charness 3.4.0 → 3.6.0

package/dist/bot.js

@@ -70,8 +70,11 @@ const terminalAdapter_1 = require("./adapters/terminalAdapter");
 const openCodeQuestionFlow_1 = require("./openCodeQuestionFlow");
 const pendingQuestionRepost_1 = require("./pendingQuestionRepost");
 const rateLimiter_1 = require("./rateLimiter");
+const testTimings_1 = require("./testTimings");
 const installManager_1 = require("./installManager");
 const startupReadiness_1 = require("./utils/startupReadiness");
+const doctorLine_1 = require("./utils/doctorLine");
+const nativeWindows_1 = require("./utils/nativeWindows");
 const state_1 = require("./state");
 const instanceLock_1 = require("./instanceLock");
 const shutdown_1 = require("./shutdown");
@@ -85,6 +88,7 @@ const timezoneRecompute_1 = require("./scheduler/timezoneRecompute");
 const validation_1 = require("./validation");
 const bindPicker_1 = require("./connectors/telegram/bindPicker");
 const topicCommand_1 = require("./connectors/telegram/commands/topicCommand");
+const forumTopicCreated_1 = require("./connectors/telegram/forumTopicCreated");
 const providerDisconnectPlan_1 = require("./utils/providerDisconnectPlan");
 const folderName_1 = require("./folderName");
 const threadRouting_1 = require("./threadRouting");
@@ -138,6 +142,8 @@ const backendUnavailableError_1 = require("./adapters/backendUnavailableError");
 const claudeCodeVersion_1 = require("./utils/claudeCodeVersion");
 const keyedTransitionQueue_1 = require("./utils/keyedTransitionQueue");
 const adoptedToolList_1 = require("./utils/adoptedToolList");
+const lostWork_1 = require("./utils/lostWork");
+const jsonStreamPendingWork_1 = require("./utils/jsonStreamPendingWork");
 const compactOnIdle_1 = require("./utils/compactOnIdle");
 const fileSendService_1 = require("./utils/fileSendService");
 const messageSendService_1 = require("./utils/messageSendService");
@@ -215,6 +221,8 @@ const claudeUsageRefresher_1 = require("./utils/claudeUsageRefresher");
 const openCodeUsage_1 = require("./utils/openCodeUsage");
 const usageRefreshBudget_1 = require("./utils/usageRefreshBudget");
 const claudeLimitSwitch_1 = require("./utils/claudeLimitSwitch");
+const anthropicApiKeyCheck_1 = require("./utils/anthropicApiKeyCheck");
+const claudeApiKeyHelper_1 = require("./utils/claudeApiKeyHelper");
 const fallbackSwitchNotice_1 = require("./utils/fallbackSwitchNotice");
 const adapterSwitchSessionIds_1 = require("./utils/adapterSwitchSessionIds");
 const fallbackChain_1 = require("./utils/fallbackChain");
@@ -226,6 +234,8 @@ const operatorSwitchPlan_1 = require("./utils/operatorSwitchPlan");
 const backendSwitchPlan_1 = require("./utils/backendSwitchPlan");
 const selfUpdate_1 = require("./connectors/telegram/commands/selfUpdate");
 const stt_1 = require("./connectors/telegram/commands/stt");
+const claudeApiSpend_1 = require("./utils/claudeApiSpend");
+const claudeProfileUsageLines_1 = require("./utils/claudeProfileUsageLines");
 const resolveBinary_1 = require("./utils/resolveBinary");
 // ═══════════════════════════════════════════════════════════════════════════════
 //  ENV parsing & fatal validation
@@ -315,12 +325,17 @@ function parseEnv() {
         const code = e.code ?? 'unknown';
         errors.push(`WORK_ROOT="${workRoot}" is not accessible (${code})`);
     }
+    // A test instance's timing overrides (never a setting); an unknown key or a bad value stops the boot, naming it.
+    const testTimingsParse = (0, testTimings_1.parseTestTimings)(process.env[testTimings_1.testTimingsEnvName]);
+    if (!testTimingsParse.ok)
+        errors.push(...testTimingsParse.errors);
     if (errors.length > 0) {
         for (const err of errors)
             console.error(`[startup] ${err}`);
         process.exit(1);
     }
     return {
+        testTimings: testTimingsParse.ok ? testTimingsParse.timings : {},
         botToken,
         servedPlatforms: (0, connectorSet_1.getServedPlatforms)(connectors),
         isTelegramServed,
@@ -332,6 +347,15 @@ function parseEnv() {
     };
 }
 const ENV = parseEnv();
+const testTimingsBootLine = (0, testTimings_1.formatTestTimingsBootLine)(ENV.testTimings);
+if (testTimingsBootLine !== null)
+    console.log(testTimingsBootLine);
+if (ENV.testTimings.telegramSendIntervalMs !== undefined)
+    (0, rateLimiter_1.configureGlobalSendInterval)(ENV.testTimings.telegramSendIntervalMs);
+if (ENV.testTimings.backgroundHoldMaxMs !== undefined)
+    (0, createAdapter_1.registerPendingWorkHoldMs)(ENV.testTimings.backgroundHoldMaxMs);
+/** The short retry that probes an unconfirmed usage limit (a test instance may shorten it). */
+const limitProbeDelayMs = ENV.testTimings.limitProbeDelayMs ?? apiErrorRetry_1.unconfirmedLimitProbeDelayMs;
 // The instance default effort (`/effort` in General) is `settings.json`'s `defaultEffort`, re-read when the file changes.
 (0, effortLevels_1.setInstanceDefaultEffortReader)((0, instanceSettings_1.createInstanceDefaultEffortReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line)));
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -877,6 +901,12 @@ const limitResumeNoticePinnedMessageId = new Map();
  * Cleared by {@link cancelApiRetry} (the user took over / the session went away).
  */
 const autoContinueOffNoticedThreads = new Set();
+/**
+ * @description Threads that already got the «API credits used up» notice for the CURRENT episode
+ * ({@link handleBalanceExhausted}): that flow arms no retry either, so — like the OFF notice above — a repeated frame
+ * of the same error needs its own guard. Cleared by {@link cancelApiRetry} (the user took over / the session went away).
+ */
+const balanceExhaustedNoticedThreads = new Set();
 /**
  * The OPEN «switch» offer per thread (`utils/fallbackChain.ts`): the limit episode the buttons on the notice
  * were posted for, the rung the topic was on and the candidate list the buttons index into. A tap is honoured
@@ -1142,6 +1172,11 @@ const wedgeRecoveriesInFlight = new Set();
  */
 function handleApiError(key, cls, options = {}) {
     const k = (0, sessionKey_1.keyToString)(key);
+    // A used-up API credit balance: no wait refills it — the account is marked, and the chain or the operator takes over.
+    if (cls.kind === 'usageLimit' && cls.isBalanceExhausted === true) {
+        void handleBalanceExhausted(key, cls);
+        return;
+    }
     // An unconfirmed usage limit is probed first; it reaches the wait below only once confirmed.
     if (cls.kind === 'usageLimit' && cls.isUnconfirmed === true && handleUnconfirmedLimit(key))
         return;
@@ -1236,7 +1271,7 @@ function armApiRetryTimer(key, arming) {
     // bottom (debounced; no-op when no question is pending).
