charness 3.2.0 → 3.3.0

package/dist/bot.js

@@ -105,7 +105,11 @@ const apiRetryKick_1 = require("./apiRetryKick");
 const limitHeldPromptQueue_1 = require("./utils/limitHeldPromptQueue");
 const foreignKeyFallbacks_1 = require("./connectors/telegram/foreignKeyFallbacks");
 const download_1 = require("./utils/download");
-const transcribeAudio_1 = require("./utils/transcribeAudio");
+const sttSettings_1 = require("./stt/sttSettings");
+const sttRuntime_1 = require("./stt/sttRuntime");
+const sttSidecarOwner_1 = require("./stt/sttSidecarOwner");
+const sttAutoInstall_1 = require("./stt/sttAutoInstall");
+const transcribeChain_1 = require("./stt/transcribeChain");
 const utils_1 = require("./utils");
 const recvPreviewRedaction_1 = require("./utils/recvPreviewRedaction");
 const sendErrorClassifier_1 = require("./sendErrorClassifier");
@@ -129,6 +133,7 @@ const clearThreadOutputQueues_1 = require("./utils/clearThreadOutputQueues");
 const groupFinalizePlan_1 = require("./utils/groupFinalizePlan");
 const persistAdapterSessionIds_1 = require("./utils/persistAdapterSessionIds");
 const ensureSessionPlan_1 = require("./utils/ensureSessionPlan");
+const backendUnavailableError_1 = require("./adapters/backendUnavailableError");
 const claudeCodeVersion_1 = require("./utils/claudeCodeVersion");
 const keyedTransitionQueue_1 = require("./utils/keyedTransitionQueue");
 const adoptedToolList_1 = require("./utils/adoptedToolList");
@@ -151,6 +156,7 @@ const voiceQueue_1 = require("./voiceQueue");
 const claudeLivenessAction_1 = require("./utils/claudeLivenessAction");
 const isoTimestamp_1 = require("./utils/isoTimestamp");
 const effortLevels_1 = require("./effortLevels");
+const instanceSettings_1 = require("./instanceSettings");
 const threadContextPreamble_1 = require("./threadContextPreamble");
 const pinnedBannerSkipDecision_1 = require("./utils/pinnedBannerSkipDecision");
 const replyQuote_1 = require("./utils/replyQuote");
@@ -191,16 +197,26 @@ const questionKeyboards_1 = require("./connectors/telegram/questionKeyboards");
 const displayModes_1 = require("./connectors/telegram/commands/displayModes");
 const reminders_1 = require("./connectors/telegram/commands/reminders");
 const modelProviders_1 = require("./connectors/telegram/commands/modelProviders");
+const callbackToast_1 = require("./connectors/telegram/commands/callbackToast");
 const compaction_1 = require("./connectors/telegram/commands/compaction");
 const autoContinueLimits_1 = require("./connectors/telegram/commands/autoContinueLimits");
 const claudeAccounts_1 = require("./connectors/telegram/commands/claudeAccounts");
 const claudeProfiles_1 = require("./utils/claudeProfiles");
 const claudeUsage_1 = require("./utils/claudeUsage");
 const claudeUsageRefresher_1 = require("./utils/claudeUsageRefresher");
+const openCodeUsage_1 = require("./utils/openCodeUsage");
+const usageRefreshBudget_1 = require("./utils/usageRefreshBudget");
 const claudeLimitSwitch_1 = require("./utils/claudeLimitSwitch");
+const fallbackSwitchNotice_1 = require("./utils/fallbackSwitchNotice");
+const adapterSwitchSessionIds_1 = require("./utils/adapterSwitchSessionIds");
 const fallbackChain_1 = require("./utils/fallbackChain");
 const fallbackBridge_1 = require("./utils/fallbackBridge");
 const fallbackChain_2 = require("./connectors/telegram/commands/fallbackChain");
+const limitsBoard_1 = require("./connectors/telegram/commands/limitsBoard");
+const backendSwitch_1 = require("./connectors/telegram/commands/backendSwitch");
+const operatorSwitchPlan_1 = require("./utils/operatorSwitchPlan");
+const backendSwitchPlan_1 = require("./utils/backendSwitchPlan");
+const stt_1 = require("./connectors/telegram/commands/stt");
 const resolveBinary_1 = require("./utils/resolveBinary");
 // ═══════════════════════════════════════════════════════════════════════════════
 //  ENV parsing & fatal validation
@@ -304,11 +320,11 @@ function parseEnv() {
         isDmSurfaceInert,
         allowedGroupId,
         workRoot,
-        openaiApiKey: process.env.OPENAI_API_KEY,
-        groqApiKey: process.env.GROQ_API_KEY,
     };
 }
 const ENV = parseEnv();
+// The instance default effort (`/effort` in General) is `settings.json`'s `defaultEffort`, re-read when the file changes.
+(0, effortLevels_1.setInstanceDefaultEffortReader)((0, instanceSettings_1.createInstanceDefaultEffortReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line)));
 // ═══════════════════════════════════════════════════════════════════════════════
 //  Effective group id — single source of truth for the forum supergroup
 //
@@ -556,14 +572,16 @@ async function checkIsForumAdmin(chatId, userId) {
 // recorded before any gating (access control, group routing) can drop it.
 // Security: while the thread awaits a `/connect` key paste (same
 // `pendingProviderConnects` state the text handler consumes later in this
-// update), the message text is a provider API key — the preview is redacted
-// at record time so the secret never lands in the on-disk trace.
+// update, or while `/stt` waits for a speech-engine key), the message text is
+// an API key — the preview is redacted at record time so the secret never
+// lands in the on-disk trace.
 bot.use(async (ctx, next) => {
     const message = ctx.message;
     const messageText = message && 'text' in message ? message.text : undefined;
     const callbackData = ctx.callbackQuery && 'data' in ctx.callbackQuery ? ctx.callbackQuery.data : undefined;
     const threadKey = messageText === undefined ? null : getThreadKey(ctx);
     const isThreadPendingProviderConnect = threadKey !== null && pendingProviderConnects.has((0, sessionKey_1.keyToString)(threadKey));
+    const awaitedSttStep = threadKey !== null ? getAwaitedSttStep(threadKey) : null;
     (0, outputTrace_1.traceRecvUpdate)({
         updateType: ctx.updateType,
         updateId: ctx.update.update_id,
@@ -572,7 +590,7 @@ bot.use(async (ctx, next) => {
         threadId: message?.message_thread_id,
         preview: messageText === undefined
             ? callbackData
-            : (0, recvPreviewRedaction_1.getRecvTracePreview)(messageText, isThreadPendingProviderConnect),
+            : (0, recvPreviewRedaction_1.getRecvTracePreview)(messageText, isThreadPendingProviderConnect, awaitedSttStep),
         tgDateSec: message?.date,
     });
     return next();
@@ -1017,6 +1035,10 @@ const apiRetryTimers = new Map();
 function clearSavedApiRetry(key) {
     void state.clearApiRetry(key).catch(e => console.error('[apiRetry] clear failed:', e));
 }
+/** Drop the saved fire time of `key`'s limit probe: a retry armed, cancelled or given up after it ends what it decided. */
+function clearSavedFiredLimitProbe(key) {
+    void state.clearLimitProbeFired(key).catch(e => console.error('[apiRetry] fired-probe clear failed:', e));
+}
 /**
  * Threads whose retry timer FIRED and whose "continue" nudge is not forwarded
  * yet ({@link fireApiRetry}). The retry is no longer armed then, but the idle
@@ -1091,14 +1113,17 @@ const wedgeRecoveriesInFlight = new Set();
  * Dedup is delegated to `decideRetryAction` (a `pending` retry → `ignore`), so a
  * repeated Claude scrape frame or a duplicate `session.error` never double-arms.
  *
- * `/auto_continue_limits` gates the `usageLimit` class ONLY: with it OFF the bot says so
+ * The «wait for the reset» setting (`/limits_autoswitch`, formerly `/auto_continue_limits`) gates the `usageLimit` class ONLY: with it OFF the bot says so
  * once per topic (and once per open request, which also stops being woken) and
  * stops, arming nothing and persisting nothing. `transient` (the short
  * 5/10/20-min retries) and `auth` (surfaced, never retried) are untouched by the
  * toggle — a rate-limit hiccup always wants the automatic retry.
  */
-function handleApiError(key, cls) {
+function handleApiError(key, cls, options = {}) {
     const k = (0, sessionKey_1.keyToString)(key);
+    // An unconfirmed usage limit is probed first; it reaches the wait below only once confirmed.
+    if (cls.kind === 'usageLimit' && cls.isUnconfirmed === true && handleUnconfirmedLimit(key))
+        return;
     if (cls.kind === 'usageLimit' && !state.checkIsAutoContinueOnLimitEnabled(key)) {
         const isFirstOffNotice = !autoContinueOffNoticedThreads.has(k);
         autoContinueOffNoticedThreads.add(k);
@@ -1112,10 +1137,11 @@ function handleApiError(key, cls) {
     const prev = entry
         ? { attempt: entry.attempt, firedAt: entry.firedAt, pending: entry.timer !== null }
         : null;
+    const now = Date.now();
     const action = (0, apiErrorRetry_1.decideRetryAction)({
         kind: cls.kind,
         resetAt: cls.resetAt,
-        now: Date.now(),
+        now,
         prev,
     });
     // auth / logged out → surface a pinned notice (never a timer). Deduped to one
@@ -1130,13 +1156,16 @@ function handleApiError(key, cls) {
         void replyToThread(key, (0, i18n_1.t)('apiRetry.giveUp', { attempts: action.attempts }));
         clearSavedApiRetry(key);
         apiRetryTimers.delete(k);
+        clearSavedFiredLimitProbe(key);
         // Nothing resumes this limit any more: a reminder would hit it and arm a fresh episode, endlessly.
-        if (cls.kind === 'usageLimit')
+        if (cls.kind === 'usageLimit') {
             void requestWakeUpEngine?.stopWakingForLimitWait(key);
+            markLimitEpisodeSettled(key);
+        }
         return;
     }
     // action === 'arm'. A LIMIT notice ends with the shared pointer at
-    // `/auto_continue_limits` (the escape hatch: skip this one resume, or turn the
+    // `/limits` and `/limits_autoswitch` (the escape hatches: skip this one resume, or turn the
     // mode off). The transient notice gets none — it is not governed by the toggle
     // and resumes within minutes anyway.
     let limitWait;
@@ -1151,7 +1180,19 @@ function handleApiError(key, cls) {
         limitWait = cls.resetAt !== undefined
             ? { kind: 'afterReset', resetAt: cls.resetAt, fireAt: action.fireAt }
             : { kind: 'nextAttempt', fireAt: action.fireAt };
-        void announceUsageLimitOrSwitch(key, cls, action.fireAt, limitWait, action.attempt, true);
+        // A recovered episode whose window is already over is no limit: the retry fires
+        // at once and its "work resumed" notice says it all. A LIVE error is always
+        // announced, whatever its reset says (a clock behind the provider's included).
+        if (options.isRecoveredEpisode === true && (0, apiErrorRetry_1.checkIsUsageLimitWindowOver)(cls, now)) {
+            console.log(`[apiRetry] ${k}: the recovered limit window has already reset — resuming without a limit notice`);
+        }
+        else {
+            void announceUsageLimitOrSwitch(key, cls, action.fireAt, limitWait, action.attempt, true);
+        }
+    }
+    else if (cls.kind === 'conversationTail') {
+        // The topic's one line for it: the retry follows in a moment, and its raw provider text was not posted.
+        void replyToThread(key, (0, i18n_1.t)('apiRetry.conversationTailNotice'));
     }
     else {
         void replyToThread(key, (0, i18n_1.t)('apiRetry.transientNotice', {
@@ -1159,26 +1200,78 @@ function handleApiError(key, cls) {
             attempt: action.attempt,
         }));
     }
+    armApiRetryTimer(key, { kind: cls.kind, attempt: action.attempt, fireAt: action.fireAt, delayMs: action.delayMs, limitWait });
+}
+/**
+ * @description Arm a thread's retry once its notice is posted: keep a pending question last, persist the record
+ * (it means ARMED), start the unref'd timer whose callback is {@link fireApiRetry}, and keep the in-memory entry.
+ */
+function armApiRetryTimer(key, arming) {
+    // One armed timer per thread: a still-pending one it replaces must not fire as well.
