openmausbot 0.1.93 → 0.1.95

package/dist-server/server/index.js

@@ -30,8 +30,9 @@ import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
 import { approvalModeFor, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { createApprovalModeSupport } from "./harness-capabilities.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
+import { threadRefUrl } from "../src/lib/thread-refs.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isPendingCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
+import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegatedApprovalMode } from "./auto-approve.js";
 import { CommandAllowlistStore, commandAllowlistCandidate } from "./command-allowlist.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
@@ -50,10 +51,14 @@ import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import * as boat from "./boat.js";
+import { cloudComputerRpc } from "./cloud-computer-tools.js";
 import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
 import { isEffortLevel } from "../shared/wire.js";
+import { isPersistentQuestionCard, QUESTION_DISMISS_MESSAGE, shouldSettleRequestCard } from "../shared/ask-question.js";
+import { parseToolScope, toolScopeWidens } from "../shared/tool-scope.js";
 import { boatCreateRecoverySnapshot, retireDeletedBoatCreate } from "./boat-create-idempotency.js";
 import { boatDeletionSnapshot } from "./boat-delete-journal.js";
+import { liveDecisionRefusal } from "../shared/live-approval.js";
 import { boatAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { connectorCallFromFrame, connectorRefusalText, connectorUnrecognizedText, evaluateConnectorTools } from "./connector-verdict.js";
@@ -62,15 +67,15 @@ import { buildRecall } from "./recall.js";
 import { createMemoryUpkeep, upkeepEnabled } from "./memory-upkeep.js";
 import { appendAboutMe, commitLearned, planLearned } from "./profile-learned.js";
 import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, livePeerRosterBlock, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
-import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmWakeAction, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, } from "./config.js";
+import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
 import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAGE_GROUPINGS, flushUsageLedger } from "./usage-ledger.js";
+import { loadPlanUsage, planAccountsFromInstances } from "./plan-usage.js";
 import { GroupUsageReader } from "./group-thread-usage.js";
 import { ledgerCost } from "./model-prices.js";
 import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
@@ -80,7 +85,7 @@ import { entitled } from "./enterprise.js";
 import { HOSTED_CONTRACT_HEADER, HOSTED_CONTRACT_METADATA, HOSTED_CONTRACT_VERSION } from "./hosted-contract.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
 import { blockedTarget, buildNotification, buildSpendNotification } from "./notify.js";
-import { isModelVariant, TurnNotStartedError, newId, } from "./contracts.js";
+import { isModelVariant, TurnNotStartedError, newId, usesCloudComputer, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { recoveryCapabilityError } from "./automatic-recovery.js";
 import { decodeGeneratedImage } from "./generated-image.js";
@@ -102,7 +107,7 @@ import { attemptAsideInjection, drainAsideMessages, queueAsideMessage, restoreAs
 import { promptWithReply, transcriptText } from "./replies.js";
 import { admit, DRAIN_COALESCE_MAX_ITEMS } from "./admission.js";
 import { _loadPending, buildDelegationFailurePrompt, buildDelegationRevivalPrompt, DELEGATION_TTL_MS, DelegationWakeBudget, discardDelegations, drainDelegations, expireStaleDelegations, findDelegationReceipt, pendingDelegationInfo, pendingDelegationSnapshot, pendingThreads, queueDelegation, recordDelegationReceipt, releaseDelegationsWaitingOn, summarizeDelegatedActivity } from "./delegations.js";
-import { cancelSteeredMessage, drainSteeredMessages, hasQueuedSteeredMessages, holdSteeredQueue, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
+import { cancelSteeredMessage, drainSteeredMessages, hasQueuedSteeredMessages, holdSteeredQueue, isSteeredMessageQueued, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
 import { cancelChannelMessage, drainChannelMessages, holdChannelQueue, headChannelGroup, queuedChannelMessage, queueChannelMessage, restoreChannelMessages, restoreHeldChannelQueue, resolveHeldReplyTarget, settleHeldChannelQueueHead, } from "./channel-queue.js";
 import { acceptedSendMatch, parseSendId, sendFingerprint, SendSequencer, } from "./send-idempotency.js";
 import { EventBus } from "./harness/bus.js";
@@ -123,7 +128,10 @@ import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sec
 import * as tts from "./tts/index.js";
 import { createDecider, deciderIncludedHere, deciderReady, deciderSavePatch, describeDecider } from "./decider/index.js";
 import { decideRoomResponder } from "./decider/room-routing.js";
+import { createLiveSession, liveAttachUrl, LiveSessionError } from "./live-call.js";
+import { LiveCallController, LiveCallSignedOutError } from "./live-call-controller.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
+import { turnStartLogLine } from "./turn-log.js";
 import { buildRecoveryText, buildTurnContext, engineIsFresh, NATIVELY_REPLAYING_DRIVER_KINDS, peerMessageText } from "./turn-context.js";
 import { Handoffs, handedStateUsable, recordHanded, renderUnseen, sessionStart, unseenMessages, withUnseenMessages } from "./delta-context.js";
 import { extractTurnImages } from "./turn-images.js";
@@ -135,14 +143,14 @@ import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, support
 import { listMemoryTopics, memoryDate, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, journalMemoryWrite, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
-import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
+import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, listBotSkillsWithOrigin, resolveBotSkills, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
 import { fetchSkillFromSource } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
-import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
+import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, TEAM_MEMORY_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, discoverExistingPoolLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { localVmStopReason, recordLocalVmIdleStop } from "./local-vm-stop-reason.js";
@@ -175,12 +183,19 @@ import { fetchGithubTeam, fetchLibraryTeam, fetchTeamCatalog } from "./team-libr
 import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageSummary, parsePackageDocument, renderBotPackageMarkdown } from "./bot-package.js";
 import { createTeamManifest, parseTeamManifest } from "./team-manifest.js";
 import { readThreadEvents } from "./thread-events.js";
+import { TeamMemory, TEAM_MEMORY_KINDS } from "./team-memory.js";
+import { describeTool, readBotActivity } from "./activity.js";
+import { OutboundCounts } from "./outbound-counts.js";
+import { OutboundRequestService } from "./outbound-requests.js";
+import { DEFAULT_OUTBOUND_POLICY, connectorCallsIn, normalizeOutboundPolicy, outboundCallsIn } from "../shared/outbound.js";
+import { connectorAccessDecision, describeConnectorScopes, normalizeConnectorScopes } from "../shared/connector-scopes.js";
 import { bindThreadLogCapProvider } from "./thread-log-rotation.js";
 import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
 import { assertModelVariantSupported, memberTurnSelection } from "./member-turn.js";
 import { WebhookManager } from "./webhooks.js";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
-import { loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, selectBundledSkills } from "./skill-library.js";
+import { installLibrarySkill, listLibrarySkills, loadBundledSkills, loadUserSkills, mergeSkills, readLibrarySkillFile, readSkillLibraryIndex, renderSkillInstructions, selectBundledSkills, setLibrarySkillReviewState, } from "./skill-library.js";
+import { runSkillsLibraryBootSweep } from "./skills-library-migration.js";
 import { installedPlaybookInstructions } from "./installed-playbooks.js";
 import { createBotPackageExport, createLibraryPackageExport, createTeamPackageExport, picture as sharedPicture, TeamExportError } from "./package-export.js";
 import { importPackageDocument, importTeamManifest, PackageImportError } from "./package-import.js";
@@ -192,10 +207,10 @@ import { MAX_TEAM_BACKUP_BYTES } from "../shared/team-backup.js";
 import { shouldMountLocalComputer } from "./local-routing.js";
 import { autoLocalVmAttachable } from "./container-computer.js";
 import { startAutoVmClaim } from "./auto-vm-claims.js";
-import { computerFreeAfterText, computerStillBusyText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
+import { computerFreeAfterText, computerParkedText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
 import { CloudOverflowConsent, CloudSeatLease, cloudOverflowAction, cloudOverflowConsentText, cloudOverflowOfferText, cloudSeatStartedText, cloudSeatStoppedText } from "./cloud-overflow.js";
 import { modelContextWindow } from "./model-context-window.js";
-import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
+import { cloudPlaceDriverError, parseSurface, PlaceUnavailableError, placeUnavailable, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
@@ -227,6 +242,7 @@ import { createDesktopViewer, desktopViewerUrl } from "./routes/desktop-viewer.j
 import { localDesktopTarget, localVmViewerStatus, viewerTargetId } from "./desktop-viewer-targets.js";
 import { createAntigravityLeftoverRoutes } from "./routes/antigravity-leftovers.js";
 import { findAntigravityLeftovers, removeAntigravityLeftovers } from "./drivers/antigravity-temp.js";
+import { createLiveRoutes } from "./routes/live.js";
 const PORT = Number(process.env.OMB_PORT || process.env.OGB_PORT || 8799);
 const WEBHOOK_PORT = Number(process.env.OMB_WEBHOOK_PORT || PORT + 1);
 // Behind a proxy or tunnel, the base URL senders should use (docs/self-hosting.md).
@@ -282,10 +298,12 @@ const workspaceMaintenance = new WorkspaceBackupMaintenance();
 // Remote clients (server/request-auth.ts, server/sessions.ts): a stable identity
 // for this server, the paired sessions, and the cookie the served UI uses.
 const ENVIRONMENT_ID = loadEnvironmentId(DATA_DIR);
-function signInAllowList() {
-    const current = loadConfig().signIn;
-    return { admins: parseAllowList(current?.admins?.join(",")), members: parseAllowList(current?.members?.join(",")) };
-}
+// Every stream frame and request rechecks email sessions against this list,
+// so config.json is parsed again only when the file changes.
+const signInAllowList = cacheUntilConfigChanges((config) => ({
+    admins: parseAllowList(config.signIn?.admins?.join(",")),
+    members: parseAllowList(config.signIn?.members?.join(",")),
+}));
 const sessions = new SessionRegistry({
     file: join(DATA_DIR, "sessions.json"),
     emailScopesSnapshot: () => {
@@ -930,6 +948,9 @@ function cardAnswerRefusal(auth, threadId, requestId, behavior) {
             ? "A local service can only decline this request. Approve or answer it in OpenMausBot while signed in."
             : null;
     }
+    if (!auth.scopes.includes("admin") && store.messagesFor(threadId).some(message => message.card?.requestId === requestId && message.card.teamMemoryRequest)) {
+        return "Only a workspace admin can review shared team memory.";
+    }
     // A Cloud home is one person's: a device paired with chat-only access (a
     // guest) may read along but never answer, or its words would reach the
     // owner's turn, and through it a lent Mac (docs/cloud-pro.md).
@@ -993,9 +1014,10 @@ function cloudCardAnswerer(card) {
     return card.requestId ? cloudCardAnswersInFlight.get(card.requestId) : undefined;
 }
 /** Answer a card as `auth`: the decision rows written meanwhile name the
- * answerer, and a card this answer settled records who settled it. A card
- * that was already settled keeps whatever it said. */
-async function answeringCardAs(auth, threadId, requestId, work) {
+ * answerer, and a card this answer settled records who settled it (and
+ * `via: "call"` when it was decided by voice on a Live call). A card that
+ * was already settled keeps whatever it said. */
+async function answeringCardAs(auth, threadId, requestId, work, via) {
     const open = (() => {
         const card = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId)?.card;
         return Boolean(card && !card.answered && !card.dismissed && !card.expired);
@@ -1003,13 +1025,13 @@ async function answeringCardAs(auth, threadId, requestId, work) {
     if (CLOUD_HOME && open)
         cloudCardAnswersInFlight.set(requestId, auth.kind === "session" ? actorKey(auth) : undefined);
     try {
-        await withDecisionActor(decisionActorFor(auth), work);
+        await withDecisionActor(decisionActorFor(auth), work, via);
     }
     finally {
         const message = open ? store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId) : undefined;
         const card = message?.card;
         if (message && card && !card.answeredBy && card.answered !== "unavailable" && (card.answered || card.dismissed)) {
-            store.patchMessage(threadId, message.id, { card: { ...card, answeredBy: cardAnswererFor(auth) } });
+            store.patchMessage(threadId, message.id, { card: { ...card, answeredBy: { ...cardAnswererFor(auth), ...(via ? { via } : {}) } } });
         }
         if (CLOUD_HOME && open)
             cloudCardAnswersInFlight.delete(requestId);
@@ -1519,6 +1541,25 @@ function resyncOpenCodeProviderKeys() {
 await registry.load(providerConfigs(), decorateHostedProvider);
 const bundledSkills = loadBundledSkills();
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
+// Skills library (features.skillsLibrary). While the flag is off both
+// helpers reduce exactly to today's per-bot calls; assignments recorded on
+// bot records stay inert until it is on.
+const listBotSkills = (bot) => skillsLibraryEnabled(cfg) ? resolveBotSkills(bot.id, bot.assignedSkills) : listSkills(bot.id);
+const readBotSkillFile = (bot, name) => {
+    const own = readSkillFile(bot.id, name);
+    if (own !== null || !skillsLibraryEnabled(cfg))
+        return own;
+    // A private listing whose stored bytes no longer verify must not fall
+    // through to a same-named library skill: private wins collisions, so a
+    // broken private file stays unreadable instead of exporting another
+    // bot's library instructions under this bot's name.
+    if (listSkills(bot.id).some((skill) => skill.name === name))
+        return null;
+    // The library fallback is by assignment only, never by name alone.
+    if (!bot.assignedSkills?.includes(name))
+        return null;
+    return readLibrarySkillFile(name);
+};
 // SAFETY: Electron's utility-process runtime is the only environment that
 // supplies parentPort; plain Node intentionally leaves it absent.
 const utilityParentPort = process.parentPort;
@@ -1975,7 +2016,20 @@ function hooksIntegration(botId, threadId, generation) {
 }
 class DirectTurnSetupCancelled extends Error {
 }
-class ComputerWaitGaveUp extends Error {
+/** The computer wait ceiling fired (ADR-2, #1651). The turn parks — settled
+ * with a registered resume — instead of failing; the carried resource names
+ * the seat the resume must wait to free. */
+class ComputerWaitParked extends Error {
+    resource;
+    /** The parked turn's generation: the drain distinguishes the turn's own
+     * settle window (keep, retry later) from a newer turn that superseded it
+     * (delete). */
+    generation;
+    constructor(message, resource, generation) {
+        super(message);
+        this.resource = resource;
+        this.generation = generation;
+    }
 }
 const directTurnDispatchClaims = new Map();
 const directTurnGenerationByThread = new Map();
@@ -2019,6 +2073,12 @@ const turnResources = new TurnResources();
 const sharedComputerControl = new SharedComputerControl(turnResources, () => store.bots.some(bot => botComputerControlSnapshot(bot.id).held));
 const turnResourceOwners = new Map();
 const turnComputerResources = new Map();
+/** Screen-touching computer calls that started before their turn's computer
+ * claim was bound (#1653 over the lazy attach of #1361): the start event
+ * finds no claim to fence, so it waits here and bindTurnComputer carries it
+ * into the fresh claim, keeping the quiet window from releasing a seat
+ * under a call the desktop is already executing. */
+const pendingComputerCallStarts = new Map();
 const teamComputerTurns = new Map();
 const settlingResourceOwners = new Map();
 /** Idle release for computer claims (#1653), disabled until the feature
@@ -2028,10 +2088,11 @@ const settlingResourceOwners = new Map();
  * yields once another turn holds the seat. The durable VM profile keeps
  * its login state, so that re-claim is cheap. Read per claim: a flag
  * change applies to new claims, never to a seat held under the old
- * setting. */
+ * setting. computer:phone is excluded: it is the #1663 exclusivity lock,
+ * claimed once per turn with no activity signal to renew it. */
 const COMPUTER_CLAIM_IDLE_POLICY = new IdleReleasePolicy();
 function computerClaimIdlePolicy(resource) {
-    return resource.startsWith("computer:") && computerClaimIdleReleaseEnabled(cfg) ? COMPUTER_CLAIM_IDLE_POLICY : undefined;
+    return resource.startsWith("computer:") && resource !== "computer:phone" && computerClaimIdleReleaseEnabled(cfg) ? COMPUTER_CLAIM_IDLE_POLICY : undefined;
 }
 /** #1655: the consent ledger for local-wait cloud overflow, and the live
  * cloud seats it has started. One seat per bot — it is the bot's own Box,
@@ -2191,11 +2252,17 @@ function releaseTurnResources(owner) {
         turnResourceOwners.delete(owner.threadId);
     if (turnComputerResources.get(owner.threadId)?.owner.generation === owner.generation)
         turnComputerResources.delete(owner.threadId);
+    if (pendingComputerCallStarts.get(owner.threadId)?.generation === owner.generation)
+        pendingComputerCallStarts.delete(owner.threadId);
     const teamTurn = teamComputerTurns.get(owner.threadId);
     if (teamTurn?.owner.generation === owner.generation) {
         stopScreenPoller(teamTurn.botId, owner.threadId);
         teamComputerTurns.delete(owner.threadId);
     }
+    // A freed seat is the parked-resume drain's trigger (#1651). Deferred past
+    // this synchronous settle so the drain reads post-cleanup state.
+    if (pendingComputerResumes.size > 0)
+        queueMicrotask(drainComputerResumes);
 }
 async function bindTurnComputer(owner, resource, exclusive = false) {
     // Every computer claim passes here: a kind the organisation disallows, or a
@@ -2210,7 +2277,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
     // bot running a titled thread, or a room. Read once, when the wait begins.
     let holder;
     let holderThreadRef;
-    const deadline = Date.now() + GROUP_GOAL_WAIT_MAX_MS;
+    const deadline = Date.now() + COMPUTER_WAIT_MAX_MS;
     // The wait is history the transcript keeps (#1647): the waiting chip stays
     // exactly as written, a resolution line is appended beside it, and the
     // turn.wait_* events carry the same facts for the inspector log.
@@ -2236,15 +2303,18 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
             return;
         waitEnded = true;
         const waitedMs = waitedSince === undefined ? 0 : Date.now() - waitedSince;
+        // Acquisition is the only wait that completes: it is the sample the
+        // per-resource estimate is built from (#1652).
+        if (outcome === "acquired")
+            turnResources.noteWait(resource, waitedMs);
         const text = outcome === "acquired"
             ? computerFreeAfterText(holder, waitedMs)
-            : outcome === "gave_up"
-                ? computerStillBusyText(holder, waitedMs)
+            : outcome === "parked"
+                ? computerParkedText(holder, COMPUTER_WAIT_MAX_MS)
                 : computerStoppedWaitingText(holder, waitedMs);
         store.appendMessage(owner.threadId, {
             role: "bot", kind: "activity",
-            ...(outcome === "gave_up" ? { turnSucceeded: false } : {}),
-            tool: { name: text, ok: outcome !== "gave_up" },
+            tool: { name: text, ok: true },
             ...(holderThreadRef ? { threadRef: holderThreadRef } : {}),
         });
         bus.publish({
@@ -2263,6 +2333,10 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
             if (!exclusive || claimTurnResource(owner, resource))
                 break;
             if (!waitingMessage) {
+                // Arrival in the waitlist is the chip's timestamp: the position it
+                // reads is where this turn sits the moment it starts waiting (#1652).
+                const position = turnResources.startWaiting(resource, owner);
+                const estimateMs = turnResources.waitEstimateMs(resource);
                 const blocker = turnResources.blocker(resource, owner);
                 const holderBot = blocker && store.botByThread(blocker.threadId);
                 const holderTask = holderBot && blocker && store.taskByThread(holderBot.id, blocker.threadId);
@@ -2275,7 +2349,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
                     : undefined;
                 waitingMessage = store.appendMessage(owner.threadId, {
                     role: "bot", kind: "activity",
-                    tool: { name: computerWaitingText(holder) },
+                    tool: { name: computerWaitingText(holder, { position, estimateMs }) },
                     ...(holderThreadRef ? { threadRef: holderThreadRef } : {}),
                 });
                 waitedSince = Date.now();
@@ -2283,6 +2357,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
                     ...waitEventBase(),
                     type: "turn.wait_started",
                     resource,
+                    position,
                     ...(holder ? { holder } : {}),
                 });
                 // #1655: the wait is where an overflow choice gets made. The card
@@ -2312,8 +2387,12 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
             }
             sweepIdleCloudSeats();
             if (Date.now() >= deadline) {
-                endWait("gave_up");
-                throw new ComputerWaitGaveUp(computerStillBusyText(holder, GROUP_GOAL_WAIT_MAX_MS));
+                // ADR-2 (#1651): the ceiling parks the turn — settled, with a
+                // registered resume — instead of failing it. The owner mark lets the
+                // live lazy-claim rejection path park the same way.
+                endWait("parked");
+                owner.computerParkedOn = resource;
+                throw new ComputerWaitParked(computerParkedText(holder, COMPUTER_WAIT_MAX_MS), resource, owner.generation);
             }
             await new Promise(resolve => setTimeout(resolve, 100));
         }
@@ -2322,9 +2401,21 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
         // Never patch the waiting chip over: the queue position this turn held
         // stays visible beside what the wait came to.
         endWait(active() && turnResources.owns(resource, owner) ? "acquired" : "stopped");
+        // Whatever the wait came to, this turn is no longer waiting: an owner
+        // left at the front would block the grant for everyone behind it.
+        turnResources.stopWaiting(resource, owner);
     }
     turnResourceOwners.set(owner.threadId, owner);
     turnComputerResources.set(owner.threadId, { owner, resource });
+    // A screen call that started before this bind (#1653) fenced nothing
+    // because no claim existed yet: carry its pending start into the fresh
+    // claim so the idle window still defers to the running call.
+    const pendingStarts = pendingComputerCallStarts.get(owner.threadId);
+    if (pendingStarts?.generation === owner.generation && pendingStarts.count > 0) {
+        pendingComputerCallStarts.delete(owner.threadId);
+        for (let i = 0; i < pendingStarts.count; i += 1)
+            turnResources.beginComputerCall(resource, owner);
+    }
 }
 function botForThread(botId, threadId) {
     return directTurnBots.get(threadId) ?? store.projectBotForTask(botId, threadId) ?? store.bot(botId);
@@ -2413,7 +2504,13 @@ function requestedTaskBot(botId, rawThreadId) {
         throw Object.assign(new Error("no such task"), { status: 404 });
     return task;
 }
-async function interruptDirectThread(botId, threadId) {
+async function interruptDirectThread(botId, threadId, options) {
+    // A parked turn has settled its provider but still owns a future resume.
+    // Stop cancels that work too. The parking teardown itself preserves it.