     onThreadActivityWhileQuestionPending(key);
     void state
-        .setApiRetry(key, { kind: arming.kind, attempt: arming.attempt, fireAt: arming.fireAt, ...(arming.isLimitProbe ? { isLimitProbe: true } : {}) })
+        .setApiRetry(key, { kind: arming.kind, attempt: arming.attempt, fireAt: arming.fireAt, ...(arming.isLimitProbe ? { isLimitProbe: true } : {}), ...(arming.resumeOn ? { resumeOn: arming.resumeOn } : {}) })
         .catch(e => console.error('[apiRetry] persist failed:', e));
     clearSavedFiredLimitProbe(key);
     const timer = setTimeout(() => {
@@ -1252,6 +1287,7 @@ function armApiRetryTimer(key, arming) {
         fireAt: arming.fireAt,
         limitWait: arming.limitWait,
         isLimitProbe: arming.isLimitProbe,
+        resumeOn: arming.resumeOn,
     });
 }
 /**
@@ -1276,9 +1312,9 @@ function handleUnconfirmedLimit(key) {
         return false;
     }
     console.log(`[apiRetry] ${k}: an unconfirmed usage limit — probing with a short retry before waiting for the reset`);
-    void replyToThread(key, (0, i18n_1.t)('apiRetry.transientNotice', { minutes: Math.round(apiErrorRetry_1.unconfirmedLimitProbeDelayMs / apiRetryMsPerMinute), attempt: 1 }));
+    void replyToThread(key, (0, i18n_1.t)('apiRetry.transientNotice', { minutes: Math.round(limitProbeDelayMs / apiRetryMsPerMinute), attempt: 1 }));
     const now = Date.now();
-    armApiRetryTimer(key, { kind: 'transient', attempt: 1, fireAt: now + apiErrorRetry_1.unconfirmedLimitProbeDelayMs, delayMs: apiErrorRetry_1.unconfirmedLimitProbeDelayMs, isLimitProbe: true });
+    armApiRetryTimer(key, { kind: 'transient', attempt: 1, fireAt: now + limitProbeDelayMs, delayMs: limitProbeDelayMs, isLimitProbe: true });
     return true;
 }
 /**
@@ -1443,15 +1479,90 @@ async function announceUsageLimitOrSwitch(key, cls, episodeId, initialWait, atte
         }
     }
     const texts = getLimitWaitTexts(key, wait, attempt, resumeOn);
-    const keyboard = plan.action === 'offer'
-        ? telegraf_1.Markup.inlineKeyboard(plan.candidates.map((entry, index) => [
-            telegraf_1.Markup.button.callback((0, i18n_1.t)('fallback.switchButton', { label: formatFallbackEntry(entry) }), (0, fallbackChain_1.buildFallbackSwitchCallbackData)(episodeId, index)),
-        ]))
-        : undefined;
+    const keyboard = plan.action === 'offer' ? buildFallbackSwitchKeyboard(episodeId, plan.candidates) : undefined;
     const { isPlainNoticePosted } = await announceLimitWait(key, wait, texts, isPlainNoticeDue, keyboard);
     if (keyboard && !isPlainNoticePosted)
         await replyToThread(key, (0, i18n_1.t)('fallback.switchOffer'), keyboard);
 }
+/** The «🔁 Switch to …» buttons of a limit episode's notice, one per candidate (best first; the index is into that episode's list). */
+function buildFallbackSwitchKeyboard(episodeId, candidates) {
+    return telegraf_1.Markup.inlineKeyboard(candidates.map((entry, index) => [
+        telegraf_1.Markup.button.callback((0, i18n_1.t)('fallback.switchButton', { label: formatFallbackEntry(entry) }), (0, fallbackChain_1.buildFallbackSwitchCallbackData)(episodeId, index)),
+    ]));
+}
+/** Whose API credits a balance notice names: a Claude account `«console»`, an OpenCode `provider/model`. */
+function formatBalanceOwner(from) {
+    if (from === null)
+        return (0, i18n_1.t)('fallback.backendClaude');
+    return from.backend === 'claude' ? `«${from.profile}»` : (0, fallbackChain_1.buildOpenCodeModelLabel)(from);
+}
+/**
+ * @description A used-up API credit balance on `key` («Credit balance is too low», `isBalanceExhausted`): nothing resets
+ * it, so no wait for a reset is armed and no hourly retry runs. The Claude account is marked out of credits
+ * (`creditExhaustedAt`, until the operator picks it or signs it in again, or a billed turn on it goes through), the parked
+ * episode is settled (a restart does not run this again), and the fallback chain decides as for a limit, with that
+ * account out: switching ON moves the topic at once; OFF puts «switch to …» buttons on the notice. With no rung free
+ * now, the topic waits only for a rung that comes back at a KNOWN time (the earliest reset, and only with «wait for
+ * reset» on) and resumes there; otherwise the notice is all, and an open request is answered and no longer woken. A
+ * repeat of the same episode (another frame, another scrape of the line, a scheduled run into the same balance) says
+ * nothing in the topic again; a request opened since — a scheduled run's — is still answered and no longer woken, unless
+ * a wait for another rung's reset is armed.
+ */
+async function handleBalanceExhausted(key, cls) {
+    const k = (0, sessionKey_1.keyToString)(key);
+    markLimitEpisodeSettled(key);
+    const position = getTopicFallbackPosition(key);
+    if (position?.backend === 'claude')
+        state.setClaudeProfileCreditExhausted(position.profile, new Date().toISOString());
+    const notice = `${(0, i18n_1.t)('apiRetry.balanceExhaustedNotice', { name: formatBalanceOwner(position) })}${getBalanceSpentLine(position)}`;
+    const texts = { plainNotice: notice, answerBody: (0, i18n_1.t)('requests.limit.answerBalanceExhaustedNotice') };
+    const stopped = { kind: 'autoResumeOff' };
+    if (balanceExhaustedNoticedThreads.has(k)) {
+        // Like the «wait for reset» OFF repeat: without it the wake-up engine re-prods that request into the same refused
+        // balance and ends in an alert.
+        if (getArmedApiRetry(key) === null)
+            await announceLimitWait(key, stopped, texts, false);
+        return;
+    }
+    balanceExhaustedNoticedThreads.add(k);
+    const episodeId = Date.now();
+    let plan = { action: 'none', from: position, earliest: null };
+    try {
+        plan = await planFallbackSwitch(key, cls, episodeId);
+    }
+    catch (e) {
+        console.warn(`[fallback] ${k}: the switch plan after a used-up balance failed:`, e instanceof Error ? e.message : e);
+    }
+    if (plan.action === 'auto') {
+        const to = plan.to;
+        await replyToThread(key, notice);
+        const outcome = await switchTopicToFallbackEntry(key, plan.from, to, { isAnnounced: true }).catch((e) => {
+            console.warn(`[fallback] ${k}: the auto-switch to ${formatFallbackEntry(to)} failed:`, e instanceof Error ? e.message : e);
+            return { isSwitched: false };
+        });
+        // The notice is already in the topic; an open request still hears that the work stopped.
+        if (!outcome.isSwitched)
+            await announceLimitWait(key, stopped, texts, false);
+        return;
+    }
+    if (plan.action === 'offer') {
+        const keyboard = buildFallbackSwitchKeyboard(episodeId, plan.candidates);
+        const { isPlainNoticePosted } = await announceLimitWait(key, stopped, texts, true, keyboard);
+        if (!isPlainNoticePosted)
+            await replyToThread(key, (0, i18n_1.t)('fallback.switchOffer'), keyboard);
+        return;
+    }
+    if (plan.earliest && state.checkIsAutoContinueOnLimitEnabled(key)) {
+        const fireAt = plan.earliest.untilMs + apiErrorRetry_1.resetBufferMs;
+        const wait = { kind: 'afterReset', resetAt: plan.earliest.untilMs, fireAt };
+        clearLimitResumeNotice(key);
+        armApiRetryTimer(key, { kind: 'usageLimit', attempt: 1, fireAt, delayMs: Math.max(fireAt - Date.now(), 0), limitWait: wait, resumeOn: plan.earliest.entry });
+        const waitTexts = getLimitWaitTexts(key, wait, 1, plan.earliest.entry);
+        await announceLimitWait(key, wait, { plainNotice: `${notice}\n\n${waitTexts.plainNotice}`, answerBody: waitTexts.answerBody }, true);
+        return;
+    }
+    await announceLimitWait(key, stopped, texts, true);
+}
 /**
  * @description Re-aim the ARMED usage-limit wait of `key` at the rung that comes back first: the timer moves to
  * that rung's reset (+ the usual buffer), and the persisted retry record carries the rung (`resumeOn`), so the
@@ -1550,6 +1661,7 @@ function cancelApiRetry(key) {
     // error — so neither can re-notify per message.
     clearLimitResumeNotice(key);
     autoContinueOffNoticedThreads.delete(k);
+    balanceExhaustedNoticedThreads.delete(k);
     fallbackSwitchOffers.delete(k);
     // NOTE: intentionally does NOT touch the logged-out notice. `cancelApiRetry`
     // fires on EVERY inbound message (user takeover); clearing the auth notice here
@@ -1741,6 +1853,8 @@ function clearLimitResumeNotice(key) {
  * sign-in driver built here), so the driver reaches it through this late-bound slot.
  */
 let claudeProfileAuthStatusSink = null;
+/** Where an API key pasted into an API account's sign-in goes: the `/account` module too, through the same late-bound idiom. */
+let claudeProfileApiKeySink = null;
 // Out-of-band sign-in drivers (`/login`, `/connect` OAuth): `agentLogin/README.md`.
 const { cancelPendingLogin, checkIsAuthLoginAwaitingCode, cancelClaudeAuthLogin, startClaudeAuthLogin, submitClaudeAuthLoginCode, checkIsOpenCodeOAuthAwaitingReply, cancelOpenCodeOAuthLogin, startOpenCodeOAuthLogin, submitOpenCodeOAuthReply, checkIsAnyLoginInProgress, } = (0, agentLogin_1.createAgentLogin)({
     replyToThread,
@@ -1748,6 +1862,7 @@ const { cancelPendingLogin, checkIsAuthLoginAwaitingCode, cancelClaudeAuthLogin,
     clearAuthNotice,
     execFileAsync,
     onClaudeProfileAuthStatus: (key, profile, status) => claudeProfileAuthStatusSink?.(key, profile, status) ?? Promise.resolve(),
+    onClaudeProfileApiKey: (key, profile, apiKey) => claudeProfileApiKeySink?.(key, profile, apiKey) ?? Promise.resolve((0, i18n_1.t)('account.apiKeyNoDirectory', { name: profile.name })),
 });
 /**
  * @description Buffers prompts typed while an agent session is still booting so
@@ -3588,6 +3703,9 @@ async function releaseThreadSession(key) {
  * adapters can't end up polling/streaming the same thread at once — that
  * desync caused mixed output, silent `/stop`, and the "I keep getting
  * 'Login successful' on every message" bug reported 2026-05-15.
+ *
+ * Resolves the work the stop cut off that the agent's next prompt is told about (`null`: none), so a caller's line to
+ * the operator is derived from the very record the note lists.
  */
 async function switchThreadAdapter(key, newName) {
     const prevName = (0, createAdapter_1.getThreadAdapterNameRaw)(key);
@@ -3596,9 +3714,13 @@ async function switchThreadAdapter(key, newName) {
     // reminding (or, in a terminal, TYPING into) a session that never saw it.
     if (prevName && !(0, createAdapter_1.checkIsSameConversationSwitch)(prevName, newName))
         cancelConversationRequest(key);
+    let switchCutOffWork = null;
     if (prevName && prevName !== newName) {
         try {
             const prev = (0, createAdapter_1.getAdapter)(prevName);
+            // What dies with the stopped process: its own background work and the turn it was in (an explicit stop records nothing).
+            if (prev.checkIsActive(key))
+                switchCutOffWork = prev.getPendingWork?.(key) ?? null;
             if (prev.checkIsActive(key)) {
                 // `stopSession` is `void` in the AgentAdapter contract — OpenCode
                 // queues teardown behind its lifecycle lock and returns
@@ -3620,7 +3742,7 @@ async function switchThreadAdapter(key, newName) {
     (0, createAdapter_1.setThreadAdapter)(key, newName);
     const agent = state.getAgent(key);
     if (!agent)
-        return;
+        return null;
     // Wipe ids that don't belong to the new adapter. We persist via
     // setAgent (which merges), so build a fresh record with only the
     // surviving fields.
