@gajae-code/coding-agent 0.12.12 → 0.12.14

package/src/main.ts

@@ -61,11 +61,13 @@ import { SessionMigrationBusyError } from "./session/internal/session-open-error
 import {
 	type ResumeSessionIdentity,
 	resolveResumableSession,
+	SESSION_OVERSIZED_RECOVERY_MESSAGE,
 	SessionArtifactCapacityError,
 	type SessionDestination,
 	type SessionDirectoryMigrationPolicy,
 	type SessionInfo,
 	SessionManager,
+	SessionTranscriptOversizedError,
 	type StrictSessionOpenResult,
 } from "./session/session-manager";
 import { runStartupCredentialAutoImportIfNeeded } from "./setup/credential-auto-import";
@@ -620,10 +622,13 @@ function operatorFacingSessionOpenMessage(value: unknown): string | undefined {
 			? value.code
 			: value instanceof SessionMigrationBusyError
 				? value.code
-				: typeof value === "string"
-					? value
-					: undefined;
+				: value instanceof SessionTranscriptOversizedError
+					? value.code
+					: typeof value === "string"
+						? value
+						: undefined;
 	if (code === "artifact_capacity_exceeded") return SESSION_ARTIFACT_CAPACITY_RECOVERY_MESSAGE;
+	if (code === "oversized") return SESSION_OVERSIZED_RECOVERY_MESSAGE;
 	if (code === "migration_busy") return new SessionMigrationBusyError().message;
 	return undefined;
 }
@@ -1834,6 +1839,9 @@ export async function runRootCommand(
 				} catch {
 					logger.warn("Failed to dispose session after interactive error");
 				}
+				if (error !== null && typeof error === "object" && "code" in error && error.code === "cancelled") {
+					return;
+				}
 				throw error;
 			}
 

package/src/modes/acp/acp-agent.ts

@@ -403,8 +403,8 @@ function receivedSdkEvent(frame: JsonObject): ReceivedSdkEvent | undefined {
 }
 
 const ACP_CONFIG_OPTIONS = [
-	{ id: MODEL_CONFIG_ID, name: "Model", options: [] },
-	{ id: THINKING_CONFIG_ID, name: "Thinking", options: [] },
+	{ id: MODEL_CONFIG_ID, name: "Model", category: "model", options: [] },
+	{ id: THINKING_CONFIG_ID, name: "Thinking", category: "thought_level", options: [] },
 	{
 		id: "steeringMode",
 		name: "Steering queue",
@@ -466,17 +466,122 @@ function modelPresetConfigOptions(query: unknown, current: string): { value: str
 	return [...options].map(([value, name]) => ({ value, name }));
 }
 
