openmausbot 0.1.94 → 0.1.96

package/dist-server/server/index.js

@@ -27,12 +27,15 @@ import { assertRequestTarget, guardedRequestPath, requestConflict, requestNeedsI
 import { botAvatarUrlFromStoredPath } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
+import { failedTurnTool } from "../shared/failed-turn.js";
+import { phonePairingLink } from "../shared/pairing-link.js";
+import { canWorkOnCloud } from "../shared/cloud-computer.js";
 import { approvalModeFor, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { createApprovalModeSupport } from "./harness-capabilities.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { threadRefUrl } from "../src/lib/thread-refs.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isPendingCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegatedApprovalMode } from "./auto-approve.js";
+import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegatedApprovalMode } from "./auto-approve.js";
 import { CommandAllowlistStore, commandAllowlistCandidate } from "./command-allowlist.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
@@ -51,13 +54,14 @@ import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import * as boat from "./boat.js";
+import { cloudComputerRpc } from "./cloud-computer-tools.js";
 import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
 import { isEffortLevel } from "../shared/wire.js";
 import { isPersistentQuestionCard, QUESTION_DISMISS_MESSAGE, shouldSettleRequestCard } from "../shared/ask-question.js";
 import { parseToolScope, toolScopeWidens } from "../shared/tool-scope.js";
 import { boatCreateRecoverySnapshot, retireDeletedBoatCreate } from "./boat-create-idempotency.js";
 import { boatDeletionSnapshot } from "./boat-delete-journal.js";
-import { liveDecisionRefusal } from "../shared/live-approval.js";
+import { liveCardKind, liveDecisionRefusal } from "../shared/live-approval.js";
 import { boatAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { connectorCallFromFrame, connectorRefusalText, connectorUnrecognizedText, evaluateConnectorTools } from "./connector-verdict.js";
@@ -66,10 +70,9 @@ import { buildRecall } from "./recall.js";
 import { createMemoryUpkeep, upkeepEnabled } from "./memory-upkeep.js";
 import { appendAboutMe, commitLearned, planLearned } from "./profile-learned.js";
 import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, livePeerRosterBlock, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
-import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmWakeAction, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, } from "./config.js";
+import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, mergeOpenCodeProviderKeys, openCodeProviderKeys, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -89,12 +92,12 @@ import { isModelVariant, TurnNotStartedError, newId, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { recoveryCapabilityError } from "./automatic-recovery.js";
 import { decodeGeneratedImage } from "./generated-image.js";
-import { MAX_MCP_SERVERS, isRemoteMcpServer, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
+import { addDisabledMcpServer, MAX_MCP_SERVERS, isRemoteMcpServer, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
 import { McpOAuthError, McpSignInError, McpOAuthManager, mcpOAuthRedirectUri, withMcpSignIn, withoutPendingSignIn } from "./mcp-oauth.js";
 import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
-import { openCodeProviderKeysAllowed, setOpenCodeProviderKeyPolicy } from "./drivers/acp/opencode-go.js";
+import { openCodeProviderKeysAllowed, setOpenCodeOwnProviderKeys, setOpenCodeProviderKeyPolicy } from "./drivers/acp/opencode-go.js";
 import { getOrCreateChannel, mirrorActivity, mirrorExchange, mirrorReply } from "./comms-visibility.js";
 import { readMessageText, recallMessages, recentMessages, searchMessagesAsync, closeMessageSearch, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups, threadsReferencing } from "./message-db.js";
 import { briefCrossingLabel, claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
@@ -115,9 +118,10 @@ import { ProviderRegistry } from "./harness/registry.js";
 import { ManagedDesktopProviders } from "./managed-desktop.js";
 import { computerKindForResource, ManagedDesktopPolicy } from "./managed-policy.js";
 import { hostedModelPolicy, HOSTED_MODEL_POLICY_HEADER, HOSTED_PROVIDER_SETTINGS_ERROR } from "./hosted-models.js";
-import { boatNotConfiguredMessage, CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_HOME_SECRET_KEYS, CLOUD_IGNORED_KEYS, CLOUD_PAIRING_PATH, cloudHomeConfiguration, cloudHomeOffersPlace, cloudHomePlaceRefusal, createCloudPairing, firstCloudTurnPatch, readSignedBody, } from "./cloud-home.js";
+import { boatNotConfiguredMessage, CLOUD_HOME_SECRET_KEYS, CLOUD_IGNORED_KEYS, CLOUD_PAIRING_PATH, cloudHomeConfiguration, cloudHomeOffersPlace, cloudHomePlaceRefusal, createCloudPairing, firstCloudTurnPatch, readSignedBody, } from "./cloud-home.js";
 import { CLOUD_PERSONAL_REFUSAL, settleCloudOwnership } from "./cloud-owner.js";
-import { createCloudMoveRoutes } from "./cloud-move-http.js";
+import { createCloudMoveRoutes, workspaceShared } from "./cloud-move-http.js";
+import { RESTART_EXIT_CODE } from "./restart.js";
 import { holdIncludedServices } from "./included-services.js";
 import { selectDefaultModelSelection, withNewBotEffort } from "./default-model-selection.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, peerApprovalFailure, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
@@ -137,8 +141,7 @@ import { Handoffs, handedStateUsable, recordHanded, renderUnseen, sessionStart,
 import { extractTurnImages } from "./turn-images.js";
 import { threadTitlePrompt, titleConversationExcerpt } from "./thread-title.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
-import { TurnResources, workspaceResource } from "./turn-resources.js";
-import { IdleReleasePolicy } from "./claim-idle.js";
+import { TurnResources } from "./turn-resources.js";
 import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, supportsWorkspaceFiles, updateMemory, appendMemoryLog, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, TASK_WORKSPACES_DIR, readMemoryOnlyFromRegularFiles, workspaceDir, } from "./workspace.js";
 import { listMemoryTopics, memoryDate, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, journalMemoryWrite, } from "./memory-journal.js";
@@ -150,7 +153,7 @@ import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefault
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
-import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
+import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, TEAM_MEMORY_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, teamAvailabilityPart, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, discoverExistingPoolLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { localVmStopReason, recordLocalVmIdleStop } from "./local-vm-stop-reason.js";
@@ -173,7 +176,6 @@ import { createOptionsCard } from "./options-card.js";
 import { buildBotOverview, connectedAppsFacts } from "./bot-overview.js";
 import { ProfileRequestService } from "./profile-requests.js";
 import { ModelRequestService } from "./model-requests.js";
-import { TighteningRequestService } from "./tightening-requests.js";
 import { TeamSetupError, TeamSetupRequestService } from "./team-setup-requests.js";
 import { profileRevision, profileSnapshot } from "./profile-revision.js";
 import { flushAllProfileHistory, flushProfileHistory, readHistory, recordProfileChange } from "./profile-versions.js";
@@ -183,6 +185,12 @@ import { fetchGithubTeam, fetchLibraryTeam, fetchTeamCatalog } from "./team-libr
 import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageSummary, parsePackageDocument, renderBotPackageMarkdown } from "./bot-package.js";
 import { createTeamManifest, parseTeamManifest } from "./team-manifest.js";
 import { readThreadEvents } from "./thread-events.js";
+import { TeamMemory, TEAM_MEMORY_KINDS } from "./team-memory.js";
+import { describeTool, readBotActivity } from "./activity.js";
+import { OutboundCounts } from "./outbound-counts.js";
+import { OutboundRequestService } from "./outbound-requests.js";
+import { DEFAULT_OUTBOUND_POLICY, connectorCallsIn, normalizeOutboundPolicy, outboundCallsIn } from "../shared/outbound.js";
+import { connectorAccessDecision, describeConnectorScopes, normalizeConnectorScopes } from "../shared/connector-scopes.js";
 import { bindThreadLogCapProvider } from "./thread-log-rotation.js";
 import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
 import { assertModelVariantSupported, memberTurnSelection } from "./member-turn.js";
@@ -202,9 +210,8 @@ import { shouldMountLocalComputer } from "./local-routing.js";
 import { autoLocalVmAttachable } from "./container-computer.js";
 import { startAutoVmClaim } from "./auto-vm-claims.js";
 import { computerFreeAfterText, computerParkedText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
-import { CloudOverflowConsent, CloudSeatLease, cloudOverflowAction, cloudOverflowConsentText, cloudOverflowOfferText, cloudSeatStartedText, cloudSeatStoppedText } from "./cloud-overflow.js";
 import { modelContextWindow } from "./model-context-window.js";
-import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
+import { cloudPlaceDriverError, parseSurface, PlaceUnavailableError, placeUnavailable, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
@@ -292,10 +299,12 @@ const workspaceMaintenance = new WorkspaceBackupMaintenance();
 // Remote clients (server/request-auth.ts, server/sessions.ts): a stable identity
 // for this server, the paired sessions, and the cookie the served UI uses.
 const ENVIRONMENT_ID = loadEnvironmentId(DATA_DIR);
-function signInAllowList() {
-    const current = loadConfig().signIn;
-    return { admins: parseAllowList(current?.admins?.join(",")), members: parseAllowList(current?.members?.join(",")) };
-}
+// Every stream frame and request rechecks email sessions against this list,
+// so config.json is parsed again only when the file changes.
+const signInAllowList = cacheUntilConfigChanges((config) => ({
+    admins: parseAllowList(config.signIn?.admins?.join(",")),
+    members: parseAllowList(config.signIn?.members?.join(",")),
+}));
 const sessions = new SessionRegistry({
     file: join(DATA_DIR, "sessions.json"),
     emailScopesSnapshot: () => {
@@ -767,11 +776,16 @@ function approvalShape(shape) {
 /** Who opens a routine's results conversation on a Cloud home: the writer
  * of this request, else the owner for a routine that is theirs (they wrote
  * it as it stands, or they are its writer: cloud-owner.ts), else its last
- * writer, else nobody. */
+ * writer, else nobody. A webhook's run is the owner's: only their own
+ * devices can create, edit or rotate one (admin scope), so it runs at the
+ * bot's own level, in its folder, as on the desktop. Its payload still never
+ * reaches the lent Mac: cloud-lending.ts refuses every webhook run. */
 function routineOpener(routineId) {
     if (routineWriterInFlight)
         return routineWriterInFlight;
     const routine = routines?.listRoutines().find((candidate) => candidate.id === routineId);
+    if (!routine && CLOUD_OWNER_KEY && webhooks.list().some((hook) => hook.id === routineId))
+        return CLOUD_OWNER_KEY;
     if (routine && CLOUD_OWNER_KEY && cloudRoutineAuthors?.authored(routineId, routine))
         return CLOUD_OWNER_KEY;
     const writer = cloudRoutineAuthors?.writer(routineId);
@@ -940,6 +954,9 @@ function cardAnswerRefusal(auth, threadId, requestId, behavior) {
             ? "A local service can only decline this request. Approve or answer it in OpenMausBot while signed in."
             : null;
     }
+    if (!auth.scopes.includes("admin") && store.messagesFor(threadId).some(message => message.card?.requestId === requestId && message.card.teamMemoryRequest)) {
+        return "Only a workspace admin can review shared team memory.";
+    }
     // A Cloud home is one person's: a device paired with chat-only access (a
     // guest) may read along but never answer, or its words would reach the
     // owner's turn, and through it a lent Mac (docs/cloud-pro.md).
@@ -1236,11 +1253,11 @@ function memberFrameContext(visible) {
         webhookBot: (webhookId) => webhooks.list().find((webhook) => webhook.id === webhookId)?.botId,
         freshBot: (botId) => {
             const bot = store.bot(botId);
-            return bot ? { ...wireBot(bot), tasks: store.tasks(bot.id).map(wireTask), ...messagePage(bot.threadId, DEFAULT_PAGE) } : undefined;
+            return bot ? publicBot(bot) : undefined;
         },
         freshGroup: (groupId) => {
             const group = store.group(groupId);
-            return group ? { ...publicGroupState(group), ...messagePage(group.threadId, DEFAULT_PAGE) } : undefined;
+            return group ? groupWithThread(group) : undefined;
         },
     };
 }
@@ -1511,6 +1528,8 @@ const openCodeKeysAllowed = () => openCodeProviderKeysAllowed({
     sharedSignIn: sharedSignIn(signInAllowList()),
 });
 setOpenCodeProviderKeyPolicy(openCodeKeysAllowed);
+// Keys the owner saved for OpenCode in Settings reach it on every server.
+setOpenCodeOwnProviderKeys(() => openCodeProviderKeys(cfg));
 let openCodeKeysLastAllowed = openCodeKeysAllowed();
 /** OpenCode lists a provider's models only while it may read that
  * provider's key. When enrollment or the sign-in list changes the answer,
@@ -1743,6 +1762,8 @@ utilityParentPort?.on("message", event => {
     });
 });
 const MAX_ATTACHED_FILES_PER_TURN = 10;
+const MAX_ROOM_POSTS_PER_TURN = 3;
+const MAX_CREATED_BOTS_PER_TURN = 4;
 // A capability lives for the exact provider-turn generation, including while
 // that turn is parked on a human approval. The long ceiling is only an orphan
 // backstop for an impossible-to-settle adapter; normal terminal paths revoke
@@ -1799,15 +1820,52 @@ function beginInternalCapabilityGeneration(threadId, generation = randomUUID())
     activeInternalGenerationByThread.set(threadId, generation);
     return generation;
 }
-function mintInternalCapability(capability) {
+// The bearer an integration's proxy holds is part of the engine's launch
+// contract (Claude's process key, ACP's session inputs): a new one every turn
+// meant a relaunch, a resumed transcript and new MCP servers every turn. So
+// the bearer stays the same while the same bot works the same thread with the
+// same grants and approval level, and only the record behind it is per turn:
+// between turns, and after any revoke, nothing honours it. A changed grant,
+// Stop, a stall, a deleted bot or thread or a provider reload gives the next
+// turn a new bearer, so whatever still holds the old one is never honoured
+// again.
+/** threadId → "botId kind" → the bearer and the grants it was minted for. */
+const sessionCredentials = new Map();
+/** What a bearer stands for: everything its record grants (a turn's counters
+ * all start at zero), plus the thread's approval level; not the turn. */
+function sessionGrants({ generation: _turn, ...grants }) {
+    const thread = botForThread(grants.botId, grants.threadId);
+    return JSON.stringify({ ...grants, approval: thread ? approvalModeFor(thread) : null });
+}
+/** The thread's bearer for this integration, new only when its grants changed. */
+function sessionBearer(capability) {
+    const credentials = sessionCredentials.get(capability.threadId) ?? new Map();
+    sessionCredentials.set(capability.threadId, credentials);
+    const slot = `${capability.botId} ${capability.kind}`;
+    const grants = sessionGrants(capability);
+    const held = credentials.get(slot);
+    if (held?.grants === grants)
+        return held.token;
+    const token = randomBytes(24).toString("hex");
+    credentials.set(slot, { grants, token });
+    return token;
+}
+function mintInternalCapability(capability, { perTurn = false } = {}) {
     if (activeInternalGenerationByThread.get(capability.threadId) !== capability.generation) {
         throw new Error("cannot mint an integration capability for an inactive turn");
     }
-    const token = randomBytes(24).toString("hex");
-    internalCapabilities.set(token, {
-        ...capability,
-        orphanExpiresAt: Date.now() + INTERNAL_CAPABILITY_ORPHAN_MS,
-    });
+    // perTurn: a bridge into a machine the harness stops and starts between
+    // turns (a Local VM, the VPS, a Boat). A warm engine never restarts a
+    // server whose machine went away, so such a turn gets a new bearer and
+    // starts its engine fresh.
+    const token = perTurn ? randomBytes(24).toString("hex") : sessionBearer(capability);
+    // Minted twice in one turn: keep that turn's record and its counters.
+    if (internalCapabilities.get(token)?.generation !== capability.generation) {
+        internalCapabilities.set(token, {
+            ...capability,
+            orphanExpiresAt: Date.now() + INTERNAL_CAPABILITY_ORPHAN_MS,
+        });
+    }
     return token;
 }
 /** A turn that was not provably the owner's has ended: judge its bot's
@@ -1841,7 +1899,9 @@ function revokeInternalCapabilityGeneration(threadId, generation) {
     }
     internalGenerationByProviderTurn.deleteGeneration(threadId, generation);
 }
-function revokeInternalCapabilitiesForThread(threadId) {
+/** Before a new turn on this thread mints: nothing an earlier turn here was
+ * given stays honoured. The thread's bearers stay, so its engine stays warm. */
+function revokeEarlierTurnCapabilities(threadId) {
     computerSelectionTurns.delete(threadId);
     const generation = activeInternalGenerationByThread.get(threadId);
     if (generation)
@@ -1854,9 +1914,16 @@ function revokeInternalCapabilitiesForThread(threadId) {
             internalCapabilities.delete(token);
     }
 }
+/** Stop, a stall, a deleted bot or thread, a provider change: the thread's
+ * bearers are retired too, so nothing that still holds one is honoured again. */
+function revokeInternalCapabilitiesForThread(threadId) {
+    revokeEarlierTurnCapabilities(threadId);
+    sessionCredentials.delete(threadId);
+}
 function revokeAllInternalCapabilities() {
     computerSelectionTurns.clear();
     internalCapabilities.clear();
+    sessionCredentials.clear();
     // foreignTurns stays: a turn that is not provably the owner's can still
     // write while its engine is torn down, and its own end (which revokes its
     // generation by id) is what judges it (server/lending-memory.ts).
@@ -2020,6 +2087,15 @@ class ComputerWaitParked extends Error {
         this.generation = generation;
     }
 }
+/** A place the turn was told to use failed to attach: its cause plus the one
+ * control that changes it (placeUnavailable). A cancelled setup, a parked
+ * computer wait and an already-worded place failure pass through as they
+ * are. The one wrapper for a bot thread and a room turn. */
+function asPlaceFailure(error, place, source, limit) {
+    if (error instanceof DirectTurnSetupCancelled || error instanceof ComputerWaitParked || error instanceof PlaceUnavailableError)
+        return error;
+    return placeUnavailable(place, source, error instanceof Error ? error.message : String(error), limit);
+}
 const directTurnDispatchClaims = new Map();
 const directTurnGenerationByThread = new Map();
 // Only the latest direct request per thread is retained. A fresh user turn
@@ -2062,173 +2138,14 @@ const turnResources = new TurnResources();
 const sharedComputerControl = new SharedComputerControl(turnResources, () => store.bots.some(bot => botComputerControlSnapshot(bot.id).held));
 const turnResourceOwners = new Map();
 const turnComputerResources = new Map();
-/** Screen-touching computer calls that started before their turn's computer
- * claim was bound (#1653 over the lazy attach of #1361): the start event
- * finds no claim to fence, so it waits here and bindTurnComputer carries it
- * into the fresh claim, keeping the quiet window from releasing a seat
- * under a call the desktop is already executing. */
-const pendingComputerCallStarts = new Map();
 const teamComputerTurns = new Map();
 const settlingResourceOwners = new Map();
-/** Idle release for computer claims (#1653), disabled until the feature
- * flag is on: a seat that stays screen-quiet for the policy's window is
- * released to waiting turns while its holder's turn still lives, and the
- * previous holder re-claims directly inside the reclaim window — it
- * yields once another turn holds the seat. The durable VM profile keeps
- * its login state, so that re-claim is cheap. Read per claim: a flag
- * change applies to new claims, never to a seat held under the old
- * setting. computer:phone is excluded: it is the #1663 exclusivity lock,
- * claimed once per turn with no activity signal to renew it. */
-const COMPUTER_CLAIM_IDLE_POLICY = new IdleReleasePolicy();
-function computerClaimIdlePolicy(resource) {
-    return resource.startsWith("computer:") && resource !== "computer:phone" && computerClaimIdleReleaseEnabled(cfg) ? COMPUTER_CLAIM_IDLE_POLICY : undefined;
-}
-/** #1655: the consent ledger for local-wait cloud overflow, and the live
- * cloud seats it has started. One seat per bot — it is the bot's own Box,
- * shared by that bot's threads the way every other computer is. */
-const cloudOverflowConsent = new CloudOverflowConsent();
-const cloudSeatLeases = new Map();
-let cloudSeatSweepTimer;
-/** One stop attempt per seat at a time (#1655): the sweep ticks faster
- * than a Box sleeps, and a second stop call would race the first. */
-const cloudSeatStopsInFlight = new Set();
-/** The waits that may overflow: a turn queued for a local desktop, never
- * one already bound for a cloud or VPS seat. */
-function localComputerWait(resource) {
-    return resource === "computer:host" || resource.startsWith("computer:vm:");
-}
-function cloudOverflowSituation(owner, resource, started) {
-    if (!localComputerWait(resource))
-        return null;
-    if (!store.botByThread(owner.threadId))
-        return null;
-    const perSecondCostUsd = cloudOverflowPerSecondCostUsd(cfg);
-    return {
-        featureEnabled: cloudOverflowEnabled(cfg),
-        // An organisation that refuses the Box kind has nothing to offer, and
-        // the decision must fail closed before any card is written.
-        cloudConfigured: boat.boatConfigured(cfg) && managedPolicy.computerRefusal("box") === undefined,
-        perSecondCostUsd,
-        // Consent answers the priced card (#1655): a grant counts only at the
-        // rate its card showed, so a config change re-offers instead of
-        // starting at a price nobody approved.
-        consented: cloudOverflowConsent.consented(owner.threadId, cloudOverflowAllowlistedThreads(cfg), perSecondCostUsd ?? undefined),
-        offered: cloudOverflowConsent.offered(owner.threadId, perSecondCostUsd ?? undefined),
-        started,
-    };
-}
 function claimTurnResource(owner, resource) {
-    const idle = computerClaimIdlePolicy(resource);
-    if (!turnResources.claim(resource, owner, idle ? { idle } : {}))
+    if (!turnResources.claim(resource, owner))
         return false;
     turnResourceOwners.set(owner.threadId, owner);
     return true;
 }
-/** Start the waiting bot's cloud seat (#1655). True once handled — started
- * or terminally failed — so the wait never retries every poll; false when
- * another turn of this bot owns the Box lifecycle and a later poll may
- * still land. */
-async function startCloudSeat(owner) {
-    const bot = store.botByThread(owner.threadId);
-    if (!bot)
-        return true;
-    const perSecondCostUsd = cloudOverflowPerSecondCostUsd(cfg);
-    if (!perSecondCostUsd)
-        return true;
-    const boxBotResource = "computer:box-bot:" + bot.id;
-    if (!claimTurnResource(owner, boxBotResource))
-        return false;
-    try {
-        broadcast({ kind: "computer", botId: bot.id, state: "waking" });
-        const machine = await boat.readyBoat(cfg, bot.id);
-        if (!machine)
-            throw new Error("the cloud computer did not wake");
-        // Consent can be revoked while the Box wakes (#1655): a seat nobody
-        // consented to must not bill. It is released and put straight back to
-        // sleep — and if even that fails, leased as already idle so the sweep
-        // keeps retrying with backoff.
-        if (!cloudOverflowConsent.consented(owner.threadId, cloudOverflowAllowlistedThreads(cfg), perSecondCostUsd)) {
-            turnResources.releaseOne(boxBotResource, owner);
-            const idleStopMs = cloudOverflowIdleStopMs(cfg);
-            void boat.sleepBoat(cfg, bot.id).catch(() => {
-                cloudSeatLeases.set(bot.id, new CloudSeatLease({ botId: bot.id, threadId: owner.threadId, generation: owner.generation, now: Date.now() - idleStopMs - 1, idleStopMs }));
-                ensureCloudSeatSweep();
-            });
-            store.appendMessage(owner.threadId, {
-                role: "bot", kind: "activity",
-                tool: { name: "Cloud overflow consent was revoked while the cloud computer woke; it stops unbilled and the local wait continues.", ok: true },
-            });
-            return true;
-        }
-        cloudSeatLeases.set(bot.id, new CloudSeatLease({ botId: bot.id, threadId: owner.threadId, generation: owner.generation, idleStopMs: cloudOverflowIdleStopMs(cfg) }));
-        ensureCloudSeatSweep();
-        store.appendMessage(owner.threadId, {
-            role: "bot", kind: "activity",
-            tool: { name: cloudSeatStartedText({ perSecondCostUsd, idleStopMs: cloudOverflowIdleStopMs(cfg) }), ok: true },
-        });
-        return true;
-    }
-    catch (error) {
-        turnResources.releaseOne(boxBotResource, owner);
-        store.appendMessage(owner.threadId, {
-            role: "bot", kind: "activity",
-            tool: { name: "Cloud computer could not start (" + (error instanceof Error ? error.message : String(error)) + "); the local wait continues.", ok: false },
-        });
-        return true;
-    }
-}
-/** A per-second-billed seat must stop on idleness even when nothing else
- * touches the server, so this slice carries the one timer — unref'd, it
- * can never hold the process open, and it dies with the last lease. */
-function ensureCloudSeatSweep() {
-    if (cloudSeatSweepTimer)
-        return;
-    cloudSeatSweepTimer = setInterval(() => {
-        sweepIdleCloudSeats();
-        if (!cloudSeatLeases.size && cloudSeatSweepTimer) {
-            clearInterval(cloudSeatSweepTimer);
-            cloudSeatSweepTimer = undefined;
-        }
-    }, 15_000);
-    cloudSeatSweepTimer.unref?.();
-}
-/** Stop every cloud seat idle past its window (#1655): the machine is
- * archived, billing pauses, and the transcript says which wait's seat it
- * was. Only real computer tool completions refresh a lease — the poller's
- * preview frames never reach the touch call. */
-/** Stop one running cloud seat (#1655): the Box sleeps, and only a
- * successful stop clears the lease and its Box claim — a failed stop
- * stays leased and retryable with backoff, because the seat still bills
- * until it sleeps. The claim releases for the lease's own generation,
- * never a newer turn's. */
-function stopCloudSeat(botId, lease, stoppedName, now = Date.now()) {
-    if (cloudSeatStopsInFlight.has(botId))
-        return;
-    if (cloudSeatLeases.get(botId) !== lease)
-        return;
-    cloudSeatStopsInFlight.add(botId);
-    void boat.sleepBoat(cfg, botId)
-        .then(() => {
-        if (cloudSeatLeases.get(botId) === lease)
-            cloudSeatLeases.delete(botId);
-        // The stopped seat's Box claim goes with it, so a still-waiting
-        // turn may start a fresh seat for the same bot.
