charness 3.6.1 → 3.8.0

package/dist/bot.js

@@ -46,7 +46,6 @@ const filters_1 = require("telegraf/filters");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
-const https = __importStar(require("https"));
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
@@ -76,6 +75,7 @@ const startupReadiness_1 = require("./utils/startupReadiness");
 const doctorLine_1 = require("./utils/doctorLine");
 const nativeWindows_1 = require("./utils/nativeWindows");
 const state_1 = require("./state");
+const diagLog_1 = require("./diagLog");
 const instanceLock_1 = require("./instanceLock");
 const shutdown_1 = require("./shutdown");
 const updateDispatcher_1 = require("./connectors/telegram/updateDispatcher");
@@ -87,7 +87,14 @@ const timezonePicker_1 = require("./connectors/telegram/timezonePicker");
 const timezoneRecompute_1 = require("./scheduler/timezoneRecompute");
 const validation_1 = require("./validation");
 const bindPicker_1 = require("./connectors/telegram/bindPicker");
+const openBindMessages_1 = require("./connectors/telegram/openBindMessages");
+const bindSweep_1 = require("./connectors/telegram/bindSweep");
 const topicCommand_1 = require("./connectors/telegram/commands/topicCommand");
+const callbackMessage_1 = require("./connectors/telegram/commands/callbackMessage");
+const callbackToast_1 = require("./connectors/telegram/commands/callbackToast");
+const bindingWelcome_1 = require("./connectors/telegram/bindingWelcome");
+const bindPickerClaims_1 = require("./connectors/telegram/bindPickerClaims");
+const pendingTopicName_1 = require("./connectors/telegram/pendingTopicName");
 const forumTopicCreated_1 = require("./connectors/telegram/forumTopicCreated");
 const providerDisconnectPlan_1 = require("./utils/providerDisconnectPlan");
 const folderName_1 = require("./folderName");
@@ -101,10 +108,13 @@ const outbound_3 = require("./connectors/jira/outbound");
 const adapterEventRouting_1 = require("./adapters/adapterEventRouting");
 const connectorSet_1 = require("./platform/connectorSet");
 const telegramCallGuard_1 = require("./connectors/telegram/telegramCallGuard");
+const botApiConnection_1 = require("./connectors/telegram/botApiConnection");
 const unservedStateGuard_1 = require("./platform/unservedStateGuard");
 const contextPreamble_1 = require("./connectors/jira/contextPreamble");
 const postToSession_1 = require("./postToSession");
 const limitHeldPrompts_1 = require("./utils/limitHeldPrompts");
+const adoptReplayGate_1 = require("./utils/adoptReplayGate");
+const topicRequestSettle_1 = require("./requests/topicRequestSettle");
 const promptDelivery_1 = require("./utils/promptDelivery");
 const apiRetryKick_1 = require("./apiRetryKick");
 const limitHeldPromptQueue_1 = require("./utils/limitHeldPromptQueue");
@@ -164,6 +174,9 @@ const claudeLivenessAction_1 = require("./utils/claudeLivenessAction");
 const isoTimestamp_1 = require("./utils/isoTimestamp");
 const effortLevels_1 = require("./effortLevels");
 const instanceSettings_1 = require("./instanceSettings");
+const taskAgentLimit_1 = require("./trackers/taskAgentLimit");
+const taskAgentSlots_1 = require("./trackers/taskAgentSlots");
+const botSkills_1 = require("./utils/botSkills");
 const constants_1 = require("./selfUpdate/constants");
 const launchEnvironment_1 = require("./selfUpdate/launchEnvironment");
 const restart_1 = require("./selfUpdate/restart");
@@ -183,11 +196,20 @@ const runLedger_1 = require("./scheduler/runLedger");
 const delivery_1 = require("./scheduler/delivery");
 const checkRun_1 = require("./scheduler/checkRun");
 const engine_1 = require("./scheduler/engine");
+const recurrence_1 = require("./scheduler/recurrence");
 const mcpSurface_1 = require("./scheduler/mcpSurface");
 const injection_1 = require("./scheduler/injection");
 const mcpBoot_1 = require("./scheduler/mcpBoot");
 const requestLedger_1 = require("./requests/requestLedger");
 const answerRequest_1 = require("./requests/answerRequest");
+const store_1 = require("./todos/store");
+const registry_1 = require("./todos/registry");
+const nag_1 = require("./todos/nag");
+const reminderEngine_1 = require("./todos/reminderEngine");
+const projects_1 = require("./todos/projects");
+const board_1 = require("./todos/board");
+const tools_1 = require("./todos/tools");
+const midTurn_1 = require("./todos/midTurn");
 const answerTail_1 = require("./requests/answerTail");
 const answerSink_1 = require("./connectors/telegram/answerSink");
 const answerSink_2 = require("./platform/answerSink");
@@ -204,6 +226,7 @@ const apiErrorRetry_1 = require("./apiErrorRetry");
 const wedgeRecovery_1 = require("./utils/wedgeRecovery");
 const claudeAuthLogin_1 = require("./utils/claudeAuthLogin");
 const limitEpisodeRecovery_1 = require("./utils/limitEpisodeRecovery");
+const transcriptErrorTime_1 = require("./utils/transcriptErrorTime");
 const autoContinueOnLimit_1 = require("./utils/autoContinueOnLimit");
 const openCodeAuthLogin_1 = require("./utils/openCodeAuthLogin");
 const agentLogin_1 = require("./agentLogin/agentLogin");
@@ -211,9 +234,19 @@ const questionKeyboards_1 = require("./connectors/telegram/questionKeyboards");
 const displayModes_1 = require("./connectors/telegram/commands/displayModes");
 const reminders_1 = require("./connectors/telegram/commands/reminders");
 const modelProviders_1 = require("./connectors/telegram/commands/modelProviders");
-const callbackToast_1 = require("./connectors/telegram/commands/callbackToast");
+const callbackToast_2 = require("./connectors/telegram/commands/callbackToast");
 const compaction_1 = require("./connectors/telegram/commands/compaction");
 const autoContinueLimits_1 = require("./connectors/telegram/commands/autoContinueLimits");
+const botSkills_2 = require("./connectors/telegram/commands/botSkills");
+const taskAgents_1 = require("./connectors/telegram/commands/taskAgents");
+const runners_1 = require("./connectors/telegram/commands/runners");
+const gateWrapper_1 = require("./runners/gateWrapper");
+const hubAddress_1 = require("./runners/hubAddress");
+const hubAddressCandidates_1 = require("./runners/hubAddressCandidates");
+const hubPaths_1 = require("./runners/hubPaths");
+const hubPairing_1 = require("./runners/hubPairing");
+const runnersOverview_1 = require("./runners/runnersOverview");
+const ssh_1 = require("./remoteRun/ssh");
 const claudeAccounts_1 = require("./connectors/telegram/commands/claudeAccounts");
 const claudeProfiles_1 = require("./utils/claudeProfiles");
 const claudeUsage_1 = require("./utils/claudeUsage");
@@ -229,6 +262,7 @@ const fallbackChain_1 = require("./utils/fallbackChain");
 const fallbackBridge_1 = require("./utils/fallbackBridge");
 const fallbackChain_2 = require("./connectors/telegram/commands/fallbackChain");
 const limitsBoard_1 = require("./connectors/telegram/commands/limitsBoard");
+const todo_1 = require("./connectors/telegram/commands/todo");
 const backendSwitch_1 = require("./connectors/telegram/commands/backendSwitch");
 const operatorSwitchPlan_1 = require("./utils/operatorSwitchPlan");
 const backendSwitchPlan_1 = require("./utils/backendSwitchPlan");
@@ -237,6 +271,7 @@ const stt_1 = require("./connectors/telegram/commands/stt");
 const claudeApiSpend_1 = require("./utils/claudeApiSpend");
 const claudeProfileUsageLines_1 = require("./utils/claudeProfileUsageLines");
 const resolveBinary_1 = require("./utils/resolveBinary");
+const runnerSummary_1 = require("./remoteRun/runnerSummary");
 // ═══════════════════════════════════════════════════════════════════════════════
 //  ENV parsing & fatal validation
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -354,6 +389,8 @@ if (ENV.testTimings.telegramSendIntervalMs !== undefined)
     (0, rateLimiter_1.configureGlobalSendInterval)(ENV.testTimings.telegramSendIntervalMs);
 if (ENV.testTimings.backgroundHoldMaxMs !== undefined)
     (0, createAdapter_1.registerPendingWorkHoldMs)(ENV.testTimings.backgroundHoldMaxMs);
+if (ENV.testTimings.scheduleMinFireIntervalMs !== undefined)
+    (0, recurrence_1.registerMinFireIntervalMs)(ENV.testTimings.scheduleMinFireIntervalMs);
 /** The short retry that probes an unconfirmed usage limit (a test instance may shorten it). */
 const limitProbeDelayMs = ENV.testTimings.limitProbeDelayMs ?? apiErrorRetry_1.unconfirmedLimitProbeDelayMs;
 // The instance default effort (`/effort` in General) is `settings.json`'s `defaultEffort`, re-read when the file changes.
@@ -446,24 +483,22 @@ function getOutputTransport() {
     }
     return outputTransport;
 }
-const telegramAgent = new https.Agent({
-    keepAlive: true,
-    keepAliveMsecs: 10000,
-    family: 4,
-});
+const telegramAgent = (0, botApiConnection_1.createBotApiHttpsAgent)();
 // Without the telegram connector there is no token (an empty one), and the call
 // guard below refuses every Bot API call before it is sent (Jira plan J3, D9).
 // `TELEGRAM_API_ROOT` points the client at another Bot API host — the
 // process-level test's fake on loopback; unset is the real `api.telegram.org`.
-// Telegraf drops the https agent itself for an `http://` root.
 const telegramApiRoot = process.env.TELEGRAM_API_ROOT?.trim();
+// Telegraf drops the https agent itself for an `http://` root and node-fetch then rides the global agent, whose
+// pooling is not the bot's. That root gets the same pooling over `http`.
+const telegramApiAgent = telegramApiRoot?.startsWith('http://') ? (0, botApiConnection_1.createBotApiHttpAgent)() : telegramAgent;
 const bot = new telegraf_1.Telegraf(ENV.botToken, {
-    telegram: { agent: telegramAgent, ...(telegramApiRoot ? { apiRoot: telegramApiRoot } : {}) },
+    telegram: { agent: telegramApiAgent, ...(telegramApiRoot ? { apiRoot: telegramApiRoot } : {}) },
 });
 // Decouple the long-polling intake/ACK from per-handler latency: wrap
 // `bot.handleUpdate` so each update is enqueued into its thread's serial queue
 // and the loop's `Promise.all` resolves at once (next `getUpdates` = ACK + new
-// batch fires now). The real middleware chain — the two `bot.use` middlewares,
+// batch fires now). The real middleware chain — every `bot.use` middleware,
 // every command/`on`/action, `bot.catch` — runs unchanged inside the captured
 // original, just off-loop and per-thread-serial. MUST be installed before
 // `bot.launch`. The graceful-shutdown path drains it (see `updateDrainTimeoutMs`).
@@ -481,6 +516,10 @@ const updateDrainTimeoutMs = 2000;
 // window is not lost on shutdown.
 (0, outputTrace_1.installCallApiTrace)(bot.telegram);
 process.on('exit', outputTrace_1.flushTraceBufferSyncOnExit);
+// The bot's pooling (the agent Telegraf dropped for an `http://` root) and the retry of a request that met a pooled
+// connection the server had closed. AFTER the trace wrap, so the trace records both real HTTP attempts, and below the
+// send queue, pacer and 429 retry. Telegraf builds a NEW client per update: see the first `bot.use` below.