@@ -3638,13 +3760,25 @@ async function switchThreadAdapter(key, newName) {
     // fallback switch or a plain /claude ↔ /opencode comes back to the conversation it left
     // (L-D4: a sleeping conversation is woken, `/new` is the fresh start). The reattach loop never reads the parked
     // slot, so the audit S12 bug (both ids on the live row) stays fixed.
-    const switched = (0, adapterSwitchSessionIds_1.getAdapterSwitchSessionIds)({ previousName: prevName, nextName: newName, agent, parked: state.getParkedSession(key), parkedAt: new Date().toISOString() });
+    const parkedBefore = state.getParkedSession(key);
+    const switched = (0, adapterSwitchSessionIds_1.getAdapterSwitchSessionIds)({ previousName: prevName, nextName: newName, agent, parked: parkedBefore, parkedAt: new Date().toISOString() });
     if (switched.ids.claudeSessionId)
         next.claudeSessionId = switched.ids.claudeSessionId;
     if (switched.ids.opencodeSessionId)
         next.opencodeSessionId = switched.ids.opencodeSessionId;
+    // Work the switch cut off is told twice, once to each agent: the next prompt (the hand-over bridge, the next message)
+    // tells the agent the topic moves to, and the parked conversation keeps it for its own agent's first prompt back.
+    const cutOffRecord = switchCutOffWork ? { ...switchCutOffWork, reason: 'switched', lostAt: Date.now() } : null;
+    // The parked copy knows the agent the topic moves to hears it first (it may restart some of the work itself).
+    const parkedLoss = switchCutOffWork && cutOffRecord ? { ...cutOffRecord, otherAgentTold: switchCutOffWork } : null;
     if (switched.parked !== undefined)
-        await state.setParkedSession(key, switched.parked);
+        await state.setParkedSession(key, switched.parked && parkedLoss ? { ...switched.parked, lostWork: parkedLoss } : switched.parked);
+    // Back to a parked conversation (the side being left may be parked in the same step): what its agent was never told
+    // rides its first prompt.
+    if (switched.isRestored && parkedBefore?.lostWork)
+        await foldLostWorkIntoNextPrompt(key, parkedBefore.lostWork);
+    if (cutOffRecord)
+        await foldLostWorkIntoNextPrompt(key, cutOffRecord);
     // The watermark is scoped to its session: it rides along while that session is kept. Every wake of a sleeping
     // conversation passes through here, and the wake reads it as the proof the conversation took a turn.
     if (agent.seenWatermark && [next.claudeSessionId, next.opencodeSessionId].includes(agent.seenWatermark.sessionId)) {
@@ -3654,6 +3788,7 @@ async function switchThreadAdapter(key, newName) {
     // fields we kept.
     await state.removeAgent(key);
     await state.setAgent(key, next);
+    return switchCutOffWork;
 }
 /**
  * @description The post-start "ready" notice for an agent that just came up — or
@@ -3758,21 +3893,20 @@ async function persistSessionStart(key, adapter) {
     }
 }
 /**
- * @description An adopted json-stream process whose tool list is stale (L4) is
- * stopped at its next idle point: now when idle, else once it stops working —
- * polled, since the bot gets no "turn ended" event it can hang this on. The next
- * trigger resumes the conversation with the current tools. The first look waits
- * for the adopt's replay: until the tail has consumed what stdout held at the
- * adopt, the live state is the persisted one plus nothing, and a turn that ended
- * or began during the downtime would be misread.
+ * @description A per-turn json-stream process that outlived the bot (L5) is stopped as soon as it is idle — its turn
+ * (if any) ended and none of its own work is pending — the per-turn backend's after-turn stop, which the downtime
+ * swallowed. Polled, since the turn may have ended before the adopt. The first look waits for the adopt's replay:
+ * until the tail has consumed what stdout held at the adopt, the live state is the persisted one plus nothing, and a
+ * turn that ended or began during the downtime would be misread. The idle-lifecycle backend has no such stop: its
+ * adopted process, stale tool list or not, is stopped by the idle fire after the compaction.
  */
-function stopAdoptedSessionWhenIdle(key, adapter, reason) {
+function stopAdoptedPerTurnSessionWhenIdle(key, adapter) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     const tick = () => {
         if (!adapter.checkIsActive(key))
-            return; // gone meanwhile (a stop, a crash): nothing to refresh
+            return; // gone meanwhile (a stop, a crash): nothing left to stop
         if (adapter.checkIsWorking?.(key)) {
-            const timer = setTimeout(tick, adoptedToolListRefreshPollMs);
+            const timer = setTimeout(tick, adoptedPerTurnStopPollMs);
             timer.unref?.();
             return;
         }
@@ -3780,22 +3914,22 @@ function stopAdoptedSessionWhenIdle(key, adapter, reason) {
         // the suspend would decline on every poll. Stop looking: a later turn's `init` reports the version,
         // and the lifecycle's own stop (the idle timer, the per-turn `turnEnded`) takes over from there.
         if (!adapter.checkIsAutoStopSupported(key)) {
-            console.log(`[reattach] ${kStr}: the adopted process is kept (${reason}): its Claude Code version is unknown or too old for the auto-stop; its own lifecycle stop takes over once a turn reports it`);
+            console.log(`[reattach] ${kStr}: the adopted process is kept (the per-turn lifecycle): its Claude Code version is unknown or too old for the auto-stop; its own lifecycle stop takes over once a turn reports it`);
             return;
         }
-        console.log(`[reattach] ${kStr}: stopping the adopted process (${reason}); the next trigger resumes it`);
+        console.log(`[reattach] ${kStr}: stopping the adopted process (the per-turn lifecycle); the next trigger resumes it`);
         void suspendThreadSession(key)
             .then(() => {
             // The suspend declines when a turn began between the look and the transition: look again.
             if (adapter.checkIsActive(key))
-                setTimeout(tick, adoptedToolListRefreshPollMs).unref?.();
+                setTimeout(tick, adoptedPerTurnStopPollMs).unref?.();
         })
-            .catch((e) => console.warn(`[reattach] ${kStr}: the stale-tool-list stop failed:`, e instanceof Error ? e.message : e));
+            .catch((e) => console.warn(`[reattach] ${kStr}: the per-turn stop of the adopted process failed:`, e instanceof Error ? e.message : e));
     };
     void adapter.whenAdoptReplayed(key).then(tick);
 }
-/** How often an adopted, stale-tool-list process that is still working is re-checked for idleness (L4). */
-const adoptedToolListRefreshPollMs = 5000;
+/** How often an adopted per-turn process that is still working is re-checked for idleness (L5). */
+const adoptedPerTurnStopPollMs = 5000;
 async function startAgentSession(key, args) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     // The bound folder IS the agent's cwd — refuse to start without one. The
@@ -4064,6 +4198,8 @@ async function suspendThreadSession(key) {
     }
     autoStopUnsupportedLoggedKeys.delete(kStr);
     await sessionTransitions.run(kStr, async () => {
+        // Decide on what the process wrote up to now, not on the last tail poll: a background task's turn may have just begun.
+        adapter.refreshWorkingState?.(key);
         if (!adapter.checkIsActive(key) || adapter.checkIsWorking?.(key))
             return;
         startupPromptBuffer.markStarting(kStr);
@@ -4084,13 +4220,20 @@ async function suspendThreadSession(key) {
 /** Conversations already told once that their CLI is too old for the auto-stop (L-D10). */
 const autoStopUnsupportedLoggedKeys = new Set();
 /**
- * @description `turnEnded` from a json-stream adapter: in the per-turn lifecycle
- * (L5, L-D3) the process is stopped right after the turn — unless a deferred
- * compaction is armed (its drain compacts first, and that turn ends here too) or
- * the process still works (a background task, input not yet taken in). The
- * session sleeps; the next trigger resumes it with the prompt cache warm.
+ * @description `turnEnded` from a json-stream adapter. The idle countdown runs from
+ * the end of the last turn: an idle fire that found the turn still running is not
+ * rescheduled (D2), and a turn whose answer went out through `answer_request`
+ * produces no later output to re-arm it — the process would never reach its idle
+ * compaction and stop, and its pending-work hold would never be enforced. (A
+ * bot-issued compaction's own turn end is skipped by the arming's loop guard.)
+ * In the per-turn lifecycle (L5, L-D3) the process is then stopped right after
+ * the turn — unless a deferred compaction is armed (its drain compacts first,
+ * and that turn ends here too) or the process still works (a background task,
+ * input not yet taken in). The session sleeps; the next trigger resumes it with
+ * the prompt cache warm.
  */
 function handleAgentTurnEnded(key) {
+    noteThreadActivity(key);
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     if (adapter.name !== adapterNames_1.claudePerTurnAdapterName)
         return;
@@ -4194,7 +4337,10 @@ async function forwardPromptToAgent(key, adapter, text, sentAtMs, options = {})
     });
     // The request header (S7) leads the per-message body, like the reply quote and
     // unlike the once-per-change thread preamble: it names THIS message's request.
-    const body = options.requestHeader ? `${options.requestHeader}${quotedBody}` : quotedBody;
+    const messageBody = options.requestHeader ? `${options.requestHeader}${quotedBody}` : quotedBody;
+    // A loss the agent was not told about yet (`utils/lostWork.ts`) rides the first real prompt, once, ahead of it.