-function modelConfigOptions(query: unknown, current: string | undefined): { value: string; name: string }[] {
+function modelConfigOptions(
+	query: unknown,
+	current: string | undefined,
+	activeProviders?: ReadonlySet<string>,
+): { value: string; name: string }[] {
 	const options = new Map<string, string>();
 	for (const item of pageItems(query)) {
 		const model = object(item);
 		if (!model || typeof model.provider !== "string" || typeof model.id !== "string") continue;
+		if (activeProviders !== undefined && !activeProviders.has(model.provider)) continue;
 		const value = `${model.provider}/${model.id}`;
 		options.set(value, typeof model.name === "string" ? model.name : value);
 	}
 	if (current && !options.has(current)) options.set(current, current);
 	return [...options].map(([value, name]) => ({ value, name }));
 }
+const MAX_ACTIVE_PROVIDER_PAGES = 100;
+
+/**
+ * Unsupported-query compatibility fallback. Session hosts without
+ * `providers.list/active` reject the unknown named query as either
+ * `operation_not_session_owned` (host knows the registry but not the query)
+ * or `invalid_request` (pre-Q29 host that predates the registry entry). Both
+ * keep the full catalog authoritative on the first page; every other failure
+ * mode fails closed so the active-provider contract is never silently
+ * widened.
+ */
+function isUnsupportedQueryError(error: unknown): boolean {
+	return (
+		typeof error === "object" &&
+		error !== null &&
+		((error as { code?: unknown }).code === "operation_not_session_owned" ||
+			(error as { code?: unknown }).code === "invalid_request")
+	);
+}
+
+function queryPage(query: unknown): { items?: unknown; complete?: unknown; continuationCursor?: unknown } | undefined {
+	const response = object(query);
+	const result = object(response?.result) ?? response;
+	return object(result?.page);
+}
+
+/**
+ * Collect every page of `providers.list/active` (Q29, GJC >= 0.12.8) and
+ * return the providers with usable stored credentials or credentialless
+ * connection kinds, mirroring the TUI model picker's
+ * `modelRegistry.getAvailable()`. The openwebui-gjc-adapter applies the same
+ * filter to `/v1/models`. Q29 pages are byte-bounded and can span multiple
+ * pages when custom provider ids inflate the payload, so all pages are
+ * consumed before the provider set is built. Returns undefined only when the
+ * session host rejects the query with `operation_not_session_owned`; any
+ * other query failure or malformed page is thrown.
+ */
+export async function collectActiveProviderIds(
+	adapter: Pick<AcpSdkAdapter, "query">,
+): Promise<ReadonlySet<string> | undefined> {
+	const providers = new Set<string>();
+	let cursor: string | undefined;
+	for (let pageCount = 0; pageCount < MAX_ACTIVE_PROVIDER_PAGES; pageCount++) {
+		let response: unknown;
+		try {
+			response = await adapter.query("providers.list/active", {}, cursor);
+		} catch (error) {
+			if (cursor === undefined && isUnsupportedQueryError(error)) return undefined;
+			throw error;
+		}
+		const page = queryPage(response);
+		if (!page) throw new AcpSdkAdapterError("protocol_error", "providers.list/active returned no page.");
+		const items = page.items;
+		if (!Array.isArray(items))
+			throw new AcpSdkAdapterError("protocol_error", "providers.list/active returned a malformed page.");
+		for (const item of items) {
+			const record = object(item);
+			if (!record || typeof record.provider !== "string") continue;
+			const connectionKind = record.connectionKind;
+			if (connectionKind === "credential" || connectionKind === "credentialless") providers.add(record.provider);
+		}
+		if (page.complete === true) return providers;
+		if (typeof page.continuationCursor !== "string")
+			throw new AcpSdkAdapterError(
+				"protocol_error",
+				"providers.list/active page is incomplete without a continuation cursor.",
+			);
+		cursor = page.continuationCursor;
+	}
+	throw new AcpSdkAdapterError("protocol_error", "providers.list/active exceeded the page budget.");
+}
+const MAX_MODEL_CATALOG_PAGES = 100;
+
+/**
+ * Collect every page of `models.list/current` (Q10) into one catalog so the
+ * active-provider filter never drops models that only appear on later pages.
+ * The SDK pages Q10 at a fixed byte target (256 KiB), which a fully
+ * configured catalog can exceed. Returns the same
+ * `{ result: { page: { items } } }` envelope `pageItems` consumes.
+ */
+export async function collectModelCatalog(adapter: Pick<AcpSdkAdapter, "query">): Promise<unknown> {
+	const items: unknown[] = [];
+	let cursor: string | undefined;
+	for (let pageCount = 0; pageCount < MAX_MODEL_CATALOG_PAGES; pageCount++) {
+		const response = await adapter.query("models.list/current", {}, cursor);
+		const page = queryPage(response);
+		if (!page) throw new AcpSdkAdapterError("protocol_error", "models.list/current returned no page.");
+		if (!Array.isArray(page.items))
+			throw new AcpSdkAdapterError("protocol_error", "models.list/current returned a malformed page.");
+		items.push(...page.items);
+		if (page.complete === true) return { result: { page: { items } } };
+		if (typeof page.continuationCursor !== "string")
+			throw new AcpSdkAdapterError(
+				"protocol_error",
+				"models.list/current page is incomplete without a continuation cursor.",
+			);
+		cursor = page.continuationCursor;
+	}
+	throw new AcpSdkAdapterError("protocol_error", "models.list/current exceeded the page budget.");
+}
 
 const THINKING_CONFIG_OPTIONS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"].map(value => ({
 	value,
@@ -484,7 +589,12 @@ const THINKING_CONFIG_OPTIONS = ["off", "minimal", "low", "medium", "high", "xhi
 }));
 