+(0, botApiConnection_1.wireBotApiClient)(bot.telegram, telegramApiAgent);
 // Default every text message/edit to NO link preview: a bare URL in agent
 // output otherwise expanded into a large preview card, one per message, in the
 // muted topic (operator complaint 2026-09-07). Installed OUTSIDE the trace wrap
@@ -601,7 +640,14 @@ async function checkIsForumAdmin(chatId, userId) {
         return false;
     }
 }
-// Output-trace `recv` hook — must be the FIRST middleware so every update is
+// Telegraf builds a NEW `Telegram` client for every update (`ctx.telegram`, behind every `ctx.reply`, `ctx.answerCbQuery`
+// and `ctx.editMessageText`) from `bot.telegram.options`, so the wiring of `bot.telegram` does not reach it and an
+// `http://` root drops the agent again. Wire it before any handler can use it.
+bot.use((ctx, next) => {
+    (0, botApiConnection_1.wireBotApiClient)(ctx.telegram, telegramApiAgent);
+    return next();
+});
+// Output-trace `recv` hook — must come before every middleware that can gate or drop an update, so every update is
 // recorded before any gating (access control, group routing) can drop it.
 // Security: while the thread awaits a `/connect` key paste (same
 // `pendingProviderConnects` state the text handler consumes later in this
@@ -788,7 +834,7 @@ let schedulerEngine = null;
  * The request wake-up engine (request/answer core S4), assigned once by
  * `startBot` after the request ledger loads. Module-level like
  * {@link schedulerEngine} because the cancel paths (`/esc`, `/c`, `/quit`,
- * `/quit-all`, `/new`, `/resume`, leaving the folder, switching the topic to
+ * `/quitall`, `/new`, `/resume`, leaving the folder, switching the topic to
  * another agent or a shell) are module-level command handlers.
  */
 let requestWakeUpEngine = null;
@@ -820,15 +866,19 @@ async function openTopicRequest(key, text, intake) {
     return { header: (0, topicRequest_1.buildTopicRequestHeader)(request.id, intake.source, view, request.supersededRequestIds), requestId: request.id };
 }
 /**
- * @description The request's prompt was handed to the prompt path (forwarded, or
- * buffered behind a session start — the turn probe holds a starting session, so
- * tracking now is right either way): the wake-up engine watches the turn.
+ * @description Where a topic request goes once its prompt came back from the prompt path (`requests/topicRequestSettle.ts`): the
+ * wake-up engine watches the turn of a prompt that reached a session (or waits behind its start), and a prompt that found no
+ * session closes the request it opened. Both ports are read at call time: the engine and the ledger are assigned at boot.
  */
-function trackTopicRequestTurn(key, opening) {
-    if (opening.requestId === null)
-        return;
-    void requestWakeUpEngine?.trackForwardedTurn(key, opening.requestId, { isRequestPrompt: true }).catch((e) => console.warn(`[requests] tracking the turn of ${opening.requestId} failed:`, e instanceof Error ? e.message : e));
-}
+const { trackTurn: trackTopicRequestTurn, settleAfterDelivery: settleTopicRequestAfterDelivery } = (0, topicRequestSettle_1.createTopicRequestSettler)({
+    trackTurn: async (key, requestId) => {
+        await requestWakeUpEngine?.trackForwardedTurn(key, requestId, { isRequestPrompt: true });
+    },
+    cancelRequest: async (requestId) => {
+        await topicRequestLedger?.closeRequest(requestId, 'cancelled');
+    },
+    warn: (message) => console.warn(message),
+});
 /** What the bot's own limit-wait answer needs (S5); set at boot next to the engine. */
 let requestLimitWaitAnswerDeps = null;
 /**
@@ -850,6 +900,212 @@ function checkIsAgentEventShownInTopic(key, event) {
 function getDataDir() {
     return path.dirname(state.stateFilePath);
 }
+/** The shared todo registry (`todos/`), built on first use: its store lives in `DATA_DIR`, known once the state is. */
+let todoRegistry = null;
+function getTodoRegistry() {
+    todoRegistry ??= (0, registry_1.createTodoRegistry)({ store: new store_1.TodoStore(getDataDir()), getNowMs: Date.now });
+    return todoRegistry;
+}
+/**
+ * The «Bot skills» switch (`/bot_skills`, `utils/botSkills.ts`): the topic's own choice, else General's value, else `settings.json`'s
+ * `botSkills` (re-read when the file changes), else ON. `state` is read when asked, so the reader is registered once it is loaded.
+ */
+const botSkillsSources = {
+    getGeneralValue: () => state.getBotSkillsGlobalValue(),
+    getTopicOverride: (key) => state.getBotSkillsOverride(key),
+    getSettingsValue: (0, instanceSettings_1.createBotSkillsSettingsReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line)),
+};
+const botSkillsReader = (0, botSkills_1.createBotSkillsReader)(botSkillsSources);
+/**
+ * The cap on tracker task agents (`trackers/taskAgentLimit.ts`): General's value, else `settings.json`'s
+ * `taskAgents.maxConcurrent` (re-read when the file changes), else the built-in default. `state` is read when asked.
+ */
+const taskAgentLimitSources = {
+    getGeneralValue: () => state.getTaskAgentsMaxConcurrentGlobalValue(),
+    getSettingsValue: (0, instanceSettings_1.createTaskAgentsMaxConcurrentReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line)),
+};
+/** The slots of the tracker task agents and their wait list; built at boot, once the request ledger is loaded. */
+let taskAgentSlots = null;
+/** `settings.json`'s `todo` (on / off, the reminder's interval), re-read when the file changes. */
+const readTodoSettings = (0, instanceSettings_1.createTodoSettingsReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line));
+/** The staleness reminder's interval now; `null` = off (the feature or its reminder). */
+function getTodoReminderIntervalMsNow() {
+    return (0, nag_1.getTodoReminderIntervalMs)(readTodoSettings(), ENV.testTimings.todoReminderIntervalMs);
+}
+/**
+ * The reminder line a prompt forwarded now carries (D11 form a), or `null`; taking it counts as delivered. The lists
+ * are a courtesy to the agent: a failure here is logged and the prompt goes on without the line.
+ */
+function takeTodoPromptReminder(key) {
+    try {
+        return getTodoRegistry().takePromptReminder(key, getTodoReminderIntervalMsNow(), Date.now());
+    }
+    catch (e) {
+        console.error(`[todos] ${(0, sessionKey_1.keyToString)(key)}: the reminder line could not be taken:`, e instanceof Error ? e.message : e);
+        return null;
+    }
+}
+/** The staleness reminder's poll (`todos/reminderEngine.ts`), built at boot and started once the sessions are restored. */
+let todoReminderEngine = null;
+let todoRepositories = null;
+/** Which folders are one git repository (`todos/projects.ts`), cached; the root commits persist in `DATA_DIR/todos`. */
+function getTodoRepositories() {
+    todoRepositories ??= (0, projects_1.createRepositoryIdentityReader)({
+        runGit: projects_1.runGitInFolder,
+        rootCommitStore: (0, projects_1.createRepositoryRootCommitFile)((0, store_1.getTodosDir)(getDataDir())),
+    });
+    return todoRepositories;
+}
+/** What the boards need of the Jira connector (D55, D57); set at boot when it is loaded. */
+let todoJiraConversations = null;
+/**
+ * A bound conversation as the project grouping sees it before git is asked: complete (a Jira issue, a folder that does
+ * not resolve), or still needing its folder's repository.
+ */
+function describeTodoProjectMember({ key, data }) {
+    const conversationKey = (0, sessionKey_1.keyToString)(key);
+    if (key.platform === 'jira') {
+        return { member: { conversationKey, workDir: null, identity: null, jiraRepositoryNames: todoJiraConversations?.getConversationRepositoryNames(key) ?? null } };
+    }
+    const decision = (0, validation_1.resolveBoundWorkDir)(ENV.workRoot, data);
+    return decision.kind === 'proceed' ? { conversationKey, workDir: decision.workDir } : { member: { conversationKey, workDir: null, identity: null } };
+}
+/** The instance's project boards (D15, D16, D57), waiting for git where a folder's read is due. */
+async function listTodoProjects() {
+    const repositories = getTodoRepositories();
+    const members = await Promise.all(state.listBindings().map(async (binding) => {
+        const described = describeTodoProjectMember(binding);
+        if ('member' in described)
+            return described.member;
+        const identity = await repositories.read(described.workDir);
+        return identity === undefined ? undefined : { ...described, identity };
+    }));
+    return (0, projects_1.groupTodoProjects)(members.filter((member) => member !== undefined), state.getTodoProjectOverrides());
+}
+/**
+ * The project boards as known NOW, never waiting for git and never yielding (a prompt, the mid-turn poll): `null` while a
+ * bound folder was never read — its read starts now, with every other one due.
+ */
+function peekTodoProjects() {
+    const repositories = getTodoRepositories();
+    const members = state.listBindings().map((binding) => {
+        const described = describeTodoProjectMember(binding);
+        if ('member' in described)
+            return described.member;
+        const identity = repositories.peek(described.workDir);
+        return identity === undefined ? undefined : { ...described, identity };
+    });
+    return members.every((member) => member !== undefined) ? (0, projects_1.groupTodoProjects)(members, state.getTodoProjectOverrides()) : null;
+}
+/** The bound folders' due repository reads start in the background (boot, a bind), so the next prompts find the grouping known. */
+function warmTodoProjects() {
+    if (!readTodoSettings().isEnabled)
+        return;
+    try {
+        peekTodoProjects();
+    }
+    catch (e) {
+        console.error('[todos] the bound folders\' repositories could not be read:', e instanceof Error ? e.message : e);
+    }
+}
+/** The project of `key`'s conversation, waiting for git; `null` = in none. */
+async function getTodoProjectOf(key) {
+    const conversationKey = (0, sessionKey_1.keyToString)(key);
+    return (await listTodoProjects()).find((project) => project.memberKeys.includes(conversationKey)) ?? null;
+}
+/** The project of `key`'s conversation as known now; `null` = in none, `undefined` = not known without waiting. */
+function peekTodoProjectOf(key) {
+    const conversationKey = (0, sessionKey_1.keyToString)(key);
+    const projects = peekTodoProjects();
+    return projects === null ? undefined : (projects.find((project) => project.memberKeys.includes(conversationKey)) ?? null);
+}
+/** How a conversation is named on a board and in the picker: `#topic (folder)`, or the issue `PROJ-123 «summary»` (D55). */
+function getTodoConversationLabel(conversationKey) {
+    const key = (0, sessionKey_1.tryKeyFromString)(conversationKey);
+    if (key === null)
+        return conversationKey;
+    if (key.platform === 'jira') {
+        const title = todoJiraConversations?.getConversationTitle(key) ?? null;
+        return title === null ? key.thread : `${key.thread} «${title}»`;
+    }
+    const binding = state.getBinding(key);
+    return `#${binding?.topicName ?? `topic ${key.thread}`}${binding ? ` (${binding.subdir})` : ''}`;
+}
+function getTodoSessionActivity(conversationKey) {
+    const key = (0, sessionKey_1.tryKeyFromString)(conversationKey);
+    if (key === null)
+        return 'asleep';
+    const adapter = (0, createAdapter_1.getThreadAdapter)(key);
+    if (!adapter.checkIsActive(key))
+        return 'asleep';
+    return adapter.checkIsBusy?.(key) ? 'working' : 'idle';
+}
+let todoBoard = null;
+/** The project boards (`todos/board.ts`), built on first use like the registry. */
+function getTodoBoard() {
+    todoBoard ??= (0, board_1.createTodoBoard)({
+        store: getTodoRegistry().getStore(),
+        getProjectOf: getTodoProjectOf,
+        peekProjectOf: peekTodoProjectOf,
+        getPeerLabel: getTodoConversationLabel,
+        getSessionActivity: getTodoSessionActivity,
+        getNowMs: Date.now,
+    });
+    return todoBoard;
+}
+/** The agent lost its context: its next prompt carries the whole board (D20). Logged, never thrown, on a lifecycle path. */
+function noteTodoFreshContext(key) {
+    try {
+        getTodoBoard().noteFreshContext(key);
+    }
+    catch (e) {
+        console.error(`[todos] ${(0, sessionKey_1.keyToString)(key)}: the board's seen state could not be reset:`, e instanceof Error ? e.message : e);
+    }
+}
+let todoMidTurn = null;
+/** Mid-turn delivery of the board (`todos/midTurn.ts`): the Claude inbox hook, the note into a running OpenCode turn. */
+function getTodoMidTurn() {
+    todoMidTurn ??= (0, midTurn_1.createTodoMidTurn)({
+        board: getTodoBoard(),
+        inboxDir: (0, midTurn_1.getTodoInboxDir)(getDataDir()),
+        getClaudeSessionId: (key) => {
+            const adapterName = (0, createAdapter_1.getThreadAdapterNameRaw)(key) ?? state.getAgent(key)?.name;
+            return adapterName !== undefined && (0, createAdapter_1.checkIsClaudeBackend)(adapterName) ? getResumableSessionId(key) : null;
+        },
+        // Into the running turn only (D21): never a new turn, never through the prompt path that resets the turn.
