openmausbot 0.1.85 → 0.1.86

package/dist-server/server/index.js

@@ -1,6 +1,7 @@
 // OpenMausBot server — the harness host. Clients hold no transports
 // (upstream rule): the React app dispatches typed commands over HTTP and
 // folds one SSE event stream; every provider process runs here.
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { existsSync, readFileSync, rmSync, mkdirSync } from "node:fs";
 import { writeFileAtomic } from "./atomic.js";
@@ -8,6 +9,7 @@ import { rm as removeDirectory } from "node:fs/promises";
 import { createServer } from "node:http";
 import { ToolResults, TOOL_RESULT_MAX_CHARS } from "./tool-results.js";
 import { extname, join } from "node:path";
+import { authorizeExternalRuntime, externalRuntimeIsActive } from "./external-runtime.js";
 import { z } from "zod";
 import { selectReplay, DEFAULT_REBUILD_BYTES, MAX_SUMMARY_BYTES } from "./context-rebuild.js";
 import { draftSummary, foldPoint } from "./compaction-summary.js";
@@ -16,6 +18,7 @@ import { autoCompactWindow } from "./drivers/claude.js";
 import { SharedComputers, sharedComputerOperation, sharedComputerRegistration } from "./shared-computers.js";
 import { SharedComputerControl } from "./shared-computer-control.js";
 import { RoomHandoffs } from "./room-handoffs.js";
+import { assertRequestTarget, guardedRequestPath, requestConflict, requestNeedsInput, requestSourceForCard } from "./guarded-requests.js";
 import { botAvatarUrlFromStoredPath } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
@@ -31,7 +34,7 @@ import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrows
 import * as checkpoints from "./checkpoints.js";
 import { commandReceipt } from "./commands.js";
 import { buildTurnDigest, coverageForDriver, digestPromptLine, renderDigest, toolEvidence } from "./digest.js";
-import { appendDecision, readDecisions, flushDecisionLog } from "./decision-log.js";
+import { appendDecision, bindDecisionRetention, boundRetentionDays, decisionRetentionDays, decisionsCsv, flushDecisionLog, pruneDecisions, readDecisionRange, readDecisions, withDecisionActor } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
@@ -50,19 +53,20 @@ import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
 import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAGE_GROUPINGS, flushUsageLedger } from "./usage-ledger.js";
+import { ledgerCost } from "./model-prices.js";
 import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
-import { assertWithinBudget, noteSpend, spendState } from "./spend.js";
+import { assertWithinBudget, noteSpend, spendAlertText, spendState, takeSpendAlert } from "./spend.js";
 import { fleetAvailable, fleetRequest, fleetSocketPath } from "./fleet-client.js";
 import { entitled } from "./enterprise.js";
 import { HOSTED_CONTRACT_HEADER, HOSTED_CONTRACT_METADATA, HOSTED_CONTRACT_VERSION } from "./hosted-contract.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
-import { blockedTarget, buildNotification } from "./notify.js";
+import { blockedTarget, buildNotification, buildSpendNotification } from "./notify.js";
 import { isModelVariant, newId, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { decodeGeneratedImage } from "./generated-image.js";
@@ -71,9 +75,9 @@ import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
 import { getOrCreateChannel, mirrorActivity, mirrorExchange, mirrorReply } from "./comms-visibility.js";
-import { readMessageText, recallMessages, recentMessages, searchMessages, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups } from "./message-db.js";
+import { readMessageText, recallMessages, recentMessages, searchMessages, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups, threadsReferencing } from "./message-db.js";
 import { briefCrossingLabel, claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
-import { parseSince, recentWork, recentWorkPrompt, turnOutcomeLine } from "./recent-work.js";
+import { parseSince, parseUntil, recentWork, recentWorkPrompt, turnOutcomeLine } from "./recent-work.js";
 import { chiefForBot, INCIDENTS_THREAD_TITLE, IncidentLedger, incidentChip, incidentText } from "./incidents.js";
 /** A session_read answer competes with the transcript for the context
  * window; a computer-use turn's output can run to hundreds of KB. */
@@ -86,6 +90,8 @@ import { acceptedSendMatch, parseSendId, sendFingerprint, SendSequencer, } from
 import { EventBus } from "./harness/bus.js";
 import { ProviderRegistry } from "./harness/registry.js";
 import { ManagedDesktopProviders } from "./managed-desktop.js";
+import { computerKindForResource, ManagedDesktopPolicy } from "./managed-policy.js";
+import { hostedModelPolicy, HOSTED_MODEL_POLICY_HEADER, HOSTED_PROVIDER_SETTINGS_ERROR } from "./hosted-models.js";
 import { selectDefaultModelSelection } from "./default-model-selection.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
@@ -156,7 +162,7 @@ import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surf
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
-import { createWorkspaceAccess, describeEdition, editionStatus, hostedWorkspaceConfiguration, hostedWorkspaceConfigured, loadEnterpriseLayer } from "./enterprise.js";
+import { createWorkspaceAccess, describeEdition, editionStatus, hostedWorkspaceConfiguration, hostedWorkspaceConfigured, editionForMembers, LICENSE_WARN_DAYS, licenseWarning, sharedWorkspaceFullAccessConfigured, loadEnterpriseLayer, workspaceMembership } from "./enterprise.js";
 import { environmentDescriptor, loadEnvironmentId, serverVersion } from "./environment.js";
 import { WorkspaceBackupMaintenance } from "./workspace-backup-maintenance.js";
 import { createWorkspaceBackupRoutes, isWorkspaceBackupSessionControl } from "./workspace-backup-http.js";
@@ -164,11 +170,19 @@ import { applyPendingWorkspaceRestore, readLastWorkspaceRestore } from "./worksp
 import { createCustomDomainVerifier, customDomainIpv4, normalizeCustomDomain } from "./custom-domain.js";
 import { allowedScopes, createEmailSignIn, parseAllowList } from "./account-signin.js";
 import { ProviderAuthSessions } from "./provider-auth-sessions.js";
-import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, requestOrigin, requestSource, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
+import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, requestOrigin, requestSource, requiredScope, resolveLoopbackTrust, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
 import { cookieMaxAgeSeconds, formatPairingCode, SessionRegistry } from "./sessions.js";
+import { ThreadStarters } from "./thread-starters.js";
+import { activityCsv, activityEntries, appendAdminAction, botAuditSnapshot, botChangeRows, configChangeRows, parseActivityWhat, flushAdminActivity, pruneAdminActivity, readAdminActivityRange, sharedSignIn, signInListsOf, } from "./admin-activity.js";
+import { frameForMember, memberBody, memberBot, noteSeen, notFoundFor, audienceEquals, memberGroup, narrowestAudience, parseVisibility, pathSubject, roomFeeds, routineVisible, sameAudience, SEES_EVERYTHING, VisibleSet, } from "./bot-visibility.js";
 import { describeBrand, loadBrand } from "./brand.js";
 import { deliverSseFrame } from "./sse-fanout.js";
 import { PHONE_SECRET_PROTOCOL_VERSION, PhoneSecretBridge, PhoneSecretError, PhoneSecretSubmissionRegistry, assertPhoneSecretRequestMatches, phoneSecretOperationId, } from "./phone-secret.js";
+// Keep these two last: a route module may import any server module, and
+// loading the table after everything above leaves module start-up order as is.
+import { json, onJsonBody, parsedBodyOf, readBody } from "./harness/http.js";
+import { ROUTES, dispatchRoutes } from "./routes/table.js";
+import { createHostedSlackRoutes } from "./routes/hosted-slack.js";
 const PORT = Number(process.env.OMB_PORT || process.env.OGB_PORT || 8799);
 const WEBHOOK_PORT = Number(process.env.OMB_WEBHOOK_PORT || PORT + 1);
 // Behind a proxy or tunnel, the base URL senders should use (docs/self-hosting.md).
@@ -232,10 +246,37 @@ const sessions = new SessionRegistry({
     portalMembership: hostedWorkspaceConfiguration()?.portalMembership === true,
 });
 const sharedComputers = new SharedComputers(id => sessions.isLive(id));
+// Who each thread is for, when a signed-in person can be named (server-private).
+const threadStarters = new ThreadStarters(join(DATA_DIR, "thread-starters.json"));
 const SESSION_COOKIE = sessionCookieName(PORT, ENVIRONMENT_ID);
 const HOSTED_WORKSPACE = hostedWorkspaceConfigured();
 let workspaceAccess = null;
 const DESKTOP_MANAGED = process.env.OMB_DESKTOP_PARENT === "1";
+const SHARED_WORKSPACE_FULL_ACCESS = sharedWorkspaceFullAccessConfigured();
+const sharedWorkspaceFullAccessEnabled = () => SHARED_WORKSPACE_FULL_ACCESS && Boolean(workspaceAccess) && entitled("admin");
+// Who a loopback request without a session is (server/request-auth.ts
+// LoopbackTrust): the owner on a desktop or a one-person server; a service on
+// a shared workspace, where every bot's shell is a loopback caller too.
+const LOOPBACK = resolveLoopbackTrust({ desktopManaged: DESKTOP_MANAGED, hostedWorkspace: HOSTED_WORKSPACE });
+// `openmausbot serve` on a service-trust server hands the server it starts a
+// per-launch secret on stdin, then closes it (server/cli.ts). It opens only
+// the pairing route, for that CLI. Never an environment variable: every
+// engine this server starts inherits its environment.
+let cliOwnerToken;
+if (process.env.OMB_CLI_OWNER_STDIN === "1" && LOOPBACK.trust === "service" && process.stdin) {
+    let received = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("error", () => { });
+    process.stdin.on("data", (chunk) => {
+        if (cliOwnerToken !== undefined || received.length > 256)
+            return;
+        received += chunk;
+        const line = received.split("\n", 1)[0];
+        if (received.includes("\n") && /^[A-Za-z0-9_-]{43}$/.test(line))
+            cliOwnerToken = line;
+    });
+}
+delete process.env.OMB_CLI_OWNER_STDIN;
 // Empty is deliberately a deny-all bootstrap state. Only Electron's private
 // utility-process port can replace it with the per-launch owner capability.
 let desktopMutationToken = DESKTOP_MANAGED ? "" : undefined;
@@ -243,10 +284,22 @@ let companionMutationToken = DESKTOP_MANAGED ? "" : undefined;
 // Where remote clients reach this server (a proxy's public address); pairing URLs use it.
 const FALLBACK_PUBLIC_URL = process.env.OMB_PUBLIC_URL?.trim().replace(/\/+$/, "") || null;
 const cfg = loadConfig();
+const hostedModels = hostedModelPolicy(DATA_DIR);
+const providerConfigs = () => hostedModels ? hostedModels.configs() : instanceConfigs(cfg);
+const decorateHostedProvider = hostedModels ? (instance) => hostedModels.decorate(instance) : undefined;
+if (hostedModels) {
+    const selection = hostedModels.select(cfg.defaultModelSelection);
+    if (selection.instanceId && JSON.stringify(selection) !== JSON.stringify(cfg.defaultModelSelection))
+        saveConfig({ defaultModelSelection: selection });
+    cfg.defaultModelSelection = selection;
+}
 // The per-thread event log cap is checked after every NDJSON append.
 // config.json is read once per process (a change restarts the server, like
 // every other hand-edited knob), so a binding made here never goes stale.
 bindThreadLogCapProvider(() => threadEventLogMaxBytes(cfg));
+// The decision log keeps month files for at least this many days. Read per
+// prune, so a Settings change applies at the next one without a restart.
+bindDecisionRetention(() => decisionRetentionDays(cfg.decisions?.retentionDays));
 const customDomainVerifier = createCustomDomainVerifier({ environmentId: ENVIRONMENT_ID });
 // "Sign in with your email" on /pair: the allow-list is read per call so a
 // Settings change or an env bootstrap applies without a restart.
@@ -276,11 +329,15 @@ const registry = new ProviderRegistry(BUILT_IN_DRIVERS);
 // Engines installed from Settings live under the data directory and win over
 // any other copy on PATH.
 registerEnginesBinDir();
-// Who asked for the next turn on a thread, noted where a message comes in
-// and read by the usage ledger when the turn settles. The last note stands
-// until the next message: a resumed connector or a drained queued send
-// still belongs to the person who wrote, and routine or peer turns are
-// told apart before this is consulted.
+// Who asked for the turn running (or last run) on each thread, read by the
+// usage ledger when it settles. It is set when a turn is ADMITTED, from the
+// message that started it — never when a message merely queues behind a
+// running turn or is steered into one, so a second person's words cannot
+// re-book the first person's turn. A queued message carries its sender's
+// trigger until it drains and starts its own turn. Continuations (a resumed
+// connector, a delegation wake) set nothing and stay with the person whose
+// ask they continue; routine and peer turns are told apart before this is
+// consulted.
 const turnTriggers = new Map();
 /** Who a user message is from, when that is someone other than the desktop
  * owner. Loopback is the owner by design, so it stays unstamped and reads as
@@ -291,15 +348,509 @@ function messageSender(auth) {
     if (auth.kind !== "session")
         return undefined;
     const name = (auth.session.email ?? auth.session.label ?? "").trim();
-    return name ? { name } : undefined;
+    return name ? { name, id: personKey(auth.session) } : undefined;
+}
+/** An opaque, stable key for the person behind a session: their account
+ * email when they signed in with one (a new device is still them), else the
+ * paired session itself. Hashed, so a message or a thread can carry it
+ * without handing other members a session id. */
+function personKey(session) {
+    const basis = session.email ? `email:${session.email.trim().toLowerCase()}` : `session:${session.id}`;
+    return `p_${createHash("sha256").update(basis).digest("base64url").slice(0, 22)}`;
+}
+/** More than one person uses this workspace: portal membership, or an email
+ * sign-in list that names members. Only then does who-may-answer narrow. */
+function sharedMembership() {
+    return hostedWorkspaceConfiguration()?.portalMembership === true || signInAllowList().members.length > 0;
+}
+/** The person a user line came from, when a session sent it. A bot's line
+ * (peerAsk), the owner, a service, a routine or a webhook names nobody. */
+function linePersonKey(message) {
+    return message?.role === "user" && !message.peerAsk ? message.sender?.id : undefined;
+}
+/** The opaque key of whoever sent the request a card belongs to: the
+ * message the harness proved started the turn, else the last user line
+ * before the card. */
+function cardRequesterKey(threadId, requestId) {
+    const thread = store.messagesFor(threadId);
+    const index = thread.findIndex((message) => message.card?.requestId === requestId);
+    if (index < 0)
+        return undefined;
+    const card = thread[index];
+    return linePersonKey(card.requestMessageId
+        ? thread.find((message) => message.id === card.requestMessageId)
+        : thread.slice(0, index).findLast((message) => message.role === "user"));
+}
+/** The signed-in person a thread's current work is for: whoever sent its
+ * current (else latest) request from a session, else whoever the thread was
+ * opened for. A bot opening a thread while working records this for the new
+ * thread, so delegated work leads back to the person who asked. */
+function threadPersonKey(threadId) {
+    const thread = store.messagesFor(threadId);
+    const owner = directRequestOwners.get(threadId);
+    const request = owner?.messageId
+        ? thread.find((message) => message.id === owner.messageId)
+        : thread.findLast((message) => message.role === "user");
+    return linePersonKey(request) ?? threadStarters.get(threadId);
+}
+/** Whose session may answer a card. The provider CLI's own approval modes and
+ * the harness's proposals stay exactly as they are; this adds no card, gate
+ * or prompt, it only decides whose answer to an existing card counts.
+ * - the owner on this machine, and admins: any card;
+ * - a session-less caller on a shared server (service trust): decline only;
+ * - where several people share the workspace and the card can be traced to
+ *   a person (who sent its request, who the thread was opened for, followed
+ *   back through threads bots opened for them): those people;
+ * - otherwise (one person; or a routine, webhook, Slack, owner-sent or older
+ *   thread that names nobody): anyone who may chat, as before. */
+function cardAnswerRefusal(auth, threadId, requestId, behavior) {
+    if (auth.kind === "loopback") {
+        return auth.trust === "service" && behavior !== "deny"
+            ? "A local service can only decline this request. Approve or answer it in OpenMausBot while signed in."
+            : null;
+    }
+    if (auth.scopes.includes("admin") || !sharedMembership())
+        return null;
+    const known = [threadStarters.get(threadId), cardRequesterKey(threadId, requestId)].filter((person) => Boolean(person));
+    if (!known.length || known.includes(personKey(auth.session)))
+        return null;
+    return "Only the person who started this conversation or sent this request, or a workspace admin, can answer this card.";
+}
+function decisionActorFor(auth) {
+    if (auth.kind === "loopback")
+        return auth.trust === "service" ? { kind: "worker" } : { kind: "loopback" };
+    const session = auth.session;
+    return {
+        kind: "session", sessionId: session.id, label: session.label,
+        ...(session.email ? { email: session.email } : {}),
+        // A portal session's id is its membership grant: never written down.
+        ...(session.userId && !session.userId.startsWith("portal:") ? { userId: session.userId } : {}),
+    };
+}
+function cardAnswererFor(auth) {
+    if (auth.kind === "loopback")
+        return auth.trust === "service" ? { kind: "worker" } : { kind: "loopback" };
+    return { kind: "session", name: (auth.session.email ?? auth.session.label ?? "").trim() || "Signed-in user" };
+}
+/** Answer a card as `auth`: the decision rows written meanwhile name the
+ * answerer, and a card this answer settled records who settled it. A card
+ * that was already settled keeps whatever it said. */
+async function answeringCardAs(auth, threadId, requestId, work) {
+    const open = (() => {
+        const card = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId)?.card;
+        return Boolean(card && !card.answered && !card.dismissed);
+    })();
+    try {
+        await withDecisionActor(decisionActorFor(auth), work);
+    }
+    finally {
+        const message = open ? store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId) : undefined;
+        const card = message?.card;
+        if (message && card && !card.answeredBy && card.answered !== "unavailable" && (card.answered || card.dismissed)) {
+            store.patchMessage(threadId, message.id, { card: { ...card, answeredBy: cardAnswererFor(auth) } });
+        }
+    }
+}
+// ── bot visibility (server/bot-visibility.ts) ──────────────────────────
+/** Who is looking. The owner, a session-less local service (the Slack
+ * worker) and admin sessions see every bot; any other session is a member,
+ * known by the email it signed in with. */
+function viewerFor(auth) {
+    if (auth.kind === "loopback" || auth.scopes.includes("admin"))
+        return SEES_EVERYTHING;
+    return { kind: "member", ...(auth.session.email ? { email: auth.session.email } : {}) };
+}
+/** Thread → the bot or room that owns it, and one VisibleSet per viewer,
+ * both kept until the next bot, room or thread change (store.onChange
+ * below), so a stream of live frames costs a map lookup each. */
+const threadOwners = new Map();
+const visibleSets = new Map();
+function threadOwner(threadId) {
+    let owner = threadOwners.get(threadId);
+    if (owner === undefined) {
+        const bot = store.botByThread(threadId);
+        const group = bot ? undefined : store.groupByThread(threadId);
+        owner = bot ? { bot: bot.id } : group ? { group: group.id } : null;
+        if (threadOwners.size >= 20_000)
+            threadOwners.clear();
+        threadOwners.set(threadId, owner);
+    }
+    return owner ?? undefined;
+}
+function visibleTo(viewer) {
+    const key = viewer.kind === "all" ? "*" : `member:${viewer.email?.trim().toLowerCase() ?? ""}`;
+    let set = visibleSets.get(key);
+    if (!set) {
+        set = new VisibleSet(store.bots, store.groups, viewer, threadOwner);
+        if (visibleSets.size >= 1_000)
+            visibleSets.clear();
+        visibleSets.set(key, set);
+    }
+    return set;
+}
+function forgetVisibility() {
+    threadOwners.clear();
+    visibleSets.clear();
+}
+/** Which threads mention an attachment, for a member's file request while a
+ * bot is restricted: a scan of the message store, so kept a minute. */
+const attachmentThreads = new Map();
+function threadsUsingAttachment(name) {
+    const cached = attachmentThreads.get(name);
+    if (cached && Date.now() - cached.at < 60_000)
+        return cached.threads;
+    const threads = threadsReferencing(name);
+    if (attachmentThreads.size >= 2_000)
+        attachmentThreads.clear();
+    attachmentThreads.set(name, { at: Date.now(), threads });
+    return threads;
+}
+/** The one check every request naming a bot, thread, room, routine, run or
+ * attachment passes through for a member. An id nobody knows goes on to its
+ * handler, which answers "not found" itself. */
+function subjectVisible(subject, visible) {
+    switch (subject.kind) {
+        case "bot":
+            return !store.bot(subject.id) || visible.bot(subject.id);
+        case "thread":
+            return !threadOwner(subject.id) || visible.thread(subject.id);
+        case "group":
+            return !store.group(subject.id) || visible.group(subject.id);
+        case "routine": {
+            const routine = routines?.listRoutines().find((candidate) => candidate.id === subject.id);
+            return !routine || routineVisible(routine, visible);
+        }
+        case "routine-run": {
+            const run = routines?.listRuns().find((candidate) => candidate.id === subject.id);
+            return !run || routineVisible(run, visible);
+        }
+        case "attachment":
+            return visible.attachment(subject.name, threadsUsingAttachment);
+    }
+}
+/** A member may schedule a routine only for a bot or room they can see. */
+function hiddenRoutineTarget(body, visible) {
+    if (visible.everything || !body || typeof body !== "object")
+        return null;
+    const { botId, groupId } = body;
+    if (typeof botId === "string" && store.bot(botId) && !visible.bot(botId))
+        return "no such bot";
+    if (typeof groupId === "string" && store.group(groupId) && !visible.group(groupId))
+        return "no such channel";
+    return null;
+}
+/** Whether a room may feed this bot's recall and recent-work brief: only
+ * when everyone who can see the bot can see every bot in the room. */
+function roomFeedsBot(group, bot) {
+    return roomFeeds([...roomMemberAudiences(group), group.audienceFloor], bot.visibility);
+}
+function roomMemberAudiences(group) {
+    return group.memberIds.flatMap((id) => {
+        const member = store.bot(id);
+        return member ? [member.visibility] : [];
+    });
+}
+/** Keep a room's floor at the narrowest audience it has ever had. Called
+ * whenever a member bot or the room changes (and for every room at start),
+ * so the floor is set before a restricted bot can leave: its departure, or
+ * its deletion, then never opens the transcript to more people. Only an
+ * admin's explicit reset (PATCH /api/groups/:id {resetAudience: true})
+ * widens it again, to what its current bots allow. */
+function settleRoomFloor(group) {
+    if (group.dm)
+        return;
+    const next = narrowestAudience([group.audienceFloor, ...roomMemberAudiences(group)]);
+    if (audienceEquals(next, group.audienceFloor))
+        return;
+    store.patchGroup(group.id, { audienceFloor: next === "everyone" ? undefined : next });
+}
+/** The conversations a bot's recent-work brief may draw on: its own, and the
+ * rooms roomFeedsBot allows. */
+function recentWorkSources(bot) {
+    return {
+        groups: store.groups.filter((group) => !group.memberIds.includes(bot.id) || roomFeedsBot(group, bot)),
+        taskByThread: (botId, threadId) => store.taskByThread(botId, threadId),
+    };
+}
+/** Bots in one room must be visible to the same people: a room is one
+ * transcript, so otherwise a restricted bot's words would feed a teammate
+ * everyone can see. Refuse a roster that adds such a bot (existing members
+ * may stay while an admin sorts it out), naming the pair in plain words. */
+function roomAudienceConflict(memberIds, existing = []) {
+    const members = memberIds.flatMap((id) => {
+        const bot = store.bot(id);
+        return bot ? [bot] : [];
+    });
+    for (const added of members.filter((bot) => !existing.includes(bot.id))) {
+        const other = members.find((bot) => bot.id !== added.id && !sameAudience(bot.visibility, added.visibility));
+        if (other) {
+            return `Bots in one room must be visible to the same people. ${added.name} and ${other.name} are not: give them the same visibility first, or use separate rooms.`;
+        }
+    }
+    return null;
 }
-function noteTurnTrigger(threadId, auth) {
-    turnTriggers.set(threadId, auth.kind === "session"
+/** A scheduled call with several bots opens a room, so its bots keep one audience too. */
+function calendarAudienceConflict(body) {
+    const botIds = body && typeof body === "object" ? body.botIds : undefined;
+    if (!Array.isArray(botIds) || botIds.length < 2 || botIds.some((id) => typeof id !== "string"))
+        return null;
+    return roomAudienceConflict(botIds);
+}
+/** What a member's live stream needs to narrow a frame. */
+function memberFrameContext(visible) {
+    return {
+        visible,
+        webhookBot: (webhookId) => webhooks.list().find((webhook) => webhook.id === webhookId)?.botId,
+        freshBot: (botId) => {
+            const bot = store.bot(botId);
+            return bot ? { ...wireBot(bot), tasks: store.tasks(bot.id).map(wireTask), ...messagePage(bot.threadId, DEFAULT_PAGE) } : undefined;
+        },
+        freshGroup: (groupId) => {
+            const group = store.group(groupId);
+            return group ? { ...publicGroupState(group), ...messagePage(group.threadId, DEFAULT_PAGE) } : undefined;
+        },
+    };
+}
+// ── admin activity (server/admin-activity.ts) ──────────────────────────
+/** Recorded only where several people share the workspace: a hosted
+ * workspace, an email sign-in list naming more than one person (or a whole
+ * domain), or a device paired with chat-only access. The desktop app and a
+ * one-person server keep no admin activity log, exactly as before. */
+function adminActivityRecording() {
+    if (DESKTOP_MANAGED)
+        return false;
+    if (HOSTED_WORKSPACE)
+        return true;
+    const chatOnly = (scopes) => !scopes.includes("admin");
+    return sharedSignIn(signInAllowList()) || sessions.list().some((session) => chatOnly(session.scopes)) ||
+        sessions.openPairings().some((pairing) => chatOnly(pairing.scopes));
+}
+/** Who made an admin change: as the decision log names who answered, plus
+ * the command line (it marks its requests; on loopback that is the owner). */
+function adminActorFor(auth, req) {
+    if (auth.kind === "loopback" && auth.trust !== "service" &&
+        (req.headers["x-openmausbot-cli"] === "1" || req.headers["x-openmausbot-cli-owner"] !== undefined))
+        return { kind: "cli" };
+    return decisionActorFor(auth);
+}
+/** The admin whose request is running, for config saves made while it runs.