+    const previousTimer = apiRetryTimers.get((0, sessionKey_1.keyToString)(key))?.timer;
+    if (previousTimer)
+        clearTimeout(previousTimer);
     // S3: the notice landed below any pending question — bring it back to the
     // bottom (debounced; no-op when no question is pending).
     onThreadActivityWhileQuestionPending(key);
     void state
-        .setApiRetry(key, { kind: cls.kind, attempt: action.attempt, fireAt: action.fireAt })
+        .setApiRetry(key, { kind: arming.kind, attempt: arming.attempt, fireAt: arming.fireAt, ...(arming.isLimitProbe ? { isLimitProbe: true } : {}) })
         .catch(e => console.error('[apiRetry] persist failed:', e));
-    const delayMs = Math.min(action.delayMs, engine_1.maxTimeoutMs);
+    clearSavedFiredLimitProbe(key);
     const timer = setTimeout(() => {
         void fireApiRetry(key);
-    }, delayMs);
+    }, Math.min(arming.delayMs, engine_1.maxTimeoutMs));
     timer.unref?.();
-    apiRetryTimers.set(k, {
+    apiRetryTimers.set((0, sessionKey_1.keyToString)(key), {
         timer,
-        attempt: action.attempt,
-        kind: cls.kind,
+        attempt: arming.attempt,
+        kind: arming.kind,
         firedAt: null,
-        fireAt: action.fireAt,
-        limitWait,
+        fireAt: arming.fireAt,
+        limitWait: arming.limitWait,
+        isLimitProbe: arming.isLimitProbe,
     });
 }
+/**
+ * @description An UNCONFIRMED usage limit (`isUnconfirmed`) of `key`: the probe retry it gets first — or `false` when the
+ * limit is confirmed and takes the usual usage-limit wait. Confirmed when it came again right after the probe fired, or
+ * the topic's account shows a window at 100 % ({@link checkIsTopicAccountUsageExhausted}); a retry already pending —
+ * the probe or a short retry — takes it with it (`true`, nothing more to do).
+ */
+function handleUnconfirmedLimit(key) {
+    const k = (0, sessionKey_1.keyToString)(key);
+    const entry = apiRetryTimers.get(k);
+    // A retry already pending (the probe itself, or a short retry) takes this error with it — as `decideRetryAction`
+    // ignores a repeat while armed. A probe armed over it replaced its record and left its timer: two "continue" nudges.
+    if (entry?.timer != null) {
+        console.log(`[apiRetry] ${k}: an unconfirmed usage limit — a retry is already pending, it stays`);
+        return true;
+    }
+    const isRepeatAfterProbe = entry?.isLimitProbe === true && entry.firedAt !== null && Date.now() - entry.firedAt <= apiErrorRetry_1.retryRecurrenceGraceMs;
+    const action = (0, apiErrorRetry_1.getUnconfirmedLimitAction)({ isRepeatAfterProbe, isUsageExhausted: checkIsTopicAccountUsageExhausted(key) });
+    if (action === 'waitForReset') {
+        console.log(`[apiRetry] ${k}: the unconfirmed usage limit is confirmed (${isRepeatAfterProbe ? 'it came again after the probe' : 'the account is marked limited or reads a window at 100 %'}) — waiting for the reset`);
+        return false;
+    }
+    console.log(`[apiRetry] ${k}: an unconfirmed usage limit — probing with a short retry before waiting for the reset`);
+    void replyToThread(key, (0, i18n_1.t)('apiRetry.transientNotice', { minutes: Math.round(apiErrorRetry_1.unconfirmedLimitProbeDelayMs / apiRetryMsPerMinute), attempt: 1 }));
+    const now = Date.now();
+    armApiRetryTimer(key, { kind: 'transient', attempt: 1, fireAt: now + apiErrorRetry_1.unconfirmedLimitProbeDelayMs, delayMs: apiErrorRetry_1.unconfirmedLimitProbeDelayMs, isLimitProbe: true });
+    return true;
+}
+/**
+ * @description Whether the topic's account usage reading proves its limit: a Claude topic's live profile marked limited
+ * (a rejected `rate_limit_event`) or showing a window its model drains at 100 %. Other backends carry no reading for the
+ * account an unconfirmed wording names: `false`, and only a repeat confirms it.
+ */
+function checkIsTopicAccountUsageExhausted(key) {
+    if (!checkIsClaudeProfileBackend(key))
+        return false;
+    const info = state.getClaudeProfileInfo(resolveLiveClaudeProfileName(key));
+    const limitedUntilMs = info?.limitedUntil ? Date.parse(info.limitedUntil) : Number.NaN;
+    const nowMs = Date.now();
+    return (Number.isFinite(limitedUntilMs) && limitedUntilMs > nowMs) || (0, claudeUsage_1.checkIsClaudeUsageExhausted)(info?.usage, getThreadClaudeModel(key), nowMs);
+}
 /**
  * @description R23: hold a prompt that arrives while `key` waits out an ARMED
  * usage limit — posting it would only hit the limit again. `false` when no
@@ -1266,6 +1359,9 @@ const apiRetryKickDeps = {
         return outcome.isSwitched;
     },
     clearSavedRetry: clearSavedApiRetry,
+    saveFiredLimitProbe: (key, firedAt) => {
+        void state.setLimitProbeFired(key, firedAt).catch(e => console.error('[apiRetry] fired-probe persist failed:', e));
+    },
 };
 /**
  * @description Post a usage-limit wait (request/answer core S5): as the bot's own
@@ -1379,7 +1475,7 @@ function announceLimitWaitToNewRequest(key) {
 /**
  * @description Both texts of a limit wait, from ONE branch on how it ends, in the
  * thread's locale. A wait ending on another day names the date. The
- * `/auto_continue_limits` pointer names a Telegram command — elsewhere it would
+ * `/limits` + `/limits_autoswitch` pointer names Telegram commands — elsewhere it would
  * be noise; the "auto-resume is off" text carries its own.
  */
 function getLimitWaitTexts(key, wait, attempt, resumeOn) {
@@ -1416,11 +1512,15 @@ function cancelApiRetry(key) {
     const entry = apiRetryTimers.get(k);
     if (entry?.timer)
         clearTimeout(entry.timer);
+    // A limit wait that ends here ends without its resume: the error it waited on stays the log's last word.
+    if (entry?.kind === 'usageLimit')
+        markLimitEpisodeSettled(key);
     // Prompts held during the wait (R23) are not dropped with it: they ride the next
     // prompt forwarded to the session — the operator's message that cancelled the
     // wait — or go to the next session on their own (`limitHeldPrompts`).
     apiRetryTimers.delete(k);
     clearSavedApiRetry(key);
+    clearSavedFiredLimitProbe(key);
     // The limit episode is over for this thread → retire its two one-shot markers.
     // Unlike the logged-out notice below, BOTH are safe to drop here: the pinned
     // "work resumed" message announces a PAST event (nothing re-posts it), and the
@@ -2121,6 +2221,7 @@ function clearInMemoryThreadState(key) {
     threadSessionLists.delete(k);
     awaitingSessionSelection.delete(k);
     pendingProviderConnects.delete(k);
+    void cancelSttInput(key, { isSilent: true }); // teardown → drop an armed /stt step and its timer
     connectMethodLists.delete(k);
     // Compound (thread + message) keys — drop every picker this thread rendered.
     for (const pickerKey of (0, providerDisconnectPlan_1.getDisconnectPickerKeysForThread)(disconnectProviderLists.keys(), k)) {
@@ -2246,7 +2347,7 @@ function computePinnedStatusText(key) {
         return null;
     let agentLabel = null;
     let model = null;
-    let effort = null;
+    let effortView = null;
     let isActive = false;
     const agent = state.getAgent(key);
     if (agent?.name) {
@@ -2255,7 +2356,7 @@ function computePinnedStatusText(key) {
             agentLabel = adapter.label;
             isActive = adapter.checkIsActive(key);
             model = adapter.getCurrentModel?.(key) ?? agent.model ?? null;
-            effort = adapter.getEffort?.(key) ?? null;
+            effortView = (0, effortLevels_1.getThreadEffortView)(adapter, key);
         }
         catch {
             // Unknown adapter name from a stale binding — fall back to raw name
@@ -2264,7 +2365,7 @@ function computePinnedStatusText(key) {
             model = agent.model ?? null;
         }
     }
-    return (0, pinnedStatus_1.formatPinnedStatus)({ binding, agentLabel, model, effort, isActive });
+    return (0, pinnedStatus_1.formatPinnedStatus)({ binding, agentLabel, model, effort: effortView?.level ?? null, effortNextStart: effortView?.nextStartLevel ?? null, isActive });
 }
 /**
  * @description Send-or-edit the pinned status banner for a thread.
@@ -3258,27 +3359,71 @@ const FILE_DOWNLOAD_CAP_MB = Math.floor(fileIntake_1.telegramFileDownloadCapByte
  */
 const ALBUM_DEBOUNCE_MS = 2_000;
 /**
- * @description Transcribe a downloaded voice note for thread `key`. Transient
- * provider failures (timeout / network error / 408 / 409 / 5xx / 429) are
- * retried inside `transcribeAudio`; before each retry the topic gets a short
- * notice naming the error and the pause, so the user knows the voice note
- * isn't lost. The notice is UNPACED like the transcript echo it precedes:
- * queued behind agent output it could land after the retry already succeeded.
- */
-async function transcribeVoiceFile(key, filePath) {
-    const endpoint = (0, transcribeAudio_1.getTranscriptionEndpoint)({ groqApiKey: ENV.groqApiKey, openaiApiKey: ENV.openaiApiKey });
-    if (!endpoint)
-        return { ok: false, error: 'no api key configured' };
-    const result = await (0, transcribeAudio_1.transcribeAudio)(filePath, endpoint, {
-        timeoutMs: DOWNLOAD_TIMEOUT_MS,
+ * The local speech engine's process (started on demand, adopted across hot reloads, stopped with its owner),
+ * the voice settings resolved against it, and the install job that fetches the engine. See `src/stt/README.md`.
+ */
+const sttOwner = (0, sttSidecarOwner_1.createSttSidecarOwner)((0, sttSidecarOwner_1.createDefaultSttSidecarOwnerDeps)(state_1.resolveDataDir));
+const sttInstallJobs = (0, sttAutoInstall_1.createSttInstallJobManager)((0, sttAutoInstall_1.createDefaultSttInstallJobDeps)(state_1.resolveDataDir));
+const sttRuntime = (0, sttRuntime_1.createSttRuntime)({
+    getDataDir: state_1.resolveDataDir,
+    getConfigPath: () => (0, sttSettings_1.getSttConfigPath)(),
+    owner: sttOwner,
+    getOwnerContext: () => (0, sttSidecarOwner_1.resolveSttOwnerContext)(),
+    logInfo: (line) => console.log(line),
+    logProblem: (line) => console.warn(line),
+    // A hand edit (or a save) that names the local engine before it is installed: fetch it by itself.
+    onNeedsAutoInstall: () => { void startSttAutoInstall(); },
+});
+/**
+ * @description The speech-engine chain in effect NOW: `stt.json` is re-read when its stamp changes (a hand edit
+ * or a `/stt` save applies to the next voice, no restart), and a change in what is wrong with it is logged once
+ * as `[STT] …`.
+ */
+function getResolvedSttSettings() {
+    return sttRuntime.getResolved();
+}
+/**
+ * @description The local engine at boot, after the state is loaded: NO process is started (the first voice that
+ * needs it does that); a stale record of a dead or foreign sidecar is cleaned; an install a reload interrupted
+ * is picked up (or settled, when it ended while the bot was down); and a `stt.json` that names the engine before
+ * it is installed starts the install.
+ */
+async function bootSttLocalEngine() {
+    await sttOwner.cleanupAtBoot();
+    await resumeSttInstallAtBoot();
+}
+/**
+ * @description Transcribe a downloaded voice note for thread `key` through the
+ * engine chain. A failing engine falls through to the next one at once (logged
+ * only); the LAST engine retries transient failures, and before each retry the
+ * topic gets a short notice naming the error and the pause, so the user knows
+ * the voice note isn't lost. The notice is UNPACED like the transcript echo it
+ * precedes: queued behind agent output it could land after the retry already
+ * succeeded.