 /** Maps live canonical SDK config and the selected model catalog into the ACP 1.2.1 session state surface. */
-export function acpSessionStateFromConfig(query: unknown, modelCatalogQuery?: unknown, modelPreset?: string) {
+export function acpSessionStateFromConfig(
+	query: unknown,
+	modelCatalogQuery?: unknown,
+	modelPreset?: string,
+	activeProviders?: ReadonlySet<string>,
+) {
 	const values = configValues(query);
 	const useModelPresets = modelPreset !== undefined;
 	const currentModeId = values.get(MODE_CONFIG_ID) === ACP_PLAN_MODE_ID ? ACP_PLAN_MODE_ID : ACP_DEFAULT_MODE_ID;
@@ -493,6 +603,7 @@ export function acpSessionStateFromConfig(query: unknown, modelCatalogQuery?: un
 			{
 				id: MODE_CONFIG_ID,
 				name: "Mode",
+				category: "mode" as const,
 				type: "select" as const,
 				currentValue: currentModeId,
 				options: [
@@ -510,7 +621,7 @@ export function acpSessionStateFromConfig(query: unknown, modelCatalogQuery?: un
 					option.id === MODEL_CONFIG_ID
 						? useModelPresets
 							? modelPresetConfigOptions(modelCatalogQuery, value)
-							: modelConfigOptions(modelCatalogQuery, value)
+							: modelConfigOptions(modelCatalogQuery, value, activeProviders)
 						: option.id === THINKING_CONFIG_ID
 							? THINKING_CONFIG_OPTIONS
 							: [...option.options];
@@ -1799,8 +1910,13 @@ export class AcpAgent implements Agent {
 		const modelPreset = this.#startupOptions?.modelPreset;
 		const [config, modelCatalog] = await Promise.all([
 			record.adapter.query("config.list/get"),
-			record.adapter.query(modelPreset === undefined ? "models.list/current" : "models.profiles.list"),
+			modelPreset === undefined ? collectModelCatalog(record.adapter) : record.adapter.query("models.profiles.list"),
 		]);
+		// Resolve usable providers in parallel. Only an older session host that
+		// rejects `providers.list/active` with `operation_not_session_owned`
+		// falls back to the full catalog; operational failures fail closed so
+		// the active-provider contract is not silently widened.
+		const activeProviders = modelPreset === undefined ? await collectActiveProviderIds(record.adapter) : undefined;
 		record.authFailure = undefined;
 		if (modelPreset !== undefined) {
 			const activePreset = configValues(config).get(MODEL_PRESET_CONFIG_KEY);
@@ -1815,7 +1931,7 @@ export class AcpAgent implements Agent {
 					throw new AcpSdkAdapterError("authentication_failed", record.authFailure);
 			}
 		}
-		return acpSessionStateFromConfig(config, modelCatalog, modelPreset);
+		return acpSessionStateFromConfig(config, modelCatalog, modelPreset, activeProviders);
 	}
 
 	async #publishAvailableCommands(id: string, adapter: AcpSdkAdapter): Promise<void> {

