quoxcli 0.4.0 → 0.5.0

package/lib/quoxon/app.js

@@ -14,16 +14,19 @@ import { bufferReducer, initialBuffer, sanitizeForSend, wordAt, selection, selec
 import { MOUSE_ON, MOUSE_OFF, DSR, DOUBLE_MS, DSR_TIMEOUT_MS, mouseOnNote, lineAt, MOUSE_HINT, screenHit, classifyClick, composerIndexAt } from './mouse.js';
 import { parseChunk, initialKeyState, flushDangling, hasDangling, PASTE_ON, PASTE_OFF, PASTE_DANGLING_MS } from './keys.js';
 import { isHeldFromBulk, heldReason } from './bulkRisk.js';
-import { walkCard, walkReply, walkNotYesNo, walkNoCatch, walkSummary, parseDecision, matchesAgent, filterPredicate, approvalRow, approvalDetail, isDecision, approvalAsWalkItem, parseAnswer, parsePairs } from './approvalsView.js';
+import { isDestructive, destructiveObject } from './destructive.js';
+import { batchFor, batchModel, batchLabel, collapseArrivals } from './approvalBatch.js';
+import { walkCard, walkReply, walkNotYesNo, walkNoCatch, walkSummary, parseDecision, matchesAgent, filterPredicate, approvalRow, approvalDetail, isDecision, approvalAsWalkItem, parseAnswer, parsePairs, needsPin } from './approvalsView.js';
+import { createAutoOpen, noteArrivals, openDecision, takeQueue, strayAnswer, parseApprovalsArg, autoOn, APPROVALS_OPTIONS } from './autoOpen.js';
 import { dividerLive, GREEN_MS, RED_MS } from './dividerAocl.js';
 import { reduce, initialState, approvalKeyAllowed, groupApprovals, orderApprovals, otherSessionsCount, isPrivileged, approvalSourceLabel, approvalWhat, describeInboxItem, textGate } from './events.js';
 import { turnTokens } from './indicator.js';
 import {
-  Composer, RingComposer, Pending, ApprovalCard, LoopCardView, AskCard, StatusLine, RowsBar, NotifyBar, Working, HistoryItem, liveRows, Intro, Roster, WaitingNotice, historyGap, INTRO_FRAMES, introAnimates, describeActivity, clampCols, clip, COLORS, revealTimingFor
-, endsInRule } from './render.js';
-import { c, mono } from './theme.js';
+  Composer, RingComposer, Pending, ApprovalCard, BatchCard, LoopCardView, AskCard, StatusLine, RowsBar, NotifyBar, Working, HistoryItem, liveRows, Intro, Roster, WaitingNotice, historyGap, INTRO_FRAMES, introAnimates, describeActivity, clampCols, clip, COLORS, revealTimingFor
+, endsInRule, approvalsPollStale } from './render.js';
+import { c, mono, isLight } from './theme.js';
 import { strayCardAnswer, strayQuestion, alreadyQueued } from './stray.js';
-import { findEntry, helpModel, nearestCommands, joinWrappedSlash, commandNames, REGISTRY, visibleRegistry } from './commands.js';
+import { findEntry, helpModel, nearestCommands, joinWrappedSlash, commandNames, REGISTRY, visibleRegistry, setExtEntries } from './commands.js';
 import { osc52, pickCopy } from './copy.js';
 import { detectSlotAgent } from './context.js';
 import { rulesContext, rulesLabel, rulesLines } from './rules.js';
@@ -33,14 +36,16 @@ import { startupWhatsNew, listWhatsNew, unseenEntries, seenRecord, tryText, LIST
 import { nextTip, normaliseMode, tipSettingsReply, tipsReply, DEFAULT_MODE, TIPS, tryCommand, tipText } from './tips.js';
 import { findSkill, skillRows, skillDetail, skillPrompt } from './skills.js';
 import { createScreenContext } from './screenContext.js';
+import { parseSlotAttach } from './slotAttach.js';
 import { askText, askQuestion, askAnswer, askChatMessage, settledAskLine, settledAskTone, askOutcomeOf, isAskClarification, askClock } from './ask.js';
 import { objectiveFromEvent, objectiveAskText, objectiveStartedNote, objectiveWatchLine, objectiveFailedNote, watchObjective } from './objectiveOffer.js';
 import { createHandoffStreak, handoffBiggerAskText, handoffFromEvent, handoffAskText, handoffAnsweredNote, handoffSupersededNote, handoffSkippedNote } from './handoffOffer.js';
 import * as selfUpdate from '../core/selfUpdate.js';
 import { parseDone, todoDoneLine, parseTodo, todoAddedLine, todoBoardText, numberBoard, resolveRef, todoMovedLine } from './slash/todoCmd.js';
 import { runRequest, runAnswer, handOverRun, runFooter } from './slotRun.js';
-import { profileChooserRows, liveApi, switchAskLine, slotCreateAskLine, loginRunRequest, okProfileName } from './profileSwitch.js';
-import { rosterView, peekLines, selectRows, backgroundAlerts, isExpired, applyProgress, SPIN_MS } from './roster.js';
+import { profileChooserRows, liveApi, switchAskLine, startupSwitchAskLine, slotCreateAskLine, loginRunRequest, okProfileName } from './profileSwitch.js';
+import { attachLines, sessionLines } from './rosterSessions.js';
+import { rosterView, peekLines, selectRows, fromApproval, backgroundAlerts, isExpired, applyProgress, SPIN_MS } from './roster.js';
 import { runObjectCommand } from './objects/index.js';
 import { runEvidenceCommand } from './slash/evidenceCmd.js';
 import { peekLines as peekIdLines } from '../core/peek.js';
@@ -49,7 +54,9 @@ import { createMentionCache, loadMentions, receiptMentions } from './mentions.js
 const OBJECT_CMDS = new Set(['/skills', '/agents', '/workflow', '/crystal', '/memory', '/rules', '/proof', '/reconcile', '/fleet', '/prove', '/replay', '/health', '/core']);
 import { intentHint } from './intent.js';
 import { observerLines } from './observers.js';
-import { inboxBarText, arrivals, arrivalLine, inboxTable, inboxDetail, parseInbox, INBOX_USAGE, newestFirst, isApprovalItem } from './inboxView.js';
+import { runWithSpinner, spinnerVerb } from './slashSpinner.js';
+import { parseMail, mailTable, mailDetail, noMailboxLines, mailNewestFirst, MAIL_USAGE } from './mailView.js';
+import { inboxBarText, arrivals, loadSeen, withSeen, arrivalLine, inboxTable, announceFresh, activeMutes, mutesLines, inboxDetail, parseInbox, INBOX_USAGE, newestFirst, unreadItems, readItems, isApprovalItem, isMuted } from './inboxView.js';
 import { devObserverOn, DEV_OBSERVER_REFUSAL } from './devObserver.js';
 import { mindLines, mindErrorLines, mindHelpLines, MIND_HELP_ARGS } from './mind.js';
 import { packageVersion } from './welcome.js';
@@ -59,7 +66,8 @@ import { modeReply, normMode, PLAN_GO, MODES, MODE_ROWS } from './mode.js'; // P
 import { echoLine } from './echo.js';
 import { inviteText, cleanName, loadNames, saveName, pickNamed, matchAgent, uniqueSquash, resolveSayTarget, addressLabel, sayMissText, looksLikeAddress, sayWhoText, parseTarget, nearest, listFailure, slotsTable } from './session.js';
 import { pushHistory } from './promptHistory.js';
-import { termRows } from './term.js';
+import { secretKinds, redactSecrets } from './secretShape.js';
+import { termRows, liveCols } from './term.js';
 import { cardTallerThanScreen } from './objects/view.js';
 import { createConnectController, connectionLines, connectOfferFor, looksLikeKey, keyWarning, providerFor, parseOllamaArg, connectOllamaFlow, ollamaModelRows, connectCompatFlow, compatModelRows, confirmLanAllow } from './connect.js';
 import { ConnectCard } from './connectCard.js';
@@ -68,8 +76,9 @@ import { createLoginController, LoginCard, SIGNED_OUT_LINE, signedOutCard, isSes
 import { createStepUp } from './slash/stepUp.js';
 import { StepUpCard, PresentBar } from './slash/stepUpCard.js';
 import { createStepUpCmds, declinedText } from './slash/stepUpCmds.js';
+import { createConfirm } from './slash/confirm.js';
 import { isConsentError, consentHintLines, consentStatusLines } from './consent.js';
-import { CHOICES, modelLines, selectModel, selectOllamaModel, selectCompatModel, adoptAfterConnect, selectDiscoveredModel, selectSubscriptionModel, modelLabel, fallbackNote, streamFields, normChoice } from './model.js';
+import { CHOICES, modelLines, selectModel, selectOllamaModel, selectCompatModel, adoptAfterConnect, selectDiscoveredModel, selectSubscriptionModel, limitedOffer, modelLabel, fallbackNote, streamFields, normChoice } from './model.js';
 import { humanSessionLines } from '../core/sessionsOverview.js';
 import { activeLines, activeRows, ACTIVE_KINDS } from '../core/activeSummary.js';
 import { capabilityLines, offerFor, findCapability } from './capabilities.js';
@@ -90,7 +99,7 @@ import { parseBroadcastText } from './slash/broadcast.js';
 import { isOwnBroadcast } from './ownBroadcast.js';
 import { orgLabel, isOrgId } from './orgLabel.js';
 import { enrichPlanItem } from './planSteps.js';
-import { parseRoomSend, roomName, roomLine, senderName, parseAtSend, senderLabel, slotLine, slotOfHolder, decodeEntities, fileMessage, prepareFile, createSlotListener, createReplyWatches, isHolderLine, loadLastSlot, saveLastSlot, presenceLine } from './slotChat.js';
+import { parseRoomSend, roomName, roomLine, senderName, parseAtSend, senderLabel, slotLine, slotOfHolder, withSenderSlot, decodeEntities, fileMessage, prepareFile, createSlotListener, createReplyWatches, isHolderLine, loadLastSlot, saveLastSlot, presenceLine, reattachSlowLine } from './slotChat.js';
 import { homedir as osHome } from 'node:os';
 import { createRowCmd } from './slash/rowCmd.js';
 import { createKillerCmds } from './slash/killer.js';
@@ -98,7 +107,8 @@ import { createUndoWish } from './slash/undoWish.js';
 import { createHatWalk } from './slash/hatWalk.js';
 import { createRowEngine, runShell } from './rows.js';
 import { qpeCommand, qpeRowsSetting, QPE_GRID } from './slash/qpeCmd.js';
-import { createExtensionHost, pickDraft as deckPickDraft, readExtList, extSetEnabled, extAdd } from './extensions.js';
+import { deckOffer, runDeckOffer, declineText } from './deckLazy.js';
+import { createExtensionHost, pickDraft as deckPickDraft, readExtList, extSetEnabled, extAdd, panelKeyName } from './extensions.js';
 import { createLoopCards, rowsWithoutLoopCards } from './loopCards.js';
 import { initLoop, applySnapshot as applyLoopSnapshot, cardLines } from './loopCard.js';
 import { createCompanionController, companionCommand, DragonCompanionLive, takeGreeting, detachGreeting } from './dragonCompanion.js';
@@ -122,6 +132,8 @@ import { supportsHyperlinks } from './markdown.js';
 import { compactResult, compactError, contextFacts, compactShowLines } from './slash/compact.js';
 import { intentPanel } from './intent.js';
 import { awayDue, parseSince } from './away.js';
+import { parseSlashArgs as parseCallMeSlashArgs, statusLines as callMeStatusLines } from '../core/callMe.js';
+import { parseDndArgs, untilEpoch, sleepIntent, afkMeansSleep, newCollected, morningLines, waitingCount, DND_NOTE } from './dnd.js';
 import { sitrepData } from './objects/sitrep.js';
 import { mirrorErrorNote } from './objects/mirror.js';
 import { launchEgg } from './egg.js';
@@ -130,12 +142,17 @@ import { Clock, FRAME_MS, SECOND_MS, motionAllowed, createFrames } from './motio
 import { FrameContext, useFrame } from './motion/frame.js';
 import { ringMode, ringAnimating } from './motion/ring.js';
 import { TIMING, revealSpan } from './motion/reveal.js';
-import { matchOrg, orgLines, orgRows } from './orgSwitch.js';
+import { matchOrg, orgLines, orgRows, orgCandidates } from './orgSwitch.js';
 import { INSTALL_TOOLS, SUGGEST_LINE, planLine, offerQuestion, runInstall, missingTools } from './installCli.js';
 import { matchHat, hatLines, hatChoices, isPrivileged as hatIsPrivileged, mintConversationId } from './hatSwitch.js';
+import { slotOutbox, isConnectivityFailure, queuedLine, sentLine, fullLine } from './slotOutbox.js';
 import { isServerDown, waitForServer, SERVER_RESTARTING, explainTermination, RETRY_HINT, isResumeRetryable, RESUME_RETRY_DELAYS, RESUME_RECONNECTING } from './resend.js';
+import { gripeFiledLine, gripeFailedLine, gripeQueuedFiledLine } from '../core/quoxglyph.js';
+import { crossOrgTuiLines } from '../core/crossOrgApprovals.js';
+const gripeLead = '📣 GRIPE │';
 
 const h = React.createElement;
+const BARE_COMMAND_WORDS = new Set(['clear', 'exit', 'quit', 'help', 'back', 'detach', 'restart', 'inbox', 'approvals']); // a message that is exactly one of these is offered as the command first
 const PASTE_GUARD_MS = 40;
 const ASK_ECHO_MS = 1500; // TUI-INPUT: how long an Enter after a single-key ask answer is treated as the confirm habit
 const MAX_ROSTER = 4;
@@ -169,8 +186,14 @@ export const friendlyError = (e, profile) =>
 const byId = (id) => CHOICES.find(x => x.id === id) || null;
 // the status line shows the new ask until the server answers
 const NO_RAN = { provider: null, model: null, endpoint: null };
+// /gripe keeps the newlines of what was pasted: the whole body goes into the issue, not a space-joined line.
+const GRIPE_LINE = /^\/gripe!?(\s|$)/i;
+const isOneLineCommand = (t) => t.startsWith('/') && (!t.includes('\n') || GRIPE_LINE.test(t));
 
-export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTimeoutMs = 120000, rosterMs = 15000, api: apiProp, profile: profileProp = 'default', org = null, version = '0.1.0', cwd = '', columns, demoLabel = null, verbose = 'on', mode = 'ask', editor = openEditor, introNote = null, animateIntro, earlyInput = null, startup = null, blocked: blockedProp = null, signedOut: signedOutProp = null, autoplay = null, rules = null, welcome = false, sessionName = null, invite = false, slotsAvailable = true, namesPath, transcript = null, modelChoice = null, resumeConversation = null, resume = null, restartSlot = null, restartAttach = null, slotRetryDelays = [2000, 5000, 10000, 20000, 30000], resumeRetryDelays = RESUME_RETRY_DELAYS, onRestart = null, onDemo = null, healthRecheck = null, healthRecheckDelays = [5000, 10000, 20000, 40000, 60000], restartCheck = null, updater = null, startSha = null, buildWatch = startBuildWatch, autoRestartMs = null, autoTickMs = 1000, serverProbe = null, serverPollMs = SERVER_WAIT_EVERY_MS, serverWaitMs = SERVER_WAIT_MAX_MS, env = process.env, motion, motionStats = null, away = null, tipStartup = false, whatsNewStartup = false, interactive, resendDelays = null, demoAuto = null, agentLogin: agentLoginProp = false, humanProfiles = [], switchProfile = null, loginCandidates = [], slotRecordPath = undefined, spawnStatePath = undefined, noReplyMs = 90000, replyWatchMs = 30 * 60 * 1000, historyStore = null, runSpawn = spawnSync, runHandOverDelayMs = 60, mouseScreen = null, runNow = Date.now, whatsNewEntries = undefined }) {
+export const INBOX_BAR_MAX_MS = 300000; // the bar never waits longer than this between reads
+export const INBOX_BAR_COST_X = 20;     // wait 20x the last read's duration (a 3s read -> 60s; a fast read keeps the poll cadence)
+
+export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTimeoutMs = 120000, rosterMs = 15000, api: apiProp, profile: profileProp = 'default', org = null, version = '0.1.0', cwd = '', columns, demoLabel = null, verbose = 'on', mode = 'ask', editor = openEditor, introNote = null, animateIntro, earlyInput = null, startup = null, blocked: blockedProp = null, signedOut: signedOutProp = null, autoplay = null, rules = null, welcome = false, sessionName = null, invite = false, slotsAvailable = true, namesPath, transcript = null, modelChoice = null, resumeConversation = null, resume = null, restartSlot = null, restartAttach = null, restartDeclined = null, slotRetryDelays = [2000, 5000, 10000, 20000, 30000], resumeRetryDelays = RESUME_RETRY_DELAYS, onRestart = null, onDemo = null, healthRecheck = null, healthRecheckDelays = [5000, 10000, 20000, 40000, 60000], startupGraceMs = 60000, startupRetryMs = 3000, neverAnswered = false, onConnect = null, restartCheck = null, updater = null, startSha = null, buildWatch = startBuildWatch, autoRestartMs = null, restartCooloffMs = null, presenceRetryDelays = [2000, 5000, 10000, 20000, 30000, 60000], presencePollMs = 30000, autoIdleMs = null, autoTickMs = 1000, autoResumeMs = 3000, serverProbe = null, serverPollMs = SERVER_WAIT_EVERY_MS, serverWaitMs = SERVER_WAIT_MAX_MS, env = process.env, motion, motionStats = null, away = null, tipStartup = false, whatsNewStartup = false, interactive, resendDelays = null, demoAuto = null, agentLogin: agentLoginProp = false, startupSwitchOffer = false, humanProfiles = [], switchProfile = null, loginCandidates = [], slotRecordPath = undefined, outboxPath = undefined, spawnStatePath = undefined, noReplyMs = 90000, replyWatchMs = 30 * 60 * 1000, historyStore = null, runSpawn = spawnSync, runHandOverDelayMs = 60, mouseScreen = null, runNow = Date.now, whatsNewEntries = undefined }) {
   // Z2H: signed-out is ONE state (card at the top + /login), not scattered errors. While it holds, `blocked` is the
   // one-line answer, so chat, /connect and the digest/approvals pollers stay quiet instead of printing raw 401s.
   // PROFILE-SWITCH (owner 2026-10-16): the window's api is swappable in place (profileSwitch.js liveApi); `who` is the
@@ -196,12 +219,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   const exit = (afterMs = 0) => {
     const R0 = R.current;
     if (R0.exiting) return undefined;
-    try { DK.current?.unloadAll(); } catch { /* closing the deck never blocks exit */ }
+    let extClosing = null;
+    try { extClosing = DK.current?.unloadAll(); } catch { /* closing the deck never blocks exit */ } // async close() is awaited up to 500 ms
     R0.exiting = true; R0.sleep = null; R0.fly = null;
     R0.bang?.run.kill(); // QUOXON-FW8: a running ! command is killed with us, never left behind
     resetDragon();
     bump(n => n + 1);
-    return setTimeout(() => inkExit(), 60 + afterMs);
+    return setTimeout(() => { Promise.resolve(extClosing).then(() => inkExit(), () => inkExit()); }, 60 + afterMs);
   };
   const [epoch, setEpoch] = React.useState(0);
 
@@ -246,7 +270,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // Drop-in reveals: history items enter <Static> only once their reveal has ended (at most ~1 s); until then
   // they render in the live region. committedRef = how many history items <Static> has been given.
   const committedRef = React.useRef(introAnimating ? 0 : S.current.history.length);
-  const staticRef = React.useRef({ list: [], seen: 0, deferred: [] }); // what <Static> was given: committed items in order, minus loop cards still running (they join when they settle)
+  const staticRef = React.useRef({ list: [], seen: 0, deferred: [], epoch: 0 }); // what <Static> was given: committed items in order, minus loop cards still running (they join when they settle)
   const fxRef = React.useRef(new Map()); // item id -> { at, timing, running, settleAt }
   const rosterSeen = React.useRef(new Map()); // roster row key -> first seen (ms)
   const K = React.useRef({ keys: initialKeyState(), lastKeyAt: null, lastKeyCh: null, lastDataAt: 0, lastPasteAt: 0, lastEscAt: 0, ctrlC: 0, guard: null, dismissed: new Set(), cardFocus: false, confirm: false, cardGoneAt: 0, typed: '', danglingTimer: null });
@@ -255,7 +279,8 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   const R = React.useRef({ abort: null, histIdx: -1, history: [], stash: [], reviewing: false, fallbackTimer: null, ctrlCTimer: null, banner: null, closed: false, pollTimers: new Set(), caps: { steer: true, interrupt: true }, confirmMulti: null, roster: { rows: [], all: false, allRows: [], alerts: [], sources: null, on: true, focus: false, sel: 0, peek: false, confirm: null, stopping: false } });
   // QUOXON-HISTORY: Up recalls what was typed in earlier runs too (most recent first); main.js passes the file store.
   if (!R.current.histLoaded) { R.current.histLoaded = true; try { R.current.history = historyStore?.load?.() || []; } catch { R.current.history = []; } }
-  const remember = (t) => { if (pushHistory(R.current.history, t)) { try { historyStore?.add?.(t); } catch { /* history is a convenience */ } } };
+  // remember: a /verify-email line with a 6-digit run (a PIN typed by mistake) is stored as the verb only
+  const remember = (t0) => { const t = /^\/verify-email(\s|$)/i.test(String(t0).trim()) && /(^|\D)\d{6}(\D|$)/.test(String(t0)) ? '/verify-email' : redactSecrets(t0); if (pushHistory(R.current.history, t)) { try { historyStore?.add?.(t); } catch { /* history is a convenience */ } } };
   // E5: when this profile was last seen (read once at launch, before it is refreshed), and a throttled touch.
   const AWAY = React.useRef({ last: null, touched: 0 });
   const touchSeen = (force = false) => {
@@ -267,10 +292,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
 
   const SND = React.useRef(null); SND.current ??= createSound({ api, stdout }); // QuoxSound: one subscription point (dispatch)
   /** QUOXON-FW15: the one card shown: the oldest waiting approval (this conversation first, then other sessions/plugins) not dismissed with Tab. */
-  const queueOf = (st) => { const all = orderApprovals([...st.approvals, ...st.waiting], LC.current.all().map((c) => c.id)); const live = new Set(all.map(x => x.callId)); for (const id of K.current.dismissed) if (!live.has(id)) K.current.dismissed.delete(id); return all.filter(x => !K.current.dismissed.has(x.callId)); };
+  const queueOf = (st) => { const all = orderApprovals([...st.approvals, ...st.waiting], LC.current.all().map((c) => c.id)); const live = new Set(all.map(x => x.callId)); for (const id of K.current.dismissed) if (!live.has(id)) K.current.dismissed.delete(id); if (AWAY.current.afk) return []; /* AFK-QUIET-CARDS: away = no card, no armed answer keys; the count rides the notify bar until /back */ return all.filter(x => !K.current.dismissed.has(x.callId)); };
   const headCard = (st) => queueOf(st)[0] || null;
   const SCX = React.useRef(null); SCX.current ??= createScreenContext(); // SCREEN-CONTEXT: the events ring + changed-only bookkeeping for the terminal block
   const dispatch = (a) => {
+    // A slash command whose request failed for want of a user session: one signed-out line plus the single
+    // sign-in offer (never the plain-CLI service-key paragraph). Covers every command's error path.
+    if (a.type === 'error' && NO_SESSION_RE.test(String(a.text || ''))) { noSessionAnswer(); return; }
     if (a.type === 'note') SCX.current.notice(a.text, a.tone);
     else if (a.type === 'error') SCX.current.error(a.text);
     else if (a.type === 'event' && a.ev) {
@@ -278,8 +306,9 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       else if (a.ev.type === 'turn.finished' && a.ev.status && !['ok', 'success', 'completed'].includes(a.ev.status)) SCX.current.failedTurn(a.ev.status);
     }
     transcript?.action(a.redact !== undefined ? { ...a, text: a.redact } : a); // dev transcript capture (off by default; see transcript.js); `redact` is what the capture sees instead of a secret-bearing text
-    const prevS = S.current; S.current = reduce(prevS, { now: Date.now(), ...a }); SND.current.observe(prevS, S.current, a);
-    if (motionOn && !mono() && feats().moods) { const m = DC.current.moodFor(prevS, a, S.current); if (m) playDragon(m); } // cinematic: the dragon reacts (one moment engine: an attached companion owns the moment instead, dragonMoments.js)
+    const prevS = S.current; S.current = reduce(prevS, { now: Date.now(), ...a }); if (!AWAY.current.afk) SND.current.observe(prevS, S.current, a); // DND: no sound while away
+    if (!AWAY.current.afk && motionOn && !mono() && feats().moods) { const m = DC.current.moodFor(prevS, a, S.current); if (m) playDragon(m); }
+    if (!AWAY.current.afk && (S.current.waiting?.length || 0) > (prevS.waiting?.length || 0)) DC.current.waitingCards(prevS, S.current).then((shown) => { if (shown) bump(n => n + 1); }, () => {}); // another session's approval from a dragon agent: its dragon (the Q dragon only reacts to this conversation's cards, so never two) // cinematic: the dragon reacts (one moment engine: an attached companion owns the moment instead, dragonMoments.js)
     // Per shown card: remember the key that was already down when it appeared, and restart the typed word.
     const c0 = headCard(S.current);
     if (!c0 && K.current.guard) K.current.cardGoneAt = Date.now();
@@ -297,6 +326,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // (never printed to scrollback while open); reconcileAsks settles it to one line once it is no longer open.
   const askSeq = React.useRef(0);
   const say = (text, tone) => {
+    R.current.spinStop?.(); // INSTANT-FEEDBACK: the first printed line replaces the spinner
     if (tone !== 'ask') return dispatch({ type: 'note', text, tone });
     const id = `ask-${++askSeq.current}`;
     R.current.lastAsk = { text, question: askQuestion(text), id };
@@ -349,10 +379,23 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   const CN = React.useRef(null);
   CN.current ??= createConnectController({ api, note: (t, tone) => say(t, tone), emit: (a) => dispatch(a), refresh: () => bump(n => n + 1) });
   // /login card: email (prefilled), masked password, MFA code if asked. Same login path as `quox login`.
