openmausbot 0.1.94 → 0.1.95

package/dist-server/server/index.js

@@ -32,7 +32,7 @@ import { createApprovalModeSupport } from "./harness-capabilities.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { threadRefUrl } from "../src/lib/thread-refs.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isPendingCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegatedApprovalMode } from "./auto-approve.js";
+import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegatedApprovalMode } from "./auto-approve.js";
 import { CommandAllowlistStore, commandAllowlistCandidate } from "./command-allowlist.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
@@ -51,6 +51,7 @@ import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import * as boat from "./boat.js";
+import { cloudComputerRpc } from "./cloud-computer-tools.js";
 import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
 import { isEffortLevel } from "../shared/wire.js";
 import { isPersistentQuestionCard, QUESTION_DISMISS_MESSAGE, shouldSettleRequestCard } from "../shared/ask-question.js";
@@ -66,10 +67,9 @@ import { buildRecall } from "./recall.js";
 import { createMemoryUpkeep, upkeepEnabled } from "./memory-upkeep.js";
 import { appendAboutMe, commitLearned, planLearned } from "./profile-learned.js";
 import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, livePeerRosterBlock, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
-import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmWakeAction, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, } from "./config.js";
+import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -85,7 +85,7 @@ import { entitled } from "./enterprise.js";
 import { HOSTED_CONTRACT_HEADER, HOSTED_CONTRACT_METADATA, HOSTED_CONTRACT_VERSION } from "./hosted-contract.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
 import { blockedTarget, buildNotification, buildSpendNotification } from "./notify.js";
-import { isModelVariant, TurnNotStartedError, newId, } from "./contracts.js";
+import { isModelVariant, TurnNotStartedError, newId, usesCloudComputer, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { recoveryCapabilityError } from "./automatic-recovery.js";
 import { decodeGeneratedImage } from "./generated-image.js";
@@ -150,7 +150,7 @@ import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefault
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
-import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
+import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, TEAM_MEMORY_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, discoverExistingPoolLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { localVmStopReason, recordLocalVmIdleStop } from "./local-vm-stop-reason.js";
@@ -183,6 +183,12 @@ import { fetchGithubTeam, fetchLibraryTeam, fetchTeamCatalog } from "./team-libr
 import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageSummary, parsePackageDocument, renderBotPackageMarkdown } from "./bot-package.js";
 import { createTeamManifest, parseTeamManifest } from "./team-manifest.js";
 import { readThreadEvents } from "./thread-events.js";
+import { TeamMemory, TEAM_MEMORY_KINDS } from "./team-memory.js";
+import { describeTool, readBotActivity } from "./activity.js";
+import { OutboundCounts } from "./outbound-counts.js";
+import { OutboundRequestService } from "./outbound-requests.js";
+import { DEFAULT_OUTBOUND_POLICY, connectorCallsIn, normalizeOutboundPolicy, outboundCallsIn } from "../shared/outbound.js";
+import { connectorAccessDecision, describeConnectorScopes, normalizeConnectorScopes } from "../shared/connector-scopes.js";
 import { bindThreadLogCapProvider } from "./thread-log-rotation.js";
 import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
 import { assertModelVariantSupported, memberTurnSelection } from "./member-turn.js";
@@ -204,7 +210,7 @@ import { startAutoVmClaim } from "./auto-vm-claims.js";
 import { computerFreeAfterText, computerParkedText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
 import { CloudOverflowConsent, CloudSeatLease, cloudOverflowAction, cloudOverflowConsentText, cloudOverflowOfferText, cloudSeatStartedText, cloudSeatStoppedText } from "./cloud-overflow.js";
 import { modelContextWindow } from "./model-context-window.js";
-import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
+import { cloudPlaceDriverError, parseSurface, PlaceUnavailableError, placeUnavailable, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
@@ -292,10 +298,12 @@ const workspaceMaintenance = new WorkspaceBackupMaintenance();
 // Remote clients (server/request-auth.ts, server/sessions.ts): a stable identity
 // for this server, the paired sessions, and the cookie the served UI uses.
 const ENVIRONMENT_ID = loadEnvironmentId(DATA_DIR);
-function signInAllowList() {
-    const current = loadConfig().signIn;
-    return { admins: parseAllowList(current?.admins?.join(",")), members: parseAllowList(current?.members?.join(",")) };
-}
+// Every stream frame and request rechecks email sessions against this list,
+// so config.json is parsed again only when the file changes.
+const signInAllowList = cacheUntilConfigChanges((config) => ({
+    admins: parseAllowList(config.signIn?.admins?.join(",")),
+    members: parseAllowList(config.signIn?.members?.join(",")),
+}));
 const sessions = new SessionRegistry({
     file: join(DATA_DIR, "sessions.json"),
     emailScopesSnapshot: () => {
@@ -940,6 +948,9 @@ function cardAnswerRefusal(auth, threadId, requestId, behavior) {
             ? "A local service can only decline this request. Approve or answer it in OpenMausBot while signed in."
             : null;
     }
+    if (!auth.scopes.includes("admin") && store.messagesFor(threadId).some(message => message.card?.requestId === requestId && message.card.teamMemoryRequest)) {
+        return "Only a workspace admin can review shared team memory.";
+    }
     // A Cloud home is one person's: a device paired with chat-only access (a
     // guest) may read along but never answer, or its words would reach the
     // owner's turn, and through it a lent Mac (docs/cloud-pro.md).
@@ -2724,8 +2735,8 @@ async function browserIntegration(botId, profile, turn) {
     const token = mintInternalCapability({ botId, ...turn, browserSession: session,
         kind: "browser", depth: 0, skillAuthoring: false, createdBots: 0, openedThreads: 0 });
     return { profile: partitionId, session, spec, integration: {
-            command: process.execPath, args: [SPAWNED_PROXIES.browser], env: {
-                ...AGENTS_NODE_FLAG, OMB_BROWSER_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
+            command: process.execPath, args: [SPAWNED_PROXIES.harnessMcp, "browser"], env: {
+                ...AGENTS_NODE_FLAG, OMB_MCP_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
             },
         } };
 }
@@ -2826,8 +2837,10 @@ const routineRequestEnvelopeSchema = z.discriminatedUnion("action", [
     }).strict(),
     ...["pause", "resume", "run_now", "delete"].map((action) => z.object({ ...routineRequestSourceSchema, action: z.literal(action), routineId: z.unknown(), forBotId: z.unknown().optional() }).strict()),
 ]);
-/** The loopback endpoint a bot's computer proxy polls before acting. */
-function controlIntegration(botId, threadId, generation, localVmTarget) {
+/** The loopback endpoint a bot's computer proxy polls before acting. With a
+ * Boat id, the same turn-scoped token also serves that Boat's tools at
+ * /api/internal/computer/mcp, and is revoked when the turn ends. */
+function controlIntegration(botId, threadId, generation, localVmTarget, boxId) {
     return {
         url: `http://127.0.0.1:${PORT}/api/internal/computer-control?botId=${encodeURIComponent(botId)}`,
         token: mintInternalCapability({
@@ -2837,6 +2850,7 @@ function controlIntegration(botId, threadId, generation, localVmTarget) {
             depth: 0,
             kind: "computer",
             ...(localVmTarget ? { localVmTarget } : {}),
+            ...(boxId ? { boxId } : {}),
             ...(teamComputerTurns.get(threadId) ? { teamComputerId: teamComputerTurns.get(threadId).computerId } : {}),
             skillAuthoring: false,
             createdBots: 0,
@@ -3318,7 +3332,7 @@ function previewSystemPrompt(bot) {
     ]
         .filter(Boolean)
         .join(" ");
-    const instance = turnInstance(bot);
+    const instance = registry.get(bot.modelSelection.instanceId);
     const caps = instance?.adapter.capabilities;
     const teamComputer = inheritedTeamComputer(bot);
     const previewComputer = teamComputer ? "cloud" : bot.computer;
@@ -3326,12 +3340,11 @@ function previewSystemPrompt(bot) {
         kind: previewComputer === "vm" ? "vm" : previewComputer === "cloud"
             ? bot.cloudBackend === "vps" ? "vps" : "box" : previewComputer === "local" ? "local" : null,
         driverKind: instance?.driverKind,
-        cloudComputerMcp: caps?.cloudComputerMcp,
         vmPrivate: localVmMode(cfg) === "per-bot",
     });
     const peers = reachablePeers(store.bots, bot);
     const coordination = bot.chiefOfStaff
-        ? chiefOfStaffSystemPrompt(bot.id, store.bots, true, openMausStatusSystemPrompt())
+        ? chiefOfStaffSystemPrompt(bot.id, store.bots, true)
         : peers.length > 0
             ? peerRosterSystemPrompt(peers)
             : "";
@@ -3367,7 +3380,7 @@ function previewSystemPrompt(bot) {
                 browser: previewPlan.computer === undefined ? false : previewPlan.browser,
             }, { note: previewPlan.note, cloudHome: Boolean(CLOUD_HOME) }) },
         { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(agentsMounted && lendingEnabled()) : "" },
-        { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) : "" },
+        { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) + describeConnectorScopes(bot.connectorScopes) : "" },
         { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(engineMcpServers(bot))) : "" },
         { id: "browser", label: "Browser", text: previewPlan.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
         { id: "coordination", label: "Team", text: agentsMounted && coordination ? ` ${coordination}` : "" },
@@ -3375,6 +3388,7 @@ function previewSystemPrompt(bot) {
         { id: "routine", label: "Routines", text: agentsMounted ? ROUTINE_PROMPT : "" },
         { id: "profile", label: "Profile changes", text: agentsMounted ? PROFILE_PROMPT : "" },
         { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+        { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (agentsMounted ? TEAM_MEMORY_PROMPT : "") },
         { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace), enabled: bot.memoryEnabled !== false }) },
         { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? bot.assignedSkills : undefined) : "" },
     ]);
@@ -4279,7 +4293,7 @@ function outstandingAssignmentsPrompt(threadId) {
         assignment: node.text.slice(0, 1_000),
         status: node.status === "queued" ? "waiting for that teammate to be free" : "working on it now",
     }));
-    return ` Assignments you already sent are still outstanding, and nothing in this conversation cancelled them: ${JSON.stringify(listed)}. Do not send them again, do not poll or wait for them, and do not tell the user they were lost. Each result returns to this conversation on its own and resumes you then. Answer the message above with that work still in flight.`;
+    return ` Assignments you already sent are still outstanding, and nothing in this conversation cancelled them: ${JSON.stringify(listed)}. Do not resend them, do not poll or wait for them, and do not tell the user they were lost. Each result returns to this conversation on its own and resumes you then. To change or add to one, send the change to the same teammate with coordinate_bots; it runs after the current work. Answer the message above with that work still in flight.`;
 }
 const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     validate: (node, parent) => roomHandoffProblem(node, parent) ??
@@ -4353,9 +4367,10 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
         }
         // A successful direct work thread closes after its result is reported:
         // folded out of the sidebar, never deleted, and reopened if addressed.