+ * Each save records exactly what it wrote, so a slow request never takes
+ * the blame (or the credit) for another admin's change made meanwhile. */
+const adminActorScope = new AsyncLocalStorage();
+onConfigSaved((before, after) => {
+    const scope = adminActorScope.getStore();
+    if (!scope || DESKTOP_MANAGED)
+        return;
+    // Shared when the request began, or now: the change that makes a server
+    // shared, or stops it being, is kept.
+    if (!scope.sharedAtStart && !adminActivityRecording() && !sharedSignIn(signInListsOf(before)) && !sharedSignIn(signInListsOf(after)))
+        return;
+    for (const row of configChangeRows(before, after))
+        appendAdminAction(DATA_DIR, { ...row, actor: scope.actor });
+});
+function adminAuditPlan(method, path) {
+    if (method === "GET" || method === "HEAD" || method === "OPTIONS")
+        return null;
+    if (path.startsWith("/api/internal/") || path.startsWith("/api/testing/"))
+        return null;
+    const plan = {
+        config: requiredScope(method, path, { sharedComputers: sharedComputersEnabled(cfg) }) === "admin",
+        createsBots: method === "POST" && (path === "/api/bots" || path === "/api/teams/import"),
+        createsWebhook: method === "POST" && path === "/api/webhooks",
+        pairing: method === "POST" && path === "/api/auth/pairing",
+    };
+    let m = /^\/api\/bots\/([\w-]+)(?:\/(always-allow|model))?$/.exec(path);
+    if (m && ((!m[2] && method === "PATCH") || (m[2] === "model" && method === "PATCH") || (m[2] === "always-allow" && method === "POST")))
+        plan.botId = m[1];
+    if (m && !m[2] && method === "DELETE")
+        plan.deletesBot = m[1];
+    m = /^\/api\/webhooks\/([\w-]+)(\/rotate)?$/.exec(path);
+    if (m && ((m[2] && method === "POST") || (!m[2] && (method === "PATCH" || method === "DELETE"))))
+        plan.webhookId = m[1];
+    m = /^\/api\/auth\/sessions\/([\w-]+)$/.exec(path);
+    if (m && method === "DELETE")
+        plan.sessionId = m[1];
+    m = /^\/api\/groups\/([\w-]+)$/.exec(path);
+    if (m && method === "PATCH")
+        plan.roomId = m[1];
+    m = /^\/api\/instances\/([\w.-]+)\/(install|auth\/complete|auth\/sign-out|claude-update)$/.exec(path);
+    if (m && method === "POST")
+        plan.engineAction = { id: m[1], action: m[2].replace("/", "-") };
+    if (method === "POST" && path === "/api/instances/claude-accounts")
+        plan.engineAction = { id: "claude", action: "account-add" };
+    return plan.config || plan.botId || plan.createsBots || plan.deletesBot || plan.createsWebhook || plan.webhookId || plan.sessionId || plan.pairing || plan.engineAction || plan.roomId ? plan : null;
+}
+const WEBHOOK_AUDIT_FIELDS = ["name", "prompt", "botId", "runOn", "enabled", "eventTypes"];
+const auditBot = (id) => (id ? botAuditSnapshot(store.bot(id)) : null);
+const auditHook = (id) => (id ? webhooks.list().find((hook) => hook.id === id) : undefined);
+const hookFields = (hook, fields = WEBHOOK_AUDIT_FIELDS) => Object.fromEntries(fields.map((field) => [field, hook[field] ?? null]));
+/** The bot fields a PATCH named: only those are compared, so a concurrent
+ * change to another field is not put down to this request. */
+function requestedBotFields(req, path) {
+    if (path.endsWith("/always-allow"))
+        return ["alwaysAllow"];
+    if (path.endsWith("/model"))
+        return ["modelSelection"];
+    const body = parsedBodyOf(req);
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return [];
+    const fields = new Set(Object.keys(body));
+    if (fields.has("autoApprove") || fields.has("approvalMode"))
+        fields.add("autoApprove").add("approvalMode");
+    if (fields.has("chiefOfStaff"))
+        fields.add("managedSections");
+    return [...fields];
+}
+/** Record this request's admin changes once it has answered successfully.
+ * Each row compares only what this request named or created, never a whole
+ * snapshot, so another admin's change made meanwhile is not attributed here. */
+function beginAdminAudit(req, res, method, path, auth) {
+    const plan = DESKTOP_MANAGED ? null : adminAuditPlan(method, path);
+    const actor = plan ? adminActorFor(auth, req) : null;
+    // Whether several people share the workspace as the request begins: a
+    // change that ends sharing (the last chat-only phone signed out) is kept.
+    const sharedAtStart = plan ? adminActivityRecording() : false;
+    // Set for every request, so a kept-alive connection never inherits one.
+    adminActorScope.enterWith(plan?.config && actor ? { actor, sharedAtStart } : null);
+    if (!plan || !actor)
+        return;
+    const before = {
+        bot: auditBot(plan.botId ?? plan.deletesBot),
+        botName: store.bot(plan.botId ?? plan.deletesBot ?? "")?.name,
+        hook: auditHook(plan.webhookId),
+        session: plan.sessionId ? sessions.list().find((session) => session.id === plan.sessionId) : undefined,
+        roomFloor: plan.roomId ? store.group(plan.roomId)?.audienceFloor ?? "everyone" : undefined,
+    };
+    let answered;
+    if (plan.createsBots || plan.createsWebhook || plan.pairing)
+        onJsonBody(res, (body) => (answered = body));
+    res.once("finish", () => {
+        if (res.statusCode >= 400 || (!sharedAtStart && !adminActivityRecording()))
+            return;
+        try {
+            for (const row of adminAuditRows(plan, req, path, before, answered))
+                appendAdminAction(DATA_DIR, { ...row, actor });
+        }
+        catch (error) {
+            console.warn(`admin activity: could not record ${method} ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+function adminAuditRows(plan, req, path, before, answered) {
+    const rows = [];
+    const reply = answered && typeof answered === "object" ? answered : {};
+    const idOf = (value) => (value && typeof value === "object" && typeof value.id === "string" ? value.id : undefined);
+    if (plan.botId) {
+        rows.push(...botChangeRows({ id: plan.botId, name: store.bot(plan.botId)?.name }, before.bot, auditBot(plan.botId), requestedBotFields(req, path)));
+    }
+    if (plan.createsBots) {
+        const created = [idOf(reply.bot), ...(Array.isArray(reply.bots) ? reply.bots.map(idOf) : [])].filter((id) => Boolean(id));
+        for (const id of new Set(created)) {
+            const fields = auditBot(id);
+            if (fields)
+                rows.push({ category: "bot", action: "bot.create", target: { kind: "bot", id, name: store.bot(id).name }, after: fields });
+        }
+    }
+    if (plan.deletesBot && before.bot && !store.bot(plan.deletesBot)) {
+        rows.push({ category: "bot", action: "bot.delete", target: { kind: "bot", id: plan.deletesBot, ...(before.botName ? { name: before.botName } : {}) }, before: before.bot });
+    }
+    const hookTarget = (hook) => ({ kind: "webhook", id: hook.id, name: hook.name });
+    if (plan.createsWebhook) {
+        const hook = auditHook(idOf(reply.webhook));
+        if (hook)
+            rows.push({ category: "webhook", action: "webhook.create", target: hookTarget(hook), after: hookFields(hook) });
+    }
+    if (plan.webhookId && before.hook) {
+        const after = auditHook(plan.webhookId);
+        if (!after)
+            rows.push({ category: "webhook", action: "webhook.delete", target: hookTarget(before.hook), before: hookFields(before.hook) });
+        else if (path.endsWith("/rotate"))
+            rows.push({ category: "webhook", action: "webhook.rotate-secret", target: hookTarget(after) });
+        else {
+            const body = parsedBodyOf(req);
+            const named = body && typeof body === "object" ? Object.keys(body) : [];
+            const changed = WEBHOOK_AUDIT_FIELDS.filter((field) => named.includes(field) &&
+                JSON.stringify(hookFields(before.hook, [field])) !== JSON.stringify(hookFields(after, [field])));
+            if (changed.length) {
+                rows.push({ category: "webhook", action: "webhook.update", target: hookTarget(after), changed: [...changed], before: hookFields(before.hook, changed), after: hookFields(after, changed) });
+            }
+        }
+    }
+    if (before.session && !sessions.list().some((session) => session.id === before.session.id)) {
+        const session = before.session;
+        rows.push({ category: "session", action: "session.revoke", target: { kind: "session", id: session.id, name: session.email ?? session.label },
+            before: { label: session.label, ...(session.email ? { email: session.email } : {}), scopes: session.scopes } });
+    }
+    if (plan.pairing) {
+        const pairing = sessions.openPairings().find((candidate) => candidate.id === reply.id);
+        if (pairing)
+            rows.push({ category: "session", action: "pairing.create", target: { kind: "pairing", name: pairing.label }, after: { label: pairing.label, scopes: pairing.scopes } });
+    }
+    if (plan.engineAction)
+        rows.push({ category: "engine", action: `engine.${plan.engineAction.action}`, target: { kind: "engine", id: plan.engineAction.id } });
+    const roomBody = plan.roomId ? parsedBodyOf(req) : undefined;
+    const room = plan.roomId ? store.group(plan.roomId) : undefined;
+    if (room && roomBody && typeof roomBody === "object" && roomBody.resetAudience === true) {
+        rows.push({ category: "visibility", action: "room.audience-reset", target: { kind: "room", id: room.id, name: room.name },
+            changed: ["audienceFloor"], before: { audienceFloor: before.roomFloor ?? "everyone" }, after: { audienceFloor: room.audienceFloor ?? "everyone" } });
+    }
+    return rows;
+}
+/** The guarded send contract external interfaces (the Slack worker) opt into.
+ * `onBehalfOf` is additive and advertised by /api/health
+ * (capabilities.guardedOnBehalfOf): it names the person a relay acts for, so
+ * the turn is booked to them rather than to this machine. Only this
+ * admin-scoped route reads it; every other send is booked to its own
+ * session. */
+const guardedSendSchema = z.object({
+    threadId: z.string().regex(/^[\w-]+$/),
+    sendId: z.string().regex(/^[A-Za-z0-9_-]{16,80}$/),
+    text: z.string().min(1),
+    expectedActiveLeafId: z.string().regex(/^[\w-]+$/).nullable(),
+    expectedApprovalMode: z.enum(["ask", "full"]).optional(),
+    replyToId: z.string().optional(),
+    onBehalfOf: z.object({
+        email: z.string().trim().toLowerCase().max(254).pipe(z.email()).optional(),
+        name: z.string().trim().min(1).max(120).optional(),
+    }).strict().refine((who) => Boolean(who.email || who.name)).optional(),
+}).strict();
+/** Who a request is, for the usage ledger: a paired or signed-in person, or
+ * this machine. Captured when the message is accepted and carried with it. */
+function usageTriggerFor(auth) {
+    return auth.kind === "session"
         ? { kind: "user", ...(auth.session.email ? { email: auth.session.email } : {}), label: auth.session.label }
-        : { kind: "owner" });
+        : { kind: "owner" };
+}
+/** The operator's price list, when the server may read it (`billing`). */
+function operatorPrices() {
+    return entitled("billing") && cfg.billing?.prices && Object.keys(cfg.billing.prices).length ? cfg.billing.prices : null;
+}
+/** Write one settled turn to the ledger, estimating its cost when the
+ * engine reported tokens but no price, and let the spend cap see it at once.
+ * The first booking that takes the month past the warning threshold, or to
+ * the cap, notifies admins (once per month each; server/spend.ts). */
+function bookTurnUsage(row) {
+    const booked = { ...row, ...ledgerCost(row, operatorPrices()), at: new Date().toISOString() };
+    // The append lands asynchronously; the cap counts the row from memory
+    // until it does, so the check below (and the next turn start) sees it.
+    noteSpend(DATA_DIR, booked, appendUsage(DATA_DIR, booked));
+    const state = spendState(cfg, DATA_DIR);
+    const alert = takeSpendAlert(DATA_DIR, state);
+    if (alert && state) {
+        broadcast({ kind: "notify", notification: buildSpendNotification({ id: row.botId, name: row.botName }, row.threadId, spendAlertText(alert, state)) }, { adminOnly: true });
+    }
+}
+/** A queued line from before triggers were stored with it: its sender, else
+ * the owner; a bot's own queued words set nothing. */
+function queuedTurnTrigger(item) {
+    if (item.trigger)
+        return item.trigger;
+    if (item.peerAsk)
+        return undefined;
+    return item.sender ? { kind: "user", label: item.sender.name } : { kind: "owner" };
 }
 const providerAuthSessions = new ProviderAuthSessions();
-await registry.load(instanceConfigs(cfg));
+await registry.load(providerConfigs(), decorateHostedProvider);
 const bundledSkills = loadBundledSkills();
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
 // SAFETY: Electron's utility-process runtime is the only environment that
@@ -395,10 +946,21 @@ const bus = new EventBus();
 bus.attach(registry.instances());
 let companyRuntimeReady;
 const companyRuntimeStarted = new Promise(resolve => { companyRuntimeReady = resolve; });
+/** The enrolled organisation's desktop policy: in memory only, read-only, and
+ * inert (null) unless Electron's enrolled parent sends one. */
+const managedPolicy = new ManagedDesktopPolicy({ onChange: () => broadcast({ kind: "config", ...configStatus() }) });
+/** Why the organisation refuses this instance for bots, or undefined. */
+function policyModelRefusal(instance) {
+    const engine = BUILT_IN_DRIVERS.find(driver => driver.driverKind === instance.driverKind)?.metadata.displayName;
+    return managedPolicy.modelRefusal({ driverKind: instance.driverKind, displayName: engine }, managedDesktop.owns(instance.instanceId));
+}
 const managedDesktop = new ManagedDesktopProviders({
     registry,
     dataDirectory: DATA_DIR,
     beforeReplace: stopCompanyInstances,
+    // Ids became stable across re-enrolment; carry old references forward once.
+    migrate: aliases => { store.renameInstances(new Map(aliases.map(({ from, to }) => [from, to]))); },
+    onAvailability: () => broadcast({ kind: "config", ...configStatus() }),
     afterReplace: ids => {
         for (const id of providerInstancesChanging)
             if (managedDesktop.owns(id))
@@ -409,6 +971,29 @@ const managedDesktop = new ManagedDesktopProviders({
         broadcast({ kind: "config", ...configStatus() });
     },
 });
+utilityParentPort?.on("message", event => {
+    const message = event.data;
+    if (message?.type !== "openmausbot:managed-desktop-identity")
+        return;
+    const requestId = typeof message.requestId === "string" && message.requestId.length <= 100 ? message.requestId : undefined;
+    void companyRuntimeStarted.then(() => managedDesktop.migrateIdentity(message.identity)).then(() => true, () => false).then(ok => {
+        utilityParentPort.postMessage({ type: "openmausbot:managed-desktop-result", requestId, ok });
+    });
+});
+utilityParentPort?.on("message", event => {
+    const message = event.data;
+    if (message?.type !== "openmausbot:managed-desktop-policy")
+        return;
+    const requestId = typeof message.requestId === "string" && message.requestId.length <= 100 ? message.requestId : undefined;
+    let ok = true;
+    try {
+        managedPolicy.apply(message.policy);
+    }
+    catch {
+        ok = false;
+    }
+    utilityParentPort.postMessage({ type: "openmausbot:managed-desktop-result", requestId, ok });
+});
 // Only Electron owns this port. There is deliberately no HTTP equivalent or
 // config patch for its organization identity, endpoint, or model capability.
 utilityParentPort?.on("message", event => {
@@ -431,6 +1016,46 @@ const internalCapabilities = new Map();
 const activeInternalGenerationByThread = new Map();
 const internalGenerationByProviderTurn = new ProviderTurnGenerationRegistry();
 const computerSelectionTurns = new Map();
+// A bot can also run outside this server — a Telegram gateway, a Slack bot,
+// any long-lived engine process the harness did not spawn. That process never
+// receives a turn-scoped capability, so it cannot ask or delegate to its peers.
+// `<data dir>/external-runtimes.json` maps bot ids to standing bearer tokens
+// and an explicit threadId. Missing bindings fail closed, even for one task.
+// A matching bearer resolves to an agents capability bound to that thread only —
+// depth 0, no skill authoring, no room coordination, no bot/room/thread
+// creation. Every other bearer still goes through the per-turn map above. The
+// file is read on demand, so adding or rotating a token needs no restart, and
+// it must not be readable by other users (mode 600).
+const EXTERNAL_RUNTIME_GENERATION = "external-runtime";
+const EXTERNAL_RUNTIMES_FILE = join(DATA_DIR, "external-runtimes.json");
+/** The standing capability is for peer comms only. Everything that creates or
+ * changes state on this server (threads, bots, rooms, skills, memory, …) needs
+ * a real turn, which an external runtime never has here, so the routes are an
+ * allow-list rather than flags on the capability. */
+function externalRuntimeMayCall(method, path) {
+    if (method === "GET")
+        return path === "/api/internal/agents" || /^\/api\/internal\/delegations\/[\w-]+$/.test(path);
+    return method === "POST" && (path === "/api/internal/ask-bot" || path === "/api/internal/delegate-bot");
+}
+function externalRuntimeCapability(header) {
+    const grant = authorizeExternalRuntime(EXTERNAL_RUNTIMES_FILE, header, id => store.bot(id));
+    if (!grant)
+        return null;
+    return {
+        botId: grant.botId,
+        threadId: grant.threadId,
+        externalRuntime: grant,
+        generation: EXTERNAL_RUNTIME_GENERATION,
+        depth: 0,
+        kind: "agents",
+        skillAuthoring: false,
+        createdBots: 0,
+        openedThreads: 0,
+        orphanExpiresAt: Number.MAX_SAFE_INTEGER,
+        roomCoordination: false,
+        ownThreadCreation: false,
+    };
+}
 function beginInternalCapabilityGeneration(threadId, generation = randomUUID()) {
     const previous = activeInternalGenerationByThread.get(threadId);
     if (previous)
@@ -506,9 +1131,14 @@ function authorizedInternalCapability(header) {
         if (got.length === expected.length && timingSafeEqual(got, expected))
             return capability;
     }
-    return null;
+    return externalRuntimeCapability(header);
 }
 function internalCapabilityIsActive(capability) {
+    if (capability.generation === EXTERNAL_RUNTIME_GENERATION) {
+        return Boolean(capability.externalRuntime && capability.externalRuntime.botId === capability.botId &&
+            capability.externalRuntime.threadId === capability.threadId &&
+            externalRuntimeIsActive(EXTERNAL_RUNTIMES_FILE, capability.externalRuntime, id => store.bot(id)));
+    }
     const switching = computerSelectionTurns.get(capability.threadId);
     if ((capability.kind === "computer" || capability.kind === "browser") &&
         switching?.generation === capability.generation && switching.selected)
@@ -608,6 +1238,9 @@ class DirectTurnSetupCancelled extends Error {
 }
 const directTurnDispatchClaims = new Map();
 const directTurnGenerationByThread = new Map();
+// Only the latest direct request per thread is retained. A fresh user turn
+// replaces it; unknown control-plane continuations deliberately lose proof.
+const directRequestOwners = new Map();
 const directFollowupTurns = new ProviderTurnGenerationRegistry();
 const directFollowupSettlers = new Map();
 const directCoordinationSettlers = new Map();
@@ -668,6 +1301,11 @@ function releaseTurnResources(owner) {
     }
 }
 async function bindTurnComputer(owner, resource, exclusive = false) {
+    // Every computer claim passes here: a kind the organisation disallows is
+    // refused at claim time, whichever path selected it.
+    const kind = computerKindForResource(resource), refusal = kind && managedPolicy.computerRefusal(kind);
+    if (refusal)
+        throw Object.assign(new Error(refusal), { code: "managed_policy" });
     const active = () => activeInternalGenerationByThread.get(owner.threadId) === owner.generation &&
         turnResourceOwners.get(owner.threadId)?.generation === owner.generation;
     let waitingMessage;
@@ -729,9 +1367,23 @@ function botAtThreadCapacity(botId) {
     // completion event has already cleared the stored busy flag.
     return store.tasks(botId).filter((task) => threadBusy(botId, task.threadId)).length >= maxConcurrentBotThreads(cfg);
 }
+/** A card waiting on the person still owns fresh coordinated work, even
+ * when another thread slot is free. A sibling that is only working does not. */
+function recipientAwaitingPerson(botId, exceptThreadId) {
+    return store.tasks(botId).some((task) => task.threadId !== exceptThreadId && task.activity === "waiting-on-you");
+}
 function hasDirectDispatch(botId) {
     return [...directTurnDispatchClaims.values()].some((claim) => claim.botId === botId);
 }
+/** Exactly what startTurn admits for a direct thread: the landing thread
+ * itself free, a free capacity slot, and no live group turn. Never the
+ * whole-bot busy flag — that is true whenever ANY thread is working,
+ * waiting on a person, or has no signal. Delegations and the resume drains
+ * share this test so peer and room work waits for a real slot, not total
+ * bot idleness. */
+function canAdmitDirectTurn(botId, threadId) {
+    return !threadBusy(botId, threadId) && !botAtThreadCapacity(botId) && !activeGroupTurnForBot(botId);
+}
 /** Routine and webhook dispatch shares startTurn's admission preconditions
  * instead of waiting for whole-bot idleness: a free thread slot and no
  * active group turn. A group turn blocks scheduled starts the same way it
@@ -754,6 +1406,12 @@ function requestedTaskBot(botId, rawThreadId) {
     return task;
 }
 async function interruptDirectThread(botId, threadId) {
+    const requestOwner = directRequestOwners.get(threadId);
+    if (requestOwner) {
+        requestOwner.stopped = true;
+        if (requestOwner.messageId)
+            store.patchMessage(threadId, requestOwner.messageId, { requestCancelled: true });
+    }
     // Stop belongs to the conversation it was pressed in. This bot's turn ends
     // and this conversation stops awaiting its teammates, so nothing resumes
     // into a stopped chat; assignments that never started are dropped. A
@@ -861,8 +1519,12 @@ function markDirectTurnDispatching(botId, claimId, threadId) {
     return true;
 }
 function clearDirectTurnDispatch(threadId, claimId) {
-    if (directTurnDispatchClaims.get(threadId)?.id === claimId)
+    if (directTurnDispatchClaims.get(threadId)?.id === claimId) {
         directTurnDispatchClaims.delete(threadId);
+        // A fast provider can settle before its dispatch ACK. Its first cleanup
+        // still saw this reservation, so releasing it must retry the final fence.