+    if (!options?.preserveComputerResume && pendingComputerResumes.delete(threadId)
+        && store.taskByThread(botId, threadId)?.activity === "parked.computer") {
+        store.setTaskActivity(botId, threadId, "idle");
+    }
     const requestOwner = directRequestOwners.get(threadId);
     if (requestOwner) {
         requestOwner.stopped = true;
@@ -2455,7 +2552,7 @@ function noteTeammatesLeftRunning(botId, threadId, running) {
     }
 }
 async function interruptAllDirectThreads(botId) {
-    const threads = store.tasks(botId).filter((task) => task.busy || directTurnDispatchClaims.has(task.threadId) || roomHandoffs.activeDirect(task.threadId));
+    const threads = store.tasks(botId).filter((task) => task.busy || directTurnDispatchClaims.has(task.threadId) || roomHandoffs.activeDirect(task.threadId) || pendingComputerResumes.has(task.threadId));
     // Revoke every sibling before yielding to any provider teardown.
     for (const task of threads) {
         cancelDirectTurnDispatch(botId, task.threadId);
@@ -2638,8 +2735,8 @@ async function browserIntegration(botId, profile, turn) {
     const token = mintInternalCapability({ botId, ...turn, browserSession: session,
         kind: "browser", depth: 0, skillAuthoring: false, createdBots: 0, openedThreads: 0 });
     return { profile: partitionId, session, spec, integration: {
-            command: process.execPath, args: [SPAWNED_PROXIES.browser], env: {
-                ...AGENTS_NODE_FLAG, OMB_BROWSER_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
+            command: process.execPath, args: [SPAWNED_PROXIES.harnessMcp, "browser"], env: {
+                ...AGENTS_NODE_FLAG, OMB_MCP_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
             },
         } };
 }
@@ -2740,8 +2837,10 @@ const routineRequestEnvelopeSchema = z.discriminatedUnion("action", [
     }).strict(),
     ...["pause", "resume", "run_now", "delete"].map((action) => z.object({ ...routineRequestSourceSchema, action: z.literal(action), routineId: z.unknown(), forBotId: z.unknown().optional() }).strict()),
 ]);
-/** The loopback endpoint a bot's computer proxy polls before acting. */
-function controlIntegration(botId, threadId, generation, localVmTarget) {
+/** The loopback endpoint a bot's computer proxy polls before acting. With a
+ * Boat id, the same turn-scoped token also serves that Boat's tools at
+ * /api/internal/computer/mcp, and is revoked when the turn ends. */
+function controlIntegration(botId, threadId, generation, localVmTarget, boxId) {
     return {
         url: `http://127.0.0.1:${PORT}/api/internal/computer-control?botId=${encodeURIComponent(botId)}`,
         token: mintInternalCapability({
@@ -2751,6 +2850,7 @@ function controlIntegration(botId, threadId, generation, localVmTarget) {
             depth: 0,
             kind: "computer",
             ...(localVmTarget ? { localVmTarget } : {}),
+            ...(boxId ? { boxId } : {}),
             ...(teamComputerTurns.get(threadId) ? { teamComputerId: teamComputerTurns.get(threadId).computerId } : {}),
             skillAuthoring: false,
             createdBots: 0,
@@ -2937,7 +3037,7 @@ function checkedExportSkillNames(value, bots) {
         return { ok: false, error: "skillIds must not contain duplicates" };
     if (names.length > BOT_PACKAGE_MAX_SKILLS)
         return { ok: false, error: `skillIds must contain at most ${BOT_PACKAGE_MAX_SKILLS} names` };
-    const available = new Set(bots.flatMap((bot) => listSkills(bot.id).map((skill) => skill.name)));
+    const available = new Set(bots.flatMap((bot) => listBotSkills(bot).map((skill) => skill.name)));
     const unknown = names.find((name) => !available.has(name));
     if (unknown)
         return { ok: false, error: `skillIds contains unknown imported skill "${unknown}"` };
@@ -2950,10 +3050,10 @@ function collectExportSkills(bots, names) {
         return byBot;
     for (const bot of bots) {
         const assigned = [];
-        for (const listing of listSkills(bot.id)) {
+        for (const listing of listBotSkills(bot)) {
             if (!selected.has(listing.name))
                 continue;
-            const instructions = readSkillFile(bot.id, listing.name);
+            const instructions = readBotSkillFile(bot, listing.name);
             if (instructions === null) {
                 throw new Error(`Skill "${listing.name}" changed or is unavailable and cannot be exported safely`);
             }
@@ -2981,7 +3081,7 @@ function collectExportSkills(bots, names) {
  * skill choices from it, so a refused choice can always be changed. */
 function collectTeamSkills(bots, selection) {
     const all = selection === undefined || selection === "all";
-    const available = [...new Set(bots.flatMap((bot) => listSkills(bot.id).map((skill) => skill.name)))].sort();
+    const available = [...new Set(bots.flatMap((bot) => listBotSkills(bot).map((skill) => skill.name)))].sort();
     if (!all && (!Array.isArray(selection) || selection.some((name) => typeof name !== "string" || !isSkillName(name)))) {
         return { ok: false, error: "skills must be \"all\" or a list of skill names", available };
     }
@@ -2993,10 +3093,10 @@ function collectTeamSkills(bots, selection) {
     const skipped = [];
     for (const bot of bots) {
         const assigned = [];
-        for (const listing of listSkills(bot.id)) {
+        for (const listing of listBotSkills(bot)) {
             if (!chosen.has(listing.name))
                 continue;
-            const instructions = readSkillFile(bot.id, listing.name);
+            const instructions = readBotSkillFile(bot, listing.name);
             if (instructions === null) {
                 if (!all)
                     return { ok: false, error: `Skill "${listing.name}" changed or is unavailable and cannot be shared safely`, available };
@@ -3133,6 +3233,26 @@ const sendSequencer = new SendSequencer();
 bootSelection = await defaultSelection();
 store.seedIfEmpty();
 hostedModels?.reconcile(store);
+// Skills library boot sweep (features.skillsLibrary): migrate per-bot
+// copies into the shared library and apply assignments. Flag-off boots
+// never enter this block, keeping per-bot behavior byte-identical.
+if (skillsLibraryEnabled(cfg)) {
+    try {
+        const sweep = runSkillsLibraryBootSweep({
+            bots: store.bots,
+            patch: (botId, assignedSkills) => {
+                store.patchBot(botId, { assignedSkills });
+            },
+        });
+        const applied = sweep.outcomes.filter((outcome) => outcome.outcome !== "skipped").length;
+        if (sweep.outcomes.length) {
+            console.log(`[skills-library] boot sweep: ${applied} skill(s) migrated or deduplicated, ${sweep.outcomes.length - applied} skipped`);
+        }
+    }
+    catch (error) {
+        console.error(`[skills-library] boot sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 // A committed profile cleanup means both its config deletion and bot-reference
 // cleanup were intended to be durable. Reconcile stale secondary references
 // before Electron can ACK and remove the journal: a crash between those writes
@@ -3174,7 +3294,7 @@ const wireTask = (task) => {
     return asleep ? { ...coordinated, snoozedUntil } : coordinated;
 };
 const wireBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
     // An elevated selection is inert until the desktop confirms its exact
     // private reply. Every ordinary client sees the effective Ask state during
     // that two-phase window, never a grant that may still roll back.
@@ -3184,10 +3304,19 @@ const wireBot = (bot) => {
     return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
         avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
+function toolScopeForTurn(botId) {
+    const bot = store.bot(botId);
+    if (!bot)
+        throw Object.assign(new Error("no such bot"), { status: 404 });
+    const parsed = parseToolScope(bot.toolScope);
+    if (!parsed.ok)
+        throw Object.assign(new Error("This bot's tool selection is invalid. Open Access settings and save a valid selection before starting a turn."), { status: 409, code: "tool_scope" });
+    return parsed.scope;
+}
 /** The correlated private response carries the requested value so Electron
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
     return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
@@ -3203,7 +3332,7 @@ function previewSystemPrompt(bot) {
     ]
         .filter(Boolean)
         .join(" ");
-    const instance = turnInstance(bot);
+    const instance = registry.get(bot.modelSelection.instanceId);
     const caps = instance?.adapter.capabilities;
     const teamComputer = inheritedTeamComputer(bot);
     const previewComputer = teamComputer ? "cloud" : bot.computer;
@@ -3211,12 +3340,11 @@ function previewSystemPrompt(bot) {
         kind: previewComputer === "vm" ? "vm" : previewComputer === "cloud"
             ? bot.cloudBackend === "vps" ? "vps" : "box" : previewComputer === "local" ? "local" : null,
         driverKind: instance?.driverKind,
-        cloudComputerMcp: caps?.cloudComputerMcp,
         vmPrivate: localVmMode(cfg) === "per-bot",
     });
     const peers = reachablePeers(store.bots, bot);
     const coordination = bot.chiefOfStaff
-        ? chiefOfStaffSystemPrompt(bot.id, store.bots, true, openMausStatusSystemPrompt())
+        ? chiefOfStaffSystemPrompt(bot.id, store.bots, true)
         : peers.length > 0
             ? peerRosterSystemPrompt(peers)
             : "";
@@ -3252,7 +3380,7 @@ function previewSystemPrompt(bot) {
                 browser: previewPlan.computer === undefined ? false : previewPlan.browser,
             }, { note: previewPlan.note, cloudHome: Boolean(CLOUD_HOME) }) },
         { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(agentsMounted && lendingEnabled()) : "" },
-        { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) : "" },
+        { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) + describeConnectorScopes(bot.connectorScopes) : "" },
         { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(engineMcpServers(bot))) : "" },
         { id: "browser", label: "Browser", text: previewPlan.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
         { id: "coordination", label: "Team", text: agentsMounted && coordination ? ` ${coordination}` : "" },
@@ -3260,8 +3388,9 @@ function previewSystemPrompt(bot) {
         { id: "routine", label: "Routines", text: agentsMounted ? ROUTINE_PROMPT : "" },
         { id: "profile", label: "Profile changes", text: agentsMounted ? PROFILE_PROMPT : "" },
         { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+        { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (agentsMounted ? TEAM_MEMORY_PROMPT : "") },
         { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace), enabled: bot.memoryEnabled !== false }) },
-        { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
+        { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? bot.assignedSkills : undefined) : "" },
     ]);
     const totalBytes = built.sections.reduce((n, s) => n + s.bytes, 0);
     return {
@@ -3326,7 +3455,7 @@ async function botOverview(bot) {
         webhooks: webhooks.list()
             .filter((webhook) => webhook.botId === bot.id)
             .map((webhook) => ({ name: webhook.name, enabled: webhook.enabled })),
-        skills: listSkills(bot.id).map((skill) => ({
+        skills: listBotSkills(bot).map((skill) => ({
             name: skill.name,
             description: skill.description,
             enabled: skill.enabled,
@@ -3345,9 +3474,9 @@ async function botOverview(bot) {
  * this too, but no provider dispatch or later permission callback relies on
  * persistence having been produced exclusively by that route. Delegation
  * uses the receiving bot's grant, never the sender's (approvalModeForOrigin) —
- * with one deliberate exception: a Chief of Staff with Full access makes the
- * threads it delegates Full too (delegatedFullAccess), so the grant the
- * person gave the Chief covers the work the Chief hands out. */
+ * with one deliberate exception: a Chief of Staff's level flows down to the
+ * threads it delegates (delegatedLevel), so the level the person gave the
+ * Chief covers the work the Chief hands out. */
 const approvalModeForTurn = (bot, peerInitiated = false, threadId = bot.threadId) => {
     // On a Cloud home a turn a guest drives runs in Ask, whatever the bot's
     // own level. Judged by the conversation the turn runs in (a room's, for a
@@ -3360,51 +3489,62 @@ const approvalModeForTurn = (bot, peerInitiated = false, threadId = bot.threadId
     }
     return mode;
 };
-/** Full belongs to the requesting conversation, not whichever sibling is
+/** A level belongs to the requesting conversation, not whichever sibling is
  * selected in the UI or the bot's default for future conversations. */
-function fullAccessForSource(botId, threadId) {
+function sourceApprovalMode(botId, threadId) {
     const owner = connectorThread(botId, threadId);
     if (!owner)
-        return false;
+        return "ask";
     const bot = store.projectBotForTask(botId, threadId) ?? owner.bot;
     // Origin changes Custom to Auto, never Full; no live-turn state is needed.
-    return approvalModeForTurn(bot, false, threadId) === "full";
+    return approvalModeForTurn(bot, false, threadId);
+}
+function fullAccessForSource(botId, threadId) {
+    return sourceApprovalMode(botId, threadId) === "full";
 }
 function peerReviewRequired(bot, threadId) {
     return Boolean(bot.approvePeerComms && !fullAccessForSource(bot.id, threadId));
 }
-/** Full access flows down a Chief of Staff's delegation. The person gave the
- * Chief Full access so its work runs without prompts; a teammate stopping
- * that same work to ask defeats the grant — and in practice the person was
- * answering every one of those cards, all day, for the whole team. So a
- * teammate a Full-access Chief delegates to runs Full for that work: the
- * recipient switches, whatever its own level says. The recipient's engine
- * has to implement Full (supportsApprovalMode); otherwise the work keeps the
- * recipient's own level, as before. Only a Chief passes access on — an
- * ordinary bot's delegation still uses the recipient's setting. */
-function delegatedFullAccess(from, fromThreadId, target) {
-    return delegationInheritsFullAccess({
+/** A Chief of Staff's level flows down its delegation. The person set the
+ * Chief's level so its work runs that way; a teammate the Chief brings in
+ * starting at "Ask for approval" meant switching every such thread by hand,
+ * all day, for the whole team. So a teammate a Chief delegates to starts at
+ * the Chief's level for that work: Auto-accept edits, Approve for me or Full
+ * access (delegatedApprovalMode: never lower than the teammate's own level,
+ * capped at what its engine implements). Only a Chief passes its level on —
+ * an ordinary bot's delegation still uses the recipient's setting. Returns
+ * null to keep the recipient's own level. */
+function delegatedLevel(from, fromThreadId, target, recipientMode) {
+    return delegatedApprovalMode({
         senderIsChief: Boolean(from.chiefOfStaff),
-        senderHasFullAccess: fullAccessForSource(from.id, fromThreadId),
+        senderMode: sourceApprovalMode(from.id, fromThreadId),
         sameBot: from.id === target.id,
+        recipientMode,
         recipientDriverKind: registry.cliTarget(target.modelSelection.instanceId)?.driverKind,
     });
 }
-/** Make a delegated thread Full and say so in it once, so the level the
- * chip shows and the level the turns run at agree, and the person can see
- * where the access came from. */
-function grantDelegatedFullAccess(from, target, threadId) {
-    if (store.taskByThread(target.id, threadId)?.approvalMode === "full")
+/** The teammate's own level for a thread of its own, before any delegation. */
+function ownThreadLevel(target, threadId) {
+    return approvalModeForTurn(store.projectBotForTask(target.id, threadId) ?? target, false, threadId);
+}
+const DELEGATED_LEVEL_NAMES = { edits: "Auto-accept edits", auto: "Approve for me", full: "Full access" };
+/** Start a thread the Chief opened at the Chief's level, and say so in it
+ * once, so the level the chip shows and the level the turns run at agree,
+ * and the person can see where it came from (and change it there). */
+function applyDelegatedLevel(from, fromThreadId, target, threadId) {
+    const level = delegatedLevel(from, fromThreadId, target, ownThreadLevel(target, threadId));
+    if (!level || store.taskByThread(target.id, threadId)?.approvalMode === level)
         return;
-    store.patchTask(target.id, threadId, { approvalMode: "full", autoApprove: false, alwaysAllow: [] });
+    store.patchTask(target.id, threadId, { approvalMode: level, autoApprove: false, alwaysAllow: [] });
+    const name = DELEGATED_LEVEL_NAMES[level] ?? level;
     store.appendMessage(threadId, {
         role: "bot",
         kind: "activity",
-        tool: { name: `Full access — delegated by ${from.name}, a Chief of Staff with Full access`, ok: true },
+        tool: { name: `${name} — delegated by ${from.name}, a Chief of Staff on ${name}`, ok: true },
     });
 }
-/** A room member's level for one turn. Work a Full-access Chief hands out
- * in a room runs Full for that turn: the room thread is shared, so the
+/** A room member's level for one turn. Work a Chief hands out in a room runs
+ * at the Chief's level for that turn: the room thread is shared, so the
  * level is not stored on it — it rides the handoff. */
 function roomTurnApprovalMode(bot, threadId, orchestration) {
     // On a Cloud home a room turn a guest drives runs in Ask (cloudGuestDriven).
@@ -3413,9 +3553,8 @@ function roomTurnApprovalMode(bot, threadId, orchestration) {
     const handoff = orchestration?.roomHandoffId ? roomHandoffs.nodes.get(orchestration.roomHandoffId) : undefined;
     const source = handoff?.parentId ? roomHandoffs.nodes.get(handoff.parentId) : undefined;
     const from = source ? store.bot(source.botId) : undefined;
-    if (from && source && delegatedFullAccess(from, source.threadId, bot))
-        return "full";
-    return approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId), threadId);
+    const own = approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId), threadId);
+    return (from && source && delegatedLevel(from, source.threadId, bot, own)) || own;
 }
 /** Privileged approval-mode transitions are deliberately absent from the
  * loopback HTTP authority model: a bot with shell access can curl that
@@ -4081,6 +4220,7 @@ function updateChannel(groupId, value) {
 const channelTaskBlocked = (group) => groupIsWorking(group) ||
     store.groupTasks(group.id).some((task) => store.messagesFor(task.threadId).some((message) => message.kind === "options" &&
         message.card?.requestId &&
+        (!isPersistentQuestionCard(message.card) || runningTurnEngines.has(task.threadId)) &&
         !message.card.answered &&
         !message.card.dismissed && !message.card.expired));
 // Recovery can synchronously emit room changes. Load coordination state
@@ -4153,7 +4293,7 @@ function outstandingAssignmentsPrompt(threadId) {
         assignment: node.text.slice(0, 1_000),
         status: node.status === "queued" ? "waiting for that teammate to be free" : "working on it now",
     }));
-    return ` Assignments you already sent are still outstanding, and nothing in this conversation cancelled them: ${JSON.stringify(listed)}. Do not send them again, do not poll or wait for them, and do not tell the user they were lost. Each result returns to this conversation on its own and resumes you then. Answer the message above with that work still in flight.`;
+    return ` Assignments you already sent are still outstanding, and nothing in this conversation cancelled them: ${JSON.stringify(listed)}. Do not resend them, do not poll or wait for them, and do not tell the user they were lost. Each result returns to this conversation on its own and resumes you then. To change or add to one, send the change to the same teammate with coordinate_bots; it runs after the current work. Answer the message above with that work still in flight.`;
 }
 const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     validate: (node, parent) => roomHandoffProblem(node, parent) ??
@@ -4227,9 +4367,10 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
         }
         // A successful direct work thread closes after its result is reported:
         // folded out of the sidebar, never deleted, and reopened if addressed.
-        // Failed or withheld work stays visible.
+        // Failed or withheld work stays visible, and so does a thread whose
+        // next request is already waiting there.
         const childTask = store.taskByThread(child.botId, child.threadId);
-        if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy
+        if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy && !roomHandoffs.activeDirect(child.threadId)
             && childTask?.openedBy?.kind === "work" && childTask.openedBy.botId === parent.botId) {
             store.setTaskClosedBy(child.botId, child.threadId, { botId: parent.botId, name: store.bot(parent.botId)?.name ?? childTask.openedBy.name, at: Date.now() });
         }
@@ -4617,6 +4758,7 @@ function cancelGroupTurnOperations(groupId, threadId, outcome = {
     status: "stopped",
     detail: "Stopped by you.",
 }) {
+    pendingComputerResumes.delete(threadId);
     cancelTeamSetupResumesForThread(threadId);
     roomHandoffs.cancelRoom(groupId, threadId);
     for (const operation of groupTurnOperations.get(groupId) ?? []) {
@@ -5115,7 +5257,7 @@ always, rememberCommand) {
     // An answered question keeps its words. `request.resolved` only records
     // the behavior, so without this the card reads "answer" forever and the
     // person can no longer see what they told the bot.
-    if (outcome !== "unavailable" && behavior === "answer" && message && cardMessage) {
+    if (outcome === "answered" && behavior === "answer" && message && cardMessage) {
         const settled = store.messagesFor(threadId).find((m) => m.id === cardMessage.id)?.card;
         if (settled) {
             store.patchMessage(threadId, cardMessage.id, { card: { ...settled, answeredText: message } });
@@ -5147,19 +5289,81 @@ always, rememberCommand) {
         const existing = messageId
             ? thread.find((m) => m.id === messageId)
             : thread.find((m) => m.card?.requestId === requestId);
-        if (existing?.card && !existing.card.answered) {
+        const persistentQuestion = isPersistentQuestionCard(existing?.card);
+        if (existing?.card && !existing.card.answered && !persistentQuestion) {
             store.patchMessage(threadId, existing.id, { card: { ...existing.card, answered: "unavailable", dismissed: true } });
         }
         if (messageId)
             askMessageByRequest.delete(`${threadId}:${requestId}`);
-        store.appendMessage(threadId, {
-            role: "bot",
-            kind: "activity",
-            tool: { name: "Couldn't deliver that answer — the request is no longer open, so the action was not run", ok: false },
-        });
+        // The card's own answered state gates the message too: a replayed respond
+        // for a card that already settled must not read as a failed delivery —
+        // nothing was lost, the earlier answer already ran.
+        if (!persistentQuestion && !existing?.card?.answered)
+            store.appendMessage(threadId, {
+                role: "bot",
+                kind: "activity",
+                tool: { name: "Couldn't deliver that answer — the request is no longer open, so the action was not run", ok: false },
+            });
     }
     return outcome;
 }
+/** A decision or answer on a provider/peer card, made on behalf of `auth`
+ * (a Live call answers as the person who started the call). Harness-native
+ * proposals (skill, routine, profile, default model, tightening, team setup)
+ * are not handled here; they are reviewed on screen (liveDecisionRefusal).
+ * Mirrors POST /api/threads/:id/respond. */
+async function respondToCard(input) {
+    const { auth, threadId, requestId, behavior, message } = input;
+    // A call outlives the request that started it: the session must still be valid.
+    if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+        return { ok: false, status: 401, error: "The session that started this call has ended." };
+    }
+    const refusal = cardAnswerRefusal(auth, threadId, requestId, behavior);
+    if (refusal)
+        return { ok: false, status: 403, error: refusal };
+    const bot = store.botByThread(threadId);
+    if (!bot)
+        return { ok: false, status: 404, error: "The chat is gone." };
+    const cardMessage = store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId);
+    const card = cardMessage?.card;
+    // Refused before anything runs: answerRequest would close a proposal it
+    // cannot deliver as "unavailable", and would add a false "not run" line to
+    // a card someone settled on screen a moment ago.
+    const refused = liveDecisionRefusal(card);
+    if (refused)
+        return { ok: false, status: 409, error: refused };
+    let result = { ok: true };
+    await answeringCardAs(auth, threadId, requestId, async () => {
+        // peer-approval intercept, as the route: only a card on this thread
+        if (card && resolvePeerComms(approvalBus, requestId, behavior))
+            return;
+        const outcome = await answerRequest(threadId, botForThread(bot.id, threadId)?.modelSelection.instanceId ?? "", requestId, behavior, message, { id: bot.id, name: bot.name });
+        if (outcome === "unavailable" && isPersistentQuestionCard(card) && behavior === "answer" && cardMessage) {
+            const answer = message?.trim() ?? "";
+            if (!answer) {
+                result = { ok: false, status: 400, error: "A question answer is required." };
+            }
+            else if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                result = { ok: false, status: 401, error: "The session that started this call has ended." };
+            }
+            else {
+                try {
+                    await deliverLateQuestionAnswer(auth, threadId, requestId, answer, cardMessage, bot, "call");
+                }
+                catch (error) {
+                    result = { ok: false, status: 409, error: error instanceof Error ? error.message : "The late answer could not be queued." };
+                }
+            }
+        }
+        else if (outcome === "unavailable") {
+            result = { ok: false, status: 409, error: "The request is no longer open." };
+        }
+        else if (behavior === "answer" && outcome !== "answered") {
+            result = { ok: false, status: 409, error: "The provider did not accept that answer. Try an offered option." };
+        }
+    }, "call");
+    return result;
+}
 /** Close every provider-owned approval still open on a thread. Interrupting a
  * turn kills the process that raised its questions, so those cards can never
  * be answered. Routine proposals are harness-owned and durable, so they stay
@@ -5177,6 +5381,12 @@ function closeOpenApprovals(threadId) {
             continue;
         if (card.routineRequest || card.skillRequest)
             continue;
+        if (isPersistentQuestionCard(card)) {
+            // Keep the durable card; its in-flight adapter mapping cannot survive
+            // turn cleanup, and the response route can resume it from the transcript.
+            askMessageByRequest.delete(`${threadId}:${card.requestId}`);
+            continue;
+        }
         store.patchMessage(threadId, message.id, { card: { ...card, answered: "unavailable", dismissed: true } });
         askMessageByRequest.delete(`${threadId}:${card.requestId}`);
     }
@@ -5238,6 +5448,9 @@ const ASK_BOT_TIMEOUT_MS = Math.max(5_000, Number(process.env.OMB_ASK_BOT_TIMEOU
 // free up and reassigns, and a chat round moves on with a chip that says so —
 // the wait ends as data, not as a dead room. Tests shrink it.
 const GROUP_GOAL_WAIT_MAX_MS = Math.max(1_000, Number(process.env.OMB_GOAL_WAIT_MAX_MS) || 30 * 60_000);
+// ADR-2 (#1651): the computer wait has its own ceiling, decoupled from the
+// room cap above, and the deadline parks the turn instead of failing it.