-        turnResources.releaseOne(`computer:box-bot:${botId}`, { threadId: lease.threadId, generation: lease.generation });
-        store.appendMessage(lease.threadId, { role: "bot", kind: "activity", tool: { name: stoppedName, ok: true } });
-    })
-        .catch(() => {
-        lease.deferSleep(now);
-        store.appendMessage(lease.threadId, { role: "bot", kind: "activity", tool: { name: "Cloud computer could not stop — the sweep retries with backoff; stop it from Settings if it stays awake. Billing continues until it sleeps.", ok: false } });
-    })
-        .finally(() => cloudSeatStopsInFlight.delete(botId));
-}
-function sweepIdleCloudSeats(now = Date.now()) {
-    for (const [botId, lease] of cloudSeatLeases) {
-        if (!lease.idleElapsed(now) || !lease.sleepDue(now))
-            continue;
-        stopCloudSeat(botId, lease, cloudSeatStoppedText(lease.idleFor(now)), now);
-    }
-}
 function releaseTurnResources(owner) {
     if (!owner)
         return;
@@ -2241,8 +2158,6 @@ function releaseTurnResources(owner) {
         turnResourceOwners.delete(owner.threadId);
     if (turnComputerResources.get(owner.threadId)?.owner.generation === owner.generation)
         turnComputerResources.delete(owner.threadId);
-    if (pendingComputerCallStarts.get(owner.threadId)?.generation === owner.generation)
-        pendingComputerCallStarts.delete(owner.threadId);
     const teamTurn = teamComputerTurns.get(owner.threadId);
     if (teamTurn?.owner.generation === owner.generation) {
         stopScreenPoller(teamTurn.botId, owner.threadId);
@@ -2272,10 +2187,6 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
     // turn.wait_* events carry the same facts for the inspector log.
     let waitedSince;
     let waitEnded = false;
-    // #1655: whether this wait already started (or terminally failed to
-    // start) a cloud seat; the decision is re-evaluated every poll because
-    // consent can arrive mid-wait.
-    let overflowHandled = false;
     const waitEventBase = () => {
         const selection = store.botByThread(owner.threadId)?.modelSelection;
         const instance = selection ? registry.get(selection.instanceId) : null;
@@ -2349,32 +2260,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
                     position,
                     ...(holder ? { holder } : {}),
                 });
-                // #1655: the wait is where an overflow choice gets made. The card
-                // names the per-second cost before anything can start, and only a
-                // turn genuinely waiting on a local desktop gets one. Fail closed:
-                // feature off, cloud unusable, or no operator-set rate means no
-                // card at all — Auto never offers, never starts.
-                const overflow = cloudOverflowSituation(owner, resource, overflowHandled);
-                const perSecondCostUsd = overflow?.perSecondCostUsd ?? null;
-                if (overflow && perSecondCostUsd !== null && cloudOverflowAction(overflow).kind === "offer") {
-                    store.appendMessage(owner.threadId, {
-                        role: "bot", kind: "activity",
-                        tool: { name: cloudOverflowOfferText({ perSecondCostUsd, idleStopMs: cloudOverflowIdleStopMs(cfg) }), ok: true },
-                    });
-                    cloudOverflowConsent.markOffered(owner.threadId, perSecondCostUsd);
-                }
             }
-            // #1655: consent can arrive mid-wait — the card's answer, or a
-            // thread the operator allowlisted — and only then may the cloud
-            // seat start, its cost chip landing beside the waiting one. The
-            // local wait itself is untouched: it still ends by acquisition,
-            // stop, or the ceiling (parking, once that stack lands).
-            if (!overflowHandled) {
-                const situation = cloudOverflowSituation(owner, resource, overflowHandled);
-                if (situation && cloudOverflowAction(situation).kind === "start")
-                    overflowHandled = await startCloudSeat(owner);
-            }
-            sweepIdleCloudSeats();
             if (Date.now() >= deadline) {
                 // ADR-2 (#1651): the ceiling parks the turn — settled, with a
                 // registered resume — instead of failing it. The owner mark lets the
@@ -2396,15 +2282,6 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
     }
     turnResourceOwners.set(owner.threadId, owner);
     turnComputerResources.set(owner.threadId, { owner, resource });
-    // A screen call that started before this bind (#1653) fenced nothing
-    // because no claim existed yet: carry its pending start into the fresh
-    // claim so the idle window still defers to the running call.
-    const pendingStarts = pendingComputerCallStarts.get(owner.threadId);
-    if (pendingStarts?.generation === owner.generation && pendingStarts.count > 0) {
-        pendingComputerCallStarts.delete(owner.threadId);
-        for (let i = 0; i < pendingStarts.count; i += 1)
-            turnResources.beginComputerCall(resource, owner);
-    }
 }
 function botForThread(botId, threadId) {
     return directTurnBots.get(threadId) ?? store.projectBotForTask(botId, threadId) ?? store.bot(botId);
@@ -2450,15 +2327,9 @@ function canAdmitDirectTurn(botId, threadId) {
 /** Routine and webhook dispatch shares startTurn's admission preconditions
  * instead of waiting for whole-bot idleness: a free thread slot and no
  * active group turn. A group turn blocks scheduled starts the same way it
- * blocks every other turn kind; it does not consume a capacity slot.
- *
- * A fresh dispatch also pins to the bot's own project folder, exactly like
- * startTurn's cwd resolution: a free thread slot alone can miss a second
- * task of this bot landing in that one folder (#F-collide). Predicting that
- * collision here lets it defer through the same busy-target machinery as
- * capacity and group-turn contention, instead of reaching startTurn's own
- * workspace claim — which throws deep inside a detached dispatch that no
- * caller here awaits, so the run would otherwise fail permanently. */
+ * blocks every other turn kind; it does not consume a capacity slot. The
+ * bot's project folder is not a slot: a fresh run works there beside the
+ * bot's other threads (see startTurn's cwd resolution). */
 function unattendedDispatchState(botId) {
     const bot = store.bot(botId);
     const decision = admit("unattended", {}, {
@@ -2468,16 +2339,6 @@ function unattendedDispatchState(botId) {
     });
     if (decision.action === "refuse")
         return decision.code === "missing" ? "missing" : "busy";
-    if (bot?.cwd) {
-        try {
-            if (turnResources.blocker(workspaceResource(bot.cwd), { threadId: "", generation: "" }))
-                return "busy";
-        }
-        catch {
-            // An unresolvable folder is startTurn's own admission check to
-            // report; this prediction only ever adds a defer, never a refusal.
-        }
-    }
     return "ready";
 }
 function requestedTaskBot(botId, rawThreadId) {
@@ -2724,8 +2585,8 @@ async function browserIntegration(botId, profile, turn) {
     const token = mintInternalCapability({ botId, ...turn, browserSession: session,
         kind: "browser", depth: 0, skillAuthoring: false, createdBots: 0, openedThreads: 0 });
     return { profile: partitionId, session, spec, integration: {
-            command: process.execPath, args: [SPAWNED_PROXIES.browser], env: {
-                ...AGENTS_NODE_FLAG, OMB_BROWSER_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
+            command: process.execPath, args: [SPAWNED_PROXIES.harnessMcp, "browser"], env: {
+                ...AGENTS_NODE_FLAG, OMB_MCP_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
             },
         } };
 }
@@ -2826,8 +2687,14 @@ const routineRequestEnvelopeSchema = z.discriminatedUnion("action", [
     }).strict(),
     ...["pause", "resume", "run_now", "delete"].map((action) => z.object({ ...routineRequestSourceSchema, action: z.literal(action), routineId: z.unknown(), forBotId: z.unknown().optional() }).strict()),
 ]);
-/** The loopback endpoint a bot's computer proxy polls before acting. */
-function controlIntegration(botId, threadId, generation, localVmTarget) {
+/** The loopback endpoint a bot's computer proxy polls before acting. With a
+ * Boat id, the same turn-scoped token also serves that Boat's tools at
+ * /api/internal/computer/mcp, and is revoked when the turn ends. This
+ * computer runs as long as the app does, so its bridge keeps the thread's
+ * bearer like every other integration; any other machine (a Local VM, the
+ * VPS, a Boat) gets a new bearer each turn. */
+function controlIntegration(botId, threadId, generation, machine = {}) {
+    const { localVmTarget, boxId } = machine === "this computer" ? {} : machine;
     return {
         url: `http://127.0.0.1:${PORT}/api/internal/computer-control?botId=${encodeURIComponent(botId)}`,
         token: mintInternalCapability({
@@ -2837,11 +2704,12 @@ function controlIntegration(botId, threadId, generation, localVmTarget) {
             depth: 0,
             kind: "computer",
             ...(localVmTarget ? { localVmTarget } : {}),
+            ...(boxId ? { boxId } : {}),
             ...(teamComputerTurns.get(threadId) ? { teamComputerId: teamComputerTurns.get(threadId).computerId } : {}),
             skillAuthoring: false,
             createdBots: 0,
             openedThreads: 0,
-        }),
+        }, { perTurn: machine !== "this computer" }),
     };
 }
 function askBotAndWait(targetBotId, message, depth, fromBotId, fromThreadId, targetThreadId) {
@@ -3139,9 +3007,6 @@ function packageImportDeps(selection) {
                 return avatarUrl;
             },
         },
-        broadcast: (event) => event.kind === "bot"
-            ? broadcast({ kind: "bot", bot: publicBot(event.bot) })
-            : broadcast({ kind: "group", group: publicGroupState(event.group) }),
         defaultSelection: () => selection,
         presets: presetStore,
     };
@@ -3280,7 +3145,7 @@ const wireTask = (task) => {
     return asleep ? { ...coordinated, snoozedUntil } : coordinated;
 };
 const wireBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
     // An elevated selection is inert until the desktop confirms its exact
     // private reply. Every ordinary client sees the effective Ask state during
     // that two-phase window, never a grant that may still roll back.
@@ -3302,7 +3167,7 @@ function toolScopeForTurn(botId) {
 /** The correlated private response carries the requested value so Electron
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
     return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
@@ -3318,7 +3183,7 @@ function previewSystemPrompt(bot) {
     ]
         .filter(Boolean)
         .join(" ");
-    const instance = turnInstance(bot);
+    const instance = registry.get(bot.modelSelection.instanceId);
     const caps = instance?.adapter.capabilities;
     const teamComputer = inheritedTeamComputer(bot);
     const previewComputer = teamComputer ? "cloud" : bot.computer;
@@ -3326,12 +3191,11 @@ function previewSystemPrompt(bot) {
         kind: previewComputer === "vm" ? "vm" : previewComputer === "cloud"
             ? bot.cloudBackend === "vps" ? "vps" : "box" : previewComputer === "local" ? "local" : null,
         driverKind: instance?.driverKind,
-        cloudComputerMcp: caps?.cloudComputerMcp,
         vmPrivate: localVmMode(cfg) === "per-bot",
     });
     const peers = reachablePeers(store.bots, bot);
     const coordination = bot.chiefOfStaff
-        ? chiefOfStaffSystemPrompt(bot.id, store.bots, true, openMausStatusSystemPrompt())
+        ? chiefOfStaffSystemPrompt(bot.id, store.bots, true)
         : peers.length > 0
             ? peerRosterSystemPrompt(peers)
             : "";
@@ -3367,7 +3231,7 @@ function previewSystemPrompt(bot) {
                 browser: previewPlan.computer === undefined ? false : previewPlan.browser,
             }, { note: previewPlan.note, cloudHome: Boolean(CLOUD_HOME) }) },
         { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(agentsMounted && lendingEnabled()) : "" },
-        { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) : "" },
+        { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) + describeConnectorScopes(bot.connectorScopes) : "" },
         { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(engineMcpServers(bot))) : "" },
         { id: "browser", label: "Browser", text: previewPlan.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
         { id: "coordination", label: "Team", text: agentsMounted && coordination ? ` ${coordination}` : "" },
@@ -3375,6 +3239,8 @@ function previewSystemPrompt(bot) {
         { id: "routine", label: "Routines", text: agentsMounted ? ROUTINE_PROMPT : "" },
         { id: "profile", label: "Profile changes", text: agentsMounted ? PROFILE_PROMPT : "" },
         { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+        { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (agentsMounted ? TEAM_MEMORY_PROMPT : "") },
+        teamAvailabilityPart(agentsMounted && coordination ? peers : []),
         { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace), enabled: bot.memoryEnabled !== false }) },
         { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? bot.assignedSkills : undefined) : "" },
     ]);
@@ -3952,10 +3818,11 @@ function handleDesktopTrustedApprovalMessage(raw) {
  * fetched immediately and a deleted/guessed attachment id cannot become a
  * dangling profile reference. */
 const storedAvatarExists = (avatarUrl) => attachmentExists(avatarUrl.slice("/api/attachments/".length));
+/** A bot with its open thread's newest page, for HTTP replies and a
+ * member stream's first frame of it. */
 const publicBot = (bot) => ({
     ...wireBot(bot),
-    messages: store.messagesFor(bot.threadId),
-    activeLeafId: store.activeLeaf(bot.threadId),
+    ...messagePage(bot.threadId, DEFAULT_PAGE),
     tasks: store.tasks(bot.id).map(wireTask),
 });
 const publicBotQueuedMessages = () => queuedSteerSnapshot((botId, threadId) => Boolean(store.taskByThread(botId, threadId)));
@@ -4277,9 +4144,11 @@ function outstandingAssignmentsPrompt(threadId) {
         requestId: node.id,
         bot: store.bot(node.botId)?.name ?? "Teammate",
         assignment: node.text.slice(0, 1_000),
-        status: node.status === "queued" ? "waiting for that teammate to be free" : "working on it now",
+        status: node.status === "queued" ? "waiting for that teammate to be free"
+            : openPersonCard(node.threadId) ? "stopped on a card waiting for the person's approval or answer in that teammate's thread; tell the person to open it"
+                : "working on it now",
     }));
-    return ` Assignments you already sent are still outstanding, and nothing in this conversation cancelled them: ${JSON.stringify(listed)}. Do not send them again, do not poll or wait for them, and do not tell the user they were lost. Each result returns to this conversation on its own and resumes you then. Answer the message above with that work still in flight.`;
+    return ` Assignments you already sent are still outstanding, and nothing in this conversation cancelled them: ${JSON.stringify(listed)}. Do not resend them, do not poll or wait for them, and do not tell the user they were lost. Each result returns to this conversation on its own and resumes you then. To change or add to one, send the change to the same teammate with coordinate_bots; it runs after the current work. Answer the message above with that work still in flight.`;
 }
 const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     validate: (node, parent) => roomHandoffProblem(node, parent) ??
@@ -4353,9 +4222,10 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
         }
         // A successful direct work thread closes after its result is reported:
         // folded out of the sidebar, never deleted, and reopened if addressed.
-        // Failed or withheld work stays visible.
+        // Failed or withheld work stays visible, and so does a thread whose
+        // next request is already waiting there.
         const childTask = store.taskByThread(child.botId, child.threadId);
-        if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy
+        if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy && !roomHandoffs.activeDirect(child.threadId)
             && childTask?.openedBy?.kind === "work" && childTask.openedBy.botId === parent.botId) {
             store.setTaskClosedBy(child.botId, child.threadId, { botId: parent.botId, name: store.bot(parent.botId)?.name ?? childTask.openedBy.name, at: Date.now() });
         }
@@ -4789,18 +4659,33 @@ function activeGroupTurnForBot(botId) {
     }
     return null;
 }
+/** A room with its open thread's newest page, for HTTP replies and a
+ * member stream's first frame of it. */
 const groupWithThread = (group) => ({
     ...publicGroupState(group),
-    messages: store.messagesFor(group.threadId),
-    activeLeafId: store.activeLeaf(group.threadId),
+    ...messagePage(group.threadId, DEFAULT_PAGE),
     ...(group.dm ? {} : { tasks: store.groupTasks(group.id) }),
 });
 // The store tells us what it wrote; this is the ONE place that turns those
 // into SSE frames. No mutation path can persist without emitting — the
 // property holds by construction, not by every call site remembering to
-// broadcast. Bot frames are the slim wire shape (no transcript); the few
-// endpoints whose callers need the transcript (task create/switch, imports)
-// still send their richer payload on top.
+// broadcast.
+//
+// A bot or room frame carries its open thread's newest page only when that
+// thread is not the one it last went out with: a switch, a new open thread,
+// deleting the open one, a new bot or room. Other windows swap transcripts
+// on exactly those frames (one whose open thread was deleted keeps its
+// composer locked until a page arrives). Every other frame stays slim, and
+// clients keep the transcript they hold when a frame carries none.
+const sentThreads = new Map();
+for (const record of [...store.bots, ...store.groups])
+    sentThreads.set(record.id, record.threadId);
+function pageIfThreadChanged(id, threadId) {
+    if (sentThreads.get(id) === threadId)
+        return {};
+    sentThreads.set(id, threadId);
+    return messagePage(threadId, DEFAULT_PAGE);
+}
 store.onChange((change) => {
     // Who owns which thread, and what each member may see, follow the fleet.
     if (change.type !== "message" && change.type !== "message.patch" && change.type !== "thread" && change.type !== "sections")
@@ -4809,11 +4694,12 @@ store.onChange((change) => {
         case "sections":
             broadcast({ kind: "sections", sections: store.sections });
             break;
+        // Live frames never carry screenshot pixels; clients load them by URL.
         case "message":
-            broadcast({ kind: "message", threadId: change.threadId, message: change.message });
+            broadcast({ kind: "message", threadId: change.threadId, message: slimMessage(change.message) });
             break;
         case "message.patch":
-            broadcast({ kind: "message.patch", threadId: change.threadId, message: change.message });
+            broadcast({ kind: "message.patch", threadId: change.threadId, message: slimMessage(change.message) });
             break;
         case "thread":
             broadcast({ kind: "thread", threadId: change.threadId, activeLeafId: change.activeLeafId });
@@ -4833,7 +4719,7 @@ store.onChange((change) => {
         case "bot": {
             const bot = store.bot(change.botId);
             if (bot)
-                broadcast({ kind: "bot", bot: wireBot(bot) });
+                broadcast({ kind: "bot", bot: { ...wireBot(bot), ...pageIfThreadChanged(bot.id, bot.threadId) } });
             // A new audience narrows the rooms this bot is in, for good.
             if (bot)
                 for (const group of store.groups.filter((candidate) => candidate.memberIds.includes(bot.id)))
@@ -4841,6 +4727,7 @@ store.onChange((change) => {
             break;
         }
         case "bot.deleted":
+            sentThreads.delete(change.botId);
             try {
                 commandAllowlist.clear(change.botId);
             }
@@ -4852,12 +4739,13 @@ store.onChange((change) => {
         case "group": {
             const group = store.group(change.groupId);
             if (group)
-                broadcast({ kind: "group", group: publicGroupState(group) });
+                broadcast({ kind: "group", group: { ...publicGroupState(group), ...pageIfThreadChanged(group.id, group.threadId) } });
             if (group)
                 settleRoomFloor(group);
             break;
         }
         case "group.deleted":
+            sentThreads.delete(change.groupId);
             broadcast({ kind: "group.deleted", groupId: change.groupId });
             break;
     }
@@ -4882,12 +4770,13 @@ function pageSize(raw) {
         return null;
     return Math.min(size, MESSAGE_PAGE_MAX);
 }
-/** A screen message without its pixels. The client fetches those from
- * `/api/threads/:threadId/messages/:id/image` when it actually shows one. */
+/** A screen message without its pixels, for live frames and pages alike.
+ * The client fetches those from `/api/threads/:threadId/messages/:id/image`
+ * when it actually shows one; `mime` stays so it can name a download. */
 function slimMessage(message) {
     if (message.kind !== "screen" || !message.png)
         return message;
-    const { png: _png, mime: _mime, ...rest } = message;
+    const { png: _png, ...rest } = message;
     return { ...rest, hasImage: true };
 }
 /** `limit === undefined` is the original, unpaginated shape. A bounded,
@@ -5280,7 +5169,10 @@ always, rememberCommand) {
         }
         if (messageId)
             askMessageByRequest.delete(`${threadId}:${requestId}`);
-        if (!persistentQuestion)
+        // The card's own answered state gates the message too: a replayed respond
+        // for a card that already settled must not read as a failed delivery —
+        // nothing was lost, the earlier answer already ran.
+        if (!persistentQuestion && !existing?.card?.answered)
             store.appendMessage(threadId, {
                 role: "bot",
                 kind: "activity",
@@ -5291,7 +5183,7 @@ always, rememberCommand) {
 }
 /** A decision or answer on a provider/peer card, made on behalf of `auth`
  * (a Live call answers as the person who started the call). Harness-native
- * proposals (skill, routine, profile, default model, tightening, team setup)
+ * proposals (skill, routine, profile, default model, team setup)
  * are not handled here; they are reviewed on screen (liveDecisionRefusal).
  * Mirrors POST /api/threads/:id/respond. */
 async function respondToCard(input) {
@@ -5450,10 +5342,7 @@ const watchdog = new TurnWatchdog({
         repeats.settle(turn.threadId);
         const bot = botForThread(turn.botId, turn.threadId);
         const routineRun = activeRoutineRunForThread(turn.threadId);
-        const instance = bot
-            ? runningTurnInstance(bot, turn.threadId, routineRun?.runOn)
-            : routineRun?.runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") : null;
-        void instance?.adapter.interruptTurn(turn.threadId).catch(() => { });
+        void runningTurnInstance(bot, turn.threadId)?.adapter.interruptTurn(turn.threadId).catch(() => { });
         const minutes = Math.round(TURN_STALL_MS / 60_000);
         if (routineRun?.target === "bot") {
             routines?.failThread(turn.threadId, `No activity for ${minutes} minutes — the routine was stopped`);
@@ -5463,7 +5352,7 @@ const watchdog = new TurnWatchdog({
         store.appendMessage(turn.threadId, {
             role: "bot",
             kind: "activity",
-            tool: { name: `error: no activity for ${minutes} minutes — the turn was stopped`, ok: false },
+            tool: failedTurnTool(`no activity for ${minutes} minutes — the turn was stopped`),
         });
         // a routine's stall reports through its own failure path
         if (bot && routineRun?.target !== "bot") {
@@ -5743,6 +5632,8 @@ bus.subscribe((event) => {
 });
 // Per-thread state the digest needs from before the turn: when it started,
 // and the checkpoint taken at dispatch (hash + folder) so settle can diff.