-        // Failed or withheld work stays visible.
+        // Failed or withheld work stays visible, and so does a thread whose
+        // next request is already waiting there.
         const childTask = store.taskByThread(child.botId, child.threadId);
-        if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy
+        if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy && !roomHandoffs.activeDirect(child.threadId)
             && childTask?.openedBy?.kind === "work" && childTask.openedBy.botId === parent.botId) {
             store.setTaskClosedBy(child.botId, child.threadId, { botId: parent.botId, name: store.bot(parent.botId)?.name ?? childTask.openedBy.name, at: Date.now() });
         }
@@ -5280,7 +5295,10 @@ always, rememberCommand) {
         }
         if (messageId)
             askMessageByRequest.delete(`${threadId}:${requestId}`);
-        if (!persistentQuestion)
+        // The card's own answered state gates the message too: a replayed respond
+        // for a card that already settled must not read as a failed delivery —
+        // nothing was lost, the earlier answer already ran.
+        if (!persistentQuestion && !existing?.card?.answered)
             store.appendMessage(threadId, {
                 role: "bot",
                 kind: "activity",
@@ -5451,8 +5469,8 @@ const watchdog = new TurnWatchdog({
         const bot = botForThread(turn.botId, turn.threadId);
         const routineRun = activeRoutineRunForThread(turn.threadId);
         const instance = bot
-            ? runningTurnInstance(bot, turn.threadId, routineRun?.runOn)
-            : routineRun?.runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") : null;
+            ? runningTurnInstance(bot, turn.threadId)
+            : runningTurnEngines.get(turn.threadId) ?? null;
         void instance?.adapter.interruptTurn(turn.threadId).catch(() => { });
         const minutes = Math.round(TURN_STALL_MS / 60_000);
         if (routineRun?.target === "bot") {
@@ -6186,10 +6204,29 @@ async function attachTeamBoat(computer, botId, owner, canMount, remoteAgent) {
         !turnResources.owns(`computer:box:${machine.id}`, owner))
         throw new Error("This computer turn ended while its machine was starting");
     return {
-        integration: { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(botId, owner.threadId, owner.generation) },
+        mount: cloudComputerMount(botId, owner, machine.id, remoteAgent),
         capture: () => boat.screenshotBoat(cfg, ownerId, machine.id),
     };
 }
+/** How a turn's engine reaches a cloud computer. The Computer engine runs its
+ * whole turn on the Boat. Every other engine keeps its own model and sign-in
+ * and gets the Boat as one more stdio computer server (harness-mcp-proxy
+ * computer), in the same slot a Local VM or VPS uses: one mechanism on a
+ * desktop, a headless server and an OMB Cloud. The agent process holds only a
+ * turn-scoped capability naming this Boat, never a Boat credential. */
+function cloudComputerMount(botId, owner, boxId, remoteAgent) {
+    if (remoteAgent)
+        return { computer: { kind: "box", boxId } };
+    const control = controlIntegration(botId, owner.threadId, owner.generation, undefined, boxId);
+    return {
+        localComputer: {
+            command: process.execPath,
+            args: [SPAWNED_PROXIES.harnessMcp, "computer"],
+            env: { ...AGENTS_NODE_FLAG, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`, OMB_MCP_TOKEN: control.token },
+            platform: "linux",
+        },
+    };
+}
 /** "Works on: This computer", strict. One mount for a bot thread and a group
  * chat, so the two cannot drift on what they check or how they fail. */
 async function mountHostComputer(owner, botId, providerSupportsLocal) {
@@ -6291,9 +6328,7 @@ async function attachBotBoat(bot, owner, opts) {
     await bindTurnComputer(owner, `computer:box:${machine.id}`, opts.remoteAgent);
     return {
         capture: () => boat.screenshotBoat(cfg, bot.id, machine.id),
-        integration: opts.canMount
-            ? { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(bot.id, owner.threadId, owner.generation) }
-            : null,
+        mount: opts.canMount ? cloudComputerMount(bot.id, owner, machine.id, opts.remoteAgent) : null,
     };
 }
 function managedBoatOwners() {
@@ -6370,17 +6405,6 @@ function turnProvider(bot, runOn, threadId) {
         return "box";
     return bot.cloudBackend === "vps" ? "vps" : wants === "cloud" ? "box" : null;
 }
-/** A driver with a Boat bridge keeps the selected model. Other engines use
- * Boat's native runner. Start and interrupt must resolve the same owner. */
-function turnInstance(bot, runOn, threadId) {
-    const selected = registry.get(bot.modelSelection.instanceId);
-    if (selected?.adapter.capabilities.cloudComputerMcp)
-        return selected;
-    const onBoat = turnProvider(bot, runOn, threadId) === "box";
-    return onBoat
-        ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
-        : registry.get(bot.modelSelection.instanceId);
-}
 /** Preview requests carry the selected conversation, not whichever thread
  * happens to be the bot's default. A query never grants lifecycle authority. */
 function computerPreviewBot(botId, url) {
@@ -6448,7 +6472,7 @@ async function selectableComputers(bot) {
                     canCreate = Boolean(status?.configured && status.daemonUp && status.container === "missing");
                     reason = status?.problem ?? reason;
                 }
-                else if (boat.boatConfigured(cfg) && (caps?.usesCloudComputer === true || registry.instances().some(instance => instance.driverKind === "boxAgent"))) {
+                else if (boat.boatConfigured(cfg) && caps !== undefined && usesCloudComputer(caps)) {
                     const status = await boat.boatStatus(cfg, bot.id);
                     const lifecycle = boat.boatTurnLifecycleAction({ explicitCloud: true, canMount: true, state: status.box?.state ?? null });
                     ready = lifecycle === "attach";
@@ -6527,8 +6551,9 @@ function continueComputerSelection(threadId, generation, succeeded) {
 /** The engine that dispatched each live turn. A bot's settings may change
  * mid-turn; an interrupt or steer must reach the engine actually running. */
 const runningTurnEngines = new Map();
-function runningTurnInstance(bot, threadId, runOn) {
-    return runningTurnEngines.get(threadId) ?? turnInstance(bot, runOn, threadId);
+function runningTurnInstance(bot, threadId) {
+    // A turn always runs on the bot's own engine, wherever it works.
+    return runningTurnEngines.get(threadId) ?? registry.get(bot.modelSelection.instanceId);
 }
 function providerTransitionForTurn(bot, runOn, threadId) {
     const provider = turnProvider(bot, runOn, threadId);
@@ -7738,7 +7763,7 @@ function markTaskContextExternallyUpdated(bot, threadId) {
     const owner = task.lastInstanceId;
     const record = owner ? task.handedMessages?.[owner] : undefined;
     if (owner && record?.session !== undefined && record.session === task.resumeCursors[owner] &&
-        turnInstance(botForThread(bot.id, threadId) ?? bot, undefined, threadId)?.instanceId === owner &&
+        (botForThread(bot.id, threadId) ?? bot).modelSelection.instanceId === owner &&
         registry.get(owner)?.adapter.capabilities.strictResume) {
         store.patchTask(bot.id, threadId, { unread: true });
         return;
@@ -8796,11 +8821,9 @@ async function startTurn(botId, text, opts) {
     if (hostedModels && !hostedModels.allows(bot.modelSelection))
         throw Object.assign(new Error(hostedModels.error()), { status: 409 });
     const plan = turnSurfacePlan(bot, opts?.runOn, threadId);
-    const instance = turnInstance(bot, opts?.runOn, threadId);
+    const instance = registry.get(bot.modelSelection.instanceId);
     if (!instance) {
-        throw Object.assign(new Error(turnProvider(bot, opts?.runOn, threadId) === "box"
-            ? "the Cloud VM runner is unavailable — configure Boat in App Settings"
-            : `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
+        throw Object.assign(new Error(`provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
     }
     const policyRefusal = policyModelRefusal(instance);
     if (policyRefusal)
@@ -8860,13 +8883,12 @@ async function startTurn(botId, text, opts) {
     if (providerInstancesChanging.has(instanceId)) {
         throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
     }
-    const switchedEngine = instance.instanceId !== bot.modelSelection.instanceId;
-    const useInstanceDefaults = switchedEngine || (opts?.runOn === "cloud" && !instance.adapter.capabilities.cloudComputerMcp);
-    const model = useInstanceDefaults ? instance.models.default : bot.modelSelection.model;
-    // A native cloud runner borrows its instance defaults; a Boat bridge keeps
-    // the bot's selected model, effort and variant.
-    const effort = useInstanceDefaults ? undefined : bot.modelSelection.effort;
-    const variant = useInstanceDefaults ? undefined : bot.modelSelection.variant;
+    // A turn always runs on the bot's own engine, model, effort and variant,
+    // wherever it works: a cloud computer is a tool it mounts, never a reason
+    // to swap the engine (the provider_not_configured incident).
+    const model = bot.modelSelection.model;
+    const effort = bot.modelSelection.effort;
+    const variant = bot.modelSelection.variant;
     assertModelVariantSupported({ variant, effort }, instance.adapter.capabilities);
     // A selection can be persisted while its engine is offline. Re-check when
     // the engine returns so an old or unsupported value never reaches a CLI.
@@ -9190,24 +9212,23 @@ async function startTurn(botId, text, opts) {
             }
             const privateWorkspace = worksInWorkspace ? ensureTaskWorkspace(bot.id, threadId) : undefined;
             const skillInstructions = renderSkillInstructions(selectedSkills, {
-                includeRoot: worksInWorkspace && opts?.runOn !== "cloud",
+                includeRoot: worksInWorkspace,
             });
             const packagePlaybooks = installedPlaybookInstructions(providerText, bot.playbooks);
             // An explicit working folder wins for new tasks; otherwise they use
             // the private bot workspace. A legacy task with an existing provider
             // session deliberately pins to null (the old home-folder behavior),
             // because moving a live session would break resume.
-            // A cloud run happens on the boat, where a host folder means nothing:
-            // pin the task to the default so the header chip never shows the
-            // bot's folder for a task that runs elsewhere.
-            if (opts?.runOn === "cloud")
-                store.pinTaskCwd(bot.id, threadId, undefined, { none: true });
+            // A cloud run keeps the bot's own engine on this host, with the cloud
+            // computer as one more tool, so it works in the same folder as any
+            // other turn (only the Computer engine runs on the Boat, and it has no
+            // workspace files).
             // On a Cloud home a conversation a guest opened is pinned to its own
             // folder when it first runs, not the bot's project folder the owner's
             // conversations share (what it leaves there reaches none of them). One
             // that ran before keeps its pin, unless the session that opened it was
             // revoked: then it was unpinned at boot (server/cloud-owner.ts).