-  const markSignedOut = (reason = null) => { if (BL.current) return; setSignedOut({ reason }); say(signedOutCard(profile, reason), 'error'); };
+  // Signed out: offer the fix as y/N (y = the same flow as /login), not only instruct. Same 2-minute ask window as the other offers.
+  const offerSignIn = () => { R.current.loginAsk = { at: Date.now() }; say(askText('Sign in now?', { title: `Signed out of ${profile}.`, action: 'open the sign-in card (same as /login)' }), 'ask'); };
+  // Once per sign-out: a ref (not state) so concurrent polls in one tick and the stale-credentials retry cannot re-announce.
+  const soNoticed = React.useRef(Boolean(signedOutProp));
+  const NO_SESSION_RE = /No authentication token|QUOX_SERVICE_KEY|service key|valid jwt|session expired|not signed in/i;
+  const noSessionAnswer = () => {
+    const first = !soNoticed.current;
+    setSignedOut(signedOutRef.current || { reason: null }); soNoticed.current = true;
+    say(SIGNED_OUT_LINE, 'error');
+    const live = R.current.loginAsk && Date.now() - R.current.loginAsk.at < 120000;
+    if (first && !live) offerSignIn();
+  };
+  const markSignedOut = (reason = null) => { if (BL.current) return; setSignedOut({ reason }); if (soNoticed.current) return; soNoticed.current = true; say(signedOutCard(profile, reason), 'error'); offerSignIn(); };
+  React.useEffect(() => { if (signedOutProp) offerSignIn(); }, []); // a window that started signed out gets the same offer
   const LI = React.useRef(null);
   LI.current ??= createLoginController({ api, note: (t, tone) => say(t, tone), refresh: () => bump(n => n + 1), onSignedIn: () => {
-    setSignedOut(null); BL.current = blockedProp || null;
+    R.current.loginAsk = null; soNoticed.current = false; setSignedOut(null); BL.current = blockedProp || null;
     R.current.notify = { fails: 0, authLost: false };
     dispatch({ type: 'notify', patch: { error: null } });
     refreshNotify(); refreshRoster();
@@ -361,9 +404,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // QUOXON-STEPUP: the PIN card. The digits live in its closure box only: never dispatched, buffered, in history,
   // undo, the transcript or any log. Agent logins never get a PIN field (slash/stepUp.js).
   const SU = React.useRef(null);
+  const AO = React.useRef(null); AO.current ??= { st: createAutoOpen({ enabled: autoOn(api.settings?.()) }), timer: null, noticeAt: 0, othersDone: false, otherCounts: new Map(), waitSaid: false, dead: false }; // APPROVALS-AUTO: new approvals open by themselves
   SU.current ??= createStepUp({ api, agentLogin: () => WHO.current.agentLogin, onAgentLogin: () => offerSwitch(), refresh: () => bump(n => n + 1), note: (t, tone) => say(t, tone), emit: (a) => dispatch(a), settingsUrl: async () => { try { const b = await api.dashboardBase?.(); return b ? `${String(b).replace(/\/$/, '')}/settings` : null; } catch { return null; } } });
   const SUC = React.useRef(null);
-  SUC.current ??= createStepUpCmds({ api, stepUp: SU.current, say: (t, tone) => say(t, tone), lastBlock: () => R.current.lastBlock || null, orgOf: () => api.orgId?.() || null });
+  SUC.current ??= createStepUpCmds({ api, stepUp: SU.current, say: (t, tone) => say(t, tone), confirm: createConfirm({ say: (t, tone) => say(t, tone) }), lastBlock: () => R.current.lastBlock || null, orgOf: () => api.orgId?.() || null });
   // L0 palette: opens under the composer while the draft is a bare /word (slash/paletteController.js).
   const PL = React.useRef(null);
   // QUOXON-FW6: model favourites + default (server-side user preferences; profile = cache).
@@ -397,6 +441,20 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   const SPN = React.useRef(null);
   SPN.current ??= createSpawnCmd({ api, say: (t, tone) => say(t, tone), session: () => SN.current.name || S.current.ctx.conversationId || 'quox', from: () => senderLabel({ slot: where.current.slot || null, display: myDisplay() }), statePath: spawnStatePath });
   React.useEffect(() => { if (!blocked && !demoLabel && api.slotSay) SPN.current.sweep().catch(() => {}); }, []); // release this session's overdue VMs
+  // GRIPE-QUEUE: gripes saved while Quox did not answer are filed on start and then at most once per 2 minutes (the queue itself enforces the gap).
+  const gripeSweep = React.useRef(null);
+  gripeSweep.current = async (force = false) => {
+    if (!api.gripeRetry) return;
+    let r; try { r = await api.gripeRetry({ force }); } catch { return; }
+    for (const it of r?.filed || []) say(gripeQueuedFiledLine(it.url));
+    for (const it of r?.expired || []) say(`Gripe not filed after 24 h, giving up: "${clip(it.text, Math.max(20, cols - 50))}" (re-file it with /gripe!)`, 'warn');
+  };
+  React.useEffect(() => {
+    if (blocked || demoLabel || !api.gripeRetry) return undefined;
+    gripeSweep.current();
+    const t = setInterval(() => gripeSweep.current(), 125000);
+    return () => clearInterval(t);
+  }, []);
   // QUOXON-FW17: custom rows above the status line (rows.js engine, slash/rowCmd.js).
   const RW = React.useRef(null);
   RW.current ??= createRowCmd({
@@ -414,15 +472,21 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     env,
     getSettings: () => api.settings?.() || {},
     handlers: {
-      openApproval: (n) => { command(`/approvals ${n}`); },
-      preselect: (n, option) => {
+      openApproval: (n, id) => {
+        if (id != null) { const i = (R.current.deckItems || []).findIndex(x => String(x?.id) === id); if (i < 0) return false; n = i + 1; } // contract v1: the id decides, a gone id is refused
+        command(`/approvals ${n}`);
+        return true;
+      },
+      preselect: (n, option, id) => {
+        if (id != null) { const i = (R.current.deckItems || []).findIndex(x => String(x?.id) === id); if (i < 0) return false; n = i + 1; }
         const it = (R.current.deckItems || [])[n - 1];
         const draft = deckPickDraft(it, n, option);
         if (!draft) return say(`Extension: no such option "${option}" for [${n}].`, 'warn');
         edit({ type: 'set', text: draft }); // preselected only: the answer goes when the user presses Enter
         say(`Preselected: ${draft.trim()}. Press Enter to confirm.`, 'accent');
       },
-      changed: () => bump(n => n + 1)
+      note: (t, tone) => say(t, tone),
+      changed: () => { setExtEntries(DK.current.commands()); bump(n => n + 1); }
     },
     log: () => {}
   });
@@ -454,6 +518,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       loops: LC.current.all().map(c => ({ id: c.state.id, title: c.state.title, turn: c.state.iteration ?? c.state.turn, max: c.state.maxTurns, status: c.state.done ? (c.state.state === 'failed' ? 'failed' : 'done') : 'running' })),
       fleet: R.current.fleetHosts || null,
       evidence: api.evidenceChain?.() || null, // quoxon holds no chain status today: 'unknown' unless the api provides one
+      readOkAt: (R.current.readOkAt ??= Date.now()), // last good approvals read: older than 60 s makes state.stale
       sessions: { active: rows.filter(r => r.state === 'running').length }
     });
   });
@@ -461,7 +526,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     getDraft: () => B.current.text, setDraft: (t) => edit({ type: 'set', text: t }),
     run: (t) => { remember(t); command(t); }, say: (t, tone) => say(t, tone),
     ctx: () => ({ api, caps: R.current.contract, blocked: BL.current }),
-    source: createArgSources({ api, getPrefs: () => MP.current.prefs, getRows: () => RW.current?.all() }),
+    source: createArgSources({ api, getPrefs: () => MP.current.prefs, getRows: () => RW.current?.all(), getInbox: () => ({ list: () => R.current.inboxList || [], mutes: () => (api.settings?.() || R.current.sessionSettings || {}).inboxMutes }), getExt: () => ({ listed: () => readExtList().map(x => x.name), loaded: () => DK.current.loadedNames(), panels: () => DK.current.panels(), keys: (n) => DK.current.settingsInfo(n).defs || [] }) }),
     refresh: () => bump(n => n + 1),
     // MENTIONS: agents, hosts and tasks fetched once per session on the first @; receipts are this session's own tool envelopes
     mentions: blocked ? null : { cache: createMentionCache({ load: () => loadMentions(api), refresh: () => bump(n => n + 1) }), local: () => receiptMentions([...S.current.history, ...S.current.blocks]) }
@@ -481,7 +546,12 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   }, []);
   const LG = React.useRef(null); LG.current ??= createLedger(); // /cost, /context: real usage only
   // /restart auto: saved per profile (profile.quoxon.restartAuto). `newId` = the newest installed build seen; `cancelledId` = the build whose countdown a key cancelled.
-  const AR = React.useRef(null); AR.current ??= { on: (api.settings?.() || {}).restartAuto === true, newId: null, cancelledId: null, timer: null, endsAt: 0 };
+  const AR = React.useRef(null); AR.current ??= { on: (api.settings?.() || {}).restartAuto === true, newId: null, cancelledId: null, timer: null, endsAt: 0, busyAt: 0, lastRestartAt: Number((api.settings?.() || {}).lastRestartAt) || 0, quietId: null, mountedAt: Date.now() };
+  // COALESCE (owner 2026-10-27): after a restart, no auto-restart for a cool-off (prop, else setting restartCooloffMin, else 30 min); a build landing
+  // inside it shows one quiet line (Enter restarts); afterwards the countdown also waits for autoIdleMs (default 2 min) without a keypress.
+  const cooloffMs = () => { if (restartCooloffMs != null) return restartCooloffMs; const m = (api.settings?.() || {}).restartCooloffMin; return (m != null && Number.isFinite(Number(m)) && Number(m) >= 0 ? Number(m) : 30) * 60000; };
+  const idleNeededMs = () => autoIdleMs ?? 120000;
+  const inCooloff = () => AR.current.lastRestartAt > 0 && Date.now() - AR.current.lastRestartAt < cooloffMs();
   // Countdown length: the autoRestartMs prop (tests), else QUOX_RESTART_COUNTDOWN seconds (default 10; 0 = restart at once).
   const countdownMs = () => { if (autoRestartMs != null) return autoRestartMs; const n = Number(env.QUOX_RESTART_COUNTDOWN); return (env.QUOX_RESTART_COUNTDOWN != null && env.QUOX_RESTART_COUNTDOWN !== '' && Number.isFinite(n) && n >= 0 ? n : 10) * 1000; };
   const cdLog = (phase, seconds = null) => transcript?.action({ type: 'restart.countdown', phase, seconds, build: AR.current.newId }); // lifecycle in the dev transcript
@@ -495,6 +565,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const token = {}; a.waiting = token; // set first: cancels and the idle check see a restart in flight
     Promise.resolve().then(() => serverUp()).catch(() => null).then((first) => {
       if (AR.current.waiting !== token || R.current.closed) return;
+      if (!autoIdle()) { stopCountdown(); cdLog('held'); bump(n => n + 1); return; } // a turn started while the health probe ran: never kill it
       if (first?.ok === true) { stopCountdown(); cdLog('timed-out'); doRestart(); return; } // healthy: no waiting line, as before
       beginWait(token);
     });
@@ -517,15 +588,22 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   } }) : undefined), []);
   const autoIdle = () => { // nothing for a restart to interrupt
     const s = S.current;
-    return !s.turn && !s.approvals.length && !s.pending.length && B.current.text === '' && !R.current.pendingWalk && !R.current.bang && !R.current.sleep
+    // AWAY-RESTART (2026-11-03): away/DND is the ideal time to restart (nothing to interrupt, DND restores from the server), so the dragon
+    // sleep screen (/sleep opens it) and approvals queued for the morning (cards are closed while away) do not count as busy.
+    const isAway = Boolean(AWAY.current.afk);
+    return !s.turn && (isAway || !s.approvals.length) && !s.pending.length && B.current.text === '' && !R.current.pendingWalk && !R.current.bang && (isAway || !R.current.sleep)
       && !R.current.restarting && !R.current.exiting && !LI.current.isOpen() && !SU.current.isOpen() && !CN.current.isOpen() && !PK.current.isOpen() && !blocked;
   };
   React.useEffect(() => {
     const id = setInterval(() => {
       const a = AR.current;
-      if (!a.on || !a.newId || a.newId === a.cancelledId || R.current.restarting || (a.waiting && !a.timer)) return;
+      if (!autoIdle() && B.current.text === '') a.busyAt = Date.now(); // a turn, approval or modal is open: the restart resumes autoResumeMs after it clears (composer text just holds while present)
+      if (!a.on || !a.newId || a.newId === a.cancelledId || R.current.restarting) return;
+      if (!a.timer && !a.waiting && inCooloff()) { if (a.quietId !== a.newId) { a.quietId = a.newId; say('↻ new version ready · Enter on an empty composer to restart', 'dim'); } return; } // coalesced: one quiet line, no countdown
+      if (!a.timer && !a.waiting && a.lastRestartAt > 0 && Date.now() - (K.current.lastKeyAt ?? a.mountedAt) < idleNeededMs()) return; // cool-off over: wait for a quiet window
+      if (a.waiting && !a.timer) { if (!autoIdle()) { stopCountdown(); cdLog('held'); bump(n => n + 1); } return; } // health probe in flight: a turn that started meanwhile cancels the restart
       if (a.timer) { if (!autoIdle()) { stopCountdown(); cdLog('held'); bump(n => n + 1); if (R.current.pendingWalk) say('Restart held: it waits until the walkthrough ends.', 'dim'); } else bump(n => n + 1); return; } // ticks the visible countdown
-      if (!autoIdle()) return;
+      if (!autoIdle() || Date.now() - a.busyAt < autoResumeMs) return;
       const ms = countdownMs();
       if (ms <= 0) { cdLog('timed-out', 0); autoFire(); return; }
       a.endsAt = Date.now() + ms;
@@ -569,6 +647,8 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const att = SN.current.agent ? `agent:${SN.current.agent}` : null;
     if (t.id !== curId) R0.prevOrg = curId ? { id: curId, name: R0.orgName ?? org ?? curId } : null; // /org back returns here
     R0.orgId = done.id; R0.orgName = done.name;
+    R0.inboxEpoch = (R0.inboxEpoch || 0) + 1; R0.inboxSeen = null; R0.inboxList = []; R0.inboxAt = 0; // re-baseline: the new org's existing unread are not arrivals
+    dispatch({ type: 'notify', patch: { inboxBar: '' } });
     dispatch({ type: 'ctx', ctx: { conversationId: null } });
     SN.current.name = null; SN.current.saved = null;
     dispatch({ type: 'history.reset' });
@@ -595,7 +675,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         ask(`Reattach to slot ${nm}?`, { action: `/slot ${nm} --take` });
         return;
       }
-      if (i === 0) say(`slot ${nm}: reattaching after the restart is slow (${r.message}); retrying.`, 'dim');
+      if (i === 0) say(reattachSlowLine({ slot: nm, message: r.message, restartSeenAt: R.current.restartSeenAt, lastGoodAt: R.current.lastGoodAt }), 'dim');
       await new Promise((res) => { const t = setTimeout(res, slotRetryDelays[i]); t.unref?.(); });
     }
   }
@@ -606,7 +686,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     return () => clearInterval(id);
   }, []);
   // ---- QUOXON-MESH: slot chat (slotChat.js) ----------------------------------------------------------------
-  // Dragon companion (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher): attach state + real stream events; art and reducer live in dragonlab.
+  // Dragon companion (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus): attach state + real stream events; art and reducer live in dragonlab.
   const DC = React.useRef(null); DC.current ??= createCompanionController({ settings: () => api.settings?.() || {}, isTTY: Boolean(stdout?.isTTY), typing: () => B.current.text !== '', jobs: createDragonJobs({ reads: api.dragonReads || {}, context: () => ({ envelopeId: receiptMentions([...S.current.history, ...S.current.blocks])[0]?.value || null }) }) }); // each dragon's one job: a real read (dragon/jobs.js)
   const dispatchEv = (a) => { DC.current.tap(a); dispatch(a); };
   // QLOOP-LIVE: live loop cards in the chat stream (loopCards.js). A card is held live (commitLimit) until its loop finishes.
@@ -625,9 +705,9 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       open: (q, signal) => api.slotStream(nm, { since: q.since, excludeFrom: label }, signal),
       wait: api.slotWait ? ({ since }) => api.slotWait(nm, { since, excludeFrom: label }) : null,
       onMessage: (m0) => {
-        // a broadcast carries the sender's session, not its slot: look the slot up so the header shows the reply address
-        if (m0.from_slot || !api.slots || !parseBroadcastText(m0.text)) return handle(m0);
-        Promise.resolve().then(() => api.slots()).then(rows => handle({ ...m0, from_slot: slotOfHolder(rows, m0.from) || undefined }), () => handle(m0));
+        // REPLY-ADDRESS: any message (say, broadcast, relayed) without a stamped from_slot gets its sender's held slot looked up
+        if (m0.from_slot || !api.slots) return handle(m0);
+        Promise.resolve().then(() => api.slots()).then(rows => handle(withSenderSlot(rows, m0)), () => handle(m0));
       },
       onState: (st) => {
         if (st.error && st.failures === 1 && !R.current.closed) { paused = true; streamPausedNote(`slot ${nm}`, st.error); }
@@ -640,9 +720,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         noteReply(m); noteSender(m);
         if (R.current.closed || SC.current.slot !== nm || (label && m.from === label)) return;
         if (isOwnBroadcast(m, { label, display: myDisplay(), userId: api.userId?.() || null })) return; // your own broadcast is not news: the "BROADCAST sent" card told you
-        { const ln = slotLine(m); const bc = parseBroadcastText(m.text); const rq = runRequest(m, { orgId: R.current.orgId ?? api.orgId?.() ?? null, now: runNow() }); if (rq) armRun(rq, ln); else dispatch({ type: 'slotmsg', line: bc ? { ...ln, urgent: bc.urgent, broadcast: true } : ln }); }
+        if (holdSlotMsg(m)) { rememberSender(m); return; } // DND: collected, no line, no bell, no run card
+        { const ln = slotLine(m); const bc = parseBroadcastText(m.text); const rq = runRequest(m, { orgId: R.current.orgId ?? api.orgId?.() ?? null, now: runNow() }); if (rq) armRun(rq, ln); else dispatch({ type: 'slotmsg', line: bc ? { ...ln, urgent: bc.urgent, broadcast: true } : ln });
+          DC.current.slotMessage(m, { broadcast: Boolean(bc), run: Boolean(rq) }).then((shown) => { if (shown) bump(n => n + 1); }, () => {}); } // a session with a dragon speaks to you: its dragon appears (dragonMoments.js sender moments; mode on, not while typing, cooled per sender)
         rememberSender(m);
-        if ((api.settings?.() || {}).slotBell !== 'off') { try { stdout?.write?.('\x07'); } catch { /* no tty */ } }
+        if ((api.settings?.() || {}).slotBell !== 'off' && !AWAY.current.afk) { try { stdout?.write?.('\x07'); } catch { /* no tty */ } }
       }
     }
     SC.current.listener = l; l.start({});
@@ -693,7 +775,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const wait = SC.current.waits ??= new Map();
     clearTimeout(wait.get(slot)); wait.delete(slot);
     if (p.listening) {
-      const t = setTimeout(() => { wait.delete(slot); if (!R.current.closed) say(`no reply from ${slot} yet`, 'warn'); }, noReplyMs);
+      const t = setTimeout(() => { wait.delete(slot); if (R.current.closed) return; const heard = SC.current.heard?.get(String(slot).toLowerCase()); if (heard && Date.now() - heard < 10 * 60000) return; say(`no reply from ${slot} yet`, 'dim'); }, noReplyMs);
       t.unref?.(); wait.set(slot, t);
     } else if (r.presence?.state === 'not_listening') {
       // Transcript fp 6a482d60fe83 (2026-10-16): an attached window got nothing for 4 minutes after "not listening".
@@ -718,8 +800,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       ttlMs: replyWatchMs,
       skipSlot: (nm) => nm === where.current.slot || SC.current.rooms?.has(nm),
       isMine: (m) => { const l = myLabel(); return Boolean(l && m?.from === l); },
-      onReply: (nm, m) => {
+      onReply: async (nm, m0) => {
         if (R.current.closed) return;
+        let m = m0;
+        if (!m0.from_slot && api.slots) { try { m = withSenderSlot(await api.slots(), m0); } catch { m = m0; } if (R.current.closed) return; }
         noteReply(m); noteSender(m);
         const ln = slotLine(m); const rq = runRequest(m, { orgId: R.current.orgId ?? api.orgId?.() ?? null, now: runNow() });
         if (rq) armRun(rq, ln); else dispatch({ type: 'slotmsg', line: ln });
@@ -733,6 +817,8 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   api.bindHolderSession?.(() => slotSession());
   /** Any inbound line from a slot we are waiting on cancels its "no reply" nudge. */
   function noteReply(m) {
+    const heard = SC.current.heard ??= new Map();
+    for (const k of [m?.from_slot, String(m?.from || '').split(' (')[0]]) if (k) heard.set(String(k).toLowerCase(), Date.now());
     const waits = SC.current.waits; if (!waits?.size) return;
     for (const [slot, t] of waits) if (isHolderLine(m, slot)) { clearTimeout(t); waits.delete(slot); } // case-insensitive: LUCID is the holder of lucid
   }
@@ -760,7 +846,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   }
   /** A dropped slot stream: a server restart (connection cut) is routine and says so calmly; anything else keeps the error. */
   function streamPausedNote(where, err) {
-    if (/terminated|ECONNRESET|ECONNREFUSED|socket hang up|fetch failed|other side closed|502|503/i.test(String(err || ''))) return say(`${where}: Quox server restarting, reconnecting (nothing is lost).`, 'dim');
+    if (/terminated|ECONNRESET|ECONNREFUSED|socket hang up|fetch failed|other side closed|502|503/i.test(String(err || ''))) { R.current.restartSeenAt = Date.now(); return say(`${where}: Quox server restarting, reconnecting (nothing is lost).`, 'dim'); }
     return say(`${where}: live messages paused (${err}); retrying.`, 'warn');
   }
   /** QUOXON-REPLY (owner 2026-10-15: "click the sender to reply"; no mouse tracking, so /r): who last messaged me. */
@@ -784,16 +870,69 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     for (const n of new Set(list.map(r => r.human_presence?.away && r.human_presence.notice).filter(Boolean))) lines.push(`⏸ ${n}`); // PRESENCE
     return say(lines.join('\n'));
   }
-  async function sendToSlot(slot, text) {
+  // ---- SLOT-OUTBOX: a send that failed because QuoxCORE did not answer is kept on disk and sent when it answers (slotOutbox.js) ----
+  const OB = React.useRef(null);
+  OB.current ??= slotOutbox(outboxPath);
+  const obProbe = React.useRef({ timer: null, i: 0 });
+  // Put text back in the prompt, in front of anything typed since (same shape as a failed steer).