+const COMPUTER_WAIT_MAX_MS = Math.max(1_000, Number(process.env.OMB_COMPUTER_WAIT_MAX_MS) || 30 * 60_000);
 // Reassigning around a busy teammate is bounded too: after this many
 // exhausted waits in one run the team is blocked on availability, not stuck.
 const GROUP_GOAL_MAX_WAIT_EXHAUSTIONS = 3;
@@ -5256,8 +5469,8 @@ const watchdog = new TurnWatchdog({
         const bot = botForThread(turn.botId, turn.threadId);
         const routineRun = activeRoutineRunForThread(turn.threadId);
         const instance = bot
-            ? runningTurnInstance(bot, turn.threadId, routineRun?.runOn)
-            : routineRun?.runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") : null;
+            ? runningTurnInstance(bot, turn.threadId)
+            : runningTurnEngines.get(turn.threadId) ?? null;
         void instance?.adapter.interruptTurn(turn.threadId).catch(() => { });
         const minutes = Math.round(TURN_STALL_MS / 60_000);
         if (routineRun?.target === "bot") {
@@ -5328,6 +5541,7 @@ const watchdog = new TurnWatchdog({
                 // connector and credential continuations.
                 drainQueuedSends();
                 drainConnectorResumes();
+                drainComputerResumes();
                 drainSecretResumes();
                 drainTeamSetupResumes();
             }
@@ -5990,10 +6204,29 @@ async function attachTeamBoat(computer, botId, owner, canMount, remoteAgent) {
         !turnResources.owns(`computer:box:${machine.id}`, owner))
         throw new Error("This computer turn ended while its machine was starting");
     return {
-        integration: { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(botId, owner.threadId, owner.generation) },
+        mount: cloudComputerMount(botId, owner, machine.id, remoteAgent),
         capture: () => boat.screenshotBoat(cfg, ownerId, machine.id),
     };
 }
+/** How a turn's engine reaches a cloud computer. The Computer engine runs its
+ * whole turn on the Boat. Every other engine keeps its own model and sign-in
+ * and gets the Boat as one more stdio computer server (harness-mcp-proxy
+ * computer), in the same slot a Local VM or VPS uses: one mechanism on a
+ * desktop, a headless server and an OMB Cloud. The agent process holds only a
+ * turn-scoped capability naming this Boat, never a Boat credential. */
+function cloudComputerMount(botId, owner, boxId, remoteAgent) {
+    if (remoteAgent)
+        return { computer: { kind: "box", boxId } };
+    const control = controlIntegration(botId, owner.threadId, owner.generation, undefined, boxId);
+    return {
+        localComputer: {
+            command: process.execPath,
+            args: [SPAWNED_PROXIES.harnessMcp, "computer"],
+            env: { ...AGENTS_NODE_FLAG, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`, OMB_MCP_TOKEN: control.token },
+            platform: "linux",
+        },
+    };
+}
 /** "Works on: This computer", strict. One mount for a bot thread and a group
  * chat, so the two cannot drift on what they check or how they fail. */
 async function mountHostComputer(owner, botId, providerSupportsLocal) {
@@ -6095,9 +6328,7 @@ async function attachBotBoat(bot, owner, opts) {
     await bindTurnComputer(owner, `computer:box:${machine.id}`, opts.remoteAgent);
     return {
         capture: () => boat.screenshotBoat(cfg, bot.id, machine.id),
-        integration: opts.canMount
-            ? { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(bot.id, owner.threadId, owner.generation) }
-            : null,
+        mount: opts.canMount ? cloudComputerMount(bot.id, owner, machine.id, opts.remoteAgent) : null,
     };
 }
 function managedBoatOwners() {
@@ -6174,17 +6405,6 @@ function turnProvider(bot, runOn, threadId) {
         return "box";
     return bot.cloudBackend === "vps" ? "vps" : wants === "cloud" ? "box" : null;
 }
-/** A driver with a Boat bridge keeps the selected model. Other engines use
- * Boat's native runner. Start and interrupt must resolve the same owner. */
-function turnInstance(bot, runOn, threadId) {
-    const selected = registry.get(bot.modelSelection.instanceId);
-    if (selected?.adapter.capabilities.cloudComputerMcp)
-        return selected;
-    const onBoat = turnProvider(bot, runOn, threadId) === "box";
-    return onBoat
-        ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
-        : registry.get(bot.modelSelection.instanceId);
-}
 /** Preview requests carry the selected conversation, not whichever thread
  * happens to be the bot's default. A query never grants lifecycle authority. */
 function computerPreviewBot(botId, url) {
@@ -6252,7 +6472,7 @@ async function selectableComputers(bot) {
                     canCreate = Boolean(status?.configured && status.daemonUp && status.container === "missing");
                     reason = status?.problem ?? reason;
                 }
-                else if (boat.boatConfigured(cfg) && (caps?.usesCloudComputer === true || registry.instances().some(instance => instance.driverKind === "boxAgent"))) {
+                else if (boat.boatConfigured(cfg) && caps !== undefined && usesCloudComputer(caps)) {
                     const status = await boat.boatStatus(cfg, bot.id);
                     const lifecycle = boat.boatTurnLifecycleAction({ explicitCloud: true, canMount: true, state: status.box?.state ?? null });
                     ready = lifecycle === "attach";
@@ -6331,8 +6551,9 @@ function continueComputerSelection(threadId, generation, succeeded) {
 /** The engine that dispatched each live turn. A bot's settings may change
  * mid-turn; an interrupt or steer must reach the engine actually running. */
 const runningTurnEngines = new Map();
-function runningTurnInstance(bot, threadId, runOn) {
-    return runningTurnEngines.get(threadId) ?? turnInstance(bot, runOn, threadId);
+function runningTurnInstance(bot, threadId) {
+    // A turn always runs on the bot's own engine, wherever it works.
+    return runningTurnEngines.get(threadId) ?? registry.get(bot.modelSelection.instanceId);
 }
 function providerTransitionForTurn(bot, runOn, threadId) {
     const provider = turnProvider(bot, runOn, threadId);
@@ -6719,8 +6940,23 @@ bus.subscribe((event) => {
                     // they cannot keep a quiet seat held.
                     if (touches && surface === "computer") {
                         const computer = turnComputerResources.get(event.threadId);
-                        if (computer)
+                        if (computer) {
+                            // A quiet window cannot expire while this call executes.
+                            turnResources.endComputerCall(computer.resource, computer.owner);
                             turnResources.activity(computer.resource, computer.owner);
+                        }
+                        else {
+                            // The call never forwarded onto a bound desktop, or the lazy
+                            // bind never landed: drop its pending start so it cannot
+                            // fence a claim taken later (#1653).
+                            const pending = pendingComputerCallStarts.get(event.threadId);
+                            if (pending) {
+                                if (pending.count > 1)
+                                    pendingComputerCallStarts.set(event.threadId, { ...pending, count: pending.count - 1 });
+                                else
+                                    pendingComputerCallStarts.delete(event.threadId);
+                            }
+                        }
                         // Real cloud-screen work refreshes the #1655 idle stop for
                         // that seat; the poller's own frames never arrive here, so
                         // preview traffic cannot keep a paid machine awake.
@@ -6752,6 +6988,26 @@ bus.subscribe((event) => {
                 });
                 if (event.itemId)
                     toolMessageByItem.set(`${event.threadId}:${event.itemId}`, message.id);
+                // A screen-touching computer tool opening is an in-flight call on
+                // that turn's claim (#1653): the seat cannot be idle-released out
+                // from under I/O the desktop is still executing. Its completion —
+                // or the turn settling — drops the fence.
+                if (screenTouchingTool(name) && screenSurfaceForTool(name) === "computer") {
+                    const computer = turnComputerResources.get(event.threadId);
+                    if (computer) {
+                        turnResources.beginComputerCall(computer.resource, computer.owner);
+                    }
+                    else {
+                        // A lazy attach (#1361) may not have seated the claim yet: the
+                        // gate finishes the bind before the call forwards, so hold the
+                        // start here and let bindTurnComputer fence the fresh claim.
+                        const generation = activeInternalGenerationByThread.get(event.threadId);
+                        if (generation) {
+                            const pending = pendingComputerCallStarts.get(event.threadId);
+                            pendingComputerCallStarts.set(event.threadId, pending?.generation === generation ? { generation, count: pending.count + 1 } : { generation, count: 1 });
+                        }
+                    }
+                }
             }
             break;
         case "request.opened": {
@@ -6872,6 +7128,7 @@ bus.subscribe((event) => {
                     subtitle: event.summary,
                     options: event.choices?.length ? event.choices : permission ? ["Allow", "Deny"] : [],
                     requestId: event.requestId,
+                    requestType: permission ? "permission" : "question",
                     tool: permission ? event.tool : undefined,
                     questionRequest: questions
                         ? { version: 1, questions, ...(event.origin === "output" ? { origin: "output" } : {}) }
@@ -6939,9 +7196,15 @@ bus.subscribe((event) => {
             if (messageId) {
                 const existing = store.messagesFor(event.threadId).find((m) => m.id === messageId);
                 if (existing?.card && !existing.card.answered) {
-                    store.patchMessage(event.threadId, messageId, {
-                        card: { ...existing.card, answered: event.behavior, dismissed: event.source !== "user" },
-                    });
+                    if (shouldSettleRequestCard(existing.card, event.source)) {
+                        store.patchMessage(event.threadId, messageId, {
+                            card: {
+                                ...existing.card,
+                                answered: event.behavior,
+                                dismissed: isPersistentQuestionCard(existing.card) ? false : event.source !== "user",
+                            },
+                        });
+                    }
                 }
                 if (event.requestId)
                     askMessageByRequest.delete(`${event.threadId}:${event.requestId}`);
@@ -7069,9 +7332,13 @@ bus.subscribe((event) => {
             // interrupted the turn; Claude settles that interrupt as
             // exit_before_result, not "interrupted", so this generation's marker
             // keeps the same failure from reporting a second incident.
+            // A turn parked at the computer ceiling (#1651) settles itself the
+            // same way: interrupted for a resume, not broken.
             const lazyClaimAlreadyReported = event.stopReason === "exit_before_result" &&
                 turnResourceOwners.get(event.threadId)?.lazyClaimFailureReported === true;
-            if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !routines?.runForThread(event.threadId)) {
+            const computerParked = event.stopReason === "exit_before_result" &&
+                turnResourceOwners.get(event.threadId)?.computerParkedOn !== undefined;
+            if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !computerParked && !routines?.runForThread(event.threadId)) {
                 const broken = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
                 if (broken)
                     reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: event.stopReason?.trim() || "the run ended without a result" });
@@ -7101,7 +7368,7 @@ bus.subscribe((event) => {
                     if (!isCurrent())
                         return;
                     if (store.taskByThread(bot.id, event.threadId)?.activity !== "dead") {
-                        store.setTaskActivity(bot.id, event.threadId, "idle");
+                        store.setTaskActivity(bot.id, event.threadId, resourceOwner?.computerParkedOn !== undefined ? "parked.computer" : "idle");
                     }
                     directTurnBots.delete(event.threadId);
                     if (continueComputerSelection(event.threadId, generation, event.ok))
@@ -7112,6 +7379,7 @@ bus.subscribe((event) => {
                         retryDelegationsWaitingOn(bot.id);
                         drainQueuedSends();
                         drainConnectorResumes();
+                        drainComputerResumes();
                         drainSecretResumes();
                         drainTeamSetupResumes();
                         drainDelegationWakes();
@@ -7495,7 +7763,7 @@ function markTaskContextExternallyUpdated(bot, threadId) {
     const owner = task.lastInstanceId;
     const record = owner ? task.handedMessages?.[owner] : undefined;
     if (owner && record?.session !== undefined && record.session === task.resumeCursors[owner] &&
-        turnInstance(botForThread(bot.id, threadId) ?? bot, undefined, threadId)?.instanceId === owner &&
+        (botForThread(bot.id, threadId) ?? bot).modelSelection.instanceId === owner &&
         registry.get(owner)?.adapter.capabilities.strictResume) {
         store.patchTask(bot.id, threadId, { unread: true });
         return;
@@ -7619,7 +7887,7 @@ function finalizeDelegationWatch(threadId, ok, reply = "", failureName = "Delega
     const source = watched.sourceBotId
         ? store.bot(watched.sourceBotId)
         : (watched.sourceThreadId ? store.botByThread(watched.sourceThreadId) : undefined);
-    if (source && target && !canReachPeer(source, target)) {
+    if (!watched.oneWay && source && target && !canReachPeer(source, target)) {
         ok = false;
         reply = "";
         failureName = "Result withheld: team or peer access changed while the teammate was working";
@@ -7637,6 +7905,16 @@ function finalizeDelegationWatch(threadId, ok, reply = "", failureName = "Delega
             result: ok ? reply : failureName,
         });
     }
+    if (watched.oneWay) {
+        if (!ok && store.taskByThread(watched.toBotId, threadId)) {
+            store.appendMessage(threadId, {
+                role: "bot",
+                kind: "activity",
+                tool: { name: `Send failed — ${failureName}`, ok: false, ...(watched.taskId ? { handoffId: watched.taskId } : {}) },
+            });
+        }
+        return true;
+    }
     let channel = watched.channelId ? store.group(watched.channelId) : undefined;
     let terminalThreadId = watched.sourceThreadId;
     if (source && watched.sourceThreadId) {
@@ -7780,7 +8058,7 @@ bus.subscribe((event) => {
 /** How a drained delegation becomes a real turn on the target. Shared by
  * the settle-time drain and the boot-time drain of what a previous process
  * left queued. */
-const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel, taskId, sourceBotId, openedThreadId) => {
+const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel, taskId, sourceBotId, openedThreadId, oneWay) => {
     // startTurn REJECTS on an ordinary condition — busy target, deleted bot,
     // unavailable provider. Unhandled, that rejection is fatal to the
     // harness (Node's default), which in the packaged app kills the server
@@ -7801,7 +8079,7 @@ const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel,
         ? { botId: opener.id, name: opener.name, unattended: unattended || undefined }
         : undefined;
     const text = openedThreadId && opener
-        ? withPeerProvenance(rawText, { botName: opener.name, delivery: "start_thread", unattended })
+        ? withPeerProvenance(rawText, { botName: opener.name, delivery: oneWay ? "send_to_bot" : "start_thread", unattended })
         : rawText;
     if (targetThreadId) {
         delegationWatch.set(targetThreadId, {
@@ -7813,6 +8091,7 @@ const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel,
             sourceBotId,
             routineRunId: activeRoutineRunForThread(sourceThreadId)?.id,
             startedAtMs: Date.now(),
+            ...(oneWay ? { oneWay: true } : {}),
         });
     }
     let failureReported = false;
@@ -7898,8 +8177,7 @@ bus.subscribe((event) => {
     // that turn queued to run anyway, minutes later, on an unrelated turn.
     if (!event.ok)
         discardDelegations(commsBus, event.threadId);
-    else
-        drainThreadDelegations(event.threadId);
+    drainThreadDelegations(event.threadId);
     // A settling bot frees itself as a delegation TARGET too: handoffs that
     // found it busy earlier were kept queued — waiting until it's free or the
     // 24-hour expiry, not counting retries — on their own source threads, and
@@ -8020,7 +8298,7 @@ function drainAsideLane() {
 }
 /** Keep a person's words off the transcript until a direct-thread slot is
  * available. Reuse the existing cancellable, idempotent composer queue. */
-async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger) {
+async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger, via) {
     const decision = admit("direct", {}, {
         // A room turn holds the bot exactly like the sibling opened-thread queue
         // below: the drain's own block check waits it out, so the words queue
@@ -8038,12 +8316,235 @@ async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId,
             prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
             sender,
             trigger,
+            via,
         });
         return { ok: true, queued: true, queueId: queued.id, threadId, reason: decision.reason };
     }
-    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender, trigger });
+    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender, trigger, via });
     return { ok: true, threadId, message };
 }
+/** Refusal from acceptDirectSend: the route turns it into its HTTP answer. */
+class DirectSendRefused extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(typeof body.error === "string" ? body.error : "send refused");
+        this.status = status;
+        this.body = body;
+    }
+}
+/** The refusals a direct send meets before it is sequenced, or null. */
+function directSendRefusal(botId, threadId) {
+    // The send is acknowledged before the turn starts, so a workspace at its
+    // spend limit is refused here, where the person can see it.
+    try {
+        assertWithinBudget(cfg, DATA_DIR);
+    }
+    catch (error) {
+        return new DirectSendRefused(409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
+    }
+    if (!store.taskByThread(botId, threadId)) {
+        return new DirectSendRefused(409, { error: "the bot switched tasks before it could receive the message" });
+    }
+    return null;
+}
+/** The one path a person's direct message takes into a bot turn: spend cap,
+ * idempotency, steer into a running turn, queue, or start. Used by
+ * POST /api/bots/:id/messages and by Live calls (via "call").
+ * `guardedStart` is POST /api/bots/:id/messages/guarded's own start, in
+ * place of steer, queue or start: it checks its preconditions against the
+ * task as it stands, then starts a turn or refuses. */
+async function acceptDirectSend(input, guardedStart) {
+    const { botId, threadId, text, sendId, replyTo, sender, trigger, via, personPresent } = input;
+    const refused = directSendRefusal(botId, threadId);
+    if (refused)
+        throw refused;
+    return sendSequencer.run(sendId ? `bot:${botId}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id), async () => {
+        if (sendId) {
+            if (cancelledChatFollowup("bot", botId, threadId, sendId)) {
+                throw Object.assign(new Error("this queued sendId was cancelled; send a new message to try again"), { status: 409 });
+            }
+            const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id);
+            if (accepted.kind === "conflict") {
+                throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
+            }
+            if (accepted.kind === "match") {
+                const canonical = {
+                    ok: true,
+                    threadId,
+                    message: accepted.message,
+                };
+                return accepted.message.steered
+                    ? { ...canonical, steered: true }
+                    : canonical;
+            }
+            const queued = queuedSteeredMessage(botId, threadId, sendId);
+            if (queued) {
+                if (queued.text !== text || queued.replyToId !== replyTo?.id) {
+                    throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
+                }
+                return { ok: true, queued: true, queueId: queued.id, threadId, reason: queued.reason };
+            }
+        }
+        const currentAtStart = store.projectBotForTask(botId, threadId);
+        if (!currentAtStart)
+            throw Object.assign(new Error("no such bot"), { status: 404 });
+        if (!store.taskByThread(currentAtStart.id, threadId)) {
+            throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
+        }
+        if (guardedStart)
+            return guardedStart(currentAtStart);
+        // Claude can accept the message inside its live turn. If the write
+        // loses a race with turn settlement, or the engine cannot steer, the
+        // existing server-side queue records it atomically for the next turn.
+        if (currentAtStart.busy) {
+            const instance = runningTurnInstance(currentAtStart, threadId);
+            let steered = "refused";
+            // A live text steer has no image side channel. Keep an attachment
+            // message intact for the next ordinary turn, where central image
+            // admission can hand it to the provider natively.
+            const carriesImages = extractTurnImages(text).images.length > 0;
+            const steerTarget = handoffs.current(threadId);
+            const busyAdmission = admit("direct-busy", {
+                carriesImages,
+                pendingComputerSelection: Boolean(computerSelectionTurns.get(threadId)?.selected),
+                engineCanSteer: Boolean(instance?.adapter.capabilities.queueing && instance.adapter.steer),
+            });
+            // steer was offered only when a live instance could take it;
+            // the second check carries that fact to the type system.
+            if (busyAdmission.action === "steer" && instance?.adapter.steer) {
+                steered = await instance.adapter
+                    .steer(threadId, promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"))
+                    .catch(() => "indeterminate");
+            }
+            // steer() is awaited adapter work. The turn can settle, the task can
+            // switch, or the whole bot can be deleted before its acknowledgement
+            // arrives. Re-read every ownership invariant before appending even a
+            // successful steer; otherwise that late acknowledgement writes a user
+            // message into a task the bot no longer owns. A conflict leaves the
+            // text in the client's composer/outbox to resend deliberately.
+            const current = store.projectBotForTask(botId, threadId);
+            if (!current)
+                throw Object.assign(new Error("no such bot"), { status: 404 });
+            if (!store.taskByThread(botId, threadId)) {
+                throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
+            }
+            const delivered = steered !== "refused";
+            if (delivered) {
+                if (steered === "steered" && !current.busy) {
+                    throw Object.assign(new Error("the running turn ended before the steered message could be recorded"), { status: 409 });
+                }
+                // "indeterminate" falls through to the same record: the words
+                // may already be folded into a turn whose acknowledgement was
+                // lost, and handing them back for a resend could run them
+                // twice. Recording them once is the honest outcome.
+                // A person steering a webhook turn is present, and auto mode may
+                // follow them again; words that do not prove a person never lift it.
+                if (personPresent)
+                    clearUnattended(threadId);
+                const message = store.appendMessage(threadId, {
+                    role: "user",
+                    kind: "text",
+                    text,
+                    replyToId: replyTo?.id,
+                    sendId,
+                    steered: true,
+                    sender,
+                    ...(via ? { via } : {}),
+                });
+                // Offered to the next turn again unless the person stops this one.
+                handoffs.steered(threadId, steerTarget, instance?.instanceId, message.id);
+                return { ok: true, steered: true, threadId, message };
+            }
+            if (!current.busy) {
+                return startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger, via);
+            }
+            const queued = queueSteeredMessage(current.id, threadId, text, {
+                replyToId: replyTo?.id,
+                sendId,
+                prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
+                sender,
+                trigger,
+                via,
+            });
+            return { ok: true, queued: true, queueId: queued.id, threadId };
+        }
+        return startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger, via);
+    });
+}
+/** A provider can finish its run before the owner answers. Persist that answer
+ * as a normal reply and run/queue it against the original conversation. */
+async function deliverLateQuestionAnswer(auth, threadId, requestId, answer, cardMessage, owner, via) {
+    const group = store.groupByThread(threadId);
+    const roomTarget = group
+        ? group.dm
+            ? group.threadId === threadId
+            : Boolean(store.groupTaskByThread(group.id, threadId))
+        : false;
+    if (group && (!roomTarget || !group.memberIds.includes(owner.id))) {
+        throw Object.assign(new Error("the bot that asked this question is no longer in this conversation"), { status: 409 });
+    }
+    if (!group && !store.taskByThread(owner.id, threadId)) {
+        throw Object.assign(new Error("the question's conversation no longer exists"), { status: 409 });
+    }
+    const text = group ? `@${owner.name}: ${answer}` : answer;
+    const sendId = `late-question-${createHash("sha256").update(`${threadId}:${requestId}`).digest("hex").slice(0, 32)}`;
+    const key = group
+        ? `group:${group.id}:${threadId}:${sendId}`
+        : `bot:${owner.id}:${threadId}:${sendId}`;
+    const receipt = await sendSequencer.run(key, sendFingerprint(text, cardMessage.id, group ? "chat" : undefined), async () => {
+        const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, cardMessage.id, group ? "chat" : undefined);
+        if (accepted.kind === "conflict")
+            throw Object.assign(new Error("this question already has a different recorded answer"), { status: 409 });
+        if (accepted.kind === "match")
+            return { queued: false };
+        const queuedDirect = group ? null : queuedSteeredMessage(owner.id, threadId, sendId);
+        if (queuedDirect) {
+            if (queuedDirect.text !== text || queuedDirect.replyToId !== cardMessage.id) {
+                throw Object.assign(new Error("this question already has a different queued answer"), { status: 409 });
+            }
+            return { queued: true };
+        }
+        const queuedRoom = group ? queuedChannelMessage(group.id, threadId, sendId) : null;
+        if (queuedRoom) {
+            if (queuedRoom.text !== text || queuedRoom.replyToId !== cardMessage.id || queuedRoom.mode !== "chat") {
+                throw Object.assign(new Error("this question already has a different queued answer"), { status: 409 });
+            }
+            return { queued: true };
+        }
+        const latestCard = store.messagesFor(threadId).find((message) => message.id === cardMessage.id)?.card;
+        if (!latestCard || latestCard.answered || latestCard.dismissed) {
+            throw Object.assign(new Error("this question has already been answered"), { status: 409 });
+        }
+        assertWithinBudget(cfg, DATA_DIR);
+        const sender = messageSender(auth);
+        const trigger = usageTriggerFor(auth);
+        if (group) {
+            const current = store.group(group.id);
+            if (!current || !roomTarget)
+                throw Object.assign(new Error("the room switched tasks before it could receive the answer"), { status: 409 });
+            if (groupIsWorking(current)) {
+                const queued = queueChannelMessage(current.id, threadId, text, {
+                    replyToId: cardMessage.id,
+                    sendId,
+                    mode: "chat",
+                    sender,
+                    trigger,
+                });
+                return { queued: true, queueId: queued.id };
+            }
+            startGroupTurn(current.id, text, cardMessage, sendId, "chat", undefined, { threadId, sender, trigger });
+            return { queued: false };
+        }
+        const direct = await startOrQueueDirectMessage(owner.id, threadId, text, cardMessage, sendId, sender, trigger, via);
+        return { queued: "queued" in direct && Boolean(direct.queued) };
+    });
+    const latest = store.messagesFor(threadId).find((message) => message.id === cardMessage.id)?.card;
+    if (latest && !latest.answered && !latest.dismissed) {
+        store.patchMessage(threadId, cardMessage.id, { card: { ...latest, answered: "answer", answeredText: answer, dismissed: false } });
+    }
+    return receipt;
+}
 /** How many start_thread calls one turn may make. Same spirit as the
  * create-bot ceiling above: a handful is a plan, more is a fan-out. */
 const MAX_THREADS_OPENED_PER_TURN = 5;
@@ -8320,15 +8821,14 @@ async function startTurn(botId, text, opts) {
     if (hostedModels && !hostedModels.allows(bot.modelSelection))
         throw Object.assign(new Error(hostedModels.error()), { status: 409 });
     const plan = turnSurfacePlan(bot, opts?.runOn, threadId);
-    const instance = turnInstance(bot, opts?.runOn, threadId);
+    const instance = registry.get(bot.modelSelection.instanceId);
     if (!instance) {
-        throw Object.assign(new Error(turnProvider(bot, opts?.runOn, threadId) === "box"
-            ? "the Cloud VM runner is unavailable — configure Boat in App Settings"
-            : `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
+        throw Object.assign(new Error(`provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
     }
     const policyRefusal = policyModelRefusal(instance);
     if (policyRefusal)
         throw Object.assign(new Error(policyRefusal), { status: 409, code: "managed_policy" });
+    const toolScope = toolScopeForTurn(bot.id);
     // On a Cloud home a guest's turn never gets a shell or reads outside its
     // own folder (docs/cloud-pro.md): an engine that cannot run it that way is
     // refused, in one plain line, before anything is recorded.