+    const lostWorkRecord = isReplayable && adapter.name !== 'terminal' ? state.getLostWork(key) : undefined;
+    const body = lostWorkRecord ? `${(0, lostWork_1.buildLostWorkNote)(lostWorkRecord, (0, i18n_1.getLocaleEndonym)((0, i18n_1.getActiveLang)()))}\n\n${messageBody}` : messageBody;
     // Cache the (reply-folded) prompt so a wedged OpenCode session can be recovered
     // by restarting fresh and replaying it — replaying WITH the quote is correct.
     // A genuine new prompt also opens a fresh recovery episode (clears the guard).
@@ -4246,6 +4392,9 @@ async function forwardPromptToAgent(key, adapter, text, sentAtMs, options = {})
         await adapter.detachRunningSubagents(key);
     }
     adapter.sendInput(key, promptText);
+    // Told only once the prompt carrying the note reached a live session: a forward that failed keeps it for the next.
+    if (lostWorkRecord && adapter.checkIsActive(key))
+        void state.clearLostWork(key);
     // S2 busy-onset arm: start the Claude liveness loop the moment the prompt is
     // forwarded — driven by `checkIsBusy`, not by waiting for an opportunistic
     // scrape emit that may never come during a long quiet think. The arming grace
@@ -5383,13 +5532,9 @@ bot.action('open_sessions', async (ctx) => {
     await ctx.answerCbQuery();
     await handleSessionsList(key);
 });
-function formatDoctorLine(line) {
-    if (line.status === 'ok')
-        return (0, i18n_1.t)('doctor.ok', { label: line.label });
-    if (line.status === 'warn')
-        return (0, i18n_1.t)('doctor.warn', { label: line.label, hint: line.hint ?? '' });
-    return (0, i18n_1.t)('doctor.fail', { label: line.label, hint: line.hint ?? '' });
-}
+// ═══════════════════════════════════════════════════════════════════════════════
+//  /doctor — self-diagnostics (plan §20.1)
+// ═══════════════════════════════════════════════════════════════════════════════
 async function checkCliPresent(cmd) {
     try {
         await execFileAsync(cmd, ['--version'], { timeout: 1500 });
@@ -5401,6 +5546,10 @@ async function checkCliPresent(cmd) {
 }
 async function runDoctor() {
     const lines = [];
+    // 0. Native Windows runs with limits (no tmux, no self-update restart, no hot mode, no local speech install).
+    const nativeWindowsLine = (0, nativeWindows_1.getNativeWindowsDoctorLine)(process.platform, i18n_1.t);
+    if (nativeWindowsLine)
+        lines.push(nativeWindowsLine);
     // 1. Bot admin permissions in the configured group.
     const groupId = getAllowedGroupId();
     if (groupId === null) {
@@ -5507,7 +5656,7 @@ command('doctor', async (_ctx, key) => {
     // Single big edit-in-place would be nicer, but doctor is rarely run and
     // gathering the report in series keeps it dead simple.
     const lines = await runDoctor();
-    const body = lines.map(formatDoctorLine).join('\n');
+    const body = lines.map((line) => (0, doctorLine_1.formatDoctorLine)(line, i18n_1.t)).join('\n');
     await replyToThread(key, `${(0, i18n_1.t)('doctor.header')}\n\n${body}`, { parse_mode: 'Markdown' });
 });
 function loadMcpFile(filePath) {
@@ -5668,12 +5817,14 @@ async function applyClaudeBackendSwitch(key, target) {
     const wasActive = (0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key);
     const sessionId = state.getAgent(key)?.claudeSessionId;
     // Stops the previous backend, records the pick, keeps `claudeSessionId`.
-    await switchThreadAdapter(key, target);
+    const cutOffWork = await switchThreadAdapter(key, target);
+    // The operator hears that the background work died with the stopped process; the agent hears it in its next prompt.
+    const backgroundStoppedSuffix = (0, lostWork_1.checkHasLostBackgroundWork)(cutOffWork) ? `\n${(0, i18n_1.t)('fallback.backgroundStopped')}` : '';
     if (!wasActive)
         return (0, i18n_1.t)('claudeMode.set_idle', { label });
     const decision = getWorkDirStartDecision(key);
     if (!decision.ok)
-        return decision.message;
+        return `${decision.message}${backgroundStoppedSuffix}`;
     const targetAdapter = (0, createAdapter_1.getThreadAdapter)(key);
     sendThreadTypingIndicator(key).catch(() => { });
     if (sessionId && targetAdapter.resumeSession) {
@@ -5682,14 +5833,14 @@ async function applyClaudeBackendSwitch(key, target) {
         try {
             await targetAdapter.resumeSession(key, decision.workDir, sessionId, { isWithRecentContext: true });
             await persistSessionStart(key, targetAdapter);
-            return (0, i18n_1.t)('claudeMode.switched_resumed', { label });
+            return `${(0, i18n_1.t)('claudeMode.switched_resumed', { label })}${backgroundStoppedSuffix}`;
         }
         catch (e) {
             console.error('[claude_mode] resume failed, starting fresh:', e instanceof Error ? e.message : e);
         }
     }
     const msg = await startAgentSession(key);
-    return msg || (0, i18n_1.t)('claudeMode.switched_fresh', { label });
+    return `${msg || (0, i18n_1.t)('claudeMode.switched_fresh', { label })}${backgroundStoppedSuffix}`;
 }
 command('claude_mode', async (_ctx, key, parsed) => {
     if (checkIsGeneral(key)) {
@@ -5773,14 +5924,19 @@ function resolveThreadClaudeConfigDir(key) {
     }
     return dir;
 }
-/** `claude auth status --json` under `configDir` (`null` = `~/.claude`), the subscription login only; `null` when the probe fails. */
+/**
+ * `claude auth status --json` under `configDir` (`null` = `~/.claude`) as its sessions see it: never through an
+ * `ANTHROPIC_API_KEY` of the bot's own, with the `apiKeyHelper` of a profile that holds a pasted API key; `null` when
+ * the probe fails.
+ */
 async function readClaudeAuthStatusUnder(configDir) {
     const env = { ...process.env };
     delete env.ANTHROPIC_API_KEY;
     if (configDir !== null)
         env[claudeProfiles_1.claudeConfigDirVariableName] = configDir;
     try {
-        const { stdout } = await execFileAsync((0, resolveBinary_1.resolveClaudeBinary)(), ['auth', 'status', '--json'], { timeout: claudeAuthStatusProbeTimeoutMs, env });
+        const args = [...(0, claudeApiKeyHelper_1.buildClaudeAuthProbeSettingsArgs)(configDir), 'auth', 'status', '--json'];
+        const { stdout } = await execFileAsync((0, resolveBinary_1.resolveClaudeBinary)(), args, { timeout: claudeAuthStatusProbeTimeoutMs, env });
         return (0, claudeProfiles_1.parseClaudeAuthStatus)(stdout);
     }
     catch (e) {
@@ -5843,9 +5999,12 @@ const openCodeUsagePoller = (0, openCodeUsage_1.createOpenCodeUsagePoller)({
  */
 const claudeUsageRefresher = (0, claudeUsageRefresher_1.createClaudeUsageRefresher)({
     listProfiles: () => [
-        { name: claudeProfiles_1.defaultClaudeProfileName, configDir: null, loggedIn: state.getClaudeProfileInfo(claudeProfiles_1.defaultClaudeProfileName)?.loggedIn },
+        {
+            name: claudeProfiles_1.defaultClaudeProfileName, configDir: null,
+            loggedIn: state.getClaudeProfileInfo(claudeProfiles_1.defaultClaudeProfileName)?.loggedIn, billing: state.getClaudeProfileInfo(claudeProfiles_1.defaultClaudeProfileName)?.billing,
+        },
         ...Object.entries(state.getClaudeProfileRecords()).map(([name, record]) => ({
-            name, configDir: (0, claudeProfiles_1.resolveClaudeProfileDir)((0, state_1.resolveDataDir)(), name), loggedIn: record.loggedIn,
+            name, configDir: (0, claudeProfiles_1.resolveClaudeProfileDir)((0, state_1.resolveDataDir)(), name), loggedIn: record.loggedIn, billing: record.billing,
         })),
     ],
     getSnapshot: (name) => state.getClaudeProfileInfo(name)?.usage,
@@ -5881,6 +6040,27 @@ function onClaudeRateLimitEvent(configDir, event) {
         state.setClaudeProfileLimitedUntil(name, null);
     }
 }
+/**
+ * A json-stream turn's cost (`utils/claudeApiSpend.ts`): the topic's conversation baseline moves on for EVERY account
+ * (a later API turn of the same conversation must count only itself), and the turn's spend adds to the account's only
+ * when it is billed to API credits. A billed turn that went through ends a used-up-credits mark on whatever account it
+ * ran on: the balance is back.