+        postRunningTurnNote: async (key, text) => (0, createAdapter_1.getThreadAdapter)(key).queueNoteIntoRunningTurn?.(key, text) ?? false,
+    });
+    return todoMidTurn;
+}
+let todoTools = null;
+function getTodoTools() {
+    todoTools ??= (0, tools_1.createTodoTools)({ registry: getTodoRegistry(), board: getTodoBoard(), onBoardShown: discardTodoInbox });
+    return todoTools;
+}
+/** A turn start the bot makes carries the board itself: a waiting mid-turn inbox is withdrawn (or counted, if taken). */
+function discardTodoInbox(key) {
+    try {
+        getTodoMidTurn().discardInbox(key);
+    }
+    catch (e) {
+        console.error(`[todos] ${(0, sessionKey_1.keyToString)(key)}: the mid-turn inbox could not be withdrawn:`, e instanceof Error ? e.message : e);
+    }
+}
+/**
+ * The board block a prompt forwarded now carries (D20), or `null`; taking it counts as seen. A failure never stops the prompt.
+ * Synchronous: it sits between the forward's decision and the write (see `TodoBoard.takePromptBoard`).
+ */
+function takeTodoPromptBoard(key) {
+    if (!readTodoSettings().isEnabled)
+        return null;
+    try {
+        return getTodoBoard().takePromptBoard(key);
+    }
+    catch (e) {
+        console.error(`[todos] ${(0, sessionKey_1.keyToString)(key)}: the project board could not be built:`, e instanceof Error ? e.message : e);
+        return null;
+    }
+}
 const threadMessageStates = new Map();
 const outputQueues = new Map();
 const pendingQuestions = new Map();
@@ -1043,10 +1299,12 @@ function onThreadActivityWhileQuestionPending(key) {
 }
 /**
  * @description Re-post the current pending question as the newest thread message
- * (S3): delete the old question message, then send the current question again
- * via {@link postPendingQuestionAt} (which re-renders with S1 descriptions /
- * S2 current index and re-owns `messageId`). No-op if the question was answered
- * meanwhile, or if it is already the last message (the loop guard re-checked at
+ * (S3): send the current question again via {@link postPendingQuestionAt} (which
+ * re-renders with S1 descriptions / S2 current index and re-owns `messageId`), then
+ * end the old message. The ORIGINAL message of the question is its record: it is closed as «asked again
+ * below» (text stays, buttons go) and never deleted. A copy that an earlier re-post made is only a duplicate of that record
+ * and is deleted, so a question that waits through a long stream of output leaves two messages, not a pile. No-op if the
+ * question was answered meanwhile, or if it is already the last message (the loop guard re-checked at
  * fire time, since the debounce window may have closed the gap).
  */
 async function repostPendingQuestionToBottom(key) {
@@ -1067,12 +1325,77 @@ async function repostPendingQuestionToBottom(key) {
         if (s.isPostInFlight)
             return;
         const oldMessageId = pending.messageId;
-        if (oldMessageId !== null) {
+        const oldQuestion = pending.data.questions[pending.currentIndex];
+        // The first message of the question is its record. A state that predates the mark has none: the message found is the
+        // original then, which is never deleted.
+        if (oldMessageId !== null)
+            pending.originalMessageId ??= oldMessageId;
+        await postPendingQuestionAt(key);
+        // The old message is touched only once there IS a copy below. A post that failed leaves the question where it was (its
+        // message id unchanged) and still answerable there.
+        const newMessageId = pendingQuestions.get(kStr)?.messageId ?? null;
+        if (oldMessageId === null || !oldQuestion || newMessageId === null || newMessageId === oldMessageId)
+            return;
+        if (oldMessageId === pending.originalMessageId) {
+            // The original: it stays as the record of the question, saying where the live copy is.
+            await closeQuestionMessage(key, oldMessageId, oldQuestion, 'askedAgain');
+        }
+        else {
+            // An earlier copy: the record already tells the question, so this one only duplicates it.
             await deleteThreadMessage(key, oldMessageId);
         }
-        await postPendingQuestionAt(key);
     });
 }
+/**
+ * @description The note a question's message ends with, by how it ended (see {@link QuestionClosing}). An answer's
+ * note is built where the chosen label is known (`agent.question_answered_note`).
+ */
+const questionClosingNoteKeys = {
+    unanswered: 'agent.question_unanswered_note',
+    askedAgain: 'agent.question_asked_again_note',
+};
+/**
+ * @description End a question's message in the topic WITHOUT deleting it: the buttons are replaced by `note`, and the
+ * header, the question and its options stay, so what the agent asked and how it ended can still be read. Resolves
+ * whether the text edit landed. Every way a question ends goes through this — a delete would take the record away.
+ *
+ * Telegram that cannot parse the Markdown render gets the plain one (no escape marks shown), and a question too long for
+ * the note gets a shortened plain one. An edit that still fails (the message gone, say) leaves the old text, and the
+ * buttons would stay on it dead — so they are taken off by themselves.
+ */
+async function editQuestionMessageToClosed(key, messageId, question, note) {
+    const markdownText = (0, openCodeQuestionFlow_1.buildClosedQuestionText)(question, note, escapeMarkdown);
+    const plainText = (0, openCodeQuestionFlow_1.buildClosedQuestionPlainText)(question, note, messageSplit_1.MAX_MESSAGE_LEN);
+    // A question that filled a message when it was asked has no room for the note under it, and Telegram refuses the text:
+    // the note is the result, so the body gives way (descriptions first) and goes out as plain text, which cutting cannot break.
+    const isEdited = markdownText.length <= messageSplit_1.MAX_MESSAGE_LEN
+        ? await editThreadMessage(key, messageId, markdownText, { parse_mode: 'Markdown' }, plainText)
+        : await editThreadMessage(key, messageId, plainText);
+    if (!isEdited)
+        await editThreadKeyboard(key, messageId, null, 'questionClose');
+    return isEdited;
+}
+/**
+ * {@link editQuestionMessageToClosed} for a question that ended some way ({@link QuestionEnd}). The note speaks the topic's
+ * language whatever called it — a boot or a session teardown runs in no request, so no locale is set by one.
+ */
+async function closeQuestionMessage(key, messageId, question, ending) {
+    const note = withThreadLocale(key, () => (typeof ending === 'string' ? (0, i18n_1.t)(questionClosingNoteKeys[ending]) : (0, i18n_1.t)('agent.question_answered_note', { answer: ending.answer })));
+    return editQuestionMessageToClosed(key, messageId, question, note);
+}
+/**
+ * @description End a question message the bot holds no record of — a copy a restart left while its re-ask was being sent, an
+ * older copy whose close Telegram refused — when somebody taps its buttons: its own text stays (`messageText`, as the tap
+ * delivered it) and «not answered» takes the place of the buttons, so the question does not end with no result at all. Without
+ * the text, or when the note does not fit under it, only the buttons come off. Resolves whether the message was changed at all
+ * (the text edit or the removal of the buttons landed): when not, the buttons are still there and the next tap tries again.
+ */
+async function closeOrphanQuestionMessage(key, messageId, messageText) {
+    const note = withThreadLocale(key, () => (0, i18n_1.t)(questionClosingNoteKeys.unanswered));
+    const closedText = messageText === null ? null : `${messageText}\n\n${note}`;
+    const isEdited = closedText !== null && closedText.length <= messageSplit_1.MAX_MESSAGE_LEN && await editThreadMessage(key, messageId, closedText);
+    return isEdited || editThreadKeyboard(key, messageId, null, 'reask');
+}
 // ── auto-retry after a provider-side API error (plan S4/S5/S6) ──
 /** One minute in ms — used only to render the "in N min" notices. */
 const apiRetryMsPerMinute = 60_000;
@@ -1172,6 +1495,13 @@ const wedgeRecoveriesInFlight = new Set();
  */
 function handleApiError(key, cls, options = {}) {
     const k = (0, sessionKey_1.keyToString)(key);
+    // The copy of a limit error that the adopt's replay reads: it ended a turn BEFORE this boot, and the boot recovery has armed
+    // that very episode (with the error's own time, which the replay cannot know). Handling it again announced a limit for a
+    // window that was over, and resumed the topic a second time.
+    if (cls.isReplayed === true && cls.kind === 'usageLimit' && limitEpisodesOwnedByRecovery.has(k)) {
+        console.log(`[limitRecovery] ${k}: the replayed limit error is the episode the recovery re-armed — not handled twice`);
+        return;
+    }
     // A used-up API credit balance: no wait refills it — the account is marked, and the chain or the operator takes over.
     if (cls.kind === 'usageLimit' && cls.isBalanceExhausted === true) {
         void handleBalanceExhausted(key, cls);
@@ -1927,8 +2257,45 @@ const awaitingSessionSelection = new Set();
  * on an invalid name so the user can retry.
  */
 const awaitingFolderName = new Set();
+/**
+ * The `/bind` picker message a «create new folder» tap came from, per thread: once the typed name is bound, that picker is
+ * deleted. Written only together with the arming of {@link awaitingFolderName}, and read only by the bind that arming
+ * leads to — so a leftover entry of an abandoned attempt is overwritten by the next tap.
+ */
+const bindPickerMessageIds = new Map();
+/** The `/bind` picker messages a bind or a leave holds (in flight or done), so a second tap on the same keyboard acts on nothing again. */
+const bindPickerClaims = new bindPickerClaims_1.BindPickerClaims(ENV.testTimings.bindPickerClaimLimit);
+/**
+ * The messages open in each topic that offer a bind or ask for a folder's name (every `/bind` picker, the «not bound» replies
+ * that carry one, the «create new folder» prompt): any bind or leave of the topic deletes them all — see
+ * {@link closeOpenBindMessages}. In memory: a picker sent before a restart is not known, and only its own tap removes it.
+ */
+const openBindMessages = new openBindMessages_1.OpenBindMessages();
+/**
+ * The welcome each topic last got (per topic, newest last): its ▶️ Claude / ▶️ OpenCode / 📋 Resume buttons act on the topic's
+ * CURRENT folder whatever the message says, so the next bind or a leave strips the buttons of the ones before. In memory, like
+ * {@link openBindMessages}: a welcome sent before a restart keeps its buttons. The same per-topic, bounded, timestamped list of
+ * message ids as {@link openBindMessages}, reused: these messages are never deleted, only stripped.
+ */
+const openWelcomeMessages = new openBindMessages_1.OpenBindMessages();
 /** Max sessions shown in a `/sessions` list (Telegram-friendly, plan S3). */
 const sessionsDisplayLimit = 10;
+/**
+ * @description Forum-topic names that arrived via `forum_topic_created`
+ * but couldn't be processed because the creator wasn't an authorised user
+ * (a group admin/creator) (audit S2 / #5). We can't read a thread's title
+ * later via Telegram Bot API in any portable way, so keeping the name here
+ * lets the first message from an authorised user trigger fuzzy auto-bind.