+ */
+async function transcribeVoiceFile(key, filePath, durationSeconds) {
+    const { engines, settings } = getResolvedSttSettings();
+    if (engines.length === 0)
+        return { ok: false, error: 'no speech engine available' };
+    const startedAtMs = Date.now();
+    const result = await (0, transcribeChain_1.transcribeWithEngines)(filePath, engines, {
+        durationSeconds,
+        language: settings.language,
+        onFallback: ({ from, to, error }) => {
+            console.warn(`[transcribe] ${from} failed (${error}); falling back to ${to}`);
+        },
         onRetry: ({ attemptNumber, error, delayMs }) => {
             console.warn(`[transcribe] attempt ${attemptNumber} failed (${error}); retrying in ${delayMs}ms`);
             const seconds = Math.round(delayMs / 1000);
             void replyToThread(key, (0, i18n_1.t)('voice.retrying', { error, seconds }), {}, { unpaced: true }).catch(() => { });
         },
     });
-    if (!result.ok)
+    if (result.ok) {
+        console.log(`[transcribe] ok via ${result.engine} in ${Date.now() - startedAtMs}ms (${durationSeconds}s audio)`);
+    }
+    else {
         console.warn(`[transcribe] failed: ${result.error}`);
+    }
     return result;
 }
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -3533,32 +3678,22 @@ async function switchThreadAdapter(key, newName) {
     // with "now" afterwards, so carrying it here can't wrongly age a new session.
     if (agent.startedAt !== undefined)
         next.startedAt = agent.startedAt;
-    // Both Claude backends share the on-disk transcript, so keep the session id
-    // when switching between tmux-scrape and json-stream — the new backend resumes
-    // the SAME conversation (`/claude_mode` live switch).
-    if ((0, createAdapter_1.checkIsClaudeBackend)(newName) && agent.claudeSessionId)
-        next.claudeSessionId = agent.claudeSessionId;
-    if (newName === adapterNames_1.openCodeAdapterName && agent.opencodeSessionId)
-        next.opencodeSessionId = agent.opencodeSessionId;
-    // The id of the family the thread LEAVES is parked, and the parked id of the family it RETURNS to is
-    // restored (`state.parkedSessions`): a cross-backend fallback switch — or a plain /claude ↔ /opencode — can
-    // come back to the conversation it left (L-D4: a sleeping conversation is woken, `/new` is the fresh start).
-    // The reattach loop never reads the parked slot, so the audit S12 bug (both ids on the live row) stays fixed.
-    const parked = state.getParkedSession(key);
-    const parkedAt = new Date().toISOString();
-    if (prevName && (0, createAdapter_1.checkIsClaudeBackend)(prevName) && !(0, createAdapter_1.checkIsClaudeBackend)(newName) && agent.claudeSessionId) {
-        await state.setParkedSession(key, { adapterName: prevName, claudeSessionId: agent.claudeSessionId, parkedAt });
-    }
-    else if (prevName === adapterNames_1.openCodeAdapterName && newName !== adapterNames_1.openCodeAdapterName && agent.opencodeSessionId) {
-        await state.setParkedSession(key, { adapterName: prevName, opencodeSessionId: agent.opencodeSessionId, parkedAt });
-    }
-    else if (parked && (0, createAdapter_1.checkIsClaudeBackend)(newName) && !next.claudeSessionId && parked.claudeSessionId) {
-        next.claudeSessionId = parked.claudeSessionId;
-        await state.setParkedSession(key, null);
-    }
-    else if (parked && newName === adapterNames_1.openCodeAdapterName && !next.opencodeSessionId && parked.opencodeSessionId) {
-        next.opencodeSessionId = parked.opencodeSessionId;
-        await state.setParkedSession(key, null);
+    // The ids the new family keeps, and the parked slot: the family the thread LEAVES is parked and the parked id of the
+    // family it RETURNS to is restored, in the same step (`utils/adapterSwitchSessionIds.ts`) — a cross-backend
+    // fallback switch or a plain /claude ↔ /opencode comes back to the conversation it left
+    // (L-D4: a sleeping conversation is woken, `/new` is the fresh start). The reattach loop never reads the parked
+    // slot, so the audit S12 bug (both ids on the live row) stays fixed.
+    const switched = (0, adapterSwitchSessionIds_1.getAdapterSwitchSessionIds)({ previousName: prevName, nextName: newName, agent, parked: state.getParkedSession(key), parkedAt: new Date().toISOString() });
+    if (switched.ids.claudeSessionId)
+        next.claudeSessionId = switched.ids.claudeSessionId;
+    if (switched.ids.opencodeSessionId)
+        next.opencodeSessionId = switched.ids.opencodeSessionId;
+    if (switched.parked !== undefined)
+        await state.setParkedSession(key, switched.parked);
+    // The watermark is scoped to its session: it rides along while that session is kept. Every wake of a sleeping
+    // conversation passes through here, and the wake reads it as the proof the conversation took a turn.
+    if (agent.seenWatermark && [next.claudeSessionId, next.opencodeSessionId].includes(agent.seenWatermark.sessionId)) {
+        next.seenWatermark = agent.seenWatermark;
     }
     // Overwrite by removing the row first; setAgent then writes only the
     // fields we kept.
@@ -3766,7 +3901,7 @@ async function startAgentSession(key, args) {
         // async transcript/HTTP read and must not be added to the start path. The
         // agent row was just written by `persistAdapterSessionIds`, so the persisted
         // fallback is populated by now.
-        const effort = adapter.getEffort ? (adapter.getEffort(key) ?? effortLevels_1.defaultEffortLevel) : null;
+        const effort = (0, effortLevels_1.getThreadEffortView)(adapter, key)?.level ?? null;
         const model = (0, threadStatusReport_1.getThreadStatusModel)({
             adapterModel: adapter.getCurrentModel?.(key) ?? null,
             runtimeModel: null,
@@ -3780,12 +3915,19 @@ async function startAgentSession(key, args) {
         // self-greeting start armed the sustained loader, and no output is coming.
         startupPromptBuffer.discardPrompts(kStr);
         getOutboundFor(key).setActivity(key, 'idle');
-        return (0, i18n_1.t)('agent.start_failed', {
-            label: adapter.label,
-            error: e instanceof Error ? e.message : String(e),
-        });
+        return getAgentStartFailureText(adapter.label, e, (error) => (0, i18n_1.t)('agent.start_failed', { label: adapter.label, error }));
     }
 }
+/**
+ * @description The topic's text for a session start or resume that threw: a backend whose server could not be
+ * brought up gets one localized line (its cause is already in the log, and means nothing to the reader); any other
+ * failure keeps its own text, rendered by `formatError`.
+ */
+function getAgentStartFailureText(adapterLabel, error, formatError) {
+    if (error instanceof backendUnavailableError_1.AgentBackendUnavailableError)
+        return (0, i18n_1.t)('agent.serverUnavailableNotice', { label: adapterLabel });
+    return formatError(error instanceof Error ? error.message : String(error));
+}
 /**
  * @description Ensure the thread `key` has an agent session ready to take a
  * prompt, starting one if needed — the single choke point shared by the
@@ -3857,9 +3999,14 @@ async function ensureAgentSessionNow(key, options) {
             return { ok: false, reason: 'nothing-to-resume', message: (0, i18n_1.t)('agent.no_session') };
         case 'resume': {
             await switchThreadAdapter(key, plan.adapterName);
-            if (await resumeSleepingSession(key, plan.sessionId))
+            const resumeFailure = await resumeSleepingSession(key, plan.sessionId);
+            if (resumeFailure === null)
                 return { ok: true, message: '', isFresh: false };
-            if ((0, ensureSessionPlan_1.getResumeFailureAction)(options.isResumeOnly === true) === 'fail') {
+            const failureAction = (0, ensureSessionPlan_1.getResumeFailureAction)(resumeFailure, options.isResumeOnly === true);
+            if (failureAction === 'reportUnavailable') {
+                return { ok: false, reason: 'start-failed', message: (0, i18n_1.t)('agent.serverUnavailableNotice', { label: (0, createAdapter_1.getThreadAdapter)(key).label }) };
+            }
+            if (failureAction === 'fail') {
                 return { ok: false, reason: 'resume-failed', message: (0, i18n_1.t)('agent.resume_failed_fresh') };
             }
             // The previous conversation is lost to this topic: say so in one line, then start fresh.
@@ -3896,29 +4043,32 @@ function getResumableSessionId(key) {
  * a message typed meanwhile is buffered and replayed, like a fresh start. The
  * conversation keeps its compaction latch, its thread-context marker and its
  * start time: nothing about it changed, only the process is back. Resolves
- * `false` when the backend refused the id or the process did not come up — the
- * caller decides between a fresh start and giving up.
+ * `null` once resumed, else how it failed — the backend refused the id or the
+ * process did not come up, or the backend's server could not be brought up; the
+ * caller decides what follows ({@link getResumeFailureAction}).
  */
 async function resumeSleepingSession(key, sessionId) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     const workDirDecision = getWorkDirStartDecision(key);
     if (!workDirDecision.ok)
-        return false;
+        return 'refused';
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     startupPromptBuffer.markStarting(kStr);
     markNeedsNewMessage(key);
     try {
-        await adapter.resumeSession(key, workDirDecision.workDir, sessionId);
+        // A conversation the bot saw take a turn whose transcript is now missing is lost, not new: the resume fails.
+        const isConversationRecorded = (0, ensureSessionPlan_1.checkIsConversationRecorded)(state.getAgent(key)?.seenWatermark, sessionId);
+        await adapter.resumeSession(key, workDirDecision.workDir, sessionId, { isConversationRecorded });
         await persistSessionStart(key, adapter);
         console.log(`[ensure] resumed the sleeping session of ${kStr}`);
         void replayBufferedPrompts(key);
-        return adapter.checkIsActive(key);
+        return adapter.checkIsActive(key) ? null : 'refused';
     }
     catch (e) {
         console.warn(`[ensure] could not resume the sleeping session of ${kStr}:`, e instanceof Error ? e.message : e);
         // A fresh start (if the caller takes one) re-opens its own window; otherwise the held prompts have nowhere to go.
         startupPromptBuffer.discardPrompts(kStr);
-        return false;
+        return e instanceof backendUnavailableError_1.AgentBackendUnavailableError ? 'backendUnavailable' : 'refused';
     }
 }
 /**
@@ -4359,6 +4509,7 @@ async function exitPendingInputModes(key, messageText) {
     if (hadPendingProviderConnect && !(0, recvPreviewRedaction_1.checkIsConnectCommandText)(messageText)) {
         await replyToThread(key, (0, i18n_1.t)('connect.cancelled'));
     }
+    await cancelSttInput(key);
     await cancelReminderWizard(key);
 }
 /**
@@ -4470,19 +4621,19 @@ command('status', async (_ctx, key) => {
     }
     // Model / effort / start date are session properties — only meaningful while
     // a session is live. Effort resolves exactly like the pinned banner
-    // (`computePinnedStatusText`), plus a fallback to the default the agent
-    // actually runs when none is picked. Model resolution is DELIBERATELY wider
+    // (`computePinnedStatusText`) and the ready notice: the level the running session
+    // uses, with the next start's level when it differs (`getThreadEffortView`). Model resolution is DELIBERATELY wider
     // than the banner's: it adds the runtime's self-reported model, which the
     // banner cannot share because `computePinnedStatusText` is synchronous while
     // reading runtime info is an async transcript/HTTP read. So on the Claude tmux
     // backend `/status` can name a model the banner still leaves blank.
     let model = null;
-    let effort = null;
+    let effortView = null;
     let startedAt = null;
     let runtime = null;
     if (isActive) {
         const agent = state.getAgent(key);
-        effort = adapter.getEffort ? (adapter.getEffort(key) ?? effortLevels_1.defaultEffortLevel) : null;
+        effortView = (0, effortLevels_1.getThreadEffortView)(adapter, key);
         startedAt = agent?.startedAt ?? null;
         if (adapter.getRuntimeInfo) {
             runtime = await adapter.getRuntimeInfo(key).catch((error) => {
@@ -4509,7 +4660,7 @@ command('status', async (_ctx, key) => {
         account = { current: readStatusAccountSource(live), pending: picked === live ? null : readStatusAccountSource(picked), nowMs };
     }
     await replyToThread(key, (0, threadStatusReport_1.getThreadStatusReport)({
-        agentLine, subdir, isActive, isSleeping: !isActive && getResumableSessionId(key) !== null, workDir, model, effort, startedAt, runtime, account,
+        agentLine, subdir, isActive, isSleeping: !isActive && getResumableSessionId(key) !== null, workDir, model, effort: effortView?.level ?? null, effortNextStart: effortView?.nextStartLevel ?? null, startedAt, runtime, account,
         view: (0, displayModes_1.formatTopicView)(state.getDisplayPrefs(key).view),
         timezone,
         timezoneNow: (0, timezone_1.formatZoneNow)(timezone, nowMs),
@@ -5441,6 +5592,10 @@ async function handleAgentStart(key, adapterName, args) {
     // json-stream); open the thread's picked backend, default tmux-scrape (for now).
     if (adapterName === 'claude')
         adapterName = (0, createAdapter_1.resolveClaudeBackendName)(key);
+    // The other backend, with a conversation to hand over: ask first; the answer makes the switch.