@@ -8371,18 +8871,24 @@ async function startTurn(botId, text, opts) {
                 .catch(() => undefined);
         }
     }
-    console.error(`[omb-turn] bot=${botId} text=${JSON.stringify(resolvedImages.text.slice(0, 70))} images=${turnImages.length} depth=${commsDepth} card=${Boolean(opts?.cardContinuation)}`);
+    // Spoken words never reach the log. A direct send says so itself; a
+    // drained queue (or a continuation) carries it on the user lines it runs.
+    const turnLineIds = new Set(opts?.excludeMessageIds ?? []);
+    const spoken = opts?.via === "call" || opts?.userMessage?.via === "call" ||
+        (turnLineIds.size > 0 && store.messagesFor(threadId).some((message) => turnLineIds.has(message.id) && message.via === "call"));
+    console.error(turnStartLogLine({
+        botId, text: resolvedImages.text, images: turnImages.length, depth: commsDepth, card: Boolean(opts?.cardContinuation), spoken,
+    }));
     const instanceId = instance.instanceId;
     if (providerInstancesChanging.has(instanceId)) {
         throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
     }
-    const switchedEngine = instance.instanceId !== bot.modelSelection.instanceId;
-    const useInstanceDefaults = switchedEngine || (opts?.runOn === "cloud" && !instance.adapter.capabilities.cloudComputerMcp);
-    const model = useInstanceDefaults ? instance.models.default : bot.modelSelection.model;
-    // A native cloud runner borrows its instance defaults; a Boat bridge keeps
-    // the bot's selected model, effort and variant.
-    const effort = useInstanceDefaults ? undefined : bot.modelSelection.effort;
-    const variant = useInstanceDefaults ? undefined : bot.modelSelection.variant;
+    // A turn always runs on the bot's own engine, model, effort and variant,
+    // wherever it works: a cloud computer is a tool it mounts, never a reason
+    // to swap the engine (the provider_not_configured incident).
+    const model = bot.modelSelection.model;
+    const effort = bot.modelSelection.effort;
+    const variant = bot.modelSelection.variant;
     assertModelVariantSupported({ variant, effort }, instance.adapter.capabilities);
     // A selection can be persisted while its engine is offline. Re-check when
     // the engine returns so an old or unsupported value never reaches a CLI.
@@ -8409,6 +8915,8 @@ async function startTurn(botId, text, opts) {
                 sendId: opts?.sendId,
                 peerAsk: opts?.peerAsk,
                 sender: opts?.sender,
+                ...(opts?.via ? { via: opts.via } : {}),
+                ...(opts?.relayed ? { relayed: true } : {}),
             });
     }
     const recoveryUserMessageId = opts?.coordination
@@ -8523,6 +9031,7 @@ async function startTurn(botId, text, opts) {
                 retryDelegationsWaitingOn(bot.id);
                 drainQueuedSends();
                 drainConnectorResumes();
+                drainComputerResumes();
                 drainSecretResumes();
                 drainTeamSetupResumes();
                 drainDelegationWakes();
@@ -8703,24 +9212,23 @@ async function startTurn(botId, text, opts) {
             }
             const privateWorkspace = worksInWorkspace ? ensureTaskWorkspace(bot.id, threadId) : undefined;
             const skillInstructions = renderSkillInstructions(selectedSkills, {
-                includeRoot: worksInWorkspace && opts?.runOn !== "cloud",
+                includeRoot: worksInWorkspace,
             });
             const packagePlaybooks = installedPlaybookInstructions(providerText, bot.playbooks);
             // An explicit working folder wins for new tasks; otherwise they use
             // the private bot workspace. A legacy task with an existing provider
             // session deliberately pins to null (the old home-folder behavior),
             // because moving a live session would break resume.
-            // A cloud run happens on the boat, where a host folder means nothing:
-            // pin the task to the default so the header chip never shows the
-            // bot's folder for a task that runs elsewhere.
-            if (opts?.runOn === "cloud")
-                store.pinTaskCwd(bot.id, threadId, undefined, { none: true });
+            // A cloud run keeps the bot's own engine on this host, with the cloud
+            // computer as one more tool, so it works in the same folder as any
+            // other turn (only the Computer engine runs on the Boat, and it has no
+            // workspace files).
             // On a Cloud home a conversation a guest opened is pinned to its own
             // folder when it first runs, not the bot's project folder the owner's
             // conversations share (what it leaves there reaches none of them). One
             // that ran before keeps its pin, unless the session that opened it was
             // revoked: then it was unpinned at boot (server/cloud-owner.ts).
-            const pinnedCwd = privateWorkspace && opts?.runOn !== "cloud"
+            const pinnedCwd = privateWorkspace
                 ? store.pinTaskCwd(bot.id, threadId, privateWorkspace, { privateOnly: cloudGuestOpened(threadId) })
                 : null;
             const cwd = pinnedCwd ?? undefined;
@@ -8737,8 +9245,8 @@ async function startTurn(botId, text, opts) {
             const dwebUrl = process.env.DWEB_URL?.trim();
             if (dwebUrl)
                 integrations.dweb = { url: dwebUrl };
-            // Cloud routines always use Boat/BoatAgent. The per-bot backend applies
-            // only to ordinary turns that mount a computer into the local agent.
+            // Cloud routines always use the bot's Boat. The per-bot backend applies
+            // only to ordinary turns.
             const teamComputer = inheritedTeamComputer(bot);
             const cloudBackend = teamComputer || opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
             const mountsComputerMcp = instance.adapter.capabilities.computerMcp === true;
@@ -8766,6 +9274,20 @@ async function startTurn(botId, text, opts) {
             const placeRefusal = wantedKind && computerPlaceRefusal(wantedKind);
             if (placeRefusal)
                 throw Object.assign(new Error(placeRefusal.message), { status: 409, code: placeRefusal.code });
+            // Where an explicit place came from, so its failure names the one
+            // control that changes it (and a failed Auto-recorded pin is cleared).
+            // Auto and a team's shared computer are nobody's per-turn choice.
+            const placeSource = teamComputer || wants === undefined || wants === "off" ? undefined
+                : opts?.runOn === "cloud" ? "routine"
+                    : plan.pinned ? (dispatchTask?.surfaceSource === "auto" ? "auto-pin" : "pin")
+                        : "works-on";
+            // An engine that cannot use the cloud computer is refused here, before
+            // anything is created or woken — never handed to another engine.
+            if (wants === "cloud" && placeSource) {
+                const unsupported = cloudPlaceDriverError(instance.adapter.capabilities, cloudBackend, placeSource);
+                if (unsupported)
+                    throw new PlaceUnavailableError("cloud", placeSource, unsupported);
+            }
             let previewCapture = null;
             let browserCapture = null;
             let computerKind = null;
@@ -8893,6 +9415,22 @@ async function startTurn(botId, text, opts) {
             const surfaceLazyClaimRejection = (label) => (failure) => {
                 if (activeInternalGenerationByThread.get(threadId) !== resourceOwner.generation || !threadBusy(bot.id, threadId))
                     return;
+                // The wait ceiling parked this turn (#1651): register the resume and
+                // settle the live turn. No error entry, no incident — the parked chip
+                // the wait appended is the whole story. The slot still fails, so the
+                // gate keeps refusing screen calls for the rest of this generation
+                // while the interrupt lands.
+                if (resourceOwner.computerParkedOn) {
+                    registerComputerResume({
+                        botId: bot.id,
+                        threadId,
+                        resource: resourceOwner.computerParkedOn,
+                        generation: resourceOwner.generation,
+                        afterMessageId: store.activePath(threadId).findLast((entry) => entry.role === "user")?.id,
+                    });
+                    void interruptDirectThread(bot.id, threadId, { preserveComputerResume: true }).catch(() => { });
+                    return;
+                }
                 const message = `computer unavailable — ${label} could not be claimed for this turn (${failure})`;
                 store.appendMessage(threadId, {
                     role: "bot",
@@ -8993,31 +9531,33 @@ async function startTurn(botId, text, opts) {
                     return true;
                 }
                 catch (error) {
-                    if (strict)
+                    // A wait ceiling settled this turn as parked, not as an unavailable
+                    // Auto destination. Let dispatch register its resume instead of
+                    // continuing the provider without the requested computer.
+                    if (strict || error instanceof ComputerWaitParked)
                         throw error;
                     if (directTurnGenerationByThread.get(threadId) === dispatchClaimId)
                         releaseLocalVmThread(threadId);
                     return false;
                 }
             };
-            if (wants === "vm") {
-                if (await attachLocalVm(true))
-                    computerKind = "vm";
-            }
-            else if (wants === "local") {
-                integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
-                computerKind = "local";
-            }
-            // A VPS is a local-agent computer mount, never a remote agent runner.
-            // Explicit Cloud may prepare/start it. Auto remains read-only unless
-            // the person explicitly opted this bot into remote lifecycle actions.
-            if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps") {
-                const unsupported = vps.vpsDriverError(instance.driverKind, mountsComputerMcp);
-                if (unsupported && wants === "cloud")
-                    throw new Error(unsupported);
-                if (unsupported && wants === undefined)
-                    autoVpsProblem = unsupported;
-                if (!unsupported) {
+            // An explicit place that cannot be attached fails the turn with its
+            // cause and the next action; it never quietly moves the work elsewhere.
+            try {
+                if (wants === "vm") {
+                    if (await attachLocalVm(true))
+                        computerKind = "vm";
+                }
+                else if (wants === "local") {
+                    integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
+                    computerKind = "local";
+                }
+                // A VPS is a local-agent computer mount, never a remote agent runner.
+                // Explicit Cloud may prepare/start it. Auto remains read-only unless
+                // the person explicitly opted this bot into remote lifecycle actions.
+                // On Auto an engine that cannot use a computer simply skips it.
+                if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps" &&
+                    !cloudPlaceDriverError(instance.adapter.capabilities, "vps")) {
                     // The VPS "computer" is the desktop inside this bot's managed
                     // container, and only screen work needs that desktop to itself.
                     // So the lease is claimed on the first computer call, through the
@@ -9055,34 +9595,40 @@ async function startTurn(botId, text, opts) {
                         autoVpsProblem = mounted.problem ?? "the VPS computer could not be reached";
                     }
                 }
-            }
-            // Cloud is strict when selected. Native Boat and drivers with a Boat
-            // bridge may also reuse an already-ready Boat on Auto.
-            if (teamComputer) {
-                const attached = await attachTeamBoat(teamComputer, bot.id, resourceOwner, instance.adapter.capabilities.usesCloudComputer === true, instance.adapter.capabilities.remoteAgent === true);
-                integrations.computer = attached.integration;
-                previewCapture = attached.capture;
-                computerKind = "box";
-            }
-            if (!teamComputer && instance.adapter.capabilities.usesCloudComputer === true && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && boat.boatConfigured(cfg)) {
-                const attached = await attachBotBoat(bot, resourceOwner, {
-                    explicitCloud: wants === "cloud",
-                    canMount: instance.adapter.capabilities.usesCloudComputer === true,
-                    remoteAgent: instance.adapter.capabilities.remoteAgent === true,
-                });
-                if (attached) {
+                // Cloud is strict when selected. Every engine that can use it may also
+                // reuse an already-ready Boat on Auto.
+                if (teamComputer) {
+                    const attached = await attachTeamBoat(teamComputer, bot.id, resourceOwner, usesCloudComputer(instance.adapter.capabilities), instance.adapter.capabilities.remoteAgent === true);
+                    Object.assign(integrations, attached.mount);
                     previewCapture = attached.capture;
-                    if (attached.integration) {
-                        integrations.computer = attached.integration;
-                        computerKind = "box";
+                    computerKind = "box";
+                }
+                if (!teamComputer && usesCloudComputer(instance.adapter.capabilities) && (wants === "cloud" || (wants === undefined && !computerPlaceRefusal("box"))) && cloudBackend === "box" && boat.boatConfigured(cfg)) {
+                    const attached = await attachBotBoat(bot, resourceOwner, {
+                        explicitCloud: wants === "cloud",
+                        canMount: usesCloudComputer(instance.adapter.capabilities),
+                        remoteAgent: instance.adapter.capabilities.remoteAgent === true,
+                    });
+                    if (attached) {
+                        previewCapture = attached.capture;
+                        if (attached.mount) {
+                            Object.assign(integrations, attached.mount);
+                            computerKind = "box";
+                        }
                     }
                 }
+                if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
+                    throw new Error(BOAT_NOT_CONFIGURED);
+                }
+                if (wants === "cloud" && cloudBackend === "box" && computerKind !== "box") {
+                    throw new Error("the cloud computer could not be created or reached");
+                }
             }
-            if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
-                throw new Error(BOAT_NOT_CONFIGURED);
-            }
-            if (wants === "cloud" && cloudBackend === "box" && !integrations.computer) {
-                throw new Error("the cloud computer could not be created or reached");
+            catch (error) {
+                if (!placeSource || wants === undefined || wants === "off" || error instanceof DirectTurnSetupCancelled ||
+                    error instanceof ComputerWaitParked || error instanceof PlaceUnavailableError)
+                    throw error;
+                throw placeUnavailable(wants, placeSource, error instanceof Error ? error.message : String(error));
             }
             // Auto-only host fallback. Electron owns cua-driver/TCC attribution;
             // the harness only reads its already-running connection descriptor.
@@ -9173,7 +9719,7 @@ async function startTurn(botId, text, opts) {
                 ? mentionedBots(providerText, sectionPeers)
                 : [];
             const coordinationPrompt = bot.chiefOfStaff
-                ? chiefOfStaffSystemPrompt(bot.id, store.bots, Boolean(integrations.agents), openMausStatusSystemPrompt(), boundedCoordination)
+                ? chiefOfStaffSystemPrompt(bot.id, store.bots, Boolean(integrations.agents), boundedCoordination)
                 : integrations.agents && sectionPeers.length > 0
                     // Ordinary bots could always CALL the peer tools; until now the
                     // one generic sentence they got never named a teammate, so the
@@ -9282,7 +9828,6 @@ async function startTurn(botId, text, opts) {
             const computerPromptKind = resolveComputerPromptKind({
                 kind: computerKind,
                 driverKind: instance.driverKind,
-                cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
                 vmPrivate: localVmMode(cfg) === "per-bot",
             });
             const coordinationNode = opts?.coordination ? roomHandoffs.nodes.get(opts.coordination.id) : undefined;
@@ -9295,14 +9840,14 @@ async function startTurn(botId, text, opts) {
                 // to a turn whose engine actually mounted them (setupMode is already
                 // false when they are not — see agentsMounted above)
                 { id: "setup", label: "Setup", text: setupSystemPrompt(setupMode, { skills: skillAuthoring, cwd: liveBot?.cwd ?? bot.cwd }) },
-                { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
+                { id: "files", label: "File locations", text: worksInWorkspace ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
                 { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
                 { id: "plan", label: "Surface", text: surfacePrompt({ computer: mountedComputer, browser: Boolean(integrations.browser) }, { pinned: plan.pinned, note: plan.note, canSelect: computerSelectionTurns.has(threadId), cloudHome: Boolean(CLOUD_HOME) }) },
                 { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
-                { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) : "" },
+                { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) + describeConnectorScopes((liveBot ?? bot).connectorScopes) : "" },
                 { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
                 { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
                 { id: "coordination", label: "Team", text: coordinationPrompt ? ` ${coordinationPrompt}` : "" },
@@ -9315,11 +9860,14 @@ async function startTurn(botId, text, opts) {
                 { id: "profile", label: "Profile changes", text: profilePrompt },
                 { id: "learn", label: "Skill authoring", text: learnPrompt },
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+                { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (integrations.agents ? TEAM_MEMORY_PROMPT : "") },
                 // what the bot said lately in its other conversations, so a task
                 // never redoes — or forgets — what another one already did
                 { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId, ...recentWorkFilter() })) },
                 { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace, enabled: bot.memoryEnabled !== false }) },
-                { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
+                // liveBot was captured before awaited setup work; an assignment PUT
+                // in that window must still reach this turn's prompt.
+                { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? (store.bot(bot.id)?.assignedSkills ?? bot.assignedSkills) : undefined) : "" },
                 { id: "skill-instructions", label: "Skill instructions", text: skillInstructions },
                 { id: "playbooks", label: "Playbooks", text: packagePlaybooks },
                 { id: "webhook", label: "Webhook provenance", text: opts?.automationSource === "webhook" ? WEBHOOK_PROMPT : "" },
@@ -9358,11 +9906,12 @@ async function startTurn(botId, text, opts) {
             const dispatch = await guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
                 botId: bot.id,
-                startupRecovery: cfg.automaticRecovery?.enabled === true && !opts?.automaticRecoveryAttempted,
+                startupRecovery: cfg.automaticRecovery?.enabled === true &&
+                    (opts?.automaticRecoveryIndex ?? 0) < ((liveBot ?? bot).fallback?.length || (cfg.automaticRecovery.backup ? 1 : 0)),
                 text: withRecalled(recalled, dispatchContext.turnText),
-                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(bot, commsDepth > 0, threadId),
+                toolScope,
                 ...(guestConfined ? { guestConfined: true, confinedWhy: confinedWhy(threadId) } : {}),
                 model,
                 effort,
@@ -9437,6 +9986,7 @@ async function startTurn(botId, text, opts) {
                 retryDelegationsWaitingOn(bot.id);
                 drainQueuedSends();
                 drainConnectorResumes();
+                drainComputerResumes();
                 drainSecretResumes();
                 drainTeamSetupResumes();
                 drainDelegationWakes();
@@ -9482,6 +10032,7 @@ async function startTurn(botId, text, opts) {
                 if (ownsLatestGeneration) {
                     drainQueuedSends();
                     drainConnectorResumes();
+                    drainComputerResumes();
                     drainSecretResumes();
                     drainTeamSetupResumes();
                     drainDelegationWakes();
@@ -9492,10 +10043,51 @@ async function startTurn(botId, text, opts) {
                 settleDirectFollowup(dispatchClaimId);
                 return;
             }
+            if (e instanceof ComputerWaitParked) {
+                settleDirectFollowup(dispatchClaimId, { ok: false, text: e.message });
+                registerComputerResume({
+                    botId: bot.id,
+                    threadId,
+                    resource: e.resource,
+                    generation: e.generation,
+                    afterMessageId: store.activePath(threadId).findLast((entry) => entry.role === "user")?.id,
+                });
+                // Settled as parked, not failed (#1651): the chip the wait appended
+                // is the whole transcript story, and the registered resume owns what
+                // happens next on this thread.
+                if (store.taskByThread(bot.id, threadId)?.activity !== "dead") {
+                    store.setTaskActivity(bot.id, threadId, "parked.computer");
+                }
+                directTurnBots.delete(threadId);
+                retryDelegationsWaitingOn(bot.id);
+                drainQueuedSends();
+                drainConnectorResumes();
+                drainComputerResumes();
+                drainSecretResumes();
+                drainTeamSetupResumes();
+                drainDelegationWakes();
+                return;
+            }
+            // A failed place never sticks. An Auto-recorded pin to it (a
+            // select_computer switch, or where an earlier Auto turn landed) is the
+            // machine's memory, not a choice: clear it so the next message runs on
+            // Auto. A person's pin stays, and the message names the composer.
+            if (e instanceof PlaceUnavailableError) {
+                const pinned = store.taskByThread(bot.id, threadId);
+                if (pinned?.surface === e.place && pinned.surfaceSource === "auto") {
+                    store.patchTask(bot.id, threadId, { surface: undefined, surfaceSource: undefined });
+                }
+            }
             let message = e instanceof Error ? e.message : String(e);
-            const backup = cfg.automaticRecovery?.enabled ? cfg.automaticRecovery.backup : undefined;
             const current = store.projectBotForTask(bot.id, threadId);
-            if (mayRecover && backup && current && !opts?.automaticRecoveryAttempted && (!opts?.cardContinuation || opts.coordination) &&
+            const backups = cfg.automaticRecovery?.enabled
+                ? current?.fallback?.length ? current.fallback : cfg.automaticRecovery.backup ? [cfg.automaticRecovery.backup] : []
+                : [];
+            const nextIndex = backups.findIndex((candidate, index) => index >= (opts?.automaticRecoveryIndex ?? 0) &&
+                registry.get(candidate.instanceId)?.enabled &&
+                (candidate.instanceId !== instanceId || candidate.model !== model));
+            const backup = backups[nextIndex];
+            if (mayRecover && backup && current && (!opts?.cardContinuation || opts.coordination) &&
                 !directRequestOwners.get(threadId)?.stopped && !hasQueuedSteeredMessages(bot.id, threadId) &&
                 JSON.stringify(current.modelSelection) === JSON.stringify(bot.modelSelection) &&
                 (backup.instanceId !== instanceId || backup.model !== model) &&
@@ -9519,7 +10111,7 @@ async function startTurn(botId, text, opts) {
                                 name: `recovery: Automatic recovery: ${instance.displayName || instance.driverKind} could not start. Trying ${target.displayName || target.driverKind} · ${checked.selection.model} once in this thread.`, ok: true,
                             } });
                         await startTurn(bot.id, text, { ...opts, threadId, userMessage, editedMessageId: undefined,
-                            automaticRecoveryAttempted: true });
+                            automaticRecoveryAttempted: true, automaticRecoveryIndex: nextIndex + 1 });
                         // The backup now owns these callbacks; don't publish a failed
                         // routine/peer result or release a queued receipt in between.
                         directFollowupSettlers.delete(dispatchClaimId);
@@ -9536,13 +10128,12 @@ async function startTurn(botId, text, opts) {
             settleDirectFollowup(dispatchClaimId, { ok: false, text: message });
             // The wait already wrote its failure resolution; keep all dispatch
             // failure bookkeeping below without adding the same error twice.