-            const pinnedCwd = privateWorkspace && opts?.runOn !== "cloud"
+            const pinnedCwd = privateWorkspace
                 ? store.pinTaskCwd(bot.id, threadId, privateWorkspace, { privateOnly: cloudGuestOpened(threadId) })
                 : null;
             const cwd = pinnedCwd ?? undefined;
@@ -9224,8 +9245,8 @@ async function startTurn(botId, text, opts) {
             const dwebUrl = process.env.DWEB_URL?.trim();
             if (dwebUrl)
                 integrations.dweb = { url: dwebUrl };
-            // Cloud routines always use Boat/BoatAgent. The per-bot backend applies
-            // only to ordinary turns that mount a computer into the local agent.
+            // Cloud routines always use the bot's Boat. The per-bot backend applies
+            // only to ordinary turns.
             const teamComputer = inheritedTeamComputer(bot);
             const cloudBackend = teamComputer || opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
             const mountsComputerMcp = instance.adapter.capabilities.computerMcp === true;
@@ -9253,6 +9274,20 @@ async function startTurn(botId, text, opts) {
             const placeRefusal = wantedKind && computerPlaceRefusal(wantedKind);
             if (placeRefusal)
                 throw Object.assign(new Error(placeRefusal.message), { status: 409, code: placeRefusal.code });
+            // Where an explicit place came from, so its failure names the one
+            // control that changes it (and a failed Auto-recorded pin is cleared).
+            // Auto and a team's shared computer are nobody's per-turn choice.
+            const placeSource = teamComputer || wants === undefined || wants === "off" ? undefined
+                : opts?.runOn === "cloud" ? "routine"
+                    : plan.pinned ? (dispatchTask?.surfaceSource === "auto" ? "auto-pin" : "pin")
+                        : "works-on";
+            // An engine that cannot use the cloud computer is refused here, before
+            // anything is created or woken — never handed to another engine.
+            if (wants === "cloud" && placeSource) {
+                const unsupported = cloudPlaceDriverError(instance.adapter.capabilities, cloudBackend, placeSource);
+                if (unsupported)
+                    throw new PlaceUnavailableError("cloud", placeSource, unsupported);
+            }
             let previewCapture = null;
             let browserCapture = null;
             let computerKind = null;
@@ -9506,24 +9541,23 @@ async function startTurn(botId, text, opts) {
                     return false;
                 }
             };
-            if (wants === "vm") {
-                if (await attachLocalVm(true))
-                    computerKind = "vm";
-            }
-            else if (wants === "local") {
-                integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
-                computerKind = "local";
-            }
-            // A VPS is a local-agent computer mount, never a remote agent runner.
-            // Explicit Cloud may prepare/start it. Auto remains read-only unless
-            // the person explicitly opted this bot into remote lifecycle actions.
-            if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps") {
-                const unsupported = vps.vpsDriverError(instance.driverKind, mountsComputerMcp);
-                if (unsupported && wants === "cloud")
-                    throw new Error(unsupported);
-                if (unsupported && wants === undefined)
-                    autoVpsProblem = unsupported;
-                if (!unsupported) {
+            // An explicit place that cannot be attached fails the turn with its
+            // cause and the next action; it never quietly moves the work elsewhere.
+            try {
+                if (wants === "vm") {
+                    if (await attachLocalVm(true))
+                        computerKind = "vm";
+                }
+                else if (wants === "local") {
+                    integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
+                    computerKind = "local";
+                }
+                // A VPS is a local-agent computer mount, never a remote agent runner.
+                // Explicit Cloud may prepare/start it. Auto remains read-only unless
+                // the person explicitly opted this bot into remote lifecycle actions.
+                // On Auto an engine that cannot use a computer simply skips it.
+                if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps" &&
+                    !cloudPlaceDriverError(instance.adapter.capabilities, "vps")) {
                     // The VPS "computer" is the desktop inside this bot's managed
                     // container, and only screen work needs that desktop to itself.
                     // So the lease is claimed on the first computer call, through the
@@ -9561,34 +9595,40 @@ async function startTurn(botId, text, opts) {
                         autoVpsProblem = mounted.problem ?? "the VPS computer could not be reached";
                     }
                 }
-            }
-            // Cloud is strict when selected. Native Boat and drivers with a Boat
-            // bridge may also reuse an already-ready Boat on Auto.
-            if (teamComputer) {
-                const attached = await attachTeamBoat(teamComputer, bot.id, resourceOwner, instance.adapter.capabilities.usesCloudComputer === true, instance.adapter.capabilities.remoteAgent === true);
-                integrations.computer = attached.integration;
-                previewCapture = attached.capture;
-                computerKind = "box";
-            }
-            if (!teamComputer && instance.adapter.capabilities.usesCloudComputer === true && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && boat.boatConfigured(cfg)) {
-                const attached = await attachBotBoat(bot, resourceOwner, {
-                    explicitCloud: wants === "cloud",
-                    canMount: instance.adapter.capabilities.usesCloudComputer === true,
-                    remoteAgent: instance.adapter.capabilities.remoteAgent === true,
-                });
-                if (attached) {
+                // Cloud is strict when selected. Every engine that can use it may also
+                // reuse an already-ready Boat on Auto.
+                if (teamComputer) {
+                    const attached = await attachTeamBoat(teamComputer, bot.id, resourceOwner, usesCloudComputer(instance.adapter.capabilities), instance.adapter.capabilities.remoteAgent === true);
+                    Object.assign(integrations, attached.mount);
                     previewCapture = attached.capture;
-                    if (attached.integration) {
-                        integrations.computer = attached.integration;
-                        computerKind = "box";
+                    computerKind = "box";
+                }
+                if (!teamComputer && usesCloudComputer(instance.adapter.capabilities) && (wants === "cloud" || (wants === undefined && !computerPlaceRefusal("box"))) && cloudBackend === "box" && boat.boatConfigured(cfg)) {
+                    const attached = await attachBotBoat(bot, resourceOwner, {
+                        explicitCloud: wants === "cloud",
+                        canMount: usesCloudComputer(instance.adapter.capabilities),
+                        remoteAgent: instance.adapter.capabilities.remoteAgent === true,
+                    });
+                    if (attached) {
+                        previewCapture = attached.capture;
+                        if (attached.mount) {
+                            Object.assign(integrations, attached.mount);
+                            computerKind = "box";
+                        }
                     }
                 }
+                if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
+                    throw new Error(BOAT_NOT_CONFIGURED);
+                }
+                if (wants === "cloud" && cloudBackend === "box" && computerKind !== "box") {
+                    throw new Error("the cloud computer could not be created or reached");
+                }
             }
-            if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
-                throw new Error(BOAT_NOT_CONFIGURED);
-            }
-            if (wants === "cloud" && cloudBackend === "box" && !integrations.computer) {
-                throw new Error("the cloud computer could not be created or reached");
+            catch (error) {
+                if (!placeSource || wants === undefined || wants === "off" || error instanceof DirectTurnSetupCancelled ||
+                    error instanceof ComputerWaitParked || error instanceof PlaceUnavailableError)
+                    throw error;
+                throw placeUnavailable(wants, placeSource, error instanceof Error ? error.message : String(error));
             }
             // Auto-only host fallback. Electron owns cua-driver/TCC attribution;
             // the harness only reads its already-running connection descriptor.
@@ -9679,7 +9719,7 @@ async function startTurn(botId, text, opts) {
                 ? mentionedBots(providerText, sectionPeers)
                 : [];
             const coordinationPrompt = bot.chiefOfStaff
-                ? chiefOfStaffSystemPrompt(bot.id, store.bots, Boolean(integrations.agents), openMausStatusSystemPrompt(), boundedCoordination)
+                ? chiefOfStaffSystemPrompt(bot.id, store.bots, Boolean(integrations.agents), boundedCoordination)
                 : integrations.agents && sectionPeers.length > 0
                     // Ordinary bots could always CALL the peer tools; until now the
                     // one generic sentence they got never named a teammate, so the
@@ -9788,7 +9828,6 @@ async function startTurn(botId, text, opts) {
             const computerPromptKind = resolveComputerPromptKind({
                 kind: computerKind,
                 driverKind: instance.driverKind,
-                cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
                 vmPrivate: localVmMode(cfg) === "per-bot",
             });
             const coordinationNode = opts?.coordination ? roomHandoffs.nodes.get(opts.coordination.id) : undefined;
@@ -9801,14 +9840,14 @@ async function startTurn(botId, text, opts) {
                 // to a turn whose engine actually mounted them (setupMode is already
                 // false when they are not — see agentsMounted above)
                 { id: "setup", label: "Setup", text: setupSystemPrompt(setupMode, { skills: skillAuthoring, cwd: liveBot?.cwd ?? bot.cwd }) },
-                { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
+                { id: "files", label: "File locations", text: worksInWorkspace ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
                 { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
                 { id: "plan", label: "Surface", text: surfacePrompt({ computer: mountedComputer, browser: Boolean(integrations.browser) }, { pinned: plan.pinned, note: plan.note, canSelect: computerSelectionTurns.has(threadId), cloudHome: Boolean(CLOUD_HOME) }) },
                 { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
-                { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) : "" },
+                { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) + describeConnectorScopes((liveBot ?? bot).connectorScopes) : "" },
                 { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
                 { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
                 { id: "coordination", label: "Team", text: coordinationPrompt ? ` ${coordinationPrompt}` : "" },
@@ -9821,6 +9860,7 @@ async function startTurn(botId, text, opts) {
                 { id: "profile", label: "Profile changes", text: profilePrompt },
                 { id: "learn", label: "Skill authoring", text: learnPrompt },
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+                { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (integrations.agents ? TEAM_MEMORY_PROMPT : "") },
                 // what the bot said lately in its other conversations, so a task
                 // never redoes — or forgets — what another one already did
                 { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId, ...recentWorkFilter() })) },
@@ -9866,9 +9906,9 @@ async function startTurn(botId, text, opts) {
             const dispatch = await guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
                 botId: bot.id,
-                startupRecovery: cfg.automaticRecovery?.enabled === true && !opts?.automaticRecoveryAttempted,
+                startupRecovery: cfg.automaticRecovery?.enabled === true &&
+                    (opts?.automaticRecoveryIndex ?? 0) < ((liveBot ?? bot).fallback?.length || (cfg.automaticRecovery.backup ? 1 : 0)),
                 text: withRecalled(recalled, dispatchContext.turnText),
-                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(bot, commsDepth > 0, threadId),
                 toolScope,
@@ -10028,10 +10068,26 @@ async function startTurn(botId, text, opts) {
                 drainDelegationWakes();
                 return;
             }
+            // A failed place never sticks. An Auto-recorded pin to it (a
+            // select_computer switch, or where an earlier Auto turn landed) is the
+            // machine's memory, not a choice: clear it so the next message runs on
+            // Auto. A person's pin stays, and the message names the composer.