+    const targetFamily = (0, backendSwitchPlan_1.getBackendFamily)(adapterName);
+    if (targetFamily !== null && await askBeforeCrossBackendSwitch(key, targetFamily, args))
+        return;
     await switchThreadAdapter(key, adapterName);
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     if (adapter.checkIsActive(key)) {
@@ -5462,7 +5617,7 @@ async function handleAgentStart(key, adapterName, args) {
 function handleStartCommand(parsed, key, adapterName) {
     return handleAgentStart(key, adapterName, parsed.argsText || undefined);
 }
-const { showConnectMethodPicker, applyProviderDisconnect, handleProviderConnectKey, applyNumberedModelPick, registerProviderCommands, registerModelCommands, registerModelCallbacks, } = (0, modelProviders_1.createModelProviders)({
+const { showConnectMethodPicker, applyProviderDisconnect, handleProviderConnectKey, applyNumberedModelPick, applyModelSelection, registerProviderCommands, registerModelCommands, registerModelCallbacks, } = (0, modelProviders_1.createModelProviders)({
     ...botCore,
     awaitingModelSelection,
     awaitingSessionSelection,
@@ -5472,6 +5627,7 @@ const { showConnectMethodPicker, applyProviderDisconnect, handleProviderConnectK
     connectMethodLists,
     disconnectProviderLists,
     startOpenCodeOAuthLogin,
+    getInstanceSettingsPath: () => (0, instanceSettings_1.getInstanceSettingsPath)(),
 });
 command('claude', (_ctx, key, parsed) => handleStartCommand(parsed, key, 'claude'));
 command(['opencode', 'oc'], (_ctx, key, parsed) => handleStartCommand(parsed, key, 'opencode'));
@@ -5593,7 +5749,7 @@ command('rename_session', async (_ctx, key, parsed) => {
 });
 const { applyAutoContinueLimits, consumeAutoContinueLimitsPicker, registerAutoContinueLimitsCommands, registerAutoContinueLimitsCallbacks, } = (0, autoContinueLimits_1.createAutoContinueLimits)({
     ...botCore,
-    openLimitsView: (key) => openLimitsView(key),
+    openAutoSwitchView: (key) => openAutoSwitchView(key),
     getArmedLimitRetryFireAt,
     cancelApiRetry,
     getRequestWakeUpEngine: () => requestWakeUpEngine,
@@ -5671,6 +5827,12 @@ async function applyClaudeProfileEverywhere() {
         }
     }
 }
+/** The OpenCode providers' usage (`utils/openCodeUsage.ts`): polled with the Claude profiles below, cached in `state.json`. */
+const openCodeUsagePoller = (0, openCodeUsage_1.createOpenCodeUsagePoller)({
+    readCredentials: () => (0, openCodeUsage_1.readOpenCodeCredentials)((0, openCodeAuthLogin_1.getOpenCodeAuthFilePath)({ XDG_DATA_HOME: process.env.XDG_DATA_HOME, HOME: os.homedir() })),
+    getRecord: (providerId) => state.getOpenCodeProviderUsage(providerId),
+    saveRecord: (providerId, record) => state.setOpenCodeProviderUsage(providerId, record),
+});
 /**
  * The per-profile usage cache (`utils/claudeUsageRefresher.ts`): every signed-in profile's windows off the
  * OAuth usage endpoint on a 10-minute timer, on `/account` open and on a `claude_profiles` call, plus the
@@ -5687,6 +5849,7 @@ const claudeUsageRefresher = (0, claudeUsageRefresher_1.createClaudeUsageRefresh
     saveSnapshot: (name, snapshot) => state.setClaudeProfileUsage(name, snapshot),
     readToken: (configDir) => (0, claudeUsage_1.readClaudeOAuthToken)(configDir),
     fetchUsage: (accessToken) => (0, claudeUsage_1.fetchClaudeUsage)(accessToken),
+    refreshOpenCode: (options) => openCodeUsagePoller.refreshAll(options),
 });
 /** The profile that owns a config directory (`null` = default); `null` for a directory outside the profiles root. */
 function resolveClaudeProfileNameForDir(configDir) {
@@ -5773,17 +5936,17 @@ function resolveLiveClaudeProfileName(key) {
     return state.resolveClaudeProfileName(key);
 }
 /**
- * @description An `/account` pick on a topic: the plain apply, except while a usage-limit wait is armed and the
- * pick moves the topic off the profile its process runs on. The process cannot work on the limited account, so
- * the pick is applied NOW and the topic resumes like after a limit switch (wait cancelled, continue nudge).
+ * @description Apply the account a Claude topic now resolves to (the follow-the-default tap): the plain apply, except
+ * while a usage-limit wait is armed and the account differs from the one the process runs — then it is the same limit
+ * move an operator's pick makes ({@link switchTopicByOperator}): applied NOW, the topic resumes like after a limit switch.
  */
 async function applyClaudePickToThread(key) {
-    const armed = getArmedApiRetry(key);
-    if (armed?.kind === 'usageLimit' && checkIsClaudeProfileBackend(key)) {
+    if (checkIsClaudeProfileBackend(key)) {
         const from = getTopicFallbackPosition(key);
-        const to = state.resolveClaudeProfileName(key);
-        if (from !== null && from.backend === 'claude' && from.profile !== to) {
-            const { isSwitched } = await switchTopicToFallbackEntry(key, from, { backend: 'claude', profile: to, model: null }, { isAnnounced: true });
+        const to = { backend: 'claude', profile: state.resolveClaudeProfileName(key), model: null };
+        const route = (0, operatorSwitchPlan_1.decideOperatorSwitch)({ isUsageLimitWaitArmed: getArmedApiRetry(key)?.kind === 'usageLimit', from, to, currentFamily: 'claude', hasConversation: false });
+        if (route === 'limitMove') {
+            const { isSwitched } = await switchTopicToFallbackEntry(key, from, to, { isAnnounced: true });
             return isSwitched ? 'respawned' : 'deferred';
         }
     }
@@ -5879,61 +6042,75 @@ function getFallbackResetTime(from) {
         return null;
     return (0, localClock_1.formatLocalClockWithDateIfNotToday)(untilMs, Date.now());
 }
-/** The one-line «switched» notice, with the reset of the exhausted rung when known (the topic is never moved back by itself). */
-function getFallbackSwitchedNotice(from, to) {
-    const fromLabel = from ? formatFallbackEntry(from) : '?';
-    const toLabel = formatFallbackEntry(to);
-    const time = getFallbackResetTime(from);
-    const reset = time === null ? '' : (0, i18n_1.t)('fallback.switchedReset', { from: fromLabel, to: toLabel, time });
-    return (0, i18n_1.t)('fallback.switched', { from: fromLabel, to: toLabel, reset });
+/** The «switched» notice (`utils/fallbackSwitchNotice.ts`), with the reset of the exhausted rung when known. */
+function getFallbackSwitchedNotice(from, to, runningModel) {
+    return (0, fallbackSwitchNotice_1.buildFallbackSwitchedNotice)({ from, to, resetTime: getFallbackResetTime(from), runningModel });
 }
-/** Whether the topic's Claude session already runs the alias (`fable` against a reported `claude-fable-5-1`). */
-function checkThreadClaudeModelMatches(key, alias) {
-    const current = getThreadClaudeModel(key);
-    return current !== null && current.toLowerCase().includes(alias.toLowerCase());
+/**
+ * @description The model the topic's Claude session runs ACROSS a move onto `to`, for deciding whether the move
+ * pins one (`getFallbackModelToPin`). A re-spawn onto another account keeps the model, but the new process reports
+ * it only with its first frame — so it is read BEFORE the move, or the rung's alias would look "not running" and be
+ * named and pinned (an extra re-spawn) for a session that already runs it. A move from another backend starts a
+ * Claude session that runs no model yet (`null`: the rung's pin applies).
+ */
+function readRunningModelBeforeMove(key, from, to) {
+    return from?.backend === 'claude' && to.backend === 'claude' ? getThreadClaudeModel(key) : null;
 }
 /**
- * @description The context bridge for a cross-backend switch (`utils/fallbackBridge.ts`), built BEFORE the old
- * adapter is stopped: its last turns off its own transcript (an unreadable one yields a bridge without turns).
+ * @description The last `limit` turns (oldest first) of the conversation the topic's agent holds, off its own
+ * transcript. `[]` when it has none yet (no session id persisted); `null` when they cannot be read (no bound
+ * folder, an adapter without a transcript reader, a read that failed).
  */
-async function buildFallbackBridge(key, from, to) {
+async function readConversationTurns(key, limit) {
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     const decision = getWorkDirStartDecision(key);
     const sessionId = (0, ensureSessionPlan_1.getPersistedSessionIdForAdapter)(state.getAgent(key) ?? null, adapter.name, (0, createAdapter_1.checkIsClaudeBackend)(adapter.name));
-    let turns = [];
-    if (decision.ok && sessionId && adapter.getRecentTurns) {
-        try {
-            turns = await adapter.getRecentTurns(key, decision.workDir, sessionId, fallbackBridge_1.fallbackBridgeTurnLimit);
-        }
-        catch (e) {
-            console.warn(`[fallback] ${(0, sessionKey_1.keyToString)(key)}: the previous agent's turns are unreadable:`, e instanceof Error ? e.message : e);
-        }
+    if (!sessionId)
+        return [];
+    if (!decision.ok || !adapter.getRecentTurns)
+        return null;
+    try {
+        return await adapter.getRecentTurns(key, decision.workDir, sessionId, limit);
     }
-    return (0, fallbackBridge_1.buildFallbackBridgePrompt)({
-        fromLabel: from ? formatFallbackEntry(from) : (0, i18n_1.t)('fallback.backendClaude'),
-        toLabel: formatFallbackEntry(to),
-        turns,
-        resetsAtText: getFallbackResetTime(from),
-        replyLanguage: (0, i18n_1.getLocaleEndonym)((0, i18n_1.getActiveLang)()),
-    });
+    catch (e) {
+        console.warn(`[fallback] ${(0, sessionKey_1.keyToString)(key)}: the previous agent's turns are unreadable:`, e instanceof Error ? e.message : e);
+        return null;
+    }
+}
+/**
+ * @description The context bridge for a cross-backend switch (`utils/fallbackBridge.ts`), built BEFORE the old
+ * adapter is stopped: its last turns off its own transcript (an unreadable one yields a bridge without turns).
+ * `reason` is why the agent changes — a usage limit or the operator's own switch.
+ */
+async function buildFallbackBridge(key, input) {
+    const turns = await readConversationTurns(key, fallbackBridge_1.fallbackBridgeTurnLimit) ?? [];
+    return (0, fallbackBridge_1.buildFallbackBridgePrompt)({ ...input, turns, replyLanguage: (0, i18n_1.getLocaleEndonym)((0, i18n_1.getActiveLang)()) });
+}
+/** The backend the topic's agent runs on, by name (`Claude` / `OpenCode`), for a label whose rung is unknown. */
+function formatThreadBackend(key) {
+    const family = (0, backendSwitchPlan_1.getBackendFamily)((0, createAdapter_1.getThreadAdapterNameRaw)(key) ?? state.getAgent(key)?.name);
+    return family === null ? (0, i18n_1.t)('fallback.backendClaude') : (0, backendSwitchPlan_1.formatBackendFamily)(family);
 }
 /**
  * @description Move a limited topic onto rung `to` and continue the work there. WITHIN a backend the
  * conversation is kept: a Claude rung sets the topic's profile (the `/account` apply path re-spawns the live
- * session under the new directory, same transcript) and pins the rung's model when it names one; an OpenCode
- * rung changes the session's per-prompt model. ACROSS backends the topic's adapter changes (the `/claude` /
- * `/opencode` path: the old session is stopped and its id parked for a switch back), the new session is started
- * or resumed, and its first prompt is the context bridge instead of the plain "continue" nudge. Either way the
- * armed limit wait is disarmed and the prompt goes the way the wait's own resume would deliver it. A Claude
- * session that works keeps its wait: the switch applies at turn end. Returns whether the work continues now and
- * the notice that says so (posted here only when `isAnnounced` — the auto-switch has no other voice, while a
- * tapped button's notice is edited into the same line by its handler).
+ * session under the new directory, same transcript) and pins the rung's model when it names one the session is not
+ * already running; an OpenCode rung changes the session's per-prompt model. ACROSS backends the topic's adapter
+ * changes (the `/claude` / `/opencode` path: the old session is stopped and its id parked for a switch back), the
+ * new session is started or resumed, and its first prompt is the context bridge instead of the plain "continue"
+ * nudge. Either way the armed limit wait is disarmed and the prompt goes the way the wait's own resume would
+ * deliver it. After a limit the turn is dead, so a working Claude session is moved at once; only one that cannot
+ * be re-spawned yet (a tmux session with nothing to resume) keeps its wait and moves at turn end. Returns whether
+ * the work continues now and the notice that says so (posted here only when `isAnnounced` — the auto-switch has no
+ * other voice, while a tapped button's notice is edited into the same line by its handler).
