
+            // "0" predates paging and means settings only — no `messages` key at
+            // all, which clients tell apart from an empty page. A positive page is
+            // the transcript a client can actually hold; omitting the parameter
+            // keeps the whole transcript, as it always did — and only that branch
+            // materialises it.
+            const responseGroup = requestedMessages === "0"
+                ? switchedSettings
+                : switchLimit === undefined
+                    ? groupWithThread(switched)
+                    : { ...switchedSettings, ...messagePage(switched.threadId, switchLimit) };
             return json(res, 200, { group: responseGroup });
         }
         if (m && method === "PATCH") {
@@ -13052,6 +13698,8 @@ const handleRequest = async (req, res) => {
             lastReply.delete(m[2]);
             cancelTeamSetupResumesForThread(m[2]);
             const updated = store.deleteGroupTask(group.id, m[2]);
+            if (updated)
+                clearTurnDigestState(m[2]);
             if (!updated)
                 return json(res, 400, { error: "a channel keeps at least one task" });
             rejectDeletedThreadSkillStages(stagedSkillCleanups);
@@ -13094,6 +13742,7 @@ const handleRequest = async (req, res) => {
             for (const threadId of threadIds) {
                 cancelTeamSetupResumesForThread(threadId);
                 lastReply.delete(threadId);
+                clearTurnDigestState(threadId);
             }
             routines.disableForGroup(group.id);
             store.deleteGroup(group.id);
@@ -13190,7 +13839,7 @@ const handleRequest = async (req, res) => {
                     });
                     return { ok: true, queued: true, queueId: queued.id, threadId };
                 }
-                const message = startGroupTurn(current.id, text, replyTo, sendId, channelMode, undefined, { via });
+                const message = startGroupTurn(current.id, text, replyTo, sendId, channelMode, undefined, { via, sender: messageSender(auth) });
                 return { ok: true, threadId, message };
             });
             return json(res, 202, receipt);
@@ -14612,12 +15261,24 @@ const handleRequest = async (req, res) => {
             });
             return json(res, 200, { message: patched });
         }
-        m = path.match(/^\/api\/bots\/([\w-]+)\/messages$/);
+        m = path.match(/^\/api\/bots\/([\w-]+)\/messages(?:\/(guarded))?$/);
         if (m && method === "POST") {
+            const guarded = m[2] === "guarded";
             const body = await readBody(req);
             if (!body || typeof body !== "object" || Array.isArray(body)) {
                 return json(res, 400, { error: "body must be a JSON object" });
             }
+            // External interfaces must opt into a distinct route: an older server
+            // returns 404 rather than silently ignoring safety preconditions.
+            if (guarded && !z.object({
+                threadId: z.string().regex(/^[\w-]+$/),
+                sendId: z.string().regex(/^[A-Za-z0-9_-]{16,80}$/),
+                text: z.string().min(1),
+                expectedActiveLeafId: z.string().regex(/^[\w-]+$/).nullable(),
+                replyToId: z.string().optional(),
+            }).strict().safeParse(body).success) {
+                return json(res, 400, { error: "guarded sends require threadId, sendId, text and expectedActiveLeafId" });
+            }
             const text = String(body.text ?? "").trim();
             if (!text)
                 return json(res, 400, { error: "text required" });
@@ -14632,7 +15293,8 @@ const handleRequest = async (req, res) => {
             // receipt after a task switch, while a genuinely new send still has to
             // target the task that is active now.
             const threadId = body.threadId ?? bot.threadId;
-            noteTurnTrigger(threadId, auth);
+            if (!guarded)
+                noteTurnTrigger(threadId, auth);
             // The send is acknowledged before the turn starts, so a workspace at its
             // spend limit is refused here, where the person can see it.
             try {
@@ -14679,6 +15341,23 @@ const handleRequest = async (req, res) => {
                 if (!store.taskByThread(currentAtStart.id, threadId)) {
                     throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
                 }
+                if (guarded) {
+                    // There is no await between these checks and startTurn's
+                    // synchronous transcript append / runtime reservation. In
+                    // particular, never steer or enqueue under stale permissions.