+        settleTrackedRequest(threadId);
+    }
 }
 const compactionControllers = new Map();
 function cancelDirectTurnDispatch(botId, expectedThreadId) {
@@ -1112,8 +1774,15 @@ function askBotAndWait(targetBotId, message, depth, fromBotId, fromThreadId, tar
     });
 }
 // New bots honor setup's saved choice; unconfigured workspaces prefer Claude.
+// While enrolled, a Company model that can run beats a signed-out personal
+// engine, and the organisation's policy is respected; otherwise inert.
 async function defaultSelection() {
-    return selectDefaultModelSelection(await registry.describe(), cfg.defaultModelSelection);
+    if (hostedModels)
+        return hostedModels.select(cfg.defaultModelSelection);
+    return selectDefaultModelSelection(await registry.describe(), cfg.defaultModelSelection, {
+        company: (instanceId) => managedDesktop.owns(instanceId),
+        refusal: (instance) => policyModelRefusal(instance),
+    });
 }
 function checkedModelSelection(raw, current, requireAvailableModel = false) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
@@ -1130,6 +1799,8 @@ function checkedModelSelection(raw, current, requireAvailableModel = false) {
         instanceId: value.instanceId.trim(),
         model: value.model.trim(),
     };
+    if (hostedModels && !hostedModels.allows(selection))
+        return { ok: false, status: 400, error: hostedModels.error() };
     if (value.effort !== undefined) {
         if (!isEffortLevel(value.effort)) {
             return { ok: false, status: 400, error: `effort "${String(value.effort)}" is not recognized` };
@@ -1305,6 +1976,7 @@ let followupsReady = false;
 const sendSequencer = new SendSequencer();
 bootSelection = await defaultSelection();
 store.seedIfEmpty();
+hostedModels?.reconcile(store);
 // A committed profile cleanup means both its config deletion and bot-reference
 // cleanup were intended to be durable. Reconcile stale secondary references
 // before Electron can ACK and remove the journal: a crash between those writes
@@ -1336,9 +2008,7 @@ if (browserCleanupReferencesReconciled)
  * than the desktop window did. Stripped here rather than at each call site
  * so a new broadcast cannot forget. */
 let activeCoordinationForThread = (_threadId) => false;
-const wireTask = (task) => activeCoordinationForThread(task.threadId) && !task.busy
-    ? { ...toWireTask(task), busy: true, activity: "working" }
-    : toWireTask(task);
+const wireTask = (task) => ({ ...toWireTask(task), waitingForTeammates: activeCoordinationForThread(task.threadId) && !task.busy });
 const wireBot = (bot) => {
     const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, ...rest } = bot;
     // An elevated selection is inert until the desktop confirms its exact
@@ -1347,7 +2017,7 @@ const wireBot = (bot) => {
     const visible = approvalGrant && !approvalGrant.threadOnly
         ? { ...rest, approvalMode: "ask", autoApprove: false }
         : rest;
-    return { ...visible, ...(activeCoordinationForThread(bot.threadId) && !visible.busy ? { busy: true, activity: "working" } : {}),
+    return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
         avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** The correlated private response carries the requested value so Electron
@@ -1417,7 +2087,7 @@ function previewSystemPrompt(bot) {
                 browser: previewPlan.computer === undefined ? false : previewPlan.browser,
             }, { note: previewPlan.note }) },
         { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? COMPOSIO_PROMPT : "" },
-        { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(customMcpServers(cfg, bot.mcpServers))) : "" },
+        { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(engineMcpServers(bot))) : "" },
         { id: "browser", label: "Browser", text: previewPlan.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
         { id: "coordination", label: "Team", text: agentsMounted && coordination ? ` ${coordination}` : "" },
         { id: "credential", label: "Credentials", text: agentsMounted ? CREDENTIAL_PROMPT : "" },
@@ -1583,8 +2253,10 @@ function handleDesktopTrustedApprovalMessage(raw) {
     const grantTarget = (bot) => bot.approvalGrant?.threadOnly
         ? store.projectBotForTask(bot.id, bot.approvalGrant.threadId) : bot;
     const grantBusy = (bot) => bot.approvalGrant?.threadOnly
-        ? threadBusy(bot.id, bot.approvalGrant.threadId) : bot.busy;
-    const grantSupported = (bot, mode) => supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode);
+        ? threadBusy(bot.id, bot.approvalGrant.threadId) : bot.busy ||
+        Boolean(bot.approvalGrant?.allThreads && store.tasks(bot.id).some(task => threadBusy(bot.id, task.threadId)));
+    const grantSupported = (bot, mode) => supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode) &&
+        (!bot.approvalGrant?.allThreads || store.tasks(bot.id).every(task => supportsApprovalMode(registry.cliTarget((task.modelSelection ?? bot.modelSelection).instanceId)?.driverKind, mode)));
     const clearGrant = (bot) => store.patchBot(bot.id, {
         ...(!bot.approvalGrant?.threadOnly ? { approvalMode: "ask", autoApprove: false } : {}),
         approvalGrant: undefined,
@@ -1617,10 +2289,14 @@ function handleDesktopTrustedApprovalMessage(raw) {
             !grantBusy(bot) &&
             threadCanReceiveGrant(bot) &&
             grantSupported(bot, mode)) {
-            if (bot.approvalGrant.threadId) {
+            if (bot.approvalGrant.allThreads && mode === "full") {
+                store.setAllThreadApprovalMode(botId, mode);
+            }
+            else if (bot.approvalGrant.threadId) {
                 store.patchTask(botId, bot.approvalGrant.threadId, { approvalMode: mode, autoApprove: false });
             }
-            store.patchBot(botId, { approvalGrant: undefined });
+            if (bot.approvalGrant)
+                store.patchBot(botId, { approvalGrant: undefined });
             postDesktopPrivateMessage({ type: "approval-trusted-mode-commit-result", requestId, ok: true, bot: wireBot(store.bot(botId)) });
         }
         else if (bot?.approvalGrant?.requestId === requestId) {
@@ -1801,6 +2477,22 @@ function handleDesktopTrustedApprovalMessage(raw) {
     }
     const currentMode = approvalModeFor(existing);
     const threadId = message.threadId;
+    if (message.allThreads !== undefined && (typeof message.allThreads !== "boolean" ||
+        (message.allThreads && (threadId !== undefined || message.threadOnly === true ||
+            message.modelSelection !== undefined || message.updateBotDefault !== undefined ||
+            (mode !== "full" && mode !== "ask"))))) {
+        respond({ ok: false, error: "Invalid all-threads approval scope" });
+        return true;
+    }
+    if (message.allThreads === true && mode === "ask") {
+        const updated = store.setAllThreadApprovalMode(botId, "ask");
+        void stopBotForEmergencyApprovalDowngrade(botId).then(() => respond({ ok: true, bot: wireBot(store.bot(botId) ?? updated) }), () => respond({ ok: false, error: "Approval was reset to Ask, but an active turn could not be stopped" }));
+        return true;
+    }
+    if (message.allThreads === true && (existing.approvalGrant || store.tasks(botId).some(task => threadBusy(botId, task.threadId) || !supportsApprovalMode(registry.cliTarget((task.modelSelection ?? existing.modelSelection).instanceId)?.driverKind, mode)))) {
+        respond({ ok: false, error: "Finish this bot's active turns and approval changes first. Every thread's provider must support Full access." });
+        return true;
+    }
     if (message.threadOnly !== undefined && typeof message.threadOnly !== "boolean") {
         respond({ ok: false, error: "Invalid thread approval scope" });
         return true;
@@ -1848,7 +2540,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
             return true;
         }
         try {
-            store.switchTaskModel(botId, threadId, checked.selection, message.updateBotDefault, true);
+            store.switchTaskModel(botId, threadId, checked.selection, message.updateBotDefault, true, hostedModels?.resetTask(target.modelSelection, checked.selection));
             const fresh = { ...wireBot(store.bot(botId)), approvalMode: approvalModeFor(store.bot(botId)) };
             broadcast({ kind: "bot", bot: fresh });
             respond({ ok: true, bot: fresh });
@@ -1897,7 +2589,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
         approvalMode: mode,
         autoApprove: mode === "auto",
         approvalGrant: mode === "full" || mode === "custom"
-            ? { requestId, mode, phase: "prepared", ...(typeof threadId === "string" ? { threadId } : {}) }
+            ? { requestId, mode, phase: "prepared", ...(typeof threadId === "string" ? { threadId } : {}), ...(message.allThreads === true ? { allThreads: true } : {}) }
             : undefined,
     });
     if (!updated) {
@@ -2013,6 +2705,9 @@ function createChannel(value) {
     if (!roster.ok)
         throw Object.assign(new Error(roster.error), { status: 400 });
     const { memberIds } = roster;
+    const audienceConflict = roomAudienceConflict(memberIds);
+    if (audienceConflict)
+        throw Object.assign(new Error(audienceConflict), { status: 400 });
     if (body.name !== undefined && typeof body.name !== "string") {
         throw Object.assign(new Error("channel name must be a string"), { status: 400 });
     }
@@ -2093,6 +2788,9 @@ function updateChannel(groupId, value) {
         const roster = checkedMemberIds(body.memberIds);
         if (!roster.ok)
             throw Object.assign(new Error(roster.error.replace("channel", "room")), { status: 400 });
+        const audienceConflict = roomAudienceConflict(roster.memberIds, existing.memberIds);
+        if (audienceConflict)
+            throw Object.assign(new Error(audienceConflict), { status: 400 });
         const removedGoalLead = routines.listRoutines().some((routine) => routine.enabled &&
             routine.target === "room-goal" &&
             routine.groupId === existing.id &&
@@ -2151,7 +2849,18 @@ function updateChannel(groupId, value) {
                 patch.section = trimmed;
         }
     }
+    // An admin's explicit "show this room to everyone its current bots allow":
+    // the only way a room's floor widens (settleRoomFloor). Admin-only: a
+    // member's PATCH is limited to display fields, and a Chief's never has it.
+    const resetAudience = body.resetAudience !== undefined;
+    if (resetAudience) {
+        if (body.resetAudience !== true)
+            throw Object.assign(new Error("resetAudience must be true"), { status: 400 });
+        patch.audienceFloor = undefined;
+    }
     const group = store.patchGroup(groupId, patch);
+    if (resetAudience)
+        audienceChanged();
     if (!group)
         throw Object.assign(new Error("no such room"), { status: 404 });
     return group;
@@ -2195,7 +2904,7 @@ function roomHandoffProblem(node, parent) {
             return "Room work cannot cross the sender's section boundary";
         if (source && group && source.id === group.id && parent.threadId !== node.threadId)
             return "Same-room work must stay in the originating conversation";
-        if (!peerAllowed(from, bot.id))
+        if (!peerAllowed(from, bot))
             return "The recipient is not an allowed peer of the sender";
     }
 }
@@ -2233,12 +2942,17 @@ function outstandingAssignmentsPrompt(threadId) {
 const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     validate: (node, parent) => roomHandoffProblem(node, parent) ??
         (parent && store.bot(parent.botId)?.approvePeerComms && !fullAccessForSource(parent.botId, parent.threadId) && !node.approvalGranted ? "Sender now requires peer approval; submit a new approved request" : undefined),
-    // Direct assignments and follow-ups use independent threads. Match direct
-    // turn admission: unrelated work need not block a free thread slot, but
-    // never overlap the addressed thread, exceed capacity, or race a group turn.
-    busy: n => !n.groupId
-        ? threadBusy(n.botId, n.threadId) || botAtThreadCapacity(n.botId) || Boolean(activeGroupTurnForBot(n.botId))
-        : Boolean(store.bot(n.botId)?.busy || (n.groupId && store.group(n.groupId) && groupIsWorking(store.group(n.groupId)))),
+    // A free slot admits fresh work beside a sibling that is actually running
+    // (#1589). A card waiting on the person still holds fresh work (#1128).
+    // An owed resume is not fresh work, so a sibling card must not starve it
+    // (#1278). Never overlap the addressed thread, exceed capacity, or race a
+    // group turn.
+    busy: n => {
+        if (n.groupId)
+            return Boolean(store.bot(n.botId)?.busy || (store.group(n.groupId) && groupIsWorking(store.group(n.groupId))));
+        const slot = threadBusy(n.botId, n.threadId) || botAtThreadCapacity(n.botId) || Boolean(activeGroupTurnForBot(n.botId));
+        return n.status === "resume" ? slot : slot || recipientAwaitingPerson(n.botId, n.threadId);
+    },
     changed: (groupIds, directThreadIds) => {
         for (const id of groupIds) {
             const group = store.group(id);
@@ -2246,6 +2960,7 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
                 broadcast({ kind: "group", group: publicGroupState(group) });
         }
         for (const threadId of directThreadIds) {
+            settleTrackedRequest(threadId);
             const bot = store.botByThread(threadId);
             if (bot)
                 broadcast({ kind: "bot", bot: wireBot(bot) });
@@ -2320,6 +3035,21 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
             });
         }
         markInternalTurn(node.threadId);
+        // The settle itself is quiet by design: both the delegated turn and
+        // this resume are internal, so turn.completed raises neither the unread
+        // flag nor a done frame. One chip plus one notification per settle
+        // covers the gap; steers land inside the running turn and never add
+        // more. Group settles already speak through the room's own flow.
+        if (resumed && !group) {
+            const settledFrom = [...new Set(roomHandoffs.children(node.id)
+                    .map(child => store.bot(child.botId)?.name ?? "Teammate"))];
+            const who = settledFrom.length ? settledFrom.join(", ") : "delegated work";
+            store.appendMessage(node.threadId, {
+                role: "bot", kind: "activity",
+                tool: { name: `Resumed with ${who} results, reviewing`, ok: true },
+            });
+            notify(buildNotification("delegation-settled", bot, node.threadId, `Results in from ${who}`, { avatarUrl: bot.avatarUrl }));
+        }
         if (sender && parent && isUnattended(sender.id, parent.threadId))
             markUnattended(bot.id, node.threadId);
         if (!group)
@@ -2343,6 +3073,8 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
                 }
                 void startTurn(bot.id, turnText, {
                     threadId: node.threadId, cardContinuation: true, commsDepth: MAX_COMMS_DEPTH,
+                    requestMessageId: directRequestOwners.get(node.threadId)?.generations.has(node.rootId)
+                        ? directRequestOwners.get(node.threadId)?.messageId : undefined,
                     unattended: isUnattended(bot.id, node.threadId),
                     coordination: { id: node.id, resumed, settle: finish },
                     onDispatchError: error => finish({ ok: false, text: error }),
@@ -2677,6 +3409,9 @@ const groupWithThread = (group) => ({
 // endpoints whose callers need the transcript (task create/switch, imports)
 // still send their richer payload on top.
 store.onChange((change) => {
+    // Who owns which thread, and what each member may see, follow the fleet.
+    if (change.type !== "message" && change.type !== "message.patch" && change.type !== "thread" && change.type !== "sections")
+        forgetVisibility();
     switch (change.type) {
         case "sections":
             broadcast({ kind: "sections", sections: store.sections });
@@ -2691,6 +3426,7 @@ store.onChange((change) => {
             broadcast({ kind: "thread", threadId: change.threadId, activeLeafId: change.activeLeafId });
             break;
         case "thread.deleted":
+            directRequestOwners.delete(change.threadId);
             routines?.forgetRoutineRequestReceiptsForThread(change.threadId);
             // A deleted destination must not strand an approval in an internal
             // task. Keep each run's snapshot and expose its execution as fallback.
@@ -2705,6 +3441,10 @@ store.onChange((change) => {
             const bot = store.bot(change.botId);
             if (bot)
                 broadcast({ kind: "bot", bot: wireBot(bot) });
+            // A new audience narrows the rooms this bot is in, for good.
+            if (bot)
+                for (const group of store.groups.filter((candidate) => candidate.memberIds.includes(bot.id)))
+                    settleRoomFloor(group);
             break;
         }
         case "bot.deleted":
@@ -2714,6 +3454,8 @@ store.onChange((change) => {
             const group = store.group(change.groupId);
             if (group)
                 broadcast({ kind: "group", group: publicGroupState(group) });
+            if (group)
+                settleRoomFloor(group);
             break;
         }
         case "group.deleted":
@@ -2773,6 +3515,62 @@ function messagePage(threadId, limit, before) {
         activeLeafId: store.activeLeaf(threadId),
     };
 }
+function guardedRequestSnapshot(botId, threadId, sendId) {
+    if (!store.taskByThread(botId, threadId))
+        throw requestConflict("No such conversation for this bot");
+    const activeLeafId = store.activeLeaf(threadId);
+    const messages = guardedRequestPath(store.messagesFor(threadId), activeLeafId, sendId);
+    const messageId = messages[0].id;
+    const owner = directRequestOwners.get(threadId);
+    const busy = threadBusy(botId, threadId);
+    const waiting = messages.some(requestNeedsInput) || roomHandoffs.activeDirect(threadId) ||
+        [...pendingTeamSetupResumes.values()].some(entry => entry.request.threadId === threadId);
+    const latestTerminal = messages.findLast(message => message.role === "bot" && message.kind === "text" && message.turnTerminal);
+    const latestTurn = messages.findLast(message => message.turnId);
+    const latestOutcome = messages.findLast(message => message.turnSucceeded !== undefined);
+    // A restart retains proven transcript annotations, not an execution lease.
+    // Unproven output or a different live owner always requires the workspace.
+    const untracked = messages[0].requestCancelled || (owner && (owner.messageId !== messageId || owner.stopped)) ||
+        (busy && !owner) || messages.slice(1).some(message => (message.turnId || (message.role === "bot" && message.kind === "text")) && message.requestMessageId !== messageId) ||
+        (!busy && !waiting && (messages[0].requestPending !== false || !latestTerminal?.turnSucceeded || latestTurn?.turnId !== latestTerminal.turnId ||
+            latestOutcome?.turnSucceeded !== true || (owner && owner.turnId !== latestTerminal.turnId)));
+    const snapshot = {
+        messageId, activeLeafId,
+        phase: untracked ? "untracked" : waiting ? "waiting" : busy ? "working" : "settled",
+        activeTurnId: busy ? owner?.turnId ?? null : null,
+        executionId: owner?.generation ?? null,
+        messages: messages.map(slimMessage),
+    };
+    if (Buffer.byteLength(JSON.stringify(snapshot), "utf8") > 1024 * 1024) {
+        throw Object.assign(new Error("Open this request in the workspace; its transcript exceeds the response limit"), { status: 413 });
+    }
+    return snapshot;
+}
+/** A durable completion fence, not a replay queue. If the process dies while
+ * a Chief is awaiting results, its earlier handoff must not become a final. */
+function settleTrackedRequest(threadId) {
+    const owner = directRequestOwners.get(threadId);
+    const bot = store.botByThread(threadId);
+    if (!owner?.messageId || owner.stopped || !bot || threadBusy(bot.id, threadId) || roomHandoffs.activeDirect(threadId) ||
+        [...pendingTeamSetupResumes.values()].some(entry => entry.request.threadId === threadId))
+        return;
+    // A failed coordination root never supplies the promised return, even if
+    // its original provider successfully said it had assigned the work.
+    if ([...roomHandoffs.nodes.values()].some(node => !node.parentId && node.threadId === threadId &&
+        owner.generations.has(node.id) && node.status !== "completed"))
+        return;
+    const path = store.activePath(threadId);
+    const source = path.findLast(message => message.role === "user");
+    if (source?.id !== owner.messageId || source.requestCancelled || source.requestPending !== true)
+        return;
+    const messages = path.slice(path.indexOf(source) + 1);
+    const terminal = messages.findLast(message => message.turnTerminal && message.role === "bot" && message.kind === "text");
+    if (messages.some(requestNeedsInput) || terminal?.requestMessageId !== source.id || !terminal.turnSucceeded ||
+        terminal.turnId !== owner.turnId || messages.findLast(message => message.turnId)?.turnId !== terminal.turnId ||
+        messages.findLast(message => message.turnSucceeded !== undefined)?.turnSucceeded !== true)
+        return;
+    store.patchMessage(threadId, source.id, { requestPending: false });
+}
 /** A bounded page centred on a known message, used when a search result is
  * opened on a client that only hydrated the newest part of the transcript. */
 function messageWindow(threadId, messageId, limit) {
@@ -2786,6 +3584,26 @@ function messageWindow(threadId, messageId, limit) {
     return { messages: all.slice(start, stop).map(slimMessage), hasMore: start > 0 };
 }
 const sseClients = new Set();
+/** The frame at which a bot's audience last changed (see the SSE route). */
+let audienceChangedAt = 0;
+/** A bot's audience changed: end every member stream. Each reconnects at
+ * once with its cursor, which now predates the change, so it is answered
+ * with a fresh snapshot of exactly what that person may see. Admin and
+ * owner streams are untouched. */
+function audienceChanged() {
+    audienceChangedAt = lastSeq;
+    for (const client of sseClients) {
+        if (client.viewer.kind !== "member")
+            continue;
+        sseClients.delete(client);
+        try {
+            client.res.end();
+        }
+        catch {
+            /* already gone */
+        }
+    }
+}
 function closeSessionStreams(sessionId) {
     browserLive.closeForOwner(sessionId);
     for (const client of sseClients) {
@@ -2836,7 +3654,9 @@ function cursorSeq(raw) {
     const parsed = Number(seq);
     return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
 }
-function broadcast(payload) {
+/** `adminOnly` frames (a workspace spend notice) reach admin streams and
+ * are withheld from client sessions, live and on replay. */
+function broadcast(payload, options = {}) {
     // Membership may also change through fleet/CLI config writes. Close stale
     // email streams before any further workspace data is delivered.
     sessions.revalidateEmailSessions();
@@ -2845,25 +3665,50 @@ function broadcast(payload) {
     const frame = `id: ${STREAM_ID}:${seq}\ndata: ${JSON.stringify({ ...payload, seq })}\n\n`;
     // Store both projections as immutable frames: live and reconnecting clients
     // must receive the same filtered config without changing the admin event.
-    const clientFrame = kind === "config"
-        ? `id: ${STREAM_ID}:${seq}\ndata: ${JSON.stringify({ ...configForAccess(payload, false), seq })}\n\n`
-        : frame;
+    const clientFrame = options.adminOnly
+        ? null
+        : kind === "config"
+            ? `id: ${STREAM_ID}:${seq}\ndata: ${JSON.stringify({ ...configForAccess(payload, false), seq })}\n\n`
+            : frame;
     // Live desktop captures can each be hundreds of kilobytes and become stale
     // as soon as the next one arrives. Keep their sequence slots so resume-gap
     // detection stays honest, but never retain their base64 payloads.
-    replayBuffer.push({ seq, kind, frame: kind === "screen" ? null : frame, clientFrame: kind === "screen" ? null : clientFrame });
+    replayBuffer.push({ seq, kind, frame: kind === "screen" ? null : frame, clientFrame: kind === "screen" ? null : clientFrame, payload: kind === "screen" ? null : payload });
     if (replayBuffer.length > REPLAY_MAX)
         replayBuffer.shift();
     for (const client of Array.from(sseClients)) {
         if (!wants(client, kind))
             continue;
+        // Admin-only frames (clientFrame null) never reach members, and a member never falls back to the admin frame.
+        const out = client.admin ? frame : clientFrame === null ? null : memberFrame(client, seq, payload, clientFrame);
+        if (out === null)
+            continue;
         // Screen frames are replaceable and durable events are not: see
         // ./sse-fanout.ts for the backpressure/bound decision this makes.
-        if (deliverSseFrame(client, kind, client.admin ? frame : clientFrame) === "disconnected") {
+        if (deliverSseFrame(client, kind, out) === "disconnected") {
             sseClients.delete(client);
         }
     }
 }
+/** The frame a non-admin stream gets: the shared client frame, unless a bot
+ * is restricted and this member may not see all of what the frame carries —
+ * then narrowed (bot-visibility.ts), withdrawn, or nothing at all (null). */
+function memberFrame(client, seq, payload, clientFrame) {
+    // A frame kept from clients altogether stays kept: never the admin copy.