  */
 async function switchTopicToFallbackEntry(key, from, to, options) {
     const k = (0, sessionKey_1.keyToString)(key);
     const fromLabel = from ? formatFallbackEntry(from) : '?';
     const toLabel = formatFallbackEntry(to);
-    const isSameFamily = from !== null && from.backend === to.backend;
+    // An OpenCode topic on the server's default model has no rung (`from` is null), yet it is on OpenCode all the same.
+    const isSameFamily = (from?.backend ?? getTopicBackendFamily(key)) === to.backend;
+    const runningModel = readRunningModelBeforeMove(key, from, to);
     const say = async (notice) => {
         if (options.isAnnounced)
             await replyToThread(key, notice);
@@ -5941,19 +6118,21 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
     const fail = async (error) => {
         const notice = (0, i18n_1.t)('fallback.switchFailed', { to: toLabel, error });
         await say(notice);
-        return { isSwitched: false, notice };
+        return { isSwitched: false, notice, isFailed: true };
     };
     let firstPrompt = null;
     let isStoppingBackground = false;
-    if (isSameFamily && to.backend === 'claude') {
-        await state.setClaudeProfileOverride(key, to.profile);
+    if (from?.backend === 'claude' && to.backend === 'claude') {
+        // The same account on another model (a pick beyond the limit's scope) is no account pick: the topic keeps following General.
+        if (from.profile !== to.profile)
+            await state.setClaudeProfileOverride(key, to.profile);
         // The turn is dead after a limit: re-spawn now, even over background work (it is stopped; the notice says so).
         const adapter = (0, createAdapter_1.getThreadAdapter)(key);
         isStoppingBackground = adapter instanceof claudeJsonStreamAdapter_1.ClaudeJsonStreamAdapter && adapter.checkHasBackgroundWork(key);
         const outcome = await applyClaudeProfileToThread(key, { isAfterLimit: true });
         if (outcome === 'deferred' || outcome === 'restartRequired') {
             fallbackSwitchOffers.delete(k);
-            const notice = (0, i18n_1.t)('fallback.switchedDeferred', { from: fromLabel, to: toLabel });
+            const notice = (0, fallbackSwitchNotice_1.buildFallbackDeferredNotice)(from, to);
             await say(notice);
             return { isSwitched: false, notice };
         }
@@ -5964,11 +6143,13 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
             return fail(error);
     }
     else {
-        const bridge = await buildFallbackBridge(key, from, to);
-        const targetName = to.backend === 'claude' ? (0, createAdapter_1.resolveClaudeBackendName)(key) : adapterNames_1.openCodeAdapterName;
-        if (to.backend === 'claude')
-            await state.setClaudeProfileOverride(key, to.profile);
-        await switchThreadAdapter(key, targetName);
+        const bridge = await buildFallbackBridge(key, {
+            fromLabel: from ? formatFallbackEntry(from) : formatThreadBackend(key),
+            toLabel: toLabel,
+            reason: 'limit',
+            resetsAtText: getFallbackResetTime(from),
+        });
+        await moveTopicToOtherBackend(key, to.backend, to.backend === 'claude' ? to.profile : null);
         if (to.backend === 'opencode') {
             const error = await (0, createAdapter_1.getThreadAdapter)(key).setModel?.(key, (0, fallbackChain_1.buildOpenCodeModelLabel)(to));
             if (error)
@@ -5977,29 +6158,223 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
         firstPrompt = { text: bridge, isRequestPrompt: false };
     }
     cancelApiRetry(key); // retires the offer too: the switch consumed it
-    const notice = `${getFallbackSwitchedNotice(from, to)}${isStoppingBackground ? ` ${(0, i18n_1.t)('fallback.backgroundStopped')}` : ''}`;
+    const notice = `${getFallbackSwitchedNotice(from, to, runningModel)}${isStoppingBackground ? `\n${(0, i18n_1.t)('fallback.backgroundStopped')}` : ''}`;
     console.log(`[fallback] ${k}: switched from ${fromLabel} to ${toLabel} after a usage limit${firstPrompt ? ' (cross-backend, bridged)' : ''}; resuming`);
     await say(notice);
-    const ensured = await ensureAgentSession(key);
-    if (!ensured.ok) {
-        await replyToThread(key, ensured.message);
-        return { isSwitched: true, notice };
-    }
+    await resumeTopicOnNewSession(key, {
+        modelToPin: (0, fallbackChain_1.getFallbackModelToPin)(to, runningModel),
+        // Read after the session is up: the open requests may have changed while it started.
+        getFirstPrompt: () => firstPrompt ?? (0, limitHeldPrompts_1.getLimitResumeMessage)({
+            continueNudge: (0, i18n_1.t)('apiRetry.continueNudge'),
+            untakenRequestPrompt: (0, requestHeader_1.joinPromptsNotTakenIn)(requestLimitWaitAnswerDeps?.ledger.listOpenRequestsOf(key) ?? []),
+        }),
+    });
+    return { isSwitched: true, notice };
+}
+/**
+ * @description The move ACROSS backends both the usage-limit switch and the operator's manual switch make, first
+ * half: record `account` as the topic's own Claude pick when one is given (the chain's rung, the operator's pick — a
+ * switch that only names the account the topic follows passes `null`), then `switchThreadAdapter` stops the old
+ * session, parks its id and brings back the target family's parked one. The context bridge is built BEFORE this, while
+ * the adapter being left still runs.
+ */
+async function moveTopicToOtherBackend(key, backend, account) {
+    if (account !== null)
+        await state.setClaudeProfileOverride(key, account);
+    await switchThreadAdapter(key, backend === 'claude' ? (0, createAdapter_1.resolveClaudeBackendName)(key) : adapterNames_1.openCodeAdapterName);
+}
+/**
+ * @description The second half, after a move (across backends or between accounts): start or resume the topic's
+ * session, pin the model the move asks for, and send it the first prompt (`getFirstPrompt`, read once the session is up;
+ * `null` sends nothing — a topic with nothing to hand over just starts, `args` being the text typed with the command).
+ * A session that cannot start posts why and sends nothing.
+ */
+async function resumeTopicOnNewSession(key, options) {
+    const k = (0, sessionKey_1.keyToString)(key);
+    const ensured = await ensureAgentSession(key, { args: options.args });
     if (ensured.message)
         await replyToThread(key, ensured.message);
-    if (to.backend === 'claude' && to.model !== null && !checkThreadClaudeModelMatches(key, to.model)) {
-        const error = await (0, createAdapter_1.getThreadAdapter)(key).setModel?.(key, to.model);
+    if (!ensured.ok)
+        return;
+    if (options.modelToPin !== null) {
+        const error = await (0, createAdapter_1.getThreadAdapter)(key).setModel?.(key, options.modelToPin);
         if (error)
-            console.warn(`[fallback] ${k}: pinning the model ${to.model} failed: ${error}`);
+            console.warn(`[fallback] ${k}: pinning the model ${options.modelToPin} failed: ${error}`);
     }
-    const prompt = firstPrompt ?? (0, limitHeldPrompts_1.getLimitResumeMessage)({
-        continueNudge: (0, i18n_1.t)('apiRetry.continueNudge'),
-        untakenRequestPrompt: (0, requestHeader_1.joinPromptsNotTakenIn)(requestLimitWaitAnswerDeps?.ledger.listOpenRequestsOf(key) ?? []),
-    });
+    const prompt = options.getFirstPrompt();
+    if (prompt === null)
+        return;
     await deliverPromptOrBuffer(key, prompt.text, startupPromptBuffer.checkIsStarting(k));
     await requestWakeUpEngine?.trackContinuationTurn(key, { isCountersReset: true, isRequestPrompt: prompt.isRequestPrompt });
-    return { isSwitched: true, notice };
 }
+// ── a MANUAL switch between the two backends (`utils/backendSwitchPlan.ts`, `commands/backendSwitch.ts`) ──
+/** The backend family the topic's agent runs on now (its in-memory pick, else the persisted one); `null` for none or a shell. */
+function getTopicBackendFamily(key) {
+    return (0, backendSwitchPlan_1.getBackendFamily)((0, createAdapter_1.getThreadAdapterNameRaw)(key) ?? state.getAgent(key)?.name);
+}
+/**
+ * Whether the topic's agent holds a conversation — running, or asleep with its session kept — with at least one turn
+ * to hand over. An agent just started and not yet spoken to has none; a transcript that cannot be read counts as
+ * one, since a needless question costs a tap and a silent switch costs the context.
+ */
+async function checkHasConversationToHandOver(key) {
+    if (getTopicBackendFamily(key) === null)
+        return false;
+    if (!(0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key) && getResumableSessionId(key) === null)
+        return false;
+    const turns = await readConversationTurns(key, 1);
+    return turns === null || turns.length > 0;
+}
+/**
+ * @description Where a manual switch to `backend` takes the topic: Claude → its account (the pick, else the
+ * default); OpenCode → the model it will run (a saved `/model` pick, else the server's default; `null` when the
+ * server cannot say). The OpenCode model is for the question only — the switch leaves it alone.
+ */
+async function resolveBackendSwitchTarget(key, backend) {
+    if (backend === 'claude')
+        return { backend: 'claude', profile: state.resolveClaudeProfileName(key), isProfilePicked: false, model: null };
+    const modelLabel = await (0, createAdapter_1.getAdapter)(adapterNames_1.openCodeAdapterName).getProspectiveModelLabel?.(key).catch(() => null);
+    return { backend: 'opencode', modelLabel: modelLabel ?? null, model: null };
+}
+/**
+ * @description The gate every MANUAL start of the other backend goes through (`/claude`, `/opencode`, the agent
+ * buttons, the natural-language "start …" phrases): when the topic runs the other backend and holds a conversation,
+ * ask first and let the answer make the switch. Returns whether it asked — the caller then stops; `false` means
+ * nothing to hand over (a fresh topic, the same backend, a shell) and the caller goes ahead as it always did.
+ * `userMessage` is the text typed with the command; the switch passes it on inside the context bridge.
+ */
+async function askBeforeCrossBackendSwitch(key, backend, userMessage) {
+    const currentFamily = getTopicBackendFamily(key);
+    if (currentFamily === null || !(0, backendSwitchPlan_1.checkNeedsBackendSwitchConfirmation)({
+        currentAdapterName: (0, createAdapter_1.getThreadAdapterNameRaw)(key) ?? state.getAgent(key)?.name,
+        targetBackend: backend,
+        hasConversation: await checkHasConversationToHandOver(key),
+    }))
+        return false;
+    await askBackendSwitch(key, { from: currentFamily, target: await resolveBackendSwitchTarget(key, backend), userMessage });
+    return true;
+}
+/**
+ * @description Move the topic onto the other backend by the operator's own choice — the cross-backend move of the
+ * usage-limit switch (`moveTopicToOtherBackend` + `resumeTopicOnNewSession`): the context bridge is built from the
+ * conversation being left, the target family's parked conversation comes back, and the bridge is the new session's
+ * first prompt. A Claude account the operator PICKED (`isProfilePicked`) becomes the topic's own pick; `/claude` leaves
+ * the topic following General. A topic with nothing to hand over (`isBridged: false`) just starts the target the way
+ * `/claude` / `/opencode` do. `userMessage` rides inside the bridge.
+ */
+async function executeBackendSwitch(key, target, options) {
+    const bridge = options.isBridged
+        ? await buildFallbackBridge(key, {
+            fromLabel: formatThreadBackend(key),
+            toLabel: (0, backendSwitchPlan_1.formatBackendSwitchBridgeLabel)(target),
+            reason: 'manual',
+            resetsAtText: null,
+            userMessage: options.userMessage,
+        })
+        : null;
+    await moveTopicToOtherBackend(key, target.backend, target.backend === 'claude' && target.isProfilePicked ? target.profile : null);
+    cancelApiRetry(key); // a wait armed for the backend just left is over
+    await resumeTopicOnNewSession(key, {
+        modelToPin: (0, backendSwitchPlan_1.getBackendSwitchModelToPin)(target),
+        getFirstPrompt: () => (bridge === null ? null : { text: bridge, isRequestPrompt: false }),
+        args: bridge === null ? options.userMessage : undefined,
+    });
+}
+/**
+ * @description Whether a pick, made while a usage-limit wait is armed, names another model of the SAME Claude account that the
+ * limit does not cover — the usage windows that model drains are all known and below 100 % (a Fable-only weekly limit does not
+ * stop `sonnet`; an exhausted session window stops every model; a model draining the same windows as the one that hit the limit
+ * is covered whatever the figures say). Such a pick lets the work continue, so it is the limit move; the
+ * figures are brought up to date first (bounded: a slow endpoint never holds the tap). Any other pick is not beyond a limit.