+  const restoreDraft = (d) => { if (!d) return; const cur = B.current.text; edit({ type: 'set', text: cur ? `${d}\n${cur}` : d }); };
+  const noteAnswering = () => { // one "answering again" line, whichever probe saw it first
+    const t = Date.now(); if (t - (R.current.answeringAt || 0) < 5000) return;
+    R.current.answeringAt = t; say('✔ QuoxCORE is answering again', 'accent');
+  };
+  async function flushOutbox({ explicit = false } = {}) {
+    if (!api.slotSay) return { sent: [], failed: [], pending: 0 };
+    const r = await OB.current.flush(async (it) => {
+      const res = await api.slotSay(it.slot, it.text, { from: myLabel(), fast: true, fromSlot: where.current.slot || null });
+      if (res.ok) return { ok: true };
+      return { ok: false, retryable: isConnectivityFailure(res), error: res.message };
+    }, { profile, includeUnsure: explicit });
+    if (R.current.closed) return r;
+    for (const it of r.sent) say(sentLine(it.slot), 'ok');
+    for (const it of r.failed) say(`Queued message to ${it.slot} was refused (${it.error}); it stays in /outbox (drop it with /outbox drop N).`, 'warn');
+    if (r.pending > 0 && !r.busy) armOutboxProbe();
+    return r;
+  }
+  function armOutboxProbe() {
+    const P = obProbe.current;
+    if (P.timer || R.current.closed) return;
+    const delays = healthRecheckDelays?.length ? healthRecheckDelays : [5000];
+    P.timer = setTimeout(async () => {
+      P.timer = null;
+      if (R.current.closed) return;
+      let hl = null; try { hl = await (healthRecheck ? healthRecheck() : api.health?.(5000)); } catch { hl = null; }
+      if (R.current.closed) return;
+      if (hl?.ok) { P.i = 0; noteAnswering(); flushOutbox(); return; }
+      P.i = Math.min(P.i + 1, delays.length - 1);
+      armOutboxProbe();
+    }, delays[Math.min(P.i, delays.length - 1)]);
+  }
+  React.useEffect(() => {
+    if (blocked || demoLabel || !api.slotSay) return undefined;
+    const open = OB.current.list({ profile });
+    const queued = open.filter(i => i.status === 'queued').length, unsure = open.filter(i => i.status === 'unsure').length;
+    if (queued) { say(`⏸ ${queued} message${queued === 1 ? '' : 's'} queued from earlier: sending when QuoxCORE answers · /outbox`, 'warn'); flushOutbox(); }
+    if (unsure) say(`⏸ ${unsure} earlier message${unsure === 1 ? '' : 's'} may or may not have been delivered (the window closed mid-send). /outbox lists them; /outbox send retries.`, 'warn');
+    return () => { clearTimeout(obProbe.current.timer); obProbe.current.timer = null; };
+  }, []);
+  async function sendToSlot(slot, text, { draft = `/say ${slot} ${text}` } = {}) {
     const target = await sayTarget(slot, { senders: true });
     slot = target.slot;
     if (!api.slotSay) return say('Slots are not available in this mode.', 'warn');
     if (SC.current.rooms.has(slot)) return postRoom(slot, text); // a joined room posts as a member
     const r = await api.slotSay(slot, text, { from: myLabel(), fast: true, fromSlot: where.current.slot || null });
+    if (!r.ok && isConnectivityFailure(r) && !demoLabel) { // QuoxCORE did not answer: keep the message, never lose it
+      const q = OB.current.enqueue({ slot, text, profile });
+      if (q.ok) { obProbe.current.i = 0; say(queuedLine(slot, q.count), 'warn'); armOutboxProbe(); return undefined; }
+      say(q.full ? fullLine() : `slot ${slot}: ${r.message}. Could not save it to the outbox either; your text is back in the prompt.`, 'warn');
+      restoreDraft(draft); return undefined;
+    }
+    if (!r.ok) restoreDraft(draft); // a refusal (4xx, no such slot): show it and keep the text for editing
     if (!r.ok && r.status === 404 && api.slots) { let rows = []; try { rows = await api.slots(); } catch { /* the list is a hint only */ } return say(sayMissText(slot, rows), 'warn'); }
+    if (!r.ok && r.ambiguous) return say(r.message, 'warn');
     if (!r.ok) return say(`slot ${slot}: ${r.message}`, 'warn');
     R.current.lastSay = { slot, at: Date.now() }; // SAY-LAST-TARGET
-    if (r.viaOrgId) say(`${slot} lives in another of your orgs; sent there.`, 'dim');
+    if (r.viaOrgId) say(`${slot} lives in ${r.viaOrgName || 'another of your orgs'}; sent there.`, 'dim');
     const ln = slotLine({ from: slot, text, created_at: r.message?.created_at || new Date().toISOString() });
     dispatch({ type: 'slotmsg', line: { ...ln, glyph: '→', who: target.label || slot, file: null, out: true, delivered: true } });
     announceDelivery(slot, r);
@@ -828,10 +967,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       onMessage: (m) => {
         noteReply(m); noteSender(m);
         if (R.current.closed || !SC.current.rooms.has(nm) || isMine(m)) return;
+        if (holdSlotMsg(m, `#${nm}`)) { rememberSender(m); return; } // DND
         if (SC.current.active !== nm) entry.unread += 1; // before the dispatch, so the status line's count is current
         dispatch({ type: 'slotmsg', line: roomLine(nm, m) });
         rememberSender(m);
-        if ((api.settings?.() || {}).slotBell !== 'off') { try { stdout?.write?.('\x07'); } catch { /* no tty */ } }
+        if ((api.settings?.() || {}).slotBell !== 'off' && !AWAY.current.afk) { try { stdout?.write?.('\x07'); } catch { /* no tty */ } }
       },
       onState: (st) => { if (st.error && st.failures === 1 && !R.current.closed) streamPausedNote(`#${nm}`, st.error); },
     });
@@ -915,13 +1055,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       SC.current.pendingFile = { slot, f, at: Date.now() };
       return ask(`Send it to ${slot} with ${f.hits === 1 ? 'that' : 'those'} redacted?`, { action: `send ${f.name} to slot ${slot}, ${f.hits} value${f.hits === 1 ? '' : 's'} replaced by [redacted]`, reason: `${f.name} has ${f.hits} secret-shaped value${f.hits === 1 ? '' : 's'}.` });
     }
-    return sendToSlot(slot, fileMessage({ name: f.name, body: f.body, size: f.size }));
+    return sendToSlot(slot, fileMessage({ name: f.name, body: f.body, size: f.size }), { draft: null });
   }
   // Startup: the slot this profile last held in this directory, free or stale (or still under our old label), is offered once.
   React.useEffect(() => {
     if (blocked || demoLabel || restartSlot || !api.checkoutSlot || !api.slots) return;
     const rec = loadLastSlot({ profile, cwd: realCwd(), path: slotRecordPath });
     if (!rec) return;
+    if (restartDeclined && restartDeclined === rec.slot) return; // this window already said no; a restart must not re-ask (a fresh launch has no carry)
     api.slots().then((rows) => {
       const row = (Array.isArray(rows) ? rows : []).find(x => String(x.name) === rec.slot);
       if (!row || SC.current.slot || R.current.closed) return; // only this window's own checkout suppresses the ask, not an inherited one
@@ -975,6 +1116,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const shown = showWhatsNew();
     if (tipStartup && !welcome && !shown) showTip({ startup: true });
   };
+  React.useEffect(() => { // STARTUP OFFER: agent login + human logins on this machine => ask once to restart as the human
+    if (!startupSwitchOffer || blocked || demoLabel || R.current.startupSwitchOffered) return;
+    R.current.startupSwitchOffered = true;
+    offerStartupSwitch();
+  }, []);
   React.useEffect(() => { // LAZY-AI-CLI: first launch after setup: one line, then a y/N card per missing CLI (admins only; never a wall)
     if (blocked || !welcome || !api.providerCliStatus || !api.providerCliPlan) return;
     api.providerCliStatus().then(async (st) => {
@@ -999,7 +1145,9 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     // Only the live region repaints at the new width (R3 D2): the stdout proxy (term.js) erases the old frame
     // by its reflowed height, so no ghost composers, and history is never reprinted into scrollback.
     const onResize = () => setCols(clampCols((stdout.columns || 80) - 1));
+    onResize.resizeFirst = true; // term.js runs Ink's own resize repaint a beat later, after this commits the new width
     stdout?.on?.('resize', onResize);
+    onResize(); // a resize between first render and this subscription (a restart replay) must not leave the old width
     return () => stdout?.off?.('resize', onResize);
   }, [stdout, columns]);
 
@@ -1029,17 +1177,49 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     } catch { /* still unknown: the next successful poll tries again */ } finally { R.current.orgLookup = false; }
   };
   // HITL-INBOX-BAR: unread inbox items on the status area + one stream line per new arrival. A failed read keeps the last bar.
-  const refreshInboxBar = async () => {
+  // The inbox list read can be heavy on the auth service (seconds per call), and every window polls: the bar backs off in
+  // proportion to the last read's cost (INBOX_BAR_COST_X, capped at INBOX_BAR_MAX_MS), reads 10 items, one read in flight
+  // per window (2026-10-27 auth overload: every window read 30 items every 4s at ~3.4s each and pegged auth).
+  const inboxMutes = () => activeMutes((api.settings ? api.settings() : (R.current.sessionSettings ||= {})).inboxMutes); // per profile, in the CLI settings
+  const barOpts = () => ({ mutes: inboxMutes(), announced: (R.current.inboxAnnounced ||= new Map()) });
+  const refreshInboxBar = async ({ force = false } = {}) => {
     if (!api.inboxItems) return;
+    const t = Date.now();
+    const gap = Math.min(INBOX_BAR_MAX_MS, (R.current.inboxCost || 0) * INBOX_BAR_COST_X);
+    if (R.current.inboxBusy || (!force && t - (R.current.inboxAt || 0) < gap)) return;
+    R.current.inboxBusy = true; R.current.inboxAt = t;
+    const epoch = R.current.inboxEpoch || 0;
     try {
-      const items = await api.inboxItems({ limit: 30 });
+      const items = await api.inboxItems({ limit: 10 });
+      R.current.inboxCost = Date.now() - t;
+      if (epoch !== (R.current.inboxEpoch || 0)) return; // an org switch landed while this read was in flight: it belongs to the old org
+      if (!R.current.inboxSeen && items.length) { try { R.current.inboxSeen = loadSeen(api.settings?.(), R.current.orgId ?? api.orgId?.() ?? null); } catch { /* no saved watermark: baseline from this read */ } }
+      const before = R.current.inboxSeen?.size || 0;
       const a = arrivals(items, R.current.inboxSeen || null);
       R.current.inboxSeen = a.ids;
-      R.current.inboxList = newestFirst(items).slice(0, 10);
-      for (const it of a.fresh.slice(0, 3)) say(arrivalLine(it), 'warn');
-      if (a.fresh.length > 3) say(`📨 ${a.fresh.length - 3} more · /inbox`, 'warn');
-      dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols) } });
-    } catch { /* last known bar stays; the approvals poll reports the outage */ }
+      if (a.ids.size !== before) { try { api.saveSetting?.('inboxSeenByOrg', withSeen(api.settings?.(), R.current.orgId ?? api.orgId?.() ?? null, a.ids)); } catch { /* persisting is best effort */ } }
+      const top = newestFirst(items).slice(0, 10);
+      R.current.inboxList = top;
+      const numOf = (it) => top.findIndex((x) => x.id === it.id) + 1; // each arrival names its own /inbox N (0: not in the latest 10)
+      const ann = announceFresh(a.fresh, barOpts().announced, { mutes: inboxMutes() }); // repeats of an announced title and muted sources print nothing
+      const lines = collapseArrivals(ann.print, numOf, arrivalLine); // APPROVAL-BURST: a burst of one agent's same-tool approvals is ONE line
+      if (AWAY.current.afk) { const col = (AWAY.current.col ||= newCollected()); for (const it of a.fresh) if (!isApprovalItem(it) && !isMuted(it, inboxMutes())) col.inbox.push(it); } // DND: collected for /morningreport, never announced
+      if (!AWAY.current.afk) for (const l of lines.slice(0, 3)) say(l, 'warn'); // AFK-QUIET-CARDS: away keeps notices quiet
+      if (lines.length > 3 && !AWAY.current.afk) say(`📨 ${lines.length - 3} more · /inbox`, 'warn');
+      dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols, barOpts()) } });
+    } catch { R.current.inboxCost = Math.max(R.current.inboxCost || 0, Date.now() - t, 3000); /* a failed read backs off too; the last bar stays */ } finally { R.current.inboxBusy = false; }
+  };
+  // ONE pending set (transcript HIGH c80bcdf776d2): the bar count, the roster's approval row(s) and the all-clear all read the
+  // approvals poll's items. The roster endpoint's own approval rows are replaced by rows derived from that set, atomically.
+  const syncApprovalRows = () => {
+    const ro = R.current.roster, open = R.current.openItems;
+    if (!open || !ro.allRows || !api.roster) return; // no roster source in this window: the bar count alone speaks
+    const now = Date.now();
+    const keep = (x) => x.kind !== 'approval';
+    const next = [...ro.allRows.filter(keep), ...open.map((it) => fromApproval(it, now)).filter(Boolean)];
+    ro.allRows = next; ro.rows = selectRows(next, { all: ro.all });
+    if (!ro.rows.length) { ro.focus = false; ro.peek = false; ro.confirm = null; }
+    ro.sel = Math.min(ro.sel, Math.max(0, ro.rows.length - 1));
   };
   const refreshNotify = async () => {
     if (BL.current) return;
@@ -1048,10 +1228,15 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       const items = await api.approvals();
       if (N.authLost) say('Signed in again: approvals are back.', 'ok');
       else if (N.slow) say('Quox server is back.', 'ok');
-      N.fails = 0; N.authLost = false; N.slow = false;
+      N.fails = 0; N.authLost = false; N.slow = false; R.current.readOkAt = Date.now();
       R.current.deckItems = groupApprovals(items, { conversationId: S.current.ctx.conversationId, cardIds: [...S.current.approvals, ...S.current.waiting].map(x => x.inboxItemId).filter(Boolean) }).flatMap(g => g.items.map(x => x.item)); // QUOXDECK: numbered as /approvals N
-      dispatch({ type: 'notify', patch: { approvals: items.length, error: null } });
+      R.current.openItems = items; syncApprovalRows();
+      dispatch({ type: 'notify', patch: { approvals: items.length, error: null, slow: false } });
       refreshInboxBar(); // HITL-INBOX-BAR: rides the same poll, never blocks it
+      if (api.otherOrgApprovals && !R.current.othersBusy) { // other orgs' counts: the helper's own 60s cache bounds the cost; never awaited, never blocks
+        R.current.othersBusy = true;
+        Promise.resolve().then(() => api.otherOrgApprovals()).then(async (v) => { if (v?.checked) { dispatch({ type: 'notify', patch: { others: v.waiting || [] } }); await autoOthers(v); } }, () => {}).finally(() => { R.current.othersBusy = false; });
+      }
       retryOrgName();
       dispatch({ type: 'inbox.sync', ids: items.map(i => i.id) });
       R.current.openIds = { ids: new Set(items.map(i => i.id)), at: Date.now() }; // a walk skips a card answered elsewhere since it started
@@ -1060,6 +1245,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         const item = await enrichPlanItem(raw, { objectiveGet: api.objectiveGet, agents: api.agents, orgs: api.orgs, cache: (R.current.planCache ||= new Map()) });
         dispatchEv({ type: 'approval.found', item, since: R.current.startedAt, userId: api.userId?.() || null });
       }
+      autoArrive(items); // APPROVALS-AUTO: after the loop, so this conversation's own inline cards are already known (and skipped)
     } catch (e) {
       N.fails++; // counted apart from an empty inbox
       const msg = e?.message || 'failed';
@@ -1070,7 +1256,8 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         return;
       }
       if (e?.transient && !N.slow) { N.slow = true; say('Quox server is slow or unreachable, retrying.', 'warn'); } // QUOXON-FW12: not signed out
-      dispatch({ type: 'notify', patch: { error: msg } });
+      // APPROVALS-POLL: one or two misses keep the last-known count on screen; only a sustained failure blanks it.
+      if (approvalsPollStale({ fails: N.fails, lastOkAt: R.current.readOkAt ?? R.current.startedAt, now: Date.now() })) dispatch({ type: 'notify', patch: { error: msg, slow: true } });
     }
   };
   React.useEffect(() => {
@@ -1107,7 +1294,24 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         // model's provider, else the provider the last turn ran on. Unknown yet: say nothing; a failing turn says why.
         const mine = String(MC.current?.provider || S.current?.ctx?.provider || '').toLowerCase();
         const hits = list ? list.filter(e => mine && String(e.provider || '').toLowerCase() === mine) : null;
-        if (hits) dispatch({ type: 'notify', patch: { providerLines: hits.map(e => `⚠ ${e.line || e.provider + ' ' + e.state}: chat on it fails until then`) } });
+        if (hits) {
+          // Limited / out of credits on the model in use: offer a working one (y/N), never switch on its own.
+          // Dismissed (n/Esc/chat) stays dismissed until the health state changes.
+          let offer = null;
+          try {
+            const sig = JSON.stringify(list.map(e => [e.provider, e.state, e.resets_at || null]));
+            if (R.current.limitedSig !== sig) { R.current.limitedSig = sig; R.current.limitedDismissed = false; }
+            if (hits.length && !R.current.limitedDismissed && api.connections) {
+              const [res, caps] = await Promise.all([api.connections(), api.capabilities ? api.capabilities() : null]);
+              offer = limitedOffer(list, MC.current, res, caps, mine);
+            }
+          } catch { /* no offer is the safe answer when the server cannot say what is ready */ }
+          R.current.limitedAsk = offer ? { ...offer, at: Date.now() } : null;
+          const lines = hits.map(e => `⚠ ${e.line || e.provider + ' ' + e.state}: chat on it fails until then`);
+          R.current.limitedBase = lines.slice();
+          if (offer) lines.push(askText(`Switch to ${offer.id} (${offer.why})?`));
+          dispatch({ type: 'notify', patch: { providerLines: lines } });
+        }
       }
       if (!stopped) timer = setTimeout(tick, 60000);
     };
@@ -1125,11 +1329,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       applyProgress(r.rows, (R0.progress ||= new Map()), Date.now());
       R0.allRows = r.rows; R0.alerts = backgroundAlerts(r.rows); R0.sources = r.sources;
       r = { ...r, rows: selectRows(r.rows, { all: R0.all }) };
-      R0.rows = r.rows;
-      DC.current.watchRoster(rowsWithoutLoopCards(R0.allRows, (id) => LC.current.has(id))).then((shown) => { if (shown) bump(n => n + 1); }, () => {}); // an objective or loop that just finished or failed summons its dragon (companion mode on, not while typing)
-      const at = r.rows.findIndex(x => x.key === prevKey);
-      R0.sel = at >= 0 ? at : Math.min(R0.sel, Math.max(0, r.rows.length - 1));
-      if (!r.rows.length) { R0.focus = false; R0.peek = false; R0.confirm = null; }
+      R0.rows = r.rows; syncApprovalRows(); R0.at = Date.now(); // when these rows were last read: a sign-out shows them as "as of" this time
+      if (!AWAY.current.afk) DC.current.watchRoster(rowsWithoutLoopCards(R0.allRows, (id) => LC.current.has(id))).then((shown) => { if (shown) bump(n => n + 1); }, () => {}); // an objective or loop that just finished or failed summons its dragon (companion mode on, not while typing)
+      const at = R0.rows.findIndex(x => x.key === prevKey);
+      R0.sel = at >= 0 ? at : Math.min(R0.sel, Math.max(0, R0.rows.length - 1));
+      if (!R0.rows.length) { R0.focus = false; R0.peek = false; R0.confirm = null; }
       if (!R.current.closed) bump(n => n + 1);
     } catch { /* api.roster handles per-source failures; nothing to show */ }
   };
@@ -1262,7 +1466,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (r?.status === 'denied') return dispatch({ type: 'approval.result', callId: run.callId, outcome: 'denied' });
         if (r && (r.status === 'approved' || r.status === 'error') && r.executed_at) {
           const text = r.result == null ? null : clip(typeof r.result === 'string' ? r.result : JSON.stringify(r.result), cols - 20);
-          return dispatch({ type: 'approval.result', callId: run.callId, outcome: r.status === 'error' ? 'failed' : 'done', text });
+          // Command reached the host and exited >= 1 (not a connect/auth failure): say "ran, exit N", not "failed".
+          const rr = r.result && typeof r.result === 'object' ? r.result : null;
+          const exit = r.status === 'error' && rr && Number.isInteger(rr.exit_code) && rr.exit_code >= 1 && !/handshake failed|unable to authenticate|no supported methods|failed to connect|connection refused|econnrefused|no route to host|connect etimedout/i.test(String(rr.error || '')) ? rr.exit_code : undefined;
+          return dispatch({ type: 'approval.result', callId: run.callId, outcome: r.status === 'error' ? 'failed' : 'done', text, ...(exit !== undefined ? { exit } : {}) });
         }
       } catch { /* keep polling until the deadline */ }
     }
@@ -1293,7 +1500,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   };
   // QUOXON-STEPUP: the server decides what needs a person. We try with any live step-up token; on 403 step_up_required
   // we ask for the PIN (masked card) and retry once. `proactive` (/authorise) asks first. Deny never needs a PIN.
+  // PRESENCE (owner 2026-11-04): approving, denying or answering a card is the owner being here, PIN or not: close an open away
+  // window server-side and stamp last-seen, so the next "While you were away" covers real absence only.
+  const ownerActed = (action) => { touchSeen(true); markPresent(action, { quiet: true }); };
   const respondWithStepUp = async (card, action, { proactive = false, reason = null, bulk = false } = {}) => {
+    ownerActed(action === 'approve' ? 'approval' : 'deny');
     const via = `tty ${sessionLabel()}`;
     const subject = { line1: `${action === 'approve' ? 'approve' : 'reject'} ${String(card.tool || card.inboxItemId || 'item')}${card.target ? ` · ${String(card.target)}` : ''}`, raisedBy: card.raisedBy || null, risk: card.risk || null };
     const ask = async () => {
@@ -1366,10 +1577,17 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     catch (e) { say(`⚠ couldn't re-check approvals (${clip(String(e?.message || e || 'unknown error').replace(/\s+/g, ' '), 80)}); /approvals to look again`, 'warn'); return; }
     const gone = walkAnsweredIds();
     const open = (Array.isArray(items) ? items : []).filter(x => x && !gone.has(x.id));
-    if (!open.length) { say('✔ Nothing else is currently waiting for you.', 'ok'); return; }
+    // the closing line repeats the other-org count + switch hint the walk opened with (the helper's own cache: no new token mints)
+    const sayOthers = async () => { try { const v = api.otherOrgApprovals ? await api.otherOrgApprovals() : null; for (const l of crossOrgTuiLines(v)) say(l, 'warn'); } catch { /* the hint is optional */ } };
+    if (!open.length) { say('✔ Nothing else is currently waiting for you.', 'ok'); await sayOthers(); return; }
     const fresh = open.filter(x => !W.ids.includes(x.id)).length;
-    if (fresh) say(`⏸ ${fresh} more arrived while you were answering · /approvals`, 'warn');
+    AO.current.noticeAt = Date.now(); // APPROVALS-AUTO: a bare y/n right after this notice is the card's, never chat
+    const added = AO.current.st.enabled ? autoArrive(open).added.length : 0; // only what is NEW since this window opened pops; older items stay a count
+    if (added) { say(`⏸ ${added} more arrived while you were answering · /approvals`, 'warn'); say(`Opening ${added === 1 ? 'it' : 'them'} next by itself${fresh > added ? `; ${fresh - added} older still waiting` : ''}.`, 'dim'); }
+    else if (fresh && W.auto) say(`⏸ ${fresh} older still waiting · /approvals`, 'warn'); // an auto-opened walk held only the new ones: the rest were there before
+    else if (fresh) say(`⏸ ${fresh} more arrived while you were answering · /approvals`, 'warn');
     else say(`⏸ ${open.length} still waiting (skipped) · /approvals`, 'warn');
+    await sayOthers();
   };
   const walkShow = () => {
     endAskEcho(); // TUI-INPUT: a new walk card is a new prompt; the last answer's echo must not sit in front of it
@@ -1389,9 +1607,23 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const it = W.items[nextId]; const c = walkCard(it, live.indexOf(nextId) + 1, live.length, { cols: cols - 2 });
     W.current = nextId; W.at = Date.now(); W.card = { at: W.at, walk: nextId };
     say(' ');
+    if (it.__orgName) say(`in ${it.__orgName} · answered there directly; this window stays in ${orgShown() || 'its own org'}`, 'warn'); // APPROVALS-AUTO: another org's card says whose it is
     c.lines.forEach((l, k) => say(l, k === 0 ? 'warn' : k === c.recoLine ? 'reco' : undefined));
     ask('Your choice, with an optional note', { who: it.payload.session || '', action: '', reason: '', keys: '· Esc stops', plain: true });
   };
+  // DESTRUCTIVE-CONFIRM: a delete is approved only by typing the object's name. y opens this step; Esc or n goes back.
+  const startDelConfirm = (obj, run) => {
+    R.current.delConfirm = { name: obj.name, run, at: Date.now() };
+    say(askText(`Type the name to delete it: ${obj.name}`, { keys: 'Esc or n cancels', action: `delete ${obj.label}`, reason: 'A delete is not approved by a single key' }), 'ask');
+    bump(n => n + 1);
+  };
+  const cancelDelConfirm = () => { R.current.delConfirm = null; B.current = initialBuffer(); say('Cancelled; nothing deleted. The card is still open.', 'dim'); bump(n => n + 1); };
+  const delConfirmLine = (text) => {
+    const d = R.current.delConfirm; const t = String(text ?? '').trim();
+    if (t === d.name) { R.current.delConfirm = null; d.run(); return; }
+    if (!t || /^n(o)?$/i.test(t)) { cancelDelConfirm(); return; }
+    say(`That is not the name, so nothing was deleted. Type ${d.name} exactly, or Esc to cancel.`, 'warn');
+  };
   const walkStart = async (list, { fresh = false, quiet = false } = {}) => {
     let decs = (list || []).filter(isDecision);
     if (!fresh && decs.length) { // a list held from before: only what the server still has waiting
@@ -1412,6 +1644,89 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     walkShow();
     return undefined;
   };
+  // APPROVALS-AUTO (owner 2026-11-06: "just make approvals pop up, i am tired of opening them"): a NEW approval or decision
+  // opens by itself as the walkthrough card. It only OPENS; it never answers. A draft, typing in the last 2s, a streaming
+  // turn or another card on screen holds it until the next idle point; an open walk simply gains the card.
+  const autoSkip = () => new Set([...S.current.approvals.map(x => x.inboxItemId), ...walkAnsweredIds(), ...(R.current.pendingWalk ? R.current.pendingWalk.ids : [])].filter(Boolean));
+  const autoBusy = () => Boolean(askOpen() || headCard(S.current) || SU.current.isOpen() || LI.current?.isOpen?.() || CN.current?.isOpen?.() || PK.current?.isOpen?.() || R.current.rs || R.current.noteAsk || R.current.delConfirm || R.current.denyReason || K.current.cardFocus || BL.current || AWAY.current.afk);
+  const autoOpenItems = (items, how) => {
+    const skip = autoSkip(); const list = items.filter(x => !skip.has(x.id));
+    if (!list.length) return;
+    if (how === 'open') { const n = list.length; say(' '); say(`⏸ ${n === 1 ? 'A new approval just arrived; it is open below' : `${n} new approvals just arrived; they are open below, one at a time`}. Esc stops · /approvals auto off stops them opening by themselves.`, 'warn'); }
+    const had = R.current.pendingWalk;
+    walkStart(list.map(approvalAsWalkItem), { fresh: true, quiet: true });
+    if (!had && R.current.pendingWalk) R.current.pendingWalk.auto = true;
+  };
+  const autoTry = () => {
+    const A = AO.current; clearTimeout(A.timer); A.timer = null;
+    if (A.dead) return;
+    const d = openDecision(A.st, { draft: B.current.text, lastKeyAt: K.current.lastKeyAt || 0, now: Date.now(), streaming: Boolean(S.current.turn), walkOpen: Boolean(R.current.pendingWalk), askOpen: autoBusy() });
+    if (!d) return;
+    if (d === 'open' || d === 'join') { A.waitSaid = false; autoOpenItems(takeQueue(A.st), d); return; }
+    if (d === 'wait-draft' && !A.waitSaid) { A.waitSaid = true; say(`⏸ ${A.st.queue.length === 1 ? 'A new approval is' : `${A.st.queue.length} new approvals are`} waiting; it opens once your draft is empty.`, 'dim'); }
+    A.timer = setTimeout(autoTry, 400); A.timer.unref?.();
+  };
+  const autoArrive = (items, opts = {}) => { const A = AO.current; const r = noteArrivals(A.st, items, { skipIds: autoSkip(), ...opts }); if (A.st.queue.length) autoTry(); return r; };
+  // Other orgs: read an org's open items only when its count changed (the counts helper caches 60s), with the user's own token.