+    if (clientFrame === null)
+        return null;
+    if (client.viewer.kind === "all")
+        return clientFrame;
+    const visible = visibleTo(client.viewer);
+    if (visible.everything) {
+        noteSeen(payload, client.seen);
+        return clientFrame;
+    }
+    const narrowed = frameForMember(payload, memberFrameContext(visible), client.seen);
+    if (!narrowed)
+        return null;
+    return narrowed === payload ? clientFrame : `id: ${STREAM_ID}:${seq}\ndata: ${JSON.stringify({ ...narrowed, seq })}\n\n`;
+}
 onSteeredQueueChange(() => broadcast({ kind: "bot.queued", queues: publicBotQueuedMessages() }));
 // ── server-side event folding (upstream's ingestion worker, miniature) ──
 // The canonical stream is the source of truth; the persisted transcript
@@ -3186,9 +4031,14 @@ bus.subscribe((event) => {
         const line = turnOutcomeLine({ ok: event.ok, reply: reply?.text, stopReason: event.stopReason, tools });
         if (!line)
             return;
+        // A room fewer people can see than this bot leaves no line in its log:
+        // session_search would hand it back in a chat anyone who sees the bot has.
+        const room = store.groupByThread(event.threadId);
+        if (room && !roomFeedsBot(room, bot))
+            return;
         appendMemoryLog(bot.id, line, {
             source: memorySourceLabel({
-                room: store.groupByThread(event.threadId),
+                room,
                 task: store.taskByThread(bot.id, event.threadId),
                 threadId: event.threadId,
             }),
@@ -3311,6 +4161,8 @@ async function scheduleTurnDigest(input) {
             text: renderDigest(digest),
             digest,
             turnId: input.turnId,
+            requestMessageId: activities.find(message => message.turnId === input.turnId && message.requestMessageId)?.requestMessageId,
+            turnSucceeded: input.succeeded,
             ...(input.from ? { from: input.from } : {}),
         }, { kind: "digest.append", key: `${input.threadId}:${input.turnId}` });
         // This is derived from the native session's own work, not an unseen
@@ -3854,6 +4706,11 @@ async function selectableComputers(bot) {
         catch (error) {
             reason = error instanceof Error ? error.message : String(error);
         }
+        // Not offered at all when the organisation disallows it.
+        const kind = surface === "local" ? "thisComputer" : surface === "vm" ? "localVm" : surface === "cloud" ? (bot.cloudBackend === "vps" ? "vps" : "box") : undefined;
+        const managed = kind && managedPolicy.computerRefusal(kind);
+        if (managed)
+            return { surface, label: surfaceLabel(surface), available: false, ready: false, canStart: false, canCreate: false, reason: managed };
         const available = ready || canStart || canCreate;
         return { surface, label: surfaceLabel(surface), available, ready, canStart, canCreate, ...(!available ? { reason } : {}) };
     }));
@@ -4118,7 +4975,11 @@ bus.subscribe((event) => {
         return;
     const speaker = group ? groupSpeakers.get(event.threadId) : undefined;
     const pushMessage = (m) => {
-        const message = store.appendMessage(event.threadId, group && m.role === "bot" ? { ...m, from: speaker } : m);
+        const owner = bot ? directRequestOwners.get(event.threadId) : undefined;
+        const proven = owner?.messageId && !owner.stopped && owner.generation === directTurnGenerationByThread.get(event.threadId) &&
+            owner.turnId && (!event.turnId || event.turnId === owner.turnId);
+        const message = store.appendMessage(event.threadId, group && m.role === "bot" ? { ...m, from: speaker }
+            : proven ? { ...m, requestMessageId: owner.messageId } : m);
         return message;
     };
     if (coordinatorVisibleText) {
@@ -4129,6 +4990,10 @@ bus.subscribe((event) => {
         handoffs.onEvent(event);
     if (event.turnId)
         liveTurnByThread.set(event.threadId, event.turnId);
+    const requestOwner = bot ? directRequestOwners.get(event.threadId) : undefined;
+    if (requestOwner && event.turnId && !requestOwner.turnId && event.type === "turn.started" &&
+        directTurnDispatchClaims.get(event.threadId)?.id === requestOwner.generation)
+        requestOwner.turnId = event.turnId;
     const liveTurnId = event.turnId ?? liveTurnByThread.get(event.threadId);
     switch (event.type) {
         case "turn.started":
@@ -4455,8 +5320,11 @@ bus.subscribe((event) => {
                     });
                 }
             }
-            if (completedTurnId)
-                store.markTerminalAssistantMessage(event.threadId, completedTurnId);
+            if (completedTurnId) {
+                const terminal = store.markTerminalAssistantMessage(event.threadId, completedTurnId);
+                if (terminal)
+                    store.patchMessage(event.threadId, terminal.id, { turnSucceeded: event.ok });
+            }
             const reply = lastReply.get(event.threadId) ?? "";
             lastReply.delete(event.threadId);
             // A run that broke — not one the person stopped, and not a routine's,
@@ -4506,6 +5374,7 @@ bus.subscribe((event) => {
                         drainTeamSetupResumes();
                         drainDelegationWakes();
                     }
+                    settleTrackedRequest(event.threadId);
                 };
                 // bank what this turn spent before the bot broadcast carries the
                 // task list to every window. The driver's own per-turn figure
@@ -4531,7 +5400,7 @@ bus.subscribe((event) => {
                 const measuredSelection = directTurnBots.get(event.threadId)?.modelSelection ?? selection;
                 store.patchTask(bot.id, event.threadId, { lastContextModel: Number.isFinite(lastContext?.tokens) && (lastContext?.tokens ?? 0) > 0
                         ? `${measuredSelection.instanceId}:${measuredSelection.model}` : undefined });
-                appendUsage(DATA_DIR, {
+                bookTurnUsage({
                     botId: bot.id,
                     botName: bot.name,
                     threadId: event.threadId,
@@ -4548,12 +5417,12 @@ bus.subscribe((event) => {
                             ? { kind: "bot", ...(settledTask?.openedBy?.botId ? { botId: settledTask.openedBy.botId } : {}) }
                             : turnTriggers.get(event.threadId) ?? { kind: "owner" },
                 });
-                noteSpend(DATA_DIR, event.cost ?? null);
                 const digestSettled = completedTurnId ? scheduleTurnDigest({
                     botId: bot.id,
                     botName: bot.name,
                     threadId: event.threadId,
                     turnId: completedTurnId,
+                    succeeded: event.ok,
                     driverKind: registry.get(selection.instanceId)?.driverKind,
                     instanceId: selection.instanceId,
                     reply,
@@ -4616,7 +5485,7 @@ bus.subscribe((event) => {
                 const tokens = event.usage ?? lastReported;
                 const speakingBot = store.bot(speaker.botId);
                 const selection = speakingBot?.modelSelection;
-                appendUsage(DATA_DIR, {
+                bookTurnUsage({
                     botId: speaker.botId,
                     botName: speaker.name,
                     threadId: event.threadId,
@@ -4631,7 +5500,6 @@ bus.subscribe((event) => {
                         ? { kind: "routine", routineId: routineRun.routineId, label: routineRun.routineName }
                         : turnTriggers.get(event.threadId) ?? { kind: "owner" },
                 });
-                noteSpend(DATA_DIR, event.cost ?? null);
                 if (completedTurnId) {
                     void scheduleTurnDigest({
                         botId: speaker.botId, botName: speaker.name,
@@ -5252,15 +6120,13 @@ function retryDelegationsWaitingOn(botId) {
         // Explicit idle releases (room/setup/reload/watchdog fallbacks) may not
         // publish turn.completed. They free a waiting source continuation too.
         drainDelegationWakes();
-        // A bot still busy in one thread has nevertheless freed a slot: the
-        // fresh-thread handoffs waiting on it can move, while the active-thread
-        // ones keep waiting for it to go idle, as they always have.
-        const stillBusy = store.bot(botId)?.busy === true;
-        if (stillBusy && botAtThreadCapacity(botId))
+        // A bot still busy in one thread has nevertheless freed a slot: every
+        // handoff waiting on it re-tests its own admission — a fresh-thread
+        // handoff asks for any free slot, a classic one the standing thread's
+        // startTurn admission — so neither waits for whole-bot idleness.
+        if (store.bot(botId)?.busy === true && botAtThreadCapacity(botId))
             return;
-        const released = stillBusy
-            ? releaseDelegationsWaitingOn(botId, (item) => item.targetThreadId !== undefined)
-            : releaseDelegationsWaitingOn(botId);
+        const released = releaseDelegationsWaitingOn(botId);
         for (const waitingThread of released) {
             drainThreadDelegations(waitingThread);
         }
@@ -5308,7 +6174,7 @@ bus.subscribe((event) => {
 function drainQueuedSends() {
     if (!followupsReady)
         return;
-    drainSteeredMessages(store, (botId, threadId, prompt, userMessage, excludeIds, unattended) => 
+    drainSteeredMessages(store, (botId, threadId, prompt, userMessage, excludeIds, unattended, head) => 
     // A plain attended turn — no automationSource, no comms depth: exactly
     // what typing the same words into an idle bot would run. Self-opened
     // work retains `unattended` and the message's bot-origin provenance
@@ -5317,8 +6183,10 @@ function drainQueuedSends() {
     // from duplicating the last one, and excludeIds drops every drained
     // line from the transcript-replay so they are not also in `prompt`.
     new Promise((resolve, reject) => {
+        // The drained turn is booked to whoever sent the first waiting line.
         void startTurn(botId, prompt, {
             threadId, userMessage, excludeMessageIds: excludeIds, unattended, onTurnSettled: resolve,
+            trigger: queuedTurnTrigger(head),
         }).catch((err) => {
             store.appendMessage(threadId, {
                 role: "bot", kind: "activity",
@@ -5337,7 +6205,7 @@ function drainQueuedSends() {
 }
 /** Keep a person's words off the transcript until a direct-thread slot is
  * available. Reuse the existing cancellable, idempotent composer queue. */
-async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender) {
+async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger) {
     const capacity = botAtThreadCapacity(botId);
     if (capacity || threadBusy(botId, threadId) || parksBehindCoordination(botId, threadId)) {
         const reason = capacity ? "capacity" : undefined;
@@ -5346,10 +6214,12 @@ async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId,
             sendId,
             reason,
             prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
+            sender,
+            trigger,
         });
         return { ok: true, queued: true, queueId: queued.id, threadId, reason };
     }
-    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender });
+    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender, trigger });
     return { ok: true, threadId, message };
 }
 /** How many start_thread calls one turn may make. Same spirit as the
@@ -5619,6 +6489,8 @@ async function startTurn(botId, text, opts) {
     const task = store.taskByThread(bot.id, threadId);
     if (!task)
         throw Object.assign(new Error("no such task"), { status: 404 });
+    if (hostedModels && !hostedModels.allows(bot.modelSelection))
+        throw Object.assign(new Error(hostedModels.error()), { status: 409 });
     const plan = turnSurfacePlan(bot, opts?.runOn, threadId);
     const instance = turnInstance(bot, opts?.runOn, threadId);
     if (!instance) {
@@ -5626,6 +6498,9 @@ async function startTurn(botId, text, opts) {
             ? "the Cloud VM runner is unavailable — configure Box in App Settings"
             : `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
     }
+    const policyRefusal = policyModelRefusal(instance);
+    if (policyRefusal)
+        throw Object.assign(new Error(policyRefusal), { status: 409, code: "managed_policy" });
     // Resolve only transport tags from this newly submitted text. The original
     // string remains the durable message. Native-image providers get a
     // path-free prompt and bounded inputs instead of needing a Read tool;
@@ -5700,6 +6575,10 @@ async function startTurn(botId, text, opts) {
                 sender: opts?.sender,
             });
     }
+    // Admitted: every refusal above has passed and no other turn runs on this
+    // thread, so this is the one moment the ledger's "who asked" may change.
+    if (opts?.trigger)
+        turnTriggers.set(threadId, opts.trigger);
     // A card continuation neither starts nor ends the person's ask: it
     // resumes the turn their last message began, so that record stands.
     if (!opts?.cardContinuation) {
@@ -5722,6 +6601,22 @@ async function startTurn(botId, text, opts) {
     const resourceOwner = { threadId, generation: dispatchClaimId };
     turnResourceOwners.set(threadId, resourceOwner);
     directTurnGenerationByThread.set(threadId, dispatchClaimId);
+    let requestMessageId = opts?.cardContinuation ? opts.requestMessageId : userMessage.id;
+    const previousRequest = directRequestOwners.get(threadId);
+    const requestGenerations = requestMessageId && previousRequest?.messageId === requestMessageId
+        ? previousRequest.generations : new Set();
+    if (requestGenerations.size >= 500) {
+        requestGenerations.clear();
+        requestMessageId = undefined;
+    }
+    requestGenerations.add(dispatchClaimId);
+    directRequestOwners.set(threadId, { generation: dispatchClaimId, messageId: requestMessageId,
+        generations: requestGenerations, turnId: null });
+    // An unknown control-plane wake may invalidate a prior final, but it must
+    // never acquire authority by guessing the latest user as its origin.
+    const pendingSource = requestMessageId ?? store.activePath(threadId).findLast(message => message.role === "user")?.id;
+    if (pendingSource)
+        store.patchMessage(threadId, pendingSource, { requestPending: true });
     if (opts?.coordination)
         directCoordinationSettlers.set(dispatchClaimId, opts.coordination.settle);
     // Ordinary sources need the same exact completion ownership as queued
@@ -5930,7 +6825,7 @@ async function startTurn(botId, text, opts) {
             // composio — only to a driver that can mount them. Their tools are
             // never pre-allowed, so every call rides the normal permission flow.
             if (instance.adapter.capabilities.customMcp === true) {
-                const custom = customMcpServers(cfg, bot.mcpServers);
+                const custom = engineMcpServers(bot);
                 if (Object.keys(custom).length)
                     integrations.custom = custom;
             }
@@ -6000,6 +6895,13 @@ async function startTurn(botId, text, opts) {
                 throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
             }
             const wants = plan.computer;
+            // A place the organisation disallows is refused before anything is
+            // prepared; Auto below simply skips disallowed places.
+            const wantedKind = teamComputer ? "box" : wants === "local" ? "thisComputer" : wants === "vm" ? "localVm"
+                : wants === "cloud" ? (cloudBackend === "vps" ? "vps" : "box") : undefined;
+            const placeRefusal = wantedKind && managedPolicy.computerRefusal(wantedKind);
+            if (placeRefusal)
+                throw Object.assign(new Error(placeRefusal), { status: 409, code: "managed_policy" });
             let previewCapture = null;
             let browserCapture = null;
             let computerKind = null;
@@ -6177,7 +7079,7 @@ async function startTurn(botId, text, opts) {
             // A VPS is a local-agent computer mount, never a remote agent runner.
             // Explicit Cloud may prepare/start it. Auto remains read-only unless
             // the person explicitly opted this bot into remote lifecycle actions.
-            if ((wants === "cloud" || wants === undefined) && cloudBackend === "vps") {
+            if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps") {
                 const unsupported = vps.vpsDriverError(instance.driverKind, mountsComputerMcp);
                 if (unsupported && wants === "cloud")
                     throw new Error(unsupported);
@@ -6253,7 +7155,7 @@ async function startTurn(botId, text, opts) {
             // Auto reaches a Local VM this bot already has before it ever touches the
             // host's own desktop: on a headless server that VM is the only desktop
             // there is, and a person who prepared one meant it to be used.
-            if (wants === undefined && !integrations.computer && !integrations.localComputer && await attachLocalVm(false))
+            if (wants === undefined && !integrations.computer && !integrations.localComputer && managedPolicy.computerAllowed("localVm") && await attachLocalVm(false))
                 computerKind = "vm";
             // An unattended run on a bot with a VPS configured never lands on the
             // host's own desktop instead: a scheduled job clicking on someone's
@@ -6263,6 +7165,7 @@ async function startTurn(botId, text, opts) {
                 !integrations.localComputer &&
                 wants === undefined &&
                 !unattendedVps &&
+                managedPolicy.computerAllowed("thisComputer") &&
                 shouldMountLocalComputer({
                     requested: undefined,
                     hostPlatform: process.platform,
@@ -6457,7 +7360,7 @@ async function startTurn(botId, text, opts) {
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
                 // what the bot said lately in its other conversations, so a task
                 // never redoes — or forgets — what another one already did
-                { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(store, bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId })) },
+                { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId })) },
                 { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace }) },
                 { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
                 { id: "skill-instructions", label: "Skill instructions", text: skillInstructions },
@@ -6507,7 +7410,7 @@ async function startTurn(botId, text, opts) {
                 systemStable: prompt.stable,
                 systemVolatile: prompt.volatile,
                 integrations,
-                mcpFromUserConfig: claudeUserMcpEnabled(cfg),
+                mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
                 cwd,
             }), () => !directTurnClaimExists(bot.id, dispatchClaimId, threadId), async () => {
                 await instance.adapter.interruptTurn(threadId).catch(() => { });
@@ -6516,6 +7419,12 @@ async function startTurn(botId, text, opts) {
                 retireProviderTurn(dispatch.value.turnId);
                 throw new DirectTurnSetupCancelled("turn stopped during provider setup");
             }
+            const requestOwner = directRequestOwners.get(threadId);
+            if (requestOwner?.generation === dispatchClaimId && dispatch.value.turnId) {
+                if (requestOwner.turnId && requestOwner.turnId !== dispatch.value.turnId)
+                    requestOwner.messageId = undefined;
+                requestOwner.turnId = dispatch.value.turnId;
+            }
             bindInternalCapabilityToProviderTurn(threadId, dispatchClaimId, dispatch.value.turnId);
             handoffs.bindTurn(threadId, dispatchClaimId, dispatch.value.turnId);
             if (directFollowupSettlers.has(dispatchClaimId) && dispatch.value.turnId &&
@@ -6601,6 +7510,7 @@ async function startTurn(botId, text, opts) {
             store.appendMessage(threadId, {
                 role: "bot",
                 kind: "activity",
+                turnSucceeded: false,
                 tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
             });
             // Worth a buzz for the same reason a routine failure is, and the rule
@@ -6827,7 +7737,12 @@ async function stopBotForEmergencyApprovalDowngrade(botId) {
 // Load queued handoffs before scheduler recovery can fail an interrupted
 // run. Its failure callback can then durably drop that work immediately;
 // nothing dispatches until the listener is ready below.
-const commsBus = { store, broadcast, threadSlotFree: (botId) => !botAtThreadCapacity(botId) };
+const commsBus = {
+    store,
+    broadcast,
+    threadSlotFree: (botId) => !botAtThreadCapacity(botId),
+    canAdmitDirectTurn,
+};
 _loadPending();
 routines = new RoutineManager({
     emit: broadcast,
@@ -7301,7 +8216,7 @@ function dispatchTeamSetupResume(entry) {
     const message = store.messagesFor(request.threadId).find((item) => item.id === messageId);
     if (!owner || !message?.card?.teamSetupRequest?.result)
         return;
-    if (owner.group ? owner.bot.busy : threadBusy(request.botId, request.threadId) || activeGroupTurnForBot(request.botId)) {
+    if (!canAdmitDirectTurn(request.botId, request.threadId)) {
         pendingTeamSetupResumes.set(request.requestId, entry);
         return;
     }
@@ -7332,7 +8247,8 @@ function dispatchTeamSetupResume(entry) {
         groupQueues.set(groupId, next.finally(() => finishGroupTurnOperation(groupId, operation)).catch((error) => failed(error instanceof Error ? error.message : String(error))));
         return;
     }
-    void startTurn(request.botId, prompt, { threadId: request.threadId, cardContinuation: true, onDispatchError: failed }).catch((error) => {
+    void startTurn(request.botId, prompt, { threadId: request.threadId, cardContinuation: true,
+        requestMessageId: requestSourceForCard(store.messagesFor(request.threadId), messageId), onDispatchError: failed }).catch((error) => {
         if (cancelled())
             return;
         if (isTurnAdmissionBlocked(error))
@@ -7343,8 +8259,7 @@ function dispatchTeamSetupResume(entry) {
 }
 function drainTeamSetupResumes() {
     for (const [key, entry] of pendingTeamSetupResumes) {
-        const owner = connectorThread(entry.request.botId, entry.request.threadId);
-        if (owner?.group ? owner.bot.busy : threadBusy(entry.request.botId, entry.request.threadId) || activeGroupTurnForBot(entry.request.botId))
+        if (!canAdmitDirectTurn(entry.request.botId, entry.request.threadId))
             continue;
         pendingTeamSetupResumes.delete(key);
         dispatchTeamSetupResume(entry);
@@ -7689,8 +8604,9 @@ setupRetry = 0) {
         onDispatchError?.(`${bot.name}'s provider account is being updated — try again shortly`);
         return true;
     }
-    if (!instance) {
-        const message = `${bot.name}'s model is unavailable`;
+    const roomPolicyRefusal = instance ? policyModelRefusal(instance) : undefined;
+    if (!instance || roomPolicyRefusal) {
+        const message = roomPolicyRefusal ?? `${bot.name}'s model is unavailable`;
         store.appendMessage(threadId, {
             role: "bot",
             kind: "activity",
@@ -7804,7 +8720,7 @@ setupRetry = 0) {
         }
         // user-configured MCP servers: same gating as the 1:1 site above.
         if (instance.adapter.capabilities.customMcp === true) {
-            const custom = customMcpServers(cfg, bot.mcpServers);
+            const custom = engineMcpServers(bot);
             if (Object.keys(custom).length)
                 integrations.custom = custom;
         }
@@ -7921,6 +8837,13 @@ setupRetry = 0) {
                 readyBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true,
         });
+        // A place the organisation disallows is refused before anything is
+        // provisioned or started, exactly as a bot thread refuses it.
+        const roomKind = roomTeamComputer ? "box" : roomPlan.computer === "local" ? "thisComputer" : readyBot.computer === "vm" ? "localVm"
+            : roomPlan.computer === "cloud" ? (turnProvider(readyBot) === "vps" ? "vps" : "box") : undefined;
+        const roomPlaceRefusal = roomKind && managedPolicy.computerRefusal(roomKind);
+        if (roomPlaceRefusal)
+            throw Object.assign(new Error(roomPlaceRefusal), { code: "managed_policy" });
         // The Computer engine runs on the Box; this computer has no tools it can
         // reach, exactly as a bot thread refuses it.
         if (roomPlan.computer === "local" && instance.driverKind === "boxAgent") {
@@ -8112,7 +9035,7 @@ setupRetry = 0) {
         // brief can carry a private chat into the room; as with session_search
         // (#754) the room is told, once per source thread, rather than the
         // crossing being blocked.
-        const recentLines = recentWork(store, bot, { userName, currentThreadId: threadId });
+        const recentLines = recentWork(recentWorkSources(bot), bot, { userName, currentThreadId: threadId });
         {
             const crossing = claimRecallCrossings(threadId, recentLines.filter((line) => line.private).map((line) => line.threadId));
             if (crossing.count) {
@@ -8254,7 +9177,7 @@ setupRetry = 0) {
                 systemVolatile: roomSystem.volatile,
                 cwd,
                 integrations,
-                mcpFromUserConfig: claudeUserMcpEnabled(cfg),
+                mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
                 ...(instance.instanceId === readyBot.modelSelection.instanceId
                     ? memberTurnSelection(readyBot.modelSelection)
                     : { model: instance.models.default }),
@@ -8778,6 +9701,9 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
         via: options.via,
         sender: options.sender,
     });
+    // Admitted (see startTurn): the room's speakers are booked to this sender.
+    if (options.trigger)
+        turnTriggers.set(threadId, options.trigger);
     const titled = group.dm ? null : store.titleGroupTaskFromFirstMessage(group.id, text, threadId);
     const snippet = titled?.title;
     const archived = members.filter((member) => member.hidden);
@@ -8833,7 +9759,8 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
     const titleBot = goalCoordinator ?? responders[0];
     const titleInstance = registry.get(titleBot.modelSelection.instanceId);
     const titleText = extractTurnImages(text).text;
-    if (titled && snippet && titleText.trim() && llmThreadTitlesEnabled(cfg) && titleInstance?.generateText) {
+    // An engine the organisation disallows never receives the text, even for a title.