package/src/modes/components/model-selector.ts

@@ -1721,9 +1721,13 @@ export class ModelSelectorComponent extends Container {
 			: choice.role === null
 				? "temporary model"
 				: GJC_MODEL_ASSIGNMENT_TARGETS[choice.role].name;
+		// Show the highlighted reasoning level — never the model id (that mislabel
+		// made "Reasoning for Default: gpt-5.6-luna" look like a level).
+		const selectedLevel = choice.levels[this.#selectedThinkingIndex];
+		const selectedLevelLabel = selectedLevel ? getThinkingLevelMetadata(selectedLevel).label : "—";
 		this.#listContainer.addChild(new Spacer(1));
 		this.#listContainer.addChild(
-			new Text(theme.fg("muted", `  Reasoning for ${targetLabel}: ${choice.item.model.id}`), 0, 0),
+			new Text(theme.fg("muted", `  Reasoning for ${targetLabel}: ${selectedLevelLabel}`), 0, 0),
 		);
 		this.#listContainer.addChild(new Spacer(1));
 		for (let i = 0; i < choice.levels.length; i++) {
@@ -2079,8 +2083,13 @@ export class ModelSelectorComponent extends Container {
 			this.#updateList();
 		}
 	}
-	#getInitialThinkingChoiceIndex(item: ModelItem | CanonicalModelItem, levels: ThinkingLevel[]): number {
-		const preferred = this.#getPreferredThinkingLevel(item);
+	#getInitialThinkingChoiceIndex(
+		item: ModelItem | CanonicalModelItem,
+		levels: ThinkingLevel[],
+		role: GjcModelAssignmentTargetId | null = null,
+		roles?: readonly GjcModelAssignmentTargetId[],
+	): number {
+		const preferred = this.#getPreferredThinkingLevel(item, role, roles);
 		if (preferred && preferred !== ThinkingLevel.Inherit) {
 			const index = levels.indexOf(preferred);
 			if (index !== -1) return index;
@@ -2088,13 +2097,51 @@ export class ModelSelectorComponent extends Container {
 		return 0;
 	}
 
-	#getPreferredThinkingLevel(item: ModelItem | CanonicalModelItem): ThinkingLevel | undefined {
+	/**
+	 * Prefer the role binding the user is editing when it already points at this
+	 * model so the reasoning menu opens on the level role badges already show
+	 * (e.g. EXECUTOR (xhigh) must not leave the cursor on "off").
+	 */
+	#getPreferredThinkingLevel(
+		item: ModelItem | CanonicalModelItem,
+		role: GjcModelAssignmentTargetId | null = null,
+		roles?: readonly GjcModelAssignmentTargetId[],
+	): ThinkingLevel | undefined {
+		const roleThinking = this.#getAssignedThinkingLevelForModel(item.model, role, roles);
+		if (roleThinking && roleThinking !== ThinkingLevel.Inherit) {
+			return roleThinking;
+		}
 		if (item.thinkingLevel && item.thinkingLevel !== ThinkingLevel.Inherit) {
 			return item.thinkingLevel;
 		}
 		return undefined;
 	}
 
+	#getAssignedThinkingLevelForModel(
+		model: Model,
+		role: GjcModelAssignmentTargetId | null,
+		roles?: readonly GjcModelAssignmentTargetId[],
+	): ThinkingLevel | undefined {
+		if (roles && roles.length > 0) {
+			const assignedLevels = roles
+				.map(targetRole => this.#roles[targetRole])
+				.filter(
+					(assigned): assigned is RoleAssignment =>
+						assigned !== undefined &&
+						modelsAreEqual(assigned.model, model) &&
+						assigned.thinkingLevel !== ThinkingLevel.Inherit,
+				)
+				.map(assigned => assigned.thinkingLevel);
+			if (assignedLevels.length === 0) return undefined;
+			const first = assignedLevels[0];
+			return assignedLevels.every(level => level === first) ? first : undefined;
+		}
+		if (role === null) return undefined;
+		const assigned = this.#roles[role];
+		if (!assigned || !modelsAreEqual(assigned.model, model)) return undefined;
+		return assigned.thinkingLevel;
+	}
+
 	#handleSelect(
 		item: ModelItem | CanonicalModelItem,
 		role: GjcModelAssignmentTargetId | null,
@@ -2109,7 +2156,7 @@ export class ModelSelectorComponent extends Container {
 		if (!hasExplicitThinkingChoice && needsExplicitThinkingChoice) {
 			const levels = getSelectableThinkingLevels(item.model);
 			this.#pendingThinkingChoice = { item, role, roles, levels };
-			this.#selectedThinkingIndex = this.#getInitialThinkingChoiceIndex(item, levels);
+			this.#selectedThinkingIndex = this.#getInitialThinkingChoiceIndex(item, levels, role, roles);
 			this.#updateList();
 			return;
 		}