+  const autoOthers = async (v) => {
+    const A = AO.current; const first = !A.othersDone; A.othersDone = true;
+    if (!api.approvalsInOrg) return;
+    const waiting = v?.waiting || []; const ids = new Set(waiting.map(w => w.id));
+    A.st.queue = A.st.queue.filter(x => !x.__orgId || ids.has(x.__orgId)); // nothing waiting there any more
+    for (const [id] of A.otherCounts) if (!ids.has(id)) A.otherCounts.delete(id);
+    for (const w of waiting) {
+      if (A.otherCounts.get(w.id) === w.count) continue;
+      try {
+        const items = await api.approvalsInOrg(w.id);
+        A.otherCounts.set(w.id, w.count);
+        autoArrive(items, { orgId: w.id, orgName: w.name, seed: first ? true : (A.st.seeded.has(w.id) ? null : false) });
+      } catch { /* unreadable: the "N more waiting in" line still says so */ }
+    }
+  };
+  // Another org's card in the walk: answered via that org's own URL (the server checks membership there). A high-risk yes
+  // still takes the PIN (a one-shot token minted for THAT org); a privileged yes still needs its explicit confirm there.
+  const walkCrossOrg = async (W, it, rep) => {
+    const org = it.__orgName || it.__orgId; const c = it.payload?.approval_context || {};
+    const keep = () => { W.at = Date.now(); if (W.card) W.card.at = W.at; return true; };
+    if (it.__approval && rep.key === 'y' && isPrivileged({ tool: c.method?.tool, risk: c.risk, flag: it.payload?.privileged === true || c.privileged === true, title: it.title })) {
+      say(`This one is privileged, so a yes needs its explicit confirm in ${org}: ${mark(`/org switch ${org}`)} then ${mark('/approvals')}. n denies it from here; s skips.`, 'warn');
+      return keep();
+    }
+    const label = it.payload.options.find(o => o.key === rep.key)?.label || rep.key;
+    const subject = { line1: `${it.__approval ? (rep.key === 'y' ? 'approve' : 'deny') : 'answer'} ${String(it.title || '')} (in ${org})`, raisedBy: it.payload.session || null, risk: 'high' };
+    let stepUp = {};
+    const pin = async () => { const r = await SU.current.request({ scope: 'approve', orgId: it.__orgId, fresh: true, subject }); if (!r.ok) { const e = new Error(declinedText(r.reason)); e.stepUpDeclined = true; throw e; } stepUp = { 'x-step-up-token': r.token }; };
+    const go = () => { ownerActed('answer'); return it.__approval
+      ? api.respond(it.id, rep.key === 'y' ? 'approve' : 'reject', { via: 'walkthrough', reason: rep.note || null, org: it.__orgId, stepUp })
+      : api.answerDecision(it.id, rep.key, { note: rep.note || null, org: it.__orgId, stepUp }); };
+    R.current.walkSend = true;
+    try {
+      if (needsPin(it) && rep.key !== 'n') await pin();
+      try { await go(); }
+      catch (e) { if (!(e?.status === 403 && e?.body?.error === 'step_up_required')) throw e; await pin(); await go(); }
+    } catch (e) {
+      if (e?.stepUpDeclined) { say(`Not answered: ${e.message}.`, 'warn'); return keep(); }
+      if (e?.status === 404 || e?.status === 400 || e?.status === 409) { say(`"${clip(it.title || it.id, 60)}" is no longer waiting in ${org}. Moving on.`, 'dim'); W.done.add(it.id); walkAnsweredIds().add(it.id); if (R.current.pendingWalk === W) walkShow(); return true; }
+      say(`Not answered in ${org} (${clip(String(e?.message || e), 80)}). The question stays: say a choice again, s to skip, or ${mark(`/org switch ${org}`)} to answer it there.`, 'warn');
+      return keep();
+    } finally { R.current.walkSend = false; }
+    say(`✔ answered in ${org}: ${clip(decodeEntities(it.title || it.id), Math.max(20, cols - 40))} -> (${rep.key}) ${decodeEntities(label)}${rep.note ? ` (note: ${clip(rep.note, 40)})` : ''}`, 'ok');
+    walkAnsweredIds().add(it.id); W.done.add(it.id); W.answered.push({ title: it.title, word: `${label} (in ${org})${rep.note ? ` (note: ${rep.note.length} characters)` : ''}` });
+    if (R.current.pendingWalk === W) walkShow();
+    return true;
+  };
+  // The stray y (2026-11-06: a y typed after "1 more arrived" went to triage-q as chat): a bare y/n while a card is queued,
+  // or just after a "more arrived" notice, opens that card NOW with the key kept in the box. A key typed before the card
+  // was on screen never approves what it has not shown: Enter then answers the card you can see.
+  const autoStray = (text) => {
+    const A = AO.current; const t = String(text).trim();
+    const queued = takeQueue(A.st);
+    const kept = () => { edit({ type: 'set', text: t }); say(`Your "${t}" was not sent as chat. It is kept in the box: press Enter to answer the card above.`, 'warn'); };
+    if (queued.length) { autoOpenItems(queued, 'open'); if (R.current.pendingWalk) kept(); return; }
+    A.noticeAt = 0;
+    Promise.resolve(command('/approvals walkthrough')).then(() => { if (R.current.pendingWalk) kept(); else say(`Your "${t}" was not sent as chat: the approval it was for is no longer waiting.`, 'dim'); });
+  };
+  React.useEffect(() => () => { AO.current.dead = true; clearTimeout(AO.current.timer); }, []);
   // NOTE-CONFIRM (transcript review 2026-10-17): an answer with a note can contradict its option, so every note is confirmed first, unless it starts with "fyi".
   const noteNeedsConfirm = (note) => { const t = String(note ?? '').trim(); return Boolean(t && !/^fyi\b/i.test(t) && /\b(not|no|never|without|only|except|instead|unless|limit\w*|max\w*|at most|at least)\b|n't\b|\d/i.test(t)); }; // only a note that could change the choice asks first; a plain comment goes through with the note attached
   const noteCard = (st) => {
@@ -1445,7 +1760,17 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     if (rep.notYesNo) { say(walkNotYesNo(it), 'warn'); W.at = Date.now(); if (W.card) W.card.at = W.at; return true; }
     if (rep.defer) { W.done.add(it.id); W.skipped.push(it.id); walkShow(); return true; }
     if (rep.ask) { W.at = Date.now(); submit(`Explain this decision to me in two plain sentences and say what you would do, about THIS one only. Title: ${it.title}. Asked by: ${it.payload.session || 'a session'}. Why: ${it.payload.why || 'not given'}. Options: ${it.payload.options.map(o => `${o.label} (${o.key})`).join('; ')}. Decision id: ${it.id}.`); return true; }
-    const n = S.current.inbox.findIndex(x => x.id === it.id) + 1; // routed by id; the position is only looked up at the moment of sending
+    if (it.__approval && rep.key === 'y' && isDestructive(it) && R.current.delBypass !== it.id) { // a delete is confirmed by typing its name, then this same yes goes through
+      W.at = Date.now(); if (W.card) W.card.at = W.at;
+      startDelConfirm(destructiveObject(it), async () => { R.current.delBypass = it.id; try { await walkHandle('y'); } finally { R.current.delBypass = null; } });
+      return true;
+    }
+    if (it.__orgId) return walkCrossOrg(W, it, rep); // APPROVALS-AUTO: another org's card is answered in THAT org, no switch
+    let n = S.current.inbox.findIndex(x => x.id === it.id) + 1; // routed by id; the position is only looked up at the moment of sending
+    if (!n) { // APPROVALS-AUTO: a card that opened by itself was never listed by /approvals: read the same list, in the same order, now
+      try { const pl = groupApprovals(await api.approvals(), { conversationId: S.current.ctx.conversationId, cardIds: [...S.current.approvals, ...S.current.waiting].map(x => x.inboxItemId).filter(Boolean) }).flatMap(g => g.items.map(x => x.item)); dispatch({ type: 'inbox', items: pl }); R.current.shownIds = pl.map(x => x.id); n = pl.findIndex(x => x.id === it.id) + 1; }
+      catch (e) { say(`Could not re-read approvals (${clip(String(e?.message || e), 80)}); nothing was sent. Say the choice again.`, 'warn'); W.at = Date.now(); if (W.card) W.card.at = W.at; return true; }
+    }
     if (!n) { say(`"${it.title}" is no longer waiting (answered or expired). Moving on.`, 'warn'); W.done.add(it.id); walkShow(); return true; }
     if (askExpiry(it) && askExpiry(it) <= Date.now()) { W.done.add(it.id); (W.dropped ||= new Set()).add(it.id); refreshNotify(); say(expiredText(it), 'accent'); walkShow(); return true; }
     if (rep.note && noteNeedsConfirm(rep.note) && !R.current.noteBypass) {
@@ -1477,7 +1802,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       // The demo's stream carries on to its own tool result, so no "running, result later" note, no poll, no stale count.
       dispatch({ type: 'approval.sent', callId: card.callId, action, tool: card.tool, target: card.target, what: card.what, who: card.facts?.who || card.origin || card.askedBy || null, where: card.facts?.where || null, approvalId: card.approvalId, inboxItemId: card.inboxItemId || null, quiet: Boolean(demoLabel), foreign: Boolean(card.foreign), batch });
       if (demoLabel) { B.current = initialBuffer(); dispatch({ type: 'notify', patch: { approvals: 0, error: null } }); } // (a stray early keystroke is not left in the composer)
-      if (action === 'approve' && card.tool !== 'hat.switch' && !card.foreign && !demoLabel && !batch) pollResult({ callId: card.callId, approvalId: card.approvalId });
+      if (action === 'approve' && card.tool !== 'hat.switch' && !demoLabel && !batch) pollResult({ callId: card.callId, approvalId: card.approvalId });
       return { ok: true };
     } catch (e) {
       if (e?.status === 404 || (e?.status === 400 && /not open for response/i.test(`${e?.code || ''} ${e?.body?.error || ''} ${e?.message || ''}`))) { // already resolved elsewhere (another window, /approve all, the dashboard)
@@ -1490,6 +1815,35 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     finally { R.current.answering.delete(card.callId); }
   };
 
+  // APPROVAL-BURST: y / n on a batch card answers every item through the normal per-item API (one call each, recorded per item).
+  const answerBatch = async (b, action) => {
+    if (R.current.batchBusy) return;
+    R.current.batchBusy = true;
+    const word = action === 'approve' ? 'approved' : 'denied'; const total = b.cards.length; let done = 0, gone = 0; const failed = [];
+    try {
+      for (const c of b.cards) {
+        try {
+          const r = await answer(c, action, { batch: true, bulk: action === 'approve' });
+          if (r?.ok) done++; else if (r?.gone) gone++; else failed.push(batchLabel(c));
+        } catch (e) { failed.push(`${batchLabel(c)} (${clip(String(e?.message || e), 40)})`); if (e?.stepUpDeclined) break; }
+      }
+    } finally { R.current.batchBusy = false; }
+    const rest = total - done - gone - failed.length; // left unattempted (step-up declined)
+    if (rest > 0) for (const c of b.cards.slice(total - rest)) failed.push(batchLabel(c));
+    say(`${word} ${done} of ${total}${gone ? ` (${gone} already handled elsewhere)` : ''}${failed.length ? `. Not ${word}: ${clip(failed.join(', '), Math.max(30, cols - 40))}` : ''}`, failed.length ? 'warn' : 'ok');
+  };
+  // p on a batch card: the existing one-by-one walk, for just those items.
+  const walkBatch = async (b) => {
+    let items;
+    try { items = await api.approvals(); } catch (e) { say(`Could not read the approvals (${clip(String(e?.message || e), 80)}); nothing changed.`, 'warn'); return; }
+    const flat = groupApprovals(items, { conversationId: S.current.ctx.conversationId, cardIds: [...S.current.approvals, ...S.current.waiting].map(x => x.inboxItemId).filter(Boolean) }).flatMap(g => g.items.map(x => x.item));
+    dispatch({ type: 'inbox', items: flat }); R.current.shownIds = flat.map(x => x.id);
+    const ids = new Set(b.cards.map(c => c.inboxItemId));
+    for (const x of queueOf(S.current)) K.current.dismissed.add(x.callId); // the walk owns the keys, as with Tab
+    K.current.confirm = false; bump(n => n + 1);
+    await walkStart(flat.filter(x => ids.has(x.id)).map(approvalAsWalkItem), { fresh: true });
+  };
+
   // ---- turn runner ---------------------------------------------------------------------------
   // Z2H-R2B: with no AI connected a turn is answered here, whole and wrapped, without a server call.
   async function aiConnected() {
@@ -1768,7 +2122,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   }
 
   React.useEffect(() => {
-    if (R.current.sleep && R.current.sleep.wakeAt == null && S.current.approvals.length) wakeDragon(); // an approval always wakes it
+    if (R.current.sleep && R.current.sleep.wakeAt == null && S.current.approvals.length && !AWAY.current.afk) wakeDragon(); // an approval always wakes it
     const s = S.current;
     if (!s.turn && s.autoDrain && s.pending.length) {
       const next = s.pending[0];
@@ -1779,7 +2133,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
 
   // A queued or steered draft that is a slash command runs as that command when its turn comes; it is never sent as chat.
   function runQueued(text, { checked = false } = {}) {
-    if (text.startsWith('/') && !text.includes('\n')) { command(text); return; }
+    if (isOneLineCommand(text)) { command(text); return; }
     const stray = checked ? null : strayCardAnswer(text, commandNames()); // TUI-INPUT: "n/help" = a card answer that leaked into the composer
     if (stray) { R.current.strayAsk = { text, command: stray.command, at: Date.now() }; ask(strayQuestion(stray)); return; }
     dispatch({ type: 'user', text, queued: true });
@@ -1793,30 +2147,91 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
 
   // PRESENCE (owner 2026-10-16): /afk and /sleep tell the server, so sessions and LLMs know you are not at this
   // terminal (approvals still queue; nothing is approved). /back or any typed turn marks you present.
-  async function setPresence(state, note) {
+  async function setPresence(state, note, { human = false, dnd = false } = {}) {
     if (!api.setPresence) return { ok: true, local: true }; // demo / offline: the local mark is all there is
-    try { return await api.setPresence(state, { note: note || undefined, slots: where.current.slot ? [where.current.slot] : undefined }); }
+    R.current.presenceSetAt = Date.now();
+    const r0 = await setPresenceRaw(state, note, { human, dnd }); R.current.presenceUnsynced = !r0.ok; return r0;
+  }
+  async function setPresenceRaw(state, note, { human = false, dnd = false } = {}) {
+    try { return await api.setPresence(state, { note: note || undefined, human, dnd, slots: where.current.slot ? [where.current.slot] : undefined }); }
     catch (e) { return { ok: false, message: e?.message || 'failed', status: e?.status || null }; }
   }
   const presenceFail = (r) => say(`Sessions can't see that (${r.status ? `HTTP ${r.status}` : r.message || 'failed'}): this window still collects for /back, but other sessions do not know.`, 'warn');
-  function markPresent(action = 'chat') {
-    if (/^\/(afk|sleep|back|away)(\s|$)/.test(String(action).replace(/^slash /, ''))) return;
+  // DO-NOT-DISTURB (owner 2026-10-28, "sleep means sleep"): while AWAY.afk is set (/dnd, /afk, /sleep) the window collects
+  // instead of announcing: no notice lines, cards, bells or dragon moments. /morningreport is the grouped digest.
+  const dndNote = (until) => DND_NOTE + (until ? ` until ${String(new Date(until).getHours()).padStart(2, '0')}:${String(new Date(until).getMinutes()).padStart(2, '0')}` : '');
+  function holdSlotMsg(m, label) {
+    if (!AWAY.current.afk) return false;
+    (AWAY.current.col ||= newCollected()).slots.push({ from: label || m.from || 'slot', text: String(m.text || '') });
+    bump(n => n + 1);
+    return true;
+  }
+  async function dndOn(until = null) {
+    const at = Date.now(); const untilMs = until ? untilEpoch(until, at) : null;
+    const note = dndNote(untilMs);
+    AWAY.current.last = at; AWAY.current.afk = { at, note, dnd: true, explicit: true, until: untilMs }; AWAY.current.col ||= newCollected();
+    try { away?.write?.(profile, at); } catch { /* in-memory mark still works */ }
+    say(`🌙 Do not disturb is on${untilMs ? ` until ${note.slice(-5)}` : ''}. Everything is collected for the morning: /morningreport shows it, /dnd off or /back ends it.`, 'ok');
+    const pr = await setPresence('sleeping', note, { dnd: true });
+    if (!pr.ok) presenceFail(pr);
+    bump(n => n + 1);
+  }
+  // MORNINGREPORT-WINDOW (owner 2026-11-03): ending DND/away must not erase what it collected. The most recent window
+  // (start, end, collected) is kept so /morningreport answers about it whether or not DND is on at the moment of asking.
+  function archiveWindow() {
+    const a = AWAY.current.afk, c = AWAY.current.col;
+    if (!a && !c) return;
+    AWAY.current.lastWindow = { since: c?.since || a?.at || Date.now(), until: Date.now(), col: c || newCollected() };
+  }
+  async function dndOff() {
+    archiveWindow();
+    AWAY.current.afk = null;
+    const n = waitingCount(AWAY.current.col, 0); AWAY.current.col = null; // the archived window keeps it; the next window starts empty
+    say(`Do not disturb is off.${n ? ` ${n} collected while it was on: /morningreport shows them.` : ''}`, 'ok');
+    const pr = await setPresence('present', undefined, { human: true });
+    if (!pr.ok) presenceFail(pr);
+    bump(n2 => n2 + 1);
+  }
+  async function sleepNow() { // owner 2026-10-29: one step to bed: sleeping AND do-not-disturb
+    const at = Date.now(); const note = dndNote(null);
+    AWAY.current.last = at; AWAY.current.afk = { at, note, dnd: true, explicit: true, until: null }; AWAY.current.col ||= newCollected();
+    try { away?.write?.(profile, at); } catch { /* the in-memory mark still works for this window */ }
+    say("🌙 Asleep, do not disturb on: everything collects for the morning. /morningreport or /back when you're up.", 'ok');
+    const pr = await setPresence('sleeping', note, { dnd: true });
+    if (!pr.ok) presenceFail(pr);
+    bump(n => n + 1);
+  }
+  function offerDndToo() {
+    if (R.current.dndAsk) return;
+    R.current.dndAsk = { at: Date.now(), off: false };
+    say(askText('Turn on do not disturb too? (y/N)', { action: 'collect arrivals quietly until you are back (same as /dnd on)' }), 'ask');
+  }
+  function offerDnd() {
+    if (AWAY.current.afk || R.current.dndAsk) return;
+    R.current.dndAsk = { at: Date.now(), off: false };
+    say(askText('Turn on do not disturb until morning?', { action: 'collect arrivals quietly until you are back (same as /dnd on)', title: 'Going to sleep?' }), 'ask');
+  }
+  function markPresent(action = 'chat', { quiet = false } = {}) {
+    if (/^\/(afk|sleep|back|away|dnd|donotdisturb|morningreport)(\s|$)/.test(String(action).replace(/^slash /, ''))) return;
     if (AWAY.current.afk) { // this window set the flag: a typed turn here is the owner back (explicit, as before)
+      archiveWindow();
       AWAY.current.afk = null;
-      setPresence('present').then((r) => { if (!r.ok) presenceFail(r); }, () => {});
+      setPresence('present', undefined, { human: true }).then((r) => { if (!r.ok) presenceFail(r); }, () => {});
       return;
     }
     // PRESENCE (owner 2026-10-19): a window that never set the flag (restarted TUI) still clears the server's stale one,
     // but only from a real terminal (api.noteActivity is a no-op for --print, pipes and proof runs). Welcome shows once.
     if (!api.noteActivity) return;
-    api.noteActivity(action).then((r) => {
+    api.noteActivity(action, quiet ? { quiet: true } : undefined).then((r) => {
       if (r?.welcome?.away_text && !AWAY.current.welcomed) { AWAY.current.welcomed = true; say(`✔ Welcome back, you were away ${r.welcome.away_text}`, 'ok'); }
     }, () => {});
   }
   function submit(text) {
     touchSeen();
+    AR.current.busyAt = Date.now(); // a just-sent turn is in flight before S.turn shows it: auto-restart must not fire in that gap
     markPresent(/^\//.test(text.trim()) ? `slash ${text.trim().split(/\s+/)[0]}` : 'chat');
     dispatch({ type: 'user', text });
+    if (!/^\//.test(text.trim()) && sleepIntent(text)) offerDnd(); // never silently: it asks
     const tip = intentHint(text); // a hint only: the turn still goes to the model
     if (tip) say(tip);
     const panel = intentPanel(text); // the same panel as the command, from local facts, above the answer
@@ -1920,7 +2335,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     if (cmd === '/cost') return help(costModel(LG.current));
     if (cmd === '/status') {
       let hl = R.current.lastHealth || null;
-      if (!local && api.health) { hl = await api.health(8000); R.current.lastHealth = hl; }
+      if (!local && api.health) { hl = await api.health(8000); R.current.lastHealth = hl; if (hl) R.current.lastGoodAt = Date.now(); }
       return help(statusModel({ ...base, profile, org: orgShown(), serverUrl: api.serverUrl?.() || hl?.url || null, health: hl, slot: where.current.slot, sessionName: SN.current.name, version, local: local && !hl }));
     }
     if (cmd === '/context') {
@@ -2199,6 +2614,27 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const cand = loginCandidates.find(x => x !== me && okProfileName(x)) || 'me';
     return offerLogin(cand, `This window is an agent login (${me}) and no human login is signed in on this machine.`);
   }
+  // STARTUP OFFER (owner 2026-10-28): `quox` opened on an agent login while human logins exist asks once, y/N, to
+  // restart as the first human profile (the rest are in /profile). N keeps the agent window; the intro warning stays.
+  function offerStartupSwitch() {
+    const { profile: me, agentLogin: isAgent } = WHO.current;
+    if (!isAgent) return undefined;
+    const human = humanProfiles.find(x => x !== me && okProfileName(x));
+    if (!human) return undefined;
+    R.current.profileAsk = { name: human, at: Date.now() };
+    return say(startupSwitchAskLine(me, human, humanProfiles.filter(x => x !== me && x !== human).length), 'ask');
+  }
+  // Plain-language slot attach: a known slot gets the /slot offer (y runs it); anything else is ordinary chat.
+  async function offerSlotAttach(nm, text) {
+    let rows = null;
+    try { rows = await api.slots(); } catch { rows = null; }
+    const known = Array.isArray(rows) && rows.find(x => String(x.name).toLowerCase() === nm.toLowerCase());
+    if (!known) { submit(text); return; }
+    const line = `/slot ${known.name}`;
+    dispatch({ type: 'user', text });
+    R.current.suggestAsk = { line, at: Date.now() };
+    ask(`Run ${line}?`, { action: line, reason: `"${clip(text, 60)}" is a request to attach to that slot` });
+  }
   function offerLogin(name, lead) {
     return armRun(loginRunRequest(name, `${lead} Sign ${name} in, then /profile ${name} switches this window to it.`, runNow()), { who: 'Quox', glyph: 'Ⓠ', text: '' });
   }
@@ -2241,17 +2677,37 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       target = c.onPath || undefined;
     }
     say(`Restarting${S.current.ctx.conversationId ? ' into this conversation' : ''}…`, 'dim');
-    onRestart({ conversationId: S.current.ctx.conversationId || null, name: SN.current.name || null, slot: where.current.slot || null, attach: SN.current.agent ? `agent:${SN.current.agent}` : (SN.current.slotTarget ? `slot:${SN.current.slotTarget}` : null), org: api.windowOrgId?.() || null, ...(MD.current === 'plan' ? { mode: 'plan' } : {}), bin: target, ...extra });
+    AR.current.lastRestartAt = Date.now(); api.saveSetting?.('lastRestartAt', AR.current.lastRestartAt); // the next window reads it: restarts coalesce
+    onRestart({ conversationId: S.current.ctx.conversationId || null, name: SN.current.name || null, slot: where.current.slot || null, attach: SN.current.agent ? `agent:${SN.current.agent}` : (SN.current.slotTarget ? `slot:${SN.current.slotTarget}` : null), org: api.windowOrgId?.() || null, ...(MD.current === 'plan' ? { mode: 'plan' } : {}), ...(R.current.declinedSlot || restartDeclined ? { declined: R.current.declinedSlot || restartDeclined } : {}), bin: target, ...extra });
     return exit(30);
   }
 
+  // INSTANT-FEEDBACK (owner 2026-10-26): every slash command goes through here, so any async handler shows `⠋ <verb>…`
+  // within 100 ms until its result or error line. A command run from inside another one reuses the outer spinner.
   async function command(line) {
+    if (R.current.spinOn || !/^\s*\/(?!\/)/.test(String(line))) return commandRun(line);
+    R.current.spinOn = true;
+    try {
+      return await runWithSpinner(() => commandRun(line), {
+        verb: spinnerVerb(line),
+        show: (t) => dispatch({ type: 'notify', patch: { spinner: t } }),
+        hide: () => dispatch({ type: 'notify', patch: { spinner: '' } }),
+        register: (stop) => { R.current.spinStop = stop; }
+      });
+    } finally { R.current.spinOn = false; R.current.spinStop = null; }
+  }
+  // A command the TUI dispatches from inside another one (/sleep -> /dragon sleep) is not the owner typing: it never marks present.