+                    if (approvalModeFor(currentAtStart) !== "ask" || currentAtStart.autoApprove === true || currentAtStart.alwaysAllow?.length) {
+                        throw Object.assign(new Error("guarded sends require Ask mode without remembered permissions"), { status: 409, code: "guarded_permissions" });
+                    }
+                    if (store.activeLeaf(threadId) !== body.expectedActiveLeafId) {
+                        throw Object.assign(new Error("the conversation changed before this message could start"), { status: 409, code: "guarded_branch" });
+                    }
+                    if (currentAtStart.busy || threadBusy(bot.id, threadId) || botAtThreadCapacity(bot.id) || parksBehindCoordination(bot.id, threadId) || activeGroupTurnForBot(bot.id)) {
+                        throw Object.assign(new Error("wait for a free thread slot before retrying this message"), { status: 409, code: "guarded_busy" });
+                    }
+                    noteTurnTrigger(threadId, auth);
+                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth) });
+                    return { ok: true, threadId, message };
+                }
                 // Claude can accept the message inside its live turn. If the write
                 // loses a race with turn settlement, or the engine cannot steer, the
                 // existing server-side queue records it atomically for the next turn.
@@ -14733,13 +15412,14 @@ const handleRequest = async (req, res) => {
                             replyToId: replyTo?.id,
                             sendId,
                             steered: true,
+                            sender: messageSender(auth),
                         });
                         // Offered to the next turn again unless the person stops this one.
                         handoffs.steered(threadId, steerTarget, instance?.instanceId, message.id);
                         return { ok: true, steered: true, threadId, message };
                     }
                     if (!current.busy) {
-                        return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId);
+                        return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth));
                     }
                     const queued = queueSteeredMessage(current.id, threadId, text, {
                         replyToId: replyTo?.id,
@@ -14748,7 +15428,7 @@ const handleRequest = async (req, res) => {
                     });
                     return { ok: true, queued: true, queueId: queued.id, threadId };
                 }
-                return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId);
+                return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth));
             });
             return json(res, 202, receipt);
         }
@@ -14838,6 +15518,19 @@ const handleRequest = async (req, res) => {
                 drainQueuedSends();
             return json(res, 200, { ok: true, queued: true, threadId: bot.threadId });
         }
+        // Compaction shares normal turn admission and Stop, but never executes
+        // an agent turn or provisions a computer. It preserves the full history.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/compact$/);
+        if (m && method === "POST") {
+            const body = await readBody(req);
+            requirePinnedClientThread(m[1], body?.threadId);
+            const bot = requestedTaskBot(m[1], body?.threadId);
+            noteTurnTrigger(bot.threadId, auth);
+            await startTurn(bot.id, "Summarize conversation context", {
+                threadId: bot.threadId, compactOnly: true, cardContinuation: true,
+            });
+            return json(res, 202, { ok: true, threadId: bot.threadId });
+        }
         // edit a user message → fork the conversation there and rerun the turn.
         // Rewinding a live thread is refused, exactly like switching versions
         // below: interrupting mid-flight and branching under the dying turn is
@@ -15187,14 +15880,26 @@ const handleRequest = async (req, res) => {
                 return json(res, 409, { error: "this bot is securely saving a credential — try again when it finishes" });
             }
             // Navigation only: execution owns its thread, never this selected id.
+            const requestedMessages = url.searchParams.get("messages");
+            const switchLimit = pageSize(requestedMessages);
+            if (switchLimit === null)
+                return json(res, 400, { error: "messages must be a non-negative whole number" });
             const switched = store.switchTask(bot.id, m[2]);
             if (!switched)
                 return json(res, 404, { error: "no such task" });
-            const fresh = botWithThread(switched);
-            broadcast({ kind: "bot", bot: fresh });
-            const responseBot = url.searchParams.get("messages") === "0"
-                ? { ...wireBot(switched), tasks: store.tasks(switched.id).map(wireTask) }
-                : fresh;
+            const switchedSettings = { ...wireBot(switched), tasks: store.tasks(switched.id).map(wireTask) };
+            // Bounded for the same reason as the channel switch above.
+            broadcast({
+                kind: "bot",
+                bot: { ...switchedSettings, ...messagePage(switched.threadId, DEFAULT_PAGE) },
+            });
+            // "0" is settings only, a positive page is a bounded transcript, and no
+            // parameter is the whole thread — the one branch that materialises it.