+    if (titled && snippet && titleText.trim() && llmThreadTitlesEnabled(cfg) && titleInstance?.generateText && !policyModelRefusal(titleInstance)) {
         void generateThreadTitle(titleInstance, titleText)
             .then((title) => {
             if (title)
@@ -8926,7 +9853,7 @@ function drainQueuedChannelSends() {
     drainChannelMessages((groupId) => {
         const group = store.group(groupId);
         return group ? groupIsWorking(group) : false;
-    }, ({ groupId, threadId, text, replyToId, sendId, mode, id, via }) => {
+    }, ({ groupId, threadId, text, replyToId, sendId, mode, id, via, sender, trigger }) => {
         const group = store.group(groupId);
         const ownsThread = group?.dm
             ? group.threadId === threadId
@@ -8934,11 +9861,11 @@ function drainQueuedChannelSends() {
         if (!group || !ownsThread)
             return;
         try {
-            startGroupTurn(groupId, text, resolveReplyTarget(threadId, replyToId), sendId, mode, id, { via, threadId });
+            startGroupTurn(groupId, text, resolveReplyTarget(threadId, replyToId), sendId, mode, id, { via, threadId, sender, trigger: queuedTurnTrigger({ trigger, sender }) });
         }
         catch (error) {
             if (!store.messagesFor(threadId).some((message) => message.queueId === id && message.role === "user")) {
-                store.appendMessage(threadId, { role: "user", kind: "text", text, replyToId, sendId, channelMode: mode, queueId: id, via });
+                store.appendMessage(threadId, { role: "user", kind: "text", text, replyToId, sendId, channelMode: mode, queueId: id, via, sender });
             }
             store.appendMessage(threadId, {
                 role: "bot",
@@ -8966,6 +9893,10 @@ function ensureCalendarCallRoom(call) {
     let group = linked && sameCalendarRoster(linked, call.botIds) && !roomSetupPending(linked)
         ? linked
         : undefined;
+    // A call's room is a room like any other: one audience.
+    const conflict = group ? null : roomAudienceConflict(call.botIds);
+    if (conflict)
+        throw Object.assign(new Error(conflict), { status: 400 });
     group ??= store.createGroup(call.name, call.botIds, false, undefined, {
         bulletin: "",
         defaultResponder: { kind: "everyone" },
@@ -8980,7 +9911,14 @@ function deliverCalendarCall(call, scheduledFor) {
     // Multi-bot entries are rooms and begin with the shared event prompt.
     if (call.botIds.length < 2)
         return;
-    const group = ensureCalendarCallRoom(call);
+    let group;
+    try {
+        group = ensureCalendarCallRoom(call);
+    }
+    catch (error) {
+        console.warn(`calendar call "${call.name}" did not start: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+    }
     const text = [
         `@everyone ${call.description.trim() || call.name}`,
         ...call.attachments.map((attachment) => `<${attachment.kind === "image" ? "attached-image" : "attached-file"} path="${escapeAttribute(attachment.path)}" name="${escapeAttribute(attachment.name)}" />`),
@@ -9018,6 +9956,8 @@ function connectorThread(botId, threadId) {
     const bot = store.bot(botId);
     if (!bot)
         return null;
+    if (bot.threadId === threadId)
+        return { bot, group: undefined }; // a bot's own main chat
     if (store.taskByThread(botId, threadId))
         return { bot, group: undefined };
     const group = store.groupByThread(threadId);
@@ -9386,7 +10326,7 @@ function dispatchConnectorResume(entry) {
         return;
     const names = entry.labels.join(", ");
     const prompt = `OpenMausBot connection update: the user securely connected ${names}. Continue the task that paused for this connection. Do not ask them to connect it again.`;
-    if (owner.group ? owner.bot.busy : threadBusy(entry.botId, entry.threadId) || activeGroupTurnForBot(entry.botId)) {
+    if (!canAdmitDirectTurn(entry.botId, entry.threadId)) {
         pendingConnectorResumes.set(`${entry.threadId}:${entry.resumeKey}`, entry);
         return;
     }
@@ -9439,8 +10379,7 @@ function maybeResumeConnectors(botId, threadId, resumeKey) {
 }
 function drainConnectorResumes() {
     for (const [key, entry] of pendingConnectorResumes) {
-        const owner = connectorThread(entry.botId, entry.threadId);
-        if (owner?.group ? owner.bot.busy : threadBusy(entry.botId, entry.threadId) || activeGroupTurnForBot(entry.botId))
+        if (!canAdmitDirectTurn(entry.botId, entry.threadId))
             continue;
         pendingConnectorResumes.delete(key);
         dispatchConnectorResume(entry);
@@ -9513,7 +10452,7 @@ function dispatchSecretResume(entry) {
     const prompt = entry.outcome === "provided"
         ? `OpenMausBot credential update: the user securely provided ${entry.label}. Continue the task that paused for it. You do not receive the secret and must not ask them to paste it into chat.`
         : `OpenMausBot credential update: the user declined to provide ${entry.label}. Continue without it if possible, or briefly explain the limitation. Do not ask them to paste it into chat.`;
-    if (owner.group ? owner.bot.busy : threadBusy(entry.botId, entry.threadId) || activeGroupTurnForBot(entry.botId)) {
+    if (!canAdmitDirectTurn(entry.botId, entry.threadId)) {
         pendingSecretResumes.set(`${entry.threadId}:${entry.messageId}`, entry);
         return;
     }
@@ -9658,8 +10597,7 @@ async function provideSecretFromPhone(context, authenticatedDeviceId) {
 }
 function drainSecretResumes() {
     for (const [key, entry] of pendingSecretResumes) {
-        const owner = connectorThread(entry.botId, entry.threadId);
-        if (owner?.group ? owner.bot.busy : threadBusy(entry.botId, entry.threadId) || activeGroupTurnForBot(entry.botId))
+        if (!canAdmitDirectTurn(entry.botId, entry.threadId))
             continue;
         pendingSecretResumes.delete(key);
         dispatchSecretResume(entry);
@@ -9847,20 +10785,38 @@ async function perBotLocalVmCountForModeChange() {
     }
     return existingPerBotLocalVmCount(runtime.runtime);
 }
+/** What Settings needs about the edition: the features, and, once the key
+ * is inside its warning window or grace period, when it lapses. The dates
+ * reach admins only (configForAccess strips them for client sessions). */
+function editionForSettings(status) {
+    const expiring = status.edition === "enterprise" && status.expiresAt && status.expiresInDays !== undefined &&
+        (status.graceEndsAt !== undefined || status.expiresInDays <= LICENSE_WARN_DAYS);
+    return {
+        edition: status.edition,
+        features: status.features,
+        ...(expiring ? { license: { expiresAt: status.expiresAt, expiresInDays: status.expiresInDays, ...(status.graceEndsAt ? { graceEndsAt: status.graceEndsAt } : {}) } } : {}),
+    };
+}
 function configStatus() {
+    // off-by-default thread cleanup knobs stay absent so clients can tell
+    // "unset" apart from any in-range value
+    const eventLogMaxBytes = threadEventLogMaxBytes(cfg);
+    const eventLogRetentionDays = threadEventLogRetentionDays(cfg);
     return {
         xai: { configured: Boolean(cfg.xai?.key) },
         anthropic: { configured: Boolean(cfg.anthropic?.key) },
         // a fleet agent on this server means Settings → Workspaces has something to drive
         fleet: { available: fleetAvailable(fleetSocketPath()) },
         // what this build is entitled to, so Settings shows only what works here
-        edition: (({ edition, features }) => ({ edition, features }))(editionStatus()),
+        edition: editionForSettings(editionStatus()),
         // settings, not secrets: the cap and the operator's own price list
         budgets: {
             ...(cfg.budgets?.monthlyUsd !== undefined ? { monthlyUsd: cfg.budgets.monthlyUsd } : {}),
             ...(cfg.budgets?.warnAtPercent !== undefined ? { warnAtPercent: cfg.budgets.warnAtPercent } : {}),
         },
         billing: { currency: cfg.billing?.currency ?? "USD", prices: cfg.billing?.prices ?? {} },
+        // how long the approval decision log is kept, after env and default
+        decisions: { retentionDays: decisionRetentionDays(cfg.decisions?.retentionDays) },
         // the base URL is a setting, not a secret; the key stays write-only
         openaiCompat: { configured: Boolean(cfg.openaiCompat?.key), url: cfg.openaiCompat?.url ?? "" },
         composio: {
@@ -9876,10 +10832,16 @@ function configStatus() {
         imageGen: avatarImageStatus(cfg),
         // not a secret — the sidebar shows it
         profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "" },
+        // the enrolled organisation's read-only desktop policy; null when not enrolled
+        managedPolicy: managedPolicy.summary(),
         // not a secret — the settings picker shows it; "" = follow the system
         language: cfg.language ?? "",
         rooms: { turnTimeoutMinutes: roomTurnTimeoutMinutes(cfg) },
-        threads: { maxConcurrentPerBot: maxConcurrentBotThreads(cfg) },
+        threads: {
+            maxConcurrentPerBot: maxConcurrentBotThreads(cfg),
+            ...(eventLogMaxBytes !== null ? { eventLogMaxBytes } : {}),
+            ...(eventLogRetentionDays !== null ? { eventLogRetentionDays } : {}),
+        },
         localVm: {
             mode: localVmMode(cfg),
             maxInstances: localVmMaxInstances(cfg),
@@ -9913,6 +10875,8 @@ function configStatus() {
         browserProfiles: cfg.browserProfiles ?? [],
         // who may sign in with an emailed code (server/account-signin.ts)
         signIn: { admins: cfg.signIn?.admins ?? [], members: cfg.signIn?.members ?? [] },
+        // whether that list decides anything here, or the organisation's Admin does
+        membership: workspaceMembership(),
     };
 }
 function configForAccess(status, admin) {
@@ -9923,6 +10887,7 @@ function configForAccess(status, admin) {
     // source objects.
     return {
         ...status,
+        edition: { edition: status.edition.edition, features: status.edition.features },
         signIn: { admins: [], members: [] },
         vps: { configured: status.vps.configured, sshAlias: "" },
         profile: { name: status.profile.name, email: "" },
@@ -9930,7 +10895,15 @@ function configForAccess(status, admin) {
     };
 }
 function mcpServerResponse() {
-    return { servers: listMcpServers(cfg.mcpServers) };
+    // While enrolled with custom servers off, say which servers stay configured
+    // but never reach bots, and why. Nothing here is written to config.json.
+    const policy = managedPolicy.current();
+    const servers = listMcpServers(cfg.mcpServers).map(server => managedPolicy.mcpAllowed(server.name, "url" in server ? server.url : undefined) ? server : { ...server, managedBy: policy.organizationName });
+    return { servers, ...(policy && !policy.mcp.allowCustom ? { managed: { organizationName: policy.organizationName, allowlist: policy.mcp.allowlist } } : {}) };
+}
+/** Adding or editing a server the organisation has not approved is refused. */
+function mcpPolicyRefusal(name, server) {
+    return managedPolicy.mcpRefusal(name, "url" in server && typeof server.url === "string" ? server.url : undefined);
 }
 /** The fields a new server may set, in whichever shape the form sent — a
  * command to run or a URL to reach. Absent keys stay absent, so the strict
@@ -9946,6 +10919,11 @@ function mcpServerBody(body) {
     }
     return out;
 }
+/** Configured MCP servers that may reach this bot's engine. While enrolled,
+ * the organisation's allow-list filters them; config.json is never changed. */
+function engineMcpServers(bot) {
+    return managedPolicy.filterMcp(customMcpServers(cfg, bot.mcpServers));
+}
 function persistMcpServers(next) {
     saveConfig({ mcpServers: next });
     // Do not reload the provider fleet: integrations are assembled from cfg at
@@ -9955,25 +10933,31 @@ function persistMcpServers(next) {
     cfg.mcpServers = next;
 }
 async function describeInstances() {
-    const configs = instanceConfigs(cfg);
+    const configs = providerConfigs();
     return (await registry.describe()).map((instance) => {
         const entry = configs[instance.instanceId];
         const described = entry?.icon ? { ...instance, icon: entry.icon } : instance;
+        if (hostedModels)
+            return { ...described, readOnly: true,
+                install: undefined, authentication: undefined, cli: undefined, cliCandidates: [],
+            };
+        const policyReason = policyModelRefusal(instance);
+        const policy = policyReason ? { policy: { organizationName: managedPolicy.current().organizationName, reason: policyReason } } : {};
         if (managedDesktop.owns(instance.instanceId))
             return {
-                ...described, readOnly: true, managed: managedDesktop.info(instance.instanceId),
+                ...described, ...policy, readOnly: true, managed: managedDesktop.info(instance.instanceId),
                 install: undefined, authentication: undefined, cli: undefined, cliCandidates: [],
             };
         if (entry?.driver !== "claudeAgent")
-            return described;
+            return { ...described, ...policy };
         try {
             const claudeAccount = claudeAccountInfo(instance.instanceId, entry, instance.cli ?? instance.cliDefault ?? "claude");
-            return { ...described, claudeAccount, install: { ...instance.install, signInCommand: claudeAccount.signInCommand } };
+            return { ...described, ...policy, claudeAccount, install: { ...instance.install, signInCommand: claudeAccount.signInCommand } };
         }
         catch {
             // A malformed saved config remains a repairable shadow, never takes
             // the model picker down or offers a login for the wrong directory.
-            return { ...described, install: { ...instance.install, signInCommand: undefined } };
+            return { ...described, ...policy, install: { ...instance.install, signInCommand: undefined } };
         }
     });
 }
@@ -10090,7 +11074,7 @@ async function reloadProviders() {
     bus.detachAll();
     try {
         await registry.disposeAll();
-        await registry.load(instanceConfigs(cfg));
+        await registry.load(providerConfigs(), decorateHostedProvider);
         // Personal providers are usable independently of the optional Company
         // overlay. Subscribe them before restoring that overlay so a broken or
         // expired Company runtime cannot leave the rebuilt personal fleet mute.
@@ -10183,11 +11167,6 @@ function serveStatic(res, path) {
         }
     }
 }
-function json(res, status, body) {
-    const data = JSON.stringify(body);
-    res.writeHead(status, { "content-type": "application/json" });
-    res.end(data);
-}
 /** A store refusal is a client error with a status of its own (400 path,
  * 409 conflict, 413 too large); a 409 also carries what is on disk now so
  * the editor can show the bot's version instead of guessing. Anything else
@@ -10208,46 +11187,6 @@ function journalEntryForClient(botId, entry) {
     const threadTitle = entry.threadId ? store.taskByThread(botId, entry.threadId)?.title : undefined;
     return threadTitle ? { ...visible, threadTitle } : visible;
 }
-function readBody(req, limit = 1_000_000) {
-    return new Promise((resolve, reject) => {
-        let data = "";
-        let bytes = 0;
-        let done = false;
-        const fail = (status, msg) => {
-            if (done)
-                return;
-            done = true;
-            const err = Object.assign(new Error(msg), { status });
-            reject(err);
-        };
-        req.on("data", (c) => {
-            if (done)
-                return;
-            bytes += typeof c === "string" ? Buffer.byteLength(c) : c.length;
-            if (bytes > limit) {
-                // Keep draining the socket, but stop retaining attacker-controlled
-                // bytes. Destroying the request here prevents the caller from
-                // receiving the useful 413 response.
-                return fail(413, "body too large");
-            }
-            data += c;
-        });
-        req.on("end", () => {
-            if (done)
-                return;
-            let body;
-            try {
-                body = data ? JSON.parse(data) : {};
-            }
-            catch {
-                return fail(400, "invalid JSON body");
-            }
-            done = true;
-            resolve(body);
-        });
-        req.on("error", (e) => fail(400, e instanceof Error ? e.message : String(e)));
-    });
-}
 // Loopback-only enforcement: the harness runs on 127.0.0.1 but accepts
 // requests from any loopback connection and any web page that DNS-rebinds
 // onto it. Reject non-loopback Hosts outright (defeats rebinding) and
@@ -10262,7 +11201,7 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
         const current = resolveRequestAuth(req, {
             sessions, cookieName: SESSION_COOKIE, streamPath: "/api/events",
             url: new URL(req.url ?? "/", `http://localhost:${PORT}`),
-            loopbackMutationToken: desktopMutationToken, companionMutationToken,
+            loopbackMutationToken: desktopMutationToken, companionMutationToken, loopbackTrust: LOOPBACK.trust, cliOwnerToken,
         }).auth;
         return Boolean(current?.scopes.includes("admin") && current.kind === original.kind &&
             (current.kind !== "session" || (original.kind === "session" && current.session.id === original.session.id)));
@@ -10286,13 +11225,16 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
         pause: () => { routines?.stop(); calendarCalls?.stop(); watchdog.stop(); },
         resume: () => { routines?.start(); calendarCalls?.start(); watchdog.start(); },
         flush: async () => {
-            await Promise.all([flushAllProfileHistory(), flushAllMemoryJournals(), flushUsageLedger(DATA_DIR), flushDecisionLog(DATA_DIR)]);
+            await Promise.all([flushAllProfileHistory(), flushAllMemoryJournals(), flushUsageLedger(DATA_DIR), flushDecisionLog(DATA_DIR), flushAdminActivity(DATA_DIR)]);
             // With writers gated and work idle, release our WAL connection for the
             // consistent snapshot. Store reopens it lazily after maintenance.
             closeMessageDb();
         },
     }, keepLocked),
 });
+// Route modules (server/routes/README.md). `workspaceAccess` is assigned at
+// boot, after this line, so the dependency reads it per request.
+ROUTES.push(createHostedSlackRoutes({ bot: (id) => store.bot(id), hostedReady: () => Boolean(workspaceAccess) && entitled("admin") }));
 const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
@@ -10317,6 +11259,8 @@ const handleRequest = async (req, res) => {
                 return json(res, 503, { error: "Hosted workspace readiness is unavailable." });
             }
             res.setHeader(HOSTED_CONTRACT_HEADER, String(HOSTED_CONTRACT_VERSION));
+            if (hostedModels)
+                res.setHeader(HOSTED_MODEL_POLICY_HEADER, "1");
             return json(res, 200, { ok: true, service: "openmausbot", membershipAuthority: "portal", workspace: hosted.workspace, ...HOSTED_CONTRACT_METADATA });
         }
         // Hosted workspaces have one sign-in authority. A missing optional layer
@@ -10333,6 +11277,13 @@ const handleRequest = async (req, res) => {
                 return json(res, 503, { error: "Workspace sign-in is unavailable." });
             }
         }
+        // An enrolled organisation that turns remote access off refuses new pairing
+        // codes and new remote sessions. Existing sessions and this app are unchanged.
+        if (method === "POST" && ["/api/auth/pair", "/api/pair", "/api/auth/pairing", "/api/auth/email/start", "/api/auth/email/verify"].includes(path)) {
+            const refusal = managedPolicy.remoteAccessRefusal();
+            if (refusal)
+                return json(res, 403, { error: refusal, code: "managed_policy" });
+        }
         // ── who is asking (server/request-auth.ts) ──────────────────────────
         // Two public routes come first: what this server is, and turning a pairing
         // code into a session. Everything else needs the loopback owner or a
@@ -10458,6 +11409,8 @@ const handleRequest = async (req, res) => {
             loopbackMutationToken: desktopMutationToken,
             companionMutationToken,
             features: { sharedComputers: sharedComputersEnabled(cfg) },
+            loopbackTrust: LOOPBACK.trust,
+            cliOwnerToken,
         });
         // The browser's cookie carries the term it was set with, and the
         // session's term slides on use (sessions.ts `renew`), so re-issue the
@@ -10494,6 +11447,20 @@ const handleRequest = async (req, res) => {
             if (failure)
                 return json(res, failure.status, { error: failure.error });
         }
+        // Bot visibility: a member reaches a restricted bot, its threads, rooms,
+        // routines and files exactly as they reach an id that does not exist.
+        // Lists and live frames are narrowed where they are built, below.
+        const visible = visibleTo(viewerFor(auth));
+        if (!visible.everything) {
+            const subject = pathSubject(path);
+            if (subject && !subjectVisible(subject, visible))
+                return json(res, 404, { error: notFoundFor(subject) });
+            // Every bot a member is sent (a read receipt, a profile or display
+            // edit, a new or switched task) comes without its audience list or
+            // the teammates they cannot see, whichever route answers.
+            onJsonBody(res, (body) => memberBody(body, visible));
+        }
+        beginAdminAudit(req, res, method, path, auth);
         if (method === "POST" && path === "/api/workspace-backup/restore" && teamComputers.list().some(computer => computer.section !== null)) {
             return json(res, 409, { error: "Unassign team computers before restoring a workspace; restored team names must not gain access to existing desktops" });
         }
@@ -10504,10 +11471,14 @@ const handleRequest = async (req, res) => {
         if (path.startsWith("/api/") && path !== "/api/events" && path !== "/api/health" && !path.startsWith("/api/shared-computers/") && !isWorkspaceBackupSessionControl(method, path)) {
             releaseWorkspaceRequest = workspaceMaintenance.request();
         }
+        // New routes live in modules registered in server/routes/table.ts and
+        // are tried here, behind the gate above; do not add route `if`s below.
+        if (await dispatchRoutes(ROUTES, { req, res, url, path, method, auth, json, readBody }))
+            return;
         // ── sessions: who am I, tickets, pairing and revocation ─────────────
         if (method === "GET" && path === "/api/auth/session") {
             return json(res, 200, auth.kind === "loopback"
-                ? { kind: "loopback", scopes: auth.scopes, environmentId: ENVIRONMENT_ID }
+                ? { kind: "loopback", scopes: auth.scopes, environmentId: ENVIRONMENT_ID, ...(auth.trust ? { trust: auth.trust } : {}) }
                 : {
                     kind: "session",
                     id: auth.session.id,
@@ -10518,6 +11489,9 @@ const handleRequest = async (req, res) => {
                     environmentId: ENVIRONMENT_ID,
                     // the account behind the session, when it came from a sign-in
                     ...(auth.session.email ? { email: auth.session.email } : {}),
+                    // a hosted team workspace: the web UI's first run skips the
+                    // desktop-only beats there. Absent everywhere else.
+                    ...(HOSTED_WORKSPACE ? { hosted: true } : {}),
                 });
         }
         if (method === "POST" && path === "/api/auth/stream-ticket") {
@@ -10620,8 +11594,14 @@ const handleRequest = async (req, res) => {
                 sharedComputerControl.release(body.id);
             else if (body.action === "renew")
                 sharedComputerControl.renew(body.id);
-            else
+            else {
+                // The desktop's own screen, lent to another computer: the organisation's
+                // "this computer" setting applies here as it does to bot turns.
+                const refusal = managedPolicy.computerRefusal("thisComputer");
+                if (refusal)
+                    return json(res, 403, { error: refusal, code: "managed_policy" });
                 sharedComputerControl.acquire(body.id);
+            }
             return json(res, 200, { ok: true });
         }
         // A paired desktop registers only its own outbound connector. A second,
@@ -10721,6 +11701,9 @@ const handleRequest = async (req, res) => {
             if (!internalSender) {
                 return json(res, 401, { error: "unauthorized" });
             }
+            if (internalCapability.generation === EXTERNAL_RUNTIME_GENERATION && !externalRuntimeMayCall(method, path)) {
+                return json(res, 403, { error: "an external runtime can only list, ask and delegate to its peers and read its delegations" });
+            }
             const requiredCapabilityKind = path === "/api/internal/hook"
                 ? "hooks"
                 : path === "/api/internal/browser/mcp"
@@ -10842,6 +11825,14 @@ const handleRequest = async (req, res) => {
                 const result = toolResults.read(internalCapability, id, offset);
                 return result ? json(res, 200, result) : json(res, 404, { error: "Saved result unavailable in this bot's conversation, expired, or offset out of range. Do not repeat an action to retrieve its output." });
             }
+            // Notes written from a room fewer people can see than this bot would
+            // carry that room's words to everyone who can see the bot.
+            if ((path === "/api/internal/memory" || path === "/api/internal/memory/log") && method === "POST") {
+                const room = store.groupByThread(internalCapability.threadId);
+                if (room && !roomFeedsBot(room, internalSender)) {
+                    return json(res, 403, { error: "This room is visible to fewer people than you are, so notes from it can't go into your memory. Keep them in the room." });
+                }
+            }
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
                 const result = updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText }, { source: memorySource() });
@@ -11165,7 +12156,7 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: "Only an active Chief may plan team setup" });
                 return json(res, 200, {
                     teams: teamSetupTeams().filter((name) => canAccessTeam(chief, name)),
-                    bots: store.bots.filter((bot) => !bot.hidden && canAccessTeam(chief, bot.section) && (bot.id === chief.id || peerAllowed(chief, bot.id)))
+                    bots: store.bots.filter((bot) => !bot.hidden && canAccessTeam(chief, bot.section) && (bot.id === chief.id || peerAllowed(chief, bot)))
                         .map((bot) => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section ?? "", modelSelection: bot.modelSelection })),
                     instances: instances.map((instance) => ({ instanceId: instance.instanceId, driverKind: instance.driverKind, displayName: instance.displayName,
                         state: instance.snapshot.state, models: instance.models, effortLevels: instance.capabilities?.effortLevels ?? [] })),
@@ -11240,7 +12231,7 @@ const handleRequest = async (req, res) => {
                 const sinceRaw = url.searchParams.get("since");
                 const untilRaw = url.searchParams.get("until");
                 const since = sinceRaw ? parseSince(sinceRaw, now) : null;
-                const until = untilRaw ? parseSince(untilRaw, now) : null;
+                const until = untilRaw ? parseUntil(untilRaw, now) : null;
                 if (sinceRaw && since === null)
                     return json(res, 400, { error: "since must be a date, or a span like 24h, 3d, today, yesterday" });
                 if (untilRaw && until === null)
@@ -11268,7 +12259,9 @@ const handleRequest = async (req, res) => {
                 // Still own-bot: another bot's threads never enter this list.
                 const roomByThread = new Map();
                 for (const group of store.groups) {
-                    if (!group.memberIds.includes(from.id))
+                    // A room fewer people can see than this bot stays out of its recall
+                    // (bot-visibility.ts roomFeeds): its lines would otherwise reach them.