+// `pin` is the dispatch that pinned that commit in the shadow repo, so a
+// sibling thread's snapshot in the same folder cannot reclaim it mid-turn.
 const turnStartedAt = new Map();
 const turnCheckpoints = new Map();
 // The turn a thread is in, from the last event that named one. Not every
@@ -5750,9 +5641,18 @@ const turnCheckpoints = new Map();
 // a digest can only count activity it can attribute — so an unstamped tool
 // row is attributed to the thread's live turn instead of to nothing.
 const liveTurnByThread = new Map();
+/** Forget a thread's pre-turn checkpoint and drop its pin, so the shadow
+ * repo's next cleanup may reclaim that commit. */
+function forgetTurnCheckpoint(threadId) {
+    const checkpoint = turnCheckpoints.get(threadId);
+    if (!checkpoint)
+        return;
+    turnCheckpoints.delete(threadId);
+    void checkpoints.release(checkpoint.botId, checkpoint.cwd, checkpoint.pin);
+}
 function clearTurnDigestState(threadId) {
     turnStartedAt.delete(threadId);
-    turnCheckpoints.delete(threadId);
+    forgetTurnCheckpoint(threadId);
     liveTurnByThread.delete(threadId);
     memoryRowsByThread.delete(threadId);
 }
@@ -5821,9 +5721,8 @@ function ingestEngineHook(capability, body) {
     }
     return { ok: true };
 }
-/** Persist observed tools and memory immediately. Keep a direct turn's
- * workspace claimed while its bounded file snapshot settles, then enrich
- * that same row only if its task and active branch still exist. */
+/** Persist observed tools and memory immediately, then enrich that same
+ * row only if its task and active branch still exist. */
 async function scheduleTurnDigest(input) {
     const at = Date.now();
     const startedAt = turnStartedAt.get(input.threadId);
@@ -5868,6 +5767,8 @@ async function scheduleTurnDigest(input) {
         }
         if (!checkpoint)
             return;
+        // A folder-level diff: when a sibling thread of this bot works in the
+        // same folder, its edits since this turn's snapshot are listed here too.
         const controller = new AbortController();
         let timer;
         const capture = async () => {
@@ -5891,6 +5792,12 @@ async function scheduleTurnDigest(input) {
     catch (error) {
         console.error(`digest: could not record turn ${input.turnId} on ${input.threadId}:`, error instanceof Error ? error.message : error);
     }
+    finally {
+        // The pre-turn commit has had its last reader (the diff above is queued
+        // ahead of this in the shadow repo); the next snapshot may reclaim it.
+        if (checkpoint)
+            void checkpoints.release(checkpoint.botId, checkpoint.cwd, checkpoint.pin);
+    }
 }
 // Bots currently working with nobody at the keyboard — a webhook turn, or a
 // turn a webhook-driven bot handed to a teammate. Auto mode is a decision
@@ -6026,9 +5933,6 @@ const vpsJoinRequests = new Map();
 const orphanBoatLifecycleBusyIds = new Set();
 const boatInventoryRequestsBusyIds = new Set();
 const computerProviderConfigTransitions = new Set();
-// A restore mutates and cleans a project work tree. Claim the bot across the
-// entire async Git operation so a turn cannot start in that folder midway.
-const checkpointRestoreLeases = new Set();
 /** The effective idle window, read from config so a Settings change applies
  * to both new and already-armed timers (see the config route). */
 const localVmIdleMs = () => localVmIdleTimeoutMinutes(cfg) * 60_000;
@@ -6093,10 +5997,6 @@ async function computerCallGate(internalCapability) {
         };
     }
     const computer = turnComputerResources.get(internalCapability.threadId);
-    // The screen call arriving here re-claims an idle-released seat directly
-    // (#1653): inside the reclaim window the previous holder picks its seat
-    // back up without re-entering the wait, and the successful claim
-    // restarts the quiet window. A seat another turn holds still refuses.
     if (!snapshot.held && computer && computer.owner.generation === internalCapability.generation &&
         !claimTurnResource(computer.owner, computer.resource)) {
         return {
@@ -6176,20 +6076,43 @@ async function attachTeamBoat(computer, botId, owner, canMount, remoteAgent) {
     if (!machine)
         throw new Error("The team's Boat computer is missing; explicitly create or retry it from the Team map");
     await bindTurnComputer(owner, `computer:box:${machine.id}`, true);
-    const action = boat.boatTurnLifecycleAction({ explicitCloud: true, canMount: true, state: typeof machine.state === "string" ? machine.state : null });
+    const action = boat.boatTurnLifecycleAction({ explicitCloud: true, state: typeof machine.state === "string" ? machine.state : null });
     if (action === "wake")
         machine = await boat.readyBoat(cfg, ownerId);
-    if (!machine || boat.boatTurnLifecycleAction({ explicitCloud: true, canMount: true, state: typeof machine.state === "string" ? machine.state : null }) !== "attach") {
+    if (!machine || boat.boatTurnLifecycleAction({ explicitCloud: true, state: typeof machine.state === "string" ? machine.state : null }) !== "attach") {
         throw new Error("The team computer is not ready; check it in the Team map");
     }
     if (turnResourceOwners.get(owner.threadId)?.generation !== owner.generation ||
         !turnResources.owns(`computer:box:${machine.id}`, owner))
         throw new Error("This computer turn ended while its machine was starting");
     return {
-        integration: { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(botId, owner.threadId, owner.generation) },
+        mount: cloudComputerMount(botId, owner, machine.id, remoteAgent),
         capture: () => boat.screenshotBoat(cfg, ownerId, machine.id),
     };
 }
+/** The two engine facts the cloud-computer rule reads (shared/cloud-computer.ts). */
+function cloudEngine(instance) {
+    return { driverKind: instance?.driverKind, computerMcp: instance?.adapter.capabilities.computerMcp };
+}
+/** How a turn's engine reaches a cloud computer. The Computer engine runs its
+ * whole turn on the Boat. Every other engine keeps its own model and sign-in
+ * and gets the Boat as one more stdio computer server (harness-mcp-proxy
+ * computer), in the same slot a Local VM or VPS uses: one mechanism on a
+ * desktop, a headless server and an OMB Cloud. The agent process holds only a
+ * turn-scoped capability naming this Boat, never a Boat credential. */
+function cloudComputerMount(botId, owner, boxId, remoteAgent) {
+    if (remoteAgent)
+        return { computer: { kind: "box", boxId } };
+    const control = controlIntegration(botId, owner.threadId, owner.generation, { boxId });
+    return {
+        localComputer: {
+            command: process.execPath,
+            args: [SPAWNED_PROXIES.harnessMcp, "computer"],
+            env: { ...AGENTS_NODE_FLAG, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`, OMB_MCP_TOKEN: control.token },
+            platform: "linux",
+        },
+    };
+}
 /** "Works on: This computer", strict. One mount for a bot thread and a group
  * chat, so the two cannot drift on what they check or how they fail. */
 async function mountHostComputer(owner, botId, providerSupportsLocal) {
@@ -6208,7 +6131,7 @@ async function mountHostComputer(owner, botId, providerSupportsLocal) {
             : "CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
     }
     await bindTurnComputer(owner, "computer:host");
-    return gatedLocalComputer(cua, controlIntegration(botId, owner.threadId, owner.generation));
+    return gatedLocalComputer(cua, controlIntegration(botId, owner.threadId, owner.generation, "this computer"));
 }
 /** The bot's own VPS desktop, mounted into the local agent. The desktop lease
  * is claimed on the first computer call, through the computer-control gate
@@ -6248,7 +6171,9 @@ async function mountBotVps(bot, owner, opts) {
 }
 /** The bot's own Boat. Explicit Cloud is the consent boundary: it may create a
  * missing machine and wake an archived one (~8s, and it un-pauses billing);
- * Auto only attaches a machine that is already running. */
+ * Auto (only ever the Computer engine, see startTurn) only attaches a machine
+ * that is already running. Callers have already checked that the engine can
+ * work on it (cloudPlaceDriverError). */
 async function attachBotBoat(bot, owner, opts) {
     // Explicit cloud turns can provision/wake the same bot's Boat. Claim before
     // any network await so setup itself cannot race another turn.
@@ -6267,7 +6192,6 @@ async function attachBotBoat(bot, owner, opts) {
     }
     const lifecycleOf = (explicitCloud) => boat.boatTurnLifecycleAction({
         explicitCloud,
-        canMount: opts.canMount,
         state: typeof b?.state === "string" ? b.state : null,
     });
     let lifecycle = lifecycleOf(opts.explicitCloud);
@@ -6291,9 +6215,7 @@ async function attachBotBoat(bot, owner, opts) {
     await bindTurnComputer(owner, `computer:box:${machine.id}`, opts.remoteAgent);
     return {
         capture: () => boat.screenshotBoat(cfg, bot.id, machine.id),
-        integration: opts.canMount
-            ? { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(bot.id, owner.threadId, owner.generation) }
-            : null,
+        mount: cloudComputerMount(bot.id, owner, machine.id, opts.remoteAgent),
     };
 }
 function managedBoatOwners() {
@@ -6370,17 +6292,6 @@ function turnProvider(bot, runOn, threadId) {
         return "box";
     return bot.cloudBackend === "vps" ? "vps" : wants === "cloud" ? "box" : null;
 }
-/** A driver with a Boat bridge keeps the selected model. Other engines use
- * Boat's native runner. Start and interrupt must resolve the same owner. */
-function turnInstance(bot, runOn, threadId) {
-    const selected = registry.get(bot.modelSelection.instanceId);
-    if (selected?.adapter.capabilities.cloudComputerMcp)
-        return selected;
-    const onBoat = turnProvider(bot, runOn, threadId) === "box";
-    return onBoat
-        ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
-        : registry.get(bot.modelSelection.instanceId);
-}
 /** Preview requests carry the selected conversation, not whichever thread
  * happens to be the bot's default. A query never grants lifecycle authority. */
 function computerPreviewBot(botId, url) {
@@ -6423,7 +6334,8 @@ async function computerPreviewSurface(bot, threadId) {
  * A Cloud home lists only the places it has (cloud-home.ts), so a bot never
  * tells the person to set up this computer or a Local VM there. */
 async function selectableComputers(bot) {
-    const caps = registry.get(bot.modelSelection.instanceId)?.adapter.capabilities;
+    const instance = registry.get(bot.modelSelection.instanceId);
+    const caps = instance?.adapter.capabilities;
     const off = bot.computer === "off";
     const localEngine = caps?.remoteAgent !== true;
     const surfaces = ["cloud", "vm", "local", "browser"].filter(surface => !CLOUD_HOME || cloudHomeOffersPlace(surface));
@@ -6441,16 +6353,16 @@ async function selectableComputers(bot) {
                 reason = "Computer access is Off in this bot's settings.";
             else if (surface === "cloud") {
                 if (bot.cloudBackend === "vps") {
-                    const status = localEngine && caps?.computerMcp ? await vps.vpsComputerStatus(cfg, bot.id) : null;
+                    const status = canWorkOnCloud(cloudEngine(instance), "vps") ? await vps.vpsComputerStatus(cfg, bot.id) : null;
                     ready = status?.ready === true;
                     canStart = Boolean(status?.daemonUp && status.managed && status.container === "stopped" &&
                         status.image && status.imageMatches && status.network === "private" && status.mounts === "none" && status.security === "hardened");
                     canCreate = Boolean(status?.configured && status.daemonUp && status.container === "missing");
                     reason = status?.problem ?? reason;
                 }
-                else if (boat.boatConfigured(cfg) && (caps?.usesCloudComputer === true || registry.instances().some(instance => instance.driverKind === "boxAgent"))) {
+                else if (boat.boatConfigured(cfg) && canWorkOnCloud(cloudEngine(instance), "box")) {
                     const status = await boat.boatStatus(cfg, bot.id);
-                    const lifecycle = boat.boatTurnLifecycleAction({ explicitCloud: true, canMount: true, state: status.box?.state ?? null });
+                    const lifecycle = boat.boatTurnLifecycleAction({ explicitCloud: true, state: status.box?.state ?? null });
                     ready = lifecycle === "attach";
                     canStart = lifecycle === "wake";
                     canCreate = lifecycle === "provision";
@@ -6527,8 +6439,9 @@ function continueComputerSelection(threadId, generation, succeeded) {
 /** The engine that dispatched each live turn. A bot's settings may change
  * mid-turn; an interrupt or steer must reach the engine actually running. */
 const runningTurnEngines = new Map();
-function runningTurnInstance(bot, threadId, runOn) {
-    return runningTurnEngines.get(threadId) ?? turnInstance(bot, runOn, threadId);
+function runningTurnInstance(bot, threadId) {
+    // A turn always runs on the bot's own engine, wherever it works.
+    return runningTurnEngines.get(threadId) ?? (bot ? registry.get(bot.modelSelection.instanceId) : null);
 }
 function providerTransitionForTurn(bot, runOn, threadId) {
     const provider = turnProvider(bot, runOn, threadId);
@@ -6909,38 +6822,6 @@ bus.subscribe((event) => {
                     if (touches || /computer|screenshot|click|type_text|press_key|scroll|open_url|wait_for|browser_/i.test(toolName)) {
                         pokeScreenPoller(event.threadId, touches, surface);
                     }
-                    // A completed screen-touching computer tool is real screen
-                    // activity (#1653): it restarts the idle clock on that turn's
-                    // computer claim. The poller's own frames never arrive here, so
-                    // they cannot keep a quiet seat held.
-                    if (touches && surface === "computer") {
-                        const computer = turnComputerResources.get(event.threadId);
-                        if (computer) {
-                            // A quiet window cannot expire while this call executes.
-                            turnResources.endComputerCall(computer.resource, computer.owner);
-                            turnResources.activity(computer.resource, computer.owner);
-                        }
-                        else {
-                            // The call never forwarded onto a bound desktop, or the lazy
-                            // bind never landed: drop its pending start so it cannot
-                            // fence a claim taken later (#1653).
-                            const pending = pendingComputerCallStarts.get(event.threadId);
-                            if (pending) {
-                                if (pending.count > 1)
-                                    pendingComputerCallStarts.set(event.threadId, { ...pending, count: pending.count - 1 });
-                                else
-                                    pendingComputerCallStarts.delete(event.threadId);
-                            }
-                        }
-                        // Real cloud-screen work refreshes the #1655 idle stop for
-                        // that seat; the poller's own frames never arrive here, so
-                        // preview traffic cannot keep a paid machine awake.
-                        if (computer?.resource.startsWith("computer:box:")) {
-                            const seatBot = store.botByThread(event.threadId);
-                            if (seatBot)
-                                cloudSeatLeases.get(seatBot.id)?.touch();
-                        }
-                    }
                 }
             }
             break;
@@ -6963,26 +6844,6 @@ bus.subscribe((event) => {
                 });
                 if (event.itemId)
                     toolMessageByItem.set(`${event.threadId}:${event.itemId}`, message.id);
-                // A screen-touching computer tool opening is an in-flight call on
-                // that turn's claim (#1653): the seat cannot be idle-released out
-                // from under I/O the desktop is still executing. Its completion —
-                // or the turn settling — drops the fence.
-                if (screenTouchingTool(name) && screenSurfaceForTool(name) === "computer") {
-                    const computer = turnComputerResources.get(event.threadId);
-                    if (computer) {
-                        turnResources.beginComputerCall(computer.resource, computer.owner);
-                    }
-                    else {
-                        // A lazy attach (#1361) may not have seated the claim yet: the
-                        // gate finishes the bind before the call forwards, so hold the
-                        // start here and let bindTurnComputer fence the fresh claim.
-                        const generation = activeInternalGenerationByThread.get(event.threadId);
-                        if (generation) {
-                            const pending = pendingComputerCallStarts.get(event.threadId);
-                            pendingComputerCallStarts.set(event.threadId, pending?.generation === generation ? { generation, count: pending.count + 1 } : { generation, count: 1 });
-                        }
-                    }
-                }
             }
             break;
         case "request.opened": {
@@ -6994,8 +6855,9 @@ bus.subscribe((event) => {
             // A permission request here is one the provider left for a person: its
             // own mode already ran (Ask, Edits, Auto's reviewer, Custom's config).
             // Only the person's explicit Full access or exact saved command answers.
-            // The app does not guess whether the action is safe. A QUESTION
-            // always reaches the human — even Full access never invents an answer.
+            // Approve for me allows a web search. The app does not guess whether
+            // the action is safe. A QUESTION always reaches the human — even Full
+            // access never invents an answer.
             const asker = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id, event.threadId) : false;
             // A turn a guest drives on a Cloud home is Ask, room turns included,
@@ -7057,9 +6919,9 @@ bus.subscribe((event) => {
                         if (outcome !== "unavailable")
                             pushMessage({
                                 role: "bot", kind: "activity",
-                                tool: { name: outcome === "rejected"
-                                        ? `The provider rejected this action despite ${verdict.source === "command-allowlist" ? "the saved command permission" : "Full access"}.`
-                                        : "error: could not deliver approval to the provider; retry the task after reconnecting.", ok: false },
+                                tool: outcome === "rejected"
+                                    ? { name: `The provider rejected this action despite ${verdict.source === "command-allowlist" ? "the saved command permission" : "Full access"}.`, ok: false }
+                                    : failedTurnTool("could not deliver approval to the provider; retry the task after reconnecting."),
                             });
                         return;
                     }
@@ -7151,6 +7013,8 @@ bus.subscribe((event) => {
                         store.setTaskActivity(bot.id, event.threadId, "waiting-on-you");
                     else if (asker.busy)
                         store.setActivity(asker.id, "waiting-on-you");
+                    if (event.requestId)
+                        showWaitingOnPersonChip(event.threadId, event.requestId, asker, permission ? "approval" : "answer");
                     const notificationBot = (routineRun && routineSourceOwner(routineRun)?.bot) || asker;
                     notify(buildNotification(permission ? "approval" : "question", notificationBot, (routineRun && routineSourceThread(routineRun)) || event.threadId, event.summary));
                 }
@@ -7160,6 +7024,8 @@ bus.subscribe((event) => {
         case "request.resolved": {
             if (event.requestId)
                 pendingCommandRules.delete(`${event.threadId}:${event.requestId}`);
+            if (event.requestId)
+                settleWaitingOnPersonChips(event.threadId, event.requestId);
             // answered (by whoever): the turn is working again, unless it settled
             const waiting = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             if (bot && store.taskByThread(bot.id, event.threadId)?.activity === "waiting-on-you") {
@@ -7205,14 +7071,7 @@ bus.subscribe((event) => {
             pushMessage({
                 role: "bot",
                 kind: "activity",
-                tool: {
-                    // a setup error carries its fix, which must not be cut mid-command
-                    name: `error: ${event.message.slice(0, event.setup ? 320 : 160)}`,
-                    ok: false,
-                    setup: event.setup,
-                    ...(event.terminal ? { terminal: true } : {}),
-                    ...(event.claudeUpdate ? { claudeUpdate: true } : {}),
-                },
+                tool: failedTurnTool(event.message, event),
             });
             // a setup error means the engine could not even start: the bot is
             // dead until something changes, not merely idle. The next successful
@@ -7230,6 +7089,7 @@ bus.subscribe((event) => {
             }
             break;
         case "turn.completed": {
+            settleWaitingOnPersonChips(event.threadId);
             // A peer-started turn settles as coordination, not as news. What keeps
             // that classification from outliving its turn is the rewrite at
             // dispatch, not this line — releasing it here too is hygiene, so a
@@ -7447,8 +7307,8 @@ bus.subscribe((event) => {
                     // still be in flight).
                     //
                     // Keep the thread busy until its bounded final capture releases
-                    // the screen AND workspace. Otherwise an accepted follow-up races
-                    // these claims and fails as though another thread owned its folder.
+                    // the screen: an accepted follow-up must not take the desktop
+                    // before the END-state frame is captured.
                     const settleLeafId = store.activePath(event.threadId).at(-1)?.id;
                     let timeout;
                     const screenSettled = Promise.race([
@@ -7540,6 +7400,57 @@ bus.subscribe((event) => {
  * channel that only ever shows requests is half a record. Mirror the
  * reply on success; mirror a failed/stopped terminal chip otherwise. */
 const delegationWatch = new Map();
+/** The card in this thread that is waiting on the person: an approval, a
+ * question or a proposal to review, newest first. */
+function openPersonCard(threadId) {
+    const messages = store.messagesFor(threadId);
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const card = messages[i].kind === "options" ? messages[i].card : undefined;
+        const kind = liveCardKind(card);
+        if (kind)
+            return { kind, tool: card?.tool };
+    }
+    return undefined;
+}
+/** The conversation waiting on work that runs in this thread: a Chief's
+ * delegate_bot task or coordinate_bots assignment. */
+function delegatorOf(threadId) {
+    const watch = delegationWatch.get(threadId);
+    if (watch?.sourceThreadId)
+        return { threadId: watch.sourceThreadId, botId: watch.sourceBotId };
+    const parent = roomHandoffs.assignerOf(threadId);
+    return parent ? { threadId: parent.threadId, botId: parent.botId } : undefined;
+}
+// MOCA-274: a delegated teammate's card used to live only in its own thread,
+// so the person talking to the Chief never saw that work was waiting on them.
+// A chip in the delegating conversation points at the card until it settles.
+const waitingOnPersonChips = new Map();
+function showWaitingOnPersonChip(threadId, requestId, asker, kind) {
+    const delegator = delegatorOf(threadId);
+    if (!delegator || delegator.threadId === threadId)
+        return;
+    const chip = store.appendMessage(delegator.threadId, { role: "bot", kind: "activity",
+        from: { botId: asker.id, name: asker.name, color: asker.color },
+        tool: { name: `Waiting on your ${kind} in @${asker.name}` },
+        threadRef: { botId: asker.id, threadId, title: store.taskByThread(asker.id, threadId)?.title ?? asker.name },
+    });
+    waitingOnPersonChips.set(`${threadId}:${requestId}`, { threadId: delegator.threadId, messageId: chip.id, name: asker.name, kind });
+}
+/** Settle the chip for one answered card, or every chip for this thread once
+ * its turn ends (a card nobody answered can no longer be answered). */
+function settleWaitingOnPersonChips(threadId, requestId) {
+    for (const [key, chip] of waitingOnPersonChips) {
+        if (requestId ? key !== `${threadId}:${requestId}` : !key.startsWith(`${threadId}:`))
+            continue;
+        waitingOnPersonChips.delete(key);
+        const existing = store.messagesFor(chip.threadId).find((message) => message.id === chip.messageId);
+        if (!existing?.tool)
+            continue;
+        store.patchMessage(chip.threadId, chip.messageId, {
+            tool: { ...existing.tool, name: requestId ? `@${chip.name} got your ${chip.kind}` : `@${chip.name} is no longer waiting on your ${chip.kind}`, ok: true },
+        });
+    }
+}
 // Peer wake: when a delegated reply lands, resume the source bot so it can
 // fold the result in and answer the user instead of sitting idle. Mirrors
 // the cardContinuation resume pattern used for connector/credential cards.
@@ -7583,10 +7494,7 @@ function dispatchDelegationWake(botId, threadId, targetName, failureReason, rout
         store.appendMessage(threadId, {
             role: "bot",
             kind: "activity",
-            tool: {
-                name: `error: could not resume after delegation — ${message.slice(0, 120)}`,
-                ok: false,
-            },
+            tool: failedTurnTool(`could not resume after delegation — ${message}`),
         });
         routines?.failThread(threadId, `Could not resume after delegation: ${message}`);
     });
@@ -7688,7 +7596,7 @@ function reportIncident(input) {
         store.appendMessage(incidents.threadId, {
             role: "bot",
             kind: "activity",
-            tool: { name: `error: the incident could not reach ${chief.name} — ${why.slice(0, 120)}`, ok: false },
+            tool: failedTurnTool(`the incident could not reach ${chief.name} — ${why}`),
         });
         tellThePerson();
     });
@@ -7738,7 +7646,7 @@ function markTaskContextExternallyUpdated(bot, threadId) {
     const owner = task.lastInstanceId;
     const record = owner ? task.handedMessages?.[owner] : undefined;
     if (owner && record?.session !== undefined && record.session === task.resumeCursors[owner] &&
-        turnInstance(botForThread(bot.id, threadId) ?? bot, undefined, threadId)?.instanceId === owner &&
+        (botForThread(bot.id, threadId) ?? bot).modelSelection.instanceId === owner &&
         registry.get(owner)?.adapter.capabilities.strictResume) {
         store.patchTask(bot.id, threadId, { unread: true });
         return;
@@ -8087,7 +7995,7 @@ const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel,
         store.appendMessage(sourceThreadId, {
             role: "bot",
             kind: "activity",
-            tool: { name: `error: delegation to @${bot?.name ?? toBotId} could not start — ${why.slice(0, 120)}`, ok: false },
+            tool: failedTurnTool(`delegation to @${bot?.name ?? toBotId} could not start — ${why}`),
         });
     };
     return startTurn(toBotId, text, {
@@ -8199,10 +8107,7 @@ function drainQueuedSends() {
         }).catch((err) => {
             store.appendMessage(threadId, {
                 role: "bot", kind: "activity",
-                tool: {
-                    name: `error: queued message could not start — ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`,
-                    ok: false,
-                },
+                tool: failedTurnTool(`queued message could not start — ${err instanceof Error ? err.message : String(err)}`),
             });
             resolve();
             // M2: only this group left the queue, and a turn that never
@@ -8259,10 +8164,7 @@ function drainAsideLane() {
             }).catch((err) => {
                 store.appendMessage(threadId, {
                     role: "bot", kind: "activity",
-                    tool: {
-                        name: `error: queued aside could not start — ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`,
-                        ok: false,
-                    },
+                    tool: failedTurnTool(`queued aside could not start — ${err instanceof Error ? err.message : String(err)}`),
                 });
                 resolve();
             }).catch(reject);
@@ -8554,7 +8456,7 @@ async function startOrQueueOpenedThread(botId, threadId, text, unattended) {
         store.appendMessage(threadId, {
             role: "bot",
             kind: "activity",
-            tool: { name: `error: this thread could not start — ${why.slice(0, 120)}`, ok: false },
+            tool: failedTurnTool(`this thread could not start — ${why}`),
         });
         return { state: "failed", error: why };
     }
@@ -8757,11 +8659,6 @@ async function startTurn(botId, text, opts) {
     // A workspace at its monthly spend limit starts no turn of any kind: a
     // person's message, a routine, a peer hop or a webhook all stop here.
     assertWithinBudget(cfg, DATA_DIR);
-    if (checkpointRestoreLeases.has(botId)) {
-        throw Object.assign(new Error("this bot's project files are being restored — wait for the restore to finish"), {
-            status: 409,
-        });
-    }
     if (boatLifecycleBusyBots.has(botId)) {
         throw Object.assign(new Error("this bot's cloud computer is being changed — wait for it to finish"), { status: 409 });
     }
@@ -8778,10 +8675,10 @@ async function startTurn(botId, text, opts) {
     // their results still return here (outstandingAssignmentsPrompt tells this
     // turn which are still out). Stop, in this conversation, is the gesture
     // that ends coordination — see interruptDirectThread.