+            const responseBot = requestedMessages === "0"
+                ? switchedSettings
+                : switchLimit === undefined
+                    ? botWithThread(switched)
+                    : { ...switchedSettings, ...messagePage(switched.threadId, switchLimit) };
             return json(res, 200, { bot: responseBot });
         }
         if (m && method === "PATCH") {
@@ -15326,6 +16031,7 @@ const handleRequest = async (req, res) => {
             const updated = store.deleteTask(m[1], m[2]);
             if (!updated)
                 return json(res, 404, { error: "no such task" });
+            clearTurnDigestState(m[2]);
             handoffs.forget(m[2]);
             settleDirectFollowup(directTurnGenerationByThread.get(m[2]));
             rejectDeletedThreadSkillStages(stagedSkillCleanups);
@@ -15349,6 +16055,11 @@ const handleRequest = async (req, res) => {
             if (method === "GET" && action === "control" && found) {
                 return json(res, 200, computerControl.snapshot(teamComputerOwner(found.id)));
             }
+            // A GET carries no body, so the content-type gate below can only
+            // mislead: the control snapshot is the sole GET on this subtree.
+            if (method === "GET" && action !== "control") {
+                return json(res, 404, { error: "unknown team computer action" });
+            }
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json"))
                 return json(res, 415, { error: "content-type must be application/json" });
             const body = await readBody(req);
@@ -15546,6 +16257,12 @@ const handleRequest = async (req, res) => {
             if (vmOwner && (action === "stop" || action === "remove" || action === "run")) {
                 return json(res, 409, { error: "the Local VM is being used by a bot — stop that turn first" });
             }
+            // A lease can lapse under a long, quiet turn whose thread still holds
+            // the desktop, so stop/remove must also refuse while the thread
+            // registry or a setup action pins it — the same guard bot deletion uses.
+            if ((action === "stop" || action === "remove") && (localVmActiveThreads.has(SHARED_LOCAL_VM_TARGET.key) || localVmLifecycleBusy.has(SHARED_LOCAL_VM_TARGET.key))) {
+                return json(res, 409, { error: localVmActiveThreads.has(SHARED_LOCAL_VM_TARGET.key) ? "the Local VM is being used by a bot — stop that turn first" : "another Local VM setup action is still running" });
+            }
             if (action === "pull")
                 localVmImageBusy = true;
             else
@@ -15573,6 +16290,7 @@ const handleRequest = async (req, res) => {
         }
         if (method === "POST" && path === "/api/local-computer/screenshot") {
             localVmIdleFor(SHARED_LOCAL_VM_TARGET).touch();
+            res.setHeader("cache-control", "private, no-store");
             return json(res, 200, {
                 image: await containerComputerScreenshot(undefined, undefined, SHARED_LOCAL_VM_TARGET),
             });
@@ -15609,6 +16327,11 @@ const handleRequest = async (req, res) => {
             const vmOwner = localVmLeaseFor(target).current(localVmOwnerBusy);
             if (vmOwner)
                 return json(res, 409, { error: "this bot is using its Local VM — stop the turn first" });
+            // Mirrors the shared-target guard above: the lease alone can miss a
+            // long, quiet turn, and a setup action must not be torn down mid-call.
+            if ((action === "stop" || action === "remove") && (localVmActiveThreads.has(target.key) || localVmLifecycleBusy.has(target.key))) {
+                return json(res, 409, { error: localVmActiveThreads.has(target.key) ? "this bot is using its Local VM — stop the turn first" : "this bot's Local VM setup action is still running" });
+            }
             // Fence this target, and the cross-target capacity decision for creates,
             // before the first await so two requests cannot both pass the limit.
             localVmLifecycleBusy.add(target.key);
@@ -15657,6 +16380,7 @@ const handleRequest = async (req, res) => {
             }
             const target = localVmTargetForBot(bot.id);
             localVmIdleFor(target).touch();
+            res.setHeader("cache-control", "private, no-store");
             return json(res, 200, {
                 image: await containerComputerScreenshot(undefined, undefined, target),
             });
@@ -15665,7 +16389,7 @@ const handleRequest = async (req, res) => {
         // child proves it is OURS by echoing its pid (a stray dev server has
         // the same API shape but a different pid)
         if (method === "GET" && path === "/api/health") {
-            return json(res, 200, { app: "openmausbot", pid: process.pid, static: Boolean(STATIC_DIR) });
+            return json(res, 200, { app: "openmausbot", pid: process.pid, static: Boolean(STATIC_DIR), capabilities: { guardedMessages: 1 } });
         }
         // The bots' browser engine: install it on this machine (agent-browser +
         // a Chrome for Testing, a one-time download), or ask how that is going.