+ *
+ * Also holds the name of a topic an authorised user made (or renamed) that matched
+ * no folder, so the binding made through the picker later can keep it
+ * (`PendingTopicName.isFromAdmin`: only such a name may reach a binding).
+ *
+ * In-memory by design: this is a UX nicety, not a security boundary —
+ * losing the cache on restart just means the user has to bind manually
+ * once. The TTL guards against unbounded growth in a busy group where
+ * non-authorised members keep creating topics.
+ */
 const pendingTopicNames = new Map();
 const PENDING_TOPIC_NAME_TTL_MS = 24 * 60 * 60 * 1000;
 /**
@@ -1958,6 +2325,10 @@ const threadContextMarkers = new Map();
  */
 function clearThreadContextMarker(key) {
     threadContextMarkers.delete((0, sessionKey_1.keyToString)(key));
+    // The same boundary for the project board: the next turn start carries it whole (D20), and an inbox no tool call of
+    // this session will take is withdrawn.
+    noteTodoFreshContext(key);
+    discardTodoInbox(key);
 }
 function getThreadMessageState(key) {
     const k = (0, sessionKey_1.keyToString)(key);
@@ -2004,7 +2375,7 @@ function getOutputQueueState(key) {
     const k = (0, sessionKey_1.keyToString)(key);
     let s = outputQueues.get(k);
     if (!s) {
-        s = { pendingOutput: null, pendingIsContinuation: false, isProcessing: false, debounceTimer: null };
+        s = { pendingSegments: [], isProcessing: false, debounceTimer: null };
         outputQueues.set(k, s);
     }
     return s;
@@ -2025,7 +2396,7 @@ function checkIsOutputStreaming(key) {
     const q = outputQueues.get((0, sessionKey_1.keyToString)(key));
     if (!q)
         return false;
-    return q.pendingOutput !== null || q.isProcessing || q.debounceTimer !== null;
+    return (0, outputFlushPlan_1.checkHasPendingOutput)(q) || q.isProcessing || q.debounceTimer !== null;
 }
 function getStatusCoalesceState(key) {
     const k = (0, sessionKey_1.keyToString)(key);
@@ -2088,11 +2459,15 @@ function clearThreadQueues(key) {
     // `/quit` release, session `closed`/`stopped`, `/unbind`, and topic-delete —
     // all route through here. CRITICAL ORDER: finalize BEFORE
     // `clearThreadOutputQueues`, because the group finalize drains
-    // `q.pendingOutput` and the clear would otherwise null it first (S2). Both
+    // the pending segments and the clear would otherwise drop them first (S2). Both
     // transports capture + reset their in-flight state SYNCHRONOUSLY before any
     // await, so the clear below can't race the drain. Fire-and-forget.
     void getOutboundFor(key).finalize(key);
-    (0, clearThreadOutputQueues_1.clearThreadOutputQueues)(outputQueues.get(k), statusCoalescers.get(k));
+    const queue = outputQueues.get(k);
+    // Text that took the new-message mark and is dropped unsent leaves the mark with the thread again.
+    if (queue?.pendingSegments.some((segment) => segment.startsNewMessage))
+        markNeedsNewMessage(key);
+    (0, clearThreadOutputQueues_1.clearThreadOutputQueues)(queue, statusCoalescers.get(k));
     // A new session starts with empty context — forget the last-sent outputs so
     // the identical-output backstop can't suppress a legitimate repeat across a
     // session boundary (the same convergence point that clears the other
@@ -2365,6 +2740,7 @@ function clearInMemoryThreadState(key) {
         disconnectProviderLists.delete(pickerKey);
     }
     awaitingFolderName.delete(k);
+    bindPickerMessageIds.delete(k);
     pinnedStatusTextCache.delete(k);
     statusCoalescers.delete(k);
     // `clearThreadQueues` → `finalizeInFlight` above already finalized any accumulated
@@ -2764,11 +3140,17 @@ async function replyToThread(key, text, extra = {}, options = {}) {
         const send = () => bot.telegram.sendMessage((0, sessionKeyCodec_1.getTelegramChatId)(key), text, sendExtra);
         return options.unpaced ? (0, rateLimiter_1.sendUnpaced)(key, send) : (0, rateLimiter_1.enqueueSend)(key, send);
     };
-    try {
-        const sent = await sendOnce(buildSendExtra(key, extra));
+    // A sent message is tracked for `/clear_messages`, and a `/bind` picker is remembered to be closed by the next bind or leave.
+    const trackSent = async (sent) => {
         const messageId = sent.message_id;
         await state.pushMessageId(key, messageId);
+        if ((0, bindPicker_1.checkIsBindPickerExtra)(extra))
+            openBindMessages.remember((0, sessionKey_1.keyToString)(key), messageId, Date.now());
         return messageId;
+    };
+    const releaseSecret = options.isSecret ? (0, outputTrace_1.markOutboundTextSecret)(text) : null;
+    try {
+        return await trackSent(await sendOnce(buildSendExtra(key, extra)));
     }
     catch (e) {
         // Markdown parse failure fallback. Several `t(...)` templates interpolate
@@ -2786,10 +3168,7 @@ async function replyToThread(key, text, extra = {}, options = {}) {
             const plainExtra = { ...extra };
             delete plainExtra.parse_mode;
             try {
-                const sent = await sendOnce(buildSendExtra(key, plainExtra));
-                const messageId = sent.message_id;
-                await state.pushMessageId(key, messageId);
-                return messageId;
+                return await trackSent(await sendOnce(buildSendExtra(key, plainExtra)));
             }
             catch (e2) {
                 await handleSendError(key, e2);
@@ -2804,6 +3183,9 @@ async function replyToThread(key, text, extra = {}, options = {}) {
         await handleSendError(key, e);
         return null;
     }
+    finally {
+        releaseSecret?.();
+    }
 }
 /**
  * @description Edit an existing assistant message in the thread.
@@ -2811,13 +3193,17 @@ async function replyToThread(key, text, extra = {}, options = {}) {
  * Returns `true` on success, `false` if the edit failed for any reason —
  * caller decides whether to fall back to a new `replyToThread`. We don't
  * track edits as new ids (the original was already tracked).
+ *
+ * `plainFallbackText`: the text for the retry without `parse_mode` when Telegram cannot parse the Markdown one — the
+ * same text when absent, which shows a Markdown render's escape marks as they are; a caller that has a real plain
+ * rendering passes it.
  */
-async function editThreadMessage(key, messageId, text, extra = {}) {
+async function editThreadMessage(key, messageId, text, extra = {}, plainFallbackText = text) {
     if (!checkIsTelegramPrimitiveKey(key, 'editThreadMessage'))
         return false;
-    const editOnce = (editExtra) => (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.editMessageText((0, sessionKeyCodec_1.getTelegramChatId)(key), messageId, undefined, text, editExtra));
+    const editOnce = (editText, editExtra) => (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.editMessageText((0, sessionKeyCodec_1.getTelegramChatId)(key), messageId, undefined, editText, editExtra));
     try {
-        await editOnce(extra);
+        await editOnce(text, extra);
         return true;
     }
     catch (e) {
@@ -2837,7 +3223,7 @@ async function editThreadMessage(key, messageId, text, extra = {}) {
             const plainExtra = { ...extra };
             delete plainExtra.parse_mode;
             try {
-                await editOnce(plainExtra);
+                await editOnce(plainFallbackText, plainExtra);
                 return true;
             }
             catch (e2) {
@@ -2852,14 +3238,63 @@ async function editThreadMessage(key, messageId, text, extra = {}) {
         return false;
     }
 }
-async function deleteThreadMessage(key, messageId) {
+/**
+ * @description Replace the inline keyboard of a message of the thread (`null` removes it) through the paced send queue.
+ * Returns `true` when the keyboard is as asked — a no-change edit («message is not modified») counts — and `false`
+ * when the edit failed, which is logged under `logTag` and left to the caller to act on (a re-render may simply skip it).
+ */
+async function editThreadKeyboard(key, messageId, keyboard, logTag) {
+    if (!checkIsTelegramPrimitiveKey(key, 'editThreadKeyboard'))
+        return false;
+    try {
+        await (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.editMessageReplyMarkup((0, sessionKeyCodec_1.getTelegramChatId)(key), messageId, undefined, keyboard ?? undefined));
+        return true;
+    }
+    catch (e) {
+        const desc = (0, sendErrorClassifier_1.checkIsApiError)(e) ? (0, sendErrorClassifier_1.getErrorDescription)(e) : '';
+        if (/message is not modified/i.test(desc))
+            return true;
+        console.warn(`[${logTag}] keyboard edit failed:`, desc || e);
+        return false;
+    }
+}
+async function deleteThreadMessageDetailed(key, messageId) {
     if (!checkIsTelegramPrimitiveKey(key, 'deleteThreadMessage'))
-        return;
+        return 'stayed';
     try {
         await (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.deleteMessage((0, sessionKeyCodec_1.getTelegramChatId)(key), messageId));
+        return 'deleted';
+    }
+    catch (e) {
+        return (0, telegramError_1.checkIsMessageNotFoundError)(e) ? 'gone' : 'stayed';
+    }
+}
+/**
+ * @description Delete a message of the thread. Resolves `false` when it is still there — older than 48 hours, refused, or no
+ * Telegram topic's key — which a caller that needs it gone can act on.
+ */
+async function deleteThreadMessage(key, messageId) {
+    return (await deleteThreadMessageDetailed(key, messageId)) === 'deleted';
+}
+/** The most message ids one `deleteMessages` call takes (the Bot API documents 1-100). */
+const deleteMessagesPerCallLimit = 100;
+/**
+ * @description Delete several messages of the thread in ONE paced send (`deleteMessages`: «if some of the specified messages
+ * can't be found, they are skipped»). Resolves `true` when the call went through; `false` when Telegram refused it — the docs do
+ * not say what it does with a message that is there but may not be deleted — and the caller tries the messages one by one.
+ */
+async function deleteThreadMessages(key, messageIds) {
+    if (!checkIsTelegramPrimitiveKey(key, 'deleteThreadMessages'))
+        return false;
+    try {
+        for (let start = 0; start < messageIds.length; start += deleteMessagesPerCallLimit) {
+            const chunk = messageIds.slice(start, start + deleteMessagesPerCallLimit);
+            await (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.deleteMessages((0, sessionKeyCodec_1.getTelegramChatId)(key), chunk));
+        }
+        return true;
     }
     catch {
-        /* messages older than 48h or already deleted — silently ignore */
+        return false;
     }
 }
 /**
@@ -2941,7 +3376,7 @@ function startTypingLoader(key) {
             const q = outputQueues.get((0, sessionKey_1.keyToString)(key));
             console.warn(`[typing] ${(0, sessionKey_1.keyToString)(key)} force-stop: kept alive by leaked output-queue state — ` +
                 `isOutputStreaming=${checkIsOutputStreaming(key)} isAdapterBusy=${checkIsAdapterBusy(key)} ` +
-                `pendingOutput=${q?.pendingOutput !== null && q?.pendingOutput !== undefined} ` +
+                `pendingOutput=${q !== undefined && (0, outputFlushPlan_1.checkHasPendingOutput)(q)} ` +
                 `isProcessing=${q?.isProcessing === true} debounceTimer=${q?.debounceTimer !== null && q?.debounceTimer !== undefined}`);
             if (q?.debounceTimer) {
                 clearTimeout(q.debounceTimer);
@@ -2968,7 +3403,7 @@ function checkIsTypingLoopStuck(key) {
         isAdapterBusy: checkIsAdapterBusy(key),
         isCompacting: checkIsThreadCompacting(key),
         isTransportStreaming: getOutboundFor(key).checkIsDelivering(key),
-        hasPendingOutput: q?.pendingOutput != null,
+        hasPendingOutput: q !== undefined && (0, outputFlushPlan_1.checkHasPendingOutput)(q),
         isProcessing: q?.isProcessing === true,
         hasDebounceTimer: q?.debounceTimer != null,
     });
@@ -3033,7 +3468,7 @@ function escapeMarkdown(text) {
  * @description Queue an output text for a thread with debounce.