+ */
+async function checkIsPickBeyondLimit(from, to) {
+    if (from?.backend !== 'claude' || to.backend !== 'claude' || to.model === null || from.profile !== to.profile)
+        return false;
+    await (0, usageRefreshBudget_1.refreshUsageWithinBudget)((options) => claudeUsageRefresher.refreshAll(options));
+    return (0, claudeUsage_1.checkIsClaudeModelClearOfLimit)(state.getClaudeProfileInfo(to.profile)?.usage, from.model, to.model);
+}
+/** The rung as a manual switch's target: a picked Claude account (+ model alias), or an OpenCode model, both named in the question. */
+function buildBackendSwitchTargetOfRung(to) {
+    if (to.backend === 'claude')
+        return { backend: 'claude', profile: to.profile, isProfilePicked: true, model: to.model };
+    return { backend: 'opencode', modelLabel: (0, fallbackChain_1.buildOpenCodeModelLabel)(to), model: { providerId: to.providerId, modelId: to.modelId } };
+}
+/**
+ * @description The ONE path an operator's own pick takes — a row of `/limits` or `/accounts`, a model page,
+ * `/accounts use` (`utils/operatorSwitchPlan.ts` decides which move it is):
+ *   - a usage-limit wait is armed → the limit move (the wait is dropped and the work continues, a conversation is
+ *     handed over without the question);
+ *   - the backend the topic runs → a Claude pick changes the account (the live session is re-spawned, same
+ *     conversation) and pins the rung's model when it names one; an OpenCode pick is the `/model` apply (its reply);
+ *     a topic with no agent only records a Claude pick for its next start;
+ *   - the other backend → the hand-over question when there is a conversation, else the switch at once.
+ * The outcome tells the screen what to say; the question and the limit move's notice are already posted.
+ */
+async function switchTopicByOperator(key, to) {
+    const currentFamily = getTopicBackendFamily(key);
+    const from = getTopicFallbackPosition(key);
+    const isUsageLimitWaitArmed = getArmedApiRetry(key)?.kind === 'usageLimit';
+    const route = (0, operatorSwitchPlan_1.decideOperatorSwitch)({
+        isUsageLimitWaitArmed,
+        from,
+        to,
+        currentFamily,
+        hasConversation: currentFamily !== null && currentFamily !== to.backend && await checkHasConversationToHandOver(key),
+        isPickBeyondLimit: isUsageLimitWaitArmed && await checkIsPickBeyondLimit(from, to),
+    });
+    const target = buildBackendSwitchTargetOfRung(to);
+    const label = (0, backendSwitchPlan_1.formatBackendSwitchTarget)(target);
+    switch (route) {
+        case 'limitMove': {
+            const moved = await switchTopicToFallbackEntry(key, from, to, { isAnnounced: true });
+            if (moved.isFailed)
+                return { kind: 'refused', text: moved.notice };
+            if (to.backend === 'opencode')
+                return { kind: 'switched', text: (0, i18n_1.t)('backendSwitch.switched', { to: label }), label };
+            return { kind: 'switched', text: (0, i18n_1.t)('account.setThisTopic', { name: to.profile, apply: (0, i18n_1.t)(`account.applied.${moved.isSwitched ? 'respawned' : 'deferred'}`) }), label };
+        }
+        case 'sameFamily': {
+            if (to.backend === 'opencode') {
+                const adapter = (0, createAdapter_1.getThreadAdapter)(key);
+                const { isOk, message, setModelError } = await applyModelSelection(adapter, key, (0, fallbackChain_1.buildOpenCodeModelLabel)(to));
+                return isOk ? { kind: 'switched', text: message, label } : { kind: 'refused', text: (0, i18n_1.t)('cb.model_error', { error: setModelError ?? message }) };
+            }
+            const runningModel = readRunningModelBeforeMove(key, from, to);
+            // A model named for the account the topic already runs is a model change: it must not turn the topic's
+            // following of General into a pick of its own.
+            const isModelChangeOnly = to.model !== null && to.profile === resolveLiveClaudeProfileName(key);
+            let switchedText = '';
+            if (!isModelChangeOnly) {
+                await state.setClaudeProfileOverride(key, to.profile);
+                const outcome = await applyClaudeProfileToThread(key);
+                switchedText = (0, i18n_1.t)('account.setThisTopic', { name: to.profile, apply: (0, i18n_1.t)(`account.applied.${outcome}`) });
+            }
+            const modelToPin = (0, fallbackChain_1.getFallbackModelToPin)(to, runningModel);
+            if (modelToPin === null)
+                return { kind: 'switched', text: switchedText === '' && to.model !== null ? (0, i18n_1.t)('cb.model_set', { model: to.model }) : switchedText, label };
+            const { isOk, message, setModelError } = await applyModelSelection((0, createAdapter_1.getThreadAdapter)(key), key, modelToPin);
+            if (!isOk)
+                return { kind: 'refused', text: (0, i18n_1.t)('cb.model_error', { error: setModelError ?? message }) };
+            return { kind: 'switched', text: switchedText === '' ? message : `${switchedText}\n${message}`, label };
+        }
+        case 'askFirst': {
+            // The route asks only when the topic runs a backend to hand over from.
+            if (currentFamily === null)
+                throw new Error(`${(0, sessionKey_1.keyToString)(key)}: the hand-over question was asked for a topic that runs no agent`);
+            await askBackendSwitch(key, { from: currentFamily, target });
+            return { kind: 'asked' };
+        }
+        case 'switchNow': {
+            await executeBackendSwitch(key, target, { isBridged: false });
+            return { kind: 'switched', text: (0, i18n_1.t)('backendSwitch.switched', { to: label }), label };
+        }
+    }
+}
+const { askBackendSwitch, registerBackendSwitchCallbacks } = (0, backendSwitch_1.createBackendSwitch)({
+    ...botCore,
+    getCurrentFamily: getTopicBackendFamily,
+    performBackendSwitch: (key, target, options) => executeBackendSwitch(key, target, { isBridged: true, userMessage: options.userMessage }),
+});
 /**
  * @description A tap on a «switch to …» button of a limit notice: honoured only while the thread's open offer
  * is the button's episode and the index is inside that offer (a stale notice changes nothing). The
@@ -6018,7 +6393,7 @@ async function listClaudeProfilesForAgent(model) {
     await claudeUsageRefresher.refreshAll({ maxAgeMs: claudeUsageRefresher_1.claudeUsageOnDemandMaxAgeMs });
     return (0, claudeUsage_1.buildClaudeProfilesReport)((0, claudeUsage_1.buildClaudeProfileUsageViews)({ dataDir: (0, state_1.resolveDataDir)(), records: state.getAllClaudeProfileInfos() }), model, Date.now());
 }
-const { registerFallbackChainCommands, registerFallbackChainCallbacks, openLimitsView, applyAutoSwitch } = (0, fallbackChain_2.createFallbackChain)({
+const { registerFallbackChainCommands, registerFallbackChainCallbacks, openAutoSwitchView, runAutoSwitchCommand, applyAutoSwitch } = (0, fallbackChain_2.createFallbackChain)({
     ...botCore,
     applyAutoContinue: applyAutoContinueLimits,
     getArmedLimitRetryFireAt,
@@ -6028,7 +6403,19 @@ const { registerFallbackChainCommands, registerFallbackChainCallbacks, openLimit
     getTopicPosition: getTopicFallbackPosition,
     takeSwitchOffer: takeFallbackSwitchOffer,
 });
-const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAwaitingProfileName, cancelProfileNameCapture, submitProfileName, onClaudeProfileAuthStatus: recordClaudeProfileAuthStatus, } = (0, claudeAccounts_1.createClaudeAccounts)({
+const { registerLimitsBoardCommands, registerLimitsBoardCallbacks } = (0, limitsBoard_1.createLimitsBoard)({
+    ...botCore,
+    getInstanceTimezone: getCurrentTimezone,
+    refreshUsage: (options) => claudeUsageRefresher.refreshAll(options),
+    detectFallbackOptions,
+    getTopicPosition: getTopicFallbackPosition,
+    pickClaudeAccount: (key, isGeneral, name) => pickClaudeAccount(key, isGeneral, name),
+    switchTopicByOperator,
+    listClaudeModels: async (key) => (await (0, createAdapter_1.getThreadAdapter)(key).getAvailableModels?.()) ?? [],
+    runAutoSwitchCommand,
+    getArmedLimitRetryFireAt,
+});
+const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAwaitingProfileName, cancelProfileNameCapture, submitProfileName, pickClaudeAccount, onClaudeProfileAuthStatus: recordClaudeProfileAuthStatus, } = (0, claudeAccounts_1.createClaudeAccounts)({
     ...botCore,
     getDataDir: state_1.resolveDataDir,
     getInstanceTimezone: getCurrentTimezone,
@@ -6037,14 +6424,32 @@ const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAw
     startClaudeProfileLogin: (key, profile) => startClaudeAuthLogin(key, profile),
     applyClaudeProfile: applyClaudePickToThread,
     applyClaudeProfileEverywhere,
+    switchTopicByOperator,
     detectOpenCodeProviders: async () => (0, fallbackChain_1.listOpenCodeProviders)((await (0, createAdapter_1.getAdapter)(adapterNames_1.openCodeAdapterName).getAvailableModels?.()) ?? []),
+    listOpenCodeModels: async () => (await (0, createAdapter_1.getAdapter)(adapterNames_1.openCodeAdapterName).getAvailableModels?.()) ?? [],
+    getTopicRun: (key) => ({ family: getTopicBackendFamily(key), rung: getTopicFallbackPosition(key) }),
     disconnectOpenCodeProvider: applyProviderDisconnect,
     startOpenCodeConnect: showConnectMethodPicker,
     applyAutoSwitch,
 });
 claudeProfileAuthStatusSink = recordClaudeProfileAuthStatus;
+const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSttInstallAtBoot, getAwaitedSttStep, submitSttInput, cancelSttInput, } = (0, stt_1.createStt)({
+    ...botCore,
+    getConfigPath: () => (0, sttSettings_1.getSttConfigPath)(),
+    getDataDir: state_1.resolveDataDir,
+    getResolvedSettings: getResolvedSttSettings,
+    getOwnerContext: () => (0, sttSidecarOwner_1.resolveSttOwnerContext)(),
+    owner: sttOwner,
+    installJobs: sttInstallJobs,
+    getGeneralKey: () => {
+        const groupId = getAllowedGroupId();
+        return groupId !== null ? (0, sessionKeyCodec_1.makeTelegramKey)(groupId, threadRouting_1.GENERAL_THREAD_ID) : null;
+    },
+});
 registerClaudeAccountCommands();
 registerFallbackChainCommands();
+registerLimitsBoardCommands();
+registerSttCommands();
 registerCompactionCommands();
 /**
  * @description Build the agent-picker keyboard.
@@ -6164,7 +6569,7 @@ async function resumeSessionByIndex(key, idx, onExpired) {
         return (0, i18n_1.t)('session.resumed');
     }
     catch (e) {
-        return (0, i18n_1.t)('session.resume_failed', { error: e instanceof Error ? e.message : String(e) });
+        return getAgentStartFailureText(adapter.label, e, (error) => (0, i18n_1.t)('session.resume_failed', { error }));
     }
 }
 command(['sessions', 'resume'], (_ctx, key) => handleSessionsList(key));
@@ -6627,8 +7032,8 @@ const botCommands = new Set([
     'start', 'claude', 'opencode', 'oc', 'terminal', 'agent', 'sessions', 'resume', 'cancel', 'model', 'connect',
     'disconnect', 'stop', 'stopall', 'stop-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'output', 'clear_messages',
     'bind', 'unbind', 'where', 'ls', 'list', 'new', 'clear_session', 'whoami', 'version', 'help', 'language', 'lang',
-    'doctor', 'mcp', 'rename_session', 'compact', 'compact_on_idle', 'compact_summary', 'auto_continue_limits', 'limits', 'trace', 'timestamps', 'timezone', 'schedule', 'reminders', 'thinking', 'tool_results',
-    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback',
+    'doctor', 'mcp', 'rename_session', 'compact', 'compact_on_idle', 'compact_summary', 'auto_continue_limits', 'limits', 'limits_autoswitch', 'trace', 'timestamps', 'timezone', 'schedule', 'reminders', 'thinking', 'tool_results',
+    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech',
 ]);
 /**
  * @description The bare `/clear` is no longer bot-owned (it was renamed to
@@ -6661,6 +7066,8 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         const cmd = text.slice(1).split(' ')[0].split('@')[0].toLowerCase();
         // A slash command ends a pending «Add account» name prompt (the command itself runs normally).
         cancelProfileNameCapture(key);
+        // ... and an armed `/stt` address or key step.