+ */
+function onClaudeTurnCost(key, configDir, report) {
+    const turnCostUsd = (0, claudeApiSpend_1.computeClaudeTurnCostUsd)({ previous: state.getClaudeCostBaseline(key), ...report });
+    state.setClaudeCostBaseline(key, { sessionId: report.sessionId, totalCostUsd: report.totalCostUsd });
+    const name = resolveClaudeProfileNameForDir(configDir);
+    if (name === null)
+        return;
+    const info = state.getClaudeProfileInfo(name);
+    const outcome = (0, claudeApiSpend_1.getClaudeTurnCostOutcome)({
+        billing: info?.billing ?? null, isCreditExhausted: info?.creditExhaustedAt !== undefined, isError: report.isError, turnCostUsd,
+    });
+    if (outcome.isCreditMarkCleared)
+        state.setClaudeProfileCreditExhausted(name, null);
+    if (outcome.spendUsd !== null)
+        state.setClaudeProfileApiSpend(name, (0, claudeApiSpend_1.addClaudeApiSpend)(info?.apiSpend, outcome.spendUsd, new Date().toISOString()));
+}
 /** The model a topic's Claude session runs (or last ran), for the usage ranking's choice of windows. */
 function getThreadClaudeModel(key) {
     return (0, createAdapter_1.getThreadAdapter)(key).getCurrentModel?.(key) ?? state.getAgent(key)?.model ?? null;
@@ -5888,7 +6068,10 @@ function getThreadClaudeModel(key) {
 /** What `/status` names of a Claude profile: its last probed sign-in and email, and its limit mark (none until probed). */
 function readStatusAccountSource(name) {
     const info = state.getClaudeProfileInfo(name);
-    return { name, email: info?.email ?? null, loggedIn: info?.loggedIn, limitedUntil: info?.limitedUntil ?? null };
+    return {
+        name, email: info?.email ?? null, loggedIn: info?.loggedIn, limitedUntil: info?.limitedUntil ?? null,
+        billing: info?.billing ?? null, creditExhaustedAt: info?.creditExhaustedAt ?? null, ...(info?.apiSpend ? { apiSpend: info.apiSpend } : {}),
+    };
 }
 /** Whether the topic's agent is a Claude backend (a usage limit there is a limit of its account profile). */
 function checkIsClaudeProfileBackend(key) {
@@ -5987,13 +6170,15 @@ async function planFallbackSwitch(key, cls, episodeId) {
     const nowMs = Date.now();
     const resetAtMs = cls.kind === 'usageLimit' ? cls.resetAt : undefined;
     if (from.backend === 'claude') {
-        state.setClaudeProfileLimitedUntil(from.profile, (0, claudeLimitSwitch_1.resolveClaudeLimitedUntil)({
-            resetAtMs,
-            usage: state.getClaudeProfileInfo(from.profile)?.usage,
-            existingLimitedUntil: state.getClaudeProfileInfo(from.profile)?.limitedUntil ?? null,
-            nowMs,
-            fallbackMs: apiErrorRetry_1.usageLimitDefaultMs,
-        }));
+        // A used-up balance has no reset: its own flow marks the account (`creditExhaustedAt`) instead.
+        if (cls.isBalanceExhausted !== true)
+            state.setClaudeProfileLimitedUntil(from.profile, (0, claudeLimitSwitch_1.resolveClaudeLimitedUntil)({
+                resetAtMs,
+                usage: state.getClaudeProfileInfo(from.profile)?.usage,
+                existingLimitedUntil: state.getClaudeProfileInfo(from.profile)?.limitedUntil ?? null,
+                nowMs,
+                fallbackMs: apiErrorRetry_1.usageLimitDefaultMs,
+            }));
     }
     else {
         const label = (0, fallbackChain_1.buildOpenCodeModelLabel)(from);
@@ -6023,8 +6208,11 @@ async function planFallbackSwitch(key, cls, episodeId) {
     let earliest = null;
     if (plan.action === 'none') {
         const explicit = state.getFallbackChain();
+        // Without a chain the implicit one is the signed-in SUBSCRIPTIONS: an account billed to API credits never ends a wait by itself.
         const rungs = explicit.length > 0 ? explicit : from.backend === 'claude'
-            ? detection.claudeProfiles.filter((profile) => profile.loggedIn !== false).map((profile) => ({ backend: 'claude', profile: profile.name, model: null }))
+            ? detection.claudeProfiles
+                .filter((profile) => profile.loggedIn !== false && profile.billing !== 'api')
+                .map((profile) => ({ backend: 'claude', profile: profile.name, model: null }))
             : [];
         const found = (0, fallbackChain_1.pickEarliestResetRung)({ chain: rungs, current: from, detection, nowMs: Date.now() });
         if (found && !found.isCurrent)
@@ -6045,9 +6233,23 @@ function getFallbackResetTime(from) {
         return null;
     return (0, localClock_1.formatLocalClockWithDateIfNotToday)(untilMs, Date.now());
 }
-/** The «switched» notice (`utils/fallbackSwitchNotice.ts`), with the reset of the exhausted rung when known. */
+/**
+ * The «switched» notice (`utils/fallbackSwitchNotice.ts`), with the reset of the exhausted rung when known — and, onto
+ * an account billed to API credits, the line that it costs money per request and what it has spent so far.
+ */
 function getFallbackSwitchedNotice(from, to, runningModel) {
-    return (0, fallbackSwitchNotice_1.buildFallbackSwitchedNotice)({ from, to, resetTime: getFallbackResetTime(from), runningModel });
+    const notice = (0, fallbackSwitchNotice_1.buildFallbackSwitchedNotice)({ from, to, resetTime: getFallbackResetTime(from), runningModel });
+    const info = to.backend === 'claude' ? state.getClaudeProfileInfo(to.profile) : undefined;
+    if (to.backend !== 'claude' || info?.billing !== 'api')
+        return notice;
+    return `${notice}\n${(0, i18n_1.t)('fallback.switchedToApi', { name: to.profile, spent: (0, claudeApiSpend_1.formatUsd)(info.apiSpend?.totalUsd ?? 0) })}`;
+}
+/** The spend line a «credits used up» notice ends with (what the account spent through the bot); `''` before any spend. */
+function getBalanceSpentLine(from) {
+    const spend = from?.backend === 'claude' ? state.getClaudeProfileInfo(from.profile)?.apiSpend : undefined;
+    if (!spend)
+        return '';
+    return `\n${(0, i18n_1.t)('apiRetry.balanceSpent', (0, claudeProfileUsageLines_1.formatClaudeApiSpendWords)(spend, getCurrentTimezone(), Date.now()))}`;
 }
 /**
  * @description The model the topic's Claude session runs ACROSS a move onto `to`, for deciding whether the move
@@ -6130,15 +6332,25 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
         if (from.profile !== to.profile)
             await state.setClaudeProfileOverride(key, to.profile);
         // The turn is dead after a limit: re-spawn now, even over background work (it is stopped; the notice says so).
-        const adapter = (0, createAdapter_1.getThreadAdapter)(key);
-        isStoppingBackground = adapter instanceof claudeJsonStreamAdapter_1.ClaudeJsonStreamAdapter && adapter.checkHasBackgroundWork(key);
-        const outcome = await applyClaudeProfileToThread(key, { isAfterLimit: true });
+        lostWorkFoldingKeys.add(k);
+        let outcome;
+        try {
+            outcome = await applyClaudeProfileToThread(key, { isAfterLimit: true });
+        }
+        finally {
+            lostWorkFoldingKeys.delete(k);
+        }
         if (outcome === 'deferred' || outcome === 'restartRequired') {
             fallbackSwitchOffers.delete(k);
             const notice = (0, fallbackSwitchNotice_1.buildFallbackDeferredNotice)(from, to);
             await say(notice);
             return { isSwitched: false, notice };
         }
+        // The re-spawn took the old process's background work: the notice below says so, the continue nudge tells the agent.
+        const cutOffWork = takeLostWorkOf(key);
+        isStoppingBackground = (0, lostWork_1.checkHasLostBackgroundWork)(cutOffWork);
+        if (cutOffWork)
+            await foldLostWorkIntoNextPrompt(key, { ...cutOffWork, reason: 'restarted', lostAt: Date.now() });
     }
     else if (isSameFamily && to.backend === 'opencode') {
         const error = await (0, createAdapter_1.getThreadAdapter)(key).setModel?.(key, (0, fallbackChain_1.buildOpenCodeModelLabel)(to));
@@ -6152,7 +6364,7 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
             reason: 'limit',
             resetsAtText: getFallbackResetTime(from),
         });
-        await moveTopicToOtherBackend(key, to.backend, to.backend === 'claude' ? to.profile : null);
+        isStoppingBackground = await moveTopicToOtherBackend(key, to.backend, to.backend === 'claude' ? to.profile : null);
         if (to.backend === 'opencode') {
             const error = await (0, createAdapter_1.getThreadAdapter)(key).setModel?.(key, (0, fallbackChain_1.buildOpenCodeModelLabel)(to));
             if (error)
@@ -6179,12 +6391,13 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
  * half: record `account` as the topic's own Claude pick when one is given (the chain's rung, the operator's pick — a
  * switch that only names the account the topic follows passes `null`), then `switchThreadAdapter` stops the old
  * session, parks its id and brings back the target family's parked one. The context bridge is built BEFORE this, while
- * the adapter being left still runs.
+ * the adapter being left still runs. Resolves whether the stop took background work with it — the caller tells the
+ * operator (the agent is told by the next prompt, `switchThreadAdapter`).
  */
 async function moveTopicToOtherBackend(key, backend, account) {
     if (account !== null)
         await state.setClaudeProfileOverride(key, account);
-    await switchThreadAdapter(key, backend === 'claude' ? (0, createAdapter_1.resolveClaudeBackendName)(key) : adapterNames_1.openCodeAdapterName);
+    return (0, lostWork_1.checkHasLostBackgroundWork)(await switchThreadAdapter(key, backend === 'claude' ? (0, createAdapter_1.resolveClaudeBackendName)(key) : adapterNames_1.openCodeAdapterName));
 }
 /**
  * @description The second half, after a move (across backends or between accounts): start or resume the topic's
@@ -6275,7 +6488,10 @@ async function executeBackendSwitch(key, target, options) {
             userMessage: options.userMessage,
         })
         : null;
-    await moveTopicToOtherBackend(key, target.backend, target.backend === 'claude' && target.isProfilePicked ? target.profile : null);
+    const isStoppingBackground = await moveTopicToOtherBackend(key, target.backend, target.backend === 'claude' && target.isProfilePicked ? target.profile : null);
+    // The operator hears that the background work died with the old session; its agent hears it in the first prompt.