+  async function commandRun(line) {
+    const nested = (R.current.cmdDepth || 0) > 0; R.current.cmdDepth = (R.current.cmdDepth || 0) + 1;
+    try { return await commandBody(line, nested); } finally { R.current.cmdDepth -= 1; }
+  }
+  async function commandBody(line, nested) {
     if (/^\/\/(\s|$)/.test(line.trim())) line = line.trim().replace(/^\/\//, '/devnote');
     const [cmd0, arg] = line.trim().split(/\s+/);
     const cmd = cmd0 === '/agent' ? '/agents' : cmd0; // /agent is the same command
-    if (!['/afk', '/sleep', '/back', '/away'].includes(cmd)) markPresent(`slash ${cmd}`); // PRESENCE: any slash command but /afk and /sleep is the owner being back
+    if (!nested && !['/afk', '/sleep', '/back', '/away', '/dnd', '/donotdisturb', '/morningreport'].includes(cmd)) markPresent(`slash ${cmd}`); // PRESENCE: any slash command but /afk and /sleep is the owner being back
     if (cmd !== '/devnote' && cmd !== '/context') SCX.current.command(line.trim());
-    if (cmd !== '/devnote') transcript?.command(/^\/(authenticate|authorise|authorize)$/.test(cmd) && !/^[\d,\s-]*$/.test(line.trim().replace(/^\S+\s*/, '')) ? cmd : line); // QUOXON-STEPUP: never record a stray argument that might be a PIN
+    if (cmd !== '/devnote') transcript?.command((/^\/(authenticate|authorise|authorize)$/.test(cmd) && !/^[\d,\s-]*$/.test(line.trim().replace(/^\S+\s*/, ''))) || (cmd === '/verify-email' && /(^|\D)\d{6}(\D|$)/.test(line)) ? cmd : line); // QUOXON-STEPUP: never record a stray argument that might be a PIN
     const restArg = line.trim().replace(/^\S+\s*/, '');
     touchSeen();
     if (TIPS.some(x => tryCommand(x) === cmd) && !TP.current.used.includes(cmd)) { TP.current.used = [...TP.current.used, cmd]; api.saveSetting?.('tipsUsed', TP.current.used); } // using a thing retires its tip
@@ -2312,10 +2768,16 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           const first = to[0] || m[1].toLowerCase();
           let rows = [];
           if (api.slots) { try { rows = await api.slots(); } catch { rows = []; } }
-          const known = !looksLikeAddress(m[1]) && !!resolveSayTarget(first, Array.isArray(rows) ? rows : [], SC.current.senders);
+          let known = !looksLikeAddress(m[1]) && !!resolveSayTarget(first, Array.isArray(rows) ? rows : [], SC.current.senders);
           const last = R.current.lastSay;
+          let lookupFailed = false;
+          // Not in this org's list: a slot in another of the user's own orgs (or name@org) is still a target, not message text.
+          if (!known && last && !looksLikeAddress(m[1]) && api.slotLocate) {
+            try { known = !!(await api.slotLocate(first))?.found; } catch { lookupFailed = true; }
+          }
           if (!known && (looksLikeAddress(m[1]) || last)) {
             if (last && Date.now() - last.at < 2 * 3600000) {
+              if (lookupFailed) say(`Could not check your other orgs for "${first}", so this goes to ${last.slot}, the last target.`, 'warn');
               R.current.sayLastAsk = { slot: last.slot, text: restArg.trim(), at: Date.now() };
               return say(askText(`Send to ${last.slot}?`, { keys: 'y send · n cancel', action: `send the whole message to ${last.slot}` }), 'ask');
             }
@@ -2326,13 +2788,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         // QUOXON-SAY-CC: one line to several slots; each copy names everyone it went to, so they know who else has it
         const slots = await Promise.all(to.map(t => canonSlot(t, { senders: true })));
         const head = `(to ${slots.join(', ')}) `;
-        for (const sl of slots) await sendToSlot(sl, head + m[2].trim());
+        for (const sl of slots) await sendToSlot(sl, head + m[2].trim(), { draft: null });
         return undefined;
       }
       case '/join': { const nm = roomName(restArg); if (!nm) return say('Usage: /join <slot>  (or #<slot>)', 'warn'); return joinRoom(nm); }
       case '/leave': { const nm = roomName(restArg); if (!nm) return say('Usage: /leave <slot>', 'warn'); return leaveRoom(nm); }
       case '/rooms': case '/groups': return showRooms();
       case '/broadcast': case '/page':
+        if (cmd === '/broadcast' && sleepIntent(restArg)) queueMicrotask(offerDnd); // never silently: it asks, after the card
         return runBroadcast({ api, kind: cmd === '/page' ? 'page' : 'broadcast', arg: restArg, from: myLabel(), say, card: (m) => dispatch({ type: 'bcard', card: m }), isClosed: () => R.current.closed });
       case '/ack': return runAck({ api, arg: restArg, slot: where.current.slot || null, say });
       case '/send': { // QUOXON-MESH: a local text file into a slot (inline, 64 KB cap, secrets scrubbed on a yes)
@@ -2409,7 +2872,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         }
         SN.current.slotTarget = null;
         SN.current.agent = m.agent.id; where.current = { ...where.current, agent: m.agent.id }; bump(x => x + 1);
-        DC.current.attach(m.agent.id, { greet: greetThis }).then(() => { const n = DC.current.takeArtNotice(); if (n) say(n, 'warn'); });
+        DC.current.attach(m.agent.id, { greet: greetThis }).then(() => { const n = DC.current.takeArtNotice() || DC.current.narrowNotice({ cols, rows: termRows(stdout) ?? 24 }); if (n) say(n, 'warn'); });
         say(`Attached to ${m.agent.id}. Your next turns go to it. /detach returns to CommanderQ.`, 'ok');
         if (both && pt.kind !== 'agent') say(`${pt.name} is also a slot: /attach slot:${pt.name} for that`, 'warn');
         if (pt.rest) { dispatch({ type: 'user', text: pt.rest }); remember(pt.rest); runTurn(pt.rest); }
@@ -2569,20 +3032,41 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       }
       case '/deck': { // provided by the quoxdeck extension when loaded; otherwise says where it comes from (the registry entry carries ext)
         if (await extDispatch(cmd, restArg)) return undefined;
-        return say('/deck comes from the quoxdeck extension, which is not loaded. npm i -g quoxdeck, then /ext on quoxdeck.', 'warn');
+        const dw = restArg.trim().split(/\s+/)[0];
+        if (dw && dw !== 'on') return say('/deck comes from the quoxdeck extension, which is not loaded. /deck on loads it.', 'warn');
+        const lr = await DK.current.load('quoxdeck'); // LAZY PATH: not loaded -> find out why and OFFER (y/N), never a raw build error
+        if (lr.ok) { extAdd('quoxdeck'); say(lr.text, 'ok'); return undefined; }
+        const offer = await deckOffer({ isInstalled: async () => !lr.notFound });
+        if (!offer) return say(lr.text, 'warn');
+        if (!offer.steps) return say(offer.text, 'warn');
+        R.current.deckAsk = { offer, at: Date.now() };
+        return ask(offer.question, { action: offer.steps.map(s => s.cmd).join(' && '), reason: 'sudo, if shown, asks for your own password in this terminal' });
       }
-      case '/ext': { // EXTENSIONS: /ext list|on|off <name>
-        const [w, nm] = restArg.trim().split(/\s+/);
+      case '/ext': { // EXTENSIONS: /ext list|on|off|tab|set|settings <name>
+        const parts = restArg.trim().split(/\s+/).filter(Boolean);
+        const [w, nm] = parts;
         const list = readExtList();
         if (!w || w === 'list') {
           if (!list.length) return say('No extensions listed. Install one (npm i -g <pkg>) and list it: quox ext add <pkg>.');
-          return say(list.map(x => `${x.name}: ${DK.current.isLoaded(x.name) ? `on (found: ${DK.current.where(x.name)})` : x.enabled ? 'listed, not loaded' : 'off'}`).join('\n'));
+          return say(list.map(x => `${x.name}: ${DK.current.isLoaded(x.name) ? `on (found: ${DK.current.where(x.name)})` : DK.current.failure(x.name) ? `failed: ${DK.current.failure(x.name)}` : x.enabled ? 'listed, not loaded' : 'off'}`).join('\n'));
         }
         if ((w === 'on' || w === 'off') && nm) {
           if (w === 'on') { if (!list.some(x => x.name === nm)) extAdd(nm); else extSetEnabled(nm, true); await extLoad(nm, false); return undefined; }
           extSetEnabled(nm, false); const r = DK.current.unload(nm); return say(r.text, 'ok');
         }
-        return say('Usage: /ext list|on|off <name>', 'warn');
+        if (w === 'tab') { // focus a panel; off collapses; alone cycles
+          if (nm === 'off') { DK.current.hidePanel(); return say('Extension panel closed.'); }
+          if (!nm) { const n = DK.current.cycle(); return n ? say(`${n} panel focused. Esc returns to the composer.`, 'ok') : say('No extension has a panel. /ext list', 'warn'); }
+          const r = DK.current.focusPanel(nm); return say(r.text, r.ok ? 'ok' : 'warn');
+        }
+        if (w === 'settings' && nm) {
+          const r = DK.current.settingsInfo(nm); if (!r.ok) return say(r.text, 'warn');
+          return say(r.defs.map(d => `${d.key} = ${JSON.stringify(r.values[d.key])}  (${d.type}${d.choices ? `: ${d.choices.join('|')}` : ''}, default ${JSON.stringify(d.default)})  ${d.help}`).join('\n'));
+        }
+        if (w === 'set' && nm && parts.length >= 4) {
+          const r = DK.current.setSetting(nm, parts[2], parts.slice(3).join(' ')); return say(r.text, r.ok ? 'ok' : 'warn');
+        }
+        return say('Usage: /ext list | on|off <name> | tab [<name>|off] | settings <name> | set <name> <key> <value>', 'warn');
       }
       case '/watch': return KC.current.watch(restArg);
       case '/automate': return KC.current.automate(restArg);
@@ -2679,18 +3163,63 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (!text) return say(cmd === '/gripe!' ? 'Nothing to file. /gripe <text> first, or /gripe! <text>.' : 'Usage: /gripe <what is wrong>  (/gripe! <text> files without asking)', 'warn');
         if (cmd === '/gripe') { // ask first: filing makes a public-ish issue
           R.current.pendingGripe = { text, at: Date.now() };
-          say(`File this as a GitHub issue via GRIPE? "${clip(text, Math.max(20, cols - 50))}"`);
+          const nl = text.split('\n').length;
+          say(`${gripeLead} File this as a GitHub issue via GRIPE? "${clip(text.split('\n')[0], Math.max(20, cols - 50))}"${nl > 1 ? ` (+${nl - 1} more lines, all of it is filed)` : ''}`);
           return say('/gripe! files it · /gripe <new text> replaces it · anything else leaves it unfiled', 'dim');
         }
         R.current.pendingGripe = null;
         say('Filing via GRIPE…', 'dim');
         const g = await api.gripe(text.slice(0, 4000), { yes: true });
-        if (!g.ok) return say(`Gripe not filed: ${g.message}`, 'warn');
+        if (!g.ok && g.queued) return say(`${g.saved || "Saved; I'll file it when Quox answers again (/gripes shows the queue)"}  (${clip(g.message, 60)})`, 'warn');
+        if (!g.ok) return say(gripeFailedLine(text, g.message), 'warn');
         if (!g.superseded && g.response && !g.url) for (const l of String(g.response).split('\n').filter(Boolean).slice(0, 6)) say(clip(l, cols - 4), 'dim');
         for (const n of g.notes || []) {
-          if (n.kind === 'created') say(`✔ GRIPE │ issue filed │ ${n.url}`, 'ok');
+          if (n.kind === 'created') { say(gripeFiledLine(n.url, text)); say(n.url, 'dim'); }
           else say(clip(n.text, cols * 3), n.kind === 'warn' ? 'warn' : 'dim');
         }
+        if (g.url) gripeSweep.current(); // Quox just answered: file anything saved earlier
+        return undefined;
+      }
+      case '/outbox': { // SLOT-OUTBOX: messages saved while QuoxCORE did not answer
+        const [sub, ...rest] = restArg.trim().split(/\s+/).filter(Boolean);
+        const rows = () => OB.current.list({ profile });
+        if (!sub) {
+          const list = rows();
+          if (!list.length) return say('Outbox is empty. A /say that fails because QuoxCORE is not answering waits here and is sent when it answers.', 'dim');
+          say(`Outbox: ${list.length} message${list.length === 1 ? '' : 's'}. /outbox send retries now, /outbox drop N removes one.`, 'dim');
+          list.forEach((it, i) => {
+            const t = new Date(it.created_at); const hm = `${String(t.getHours()).padStart(2, '0')}:${String(t.getMinutes()).padStart(2, '0')}`;
+            const st = it.status === 'queued' ? '⏸ queued' : it.status === 'sending' ? '◐ sending' : it.status === 'unsure' ? '⚠ may already be delivered (/outbox send retries)' : `✖ refused (${it.error || 'refused'})`;
+            say(`${i + 1}. ${it.slot} · ${hm} │ ${clip(String(it.text).replace(/\s+/g, ' '), Math.max(20, cols - 60))} │ ${st}`, it.status === 'queued' ? 'dim' : 'warn');
+          });
+          return undefined;
+        }
+        if (sub === 'drop') {
+          const n = Number(rest[0]);
+          if (!Number.isInteger(n) || n < 1) return say('Usage: /outbox drop N  (N is the number /outbox shows)', 'warn');
+          const it = OB.current.drop(n, { profile });
+          return say(it ? `Dropped the message to ${it.slot} (${clip(String(it.text).replace(/\s+/g, ' '), 40)}); it will not be sent.` : `No message ${n} in the outbox. /outbox lists them.`, it ? 'ok' : 'warn');
+        }
+        if (sub === 'send') {
+          if (!rows().length) return say('Outbox is empty.', 'dim');
+          const r = await flushOutbox({ explicit: true });
+          if (r.busy) return say('A send is already in progress.', 'dim');
+          if (r.pending > 0) say(`QuoxCORE is still not answering (${r.pending} queued). They will be sent when it does.`, 'warn');
+          else if (!r.sent.length && !r.failed.length) say('Nothing to send.', 'dim');
+          return undefined;
+        }
+        return say('Usage: /outbox  |  /outbox drop N  |  /outbox send', 'warn');
+      }
+      case '/gripes': {
+        if (!api.gripes) return say('/gripes is not available in this mode.', 'warn');
+        const rows = api.gripes();
+        if (!rows.length) return say('No queued or recent gripes. /gripe! files one.', 'dim');
+        const queued = rows.filter(g => g.status === 'queued').length;
+        say(`Gripes: ${queued} waiting to be filed, ${rows.length - queued} recent`, 'dim');
+        for (const g of rows.slice(-12)) {
+          const where = g.status === 'filed' ? g.url : g.status === 'queued' ? 'queued, will retry' : g.status === 'expired' ? 'not filed (gave up after 24 h)' : `not filed (${g.error || 'refused'})`;
+          say(`${g.status === 'filed' ? '✔' : '◐'} ${clip(g.text, Math.max(20, cols - 70))} │ ${where}`, g.status === 'filed' ? 'ok' : 'warn');
+        }
         return undefined;
       }
       case '/context':
@@ -2926,8 +3455,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           const q = restArg.trim();
           const m = matchOrg(q, list);
           if (m.org) return switchOrgNow(m.org, { quick: true });
-          const words = q.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
-          const part = orgRows(list).filter(o => words.every(w => `${o.name} ${o.slug || ''}`.toLowerCase().includes(w)));
+          const part = orgCandidates(q, list); // verb stripped, best-matching token: never a dead end on a typo
           if (!part.length) return say(`No org of yours matches "${q}". /org lists them.`, 'warn');
           openOrgPicker(part, `Orgs matching "${q}"`);
           return undefined;
@@ -3000,6 +3528,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           return undefined;
         } catch (e) { return say(`Action Tracker: ${e?.message || 'failed'}`, 'warn'); }
       }
+      case '/callmeforapprovals': case '/callme': {
+        if (!api.callMe) return say('This server has no call-me setting.', 'warn');
+        try {
+          const { data, changed } = await api.callMe(parseCallMeSlashArgs(restArg));
+          const lines = callMeStatusLines(data);
+          return say(`${changed ? 'Updated. ' : ''}${lines.join('\n')}`);
+        } catch (e) { return say(`Call me for approvals: ${e?.headline || e?.message || 'failed'}`, 'warn'); }
+      }
       case '/plugin': case '/extensions': case '/extension': case '/addons': case '/apps': case '/plugins': {
         if (!api.pluginList) return say('This server has no plugin list.', 'warn');
         const want = /^(list|ls|all)?$/i.test(restArg.trim()) ? '' : restArg.trim().split(/\s+/)[0]; // "/extension list" is just the list
@@ -3090,6 +3626,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         for (const src of ro.sources || []) {
           say(`${src.state === 'connected' ? '✔' : src.state === 'error' ? '✖' : '·'} ${src.label}: ${src.state === 'connected' ? `${src.count} shown` : `${src.state}${src.note ? ` (${src.note})` : ''}`}`, src.state === 'error' ? 'warn' : undefined);
         }
+        for (const src of ro.sources || []) {
+          if (src.id === 'agents' && src.state === 'connected') for (const l of attachLines(src.items, Date.now())) say(l);
+          if (src.id === 'boxsessions' && src.state === 'connected') for (const l of sessionLines(src.items)) say(l, /x\d/.test(l) ? 'warn' : undefined);
+        }
         if (ro.sources) say('Down on an empty composer focuses the roster. Enter peeks, s stops (y confirms), Esc returns.');
         return undefined;
       }
@@ -3116,17 +3656,65 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         return dispatch({ type: 'object', obj: { type: 'sitrep', data: sitrepData(r.situation, r.approvals) } });
       }
       case '/afk': { // owner 2026-10-15: "/afk need a break, keep my requests organised for my return"
-        const at = Date.now(); AWAY.current.last = at; AWAY.current.afk = { at, note: restArg || '' };
+        if (afkMeansSleep(restArg)) { await sleepNow(); return command('/dragon sleep'); } // owner 2026-10-29: "/afk going to bed" is /sleep
+        const at = Date.now(); AWAY.current.last = at; AWAY.current.afk = { at, note: restArg || '', dnd: true }; AWAY.current.col ||= newCollected();
         try { away?.write?.(profile, at); } catch { /* the in-memory mark still works for this window */ }
         say(`Away from ${new Date(at).toISOString().slice(11, 16)} UTC${restArg ? ` (${clip(restArg, 80)})` : ''}. Approvals and messages keep collecting; when you're back, /back shows everything since, grouped.`, 'ok');
-        const pr = await setPresence('away', restArg);
+        const pr = await setPresence('away', restArg, { dnd: true });
         if (!pr.ok) presenceFail(pr);
         else if (!pr.local) say(`Sessions now see: ${pr.notice || 'you are away'}. Nothing is approved while you are away; /back or any message marks you present.`, 'dim');
+        offerDndToo();
+        return undefined;
+      }
+      case '/donotdisturb': case '/dnd': {
+        const p = parseDndArgs(restArg);
+        if (!p.ok) return say(p.error, 'warn');
+        // owner 2026-10-29: a bare /dnd never turns DND off. The old toggle read /afk's away mark as "DND on" and reported "off" on the first press.
+        if (p.op === 'toggle' && AWAY.current.afk?.explicit) return say('Do not disturb is already on. /dnd off turns it off, /back ends it.', 'dim');
+        if (p.op === 'off') return AWAY.current.afk ? dndOff() : say('Do not disturb is off.', 'dim');
+        return dndOn(p.until);
+      }
+      case '/morningreport': {
+        // The report is about the most recent DND/away window (start to end, or now if still on), not the current on/off state.
+        const live = AWAY.current.afk ? { since: AWAY.current.col?.since, col: AWAY.current.col } : null;
+        const win = live || AWAY.current.lastWindow || (AWAY.current.col ? { since: AWAY.current.col.since, col: AWAY.current.col } : null);
+        const held = (c) => Boolean(c && ((c.inbox?.length || 0) + (c.slots?.length || 0)));
+        if (!win || (!AWAY.current.afk && !held(win.col))) { // nothing held in the last window: same since-last-seen digest as /away, honest note first
+          say(win ? 'Nothing was held in your last do not disturb window. Here is what happened since you were last here.' : 'Nothing was held: do not disturb was off. Here is what happened since you were last here.', 'dim');
+          return command('/away');
+        }
+        const col = win.col;
+        const approvals = Math.max(S.current.notify?.approvals || 0, [...S.current.approvals, ...S.current.waiting].length);
+        const sessions = (R.current.roster.allRows || []).filter((x) => x.state === 'waiting').map((x) => String(x.name || x.key || 'a session')).slice(0, 8);
+        const hm = (ms) => new Date(ms).toISOString().slice(11, 16);
+        say(`🌙 Morning report${win.since ? ` since ${hm(win.since)} UTC` : ''}${win.until ? ` until ${hm(win.until)} UTC` : ''}`, 'ok');
+        for (const [t, tone] of morningLines(col || newCollected(), { approvals, sessions })) say(t, tone);
+        if (api.away && win.since) { try { dispatch({ type: 'object', obj: { type: 'away', data: await api.away(new Date(win.since).toISOString()) } }); } catch { /* the local digest above stands */ } }
+        if (AWAY.current.afk) {
+          AWAY.current.col = newCollected();
+          R.current.dndAsk = { at: Date.now(), off: true }; say(askText('Good morning. Turn off do not disturb?', { action: 'end do not disturb and show approvals again (same as /dnd off)' }), 'ask');
+        }
         return undefined;
       }
-      case '/back': { // PRESENCE: present on the server too, then the digest
-        AWAY.current.afk = null;
-        const pr = await setPresence('present');
+      case '/back': { // PRESENCE: present on the server too, then the digest (also ends do not disturb)
+        // Presence is owner-level: if another window's first act already ended this away, the server's since/until win.