+            if (e instanceof PlaceUnavailableError) {
+                const pinned = store.taskByThread(bot.id, threadId);
+                if (pinned?.surface === e.place && pinned.surfaceSource === "auto") {
+                    store.patchTask(bot.id, threadId, { surface: undefined, surfaceSource: undefined });
+                }
+            }
             let message = e instanceof Error ? e.message : String(e);
-            const backup = cfg.automaticRecovery?.enabled ? cfg.automaticRecovery.backup : undefined;
             const current = store.projectBotForTask(bot.id, threadId);
-            if (mayRecover && backup && current && !opts?.automaticRecoveryAttempted && (!opts?.cardContinuation || opts.coordination) &&
+            const backups = cfg.automaticRecovery?.enabled
+                ? current?.fallback?.length ? current.fallback : cfg.automaticRecovery.backup ? [cfg.automaticRecovery.backup] : []
+                : [];
+            const nextIndex = backups.findIndex((candidate, index) => index >= (opts?.automaticRecoveryIndex ?? 0) &&
+                registry.get(candidate.instanceId)?.enabled &&
+                (candidate.instanceId !== instanceId || candidate.model !== model));
+            const backup = backups[nextIndex];
+            if (mayRecover && backup && current && (!opts?.cardContinuation || opts.coordination) &&
                 !directRequestOwners.get(threadId)?.stopped && !hasQueuedSteeredMessages(bot.id, threadId) &&
                 JSON.stringify(current.modelSelection) === JSON.stringify(bot.modelSelection) &&
                 (backup.instanceId !== instanceId || backup.model !== model) &&
@@ -10055,7 +10111,7 @@ async function startTurn(botId, text, opts) {
                                 name: `recovery: Automatic recovery: ${instance.displayName || instance.driverKind} could not start. Trying ${target.displayName || target.driverKind} · ${checked.selection.model} once in this thread.`, ok: true,
                             } });
                         await startTurn(bot.id, text, { ...opts, threadId, userMessage, editedMessageId: undefined,
-                            automaticRecoveryAttempted: true });
+                            automaticRecoveryAttempted: true, automaticRecoveryIndex: nextIndex + 1 });
                         // The backup now owns these callbacks; don't publish a failed
                         // routine/peer result or release a queued receipt in between.
                         directFollowupSettlers.delete(dispatchClaimId);
@@ -10395,15 +10451,15 @@ routines = new RoutineManager({
             goalRunId: runId,
         });
     },
-    interruptTurn: async (botId, threadId, runOn) => {
+    interruptTurn: async (botId, threadId) => {
         const bot = botForThread(botId, threadId);
         pendingDelegationWakes.delete(threadId);
         discardDelegations(commsBus, threadId);
         cancelDirectTurnDispatch(botId, threadId);
         revokeInternalCapabilitiesForThread(threadId);
         const instance = bot
-            ? runningTurnInstance(bot, threadId, runOn)
-            : runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null : null;
+            ? runningTurnInstance(bot, threadId)
+            : runningTurnEngines.get(threadId) ?? null;
         try {
             await instance?.adapter.interruptTurn(threadId);
         }
@@ -10564,9 +10620,13 @@ async function cloudRoutineReadiness(botId, threadId) {
             reason: 'The Boat cloud computer needs a working Boat API key. For the bot’s configured computer, including a self-hosted VPS, set run_on="maus" instead.',
         };
     }
-    const instance = turnInstance(bot, "cloud", threadId);
+    const instance = registry.get(bot.modelSelection.instanceId);
     if (!instance)
-        return { ready: false, reason: "The Cloud VM runner is unavailable. Restart OpenMausBot and try again." };
+        return { ready: false, reason: "The target bot's model is unavailable. Choose another model in the bot's settings." };
+    // The same rule a cloud turn applies, before anything is provisioned.
+    const unsupported = cloudPlaceDriverError(instance.adapter.capabilities, "box");
+    if (unsupported)
+        return { ready: false, reason: "This model can't use a computer. Choose another model, or change where this routine runs." };
     try {
         if ((await instance.snapshot()).state !== "available") {
             return { ready: false, reason: "The target bot's model is not ready to use the Boat cloud computer." };
@@ -10859,6 +10919,69 @@ const validateModelProposal = (selection, current) => {
     }
     return null;
 };
+const teamMemory = new TeamMemory(join(DATA_DIR, "team-memory.json"));
+const outboundRequests = new OutboundRequestService();
+const outboundCounts = new OutboundCounts(join(DATA_DIR, "outbound-counts.json"));
+const OUTBOUND_HOLD_MS = 9 * 60_000;
+function resolveAndSendTrust(res, threadId, requestId, behavior) {
+    const teamMemoryCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.teamMemoryRequest);
+    if (teamMemoryCard?.card?.teamMemoryRequest) {
+        const request = teamMemoryCard.card.teamMemoryRequest;
+        const proposer = teamMemoryCard.from?.botId ? store.bot(teamMemoryCard.from.botId) : store.botByThread(threadId);
+        const result = teamMemory.resolve(request.section, request.entryId, behavior === "allow" ? "accept" : "reject");
+        if (!result.claimed) {
+            if (!teamMemoryCard.card.answered) {
+                store.patchMessage(threadId, teamMemoryCard.id, { card: { ...teamMemoryCard.card, answered: "unavailable", dismissed: true } });
+            }
+            json(res, 200, { ok: true, outcome: "unavailable" });
+            return true;
+        }
+        if (result.state === "already_settled") {
+            json(res, 200, { ok: true, outcome: "allowed-once", alreadySettled: true });
+            return true;
+        }
+        store.patchMessage(threadId, teamMemoryCard.id, {
+            card: { ...teamMemoryCard.card, answered: result.state === "accepted" ? "allow" : "deny" },
+        });
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId: proposer?.id, botName: proposer?.name,
+            tool: "propose_team_memory", summary: teamMemoryCard.card.subtitle,
+            decision: result.state === "accepted" ? "user-approved" : "user-denied", source: "user",
+        });
+        json(res, 200, { ok: true, outcome: result.state === "accepted" ? "allowed-once" : "rejected" });
+        return true;
+    }
+    const outboundCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.outboundRequest);
+    if (outboundCard?.card?.outboundRequest) {
+        const outboundBot = outboundCard.from?.botId ? store.bot(outboundCard.from.botId) : store.botByThread(threadId);
+        const result = outboundRequests.resolve({ threadId, requestId, behavior });
+        if (!result.claimed) {
+            // The hold is memory-only: after a restart the card outlives the
+            // relay that was waiting on it, so close it rather than leave an
+            // approval nobody can deliver owning the composer.
+            if (!outboundCard.card.answered) {
+                store.patchMessage(threadId, outboundCard.id, { card: { ...outboundCard.card, answered: "unavailable", dismissed: true } });
+            }
+            json(res, 200, { ok: true, outcome: "unavailable" });
+            return true;
+        }
+        if (result.state === "already_settled") {
+            json(res, 200, { ok: true, outcome: result.behavior === "allow" ? "allowed-once" : "rejected", alreadySettled: true });
+            return true;
+        }
+        store.patchMessage(threadId, outboundCard.id, {
+            card: { ...outboundCard.card, answered: result.state === "allowed" ? "allow" : "deny" },
+        });
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId: outboundBot?.id, botName: outboundBot?.name,
+            tool: outboundCard.card.tool, summary: outboundCard.card.subtitle,
+            decision: result.state === "allowed" ? "user-approved" : "user-denied", source: "user",
+        });
+        json(res, 200, { ok: true, outcome: result.state === "allowed" ? "allowed-once" : "rejected" });
+        return true;
+    }
+    return false;
+}
 const profileRequests = new ProfileRequestService({
     store,
     autoApply: fullAccessForSource,
@@ -11475,7 +11598,7 @@ setupRetry = 0) {
     const preparedApprovalMode = roomTurnApprovalMode(bot, threadId, orchestration);
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
-    const instance = turnInstance(bot);
+    const instance = registry.get(bot.modelSelection.instanceId);
     const userName = cfg.profile?.name?.trim() || "User";
     if (providerInstancesChanging.has(bot.modelSelection.instanceId)) {
         onDispatchError?.(`${bot.name}'s provider account is being updated — try again shortly`);
@@ -11655,7 +11778,7 @@ setupRetry = 0) {
             : Boolean(readyGroup && store.groupTaskByThread(readyGroup.id, threadId));
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
-        const setupChanged = turnInstance(readyBot) !== instance ||
+        const setupChanged = registry.get(readyBot.modelSelection.instanceId) !== instance ||
             roomTurnApprovalMode(readyBot, threadId, orchestration) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
@@ -11780,6 +11903,13 @@ setupRetry = 0) {
         if (roomPlan.computer === "local" && instance.adapter.capabilities.remoteAgent === true) {
             throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
         }
+        // The same one rule as a bot thread, before anything is provisioned: an
+        // engine that cannot use the cloud computer is refused, never swapped.
+        if (!roomTeamComputer && roomPlan.computer === "cloud") {
+            const unsupported = cloudPlaceDriverError(instance.adapter.capabilities, turnProvider(readyBot) === "vps" ? "vps" : "box");
+            if (unsupported)
+                throw new PlaceUnavailableError("cloud", "works-on", unsupported);
+        }
         // One place per room turn as well: a team computer reached on Auto means
         // no separate built-in browser.
         if (roomPlan.browser && !(roomPlan.computer === undefined && roomTeamComputer)) {
@@ -11798,11 +11928,11 @@ setupRetry = 0) {
             return false;
         }
         if (roomTeamComputer) {
-            const attached = await attachTeamBoat(roomTeamComputer, readyBot.id, resourceOwner, instance.adapter.capabilities.usesCloudComputer === true, instance.adapter.capabilities.remoteAgent === true);
+            const attached = await attachTeamBoat(roomTeamComputer, readyBot.id, resourceOwner, usesCloudComputer(instance.adapter.capabilities), instance.adapter.capabilities.remoteAgent === true);
             if (isCancelled?.() || groupSpeakers.get(threadId) !== roomSpeaker ||
                 activeInternalGenerationByThread.get(threadId) !== internalGeneration)
                 return false;
-            integrations.computer = attached.integration;
+            Object.assign(integrations, attached.mount);
             startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: instance.adapter.capabilities.remoteAgent === true });
         }
         // The speaker's own explicit place, mounted exactly as its bot thread
@@ -11811,89 +11941,99 @@ setupRetry = 0) {
         const roomSetupIsCurrent = () => !isCancelled?.() &&
             groupSpeakers.get(threadId) === roomSpeaker &&
             activeInternalGenerationByThread.get(threadId) === internalGeneration;
-        if (!roomTeamComputer && roomPlan.computer === "local") {
-            integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
-            if (!roomSetupIsCurrent())
-                return false;
-            roomComputerKind = "local";
-        }
-        if (!roomTeamComputer && roomPlan.computer === "cloud") {
-            if (turnProvider(readyBot) === "vps") {
-                const unsupported = vps.vpsDriverError(instance.driverKind, instance.adapter.capabilities.computerMcp === true);
-                if (unsupported)
-                    throw new Error(unsupported);
-                vpsThreadStarted(readyBot.id, threadId);
-                roomVpsBotId = readyBot.id;
-                const mounted = await mountBotVps(readyBot, resourceOwner, {
-                    start: true,
-                    onClaimed: (capture) => {
-                        if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
-                            roomScreenBotId = readyBot.id;
-                            startScreenPoller(readyBot.id, threadId, { computer: capture });
-                        }
-                    },
-                });
+        // An explicit place that cannot be attached fails the member's turn with
+        // its cause and the one setting that changes it.