-            if (!(e instanceof ComputerWaitGaveUp))
-                store.appendMessage(threadId, {
-                    role: "bot",
-                    kind: "activity",
-                    turnSucceeded: false,
-                    tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
-                });
+            store.appendMessage(threadId, {
+                role: "bot",
+                kind: "activity",
+                turnSucceeded: false,
+                tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
+            });
             // Worth a buzz for the same reason a routine failure is, and the rule
             // notify.ts encodes: the bot is not working, and the cause is usually
             // a setting only a person can change — an unattended user would
@@ -9565,6 +10156,7 @@ async function startTurn(botId, text, opts) {
             // drain would strand anything queued behind this turn
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
             drainDelegationWakes();
@@ -9859,15 +10451,15 @@ routines = new RoutineManager({
             goalRunId: runId,
         });
     },
-    interruptTurn: async (botId, threadId, runOn) => {
+    interruptTurn: async (botId, threadId) => {
         const bot = botForThread(botId, threadId);
         pendingDelegationWakes.delete(threadId);
         discardDelegations(commsBus, threadId);
         cancelDirectTurnDispatch(botId, threadId);
         revokeInternalCapabilitiesForThread(threadId);
         const instance = bot
-            ? runningTurnInstance(bot, threadId, runOn)
-            : runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null : null;
+            ? runningTurnInstance(bot, threadId)
+            : runningTurnEngines.get(threadId) ?? null;
         try {
             await instance?.adapter.interruptTurn(threadId);
         }
@@ -10028,9 +10620,13 @@ async function cloudRoutineReadiness(botId, threadId) {
             reason: 'The Boat cloud computer needs a working Boat API key. For the bot’s configured computer, including a self-hosted VPS, set run_on="maus" instead.',
         };
     }
-    const instance = turnInstance(bot, "cloud", threadId);
+    const instance = registry.get(bot.modelSelection.instanceId);
     if (!instance)
-        return { ready: false, reason: "The Cloud VM runner is unavailable. Restart OpenMausBot and try again." };
+        return { ready: false, reason: "The target bot's model is unavailable. Choose another model in the bot's settings." };
+    // The same rule a cloud turn applies, before anything is provisioned.
+    const unsupported = cloudPlaceDriverError(instance.adapter.capabilities, "box");
+    if (unsupported)
+        return { ready: false, reason: "This model can't use a computer. Choose another model, or change where this routine runs." };
     try {
         if ((await instance.snapshot()).state !== "available") {
             return { ready: false, reason: "The target bot's model is not ready to use the Boat cloud computer." };
@@ -10323,6 +10919,69 @@ const validateModelProposal = (selection, current) => {
     }
     return null;
 };
+const teamMemory = new TeamMemory(join(DATA_DIR, "team-memory.json"));
+const outboundRequests = new OutboundRequestService();
+const outboundCounts = new OutboundCounts(join(DATA_DIR, "outbound-counts.json"));
+const OUTBOUND_HOLD_MS = 9 * 60_000;
+function resolveAndSendTrust(res, threadId, requestId, behavior) {
+    const teamMemoryCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.teamMemoryRequest);
+    if (teamMemoryCard?.card?.teamMemoryRequest) {
+        const request = teamMemoryCard.card.teamMemoryRequest;
+        const proposer = teamMemoryCard.from?.botId ? store.bot(teamMemoryCard.from.botId) : store.botByThread(threadId);
+        const result = teamMemory.resolve(request.section, request.entryId, behavior === "allow" ? "accept" : "reject");
+        if (!result.claimed) {
+            if (!teamMemoryCard.card.answered) {
+                store.patchMessage(threadId, teamMemoryCard.id, { card: { ...teamMemoryCard.card, answered: "unavailable", dismissed: true } });
+            }
+            json(res, 200, { ok: true, outcome: "unavailable" });
+            return true;
+        }
+        if (result.state === "already_settled") {
+            json(res, 200, { ok: true, outcome: "allowed-once", alreadySettled: true });
+            return true;
+        }
+        store.patchMessage(threadId, teamMemoryCard.id, {
+            card: { ...teamMemoryCard.card, answered: result.state === "accepted" ? "allow" : "deny" },
+        });
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId: proposer?.id, botName: proposer?.name,
+            tool: "propose_team_memory", summary: teamMemoryCard.card.subtitle,
+            decision: result.state === "accepted" ? "user-approved" : "user-denied", source: "user",
+        });
+        json(res, 200, { ok: true, outcome: result.state === "accepted" ? "allowed-once" : "rejected" });
+        return true;
+    }
+    const outboundCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.outboundRequest);
+    if (outboundCard?.card?.outboundRequest) {
+        const outboundBot = outboundCard.from?.botId ? store.bot(outboundCard.from.botId) : store.botByThread(threadId);
+        const result = outboundRequests.resolve({ threadId, requestId, behavior });
+        if (!result.claimed) {
+            // The hold is memory-only: after a restart the card outlives the
+            // relay that was waiting on it, so close it rather than leave an
+            // approval nobody can deliver owning the composer.
+            if (!outboundCard.card.answered) {
+                store.patchMessage(threadId, outboundCard.id, { card: { ...outboundCard.card, answered: "unavailable", dismissed: true } });
+            }
+            json(res, 200, { ok: true, outcome: "unavailable" });
+            return true;
+        }
+        if (result.state === "already_settled") {
+            json(res, 200, { ok: true, outcome: result.behavior === "allow" ? "allowed-once" : "rejected", alreadySettled: true });
+            return true;
+        }
+        store.patchMessage(threadId, outboundCard.id, {
+            card: { ...outboundCard.card, answered: result.state === "allowed" ? "allow" : "deny" },
+        });
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId: outboundBot?.id, botName: outboundBot?.name,
+            tool: outboundCard.card.tool, summary: outboundCard.card.subtitle,
+            decision: result.state === "allowed" ? "user-approved" : "user-denied", source: "user",
+        });
+        json(res, 200, { ok: true, outcome: result.state === "allowed" ? "allowed-once" : "rejected" });
+        return true;
+    }
+    return false;
+}
 const profileRequests = new ProfileRequestService({
     store,
     autoApply: fullAccessForSource,
@@ -10359,8 +11018,24 @@ const tighteningRequests = new TighteningRequestService({
     // The card judges the effective mounts, so the snapshot resolves the same
     // way the engine does: through the config-aware custom-server filter.
     mountedMcpServers: (bot) => Object.keys(engineMcpServers(bot)),
-    enabledSkills: (botId) => listSkills(botId).filter((skill) => skill.enabled).map((skill) => skill.name),
+    enabledSkills: (botId) => {
+        const record = store.bot(botId);
+        return (record ? listBotSkills(record) : listSkills(botId)).filter((skill) => skill.enabled).map((skill) => skill.name);
+    },
     disableSkill: (botId, name) => {
+        const record = store.bot(botId);
+        // Private skills win collisions, including disabled/private copies.
+        // Disabling one must not reveal a same-named shared skill instead.
+        if (skillsLibraryEnabled(cfg) && !listSkills(botId).some((skill) => skill.name === name)
+            && record?.assignedSkills?.includes(name)) {
+            try {
+                const saved = store.patchBot(botId, { assignedSkills: record.assignedSkills.filter((assigned) => assigned !== name) });
+                return saved ? { ok: true } : { ok: false, error: "that bot no longer exists" };
+            }
+            catch (error) {
+                return { ok: false, error: error instanceof Error ? error.message : String(error) };
+            }
+        }
         const disabled = setSkillEnabled(botId, name, false);
         return typeof disabled === "object" && "error" in disabled ? { ok: false, error: disabled.error } : { ok: true };
     },
@@ -10923,7 +11598,7 @@ setupRetry = 0) {
     const preparedApprovalMode = roomTurnApprovalMode(bot, threadId, orchestration);
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
-    const instance = turnInstance(bot);
+    const instance = registry.get(bot.modelSelection.instanceId);
     const userName = cfg.profile?.name?.trim() || "User";
     if (providerInstancesChanging.has(bot.modelSelection.instanceId)) {
         onDispatchError?.(`${bot.name}'s provider account is being updated — try again shortly`);
@@ -11096,13 +11771,14 @@ setupRetry = 0) {
         const readyBot = store.bot(bot.id);
         if (!readyBot)
             return false;
+        toolScopeForTurn(readyBot.id);
         const readyGroup = store.group(group.id);
         const stillOwnsThread = readyGroup?.dm
             ? readyGroup.threadId === threadId
             : Boolean(readyGroup && store.groupTaskByThread(readyGroup.id, threadId));
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
-        const setupChanged = turnInstance(readyBot) !== instance ||
+        const setupChanged = registry.get(readyBot.modelSelection.instanceId) !== instance ||
             roomTurnApprovalMode(readyBot, threadId, orchestration) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
@@ -11227,6 +11903,13 @@ setupRetry = 0) {
         if (roomPlan.computer === "local" && instance.adapter.capabilities.remoteAgent === true) {
             throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
         }
+        // The same one rule as a bot thread, before anything is provisioned: an
+        // engine that cannot use the cloud computer is refused, never swapped.
+        if (!roomTeamComputer && roomPlan.computer === "cloud") {
+            const unsupported = cloudPlaceDriverError(instance.adapter.capabilities, turnProvider(readyBot) === "vps" ? "vps" : "box");
+            if (unsupported)
+                throw new PlaceUnavailableError("cloud", "works-on", unsupported);
+        }
         // One place per room turn as well: a team computer reached on Auto means
         // no separate built-in browser.
         if (roomPlan.browser && !(roomPlan.computer === undefined && roomTeamComputer)) {
@@ -11245,11 +11928,11 @@ setupRetry = 0) {
             return false;
         }
         if (roomTeamComputer) {
-            const attached = await attachTeamBoat(roomTeamComputer, readyBot.id, resourceOwner, instance.adapter.capabilities.usesCloudComputer === true, instance.adapter.capabilities.remoteAgent === true);
+            const attached = await attachTeamBoat(roomTeamComputer, readyBot.id, resourceOwner, usesCloudComputer(instance.adapter.capabilities), instance.adapter.capabilities.remoteAgent === true);
             if (isCancelled?.() || groupSpeakers.get(threadId) !== roomSpeaker ||
                 activeInternalGenerationByThread.get(threadId) !== internalGeneration)
                 return false;
-            integrations.computer = attached.integration;
+            Object.assign(integrations, attached.mount);
             startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: instance.adapter.capabilities.remoteAgent === true });
         }
         // The speaker's own explicit place, mounted exactly as its bot thread
@@ -11258,89 +11941,99 @@ setupRetry = 0) {
         const roomSetupIsCurrent = () => !isCancelled?.() &&
             groupSpeakers.get(threadId) === roomSpeaker &&
             activeInternalGenerationByThread.get(threadId) === internalGeneration;
-        if (!roomTeamComputer && roomPlan.computer === "local") {
-            integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
-            if (!roomSetupIsCurrent())
-                return false;
-            roomComputerKind = "local";
-        }
-        if (!roomTeamComputer && roomPlan.computer === "cloud") {
-            if (turnProvider(readyBot) === "vps") {
-                const unsupported = vps.vpsDriverError(instance.driverKind, instance.adapter.capabilities.computerMcp === true);
-                if (unsupported)
-                    throw new Error(unsupported);
-                vpsThreadStarted(readyBot.id, threadId);
-                roomVpsBotId = readyBot.id;
-                const mounted = await mountBotVps(readyBot, resourceOwner, {
-                    start: true,
-                    onClaimed: (capture) => {
-                        if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
-                            roomScreenBotId = readyBot.id;
-                            startScreenPoller(readyBot.id, threadId, { computer: capture });
-                        }
-                    },
-                });
+        // An explicit place that cannot be attached fails the member's turn with
+        // its cause and the one setting that changes it.
+        try {
+            if (!roomTeamComputer && roomPlan.computer === "local") {
+                integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
                 if (!roomSetupIsCurrent())
                     return false;
-                if (!("integration" in mounted))
-                    throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
-                integrations.localComputer = mounted.integration;
-                roomComputerKind = "vps";
+                roomComputerKind = "local";
+            }
+            if (!roomTeamComputer && roomPlan.computer === "cloud") {
+                if (turnProvider(readyBot) === "vps") {
+                    vpsThreadStarted(readyBot.id, threadId);
+                    roomVpsBotId = readyBot.id;
+                    const mounted = await mountBotVps(readyBot, resourceOwner, {
+                        start: true,
+                        onClaimed: (capture) => {
+                            if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
+                                roomScreenBotId = readyBot.id;
+                                startScreenPoller(readyBot.id, threadId, { computer: capture });
+                            }
+                        },
+                    });
+                    if (!roomSetupIsCurrent())
+                        return false;
+                    if (!("integration" in mounted))
+                        throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
+                    integrations.localComputer = mounted.integration;
+                    roomComputerKind = "vps";
+                }
+                else {
+                    if (!boat.boatConfigured(cfg))
+                        throw new Error(BOAT_NOT_CONFIGURED);
+                    const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
+                    const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true,
+                        canMount: usesCloudComputer(instance.adapter.capabilities), remoteAgent });
+                    if (!roomSetupIsCurrent())
+                        return false;
+                    if (!attached?.mount)
+                        throw new Error("the cloud computer could not be created or reached");
+                    Object.assign(integrations, attached.mount);
+                    roomScreenBotId = readyBot.id;
+                    startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
+                    roomComputerKind = "box";
+                }
             }
-            else {
-                if (!boat.boatConfigured(cfg))
-                    throw new Error(BOAT_NOT_CONFIGURED);
-                const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
-                const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true,
-                    canMount: instance.adapter.capabilities.usesCloudComputer === true, remoteAgent });
-                if (!roomSetupIsCurrent())
+            // Room and Goal turns use the speaker's desktop, never the coordinator's.
+            // Claim the same lease as direct turns before asynchronous VM setup.
+            if (readyBot.computer === "vm") {
+                if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
+                    throw new Error("this model cannot use the Local VM");
+                }
+                // A distinct identity fences cleanup even in shared mode on the same room thread.
+                const target = { ...localVmTargetForThread(readyBot.id, threadId) };
+                await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
+                if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
+                    throw new Error("this Local VM is being started, stopped, or replaced");
+                }
+                if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
+                    throw new Error("this Local VM is already being used by another turn");
+                }
+                if (localVmMode(cfg) === "pool")
+                    localVmSeatPool.touch(threadId);
+                roomVmTarget = target;
+                localVmThreadTargets.set(threadId, target);
+                localVmActiveThreads.set(target.key, threadId);
+                localVmIdleFor(target).touch();
+                const setupIsCurrent = () => !isCancelled?.() &&
+                    groupSpeakers.get(threadId) === roomSpeaker &&
+                    activeInternalGenerationByThread.get(threadId) === internalGeneration &&
+                    store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
+                    store.bot(readyBot.id)?.busy === true &&
+                    store.group(readyGroup.id)?.busyBotId === readyBot.id;
+                const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
+                if (!setupIsCurrent()) {
                     return false;
-                if (!attached?.integration)
-                    throw new Error("the cloud computer could not be created or reached");
-                integrations.computer = attached.integration;
-                roomScreenBotId = readyBot.id;
-                startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
-                roomComputerKind = "box";
+                }
+                if (!vm.ready || !vm.runtime)
+                    throw new Error(vm.problem ?? "the Local VM is not ready");
+                const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
+                if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
+                    throw new Error("the Local VM lease expired while preparing the turn");
+                }
+                integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, target), target);
             }
         }
-        // Room and Goal turns use the speaker's desktop, never the coordinator's.
-        // Claim the same lease as direct turns before asynchronous VM setup.
-        if (readyBot.computer === "vm") {
-            if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
-                throw new Error("this model cannot use the Local VM");
-            }
-            // A distinct identity fences cleanup even in shared mode on the same room thread.
-            const target = { ...localVmTargetForThread(readyBot.id, threadId) };
-            await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
-            if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
-                throw new Error("this Local VM is being started, stopped, or replaced");
-            }
-            if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
-                throw new Error("this Local VM is already being used by another turn");
-            }
-            if (localVmMode(cfg) === "pool")
-                localVmSeatPool.touch(threadId);
-            roomVmTarget = target;
-            localVmThreadTargets.set(threadId, target);
-            localVmActiveThreads.set(target.key, threadId);
-            localVmIdleFor(target).touch();
-            const setupIsCurrent = () => !isCancelled?.() &&
-                groupSpeakers.get(threadId) === roomSpeaker &&
-                activeInternalGenerationByThread.get(threadId) === internalGeneration &&
-                store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
-                store.bot(readyBot.id)?.busy === true &&
-                store.group(readyGroup.id)?.busyBotId === readyBot.id;
-            const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
-            if (!setupIsCurrent()) {
-                return false;
-            }
-            if (!vm.ready || !vm.runtime)
-                throw new Error(vm.problem ?? "the Local VM is not ready");
-            const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
-            if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
-                throw new Error("the Local VM lease expired while preparing the turn");
-            }
-            integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, target), target);
+        catch (error) {
+            const place = roomPlan.computer;
+            if (place !== "cloud" && place !== "vm" && place !== "local")
+                throw error;
+            if (error instanceof DirectTurnSetupCancelled || error instanceof ComputerWaitParked || error instanceof PlaceUnavailableError)
+                throw error;
+            // A room row is not cut, so the cause keeps all its words.
+            throw placeUnavailable(place, "works-on", error instanceof Error ? error.message : String(error), Infinity);
         }
         const roster = readyGroup.memberIds
             .map((id) => store.bot(id))
@@ -11426,7 +12119,7 @@ setupRetry = 0) {
         const recentLines = recentWork(recentWorkSources(bot), bot, { userName, currentThreadId: threadId, ...recentWorkFilter() });
         const roomComputerPromptKind = resolveComputerPromptKind({
             kind: roomTeamComputer || roomComputerKind === "box" ? "box" : roomVmTarget ? "vm" : roomComputerKind,
-            driverKind: instance.driverKind, cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
+            driverKind: instance.driverKind,
             vmPrivate: localVmMode(cfg) === "per-bot",
         });
         {
@@ -11452,13 +12145,16 @@ setupRetry = 0) {
             { id: "recall", label: "Recall", text: integrations.agents && bot.memoryEnabled !== false ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
             { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+            { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (integrations.agents ? TEAM_MEMORY_PROMPT : "") },
             // the room path has always put a newline before memory and trimmed
             // the block's leading space; keep that so existing prompts are
             // byte-identical. The write guidance follows the tools actually
             // mounted, exactly as the 1:1 path decides it: memory_update is on the
             // agents server, so a room turn with it must be told to use it too.
             { id: "memory", label: "Memory", text: roomMemory ? `\n${roomMemory.trim()}` : "" },
-            { id: "skills", label: "Skills index", text: workspace ? skillsSystemPrompt(bot.id) : "" },
+            // readyBot was captured before awaited setup work; an assignment PUT in
+            // that window must still reach this turn's prompt.
+            { id: "skills", label: "Skills index", text: workspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? (store.bot(bot.id)?.assignedSkills ?? bot.assignedSkills) : undefined) : "" },
             { id: "skill-instructions", label: "Skill instructions", text: renderSkillInstructions(selectedSkills, { includeRoot: Boolean(workspace) }) },
             { id: "playbooks", label: "Playbooks", text: installedPlaybookInstructions(text, bot.playbooks) },
         ]);
@@ -11582,9 +12278,9 @@ setupRetry = 0) {
                 threadId,
                 botId: readyBot.id,
                 text: withRecalled(roomRecalled, text),
-                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: roomTurnApprovalMode(readyBot, threadId, orchestration),
+                toolScope: toolScopeForTurn(readyBot.id),
                 ...(roomGuestConfined ? { guestConfined: true, confinedWhy: confinedWhy(threadId) } : {}),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
@@ -11667,6 +12363,7 @@ setupRetry = 0) {
             watchdog.settle(threadId);
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
             return false;
@@ -11697,6 +12394,7 @@ setupRetry = 0) {
                     retryDelegationsWaitingOn(bot.id);
                     drainQueuedSends();
                     drainConnectorResumes();
+                    drainComputerResumes();
                     drainSecretResumes();
                     drainTeamSetupResumes();
                 }
@@ -11725,6 +12423,7 @@ setupRetry = 0) {
             // queued while this bot briefly owned the room must be retried now.
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
         }
@@ -11790,15 +12489,35 @@ setupRetry = 0) {
             return false;
         const isSpendCap = typeof error === "object" && error !== null && error.code === "spend_cap";
         const isVariantError = typeof error === "object" && error !== null && error.code === "unsupported_model_variant";
-        if (!roomSpeaker && !isSpendCap && !isVariantError)
+        const isToolScopeError = typeof error === "object" && error !== null && error.code === "tool_scope";
+        if (error instanceof ComputerWaitParked) {
+            registerComputerResume({
+                botId: bot.id,
+                threadId,
+                resource: error.resource,
+                generation: error.generation,
+                afterMessageId: store.activePath(threadId).findLast((entry) => entry.role === "user")?.id,
+            });
+            // The room settles with the parked chip the wait appended (#1651);
+            // the registered resume re-runs the speaker turn through the group
+            // queue once the seat frees. "parked" is its own outcome, not "busy":
+            // the member never ran, an in-step retry would only wait the ceiling
+            // out again and burn goal turns, and the goal loop routes around the
+            // member while the registered resume owns the re-run.
+            if (orchestration) {
+                orchestration.result.outcome = "parked";
+                orchestration.result.stopReason = `${bot.name} parked waiting for the computer`;
+            }
+            return false;
+        }
+        if (!roomSpeaker && !isSpendCap && !isVariantError && !isToolScopeError)
             throw error;
         const message = error instanceof Error ? error.message : "Local VM setup failed";
-        if (!(error instanceof ComputerWaitGaveUp))
-            store.appendMessage(threadId, {
-                role: "bot", kind: "activity",
-                from: { botId: bot.id, name: bot.name, color: bot.color },
-                tool: { name: `error: ${message}`, ok: false },
-            });
+        store.appendMessage(threadId, {
+            role: "bot", kind: "activity",
+            from: { botId: bot.id, name: bot.name, color: bot.color },
+            tool: { name: `error: ${message}`, ok: false },
+        });
         onDispatchError?.(message);
         if (orchestration) {
             // A spend-cap refusal is deterministic: record it as its own
@@ -11808,7 +12527,7 @@ setupRetry = 0) {
             if (isSpendCap)
                 orchestration.result.stopReason = message;
         }
-        return false;
+        return isToolScopeError;
     }
     finally {
         // Covers connector/setup failures, cancellation before dispatch, and all
@@ -11829,6 +12548,7 @@ setupRetry = 0) {
             }
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
         }
@@ -11887,6 +12607,12 @@ async function runGroupGoalStep(args) {
                         coordinatorTurn.turnId = turnId;
                 },
             });
+            // Busy here is a lost claim race — a 1:1 re-claiming the bot between
+            // the wait settling and this turn starting — so wait and retry
+            // in-step. A parked member is deliberately absent from both this
+            // retry and the transient one below: the computer seat is still held,
+            // an immediate retry would wait the ceiling out again while the
+            // registered resume already owns re-running the member.
             if (result.outcome === "busy")
                 continue;
             // One retry for a transient provider failure: a 13-turn goal must not
@@ -11990,6 +12716,13 @@ async function runGroupGoalOperation(args) {
             finishGroupGoalRun(args.groupId, args.operation, "blocked", `${coordinatorResult.stopReason ?? `${args.coordinator.name} stayed busy`} — send the goal again when they are free.`);
             return;
         }
+        if (coordinatorResult.outcome === "parked") {
+            // The lead parked at the computer wait ceiling: like lead-busy, the
+            // run cannot route around them, but the parked lead turn itself
+            // resumes through the registered entry once the seat frees.
+            finishGroupGoalRun(args.groupId, args.operation, "blocked", `${coordinatorResult.stopReason ?? `${args.coordinator.name} parked waiting for the computer`} — send the goal again when the computer is free.`);
+            return;
+        }
         if (!coordinatorResult.ran || coordinatorResult.outcome !== "settled") {
             const reason = coordinatorResult.stopReason?.trim().slice(0, 120);
             finishGroupGoalRun(args.groupId, args.operation, "failed", `${args.coordinator.name} could not complete the coordination step${reason ? ` — ${reason}` : ""}.`);
@@ -12047,9 +12780,10 @@ async function runGroupGoalOperation(args) {
             finishGroupGoalRun(args.groupId, args.operation, "blocked", workerResult.stopReason ?? `${workerBot.name} hit the workspace spend cap.`);
             return;
         }
-        if (workerResult.outcome === "busy") {
-            // bounded: a team that keeps landing on busy teammates is blocked, not
-            // looping — three exhausted waits per run, then stop and say so
+        if (workerResult.outcome === "busy" || workerResult.outcome === "parked") {
+            // bounded: a team that keeps landing on busy or computer-parked
+            // teammates is blocked, not looping — three exhausted waits per run,
+            // then stop and say so
             waitExhaustions += 1;
             if (waitExhaustions >= GROUP_GOAL_MAX_WAIT_EXHAUSTIONS) {
                 finishGroupGoalRun(args.groupId, args.operation, "blocked", `Teammates stayed busy past the wait limit ${waitExhaustions} times — try again when the team is free.`);
@@ -12944,6 +13678,95 @@ function drainConnectorResumes() {
         dispatchConnectorResume(entry);
     }
 }
+const pendingComputerResumes = new Map();
+function registerComputerResume(entry) {
+    // One per thread: the newest park replaces an older one.