+                    if (!group.memberIds.includes(from.id) || !roomFeedsBot(group, from))
                         continue;
                     roomByThread.set(group.threadId, group);
                     for (const task of group.tasks ?? [])
@@ -11461,7 +12454,7 @@ const handleRequest = async (req, res) => {
                 // The sender's allow-list, when it has one. Checked here rather than
                 // trusted from the roster: the tool call carries a bot id, and an id
                 // the model held from an earlier turn must not outlive the grant.
-                if (!peerAllowed(from, target.id)) {
+                if (!peerAllowed(from, target)) {
                     return json(res, 403, { error: `that bot is not on this bot's allowed peers. ${PEER_ACCESS_HELP}` });
                 }
                 const fromThreadId = internalCapability.threadId;
@@ -11484,6 +12477,12 @@ const handleRequest = async (req, res) => {
                     const queued = queueDelegation(commsBus, from, { toBotId, message, reason: "asked while busy", depth, approvalAlreadyGranted }, MAX_COMMS_DEPTH, fromThreadId);
                     if (queued.result !== "ok" || !queued.id)
                         return json(res, 200, { busy: true });
+                    // An external caller has no source turn whose completion can
+                    // begin the busy wait. Drain now so the target's idle release
+                    // retries this handoff, retaining any approval already granted.
+                    if (internalCapability.generation === EXTERNAL_RUNTIME_GENERATION && !threadBusy(from.id, fromThreadId)) {
+                        drainThreadDelegations(fromThreadId);
+                    }
                     return json(res, 200, { busy: true, taskId: queued.id, toBotName: target.name });
                 };
                 if (target.busy)
@@ -11515,7 +12514,7 @@ const handleRequest = async (req, res) => {
                     if (!canAccessTeam(freshFrom, freshTarget.section) || freshTarget.hidden) {
                         return json(res, 200, { error: "that bot moved to a different section" });
                     }
-                    if (!peerAllowed(freshFrom, freshTarget.id)) {
+                    if (!peerAllowed(freshFrom, freshTarget)) {
                         return json(res, 200, { error: "that bot is no longer an allowed peer" });
                     }
                     // Membership can be revoked while the card is open: re-check the
@@ -11604,11 +12603,17 @@ const handleRequest = async (req, res) => {
                 // Bounded long-poll: the delegating bot parks ONE cheap HTTP request
                 // here instead of burning a model inference per status check.
                 for (;;) {
+                    requireActiveInternalCapability();
                     const receipt = findDelegationReceipt(taskId);
                     if (receipt) {
                         if (receipt.sourceThreadId !== fromThreadId) {
                             return json(res, 403, { error: "that task belongs to a different conversation" });
                         }
+                        const sender = store.bot(from.id);
+                        const target = store.bot(receipt.toBotId);
+                        if (!sender || (target && !canReachPeer(sender, target))) {
+                            return json(res, 403, { error: "Result withheld: team access changed while the teammate was working" });
+                        }
                         return json(res, 200, { status: receipt.status, toBotName: receipt.toBotName, result: receipt.result ?? "" });
                     }
                     const stillQueued = pendingDelegationInfo(taskId);
@@ -11619,8 +12624,13 @@ const handleRequest = async (req, res) => {
                         return json(res, 404, { error: "unknown task id — delegation receipts are kept for about 48 hours" });
                     if (owner !== fromThreadId)
                         return json(res, 403, { error: "that task belongs to a different conversation" });
+                    const toBotId = stillQueued?.toBotId ?? running?.toBotId ?? "";
+                    const sender = store.bot(from.id);
+                    const target = store.bot(toBotId);
+                    if (!sender || (target && !canReachPeer(sender, target))) {
+                        return json(res, 403, { error: "Result withheld: team access changed while the teammate was working" });
+                    }
                     if (Date.now() >= deadline) {
-                        const toBotId = stillQueued?.toBotId ?? running?.toBotId ?? "";
                         if (running && runningEntry) {
                             const recent = summarizeDelegatedActivity(store.messagesFor(runningEntry[0]), running.startedAtMs ?? Date.now());
                             return json(res, 200, {
@@ -11665,7 +12675,7 @@ const handleRequest = async (req, res) => {
                 const target = store.bot(botId);
                 if (!target || target.id === from.id)
                     return json(res, 404, { error: "no such teammate" });
-                if (target.hidden || !canAccessTeam(from, target.section) || !peerAllowed(from, target.id)) {
+                if (target.hidden || !canAccessTeam(from, target.section) || !peerAllowed(from, target)) {
                     return json(res, 403, { error: "that bot is not on this Chief's team — call list_bots for the ones you can reach" });
                 }
                 if (store.groupByThread(threadId))
@@ -11716,7 +12726,7 @@ const handleRequest = async (req, res) => {
                 if (!canAccessTeam(from, target.section) || target.hidden) {
                     return json(res, 403, { error: `that bot belongs to a different section or is unavailable. ${PEER_ACCESS_HELP}` });
                 }
-                if (!peerAllowed(from, target.id)) {
+                if (!peerAllowed(from, target)) {
                     return json(res, 403, { error: `that bot is not on this bot's allowed peers. ${PEER_ACCESS_HELP}` });
                 }
                 const fromThreadId = internalCapability.threadId;
@@ -11736,6 +12746,21 @@ const handleRequest = async (req, res) => {
                     return json(res, 200, { error: said[queued.result === "ok" ? "no_target" : queued.result] });
                 }
                 const targetName = store.bot(toBotId)?.name ?? toBotId;
+                // The queue normally drains when the source thread's turn completes. A
+                // caller this server did not spawn (an external runtime) has no live
+                // turn here, so its handoff would wait for an unrelated turn on that
+                // thread to settle. Nothing in flight on the source thread means there
+                // is nothing to wait for: drain now.
+                if (internalCapability.generation === EXTERNAL_RUNTIME_GENERATION && !threadBusy(from.id, fromThreadId)) {
+                    drainThreadDelegations(fromThreadId);
+                    return json(res, 200, {
+                        queued: true,
+                        taskId: queued.id,
+                        message: peerReviewRequired(from, fromThreadId)
+                            ? `Queued for review — @${targetName} will pick it up once the user approves.`
+                            : `Delegated — @${targetName} is picking it up now.`,
+                    });
+                }
                 return json(res, 200, {
                     queued: true,
                     taskId: queued.id,
@@ -11844,6 +12869,11 @@ const handleRequest = async (req, res) => {
                                 target.threadId = resolved.task.threadId;
                                 if (resolved.created)
                                     createdThread = resolved.task.threadId;
+                                // A work thread carries one assignment: it is for the person
+                                // this coordination serves. The durable pair conversation is
+                                // shared by every assignment between two bots, so it names nobody.
+                                if (resolved.created && resolved.task.openedBy?.kind === "work")
+                                    threadStarters.set(resolved.task.threadId, threadPersonKey(address.threadId));
                                 if (delegatedFullAccess(internalSender, internalCapability.threadId, store.bot(target.botId))) {
                                     grantDelegatedFullAccess(internalSender, store.bot(target.botId), target.threadId);
                                 }
@@ -12074,6 +13104,7 @@ const handleRequest = async (req, res) => {
                     const task = store.createTask(from.id, title, false, projectId, { botId: from.id, name: from.name, at: Date.now() });
                     if (!task)
                         return json(res, 500, { error: "couldn't create that thread" });
+                    threadStarters.set(task.threadId, threadPersonKey(fromThreadId));
                     internalCapability.openedThreads += 1;
                     const chip = {
                         role: "bot",
@@ -12109,12 +13140,14 @@ const handleRequest = async (req, res) => {
                 if (!canAccessTeam(from, target.section) || target.hidden) {
                     return json(res, 403, { error: `that bot belongs to a different section or is unavailable. ${PEER_ACCESS_HELP}` });
                 }
-                if (!peerAllowed(from, target.id)) {
+                if (!peerAllowed(from, target)) {
                     return json(res, 403, { error: `that bot is not on this bot's allowed peers. ${PEER_ACCESS_HELP}` });
                 }
                 const task = store.createTask(target.id, title, false, projectId, { botId: from.id, name: from.name, at: Date.now() });
                 if (!task)
                     return json(res, 500, { error: "couldn't create that thread" });
+                // The work is still for the person whose request the opener is on.
+                threadStarters.set(task.threadId, threadPersonKey(fromThreadId));
                 if (delegatedFullAccess(from, fromThreadId, target))
                     grantDelegatedFullAccess(from, target, task.threadId);
                 const queued = queueDelegation(commsBus, from, { toBotId: target.id, message, depth, targetThreadId: task.threadId }, MAX_COMMS_DEPTH, fromThreadId);
@@ -12198,6 +13231,8 @@ const handleRequest = async (req, res) => {
                     description: instructions,
                     modelSelection: { ...chief.modelSelection },
                     section: chief.section,
+                    // exactly the Chief's audience: a restricted Chief never makes a bot everyone sees
+                    ...(chief.visibility ? { visibility: chief.visibility } : {}),
                 }, { seedMessages: false });
                 const safeBot = store.patchBot(created.id, {
                     composio: false,
@@ -12515,11 +13550,11 @@ const handleRequest = async (req, res) => {
         // transcripts: this projection carries only ids, status relationships,
         // optional delegation labels, and timestamps.
         if (method === "GET" && path === "/api/team-map") {
-            const visible = new Set(store.bots.filter((bot) => !bot.hidden).map((bot) => bot.id));
+            const mapped = new Set(store.bots.filter((bot) => !bot.hidden && visible.bot(bot.id)).map((bot) => bot.id));
             const collaborations = store.groups
                 .filter((group) => group.dm === true &&
                 group.memberIds.length === 2 &&
-                group.memberIds.every((botId) => visible.has(botId)))
+                group.memberIds.every((botId) => mapped.has(botId)))
                 .map((group) => ({
                 groupId: group.id,
                 botIds: [group.memberIds[0], group.memberIds[1]],
@@ -12527,17 +13562,17 @@ const handleRequest = async (req, res) => {
             }))
                 .sort((a, b) => b.lastAt - a.lastAt);
             const queued = pendingDelegationSnapshot().flatMap((item) => {
-                if (!visible.has(item.sourceBotId) || !visible.has(item.toBotId))
+                if (!mapped.has(item.sourceBotId) || !mapped.has(item.toBotId))
                     return [];
                 return [{ sourceBotId: item.sourceBotId, targetBotId: item.toBotId, reason: item.reason }];
             });
             const running = [...delegationWatch.entries()].flatMap(([threadId, watch]) => {
-                if (!visible.has(watch.toBotId))
+                if (!mapped.has(watch.toBotId))
                     return [];
                 const channel = watch.channelId ? store.group(watch.channelId) : undefined;
                 const sourceBotId = watch.sourceBotId ??
                     channel?.memberIds.find((botId) => botId !== watch.toBotId);
-                if (!sourceBotId || !visible.has(sourceBotId))
+                if (!sourceBotId || !mapped.has(sourceBotId))
                     return [];
                 return [{ sourceBotId, targetBotId: watch.toBotId, threadId, groupId: channel?.id }];
             });
@@ -12550,12 +13585,17 @@ const handleRequest = async (req, res) => {
             const from = fromParam == null ? undefined : Number(fromParam);
             const to = toParam == null ? undefined : Number(toParam);
             return json(res, 200, {
-                routines: routines.listRoutines(),
-                runs: routines.listRuns(from != null && Number.isFinite(from) ? from : undefined, to != null && Number.isFinite(to) ? to : undefined),
+                routines: routines.listRoutines().filter((routine) => routineVisible(routine, visible)),
+                runs: routines.listRuns(from != null && Number.isFinite(from) ? from : undefined, to != null && Number.isFinite(to) ? to : undefined)
+                    .filter((run) => routineVisible(run, visible)),
             });
         }
         if (path === "/api/routines" && method === "POST") {
-            return json(res, 201, { routine: routines.create(await readBody(req)) });
+            const body = await readBody(req);
+            const hidden = hiddenRoutineTarget(body, visible);
+            if (hidden)
+                return json(res, 404, { error: hidden });
+            return json(res, 201, { routine: routines.create(body) });
         }
         // The desktop shell polls this to decide whether to hold the computer
         // awake: a run in flight, or a routine due within the hour.
@@ -12569,7 +13609,11 @@ const handleRequest = async (req, res) => {
         }
         routineMatch = path.match(/^\/api\/routines\/([\w-]+)$/);
         if (routineMatch && method === "PATCH") {
-            const routine = routines.update(routineMatch[1], await readBody(req));
+            const body = await readBody(req);
+            const hidden = hiddenRoutineTarget(body, visible);
+            if (hidden)
+                return json(res, 404, { error: hidden });
+            const routine = routines.update(routineMatch[1], body);
             return routine ? json(res, 200, { routine }) : json(res, 404, { error: "no such routine" });
         }
         if (routineMatch && method === "DELETE") {
@@ -12577,6 +13621,9 @@ const handleRequest = async (req, res) => {
                 ? json(res, 200, { ok: true })
                 : json(res, 404, { error: "no such routine" });
         }
+        if (path === "/api/routine-runs/seen-all" && method === "POST") {
+            return json(res, 200, { runs: routines.markAllSeen() });
+        }
         const runMatch = path.match(/^\/api\/routine-runs\/([\w-]+)\/(cancel|seen)$/);
         if (runMatch && method === "POST") {
             const run = runMatch[2] === "cancel"
@@ -12590,7 +13637,11 @@ const handleRequest = async (req, res) => {
         }
         if (path === "/api/calendar-calls" && method === "POST") {
             try {
-                return json(res, 201, { call: calendarCalls.create(await readBody(req)) });
+                const body = await readBody(req);
+                const conflict = calendarAudienceConflict(body);
+                if (conflict)
+                    return json(res, 400, { error: conflict });
+                return json(res, 201, { call: calendarCalls.create(body) });
             }
             catch (error) {
                 throw Object.assign(error instanceof Error ? error : new Error(String(error)), { status: 400 });
@@ -12612,7 +13663,11 @@ const handleRequest = async (req, res) => {
             if (!calendarCalls.get(calendarCallMatch[1]))
                 return json(res, 404, { error: "no such scheduled call" });
             try {
-                return json(res, 200, { call: calendarCalls.update(calendarCallMatch[1], await readBody(req)) });
+                const body = await readBody(req);
+                const conflict = calendarAudienceConflict(body);
+                if (conflict)
+                    return json(res, 400, { error: conflict });
+                return json(res, 200, { call: calendarCalls.update(calendarCallMatch[1], body) });
             }
             catch (error) {
                 throw Object.assign(error instanceof Error ? error : new Error(String(error)), { status: 400 });
@@ -12628,7 +13683,9 @@ const handleRequest = async (req, res) => {
         // second, webhook-only loopback listener so Funnel or a future hosted
         // relay never has to expose the rest of OpenMausBot's control surface.
         if (path === "/api/webhooks" && method === "GET") {
-            return json(res, 200, { webhooks: webhooks.list(), attempts: webhooks.listAttempts(), ingress: webhookIngressStatus() });
+            const shownHooks = webhooks.list().filter((webhook) => visible.bot(webhook.botId));
+            const shownIds = new Set(shownHooks.map((webhook) => webhook.id));
+            return json(res, 200, { webhooks: shownHooks, attempts: webhooks.listAttempts().filter((attempt) => visible.everything || shownIds.has(attempt.webhookId)), ingress: webhookIngressStatus() });
         }
         if (path === "/api/webhooks" && method === "POST") {
             const created = webhooks.create(await readBody(req));
@@ -12716,11 +13773,19 @@ const handleRequest = async (req, res) => {
             return json(res, 405, { error: "method not allowed" });
         }
         if (method === "GET" && path === "/api/events") {
+            const viewer = viewerFor(auth);
+            const visibleNow = visibleTo(viewer);
             const client = {
                 res,
                 admin: auth.scopes.includes("admin"),
                 screens: url.searchParams.get("screens") !== "off",
                 backpressured: false,
+                viewer,
+                // What this person's hydration (GET /api/bots, narrowed the same way) showed them.
+                seen: viewer.kind === "all" ? { bots: new Set(), groups: new Set() } : {
+                    bots: new Set(store.bots.filter((bot) => visibleNow.bot(bot.id)).map((bot) => bot.id)),
+                    groups: new Set(store.groups.filter((group) => visibleNow.group(group.id)).map((group) => group.id)),
+                },
             };
             if (auth.kind === "session")
                 client.sessionId = auth.session.id;
@@ -12746,7 +13811,11 @@ const handleRequest = async (req, res) => {
             // would leave a permanent hole in its state.
             const resumed = since !== null &&
                 since <= lastSeq &&
-                (replayBuffer.length === 0 ? since === lastSeq : replayBuffer[0].seq <= since + 1);
+                (replayBuffer.length === 0 ? since === lastSeq : replayBuffer[0].seq <= since + 1) &&
+                // A member whose cursor predates a bot's audience change gets a fresh
+                // snapshot: a replay is judged by today's audience and could neither
+                // withdraw what the change hid nor bring back whole what it showed.
+                !(viewer.kind === "member" && audienceChangedAt > 0 && since <= audienceChangedAt);
             res.write(`data: ${JSON.stringify({
                 kind: "hello",
                 cursor: `${STREAM_ID}:${lastSeq}`,
@@ -12757,8 +13826,14 @@ const handleRequest = async (req, res) => {
             })}\n\n`);
             if (resumed) {
                 for (const buffered of replayBuffer) {
-                    const frame = client.admin ? buffered.frame : buffered.clientFrame;
-                    if (buffered.seq > since && frame && wants(client, buffered.kind))
+                    if (buffered.seq <= since || !wants(client, buffered.kind))
+                        continue;
+                    const frame = client.admin
+                        ? buffered.frame
+                        : buffered.payload
+                            ? memberFrame(client, buffered.seq, buffered.payload, buffered.clientFrame)
+                            : buffered.clientFrame;
+                    if (frame)
                         res.write(frame);
                 }
             }
@@ -12807,16 +13882,23 @@ const handleRequest = async (req, res) => {
             // tasks stays explicit, because that is the one field publicBot() adds
             // that messagePage() does not: wireBot() omits the key entirely for a
             // bot record carrying no tasks, where publicBot() always sent [].
+            // A member on a workspace with a restricted bot gets only what they may
+            // see (bot-visibility.ts); for everyone else these filters keep all.
+            const shownBots = store.bots.filter((bot) => visible.bot(bot.id));
+            const queued = publicBotQueuedMessages();
             return json(res, 200, {
-                bots: store.bots.map((bot) => ({
+                bots: shownBots.map((bot) => memberBot({
                     ...wireBot(bot),
                     tasks: store.tasks(bot.id).map(wireTask),
                     ...messagePage(bot.threadId, limit),
-                })),
-                botQueuedMessages: publicBotQueuedMessages(),
-                sections: store.sections,
-                groups: store.groups.map((g) => ({ ...publicGroupState(g), ...messagePage(g.threadId, limit) })),
-                computerControl: Object.fromEntries(store.bots.map((bot) => {
+                }, visible)),
+                botQueuedMessages: visible.everything ? queued : Object.fromEntries(Object.entries(queued).filter(([threadId]) => visible.thread(threadId))),
+                sections: visible.sections(store.sections),
+                groups: store.groups.filter((g) => visible.group(g.id)).map((g) => {
+                    const room = { ...publicGroupState(g), ...messagePage(g.threadId, limit) };
+                    return visible.everything ? room : memberGroup(room);
+                }),
+                computerControl: Object.fromEntries(shownBots.map((bot) => {
                     const snapshot = botComputerControlSnapshot(bot.id);
                     return [bot.id, { held: snapshot.held, helpReason: snapshot.helpReason }];
                 })),
@@ -13124,7 +14206,7 @@ const handleRequest = async (req, res) => {
             const rawLimit = url.searchParams.get("limit");
             const limit = rawLimit ? Math.min(Math.max(Number(rawLimit) || 0, 1), 100) : 40;
             const threadId = url.searchParams.get("threadId")?.trim() || undefined;
-            if (threadId && !store.botByThread(threadId) && !store.groupByThread(threadId)) {
+            if (threadId && ((!store.botByThread(threadId) && !store.groupByThread(threadId)) || !visible.thread(threadId))) {
                 return json(res, 404, { error: "no such conversation" });
             }
             // whether each hit sits on its thread's visible branch — a click on
@@ -13136,7 +14218,11 @@ const handleRequest = async (req, res) => {
                     activePaths.set(threadId, (ids = new Set(store.activePath(threadId).map((m) => m.id))));
                 return ids.has(messageId);
             };
-            const hits = searchMessages(q, limit, threadId)
+            // A member who may not see every bot: look further, then keep only
+            // hits in conversations they can open.
+            const hits = searchMessages(q, visible.everything ? limit : Math.min(limit * 10, 1_000), threadId)
+                .filter((hit) => visible.thread(hit.threadId))
+                .slice(0, limit)
                 .map((hit) => {
                 const bot = store.botByThread(hit.threadId);
                 const group = bot ? undefined : store.groupByThread(hit.threadId);
@@ -13208,7 +14294,13 @@ const handleRequest = async (req, res) => {
         }
         // ── channels (persisted internally as groups) ───────────────────────
         if (method === "POST" && path === "/api/groups") {
-            const group = createChannel(await readBody(req));
+            const body = await readBody(req);
+            // A member may only put bots they can see in a room: the room would
+            // otherwise show them a restricted bot (bot-visibility.ts).
+            const hiddenMember = Array.isArray(body?.memberIds) ? body.memberIds.find((id) => typeof id === "string" && store.bot(id) && !visible.bot(id)) : undefined;
+            if (hiddenMember)
+                return json(res, 400, { error: `unknown channel member: ${String(hiddenMember)}` });
+            const group = createChannel(body);
             return json(res, 201, { group: { ...publicGroupState(group), messages: [] } });
         }
         if (method === "POST" && path === "/api/teams/export") {
@@ -13350,12 +14442,31 @@ const handleRequest = async (req, res) => {
                     projectCwd = validated.cwd;
                 }
             }
+            // Who may see the imported bots, from their first moment: the admin's
+            // choice (?visibility=admins, or a JSON value), never the file's.
+            const rawVisibility = url.searchParams.get("visibility");
+            let importVisibility;
+            if (rawVisibility !== null) {
+                let value = rawVisibility;
+                if (rawVisibility.trim().startsWith("{")) {
+                    try {
+                        value = JSON.parse(rawVisibility);
+                    }
+                    catch {
+                        /* parseVisibility refuses the raw text with a plain sentence */
+                    }
+                }
+                const parsed = parseVisibility(value);
+                if (!parsed.ok)
+                    return json(res, 400, { error: parsed.error });
+                importVisibility = parsed.visibility;
+            }
             const body = await readBody(req, MAX_TEAM_BACKUP_BYTES);
             if (body?.format === "openmaus.backup") {
                 if (importMode !== "add")
                     return json(res, 400, { error: "Import backups alongside your existing bots; project mode is only for templates" });
                 try {
-                    const imported = importTeamBackup(store, routines, body, await defaultSelection());
+                    const imported = importTeamBackup(store, routines, body, await defaultSelection(), { visibility: importVisibility });
                     const bots = imported.bots.map((bot) => publicBot(bot));
                     const groups = imported.groups.map((group) => ({ ...publicGroupState(group), ...messagePage(group.threadId, undefined) }));
                     for (const bot of bots)
@@ -13418,6 +14529,7 @@ const handleRequest = async (req, res) => {
                         ...importedMemberProfile(member, takenNames),
                         modelSelection: selection,
                         section: importSection,
+                        ...(importVisibility ? { visibility: importVisibility } : {}),
                     }, { seedMessages: false });
                     importedBots.push(created);
                     const installedPlaybooks = source.playbookKeys.flatMap((key) => {
@@ -13614,6 +14726,9 @@ const handleRequest = async (req, res) => {
             const task = store.createGroupTask(group.id, request.data.title);
             if (!task)
                 return json(res, 500, { error: "couldn't create that task" });
+            // Who opened it decides who may answer its cards on a shared workspace.