+        try {
+            if (!roomTeamComputer && roomPlan.computer === "local") {
+                integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
                 if (!roomSetupIsCurrent())
                     return false;
-                if (!("integration" in mounted))
-                    throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
-                integrations.localComputer = mounted.integration;
-                roomComputerKind = "vps";
+                roomComputerKind = "local";
+            }
+            if (!roomTeamComputer && roomPlan.computer === "cloud") {
+                if (turnProvider(readyBot) === "vps") {
+                    vpsThreadStarted(readyBot.id, threadId);
+                    roomVpsBotId = readyBot.id;
+                    const mounted = await mountBotVps(readyBot, resourceOwner, {
+                        start: true,
+                        onClaimed: (capture) => {
+                            if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
+                                roomScreenBotId = readyBot.id;
+                                startScreenPoller(readyBot.id, threadId, { computer: capture });
+                            }
+                        },
+                    });
+                    if (!roomSetupIsCurrent())
+                        return false;
+                    if (!("integration" in mounted))
+                        throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
+                    integrations.localComputer = mounted.integration;
+                    roomComputerKind = "vps";
+                }
+                else {
+                    if (!boat.boatConfigured(cfg))
+                        throw new Error(BOAT_NOT_CONFIGURED);
+                    const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
+                    const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true,
+                        canMount: usesCloudComputer(instance.adapter.capabilities), remoteAgent });
+                    if (!roomSetupIsCurrent())
+                        return false;
+                    if (!attached?.mount)
+                        throw new Error("the cloud computer could not be created or reached");
+                    Object.assign(integrations, attached.mount);
+                    roomScreenBotId = readyBot.id;
+                    startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
+                    roomComputerKind = "box";
+                }
             }
-            else {
-                if (!boat.boatConfigured(cfg))
-                    throw new Error(BOAT_NOT_CONFIGURED);
-                const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
-                const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true,
-                    canMount: instance.adapter.capabilities.usesCloudComputer === true, remoteAgent });
-                if (!roomSetupIsCurrent())
+            // Room and Goal turns use the speaker's desktop, never the coordinator's.
+            // Claim the same lease as direct turns before asynchronous VM setup.
+            if (readyBot.computer === "vm") {
+                if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
+                    throw new Error("this model cannot use the Local VM");
+                }
+                // A distinct identity fences cleanup even in shared mode on the same room thread.
+                const target = { ...localVmTargetForThread(readyBot.id, threadId) };
+                await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
+                if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
+                    throw new Error("this Local VM is being started, stopped, or replaced");
+                }
+                if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
+                    throw new Error("this Local VM is already being used by another turn");
+                }
+                if (localVmMode(cfg) === "pool")
+                    localVmSeatPool.touch(threadId);
+                roomVmTarget = target;
+                localVmThreadTargets.set(threadId, target);
+                localVmActiveThreads.set(target.key, threadId);
+                localVmIdleFor(target).touch();
+                const setupIsCurrent = () => !isCancelled?.() &&
+                    groupSpeakers.get(threadId) === roomSpeaker &&
+                    activeInternalGenerationByThread.get(threadId) === internalGeneration &&
+                    store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
+                    store.bot(readyBot.id)?.busy === true &&
+                    store.group(readyGroup.id)?.busyBotId === readyBot.id;
+                const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
+                if (!setupIsCurrent()) {
                     return false;
-                if (!attached?.integration)
-                    throw new Error("the cloud computer could not be created or reached");
-                integrations.computer = attached.integration;
-                roomScreenBotId = readyBot.id;
-                startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
-                roomComputerKind = "box";
+                }
+                if (!vm.ready || !vm.runtime)
+                    throw new Error(vm.problem ?? "the Local VM is not ready");
+                const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
+                if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
+                    throw new Error("the Local VM lease expired while preparing the turn");
+                }
+                integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, target), target);
             }
         }
-        // Room and Goal turns use the speaker's desktop, never the coordinator's.
-        // Claim the same lease as direct turns before asynchronous VM setup.
-        if (readyBot.computer === "vm") {
-            if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
-                throw new Error("this model cannot use the Local VM");
-            }
-            // A distinct identity fences cleanup even in shared mode on the same room thread.
-            const target = { ...localVmTargetForThread(readyBot.id, threadId) };
-            await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
-            if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
-                throw new Error("this Local VM is being started, stopped, or replaced");
-            }
-            if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
-                throw new Error("this Local VM is already being used by another turn");
-            }
-            if (localVmMode(cfg) === "pool")
-                localVmSeatPool.touch(threadId);
-            roomVmTarget = target;
-            localVmThreadTargets.set(threadId, target);
-            localVmActiveThreads.set(target.key, threadId);
-            localVmIdleFor(target).touch();
-            const setupIsCurrent = () => !isCancelled?.() &&
-                groupSpeakers.get(threadId) === roomSpeaker &&
-                activeInternalGenerationByThread.get(threadId) === internalGeneration &&
-                store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
-                store.bot(readyBot.id)?.busy === true &&
-                store.group(readyGroup.id)?.busyBotId === readyBot.id;
-            const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
-            if (!setupIsCurrent()) {
-                return false;
-            }
-            if (!vm.ready || !vm.runtime)
-                throw new Error(vm.problem ?? "the Local VM is not ready");
-            const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
-            if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
-                throw new Error("the Local VM lease expired while preparing the turn");
-            }
-            integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, target), target);
+        catch (error) {
+            const place = roomPlan.computer;
+            if (place !== "cloud" && place !== "vm" && place !== "local")
+                throw error;
+            if (error instanceof DirectTurnSetupCancelled || error instanceof ComputerWaitParked || error instanceof PlaceUnavailableError)
+                throw error;
+            // A room row is not cut, so the cause keeps all its words.
+            throw placeUnavailable(place, "works-on", error instanceof Error ? error.message : String(error), Infinity);
         }
         const roster = readyGroup.memberIds
             .map((id) => store.bot(id))
@@ -11979,7 +12119,7 @@ setupRetry = 0) {
         const recentLines = recentWork(recentWorkSources(bot), bot, { userName, currentThreadId: threadId, ...recentWorkFilter() });
         const roomComputerPromptKind = resolveComputerPromptKind({
             kind: roomTeamComputer || roomComputerKind === "box" ? "box" : roomVmTarget ? "vm" : roomComputerKind,
-            driverKind: instance.driverKind, cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
+            driverKind: instance.driverKind,
             vmPrivate: localVmMode(cfg) === "per-bot",
         });
         {
@@ -12005,6 +12145,7 @@ setupRetry = 0) {
             { id: "recall", label: "Recall", text: integrations.agents && bot.memoryEnabled !== false ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
             { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+            { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (integrations.agents ? TEAM_MEMORY_PROMPT : "") },
             // the room path has always put a newline before memory and trimmed
             // the block's leading space; keep that so existing prompts are
             // byte-identical. The write guidance follows the tools actually
@@ -12137,7 +12278,6 @@ setupRetry = 0) {
                 threadId,
                 botId: readyBot.id,
                 text: withRecalled(roomRecalled, text),
-                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: roomTurnApprovalMode(readyBot, threadId, orchestration),
                 toolScope: toolScopeForTurn(readyBot.id),
@@ -15212,7 +15352,7 @@ const handleRequest = async (req, res) => {
                         ? "phone"
                         : path.startsWith("/api/internal/connectors/")
                             ? "connectors"
-                            : path === "/api/internal/computer-control"
+                            : path === "/api/internal/computer-control" || path === "/api/internal/computer/mcp"
                                 ? "computer"
                                 : "agents";
             if (internalCapability.kind !== requiredCapabilityKind) {
@@ -15369,7 +15509,7 @@ const handleRequest = async (req, res) => {
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
                 const result = ownersWrite(() => updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText, ...(body.until !== undefined ? { until: body.until } : {}) }, { source: memorySource() }));
-                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : result.code === "over-budget" ? 413 : 400, result);
+                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : 400, result);
             }
             if (method === "POST" && path === "/api/internal/memory/log") {
                 const body = await readInternalBody();
@@ -15403,6 +15543,22 @@ const handleRequest = async (req, res) => {
                 requireActiveInternalCapability();
                 return json(res, 200, { result });
             }
+            // The cloud computer's tools (harness-mcp-proxy computer): the turn's
+            // capability names its Boat, and the Boat credential stays here.