package/src/modes/print-mode.ts

@@ -7,6 +7,7 @@
  */
 import { type AssistantMessage, type ImageContent, isContextOverflow } from "@gajae-code/ai";
 import { isKnownSinkPeerClosedError, logger, sanitizeText } from "@gajae-code/utils";
+import { loadSlashCommands } from "../extensibility/slash-commands";
 import type { AgentSession } from "../session/agent-session";
 import { isSilentAbort } from "../session/messages";
 import { initializeExtensions } from "./runtime-init";
@@ -207,6 +208,15 @@ export async function runPrintMode(session: AgentSession, options: PrintModeOpti
 			if (header) stdout.write(`${JSON.stringify(header)}\n`);
 		}
 
+		// Bundled and file-based slash commands (`/init`, project `commands/*.md`, …) expand
+		// inside AgentSession#prompt from the list handed over by setSlashCommands. Interactive
+		// mode loads it while building its autocomplete; print mode has no autocomplete, so
+		// without this the list stays empty and a leading-slash prompt reaches the model as
+		// literal prose — no expansion, no error, and an answer that looks like the command ran.
+		await logger.time("print:slash-commands", async () => {
+			session.setSlashCommands(await loadSlashCommands({ cwd: session.sessionManager.getCwd() }));
+		});
+
 		// Set up extensions for print mode (no UI, no command context).
 		await initializeExtensions(session, {
 			reportSendError: (action, err) => {

package/src/prompts/system/project-prompt.md

@@ -21,6 +21,25 @@ MUST read before making changes within:
 {{#list agentsMdSearch.files join="\n"}}- {{this}}{{/list}}
 </dir-context>
 {{/if}}
+
+{{#if alwaysApplyRules.length}}
+{{#each alwaysApplyRules}}
+{{content}}
+{{/each}}
+{{/if}}
+{{#if rules.length}}
+Rules are local constraints. You MUST read `rule://<name>` when working in that domain.
+<rules>
+{{#list rules join="\n"}}
+<rule name="{{name}}">
+{{description}}
+{{#if globs.length}}
+{{#list globs join="\n"}}<glob>{{this}}</glob>{{/list}}
+{{/if}}
+</rule>
+{{/list}}
+</rules>
+{{/if}}
 <critical>
 - Each response MUST advance the task. There is no stopping condition other than completion.
 - You MUST default to informed action; do not ask for confirmation when tools or repo context can answer.

package/src/sdk/bus/html-format.ts

@@ -427,6 +427,23 @@ export function finalizeTelegramHtml(message?: string): string | undefined {
 	return truncateTelegramHtml(message);
 }
 
+/** Multi-select state marker a transport may prepend to an option label. */
+export const SELECTION_MARK_CHECKED = "☑";
+export const SELECTION_MARK_UNCHECKED = "☐";
+const SELECTION_MARK_PREFIX = new RegExp(`^\\s*([${SELECTION_MARK_CHECKED}${SELECTION_MARK_UNCHECKED}])\\s+`);
+
+/**
+ * Drop a leading `N.`/`N)` index already embedded in an option label (e.g.
+ * deep-interview options pre-numbered by the ask tool) so the canonical
+ * one-based index can be applied instead. A selection marker stays in front of
+ * the text: the label is renumbered, not un-marked.
+ */
+export function renumberableOptionText(label: string): string {
+	const marker = SELECTION_MARK_PREFIX.exec(label);
+	const rest = marker ? label.slice(marker[0].length) : label;
+	return `${marker ? `${marker[1]} ` : ""}${rest.replace(/^\s*\d+[.)]\s+/, "")}`;
+}
+
 /**
  * One-based, plain-text button label (Telegram does not parse HTML in labels).
  *
@@ -436,13 +453,12 @@ export function finalizeTelegramHtml(message?: string): string | undefined {
  * `1. 1. …` and keeps the displayed number aligned with the button's real index.
  */
 export function buttonLabel(label: string, index: number): string {
-	const stripped = label.replace(/^\s*\d+[.)]\s+/, "");
-	return `${index + 1}. ${stripped}`;
+	return `${index + 1}. ${renumberableOptionText(label)}`;
 }
 