+            if (auth.kind === "session")
+                threadStarters.set(task.threadId, personKey(auth.session));
             const fresh = groupWithThread(store.group(group.id));
             broadcast({ kind: "group", group: fresh });
             return json(res, 201, { group: fresh, task });
@@ -13669,15 +14784,43 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such channel" });
             if (group.dm)
                 return json(res, 400, { error: "bot-to-bot channels keep one canonical conversation" });
-            if (channelTaskBlocked(group)) {
-                return json(res, 409, { error: "this channel is working or waiting on you — finish that turn first" });
-            }
             if (!body || typeof body !== "object" || Array.isArray(body)) {
                 return json(res, 400, { error: "body must be a JSON object" });
             }
-            const task = store.renameGroupTask(m[1], m[2], String(body.title ?? ""));
-            if (!task)
+            const allowed = new Set(["title", "pinned"]);
+            if (Object.keys(body).some((key) => !allowed.has(key)))
+                return json(res, 400, { error: "unsupported channel thread setting" });
+            const existing = store.groupTaskByThread(group.id, m[2]);
+            if (!existing)
                 return json(res, 404, { error: "no such channel task" });
+            const pinning = body.pinned !== undefined;
+            const renaming = body.title !== undefined;
+            if (!pinning && !renaming)
+                return json(res, 400, { error: "unsupported channel thread setting" });
+            if (pinning && typeof body.pinned !== "boolean")
+                return json(res, 400, { error: "pinned must be a boolean" });
+            if (renaming && typeof body.title !== "string")
+                return json(res, 400, { error: "title must be a string" });
+            // Echoing the current title lets a newer client pin on an older server
+            // without the old handler turning a missing title into "Untitled".
+            // That echo is not a rename. A real rename stays blocked while working.
+            const titleChange = renaming && body.title !== existing.title;
+            if (channelTaskBlocked(group) && !(pinning && !titleChange)) {
+                return json(res, 409, { error: "this channel is working or waiting on you — finish that turn first" });
+            }
+            let task = existing;
+            if (pinning) {
+                const pinned = store.setGroupTaskPinned(group.id, m[2], body.pinned === true);
+                if (!pinned)
+                    return json(res, 404, { error: "no such channel task" });
+                task = pinned;
+            }
+            if (titleChange) {
+                const renamed = store.renameGroupTask(group.id, m[2], body.title);
+                if (!renamed)
+                    return json(res, 404, { error: "no such channel task" });
+                task = renamed;
+            }
             return json(res, 200, { task });
         }
         if (m && method === "DELETE") {
@@ -13772,7 +14915,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "threadId must be a task id" });
             }
             const threadId = body.threadId ?? group.threadId;
-            noteTurnTrigger(threadId, auth);
+            const trigger = usageTriggerFor(auth);
             try {
                 assertWithinBudget(cfg, DATA_DIR);
             }
@@ -13836,10 +14979,12 @@ const handleRequest = async (req, res) => {
                         sendId,
                         mode: channelMode,
                         via,
+                        sender: messageSender(auth),
+                        trigger,
                     });
                     return { ok: true, queued: true, queueId: queued.id, threadId };
                 }
-                const message = startGroupTurn(current.id, text, replyTo, sendId, channelMode, undefined, { via, sender: messageSender(auth) });
+                const message = startGroupTurn(current.id, text, replyTo, sendId, channelMode, undefined, { via, sender: messageSender(auth), trigger });
                 return { ok: true, threadId, message };
             });
             return json(res, 202, receipt);
@@ -13879,7 +15024,8 @@ const handleRequest = async (req, res) => {
             if (!ownsThread) {
                 return json(res, 409, { error: "the channel switched tasks before it could receive the message" });
             }
-            noteTurnTrigger(targetThreadId, auth);
+            // Steering folds words into the running room turn; who pressed Steer
+            // does not re-book that turn (its sender was captured when it started).
             const current = store.group(group.id);
             if (!current)
                 return json(res, 404, { error: "no such room" });
@@ -13937,6 +15083,7 @@ const handleRequest = async (req, res) => {
                     queueId: head.id,
                     via: head.via,
                     steered: true,
+                    sender: head.sender,
                 });
                 settleHeldChannelQueueHead(held);
                 return json(res, 200, {
@@ -14118,12 +15265,20 @@ const handleRequest = async (req, res) => {
                     return json(res, checked.status, { error: checked.error });
                 selection = checked.selection;
             }
+            if (hostedModels && !hostedModels.allows(selection))
+                return json(res, 400, { error: hostedModels.error() });
             // Keep the capacity check immediately beside the synchronous write.
             // Awaiting provider discovery before this point cannot race the cap.
             if (store.bots.length >= MAX_WORKSPACE_BOTS) {
                 return json(res, 409, { error: `this workspace is limited to ${MAX_WORKSPACE_BOTS} bots` });
             }
-            const bot = store.createBot({ ...profile.patch, section, modelSelection: selection });
+            // Who may see it, from the first moment (admin route: members cannot
+            // create bots). A bot named for a sensitive job must never be
+            // announced to everyone before it is restricted.
+            const created = body.visibility === undefined ? null : parseVisibility(body.visibility);
+            if (created && !created.ok)
+                return json(res, 400, { error: created.error });
+            const bot = store.createBot({ ...profile.patch, section, modelSelection: selection, ...(created?.ok ? { visibility: created.visibility } : {}) });
             return json(res, 201, {
                 bot: {
                     ...wireBot(bot),
@@ -14228,7 +15383,8 @@ const handleRequest = async (req, res) => {
             const bot = store.patchBot(existing.id, { modelSelection: checked.selection });
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
-            store.patchTask(bot.id, selected.threadId, { modelSelection: checked.selection });
+            store.patchTask(bot.id, selected.threadId, { modelSelection: checked.selection,
+                ...hostedModels?.resetTask(selected.modelSelection, checked.selection) });
             return json(res, 200, { bot: wireBot(bot) });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/read$/);
@@ -14250,13 +15406,18 @@ const handleRequest = async (req, res) => {
             const bot = requestedTaskBot(m[1], body.threadId);
             if (!allowKey)
                 return json(res, 400, { error: "allowKey required" });
-            const pending = store.messagesFor(bot.threadId).some((message) => message.card?.requestId &&
+            const pending = store.messagesFor(bot.threadId).find((message) => message.card?.requestId &&
                 !message.card.answered &&
                 message.card.dismissed !== true &&
                 message.card.allowKey === allowKey);
             if (!pending) {
                 return json(res, 409, { error: "that grant is not on a pending approval for this bot" });
             }
+            // A standing grant is an approval: the same people who may approve
+            // the card it came from may remember it.
+            const refusal = cardAnswerRefusal(auth, bot.threadId, pending.card.requestId, "allow");
+            if (refusal)
+                return json(res, 403, { error: refusal });
             store.patchTask(bot.id, bot.threadId, {
                 alwaysAllow: [...new Set([...(bot.alwaysAllow ?? []), allowKey])].slice(0, 200),
             });
@@ -14282,6 +15443,7 @@ const handleRequest = async (req, res) => {
             const existingBot = store.bot(m[1]);
             const selectedTask = existingBot ? requestedTaskBot(existingBot.id, undefined) : null;
             const beforeProfile = existingBot ? profileSnapshot(existingBot) : undefined;
+            const beforeVisibility = existingBot?.visibility;
             if (body.requireAvailableModel !== undefined && typeof body.requireAvailableModel !== "boolean") {
                 return json(res, 400, { error: "requireAvailableModel must be true or false" });
             }
@@ -14616,6 +15778,16 @@ const handleRequest = async (req, res) => {
             // authority to return if this bot is elected Chief again later.
             if (body.chiefOfStaff === false)
                 patch.managedSections = [];
+            // Who may see this bot on a workspace several people share
+            // (bot-visibility.ts): "everyone" (the default), "admins", or
+            // { people: [...] }. Access control, applied at once; members' PATCHes
+            // never get here (clientBotPatchViolation).
+            if (Object.hasOwn(body, "visibility")) {
+                const parsed = parseVisibility(body.visibility);
+                if (!parsed.ok)
+                    return json(res, 400, { error: parsed.error });
+                patch.visibility = parsed.visibility;
+            }
             if (body.alwaysAllow !== undefined) {
                 if (!Array.isArray(body.alwaysAllow) || body.alwaysAllow.some((t) => typeof t !== "string")) {
                     return json(res, 400, { error: "alwaysAllow must be a list of tool keys" });
@@ -14749,7 +15921,8 @@ const handleRequest = async (req, res) => {
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
             if (normalizedSelection && selectedTask)
-                store.patchTask(bot.id, selectedTask.threadId, { modelSelection: normalizedSelection });
+                store.patchTask(bot.id, selectedTask.threadId, { modelSelection: normalizedSelection,
+                    ...hostedModels?.resetTask(selectedTask.modelSelection, normalizedSelection) });
             if (existingBot && (bot.browserProfile !== beforeBrowserProfile || bot.browser !== beforeBrowserEnabled)) {
                 browserLive.closeForBot(bot.id);
                 if (beforeBrowserProfile === "guest" && (bot.browserProfile !== "guest" || bot.browser === false)) {
@@ -14765,6 +15938,15 @@ const handleRequest = async (req, res) => {
                 const now = store.bot(bot.id);
                 recordProfileChange(bot.id, "user", "api", beforeProfile, profileSnapshot(now));
             }
+            // A new audience changes who may see this bot's rooms and teams too:
+            // re-announce them so every member's stream gains or withdraws them.
+            if (Object.hasOwn(patch, "visibility") && JSON.stringify(beforeVisibility ?? "everyone") !== JSON.stringify(bot.visibility ?? "everyone")) {
+                for (const group of store.groups.filter((candidate) => candidate.memberIds.includes(bot.id))) {
+                    broadcast({ kind: "group", group: publicGroupState(group) });
+                }
+                broadcast({ kind: "sections", sections: store.sections });
+                audienceChanged();
+            }
             return json(res, 200, { bot: wireBot(store.bot(bot.id)) });
         }
         if (method === "POST" && path === "/api/local-computer/interrupt") {
@@ -15261,6 +16443,35 @@ const handleRequest = async (req, res) => {
             });
             return json(res, 200, { message: patched });
         }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/requests\/([A-Za-z0-9_-]{16,80})(\/interrupt)?$/);
+        if (m && ((method === "GET" && !m[3]) || (method === "POST" && m[3]))) {
+            const body = method === "GET" ? { threadId: url.searchParams.get("threadId") } : await readBody(req);
+            const id = z.string().regex(/^[\w-]+$/);
+            const parsed = (method === "GET" ? z.object({ threadId: id }).strict() : z.object({
+                threadId: id, messageId: id, expectedActiveLeafId: id.nullable(),
+                expectedTurnId: z.string().min(1).max(200).nullable(), expectedExecutionId: id.nullable(),
+            }).strict()).safeParse(body);
+            if (!parsed.success)
+                return json(res, 400, { error: "A pinned thread and exact request snapshot are required" });
+            const threadId = parsed.data.threadId;
+            const snapshot = guardedRequestSnapshot(m[1], threadId, m[2]);
+            res.setHeader("cache-control", "private, no-store");
+            if (method === "GET")
+                return json(res, 200, snapshot);
+            assertRequestTarget(snapshot, body);
+            const owner = directRequestOwners.get(threadId);
+            if (snapshot.phase === "untracked" || !owner || owner.messageId !== snapshot.messageId) {
+                return json(res, 409, { error: "This continuation cannot be safely stopped from this interface", code: "guarded_request_untracked" });
+            }
+            if (snapshot.phase === "settled")
+                throw requestConflict("This request has already settled");
+            // No await between comparing the exact lease and revoking it. Retrying
+            // this body cannot bind to a later setup claim with a null provider id.
+            owner.stopped = true;
+            handoffs.stoppedByPerson(threadId);
+            await interruptDirectThread(m[1], threadId);
+            return json(res, 200, { ok: true, outcome: "stopped" });
+        }
         m = path.match(/^\/api\/bots\/([\w-]+)\/messages(?:\/(guarded))?$/);
         if (m && method === "POST") {
             const guarded = m[2] === "guarded";
@@ -15270,14 +16481,12 @@ const handleRequest = async (req, res) => {
             }
             // External interfaces must opt into a distinct route: an older server
             // returns 404 rather than silently ignoring safety preconditions.
-            if (guarded && !z.object({
-                threadId: z.string().regex(/^[\w-]+$/),
-                sendId: z.string().regex(/^[A-Za-z0-9_-]{16,80}$/),
-                text: z.string().min(1),
-                expectedActiveLeafId: z.string().regex(/^[\w-]+$/).nullable(),
-                replyToId: z.string().optional(),
-            }).strict().safeParse(body).success) {
-                return json(res, 400, { error: "guarded sends require threadId, sendId, text and expectedActiveLeafId" });
+            const guardedBody = guarded ? guardedSendSchema.safeParse(body) : null;
+            if (guardedBody && !guardedBody.success) {
+                const onBehalfOfInvalid = guardedBody.error.issues.some((issue) => issue.path[0] === "onBehalfOf");
+                return json(res, 400, { error: onBehalfOfInvalid
+                        ? "onBehalfOf must name the person with an email address, a name, or both"
+                        : "guarded sends require threadId, sendId, text and expectedActiveLeafId" });
             }
             const text = String(body.text ?? "").trim();
             if (!text)
@@ -15293,8 +16502,16 @@ const handleRequest = async (req, res) => {
             // receipt after a task switch, while a genuinely new send still has to
             // target the task that is active now.
             const threadId = body.threadId ?? bot.threadId;
-            if (!guarded)
-                noteTurnTrigger(threadId, auth);
+            // Who this message is from, for the ledger. It is captured here and
+            // travels with the message: into the turn it starts, or into the queue
+            // until it drains. A message steered into someone else's running turn
+            // books nothing — that turn stays with whoever started it. A guarded
+            // relay (the Slack worker, which already holds admin scope to reach
+            // this route) names the person it acts for.
+            const onBehalfOf = guardedBody?.data?.onBehalfOf;
+            const trigger = onBehalfOf
+                ? { kind: "user", ...(onBehalfOf.email ? { email: onBehalfOf.email } : {}), ...(onBehalfOf.name ? { label: onBehalfOf.name } : {}) }
+                : usageTriggerFor(auth);
             // The send is acknowledged before the turn starts, so a workspace at its
             // spend limit is refused here, where the person can see it.
             try {
@@ -15345,8 +16562,10 @@ const handleRequest = async (req, res) => {
                     // There is no await between these checks and startTurn's
                     // synchronous transcript append / runtime reservation. In
                     // particular, never steer or enqueue under stale permissions.
-                    if (approvalModeFor(currentAtStart) !== "ask" || currentAtStart.autoApprove === true || currentAtStart.alwaysAllow?.length) {
-                        throw Object.assign(new Error("guarded sends require Ask mode without remembered permissions"), { status: 409, code: "guarded_permissions" });
+                    const expectedMode = body.expectedApprovalMode ?? "ask";
+                    if (approvalModeFor(currentAtStart) !== expectedMode ||
+                        (expectedMode === "ask" && (currentAtStart.autoApprove === true || currentAtStart.alwaysAllow?.length))) {
+                        throw Object.assign(new Error("guarded sends require the exact expected approval mode; Ask cannot have remembered permissions"), { status: 409, code: "guarded_permissions" });
                     }
                     if (store.activeLeaf(threadId) !== body.expectedActiveLeafId) {
                         throw Object.assign(new Error("the conversation changed before this message could start"), { status: 409, code: "guarded_branch" });
@@ -15354,8 +16573,7 @@ const handleRequest = async (req, res) => {
                     if (currentAtStart.busy || threadBusy(bot.id, threadId) || botAtThreadCapacity(bot.id) || parksBehindCoordination(bot.id, threadId) || activeGroupTurnForBot(bot.id)) {
                         throw Object.assign(new Error("wait for a free thread slot before retrying this message"), { status: 409, code: "guarded_busy" });
                     }
-                    noteTurnTrigger(threadId, auth);
-                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth) });
+                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth), trigger });
                     return { ok: true, threadId, message };
                 }
                 // Claude can accept the message inside its live turn. If the write
@@ -15419,16 +16637,18 @@ const handleRequest = async (req, res) => {
                         return { ok: true, steered: true, threadId, message };
                     }
                     if (!current.busy) {
-                        return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth));
+                        return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth), trigger);
                     }
                     const queued = queueSteeredMessage(current.id, threadId, text, {
                         replyToId: replyTo?.id,
                         sendId,
                         prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
+                        sender: messageSender(auth),
+                        trigger,
                     });
                     return { ok: true, queued: true, queueId: queued.id, threadId };
                 }
-                return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth));
+                return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth), trigger);
             });
             return json(res, 202, receipt);
         }
@@ -15450,7 +16670,9 @@ const handleRequest = async (req, res) => {
             const body = await readBody(req);
             requirePinnedClientThread(m[1], body?.threadId);
             const bot = requestedTaskBot(m[1], body?.threadId);
-            noteTurnTrigger(bot.threadId, auth);
+            // Pressing Steer folds the queued words into the running turn. It does
+            // not re-book that turn to whoever pressed it, and the words keep the
+            // sender they were queued with.
             // Lift the whole queue atomically: a settle racing this request can
             // drain it as a follow-up, or this request can steer it into the live
             // turn — never both for the same words.
@@ -15494,6 +16716,7 @@ const handleRequest = async (req, res) => {
                     queueId: item.messageId,
                     peerAsk: item.peerAsk,
                     steered: true,
+                    sender: item.sender,
                 }));
                 // Offered to the next turn again unless the person stops this one.
                 for (const message of messages)
@@ -15525,9 +16748,8 @@ const handleRequest = async (req, res) => {
             const body = await readBody(req);
             requirePinnedClientThread(m[1], body?.threadId);
             const bot = requestedTaskBot(m[1], body?.threadId);
-            noteTurnTrigger(bot.threadId, auth);
             await startTurn(bot.id, "Summarize conversation context", {
-                threadId: bot.threadId, compactOnly: true, cardContinuation: true,
+                threadId: bot.threadId, compactOnly: true, cardContinuation: true, trigger: usageTriggerFor(auth),
             });
             return json(res, 202, { ok: true, threadId: bot.threadId });
         }
@@ -15561,10 +16783,14 @@ const handleRequest = async (req, res) => {
                     error: `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`,
                 });
             }
+            const rerunInstance = registry.get(bot.modelSelection.instanceId);
+            const rerunRefusal = policyModelRefusal(rerunInstance);
+            if (rerunRefusal)
+                return json(res, 409, { error: rerunRefusal });
             // startTurn admits the rerun before branching. A shared-resource or
             // concurrency-limit refusal must leave the original transcript intact.
             const replyTo = source.replyToId ? resolveReplyTarget(bot.threadId, source.replyToId) : undefined;
-            const message = await startTurn(bot.id, text, { threadId: bot.threadId, editedMessageId: messageId, replyTo });
+            const message = await startTurn(bot.id, text, { threadId: bot.threadId, editedMessageId: messageId, replyTo, trigger: usageTriggerFor(auth) });
             return json(res, 202, { ok: true, message });
         }
         // switch which fork of the conversation is visible (no new turn)
@@ -15594,44 +16820,49 @@ const handleRequest = async (req, res) => {
             const reviewedSha256 = typeof body.reviewedSha256 === "string" ? body.reviewedSha256 : undefined;
             if (!behavior)
                 return json(res, 400, { error: "behavior must be allow, deny, or answer" });
-            if (await resolveAndSendTeamSetup(res, {
-                botId: bot.id, threadId: bot.threadId, requestId: String(body.requestId), behavior,
-            }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
-                return;
-            if (resolveAndSendRoutine(res, {
-                botId: bot.id,
-                botName: bot.name,
-                threadId: bot.threadId,
-                requestId: String(body.requestId),
-                behavior,
-            }))
-                return;
-            if (resolveAndSendProfile(res, {
-                botId: bot.id,
-                botName: bot.name,
-                threadId: bot.threadId,
-                requestId: String(body.requestId),
-                behavior,
-            }))
-                return;
-            if (sendSkillResolution(res, resolveSkillRequest({
-                botId: bot.id,
-                botName: bot.name,
-                threadId: bot.threadId,
-                requestId: String(body.requestId),
-                behavior,
-                reviewedSha256,
-            })))
-                return;
-            // peer-approval intercept: harness-native cards carry a requestId
-            // that lives in peer-approval's pending map. Resolve them here so
-            // the provider adapter never sees a request it didn't raise.
-            if (store.messagesFor(bot.threadId).some((message) => message.card?.requestId === String(body.requestId)) &&
-                resolvePeerComms(approvalBus, String(body.requestId), behavior)) {
-                return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
-            }
-            const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true);
-            return json(res, 200, { ok: true, outcome });
+            const refusal = cardAnswerRefusal(auth, bot.threadId, String(body.requestId), behavior);
+            if (refusal)
+                return json(res, 403, { error: refusal });
+            return await answeringCardAs(auth, bot.threadId, String(body.requestId), async () => {
+                if (await resolveAndSendTeamSetup(res, {
+                    botId: bot.id, threadId: bot.threadId, requestId: String(body.requestId), behavior,
+                }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
+                    return;
+                if (resolveAndSendRoutine(res, {
+                    botId: bot.id,
+                    botName: bot.name,
+                    threadId: bot.threadId,
+                    requestId: String(body.requestId),
+                    behavior,
+                }))
+                    return;
+                if (resolveAndSendProfile(res, {
+                    botId: bot.id,
+                    botName: bot.name,
+                    threadId: bot.threadId,
+                    requestId: String(body.requestId),
+                    behavior,
+                }))
+                    return;
+                if (sendSkillResolution(res, resolveSkillRequest({
+                    botId: bot.id,
+                    botName: bot.name,
+                    threadId: bot.threadId,
+                    requestId: String(body.requestId),
+                    behavior,
+                    reviewedSha256,
+                })))
+                    return;
+                // peer-approval intercept: harness-native cards carry a requestId
+                // that lives in peer-approval's pending map. Resolve them here so
+                // the provider adapter never sees a request it didn't raise.
+                if (store.messagesFor(bot.threadId).some((message) => message.card?.requestId === String(body.requestId)) &&
+                    resolvePeerComms(approvalBus, String(body.requestId), behavior)) {
+                    return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
+                }
+                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true);
+                return json(res, 200, { ok: true, outcome });
+            });
         }
         // Answer by THREAD, so a request raised inside a room can be answered
         // too: a member's turn runs on the room's thread, and the bot that
@@ -15645,86 +16876,91 @@ const handleRequest = async (req, res) => {
             if (!behavior)
                 return json(res, 400, { error: "behavior must be allow, deny, or answer" });
             const requestId = String(body.requestId);
-            const skillCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.skillRequest);
-            if (skillCard?.card?.skillRequest) {
-                const skillBotId = skillCard.from?.botId ?? store.botByThread(threadId)?.id;
-                if (!skillBotId)
-                    return json(res, 400, { error: "this skill request has no valid owner" });
-                const skillOwner = store.bot(skillBotId);
-                if (sendSkillResolution(res, resolveSkillRequest({
-                    botId: skillBotId,
-                    botName: skillOwner?.name,
-                    threadId,
-                    requestId,
-                    behavior,
-                    reviewedSha256,
-                })))
-                    return;
-            }
-            const routineCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.routineRequest);
-            if (routineCard?.card?.routineRequest) {
-                // Derive the owner from the conversation, not from the executable
-                // payload being authorized. Room cards carry their trusted sender;
-                // one-to-one tasks resolve through the store's thread ownership.