+        let ended = null;
+        if (AWAY.current.afk && api.getPresence) {
+          try {
+            const sp = await api.getPresence();
+            const ea = sp?.ok && sp.presence && sp.presence.away !== true ? sp.presence.ended_away : null;
+            if (ea && Date.parse(ea.until) >= AWAY.current.afk.at - 60000) ended = ea;
+          } catch { /* unreadable: fall through to this window's own marks */ }
+        }
+        archiveWindow();
+        AWAY.current.afk = null; AWAY.current.col = null;
+        if (ended && api.away) {
+          say(`✔ Welcome back, you were already marked present at ${new Date(ended.until).toISOString().slice(11, 16)} UTC (${ended.via || 'activity'} in another window).`, 'ok');
+          try { dispatch({ type: 'object', obj: { type: 'away', data: { ...(await api.away(ended.since)), endedAt: ended.until } } }); }
+          catch (e) { say(`away: could not read the digest (${e?.status ? `HTTP ${e.status}` : e?.message || 'failed'}). Nothing is assumed.`, 'warn'); }
+          return undefined;
+        }
+        const pr = await setPresence('present', undefined, { human: true });
         if (!pr.ok) presenceFail(pr);
         return command('/away');
       }
@@ -3136,7 +3724,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (!api.slotSay) return say('Slots are not available in this mode.', 'warn');
         const r = await api.slotSay('quoxon', restArg.trim(), { from: myLabel(), fast: true, fromSlot: where.current.slot || null });
         if (!r.ok) return say(`observe: not delivered (${r.message})`, 'warn');
-        return say('✔ noted for the observer (quoxon)', 'ok');
+        return say(`✔ noted for the observer (quoxon${r.viaOrgName ? ` in ${r.viaOrgName}` : ''})`, 'ok');
       }
       case '/poke': case '/wake': case '/nudge': case '/ping': case '/slap': case '/awaken': { // owner tried all five on 2026-10-15
         const m = parsePokeArgs(restArg); // FORCE-WAKE: --force is a no-op, never page text
@@ -3175,17 +3763,31 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         try { items = await api.inboxItems({ limit: 30 }); }
         catch (e) { return dispatch({ type: 'error', text: `Could not read the inbox (${e.message}). That does not mean it is empty; try again or run: quox inbox list` }); }
         const top = newestFirst(items).slice(0, 10);
-        R.current.inboxList = top; R.current.inboxSeen = new Set(items.map((i) => i?.id).filter(Boolean));
-        dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols) } });
+        R.current.inboxList = top; R.current.inboxSeen = arrivals(items, R.current.inboxSeen || null).ids;
+        dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols, barOpts()) } });
+        if (q.kind === 'mutes') { for (const l of mutesLines(inboxMutes())) say(l.text, l.tone); return undefined; }
+        if (q.kind === 'mute' || q.kind === 'unmute') {
+          const key = q.source.toLowerCase(); const next = { ...inboxMutes() };
+          if (q.kind === 'mute') next[key] = Date.now() + q.ms; else if (!next[key]) return say(`${q.source} is not muted. ${mark('/inbox mutes')} lists them.`, 'warn'); else delete next[key];
+          if (api.saveSetting) api.saveSetting('inboxMutes', next); else (R.current.sessionSettings ||= {}).inboxMutes = next;
+          dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols, barOpts()) } });
+          return say(q.kind === 'mute' ? `✔ muted ${q.source} for ${Math.round(q.ms / 360000) / 10}h: no arrival lines, out of the bar count, still listed in /inbox. Approvals are never muted. ${mark(`/inbox unmute ${q.source}`)} undoes it.` : `✔ unmuted ${q.source}`, 'ok');
+        }
         const pick = (n) => { const it = top[n - 1]; if (!it) say(`No item ${n}: the list has ${top.length}. ${mark('/inbox')} shows it.`, 'warn'); return it; };
-        if (q.kind === 'list') { for (const l of inboxTable(items, Date.now(), cols)) say(l.text, l.tone === 'accent' ? 'warn' : l.tone); return undefined; }
-        if (q.kind === 'read') {
-          const targets = q.all ? top.filter((i) => !i.is_read) : [pick(q.n)].filter(Boolean);
-          if (!targets.length) return q.all ? say('Nothing unread.', 'dim') : undefined;
-          let ok = 0; const bad = [];
-          for (const it of targets) { try { await api.inboxMarkRead(it.id, true); ok++; } catch (e) { bad.push(e?.message || 'failed'); } }
-          if (bad.length) say(`Marked ${ok} read; ${bad.length} failed (${clip(bad[0], 60)}).`, 'warn'); else say(`✔ marked ${ok} read`, 'ok');
-          refreshInboxBar();
+        if (q.kind === 'list') { for (const l of inboxTable(items, Date.now(), cols, 10, inboxMutes())) say(l.text, l.tone === 'accent' ? 'warn' : l.tone); return undefined; }
+        if (q.kind === 'read' || q.kind === 'unread') {
+          const markRead = q.kind === 'read';
+          let targets;
+          if (q.all) { // "all" is ALL unread, paged through the API, not just the 10 listed
+            let every; try { every = api.inboxAllItems ? await api.inboxAllItems() : await api.inboxItems({ limit: 100 }); } catch (e) { return dispatch({ type: 'error', text: `Could not read the whole inbox (${e.message}). Nothing was marked ${q.kind}.` }); }
+            targets = markRead ? unreadItems(every) : readItems(every);
+          } else targets = (q.ns || [q.n]).map(pick).filter(Boolean);
+          if (!targets.length) return q.all ? say(markRead ? 'Nothing unread.' : 'Nothing read to mark unread.', 'dim') : undefined;
+          let ok = 0; const bad = []; let next = 0;
+          const worker = async () => { while (next < targets.length) { const it = targets[next++]; try { await api.inboxMarkRead(it.id, markRead); ok++; } catch (e) { bad.push(e?.message || 'failed'); } } };
+          await Promise.all(Array.from({ length: Math.min(5, targets.length) }, worker));
+          if (bad.length) say(`Marked ${ok} ${q.kind}; ${bad.length} failed (${clip(bad[0], 60)}).`, 'warn'); else say(`✔ marked ${ok} ${q.kind}`, 'ok');
+          refreshInboxBar({ force: true });
           return undefined;
         }
         const it = pick(q.n); if (!it) return undefined;
@@ -3195,21 +3797,52 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           return command(at >= 0 ? `/approvals ${at + 1}` : '/approvals');
         }
         let full = it; try { full = (await api.inboxItem(it.id)) || it; } catch (e) { say(`Could not load the full item (${clip(e?.message || 'failed', 60)}); showing the list row.`, 'warn'); }
-        for (const l of inboxDetail(full)) say(l.text, l.tone === 'accent' ? 'ok' : l.tone === 'text' ? undefined : l.tone);
-        if (isApprovalItem(full)) say(`This is an approval: ${mark(`/inbox open ${q.n}`)} takes you to it.`, 'dim');
-        refreshInboxBar();
+        for (const l of inboxDetail(full, Date.now(), q.n)) say(l.text, l.tone === 'accent' ? 'ok' : l.tone === 'text' ? undefined : l.tone);
+        refreshInboxBar({ force: true });
+        return undefined;
+      }
+      case '/mail': { // TUI-MAIL: triaged InboxQ mail, read only (same reads as `quox mail list`)
+        if (!api.mailMessages) return say('Mail is not available in this mode.', 'warn');
+        const q = parseMail(restArg);
+        if (q.kind === 'usage') return say(MAIL_USAGE, 'warn');
+        let list;
+        try { list = mailNewestFirst(await api.mailMessages({ limit: 30, zone: q.zone })).slice(0, 10); }
+        catch (e) { return dispatch({ type: 'error', text: `Could not read your mail (${e.message}). That does not mean it is empty; try again or run: quox mail list` }); }
+        if (!list.length && !q.zone) {
+          let accts = null; try { accts = await api.mailAccounts(); } catch { /* unknown: fall through to the plain empty line */ }
+          if (accts && !accts.length) { for (const l of noMailboxLines()) say(l.text, l.tone); return undefined; }
+        }
+        if (q.kind === 'list') { for (const l of mailTable(list, Date.now(), cols, 10)) say(l.text, l.tone === 'accent' ? 'warn' : l.tone); return undefined; }
+        const m = list[q.n - 1]; if (!m) return say(`No message ${q.n}: the list has ${list.length}. ${mark('/mail')} shows it.`, 'warn');
+        let full = m; try { full = (await api.mailMessage(m.id)) || m; } catch (e) { say(`Could not load the full message (${clip(e?.message || 'failed', 60)}); showing the list row.`, 'warn'); }
+        for (const l of mailDetail(full, Date.now(), q.n)) say(l.text, l.tone === 'accent' ? 'ok' : l.tone === 'text' ? undefined : l.tone);
         return undefined;
       }
       case '/approvals': {
         if (/^help$/i.test(restArg.trim())) { // the syntax lives here, not above every list
-          say(`${mark('/approve N')} ${mark('/deny N <reason>')} ${mark('/approvals N')} detail ${mark('/approvals walkthrough')} one at a time ${mark('/approvals mine|agents|old|<agent>')} filter (privileged: ${mark('/approve N confirm')})`);
+          say(`${mark('/approve N')} ${mark('/deny N <reason>')} ${mark('/approvals N')} detail ${mark('/approvals walkthrough')} one at a time ${mark('/approvals mine|agents|old|<agent>')} filter ${mark('/approvals auto on|off')} open new ones by themselves (privileged: ${mark('/approve N confirm')})`);
           return undefined;
         }
+        if (/^auto\b/i.test(restArg.trim())) { // APPROVALS-AUTO: the real verb behind "/approvals instant-interrupt"
+          const a = parseApprovalsArg(restArg);
+          if (a.kind !== 'auto') return say(`Unknown option "${restArg.trim()}" for /approvals. Use ${mark('/approvals auto on')} or ${mark('/approvals auto off')}.`, 'warn');
+          const st = AO.current.st;
+          if (a.set === null) return say(`New approvals open by themselves: ${st.enabled ? 'on' : 'off'}. ${mark(`/approvals auto ${st.enabled ? 'off' : 'on'}`)} changes it.`);
+          st.enabled = a.set;
+          const saved = api.saveSetting ? api.saveSetting('approvalsAuto', a.set) : false;
+          return say(a.set ? `✔ New approvals and questions now open by themselves as a card (after your draft or turn, never mid-typing). Nothing is ever answered for you.${saved ? '' : ' (Not saved to this profile: this window only.)'}` : `✔ New approvals no longer open by themselves; the ⏸ line and ${mark('/approvals')} still show them.${saved ? '' : ' (Not saved to this profile: this window only.)'}`, 'ok');
+        }
         let items;
-        try { items = await api.approvals(); }
-        catch (e) { return dispatch({ type: 'error', text: `Could not check inbox approvals (${e.message}). That does not mean nothing is waiting; try again or run: quox inbox list` }); }
         let stats = null; let statsErr = null;
-        if (api.approvalStats) { try { stats = await api.approvalStats(); } catch (e) { statsErr = e.message; } }
+        // the list and the org-wide count are independent reads: ask together (the first decision waited on both in turn)
+        const statsP = api.approvalStats ? api.approvalStats().then((v) => { stats = v; }, (e) => { statsErr = e.message; }) : Promise.resolve();
+        // approvals waiting in the user's OTHER orgs: a count and the switch command, never their contents
+        let moreOrgs = [];
+        const moreP = api.otherOrgApprovals ? api.otherOrgApprovals().then((v) => { moreOrgs = crossOrgTuiLines(v); }, () => {}) : Promise.resolve();
+        try { items = await api.approvals(); }
+        catch (e) { await statsP; return dispatch({ type: 'error', text: `Could not check inbox approvals (${e.message}). That does not mean nothing is waiting; try again or run: quox inbox list` }); }
+        await Promise.all([statsP, moreP]);
+        const sayMoreOrgs = () => { for (const l of moreOrgs) say(l, 'warn'); };
         const cardIds = [...S.current.approvals, ...S.current.waiting].map(x => x.inboxItemId).filter(Boolean);
         const groups = groupApprovals(items, { conversationId: S.current.ctx.conversationId, cardIds });
         const flat = groups.flatMap(g => g.items.map(x => x.item));
@@ -3217,11 +3850,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         R.current.shownIds = flat.map(x => x.id);
         dispatch({ type: 'notify', patch: { approvals: flat.length, error: null } });
         const hidden = stats ? Math.max(0, stats.awaiting - flat.length) : 0;
-        if (!flat.length && !hidden && !statsErr) return say('Nothing waiting for you.', 'ok');
         const fArg = restArg.trim();
+        { const pk = parseApprovalsArg(fArg, { items: flat }); if (pk.kind === 'unknown') return say(`Unknown option "${fArg}" for /approvals. Options: ${APPROVALS_OPTIONS}.${/instant|interrupt|pop|auto/i.test(fArg) ? ` To have new ones open by themselves: ${mark('/approvals auto on')}.` : ''}`, 'warn'); }
+        if (!flat.length && !hidden && !statsErr) { say('Nothing waiting for you.', 'ok'); sayMoreOrgs(); return undefined; }
         if (/^walkthrough$/i.test(fArg)) { // plain approvals walk as cards too, after any session questions
           const plain = flat.filter(x => !isDecision(x));
           if (plain.length && plain.length === flat.length) say(`No session questions; ${plain.length} approval${plain.length === 1 ? '' : 's'} waiting, starting with the first.`, 'warn');
+          sayMoreOrgs();
           return walkStart(flat.map(approvalAsWalkItem), { fresh: true });
         }
         if (/^\d+$/.test(fArg)) { // /approvals N: everything the item carries
@@ -3258,6 +3893,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           say(`${hidden} more approval${hidden === 1 ? ' is' : 's are'} waiting org-wide. This window is signed in as ${whoTxt}.${others.length ? ` Quit and run: quox -p ${others[0]}${others.length > 1 ? ` (human profiles found: ${others.join(', ')})` : ''}. Or approve in the dashboard Approvals page, or: quox inbox -p ${others[0]} respond <id> --action approve|reject` : ' Approve in the dashboard Approvals page.'}`, 'warn');
           if (agentLogin) offerSwitch(); // one keypress instead of quit and relaunch
         }
+        sayMoreOrgs();
         if (statsErr) say(`Could not check the org-wide approval count (${statsErr}); the list above is what the inbox returned.`, 'warn');
         return undefined;
       }
@@ -3295,12 +3931,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         return say(m.text, m.tone || undefined);
       }
       case '/sleep': { // owner typed /sleep first (2026-10-16); it now MEANS sleeping: sessions stop waiting on approvals
-        const at = Date.now(); AWAY.current.last = at; AWAY.current.afk = { at, note: 'sleeping' };
-        try { away?.write?.(profile, at); } catch { /* the in-memory mark still works for this window */ }
-        const pr = await setPresence('sleeping');
-        if (!pr.ok) presenceFail(pr);
+        await sleepNow();
         return command('/dragon sleep');
       }
+      case '/broadcast-active': return command(`/broadcast --active${restArg ? ` ${restArg}` : ''}`);
       case '/roar': return command(`/broadcast${restArg ? ` ${restArg}` : ''}`);
       case '/soar': return command(`/fleet${restArg ? ` ${restArg}` : ''}`);
       case '/summon': return command(`/attach${restArg ? ` ${restArg}` : ''}`);
@@ -3334,6 +3968,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (/\d{4,}/.test(restArg)) return say('Never type your PIN after a command. It is asked for in a private card.', 'warn');
         await SUC.current.authenticate(); bump(n => n + 1); return undefined;
       }
+      case '/verify-email': return SUC.current.verifyEmail(restArg); // the TUI front of `quox admin users verify-email`: preview, y/N, hidden PIN card, same endpoint
       case '/override': {
         const res = await SUC.current.override(restArg);
         if (res?.override_id && res.enforced) R.current.override = { id: res.override_id, until: Date.parse(res.expires_at) || Date.now() + 300000 };
@@ -3347,7 +3982,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           if (!li.length) { try { li = groupApprovals(await api.approvals(), { conversationId: S.current.ctx.conversationId, cardIds: [...S.current.approvals, ...S.current.waiting].map(x => x.inboxItemId).filter(Boolean) }).flatMap(g => g.items.map(x => x.item)); dispatch({ type: 'inbox', items: li }); } catch (e) { return dispatch({ type: 'error', text: `Could not check inbox approvals (${e.message}); try again or run: quox inbox list` }); } }
           const needs = li.map((x, k) => ((isDecision(x) ? x.payload.high_risk === true && x.payload.options.some(o => o.key === 'y') : (x.payload?.approval_context?.risk === 'high' || x.payload?.high_risk === true)) ? k + 1 : 0)).filter(Boolean);
           if (needs.length === 1) authArg = String(needs[0]);
-          else return say(needs.length ? `${needs.length} items need your PIN, so say which: ${needs.map(k => mark(`/authorise ${k}`)).join(' ')}` : 'Usage: /authorise N  (approve item N with your PIN; list them with /approvals). Nothing waiting needs a PIN right now.', 'warn');
+          else if (needs.length) return say(`${needs.length} items need your PIN, so say which: ${needs.map(k => mark(`/authorise ${k}`)).join(' ')}`, 'warn');
+          else if (li.length === 1) authArg = '1'; // DS-010: one thing is waiting; the server decides if it needs the PIN, and /approve asks for it
+          else if (li.length) return say(`${li.length} items are waiting and none is marked as needing a PIN up front, so say which to approve with your PIN: ${li.slice(0, 5).map((_, k) => mark(`/authorise ${k + 1}`)).join(' ')}${li.length > 5 ? ' ...' : ''}   (the server asks for the PIN on anything an agent raised)`, 'warn');
+          else return say(`Nothing is waiting for your approval, so there is nothing to authorise. ${mark('/approvals')} lists what is open. /authenticate opens a human-present window ahead of time.`, 'warn');
         }
         R.current.authorising = true; // /approve's answer() asks for the PIN first when there is no live step-up
         try { await command(`/approve ${authArg}`); } finally { R.current.authorising = false; }
@@ -3396,7 +4034,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           const okIds = []; const failedK = [];
           for (const k of pa.ns) {
             const x = list[k - 1];
-            const go = () => api.answerDecision(x.id, keyOf(k), { note: pa.note || null, stepUp: SU.current.headers('approve'), bulk: bulkAns });
+            const go = () => { ownerActed('answer'); return api.answerDecision(x.id, keyOf(k), { note: pa.note || null, stepUp: SU.current.headers('approve'), bulk: bulkAns }); };
             try {
               try { await go(); }
               catch (e) { if (!(e?.status === 403 && e?.body?.error === 'step_up_required')) throw e; SU.current.drop('approve'); await askPin(); await go(); }
@@ -3419,7 +4057,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         }
         const it = list[pa.n - 1];
         if (!it) return say(`No such item: [${pa.n}] (${list.length} listed).`, 'warn');
-        if (!isDecision(it)) return say(`[${pa.n}] is an approval, not a question. Use ${mark(`/approve ${pa.n}`)} or ${mark(`/deny ${pa.n} <reason>`)}.`, 'warn');
+        if (!isDecision(it)) { // DS-010 / #1191: a yes or no on an approval goes to /approve or /deny, which asks for the PIN itself
+          if (pa.key === 'y') return command(`/approve ${pa.n}`);
+          if (pa.key === 'n') return command(`/deny ${pa.n}${pa.note ? ` ${pa.note}` : ''}`);
+          return say(`[${pa.n}] is an approval, not a question. Use ${mark(`/approve ${pa.n}`)} or ${mark(`/deny ${pa.n} <reason>`)}.`, 'warn');
+        }
         if (!it.payload.options.some(o => o.key === pa.key)) return say(`[${pa.n}] has no option "${pa.key}". Options: ${it.payload.options.map(o => `(${o.key}) ${o.label}`).join(' ')}`, 'warn');
         if (pa.note && noteNeedsConfirm(pa.note) && !R.current.noteBypass) { noteCard({ walk: false, cmd: `${pa.n} ${pa.key}`, key: pa.key, label: it.payload.options.find(o => o.key === pa.key).label, note: pa.note, id: it.id }); return undefined; }
         say(`Answering: ${clip(it.title || it.id, Math.max(20, cols - 30))} → ${it.payload.options.find(o => o.key === pa.key).label} (${pa.key})${pa.note ? `, with your note (${pa.note.length} characters)` : ''}`, 'dim'); // DECISION-LABELS: say which question and which option BEFORE it is sent
@@ -3428,7 +4070,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           const subject = { line1: `answer ${String(it.title || "")}`, raisedBy: it.payload.session || null, risk: 'high' };
           const askPin = async () => { const r = await SU.current.request({ scope: 'approve', orgId: api.orgId?.() || null, subject }); if (!r.ok) { const err = new Error(declinedText(r.reason)); err.stepUpDeclined = true; throw err; } };
           if (gate && !SU.current.token('approve')) await askPin();
-          const go = () => api.answerDecision(it.id, pa.key, { note: pa.note || null, stepUp: SU.current.headers('approve') });
+          const go = () => { ownerActed('answer'); return api.answerDecision(it.id, pa.key, { note: pa.note || null, stepUp: SU.current.headers('approve') }); };
           try { await go(); }
           catch (e) {
             if (!(e?.status === 403 && e?.body?.error === 'step_up_required')) throw e;
@@ -3493,12 +4135,19 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           if (!targets.length) return say(`Nothing waiting from "${agent}". ${mark('/approvals agents')} shows who is asking.`, 'warn');
         }
         const privOf = (it) => isPrivileged({ tool: it.payload?.approval_context?.method?.tool, risk: it.payload?.approval_context?.risk, flag: it.payload?.privileged === true || it.payload?.approval_context?.privileged === true, title: it.title });
-        const bulkish = Boolean(all || agent || targets.length > 1); const heldRisky = [];
+        const bulkish = Boolean(all || agent || targets.length > 1); const heldRisky = []; const heldDel = [];
         const heldDecisions = []; const done = []; const heldPriv = []; const failed = []; const missing = []; const gone = [];
         const label = (k) => { const it = list[k - 1]; return `[${k}] ${approvalSourceLabel(it)}: ${approvalWhat(it)}`; }; // owner 2026-10-15: no repeated who, no cut at all (lines wrap); the server caps summary length
         for (const k of targets) {
           const it = list[k - 1];
           if (!it) { missing.push(k); continue; }
+          if (verb === 'approve' && isDestructive(it)) { // a delete is never part of a bulk yes, and a single one needs its name typed
+            if (bulkish) { heldDel.push(k); continue; }
+            if (R.current.delBypass !== it.id) {
+              startDelConfirm(destructiveObject(it), async () => { R.current.delBypass = it.id; try { const n2 = S.current.inbox.findIndex(x => x.id === it.id) + 1; await command(`${cmd} ${n2 || k}`); } finally { R.current.delBypass = null; } });
+              continue;
+            }
+          }
           if (isDecision(it)) {
             if (all || agent) { heldDecisions.push(k); continue; } // a bulk approve never answers a human question for you
             if (verb === 'approve' && bulkish && isHeldFromBulk(it)) { heldRisky.push(k); continue; } // risky asks are never part of a bulk yes
@@ -3510,7 +4159,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
             const dsc = describeInboxItem(it); // APPROVAL-WHAT: record the real action and target, not a clipped title
             const r = await answer({ callId: it.id, inboxItemId: it.id, approvalId: it.approval_id || it.approvalId || null, tool: dsc.tool || clip(it.title || it.id, cols - 40), target: dsc.target, raisedBy: approvalSourceLabel(it), risk: it.payload?.approval_context?.risk || null }, verb, { batch: true, reason, proactive: Boolean(R.current.authorising) && verb === 'approve', bulk: bulkish && isDecision(it) });
             if (r?.gone) gone.push(k); else if (r?.ok) { done.push(k); R.current.lastAnswered = it.id; }
-          } catch (e) { failed.push(`[${k}] ${e.message}`); }
+          } catch (e) {
+            failed.push(`[${k}] ${e.message}`);
+            if (e?.stepUpDeclined) { const rest = targets.slice(targets.indexOf(k) + 1).filter(j => list[j - 1]); if (rest.length) failed.push(`${rest.map(j => `[${j}]`).join(' ')} not tried: the PIN was not given, so nothing more was sent`); break; } // DS-010: one PIN ask per batch, a "no" ends it
+          }
         }
         if (done.length || gone.length || failed.length || missing.length) say(' ');
         for (const k of done) say(`${verb === 'approve' ? '✔ approved' : '✔ denied'} ${label(k)}${reason ? ` (reason: ${clip(reason, 40)})` : ''}`, 'ok');
@@ -3531,13 +4183,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (ynShown.length) say(`${ynShown.length} decision${ynShown.length === 1 ? '' : 's'} left for you to pick: ${ynShown.map(k => `/answer ${k} ${list[k - 1].payload.options.map(o => o.key).join('|')}`).join(', ')} (or /deny ${ynShown.join(',')} <reason>)`, 'warn');
         if (ynHeld.length) { // ONE card for the LOW-RISK y/N decisions only, each listed in full; risky ones were held back for the walkthrough
           for (const k of ynHeld) say(`  [${k}] ${list[k - 1].title || list[k - 1].id}`, 'dim');
-          R.current.pendingGrant = { cmd, verb, items: ynHeld.map(k => list[k - 1]), ks: ynHeld, decisions: true, hi: 0, at: Date.now(), thenWalk: walkKs.length ? walkKs.map(k => list[k - 1]) : null };
+          R.current.pendingGrant = { cmd, verb, items: ynHeld.map(k => list[k - 1]), ks: ynHeld, decisions: true, hi: 0, at: Date.now(), thenWalk: walkKs.length ? walkKs.map(k => approvalAsWalkItem(list[k - 1])) : null };
           ask(`Answer yes to ${ynHeld.length === 1 ? 'it' : `all ${ynHeld.length}`}?`, { who: '', action: `/answer ${ynHeld.join(',')} y`, reason: `${walkKs.length ? `${walkKs.length} risky or lettered held back for the walkthrough. ` : ''}Each one listed above is answered yes.`, keys: 'y answers yes to these, N cancels' });
         }
         if (walkKs.length) {
           say(`${walkKs.length} question${walkKs.length === 1 ? '' : 's'} held back from any bulk yes (${[...new Set(walkKs.map(k => heldReason(list[k - 1]) || 'needs a real choice'))].join(', ')}). I will take ${walkKs.length === 1 ? 'it' : 'them'} one at a time, with the full text, each with your own yes.`, 'warn');
-          if (!ynHeld.length) walkStart(walkKs.map(k => list[k - 1])); // with a bulk card up, the walkthrough starts once the card is answered
+          if (!ynHeld.length) walkStart(walkKs.map(k => approvalAsWalkItem(list[k - 1]))); // with a bulk card up, the walkthrough starts once the card is answered
         }
+        if (heldDel.length) say(`${heldDel.length} delete${heldDel.length === 1 ? '' : 's'} left for you to confirm one by one: ${heldDel.map(k => `${cmd} ${k}`).join(', ')}`, 'warn');
         if (heldPriv.length && (all || agent)) say(`${heldPriv.length} privileged left: ${heldPriv.map(k => `${cmd} ${k} confirm`).join(', ')}`, 'warn');
         else if (heldPriv.length) { // ask inline instead of sending the user to a second command
           R.current.pendingGrant = { cmd, verb, items: heldPriv.map(k => list[k - 1]), at: Date.now() };
@@ -3599,10 +4252,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   function openAskStates() {
     const fresh = (x) => (x && Date.now() - (x.at ?? 0) < ASK_TTL ? x : null);
     const W = R.current.pendingWalk; const walkCardSt = W && W.card && Date.now() - W.at < WALK_TTL ? W.card : null; // WALK-FIXES: one card per decision, open as long as the walk (30 min), not the 2-minute ask clock
-    return [walkCardSt, ...[R.current.wakeAsk, R.current.pendingGrant, R.current.feedbackAsk, R.current.slotAsk, R.current.slotCreateAsk, R.current.sayLastAsk, R.current.profileAsk, R.current.cliAsk, R.current.installAsk, R.current.updateAsk, R.current.orgPending, R.current.hatPending, HW.current.card(), RW.current.walk.card(), R.current.suggestAsk && !R.current.suggestLine ? R.current.suggestAsk : null, R.current.objectiveAsk, R.current.handoffAsk, R.current.askQuox, R.current.strayAsk, R.current.planAsk, SC.current.pendingFile, SC.current.reattach, CH.current.pending, SPN.current.pending].map(fresh)].filter(Boolean);
+    return [walkCardSt, ...[R.current.wakeAsk, R.current.pendingGrant, R.current.feedbackAsk, R.current.slotAsk, R.current.slotCreateAsk, R.current.sayLastAsk, R.current.profileAsk, R.current.loginAsk, R.current.neverAsk, R.current.dndAsk, R.current.secretAsk, R.current.limitedAsk, R.current.cliAsk, R.current.deckAsk, R.current.installAsk, R.current.updateAsk, R.current.orgPending, R.current.hatPending, HW.current.card(), RW.current.walk.card(), R.current.suggestAsk && !R.current.suggestLine ? R.current.suggestAsk : null, R.current.objectiveAsk, R.current.handoffAsk, R.current.askQuox, R.current.strayAsk, R.current.planAsk, SC.current.pendingFile, SC.current.reattach, CH.current.pending, SPN.current.pending].map(fresh)].filter(Boolean);
   }
-  const askOpen = () => openAskStates().length > 0 || KC.current.pending?.() || UW.current.pending?.() || runAskOpen();
-  function touchAsks() { for (const x of openAskStates()) x.at = Date.now(); KC.current.touch?.(); UW.current.touch?.(); }
+  const askOpen = () => openAskStates().length > 0 || KC.current.pending?.() || SUC.current.pending() || UW.current.pending?.() || runAskOpen();
+  function touchAsks() { for (const x of openAskStates()) x.at = Date.now(); KC.current.touch?.(); SUC.current.touch(); UW.current.touch?.(); }
   // ASK-SETTLE (owner 2026-10-17: "questions should go once answered, or change to answer"): each live ask card is
   // bound to the open state it asks about; once that state is no longer open the card goes and ONE line stays:
   // "✔ Wake it now? yes (00:44)", "⌛ ... expired, not answered", "↷ ... no longer open". Run requests likewise.