-    // Retire anything a previous turn left behind before minting this turn's
-    // integrations. Completion and interrupt paths do the same; this is the
-    // final backstop against a retained proxy process.
-    revokeInternalCapabilitiesForThread(threadId);
+    // Revoke anything a previous turn left behind before minting this turn's
+    // integrations. Completion and interrupt paths do the same; a proxy the
+    // warm engine kept is honoured again only through this turn's records.
+    revokeEarlierTurnCapabilities(threadId);
     // a webhook turn, or one inherited from a bot already running unattended
     if (opts?.automationSource === "webhook" || opts?.unattended)
         markUnattended(bot.id, threadId);
@@ -8796,11 +8693,9 @@ async function startTurn(botId, text, opts) {
     if (hostedModels && !hostedModels.allows(bot.modelSelection))
         throw Object.assign(new Error(hostedModels.error()), { status: 409 });
     const plan = turnSurfacePlan(bot, opts?.runOn, threadId);
-    const instance = turnInstance(bot, opts?.runOn, threadId);
+    const instance = registry.get(bot.modelSelection.instanceId);
     if (!instance) {
-        throw Object.assign(new Error(turnProvider(bot, opts?.runOn, threadId) === "box"
-            ? "the Cloud VM runner is unavailable — configure Boat in App Settings"
-            : `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
+        throw Object.assign(new Error(`provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
     }
     const policyRefusal = policyModelRefusal(instance);
     if (policyRefusal)
@@ -8860,13 +8755,12 @@ async function startTurn(botId, text, opts) {
     if (providerInstancesChanging.has(instanceId)) {
         throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
     }
-    const switchedEngine = instance.instanceId !== bot.modelSelection.instanceId;
-    const useInstanceDefaults = switchedEngine || (opts?.runOn === "cloud" && !instance.adapter.capabilities.cloudComputerMcp);
-    const model = useInstanceDefaults ? instance.models.default : bot.modelSelection.model;
-    // A native cloud runner borrows its instance defaults; a Boat bridge keeps
-    // the bot's selected model, effort and variant.
-    const effort = useInstanceDefaults ? undefined : bot.modelSelection.effort;
-    const variant = useInstanceDefaults ? undefined : bot.modelSelection.variant;
+    // A turn always runs on the bot's own engine, model, effort and variant,
+    // wherever it works: a cloud computer is a tool it mounts, never a reason
+    // to swap the engine (the provider_not_configured incident).
+    const model = bot.modelSelection.model;
+    const effort = bot.modelSelection.effort;
+    const variant = bot.modelSelection.variant;
     assertModelVariantSupported({ variant, effort }, instance.adapter.capabilities);
     // A selection can be persisted while its engine is offline. Re-check when
     // the engine returns so an old or unsupported value never reaches a CLI.
@@ -9190,42 +9084,43 @@ async function startTurn(botId, text, opts) {
             }
             const privateWorkspace = worksInWorkspace ? ensureTaskWorkspace(bot.id, threadId) : undefined;
             const skillInstructions = renderSkillInstructions(selectedSkills, {
-                includeRoot: worksInWorkspace && opts?.runOn !== "cloud",
+                includeRoot: worksInWorkspace,
             });
             const packagePlaybooks = installedPlaybookInstructions(providerText, bot.playbooks);
             // An explicit working folder wins for new tasks; otherwise they use
             // the private bot workspace. A legacy task with an existing provider
             // session deliberately pins to null (the old home-folder behavior),
             // because moving a live session would break resume.
-            // A cloud run happens on the boat, where a host folder means nothing:
-            // pin the task to the default so the header chip never shows the
-            // bot's folder for a task that runs elsewhere.
-            if (opts?.runOn === "cloud")
-                store.pinTaskCwd(bot.id, threadId, undefined, { none: true });
+            // A cloud run keeps the bot's own engine on this host, with the cloud
+            // computer as one more tool, so it works in the same folder as any
+            // other turn (only the Computer engine runs on the Boat, and it has no
+            // workspace files).
             // On a Cloud home a conversation a guest opened is pinned to its own
             // folder when it first runs, not the bot's project folder the owner's
             // conversations share (what it leaves there reaches none of them). One
             // that ran before keeps its pin, unless the session that opened it was
             // revoked: then it was unpinned at boot (server/cloud-owner.ts).
-            const pinnedCwd = privateWorkspace && opts?.runOn !== "cloud"
+            const pinnedCwd = privateWorkspace
                 ? store.pinTaskCwd(bot.id, threadId, privateWorkspace, { privateOnly: cloudGuestOpened(threadId) })
                 : null;
+            // A bot's threads run side by side in one project folder, like several
+            // Claude Code or Codex sessions open in one repo: the folder is never a
+            // turn-long claim. What truly needs one writer queues on its own — the
+            // per-turn snapshot per folder (server/checkpoints.ts), memory through
+            // memory_update — and the engines key their sessions by id, not folder.
             const cwd = pinnedCwd ?? undefined;
-            if (cwd && !claimTurnResource(resourceOwner, workspaceResource(cwd))) {
-                throw Object.assign(new Error("another thread is working in this project folder — wait for it to finish or choose a separate folder"), { status: 409, code: "workspace_busy" });
-            }
             // Checkpoint explicit project folders, where a bot can overwrite the
             // user's work. Its private OpenMaus workspace is app-owned and changes
             // on nearly every ordinary chat; snapshotting it would add hidden disk
-            // and process overhead without a user project to restore.
+            // and process overhead without a user project to list changes for.
             const checkpointCwd = cwd && cwd !== privateWorkspace ? cwd : undefined;
             // dweb is opt-in: without an explicit daemon URL, do not advertise
             // tools that would fail on every call or spawn an unnecessary proxy.
             const dwebUrl = process.env.DWEB_URL?.trim();
             if (dwebUrl)
                 integrations.dweb = { url: dwebUrl };
-            // Cloud routines always use Boat/BoatAgent. The per-bot backend applies
-            // only to ordinary turns that mount a computer into the local agent.
+            // Cloud routines always use the bot's Boat. The per-bot backend applies
+            // only to ordinary turns.
             const teamComputer = inheritedTeamComputer(bot);
             const cloudBackend = teamComputer || opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
             const mountsComputerMcp = instance.adapter.capabilities.computerMcp === true;
@@ -9240,8 +9135,6 @@ async function startTurn(botId, text, opts) {
             // landed. A team computer or a cloud routine is not this conversation's
             // choice, so those ignore the pin.
             const dispatchTask = store.taskByThread(bot.id, threadId);
-            if (plan.clearPin && dispatchTask)
-                store.patchTask(bot.id, threadId, { surface: undefined });
             if (plan.computer !== undefined && plan.computer !== "cloud" && instance.adapter.capabilities.remoteAgent === true) {
                 throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
             }
@@ -9253,6 +9146,21 @@ async function startTurn(botId, text, opts) {
             const placeRefusal = wantedKind && computerPlaceRefusal(wantedKind);
             if (placeRefusal)
                 throw Object.assign(new Error(placeRefusal.message), { status: 409, code: placeRefusal.code });
+            // Where an explicit place came from, so its failure names the one
+            // control that changes it (and a failed Auto-recorded pin is cleared).
+            // Auto and a team's shared computer are nobody's per-turn choice.
+            const namedPlace = teamComputer || wants === undefined || wants === "off" ? undefined : wants;
+            const placeSource = !namedPlace ? undefined
+                : opts?.runOn === "cloud" ? "routine"
+                    : plan.pinned ? (dispatchTask?.surfaceSource === "auto" ? "auto-pin" : "pin")
+                        : "works-on";
+            // An engine that cannot use the cloud computer is refused here, before
+            // anything is created or woken — never handed to another engine.
+            if (wants === "cloud" && placeSource) {
+                const unsupported = cloudPlaceDriverError(cloudEngine(instance), cloudBackend, placeSource);
+                if (unsupported)
+                    throw new PlaceUnavailableError("cloud", unsupported);
+            }
             let previewCapture = null;
             let browserCapture = null;
             let computerKind = null;
@@ -9400,7 +9308,7 @@ async function startTurn(botId, text, opts) {
                 store.appendMessage(threadId, {
                     role: "bot",
                     kind: "activity",
-                    tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
+                    tool: failedTurnTool(message),
                 });
                 if (opts?.automationSource === undefined && !opts?.commsDepth && !opts?.cardContinuation) {
                     notify(buildNotification("turn-failed", bot, threadId, redactSecretsInText(message), { avatarUrl: bot.avatarUrl }));
@@ -9506,24 +9414,23 @@ async function startTurn(botId, text, opts) {
                     return false;
                 }
             };
-            if (wants === "vm") {
-                if (await attachLocalVm(true))
-                    computerKind = "vm";
-            }
-            else if (wants === "local") {
-                integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
-                computerKind = "local";
-            }
-            // A VPS is a local-agent computer mount, never a remote agent runner.
-            // Explicit Cloud may prepare/start it. Auto remains read-only unless
-            // the person explicitly opted this bot into remote lifecycle actions.
-            if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps") {
-                const unsupported = vps.vpsDriverError(instance.driverKind, mountsComputerMcp);
-                if (unsupported && wants === "cloud")
-                    throw new Error(unsupported);
-                if (unsupported && wants === undefined)
-                    autoVpsProblem = unsupported;
-                if (!unsupported) {
+            // An explicit place that cannot be attached fails the turn with its
+            // cause and the next action; it never quietly moves the work elsewhere.
+            try {
+                if (wants === "vm") {
+                    if (await attachLocalVm(true))
+                        computerKind = "vm";
+                }
+                else if (wants === "local") {
+                    integrations.localComputer = await mountHostComputer(resourceOwner, bot.id, mountsLocalComputer);
+                    computerKind = "local";
+                }
+                // A VPS is a local-agent computer mount, never a remote agent runner.
+                // Explicit Cloud may prepare/start it. Auto remains read-only unless
+                // the person explicitly opted this bot into remote lifecycle actions.
+                // On Auto an engine that cannot use a computer simply skips it.
+                if ((wants === "cloud" || (wants === undefined && managedPolicy.computerAllowed("vps"))) && cloudBackend === "vps" &&
+                    canWorkOnCloud(cloudEngine(instance), "vps")) {
                     // The VPS "computer" is the desktop inside this bot's managed
                     // container, and only screen work needs that desktop to itself.
                     // So the lease is claimed on the first computer call, through the
@@ -9561,34 +9468,42 @@ async function startTurn(botId, text, opts) {
                         autoVpsProblem = mounted.problem ?? "the VPS computer could not be reached";
                     }
                 }
-            }
-            // Cloud is strict when selected. Native Boat and drivers with a Boat
-            // bridge may also reuse an already-ready Boat on Auto.
-            if (teamComputer) {
-                const attached = await attachTeamBoat(teamComputer, bot.id, resourceOwner, instance.adapter.capabilities.usesCloudComputer === true, instance.adapter.capabilities.remoteAgent === true);
-                integrations.computer = attached.integration;
-                previewCapture = attached.capture;
-                computerKind = "box";
-            }
-            if (!teamComputer && instance.adapter.capabilities.usesCloudComputer === true && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && boat.boatConfigured(cfg)) {
-                const attached = await attachBotBoat(bot, resourceOwner, {
-                    explicitCloud: wants === "cloud",
-                    canMount: instance.adapter.capabilities.usesCloudComputer === true,
-                    remoteAgent: instance.adapter.capabilities.remoteAgent === true,
-                });
-                if (attached) {
+                if (teamComputer) {
+                    const attached = await attachTeamBoat(teamComputer, bot.id, resourceOwner, canWorkOnCloud(cloudEngine(instance), "box"), instance.adapter.capabilities.remoteAgent === true);
+                    Object.assign(integrations, attached.mount);
                     previewCapture = attached.capture;
-                    if (attached.integration) {
-                        integrations.computer = attached.integration;
+                    computerKind = "box";
+                }
+                // Cloud is strict when selected. On Auto only the Computer engine,
+                // whose whole turn runs on its Boat, attaches one, and only one that
+                // is already running. Every other engine reaches the Boat only when
+                // this conversation is on it (Works on, a pin, a cloud routine, or
+                // select_computer): an Auto turn never reads the Boat account, so it
+                // adds no Boat call, cannot be stopped by a Boat being deleted, and
+                // never records a place nobody chose.
+                const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
+                if (!teamComputer && cloudBackend === "box" && boat.boatConfigured(cfg) &&
+                    (wants === "cloud" || (wants === undefined && remoteAgent && !computerPlaceRefusal("box")))) {
+                    const attached = await attachBotBoat(bot, resourceOwner, { explicitCloud: wants === "cloud", remoteAgent });
+                    if (attached) {
+                        previewCapture = attached.capture;
+                        Object.assign(integrations, attached.mount);
                         computerKind = "box";
                     }
                 }
+                if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
+                    throw new Error(BOAT_NOT_CONFIGURED);
+                }
+                if (wants === "cloud" && cloudBackend === "box" && computerKind !== "box") {
+                    throw new Error("the cloud computer could not be created or reached");
+                }
             }
-            if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
-                throw new Error(BOAT_NOT_CONFIGURED);
-            }
-            if (wants === "cloud" && cloudBackend === "box" && !integrations.computer) {
-                throw new Error("the cloud computer could not be created or reached");
+            catch (error) {
+                // Auto, Off and a team's shared computer name no place; they fail as
+                // they are.
+                if (!namedPlace || !placeSource)
+                    throw error;
+                throw asPlaceFailure(error, namedPlace, placeSource);
             }
             // Auto-only host fallback. Electron owns cua-driver/TCC attribution;
             // the harness only reads its already-running connection descriptor.
@@ -9631,7 +9546,7 @@ async function startTurn(botId, text, opts) {
                             pinAutoSurface("local");
                         },
                     });
-                    integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId));
+                    integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId, "this computer"));
                     computerKind = "local";
                 }
             }
@@ -9679,7 +9594,7 @@ async function startTurn(botId, text, opts) {
                 ? mentionedBots(providerText, sectionPeers)
                 : [];
             const coordinationPrompt = bot.chiefOfStaff
-                ? chiefOfStaffSystemPrompt(bot.id, store.bots, Boolean(integrations.agents), openMausStatusSystemPrompt(), boundedCoordination)
+                ? chiefOfStaffSystemPrompt(bot.id, store.bots, Boolean(integrations.agents), boundedCoordination)
                 : integrations.agents && sectionPeers.length > 0
                     // Ordinary bots could always CALL the peer tools; until now the
                     // one generic sentence they got never named a teammate, so the
@@ -9699,14 +9614,17 @@ async function startTurn(botId, text, opts) {
             // snapshot() absorbs failures, so checkpointing may delay but never fail
             // a turn.
             if (checkpointCwd) {
-                const before = await checkpoints.snapshot(bot.id, checkpointCwd, `turn ${threadId.slice(0, 8)}`);
+                // Pinned by this dispatch: a sibling thread's snapshot in the same
+                // folder must not reclaim this turn's "before" state while it runs.
+                const before = await checkpoints.snapshot(bot.id, checkpointCwd, `turn ${threadId.slice(0, 8)}`, undefined, { pin: dispatchClaimId });
                 if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId)) {
+                    if (before)
+                        void checkpoints.release(bot.id, checkpointCwd, dispatchClaimId);
                     throw new DirectTurnSetupCancelled("turn stopped during checkpoint");
                 }
+                forgetTurnCheckpoint(threadId);
                 if (before)
-                    turnCheckpoints.set(threadId, { cwd: checkpointCwd, hash: before });
-                else
-                    turnCheckpoints.delete(threadId);
+                    turnCheckpoints.set(threadId, { botId: bot.id, cwd: checkpointCwd, hash: before, pin: dispatchClaimId });
             }
             if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId)) {
                 throw new DirectTurnSetupCancelled("turn stopped before dispatch");
@@ -9765,8 +9683,9 @@ async function startTurn(botId, text, opts) {
             // Pin on use (issue #1650): every computer that registers a claim
             // slot — a ready Local VM, the VPS, the host fallback, a VM created
             // for this turn — records its pin inside the claim itself, so a turn
-            // that only mounted tools records nothing. A Box attached during
-            // dispatch and the built-in browser (no seat to claim) pin here.
+            // that only mounted tools records nothing. The Computer engine's Boat
+            // (its whole turn runs there) and the built-in browser (no seat to
+            // claim) pin here.
             if (autoPinAllowed()) {
                 const claimSlot = autoVmClaims.get(threadId);
                 const pinsAtClaim = claimSlot?.owner.generation === resourceOwner.generation;
@@ -9788,7 +9707,6 @@ async function startTurn(botId, text, opts) {
             const computerPromptKind = resolveComputerPromptKind({
                 kind: computerKind,
                 driverKind: instance.driverKind,
-                cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
                 vmPrivate: localVmMode(cfg) === "per-bot",
             });
             const coordinationNode = opts?.coordination ? roomHandoffs.nodes.get(opts.coordination.id) : undefined;
@@ -9801,14 +9719,14 @@ async function startTurn(botId, text, opts) {
                 // to a turn whose engine actually mounted them (setupMode is already
                 // false when they are not — see agentsMounted above)
                 { id: "setup", label: "Setup", text: setupSystemPrompt(setupMode, { skills: skillAuthoring, cwd: liveBot?.cwd ?? bot.cwd }) },
-                { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
+                { id: "files", label: "File locations", text: worksInWorkspace ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
                 { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
                 { id: "plan", label: "Surface", text: surfacePrompt({ computer: mountedComputer, browser: Boolean(integrations.browser) }, { pinned: plan.pinned, note: plan.note, canSelect: computerSelectionTurns.has(threadId), cloudHome: Boolean(CLOUD_HOME) }) },
                 { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
-                { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) : "" },
+                { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) + describeConnectorScopes((liveBot ?? bot).connectorScopes) : "" },
                 { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
                 { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
                 { id: "coordination", label: "Team", text: coordinationPrompt ? ` ${coordinationPrompt}` : "" },
@@ -9821,6 +9739,10 @@ async function startTurn(botId, text, opts) {
                 { id: "profile", label: "Profile changes", text: profilePrompt },
                 { id: "learn", label: "Skill authoring", text: learnPrompt },
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+                { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (integrations.agents ? TEAM_MEMORY_PROMPT : "") },
+                // who on the team roster is busy right now; volatile, so a teammate
+                // starting or finishing work never changes the stable half
+                teamAvailabilityPart(coordinationPrompt ? sectionPeers : []),
                 // what the bot said lately in its other conversations, so a task
                 // never redoes — or forgets — what another one already did
                 { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId, ...recentWorkFilter() })) },
@@ -9866,9 +9788,9 @@ async function startTurn(botId, text, opts) {
             const dispatch = await guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
                 botId: bot.id,
-                startupRecovery: cfg.automaticRecovery?.enabled === true && !opts?.automaticRecoveryAttempted,
+                startupRecovery: cfg.automaticRecovery?.enabled === true &&
+                    (opts?.automaticRecoveryIndex ?? 0) < ((liveBot ?? bot).fallback?.length || (cfg.automaticRecovery.backup ? 1 : 0)),
                 text: withRecalled(recalled, dispatchContext.turnText),
-                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(bot, commsDepth > 0, threadId),
                 toolScope,
@@ -10028,10 +9950,26 @@ async function startTurn(botId, text, opts) {
                 drainDelegationWakes();
                 return;
             }
+            // A failed place never sticks. An Auto-recorded pin to it (a
+            // select_computer switch, or where an earlier Auto turn landed) is the
+            // machine's memory, not a choice: clear it so the next message runs on
+            // Auto. A person's pin stays, and the message names the composer.
+            if (e instanceof PlaceUnavailableError) {
+                const pinned = store.taskByThread(bot.id, threadId);
+                if (pinned?.surface === e.place && pinned.surfaceSource === "auto") {
+                    store.patchTask(bot.id, threadId, { surface: undefined, surfaceSource: undefined });
+                }
+            }
             let message = e instanceof Error ? e.message : String(e);
-            const backup = cfg.automaticRecovery?.enabled ? cfg.automaticRecovery.backup : undefined;
             const current = store.projectBotForTask(bot.id, threadId);
-            if (mayRecover && backup && current && !opts?.automaticRecoveryAttempted && (!opts?.cardContinuation || opts.coordination) &&
+            const backups = cfg.automaticRecovery?.enabled
+                ? current?.fallback?.length ? current.fallback : cfg.automaticRecovery.backup ? [cfg.automaticRecovery.backup] : []
+                : [];
+            const nextIndex = backups.findIndex((candidate, index) => index >= (opts?.automaticRecoveryIndex ?? 0) &&
+                registry.get(candidate.instanceId)?.enabled &&
+                (candidate.instanceId !== instanceId || candidate.model !== model));
+            const backup = backups[nextIndex];
+            if (mayRecover && backup && current && (!opts?.cardContinuation || opts.coordination) &&
                 !directRequestOwners.get(threadId)?.stopped && !hasQueuedSteeredMessages(bot.id, threadId) &&
                 JSON.stringify(current.modelSelection) === JSON.stringify(bot.modelSelection) &&
                 (backup.instanceId !== instanceId || backup.model !== model) &&
@@ -10055,7 +9993,7 @@ async function startTurn(botId, text, opts) {
                                 name: `recovery: Automatic recovery: ${instance.displayName || instance.driverKind} could not start. Trying ${target.displayName || target.driverKind} · ${checked.selection.model} once in this thread.`, ok: true,
                             } });
                         await startTurn(bot.id, text, { ...opts, threadId, userMessage, editedMessageId: undefined,
-                            automaticRecoveryAttempted: true });
+                            automaticRecoveryAttempted: true, automaticRecoveryIndex: nextIndex + 1 });
                         // The backup now owns these callbacks; don't publish a failed
                         // routine/peer result or release a queued receipt in between.