 /** Numbered, escaped option list for the Telegram message body. */
 export function numberedOptionList(labels: string[]): string {
-	return labels.map((label, i) => `${i + 1}. ${escapeHtml(label.replace(/^\s*\d+[.)]\s+/, ""))}`).join("\n");
+	return labels.map((label, i) => `${i + 1}. ${escapeHtml(renumberableOptionText(label))}`).join("\n");
 }
 
 /** Compact numeric button label; full option text belongs in the message body. */

package/src/sdk/bus/index.ts

@@ -837,16 +837,22 @@ export class PresentationArbiter {
 							...(presentation.recommendedIndex === undefined
 								? {}
 								: { recommendedIndex: presentation.recommendedIndex }),
-							controls: presentation.multi
-								? [
-										{
-											id: "navigation_forward",
-											kind: "navigation",
-											label: presentation.navigationLabel ?? "Done",
-											enabled: presentation.allowEmpty || presentation.selectedOptions.length > 0,
-										},
-									]
-								: presentation.controls,
+							// A presentation that carries its own controls (the ask tool's
+							// Next/Done) keeps them; a durable workflow gate presents none,
+							// so its navigation control is synthesized here.
+							controls:
+								presentation.controls.length > 0
+									? presentation.controls
+									: presentation.multi
+										? [
+												{
+													id: "navigation_forward",
+													kind: "navigation",
+													label: presentation.navigationLabel ?? "Done",
+													enabled: presentation.allowEmpty || presentation.selectedOptions.length > 0,
+												},
+											]
+										: [],
 						},
 						{ redact: this.redact(), sessionTag: this.tag },
 					),
@@ -1824,9 +1830,12 @@ function registerInteractiveAnswerSource(
 					options: request.options,
 					controls: request.controls,
 					recommendedIndex: request.recommendedIndex,
-					multi: false,
+					// The ask tool owns the multi-select loop and re-issues one request per
+					// toggle; carrying its selection here is what makes the toggle visible
+					// on a remote transport instead of an identical repeated prompt.
+					multi: request.multi === true,
 					allowEmpty: false,
-					selectedOptions: [],
+					selectedOptions: [...(request.selectedOptions ?? [])],
 					onActivated: (actionId, lease) => {
 						if (pending.actionId && pendingInteractive.get(pending.actionId) === pending)
 							pendingInteractive.delete(pending.actionId);

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -75,9 +75,13 @@ export const NOTIFICATION_PROTOCOL_VERSION = 3;
  * final-component file symlinks fail-closed under AT_SYMLINK_NOFOLLOW (bounded
  * #3761 multi-account activation repair). Generation 51 adds shared durable
  * topic authority, archive recovery, and requires Telegram's documented error
- * code for idempotent archive settlement.
+ * code for idempotent archive settlement. Generation 52 is claimed by the
+ * pre-readiness daemon-child exit diagnostics slice (#3761). Generation 53
+ * renders multi-select state for ask-tool asks, not only durable workflow
+ * gates, and renumbers pre-numbered options exactly once around the selection
+ * marker.
  */
-export const DAEMON_GENERATION = 51;
+export const DAEMON_GENERATION = 53;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 5