  *
  * Multiple `output` events from the adapter are coalesced into one pending
- * buffer (see {@link appendPendingOutput}), not overwritten — every emitted
+ * buffer (see {@link addPendingOutput}), not overwritten — every emitted
  * chunk reaches Telegram. A continuation tail concatenates as-is (it may be
  * cut mid-word); a standalone output joins the buffer with `\n`. The first
  * batch's `isContinuation` is recorded so the flush knows whether the buffer
@@ -3069,11 +3504,9 @@ function getOutputDelay(chatId) {
  */
 function queueOutput(key, output, isContinuation = false, isFinal = false, isComplete = false, startsNewParagraph = false) {
     const q = getOutputQueueState(key);
-    // The continuation flag of the FIRST batch in a fresh buffer decides whether
-    // the whole flush extends the last sent message; later batches only append.
-    if (q.pendingOutput === null)
-        q.pendingIsContinuation = isContinuation;
-    q.pendingOutput = (0, outputFlushPlan_1.appendPendingOutput)(q.pendingOutput, output, isContinuation, startsNewParagraph);
+    // A batch joins the newest pending segment; one queued after a turn boundary was marked starts a segment of its own, which
+    // opens a new message, and leaves the earlier segment to flush where it was going.
+    (0, outputFlushPlan_1.addPendingOutput)(q, getThreadMessageState(key), { output, isContinuation, startsNewParagraph });
     // `isFinal` / `isComplete` still drive the immediate-flush timing below (a
     // finished turn must not wait out the debounce) — they no longer mark the
     // buffer for redelivery (retired with the global send pacer, S4).
@@ -3098,7 +3531,8 @@ function queueOutput(key, output, isContinuation = false, isFinal = false, isCom
         // S3: scale the in-cooldown debounce to the live remaining cooldown.
         remainingCooldownMs: (0, rateLimiter_1.getRateLimitRemainingMs)((0, sessionKeyCodec_1.getTelegramChatId)(key)),
     });
-    if (timing === 'now') {
+    // An earlier segment, sealed by a boundary, has nothing more to wait for: its turn is over.
+    if (timing === 'now' || q.pendingSegments.length > 1) {
         // Final frame: flush immediately. `processOutputQueue` already guards
         // `isProcessing`, so this is idempotent if a flush is mid-flight (the
         // pending frame will be picked up by the re-trigger timer it arms).
@@ -3112,14 +3546,14 @@ function queueOutput(key, output, isContinuation = false, isFinal = false, isCom
 }
 async function processOutputQueue(key) {
     const q = getOutputQueueState(key);
-    if (q.isProcessing || !q.pendingOutput)
+    if (q.isProcessing || !(0, outputFlushPlan_1.checkHasPendingOutput)(q))
         return;
     q.isProcessing = true;
     try {
-        const out = q.pendingOutput;
-        const isContinuation = q.pendingIsContinuation;
-        q.pendingOutput = null;
-        const { unsentRemainder } = await sendOutputImmediate(key, out, isContinuation);
+        const flush = (0, outputFlushPlan_1.takePendingOutput)(q);
+        if (!flush)
+            return;
+        const { unsentRemainder } = await sendOutputImmediate(key, flush.output, flush.isContinuation, flush.startsNewMessage);
         // No silent drop: a chunk dropped on a 429 after the retry-after wait comes
         // back as `unsentRemainder`. Put it BACK at the FRONT of the buffer (it is
         // older than anything that arrived during the await) so the re-trigger flush
@@ -3127,17 +3561,12 @@ async function processOutputQueue(key) {
         // `getUnsentRemainder`, so this never re-sends what already reached Telegram.
         // The remainder restarts a fresh message (its predecessors landed / edited in
         // place already), so it is NOT a continuation.
-        if (unsentRemainder) {
-            q.pendingOutput =
-                q.pendingOutput === null
-                    ? unsentRemainder
-                    : (0, outputFlushPlan_1.appendPendingOutput)(unsentRemainder, q.pendingOutput, false);
-            q.pendingIsContinuation = false;
-        }
+        if (unsentRemainder)
+            (0, outputFlushPlan_1.requeueUnsentRemainder)(q, unsentRemainder);
     }
     finally {
         q.isProcessing = false;
-        if (q.pendingOutput) {
+        if ((0, outputFlushPlan_1.checkHasPendingOutput)(q)) {
             // Audit S13 / #30: the re-trigger `setTimeout` used to be a bare
             // call whose handle was never stored. A `queueOutput` call between
             // here and the timer firing would `clearTimeout(null)` and
@@ -3149,7 +3578,7 @@ async function processOutputQueue(key) {
             q.debounceTimer = setTimeout(() => {
                 q.debounceTimer = null;
                 processOutputQueue(key);
-            }, getOutputDelay((0, sessionKeyCodec_1.getTelegramChatId)(key)));
+            }, q.pendingSegments.length > 1 ? 0 : getOutputDelay((0, sessionKeyCodec_1.getTelegramChatId)(key)));
         }
     }
 }
@@ -3158,7 +3587,7 @@ async function processOutputQueue(key) {
  * coalesced-but-unsent output against what actually landed, and force-send the
  * remainder so the agent's FINAL answer is never discarded on teardown (S2).
  *
- * Today the group output queue coalesces into `q.pendingOutput` and the
+ * Today the group output queue coalesces into `q.pendingSegments` and the
  * (possibly 429-stretched) debounce flushes it later; a teardown
  * (`idle`/`isFinal` → `handleAgentStopped`, `/new`, `/quit`, `/unbind`,
  * topic-delete) runs `clearThreadOutputQueues` which DISCARDS that buffer — so
@@ -3180,20 +3609,23 @@ async function finalizeGroupOutput(key) {
     const plan = (0, groupFinalizePlan_1.getGroupFinalizePlan)(q);
     if (plan.action === 'noop')
         return; // fully delivered → no-op, no dupe.
-    // Snapshot is captured by the plan; null the buffer SYNCHRONOUSLY before the
+    // Snapshot is captured by the plan; empty the buffer SYNCHRONOUSLY before the
     // await so the immediately-following clear / a concurrent flush can't re-send it.
-    q.pendingOutput = null;
+    q.pendingSegments = [];
     if (q.debounceTimer) {
         clearTimeout(q.debounceTimer);
         q.debounceTimer = null;
     }
-    const { unsentRemainder } = await sendOutputImmediate(key, plan.text, plan.isContinuation);
-    // A remainder that still 429'd at teardown is dropped (the buffer is being
-    // torn down anyway — unchanged from the pre-S2 discard). Do NOT re-queue: the
-    // queue is about to be cleared, and re-queuing would race that clear. At 1/2s
-    // global pacing a 429 here is essentially impossible.
-    if (unsentRemainder) {
-        console.warn(`[send] ${(0, sessionKey_1.keyToString)(key)} finalize remainder 429'd and was dropped at teardown`);
+    for (const segment of plan.segments) {
+        const { unsentRemainder } = await sendOutputImmediate(key, segment.output, segment.isContinuation, segment.startsNewMessage);
+        // A remainder that still 429'd at teardown is dropped (the buffer is being
+        // torn down anyway — unchanged from the pre-S2 discard), and so is everything behind it. Do NOT re-queue: the
+        // queue is about to be cleared, and re-queuing would race that clear. At 1/2s
+        // global pacing a 429 here is essentially impossible.
+        if (unsentRemainder) {
+            console.warn(`[send] ${(0, sessionKey_1.keyToString)(key)} finalize remainder 429'd and was dropped at teardown`);
+            return;
+        }
     }
 }
 /**
@@ -3210,12 +3642,17 @@ async function finalizeGroupOutput(key) {
  * previous text on the same message id, so the user could read only the last
  * tail. Editing is now reserved for explicit continuations of the SAME reply.
  *
+ * `startsNewMessage`: the text was queued after a turn boundary, so it opens a
+ * message of its own — decided when the text was queued ({@link addPendingOutput}),
+ * not read from the thread here, where a flush of EARLIER text finishing after the
+ * boundary would have spent the mark.
+ *
  * On Markdown rejection by Telegram we fall back to plain text (`parse_mode`
  * unset) — the message lands either way. If the in-place edit fails (message
  * deleted / API hiccup) we send every chunk fresh so the full combined text
  * still reaches the user.
  */
-async function sendOutputImmediate(key, output, isContinuation = false) {
+async function sendOutputImmediate(key, output, isContinuation = false, startsNewMessage = false) {
     // The typing loader is stopped upstream in `handleAgentOutput` (the shared
     // onOutput entry for BOTH transports), so it's not repeated here.
     await deleteStatusMessage(key);
@@ -3223,7 +3660,7 @@ async function sendOutputImmediate(key, output, isContinuation = false) {
     const { chunks: planChunks, shouldEditFirstChunk } = (0, outputFlushPlan_1.getOutputFlushPlan)({
         output,
         isContinuation,
-        needsNewMessage: msgState.needsNewMessage,
+        needsNewMessage: startsNewMessage,
         lastMessageId: msgState.lastMessageId,
         lastMessageText: msgState.lastMessageText,
     });
@@ -3261,7 +3698,6 @@ async function sendOutputImmediate(key, output, isContinuation = false) {
             break;
         msgState.lastMessageId = id;
         msgState.lastMessageText = chunks[i];
-        msgState.needsNewMessage = false;
         sentCount = i + 1;
     }
     // S3: output just landed below any pending question — bring the question back
@@ -3399,7 +3835,7 @@ const shutdownOutputFlushMaxMs = rateLimiter_1.shutdownDrainMaxMs + 1000;
  * already-emitted answer chunks died in the send pipeline with the
  * process and were never re-sent). Two buffers drain, in order:
  *
- *  [A] per-thread COALESCE state — the group/baseline `q.pendingOutput`
+ *  [A] per-thread COALESCE state — the group/baseline `q.pendingSegments`
  *      buffers (enumerated here from {@link outputQueues}) and the DM
  *      transport's active drafts (enumerated via `getInFlightThreadKeys`) —
  *      each finalized to a permanent message via the transport's
@@ -3429,7 +3865,7 @@ async function finalizePendingOutputOnShutdown() {
         // queues + the connector's own unfinalized content (deduped by serialised key).
         const pendingKeys = new Map();
         for (const [keyStr, q] of outputQueues) {
-            if (q.pendingOutput === null)
+            if (!(0, outputFlushPlan_1.checkHasPendingOutput)(q))
                 continue;
             try {
                 pendingKeys.set(keyStr, (0, sessionKey_1.keyFromString)(keyStr));
@@ -3447,11 +3883,11 @@ async function finalizePendingOutputOnShutdown() {
         // A DM-surface thread on a non-draft adapter (e.g. terminal) coalesces via
         // the group `queueOutput` path, but its transport finalize handled only the
         // draft — drain any such leftover buffer directly. Group keys were already
-        // drained above (their finalize nulls `pendingOutput` synchronously), so
+        // drained above (their finalize empties the pending segments synchronously), so
         // this is a no-op for them.
         const leftoverDrains = [];
         for (const [keyStr, q] of outputQueues) {
-            if (q.pendingOutput === null)
+            if (!(0, outputFlushPlan_1.checkHasPendingOutput)(q))
                 continue;
             try {
                 leftoverDrains.push(finalizeGroupOutput((0, sessionKey_1.keyFromString)(keyStr)));
@@ -3663,7 +4099,7 @@ function stopAllAdaptersFor(key, adapterNames) {
     return (0, createAdapter_1.stopAllAdaptersFor)(key, createAdapter_1.getAdapter, adapterNames);
 }
 /**
- * @description Explicit-stop teardown used by `/new`/`/clear_session`:
+ * @description Explicit-stop teardown used by `/new`:
  * sweep every adapter active for the thread, then RELEASE the persisted session
  * ids (even when nothing was running) so a later bot restart won't auto-reattach
  * and any half-dead state from a crash/SSE-giveup is cleared. The session stays
@@ -3687,9 +4123,18 @@ async function releaseThreadSession(key) {
     // Claude / no pending question.