+    if (isStoppingBackground)
+        await replyToThread(key, (0, i18n_1.t)('fallback.backgroundStopped'));
     cancelApiRetry(key); // a wait armed for the backend just left is over
     await resumeTopicOnNewSession(key, {
         modelToPin: (0, backendSwitchPlan_1.getBackendSwitchModelToPin)(target),
@@ -6314,6 +6530,10 @@ function buildBackendSwitchTargetOfRung(to) {
  * The outcome tells the screen what to say; the question and the limit move's notice are already posted.
  */
 async function switchTopicByOperator(key, to) {
+    // The operator's own pick of an account whose API credits were used up is the act that ends that mark (topped up, or
+    // trying anyway): a failing request marks it again.
+    if (to.backend === 'claude')
+        state.setClaudeProfileCreditExhausted(to.profile, null);
     const currentFamily = getTopicBackendFamily(key);
     const from = getTopicFallbackPosition(key);
     const isUsageLimitWaitArmed = getArmedApiRetry(key)?.kind === 'usageLimit';
@@ -6418,7 +6638,7 @@ const { registerLimitsBoardCommands, registerLimitsBoardCallbacks } = (0, limits
     runAutoSwitchCommand,
     getArmedLimitRetryFireAt,
 });
-const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAwaitingProfileName, cancelProfileNameCapture, submitProfileName, pickClaudeAccount, onClaudeProfileAuthStatus: recordClaudeProfileAuthStatus, } = (0, claudeAccounts_1.createClaudeAccounts)({
+const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAwaitingProfileName, cancelProfileNameCapture, submitProfileName, pickClaudeAccount, onClaudeProfileAuthStatus: recordClaudeProfileAuthStatus, onClaudeProfileApiKey: storeClaudeProfileApiKey, } = (0, claudeAccounts_1.createClaudeAccounts)({
     ...botCore,
     getDataDir: state_1.resolveDataDir,
     getInstanceTimezone: getCurrentTimezone,
@@ -6434,8 +6654,10 @@ const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAw
     disconnectOpenCodeProvider: applyProviderDisconnect,
     startOpenCodeConnect: showConnectMethodPicker,
     applyAutoSwitch,
+    verifyAnthropicApiKey: (apiKey) => (0, anthropicApiKeyCheck_1.verifyAnthropicApiKey)(apiKey),
 });
 claudeProfileAuthStatusSink = recordClaudeProfileAuthStatus;
+claudeProfileApiKeySink = storeClaudeProfileApiKey;
 const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSttInstallAtBoot, getAwaitedSttStep, checkIsAnySttInputAwaited, submitSttInput, cancelSttInput, } = (0, stt_1.createStt)({
     ...botCore,
     getConfigPath: () => (0, sttSettings_1.getSttConfigPath)(),
@@ -7147,7 +7369,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
     // `/account` «Add» asked for the new profile's name → this message is it (a bad name keeps the prompt
     // armed and says so; a slash command above already disarmed it).
     if (checkIsAwaitingProfileName(key) && !text.startsWith('/')) {
-        await submitProfileName(key, text);
+        await submitProfileName(key, text, ctx.message.message_id);
         return;
     }
     // `/topic` asked for the new topic's name, or for the name of a folder to create → this message is the answer (a bad
@@ -7928,7 +8150,11 @@ bot.on((0, filters_1.message)('forum_topic_created'), async (ctx) => {
     // attacker-chosen folder. Stash the topic name so a later authorised-user
     // message in the same thread can still benefit from fuzzy auto-bind.
     const userId = ctx.from?.id;
-    if (!userId || !(await checkIsAllowedUser(ctx))) {
+    const action = await (0, forumTopicCreated_1.getForumTopicCreatedAction)({ creatorId: userId, botUserId: bot.botInfo?.id, checkIsCreatorAllowed: () => checkIsAllowedUser(ctx) });
+    // `/topic` binds and greets the topic it created itself; its own service message needs nothing more.
+    if (action === 'ignoreOwn')
+        return;
+    if (action === 'cacheNameOnly') {
         if (topicName) {
             pendingTopicNames.set((0, sessionKey_1.keyToString)(key), { name: topicName, ts: Date.now() });
         }
@@ -8338,12 +8564,9 @@ bot.action(/^reask_(\d+)$/, async (ctx) => {
     // The label goes to the agent as a prompt and nothing else in the topic shows it whole (the buttons clip long
     // labels): a label too long for the toast is posted in full, as the record of the answer that was sent.
     await (0, callbackToast_1.answerCallbackWithWholeText)(ctx, label, (wholeLabel) => replyToThread(key, wholeLabel));
-    // An answer to the agent's own question is never a request (S7), even delivered as a prompt.
-    if (isStarting) {
-        noteThreadUserActivity(key);
-        await withThreadLocale(key, () => deliverPromptOrBuffer(key, label, true));
-        return;
-    }
+    // An answer to the agent's own question is never a request (S7), even delivered as a prompt. Routed at delivery,
+    // not on the `isStarting` read above: the stop may have ended during the toast, and a label buffered into its closed
+    // window was never replayed.
     const outcome = await withThreadLocale(key, () => deliverActivePrompt(key, adapter, label, null));
     // The label reached no session (the topic was told why): the question is still open, so are its buttons.
     if (outcome === 'noSession' && labels && !reAskedQuestionOptions.has((0, sessionKey_1.keyToString)(key)))
@@ -9852,6 +10075,8 @@ function handleQuestionGone(key) {
     void unpinThreadQuestion(key);
 }
 function handleAgentClosed(key) {
+    // What the process held that died with it (its own background work), taken before the cleanup below.
+    const lostWork = takeLostWorkOf(key);
     // Session is gone — drop any not-yet-sent output AND status frame so they
     // don't surface after the "session ended" notice (the trailing-output bug:
     // a 429 backlog could let queued deltas land seconds after the close).
@@ -9872,11 +10097,99 @@ function handleAgentClosed(key) {
     // A closed session has nothing to compact — drop the idle watchdog + any arm.
     clearThreadCompaction(key);
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
-    replyToThread(key, (0, i18n_1.t)('agent.session_ended', { label: adapter.label })).catch(() => { });
+    // Work died with the process: the lost-work line (and the resume it announces) replaces the bare "session ended".
+    if (lostWork)
+        scheduleLostWorkNote(key, lostWork, 'exited');
+    else
+        replyToThread(key, (0, i18n_1.t)('agent.session_ended', { label: adapter.label })).catch(() => { });
     // Banner now reads `idle`; closed sessions may also persist with the
     // wrong model/agent label otherwise.
     updatePinnedStatus(key).catch(() => { });
 }
+const msPerHour = 60 * 60 * 1000;
+/** The pending-work hold in force, in hours, as the topic line names it (`utils/jsonStreamPendingWork.ts`; a test instance's shorter one). */
+const pendingWorkHoldHours = Number(((ENV.testTimings.backgroundHoldMaxMs ?? jsonStreamPendingWork_1.pendingWorkHoldDefaultMs) / msPerHour).toFixed(1));
+/** What the conversation's last process took with it when it ended, handed over once by its adapter. */
+function takeLostWorkOf(key, adapter = (0, createAdapter_1.getThreadAdapter)(key)) {
+    return adapter.takeLostWork?.(key) ?? null;
+}
+/**
+ * The conversations a usage-limit switch is re-spawning right now: the re-spawn's `started` leaves the loss to the
+ * switch, which folds it into its own first prompt — decided at the call site, never by which of the two ran first.
+ */
+const lostWorkFoldingKeys = new Set();
+/**
+ * @description Keep a loss for the NEXT prompt the conversation gets, with no line and no resume of its own: a move
+ * that already says so in its notice and sends a first prompt (a limit switch's continue nudge, a backend switch's
+ * hand-over bridge, a return to a parked conversation).
+ */
+async function foldLostWorkIntoNextPrompt(key, record) {
+    console.log(`[lost-work] ${(0, sessionKey_1.keyToString)(key)}: the agent's own work ended with the process (${record.reason}); the move's first prompt tells the agent`);
+    await state.setLostWork(key, (0, lostWork_1.mergeLostWorkRecords)(state.getLostWork(key), record));
+}
+/** {@link noteLostWork} from an event handler: in the conversation's locale, not awaited, a failure logged. */
+function scheduleLostWorkNote(key, lostWork, reason) {
+    if (!lostWork)
+        return;
+    void withThreadLocale(key, () => noteLostWork(key, lostWork, reason)).catch((e) => console.warn(`[lost-work] ${(0, sessionKey_1.keyToString)(key)}:`, e instanceof Error ? e.message : e));
+}
+/**
+ * @description A process ended with the agent's own work pending (`utils/lostWork.ts`): keep the loss until the agent
+ * is told, post the ONE plain line in a topic, and — unless the plan says the note waits for the next prompt — resume
+ * the conversation with the note as its prompt. Runs in the conversation's locale.
+ */
+async function noteLostWork(key, lostWork, reason) {
+    if (!lostWork)
+        return;
+    const kStr = (0, sessionKey_1.keyToString)(key);
+    const now = Date.now();
+    const record = (0, lostWork_1.mergeLostWorkRecords)(state.getLostWork(key), { ...lostWork, reason, lostAt: now });
+    await state.setLostWork(key, record);
+    const lastAutoResumeAt = state.getLostWorkResumedAt(key);
+    const isLimitWaitArmed = getArmedApiRetry(key)?.kind === 'usageLimit';
+    const plan = (0, lostWork_1.getLostWorkPlan)({
+        reason,
+        isLimitWaitArmed,
+        msSinceLastAutoResume: lastAutoResumeAt === undefined ? null : now - lastAutoResumeAt,
+        // A tracker issue's agent answers only through a request: a bare note would have nowhere to answer.