package/src/sdk/bus/telegram-daemon.ts

@@ -48,6 +48,8 @@ import {
 	buildCompactChoiceGrid,
 	code,
 	markdownToTelegramHtml,
+	SELECTION_MARK_CHECKED,
+	SELECTION_MARK_UNCHECKED,
 	splitTelegramHtml,
 	TELEGRAM_MESSAGE_LIMIT,
 	TELEGRAM_PARSE_MODE,
@@ -383,6 +385,10 @@ const BTW_QUESTION_LIMIT_TEXT = "Question must be at most 4096 Unicode scalar va
 type ParsedBtwCommand = { kind: "question"; question: string } | { kind: "ignored" };
 type TelegramFileDownload = { bytes: Buffer } | { failure: "download_failed" | "too_large" };
 class ThreadedModeCapabilityRefusal extends Error {}
+/** Telegram answered `createForumTopic` with an explicit `ok: false` rejection. */
+class TopicCreationRejected extends Error {}
+/** The transport suppressed `createForumTopic` (no response body to classify). */
+class TopicCreationSuppressed extends Error {}
 
 async function prepareTelegramImageAttachment(frame: Record<string, unknown>): Promise<Record<string, unknown>> {
 	if (frame.type !== "image_attachment") return frame;
@@ -422,7 +428,7 @@ function isThreadedModeCapabilityRefusal(response: unknown): boolean {
 	return (
 		ok === false &&
 		typeof description === "string" &&
-		/(?:threaded mode|forum topics? (?:is|are) (?:disabled|not enabled)|(?:not allowed|not permitted|cannot|can't) create forum topics?)/i.test(
+		/(?:threaded mode|forum topics? (?:is|are) (?:disabled|not enabled)|(?:not allowed|not permitted|cannot|can't) create forum topics?|chat is not a forum)/i.test(
 			description,
 		)
 	);
@@ -5068,6 +5074,8 @@ export class TelegramNotificationDaemon {
 	private readonly flatIdentitySent = new Set<string>();
 	/** Cached delivery boundary for the private owner chat or validation forum. */
 	private pairedChatPrivacy: PairedChatPrivacy | undefined;
+	/** Latched once Telegram confirms this chat cannot host forum topics. */
+	private topicCapabilityRefused = false;
 	/** Bot username from getMe, cached once at owner startup for group/forum command targeting. */
 	private botUsername: string | undefined;
 	/** Sessions whose agent loop is currently busy (drives the typing indicator). */
@@ -7836,8 +7844,6 @@ export class TelegramNotificationDaemon {
 		let acceptedTopicId: string | undefined;
 		let acceptedTopicCompensated = false;
 		let acceptedTopicArchiveAttempted = false;
-		let creationSuppressed = false;
-		let creationRejected = false;
 		let adoptedTopicId: number | undefined;
 		const adoptionIntentCandidate = this.#adoptionIntents.bySession(sessionId);
 		try {
@@ -7876,10 +7882,10 @@ export class TelegramNotificationDaemon {
 					const res = (await this.botApi.call("createForumTopic", { chat_id: this.opts.chatId, name })) as
 						| { result?: { message_thread_id?: unknown } }
 						| undefined;
-					if (res === undefined) {
-						creationSuppressed = true;
-						return undefined;
-					}
+					// Classification must travel with the rejection, not through
+					// closure flags: `getOrCreateTopic` shares one in-flight create
+					// promise, so every other awaiter observes only the error.
+					if (res === undefined) throw new TopicCreationSuppressed();
 					if (isThreadedModeCapabilityRefusal(res)) throw new ThreadedModeCapabilityRefusal();
 					const response = res as {
 						ok?: unknown;
@@ -7887,8 +7893,8 @@ export class TelegramNotificationDaemon {
 					};
 					const tid = response.result?.message_thread_id;
 					if (typeof tid !== "number" || !Number.isSafeInteger(tid) || tid <= 0) {
-						creationRejected = response.ok === false;
-						if (!creationRejected) this.#malformedTopicCreateEndpoints.set(sessionId, creationEndpointKey);
+						if (response.ok === false) throw new TopicCreationRejected();
+						this.#malformedTopicCreateEndpoints.set(sessionId, creationEndpointKey);
 						throw new Error("createForumTopic: invalid message_thread_id");
 					}
 					acceptedTopicId = String(tid);
@@ -8009,7 +8015,12 @@ export class TelegramNotificationDaemon {
 		} catch (err) {
 			if (adoptedTopicId !== undefined) this.#adoptionIntents.releaseClaim(adoptedTopicId, sessionId);
 			if (adoptionIntentCandidate) this.topics.abandonCreateClaim(sessionId, creationLeaseEpoch);
-			if (creationSuppressed || creationRejected || err instanceof ThreadedModeCapabilityRefusal) {
+			if (
+				err instanceof TopicCreationSuppressed ||
+				err instanceof TopicCreationRejected ||
+				err instanceof ThreadedModeCapabilityRefusal
+			) {
+				if (err instanceof ThreadedModeCapabilityRefusal) this.topicCapabilityRefused = true;
 				if (this.topics.abandonCreateClaim(sessionId, creationLeaseEpoch)) await this.persistTopics();
 				return undefined;
 			}
@@ -9515,6 +9526,7 @@ export class TelegramNotificationDaemon {
 	}
 