     (0, createAdapter_1.getThreadAdapter)(key).rejectQuestion?.(key);
     const result = stopAllAdaptersFor(key);
-    await state.clearAgentSessionIds(key);
+    await releaseConversationIds(key);
     return result;
 }
+/**
+ * @description Release a conversation for good: its saved session ids go, so nothing resumes it, and the question the idle
+ * compaction re-asked for it is closed (its message stays, without its buttons). A conversation that is asleep has no process
+ * whose stop would say so, so the release itself has to — every release of a conversation that may be asleep goes through here.
+ */
+async function releaseConversationIds(key) {
+    await state.clearAgentSessionIds(key);
+    clearThreadCompaction(key);
+}
 /**
  * @description Switch a thread's adapter and clear the previous adapter's
  * persisted session id, so a later restart can't re-attach to the wrong
@@ -3712,8 +4157,11 @@ async function switchThreadAdapter(key, newName) {
     // Another agent or a shell takes the topic over: the open request belonged to
     // the old conversation, so it closes silently instead of a later wake-up
     // reminding (or, in a terminal, TYPING into) a session that never saw it.
-    if (prevName && !(0, createAdapter_1.checkIsSameConversationSwitch)(prevName, newName))
+    if (prevName && !(0, createAdapter_1.checkIsSameConversationSwitch)(prevName, newName)) {
         cancelConversationRequest(key);
+        // Nor does the conversation left behind get its re-asked question answered: its buttons would send the label into the new one.
+        closeReAskedQuestion(key);
+    }
     let switchCutOffWork = null;
     if (prevName && prevName !== newName) {
         try {
@@ -3848,8 +4296,8 @@ function getStartReadyMessage(adapter, subdir, args, model, effort) {
     return (0, i18n_1.t)('agent.ready', { ...vars, infoBlock: getStartReadyInfoBlock(model, effort) });
 }
 /**
- * The bot-MCP tool digest per platform, from the scheduler handle once it is wired
- * at boot; `null` before that (no digest is persisted, which reads as stale).
+ * The bot-MCP tool digest of a conversation (its platform's tools, its «Bot skills» instructions), from the scheduler handle
+ * once it is wired at boot; `null` before that (no digest is persisted, which reads as stale).
  */
 let botMcpToolDigestReader = null;
 /**
@@ -3889,7 +4337,7 @@ function getPerTurnRefusal(key) {
 async function persistSessionStart(key, adapter) {
     await (0, persistAdapterSessionIds_1.persistAdapterSessionIds)(key, adapter, state);
     if ((0, adapterNames_1.checkIsJsonStreamBackend)(adapter.name) && botMcpToolDigestReader) {
-        await state.setAgentMcpToolDigest(key, botMcpToolDigestReader(key.platform));
+        await state.setAgentMcpToolDigest(key, botMcpToolDigestReader(key));
     }
 }
 /**
@@ -4231,6 +4679,11 @@ const autoStopUnsupportedLoggedKeys = new Set();
  * and that turn ends here too) or the process still works (a background task,
  * input not yet taken in). The session sleeps; the next trigger resumes it with
  * the prompt cache warm.
+ *
+ * The stop is QUEUED here, in the same tick the adapter marks the turn done (nothing awaits in between): a
+ * `postToSession` that polled the session idle and ensures it again (`postToSession.ts`) therefore always finds
+ * the stop already on the transition queue and runs after it. Keep it that way — an await ahead of the queueing
+ * would let that ensure run beside the stop and forward to the process it ends.
  */
 function handleAgentTurnEnded(key) {
     noteThreadActivity(key);
@@ -4273,7 +4726,7 @@ async function replayBufferedPrompts(key) {
     // like the API-error retry's nudge, hears whether it reached the session).
     await startupPromptBuffer.replayPrompts((0, sessionKey_1.keyToString)(key), {
         isSessionActive,
-        forward: (prompt) => forwardPromptToAgent(key, adapter, prompt),
+        forward: async (prompt) => { await forwardPromptToAgent(key, adapter, prompt); },
     });
     if (!isSessionActive)
         return;
@@ -4307,17 +4760,61 @@ async function replayBufferedPrompts(key) {
  * `session.status=retry` will not read queued prompts until the provider retry
  * time, so a new prompt aborts that stale wait before using the current model.
  * An adapter without the method forwards directly.
+ *
+ * Resolves where the prompt went (`LatePromptOutcome`): `forwarded` to the session, `buffered` behind a stop window, `noSession`
+ * (nothing to take it; the person was told), `dropped` (a technical prompt found no live idle session). Only a prompt that waited
+ * for an adopt replay can come out as anything but `forwarded`; most callers have no use for the answer.
  */
 async function forwardPromptToAgent(key, adapter, text, sentAtMs, options = {}) {
+    // An adopted session replays what its process wrote during the downtime first: a prompt written meanwhile would reset
+    // the answer and error state those frames still use, and the replayed text would join the new reply's message (the
+    // «new message» mark would go to the replayed text). Nothing is awaited when no replay is pending: the forward then runs
+    // in the caller's tick, as it always did — an await ahead of it would let a stop queued meanwhile begin first.
+    if (!adapter.checkIsAdoptReplayPending?.(key)) {
+        await forwardPromptToLiveAgent(key, adapter, text, sentAtMs, options);
+        return 'forwarded';
+    }
+    await (0, adoptReplayGate_1.waitForAdoptedReplay)(adapter, key);
+    // The wait let the replay run: the replayed turn's end may have queued the per-turn stop, which holds the window open and
+    // ends the process — a prompt written now would go to a process being killed and be lost. Routed again, as a late prompt is.
+    // A technical prompt (the standalone todo reminder) goes only into a session that is live and idle now, and is otherwise
+    // dropped without a word: never buffered, never a resume, never a "no session" line to the person.
+    const isTechnicalPrompt = options.isTechnicalPrompt === true;
+    const outcome = await (0, promptDelivery_1.deliverLatePrompt)({
+        isTechnical: isTechnicalPrompt,
+        checkIsWindowOpen: () => startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key)),
+        checkIsSessionActive: () => adapter.checkIsActive(key) && !(isTechnicalPrompt && (adapter.checkIsBusy?.(key) ?? false)),
+        buffer: async () => {
+            await deliverPromptOrBuffer(key, `${options.requestHeader ?? ''}${getPromptWithThreadReplyQuote(key, text, options.replyContext)}`, true);
+        },
+        wake: () => wakeSleepingSessionForPrompt(key),
+        forward: async () => {
+            await forwardPromptToLiveAgent(key, (0, createAdapter_1.getThreadAdapter)(key), text, sentAtMs, options);
+            return 'forwarded';
+        },
+        reportNoSession: async (isAlreadyTold) => {
+            console.warn(`[adopt] ${(0, sessionKey_1.keyToString)(key)}: no session is left to take the prompt that waited for the replay; it is dropped`);
+            if (!isAlreadyTold)
+                await replyToThread(key, (0, i18n_1.t)('agent.no_session'));
+        },
+    });
+    if (outcome === 'dropped')
+        console.log(`[adopt] ${(0, sessionKey_1.keyToString)(key)}: the technical prompt found no live, idle session after the replay wait; it is dropped`);
+    return outcome;
+}
+/** @description The forward itself, for a session that is ready to take the prompt: {@link forwardPromptToAgent} minus the replay wait. */
+async function forwardPromptToLiveAgent(key, adapter, text, sentAtMs, options = {}) {
     // A forwarded prompt is thread activity — reset the compact-on-idle watchdog (F2).
     noteThreadActivity(key);
+    const isTechnicalPrompt = options.isTechnicalPrompt ?? false;
     // Skip slash commands (not worth replaying), the recovery replay itself (keeps
-    // the once-per-episode guard intact) and a request reminder (the request's own
-    // prompt stays the one to replay).
+    // the once-per-episode guard intact), a request reminder (the request's own
+    // prompt stays the one to replay) and a bot-made technical prompt.
     const isReplayable = (0, wedgeRecovery_1.checkIsReplayablePrompt)({
         isSlashCommand: (0, threadContextPreamble_1.checkShouldSkipPreambleForText)(text),
         isRecoveryReplay: options.isRecoveryReplay ?? false,
         isRequestReminder: options.isRequestReminder ?? false,
+        isTechnicalPrompt,
     });
     // R23: prompts held during a usage-limit wait ride the first such prompt
     // forwarded to a live session once no wait holds them — after it, in arrival
@@ -4366,6 +4863,18 @@ async function forwardPromptToAgent(key, adapter, text, sentAtMs, options = {})
     if (state.checkIsTimestampsEnabled(key) && !(0, threadContextPreamble_1.checkShouldSkipPreambleForText)(text)) {
         promptText = `${(0, isoTimestamp_1.formatIsoLocalOffset)(sentAtMs ?? Date.now())}\n\n${promptText}`;
     }
+    // The project board rides every turn start the bot makes (D20: whole on a fresh context, else only what changed),
+    // then the todo list's staleness reminder rides the next real prompt from any source (D11 form a) — never a slash
+    // command or a shell line; the reminder never rides the standalone reminder itself.
+    const isTodoDecorated = !(0, threadContextPreamble_1.checkShouldSkipPreambleForText)(text) && adapter.name !== 'terminal';
+    if (isTodoDecorated)
+        discardTodoInbox(key);
+    const todoBoardBlock = isTodoDecorated ? takeTodoPromptBoard(key) : null;
+    if (todoBoardBlock !== null)
+        promptText = `${promptText}\n\n${todoBoardBlock}`;
+    const todoReminderLine = isTodoDecorated && !isTechnicalPrompt ? takeTodoPromptReminder(key) : null;
+    if (todoReminderLine !== null)
+        promptText = `${promptText}\n\n${todoReminderLine}`;
     markNeedsNewMessage(key);
     // A new prompt is a new turn: lift the S2 idle-suppress latch and re-base the
     // working-status elapsed so the next busy period shows a fresh 0:00 counter
@@ -4380,7 +4889,8 @@ async function forwardPromptToAgent(key, adapter, text, sentAtMs, options = {})
     // persists while output is streaming OR the agent is busy — self-stopping only
     // when the topic drains + idles.
     getOutboundFor(key).setActivity(key, 'working');
-    if (adapter.interruptAndWaitIdle) {
+    // A technical prompt is posted only into an idle session: there is no turn to interrupt or sub-agent to detach.
+    if (adapter.interruptAndWaitIdle && !isTechnicalPrompt) {
         await adapter.interruptAndWaitIdle(key);
     }
     // OpenCode: if a sub-agent is synchronously blocking this session, detach it to
@@ -4388,7 +4898,7 @@ async function forwardPromptToAgent(key, adapter, text, sentAtMs, options = {})
     // the whole (possibly long) sub-agent run — the sub-agent keeps working and its
     // result is injected back when it finishes. No-op for other adapters and when
     // no sub-agent is running. Best-effort; never blocks the forward on failure.