+        await cancelSttInput(key);
         if (botCommands.has(cmd))
             return;
         // `/login` on a json-stream Claude thread (idle or per-turn lifecycle) has no
@@ -6710,6 +7117,12 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         await submitProfileName(key, text);
         return;
     }
+    // `/stt` asked for a server address or an API key → this message is the answer. A plausible key is deleted at
+    // once and never echoed; anything else re-arms the step. A slash command above already disarmed it.
+    if (getAwaitedSttStep(key) !== null && !text.startsWith('/')) {
+        await submitSttInput(key, text, ctx.message.message_id);
+        return;
+    }
     // Safety net: a pasted OAuth callback URL with NO flow in progress (e.g. a
     // stale one from a browser that timed out, or a re-paste after the flow ended)
     // must NOT be forwarded to the agent as a prompt — that both leaks the code
@@ -6854,6 +7267,10 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
                 await replyToThread(key, (0, i18n_1.t)('error.start_in_general'));
                 return;
             }
+            // The other backend, with a conversation to hand over: ask first (a shell is no backend to hand over to).
+            const requestedFamily = (0, backendSwitchPlan_1.getBackendFamily)(startMatch.adapterName);
+            if (requestedFamily !== null && state.getBinding(key) && await askBeforeCrossBackendSwitch(key, requestedFamily, startMatch.args))
+                return;
             // The shared `ensureAgentSession` does the bind-check + switch + start.
             // The explicit matched adapter wins (`preferredAdapterName`); the phrase's
             // trailing args ride along. On `unbound` we keep this path's own reply:
@@ -6963,8 +7380,9 @@ bot.on((0, filters_1.message)('voice'), async (ctx) => {
     // it silently, like the text handler.
     cancelApiRetry(key);
     await state.pushMessageId(key, ctx.message.message_id);
-    if (!ENV.groqApiKey && !ENV.openaiApiKey) {
-        await replyToThread(key, (0, i18n_1.t)('voice.no_api_key'));
+    const sttSettings = getResolvedSttSettings();
+    if (sttSettings.engines.length === 0) {
+        await replyToThread(key, (0, i18n_1.t)((0, sttSettings_1.getNoEngineNoticeCode)(sttSettings)));
         return;
     }
     // Offload the slow download+transcribe+forward off the telegraf update loop:
@@ -6975,13 +7393,14 @@ bot.on((0, filters_1.message)('voice'), async (ctx) => {
     // rejected job is guarded so it can never become an unhandledRejection
     // (processVoiceJob already reports its own errors via replyToThread).
     const fileId = ctx.message.voice.file_id;
+    const durationSeconds = ctx.message.voice.duration;
     const sentAtMs = ctx.message.date * 1000;
     // A Telegram REPLY on the voice note folds the quoted message into the prompt.
     // Compute it HERE (only the handler has `ctx`); the job runs later off the
     // update loop and only sees `key`/`bot`.
     const replyBlock = getReplyQuoteBlock(key, ctx.message);
     void (0, voiceQueue_1.getVoiceTranscriptionQueue)(key)
-        .run(() => processVoiceJob(key, fileId, (0, topicRequest_1.getTopicRequesterId)(ctx.from), sentAtMs, replyBlock))
+        .run(() => processVoiceJob(key, fileId, durationSeconds, (0, topicRequest_1.getTopicRequesterId)(ctx.from), sentAtMs, replyBlock))
         .catch((err) => {
         console.error('[Bot] Voice job error (already handled):', err);
     });
@@ -6999,7 +7418,7 @@ bot.on((0, filters_1.message)('voice'), async (ctx) => {
  * the voice note), plumbed here since the job no longer has `ctx`; so is
  * `requesterId`, the sender the transcript's request is filed under.
  */
-async function processVoiceJob(key, fileId, requesterId, sentAtMs, replyContext) {
+async function processVoiceJob(key, fileId, durationSeconds, requesterId, sentAtMs, replyContext) {
     try {
         // Audit S14 / #33: `getFileLink` builds the bot-token URL in one
         // place inside Telegraf instead of us materialising the token in a
@@ -7029,7 +7448,7 @@ async function processVoiceJob(key, fileId, requesterId, sentAtMs, replyContext)
             await replyToThread(key, `${(0, i18n_1.t)('voice.failed')} (${msg})`);
             return;
         }
-        const result = await transcribeVoiceFile(key, tempFile);
+        const result = await transcribeVoiceFile(key, tempFile, durationSeconds);
         fs.unlink(tempFile, () => { });
         if (!result.ok) {
             await replyToThread(key, `${(0, i18n_1.t)('voice.failed')} (${result.error})`);
@@ -7064,6 +7483,9 @@ async function processVoiceJob(key, fileId, requesterId, sentAtMs, replyContext)
                     await replyToThread(key, (0, i18n_1.t)('error.start_in_general'));
                     return;
                 }
+                const requestedFamily = (0, backendSwitchPlan_1.getBackendFamily)(startMatch.adapterName);
+                if (requestedFamily !== null && state.getBinding(key) && await askBeforeCrossBackendSwitch(key, requestedFamily, startMatch.args))
+                    return;
                 // Same choke point as the text trigger (L-D4): a sleeping conversation is
                 // woken, never replaced by a fresh start; `unbound` keeps the folder picker.
                 const result = await ensureAgentSession(key, {
@@ -7812,9 +8234,12 @@ bot.action(timezonePicker_1.zonePickCallbackRe, async (ctx) => {
 registerModelCallbacks();
 registerCompactionCallbacks();
 registerAutoContinueLimitsCallbacks();
+registerBackendSwitchCallbacks();
 registerClaudeAccountCallbacks();
 registerFallbackChainCallbacks();
-// «⏭ Skip once» in the `/auto_continue_limits` picker: drop THIS armed resume and
+registerLimitsBoardCallbacks();
+registerSttCallbacks();
+// «⏭ Skip once» on the `/limits` board and the `/limits_autoswitch` screen: drop THIS armed resume and
 // leave the on/off setting alone. The episode is identified by the `fireAt` baked
 // into the callback data, so an untouched older picker can never cancel a LATER
 // episode (pure `getArmedRetrySkipDecision`); a stale tap changes nothing and says
@@ -7858,15 +8283,25 @@ bot.action(/^reask_(\d+)$/, async (ctx) => {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.no_pending_question'));
         return;
     }
+    // The idle fire posts the re-asked question just BEFORE it stops the process, and a stopping process still reads as
+    // active: a tap inside that window (or inside a start) is buffered like a typed prompt and replayed once a session is up.
+    const isStarting = startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key));
     // The answer to a re-asked question wakes a sleeping conversation (L-D4) — the question is its own.
-    if (!(0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key) && !(await resumeSleepingSessionForPrompt(key))) {
+    if (!isStarting && !(0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key) && !(await resumeSleepingSessionForPrompt(key))) {
         await ctx.answerCbQuery((0, i18n_1.t)('agent.no_session'));
         return;
     }
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     reAskedQuestionOptions.delete((0, sessionKey_1.keyToString)(key));
-    await ctx.answerCbQuery(label);
+    // The label goes to the agent as a prompt and nothing else in the topic shows it whole (the buttons clip long
+    // labels): a label too long for the toast is posted in full, as the record of the answer that was sent.
+    await (0, callbackToast_1.answerCallbackWithWholeText)(ctx, label, (wholeLabel) => replyToThread(key, wholeLabel));
     // An answer to the agent's own question is never a request (S7), even delivered as a prompt.
+    if (isStarting) {
+        noteThreadUserActivity(key);
+        await withThreadLocale(key, () => deliverPromptOrBuffer(key, label, true));
+        return;
+    }
     await withThreadLocale(key, () => deliverActivePrompt(key, adapter, label, null));
 });
 registerReminderCallbacks();
@@ -8011,8 +8446,17 @@ bot.action(/^qa_(\d+)_(\d+)$/, async (ctx) => {
         return;
     }
     const selectedLabel = question.options[optIdx].label;
-    await applyQuestionAnswer(key, [selectedLabel]);
-    await ctx.answerCbQuery(selectedLabel);
+    const isAnswerShown = await applyQuestionAnswer(key, [selectedLabel]);
+    if (isAnswerShown) {
+        // The question message was just edited to "✅ <header>: <answer>", which carries the whole answer: the toast only
+        // confirms the tap, so a label too long for it is cut there and not posted a second time.
+        await (0, callbackToast_1.answerCallbackWithFittedText)(ctx, selectedLabel);
+    }
+    else {
+        // The message could not be edited (it is gone, or the edit failed): nothing in the topic shows the answer, so a
+        // label too long for the toast is posted in full.
+        await (0, callbackToast_1.answerCallbackWithWholeText)(ctx, selectedLabel, (wholeLabel) => replyToThread(key, wholeLabel));
+    }
 });
 /**
  * @description Buffer a free-form prompt (text OR voice) that arrived while the
@@ -8092,8 +8536,24 @@ async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyCo
     // wait (the handlers' `cancelApiRetry`) and before the forward, so its id is
     // durable by the time the agent reads it.
     const opening = await openTopicRequest(key, text, intake);
-    await forwardPromptToAgent(key, adapter, text, sentAtMs, { replyContext, requestHeader: opening.header });
-    trackTopicRequestTurn(key, opening);
+    // Routed now, not when the message arrived: the idle stop may have begun or ended during the awaits since.
+    const outcome = await (0, promptDelivery_1.deliverLatePrompt)({
+        checkIsWindowOpen: () => startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key)),
+        checkIsSessionActive: () => adapter.checkIsActive(key),
+        buffer: async () => {
+            await deliverPromptOrBuffer(key, `${opening.header}${getPromptWithThreadReplyQuote(key, text, replyContext)}`, true);
+        },
+        wake: () => resumeSleepingSessionForPrompt(key),
+        forward: () => forwardPromptToAgent(key, (0, createAdapter_1.getThreadAdapter)(key), text, sentAtMs, { replyContext, requestHeader: opening.header }),
+        reportNoSession: async () => {
+            // The prompt reaches no agent: the request it opened would only wait for a turn that never comes.
+            if (opening.requestId !== null)
+                await topicRequestLedger?.closeRequest(opening.requestId, 'cancelled');
+            await replyToThread(key, (0, i18n_1.t)('agent.no_session'));
+        },
+    });
+    if (outcome !== 'noSession')
+        trackTopicRequestTurn(key, opening);
 }
 /**
  * @description Cancel a pending OpenCode question because the user sent free-form
@@ -8149,19 +8609,18 @@ async function applyQuestionAnswer(key, answerForCurrent) {
     // the answer reads `messageId` for its ✅-edit — otherwise the edit targets
     // a message the re-post just deleted (live 2026-06-10: "message to edit not
     // found" + the next question never reached the topic).
-    await runQuestionLifecycleOp(key, () => applyQuestionAnswerInner(key, answerForCurrent));
+    return runQuestionLifecycleOp(key, () => applyQuestionAnswerInner(key, answerForCurrent));
 }
+/** Resolves to whether the topic now shows the whole answer: the answered question's message was edited to carry it. */
 async function applyQuestionAnswerInner(key, answerForCurrent) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     const pending = pendingQuestions.get(kStr);
     if (!pending)
-        return;
+        return false;
     const answeredQuestion = pending.data.questions[pending.currentIndex];
     const { nextState, action } = (0, openCodeQuestionFlow_1.recordAnswerAndAdvance)(pending, answerForCurrent);
     // Mark the answered question's message as done (the chosen answer in place).
-    if (pending.messageId !== null && answeredQuestion) {
-        await editThreadMessage(key, pending.messageId, `✅ ${answeredQuestion.header || answeredQuestion.question}: ${answerForCurrent.join(', ')}`);
-    }
+    const isAnswerShown = pending.messageId !== null && answeredQuestion !== undefined && await editThreadMessage(key, pending.messageId, `✅ ${answeredQuestion.header || answeredQuestion.question}: ${answerForCurrent.join(', ')}`);
     if (action.kind === 'submit') {
         const adapter = (0, createAdapter_1.getThreadAdapter)(key);
         clearPendingQuestion(key);
@@ -8171,12 +8630,13 @@ async function applyQuestionAnswerInner(key, answerForCurrent) {
             adapter.answerQuestion(key, action.matrix);
             markNeedsNewMessage(key);
         }
-        return;
+        return isAnswerShown;
     }
     // More questions remain: persist the advanced state, then post the next one
     // (which re-owns `messageId`). DO NOT reply to the agent yet.
     setPendingQuestion(key, nextState);
     await postPendingQuestionAt(key);
+    return isAnswerShown;
 }
 // ═══════════════════════════════════════════════════════════════════════════════
 //  Adapter event handlers (output / status / question / closed / error)
@@ -9442,6 +9902,26 @@ function handleAgentStopped(key) {
     clearThreadCompaction(key);
     updatePinnedStatus(key).catch(() => { });
 }
+/**
+ * @description `conversationLost` from the adapter: a live re-spawn (an account, model or effort change) found the
+ * conversation's transcript gone — it held turns, the stopped process left only a metadata stub — and began a NEW
+ * conversation under the same id. The agent has forgotten everything, so say so in the one line a failed resume gets
+ * (`agent.resume_failed_fresh`), and forget that the thread-context preamble was injected: the new conversation was
+ * never told it.