@@ -3632,6 +4285,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (askStateOpen(st)) continue;
       bind.delete(cd.id);
       const expired = st && typeof st === 'object' ? now - (st.at ?? 0) >= ASK_TTL : false;
+      if (expired && st === SC.current.reattach && st.slot) R.current.declinedSlot = st.slot; // an unanswered reattach counts as a decline across the auto-restart of this window
       if (st && typeof st === 'object' && st.walkWhy) { // a walkthrough card: a normal end says nothing (the summary does), an interruption says so
         takeAnswer();
         if (st.walkWhy === 'stop') dispatch({ type: 'ask.settle', id: cd.id, text: 'The question closed before you answered.', tone: 'plain' });
@@ -3669,6 +4323,12 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     if (now - K.current.lastPasteAt < PASTE_GUARD_MS) return; // post-paste guard
     if (now - K.current.cardGoneAt < CARD_GONE_MS) return; // keys meant for the card must not send a turn
     let buf = B.current;
+    if (R.current.delConfirm) { // DESTRUCTIVE-CONFIRM: this line is the typed name (a slash command leaves the step)
+      const t = buf.text.trim();
+      if (!t.startsWith('/')) { B.current = initialBuffer(); bump(n => n + 1); delConfirmLine(t); return; }
+      R.current.delConfirm = null;
+    }
+    if (!buf.text.trim() && R.current.secretAsk) { B.current = { ...initialBuffer(), text: 'y', cursor: 1 }; buf = B.current; } // SECRET-GUARD: Enter alone keeps the credentials out (never "send anyway")
     // y/N/c: Enter alone answers an open ask "no" (the default), as typing n does.
     if (!buf.text.trim() && R.current.pendingWalk && !R.current.denyReason) { say('Type a choice for the card above (s skips, Esc stops). Enter alone answers nothing.', 'dim'); return; } // WALK-FIXES: an empty Enter must never answer "no"
     if (!buf.text.trim() && !R.current.denyReason && !S.current.turn && askOpen()) { B.current = { ...initialBuffer(), text: 'n', cursor: 1 }; buf = B.current; }
@@ -3684,7 +4344,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     if (!chk.ok) { B.current = { ...chk.buffer, undo: buf.undo, redo: buf.redo }; say(chk.note, 'warn'); bump(n => n + 1); return; }
     let text = chk.text.trim();
     const wrapped = joinWrappedSlash(text); // a wrapped paste of "/say slot long text": one command, not a refusal
-    if (wrapped) { text = wrapped.text; say(`joined ${wrapped.lines} lines`, 'dim'); }
+    if (wrapped && !GRIPE_LINE.test(text)) { text = wrapped.text; say(`joined ${wrapped.lines} lines`, 'dim'); }
+    if (SUC.current.pending() && !text.startsWith('/')) { // the /verify-email y/N preview owns the next plain line: never chat, never a turn, never history (a PIN typed early must go nowhere)
+      B.current = initialBuffer(); R.current.confirmMulti = null; R.current.histIdx = -1;
+      if (/^(y(es)?|no?)$/i.test(text)) SUC.current.answer(text);
+      else { SUC.current.touch(); say('Answer y or n for /verify-email (n cancels). Nothing was sent. The PIN is asked for in a private card after y, never here.', 'warn'); }
+      bump(n => n + 1); return;
+    }
     const keyHit = looksLikeKey(text);
     if (keyHit) { B.current = initialBuffer(); R.current.confirmMulti = null; say(keyWarning(keyHit), 'warn'); return; } // never sent, never in history
     if (text.startsWith('!') && text.includes('\n')) { // owner 2026-10-15: a wrapped `!git ... push origin\nHEAD:main` ran as two commands
@@ -3693,6 +4359,29 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       say(`That ! command arrived on ${text.split('\n').filter(l => l.trim()).length} lines (a wrapped paste?). Joined into one line in the composer: check it, then Enter runs it.`, 'warn');
       bump(n => n + 1); return;
     }
+    // QUOXON-SECRET-GUARD: credential-shaped text is never sent, saved or remembered without an explicit "send anyway"
+    const sa = R.current.secretAsk;
+    if (sa) {
+      const ans = askAnswer(text);
+      if (ans === 'yes' || ans === 'no') {
+        R.current.secretAsk = null; R.current.askAnswer = { kind: ans, at: Date.now() }; queueMicrotask(() => reconcileAsks());
+        B.current = initialBuffer(); R.current.confirmMulti = null; R.current.histIdx = -1;
+        if (ans === 'yes' && Date.now() - sa.at < 120000) { say('Not sent. Nothing was saved anywhere.', 'ok'); bump(n => n + 1); return; }
+        if (ans === 'no') { R.current.secretOk = sa.text; if (sa.text.startsWith('/') && sa.text.includes('\n')) R.current.confirmMulti = true; B.current = { ...initialBuffer(), text: sa.text, cursor: sa.text.length }; bump(n => n + 1); onEnter(now); return; }
+        say('That question expired, so nothing was sent. Paste it again if you still mean to.', 'dim'); bump(n => n + 1); return;
+      }
+      R.current.secretAsk = null; // anything else moves on; the new line is checked on its own below
+    }
+    if (R.current.secretOk === text) R.current.secretOk = null;
+    else {
+      R.current.secretOk = null;
+      const kinds = secretKinds(text);
+      if (kinds.length) {
+        B.current = initialBuffer(); R.current.confirmMulti = null; R.current.secretAsk = { at: Date.now(), text };
+        say(askText(`This looks like credentials (${kinds.join(', ')}). Don't send it?`, { keys: 'y keeps it out (recommended) · n send anyway', action: 'discard it, nothing is sent or saved', title: 'Credentials in your message' }), 'ask');
+        bump(n => n + 1); return;
+      }
+    }
     const bang = parseBang(text);
     if (bang) { // QUOXON-FW8: the user's own command on their own machine; never a turn, never the server
       if (bang.kind !== 'reserved' && bang.kind !== 'empty' && R.current.bang) { say('A command is still running. Ctrl+C stops it; your draft is kept.', 'warn'); return; }
@@ -3700,16 +4389,61 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       echoCmd(text); bangCommand(bang, { echoed: true }); bump(n => n + 1); return;
     }
     const s = S.current;
-    const isCommand = text.startsWith('/') && !text.includes('\n');
+    const isCommand = isOneLineCommand(text);
     const ws = R.current.wokeSwallowed; R.current.wokeSwallowed = null;
     if (ws && !isCommand && !text.startsWith('!') && now - ws.at < 15000 && !askOpen() && !R.current.pendingWalk) { // the key that woke the screen was not typed: this line may be missing its first letter, so nothing goes to the model unless the user means it
       B.current = { ...initialBuffer(), text, cursor: text.length };
       say('Not sent: the key that woke the screen was not typed, so this line may be missing its first letter. Check it, then press Enter to send.', 'warn'); bump(n => n + 1); return;
     }
+    if (R.current.dndAsk) { // DND offers: "Turn on do not disturb until morning?" and "Good morning. Turn off do not disturb?"
+      const a = R.current.dndAsk;
+      const ans = askAnswer(text);
+      if (ans === 'yes' || ans === 'no') {
+        R.current.dndAsk = null; R.current.askAnswer = { kind: ans, at: Date.now() }; queueMicrotask(() => reconcileAsks());
+        B.current = initialBuffer(); R.current.histIdx = -1;
+        if (ans === 'yes' && Date.now() - a.at < 600000) { (a.off ? dndOff() : dndOn()).catch(() => {}); return; }
+        say(ans === 'yes' ? 'That offer expired. /dnd on turns it on.' : (a.off ? 'Staying on do not disturb. /dnd off ends it.' : 'Not now. /dnd on whenever you like.'), 'dim'); bump(n => n + 1); return;
+      }
+      if (isCommand) R.current.dndAsk = null;
+    }
+    if (R.current.neverAsk) { // ONBOARD-P2: "Quox at <url> has never answered. Connect to a different server? y/N", then the address
+      const a = R.current.neverAsk;
+      if (a.stage === 'offer') {
+        const ans = askAnswer(text);
+        if (ans === 'yes') {
+          R.current.neverAsk = { ...a, stage: 'url', at: Date.now() };
+          say(askText('Quox server address (for example https://192.0.2.10:3000)?', { keys: 'Enter or n cancels', action: 'check it is a Quox, then sign you in (the certificate is shown first)' }), 'ask'); return;
+        }
+        if (ans === 'no' || ans === 'chat') {
+          R.current.neverAsk = null;
+          say('Still trying quietly. To connect elsewhere any time, run: quox connect <url>', 'dim');
+          if (healthRecheck) startupRecheck.current?.(0);
+          return;
+        }
+        if (ans === 'command') R.current.neverAsk = null;
+      } else {
+        const t = text.trim();
+        R.current.neverAsk = null;
+        if (!t || /^no?$/i.test(t)) { say('Not connecting. To connect elsewhere any time, run: quox connect <url>', 'dim'); if (healthRecheck) startupRecheck.current?.(0); return; }
+        if (!/^https?:\/\//i.test(t)) { say('That is not a web address. Run: quox connect <url> when you have it.', 'warn'); return; }
+        say(`Connecting to ${t}…`, 'dim');
+        onConnect(t); exit(); return;
+      }
+    }
+    if (R.current.loginAsk) { // "Signed out of X. Sign in now? y/N": y is exactly /login; n or Enter alone dismisses; other chat falls to the signed-out refusal below
+      const a = R.current.loginAsk;
+      const ans = askAnswer(text);
+      if (ans === 'yes' || ans === 'no') {
+        R.current.loginAsk = null; R.current.askAnswer = { kind: ans === 'yes' ? 'yes' : 'no', at: Date.now() }; queueMicrotask(() => reconcileAsks());
+        if (ans === 'yes' && Date.now() - a.at < 120000) { echoCmd('/login'); command('/login'); return; }
+        say('Not now. /login signs in whenever you like.', 'dim'); return;
+      }
+      if (isCommand) R.current.loginAsk = null;
+    }
     if (blocked && !isCommand) { // Z2H-R4: clear the box (else the next /login is appended and refused); Up recalls the message
       remember(text); R.current.histIdx = -1; B.current = initialBuffer(); say(blocked, 'warn'); bump(n => n + 1); return;
     }
-    if (text.startsWith('/') && text.includes('\n') && !R.current.confirmMulti) {
+    if (text.startsWith('/') && text.includes('\n') && !isOneLineCommand(text) && !R.current.confirmMulti) {
       // commands are one line: never ship a multi-line "/..." draft to the model without an explicit second Enter.
       // The second Enter sends it even after edits (R3 D3: requiring a byte-identical draft swallowed every later Enter).
       R.current.confirmMulti = true;
@@ -3737,13 +4471,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     let askDismissed = false; // a chat line that is not a question about the offer answers it by moving on: the card closes itself
     if (askOpen() && !R.current.noteAsk) {
       const o = askOutcomeOf(text, { runWord: runAskOpen() }) || (askAnswer(text) === 'chat' && !S.current.turn && !R.current.pendingWalk && !isAskClarification(text) ? { kind: 'dismissed' } : null);
-      const OWN = ['wakeAsk', 'pendingGrant', 'feedbackAsk', 'slotAsk', 'slotCreateAsk', 'sayLastAsk', 'profileAsk', 'cliAsk', 'installAsk', 'updateAsk', 'orgPending', 'hatPending', 'suggestAsk', 'askQuox', 'planAsk'];
+      const OWN = ['wakeAsk', 'pendingGrant', 'feedbackAsk', 'slotAsk', 'slotCreateAsk', 'sayLastAsk', 'profileAsk', 'loginAsk', 'neverAsk', 'dndAsk', 'secretAsk', 'limitedAsk', 'cliAsk', 'deckAsk', 'installAsk', 'updateAsk', 'orgPending', 'hatPending', 'suggestAsk', 'askQuox', 'planAsk'];
       const foreign = KC.current.pending?.() || UW.current.pending?.() || HW.current.card() || SC.current.pendingFile || SC.current.reattach || CH.current.pending || SPN.current.pending || runAskOpen();
       if (o?.kind === 'dismissed' && foreign) { /* a card owned by another module keeps its own rules: the line is about it, as before */ }
       else if (o) {
         askDismissed = o.kind === 'dismissed';
         R.current.askAnswer = { ...o, at: Date.now() }; queueMicrotask(() => reconcileAsks());
-        if (askDismissed) for (const k of OWN) R.current[k] = null; // the offer is gone: the line below is plain chat, not an answer to anything
+        if (askDismissed) { if (R.current.limitedAsk) { R.current.limitedDismissed = true; dispatch({ type: 'notify', patch: { providerLines: R.current.limitedBase || [] } }); } for (const k of OWN) R.current[k] = null; } // the offer is gone: the line below is plain chat, not an answer to anything
       }
     }
     // y/N/c: c or any other free text keeps the open ask and asks Quox about it first (never a silent cancel).
@@ -3755,8 +4489,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       say('Not sent. Your answer and note are back in the composer; press Enter to send it, or edit it first.', 'warn');
       return;
     }
+    if (!R.current.pendingWalk && !askOpen() && !headCard(S.current) && strayAnswer(text, { queued: AO.current.st.queue.length, walkOpen: false, noticeAt: AO.current.noticeAt, now: Date.now() })) { autoStray(text); return; } // APPROVALS-AUTO: the stray y
     if (R.current.pendingWalk && !text.startsWith('/')) { walkHandle(text); return; } if (R.current.pendingWalk) walkEnd(`you ran ${text.split(/\s+/)[0]}`); // WALKTHROUGH: the line is the answer to the card on screen; a command ends the walk with its summary
     if (!askDismissed && !S.current.turn && !noAiNow() && askAnswer(text) === 'chat' && askOpen() && !(runAskOpen() && /^run$/i.test(text.trim()))) { chatAboutAsk(text); return; }
+    if (SUC.current.answer(text)) return; // y/N after a /verify-email preview
     if (KC.current.answer(text)) return; // y/n after a /watch, /automate or /crystallize preview card
     if (UW.current.answer(text)) return; // y/n after a /undo or /wish card
     if (HW.current.active() && HW.current.answer(text)) return; // CUSTOM-HATS: the next line of a /hat new|edit|delete walk
@@ -3770,7 +4506,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (Date.now() - g.at < 120000 && !text.startsWith('/')) {
         if (/^y(es)?$/i.test(text.trim())) {
           (async () => {
-            if (g.decisions) g.items = g.items.filter(it => !isHeldFromBulk(it)); // defence: a risky ask never rides the bulk card
+            if (g.decisions) g.items = g.items.filter(it => !isHeldFromBulk(it) && !isDestructive(it)); // defence: a risky ask or a delete never rides the bulk card
             if (g.decisions && g.hi) { // one PIN for the whole batch; the token then rides on every item
               const r = SU.current.token('approve') ? { ok: true } : await SU.current.request({ scope: 'approve', orgId: api.orgId?.() || null, subject: { line1: `answer yes to ${g.items.length} decisions (${g.hi} high risk)`, raisedBy: null, risk: 'high' } });
               if (!r.ok) return say(`Not answered: ${declinedText(r.reason)}. Nothing was sent.`, 'warn');
@@ -3817,6 +4553,12 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (askAnswer(text) === 'yes' && Date.now() - a.at < 120000) { switchTo(a.name); return; }
       if (!text.startsWith('/')) { say(`Not switched. This window stays ${WHO.current.profile}.`, 'dim'); return; }
     }
+    if (R.current.limitedAsk) { // "Switch to <model>? y/N" under the limited banner: y is exactly /model <name>; anything else dismisses it
+      const a = R.current.limitedAsk; R.current.limitedAsk = null;
+      if (askAnswer(text) === 'yes' && Date.now() - a.at < 120000) { echoCmd(`/model ${a.id}`); command(`/model ${a.id}`); return; }
+      R.current.limitedDismissed = true; dispatch({ type: 'notify', patch: { providerLines: R.current.limitedBase || [] } });
+      if (!text.startsWith('/')) { say(`Staying on the current model. /model ${a.id} switches whenever you like.`, 'dim'); return; }
+    }
     if (R.current.sayLastAsk) { // SAY-LAST-TARGET "Send to <slot>? y send · n cancel": y sends the whole text
       const a = R.current.sayLastAsk; R.current.sayLastAsk = null;
       if (/^y(es)?$/i.test(text.trim()) && Date.now() - a.at < 120000) { sendToSlot(a.slot, a.text); return; }
@@ -3842,6 +4584,22 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       }
       if (!text.startsWith('/')) { say('Not updated. Nothing was changed.', 'dim'); return; }
     }
+    if (R.current.deckAsk) { // LAZY PATH: "quoxdeck needs: ... Install now? y/N" (typing y is the authorization; sudo is the user's own)
+      const a = R.current.deckAsk; R.current.deckAsk = null;
+      if (/^y(es)?$/i.test(text.trim()) && Date.now() - a.at < 120000) {
+        const run = (st) => new Promise((resolve) => {
+          const hold = { deck: true }; R.current.bang = hold;
+          setTimeout(() => {
+            if (R.current.bang === hold) R.current.bang = null;
+            const r = handOverRun({ cmd: st.cmd, env, cwd: process.cwd(), stdout, setRawMode: isRawModeSupported ? setRawMode : null, spawn: runSpawn, resume: mouseResume() });
+            bump(n => n + 1); resolve({ code: r.error ? 1 : r.code, error: r.error });
+          }, runHandOverDelayMs);
+        });
+        runDeckOffer(a.offer, { run: (st) => st.cmd === `quox ext add quoxdeck` ? Promise.resolve(extAdd('quoxdeck').ok ? { code: 0 } : { code: 1 }) : run(st), say: (t, tone) => say(t, tone || 'dim'), rerun: async () => { echoCmd('/deck on'); command('/deck on'); } }).catch(() => {});
+        return;
+      }
+      if (!text.startsWith('/')) { say(declineText(a.offer), 'dim'); return; }
+    }
     if (R.current.installAsk) { // LAZY-AI-CLI: "Claude Code isn't installed on this server. Install it now? y/N" (typing y is the authorization)
       const a = R.current.installAsk; R.current.installAsk = null;
       if (/^y(es)?$/i.test(text.trim()) && Date.now() - a.at < 120000) { installNow(a); return; }
@@ -3894,13 +4652,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     }
     if (SC.current.pendingFile) { // /send found secret-shaped values: "y/N" (send redacted)
       const pf = SC.current.pendingFile; SC.current.pendingFile = null;
-      if (/^y(es)?$/i.test(text.trim()) && Date.now() - pf.at < 120000) { sendToSlot(pf.slot, fileMessage({ name: pf.f.name, body: pf.f.redacted, size: Buffer.byteLength(pf.f.redacted) })); return; }
+      if (/^y(es)?$/i.test(text.trim()) && Date.now() - pf.at < 120000) { sendToSlot(pf.slot, fileMessage({ name: pf.f.name, body: pf.f.redacted, size: Buffer.byteLength(pf.f.redacted) }), { draft: null }); return; }
       if (!text.startsWith('/')) { say('Not sent.', 'dim'); return; }
     }
     if (SC.current.reattach) { // startup "Reattach to slot X? y/N"
       const ra = SC.current.reattach; SC.current.reattach = null;
       if (/^y(es)?$/i.test(text.trim())) { takeSlot(ra.slot, ra.take); return; }
-      if (/^no?$/i.test(text.trim())) { say('Left it.', 'dim'); return; }
+      if (/^no?$/i.test(text.trim())) { R.current.declinedSlot = ra.slot; say('Left it.', 'dim'); return; }
     }
     if (SC.current.runAsk) { // SLOT-RUN: "Run it? y/N/c" (or "run" for a dangerous one) on a slot sender's command
       const ra = SC.current.runAsk;
@@ -3914,7 +4672,16 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     }
     { const ls = R.current.listShownAt; R.current.listShownAt = null; // APPROVALS-UX: y/n right after a list (not a card) is not chat to the agent
       if (ls && Date.now() - ls < 600000 && /^(y(es)?|no?)$/i.test(text.trim())) { remember(text); R.current.histIdx = -1; say('Which one? /approve 1 or /approvals 1 to see it.', 'warn'); R.current.listShownAt = ls; return; } }
-    if (text.startsWith('/') && !text.includes('\n')) { remember(text); R.current.histIdx = -1; echoCmd(text); command(text); return; } // Up recalls commands too
+    if (isOneLineCommand(text)) { PL.current.submitted(buf.text); remember(text); R.current.histIdx = -1; echoCmd(text); command(text); return; } // Up recalls commands too
+    if (!SC.current.active && BARE_COMMAND_WORDS.has(text.toLowerCase()) && findEntry('/' + text.toLowerCase())?.kind === 'command') { // owner 2026-10-26 18:22: "clear" went to the model as chat. Offer the command BEFORE anything is sent; n sends it as chat.
+      const line = '/' + text.toLowerCase();
+      remember(text); R.current.histIdx = -1;
+      R.current.strayAsk = { text, command: line, at: Date.now() };
+      ask(`Run ${line}?`, { action: line, reason: `"${text}" is a command word. n sends it to Quox as chat instead.` });
+      return;
+    }
+    const attachSlot = !SC.current.active && !s.turn && api.slots ? parseSlotAttach(text) : null;
+    if (attachSlot) { remember(text); R.current.histIdx = -1; offerSlotAttach(attachSlot, text); return; } // "attach to hitl slot": offer /slot hitl, no model turn
     const roomSend = api.slotSay ? parseRoomSend(text) : null;
     if (roomSend) { // QUOXON-ROOMS: #room text posts, bare #room makes it the default target
       remember(text); R.current.histIdx = -1;
@@ -4047,7 +4814,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       k.askEchoTimer = setTimeout(() => { endAskEcho(); bump(n => n + 1); }, ASK_ECHO_MS + 50); k.askEchoTimer.unref?.();
       bump(n => n + 1); return true;
     }
-    if (!askOpen() || R.current.pendingWalk || R.current.denyReason || HW.current.active?.()) return false;
+    if (!askOpen() || R.current.pendingWalk || R.current.denyReason || R.current.delConfirm || HW.current.active?.()) return false;
     if (/c/i.test(ch) && (S.current.turn || noAiNow())) { say('Quox is busy or off; c chats about this question once it can. y or n answers it now.', 'dim'); return true; }
     B.current = { ...initialBuffer(), text: ch, cursor: 1 };
     onEnter(now);
@@ -4074,6 +4841,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const k = K.current;
     const g = k.guard;
     if (R.current.denyReason && Date.now() - R.current.denyReason.at < 120000) return false; // typing the deny reason: y/n are text
+    if (R.current.delConfirm) return false; // typing the name to delete: every key is text
     if (B.current.text && !k.cardFocus) { k.confirm = false; return false; } // a draft in progress: the key is text (Tab focuses the card, draft kept)
     const armedAt = Math.max(card.displayedAt ?? card.shownAt ?? 0, g?.since ?? 0);
     const ok = () => approvalKeyAllowed({ now, shownAt: armedAt, lastKeyAt: k.lastKeyAt, heldKey: g?.heldKey, ch });
@@ -4084,6 +4852,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       return true; // any other key cancels
     }
     const key = ch.toLowerCase();
+    if (signedOutRef.current) { if (key === 'y' && ok()) { echoCmd('/login'); command('/login'); } return key === 'y' || key === 'n' || key === 'c'; } // signed out: the card is read-only, y signs in
+    const burst = batchFor(queueOf(S.current), card); // APPROVAL-BURST: y and n apply to the whole batch, p walks it
+    if (burst && (key === 'y' || key === 'n' || key === 'p')) {
+      if (!ok()) return true;
+      if (key === 'p') walkBatch(burst); else answerBatch(burst, key === 'y' ? 'approve' : 'reject');
+      return true;
+    }
     if (key === 'c' && !S.current.turn && !noAiNow()) { // y/N/c: chat about the approval first; the card stays
       if (!ok()) return true;
       const what = card.what || [card.tool, card.target].filter(Boolean).join(' ') || 'this approval';
@@ -4093,9 +4868,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     if (key !== 'y' && key !== 'n') return false; // ordinary typing: the composer keeps it
     if (!ok()) return true; // too early / key repeat: swallowed, never answered
     if (key === 'n' && k.cardFocus) { k.cardFocus = false; answer(card, 'reject'); return true; } // focused over a draft: the composer holds the draft, so no reason prompt
-    if (key === 'n') { // ask why in one line; Enter skips. The card stays until the answer is sent.
+    if (key === 'n') { // ask why in one line; Enter skips, Esc backs out. The card stays until the answer is sent.