                         directFollowupSettlers.delete(dispatchClaimId);
@@ -10076,7 +10014,7 @@ async function startTurn(botId, text, opts) {
                 role: "bot",
                 kind: "activity",
                 turnSucceeded: false,
-                tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
+                tool: failedTurnTool(message),
             });
             // Worth a buzz for the same reason a routine failure is, and the rule
             // notify.ts encodes: the bot is not working, and the cause is usually
@@ -10344,9 +10282,10 @@ routines = new RoutineManager({
         // nobody's is confined to a folder of its own, never the bot's project.
         if (task && CLOUD_HOME && routineId)
             threadStarters.set(task.threadId, routineOpener(routineId));
-        const bot = store.bot(botId);
-        if (task && bot)
-            broadcast({ kind: "bot", bot: publicBot(bot) });
+        // The store's frame announces it. A run's task that stays in the
+        // background leaves the open thread alone, so that frame carries no
+        // transcript: a whole thread on every scheduled run once passed the phone
+        // sidecar's 4 MiB event ceiling and ended the stream (MOCA-179).
         return task;
     },
     joinConversation: (run) => {
@@ -10395,17 +10334,14 @@ routines = new RoutineManager({
             goalRunId: runId,
         });
     },
-    interruptTurn: async (botId, threadId, runOn) => {
+    interruptTurn: async (botId, threadId) => {
         const bot = botForThread(botId, threadId);
         pendingDelegationWakes.delete(threadId);
         discardDelegations(commsBus, threadId);
         cancelDirectTurnDispatch(botId, threadId);
         revokeInternalCapabilitiesForThread(threadId);
-        const instance = bot
-            ? runningTurnInstance(bot, threadId, runOn)
-            : runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null : null;
         try {
-            await instance?.adapter.interruptTurn(threadId);
+            await runningTurnInstance(bot, threadId)?.adapter.interruptTurn(threadId);
         }
         finally {
             closeOpenApprovals(threadId);
@@ -10564,9 +10500,13 @@ async function cloudRoutineReadiness(botId, threadId) {
             reason: 'The Boat cloud computer needs a working Boat API key. For the bot’s configured computer, including a self-hosted VPS, set run_on="maus" instead.',
         };
     }
-    const instance = turnInstance(bot, "cloud", threadId);
+    const instance = registry.get(bot.modelSelection.instanceId);
     if (!instance)
-        return { ready: false, reason: "The Cloud VM runner is unavailable. Restart OpenMausBot and try again." };
+        return { ready: false, reason: "The target bot's model is unavailable. Choose another model in the bot's settings." };
+    // The same rule a cloud turn applies, before anything is provisioned.
+    const unsupported = cloudPlaceDriverError(cloudEngine(instance), "box", "routine");
+    if (unsupported)
+        return { ready: false, reason: unsupported };
     try {
         if ((await instance.snapshot()).state !== "available") {
             return { ready: false, reason: "The target bot's model is not ready to use the Boat cloud computer." };
@@ -10859,6 +10799,69 @@ const validateModelProposal = (selection, current) => {
     }
     return null;
 };
+const teamMemory = new TeamMemory(join(DATA_DIR, "team-memory.json"));
+const outboundRequests = new OutboundRequestService();
+const outboundCounts = new OutboundCounts(join(DATA_DIR, "outbound-counts.json"));
+const OUTBOUND_HOLD_MS = 9 * 60_000;
+function resolveAndSendTrust(res, threadId, requestId, behavior) {
+    const teamMemoryCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.teamMemoryRequest);
+    if (teamMemoryCard?.card?.teamMemoryRequest) {
+        const request = teamMemoryCard.card.teamMemoryRequest;
+        const proposer = teamMemoryCard.from?.botId ? store.bot(teamMemoryCard.from.botId) : store.botByThread(threadId);
+        const result = teamMemory.resolve(request.section, request.entryId, behavior === "allow" ? "accept" : "reject");
+        if (!result.claimed) {
+            if (!teamMemoryCard.card.answered) {
+                store.patchMessage(threadId, teamMemoryCard.id, { card: { ...teamMemoryCard.card, answered: "unavailable", dismissed: true } });
+            }
+            json(res, 200, { ok: true, outcome: "unavailable" });
+            return true;
+        }
+        if (result.state === "already_settled") {
+            json(res, 200, { ok: true, outcome: "allowed-once", alreadySettled: true });
+            return true;
+        }
+        store.patchMessage(threadId, teamMemoryCard.id, {
+            card: { ...teamMemoryCard.card, answered: result.state === "accepted" ? "allow" : "deny" },
+        });
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId: proposer?.id, botName: proposer?.name,
+            tool: "propose_team_memory", summary: teamMemoryCard.card.subtitle,
+            decision: result.state === "accepted" ? "user-approved" : "user-denied", source: "user",
+        });
+        json(res, 200, { ok: true, outcome: result.state === "accepted" ? "allowed-once" : "rejected" });
+        return true;
+    }
+    const outboundCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.outboundRequest);
+    if (outboundCard?.card?.outboundRequest) {
+        const outboundBot = outboundCard.from?.botId ? store.bot(outboundCard.from.botId) : store.botByThread(threadId);
+        const result = outboundRequests.resolve({ threadId, requestId, behavior });
+        if (!result.claimed) {
+            // The hold is memory-only: after a restart the card outlives the
+            // relay that was waiting on it, so close it rather than leave an
+            // approval nobody can deliver owning the composer.
+            if (!outboundCard.card.answered) {
+                store.patchMessage(threadId, outboundCard.id, { card: { ...outboundCard.card, answered: "unavailable", dismissed: true } });
+            }
+            json(res, 200, { ok: true, outcome: "unavailable" });
+            return true;
+        }
+        if (result.state === "already_settled") {
+            json(res, 200, { ok: true, outcome: result.behavior === "allow" ? "allowed-once" : "rejected", alreadySettled: true });
+            return true;
+        }
+        store.patchMessage(threadId, outboundCard.id, {
+            card: { ...outboundCard.card, answered: result.state === "allowed" ? "allow" : "deny" },
+        });
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId: outboundBot?.id, botName: outboundBot?.name,
+            tool: outboundCard.card.tool, summary: outboundCard.card.subtitle,
+            decision: result.state === "allowed" ? "user-approved" : "user-denied", source: "user",
+        });
+        json(res, 200, { ok: true, outcome: result.state === "allowed" ? "allowed-once" : "rejected" });
+        return true;
+    }
+    return false;
+}
 const profileRequests = new ProfileRequestService({
     store,
     autoApply: fullAccessForSource,
@@ -10875,52 +10878,6 @@ const modelRequests = new ModelRequestService({
     validateModel: validateModelProposal,
     driverCapabilities: driverCapabilitiesFor,
 });
-const tighteningRequests = new TighteningRequestService({
-    store,
-    autoApply: fullAccessForSource,
-    canPersist: proposalPersistence,
-    // Same reach as a profile change: a Chief may tighten a section peer;
-    // anyone else only itself. Re-checked at confirm.
-    validateTarget: (proposerBotId, targetBotId) => {
-        const proposer = store.bot(proposerBotId);
-        const target = store.bot(targetBotId);
-        if (!target)
-            return "that bot no longer exists";
-        if (!proposer?.chiefOfStaff)
-            return "only a section's Chief of Staff can change another bot's permissions";
-        if (!canReachPeer(proposer, target))
-            return "that bot is not in a team this Chief is allowed to manage";
-        return null;
-    },
-    // The card judges the effective mounts, so the snapshot resolves the same
-    // way the engine does: through the config-aware custom-server filter.
-    mountedMcpServers: (bot) => Object.keys(engineMcpServers(bot)),
-    enabledSkills: (botId) => {
-        const record = store.bot(botId);
-        return (record ? listBotSkills(record) : listSkills(botId)).filter((skill) => skill.enabled).map((skill) => skill.name);
-    },
-    disableSkill: (botId, name) => {
-        const record = store.bot(botId);
-        // Private skills win collisions, including disabled/private copies.
-        // Disabling one must not reveal a same-named shared skill instead.
-        if (skillsLibraryEnabled(cfg) && !listSkills(botId).some((skill) => skill.name === name)
-            && record?.assignedSkills?.includes(name)) {
-            try {
-                const saved = store.patchBot(botId, { assignedSkills: record.assignedSkills.filter((assigned) => assigned !== name) });
-                return saved ? { ok: true } : { ok: false, error: "that bot no longer exists" };
-            }
-            catch (error) {
-                return { ok: false, error: error instanceof Error ? error.message : String(error) };
-            }
-        }
-        const disabled = setSkillEnabled(botId, name, false);
-        return typeof disabled === "object" && "error" in disabled ? { ok: false, error: disabled.error } : { ok: true };
-    },
-    // The owner's own routes stop a busy bot before touching its approval
-    // level or MCP mounts; the card asks for the same, except an emergency
-    // full/custom → ask downgrade, which applies first and stops after.
-    targetBusy: (botId) => Boolean(store.bot(botId)?.busy || activeGroupTurnForBot(botId)),
-});
 const teamSetupTeams = () => [...new Set(["", ...readSections(), ...store.bots.map((bot) => sectionKey(bot.section)), ...store.groups.map((group) => sectionKey(group.section))])];
 const teamSetupRequests = new TeamSetupRequestService({
     store, teams: teamSetupTeams, canAccessTeam, canPersist: proposalPersistence, maxBots: MAX_WORKSPACE_BOTS,
@@ -11232,46 +11189,6 @@ function resolveAndSendModel(res, args) {
     json(res, 200, { ok: true, outcome: "rejected" });
     return true;
 }
-function resolveAndSendTightening(res, args) {
-    const card = store.messagesFor(args.threadId).find((message) => message.card?.requestId === args.requestId && message.card.tighteningRequest)?.card;
-    if (!card)
-        return false;
-    const result = tighteningRequests.resolve(args);
-    if (!result.claimed)
-        return false;
-    if (result.state === "applied" || result.state === "denied") {
-        appendDecision(DATA_DIR, {
-            threadId: args.threadId, requestId: args.requestId, botId: args.botId, botName: args.botName,
-            tool: "tighten_permissions", summary: card.subtitle,
-            decision: result.state === "applied" ? "user-approved" : "user-denied", source: "user",
-        });
-    }
-    if (result.state === "applied") {
-        const target = store.bot(result.targetBotId);
-        if (target)
-            broadcast({ kind: "bot", bot: wireBot(target) });
-        if (result.emergencyStop) {
-            // Mirror the owner's own route: the fail-closed Ask is already
-            // persisted, then the exact turn still holding the elevated
-            // per-turn snapshot is stopped. The response never waits on it.
-            void stopBotForEmergencyApprovalDowngrade(result.targetBotId).catch((error) => {
-                console.warn(`[tightening] emergency stop failed for bot ${result.targetBotId}: ${error instanceof Error ? error.message : String(error)}. The fail-closed Ask is persisted, but the in-flight turn keeps its elevated access until it ends.`);
-            });
-        }
-        json(res, 200, { ok: true, outcome: "allowed-once", tighteningFields: result.fields });
-        return true;
-    }
-    if (result.state === "invalid") {
-        json(res, result.status, { error: result.error });
-        return true;
-    }
-    if (result.state === "already_settled") {
-        json(res, 200, { ok: true, outcome: result.behavior === "allow" ? "allowed-once" : "rejected", alreadySettled: true });
-        return true;
-    }
-    json(res, 200, { ok: true, outcome: "rejected" });
-    return true;
-}
 // Webhook definitions are independent from calendar schedules, but every
 // delivery joins the same RoutineManager queue. That keeps unattended work
 // ordered behind a busy MAUS and gives webhook runs the same durable receipts.
@@ -11466,7 +11383,7 @@ setupRetry = 0) {
         onDispatchError?.(`${bot.name}'s approval level is still being confirmed — skipped this round`);
         return true;
     }
-    revokeInternalCapabilitiesForThread(threadId);
+    revokeEarlierTurnCapabilities(threadId);
     spoken.add(botId);
     // Must be the SAME resolver the readiness re-check uses below, or a Chief's
     // delegated Full elevation makes the two disagree by construction: every
@@ -11475,7 +11392,7 @@ setupRetry = 0) {
     const preparedApprovalMode = roomTurnApprovalMode(bot, threadId, orchestration);
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
-    const instance = turnInstance(bot);
+    const instance = registry.get(bot.modelSelection.instanceId);
     const userName = cfg.profile?.name?.trim() || "User";
     if (providerInstancesChanging.has(bot.modelSelection.instanceId)) {
         onDispatchError?.(`${bot.name}'s provider account is being updated — try again shortly`);
@@ -11494,7 +11411,7 @@ setupRetry = 0) {
             role: "bot",
             kind: "activity",
             from: { botId: bot.id, name: bot.name, color: bot.color },
-            tool: { name: `error: ${message}`, ok: false },
+            tool: failedTurnTool(message),
         });
         onDispatchError?.(message);
         return true;
@@ -11626,7 +11543,7 @@ setupRetry = 0) {
                 role: "bot",
                 kind: "activity",
                 from: { botId: bot.id, name: bot.name, color: bot.color },
-                tool: { name: `error: ${message}`, ok: false },
+                tool: failedTurnTool(message),
             });
             onDispatchError?.(message);
             return true;
@@ -11655,7 +11572,7 @@ setupRetry = 0) {
             : Boolean(readyGroup && store.groupTaskByThread(readyGroup.id, threadId));
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
-        const setupChanged = turnInstance(readyBot) !== instance ||
+        const setupChanged = registry.get(readyBot.modelSelection.instanceId) !== instance ||
             roomTurnApprovalMode(readyBot, threadId, orchestration) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
@@ -11780,6 +11697,13 @@ setupRetry = 0) {
         if (roomPlan.computer === "local" && instance.adapter.capabilities.remoteAgent === true) {
             throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
         }
+        // The same one rule as a bot thread, before anything is provisioned: an
+        // engine that cannot use the cloud computer is refused, never swapped.
+        if (!roomTeamComputer && roomPlan.computer === "cloud") {
+            const unsupported = cloudPlaceDriverError(cloudEngine(instance), turnProvider(readyBot) === "vps" ? "vps" : "box");
+            if (unsupported)
+                throw new PlaceUnavailableError("cloud", unsupported);
+        }
         // One place per room turn as well: a team computer reached on Auto means
         // no separate built-in browser.
         if (roomPlan.browser && !(roomPlan.computer === undefined && roomTeamComputer)) {
@@ -11798,11 +11722,11 @@ setupRetry = 0) {
             return false;
         }
         if (roomTeamComputer) {
-            const attached = await attachTeamBoat(roomTeamComputer, readyBot.id, resourceOwner, instance.adapter.capabilities.usesCloudComputer === true, instance.adapter.capabilities.remoteAgent === true);
+            const attached = await attachTeamBoat(roomTeamComputer, readyBot.id, resourceOwner, canWorkOnCloud(cloudEngine(instance), "box"), instance.adapter.capabilities.remoteAgent === true);
             if (isCancelled?.() || groupSpeakers.get(threadId) !== roomSpeaker ||
                 activeInternalGenerationByThread.get(threadId) !== internalGeneration)
                 return false;
-            integrations.computer = attached.integration;
+            Object.assign(integrations, attached.mount);
             startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: instance.adapter.capabilities.remoteAgent === true });
         }
         // The speaker's own explicit place, mounted exactly as its bot thread
@@ -11811,89 +11735,96 @@ setupRetry = 0) {
         const roomSetupIsCurrent = () => !isCancelled?.() &&
             groupSpeakers.get(threadId) === roomSpeaker &&
             activeInternalGenerationByThread.get(threadId) === internalGeneration;
-        if (!roomTeamComputer && roomPlan.computer === "local") {
-            integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
-            if (!roomSetupIsCurrent())
-                return false;
-            roomComputerKind = "local";
-        }
-        if (!roomTeamComputer && roomPlan.computer === "cloud") {
-            if (turnProvider(readyBot) === "vps") {
-                const unsupported = vps.vpsDriverError(instance.driverKind, instance.adapter.capabilities.computerMcp === true);
-                if (unsupported)
-                    throw new Error(unsupported);
-                vpsThreadStarted(readyBot.id, threadId);
-                roomVpsBotId = readyBot.id;
-                const mounted = await mountBotVps(readyBot, resourceOwner, {
-                    start: true,
-                    onClaimed: (capture) => {
-                        if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
-                            roomScreenBotId = readyBot.id;
-                            startScreenPoller(readyBot.id, threadId, { computer: capture });
-                        }
-                    },
-                });
+        // An explicit place that cannot be attached fails the member's turn with
+        // its cause and the one setting that changes it.
+        try {
+            if (!roomTeamComputer && roomPlan.computer === "local") {
+                integrations.localComputer = await mountHostComputer(resourceOwner, readyBot.id, instance.adapter.capabilities.localComputerMcp === true);
                 if (!roomSetupIsCurrent())
                     return false;
-                if (!("integration" in mounted))
-                    throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
-                integrations.localComputer = mounted.integration;
-                roomComputerKind = "vps";
+                roomComputerKind = "local";
+            }
+            if (!roomTeamComputer && roomPlan.computer === "cloud") {
+                if (turnProvider(readyBot) === "vps") {
+                    vpsThreadStarted(readyBot.id, threadId);
+                    roomVpsBotId = readyBot.id;
+                    const mounted = await mountBotVps(readyBot, resourceOwner, {
+                        start: true,
+                        onClaimed: (capture) => {
+                            if (roomSetupIsCurrent() && store.group(readyGroup.id)?.busyBotId === readyBot.id) {
+                                roomScreenBotId = readyBot.id;
+                                startScreenPoller(readyBot.id, threadId, { computer: capture });
+                            }
+                        },
+                    });
+                    if (!roomSetupIsCurrent())
+                        return false;
+                    if (!("integration" in mounted))
+                        throw new Error(mounted.problem ?? "the VPS computer could not be created or reached");
+                    integrations.localComputer = mounted.integration;
+                    roomComputerKind = "vps";
+                }
+                else {
+                    if (!boat.boatConfigured(cfg))
+                        throw new Error(BOAT_NOT_CONFIGURED);
+                    const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
+                    const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true, remoteAgent });
+                    if (!roomSetupIsCurrent())
+                        return false;
+                    if (!attached)
+                        throw new Error("the cloud computer could not be created or reached");
+                    Object.assign(integrations, attached.mount);
+                    roomScreenBotId = readyBot.id;
+                    startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
+                    roomComputerKind = "box";
+                }
             }
-            else {
-                if (!boat.boatConfigured(cfg))
-                    throw new Error(BOAT_NOT_CONFIGURED);
-                const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
-                const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true,
-                    canMount: instance.adapter.capabilities.usesCloudComputer === true, remoteAgent });
-                if (!roomSetupIsCurrent())
+            // Room and Goal turns use the speaker's desktop, never the coordinator's.
+            // Claim the same lease as direct turns before asynchronous VM setup.
+            if (readyBot.computer === "vm") {
+                if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
+                    throw new Error("this model cannot use the Local VM");
+                }
+                // A distinct identity fences cleanup even in shared mode on the same room thread.
+                const target = { ...localVmTargetForThread(readyBot.id, threadId) };
+                await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
+                if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
+                    throw new Error("this Local VM is being started, stopped, or replaced");
+                }
+                if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
+                    throw new Error("this Local VM is already being used by another turn");
+                }
+                if (localVmMode(cfg) === "pool")
+                    localVmSeatPool.touch(threadId);
+                roomVmTarget = target;
+                localVmThreadTargets.set(threadId, target);
+                localVmActiveThreads.set(target.key, threadId);
+                localVmIdleFor(target).touch();
+                const setupIsCurrent = () => !isCancelled?.() &&
+                    groupSpeakers.get(threadId) === roomSpeaker &&
+                    activeInternalGenerationByThread.get(threadId) === internalGeneration &&
+                    store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
+                    store.bot(readyBot.id)?.busy === true &&
+                    store.group(readyGroup.id)?.busyBotId === readyBot.id;
+                const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
+                if (!setupIsCurrent()) {
                     return false;
-                if (!attached?.integration)
-                    throw new Error("the cloud computer could not be created or reached");
-                integrations.computer = attached.integration;
-                roomScreenBotId = readyBot.id;
-                startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: remoteAgent });
-                roomComputerKind = "box";
+                }
+                if (!vm.ready || !vm.runtime)
+                    throw new Error(vm.problem ?? "the Local VM is not ready");
+                const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
+                if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
+                    throw new Error("the Local VM lease expired while preparing the turn");
+                }
+                integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, { localVmTarget: target }), target);
             }
         }
-        // Room and Goal turns use the speaker's desktop, never the coordinator's.
-        // Claim the same lease as direct turns before asynchronous VM setup.
-        if (readyBot.computer === "vm") {
-            if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
-                throw new Error("this model cannot use the Local VM");
-            }
-            // A distinct identity fences cleanup even in shared mode on the same room thread.
-            const target = { ...localVmTargetForThread(readyBot.id, threadId) };
-            await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
-            if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
-                throw new Error("this Local VM is being started, stopped, or replaced");
-            }
-            if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
-                throw new Error("this Local VM is already being used by another turn");
-            }
-            if (localVmMode(cfg) === "pool")
-                localVmSeatPool.touch(threadId);
-            roomVmTarget = target;
-            localVmThreadTargets.set(threadId, target);
-            localVmActiveThreads.set(target.key, threadId);
-            localVmIdleFor(target).touch();
-            const setupIsCurrent = () => !isCancelled?.() &&
-                groupSpeakers.get(threadId) === roomSpeaker &&
-                activeInternalGenerationByThread.get(threadId) === internalGeneration &&
-                store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
-                store.bot(readyBot.id)?.busy === true &&
-                store.group(readyGroup.id)?.busyBotId === readyBot.id;
-            const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
-            if (!setupIsCurrent()) {
-                return false;
-            }
-            if (!vm.ready || !vm.runtime)
-                throw new Error(vm.problem ?? "the Local VM is not ready");
-            const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
-            if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
-                throw new Error("the Local VM lease expired while preparing the turn");
-            }
-            integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, target), target);
+        catch (error) {
+            const place = roomPlan.computer;
+            if (place !== "cloud" && place !== "vm" && place !== "local")
+                throw error;
+            // A room row is not cut, so the cause keeps all its words.
+            throw asPlaceFailure(error, place, "works-on", Infinity);
         }
         const roster = readyGroup.memberIds
             .map((id) => store.bot(id))
@@ -11904,8 +11835,9 @@ setupRetry = 0) {
         // are who it cannot. The 1:1 prompt has carried a peer roster since #774,
         // and a room turn had nothing — the only advice it gave ("mention them
         // like @Name") sends the model after a teammate who will never see it.
-        // Same reachability rule as list_bots, minus the room's own members.
-        const outsideRoom = integrations.agents
+        // Same reachability rule as list_bots, minus the room's own members, and
+        // only on a turn that is not answering a room request.
+        const outsideRoom = integrations.agents && orchestration && !orchestration.roomHandoffId
             ? reachablePeers(store.bots, bot).filter((peer) => !readyGroup.memberIds.includes(peer.id))
             : [];
         const system = [
@@ -11915,7 +11847,7 @@ setupRetry = 0) {
             `Room members: ${roster}, and ${userName} (the human).`,
             readyGroup.bulletin.trim() && `Room bulletin (shared instructions for everyone):\n${readyGroup.bulletin.trim()}`,
             `Reply as yourself, briefly and conversationally. To bring a teammate in, mention them like @Name — they'll see the conversation and respond.`,
-            outsideRoom.length > 0 && orchestration && !orchestration.roomHandoffId && roomPeerRosterSystemPrompt(outsideRoom),
+            outsideRoom.length > 0 && roomPeerRosterSystemPrompt(outsideRoom),
             integrations.agents && (CREDENTIAL_PROMPT + (orchestration && !orchestration.roomHandoffId ? THREADS_PROMPT : "")).trim(),
             integrations.agents && (!orchestration || orchestration.roomHandoffId) && "For actual OpenMausBot teamwork, discover IDs with list_room_targets and use coordinate_bots for advice or work in this or another room. Do not substitute native coding helpers for these named bots. Consult only when needed to make a decision; no discussion step is mandatory. Give concrete responsibilities, exact accessible paths and acceptance checks. End your turn after assigning; busy teammates queue and results automatically resume you. When they return, finish the requested verification and give the user one final answer. Native helper names are not evidence that an OpenMausBot teammate participated. Plain @mentions are only for conversational replies in this room.",
             integrations.agents && ROUTINE_PROMPT.trim(),
@@ -11979,7 +11911,7 @@ setupRetry = 0) {
         const recentLines = recentWork(recentWorkSources(bot), bot, { userName, currentThreadId: threadId, ...recentWorkFilter() });
         const roomComputerPromptKind = resolveComputerPromptKind({
             kind: roomTeamComputer || roomComputerKind === "box" ? "box" : roomVmTarget ? "vm" : roomComputerKind,
-            driverKind: instance.driverKind, cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
+            driverKind: instance.driverKind,
             vmPrivate: localVmMode(cfg) === "per-bot",
         });
         {
@@ -12003,8 +11935,10 @@ setupRetry = 0) {
             { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents && bot.memoryEnabled !== false ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
+            teamAvailabilityPart(outsideRoom),
             { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+            { id: "team-memory", label: "Team memory", text: teamMemory.systemPrompt(bot.section) + (integrations.agents ? TEAM_MEMORY_PROMPT : "") },
             // the room path has always put a newline before memory and trimmed
             // the block's leading space; keep that so existing prompts are
             // byte-identical. The write guidance follows the tools actually
@@ -12137,7 +12071,6 @@ setupRetry = 0) {
                 threadId,
                 botId: readyBot.id,
                 text: withRecalled(roomRecalled, text),
-                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: roomTurnApprovalMode(readyBot, threadId, orchestration),
                 toolScope: toolScopeForTurn(readyBot.id),
@@ -12183,7 +12116,7 @@ setupRetry = 0) {
                     role: "bot",
                     kind: "activity",
                     from: { botId: bot.id, name: bot.name, color: bot.color },
-                    tool: { name: `error: ${message.slice(0, 140)}`, ok: false },
+                    tool: failedTurnTool(message),
                 });
                 onDispatchError?.(message);
                 watchdog.settle(threadId);
@@ -12376,7 +12309,7 @@ setupRetry = 0) {
         store.appendMessage(threadId, {
             role: "bot", kind: "activity",
             from: { botId: bot.id, name: bot.name, color: bot.color },
-            tool: { name: `error: ${message}`, ok: false },
+            tool: failedTurnTool(message),
         });
         onDispatchError?.(message);
         if (orchestration) {
@@ -12985,10 +12918,7 @@ function drainQueuedChannelSends() {
             store.appendMessage(threadId, {
                 role: "bot",
                 kind: "activity",
-                tool: {
-                    name: `error: queued channel message could not start — ${(error instanceof Error ? error.message : String(error)).slice(0, 120)}`,
-                    ok: false,
-                },
+                tool: failedTurnTool(`queued channel message could not start — ${error instanceof Error ? error.message : String(error)}`),
             });
         }
         // A message with no eligible responder creates no operation. Continue
@@ -13195,9 +13125,9 @@ function proposalPersistence(botId, threadId) {
         return { ok: true };
     // Only cards on the visible branch can be acted on from the composer.