+    pendingComputerResumes.set(entry.threadId, entry);
+    // The seat may already be free (it freed before this park registered):
+    // an idle install would otherwise never drain. #1651.
+    queueMicrotask(drainComputerResumes);
+}
+function markComputerResumeFailed(entry, message) {
+    const owner = connectorThread(entry.botId, entry.threadId);
+    if (!owner)
+        return;
+    store.appendMessage(entry.threadId, {
+        role: "bot", kind: "activity",
+        ...(owner.group ? { from: { botId: owner.bot.id, name: owner.bot.name, color: owner.bot.color } } : {}),
+        tool: { name: `Parked turn could not continue: ${message.slice(0, 160)}`, ok: false },
+    });
+}
+function dispatchComputerResume(entry) {
+    const owner = connectorThread(entry.botId, entry.threadId);
+    if (!owner)
+        return;
+    const prompt = "OpenMausBot computer update: the computer this conversation waited for is free again. Continue the task that parked waiting for it.";
+    if (owner.group) {
+        const groupId = owner.group.id;
+        const operation = beginGroupTurnOperation(groupId, entry.threadId, [entry.botId]);
+        const previous = groupQueues.get(groupId) ?? Promise.resolve();
+        const next = previous.then(async () => {
+            if (operation.cancelled)
+                return;
+            const current = connectorThread(entry.botId, entry.threadId);
+            if (!current?.group)
+                return;
+            if (current.bot.busy) {
+                pendingComputerResumes.set(entry.threadId, entry);
+                return;
+            }
+            await runGroupMemberTurn(current.group.id, entry.threadId, entry.botId, 0, new Set(), prompt, (message) => markComputerResumeFailed(entry, message), () => operation.cancelled, () => groupProviderHandshakeStarted(operation), () => groupProviderHandshakeSettled(operation));
+        });
+        const tracked = next.finally(() => finishGroupTurnOperation(groupId, operation));
+        groupQueues.set(groupId, tracked.catch((error) => {
+            markComputerResumeFailed(entry, error instanceof Error ? error.message : String(error));
+        }));
+        return;
+    }
+    void startTurn(entry.botId, prompt, {
+        threadId: entry.threadId,
+        cardContinuation: true,
+        onDispatchError: (message) => markComputerResumeFailed(entry, message),
+    }).catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        if (isTurnAdmissionBlocked(error))
+            pendingComputerResumes.set(entry.threadId, entry);
+        else
+            markComputerResumeFailed(entry, message);
+    });
+}
+function drainComputerResumes() {
+    for (const [key, entry] of pendingComputerResumes) {
+        if (!connectorThread(entry.botId, entry.threadId)) {
+            pendingComputerResumes.delete(key);
+            continue;
+        }
+        // A newer ask replaced the parked work: the resume is stale, not blocked.
+        const latestUser = store.activePath(entry.threadId).findLast((message) => message.role === "user")?.id;
+        if (entry.afterMessageId !== undefined && latestUser !== entry.afterMessageId) {
+            pendingComputerResumes.delete(key);
+            continue;
+        }
+        // A newer generation owns the thread — a new turn superseded the parked
+        // one — so the parked resume is stale too. The parked turn's OWN
+        // generation is still current while it settles: the lazy-claim park
+        // registers its resume before the interrupt lands, and a drain in that
+        // window must keep the entry (#1651), not read busy as superseded.
+        const activeGeneration = activeInternalGenerationByThread.get(entry.threadId);
+        if (activeGeneration !== undefined && activeGeneration !== entry.generation) {
+            pendingComputerResumes.delete(key);
+            continue;
+        }
+        // Busy under the parked generation: the turn is still settling. Keep the
+        // entry; the next drain (its completion, the next release) dispatches.
+        if (threadBusy(entry.botId, entry.threadId))
+            continue;
+        if (!turnResources.free(entry.resource))
+            continue;
+        pendingComputerResumes.delete(key);
+        dispatchComputerResume(entry);
+    }
+}
 const pendingSecretResumes = new Map();
 const phoneSecretSubmissions = new PhoneSecretSubmissionRegistry();
 function claimPhoneSecretBotDeletion(botId) {
@@ -13175,6 +13998,7 @@ bus.subscribe((event) => {
         return;
     if (event.type === "turn.completed") {
         drainConnectorResumes();
+        drainComputerResumes();
         drainSecretResumes();
         drainTeamSetupResumes();
     }
@@ -13382,6 +14206,8 @@ function configStatus() {
         // the decision model: switches and configured-or-not, never the key
         decider: describeDecider(cfg),
         imageGen: avatarImageStatus(cfg),
+        // Live calls: configured-or-not only; the voice name is a setting
+        live: liveSettingsFor(cfg),
         // not a secret — the sidebar shows it
         profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "" },
         // the enrolled organisation's read-only desktop policy; null when not enrolled
@@ -13407,6 +14233,7 @@ function configStatus() {
         },
         features: {
             skillAuthoring: skillAuthoringEnabled(cfg),
+            skillsLibrary: skillsLibraryEnabled(cfg),
             showToolCalls: showToolCallsEnabled(cfg),
             routinesInConversation: routinesInConversationEnabled(cfg),
             browser: builtInBrowserEnabled(cfg),
@@ -13708,6 +14535,7 @@ async function reloadProviders() {
     // queued behind them drains now — onto the freshly loaded fleet
     drainQueuedSends();
     drainConnectorResumes();
+    drainComputerResumes();
     drainSecretResumes();
     drainTeamSetupResumes();
 }
@@ -13864,6 +14692,102 @@ ROUTES.push(createAntigravityLeftoverRoutes({
     remove: () => removeAntigravityLeftovers(),
 }));
 ROUTES.push(desktopViewer.route);
+// Live calls (GPT-Live as the voice, the bot as the brain). A client holds
+// the WebRTC audio; the harness creates the session with the key (which
+// never leaves it) and runs the call in LiveCallController.
+/** Who the voice speaks for, for its instructions. */
+function liveBotFor(botId) {
+    const bot = store.bot(botId);
+    if (!bot)
+        throw new LiveSessionError("That bot no longer exists.", 404);
+    return { name: bot.name, title: bot.title, description: bot.description };
+}
+/** The chat's text so far, so the voice can follow "and the other one?". */
+function liveHistoryFor(threadId) {
+    return store.activePath(threadId)
+        .filter((message) => message.kind === "text" && typeof message.text === "string" && (message.role === "user" || message.role === "bot"))
+        .map((message) => ({ role: message.role === "user" ? "user" : "assistant", text: message.text ?? "" }));
+}
+/** A call outlives the request that started it: a signed-out or removed
+ * person's call must not keep reaching the bot (or spending the key). */
+function liveSignedIn(auth) {
+    return auth.kind !== "session" || sessions.isLive(auth.session.id);
+}
+const liveCalls = new LiveCallController({
+    store,
+    send: async ({ auth, botId, threadId, text }) => {
+        // the controller ends the call on this error
+        if (!liveSignedIn(auth))
+            throw new LiveCallSignedOutError();
+        const receipt = await acceptDirectSend({
+            botId, threadId, text,
+            sendId: randomUUID().replaceAll("-", ""),
+            sender: messageSender(auth),
+            trigger: usageTriggerFor(auth),
+            via: "call",
+            // a person is on the call: these are their words
+            personPresent: true,
+        });
+        if ("queued" in receipt)
+            return { kind: "queued", queueId: receipt.queueId };
+        return { kind: receipt.steered ? "steered" : "started", messageId: receipt.message.id };
+    },
+    respond: async (input) => {
+        const result = await respondToCard(input);
+        if (result.ok)
+            return { ok: true };
+        // respondToCard's 401: the session that started the call has ended
+        if (result.status === 401)
+            throw new LiveCallSignedOutError();
+        return { ok: false, error: result.error };
+    },
+    // send() queues through the steer queue; an edit or cancel there removes a request undelivered
+    queued: isSteeredMessageQueued,
+    signedIn: liveSignedIn,
+    // the caller's own typed lines carry this sender (none for the owner)
+    personKey: (auth) => messageSender(auth)?.id,
+    activity: (botId, threadId) => {
+        const task = store.taskByThread(botId, threadId);
+        if (!task?.busy)
+            return "idle";
+        return task.activity === "waiting-on-you" ? "waiting" : "working";
+    },
+    broadcast: (frame) => broadcast(frame, { adminOnly: true }),
+    settings: () => ({ key: cfg.live?.key ?? "", ...liveSettingsFor(cfg) }),
+    createSession: ({ key, sdp, botId, threadId, voice }) => createLiveSession({ key, sdp, voice, bot: liveBotFor(botId), history: liveHistoryFor(threadId) }),
+    // Node's WebSocket (undici) accepts headers in its second argument.
+    openSocket: (url, key) => new WebSocket(url, { headers: { authorization: `Bearer ${key}` } }),
+    attachUrl: (sessionId) => liveAttachUrl(sessionId),
+    speakable: (text) => toUtterances(text),
+    log: (line) => console.log(line),
+});
+// A signed-out or revoked sign-in ends the call it started at once (the idle
+// check would only notice within 15 s). A paired phone's unpairing arrives
+// from the companion instead (POST /api/live/device-revoked).
+sessions.onSessionRevoked((sessionId) => liveCalls.sessionRevoked(sessionId));
+ROUTES.push(createLiveRoutes({
+    calls: liveCalls,
+    resolveTarget: (botId, threadId) => {
+        const bot = store.bot(botId);
+        if (!bot)
+            return null;
+        const target = threadId ?? bot.threadId;
+        if (store.botByThread(target)?.id !== bot.id)
+            return null;
+        return { botId: bot.id, botName: bot.name, threadId: target };
+    },
+    settings: () => liveSettingsFor(cfg),
+    // Non-secret settings only, written the way PUT /api/config writes a
+    // section: saveConfig merges into `live`, so the key stays where it is.
+    saveSettings: async (patch) => {
+        if (providerConfigBusy)
+            throw Object.assign(new Error("Settings are already being updated. Try again in a moment."), { status: 409 });
+        saveConfig({ live: patch });
+        Object.assign(cfg, loadConfig());
+        broadcast({ kind: "config", ...configStatus() });
+        return liveSettingsFor(cfg);
+    },
+}));
 const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
@@ -13920,7 +14844,7 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && !path.startsWith("/api/") && !path.startsWith("/.well-known/") && serveStatic(res, path))
             return;
         if (method === "GET" && path === "/.well-known/openmausbot/environment") {
-            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled() }));
+            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled(), cloudHome: Boolean(CLOUD_HOME) }));
         }
         const domainCheck = /^\/\.well-known\/openmausbot\/domain-check\/([a-f0-9]{64})$/.exec(path);
         if (method === "GET" && domainCheck) {
@@ -14019,7 +14943,7 @@ const handleRequest = async (req, res) => {
                 console.warn(`pairing refused from ${requestSource(req)}: ${result.error}`);
                 return json(res, result.status, { error: result.error });
             }
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled() });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled(), cloudHome: Boolean(CLOUD_HOME) });
             if (wantsCookie) {
                 // A browser sign-in replaces this browser's own session here, if it had one, rather than leaving it behind.
                 const previous = browser ? sessions.authenticate(parseCookies(req.headers.cookie).get(SESSION_COOKIE)) : null;
@@ -14428,7 +15352,7 @@ const handleRequest = async (req, res) => {
                         ? "phone"
                         : path.startsWith("/api/internal/connectors/")
                             ? "connectors"
-                            : path === "/api/internal/computer-control"
+                            : path === "/api/internal/computer-control" || path === "/api/internal/computer/mcp"
                                 ? "computer"
                                 : "agents";
             if (internalCapability.kind !== requiredCapabilityKind) {
@@ -14585,7 +15509,7 @@ const handleRequest = async (req, res) => {
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
                 const result = ownersWrite(() => updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText, ...(body.until !== undefined ? { until: body.until } : {}) }, { source: memorySource() }));
-                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : result.code === "over-budget" ? 413 : 400, result);
+                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : 400, result);
             }
             if (method === "POST" && path === "/api/internal/memory/log") {
                 const body = await readInternalBody();
@@ -14619,6 +15543,22 @@ const handleRequest = async (req, res) => {
                 requireActiveInternalCapability();
                 return json(res, 200, { result });
             }
+            // The cloud computer's tools (harness-mcp-proxy computer): the turn's
+            // capability names its Boat, and the Boat credential stays here.
+            if (method === "POST" && path === "/api/internal/computer/mcp") {
+                const body = await readInternalBody();
+                const boxId = internalCapability.boxId;
+                if (!boxId)
+                    return json(res, 403, { error: "this turn has no cloud computer" });
+                const abort = new AbortController();
+                res.once("close", () => { if (!res.writableEnded)
+                    abort.abort(); });
+                return json(res, 200, { result: await cloudComputerRpc(body, {
+                        cfg, boxId, signal: abort.signal,
+                        gate: () => computerCallGate(internalCapability),
+                        assertActive: requireActiveInternalCapability,
+                    }) });
+            }
             if (method === "POST" && path === "/api/internal/phone/claim") {
                 // Lazy phone exclusivity (issue #1663): the turn holds computer:phone
                 // from its first real tool call until it settles. The proxy answers a
@@ -15000,6 +15940,58 @@ const handleRequest = async (req, res) => {
                 });
                 return json(res, 201, proposed);
             }
+            if (method === "POST" && path === "/api/internal/team-memory") {
+                const parsed = z.object({
+                    fromBotId: z.string().min(1).max(128),
+                    fromThreadId: z.string().min(1).max(128),
+                    kind: z.string(),
+                    name: z.string(),
+                    detail: z.string(),
+                    aliases: z.array(z.string()).optional(),
+                }).strict().safeParse(await readInternalBody());
+                if (!parsed.success)
+                    return json(res, 400, { error: "invalid team memory proposal" });
+                const body = parsed.data;
+                const from = store.bot(body.fromBotId);
+                if (!from)
+                    return json(res, 403, { error: "unknown sender" });
+                const owner = connectorThread(from.id, body.fromThreadId);
+                if (!owner)
+                    return json(res, 403, { error: "source conversation does not belong to sender" });
+                if (!sameAudience(from.visibility, undefined) || (owner.group && !roomFeedsBot(owner.group, from))) {
+                    return json(res, 403, { error: "restricted conversations cannot publish section-wide memory; ask an admin to add it" });
+                }
+                if (!TEAM_MEMORY_KINDS.includes(body.kind)) {
+                    return json(res, 400, { error: `kind must be one of ${TEAM_MEMORY_KINDS.join(", ")}` });
+                }
+                let proposed;
+                try {
+                    proposed = teamMemory.propose(from.section, { kind: body.kind, name: body.name, detail: body.detail, aliases: body.aliases }, { botId: from.id, botName: from.name, threadId: body.fromThreadId, at: Date.now() });
+                }
+                catch (error) {
+                    return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+                }
+                const summary = `${proposed.entry.kind[0].toUpperCase()}${proposed.entry.kind.slice(1)}: ${proposed.entry.name}${proposed.entry.aliases.length ? ` (also ${proposed.entry.aliases.join(", ")})` : ""} — ${proposed.entry.detail}`;
+                const section = sectionContextKey(from.section);
+                const card = store.appendMessage(body.fromThreadId, {
+                    role: "bot",
+                    kind: "options",
+                    ...(owner.group ? { from: { botId: from.id, name: from.name, color: from.color } } : {}),
+                    card: {
+                        title: "Remember this for the team?",
+                        subtitle: summary,
+                        options: ["Remember", "Skip"],
+                        requestId: proposed.entry.id,
+                        tool: "propose_team_memory",
+                        teamMemoryRequest: { section, entryId: proposed.entry.id, kind: proposed.entry.kind },
+                    },
+                });
+                appendDecision(DATA_DIR, {
+                    threadId: body.fromThreadId, requestId: proposed.entry.id, botId: from.id, botName: from.name,
+                    tool: "propose_team_memory", summary, decision: "card-shown", source: "team-memory",
+                });
+                return json(res, 201, { status: "proposed", requestId: proposed.entry.id, messageId: card.id, summary });
+            }
             if (method === "POST" && path === "/api/internal/profile-requests") {
                 const parsed = z.object({
                     fromBotId: z.string().min(1).max(128),
@@ -15290,7 +16282,7 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: "source conversation does not belong to sender" });
                 }
                 return json(res, 200, {
-                    skills: listSkills(from.id),
+                    skills: listBotSkills(from),
                     staged: listStagedSkillWrites(from.id).map(stagedSkillListing),
                 });
             }
@@ -15864,20 +16856,17 @@ const handleRequest = async (req, res) => {
                     })).filter(g => g.members.length);
                     return json(res, 200, { currentRoom: source ? { id: source.id, name: source.name, workingFolder: source.cwd || null } : null,
                         bots: reachablePeers(store.bots, internalSender).map(bot => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section, busy: bot.busy })),
-                        rooms, note: "Without group_id: use this room when in a room, otherwise each distinct assignment starts a fresh thread for that teammate. Give a self-contained brief. Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
+                        rooms, note: "Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
                 }
                 if (method === "POST" && path === "/api/internal/coordinate-bots") {
                     const parsed = z.object({
                         groupId: z.string().min(1).max(128).optional(),
                         botIds: z.array(z.string().min(1).max(128)).min(1).max(4).refine(ids => new Set(ids).size === ids.length),
-                        message: z.string().trim().min(1).max(4000), requestKey: z.string().regex(/^[\w-]{1,100}$/),
+                        message: z.string().trim().min(1).max(4000),
                         rework: z.boolean().default(false),
-                        // Only ever a name for a thread, so it travels under the same
-                        // one-line rule as a peer thread title.
-                        label: z.string().trim().min(1).max(60).refine(fitsOnOneLine).optional(),
                     }).safeParse(await readInternalBody());
                     if (!parsed.success)
-                        return json(res, 400, { error: "Provide 1-4 distinct botIds, message (1-4000 characters), a short requestKey (letters, digits, underscores or hyphens) and an optional one-line label of at most 60 characters." });
+                        return json(res, 400, { error: "Provide 1-4 distinct botIds and a message of 1-4000 characters." });
                     const groupId = parsed.data.groupId ?? source?.id;
                     const destination = groupId ? store.group(groupId) : undefined;
                     if (groupId && !destination)
@@ -15929,60 +16918,63 @@ const handleRequest = async (req, res) => {
                             });
                         approvalGranted = true;
                     }
-                    const accepted = [];
-                    const errors = [];
+                    // A room shows one brief per call, addressed to the call's recipients.
+                    const requestBatchKey = destination ? randomUUID() : undefined;
                     // One receipt per recipient, in the order the caller addressed
                     // them. Dispatch is asynchronous (RoomHandoffs.tick), so a fresh
-                    // enqueue is honestly "queued"; a duplicate inherits the state of
-                    // the node that already carries this request_key.
+                    // enqueue is honestly "queued"; a repeat reports the request it
+                    // repeats.
                     const receipts = [];
+                    // Why nothing was sent, in full: a receipt's detail is clipped.
+                    const refused = [];
                     for (const target of targets) {
                         let createdThread;
                         try {
                             requireActiveInternalCapability();
+                            // Outside a room this conversation has one thread with each
+                            // teammate: the first request opens it, everything after
+                            // continues it and runs once the work already there is done.
+                            const continued = destination ? undefined : store.workThread(target.botId, internalSender.id, address.threadId);
                             if (!destination) {
-                                const task = store.createTask(target.botId, `@${internalSender.name}${parsed.data.label ? ` · ${parsed.data.label}` : " · work"}`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", at: Date.now() });
+                                const task = continued ?? store.createTask(target.botId, `@${internalSender.name} · work`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", threadId: address.threadId, at: Date.now() });
                                 if (!task)
                                     throw new Error("The recipient no longer exists");
-                                target.threadId = createdThread = task.threadId;
-                                if (delegatedFullAccess(internalSender, internalCapability.threadId, store.bot(target.botId))) {
-                                    grantDelegatedFullAccess(internalSender, store.bot(target.botId), target.threadId);
-                                }
+                                target.threadId = task.threadId;
+                                if (!continued)
+                                    createdThread = task.threadId;
+                                applyDelegatedLevel(internalSender, internalCapability.threadId, store.bot(target.botId), target.threadId);
                             }
-                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", destination ? parsed.data.requestKey : undefined);
-                            // A retry keeps its original task; discard the speculative row.
-                            if (duplicate && createdThread && createdThread !== node.threadId) {
+                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", requestBatchKey);
+                            // A repeat lands on the request already made, possibly in a
+                            // thread the person archived meanwhile; a thread opened for it
+                            // is never used.
+                            if (duplicate && createdThread)
                                 store.deleteTask(target.botId, createdThread);
-                            }
-                            if (!duplicate && createdThread)
+                            else if (createdThread)
                                 threadStarters.set(createdThread, openerFrom(address.threadId));
                             createdThread = undefined; // The durable coordinator now owns this task.
-                            accepted.push({ requestId: node.id, botId: node.botId, duplicate, status: node.status });
-                            // A duplicate request_key lands on the node enqueue already
-                            // made. Only a live node can still report: a failed or
-                            // cancelled one already fired its report and tick() skips it,
-                            // so promising "its result will resume you" would be the one
-                            // lie a receipt must never tell.
+                            // Only a live request can still report: a finished one already
+                            // fired its report and tick() skips it, so a repeat of it sends
+                            // nothing and says how to run it again.