 	private async pairedChatAllowsTopics(): Promise<boolean> {
+		if (this.topicCapabilityRefused) return false;
 		const privacy = await this.resolvePairedChatPrivacy();
 		return privacy === "private" || privacy === "validation-forum";
 	}
@@ -9556,7 +9568,11 @@ export class TelegramNotificationDaemon {
 	private startFlushTimer(): void {
 		this.runtime.startInterval("telegram-flush", RATE_LIMIT_FLUSH_INTERVAL_MS, () => {
 			if (!this.running || this.pool.pending === 0) return;
-			void this.flushPool();
+			// `flushPool` only swallows failures for the shared chain; the promise it
+			// returns still rejects, and an unhandled rejection here exits the daemon.
+			void this.flushPool().catch(error => {
+				logger.warn(`notifications: queue flush failed: ${sanitizeDiagnostic(String(error), this.opts.botToken)}`);
+			});
 		});
 	}
 
@@ -9596,11 +9612,27 @@ export class TelegramNotificationDaemon {
 		this.runtime.stopInterval("telegram-owner-heartbeat");
 	}
 
-	/** Run a root scan, guarding against overlapping scans from the timer + loop. */
+	/**
+	 * Run a root scan, guarding against overlapping scans from the timer + loop.
+	 *
+	 * A reconciliation pass is retried every scan interval, so a failed one must
+	 * never tear the owner down. Both callers are fatal boundaries: the timer
+	 * fires and forgets, and the run loop awaits without a handler. A rejection
+	 * escaping either one (a shared topic authority whose lock or compare-and-set
+	 * is momentarily unavailable is the observed case) reaches the process-level
+	 * handler, which exits the daemon: every session topic is then left as an
+	 * unarchived shell that answers nothing, and the sessions that were still
+	 * live lose notifications too. Report the failure and let the next scan
+	 * retry instead.
+	 */
 	private async runScan(): Promise<void> {
-		await this.runtime.runExclusive("telegram-scan", async () => {
-			await this.scanRoots();
-		});
+		try {
+			await this.runtime.runExclusive("telegram-scan", async () => {
+				await this.scanRoots();
+			});
+		} catch (error) {
+			logger.warn(`notifications: session scan failed: ${sanitizeDiagnostic(String(error), this.opts.botToken)}`);
+		}
 	}
 
 	private startScanTimer(): void {
@@ -10376,7 +10408,9 @@ export class TelegramNotificationDaemon {
 					: [],
 			);
 			const displayOptions = options.map((option, index) =>
-				multiSelect ? `${selectedOptionIndices.has(index) ? "☑" : "☐"} ${option}` : option,
+				multiSelect
+					? `${selectedOptionIndices.has(index) ? SELECTION_MARK_CHECKED : SELECTION_MARK_UNCHECKED} ${option}`
+					: option,
 			);
 			const rendered = buildActionMessage({
 				kind: msg.kind ?? "ask",