@@ -15828,6 +16552,37 @@ const handleRequest = async (req, res) => {
         const companyMutation = /^\/api\/instances\/(company\.[\w.-]+)(?:\/|$)/.exec(path);
         if (companyMutation && method !== "GET")
             return json(res, 403, { error: "Company accounts are read-only here. Manage this connection in desktop Settings." });
+        const instanceIconPatch = /^\/api\/instances\/([\w.-]+)\/icon$/.exec(path);
+        if (method === "PATCH" && instanceIconPatch) {
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            const parsed = providerIconPatchSchema.safeParse(await readBody(req, 192 * 1024));
+            if (!parsed.success) {
+                const detail = parsed.error.issues[0]?.message;
+                return json(res, 400, { error: detail && detail !== "Invalid input" ? detail : "Choose a built-in icon or upload a PNG, JPEG, or WebP image up to 128 KB." });
+            }
+            if (parsed.data.icon) {
+                const invalid = providerIconError(parsed.data.icon);
+                if (invalid)
+                    return json(res, 400, { error: invalid });
+            }
+            if (providerConfigBusy)
+                return json(res, 409, { error: "provider settings are already being updated" });
+            providerConfigBusy = true;
+            try {
+                const changed = withInstanceIcon(cfg, instanceIconPatch[1], parsed.data.icon);
+                if (!changed.ok)
+                    return json(res, 404, { error: `unknown instance "${instanceIconPatch[1]}"` });
+                saveConfig({ instances: changed.instances }, { replaceInstances: true });
+                cfg.instances = changed.instances;
+                broadcast({ kind: "config", ...configStatus() });
+                return json(res, 200, { instances: await describeInstances() });
+            }
+            finally {
+                providerConfigBusy = false;
+            }
+        }
         if (method === "POST" && path === "/api/instances/claude-accounts") {
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
@@ -17054,8 +17809,10 @@ const handleRequest = async (req, res) => {
                 try {
                     if (m[2] === "join")
                         return json(res, 200, await box.joinReadyBox(cfg, key));
-                    if (m[2] === "screenshot")
+                    if (m[2] === "screenshot") {
+                        res.setHeader("cache-control", "private, no-store");
                         return json(res, 200, await box.screenshotBox(cfg, key));
+                    }
                     return json(res, 200, await box.sleepBox(cfg, key));
                 }
                 finally {
@@ -17071,6 +17828,7 @@ const handleRequest = async (req, res) => {
                         });
                         vpsPreviewRequests.set(botId, preview);
                     }
+                    res.setHeader("cache-control", "private, no-store");
                     return json(res, 200, await preview);
                 }
                 // Opening the existing SSH viewer can coexist with a capture. Start,
@@ -17136,6 +17894,7 @@ const handleRequest = async (req, res) => {
                     case "exec":
                         return json(res, 200, await box.execOnBox(cfg, botId, boxCommand ?? ""));
                     case "screenshot":
+                        res.setHeader("cache-control", "private, no-store");
                         return json(res, 200, await box.screenshotBox(cfg, botId));
                 }
             }
@@ -17147,7 +17906,10 @@ const handleRequest = async (req, res) => {
     }
     catch (e) {
         const status = e?.status ?? 500;
-        return json(res, status, { error: e instanceof Error ? e.message : String(e) });
+        const candidateCode = e?.code;
+        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions"].includes(candidateCode)
+            ? candidateCode : undefined;
+        return json(res, status, { error: e instanceof Error ? e.message : String(e), ...(code ? { code } : {}) });
     }
     finally {
         releaseWorkspaceRequest?.();