+ */
+function handleConversationLost(key) {
+    dropLostConversationWatermark(key);
+    clearThreadContextMarker(key);
+    replyToThread(key, (0, i18n_1.t)('agent.resume_failed_fresh')).catch(() => { });
+}
+/**
+ * @description The seen watermark measured the conversation a live re-spawn found gone; the one begun under its id
+ * has taken no turn. Kept, it would make that conversation's next wake fail as lost — a second notice for one loss
+ * (Telegram) or a second whole prompt (a tracker). Its first turn writes a new one.
+ */
+function dropLostConversationWatermark(key) {
+    state.clearSeenWatermark(key).catch((e) => console.error(`[Bot] clearSeenWatermark failed for ${(0, sessionKey_1.keyToString)(key)}:`, e));
+}
 /**
  * @description `suspended` from the adapter — the idle stop (L3): the process is
  * gone, the conversation stays. The frame cleanup of {@link handleAgentStopped}
@@ -9485,8 +9965,10 @@ exports.COMMANDS_MENU = [
     { command: 'compact', description: '🧹 Compact agent context' },
     { command: 'compact_on_idle', description: '🧹 Auto-compact after idle (toggle)' },
     { command: 'compact_summary', description: '📄 Post the compaction summary (toggle)' },
-    { command: 'accounts', description: '👤 Claude accounts and OpenCode providers (pick, add, re-login, remove, connect, disconnect)' },
-    { command: 'limits', description: '🚧 What happens when an agent hits a usage limit' },
+    { command: 'accounts', description: '👤 Claude accounts and OpenCode providers (switch, add, re-login, remove, connect, disconnect)' },
+    { command: 'limits', description: '🚧 Usage limits — switch this topic' },
+    { command: 'limits_autoswitch', description: '🔁 Automatic switching on a usage limit' },
+    { command: 'stt', description: '🎙 Voice recognition: engines, language, local engine' },
     { command: 'schedule', description: '⏰ Schedule a prompt (agent does the work)' },
     { command: 'reminders', description: '🔔 Reminders — add, list, delete (no agent)' },
     { command: 'status', description: '📊 Show status' },
@@ -9985,6 +10467,20 @@ function restorePendingQuestions() {
  * dropped (Jira plan J3b, R10): its kick would start that conversation's session
  * here, under this instance's environment and tmux server.
  */
+/**
+ * @description Put back the limit probes that fired shortly before this boot (`restoreFiredLimitProbes`,
+ * `apiRetryKick.ts`), so the same error on a probe's resume confirms its limit even when this bot reads it. MUST run
+ * BEFORE {@link reattachExistingSessions}: an adopted json-stream session replays the error it wrote meanwhile.
+ */
+function restoreFiredLimitProbesAtBoot() {
+    const restored = (0, apiRetryKick_1.restoreFiredLimitProbes)({
+        entries: apiRetryTimers,
+        now: () => Date.now(),
+        isServed: (key) => (0, connectorSet_1.checkIsServedConversation)(key, ENV.servedPlatforms),
+        dropRecord: clearSavedFiredLimitProbe,
+    }, state.getLimitProbesFired(), apiErrorRetry_1.retryRecurrenceGraceMs);
+    console.log(`[reattach] fired limit probes: restored ${restored}`);
+}
 function restoreApiRetries() {
     const restored = (0, apiRetryKick_1.restoreApiRetryTimers)({
         entries: apiRetryTimers,
@@ -9996,6 +10492,49 @@ function restoreApiRetries() {
     }, state.getApiRetries());
     console.log(`[reattach] api retries: re-armed ${restored}`);
 }
+/**
+ * @description Record a json-stream conversation's stdout log, as it is now, as a limit episode already handled
+ * (`limitEpisodesRecovered`, the stamp {@link recoverLimitEpisodesFromDisk} checks). A live wait that ends without
+ * its resume — «⏭ Skip once», a give-up, a takeover — leaves the error it waited on as the log's last terminal frame,
+ * and the next boot's recovery armed it again: only the recovery itself wrote the stamp. A later turn writes to the
+ * log and changes its identity, so a NEW parked error is still recovered.
+ */
+function markLimitEpisodeSettled(key) {
+    const agent = state.getAgent(key);
+    if (!agent || !(0, adapterNames_1.checkIsJsonStreamBackend)(agent.name))
+        return;
+    const { stdoutFile } = (0, jsonStreamHost_1.getJsonStreamSessionPaths)((0, jsonStreamHost_1.resolveJsonStreamSessionDir)(getDataDir(), key));
+    let log;
+    try {
+        const stat = fs.statSync(stdoutFile);
+        log = { sizeBytes: stat.size, mtimeMs: stat.mtimeMs };
+    }
+    catch {
+        return; // no stdout log for this thread — nothing a boot could recover
+    }
+    void state
+        .setLimitEpisodeRecovered(key, log)
+        .catch((e) => console.error('[limitRecovery] marker persist failed:', e));
+}
+/**
+ * @description When the parked `errorText` of a json-stream conversation was written, from its Claude transcript's
+ * API-error entry ({@link getParkedErrorWrittenAtMs}); `null` when the transcript tail cannot be read or holds no such
+ * entry — the recovery then goes by the stdout log's mtime.
+ */
+function readParkedErrorWrittenAtMs(key, claudeSessionId, errorText) {
+    const workDirDecision = getWorkDirStartDecision(key);
+    if (!workDirDecision.ok)
+        return null;
+    const transcriptPath = (0, claudeCliAdapter_1.getClaudeTranscriptPath)(workDirDecision.workDir, claudeSessionId);
+    try {
+        const sizeBytes = fs.statSync(transcriptPath).size;
+        const tail = (0, jsonStreamHost_1.readFileByteRange)(transcriptPath, Math.max(0, sizeBytes - limitEpisodeRecovery_1.limitEpisodeTailMaxBytes), sizeBytes);
+        return (0, limitEpisodeRecovery_1.getParkedErrorWrittenAtMs)(tail.toString('utf8'), errorText);
+    }
+    catch {
+        return null; // no transcript on disk — the mtime decides
+    }
+}
 /**
  * @description Recover a usage/session-limit episode that ENDED BEFORE this boot
  * and left no armed retry behind — the case {@link restoreApiRetries} cannot help
@@ -10008,12 +10547,13 @@ function restoreApiRetries() {
  * end of the session's append-only `stdout.jsonl`. Only the TAIL is read
  * ({@link limitEpisodeTailMaxBytes}), never the whole log. A recovered episode goes
  * through {@link handleApiError}, so the notice, the timer, the persistence and the
- * `/auto_continue_limits` gate behave exactly as for a live error — there is no second
+ * «wait for the reset» gate (`/limits_autoswitch`) behave exactly as for a live error — there is no second
  * arming path to keep in sync.
  *
  * MUST run AFTER {@link restoreApiRetries} so an already-armed thread is visible
- * and skipped. A re-armed episode whose reset time has passed needs no special
- * case: the retry plan clamps the negative delay to zero.
+ * and skipped. A re-armed episode whose reset time has passed (read against the
+ * error's own time) resumes at once: the retry plan clamps the negative delay to
+ * zero, and {@link handleApiError} announces no limit for a window that is over.
  *
  * Each arming STAMPS the log's identity (`state.json` `limitEpisodesRecovered`), so
  * an episode is recovered at most once: «⏭ Skip once», a user takeover and a
@@ -10060,6 +10600,7 @@ function recoverLimitEpisodesFromDisk() {
         }
         const decision = (0, limitEpisodeRecovery_1.decideLimitEpisodeRecovery)({
             errorText,
+            errorWrittenAtMs: errorText === null ? null : readParkedErrorWrittenAtMs(key, agent.claudeSessionId, errorText),
             log,
             handled: state.getLimitEpisodeRecovered(key),
             now,
@@ -10077,7 +10618,7 @@ function recoverLimitEpisodesFromDisk() {
         void state
             .setLimitEpisodeRecovered(key, log)
             .catch(e => console.error('[limitRecovery] marker persist failed:', e));
-        void withThreadLocale(key, () => handleApiError(key, decision.cls));
+        void withThreadLocale(key, () => handleApiError(key, decision.cls, { isRecoveredEpisode: true }));
         recovered += 1;
     }
     if (recovered > 0)
@@ -10531,7 +11072,7 @@ async function sendStartupStatus(isHotReload) {
         botRights,
         hasBinding,
         availableAgents,
-        hasGroq: !!ENV.groqApiKey,
+        hasSpeechEngine: getResolvedSttSettings().engines.length > 0,
         ownerSet,
         usedGeneralFallback: !ownerSet,
     };
@@ -10667,6 +11208,9 @@ async function startBot() {
     //     environment is left exactly as launched.
     (0, timezone_1.applyProcessTimezone)(state.getTimezone());
     console.log(`Timezone:         ${(0, timezone_1.getEffectiveTimezone)(state.getTimezone())} (host: ${(0, timezone_1.getHostTimezone)()})`);
+    // 1a''. The voice settings (`stt.json`): the old env keys move into it once,
+    //     before the first voice note or the readiness check reads the chain.
+    sttRuntime.init();
     // 1a'. The Jira connector (Jira plan J5), loaded only when CONNECTORS lists it
     //     (R20: a Telegram-only instance never loads its code). Prepared BEFORE the
     //     answer sinks (its comments are the jira sink, J6) and the session boot
@@ -10819,6 +11363,7 @@ async function startBot() {
         onSuspended: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'suspended', () => withThreadLocale(key, () => handleAgentSuspended(key))),
         onTurnEnded: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'turnEnded', () => handleAgentTurnEnded(key)),
         onContextCompacted: (key, trigger) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'contextCompacted', () => noteConversationContextReset(key, `compaction (${trigger ?? 'bot'})`)),
+        onConversationLost: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'conversationLost', () => withThreadLocale(key, () => handleConversationLost(key)), () => { dropLostConversationWatermark(key); noteConversationContextReset(key, 'its transcript was lost'); }),
         onError: (key, error) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'error', () => withThreadLocale(key, () => handleAgentError(key, error)), () => {
             console.error(`[Bot] adapter error ${(0, sessionKey_1.keyToString)(key)}:`, error.message);
         }),
@@ -10930,7 +11475,10 @@ async function startBot() {
         // A successful re-adopt is silent; `quietReattach` only suppresses the
         // reattach ERROR notice (workDir vanished) during a hot reload, surfaced on
         // a real cold start.
-        reattachSessions: () => reattachExistingSessions({ quietReattach: bootMode.isHotReload }),
+        reattachSessions: () => {
+            restoreFiredLimitProbesAtBoot();
+            return reattachExistingSessions({ quietReattach: bootMode.isHotReload });
+        },
         restoreAfterReattach: () => {
             // Re-arm pending interactive questions that survived the restart, so the
             // existing option buttons keep working. A question is restored only for a
@@ -11166,6 +11714,8 @@ async function startBot() {
             drainPendingUpdates: () => updateDispatcher.drainIdle(updateDrainTimeoutMs),
             finalizePendingOutput: () => finalizePendingOutputOnShutdown(),
             clearTransientFrames: () => sweepTransientFramesOnShutdown(),
+            // A hot worker's reload keeps the sidecar for the next worker to adopt; the supervisor stops it for good.
+            stopSidecars: (0, installManager_1.checkIsOpenCodeExternalHost)() ? undefined : () => sttOwner.stop(),
             cleanupTimers: () => {
                 clearInterval(inMemoryGcInterval);
                 clearInterval(heartbeatInterval);
@@ -11207,6 +11757,8 @@ async function startBot() {
     catch (e) {
         console.warn('[startup-status] failed:', e instanceof Error ? e.message : e);
     }
+    // The local speech engine: clean up after an earlier run, re-attach to / start its install. Starts no process.
+    void bootSttLocalEngine().catch((e) => console.warn('[STT] boot step failed:', e instanceof Error ? e.message : e));
     console.log(`Launching Telegraf bot (long polling, dropPendingUpdates=${bootMode.dropPendingUpdates})...`);
     try {
         await bot.launch({