     // Abandoned branches must not permanently consume the proposal quota.
-    // Routine, profile, default-model, tightening and team-setup proposals
+    // Routine, profile, default-model and team-setup proposals
     // share one budget per bot per thread, so one thread cannot pile up 8 of each.
-    const openRequests = store.activePath(threadId).filter((message) => (message.card?.routineRequest?.botId === botId || message.card?.profileRequest?.botId === botId || message.card?.modelRequest?.botId === botId || message.card?.tighteningRequest?.botId === botId || message.card?.teamSetupRequest?.botId === botId) &&
+    const openRequests = store.activePath(threadId).filter((message) => (message.card?.routineRequest?.botId === botId || message.card?.profileRequest?.botId === botId || message.card?.modelRequest?.botId === botId || message.card?.teamSetupRequest?.botId === botId) &&
         !message.card.answered &&
         !message.card.dismissed && !message.card.expired).length;
     return openRequests >= 8
@@ -14059,7 +13989,8 @@ function configStatus() {
         // not a saved key
         box: boat.describeBoatAccount(cfg),
         vps: { configured: Boolean(vpsSshAlias(cfg)), sshAlias: vpsSshAlias(cfg) ?? "" },
-        opencodeGo: { configured: Boolean(cfg.opencodeGo?.apiKey) },
+        // names only: every provider key stays write-only
+        opencodeGo: { configured: Boolean(cfg.opencodeGo?.apiKey), providerKeys: Object.keys(openCodeProviderKeys(cfg)) },
         // the chosen voice is a setting, not a secret; the key is reported the
         // same configured-or-not way as every other credential
         tts: tts.describeVoice(cfg),
@@ -14141,6 +14072,7 @@ function configForAccess(status, admin) {
         edition: { edition: status.edition.edition, features: status.edition.features },
         signIn: { admins: [], members: [] },
         vps: { configured: status.vps.configured, sshAlias: "" },
+        opencodeGo: { configured: status.opencodeGo.configured, providerKeys: [] },
         profile: { name: status.profile.name, email: "" },
         browserProfiles: status.browserProfiles.map((profile) => Object.fromEntries(Object.entries(profile).filter(([key]) => key !== "partitionId"))),
     };
@@ -14368,7 +14300,7 @@ async function reloadProviders() {
             if (store.taskByThread(botId, threadId)) {
                 store.appendMessage(threadId, {
                     role: "bot", kind: "activity",
-                    tool: { name: "error: turn interrupted — provider settings changed", ok: false },
+                    tool: failedTurnTool("turn interrupted — provider settings changed"),
                 });
                 store.setTaskActivity(botId, threadId, "idle");
             }
@@ -14471,7 +14403,7 @@ const workspaceBackupAccess = {
             !routines?.isTicking && !calendarCalls?.isTicking &&
             !localVmImageBusy && !localVmProvisionBusy && !localVmModeChangeBusy &&
             !localVmLifecycleBusy.size && !boatLifecycleBusyBots.size && !vpsPreviewRequests.size && !orphanBoatLifecycleBusyIds.size &&
-            !computerProviderConfigTransitions.size && !checkpointRestoreLeases.size &&
+            !computerProviderConfigTransitions.size &&
             teamComputers.list().every(computer => !teamComputerInUse(computer)) &&
             store.bots.every((bot) => !botHasActiveTurn(bot.id) && !routines?.activeRunForBot(bot.id) && !botComputerControlSnapshot(bot.id).held) &&
             store.groups.every((group) => !groupIsWorking(group)),
@@ -14494,18 +14426,24 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
     restored: workspaceRestore,
     ...workspaceBackupAccess,
 });
-// Move to Cloud (server/cloud-move-http.ts): every server sizes its own
-// workspace for the desktop; only a Cloud home receives one. After its
-// restore commits, the Cloud home restarts so startup installs it.
-let cloudHomeRestartRequested = false;
+// Copy this computer here (server/cloud-move-http.ts, docs/copy-workspace.md):
+// every server sizes its own workspace for its desktop, and every server the
+// person owns receives one, a Cloud home included. A workspace shared with
+// other people never does (workspaceShared): a hosted organisation
+// workspace, or a server whose email sign-in lets someone besides its owner
+// in. After the restore commits, the server
+// exits with RESTART_EXIT_CODE and its launcher starts it again, so startup
+// installs it (server/restart.ts).
+let restartRequested = false;
 const cloudMoveRoutes = createCloudMoveRoutes({
     dataDir: DATA_DIR,
     appVersion: serverVersion(),
-    cloudHome: Boolean(CLOUD_HOME),
+    environmentId: ENVIRONMENT_ID,
+    sharedWorkspace: () => workspaceShared({ hosted: HOSTED_WORKSPACE, cloudHome: Boolean(CLOUD_HOME), signIn: signInAllowList() }),
     readBody,
     restored: workspaceRestore,
     ...workspaceBackupAccess,
-    restart: () => { cloudHomeRestartRequested = true; gracefulShutdown(); },
+    restart: () => { restartRequested = true; gracefulShutdown(); },
 });
 // Route modules (server/routes/README.md). `workspaceAccess` is assigned at
 // boot, after this line, so the dependency reads it per request.
@@ -14995,9 +14933,7 @@ const handleRequest = async (req, res) => {
             // scheme the native companion scanners accept; it carries the
             // credential encoding because those scanners cannot take a typed code.
             const serverName = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED }).label;
-            const invite = base
-                ? `openmausbot://pair?address=${encodeURIComponent(base)}&token=${encodeURIComponent(opened.credential)}&name=${encodeURIComponent(serverName)}`
-                : null;
+            const invite = base ? phonePairingLink({ address: base, token: opened.credential, name: serverName }) : null;
             return json(res, 200, {
                 id: opened.id,
                 code,
@@ -15212,7 +15148,7 @@ const handleRequest = async (req, res) => {
                         ? "phone"
                         : path.startsWith("/api/internal/connectors/")
                             ? "connectors"
-                            : path === "/api/internal/computer-control"
+                            : path === "/api/internal/computer-control" || path === "/api/internal/computer/mcp"
                                 ? "computer"
                                 : "agents";
             if (internalCapability.kind !== requiredCapabilityKind) {
@@ -15261,6 +15197,9 @@ const handleRequest = async (req, res) => {
                     throw Object.assign(new Error("the internal turn capability has expired"), { status: 401 });
                 }
             };
+            const delegatedThisTurn = (taskId) => {
+                (internalCapability.delegatedThisTurn ??= new Set()).add(taskId);
+            };
             // Where an entry came from, as the person will read it in MEMORY.md:
             // the room or the thread title, never a bare id unless nothing else
             // names the conversation.
@@ -15369,7 +15308,7 @@ const handleRequest = async (req, res) => {
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
                 const result = ownersWrite(() => updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText, ...(body.until !== undefined ? { until: body.until } : {}) }, { source: memorySource() }));
-                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : result.code === "over-budget" ? 413 : 400, result);
+                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : 400, result);
             }
             if (method === "POST" && path === "/api/internal/memory/log") {
                 const body = await readInternalBody();
@@ -15403,6 +15342,22 @@ const handleRequest = async (req, res) => {
                 requireActiveInternalCapability();
                 return json(res, 200, { result });
             }
+            // The cloud computer's tools (harness-mcp-proxy computer): the turn's
+            // capability names its Boat, and the Boat credential stays here.
+            if (method === "POST" && path === "/api/internal/computer/mcp") {
+                const body = await readInternalBody();
+                const boxId = internalCapability.boxId;
+                if (!boxId)
+                    return json(res, 403, { error: "this turn has no cloud computer" });
+                const abort = new AbortController();
+                res.once("close", () => { if (!res.writableEnded)
+                    abort.abort(); });
+                return json(res, 200, { result: await cloudComputerRpc(body, {
+                        cfg, boxId, signal: abort.signal,
+                        gate: () => computerCallGate(internalCapability),
+                        assertActive: requireActiveInternalCapability,
+                    }) });
+            }
             if (method === "POST" && path === "/api/internal/phone/claim") {
                 // Lazy phone exclusivity (issue #1663): the turn holds computer:phone
                 // from its first real tool call until it settles. The proxy answers a
@@ -15784,6 +15739,58 @@ const handleRequest = async (req, res) => {
                 });
                 return json(res, 201, proposed);
             }
+            if (method === "POST" && path === "/api/internal/team-memory") {
+                const parsed = z.object({
+                    fromBotId: z.string().min(1).max(128),
+                    fromThreadId: z.string().min(1).max(128),
+                    kind: z.string(),
+                    name: z.string(),
+                    detail: z.string(),
+                    aliases: z.array(z.string()).optional(),
+                }).strict().safeParse(await readInternalBody());
+                if (!parsed.success)
+                    return json(res, 400, { error: "invalid team memory proposal" });
+                const body = parsed.data;
+                const from = store.bot(body.fromBotId);
+                if (!from)
+                    return json(res, 403, { error: "unknown sender" });
+                const owner = connectorThread(from.id, body.fromThreadId);
+                if (!owner)
+                    return json(res, 403, { error: "source conversation does not belong to sender" });
+                if (!sameAudience(from.visibility, undefined) || (owner.group && !roomFeedsBot(owner.group, from))) {
+                    return json(res, 403, { error: "restricted conversations cannot publish section-wide memory; ask an admin to add it" });
+                }
+                if (!TEAM_MEMORY_KINDS.includes(body.kind)) {
+                    return json(res, 400, { error: `kind must be one of ${TEAM_MEMORY_KINDS.join(", ")}` });
+                }
+                let proposed;
+                try {
+                    proposed = teamMemory.propose(from.section, { kind: body.kind, name: body.name, detail: body.detail, aliases: body.aliases }, { botId: from.id, botName: from.name, threadId: body.fromThreadId, at: Date.now() });
+                }
+                catch (error) {
+                    return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+                }
+                const summary = `${proposed.entry.kind[0].toUpperCase()}${proposed.entry.kind.slice(1)}: ${proposed.entry.name}${proposed.entry.aliases.length ? ` (also ${proposed.entry.aliases.join(", ")})` : ""} — ${proposed.entry.detail}`;
+                const section = sectionContextKey(from.section);
+                const card = store.appendMessage(body.fromThreadId, {
+                    role: "bot",
+                    kind: "options",
+                    ...(owner.group ? { from: { botId: from.id, name: from.name, color: from.color } } : {}),
+                    card: {
+                        title: "Remember this for the team?",
+                        subtitle: summary,
+                        options: ["Remember", "Skip"],
+                        requestId: proposed.entry.id,
+                        tool: "propose_team_memory",
+                        teamMemoryRequest: { section, entryId: proposed.entry.id, kind: proposed.entry.kind },
+                    },
+                });
+                appendDecision(DATA_DIR, {
+                    threadId: body.fromThreadId, requestId: proposed.entry.id, botId: from.id, botName: from.name,
+                    tool: "propose_team_memory", summary, decision: "card-shown", source: "team-memory",
+                });
+                return json(res, 201, { status: "proposed", requestId: proposed.entry.id, messageId: card.id, summary });
+            }
             if (method === "POST" && path === "/api/internal/profile-requests") {
                 const parsed = z.object({
                     fromBotId: z.string().min(1).max(128),
@@ -15849,39 +15856,6 @@ const handleRequest = async (req, res) => {
                 });
                 return json(res, 201, proposed);
             }
-            if (method === "POST" && path === "/api/internal/tightening-requests") {
-                const parsed = z.object({
-                    fromBotId: z.string().min(1).max(128),
-                    fromThreadId: z.string().min(1).max(128),
-                    forBotId: z.string().max(128).optional(),
-                    intents: z.unknown(),
-                    reason: z.unknown(),
-                }).strict().safeParse(await readInternalBody());
-                if (!parsed.success)
-                    return json(res, 400, { error: "invalid tightening proposal" });
-                const body = parsed.data;
-                const from = store.bot(body.fromBotId);
-                if (!from)
-                    return json(res, 403, { error: "unknown sender" });
-                const owner = connectorThread(from.id, body.fromThreadId);
-                if (!owner)
-                    return json(res, 403, { error: "source conversation does not belong to sender" });
-                const targetBotId = body.forBotId?.trim() || from.id;
-                const proposed = tighteningRequests.submit({
-                    botId: from.id,
-                    threadId: body.fromThreadId,
-                    targetBotId,
-                    intents: body.intents,
-                    reason: body.reason,
-                    from: owner.group ? { botId: from.id, name: from.name, color: from.color } : undefined,
-                });
-                appendDecision(DATA_DIR, {
-                    threadId: body.fromThreadId, requestId: proposed.requestId, botId: from.id, botName: from.name,
-                    tool: "tighten_permissions", summary: proposed.detail, decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "tightening",
-                });
-                return json(res, 201, proposed);
-            }
             if (method === "GET" && path === "/api/internal/team-setup-catalog") {
                 let chief = store.bot(internalCapability.botId);
                 if (!chief.chiefOfStaff || chief.hidden)
@@ -16234,6 +16208,7 @@ const handleRequest = async (req, res) => {
                     if (internalCapability.generation === EXTERNAL_RUNTIME_GENERATION && !threadBusy(from.id, fromThreadId)) {
                         drainThreadDelegations(fromThreadId);
                     }
+                    delegatedThisTurn(queued.id);
                     return json(res, 200, { busy: true, taskId: queued.id, toBotName: target.name, receipt: peerDeliveryReceipt({
                             botId: toBotId, botName: target.name, outcome: "queued", taskId: queued.id,
                             detail: "the teammate was busy; the ask was queued as a delegation instead",
@@ -16393,6 +16368,7 @@ const handleRequest = async (req, res) => {
                         kind: "activity",
                         tool: { name: `@${currentTarget.name} is still working — ask converted to a delegation` },
                     });
+                    delegatedThisTurn(taskId);
                     return json(res, 200, { timeout: true, taskId, toBotName: currentTarget.name, waitedMs: ASK_BOT_TIMEOUT_MS,
                         receipt: peerDeliveryReceipt({ botId: toBotId, botName: currentTarget.name, outcome: "injected", taskId,
                             detail: "the teammate's turn started and is still running; only the synchronous wait ended" }) });
@@ -16431,6 +16407,9 @@ const handleRequest = async (req, res) => {
             const delegationMatch = method === "GET" ? path.match(/^\/api\/internal\/delegations\/([\w-]{4,64})$/) : null;
             if (delegationMatch) {
                 const taskId = delegationMatch[1];
+                if (internalCapability.delegatedThisTurn?.has(taskId)) {
+                    return json(res, 409, { error: `Task ${taskId} was delegated during this turn. Finish your response now so the other bot can work; its result will be delivered to this conversation automatically. Do not check or wait for a newly delegated task until a later turn.` });
+                }
                 const fromThreadId = internalCapability.threadId;
                 const from = internalSender;
                 if (!connectorThread(from.id, fromThreadId))
@@ -16472,7 +16451,10 @@ const handleRequest = async (req, res) => {
                     if (!sender || (target && !canReachPeer(sender, target))) {
                         return json(res, 403, { error: "Result withheld: team access changed while the teammate was working" });
                     }
-                    if (Date.now() >= deadline) {
+                    // Nothing moves while the teammate's card waits on the person, so
+                    // say so now rather than holding the long-poll to its deadline.
+                    const awaitingPerson = running && runningEntry ? openPersonCard(runningEntry[0]) : undefined;
+                    if (Date.now() >= deadline || awaitingPerson) {
                         if (running && runningEntry) {
                             const recent = summarizeDelegatedActivity(store.messagesFor(runningEntry[0]), running.startedAtMs ?? Date.now());
                             return json(res, 200, {
@@ -16480,6 +16462,12 @@ const handleRequest = async (req, res) => {
                                 toBotName: store.bot(toBotId)?.name ?? toBotId,
                                 elapsedMs: Math.max(0, Date.now() - (running.startedAtMs ?? Date.now())),
                                 recentActivity: recent,
+                                ...(awaitingPerson ? {
+                                    awaitingPerson: {
+                                        ...awaitingPerson,
+                                        threadTitle: store.taskByThread(toBotId, runningEntry[0])?.title,
+                                    },
+                                } : {}),
                             });
                         }
                         const queuedTarget = store.bot(toBotId);
@@ -16596,6 +16584,7 @@ const handleRequest = async (req, res) => {
                             detail: `${refusal} — nothing was queued`,
                         }) });
                 }
+                delegatedThisTurn(queued.id);
                 const targetName = store.bot(toBotId)?.name ?? toBotId;
                 // The queue normally drains when the source thread's turn completes. A
                 // caller this server did not spawn (an external runtime) has no live
@@ -16648,20 +16637,17 @@ const handleRequest = async (req, res) => {
                     })).filter(g => g.members.length);
                     return json(res, 200, { currentRoom: source ? { id: source.id, name: source.name, workingFolder: source.cwd || null } : null,
                         bots: reachablePeers(store.bots, internalSender).map(bot => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section, busy: bot.busy })),
-                        rooms, note: "Without group_id: use this room when in a room, otherwise each distinct assignment starts a fresh thread for that teammate. Give a self-contained brief. Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
+                        rooms, note: "Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
                 }
                 if (method === "POST" && path === "/api/internal/coordinate-bots") {
                     const parsed = z.object({
                         groupId: z.string().min(1).max(128).optional(),
                         botIds: z.array(z.string().min(1).max(128)).min(1).max(4).refine(ids => new Set(ids).size === ids.length),
-                        message: z.string().trim().min(1).max(4000), requestKey: z.string().regex(/^[\w-]{1,100}$/),
+                        message: z.string().trim().min(1).max(4000),
                         rework: z.boolean().default(false),
-                        // Only ever a name for a thread, so it travels under the same
-                        // one-line rule as a peer thread title.
-                        label: z.string().trim().min(1).max(60).refine(fitsOnOneLine).optional(),
                     }).safeParse(await readInternalBody());
                     if (!parsed.success)
-                        return json(res, 400, { error: "Provide 1-4 distinct botIds, message (1-4000 characters), a short requestKey (letters, digits, underscores or hyphens) and an optional one-line label of at most 60 characters." });
+                        return json(res, 400, { error: "Provide 1-4 distinct botIds and a message of 1-4000 characters." });
                     const groupId = parsed.data.groupId ?? source?.id;
                     const destination = groupId ? store.group(groupId) : undefined;
                     if (groupId && !destination)
@@ -16713,58 +16699,63 @@ const handleRequest = async (req, res) => {
                             });
                         approvalGranted = true;
                     }
-                    const accepted = [];
-                    const errors = [];
+                    // A room shows one brief per call, addressed to the call's recipients.
+                    const requestBatchKey = destination ? randomUUID() : undefined;
                     // One receipt per recipient, in the order the caller addressed
                     // them. Dispatch is asynchronous (RoomHandoffs.tick), so a fresh
-                    // enqueue is honestly "queued"; a duplicate inherits the state of
-                    // the node that already carries this request_key.
+                    // enqueue is honestly "queued"; a repeat reports the request it
+                    // repeats.
                     const receipts = [];
+                    // Why nothing was sent, in full: a receipt's detail is clipped.
+                    const refused = [];
                     for (const target of targets) {
                         let createdThread;
                         try {
                             requireActiveInternalCapability();
+                            // Outside a room this conversation has one thread with each
+                            // teammate: the first request opens it, everything after
+                            // continues it and runs once the work already there is done.
+                            const continued = destination ? undefined : store.workThread(target.botId, internalSender.id, address.threadId);
                             if (!destination) {
-                                const task = store.createTask(target.botId, `@${internalSender.name}${parsed.data.label ? ` · ${parsed.data.label}` : " · work"}`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", at: Date.now() });
+                                const task = continued ?? store.createTask(target.botId, `@${internalSender.name} · work`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", threadId: address.threadId, at: Date.now() });
                                 if (!task)
                                     throw new Error("The recipient no longer exists");
-                                target.threadId = createdThread = task.threadId;
+                                target.threadId = task.threadId;
+                                if (!continued)
+                                    createdThread = task.threadId;
                                 applyDelegatedLevel(internalSender, internalCapability.threadId, store.bot(target.botId), target.threadId);
                             }
-                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", destination ? parsed.data.requestKey : undefined);
-                            // A retry keeps its original task; discard the speculative row.
-                            if (duplicate && createdThread && createdThread !== node.threadId) {
+                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", requestBatchKey);
+                            // A repeat lands on the request already made, possibly in a
+                            // thread the person archived meanwhile; a thread opened for it
+                            // is never used.
+                            if (duplicate && createdThread)
                                 store.deleteTask(target.botId, createdThread);
-                            }
-                            if (!duplicate && createdThread)
+                            else if (createdThread)
                                 threadStarters.set(createdThread, openerFrom(address.threadId));
                             createdThread = undefined; // The durable coordinator now owns this task.
-                            accepted.push({ requestId: node.id, botId: node.botId, duplicate, status: node.status });
-                            // A duplicate request_key lands on the node enqueue already
-                            // made. Only a live node can still report: a failed or
-                            // cancelled one already fired its report and tick() skips it,
-                            // so promising "its result will resume you" would be the one
-                            // lie a receipt must never tell.
+                            // Only a live request can still report: a finished one already
+                            // fired its report and tick() skips it, so a repeat of it sends
+                            // nothing and says how to run it again.
+                            const title = destination ? undefined : store.taskByThread(node.botId, node.threadId)?.title;
+                            const finished = {
+                                completed: "it already finished and its result stands; send it with rework=true to run it again",
+                                failed: "it failed; send it with rework=true to retry", cancelled: "it was cancelled; send it with rework=true to retry",
+                            };
+                            const notSent = duplicate && finished[node.status] ? `not sent again: ${finished[node.status]}` : undefined;
+                            if (notSent)
+                                refused.push(notSent);
                             receipts.push(peerDeliveryReceipt({
                                 botId: node.botId,
                                 botName: store.bot(node.botId)?.name,
-                                outcome: duplicate
-                                    ? node.status === "running" || node.status === "completed"
-                                        ? "injected"
-                                        : node.status === "failed" || node.status === "cancelled"
-                                            ? "failed"
-                                            : "queued"
-                                    : "queued",
-                                detail: duplicate
-                                    ? node.status === "running"
-                                        ? "duplicate request_key — this teammate is already running that exact assignment"
-                                        : node.status === "completed"
-                                            ? "duplicate request_key — this teammate already completed that assignment; the earlier result stands"
-                                            : node.status === "failed" || node.status === "cancelled"
-                                                ? `duplicate request_key — the earlier assignment ${node.status === "cancelled" ? "was cancelled" : "failed"} and will not rerun or resume you; resend with a new request_key to retry`
-                                                : "duplicate request_key — already in flight; its result will resume you automatically"
-                                    : "handed to the coordinator; the teammate's turn has not started yet",
+                                outcome: notSent ? "failed" : !duplicate || node.status === "queued" ? "queued" : "injected",
+                                detail: notSent ?? (duplicate
+                                    ? `already sent: it is ${node.status === "queued" ? "queued" : "under way"} and its result will resume you`
+                                    : title
+                                        ? `sent to "${title}"; it runs after anything still running there`
+                                        : "handed to the coordinator; the teammate's turn has not started yet"),
                                 requestId: node.id,
+                                ...(destination ? {} : { threadId: node.threadId }),
                             }));
                             if (!duplicate) {
                                 const recipient = store.bot(target.botId);
@@ -16781,14 +16772,13 @@ const handleRequest = async (req, res) => {
                                 store.deleteTask(target.botId, createdThread);
                             }
                             const said = error instanceof Error ? error.message : String(error);
-                            errors.push({ botId: target.botId, error: said });
-                            receipts.push(peerDeliveryReceipt({
-                                botId: target.botId, botName: store.bot(target.botId)?.name, outcome: "failed", detail: said,
-                            }));
+                            refused.push(said);
+                            receipts.push(peerDeliveryReceipt({ botId: target.botId, botName: store.bot(target.botId)?.name, outcome: "failed", detail: said }));
                         }
                     }
-                    return json(res, accepted.length ? 200 : 409, { accepted, errors, receipts,
-                        ...(accepted.length ? { message: "End your turn after sending all work. These actual teammates will reply and resume you automatically. Do not poll or wait." } : { error: errors.map(e => e.error).join("; ") }),
+                    const sent = refused.length < receipts.length;
+                    return json(res, sent ? 200 : 409, { receipts,
+                        ...(sent ? { message: "End your turn after sending all work. These actual teammates will reply and resume you automatically. Do not poll or wait." } : { error: refused.join("; ") }),
                     });
                 }
             }
@@ -16823,6 +16813,12 @@ const handleRequest = async (req, res) => {
                 if (!groupId || !message) {
                     return json(res, 400, { error: "post_to_room needs group_id (from list_rooms) and message" });
                 }
+                // One turn's worth of posts is a handful; past it the turn has
+                // stopped reporting and started broadcasting. Counted per turn, on
+                // top of the room's own budget below.