+        isRequestRequired: !(0, sessionKeyCodec_1.checkIsTelegramKey)(key),
+    });
+    console.log(`[lost-work] ${kStr}: the process ended (${reason}) with the agent's own work pending (${record.backgroundTasks.length} background task(s), ${record.scheduledJobCount} scheduled job(s)${record.hasUnreadTaskResult ? ', an unread task result' : ''}${record.wasTurnInFlight ? ', a cut-off turn' : ''}); ${plan.isAutoResume ? 'resuming it with a note' : 'the note rides the next prompt'}`);
+    let linePlan = plan;
+    if (plan.isAutoResume) {
+        await state.setLostWorkResumedAt(key, now);
+        // The line says what happened: a resume that failed leaves the note for the next prompt, worded by the same rule.
+        if (!(await resumeConversationForLostWork(key)))
+            linePlan = (0, lostWork_1.getHeldLostWorkPlan)({ reason, isLimitWaitArmed });
+    }
+    if ((0, sessionKeyCodec_1.checkIsTelegramKey)(key))
+        replyToThread(key, (0, lostWork_1.formatLostWorkTopicLine)(record, linePlan, pendingWorkHoldHours, i18n_1.t)).catch(() => { });
+}
+/**
+ * @description Resume the conversation with the lost-work note as its prompt; `false` when the post failed — the note
+ * then stays for the next prompt.
+ */
+async function resumeConversationForLostWork(key) {
+    const record = state.getLostWork(key);
+    if (!record)
+        return true;
+    await state.clearLostWork(key);
+    const posted = await (0, postToSession_1.postToSession)(createLostWorkPostDeps(), (0, sessionKey_1.keyToString)(key), (0, lostWork_1.buildLostWorkNote)(record, (0, i18n_1.getLocaleEndonym)((0, i18n_1.getActiveLang)())));
+    if (posted.ok)
+        return true;
+    console.warn(`[lost-work] ${(0, sessionKey_1.keyToString)(key)}: the resume failed (${posted.reason === 'forward-failed' ? posted.error : posted.reason}); the note rides the next prompt`);
+    await state.setLostWork(key, (0, lostWork_1.mergeLostWorkRecords)(state.getLostWork(key), record));
+    return false;
+}
+/** The session post of a lost-work note: a bot note to the agent, not a request — no request is opened for it. */
+function createLostWorkPostDeps() {
+    return {
+        ...createSessionPostDeps(),
+        forwardPrompt: async (conversationKey, text) => {
+            await deliverPromptOrBuffer((0, sessionKey_1.keyFromString)(conversationKey), text, startupPromptBuffer.checkIsStarting(conversationKey));
+        },
+    };
+}
 function handleAgentError(key, error) {
     console.error(`[Bot] adapter error ${(0, sessionKey_1.keyToString)(key)}:`, error.message);
     stopClaudeLiveness(key);
@@ -9912,6 +10225,10 @@ function handleAgentStarted(key) {
     // activity instant rather than restart at the full 55 minutes. A genuinely fresh
     // session has no persisted instant and so gets the full window anyway.
     rearmThreadIdleTimer(key);
+    // A re-spawn (model, effort, account) began without the old process's background work — unless a usage-limit switch
+    // is re-spawning it: that switch folds the loss into its own first prompt (`switchTopicToFallbackEntry`).
+    if (!lostWorkFoldingKeys.has((0, sessionKey_1.keyToString)(key)))
+        scheduleLostWorkNote(key, takeLostWorkOf(key), 'restarted');
 }
 /**
  * @description `stopped` from the adapter — flip the banner back to `idle`.
@@ -9987,6 +10304,8 @@ function dropLostConversationWatermark(key) {
 function handleAgentSuspended(key) {
     clearGoneProcessFrames(key);
     updatePinnedStatus(key).catch(() => { });
+    // An idle stop takes pending work with it only once the hold ran out.
+    scheduleLostWorkNote(key, takeLostWorkOf(key), 'holdExpired');
 }
 // ═══════════════════════════════════════════════════════════════════════════════
 //  Startup orchestration — state init, re-attach, setMyCommands, launch
@@ -10288,10 +10607,14 @@ async function reattachExistingSessions(opts = { quietReattach: false }) {
     //     json-stream thread with a persisted id but no live process SLEEPS
     //     (lifecycle plan L4): it is NOT re-spawned — its next trigger resumes it
     //     — and it gets the downtime recap read from the transcript alone. An
-    //     adopted process keeps the bot-MCP tool list it got at its own start, so
-    //     one started under an earlier bot build is stopped at its next idle point
-    //     and resumed with the current tools (`decideAdoptedToolListRefresh`).
+    //     adopted process keeps the bot-MCP tool list it got at its own start: one
+    //     started under an earlier bot build is NOT stopped early — it follows the
+    //     normal idle lifecycle (compaction at the idle mark, then the stop, never
+    //     while its own work is pending) and the next trigger resumes it with the
+    //     current tools (`checkIsAdoptedToolListStale`).
     const claudeJsonAdapter = (0, createAdapter_1.getAdapter)(adapterNames_1.claudeJsonStreamAdapterName);
+    /** The conversations whose process was gone at boot with the agent's own work pending, by key — each told once. */
+    const lostWorkFoundAtBoot = new Map();
     let jsonAdopted = 0;
     let jsonKilled = 0;
     let jsonSleeping = 0;
@@ -10325,33 +10648,31 @@ async function reattachExistingSessions(opts = { quietReattach: false }) {
                         jsonAdopted += 1;
                         if (ownerAdapter.lifecycle === 'perTurn') {
                             // A per-turn process that outlived the bot is stopped as soon as its turn (if any) ends (L5).
-                            stopAdoptedSessionWhenIdle(key, ownerAdapter, 'the per-turn lifecycle');
+                            stopAdoptedPerTurnSessionWhenIdle(key, ownerAdapter);
                         }
-                        const refresh = (0, adoptedToolList_1.decideAdoptedToolListRefresh)({
-                            persistedDigest: agent.mcpToolDigest,
-                            currentDigest: botMcpToolDigestReader?.(key.platform) ?? '',
-                            isWorking: ownerAdapter.checkIsWorking(key),
-                        });
-                        if (refresh !== 'fresh') {
-                            // Read from the persisted state (the turn-in-flight flag, the task list); the stop itself
-                            // looks again once the downtime frames have replayed.
-                            console.log(`[reattach] ${(0, sessionKey_1.keyToString)(key)}: adopted with a stale tool list (${refresh === 'stopNow' ? 'idle: stopped now' : 'working: stopped once idle'})`);
-                            if (ownerAdapter.lifecycle !== 'perTurn')
-                                stopAdoptedSessionWhenIdle(key, ownerAdapter, 'the stale tool list');
+                        if ((0, adoptedToolList_1.checkIsAdoptedToolListStale)({ persistedDigest: agent.mcpToolDigest, currentDigest: botMcpToolDigestReader?.(key.platform) ?? '' })) {
+                            console.log(`[reattach] ${(0, sessionKey_1.keyToString)(key)}: adopted with a stale tool list; it gets the current tools when it resumes after its idle stop`);
                         }
-                        // The surviving process keeps the account it was spawned with; a topic whose pick changed while the
-                        // bot was down gets it at the next idle point (the resume reads the current profile).
+                        // The surviving process keeps the account it was spawned with. A switch the user picked while it worked is
+                        // restored with the adopt and still applies at the end of its turn; any other change of the resolved
+                        // profile reaches it when it resumes after its idle stop.
                         const spawnedConfigDir = ownerAdapter.getSessionClaudeConfigDir(key);
                         if (spawnedConfigDir !== undefined && !(0, claudeProfiles_1.checkIsSameClaudeConfigDir)(spawnedConfigDir, resolveThreadClaudeConfigDir(key))) {
                             console.log(`[reattach] ${(0, sessionKey_1.keyToString)(key)}: adopted under profile dir ${spawnedConfigDir ?? 'default'}, the topic now resolves to ${resolveThreadClaudeConfigDir(key) ?? 'default'}`);
-                            if (ownerAdapter.lifecycle !== 'perTurn')
-                                stopAdoptedSessionWhenIdle(key, ownerAdapter, 'the account profile');
                         }
                     }
                     else {
                         // Dead/zombie — adopt cleaned it up itself; the thread sleeps (below)
-                        // and its next trigger resumes it from the persisted session id.
+                        // and its next trigger resumes it from the persisted session id — at once
+                        // when its own work died with it (the agent is told, once the adopts are done).
                         jsonKilled += 1;
+                        const lostWork = takeLostWorkOf(key, ownerAdapter);
+                        if (lostWork) {
+                            lostWorkFoundAtBoot.set((0, sessionKey_1.keyToString)(key), { key, lostWork });
+                            // Told once: the record it came from drops it (the pass over the sleeping conversations below reads it too).
+                            if (agent.jsonStreamTail)
+                                void state.setJsonStreamTail(key, (0, lostWork_1.getTailRecordWithoutPendingWork)(agent.jsonStreamTail));
+                        }
                     }
                 }
                 catch (e) {
@@ -10373,6 +10694,13 @@ async function reattachExistingSessions(opts = { quietReattach: false }) {
         // Sleeping (L4): no process is started — the next trigger resumes the conversation. What the agent
         // produced while the bot was down is still recapped, read from the transcript on disk.
         jsonSleeping += 1;
+        // A process that died while the bot was down (its tmux session gone with it) left its pending work in the record:
+        // the agent is told — once: the record drops it now.