-    if (adapter.detachRunningSubagents) {
+    if (adapter.detachRunningSubagents && !isTechnicalPrompt) {
         await adapter.detachRunningSubagents(key);
     }
     adapter.sendInput(key, promptText);
@@ -4567,6 +5077,7 @@ const botCore = {
     getState: () => state,
     replyToThread,
     editThreadMessage,
+    editThreadKeyboard,
     deleteThreadMessage,
     authoriseContext,
     withThreadLocale,
@@ -4575,17 +5086,25 @@ const botCore = {
     cancelConversationRequest,
     wakeSleepingSession,
 };
-const { checkIsThreadCompacting, noteThreadActivity, noteThreadUserActivity, markThreadTurnProducedOutput, clearThreadCompaction, rearmThreadIdleTimer, armDeferredCompaction, checkIsDeferredCompactionArmed, threadsCompacting, reAskedQuestionOptions, registerCompactionCommands, registerCompactionCallbacks, } = (0, compaction_1.createCompaction)({
+const { checkIsThreadCompacting, noteThreadActivity, noteThreadUserActivity, markThreadTurnProducedOutput, clearThreadCompaction, rearmThreadIdleTimer, armDeferredCompaction, checkIsDeferredCompactionArmed, threadsCompacting, answerReAskedQuestionByNumber, reAskInterruptedQuestion, restoreReAskedQuestion, closeSavedReAskedQuestion, closeReAskedQuestion, registerCompactionCommands, registerCompactionCallbacks, } = (0, compaction_1.createCompaction)({
     ...botCore,
     startTypingLoader,
-    forwardPromptToAgent,
+    forwardPromptToAgent: async (key, adapter, text) => { await forwardPromptToAgent(key, adapter, text); },
     pendingQuestions,
     clearPendingQuestion,
+    closeQuestionMessage,
     idleWindowMs: (0, compactOnIdle_1.getAgentIdleMs)(process.env.AGENT_IDLE_MINUTES),
     checkIsLimitWaitArmed: (key) => getArmedApiRetry(key)?.kind === 'usageLimit',
     suspendThreadSession,
     // L-D7: a sleeping per-turn session is woken for its idle compaction — a resume only, never a fresh start.
     resumeSleepingSessionForCompaction: async (key) => (await ensureAgentSession(key, { isResumeOnly: true })).ok && (0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key),
+    getThreadAdapter: createAdapter_1.getThreadAdapter,
+    // An answer to the agent's own question is never a request (S7), even delivered as a prompt.
+    deliverLabel: (key, label) => withThreadLocale(key, () => deliverActivePrompt(key, (0, createAdapter_1.getThreadAdapter)(key), label, null)),
+    resumeSleepingSessionForPrompt: (key) => resumeSleepingSessionForPrompt(key),
+    checkIsStarting: (key) => startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key)),
+    closeOrphanQuestionMessage,
+    notePersonActivity,
 });
 /**
  * @description True iff the neutral router owns `name`, i.e. a `/name` message
@@ -4703,6 +5222,11 @@ command('start', async (_ctx, key) => {
         '/quit — quit current agent\n' +
         '/status — show status');
 });
+/** The `/status` agent line (`Claude Code (claude)`), flagged when the backend is the deprecated tmux one. */
+function formatStatusAgentLine(label, adapterName) {
+    const agentLine = `${label} (${adapterName})`;
+    return adapterName === adapterNames_1.claudeTmuxAdapterName ? (0, i18n_1.t)('status.thread_agentTmuxDeprecated', { agent: agentLine }) : agentLine;
+}
 command('status', async (_ctx, key) => {
     // In General the per-thread status is meaningless (no binding ever) — so
     // we promote /status to a workspace-wide overview there. Topical threads
@@ -4725,7 +5249,7 @@ command('status', async (_ctx, key) => {
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     const isActive = adapter.checkIsActive(key);
     const adapterName = (0, createAdapter_1.getThreadAdapterNameRaw)(key);
-    const agentLine = adapterName ? `${adapter.label} (${adapterName})` : (0, i18n_1.t)('status.thread_no_agent');
+    const agentLine = adapterName ? formatStatusAgentLine(adapter.label, adapterName) : (0, i18n_1.t)('status.thread_no_agent');
     const binding = state.getBinding(key);
     const subdir = binding?.subdir ?? (0, i18n_1.t)('status.thread_no_binding');
     let workDir = null;
@@ -4901,6 +5425,19 @@ command('timezone', async (_ctx, key, parsed) => {
     const view = buildTimezoneRegionView();
     await replyToThread(key, view.text, view.keyboard);
 });
+/**
+ * @description How the welcome's shared-folder row writes `peerKey`, a topic of the SAME chat as the one being bound: by the
+ * name stored on its binding, else by the link that opens it (a person can follow it; a session key means nothing to them).
+ * The link is the numeric `t.me/c/…` form, which opens a topic for any member of the group. `null` for a topic that can be
+ * neither named nor linked (a thread of a private chat, say) — it is only counted, never shown as an id.
+ */
+function describeSharedTopic(peerKey) {
+    const name = state.getBinding(peerKey)?.topicName;
+    const link = (0, topicCommand_1.buildTopicLink)({ chatId: (0, sessionKeyCodec_1.getTelegramChatId)(peerKey), username: null }, (0, sessionKeyCodec_1.getTelegramThreadId)(peerKey));
+    if (name === undefined && link === null)
+        return null;
+    return { name, link: link ?? '' };
+}
 async function applyBinding(key, rawSubdir, options = {}) {
     let subdir;
     try {
@@ -4920,18 +5457,88 @@ async function applyBinding(key, rawSubdir, options = {}) {
     // user should know they're about to join an existing workspace rather
     // than start a fresh one.
     const peers = state.listKeysForSubdir(subdir).filter(k => (0, sessionKeyCodec_1.checkIsTelegramKey)(k) && (0, sessionKey_1.keyToString)(k) !== (0, sessionKey_1.keyToString)(key));
-    await state.setBinding(key, subdir, options.topicName !== undefined ? { topicName: options.topicName } : {});
-    const message = peers.length > 0
-        ? (0, i18n_1.t)('thread.bind_collision', {
-            subdir,
-            threads: peers.map(k => `\`${(0, sessionKey_1.keyToString)(k)}\``).join(', '),
-        })
-        : (0, i18n_1.t)('thread.bound', { subdir });
+    const topicName = options.topicName ?? (0, pendingTopicName_1.getTrustedPendingTopicName)(pendingTopicNames.get((0, sessionKey_1.keyToString)(key)), Date.now(), PENDING_TOPIC_NAME_TTL_MS);
+    await state.setBinding(key, subdir, topicName !== undefined ? { topicName } : {});
+    // Bound: the set-aside name has done its part (an unbound topic is the only reader of it), and a «create new folder» wait
+    // armed on a picker is over — the next plain message is nobody's folder name any more.
+    const boundKey = (0, sessionKey_1.keyToString)(key);
+    pendingTopicNames.delete(boundKey);
+    awaitingFolderName.delete(boundKey);
+    bindPickerMessageIds.delete(boundKey);
+    warmTodoProjects();
+    // Only topics of THIS chat are named: a member of one group is not told what another group (or a private chat) calls its
+    // topics. The rest — and a topic of this chat that can be neither named nor linked — are counted.
+    const sharedWith = [];
+    let sharedMore = 0;
+    for (const peerKey of peers) {
+        const described = peerKey.space === key.space ? describeSharedTopic(peerKey) : null;
+        if (described === null)
+            sharedMore += 1;
+        else
+            sharedWith.push(described);
+    }
     // Rebind resume (S8): a thread that was unbound paused its schedules; binding
     // it again (this thread, possibly a different folder) resumes them. Best
     // effort — a folder pick must succeed even if the resume bookkeeping hiccups.
     await resumeThreadSchedulesOnRebind(key).catch((e) => console.warn(`[scheduler] resume-on-rebind failed for ${(0, sessionKey_1.keyToString)(key)}:`, e));
-    return { ok: true, message, subdir };
+    return { ok: true, subdir, sharedWith, sharedMore };
+}
+/**
+ * @description Answer a bind attempt in the topic: the refusal's message, or — once bound — the rich welcome, the one
+ * message announcing the binding (with the shared-folder row when other topics use the folder, and whatever else the
+ * caller knows of this bind: `notes`). Shared by `/bind <subdir>`, the `bind_<subdir>` picker button and the picker's
+ * «create new folder».
+ */
+async function replyToBindResult(key, result, notes = {}) {
+    if (!result.ok) {
+        await replyToThread(key, result.message);
+        return;
+    }
+    await sendBindingWelcome(key, result.subdir, { ...notes, sharedWith: result.sharedWith, sharedMore: result.sharedMore });
+}
+/**
+ * @description The `/bind` picker is one-shot (§ Inline keyboards): once a folder is bound through it — or the topic left its
+ * folder from it — the message is deleted, since its text («not bound, pick from the list», «currently bound: …») is no
+ * longer true and the welcome replaces it; a stale tap cannot rebind the topic either. A pick that bound nothing never gets
+ * here, and paging or the create-folder prompt leave the picker alone. A message that stayed ({@link deleteThreadMessage}
+ * resolved `false`: older than 48 hours, say) loses at least its buttons.
+ */
+async function removeBindPicker(key, pickerMessageId) {
+    openBindMessages.forget((0, sessionKey_1.keyToString)(key), pickerMessageId);
+    // A message that is gone has no buttons to strip (and Telegram would only answer «not found»).
+    if (await deleteThreadMessageDetailed(key, pickerMessageId) === 'stayed')
+        await editThreadKeyboard(key, pickerMessageId, null, 'bind');
+}
+/**
+ * @description Delete every message still open in the topic that offers a bind or asks for a folder's name — each `/bind`
+ * picker (every plain message in an unbound topic posted another), the «not bound» replies, the «send the folder name»
+ * prompt — once the topic is bound or has left its folder, whichever way that happened (a tap, a typed `/bind <folder>`, the
+ * bot's own auto-bind, a leave): their text is no longer true, and a tap on a stale one would rebind the topic. A message
+ * the bot has no record of (sent before a restart) is not touched.
+ *
+ * Every one of them is held first ({@link BindPickerClaims.retire}, outside the limited claim list), so a tap is refused
+ * whatever becomes of its message; the hold is let go of only for the ones with nothing left to tap. ONE bulk call deletes them
+ * (each single delete is a paced send, and there can be dozens). A message too old for Telegram to delete loses its buttons
+ * instead, and so does every one of a bulk call Telegram refused — no delete per picker — but only the newest `keyboardStripsPerSweepLimit` of them; the
+ * older rest keeps its buttons, refused by the hold (`sweepOpenBindMessages`). The hold lives in memory: after a restart such a
+ * picker works again. Never rejects: the callers that do not wait for it ({@link sendBindingWelcome}) have nothing to catch.
+ */
+async function closeOpenBindMessages(key) {
+    try {
+        await (0, bindSweep_1.sweepOpenBindMessages)(openBindMessages.take((0, sessionKey_1.keyToString)(key)), Date.now(), {
+            retire: (messageId) => bindPickerClaims.retire(key, messageId),
+            unretire: (messageId) => bindPickerClaims.unretire(key, messageId),
+            deleteMessages: (messageIds) => deleteThreadMessages(key, messageIds),
+            removeKeyboard: (messageId) => editThreadKeyboard(key, messageId, null, 'bind'),
+        });
+    }
+    catch (e) {
+        console.warn(`[bind] closing the open pickers of ${(0, sessionKey_1.keyToString)(key)} failed:`, e);
+    }
+}
+/** Remove the buttons of the topic's earlier welcomes (the newest few; see `stripStaleKeyboards`). Never rejects. */
+async function stripWelcomeKeyboards(key, messageIds) {
+    await (0, bindSweep_1.stripStaleKeyboards)(messageIds, (messageId) => editThreadKeyboard(key, messageId, null, 'welcome'));
 }
 /**
  * @description Pause the AGENT-PROMPT schedules owned by `key` because its topic
@@ -5002,16 +5609,18 @@ async function resumeThreadSchedulesOnRebind(key) {
  * armed-mode branches in the text handler never overlap (only one armed
  * mode is active per thread at a time).
  */
-function armFolderCreation(key) {
+function armFolderCreation(key, pickerMessageId) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     awaitingModelSelection.delete(kStr);
     awaitingSessionSelection.delete(kStr);
     // The `/topic` prompts are other readers of the next plain message.
     cancelTopicInput(key);
     // A stale pending question would otherwise consume the message AFTER the
-    // folder name as an answer to the old (pre-rebind) agent question.
-    clearPendingQuestion(key);
+    // folder name as an answer to the old (pre-rebind) agent question. Its message stays, closed as unanswered.