+                if ((internalCapability.roomPosts ?? 0) >= MAX_ROOM_POSTS_PER_TURN) {
+                    return json(res, 429, { error: `You have already posted ${MAX_ROOM_POSTS_PER_TURN} times this turn, which is the limit. Do not retry — finish your turn and say anything further to the user directly.` });
+                }
                 if (message.length > ROOM_POST_MAX_CHARS) {
                     return json(res, 400, {
                         error: `a room post is at most ${ROOM_POST_MAX_CHARS} characters — post the short version and keep the detail in your own reply`,
@@ -16951,6 +16947,7 @@ const handleRequest = async (req, res) => {
                     peerPost: unattended ? { unattended: true } : {},
                     ...(attachedVoiceNote ? { attachments: stagedAttachments } : {}),
                 });
+                internalCapability.roomPosts = (internalCapability.roomPosts ?? 0) + 1;
                 detachParkedAudio?.();
                 store.patchGroup(room.id, { unread: true });
                 // The same visibility contract the peer tools keep: whatever a bot
@@ -16994,7 +16991,7 @@ const handleRequest = async (req, res) => {
                 if (!fitsOnOneLine(title))
                     return json(res, 400, { error: "title must fit on one line" });
                 if (internalCapability.openedThreads >= MAX_THREADS_OPENED_PER_TURN) {
-                    return json(res, 429, { error: `you can open at most ${MAX_THREADS_OPENED_PER_TURN} threads in one turn` });
+                    return json(res, 429, { error: `You have already opened ${MAX_THREADS_OPENED_PER_TURN} threads this turn, which is the limit. Do not retry — finish your turn and tell the person which threads you still wanted to open, so they can open them or ask you again.` });
                 }
                 const toBotId = typeof body.toBotId === "string" && body.toBotId.trim() ? body.toBotId.trim() : from.id;
                 const target = store.bot(toBotId);
@@ -17093,6 +17090,7 @@ const handleRequest = async (req, res) => {
                 }
                 store.setTaskOpenedBy(target.id, task.threadId, { botId: from.id, name: from.name, delegationId: queued.id, at: task.openedBy?.at ?? Date.now() });
                 internalCapability.openedThreads += 1;
+                delegatedThisTurn(queued.id);
                 // An honest forecast, not a promise: the handoff starts when this
                 // turn ends, and by then the target's slots are taken by whatever is
                 // running there plus the threads this turn already opened ahead.
@@ -17122,8 +17120,8 @@ const handleRequest = async (req, res) => {
                 if (!chief.chiefOfStaff) {
                     return json(res, 403, { error: "only a section's Chief of Staff can create operator bots" });
                 }
-                if (internalCapability.createdBots >= 4) {
-                    return json(res, 429, { error: "you can create at most 4 bots in one turn" });
+                if (internalCapability.createdBots >= MAX_CREATED_BOTS_PER_TURN) {
+                    return json(res, 429, { error: `You can create at most ${MAX_CREATED_BOTS_PER_TURN} bots in one turn. Use the team you have before adding more.` });
                 }
                 if (store.bots.length >= MAX_WORKSPACE_BOTS) {
                     return json(res, 409, { error: `this workspace is limited to ${MAX_WORKSPACE_BOTS} bots` });
@@ -17172,8 +17170,9 @@ const handleRequest = async (req, res) => {
                 if (store.bot(chief.id) !== chief || chief.hidden || !chief.chiefOfStaff || !connectorThread(chief.id, fromThreadId)) {
                     return json(res, 403, { error: "only an active Chief of Staff can create operator bots" });
                 }
-                if (internalCapability.createdBots >= 4)
-                    return json(res, 429, { error: "you can create at most 4 bots in one turn" });
+                if (internalCapability.createdBots >= MAX_CREATED_BOTS_PER_TURN) {
+                    return json(res, 429, { error: `You can create at most ${MAX_CREATED_BOTS_PER_TURN} bots in one turn. Use the team you have before adding more.` });
+                }
                 if (store.bots.length >= MAX_WORKSPACE_BOTS)
                     return json(res, 409, { error: `this workspace is limited to ${MAX_WORKSPACE_BOTS} bots` });
                 const duplicate = store.bots.find((candidate) => !candidate.hidden &&
@@ -17292,6 +17291,36 @@ const handleRequest = async (req, res) => {
                 const updated = updateChannel(room.id, patch);
                 return json(res, 200, { ok: true, memberIds: updated.memberIds, memberCount: updated.memberIds.length, message: `Updated room “${updated.name}”.` });
             }
+            if (method === "POST" && path === "/api/internal/mcp-servers") {
+                // Same single-flight lock as POST /api/mcp/servers: two writers must
+                // not interleave a read of cfg.mcpServers with a save.
+                if (mcpConfigBusy)
+                    return json(res, 409, { error: "MCP servers are already being updated." });
+                mcpConfigBusy = true;
+                try {
+                    const body = await readInternalBody();
+                    const added = addDisabledMcpServer(cfg.mcpServers ?? {}, body);
+                    if (!added.ok)
+                        return json(res, added.status, { error: added.error });
+                    const refusal = mcpPolicyRefusal(added.name, added.server);
+                    if (refusal)
+                        return json(res, 403, { error: refusal, code: "managed_policy" });
+                    persistMcpServers(added.next);
+                    const server = added.server;
+                    const remote = isRemoteMcpServer(server);
+                    return json(res, 201, {
+                        name: added.name,
+                        enabled: false,
+                        transport: remote ? server.type : "command",
+                        target: remote ? server.url : server.command,
+                        envKeys: remote ? [] : Object.keys(server.env).sort(),
+                        headerKeys: remote ? Object.keys(server.headers).sort() : [],
+                    });
+                }
+                finally {
+                    mcpConfigBusy = false;
+                }
+            }
             if (method === "POST" && path === "/api/internal/request-credential") {
                 const body = await readInternalBody();
                 const from = internalSender;
@@ -17386,7 +17415,7 @@ const handleRequest = async (req, res) => {
                 // Reading a streamed MCP body yields to ordinary settings requests.
                 // Re-read the live bot immediately before relay so turning Connected
                 // Apps off wins over a request that authenticated under the old value.
-                const currentSender = store.bot(internalCapability.botId);
+                let currentSender = store.bot(internalCapability.botId);
                 if (!currentSender || currentSender.composio === false || !composio.configured(cfg)) {
                     return json(res, 403, { error: "connected apps are not enabled for this bot" });
                 }
@@ -17397,6 +17426,7 @@ const handleRequest = async (req, res) => {
                 // Rows are fire-and-forget: a log failure must never take the call
                 // (or its refusal) down with it.
                 const call = connectorCallFromFrame(body);
+                let serviceSlugs = [];
                 // A bot with no grants record keeps the pre-grants relay: even an
                 // unreadable frame passes through exactly as it always did.
                 if (call.kind === "unrecognized" && currentSender.connectorTools !== undefined) {
@@ -17423,7 +17453,11 @@ const handleRequest = async (req, res) => {
                     // underscored service (bland_ai) keeps its own tools instead of
                     // a plain-prefix grant (bland) capturing them; an unreachable
                     // catalog reads as empty and the plain split stands.
-                    const serviceSlugs = await composio.connectedServiceSlugs(cfg);
+                    serviceSlugs = await composio.connectedServiceSlugs(cfg);
+                    requireActiveInternalCapability();
+                    currentSender = store.bot(internalCapability.botId);
+                    if (!currentSender || currentSender.composio === false || !composio.configured(cfg))
+                        return json(res, 403, { error: "connected apps are no longer enabled for this bot" });
                     const verdict = evaluateConnectorTools(call.names, currentSender.connectorTools, serviceSlugs);
                     if (!verdict.allowed) {
                         for (const denial of verdict.denials) {
@@ -17463,9 +17497,174 @@ const handleRequest = async (req, res) => {
                         rule: verdict.rule,
                     });
                 }
-                const upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
-                    ? req.headers["mcp-session-id"][0]
-                    : req.headers["mcp-session-id"]);
+                // ── the outbound gate ──
+                // A tools/call that sends something (shared/outbound.ts) is its own
+                // confirmation in every approval mode, Full included: it waits on a
+                // card, or spends the bot's daily allowance. Everything else relays
+                // untouched. A refusal is an ordinary tool error so the bot reads
+                // it and carries on, rather than a transport failure it retries.
+                const rpc = body && typeof body === "object" && !Array.isArray(body)
+                    ? body
+                    : null;
+                const rpcParams = rpc?.params && typeof rpc.params === "object" && !Array.isArray(rpc.params)
+                    ? rpc.params
+                    : null;
+                // The app tools this call would actually run, seen through Composio's
+                // meta tools (a multi-execute list, workbench code), and the ones
+                // among them that send.
+                const outboundCalls = rpc?.method === "tools/call" && typeof rpcParams?.name === "string"
+                    ? outboundCallsIn(rpcParams.name, rpcParams.arguments)
+                    : [];
+                const outboundTool = outboundCalls.length ? outboundCalls[0].slug : null;
+                const refuseOutbound = (text) => {
+                    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+                    return res.end(JSON.stringify({ jsonrpc: "2.0", id: rpc?.id ?? null, result: { content: [{ type: "text", text }], isError: true } }));
+                };
+                // ── connection scopes ──
+                // Checked first: an app this bot may not touch is refused outright,
+                // never turned into a question for the person.
+                const connectorCalls = rpc?.method === "tools/call" && typeof rpcParams?.name === "string"
+                    ? connectorCallsIn(rpcParams.name, rpcParams.arguments)
+                    : [];
+                const access = connectorAccessDecision(currentSender.connectorScopes, connectorCalls, serviceSlugs);
+                if (!access.ok) {
+                    const described = describeTool(access.slug);
+                    const appName = described.app ?? access.toolkit;
+                    appendDecision(DATA_DIR, {
+                        threadId: internalCapability.threadId, botId: currentSender.id, botName: currentSender.name,
+                        tool: access.slug, decision: "auto-denied", source: "connector-scope", rule: `scope:${access.toolkit}:${access.reason}`,
+                    });
+                    return refuseOutbound(access.reason === "app"
+                        ? `OpenMausBot did not run this: ${currentSender.name} has not been given access to ${appName}. Ask the user to allow it under the bot's Access settings, and do not retry.`
+                        : `OpenMausBot did not run this: ${appName} is read-only for ${currentSender.name}, and ${described.label} would write to it. Ask the user before trying again.`);
+                }
+                const opaque = connectorCalls.some(call => call.slug === "COMPOSIO_PROXY_EXECUTE");
+                if (opaque && currentSender.connectorTools !== undefined)
+                    return refuseOutbound("OpenMausBot cannot verify this code against this bot's tool grants. Use a direct app tool.");
+                let outboundApproved = false;
+                if (outboundTool) {
+                    const policy = currentSender.outbound ?? DEFAULT_OUTBOUND_POLICY;
+                    const threadId = internalCapability.threadId;
+                    const { app } = describeTool(outboundTool);
+                    const summary = outboundCalls.map((call) => {
+                        const described = describeTool(call.slug);
+                        const argsText = call.arguments === undefined ? "" : JSON.stringify(call.arguments);
+                        return `${described.app ? `${described.app} · ` : ""}${described.label}${argsText ? `\n${argsText.slice(0, 400)}${argsText.length > 400 ? "… [arguments truncated]" : ""}` : ""}`;
+                    }).join("\n\n");
+                    const capNote = (count) => `OpenMausBot did not send this. ${currentSender.name} has reached its daily limit of ${count} outbound action${count === 1 ? "" : "s"}. Ask the user to raise the limit under the bot's Permissions before trying again.`;
+                    if (policy.policy === "allow" && !opaque) {
+                        const today = outboundCounts.today(currentSender.id);
+                        if (today + outboundCalls.length > policy.dailyCap) {
+                            appendDecision(DATA_DIR, {
+                                threadId, botId: currentSender.id, botName: currentSender.name,
+                                tool: outboundTool, summary, decision: "auto-denied", source: "outbound", rule: `daily-cap:${policy.dailyCap}`,
+                            });
+                            return refuseOutbound(capNote(policy.dailyCap));
+                        }
+                    }
+                    else {
+                        const owner = connectorThread(currentSender.id, threadId);
+                        const held = outboundRequests.open({ botId: currentSender.id, threadId, tool: outboundTool, timeoutMs: OUTBOUND_HOLD_MS });
+                        const card = store.appendMessage(threadId, {
+                            role: "bot",
+                            kind: "options",
+                            ...(owner?.group ? { from: { botId: currentSender.id, name: currentSender.name, color: currentSender.color } } : {}),
+                            card: {
+                                title: "Send on your behalf?",
+                                subtitle: summary,
+                                options: ["Allow", "Deny"],
+                                requestId: held.requestId,
+                                tool: outboundTool,
+                                held: HELD_NOTE["approval.held.outbound"],
+                                heldCode: "approval.held.outbound",
+                                outboundRequest: { tool: outboundTool, app },
+                            },
+                        });
+                        appendDecision(DATA_DIR, {
+                            threadId, requestId: held.requestId, botId: currentSender.id, botName: currentSender.name,
+                            tool: outboundTool, summary, decision: "card-shown", source: "outbound",
+                        });
+                        if (owner?.group) {
+                            if (activeGroupTurnForBot(currentSender.id)?.threadId === threadId)
+                                store.setActivity(currentSender.id, "waiting-on-you");
+                        }
+                        else if (store.taskByThread(currentSender.id, threadId)?.busy) {
+                            store.setTaskActivity(currentSender.id, threadId, "waiting-on-you");
+                        }
+                        notify(buildNotification("approval", currentSender, threadId, summary, { avatarUrl: currentSender.avatarUrl }));
+                        const answer = await held.answer;
+                        outboundRequests.forget(held.requestId);
+                        if (internalCapabilityIsActive(internalCapability)) {
+                            const waiting = store.bot(currentSender.id);
+                            if (owner?.group) {
+                                if (activeGroupTurnForBot(currentSender.id)?.threadId === threadId && waiting?.activity === "waiting-on-you")
+                                    store.setActivity(waiting.id, "working");
+                            }
+                            else if (store.taskByThread(currentSender.id, threadId)?.activity === "waiting-on-you") {
+                                store.setTaskActivity(currentSender.id, threadId, "working");
+                            }
+                        }
+                        if (answer !== "allow") {
+                            if (answer === "timeout") {
+                                const stale = store.messagesFor(threadId).find((message) => message.id === card.id);
+                                if (stale?.card && !stale.card.answered) {
+                                    store.patchMessage(threadId, stale.id, { card: { ...stale.card, answered: "unavailable", dismissed: true } });
+                                }
+                            }
+                            return refuseOutbound(answer === "timeout"
+                                ? "OpenMausBot did not send this: nobody answered the approval in time. Ask the user before trying again."
+                                : "OpenMausBot did not send this: the user declined. Do not retry it; ask the user what they would like instead.");
+                        }
+                        outboundApproved = true;
+                        requireActiveInternalCapability();
+                    }
+                }
+                let dispatchRefusal;
+                const refuseDispatch = (text) => {
+                    dispatchRefusal = text;
+                    throw new Error(text);
+                };
+                let upstream;
+                try {
+                    upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
+                        ? req.headers["mcp-session-id"][0]
+                        : req.headers["mcp-session-id"], () => {
+                        requireActiveInternalCapability();
+                        const fresh = store.bot(internalCapability.botId);
+                        if (!fresh || fresh.composio === false || !composio.configured(cfg))
+                            refuseDispatch("Connected apps were disabled while this call waited.");
+                        const freshAccess = connectorAccessDecision(fresh.connectorScopes, connectorCalls, serviceSlugs);
+                        if (!freshAccess.ok || (opaque && fresh.connectorTools !== undefined) ||
+                            (call.kind === "tools" && !evaluateConnectorTools(call.names, fresh.connectorTools, serviceSlugs).allowed) ||
+                            (call.kind === "unrecognized" && fresh.connectorTools !== undefined)) {
+                            refuseDispatch("This bot's connected-app permissions changed. The call was not run.");
+                        }
+                        if (outboundTool) {
+                            const policy = fresh.outbound ?? DEFAULT_OUTBOUND_POLICY;
+                            if (policy.policy === "allow" && !opaque) {
+                                let reserved;
+                                try {
+                                    reserved = outboundCounts.reserve(fresh.id, outboundCalls.length, policy.dailyCap);
+                                }
+                                catch {
+                                    refuseDispatch("The daily allowance could not be saved. Nothing was sent.");
+                                }
+                                if (reserved === null)
+                                    refuseDispatch("This bot has reached its daily outbound limit. Nothing was sent.");
+                                appendDecision(DATA_DIR, { threadId: internalCapability.threadId, botId: fresh.id, botName: fresh.name,
+                                    tool: outboundTool, decision: "auto-approved", source: "outbound", rule: `daily-allowance:${reserved}/${policy.dailyCap}` });
+                            }
+                            else if (!outboundApproved) {
+                                refuseDispatch("The outbound policy changed. Ask for approval again before sending.");
+                            }
+                        }
+                    });
+                }
+                catch (error) {
+                    if (dispatchRefusal)
+                        return refuseOutbound(dispatchRefusal);
+                    throw error;
+                }
                 const headers = {
                     "content-type": upstream.contentType,
                     "cache-control": "no-store",
@@ -17543,6 +17742,16 @@ const handleRequest = async (req, res) => {
                 if (!composio.configured(cfg) || owner.bot.composio === false) {
                     return json(res, 409, { error: "connected apps are not enabled for this bot" });
                 }
+                if (owner.bot.connectorScopes) {
+                    const outside = slugs.find((slug) => !owner.bot.connectorScopes?.apps[slug]);
+                    if (outside) {
+                        appendDecision(DATA_DIR, {
+                            threadId, botId: owner.bot.id, botName: owner.bot.name,
+                            tool: "COMPOSIO_MANAGE_CONNECTIONS", summary: outside, decision: "auto-denied", source: "connector-scope", rule: `scope:${outside}:app`,
+                        });
+                        return json(res, 403, { error: `${owner.bot.name} has not been given access to ${outside}; allow it under the bot's Access settings first` });
+                    }
+                }
                 const connectionState = await composio.connectionStatus(cfg, slugs).catch(() => ({}));
                 requireActiveInternalCapability();
                 const messageIds = [];
@@ -17964,12 +18173,10 @@ const handleRequest = async (req, res) => {
             const limit = pageSize(url.searchParams.get("messages"));
             if (limit === null)
                 return json(res, 400, { error: "messages must be a non-negative whole number" });
-            // wireBot(), not publicBot(): publicBot() pulls the whole transcript via
-            // messagesFor() just to have it overwritten below by messagePage(),
-            // which — for a bounded request — never needs the full transcript.
-            // tasks stays explicit, because that is the one field publicBot() adds
-            // that messagePage() does not: wireBot() omits the key entirely for a
-            // bot record carrying no tasks, where publicBot() always sent [].
+            // wireBot(), not publicBot(): this snapshot answers with the page it
+            // was asked for, not the default one. tasks stays explicit, as in
+            // publicBot(): wireBot() omits the key entirely for a bot record
+            // carrying no tasks, where clients expect [].
             // A member on a workspace with a restricted bot gets only what they may
             // see (bot-visibility.ts); for everyone else these filters keep all.
             const shownBots = store.bots.filter((bot) => visible.bot(bot.id));
@@ -17993,47 +18200,6 @@ const handleRequest = async (req, res) => {
             });
         }
         // scrollback: the page before a message the client already holds
-        // #1655: the consent card's answer, per conversation. Explicit and
-        // revocable; a thread allowlisted in config carries the same standing
-        // consent without ever seeing a card.
-        m = path.match(/^\/api\/threads\/([\w-]+)\/cloud-overflow$/);
-        if (m && method === "POST") {
-            const threadId = m[1];
-            if (!store.botByThread(threadId))
-                return json(res, 404, { error: "no such conversation" });
-            const body = await readBody(req);
-            if (!body || typeof body !== "object" || Array.isArray(body))
-                return json(res, 400, { error: "body must be a JSON object" });
-            if (typeof body.consent !== "boolean")
-                return json(res, 400, { error: "consent must be a boolean" });
-            if (body.consent) {
-                // Consent answers the priced card, never a guess: without a prior
-                // offer the rate was never shown, so a seat must not start yet.
-                // The grant binds to the rate the card showed (#1655): a config
-                // change re-offers instead of starting at a new price silently.
-                const offeredRate = cloudOverflowConsent.offeredRate(threadId);
-                if (offeredRate === null)
-                    return json(res, 409, { error: "no cloud overflow offer" });
-                cloudOverflowConsent.grant(threadId, offeredRate);
-            }
-            else {
-                cloudOverflowConsent.revoke(threadId);
-                // Revocation must reach the machine (#1655): the ledger alone
-                // would leave this conversation's seat billing to its idle
-                // timeout. A start still waking is caught by its own revoke
-                // check once readyBox resolves.
-                const seatBot = store.botByThread(threadId);
-                const lease = seatBot ? cloudSeatLeases.get(seatBot.id) : undefined;
-                if (seatBot && lease && lease.threadId === threadId) {
-                    stopCloudSeat(seatBot.id, lease, "Cloud computer stopped because overflow consent was revoked — billing pauses while it sleeps.");
-                }
-            }
-            store.appendMessage(threadId, {
-                role: "bot", kind: "activity",
-                tool: { name: cloudOverflowConsentText(body.consent, cloudOverflowIdleStopMs(cfg)), ok: true },
-            });
-            return json(res, 200, { consented: body.consent });
-        }
         m = path.match(/^\/api\/threads\/([\w-]+)\/messages$/);
         if (m && method === "GET") {
             const threadId = m[1];
@@ -18783,8 +18949,11 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "Import backups alongside your existing bots; project mode is only for templates" });
                 try {
                     const imported = importTeamBackup(store, routines, body, await defaultSelection(), { visibility: importVisibility });
+                    // A restore writes its transcripts without store events, after the
+                    // store's own frames announced each bot and room, so these frames
+                    // are what carries the restored pages to other clients.
                     const bots = imported.bots.map((bot) => publicBot(bot));
-                    const groups = imported.groups.map((group) => ({ ...publicGroupState(group), ...messagePage(group.threadId, undefined) }));
+                    const groups = imported.groups.map((group) => groupWithThread(group));
                     for (const bot of bots)
                         broadcast({ kind: "bot", bot });
                     for (const group of groups)
@@ -18934,9 +19103,7 @@ const handleRequest = async (req, res) => {
             // Who opened it decides who may answer its cards on a shared workspace.
             if (auth.kind === "session")
                 threadStarters.set(task.threadId, actorKey(auth));
-            const fresh = groupWithThread(store.group(group.id));
-            broadcast({ kind: "group", group: fresh });
-            return json(res, 201, { group: fresh, task });
+            return json(res, 201, { group: groupWithThread(store.group(group.id)), task });
         }
         m = path.match(/^\/api\/groups\/([\w-]+)\/tasks\/([\w-]+)$/);
         if (m && method === "POST") {
@@ -18961,15 +19128,6 @@ const handleRequest = async (req, res) => {
             if (!switched)
                 return json(res, 404, { error: "no such channel task" });
             const switchedSettings = { ...publicGroupState(switched), tasks: store.groupTasks(switched.id) };
-            // The frame says the channel moved; it is not a transcript delivery.