+        const goneProcessLostWork = (0, lostWork_1.getLostWorkFromTailRecord)(agent.jsonStreamTail ?? null, agent.claudeSessionId);
+        if (agent.jsonStreamTail && (0, lostWork_1.checkHasLostWork)(goneProcessLostWork) && !lostWorkFoundAtBoot.has((0, sessionKey_1.keyToString)(key))) {
+            lostWorkFoundAtBoot.set((0, sessionKey_1.keyToString)(key), { key, lostWork: goneProcessLostWork });
+            void state.setJsonStreamTail(key, (0, lostWork_1.getTailRecordWithoutPendingWork)(agent.jsonStreamTail));
+        }
         // A sleeping per-turn session with a compaction due gets its idle timer from the persisted stamps (L-D7).
         if (agent.name === adapterNames_1.claudePerTurnAdapterName)
             rearmThreadIdleTimer(key);
@@ -10382,6 +10710,9 @@ async function reattachExistingSessions(opts = { quietReattach: false }) {
         void postReattachRecap(key, ownerAdapter, workDirDecision.workDir, agent.claudeSessionId, agent.seenWatermark ?? null, !opts.quietReattach).catch(() => { });
     }
     console.log(`[reattach] claude-json-stream: adopted ${jsonAdopted}, sleeping ${jsonSleeping}, killed ${jsonKilled} orphans (quiet=${opts.quietReattach})`);
+    // Not awaited: a resume must not hold up the rest of the boot (the prompt is buffered while the session starts).
+    for (const { key, lostWork } of lostWorkFoundAtBoot.values())
+        scheduleLostWorkNote(key, lostWork, 'foundDead');
     // 3. Terminal — tmux shells (`term-…`). Like the Claude scan but simpler:
     //    a terminal has no session-id to recover, so adoption keys purely on a
     //    live binding whose agent is `terminal`. The tmux name is derived from
@@ -11100,10 +11431,11 @@ async function resolveBotAdminRights(groupId, botUserId) {
     }
 }
 /**
- * @description The General topic the updater talks in: the paired group's General when a group is paired, else the owner's DM
- * General (`null` when neither exists — a Jira-only instance has no Telegram to say anything in).
+ * @description The General topic the bot speaks to the operator in (the updater, the native-Windows notice): the paired group's
+ * General when a group is paired, else the owner's DM General (`null` when neither exists — a Jira-only instance has no
+ * Telegram to say anything in).
  */
-function getUpdateGeneralKey() {
+function getOperatorGeneralKey() {
     const groupId = getAllowedGroupId();
     if (groupId !== null)
         return (0, sessionKeyCodec_1.makeTelegramKey)(groupId, threadRouting_1.GENERAL_THREAD_ID);
@@ -11118,7 +11450,7 @@ function getUpdateGeneralKey() {
 async function postUpdateMessageToGeneral(message) {
     if (!ENV.isTelegramServed)
         return;
-    const generalKey = getUpdateGeneralKey();
+    const generalKey = getOperatorGeneralKey();
     if (generalKey === null) {
         console.log(`[update] no General topic to post "${message.kind}" in`);
         return;
@@ -11243,6 +11575,20 @@ async function sendStartupStatus(isHotReload) {
     }
     console.warn('[startup-status] no reachable target — status not delivered');
 }
+/**
+ * @description On native Windows, say once per cold start in General which features do not work there and point to WSL2,
+ * worded in that chat's language. Best-effort like the readiness status: no General topic to speak in is not an error (the
+ * console line already said it), and a failed send is logged by the send path.
+ */
+async function postNativeWindowsNoticeToGeneral(isHotReload) {
+    const generalKey = getOperatorGeneralKey();
+    if (generalKey === null)
+        return;
+    const text = withThreadLocale(generalKey, () => (0, nativeWindows_1.getNativeWindowsGeneralNotice)({ platform: process.platform, isHotReload }, i18n_1.t));
+    if (text === null)
+        return;
+    await replyToThread(generalKey, text);
+}
 /**
  * @description Load and prepare the Jira connector, or end the start: a broken
  * config, a token of another account or an unknown trigger status is fatal, with
@@ -11255,6 +11601,7 @@ async function prepareJiraConnectorOrExit() {
             dataDir: path.dirname(state.stateFilePath),
             workRoot: ENV.workRoot,
             openCodeUrl: process.env.OPENCODE_URL,
+            pollIntervalMsOverride: ENV.testTimings.jiraPollIntervalMs,
         });
     }
     catch (error) {
@@ -11307,7 +11654,7 @@ async function startBot() {
     // 1. State store. The `[startup] DATA_DIR=` shape is load-bearing: the
     // README's two-instances troubleshooting tells the operator to compare this
     // exact line across instances.
-    state = await (0, state_1.getStateStore)();
+    state = await (0, state_1.getStateStore)({ saveDebounceMs: ENV.testTimings.stateSaveDebounceMs });
     console.log(`[startup] DATA_DIR=${path.dirname(state.stateFilePath)}`);
     // R13: before anything reads, rewrites or acts on the state, it must hold only
     // conversations of the platforms this instance serves.
@@ -11336,6 +11683,9 @@ async function startBot() {
     // Every Claude spawn from here on reads the conversation's account profile (`/account`).
     (0, createAdapter_1.registerClaudeConfigDirReader)(resolveThreadClaudeConfigDir);
     (0, createAdapter_1.registerClaudeRateLimitSink)(onClaudeRateLimitEvent);
+    (0, createAdapter_1.registerClaudeTurnCostSink)(onClaudeTurnCost);
+    if (ENV.testTimings.openCodeServerUpBudgetMs !== undefined)
+        (0, createAdapter_1.registerOpenCodeServerUpBudgetMs)(ENV.testTimings.openCodeServerUpBudgetMs);
     // The usage cache: a first poll now (off the boot path), then the timer.
     claudeUsageRefresher.start();
     void claudeUsageRefresher.refreshAll();
@@ -11389,6 +11739,8 @@ async function startBot() {
             return result.ok ? (result.alertRef ?? null) : null;
         },
         backstopMs: (0, wakeUpRules_1.getRequestBackstopMs)(process.env.REQUEST_BACKSTOP_MINUTES),
+        sweepIntervalMs: ENV.testTimings.requestSweepIntervalMs,
+        firstPostRetryDelayMs: ENV.testTimings.requestFirstPostRetryDelayMs,
         // Only a Telegram topic in the answers-only view hides the stream from someone who expects to see the work.
         checkIsAnswerTailWatched: (key) => (0, sessionKeyCodec_1.checkIsTelegramKey)(key) && !(0, topicView_1.checkIsStreamShown)(state.getDisplayPrefs(key).view),
         remindAnswerTail,
@@ -11412,6 +11764,9 @@ async function startBot() {
     const bootMode = (0, bootClassifier_1.classifyBoot)(downtimeMs);
     console.log(`Boot mode:        ${bootMode.isHotReload ? 'HOT RELOAD' : 'COLD START'} ` +
         `(downtime=${downtimeMs === null ? 'unknown' : `${downtimeMs}ms`})`);
+    const nativeWindowsConsoleLine = (0, nativeWindows_1.getNativeWindowsConsoleLine)(process.platform, i18n_1.t);
+    if (nativeWindowsConsoleLine)
+        console.warn(nativeWindowsConsoleLine);
     console.log(`Chat mode:        ${getChatMode()}`);
     // In `both`, the DM surface only lights up when an OWNER_USER_ID is set;
     // otherwise the instance serves the group only. Surface that explicitly so an
@@ -11473,10 +11828,19 @@ async function startBot() {
         onApiError: (key, error) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'apiError', () => withThreadLocale(key, () => handleApiError(key, error))),
         onNoResponse: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'noResponse', () => handleNoResponse(key)),
         onQuestionGone: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'questionGone', () => withThreadLocale(key, () => handleQuestionGone(key))),
-        onClosed: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'closed', () => withThreadLocale(key, () => handleAgentClosed(key)), () => clearForeignSessionState(key)),
-        onStarted: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'started', () => withThreadLocale(key, () => handleAgentStarted(key))),
+        onClosed: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'closed', () => withThreadLocale(key, () => handleAgentClosed(key)), () => {
+            const lostWork = takeLostWorkOf(key);
+            clearForeignSessionState(key);
+            scheduleLostWorkNote(key, lostWork, 'exited');
+        }),
+        // An issue's process gets the idle countdown and the lost-work note of a re-spawn: it has no banner.
+        onStarted: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'started', () => withThreadLocale(key, () => handleAgentStarted(key)), () => {
+            rearmThreadIdleTimer(key);
+            if (!lostWorkFoldingKeys.has((0, sessionKey_1.keyToString)(key)))
+                scheduleLostWorkNote(key, takeLostWorkOf(key), 'restarted');
+        }),
         onStopped: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'stopped', () => withThreadLocale(key, () => handleAgentStopped(key)), () => clearForeignSessionState(key)),
-        onSuspended: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'suspended', () => withThreadLocale(key, () => handleAgentSuspended(key))),
+        onSuspended: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'suspended', () => withThreadLocale(key, () => handleAgentSuspended(key)), () => scheduleLostWorkNote(key, takeLostWorkOf(key), 'holdExpired')),
         onTurnEnded: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'turnEnded', () => handleAgentTurnEnded(key)),
         onContextCompacted: (key, trigger) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'contextCompacted', () => noteConversationContextReset(key, `compaction (${trigger ?? 'bot'})`)),
         onConversationLost: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'conversationLost', () => withThreadLocale(key, () => handleConversationLost(key)), () => { dropLostConversationWatermark(key); noteConversationContextReset(key, 'its transcript was lost'); }),
@@ -11920,6 +12284,12 @@ async function startBot() {
     catch (e) {
         console.warn('[startup-status] failed:', e instanceof Error ? e.message : e);
     }
+    try {
+        await postNativeWindowsNoticeToGeneral(bootMode.isHotReload);
+    }
+    catch (e) {
+        console.warn('[platform] native Windows notice failed:', e instanceof Error ? e.message : e);
+    }
     await startUpdates();
     // The local speech engine: clean up after an earlier run, re-attach to / start its install. Starts no process.
     void bootSttLocalEngine().catch((e) => console.warn('[STT] boot step failed:', e instanceof Error ? e.message : e));