-                const routineBotId = routineCard.from?.botId ?? store.botByThread(threadId)?.id;
-                if (!routineBotId)
-                    return json(res, 400, { error: "this routine request has no valid owner" });
-                const routineOwner = store.bot(routineBotId);
-                if (resolveAndSendRoutine(res, {
-                    botId: routineBotId,
-                    botName: routineOwner?.name,
-                    threadId,
-                    requestId,
-                    behavior,
-                }))
-                    return;
-            }
-            const setupCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.teamSetupRequest);
-            if (setupCard) {
-                const setupBotId = setupCard.from?.botId ?? store.botByThread(threadId)?.id;
-                if (!setupBotId)
-                    return json(res, 400, { error: "This team setup has no valid owner" });
-                if (await resolveAndSendTeamSetup(res, { botId: setupBotId, threadId, requestId, behavior }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
-                    return;
-            }
-            const profileCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.profileRequest);
-            if (profileCard?.card?.profileRequest) {
-                const profileBotId = profileCard.from?.botId ?? store.botByThread(threadId)?.id;
-                if (!profileBotId)
-                    return json(res, 400, { error: "this profile request has no valid owner" });
-                const profileOwner = store.bot(profileBotId);
-                if (resolveAndSendProfile(res, {
-                    botId: profileBotId,
-                    botName: profileOwner?.name,
-                    threadId,
-                    requestId,
-                    behavior,
-                }))
-                    return;
-            }
-            // peer-approval intercept (see /api/bots/:id/respond above). A peer card
-            // belongs to the bus rather than to a speaker, so resolve it before we go
-            // looking for one — a room between turns has no speaker to find.
-            if (store.messagesFor(threadId).some((message) => message.card?.requestId === requestId) &&
-                resolvePeerComms(approvalBus, requestId, behavior)) {
-                return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
-            }
-            const group = store.groupByThread(threadId);
-            // busyBotId is in-memory only, so an approval that outlives its turn — or
-            // the process — leaves a durable card with no speaker behind it. Fall back
-            // to the member that raised it, and answer even when that member is gone:
-            // answerRequest closes an unreachable card, and a pending approval owns
-            // the composer, so a dead end here locks the room for good.
-            const pending = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId);
-            const owner = group
-                ? (group.busyBotId ? store.bot(group.busyBotId) : undefined) ??
-                    (pending?.from ? store.bot(pending.from.botId) : undefined)
-                : store.botByThread(threadId);
-            if (!owner && !pending)
-                return json(res, 404, { error: "nothing is waiting on an answer in this conversation" });
-            const requestOwner = owner ? botForThread(owner.id, threadId) : null;
-            const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true);
-            return json(res, 200, { ok: true, outcome });
+            const refusal = cardAnswerRefusal(auth, threadId, requestId, behavior);
+            if (refusal)
+                return json(res, 403, { error: refusal });
+            return await answeringCardAs(auth, threadId, requestId, async () => {
+                const skillCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.skillRequest);
+                if (skillCard?.card?.skillRequest) {
+                    const skillBotId = skillCard.from?.botId ?? store.botByThread(threadId)?.id;
+                    if (!skillBotId)
+                        return json(res, 400, { error: "this skill request has no valid owner" });
+                    const skillOwner = store.bot(skillBotId);
+                    if (sendSkillResolution(res, resolveSkillRequest({
+                        botId: skillBotId,
+                        botName: skillOwner?.name,
+                        threadId,
+                        requestId,
+                        behavior,
+                        reviewedSha256,
+                    })))
+                        return;
+                }
+                const routineCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.routineRequest);
+                if (routineCard?.card?.routineRequest) {
+                    // Derive the owner from the conversation, not from the executable
+                    // payload being authorized. Room cards carry their trusted sender;
+                    // one-to-one tasks resolve through the store's thread ownership.
+                    const routineBotId = routineCard.from?.botId ?? store.botByThread(threadId)?.id;
+                    if (!routineBotId)
+                        return json(res, 400, { error: "this routine request has no valid owner" });
+                    const routineOwner = store.bot(routineBotId);
+                    if (resolveAndSendRoutine(res, {
+                        botId: routineBotId,
+                        botName: routineOwner?.name,
+                        threadId,
+                        requestId,
+                        behavior,
+                    }))
+                        return;
+                }
+                const setupCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.teamSetupRequest);
+                if (setupCard) {
+                    const setupBotId = setupCard.from?.botId ?? store.botByThread(threadId)?.id;
+                    if (!setupBotId)
+                        return json(res, 400, { error: "This team setup has no valid owner" });
+                    if (await resolveAndSendTeamSetup(res, { botId: setupBotId, threadId, requestId, behavior }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
+                        return;
+                }
+                const profileCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.profileRequest);
+                if (profileCard?.card?.profileRequest) {
+                    const profileBotId = profileCard.from?.botId ?? store.botByThread(threadId)?.id;
+                    if (!profileBotId)
+                        return json(res, 400, { error: "this profile request has no valid owner" });
+                    const profileOwner = store.bot(profileBotId);
+                    if (resolveAndSendProfile(res, {
+                        botId: profileBotId,
+                        botName: profileOwner?.name,
+                        threadId,
+                        requestId,
+                        behavior,
+                    }))
+                        return;
+                }
+                // peer-approval intercept (see /api/bots/:id/respond above). A peer card
+                // belongs to the bus rather than to a speaker, so resolve it before we go
+                // looking for one — a room between turns has no speaker to find.
+                if (store.messagesFor(threadId).some((message) => message.card?.requestId === requestId) &&
+                    resolvePeerComms(approvalBus, requestId, behavior)) {
+                    return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
+                }
+                const group = store.groupByThread(threadId);
+                // busyBotId is in-memory only, so an approval that outlives its turn — or
+                // the process — leaves a durable card with no speaker behind it. Fall back
+                // to the member that raised it, and answer even when that member is gone:
+                // answerRequest closes an unreachable card, and a pending approval owns
+                // the composer, so a dead end here locks the room for good.
+                const pending = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId);
+                const owner = group
+                    ? (group.busyBotId ? store.bot(group.busyBotId) : undefined) ??
+                        (pending?.from ? store.bot(pending.from.botId) : undefined)
+                    : store.botByThread(threadId);
+                if (!owner && !pending)
+                    return json(res, 404, { error: "nothing is waiting on an answer in this conversation" });
+                const requestOwner = owner ? botForThread(owner.id, threadId) : null;
+                const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true);
+                return json(res, 200, { ok: true, outcome });
+            });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/interrupt$/);
         if (m && method === "POST") {
@@ -15855,18 +17091,36 @@ const handleRequest = async (req, res) => {
         m = path.match(/^\/api\/bots\/([\w-]+)\/tasks$/);
         if (m && method === "POST") {
             const body = await readBody(req);
+            if (!body || typeof body !== "object" || Array.isArray(body))
+                return json(res, 400, { error: "body must be a JSON object" });
             const bot = store.bot(m[1]);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            if (body.approvalMode !== undefined && body.approvalMode !== "ask" && body.approvalMode !== "full") {
+                return json(res, 400, { error: "new task approvalMode must be ask or full" });
+            }
+            if (body.approvalMode === "full") {
+                if (auth.kind !== "loopback" || !sharedWorkspaceFullAccessEnabled()) {
+                    return json(res, 403, { error: "New Full tasks require the operator's dedicated shared-workspace policy" });
+                }
+                if (bot.approvalGrant)
+                    return json(res, 409, { error: "the bot's approval mode is still being confirmed" });
+                if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, "full")) {
+                    return json(res, 400, { error: "This provider does not support Full access" });
+                }
+            }
             if (phoneSecretSubmissions.hasBot(bot.id)) {
                 return json(res, 409, { error: "this bot is securely saving a credential — try again when it finishes" });
             }
             if (body.projectId !== undefined && (typeof body.projectId !== "string" || !store.project(bot.id, body.projectId))) {
                 return json(res, 400, { error: "projectId must belong to this bot" });
             }
-            const task = store.createTask(bot.id, typeof body.title === "string" ? body.title : undefined, true, body.projectId);
+            const task = store.createTask(bot.id, typeof body.title === "string" ? body.title : undefined, true, body.projectId, undefined, body.approvalMode);
             if (!task)
                 return json(res, 500, { error: "couldn't create that task" });
+            // Who opened it decides who may answer its cards on a shared workspace.
+            if (auth.kind === "session")
+                threadStarters.set(task.threadId, personKey(auth.session));
             const fresh = botWithThread(store.bot(bot.id));
             broadcast({ kind: "bot", bot: fresh });
             return json(res, 201, { bot: fresh, task: wireTask(task) });
@@ -15909,7 +17163,7 @@ const handleRequest = async (req, res) => {
             const current = store.projectBotForTask(m[1], m[2]);
             if (!current)
                 return json(res, 404, { error: "no such task" });
-            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "surface"]);
+            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "pinned", "surface"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported thread setting" });
             for (const key of ["requireAvailableModel", "acknowledgeLocalAuto", "updateBotDefault", "resetApprovalToAsk"]) {
@@ -15946,6 +17200,11 @@ const handleRequest = async (req, res) => {
                 else
                     return json(res, 400, { error: "archivedAt must be a timestamp, or null to unarchive" });
             }
+            if (body.pinned !== undefined) {
+                if (typeof body.pinned !== "boolean")
+                    return json(res, 400, { error: "pinned must be a boolean" });
+                patch.pinned = body.pinned ? true : undefined;
+            }
             if (body.surface !== undefined) {
                 if (threadBusy(current.id, current.threadId))
                     return json(res, 409, { error: "Stop this thread before changing its computer destination." });
@@ -16008,7 +17267,7 @@ const handleRequest = async (req, res) => {
                     return json(res, checked.status, { error: checked.error });
             }
             const task = patch.modelSelection
-                ? store.switchTaskModel(m[1], m[2], patch.modelSelection, body.updateBotDefault === true, body.resetApprovalToAsk === true, patch)
+                ? store.switchTaskModel(m[1], m[2], patch.modelSelection, body.updateBotDefault === true, body.resetApprovalToAsk === true, { ...patch, ...hostedModels?.resetTask(current.modelSelection, patch.modelSelection) })
                 : store.patchTask(m[1], m[2], patch);
             const fresh = botWithThread(store.bot(m[1]));
             broadcast({ kind: "bot", bot: fresh });
@@ -16389,7 +17648,10 @@ const handleRequest = async (req, res) => {
         // child proves it is OURS by echoing its pid (a stray dev server has
         // the same API shape but a different pid)
         if (method === "GET" && path === "/api/health") {
-            return json(res, 200, { app: "openmausbot", pid: process.pid, static: Boolean(STATIC_DIR), capabilities: { guardedMessages: 1 } });
+            return json(res, 200, { app: "openmausbot", pid: process.pid, static: Boolean(STATIC_DIR), capabilities: {
+                    guardedMessages: 1, guardedRequests: 1, guardedFullAccess: 1, guardedOnBehalfOf: 1,
+                    ...(sharedWorkspaceFullAccessEnabled() ? { sharedWorkspaceFullAccess: 1 } : {}),
+                } });
         }
         // The bots' browser engine: install it on this machine (agent-browser +
         // a Chrome for Testing, a one-time download), or ask how that is going.
@@ -16446,7 +17708,9 @@ const handleRequest = async (req, res) => {
         }
         // Which edition this server runs and why (see server/enterprise.ts). Read-only.
         if (method === "GET" && path === "/api/edition") {
-            return json(res, 200, editionStatus());
+            // A member learns what is entitled; when the key lapses is for admins.
+            const status = editionStatus();
+            return json(res, 200, auth.scopes.includes("admin") ? status : editionForMembers(status));
         }
         // The brand for this deployment (server/brand.ts): read per request so edits show on reload.
         if (method === "GET" && path === "/api/brand") {
@@ -16483,7 +17747,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "from and to must be YYYY-MM-DD, from no later than to, at most a year apart" });
             const rows = readUsage(DATA_DIR, range);
             // The operator's price list is applied only with the billing entitlement.
-            const prices = entitled("billing") && cfg.billing?.prices && Object.keys(cfg.billing.prices).length ? cfg.billing.prices : null;
+            const prices = operatorPrices();
             if (path === "/api/usage.csv") {
                 const stamp = (date) => date.toISOString().slice(0, 10);
                 res.writeHead(200, {
@@ -16540,6 +17804,57 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 200, { decisions: readDecisions(DATA_DIR, parsedLimit ?? 200) });
         }
+        // Settings → Activity: admin actions and approvals together, filtered by
+        // who, what and when; the same list as CSV. Admin scope by default.
+        if (method === "GET" && (path === "/api/admin-activity" || path === "/api/admin-activity.csv")) {
+            const fromParam = url.searchParams.get("from") || new Date(Date.now() - 29 * 24 * 60 * 60_000).toISOString().slice(0, 10);
+            const range = parseUsageRange(fromParam, url.searchParams.get("to"));
+            if (!range)
+                return json(res, 400, { error: "from and to must be dates (YYYY-MM-DD), from no later than to, at most a year apart" });
+            const what = parseActivityWhat(url.searchParams.get("what"));
+            if (!what)
+                return json(res, 400, { error: "what must be all, approvals, decisions, config, people, session, webhook, mcp, engine, bot, budget or visibility" });
+            const entries = activityEntries(readDecisionRange(DATA_DIR, range), readAdminActivityRange(DATA_DIR, range), {
+                what,
+                who: (url.searchParams.get("who") ?? "").slice(0, 200),
+            });
+            if (path.endsWith(".csv")) {
+                const stamp = (date) => date.toISOString().slice(0, 10);
+                res.writeHead(200, {
+                    "content-type": "text/csv; charset=utf-8",
+                    "content-disposition": `attachment; filename="activity-${stamp(range.from)}-${stamp(range.to)}.csv"`,
+                    "cache-control": "no-store",
+                });
+                res.end(activityCsv(entries));
+                return;
+            }
+            const rawLimit = Number(url.searchParams.get("limit") ?? 500);
+            const limit = Number.isInteger(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 5_000) : 500;
+            res.setHeader("cache-control", "no-store");
+            return json(res, 200, {
+                entries: entries.slice(0, limit),
+                total: entries.length,
+                from: range.from.toISOString(),
+                to: range.to.toISOString(),
+                retentionDays: boundRetentionDays(),
+                recording: adminActivityRecording(),
+            });
+        }
+        // The same rows for an auditor's spreadsheet, over a date range. Admin
+        // scope by default (not in CLIENT_ALLOW, not a service route).
+        if (method === "GET" && path === "/api/decisions.csv") {
+            const range = parseUsageRange(url.searchParams.get("from"), url.searchParams.get("to"));
+            if (!range)
+                return json(res, 400, { error: "from and to must be YYYY-MM-DD, from no later than to, at most a year apart" });
+            const stamp = (date) => date.toISOString().slice(0, 10);
+            res.writeHead(200, {
+                "content-type": "text/csv; charset=utf-8",
+                "content-disposition": `attachment; filename="decisions-${stamp(range.from)}-${stamp(range.to)}.csv"`,
+                "cache-control": "no-store",
+            });
+            res.end(decisionsCsv(readDecisionRange(DATA_DIR, range)));
+            return;
+        }
         // ── provider instances (model picker) ──
         if (method === "GET" && path === "/api/instances") {
             // Rescan PATH first: this endpoint is how the app answers "what can I
@@ -16550,6 +17865,8 @@ const handleRequest = async (req, res) => {
             return json(res, 200, { instances: await describeInstances() });
         }
         const companyMutation = /^\/api\/instances\/(company\.[\w.-]+)(?:\/|$)/.exec(path);
+        if (hostedModels && path.startsWith("/api/instances/") && method !== "GET")
+            return json(res, 403, { error: HOSTED_PROVIDER_SETTINGS_ERROR });
         if (companyMutation && method !== "GET")
             return json(res, 403, { error: "Company accounts are read-only here. Manage this connection in desktop Settings." });
         const instanceIconPatch = /^\/api\/instances\/([\w.-]+)\/icon$/.exec(path);
@@ -16882,6 +18199,9 @@ const handleRequest = async (req, res) => {
                 const parsed = parseMcpServerMutation(name, mcpServerBody(body));
                 if (!parsed.ok)
                     return json(res, 400, { error: parsed.error });
+                const refusal = mcpPolicyRefusal(name, parsed.server);
+                if (refusal)
+                    return json(res, 403, { error: refusal, code: "managed_policy" });
                 persistMcpServers({ ...current, [name]: parsed.server });
                 return json(res, 201, mcpServerResponse());
             }
@@ -16918,6 +18238,9 @@ const handleRequest = async (req, res) => {
                 if (Object.keys(current).length + names.length > MAX_MCP_SERVERS) {
                     return json(res, 400, { error: `You can add at most ${MAX_MCP_SERVERS} MCP servers.` });
                 }
+                const refused = names.filter(name => mcpPolicyRefusal(name, parsed.servers[name]));
+                if (refused.length)
+                    return json(res, 403, { error: `${mcpPolicyRefusal(refused[0], parsed.servers[refused[0]])} Not approved: ${refused.join(", ")}.`, code: "managed_policy" });
                 persistMcpServers({ ...current, ...parsed.servers });
                 return json(res, 201, { ...mcpServerResponse(), added: names });
             }
@@ -16959,6 +18282,9 @@ const handleRequest = async (req, res) => {
                 const parsed = parseMcpServerMutation(name, body, existing.server);
                 if (!parsed.ok)
                     return json(res, 400, { error: parsed.error });
+                const refusal = mcpPolicyRefusal(name, parsed.server);
+                if (refusal)
+                    return json(res, 403, { error: refusal, code: "managed_policy" });
                 persistMcpServers({ ...current, [name]: parsed.server });
                 return json(res, 200, mcpServerResponse());
             }
@@ -16972,7 +18298,14 @@ const handleRequest = async (req, res) => {
         }
         if ((method === "PUT" || method === "PATCH") && path === "/api/config") {
             const body = await readBody(req);
+            if (hostedModels && ["instances", "anthropic", "openaiCompat", "xai", "opencodeGo"].some(key => Object.hasOwn(body, key)))
+                return json(res, 403, { error: HOSTED_PROVIDER_SETTINGS_ERROR });
             const patch = parseConfigPatch(body);
+            if (hostedModels && patch.defaultModelSelection) {
+                const checked = checkedModelSelection(patch.defaultModelSelection);
+                if (!checked.ok)
+                    return json(res, checked.status, { error: checked.error });
+            }
             if (!Object.keys(patch).length)
                 return json(res, 400, { error: "nothing to save" });
             const changingVoiceProvider = patch.tts?.provider !== undefined
@@ -17092,21 +18425,22 @@ const handleRequest = async (req, res) => {
                     }
                 }
                 let currentBoxInventory = null;
+                let replacingRejectedBoxToken = false;
                 let currentBoxResources = null;
                 const journalBoxResources = [];
                 const deletingBoxIds = new Set(boxDeletions.map((entry) => entry.boxId));
                 if (changingBoxToken && currentBoxToken) {
                     currentBoxInventory = await box.listManagedBoxes({ box: { token: currentBoxToken } }, managedBoxOwners());
                     if (!currentBoxInventory.available) {
-                        if (!replacementProvedByDeletion) {
+                        replacingRejectedBoxToken = currentBoxInventory.credentialRejected === true && Boolean(nextBoxToken);
+                        if (!replacementProvedByDeletion && !replacingRejectedBoxToken) {
                             return json(res, 503, {
                                 error: `${currentBoxInventory.problem ?? "cloud computer inventory is unavailable"}. Keep the current Box account and retry`,
                             });
                         }
-                        // The old token may be the reason this deletion is stuck. A
-                        // target-bound operation/identity proved the replacement belongs
-                        // to the same account, so do not deadlock credential recovery on
-                        // an inventory request made with the expired token.
+                        // A rejected old key cannot authorize its own rotation. Below,
+                        // validate the replacement and prove access to remembered Boxes;
+                        // pending deletions retain their target-bound verification.
                         currentBoxInventory = null;
                     }
                     if (currentBoxInventory) {
@@ -17189,7 +18523,14 @@ const handleRequest = async (req, res) => {
                     if (!check.ok)
                         return json(res, 400, { error: check.message });
                 }
-                if (changingBoxToken && (!currentBoxToken || replacementProvedByDeletion) && boxRecovery.length > 0) {
+                if (replacingRejectedBoxToken) {
+                    // An expired credential cannot authorize its own replacement. Probe
+                    // the new account without adopting or retiring any local identities.
+                    const replacement = await box.listManagedBoxes({ box: { token: nextBoxToken } }, managedBoxOwners(), { adoptLegacy: false });
+                    if (!replacement.available)
+                        return json(res, 503, { error: replacement.problem ?? "Could not verify the replacement Box key. Your saved key and computers are unchanged." });
+                }
+                if (changingBoxToken && (!currentBoxToken || replacementProvedByDeletion || replacingRejectedBoxToken) && boxRecovery.length > 0) {
                     if (!nextBoxToken) {
                         return json(res, 409, { error: "restore the Box account that owns the remembered cloud computers before clearing it" });
                     }
@@ -17502,8 +18843,14 @@ const handleRequest = async (req, res) => {
         }
         // ── connectors (Composio) ──
         if (method === "GET" && path === "/api/connectors/catalog") {
-            const { cards, source } = await composio.listToolkits(cfg);
-            return json(res, 200, { configured: composio.configured(cfg), mode: composio.connectionMode(cfg), source, cards });
+            const { cards, source, pagination } = await composio.listToolkits(cfg);
+            return json(res, 200, {
+                configured: composio.configured(cfg),
+                mode: composio.connectionMode(cfg),
+                source,
+                cards,
+                ...(pagination ? { pagination } : {}),
+            });
         }
         if (method === "GET" && path === "/api/connectors/connected") {
             const availability = composio.connectorAvailability(cfg);
@@ -17907,7 +19254,7 @@ const handleRequest = async (req, res) => {
     catch (e) {
         const status = e?.status ?? 500;
         const candidateCode = e?.code;
-        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions"].includes(candidateCode)
+        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions", "guarded_request_changed", "guarded_request_untracked"].includes(candidateCode)
             ? candidateCode : undefined;
         return json(res, status, { error: e instanceof Error ? e.message : String(e), ...(code ? { code } : {}) });
     }
@@ -17919,6 +19266,28 @@ const server = createServer(handleRequest);
 calendarCalls.start();
 // Resolve the edition before accepting requests so /api/edition is never a guess.
 console.log(describeEdition(await loadEnterpriseLayer()));
+// A key inside its last 30 days, or already in its grace period, says so
+// where an operator reads first.
+const startupLicenseWarning = licenseWarning(editionStatus());
+if (startupLicenseWarning)
+    console.warn(startupLicenseWarning);
+console.log(LOOPBACK.trust === "service"
+    ? `local requests: service trust (${LOOPBACK.reason}); without a session, loopback may use only health, the Slack worker's guarded routes and bot capability routes`
+    : `local requests: owner trust (${LOOPBACK.reason})`);
+if (LOOPBACK.warning)
+    console.warn(`local requests: ${LOOPBACK.warning}`);
+// The decision log also prunes as it writes; this covers a quiet server.
+// Every room's floor, once, before any request: a room that was already
+// mixed when this server started keeps its narrowest audience from here on.
+for (const group of store.groups)
+    settleRoomFloor(group);
+const pruneDecisionLog = () => {
+    void pruneDecisions(DATA_DIR, decisionRetentionDays(cfg.decisions?.retentionDays));
+    // The admin activity log keeps its months for the same window.
+    void pruneAdminActivity(DATA_DIR, decisionRetentionDays(cfg.decisions?.retentionDays));
+};
+pruneDecisionLog();
+setInterval(pruneDecisionLog, 6 * 60 * 60_000).unref();
 workspaceAccess = createWorkspaceAccess({ sessions, cookieName: SESSION_COOKIE, closeSessionStreams });
 // Ten-second cadence plus the bridge's five-second backchannel deadline bounds
 // stale portal access on quiet event/browser streams to fifteen seconds.
@@ -17990,7 +19359,7 @@ for (const row of chatFollowups()) {
     const messages = store.messagesFor(row.threadId);
     const recovered = messages.find((message) => message.queueId === row.id && message.role === "user") ?? store.appendMessage(row.threadId, {
         role: "user", kind: "text", text: row.payload.text, replyToId: row.payload.replyToId,
-        sendId: row.payload.sendId, queueId: row.id,
+        sendId: row.payload.sendId, queueId: row.id, sender: row.payload.sender,
         ...(row.kind === "channel" ? { channelMode: row.payload.mode, via: row.payload.via } : {}),
     });
     // Nor as a message a resumed session has not seen: count it as handed.
@@ -18088,6 +19457,7 @@ const gracefulShutdown = createGracefulShutdown({
         () => flushAllMemoryJournals(),
         () => flushUsageLedger(DATA_DIR),
         () => flushDecisionLog(DATA_DIR),
+        () => flushAdminActivity(DATA_DIR),
     ],
     // Cleanup jobs run concurrently. Release only after they settle (or reach
     // the shutdown deadline), immediately before the process exits, so no new