+            if (method === "POST" && path === "/api/internal/computer/mcp") {
+                const body = await readInternalBody();
+                const boxId = internalCapability.boxId;
+                if (!boxId)
+                    return json(res, 403, { error: "this turn has no cloud computer" });
+                const abort = new AbortController();
+                res.once("close", () => { if (!res.writableEnded)
+                    abort.abort(); });
+                return json(res, 200, { result: await cloudComputerRpc(body, {
+                        cfg, boxId, signal: abort.signal,
+                        gate: () => computerCallGate(internalCapability),
+                        assertActive: requireActiveInternalCapability,
+                    }) });
+            }
             if (method === "POST" && path === "/api/internal/phone/claim") {
                 // Lazy phone exclusivity (issue #1663): the turn holds computer:phone
                 // from its first real tool call until it settles. The proxy answers a
@@ -15784,6 +15940,58 @@ const handleRequest = async (req, res) => {
                 });
                 return json(res, 201, proposed);
             }
+            if (method === "POST" && path === "/api/internal/team-memory") {
+                const parsed = z.object({
+                    fromBotId: z.string().min(1).max(128),
+                    fromThreadId: z.string().min(1).max(128),
+                    kind: z.string(),
+                    name: z.string(),
+                    detail: z.string(),
+                    aliases: z.array(z.string()).optional(),
+                }).strict().safeParse(await readInternalBody());
+                if (!parsed.success)
+                    return json(res, 400, { error: "invalid team memory proposal" });
+                const body = parsed.data;
+                const from = store.bot(body.fromBotId);
+                if (!from)
+                    return json(res, 403, { error: "unknown sender" });
+                const owner = connectorThread(from.id, body.fromThreadId);
+                if (!owner)
+                    return json(res, 403, { error: "source conversation does not belong to sender" });
+                if (!sameAudience(from.visibility, undefined) || (owner.group && !roomFeedsBot(owner.group, from))) {
+                    return json(res, 403, { error: "restricted conversations cannot publish section-wide memory; ask an admin to add it" });
+                }
+                if (!TEAM_MEMORY_KINDS.includes(body.kind)) {
+                    return json(res, 400, { error: `kind must be one of ${TEAM_MEMORY_KINDS.join(", ")}` });
+                }
+                let proposed;
+                try {
+                    proposed = teamMemory.propose(from.section, { kind: body.kind, name: body.name, detail: body.detail, aliases: body.aliases }, { botId: from.id, botName: from.name, threadId: body.fromThreadId, at: Date.now() });
+                }
+                catch (error) {
+                    return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+                }
+                const summary = `${proposed.entry.kind[0].toUpperCase()}${proposed.entry.kind.slice(1)}: ${proposed.entry.name}${proposed.entry.aliases.length ? ` (also ${proposed.entry.aliases.join(", ")})` : ""} — ${proposed.entry.detail}`;
+                const section = sectionContextKey(from.section);
+                const card = store.appendMessage(body.fromThreadId, {
+                    role: "bot",
+                    kind: "options",
+                    ...(owner.group ? { from: { botId: from.id, name: from.name, color: from.color } } : {}),
+                    card: {
+                        title: "Remember this for the team?",
+                        subtitle: summary,
+                        options: ["Remember", "Skip"],
+                        requestId: proposed.entry.id,
+                        tool: "propose_team_memory",
+                        teamMemoryRequest: { section, entryId: proposed.entry.id, kind: proposed.entry.kind },
+                    },
+                });
+                appendDecision(DATA_DIR, {
+                    threadId: body.fromThreadId, requestId: proposed.entry.id, botId: from.id, botName: from.name,
+                    tool: "propose_team_memory", summary, decision: "card-shown", source: "team-memory",
+                });
+                return json(res, 201, { status: "proposed", requestId: proposed.entry.id, messageId: card.id, summary });
+            }
             if (method === "POST" && path === "/api/internal/profile-requests") {
                 const parsed = z.object({
                     fromBotId: z.string().min(1).max(128),
@@ -16648,20 +16856,17 @@ const handleRequest = async (req, res) => {
                     })).filter(g => g.members.length);
                     return json(res, 200, { currentRoom: source ? { id: source.id, name: source.name, workingFolder: source.cwd || null } : null,
                         bots: reachablePeers(store.bots, internalSender).map(bot => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section, busy: bot.busy })),
-                        rooms, note: "Without group_id: use this room when in a room, otherwise each distinct assignment starts a fresh thread for that teammate. Give a self-contained brief. Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
+                        rooms, note: "Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
                 }
                 if (method === "POST" && path === "/api/internal/coordinate-bots") {
                     const parsed = z.object({
                         groupId: z.string().min(1).max(128).optional(),
                         botIds: z.array(z.string().min(1).max(128)).min(1).max(4).refine(ids => new Set(ids).size === ids.length),
-                        message: z.string().trim().min(1).max(4000), requestKey: z.string().regex(/^[\w-]{1,100}$/),
+                        message: z.string().trim().min(1).max(4000),
                         rework: z.boolean().default(false),
-                        // Only ever a name for a thread, so it travels under the same
-                        // one-line rule as a peer thread title.
-                        label: z.string().trim().min(1).max(60).refine(fitsOnOneLine).optional(),
                     }).safeParse(await readInternalBody());
                     if (!parsed.success)
-                        return json(res, 400, { error: "Provide 1-4 distinct botIds, message (1-4000 characters), a short requestKey (letters, digits, underscores or hyphens) and an optional one-line label of at most 60 characters." });
+                        return json(res, 400, { error: "Provide 1-4 distinct botIds and a message of 1-4000 characters." });
                     const groupId = parsed.data.groupId ?? source?.id;
                     const destination = groupId ? store.group(groupId) : undefined;
                     if (groupId && !destination)
@@ -16713,58 +16918,63 @@ const handleRequest = async (req, res) => {
                             });
                         approvalGranted = true;
                     }
-                    const accepted = [];
-                    const errors = [];
+                    // A room shows one brief per call, addressed to the call's recipients.
+                    const requestBatchKey = destination ? randomUUID() : undefined;
                     // One receipt per recipient, in the order the caller addressed
                     // them. Dispatch is asynchronous (RoomHandoffs.tick), so a fresh
-                    // enqueue is honestly "queued"; a duplicate inherits the state of
-                    // the node that already carries this request_key.
+                    // enqueue is honestly "queued"; a repeat reports the request it
+                    // repeats.
                     const receipts = [];
+                    // Why nothing was sent, in full: a receipt's detail is clipped.
+                    const refused = [];
                     for (const target of targets) {
                         let createdThread;
                         try {
                             requireActiveInternalCapability();
+                            // Outside a room this conversation has one thread with each
+                            // teammate: the first request opens it, everything after
+                            // continues it and runs once the work already there is done.
+                            const continued = destination ? undefined : store.workThread(target.botId, internalSender.id, address.threadId);
                             if (!destination) {
-                                const task = store.createTask(target.botId, `@${internalSender.name}${parsed.data.label ? ` · ${parsed.data.label}` : " · work"}`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", at: Date.now() });
+                                const task = continued ?? store.createTask(target.botId, `@${internalSender.name} · work`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", threadId: address.threadId, at: Date.now() });
                                 if (!task)
                                     throw new Error("The recipient no longer exists");
-                                target.threadId = createdThread = task.threadId;
+                                target.threadId = task.threadId;
+                                if (!continued)
+                                    createdThread = task.threadId;
                                 applyDelegatedLevel(internalSender, internalCapability.threadId, store.bot(target.botId), target.threadId);
                             }
-                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", destination ? parsed.data.requestKey : undefined);
-                            // A retry keeps its original task; discard the speculative row.
-                            if (duplicate && createdThread && createdThread !== node.threadId) {
+                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", requestBatchKey);
+                            // A repeat lands on the request already made, possibly in a
+                            // thread the person archived meanwhile; a thread opened for it
+                            // is never used.
+                            if (duplicate && createdThread)
                                 store.deleteTask(target.botId, createdThread);
-                            }
-                            if (!duplicate && createdThread)
+                            else if (createdThread)
                                 threadStarters.set(createdThread, openerFrom(address.threadId));
                             createdThread = undefined; // The durable coordinator now owns this task.
-                            accepted.push({ requestId: node.id, botId: node.botId, duplicate, status: node.status });
-                            // A duplicate request_key lands on the node enqueue already
-                            // made. Only a live node can still report: a failed or
-                            // cancelled one already fired its report and tick() skips it,
-                            // so promising "its result will resume you" would be the one
-                            // lie a receipt must never tell.
+                            // Only a live request can still report: a finished one already
+                            // fired its report and tick() skips it, so a repeat of it sends
+                            // nothing and says how to run it again.
+                            const title = destination ? undefined : store.taskByThread(node.botId, node.threadId)?.title;
+                            const finished = {
+                                completed: "it already finished and its result stands; send it with rework=true to run it again",
+                                failed: "it failed; send it with rework=true to retry", cancelled: "it was cancelled; send it with rework=true to retry",
+                            };
+                            const notSent = duplicate && finished[node.status] ? `not sent again: ${finished[node.status]}` : undefined;
+                            if (notSent)
+                                refused.push(notSent);
                             receipts.push(peerDeliveryReceipt({
                                 botId: node.botId,
                                 botName: store.bot(node.botId)?.name,
-                                outcome: duplicate
-                                    ? node.status === "running" || node.status === "completed"
-                                        ? "injected"
-                                        : node.status === "failed" || node.status === "cancelled"
-                                            ? "failed"
-                                            : "queued"
-                                    : "queued",
-                                detail: duplicate
-                                    ? node.status === "running"
-                                        ? "duplicate request_key — this teammate is already running that exact assignment"
-                                        : node.status === "completed"
-                                            ? "duplicate request_key — this teammate already completed that assignment; the earlier result stands"
-                                            : node.status === "failed" || node.status === "cancelled"
-                                                ? `duplicate request_key — the earlier assignment ${node.status === "cancelled" ? "was cancelled" : "failed"} and will not rerun or resume you; resend with a new request_key to retry`
-                                                : "duplicate request_key — already in flight; its result will resume you automatically"
-                                    : "handed to the coordinator; the teammate's turn has not started yet",
+                                outcome: notSent ? "failed" : !duplicate || node.status === "queued" ? "queued" : "injected",
+                                detail: notSent ?? (duplicate
+                                    ? `already sent: it is ${node.status === "queued" ? "queued" : "under way"} and its result will resume you`
+                                    : title
+                                        ? `sent to "${title}"; it runs after anything still running there`
+                                        : "handed to the coordinator; the teammate's turn has not started yet"),
                                 requestId: node.id,
+                                ...(destination ? {} : { threadId: node.threadId }),
                             }));
                             if (!duplicate) {
                                 const recipient = store.bot(target.botId);
@@ -16781,14 +16991,13 @@ const handleRequest = async (req, res) => {
                                 store.deleteTask(target.botId, createdThread);
                             }
                             const said = error instanceof Error ? error.message : String(error);
-                            errors.push({ botId: target.botId, error: said });
-                            receipts.push(peerDeliveryReceipt({
-                                botId: target.botId, botName: store.bot(target.botId)?.name, outcome: "failed", detail: said,
-                            }));
+                            refused.push(said);
+                            receipts.push(peerDeliveryReceipt({ botId: target.botId, botName: store.bot(target.botId)?.name, outcome: "failed", detail: said }));
                         }
                     }
-                    return json(res, accepted.length ? 200 : 409, { accepted, errors, receipts,
-                        ...(accepted.length ? { message: "End your turn after sending all work. These actual teammates will reply and resume you automatically. Do not poll or wait." } : { error: errors.map(e => e.error).join("; ") }),
+                    const sent = refused.length < receipts.length;
+                    return json(res, sent ? 200 : 409, { receipts,
+                        ...(sent ? { message: "End your turn after sending all work. These actual teammates will reply and resume you automatically. Do not poll or wait." } : { error: refused.join("; ") }),
                     });
                 }
             }
@@ -17386,7 +17595,7 @@ const handleRequest = async (req, res) => {
                 // Reading a streamed MCP body yields to ordinary settings requests.
                 // Re-read the live bot immediately before relay so turning Connected
                 // Apps off wins over a request that authenticated under the old value.
-                const currentSender = store.bot(internalCapability.botId);
+                let currentSender = store.bot(internalCapability.botId);
                 if (!currentSender || currentSender.composio === false || !composio.configured(cfg)) {
                     return json(res, 403, { error: "connected apps are not enabled for this bot" });
                 }
@@ -17397,6 +17606,7 @@ const handleRequest = async (req, res) => {
                 // Rows are fire-and-forget: a log failure must never take the call
                 // (or its refusal) down with it.
                 const call = connectorCallFromFrame(body);
+                let serviceSlugs = [];
                 // A bot with no grants record keeps the pre-grants relay: even an
                 // unreadable frame passes through exactly as it always did.
                 if (call.kind === "unrecognized" && currentSender.connectorTools !== undefined) {
@@ -17423,7 +17633,11 @@ const handleRequest = async (req, res) => {
                     // underscored service (bland_ai) keeps its own tools instead of
                     // a plain-prefix grant (bland) capturing them; an unreachable
                     // catalog reads as empty and the plain split stands.