-            // A long room's whole history over SSE is the payload `?messages=`
-            // exists to avoid, and it would also overwrite a bounded snapshot on
-            // every other client. One default page is enough to render the switch;
-            // anything earlier pages back through /api/threads/:id/messages.
-            broadcast({
-                kind: "group",
-                group: { ...switchedSettings, ...messagePage(switched.threadId, DEFAULT_PAGE) },
-            });
             // "0" predates paging and means settings only — no `messages` key at
             // all, which clients tell apart from an empty page. A positive page is
             // the transcript a client can actually hold; omitting the parameter
@@ -18977,9 +19135,7 @@ const handleRequest = async (req, res) => {
             // materialises it.
             const responseGroup = requestedMessages === "0"
                 ? switchedSettings
-                : switchLimit === undefined
-                    ? groupWithThread(switched)
-                    : { ...switchedSettings, ...messagePage(switched.threadId, switchLimit) };
+                : { ...switchedSettings, ...messagePage(switched.threadId, switchLimit) };
             return json(res, 200, { group: responseGroup });
         }
         if (m && method === "PATCH") {
@@ -19052,14 +19208,12 @@ const handleRequest = async (req, res) => {
             lastReply.delete(m[2]);
             cancelTeamSetupResumesForThread(m[2]);
             const updated = store.deleteGroupTask(group.id, m[2]);
-            if (updated)
-                clearTurnDigestState(m[2]);
             if (!updated)
                 return json(res, 400, { error: "a channel keeps at least one task" });
+            clearTurnDigestState(m[2]);
+            revokeInternalCapabilitiesForThread(m[2]);
             rejectDeletedThreadSkillStages(stagedSkillCleanups);
-            const fresh = groupWithThread(updated);
-            broadcast({ kind: "group", group: fresh });
-            return json(res, 200, { group: fresh });
+            return json(res, 200, { group: groupWithThread(updated) });
         }
         m = path.match(/^\/api\/groups\/([\w-]+)$/);
         if (m && method === "PATCH") {
@@ -20045,6 +20199,43 @@ const handleRequest = async (req, res) => {
                 patch.section = section ?? undefined;
             if (body.chiefOfStaff === false)
                 patch.chiefOfStaff = false;
+            // where a task carries on when this engine is unavailable, in order
+            if (body.fallback !== undefined) {
+                if (!Array.isArray(body.fallback) || body.fallback.length > 5) {
+                    return json(res, 400, { error: "fallback must be a list of up to five { instanceId, model } entries" });
+                }
+                const chain = [];
+                for (const entry of body.fallback) {
+                    const row = entry && typeof entry === "object" ? entry : null;
+                    if (!row || typeof row.instanceId !== "string" || !/^[\w.-]+$/.test(row.instanceId) || typeof row.model !== "string" || !row.model.trim() || row.model.length > 500) {
+                        return json(res, 400, { error: "fallback must be a list of up to five { instanceId, model } entries" });
+                    }
+                    if (!registry.get(row.instanceId))
+                        return json(res, 400, { error: `fallback engine "${row.instanceId}" is not available` });
+                    if (chain.some((seen) => seen.instanceId === row.instanceId))
+                        continue;
+                    chain.push({ instanceId: row.instanceId, model: row.model.trim() });
+                }
+                patch.fallback = chain;
+            }
+            // which connected apps this bot may use; null clears back to all of them
+            if (body.connectorScopes !== undefined) {
+                if (body.connectorScopes === null)
+                    patch.connectorScopes = undefined;
+                else {
+                    const scopes = normalizeConnectorScopes(body.connectorScopes);
+                    if (!scopes)
+                        return json(res, 400, { error: "connectorScopes must be { apps: { <toolkit>: read | write } } or null" });
+                    patch.connectorScopes = scopes;
+                }
+            }
+            // sending on the person's behalf: ask every time, or a daily allowance
+            if (body.outbound !== undefined) {
+                const policy = normalizeOutboundPolicy(body.outbound);
+                if (!policy)
+                    return json(res, 400, { error: "outbound must be { policy: ask | allow, dailyCap: 1..1000 }" });
+                patch.outbound = policy;
+            }
             // per-bot gate on the workspace's connected apps (Composio)
             if (body.composio !== undefined) {
                 if (typeof body.composio !== "boolean")
@@ -20356,6 +20547,16 @@ const handleRequest = async (req, res) => {
             // desktop capability or a paired session, which is what the refusal
             // points at.
             const loosened = [];
+            // These three fields were validated above before joining the broad patch.
+            const trustPatch = patch;
+            if (body.outbound !== undefined && trustPatch.outbound?.policy === "allow" &&
+                (existingBot?.outbound?.policy !== "allow" || trustPatch.outbound.dailyCap > existingBot.outbound.dailyCap))
+                loosened.push("outbound");
+            if (body.connectorScopes !== undefined && existingBot?.connectorScopes &&
+                (!trustPatch.connectorScopes || Object.entries(trustPatch.connectorScopes.apps).some(([slug, scope]) => !existingBot.connectorScopes.apps[slug] || (scope === "write" && existingBot.connectorScopes.apps[slug] === "read"))))
+                loosened.push("connectorScopes");
+            if (body.fallback !== undefined && trustPatch.fallback?.some(candidate => !existingBot?.fallback?.some(previous => previous.instanceId === candidate.instanceId && previous.model === candidate.model)))
+                loosened.push("fallback");
             if (Array.isArray(patch.managedSections) && patch.managedSections.some(section => !(existingBot?.managedSections ?? []).includes(section))) {
                 loosened.push("managedSections");
             }
@@ -20731,6 +20932,71 @@ const handleRequest = async (req, res) => {
         // it. That keeps one bot from silently changing every teammate's future
         // turns. The section query parameter is required even for General (""),
         // so a malformed client cannot accidentally read or replace that brief.
+        // ── team memory: the section's shared people, places, decisions, terms ──
+        // The person's view and their edits. Same section rule as the brief:
+        // the query parameter is required even for General.
+        if (path === "/api/team-memory" && (method === "GET" || method === "POST")) {
+            if (!url.searchParams.has("section"))
+                return json(res, 400, { error: "section is required" });
+            const section = sectionContextKey(url.searchParams.get("section") ?? "");
+            if (section.length > 60)
+                return json(res, 400, { error: "section must be at most 60 characters" });
+            if (method === "GET") {
+                return json(res, 200, { section, label: sectionContextLabel(section), entries: teamMemory.list(section) });
+            }
+            const body = await readBody(req);
+            if (!body || typeof body !== "object" || !TEAM_MEMORY_KINDS.includes(String(body.kind))) {
+                return json(res, 400, { error: `kind must be one of ${TEAM_MEMORY_KINDS.join(", ")}` });
+            }
+            try {
+                const proposed = teamMemory.propose(section, { kind: body.kind, name: String(body.name ?? ""), detail: String(body.detail ?? ""), aliases: Array.isArray(body.aliases) ? body.aliases.map(String) : undefined }, { botId: "", botName: "you", threadId: "", at: Date.now() });
+                // the person's own entry never waits on the person
+                if (proposed.status === "proposed")
+                    teamMemory.resolve(section, proposed.entry.id, "accept");
+                return json(res, 201, { entries: teamMemory.list(section) });
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        m = path.match(/^\/api\/team-memory\/([\w-]+)$/);
+        if (m && (method === "PATCH" || method === "DELETE")) {
+            if (!url.searchParams.has("section"))
+                return json(res, 400, { error: "section is required" });
+            const section = sectionContextKey(url.searchParams.get("section") ?? "");
+            if (method === "DELETE") {
+                if (!teamMemory.remove(section, m[1]))
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entries: teamMemory.list(section) });
+            }
+            const body = await readBody(req);
+            if (!body || typeof body !== "object")
+                return json(res, 400, { error: "body must be a JSON object" });
+            if (body.accept === true) {
+                const result = teamMemory.resolve(section, m[1], "accept");
+                if (!result.claimed)
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entries: teamMemory.list(section) });
+            }
+            const patch = {};
+            if (typeof body.name === "string")
+                patch.name = body.name;
+            if (typeof body.detail === "string")
+                patch.detail = body.detail;
+            if (Array.isArray(body.aliases))
+                patch.aliases = body.aliases.map(String);
+            if (typeof body.kind === "string" && TEAM_MEMORY_KINDS.includes(body.kind))
+                patch.kind = body.kind;
+            try {
+                const updated = teamMemory.update(section, m[1], patch);
+                if (!updated)
+                    return json(res, 404, { error: "no such entry" });
+                return json(res, 200, { entry: updated, entries: teamMemory.list(section) });
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
         if (path === "/api/section-context" && (method === "GET" || method === "PUT")) {
             if (!url.searchParams.has("section"))
                 return json(res, 400, { error: "section is required" });
@@ -20911,54 +21177,6 @@ const handleRequest = async (req, res) => {
             broadcast({ kind: "bot", bot: visible });
             return json(res, 200, { bot: visible });
         }
-        // ── workspace checkpoints: per-turn shadow-git snapshots ────────────
-        // The list endpoint is the source of truth (turns store nothing), and
-        // `enabled` tells the UI whether snapshots can happen here at all —
-        // false for refused folders (home, Desktop…), a missing git, or a bot
-        // whose checkpoints failed earlier this session.
-        m = path.match(/^\/api\/bots\/([\w-]+)\/checkpoints$/);
-        if (m && method === "GET") {
-            if (!store.bot(m[1]))
-                return json(res, 404, { error: "no such bot" });
-            const cwd = url.searchParams.get("cwd") ?? "";
-            if (!cwd.trim())
-                return json(res, 400, { error: "cwd query parameter required" });
-            return json(res, 200, {
-                checkpoints: await checkpoints.listCheckpoints(m[1], cwd),
-                enabled: await checkpoints.checkpointsEnabled(m[1], cwd),
-            });
-        }
-        m = path.match(/^\/api\/bots\/([\w-]+)\/checkpoints\/restore$/);
-        if (m && method === "POST") {
-            const bot = store.bot(m[1]);
-            if (!bot)
-                return json(res, 404, { error: "no such bot" });
-            const parsed = z
-                .object({ cwd: z.string().min(1), hash: z.string().regex(/^[0-9a-f]{40}$/) })
-                .safeParse(await readBody(req));
-            if (!parsed.success) {
-                return json(res, 400, { error: "cwd (absolute path) and hash (full 40-character checkpoint hash) required" });
-            }
-            // Claim synchronously with the busy check. startTurn checks the same
-            // lease before reserving the bot, so no turn can enter during the
-            // awaited Git operation.
-            if (bot.busy)
-                return json(res, 409, { error: "the bot is working — stop the turn before restoring files" });
-            if (checkpointRestoreLeases.has(bot.id)) {
-                return json(res, 409, { error: "this bot's project files are already being restored" });
-            }
-            checkpointRestoreLeases.add(bot.id);
-            let result;
-            try {
-                result = await checkpoints.restore(bot.id, parsed.data.cwd, parsed.data.hash);
-            }
-            finally {
-                checkpointRestoreLeases.delete(bot.id);
-            }
-            if (!result.ok)
-                return json(res, 400, { error: result.error });
-            return json(res, 200, { ok: true });
-        }
         // onboarding/ask cards persist their answered/dismissed state
         m = path.match(/^\/api\/bots\/([\w-]+)\/cards\/([\w-]+)$/);
         if (m && method === "PATCH") {
@@ -21332,6 +21550,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: refusal });
             }
             return await answeringCardAs(auth, bot.threadId, String(body.requestId), async () => {
+                if (resolveAndSendTrust(res, bot.threadId, String(body.requestId), behavior))
+                    return;
                 if (await resolveAndSendTeamSetup(res, {
                     botId: bot.id, threadId: bot.threadId, requestId: String(body.requestId), behavior,
                 }, auth.kind === "loopback" ? DESKTOP_MANAGED || Boolean(req.headers.origin) && !store.bots.some((bot) => bot.busy || activeGroupTurnForBot(bot.id)) : auth.scopes.includes("admin")))
@@ -21360,14 +21580,6 @@ const handleRequest = async (req, res) => {
                     behavior,
                 }))
                     return;
-                if (resolveAndSendTightening(res, {
-                    botId: bot.id,
-                    botName: bot.name,
-                    threadId: bot.threadId,
-                    requestId: String(body.requestId),
-                    behavior,
-                }))
-                    return;
                 if (sendSkillResolution(res, resolveSkillRequest({
                     botId: bot.id,
                     botName: bot.name,
@@ -21434,6 +21646,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: refusal });
             }
             return await answeringCardAs(auth, threadId, requestId, async () => {
+                if (resolveAndSendTrust(res, threadId, requestId, behavior))
+                    return;
                 const skillCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.skillRequest);
                 if (skillCard?.card?.skillRequest) {
                     const skillBotId = skillCard.from?.botId ?? store.botByThread(threadId)?.id;
@@ -21506,21 +21720,6 @@ const handleRequest = async (req, res) => {
                     }))
                         return;
                 }
-                const tighteningCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.tighteningRequest);
-                if (tighteningCard?.card?.tighteningRequest) {
-                    const tighteningBotId = tighteningCard.from?.botId ?? store.botByThread(threadId)?.id;
-                    if (!tighteningBotId)
-                        return json(res, 400, { error: "this tightening request has no valid owner" });
-                    const tighteningOwner = store.bot(tighteningBotId);
-                    if (resolveAndSendTightening(res, {
-                        botId: tighteningBotId,
-                        botName: tighteningOwner?.name,
-                        threadId,
-                        requestId,
-                        behavior,
-                    }))
-                        return;
-                }
                 // peer-approval intercept (see /api/bots/:id/respond above). A peer card
                 // belongs to the bus rather than to a speaker, so resolve it before we go
                 // looking for one — a room between turns has no speaker to find.
@@ -21643,15 +21842,8 @@ const handleRequest = async (req, res) => {
             return json(res, 200, { ok: true });
         }
         // ── tasks: a bot's separate contexts ────────────────────────────────
-        // The bot record answers with its messages because switching tasks
-        // changes which transcript is live, and a partial patch would leave
-        // the client showing the previous task's conversation.
-        const botWithThread = (bot) => ({
-            ...wireBot(bot),
-            messages: store.messagesFor(bot.threadId),
-            activeLeafId: store.activeLeaf(bot.threadId),
-            tasks: store.tasks(bot.id).map(wireTask),
-        });
+        // Replies carry the open thread's newest page: a create or delete can
+        // change which transcript is live. The frames come from store.onChange.
         // Folders organize one bot's threads; they never own settings,
         // transcripts or working directories. The project wire names stay stable.
         m = path.match(/^\/api\/bots\/([\w-]+)\/projects\/order$/);
@@ -21668,7 +21860,7 @@ const handleRequest = async (req, res) => {
             const projects = store.reorderProjects(bot.id, body.projectIds);
             if (!projects)
                 return json(res, 400, { error: "projectIds must include each of this bot's folders exactly once" });
-            return json(res, 200, { projects, bot: botWithThread(bot) });
+            return json(res, 200, { projects, bot: publicBot(bot) });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/projects(?:\/([\w-]+))?$/);
         if (m && ((method === "POST" && !m[2]) || (method === "PATCH" && m[2]) || (method === "DELETE" && m[2]))) {
@@ -21679,7 +21871,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such folder" });
             if (method === "DELETE") {
                 const updated = store.deleteProject(bot.id, m[2]);
-                return json(res, 200, { bot: botWithThread(updated) });
+                return json(res, 200, { bot: publicBot(updated) });
             }
             const body = await readBody(req);
             if (!body || typeof body !== "object" || Array.isArray(body))
@@ -21702,7 +21894,7 @@ const handleRequest = async (req, res) => {
             const project = method === "POST"
                 ? store.createProject(bot.id, patch.name, patch.emoji)
                 : store.patchProject(bot.id, m[2], patch);
-            return json(res, method === "POST" ? 201 : 200, { project, bot: botWithThread(bot) });
+            return json(res, method === "POST" ? 201 : 200, { project, bot: publicBot(bot) });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/tasks$/);
         if (m && method === "POST") {
@@ -21737,9 +21929,7 @@ const handleRequest = async (req, res) => {
             // Who opened it decides who may answer its cards on a shared workspace.
             if (auth.kind === "session")
                 threadStarters.set(task.threadId, actorKey(auth));
-            const fresh = botWithThread(store.bot(bot.id));
-            broadcast({ kind: "bot", bot: fresh });
-            return json(res, 201, { bot: fresh, task: wireTask(task) });
+            return json(res, 201, { bot: publicBot(store.bot(bot.id)), task: wireTask(task) });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/tasks\/([\w-]+)$/);
         if (m && method === "POST") {
@@ -21758,18 +21948,13 @@ const handleRequest = async (req, res) => {
             if (!switched)
                 return json(res, 404, { error: "no such task" });
             const switchedSettings = { ...wireBot(switched), tasks: store.tasks(switched.id).map(wireTask) };
-            // Bounded for the same reason as the channel switch above.
-            broadcast({
-                kind: "bot",
-                bot: { ...switchedSettings, ...messagePage(switched.threadId, DEFAULT_PAGE) },
-            });
             // "0" is settings only, a positive page is a bounded transcript, and no
             // parameter is the whole thread — the one branch that materialises it.
+            // Search results land through that branch (src/lib/focus-message.ts):
+            // the hit can be older than one page.
             const responseBot = requestedMessages === "0"
                 ? switchedSettings
-                : switchLimit === undefined
-                    ? botWithThread(switched)
-                    : { ...switchedSettings, ...messagePage(switched.threadId, switchLimit) };
+                : { ...switchedSettings, ...messagePage(switched.threadId, switchLimit) };
             return json(res, 200, { bot: responseBot });
         }
         if (m && method === "PATCH") {
@@ -21844,9 +22029,7 @@ const handleRequest = async (req, res) => {
                 const task = store.refreshTaskPermissions(profile.id, m[2]);
                 if (!task)
                     return json(res, 404, { error: "no such task" });
-                const fresh = botWithThread(store.bot(profile.id));
-                broadcast({ kind: "bot", bot: fresh });
-                return json(res, 200, { task: wireTask(task), bot: fresh });
+                return json(res, 200, { task: wireTask(task), bot: publicBot(store.bot(profile.id)) });
             }
             const patch = {};
             if (body.projectId !== undefined) {
@@ -21952,9 +22135,7 @@ const handleRequest = async (req, res) => {
             const task = patch.modelSelection
                 ? store.switchTaskModel(m[1], m[2], patch.modelSelection, body.updateBotDefault === true, body.resetApprovalToAsk === true, { ...patch, ...hostedModels?.resetTask(current.modelSelection, patch.modelSelection) })
                 : store.patchTask(m[1], m[2], patch);
-            const fresh = botWithThread(store.bot(m[1]));
-            broadcast({ kind: "bot", bot: fresh });
-            return json(res, 200, { task: wireTask(task), bot: fresh });
+            return json(res, 200, { task: wireTask(task), bot: publicBot(store.bot(m[1])) });
         }
         if (m && method === "DELETE") {
             const bot = store.bot(m[1]);
@@ -21977,12 +22158,11 @@ const handleRequest = async (req, res) => {
             if (!updated)
                 return json(res, 404, { error: "no such task" });
             clearTurnDigestState(m[2]);
+            revokeInternalCapabilitiesForThread(m[2]);
             handoffs.forget(m[2]);
             settleDirectFollowup(directTurnGenerationByThread.get(m[2]));
             rejectDeletedThreadSkillStages(stagedSkillCleanups);
-            const fresh = botWithThread(updated);
-            broadcast({ kind: "bot", bot: fresh });
-            return json(res, 200, { bot: fresh });
+            return json(res, 200, { bot: publicBot(updated) });
         }
         // Regenerate title (#1858): name the thread again from its conversation
         // as it is now. The person asked, so the result replaces any title, but
@@ -22663,6 +22843,34 @@ const handleRequest = async (req, res) => {
             res.end(decisionsCsv(readDecisionRange(DATA_DIR, range)));
             return;
         }
+        // ── a bot's activity: what it did, with the outcome ──
+        // Read-only over the same two logs as the inspector and the decision
+        // route above. The bot's own threads (its DM and every task) carry the
+        // tool runs; the decision log carries the bot's requests wherever they
+        // happened, since those rows name the bot.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/activity$/);
+        if (m && method === "GET") {
+            const bot = store.bot(m[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            const rawLimit = url.searchParams.get("limit");
+            const parsedLimit = rawLimit === null ? undefined : Number(rawLimit);
+            if (parsedLimit !== undefined && (!Number.isInteger(parsedLimit) || parsedLimit <= 0)) {
+                return json(res, 400, { error: "limit must be a positive whole number" });
+            }
+            const threadIds = [...new Set([bot.threadId, ...store.tasks(bot.id).map((task) => task.threadId)])];
+            return json(res, 200, {
+                rows: readBotActivity({ dataDir: DATA_DIR, eventsDir: EVENTS_DIR, botId: bot.id, threadIds, limit: parsedLimit ?? 300 }),
+            });
+        }
+        // ── a bot's outbound allowance: the policy, and how much of it is spent ──
+        m = path.match(/^\/api\/bots\/([\w-]+)\/outbound$/);
+        if (m && method === "GET") {
+            const bot = store.bot(m[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            return json(res, 200, { policy: bot.outbound ?? DEFAULT_OUTBOUND_POLICY, today: outboundCounts.today(bot.id) });
+        }
         // ── provider instances (model picker) ──
         if (method === "GET" && path === "/api/instances") {
             // Rescan PATH first: this endpoint is how the app answers "what can I
@@ -22947,7 +23155,7 @@ const handleRequest = async (req, res) => {
                     catch { /* Allow repairing an unused malformed account. */ }
                     entry.config = { ...entry.config, configDir: body.configDir };
                     if (previousDir !== configuredAccountDirectory(entry)) {
-                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId || task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
+                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || bot.fallback?.some(candidate => candidate.instanceId === instanceId) || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId || task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
                         if (used)
                             return json(res, 409, { error: "This account is used by bots or conversation history. Add another account and select it for the bot instead." });
                         assertSeparateClaudeAccount(instances, instanceId, entry);
@@ -22971,7 +23179,7 @@ const handleRequest = async (req, res) => {
             if (instances[instanceId].driver !== "claudeAgent" || instanceId === "claude") {
                 return json(res, 400, { error: "Only added Claude accounts can be removed here." });
             }
-            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId)) ||
+            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || bot.fallback?.some(candidate => candidate.instanceId === instanceId) || store.tasks(bot.id).some((task) => task.modelSelection?.instanceId === instanceId)) ||
                 busyProviderSelections().some((selection) => selection.instanceId === instanceId)) {
                 return json(res, 409, { error: "Choose another account for the bots and default model using this account before removing it." });
             }
@@ -23579,6 +23787,15 @@ const handleRequest = async (req, res) => {
                     if (conflict)
                         return json(res, 409, { error: conflict });
                 }
+                // A change names only the OpenCode provider keys it saves or removes;
+                // the rest stay. Merged with no await before the save below, so it
+                // starts from what is saved at that moment.
+                if (patch.opencodeGo?.providerKeys) {
+                    const merged = mergeOpenCodeProviderKeys(cfg, patch.opencodeGo.providerKeys);
+                    if (!merged.ok)
+                        return json(res, 400, { error: merged.error });
+                    patch.opencodeGo = { ...patch.opencodeGo, providerKeys: merged.keys };
+                }
                 const browserCleanupRequests = [];
                 if (profileControlConflict())
                     return json(res, 409, { error: "Release browser control before deleting its profile." });
@@ -24517,6 +24734,8 @@ const gracefulShutdown = createGracefulShutdown({
     // the shutdown deadline), immediately before the process exits, so no new
     // server can overlap with a still-mutating old one.
     exit: (code) => {
+        // Streamed text the bus is still merging reaches the log and clients.
+        bus.flush();
         try {
             sessions.close();
         }
@@ -24529,8 +24748,8 @@ const gracefulShutdown = createGracefulShutdown({
         closeMessageDb();
         mcpOAuth.dispose();
         releaseDataDirLeaseAtExit();
-        // A Cloud home's launcher starts the server again on this code only.
-        process.exit(cloudHomeRestartRequested && code === 0 ? CLOUD_HOME_RESTART_EXIT_CODE : code);
+        // Every launcher in this repo starts the server again on this code (server/restart.ts).
+        process.exit(restartRequested && code === 0 ? RESTART_EXIT_CODE : code);
     },
 });
 for (const signal of ["SIGINT", "SIGTERM"]) {