+                            const title = destination ? undefined : store.taskByThread(node.botId, node.threadId)?.title;
+                            const finished = {
+                                completed: "it already finished and its result stands; send it with rework=true to run it again",
+                                failed: "it failed; send it with rework=true to retry", cancelled: "it was cancelled; send it with rework=true to retry",
+                            };
+                            const notSent = duplicate && finished[node.status] ? `not sent again: ${finished[node.status]}` : undefined;
+                            if (notSent)
+                                refused.push(notSent);
                             receipts.push(peerDeliveryReceipt({
                                 botId: node.botId,
                                 botName: store.bot(node.botId)?.name,
-                                outcome: duplicate
-                                    ? node.status === "running" || node.status === "completed"
-                                        ? "injected"
-                                        : node.status === "failed" || node.status === "cancelled"
-                                            ? "failed"
-                                            : "queued"
-                                    : "queued",
-                                detail: duplicate
-                                    ? node.status === "running"
-                                        ? "duplicate request_key — this teammate is already running that exact assignment"
-                                        : node.status === "completed"
-                                            ? "duplicate request_key — this teammate already completed that assignment; the earlier result stands"
-                                            : node.status === "failed" || node.status === "cancelled"
-                                                ? `duplicate request_key — the earlier assignment ${node.status === "cancelled" ? "was cancelled" : "failed"} and will not rerun or resume you; resend with a new request_key to retry`
-                                                : "duplicate request_key — already in flight; its result will resume you automatically"
-                                    : "handed to the coordinator; the teammate's turn has not started yet",
+                                outcome: notSent ? "failed" : !duplicate || node.status === "queued" ? "queued" : "injected",
+                                detail: notSent ?? (duplicate
+                                    ? `already sent: it is ${node.status === "queued" ? "queued" : "under way"} and its result will resume you`
+                                    : title
+                                        ? `sent to "${title}"; it runs after anything still running there`
+                                        : "handed to the coordinator; the teammate's turn has not started yet"),
                                 requestId: node.id,
+                                ...(destination ? {} : { threadId: node.threadId }),
                             }));
                             if (!duplicate) {
                                 const recipient = store.bot(target.botId);
@@ -15999,14 +16991,13 @@ const handleRequest = async (req, res) => {
                                 store.deleteTask(target.botId, createdThread);
                             }
                             const said = error instanceof Error ? error.message : String(error);
-                            errors.push({ botId: target.botId, error: said });
-                            receipts.push(peerDeliveryReceipt({
-                                botId: target.botId, botName: store.bot(target.botId)?.name, outcome: "failed", detail: said,
-                            }));
+                            refused.push(said);
+                            receipts.push(peerDeliveryReceipt({ botId: target.botId, botName: store.bot(target.botId)?.name, outcome: "failed", detail: said }));
                         }
                     }
-                    return json(res, accepted.length ? 200 : 409, { accepted, errors, receipts,
-                        ...(accepted.length ? { message: "End your turn after sending all work. These actual teammates will reply and resume you automatically. Do not poll or wait." } : { error: errors.map(e => e.error).join("; ") }),
+                    const sent = refused.length < receipts.length;
+                    return json(res, sent ? 200 : 409, { receipts,
+                        ...(sent ? { message: "End your turn after sending all work. These actual teammates will reply and resume you automatically. Do not poll or wait." } : { error: refused.join("; ") }),
                     });
                 }
             }
@@ -16218,11 +17209,15 @@ const handleRequest = async (req, res) => {
                 const target = store.bot(toBotId);
                 if (!target)
                     return json(res, 404, { error: "no such bot" });
+                const oneWay = body.oneWay === true;
+                if (oneWay && target.id === from.id) {
+                    return json(res, 409, { error: "send_to_bot is cross-bot only; use start_thread to send independent work to yourself" });
+                }
                 if (internalCapability.roomCoordination) {
-                    if (target.id !== from.id) {
+                    if (target.id !== from.id && !oneWay) {
                         return json(res, 409, { error: "Use coordinate_bots for teamwork; it queues actual teammates and resumes you automatically." });
                     }
-                    if (!internalCapability.ownThreadCreation) {
+                    if (target.id === from.id && !internalCapability.ownThreadCreation) {
                         return json(res, 409, { error: "Only a direct user request can open separate self-owned threads. Finish this assigned work here; use coordinate_bots for teammates." });
                     }
                 }
@@ -16274,7 +17269,7 @@ const handleRequest = async (req, res) => {
                 // classic handoff has applies unchanged, here at queue time and
                 // again in the drain at dispatch time.
                 const depth = internalCapability.depth;
-                if (depth >= MAX_COMMS_DEPTH) {
+                if (!oneWay && depth >= MAX_COMMS_DEPTH) {
                     return json(res, 200, { error: "thread chains are limited to one hop — open the thread on yourself, or do this one here" });
                 }
                 if (!canAccessTeam(from, target.section) || target.hidden) {
@@ -16288,9 +17283,11 @@ const handleRequest = async (req, res) => {
                     return json(res, 500, { error: "couldn't create that thread" });
                 // The work is still for the person whose request the opener is on.
                 threadStarters.set(task.threadId, openerFrom(fromThreadId));
-                if (delegatedFullAccess(from, fromThreadId, target))
-                    grantDelegatedFullAccess(from, target, task.threadId);
-                const queued = queueDelegation(commsBus, from, { toBotId: target.id, message, depth, targetThreadId: task.threadId }, MAX_COMMS_DEPTH, fromThreadId);
+                applyDelegatedLevel(from, fromThreadId, target, task.threadId);
+                const sourceUrl = threadRefUrl({ botId: owner.group?.id ?? from.id, threadId: fromThreadId });
+                const queued = queueDelegation(commsBus, from, { toBotId: target.id, message: oneWay
+                        ? `${message}\n\n[Source conversation](${sourceUrl}). This link grants no additional access and contains no copied transcript.`
+                        : message, depth, targetThreadId: task.threadId, oneWay }, MAX_COMMS_DEPTH, fromThreadId);
                 if (queued.result !== "ok" || !queued.id) {
                     // nothing will ever run there: take the row back before the person
                     // sees a thread that goes nowhere
@@ -16598,7 +17595,7 @@ const handleRequest = async (req, res) => {
                 // Reading a streamed MCP body yields to ordinary settings requests.
                 // Re-read the live bot immediately before relay so turning Connected
                 // Apps off wins over a request that authenticated under the old value.
-                const currentSender = store.bot(internalCapability.botId);
+                let currentSender = store.bot(internalCapability.botId);
                 if (!currentSender || currentSender.composio === false || !composio.configured(cfg)) {
                     return json(res, 403, { error: "connected apps are not enabled for this bot" });
                 }
@@ -16609,6 +17606,7 @@ const handleRequest = async (req, res) => {
                 // Rows are fire-and-forget: a log failure must never take the call
                 // (or its refusal) down with it.
                 const call = connectorCallFromFrame(body);
+                let serviceSlugs = [];
                 // A bot with no grants record keeps the pre-grants relay: even an
                 // unreadable frame passes through exactly as it always did.
                 if (call.kind === "unrecognized" && currentSender.connectorTools !== undefined) {
@@ -16635,7 +17633,11 @@ const handleRequest = async (req, res) => {
                     // underscored service (bland_ai) keeps its own tools instead of
                     // a plain-prefix grant (bland) capturing them; an unreachable
                     // catalog reads as empty and the plain split stands.
-                    const serviceSlugs = await composio.connectedServiceSlugs(cfg);
+                    serviceSlugs = await composio.connectedServiceSlugs(cfg);
+                    requireActiveInternalCapability();
+                    currentSender = store.bot(internalCapability.botId);
+                    if (!currentSender || currentSender.composio === false || !composio.configured(cfg))
+                        return json(res, 403, { error: "connected apps are no longer enabled for this bot" });
                     const verdict = evaluateConnectorTools(call.names, currentSender.connectorTools, serviceSlugs);
                     if (!verdict.allowed) {
                         for (const denial of verdict.denials) {
@@ -16675,9 +17677,174 @@ const handleRequest = async (req, res) => {
                         rule: verdict.rule,
                     });
                 }
-                const upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
-                    ? req.headers["mcp-session-id"][0]
-                    : req.headers["mcp-session-id"]);
+                // ── the outbound gate ──
+                // A tools/call that sends something (shared/outbound.ts) is its own
+                // confirmation in every approval mode, Full included: it waits on a
+                // card, or spends the bot's daily allowance. Everything else relays
+                // untouched. A refusal is an ordinary tool error so the bot reads
+                // it and carries on, rather than a transport failure it retries.
+                const rpc = body && typeof body === "object" && !Array.isArray(body)
+                    ? body
+                    : null;
+                const rpcParams = rpc?.params && typeof rpc.params === "object" && !Array.isArray(rpc.params)
+                    ? rpc.params
+                    : null;
+                // The app tools this call would actually run, seen through Composio's
+                // meta tools (a multi-execute list, workbench code), and the ones
+                // among them that send.
+                const outboundCalls = rpc?.method === "tools/call" && typeof rpcParams?.name === "string"
+                    ? outboundCallsIn(rpcParams.name, rpcParams.arguments)
+                    : [];
+                const outboundTool = outboundCalls.length ? outboundCalls[0].slug : null;
+                const refuseOutbound = (text) => {
+                    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+                    return res.end(JSON.stringify({ jsonrpc: "2.0", id: rpc?.id ?? null, result: { content: [{ type: "text", text }], isError: true } }));
+                };
+                // ── connection scopes ──
+                // Checked first: an app this bot may not touch is refused outright,
+                // never turned into a question for the person.
+                const connectorCalls = rpc?.method === "tools/call" && typeof rpcParams?.name === "string"
+                    ? connectorCallsIn(rpcParams.name, rpcParams.arguments)
+                    : [];
+                const access = connectorAccessDecision(currentSender.connectorScopes, connectorCalls, serviceSlugs);
+                if (!access.ok) {
+                    const described = describeTool(access.slug);
+                    const appName = described.app ?? access.toolkit;
+                    appendDecision(DATA_DIR, {
+                        threadId: internalCapability.threadId, botId: currentSender.id, botName: currentSender.name,
+                        tool: access.slug, decision: "auto-denied", source: "connector-scope", rule: `scope:${access.toolkit}:${access.reason}`,
+                    });
+                    return refuseOutbound(access.reason === "app"
+                        ? `OpenMausBot did not run this: ${currentSender.name} has not been given access to ${appName}. Ask the user to allow it under the bot's Access settings, and do not retry.`
+                        : `OpenMausBot did not run this: ${appName} is read-only for ${currentSender.name}, and ${described.label} would write to it. Ask the user before trying again.`);
+                }
+                const opaque = connectorCalls.some(call => call.slug === "COMPOSIO_PROXY_EXECUTE");
+                if (opaque && currentSender.connectorTools !== undefined)
+                    return refuseOutbound("OpenMausBot cannot verify this code against this bot's tool grants. Use a direct app tool.");
+                let outboundApproved = false;
+                if (outboundTool) {
+                    const policy = currentSender.outbound ?? DEFAULT_OUTBOUND_POLICY;
+                    const threadId = internalCapability.threadId;
+                    const { app } = describeTool(outboundTool);
+                    const summary = outboundCalls.map((call) => {
+                        const described = describeTool(call.slug);
+                        const argsText = call.arguments === undefined ? "" : JSON.stringify(call.arguments);
+                        return `${described.app ? `${described.app} · ` : ""}${described.label}${argsText ? `\n${argsText.slice(0, 400)}${argsText.length > 400 ? "… [arguments truncated]" : ""}` : ""}`;
+                    }).join("\n\n");
+                    const capNote = (count) => `OpenMausBot did not send this. ${currentSender.name} has reached its daily limit of ${count} outbound action${count === 1 ? "" : "s"}. Ask the user to raise the limit under the bot's Permissions before trying again.`;
+                    if (policy.policy === "allow" && !opaque) {
+                        const today = outboundCounts.today(currentSender.id);
+                        if (today + outboundCalls.length > policy.dailyCap) {
+                            appendDecision(DATA_DIR, {
+                                threadId, botId: currentSender.id, botName: currentSender.name,
+                                tool: outboundTool, summary, decision: "auto-denied", source: "outbound", rule: `daily-cap:${policy.dailyCap}`,
+                            });
+                            return refuseOutbound(capNote(policy.dailyCap));
+                        }
+                    }
+                    else {
+                        const owner = connectorThread(currentSender.id, threadId);
+                        const held = outboundRequests.open({ botId: currentSender.id, threadId, tool: outboundTool, timeoutMs: OUTBOUND_HOLD_MS });
+                        const card = store.appendMessage(threadId, {
+                            role: "bot",
+                            kind: "options",
+                            ...(owner?.group ? { from: { botId: currentSender.id, name: currentSender.name, color: currentSender.color } } : {}),
+                            card: {
+                                title: "Send on your behalf?",
+                                subtitle: summary,
+                                options: ["Allow", "Deny"],
+                                requestId: held.requestId,
+                                tool: outboundTool,
+                                held: HELD_NOTE["approval.held.outbound"],
+                                heldCode: "approval.held.outbound",
+                                outboundRequest: { tool: outboundTool, app },
+                            },
+                        });
+                        appendDecision(DATA_DIR, {
+                            threadId, requestId: held.requestId, botId: currentSender.id, botName: currentSender.name,
+                            tool: outboundTool, summary, decision: "card-shown", source: "outbound",
+                        });
+                        if (owner?.group) {
+                            if (activeGroupTurnForBot(currentSender.id)?.threadId === threadId)
+                                store.setActivity(currentSender.id, "waiting-on-you");
+                        }
+                        else if (store.taskByThread(currentSender.id, threadId)?.busy) {
+                            store.setTaskActivity(currentSender.id, threadId, "waiting-on-you");
+                        }
+                        notify(buildNotification("approval", currentSender, threadId, summary, { avatarUrl: currentSender.avatarUrl }));
+                        const answer = await held.answer;
+                        outboundRequests.forget(held.requestId);
+                        if (internalCapabilityIsActive(internalCapability)) {
+                            const waiting = store.bot(currentSender.id);
+                            if (owner?.group) {
+                                if (activeGroupTurnForBot(currentSender.id)?.threadId === threadId && waiting?.activity === "waiting-on-you")
+                                    store.setActivity(waiting.id, "working");
+                            }
+                            else if (store.taskByThread(currentSender.id, threadId)?.activity === "waiting-on-you") {
+                                store.setTaskActivity(currentSender.id, threadId, "working");
+                            }
+                        }
+                        if (answer !== "allow") {
+                            if (answer === "timeout") {
+                                const stale = store.messagesFor(threadId).find((message) => message.id === card.id);
+                                if (stale?.card && !stale.card.answered) {
+                                    store.patchMessage(threadId, stale.id, { card: { ...stale.card, answered: "unavailable", dismissed: true } });
+                                }
+                            }
+                            return refuseOutbound(answer === "timeout"
+                                ? "OpenMausBot did not send this: nobody answered the approval in time. Ask the user before trying again."
+                                : "OpenMausBot did not send this: the user declined. Do not retry it; ask the user what they would like instead.");
+                        }
+                        outboundApproved = true;
+                        requireActiveInternalCapability();
+                    }
+                }
+                let dispatchRefusal;
+                const refuseDispatch = (text) => {
+                    dispatchRefusal = text;
+                    throw new Error(text);
+                };
+                let upstream;
+                try {
+                    upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
+                        ? req.headers["mcp-session-id"][0]
+                        : req.headers["mcp-session-id"], () => {
+                        requireActiveInternalCapability();
+                        const fresh = store.bot(internalCapability.botId);
+                        if (!fresh || fresh.composio === false || !composio.configured(cfg))
+                            refuseDispatch("Connected apps were disabled while this call waited.");
+                        const freshAccess = connectorAccessDecision(fresh.connectorScopes, connectorCalls, serviceSlugs);
+                        if (!freshAccess.ok || (opaque && fresh.connectorTools !== undefined) ||
+                            (call.kind === "tools" && !evaluateConnectorTools(call.names, fresh.connectorTools, serviceSlugs).allowed) ||
+                            (call.kind === "unrecognized" && fresh.connectorTools !== undefined)) {
+                            refuseDispatch("This bot's connected-app permissions changed. The call was not run.");
+                        }
+                        if (outboundTool) {
+                            const policy = fresh.outbound ?? DEFAULT_OUTBOUND_POLICY;
+                            if (policy.policy === "allow" && !opaque) {
+                                let reserved;
+                                try {
+                                    reserved = outboundCounts.reserve(fresh.id, outboundCalls.length, policy.dailyCap);
+                                }
+                                catch {
+                                    refuseDispatch("The daily allowance could not be saved. Nothing was sent.");
+                                }
+                                if (reserved === null)
+                                    refuseDispatch("This bot has reached its daily outbound limit. Nothing was sent.");
+                                appendDecision(DATA_DIR, { threadId: internalCapability.threadId, botId: fresh.id, botName: fresh.name,
+                                    tool: outboundTool, decision: "auto-approved", source: "outbound", rule: `daily-allowance:${reserved}/${policy.dailyCap}` });
+                            }
+                            else if (!outboundApproved) {
+                                refuseDispatch("The outbound policy changed. Ask for approval again before sending.");
+                            }
+                        }
+                    });
+                }
+                catch (error) {
+                    if (dispatchRefusal)
+                        return refuseOutbound(dispatchRefusal);
+                    throw error;
+                }
                 const headers = {
                     "content-type": upstream.contentType,
                     "cache-control": "no-store",
@@ -16755,6 +17922,16 @@ const handleRequest = async (req, res) => {
                 if (!composio.configured(cfg) || owner.bot.composio === false) {
                     return json(res, 409, { error: "connected apps are not enabled for this bot" });
                 }
+                if (owner.bot.connectorScopes) {
+                    const outside = slugs.find((slug) => !owner.bot.connectorScopes?.apps[slug]);
+                    if (outside) {
+                        appendDecision(DATA_DIR, {
+                            threadId, botId: owner.bot.id, botName: owner.bot.name,
+                            tool: "COMPOSIO_MANAGE_CONNECTIONS", summary: outside, decision: "auto-denied", source: "connector-scope", rule: `scope:${outside}:app`,
+                        });
+                        return json(res, 403, { error: `${owner.bot.name} has not been given access to ${outside}; allow it under the bot's Access settings first` });
+                    }
+                }
                 const connectionState = await composio.connectionStatus(cfg, slugs).catch(() => ({}));
                 requireActiveInternalCapability();
                 const messageIds = [];
@@ -18115,6 +19292,7 @@ const handleRequest = async (req, res) => {
                 return true;
             const openApprovalThreads = store.groupTasks(group.id).flatMap((task) => store.messagesFor(task.threadId).some((message) => message.kind === "options" &&
                 message.card?.requestId &&
+                (!isPersistentQuestionCard(message.card) || runningTurnEngines.has(task.threadId)) &&
                 !message.card.answered &&
                 !message.card.dismissed && !message.card.expired) ? [task.threadId] : []);
             return openApprovalThreads.length > 0 && !openApprovalThreads.includes(targetThreadId);
@@ -18866,10 +20044,11 @@ const handleRequest = async (req, res) => {
             if (created && !created.ok)
                 return json(res, 400, { error: created.error });
             const bot = store.createBot({ ...profile.patch, soul: settings.soul, section, modelSelection: selection,
+                toolScope: settings.toolScope ?? undefined,
                 ...(created?.ok ? { visibility: created.visibility } : {}) });
             const createdRoutines = [];
             try {
-                const { chiefOfStaff: _chief, managedSections: _managed, ...ordinary } = settings;
+                const { chiefOfStaff: _chief, managedSections: _managed, toolScope: _toolScope, ...ordinary } = settings;
                 store.patchBot(bot.id, {
                     // Store creation completes workspace defaults (including effort).
                     // Applying the rest of the template must not undo that selection.
@@ -19255,6 +20434,43 @@ const handleRequest = async (req, res) => {
                 patch.section = section ?? undefined;
             if (body.chiefOfStaff === false)
                 patch.chiefOfStaff = false;
+            // where a task carries on when this engine is unavailable, in order
+            if (body.fallback !== undefined) {
+                if (!Array.isArray(body.fallback) || body.fallback.length > 5) {
+                    return json(res, 400, { error: "fallback must be a list of up to five { instanceId, model } entries" });
+                }
+                const chain = [];
+                for (const entry of body.fallback) {
+                    const row = entry && typeof entry === "object" ? entry : null;
+                    if (!row || typeof row.instanceId !== "string" || !/^[\w.-]+$/.test(row.instanceId) || typeof row.model !== "string" || !row.model.trim() || row.model.length > 500) {
+                        return json(res, 400, { error: "fallback must be a list of up to five { instanceId, model } entries" });
+                    }
+                    if (!registry.get(row.instanceId))
+                        return json(res, 400, { error: `fallback engine "${row.instanceId}" is not available` });
+                    if (chain.some((seen) => seen.instanceId === row.instanceId))
+                        continue;
+                    chain.push({ instanceId: row.instanceId, model: row.model.trim() });
+                }
+                patch.fallback = chain;
+            }
+            // which connected apps this bot may use; null clears back to all of them
+            if (body.connectorScopes !== undefined) {
+                if (body.connectorScopes === null)
+                    patch.connectorScopes = undefined;
+                else {
+                    const scopes = normalizeConnectorScopes(body.connectorScopes);
+                    if (!scopes)
+                        return json(res, 400, { error: "connectorScopes must be { apps: { <toolkit>: read | write } } or null" });
+                    patch.connectorScopes = scopes;
+                }
+            }
+            // sending on the person's behalf: ask every time, or a daily allowance
+            if (body.outbound !== undefined) {
+                const policy = normalizeOutboundPolicy(body.outbound);
+                if (!policy)
+                    return json(res, 400, { error: "outbound must be { policy: ask | allow, dailyCap: 1..1000 }" });
+                patch.outbound = policy;
+            }
             // per-bot gate on the workspace's connected apps (Composio)
             if (body.composio !== undefined) {
                 if (typeof body.composio !== "boolean")
@@ -19309,6 +20525,12 @@ const handleRequest = async (req, res) => {
             // Per-bot selection of app-wide MCP servers. Omitted keeps the current
             // selection; null restores all enabled servers; [] explicitly mounts none.
             let requestedMcpServers = existingBot?.mcpServers;
+            if (Object.hasOwn(body, "toolScope")) {
+                const parsed = parseToolScope(body.toolScope === null ? undefined : body.toolScope);
+                if (!parsed.ok)
+                    return json(res, 400, { error: parsed.error });
+                patch.toolScope = parsed.scope;
+            }
             if (body.mcpServers !== undefined) {
                 if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
                     return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
@@ -19560,6 +20782,16 @@ const handleRequest = async (req, res) => {
             // desktop capability or a paired session, which is what the refusal
             // points at.
             const loosened = [];
+            // These three fields were validated above before joining the broad patch.
+            const trustPatch = patch;
+            if (body.outbound !== undefined && trustPatch.outbound?.policy === "allow" &&
+                (existingBot?.outbound?.policy !== "allow" || trustPatch.outbound.dailyCap > existingBot.outbound.dailyCap))
+                loosened.push("outbound");
+            if (body.connectorScopes !== undefined && existingBot?.connectorScopes &&
+                (!trustPatch.connectorScopes || Object.entries(trustPatch.connectorScopes.apps).some(([slug, scope]) => !existingBot.connectorScopes.apps[slug] || (scope === "write" && existingBot.connectorScopes.apps[slug] === "read"))))
+                loosened.push("connectorScopes");
+            if (body.fallback !== undefined && trustPatch.fallback?.some(candidate => !existingBot?.fallback?.some(previous => previous.instanceId === candidate.instanceId && previous.model === candidate.model)))
+                loosened.push("fallback");
             if (Array.isArray(patch.managedSections) && patch.managedSections.some(section => !(existingBot?.managedSections ?? []).includes(section))) {
                 loosened.push("managedSections");
             }
@@ -19586,6 +20818,8 @@ const handleRequest = async (req, res) => {
                 (requestedMcpServers === undefined || requestedMcpServers.some((name) => !existingBot.mcpServers.includes(name)))) {
                 loosened.push("mcpServers");
             }
+            if (Object.hasOwn(body, "toolScope") && toolScopeWidens(existingBot?.toolScope, patch.toolScope))
+                loosened.push("toolScope");
             const browserOrigin = typeof req.headers.origin === "string" && req.headers.origin.trim() !== "";
             if (loosened.length && auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin) {
                 if (store.bots.some((candidate) => candidate.busy)) {
@@ -19621,6 +20855,18 @@ const handleRequest = async (req, res) => {
                 (freshBrowserBot.busy || activeGroupTurnForBot(freshBrowserBot.id))) {
                 return json(res, 409, { error: "stop this bot's turn before changing its memory setting" });
             }
+            if (Object.hasOwn(body, "toolScope")) {
+                if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                    return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
+                }
+                if (toolScopeWidens(freshBrowserBot?.toolScope, patch.toolScope) && auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin && store.bots.some((candidate) => candidate.busy)) {
+                    return json(res, 409, { error: "A bot is working right now, so this change has to come from the desktop app or a paired device. Try again once every bot is idle." });
+                }
+                if (freshBrowserBot && JSON.stringify(freshBrowserBot.toolScope) !== JSON.stringify(patch.toolScope)
+                    && (freshBrowserBot.busy || activeGroupTurnForBot(freshBrowserBot.id))) {
+                    return json(res, 409, { error: "Stop this bot's turns before changing its tool selection." });
+                }
+            }
             // Custom servers are process configuration: a running turn cannot
             // unmount them. Recheck after any awaited runtime revocation above.
             if (body.mcpServers !== undefined) {
@@ -19772,8 +21018,19 @@ const handleRequest = async (req, res) => {
         if (m && method === "GET") {
             if (!store.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
+            if (skillsLibraryEnabled(cfg)) {
+                const { skills, library } = listBotSkillsWithOrigin(m[1], store.bot(m[1]).assignedSkills);
+                return json(res, 200, {
+                    skills,
+                    library,
+                    // the authoritative assignment list: merged rows hide
+                    // assignments a same-name private skill shadows
+                    assignedSkills: store.bot(m[1]).assignedSkills,
+                    staged: listStagedSkillWrites(m[1]).map(stagedSkillListing),
+                });
+            }
             return json(res, 200, {
-                skills: listSkills(m[1]),
+                skills: listBotSkills(store.bot(m[1])),
                 staged: listStagedSkillWrites(m[1]).map(stagedSkillListing),
             });
         }
@@ -19795,7 +21052,8 @@ const handleRequest = async (req, res) => {
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/skills\/([a-z0-9-]+)$/);
         if (m && method === "GET") {
-            const text = readSkillFile(m[1], m[2]);
+            const bot = store.bot(m[1]);
+            const text = bot ? readBotSkillFile(bot, m[2]) : null;
             if (text === null)
                 return json(res, 404, { error: "no such skill" });
             return json(res, 200, { text });
@@ -19815,11 +21073,165 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: result.error });
             return json(res, 200, { ok: true });
         }
+        // ── skills library (features.skillsLibrary): local browse surface ────
+        // Everything here is local: the library on disk, assignments on bot
+        // records, imports from pasted SKILL.md text. No registry, no network.