-                    const serviceSlugs = await composio.connectedServiceSlugs(cfg);
+                    serviceSlugs = await composio.connectedServiceSlugs(cfg);
+                    requireActiveInternalCapability();
+                    currentSender = store.bot(internalCapability.botId);
+                    if (!currentSender || currentSender.composio === false || !composio.configured(cfg))
+                        return json(res, 403, { error: "connected apps are no longer enabled for this bot" });
                     const verdict = evaluateConnectorTools(call.names, currentSender.connectorTools, serviceSlugs);
                     if (!verdict.allowed) {
                         for (const denial of verdict.denials) {
@@ -17463,9 +17677,174 @@ const handleRequest = async (req, res) => {
                         rule: verdict.rule,
                     });
                 }
-                const upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
-                    ? req.headers["mcp-session-id"][0]
-                    : req.headers["mcp-session-id"]);
+                // ── the outbound gate ──
+                // A tools/call that sends something (shared/outbound.ts) is its own
+                // confirmation in every approval mode, Full included: it waits on a
+                // card, or spends the bot's daily allowance. Everything else relays
+                // untouched. A refusal is an ordinary tool error so the bot reads
+                // it and carries on, rather than a transport failure it retries.
+                const rpc = body && typeof body === "object" && !Array.isArray(body)
+                    ? body
+                    : null;
+                const rpcParams = rpc?.params && typeof rpc.params === "object" && !Array.isArray(rpc.params)
+                    ? rpc.params
+                    : null;
+                // The app tools this call would actually run, seen through Composio's
+                // meta tools (a multi-execute list, workbench code), and the ones
+                // among them that send.
+                const outboundCalls = rpc?.method === "tools/call" && typeof rpcParams?.name === "string"
+                    ? outboundCallsIn(rpcParams.name, rpcParams.arguments)
+                    : [];
+                const outboundTool = outboundCalls.length ? outboundCalls[0].slug : null;
+                const refuseOutbound = (text) => {
+                    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+                    return res.end(JSON.stringify({ jsonrpc: "2.0", id: rpc?.id ?? null, result: { content: [{ type: "text", text }], isError: true } }));
+                };
+                // ── connection scopes ──
+                // Checked first: an app this bot may not touch is refused outright,
+                // never turned into a question for the person.
+                const connectorCalls = rpc?.method === "tools/call" && typeof rpcParams?.name === "string"
+                    ? connectorCallsIn(rpcParams.name, rpcParams.arguments)
+                    : [];
+                const access = connectorAccessDecision(currentSender.connectorScopes, connectorCalls, serviceSlugs);
+                if (!access.ok) {
+                    const described = describeTool(access.slug);
+                    const appName = described.app ?? access.toolkit;
+                    appendDecision(DATA_DIR, {
+                        threadId: internalCapability.threadId, botId: currentSender.id, botName: currentSender.name,
+                        tool: access.slug, decision: "auto-denied", source: "connector-scope", rule: `scope:${access.toolkit}:${access.reason}`,
+                    });
+                    return refuseOutbound(access.reason === "app"
+                        ? `OpenMausBot did not run this: ${currentSender.name} has not been given access to ${appName}. Ask the user to allow it under the bot's Access settings, and do not retry.`
+                        : `OpenMausBot did not run this: ${appName} is read-only for ${currentSender.name}, and ${described.label} would write to it. Ask the user before trying again.`);
+                }
+                const opaque = connectorCalls.some(call => call.slug === "COMPOSIO_PROXY_EXECUTE");
+                if (opaque && currentSender.connectorTools !== undefined)
+                    return refuseOutbound("OpenMausBot cannot verify this code against this bot's tool grants. Use a direct app tool.");
+                let outboundApproved = false;
+                if (outboundTool) {
+                    const policy = currentSender.outbound ?? DEFAULT_OUTBOUND_POLICY;
+                    const threadId = internalCapability.threadId;
+                    const { app } = describeTool(outboundTool);
+                    const summary = outboundCalls.map((call) => {
+                        const described = describeTool(call.slug);
+                        const argsText = call.arguments === undefined ? "" : JSON.stringify(call.arguments);
+                        return `${described.app ? `${described.app} · ` : ""}${described.label}${argsText ? `\n${argsText.slice(0, 400)}${argsText.length > 400 ? "… [arguments truncated]" : ""}` : ""}`;
+                    }).join("\n\n");
+                    const capNote = (count) => `OpenMausBot did not send this. ${currentSender.name} has reached its daily limit of ${count} outbound action${count === 1 ? "" : "s"}. Ask the user to raise the limit under the bot's Permissions before trying again.`;
+                    if (policy.policy === "allow" && !opaque) {
+                        const today = outboundCounts.today(currentSender.id);
+                        if (today + outboundCalls.length > policy.dailyCap) {
+                            appendDecision(DATA_DIR, {
+                                threadId, botId: currentSender.id, botName: currentSender.name,
+                                tool: outboundTool, summary, decision: "auto-denied", source: "outbound", rule: `daily-cap:${policy.dailyCap}`,
+                            });
+                            return refuseOutbound(capNote(policy.dailyCap));
+                        }
+                    }
+                    else {
+                        const owner = connectorThread(currentSender.id, threadId);
+                        const held = outboundRequests.open({ botId: currentSender.id, threadId, tool: outboundTool, timeoutMs: OUTBOUND_HOLD_MS });
+                        const card = store.appendMessage(threadId, {
+                            role: "bot",
+                            kind: "options",
+                            ...(owner?.group ? { from: { botId: currentSender.id, name: currentSender.name, color: currentSender.color } } : {}),
+                            card: {
+                                title: "Send on your behalf?",
+                                subtitle: summary,
+                                options: ["Allow", "Deny"],
+                                requestId: held.requestId,
+                                tool: outboundTool,
+                                held: HELD_NOTE["approval.held.outbound"],
+                                heldCode: "approval.held.outbound",
+                                outboundRequest: { tool: outboundTool, app },
+                            },
+                        });
+                        appendDecision(DATA_DIR, {
+                            threadId, requestId: held.requestId, botId: currentSender.id, botName: currentSender.name,
+                            tool: outboundTool, summary, decision: "card-shown", source: "outbound",
+                        });
+                        if (owner?.group) {
+                            if (activeGroupTurnForBot(currentSender.id)?.threadId === threadId)
+                                store.setActivity(currentSender.id, "waiting-on-you");
+                        }
+                        else if (store.taskByThread(currentSender.id, threadId)?.busy) {
+                            store.setTaskActivity(currentSender.id, threadId, "waiting-on-you");
+                        }
+                        notify(buildNotification("approval", currentSender, threadId, summary, { avatarUrl: currentSender.avatarUrl }));
+                        const answer = await held.answer;
+                        outboundRequests.forget(held.requestId);
+                        if (internalCapabilityIsActive(internalCapability)) {
+                            const waiting = store.bot(currentSender.id);
+                            if (owner?.group) {
+                                if (activeGroupTurnForBot(currentSender.id)?.threadId === threadId && waiting?.activity === "waiting-on-you")
+                                    store.setActivity(waiting.id, "working");
+                            }
+                            else if (store.taskByThread(currentSender.id, threadId)?.activity === "waiting-on-you") {
+                                store.setTaskActivity(currentSender.id, threadId, "working");
+                            }
+                        }
+                        if (answer !== "allow") {
+                            if (answer === "timeout") {
+                                const stale = store.messagesFor(threadId).find((message) => message.id === card.id);
+                                if (stale?.card && !stale.card.answered) {
+                                    store.patchMessage(threadId, stale.id, { card: { ...stale.card, answered: "unavailable", dismissed: true } });
+                                }
+                            }
+                            return refuseOutbound(answer === "timeout"
+                                ? "OpenMausBot did not send this: nobody answered the approval in time. Ask the user before trying again."
+                                : "OpenMausBot did not send this: the user declined. Do not retry it; ask the user what they would like instead.");
+                        }
+                        outboundApproved = true;
+                        requireActiveInternalCapability();
+                    }
+                }
+                let dispatchRefusal;
+                const refuseDispatch = (text) => {
+                    dispatchRefusal = text;
+                    throw new Error(text);
+                };
+                let upstream;
+                try {
+                    upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
+                        ? req.headers["mcp-session-id"][0]
+                        : req.headers["mcp-session-id"], () => {
+                        requireActiveInternalCapability();
+                        const fresh = store.bot(internalCapability.botId);
+                        if (!fresh || fresh.composio === false || !composio.configured(cfg))
+                            refuseDispatch("Connected apps were disabled while this call waited.");
+                        const freshAccess = connectorAccessDecision(fresh.connectorScopes, connectorCalls, serviceSlugs);
+                        if (!freshAccess.ok || (opaque && fresh.connectorTools !== undefined) ||
+                            (call.kind === "tools" && !evaluateConnectorTools(call.names, fresh.connectorTools, serviceSlugs).allowed) ||
+                            (call.kind === "unrecognized" && fresh.connectorTools !== undefined)) {
+                            refuseDispatch("This bot's connected-app permissions changed. The call was not run.");
+                        }
+                        if (outboundTool) {
+                            const policy = fresh.outbound ?? DEFAULT_OUTBOUND_POLICY;
+                            if (policy.policy === "allow" && !opaque) {
+                                let reserved;
+                                try {
+                                    reserved = outboundCounts.reserve(fresh.id, outboundCalls.length, policy.dailyCap);
+                                }
+                                catch {
+                                    refuseDispatch("The daily allowance could not be saved. Nothing was sent.");
+                                }
+                                if (reserved === null)
+                                    refuseDispatch("This bot has reached its daily outbound limit. Nothing was sent.");
+                                appendDecision(DATA_DIR, { threadId: internalCapability.threadId, botId: fresh.id, botName: fresh.name,
+                                    tool: outboundTool, decision: "auto-approved", source: "outbound", rule: `daily-allowance:${reserved}/${policy.dailyCap}` });
+                            }
+                            else if (!outboundApproved) {
+                                refuseDispatch("The outbound policy changed. Ask for approval again before sending.");
+                            }
+                        }
+                    });
+                }
+                catch (error) {
+                    if (dispatchRefusal)
+                        return refuseOutbound(dispatchRefusal);
+                    throw error;
+                }
                 const headers = {
                     "content-type": upstream.contentType,
                     "cache-control": "no-store",
@@ -17543,6 +17922,16 @@ const handleRequest = async (req, res) => {
                 if (!composio.configured(cfg) || owner.bot.composio === false) {
                     return json(res, 409, { error: "connected apps are not enabled for this bot" });
                 }
+                if (owner.bot.connectorScopes) {
+                    const outside = slugs.find((slug) => !owner.bot.connectorScopes?.apps[slug]);
+                    if (outside) {
+                        appendDecision(DATA_DIR, {
+                            threadId, botId: owner.bot.id, botName: owner.bot.name,
+                            tool: "COMPOSIO_MANAGE_CONNECTIONS", summary: outside, decision: "auto-denied", source: "connector-scope", rule: `scope:${outside}:app`,
+                        });
+                        return json(res, 403, { error: `${owner.bot.name} has not been given access to ${outside}; allow it under the bot's Access settings first` });
+                    }
+                }
                 const connectionState = await composio.connectionStatus(cfg, slugs).catch(() => ({}));
                 requireActiveInternalCapability();
                 const messageIds = [];
@@ -20045,6 +20434,43 @@ const handleRequest = async (req, res) => {
                 patch.section = section ?? undefined;
             if (body.chiefOfStaff === false)
                 patch.chiefOfStaff = false;
+            // where a task carries on when this engine is unavailable, in order
+            if (body.fallback !== undefined) {
+                if (!Array.isArray(body.fallback) || body.fallback.length > 5) {
+                    return json(res, 400, { error: "fallback must be a list of up to five { instanceId, model } entries" });
+                }
+                const chain = [];
+                for (const entry of body.fallback) {
+                    const row = entry && typeof entry === "object" ? entry : null;
+                    if (!row || typeof row.instanceId !== "string" || !/^[\w.-]+$/.test(row.instanceId) || typeof row.model !== "string" || !row.model.trim() || row.model.length > 500) {
+                        return json(res, 400, { error: "fallback must be a list of up to five { instanceId, model } entries" });
+                    }
+                    if (!registry.get(row.instanceId))
+                        return json(res, 400, { error: `fallback engine "${row.instanceId}" is not available` });
+                    if (chain.some((seen) => seen.instanceId === row.instanceId))
+                        continue;
+                    chain.push({ instanceId: row.instanceId, model: row.model.trim() });
+                }
+                patch.fallback = chain;
+            }
+            // which connected apps this bot may use; null clears back to all of them
+            if (body.connectorScopes !== undefined) {
+                if (body.connectorScopes === null)
+                    patch.connectorScopes = undefined;
+                else {
+                    const scopes = normalizeConnectorScopes(body.connectorScopes);
+                    if (!scopes)
+                        return json(res, 400, { error: "connectorScopes must be { apps: { <toolkit>: read | write } } or null" });
+                    patch.connectorScopes = scopes;
+                }
+            }
+            // sending on the person's behalf: ask every time, or a daily allowance
+            if (body.outbound !== undefined) {
+                const policy = normalizeOutboundPolicy(body.outbound);
+                if (!policy)
+                    return json(res, 400, { error: "outbound must be { policy: ask | allow, dailyCap: 1..1000 }" });
+                patch.outbound = policy;
+            }
             // per-bot gate on the workspace's connected apps (Composio)
             if (body.composio !== undefined) {
                 if (typeof body.composio !== "boolean")
@@ -20356,6 +20782,16 @@ const handleRequest = async (req, res) => {
             // desktop capability or a paired session, which is what the refusal
             // points at.