       R.current.denyReason = { card, at: Date.now() }; say('Reason? (Enter to skip)', 'warn'); bump(n => n + 1); return true;
     }
+    if (card.destructive) { startDelConfirm(card.destructive, () => answer(card, 'approve')); return true; } // a delete is never one key
     if (card.privileged || card.undescribable) { k.confirm = true; bump(n => n + 1); return true; }
     answer(card, 'approve');
     return true;
@@ -4186,6 +4962,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (R.current.askArmed) { R.current.askArmed = false; R.current.dragonTalk = null; say('Dragon ask cancelled.', 'dim'); return; }
       if (HW.current.cancel()) return; // CUSTOM-HATS: Esc ends the hat walk, nothing sent
       if (RW.current.walk.cancel()) return; // ROWS: Esc ends the row walk, nothing saved
+      if (R.current.limitedAsk && !B.current.text) { R.current.limitedAsk = null; R.current.limitedDismissed = true; dispatch({ type: 'notify', patch: { providerLines: R.current.limitedBase || [] } }); return; } // Esc says no to the switch offer
       if (R.current.pendingWalk) { walkEnd('Esc'); K.current.lastEscAt = now; return; } // WALK-FIXES: Esc leaves the walkthrough with a summary; the draft stays
       if (now - K.current.lastEscAt < ESC_ESC_MS && B.current.text) {
         if (looksLikeKey(B.current.text)) { edit({ type: 'clear' }); say('Draft cleared. It looked like a key, so it was not kept.'); }
@@ -4281,6 +5058,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (e.name === 'escape') { stopCountdown(); cdLog('cancelled'); AR.current.cancelledId = AR.current.newId; say("Restart cancelled. /restart when you're ready.", 'accent'); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
         if (e.name === 'enter' && autoIdle()) { stopCountdown(); cdLog('restart-now'); doRestart(); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
       }
+      if (e.type === 'key' && e.name === 'enter' && !AR.current.timer && !AR.current.waiting && AR.current.quietId && AR.current.quietId === AR.current.newId && autoIdle()) { cdLog('restart-now'); autoFire(); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; } // the quiet line's Enter: waits for collector /health like the countdown does
       if (R.current.sleep) { // the sleep screen eats the waking key (nothing is lost), except "/": slash commands always work asleep
         if (e.type === 'key' && e.name === 'ctrl-c') { exit(); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
         if (R.current.sleep.wakeAt != null) { /* already waking: later keys are typed as normal, so "/back" typed in one go is not cut short */ }
@@ -4297,6 +5075,16 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (PK.current.isOpen() && !S.current.approvals.length && PK.current.onEvent(e) !== false) { K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; } // /resume, /config (typing closes it and falls through)
       if (R.current.rs && (e.type === 'key' || e.type === 'text' || e.type === 'paste')) { rsEvent(e); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
       if (e.type === 'key' && e.name === 'ctrl-r' && !headCard(S.current) && R.current.history.length) { R.current.rs = { saved: B.current, q: '', skip: 0, hit: null }; rsShow(); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
+      if (e.type === 'key' && e.name === 'ctrl-]') { // EXT panels: Ctrl+] cycles focus through them
+        if (!DK.current.cycle()) say(DK.current.armed() ? 'No extension has a panel. /ext list' : 'No extension is loaded. /ext list', 'dim');
+        K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue;
+      }
+      if (DK.current.focused() && (e.type === 'text' || (e.type === 'key' && e.name !== 'ctrl-c' && e.name !== 'ctrl-d'))) { // a focused panel has the keys; Esc gives them back
+        let took = false;
+        for (const k of e.type === 'text' ? [...e.text].map(panelKeyName) : [panelKeyName(e)]) took = DK.current.key(k) || took;
+        if (took) { K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
+      }
+      if (e.type === 'key' && e.name === 'escape' && R.current.delConfirm) { cancelDelConfirm(); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; } // Esc backs out of the type-the-name step to the card
       const card = headCard(S.current);
       const g = K.current.guard;
       // any different key ends the "this key was already down" suppression
@@ -4304,6 +5092,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       // Tab (composer empty) puts the card away into the status line until a NEW approval arrives
       // RESTORE-TUI: Tab with a draft focuses the card (the draft is kept, never queued or sent); Esc returns to the draft
       if (card && e.type === 'key' && e.name === 'tab' && B.current.text) { K.current.cardFocus = true; K.current.confirm = false; bump(n => n + 1); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
+      if (card && e.type === 'key' && e.name === 'escape' && R.current.denyReason) { R.current.denyReason = null; B.current = initialBuffer(); say('Deny cancelled. The card is still open.', 'dim'); bump(n => n + 1); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; } // Esc backs out of the Reason? prompt to y/n
       if (card && e.type === 'key' && e.name === 'escape' && K.current.cardFocus) { K.current.cardFocus = false; K.current.confirm = false; bump(n => n + 1); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
       if (card && e.type === 'key' && e.name === 'tab' && !B.current.text) { for (const x of queueOf(S.current)) K.current.dismissed.add(x.callId); K.current.confirm = false; bump(n => n + 1); K.current.lastKeyAt = now; K.current.lastKeyCh = null; continue; }
       if (card && K.current.confirm && e.type === 'key') { K.current.confirm = false; bump(n => n + 1); } // any other key cancels a pending privileged confirm
@@ -4365,6 +5154,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     }, (e) => { if (!live || R.current.closed) return; if (e?.reconnectGaveUp) { resumeGaveUp(resumeConversation); return; } dispatch({ type: 'error', text: `could not load conversation ${resumeConversation}: ${e?.status ? `HTTP ${e.status}: ` : ''}${e?.message || 'failed'}` }); });
     return () => { live = false; };
   }, []);
+  const startupRecheck = React.useRef(null);
   React.useEffect(() => {
     if (!startup) return undefined;
     let live = true;
@@ -4377,18 +5167,90 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         timer = null;
         let hl = null; try { hl = await healthRecheck(); } catch { hl = null; }
         if (!live) return;
-        if (hl?.ok) { say('✔ QuoxCORE is answering again', 'accent'); return; }
+        if (hl?.ok) { noteAnswering(); flushOutbox(); return; }
         recheck(Math.min(i + 1, delays.length - 1));
       }, delays[Math.min(i, delays.length - 1)]);
     };
+    // A fresh window that cannot reach QuoxCORE is most likely racing a collector restart: say so (spinner) for the grace
+    // window and only then fall back to "No QuoxCORE running". Connecting inside it says nothing.
+    const graceThenSay = (note) => {
+      const t0 = Date.now(); let tm = null;
+      const spin = (t) => dispatch({ type: 'notify', patch: { spinner: t } });
+      spin('QuoxCORE is restarting, retrying…');
+      const step = async () => {
+        tm = null;
+        let hl = null; try { hl = await healthRecheck(); } catch { hl = null; }
+        if (!live) return;
+        if (hl?.ok) { spin(''); return; }
+        if (Date.now() - t0 >= startupGraceMs) { spin(''); say(note, 'warn'); return; }
+        tm = setTimeout(step, startupRetryMs);
+      };
+      tm = setTimeout(step, startupRetryMs);
+      stopGrace = () => { clearTimeout(tm); spin(''); };
+    };
+    let stopGrace = null;
+    startupRecheck.current = recheck;
     Promise.resolve().then(startup).then((note) => {
       if (!live || !note) return;
+      if (neverAnswered && onConnect && /^No QuoxCORE running/.test(note) && !R.current.neverAsk && !R.current.neverAsked) { // ONBOARD-P2: never answered + dead URL = wrong address, not an outage
+        const url = (/ at (\S+)/.exec(note) || [])[1] || 'the configured server';
+        R.current.neverAsked = true; R.current.neverAsk = { stage: 'offer', url, at: Date.now() };
+        say(askText(`Quox at ${url} has never answered from this machine. Connect to a different server?`, { action: 'ask for its address, check it is a Quox, then sign you in' }), 'ask');
+        return;
+      }
+      if (/^No QuoxCORE running/.test(note) && healthRecheck && startupGraceMs > 0) { graceThenSay(note); return; }
       if (slow(note)) { if (startup.said) return; startup.said = true; } // once per session, even if the probe is mounted twice
       say(note, 'warn');
       if (slow(note)) recheck(0);
     }, () => {});
+    return () => { live = false; clearTimeout(timer); stopGrace?.(); };
+  }, []);
+  // The server holds presence per user: any window's /afk, /dnd, /sleep, /back lands there. A window that is already open
+  // re-reads it (mount + every presencePollMs) so they all agree. An unreadable read changes nothing.
+  function applyServerAway(p) {
+    if (!p || AWAY.current.afk || !(p.away === true || p.state === 'away' || p.state === 'sleeping')) return;
+    const note = p.note || (p.state === 'sleeping' ? 'sleeping' : '');
+    const explicit = p.dnd === true || note.toLowerCase().includes(DND_NOTE); const um = /until (\d\d):(\d\d)/.exec(note); // DND restored from the server note
+    const sMs = Date.parse(p.since); const sOk = Number.isFinite(sMs) && sMs <= Date.now(); // the server knows when this away began: carry it, not this window's start
+    if (sOk) AWAY.current.last = sMs;
+    AWAY.current.afk = { at: sOk ? sMs : Date.now(), ...(sOk ? {} : { sinceUnknown: true }), note, dnd: true, ...(explicit ? { explicit: true, until: um ? untilEpoch({ h: Number(um[1]), m: Number(um[2]) }) : null } : {}) }; AWAY.current.col ||= newCollected(); if (sOk) AWAY.current.col.since = sMs;
+    bump(n => n + 1);
+  }
+  React.useEffect(() => { // PRESENCE-SYNC: /back (or /afk, /dnd) in ANOTHER window of this user reaches this one
+    if (!api.getPresence || !(presencePollMs > 0)) return undefined;
+    let live = true;
+    const t = setInterval(() => {
+      api.getPresence().then((r) => {
+        if (!live || !r?.ok || !r.presence) return; // unreadable: never a verdict
+        const p = r.presence; const isAway = p.away === true || p.state === 'away' || p.state === 'sleeping';
+        if (isAway) { applyServerAway(p); return; }
+        const a = AWAY.current.afk;
+        // present on the server: a window still showing away was ended elsewhere. Not while this window's own write is in flight / failed.
+        if (a && !R.current.presenceUnsynced && Date.now() - (R.current.presenceSetAt || 0) > 15000) { archiveWindow(); AWAY.current.afk = null; bump(n => n + 1); }
+      }, () => {});
+    }, presencePollMs);
+    return () => { live = false; clearInterval(t); };
+  }, []);
+  React.useEffect(() => { // AFK-SURVIVES-RESTART (owner 2026-10-28): a restarted window forgets AWAY; the server still knows. Read-only, never marks present; unreadable = as today.
+    if (!api.getPresence) return undefined;
+    let live = true; let timer = null;
+    // owner live 2026-10-30 10:16: a restart onto a slow collector read nothing and defaulted DND off. An UNREADABLE presence
+    // (error, timeout) is retried with backoff and never means "present"; only a successful read can say so.
+    const attempt = (i) => {
+    const retry = () => { if (live && i < presenceRetryDelays.length) timer = setTimeout(() => attempt(i + 1), presenceRetryDelays[i]); };
+    api.getPresence().then((r) => {
+      if (!r?.ok) { retry(); return; }
+      if (!live) return;
+      applyServerAway(r.presence);
+    }, retry);
+    };
+    attempt(0);
     return () => { live = false; clearTimeout(timer); };
   }, []);
+  React.useEffect(() => { // DND "until HH:MM": the deadline ends it (the owner is back at that time; collected items stay for /morningreport)
+    const t = setInterval(() => { const a = AWAY.current.afk; if (a?.explicit && a.until && Date.now() >= a.until) dndOff(); }, 15000);
+    return () => clearInterval(t);
+  }, []);
   React.useEffect(() => { // E5: "While you were away" under the intro, after more than 2 h away
     if (!away) return undefined;
     let live = true;
@@ -4484,10 +5346,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     }
     pendingHist = s.history.slice(committedRef.current);
   }
+  const staticCols = columns != null ? cols : liveCols(stdout, cols); // history prints at the terminal's width NOW
   const staticItems = (() => { // QLOOP-LIVE: the committed history for <Static>; append-only, a settled loop card joins at the end
     let st = staticRef.current;
     const upto = Math.min(committedRef.current, s.history.length);
-    if (st.seen > s.history.length) st = staticRef.current = { list: [], seen: 0, deferred: [] };
+    if (st.seen > s.history.length || st.epoch !== epoch) st = staticRef.current = { list: [], seen: 0, deferred: [], epoch }; // /clear bumps the epoch: a reset that leaves history no shorter than before (one welcome, then one note) must still start the list over
     let list = st.list;
     for (; st.seen < upto; st.seen++) { const it = s.history[st.seen]; if (LC.current.held(it)) st.deferred.push(it); else list = [...list, it]; }
     if (st.deferred.length) { const done = st.deferred.filter((it) => !LC.current.held(it)); if (done.length) { st.deferred = st.deferred.filter((it) => !done.includes(it)); list = [...list, ...done]; } }
@@ -4498,6 +5361,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // Composer ring: motion and colour both on. Thinking/tools cyan-purple, writing green, approval amber.
   const ring = motionOn && !mono() ? { ref: ringRef, active: busy, mode: ringMode({ approvals: s.approvals.length, act: s.turn?.act }) } : null;
   const queue = queueOf(s);
+  const burst0 = queue[0] && !signedOut ? batchFor(queue, queue[0]) : null; // APPROVAL-BURST: the head card's batch, if it has one
   const card = queue[0] || null;
   const armed = card ? Date.now() - Math.max(card.displayedAt ?? card.shownAt ?? 0, K.current.guard?.since ?? 0) >= 300 : false;
   R.current.cardMidAnim = Boolean(card && motionOn && nowR - (card.displayedAt ?? card.shownAt) < 1000); // this render draws the card mid-animation (appDue keeps it due until a settled draw)
@@ -4527,13 +5391,26 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   function approvalRowShown() {
     const ro = R.current.roster;
     if (!ro.on || !ro.rows.some(r => r.kind === 'approval')) return false;
-    const v = rosterView({ rows: ro.rows, cols, termRows: termRows(stdout) ?? 40, max: MAX_ROSTER, on: ro.on, sel: ro.sel, focus: ro.focus, now: Date.now() });
+    const v = rosterView({ rows: ro.rows, cols, termRows: termRows(stdout) ?? 40, max: MAX_ROSTER, on: ro.on, sel: ro.sel, focus: ro.focus, now: Date.now(), staleAt: signedOut ? ro.at || Date.now() : null });
     return v.mode === 'full' && v.lines.some(l => l.kind === 'approval');
   }
 
+  /** EXT panels: the host-owned tab strip (only with 1+ panels) and, when one is open, its clipped lines above the composer. */
+  function extPanelRows() {
+    const ps = DK.current.panels(); if (!ps.length) return [];
+    const open = DK.current.shown();
+    const rowsN = DK.current.regionHeight(termRows(stdout));
+    const theme = { name: mono() ? 'mono' : isLight() ? 'light' : 'dark', color: !mono(), unicode: /utf-?8/i.test(String(process.env.LC_ALL || process.env.LC_CTYPE || process.env.LANG || '')) };
+    const out = [h(Box, { key: 'ext-tabs', paddingLeft: 1 }, ...ps.map(p => h(Text, { key: p.name, color: c(p.focused ? 'accent' : 'dim'), bold: p.focused, inverse: p.focused }, ` ${p.title} `)), h(Text, { key: 'ext-hint', color: c('dim') }, DK.current.focused() ? '  Esc: composer  Ctrl+]: next' : '  Ctrl+]: focus'))];
+    if (open) {
+      const lines = DK.current.renderPanel(open, { width: Math.max(1, cols - 2), height: rowsN, theme });
+      out.push(h(Box, { key: 'ext-body', flexDirection: 'column', paddingLeft: 1 }, ...lines.map((l, i) => h(Text, { key: i, wrap: 'truncate-end' }, l || ' '))));
+    }
+    return out;
+  }
   function rosterNode() {
     const ro = R.current.roster;
-    const view = rosterView({ rows: ro.rows, cols, termRows: termRows(stdout) ?? 40, max: MAX_ROSTER, on: ro.on, sel: ro.sel, focus: ro.focus, now: Date.now(), motion: motionOn && !mono() });
+    const view = rosterView({ rows: ro.rows, cols, termRows: termRows(stdout) ?? 40, max: MAX_ROSTER, on: ro.on, sel: ro.sel, focus: ro.focus, now: Date.now(), motion: motionOn && !mono(), staleAt: signedOut ? ro.at || Date.now() : null });
     const row = ro.rows[ro.sel];
     return h(Roster, {
       view, cols,
@@ -4547,14 +5424,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   if (sleeping) { // the screensaver replaces the live region only; Static (scrollback) is frozen, the transcript untouched
     const rows = Math.max(8, (termRows(stdout) ?? 24) - 1), sl = R.current.sleep;
     return h(FrameContext.Provider, { value: framesRef.current }, h(Box, { flexDirection: 'column' },
-      h(Static, { key: `static-${epoch}`, items: staticItems }, (it, i) => h(Box, { key: it.id, flexDirection: 'column' }, h(HistoryItem, { item: it, cols, gap: historyGap(staticItems[i - 1], it, termRows(stdout)) }))),
+      h(Static, { key: `static-${epoch}`, items: staticItems }, (it, i) => h(Box, { key: it.id, flexDirection: 'column' }, h(HistoryItem, { item: it, cols: staticCols, gap: historyGap(staticItems[i - 1], it, termRows(stdout)) }))),
       h(SleepScreen, { lines: sourceLines(S.current, cols, rows), cols, rows, startedAt: sl.startedAt, wakeAt: sl.wakeAt, still: sl.still })));
   }
   const ruleAbove = endsInRule({ card, asks: s.asks || [], background: s.background, pending: s.pending, steering: s.steering, countdown: Boolean(AR.current.timer && AR.current.endsAt) }) && !(SU.current.isOpen() || LI.current.isOpen() || CN.current.isOpen());
   return h(FrameContext.Provider, { value: framesRef.current }, h(Box, { flexDirection: 'column' },
     // Nothing enters <Static> before the intro settles: Static is index-based, so prepending the intro to
     // already-printed items would drop it (and reprint the rest).
-    h(Static, { key: `static-${epoch}`, items: introDone.current ? staticItems : [] }, (it, i) => h(Box, { key: it.id, flexDirection: 'column' }, h(HistoryItem, { item: it, cols, gap: historyGap(staticItems[i - 1], it, termRows(stdout)) }))),
+    h(Static, { key: `static-${epoch}`, items: introDone.current ? staticItems : [] }, (it, i) => h(Box, { key: it.id, flexDirection: 'column' }, h(HistoryItem, { item: it, cols: staticCols, gap: historyGap(staticItems[i - 1], it, termRows(stdout)) }))),
     introDone.current ? null : h(Box, { key: 'intro-live', flexDirection: 'column' }, h(Intro, { item: introItem, cols, dragon: introDragon, progress: Math.min(1, (Date.now() - introStart.current) / introMs) })),
     liveRegion([
       ...pendingHist.map((it, i) => h(Box, { key: it.id, flexDirection: 'column' }, h(FxItem, { item: it, cols, fxFor, gap: historyGap(i ? pendingHist[i - 1] : s.history[committedRef.current - 1], it, termRows(stdout)), active: busy && it.kind === 'trace' && i === pendingHist.length - 1 && !s.blocks.length }))),
@@ -4566,22 +5443,25 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     h(Box, { key: 'chrome', ref: chromeRef, flexDirection: 'column' },
     busy ? h(Working, { key: 'working', motion: motionOn && !R.current.exiting, handoff: feats().handoff, tokens: turnTokens(s.turn), act: s.turn.act, activity: describeActivity(s), since: s.turn.startedAt, interrupting: s.turn.status === 'interrupting', escLabel: caps.interrupt ? null : 'Esc disconnects' }) : null,
     ...LC.current.pinned().map((lc) => h(Box, { key: `loopcard-${lc.id}`, marginTop: 1 }, h(LoopCardView, { item: { card: lc }, cols, pinned: true }))), // QLOOP-LIVE: running loops are pinned above the composer
-    card ? h(ApprovalCard, { card, org: orgShown() || null, cols, armed, motionE: motionOn && nowR - (card.displayedAt ?? card.shownAt) < 1000 ? (nowR - (card.displayedAt ?? card.shownAt)) / 1000 : null, draftHint: K.current.cardFocus ? 'focus' : (B.current.text ? 'draft' : null), confirm: K.current.confirm, position: { i: 1, n: queue.length, others: otherSessionsCount(queue) } }) : null,
+    // PIN-GLITCH: while the PIN pad is open the pad is the whole question (its subject names the action). Keeping the card body above it
+    // pushed the live region to the terminal height, and Ink then wipes and rewrites the whole screen on every keystroke and poll.
+    SU.current.isOpen() ? null : card && burst0 ? h(BatchCard, { model: batchModel(burst0), cols, armed, motionE: motionOn && nowR - (card.displayedAt ?? card.shownAt) < 1000 ? (nowR - (card.displayedAt ?? card.shownAt)) / 1000 : null }) : card ? h(ApprovalCard, { card, org: orgShown() || null, cols, armed, motionE: motionOn && nowR - (card.displayedAt ?? card.shownAt) < 1000 ? (nowR - (card.displayedAt ?? card.shownAt)) / 1000 : null, signedOut: Boolean(signedOut), draftHint: R.current.denyReason ? 'reason' : K.current.cardFocus ? 'focus' : (B.current.text ? 'draft' : null), confirm: K.current.confirm, position: { i: 1, n: queue.length, others: otherSessionsCount(queue) } }) : null,
     ...(s.asks || []).map(a => h(Box, { key: a.id, flexDirection: 'column' }, h(AskCard, { text: a.text, cols }))), // ASK-SETTLE: open asks are live
     // TODO(contract v2): background agents. `background.status` is NOT in events v1, so nothing sets s.background today.
     s.background > 0 ? h(Box, { paddingLeft: 2 }, h(Text, { color: c('dim') }, `Waiting for ${s.background} background agent${s.background === 1 ? '' : 's'} to finish`)) : null,
     h(Pending, { pending: s.pending, steering: s.steering, cols }),
     AR.current.timer && AR.current.endsAt ? h(Box, { key: 'restart-countdown', paddingLeft: 2 }, h(Text, { color: c('accent'), bold: true }, countdownLine(Math.max(1, Math.ceil((AR.current.endsAt - Date.now()) / 1000)), cols, { waiting: Boolean(AR.current.waiting) }))) : null,
+    ...extPanelRows(),
     ruleAbove ? null : h(Box, { marginTop: 1 }),
     SU.current.isOpen() ? h(StepUpCard, { view: SU.current.view(), cols }) : LI.current.isOpen() ? h(LoginCard, { ...LI.current.view(), cols, profile }) : CN.current.isOpen() ? h(ConnectCard, { ...CN.current.view(), cols })
-      : ring ? h(RingComposer, { buf: B.current, cols, mode: demoLabel ? 'demo' : MD.current, busy, placeholder, name: SN.current.name, model: ctxParts[2], topRule: !ruleAbove, approvals: { count: s.notify.approvals, error: s.notify.error, signedOut: Boolean(blocked) }, ring, divider: s.divider ? { d: s.divider, slow: dividerSlowRef.current } : null })
-        : h(Composer, { buf: B.current, cols, mode: demoLabel ? 'demo' : MD.current, busy, placeholder, name: SN.current.name, model: ctxParts[2], topRule: !ruleAbove, approvals: { count: s.notify.approvals, error: s.notify.error, signedOut: Boolean(blocked) } }),
+      : ring ? h(RingComposer, { buf: B.current, cols, mode: demoLabel ? 'demo' : MD.current, busy, placeholder, name: SN.current.name, model: ctxParts[2], topRule: !ruleAbove, approvals: { count: s.notify.approvals, error: s.notify.error, slow: s.notify.slow, signedOut: Boolean(blocked), outstanding: s.notify.outstanding, blind: s.notify.blind, others: s.notify.others }, ring, divider: s.divider ? { d: s.divider, slow: dividerSlowRef.current } : null })
+        : h(Composer, { buf: B.current, cols, mode: demoLabel ? 'demo' : MD.current, busy, placeholder, name: SN.current.name, model: ctxParts[2], topRule: !ruleAbove, approvals: { count: s.notify.approvals, error: s.notify.error, slow: s.notify.slow, signedOut: Boolean(blocked), outstanding: s.notify.outstanding, blind: s.notify.blind, others: s.notify.others } }),
     !CN.current.isOpen() && PK.current.isOpen() && !card ? h(ListView, { ...PK.current.view(), cols }) : !CN.current.isOpen() && PL.current.isOpen() && !card ? h(ListView, { ...PL.current.view(), cols }) : null,
     h(RowsBar, { rows: RW.current.view(), cols, limit: { grid: QPE_GRID, n: qpeRowsSetting(api.settings?.()) } }),
     h(PresentBar, { stepUp: SU.current, cols }),
     h(StatusLine, { cols, slot: where.current.slot, agent: where.current.agent, groups: [...SC.current.rooms].map(([name, e]) => ({ name, unread: e.unread })), parts: ctxParts, right: hint }),
     h(WaitingNotice, { items: s.waiting.filter(x => K.current.dismissed.has(x.callId)), cols }),
-    h(NotifyBar, { approvals: s.notify.approvals, error: s.notify.error, cols, signedOut: Boolean(blocked), hideCount: approvalRowShown(), inbox: s.notify.inboxBar || '', alerts: [...(s.notify.providerLines || []), ...(R.current.roster.all ? [] : R.current.roster.alerts)] }),
+    h(NotifyBar, { approvals: s.notify.approvals, error: s.notify.error, cols, signedOut: Boolean(blocked), hideCount: approvalRowShown(), away: Boolean(AWAY.current.afk), awaySince: AWAY.current.afk?.sinceUnknown ? 0 : AWAY.current.afk?.at || 0, awayUnknown: Boolean(AWAY.current.afk?.sinceUnknown), dndUntil: AWAY.current.afk?.until || 0, dnd: Boolean(AWAY.current.afk?.explicit), awayCount: Math.max(s.notify.approvals || 0, [...s.approvals, ...s.waiting].length), dndCount: waitingCount(AWAY.current.col, Math.max(s.notify.approvals || 0, [...s.approvals, ...s.waiting].length)), inbox: AWAY.current.afk ? '' : (s.notify.inboxBar || ''), spinner: s.notify.spinner || '', alerts: [...(s.notify.providerLines || []), ...(R.current.roster.all ? [] : R.current.roster.alerts)] }),
     rosterNode())));
 }