+        m = path.match(/^\/api\/skills-library$/);
+        if (m && method === "GET") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const index = readSkillLibraryIndex();
+            const skills = listLibrarySkills()
+                .map((listing) => ({
+                name: listing.name,
+                description: listing.description,
+                source: listing.source,
+                enabled: listing.enabled,
+                tags: listing.tags ?? [],
+                version: index[listing.name]?.package?.release ?? null,
+                importedAt: listing.importedAt,
+                ...(listing.license ? { license: listing.license } : {}),
+                ...(listing.compatibility ? { compatibility: listing.compatibility } : {}),
+                warnings: listing.warnings,
+                assignedBots: store.bots
+                    .filter((bot) => bot.assignedSkills?.includes(listing.name))
+                    .map((bot) => ({ id: bot.id, name: bot.name })),
+            }))
+                .sort((a, b) => a.name.localeCompare(b.name));
+            return json(res, 200, { skills });
+        }
+        if (m && method === "POST") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const parsed = z.object({ text: z.string().min(1) }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "text must be the SKILL.md contents to import" });
+            const skill = parseSkillMd(parsed.data.text);
+            if ("error" in skill)
+                return json(res, 400, { error: skill.error });
+            // Imports land disabled with their scan warnings attached: enabling is
+            // a separate, explicit review step on the row.
+            const installed = installLibrarySkill({
+                name: skill.name,
+                instructions: parsed.data.text,
+                source: "local-import",
+                license: skill.license,
+                compatibility: skill.compatibility,
+                tags: skill.tags,
+                warnings: scanSkillText(parsed.data.text),
+                reviewState: "disabled",
+            });
+            if ("error" in installed)
+                return json(res, 422, { error: installed.error });
+            return json(res, 201, { skill: installed });
+        }
+        m = path.match(/^\/api\/skills-library\/([a-z0-9-]+)$/);
+        if (m && method === "GET") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const text = readLibrarySkillFile(m[1]);
+            if (text === null)
+                return json(res, 404, { error: "no such skill" });
+            return json(res, 200, { text });
+        }
+        if (m && method === "PATCH") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const parsed = z.object({ enabled: z.boolean() }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "enabled must be true or false" });
+            const result = setLibrarySkillReviewState(m[1], parsed.data.enabled ? "approved" : "disabled");
+            if ("error" in result)
+                return json(res, 404, { error: result.error });
+            return json(res, 200, { skill: result });
+        }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/skills-library$/);
+        if (m && method === "PUT") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            const parsed = z.object({ skills: z.array(z.string().min(1).max(64)).max(200) }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "skills must be a list of skill names" });
+            const index = readSkillLibraryIndex();
+            const names = [...new Set(parsed.data.skills)];
+            const unknown = names.filter((name) => !index[name]);
+            if (unknown.length)
+                return json(res, 422, { error: "not in the library: " + unknown.join(", ") });
+            store.patchBot(m[1], { assignedSkills: names });
+            return json(res, 200, { assignedSkills: names });
+        }
         // ── section context: a user-owned team brief ────────────────────────
         // Bots receive this in their system context, but no agent tool can write
         // it. That keeps one bot from silently changing every teammate's future
         // turns. The section query parameter is required even for General (""),
         // so a malformed client cannot accidentally read or replace that brief.
+        // ── team memory: the section's shared people, places, decisions, terms ──
+        // The person's view and their edits. Same section rule as the brief:
+        // the query parameter is required even for General.
+        if (path === "/api/team-memory" && (method === "GET" || method === "POST")) {
+            if (!url.searchParams.has("section"))
+                return json(res, 400, { error: "section is required" });
+            const section = sectionContextKey(url.searchParams.get("section") ?? "");
+            if (section.length > 60)
+                return json(res, 400, { error: "section must be at most 60 characters" });
+            if (method === "GET") {
+                return json(res, 200, { section, label: sectionContextLabel(section), entries: teamMemory.list(section) });
+            }
+            const body = await readBody(req);
+            if (!body || typeof body !== "object" || !TEAM_MEMORY_KINDS.includes(String(body.kind))) {
+                return json(res, 400, { error: `kind must be one of ${TEAM_MEMORY_KINDS.join(", ")}` });
+            }
+            try {
+                const proposed = teamMemory.propose(section, { kind: body.kind, name: String(body.name ?? ""), detail: String(body.detail ?? ""), aliases: Array.isArray(body.aliases) ? body.aliases.map(String) : undefined }, { botId: "", botName: "you", threadId: "", at: Date.now() });
+                // the person's own entry never waits on the person
+                if (proposed.status === "proposed")
+                    teamMemory.resolve(section, proposed.entry.id, "accept");
+                return json(res, 201, { entries: teamMemory.list(section) });
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        m = path.match(/^\/api\/team-memory\/([\w-]+)$/);
+        if (m && (method === "PATCH" || method === "DELETE")) {
+            if (!url.searchParams.has("section"))
+                return json(res, 400, { error: "section is required" });
+            const section = sectionContextKey(url.searchParams.get("section") ?? "");
+            if (method === "DELETE") {
+                if (!teamMemory.remove(section, m[1]))
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entries: teamMemory.list(section) });
+            }
+            const body = await readBody(req);
+            if (!body || typeof body !== "object")
+                return json(res, 400, { error: "body must be a JSON object" });
+            if (body.accept === true) {
+                const result = teamMemory.resolve(section, m[1], "accept");
+                if (!result.claimed)
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entries: teamMemory.list(section) });
+            }
+            const patch = {};
+            if (typeof body.name === "string")
+                patch.name = body.name;
+            if (typeof body.detail === "string")
+                patch.detail = body.detail;
+            if (Array.isArray(body.aliases))
+                patch.aliases = body.aliases.map(String);
+            if (typeof body.kind === "string" && TEAM_MEMORY_KINDS.includes(body.kind))
+                patch.kind = body.kind;
+            try {
+                const updated = teamMemory.update(section, m[1], patch);
+                if (!updated)
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entry: updated, entries: teamMemory.list(section) });
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
         if (path === "/api/section-context" && (method === "GET" || method === "PUT")) {
             if (!url.searchParams.has("section"))
                 return json(res, 400, { error: "section is required" });
@@ -20159,53 +21571,17 @@ const handleRequest = async (req, res) => {
             const trigger = onBehalfOf
                 ? { kind: "user", ...(onBehalfOf.email ? { email: onBehalfOf.email } : {}), ...(onBehalfOf.name ? { label: onBehalfOf.name } : {}) }
                 : usageTriggerFor(auth);
-            // The send is acknowledged before the turn starts, so a workspace at its
-            // spend limit is refused here, where the person can see it.
-            try {
-                assertWithinBudget(cfg, DATA_DIR);
-            }
-            catch (error) {
-                return json(res, 409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
-            }
-            if (!store.taskByThread(bot.id, threadId)) {
-                return json(res, 409, { error: "the bot switched tasks before it could receive the message" });
-            }
+            // The spend cap and a task that is gone answer before a malformed
+            // sendId or reply target does. acceptDirectSend checks both again for
+            // callers that do not come through this route; nothing awaits between.
+            const refused = directSendRefusal(bot.id, threadId);
+            if (refused)
+                return json(res, refused.status, refused.body);
             const sendId = parseSendId(body.sendId);
             const replyTo = resolveReplyTarget(threadId, body.replyToId);
-            const receipt = await sendSequencer.run(sendId ? `bot:${bot.id}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id), async () => {
-                if (sendId) {
-                    if (cancelledChatFollowup("bot", bot.id, threadId, sendId)) {
-                        throw Object.assign(new Error("this queued sendId was cancelled; send a new message to try again"), { status: 409 });
-                    }
-                    const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id);
-                    if (accepted.kind === "conflict") {
-                        throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
-                    }
-                    if (accepted.kind === "match") {
-                        const canonical = {
-                            ok: true,
-                            threadId,
-                            message: accepted.message,
-                        };
-                        return accepted.message.steered
-                            ? { ...canonical, steered: true }
-                            : canonical;
-                    }
-                    const queued = queuedSteeredMessage(bot.id, threadId, sendId);
-                    if (queued) {
-                        if (queued.text !== text || queued.replyToId !== replyTo?.id) {
-                            throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
-                        }
-                        return { ok: true, queued: true, queueId: queued.id, threadId, reason: queued.reason };
-                    }
-                }
-                const currentAtStart = store.projectBotForTask(bot.id, threadId);
-                if (!currentAtStart)
-                    throw Object.assign(new Error("no such bot"), { status: 404 });
-                if (!store.taskByThread(currentAtStart.id, threadId)) {
-                    throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
-                }
-                if (guarded) {
+            const sender = messageSender(auth);
+            const guardedStart = guarded
+                ? async (currentAtStart) => {
                     // There is no await between these checks and startTurn's
                     // synchronous transcript append / runtime reservation. In
                     // particular, never steer or enqueue under stale permissions.
@@ -20227,91 +21603,32 @@ const handleRequest = async (req, res) => {
                     if (guardedAdmission.action === "refuse") {
                         throw Object.assign(new Error("wait for a free thread slot before retrying this message"), { status: 409, code: "guarded_busy" });
                     }
-                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth), trigger });
+                    // Stored as relayed: a worker's line for someone else, which a
+                    // Live call on this thread must not read back as typed there.
+                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender, trigger, relayed: true });
                     return { ok: true, threadId, message };
                 }
-                // Claude can accept the message inside its live turn. If the write
-                // loses a race with turn settlement, or the engine cannot steer, the
-                // existing server-side queue records it atomically for the next turn.
-                if (currentAtStart.busy) {
-                    const instance = runningTurnInstance(currentAtStart, threadId);
-                    let steered = "refused";
-                    // A live text steer has no image side channel. Keep an attachment
-                    // message intact for the next ordinary turn, where central image
-                    // admission can hand it to the provider natively.
-                    const carriesImages = extractTurnImages(text).images.length > 0;
-                    const steerTarget = handoffs.current(threadId);
-                    const busyAdmission = admit("direct-busy", {
-                        carriesImages,
-                        pendingComputerSelection: Boolean(computerSelectionTurns.get(threadId)?.selected),
-                        engineCanSteer: Boolean(instance?.adapter.capabilities.queueing && instance.adapter.steer),
-                    });
-                    // steer was offered only when a live instance could take it;
-                    // the second check carries that fact to the type system.
-                    if (busyAdmission.action === "steer" && instance?.adapter.steer) {
-                        steered = await instance.adapter
-                            .steer(threadId, promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"))
-                            .catch(() => "indeterminate");
-                    }
-                    // steer() is awaited adapter work. The turn can settle, the task can
-                    // switch, or the whole bot can be deleted before its acknowledgement
-                    // arrives. Re-read every ownership invariant before appending even a
-                    // successful steer; otherwise that late acknowledgement writes a user
-                    // message into a task the bot no longer owns. A conflict leaves the
-                    // text in the client's composer/outbox to resend deliberately.
-                    const current = store.projectBotForTask(bot.id, threadId);
-                    if (!current)
-                        throw Object.assign(new Error("no such bot"), { status: 404 });
-                    if (!store.taskByThread(bot.id, threadId)) {
-                        throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
-                    }
-                    const delivered = steered !== "refused";
-                    if (delivered) {
-                        if (steered === "steered" && !current.busy) {
-                            throw Object.assign(new Error("the running turn ended before the steered message could be recorded"), { status: 409 });
-                        }
-                        // "indeterminate" falls through to the same record: the words
-                        // may already be folded into a turn whose acknowledgement was
-                        // lost, and handing them back for a resend could run them
-                        // twice. Recording them once is the honest outcome.
-                        // A person steering a webhook turn is present, and auto mode may
-                        // follow them again. But this route is also reachable from the
-                        // bot's own shell on a headless server (loopback is the owner
-                        // there), and "continue" typed by the turn itself must not be
-                        // the thing that lifts the block written against it — so only
-                        // a request that proves a person (a paired session, or the
-                        // desktop's owner capability, which every mutation there has
-                        // already shown) clears the mark.
-                        if (auth.kind === "session" || DESKTOP_MANAGED)
-                            clearUnattended(threadId);
-                        const message = store.appendMessage(threadId, {
-                            role: "user",
-                            kind: "text",
-                            text,
-                            replyToId: replyTo?.id,
-                            sendId,
-                            steered: true,
-                            sender: messageSender(auth),
-                        });
-                        // Offered to the next turn again unless the person stops this one.
-                        handoffs.steered(threadId, steerTarget, instance?.instanceId, message.id);
-                        return { ok: true, steered: true, threadId, message };
-                    }
-                    if (!current.busy) {
-                        return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth), trigger);
-                    }
-                    const queued = queueSteeredMessage(current.id, threadId, text, {
-                        replyToId: replyTo?.id,
-                        sendId,
-                        prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
-                        sender: messageSender(auth),
-                        trigger,
-                    });
-                    return { ok: true, queued: true, queueId: queued.id, threadId };
-                }
-                return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth), trigger);
-            });
-            return json(res, 202, receipt);
+                : undefined;
+            try {
+                const receipt = await acceptDirectSend({
+                    botId: bot.id, threadId, text, sendId, replyTo, sender, trigger,
+                    // A person steering a webhook turn is present, and auto mode may
+                    // follow them again. But this route is also reachable from the
+                    // bot's own shell on a headless server (loopback is the owner
+                    // there), and "continue" typed by the turn itself must not be the
+                    // thing that lifts the block written against it — so only a
+                    // request that proves a person (a paired session, or the desktop's
+                    // owner capability, which every mutation there has already shown)
+                    // clears the mark.
+                    personPresent: auth.kind === "session" || DESKTOP_MANAGED,
+                }, guardedStart);
+                return json(res, 202, receipt);
+            }
+            catch (error) {
+                if (error instanceof DirectSendRefused)
+                    return json(res, error.status, error.body);
+                throw error;
+            }
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/queue\/([\w-]+)$/);
         if (m && method === "DELETE") {
@@ -20378,6 +21695,7 @@ const handleRequest = async (req, res) => {
                     peerAsk: item.peerAsk,
                     steered: true,
                     sender: item.sender,
+                    ...(item.via ? { via: item.via } : {}),
                 }));
                 // Offered to the next turn again unless the person stops this one.
                 for (const message of messages)
@@ -20515,6 +21833,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: refusal });
             }
             return await answeringCardAs(auth, bot.threadId, String(body.requestId), async () => {
+                if (resolveAndSendTrust(res, bot.threadId, String(body.requestId), behavior))
+                    return;
                 if (await resolveAndSendTeamSetup(res, {
                     botId: bot.id, threadId: bot.threadId, requestId: String(body.requestId), behavior,
                 }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
@@ -20567,7 +21887,32 @@ const handleRequest = async (req, res) => {
                     resolvePeerComms(approvalBus, String(body.requestId), behavior)) {
                     return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
                 }
-                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true, body.rememberCommand === true);
+                const requestId = String(body.requestId);
+                const pending = store.messagesFor(bot.threadId).find((message) => message.card?.requestId === requestId);
+                if (isPersistentQuestionCard(pending?.card) && (body.dismiss === true || body.message === QUESTION_DISMISS_MESSAGE)) {
+                    if (!pending?.card)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    if (pending.card.answered !== "answer" || pending.card.dismissed) {
+                        return json(res, 409, { error: "answer this question before dismissing it" });
+                    }
+                    store.patchMessage(bot.threadId, pending.id, { card: { ...pending.card, dismissed: true } });
+                    return json(res, 200, { ok: true, dismissed: true });
+                }
+                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, requestId, behavior, body.message, { id: bot.id, name: bot.name }, body.always === true, body.rememberCommand === true);
+                if (outcome === "unavailable" && isPersistentQuestionCard(pending?.card) && behavior === "answer") {
+                    if (!pending)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    const answer = typeof body.message === "string" ? body.message.trim() : "";
+                    if (!answer)
+                        return json(res, 400, { error: "a question answer is required" });
+                    try {
+                        const reply = await deliverLateQuestionAnswer(auth, bot.threadId, requestId, answer, pending, bot);
+                        return json(res, 200, { ok: true, outcome: "answered", late: true, ...(reply.queued ? { queued: true } : {}) });
+                    }
+                    catch (error) {
+                        return json(res, 409, { error: error instanceof Error ? error.message : "the late answer could not be queued" });
+                    }
+                }
                 return json(res, 200, { ok: true, outcome });
             });
         }
@@ -20592,6 +21937,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: refusal });
             }
             return await answeringCardAs(auth, threadId, requestId, async () => {
+                if (resolveAndSendTrust(res, threadId, requestId, behavior))
+                    return;
                 const skillCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.skillRequest);
                 if (skillCard?.card?.skillRequest) {
                     const skillBotId = skillCard.from?.botId ?? store.botByThread(threadId)?.id;
@@ -20693,14 +22040,46 @@ const handleRequest = async (req, res) => {
                 // answerRequest closes an unreachable card, and a pending approval owns
                 // the composer, so a dead end here locks the room for good.
                 const pending = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId);
+                if (isPersistentQuestionCard(pending?.card) && (body.dismiss === true || body.message === QUESTION_DISMISS_MESSAGE)) {
+                    if (!pending?.card)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    if (pending.card.answered !== "answer" || pending.card.dismissed) {
+                        return json(res, 409, { error: "answer this question before dismissing it" });
+                    }
+                    store.patchMessage(threadId, pending.id, { card: { ...pending.card, dismissed: true } });
+                    return json(res, 200, { ok: true, dismissed: true });
+                }
+                const persistentQuestion = isPersistentQuestionCard(pending?.card);
                 const owner = group
-                    ? (group.busyBotId ? store.bot(group.busyBotId) : undefined) ??
-                        (pending?.from ? store.bot(pending.from.botId) : undefined)
+                    ? persistentQuestion
+                        ? (pending?.from ? store.bot(pending.from.botId) : undefined)
+                        : (group.busyBotId ? store.bot(group.busyBotId) : undefined) ??
+                            (pending?.from ? store.bot(pending.from.botId) : undefined)
                     : store.botByThread(threadId);
+                // A surviving question belongs to its original asker, never a later speaker.
+                if (group && persistentQuestion && !owner) {
+                    return json(res, 409, { error: "the bot that asked this question is no longer available" });
+                }
                 if (!owner && !pending)
                     return json(res, 404, { error: "nothing is waiting on an answer in this conversation" });
                 const requestOwner = owner ? botForThread(owner.id, threadId) : null;
                 const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true, body.rememberCommand === true);
+                if (outcome === "unavailable" && isPersistentQuestionCard(pending?.card) && behavior === "answer") {
+                    if (!pending?.card)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    const answer = typeof body.message === "string" ? body.message.trim() : "";
+                    if (!answer)
+                        return json(res, 400, { error: "a question answer is required" });
+                    if (!owner)
+                        return json(res, 409, { error: "the bot that asked this question is no longer available" });
+                    try {
+                        const reply = await deliverLateQuestionAnswer(auth, threadId, requestId, answer, pending, owner);
+                        return json(res, 200, { ok: true, outcome: "answered", late: true, ...(reply.queued ? { queued: true } : {}) });
+                    }
+                    catch (error) {
+                        return json(res, 409, { error: error instanceof Error ? error.message : "the late answer could not be queued" });
+                    }
+                }
                 return json(res, 200, { ok: true, outcome });
             });
         }
@@ -21697,6 +23076,16 @@ const handleRequest = async (req, res) => {
                 billing: prices ? { currency: cfg.billing?.currency ?? "USD" } : null,
             });
         }
+        // Subscription windows (5-hour and weekly), not the token ledger above.
+        // Same admin gate as /api/usage: this route is unlisted, so it stays admin.
+        if (method === "GET" && path === "/api/plan-usage") {
+            res.setHeader("cache-control", "no-store");
+            const report = await loadPlanUsage({
+                accounts: planAccountsFromInstances(instanceConfigs(cfg)),
+                refresh: url.searchParams.get("refresh") === "1",
+            });
+            return json(res, 200, report);
+        }
         // ── provider key check: does a pasted or saved key open the provider's door ──
         // One read-only request from this server; the verdict never carries the
         // key. Admin scope by default, like every route not opened to clients.
@@ -21779,6 +23168,34 @@ const handleRequest = async (req, res) => {
             res.end(decisionsCsv(readDecisionRange(DATA_DIR, range)));
             return;
         }
+        // ── a bot's activity: what it did, with the outcome ──
+        // Read-only over the same two logs as the inspector and the decision
+        // route above. The bot's own threads (its DM and every task) carry the
+        // tool runs; the decision log carries the bot's requests wherever they
+        // happened, since those rows name the bot.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/activity$/);
+        if (m && method === "GET") {
+            const bot = store.bot(m[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            const rawLimit = url.searchParams.get("limit");
+            const parsedLimit = rawLimit === null ? undefined : Number(rawLimit);
+            if (parsedLimit !== undefined && (!Number.isInteger(parsedLimit) || parsedLimit <= 0)) {
+                return json(res, 400, { error: "limit must be a positive whole number" });
+            }
+            const threadIds = [...new Set([bot.threadId, ...store.tasks(bot.id).map((task) => task.threadId)])];
+            return json(res, 200, {
+                rows: readBotActivity({ dataDir: DATA_DIR, eventsDir: EVENTS_DIR, botId: bot.id, threadIds, limit: parsedLimit ?? 300 }),
+            });
+        }
+        // ── a bot's outbound allowance: the policy, and how much of it is spent ──
+        m = path.match(/^\/api\/bots\/([\w-]+)\/outbound$/);
+        if (m && method === "GET") {
+            const bot = store.bot(m[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            return json(res, 200, { policy: bot.outbound ?? DEFAULT_OUTBOUND_POLICY, today: outboundCounts.today(bot.id) });
+        }
         // ── provider instances (model picker) ──
         if (method === "GET" && path === "/api/instances") {
             // Rescan PATH first: this endpoint is how the app answers "what can I
@@ -22063,7 +23480,7 @@ const handleRequest = async (req, res) => {
                     catch { /* Allow repairing an unused malformed account. */ }
                     entry.config = { ...entry.config, configDir: body.configDir };
                     if (previousDir !== configuredAccountDirectory(entry)) {
-                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId || task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
+                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || bot.fallback?.some(candidate => candidate.instanceId === instanceId) || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId || task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
                         if (used)
                             return json(res, 409, { error: "This account is used by bots or conversation history. Add another account and select it for the bot instead." });
                         assertSeparateClaudeAccount(instances, instanceId, entry);
@@ -22087,7 +23504,7 @@ const handleRequest = async (req, res) => {
             if (instances[instanceId].driver !== "claudeAgent" || instanceId === "claude") {
                 return json(res, 400, { error: "Only added Claude accounts can be removed here." });
             }
-            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId)) ||
+            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || bot.fallback?.some(candidate => candidate.instanceId === instanceId) || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId)) ||
                 busyProviderSelections().some((selection) => selection.instanceId === instanceId)) {
                 return json(res, 409, { error: "Choose another account for the bots and default model using this account before removing it." });
             }
@@ -22746,6 +24163,8 @@ const handleRequest = async (req, res) => {
                             persisted.imageGen.key = "";
                         if (persisted.imageGen?.customApiKey !== undefined)
                             persisted.imageGen.customApiKey = "";
+                        if (persisted.live?.key !== undefined)
+                            persisted.live.key = "";
                         saveConfig(persisted);
                         configWriteCommitted = true;
                         syncCredentialEnv(patch);
@@ -22856,6 +24275,7 @@ const handleRequest = async (req, res) => {
                             drainQueuedSends();
                             drainDelegationWakes();
                             drainConnectorResumes();
+                            drainComputerResumes();
                             drainSecretResumes();
                             drainTeamSetupResumes();
                         }
@@ -23502,6 +24922,7 @@ for (const row of chatFollowups()) {
         role: "user", kind: "text", text: row.kind === "aside" ? row.payload.prompt ?? row.payload.text : row.payload.text, replyToId: row.payload.replyToId,
         sendId: row.payload.sendId, queueId: row.id, sender: row.payload.sender,
         ...(row.kind === "channel" ? { channelMode: row.payload.mode, via: row.payload.via } : {}),
+        ...(row.kind === "bot" && row.payload.via === "call" ? { via: "call" } : {}),
         ...(row.kind === "aside" ? {
             aside: true,
             peerAsk: row.payload.aside
@@ -23617,6 +25038,7 @@ const gracefulShutdown = createGracefulShutdown({
             await Promise.all([...temporaryBrowserSessions.keys()].map((botId) => forgetTemporaryBrowser(botId)));
             await browserRuntime.closeAll();
         },
+        () => liveCalls.shutdown(),
         () => flushAllProfileHistory(),
         () => flushAllMemoryJournals(),
         () => flushUsageLedger(DATA_DIR),