             const loosened = [];
+            // These three fields were validated above before joining the broad patch.
+            const trustPatch = patch;
+            if (body.outbound !== undefined && trustPatch.outbound?.policy === "allow" &&
+                (existingBot?.outbound?.policy !== "allow" || trustPatch.outbound.dailyCap > existingBot.outbound.dailyCap))
+                loosened.push("outbound");
+            if (body.connectorScopes !== undefined && existingBot?.connectorScopes &&
+                (!trustPatch.connectorScopes || Object.entries(trustPatch.connectorScopes.apps).some(([slug, scope]) => !existingBot.connectorScopes.apps[slug] || (scope === "write" && existingBot.connectorScopes.apps[slug] === "read"))))
+                loosened.push("connectorScopes");
+            if (body.fallback !== undefined && trustPatch.fallback?.some(candidate => !existingBot?.fallback?.some(previous => previous.instanceId === candidate.instanceId && previous.model === candidate.model)))
+                loosened.push("fallback");
             if (Array.isArray(patch.managedSections) && patch.managedSections.some(section => !(existingBot?.managedSections ?? []).includes(section))) {
                 loosened.push("managedSections");
             }
@@ -20731,6 +21167,71 @@ const handleRequest = async (req, res) => {
         // it. That keeps one bot from silently changing every teammate's future
         // turns. The section query parameter is required even for General (""),
         // so a malformed client cannot accidentally read or replace that brief.
+        // ── team memory: the section's shared people, places, decisions, terms ──
+        // The person's view and their edits. Same section rule as the brief:
+        // the query parameter is required even for General.
+        if (path === "/api/team-memory" && (method === "GET" || method === "POST")) {
+            if (!url.searchParams.has("section"))
+                return json(res, 400, { error: "section is required" });
+            const section = sectionContextKey(url.searchParams.get("section") ?? "");
+            if (section.length > 60)
+                return json(res, 400, { error: "section must be at most 60 characters" });
+            if (method === "GET") {
+                return json(res, 200, { section, label: sectionContextLabel(section), entries: teamMemory.list(section) });
+            }
+            const body = await readBody(req);
+            if (!body || typeof body !== "object" || !TEAM_MEMORY_KINDS.includes(String(body.kind))) {
+                return json(res, 400, { error: `kind must be one of ${TEAM_MEMORY_KINDS.join(", ")}` });
+            }
+            try {
+                const proposed = teamMemory.propose(section, { kind: body.kind, name: String(body.name ?? ""), detail: String(body.detail ?? ""), aliases: Array.isArray(body.aliases) ? body.aliases.map(String) : undefined }, { botId: "", botName: "you", threadId: "", at: Date.now() });
+                // the person's own entry never waits on the person
+                if (proposed.status === "proposed")
+                    teamMemory.resolve(section, proposed.entry.id, "accept");
+                return json(res, 201, { entries: teamMemory.list(section) });
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        m = path.match(/^\/api\/team-memory\/([\w-]+)$/);
+        if (m && (method === "PATCH" || method === "DELETE")) {
+            if (!url.searchParams.has("section"))
+                return json(res, 400, { error: "section is required" });
+            const section = sectionContextKey(url.searchParams.get("section") ?? "");
+            if (method === "DELETE") {
+                if (!teamMemory.remove(section, m[1]))
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entries: teamMemory.list(section) });
+            }
+            const body = await readBody(req);
+            if (!body || typeof body !== "object")
+                return json(res, 400, { error: "body must be a JSON object" });
+            if (body.accept === true) {
+                const result = teamMemory.resolve(section, m[1], "accept");
+                if (!result.claimed)
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entries: teamMemory.list(section) });
+            }
+            const patch = {};
+            if (typeof body.name === "string")
+                patch.name = body.name;
+            if (typeof body.detail === "string")
+                patch.detail = body.detail;
+            if (Array.isArray(body.aliases))
+                patch.aliases = body.aliases.map(String);
+            if (typeof body.kind === "string" && TEAM_MEMORY_KINDS.includes(body.kind))
+                patch.kind = body.kind;
+            try {
+                const updated = teamMemory.update(section, m[1], patch);
+                if (!updated)
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entry: updated, entries: teamMemory.list(section) });
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
         if (path === "/api/section-context" && (method === "GET" || method === "PUT")) {
             if (!url.searchParams.has("section"))
                 return json(res, 400, { error: "section is required" });
@@ -21332,6 +21833,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: refusal });
             }
             return await answeringCardAs(auth, bot.threadId, String(body.requestId), async () => {
+                if (resolveAndSendTrust(res, bot.threadId, String(body.requestId), behavior))
+                    return;
                 if (await resolveAndSendTeamSetup(res, {
                     botId: bot.id, threadId: bot.threadId, requestId: String(body.requestId), behavior,
                 }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
@@ -21434,6 +21937,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: refusal });
             }
             return await answeringCardAs(auth, threadId, requestId, async () => {
+                if (resolveAndSendTrust(res, threadId, requestId, behavior))
+                    return;
                 const skillCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.skillRequest);
                 if (skillCard?.card?.skillRequest) {
                     const skillBotId = skillCard.from?.botId ?? store.botByThread(threadId)?.id;
@@ -22663,6 +23168,34 @@ const handleRequest = async (req, res) => {
             res.end(decisionsCsv(readDecisionRange(DATA_DIR, range)));
             return;
         }
+        // ── a bot's activity: what it did, with the outcome ──
+        // Read-only over the same two logs as the inspector and the decision
+        // route above. The bot's own threads (its DM and every task) carry the
+        // tool runs; the decision log carries the bot's requests wherever they
+        // happened, since those rows name the bot.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/activity$/);
+        if (m && method === "GET") {
+            const bot = store.bot(m[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            const rawLimit = url.searchParams.get("limit");
+            const parsedLimit = rawLimit === null ? undefined : Number(rawLimit);
+            if (parsedLimit !== undefined && (!Number.isInteger(parsedLimit) || parsedLimit <= 0)) {
+                return json(res, 400, { error: "limit must be a positive whole number" });
+            }
+            const threadIds = [...new Set([bot.threadId, ...store.tasks(bot.id).map((task) => task.threadId)])];
+            return json(res, 200, {
+                rows: readBotActivity({ dataDir: DATA_DIR, eventsDir: EVENTS_DIR, botId: bot.id, threadIds, limit: parsedLimit ?? 300 }),
+            });
+        }
+        // ── a bot's outbound allowance: the policy, and how much of it is spent ──
+        m = path.match(/^\/api\/bots\/([\w-]+)\/outbound$/);
+        if (m && method === "GET") {
+            const bot = store.bot(m[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            return json(res, 200, { policy: bot.outbound ?? DEFAULT_OUTBOUND_POLICY, today: outboundCounts.today(bot.id) });
+        }
         // ── provider instances (model picker) ──
         if (method === "GET" && path === "/api/instances") {
             // Rescan PATH first: this endpoint is how the app answers "what can I
@@ -22947,7 +23480,7 @@ const handleRequest = async (req, res) => {
                     catch { /* Allow repairing an unused malformed account. */ }
                     entry.config = { ...entry.config, configDir: body.configDir };
                     if (previousDir !== configuredAccountDirectory(entry)) {
-                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId || task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
+                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || bot.fallback?.some(candidate => candidate.instanceId === instanceId) || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId || task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
                         if (used)
                             return json(res, 409, { error: "This account is used by bots or conversation history. Add another account and select it for the bot instead." });
                         assertSeparateClaudeAccount(instances, instanceId, entry);
@@ -22971,7 +23504,7 @@ const handleRequest = async (req, res) => {
             if (instances[instanceId].driver !== "claudeAgent" || instanceId === "claude") {
                 return json(res, 400, { error: "Only added Claude accounts can be removed here." });
             }
-            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId)) ||
+            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || bot.fallback?.some(candidate => candidate.instanceId === instanceId) || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId)) ||
                 busyProviderSelections().some((selection) => selection.instanceId === instanceId)) {
                 return json(res, 409, { error: "Choose another account for the bots and default model using this account before removing it." });
             }