+    retirePendingQuestionInBackground(key);
     awaitingFolderName.add(kStr);
+    if (pickerMessageId !== null)
+        bindPickerMessageIds.set(kStr, pickerMessageId);
 }
 /** Map a `validateNewFolderName` rejection to its localised reply. */
 function mapNewFolderError(reason) {
@@ -5027,10 +5636,10 @@ function mapNewFolderError(reason) {
 /**
  * @description Create a new folder under WORK_ROOT from a user-typed name:
  * validate the name first (no traversal/slashes/dots), then `mkdir` (recursive:
- * an already-existing folder is fine — the caller just uses it, and the topic is
- * told so). A refusal or a filesystem failure is reported to `key`'s topic here;
- * the outcome says which, so the caller knows whether a retry is still wanted
- * (`invalid`) or not (`failed`).
+ * an already-existing folder is fine — the caller just uses it, and says so in its
+ * own way: `alreadyExisted`). A refusal or a filesystem failure is reported to
+ * `key`'s topic here; the outcome says which, so the caller knows whether a retry
+ * is still wanted (`invalid`) or not (`failed`).
  */
 async function createWorkFolder(key, rawName) {
     const validated = (0, folderName_1.validateNewFolderName)(rawName);
@@ -5052,10 +5661,7 @@ async function createWorkFolder(key, rawName) {
     // Folder freshly on disk → the cached subdir list is stale; drop it so the
     // next picker render includes the new folder.
     subdirCache.clear();
-    if (alreadyExisted) {
-        await replyToThread(key, (0, i18n_1.t)('bind.create_exists', { subdir: validated.name }));
-    }
-    return { outcome: 'ready', subdir: validated.name };
+    return { outcome: 'ready', subdir: validated.name, alreadyExisted };
 }
 /**
  * @description Create a new folder under WORK_ROOT from a user-typed name and
@@ -5068,21 +5674,36 @@ async function createWorkFolder(key, rawName) {
  * filesystem failure disarms it.
  */
 async function createAndBindFolder(key, rawName) {
-    const folder = await createWorkFolder(key, rawName);
-    if (folder.outcome === 'invalid')
-        return { ok: false };
-    if (folder.outcome === 'failed')
-        return { ok: true };
-    const result = await applyBinding(key, folder.subdir);
-    await replyToThread(key, result.message);
-    if (result.ok)
-        await sendBindingWelcome(key, result.subdir);
-    return { ok: true };
+    const kStr = (0, sessionKey_1.keyToString)(key);
+    // Read before the bind: a bind drops it (and the wait) itself; deleted below for a refused one, which does not.
+    const pickerMessageId = bindPickerMessageIds.get(kStr) ?? null;
+    let isNameRefused = false;
+    // The picker this name was asked on is held from BEFORE the folder is made, for the whole bind, like a tap on a folder holds
+    // it: a tap on it that lands behind the typed name is told the picker was used instead of binding the topic a second time, and
+    // a name that arrives when a tap already holds the picker makes no (empty) folder — it is told so, not dropped in silence.
+    const run = await bindPickerClaims.runClaimed(key, pickerMessageId, async () => {
+        const folder = await createWorkFolder(key, rawName);
+        if (folder.outcome === 'invalid') {
+            isNameRefused = true;
+            return false;
+        }
+        if (folder.outcome === 'failed')
+            return false;
+        const result = await applyBinding(key, folder.subdir);
+        bindPickerMessageIds.delete(kStr);
+        if (result.ok && pickerMessageId !== null)
+            await removeBindPicker(key, pickerMessageId);
+        await replyToBindResult(key, result, { isExistingFolder: folder.alreadyExisted });
+        return result.ok;
+    });
+    if (run === 'busy')
+        await replyToThread(key, (0, i18n_1.t)('cb.bind_picker_used'));
+    return { ok: !isNameRefused };
 }
 /**
  * @description Bind a topic the bot has just created (`/topic`) to `subdir` and greet it with the usual binding welcome:
- * the folder's stats and the start buttons. No agent starts by itself: it is started there as in any bound topic. The binding's own notice
- * is left out: its warning about other topics on the folder would warn of what the person just asked for. The topic's name
+ * the folder's stats and the start buttons. No agent starts by itself: it is started there as in any bound topic. The welcome's
+ * shared-folder row is left out (`sharedWith` is not passed on): it would warn of what the person just asked for. The topic's name
  * rides on the binding for the thread-context preamble. Resolves why it could not bind, `null` once it is bound.
  */
 async function bindNewTopic(key, subdir, topicName) {
@@ -5092,6 +5713,22 @@ async function bindNewTopic(key, subdir, topicName) {
     await sendBindingWelcome(key, result.subdir);
     return null;
 }
+/**
+ * @description Bind a topic the bot matched to the folder `subdirName` by the topic's own name, and welcome it. It goes
+ * through {@link applyBinding} like every other bind (validation, the schedules a rebind resumes, the collision lookup), so
+ * the welcome says why the bot did it AND names the topics already on the folder. The topic's name rides on the binding for
+ * the thread-context preamble. Resolves whether the topic is bound: a refused folder is only logged, and the caller falls
+ * back to the folder picker.
+ */
+async function autoBindTopicByName(key, subdirName, topicName) {
+    const result = await applyBinding(key, subdirName, topicName ? { topicName } : {});
+    if (!result.ok) {
+        console.warn(`[auto-bind] "${subdirName}" refused for ${(0, sessionKey_1.keyToString)(key)}: ${result.message}`);
+        return false;
+    }
+    await sendBindingWelcome(key, result.subdir, { isAutoBound: true, sharedWith: result.sharedWith, sharedMore: result.sharedMore });
+    return true;
+}
 command('bind', async (_ctx, key, parsed) => {
     if (checkIsGeneral(key)) {
         await replyToThread(key, (0, i18n_1.t)('bind.in_general'));
@@ -5118,10 +5755,7 @@ command('bind', async (_ctx, key, parsed) => {
         await replyToThread(key, usage, (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!binding));
         return;
     }
-    const result = await applyBinding(key, arg);
-    await replyToThread(key, result.message);
-    if (result.ok)
-        await sendBindingWelcome(key, result.subdir);
+    await replyToBindResult(key, await applyBinding(key, arg));
 });
 /**
  * @description Unbind a thread from its folder: stop any live session, drop the
@@ -5142,6 +5776,11 @@ async function unbindThread(key) {
         // Order matters: drop the pin FIRST (while binding.pinnedStatusMessageId
         // is still readable), then stop the session, then wipe the binding.
         await clearPinnedStatus(key);
+        // A question still on screen ends here with its «not answered» note: the stop below is reported only after the process
+        // is gone (json-stream stops in the background), by which time the teardown has cleared the question's state and the
+        // report finds nothing to close — the buttons would stay, dead, with no note.
+        if (pendingQuestions.has(kStr))
+            await retirePendingQuestion(key);
         // Stop any running session before discarding the binding so we don't leave
         // an orphan tmux/SSE stream pointing at a directory we no longer track.
         const adapter = (0, createAdapter_1.getThreadAdapter)(key);
@@ -5160,7 +5799,7 @@ async function unbindThread(key) {
         }
         // Release persisted session ids too — otherwise re-binding this thread
         // later + a bot restart would resurrect the old session the user unbound.
-        await state.clearAgentSessionIds(key);
+        await releaseConversationIds(key);
         // Pause this thread's schedules BEFORE dropping the binding: a fire against
         // an unbound topic can't deliver, so the jobs park (paused + disarmed) and
         // the next /bind resumes them. `removeBinding` only touches bindings/agents/
@@ -5247,7 +5886,7 @@ command('list', async (_ctx, key) => {
     await replyToThread(key, `${(0, i18n_1.t)('list.header', { count: rows.length })}\n${body}`, { parse_mode: 'Markdown' });
 });
 /**
- * @description `/new` (alias `/clear_session`) — stop the thread's current agent
+ * @description `/new` — stop the thread's current agent
  * session and immediately start a fresh one in the SAME topic with the SAME
  * adapter. The old session is RELEASED (not deleted): its transcript stays on
  * disk so it's still resumable via `/sessions`, but a bot restart won't
@@ -5257,7 +5896,7 @@ command('list', async (_ctx, key) => {
  * Guards mirror `handleStartCommand`: General has no binding/agent, so it just
  * hints; an unbound topic gets the standard bind-required reply.
  */
-command(['new', 'clear_session'], async (_ctx, key) => {
+command('new', async (_ctx, key) => {
     if (checkIsGeneral(key)) {
         await replyToThread(key, (0, i18n_1.t)('new.general_hint'));
         return;
@@ -5480,11 +6119,15 @@ function buildStartAgentKeyboard() {
 }
 /**
  * @description Compose and send the rich post-bind welcome described in
- * plan §20.5: header with the bound subdir, three optional fact rows
- * (CLAUDE.md / .mcp.json / git), and an inline keyboard to start an agent.
- * Falls back gracefully when stats can't be probed.
- */
-async function sendBindingWelcome(key, subdir) {
+ * plan §20.5: header with the bound subdir, the optional rows (why it was bound
+ * when the bot did it by itself, that the folder was there already, CLAUDE.md /
+ * .mcp.json / git, which other topics use the folder), and an inline keyboard to start an agent. It is the ONE
+ * message every way of binding leaves in the topic. Falls back gracefully when
+ * stats can't be probed.
+ */
+async function sendBindingWelcome(key, subdir, notes = {}) {
+    // The welcomes this topic got before are outdated the moment this one goes out: their buttons would act on the CURRENT folder.
+    const outdatedWelcomeIds = openWelcomeMessages.take((0, sessionKey_1.keyToString)(key)).map((entry) => entry.messageId);
     // Pin the status banner first so the user sees it land near the top of
     // the thread before the slower stats probe finishes. Fire-and-forget —
     // a failed pin (missing permissions, closed topic) just logs a warning
@@ -5499,6 +6142,10 @@ async function sendBindingWelcome(key, subdir) {
         stats = { claudeMdSize: null, mcpServerCount: null, gitBranch: null, gitClean: null };
     }
     const lines = [(0, i18n_1.t)('binding.welcome.header', { subdir })];
+    if (notes.isAutoBound)
+        lines.push((0, i18n_1.t)('binding.welcome.auto_bound'));
+    if (notes.isExistingFolder)
+        lines.push((0, i18n_1.t)('binding.welcome.existed'));
     if (stats.claudeMdSize)
         lines.push((0, i18n_1.t)('binding.welcome.claude_md', { size: stats.claudeMdSize }));
     if (stats.mcpServerCount !== null) {
@@ -5513,12 +6160,23 @@ async function sendBindingWelcome(key, subdir) {
     else if (fs.existsSync(path.join(workDir, '.git')) === false) {
         lines.push((0, i18n_1.t)('binding.welcome.git_none'));
     }
+    const sharedMore = notes.sharedMore ?? 0;
+    if ((notes.sharedWith && notes.sharedWith.length > 0) || sharedMore > 0) {
+        const moreLabel = sharedMore > 0 ? (0, i18n_1.t)('binding.welcome.sharedMore', { count: sharedMore }) : null;
+        lines.push((0, i18n_1.t)('binding.welcome.shared', { threads: (0, bindingWelcome_1.formatSharedTopicList)(notes.sharedWith ?? [], moreLabel) }));
+    }
     lines.push('');
     lines.push((0, i18n_1.t)('binding.welcome.start_prompt'));
-    await replyToThread(key, lines.join('\n'), {
+    const welcomeMessageId = await replyToThread(key, lines.join('\n'), {
         parse_mode: 'Markdown',
         ...buildStartAgentKeyboard(),
     });
+    if (welcomeMessageId !== null)
+        openWelcomeMessages.remember((0, sessionKey_1.keyToString)(key), welcomeMessageId, Date.now());
+    // Every bind ends in this welcome, so every bind sweeps here — after the welcome, and NOT waited for: what follows a bind
+    // (an agent start, when the first message was a start phrase) must not hang on the deletions and edits, which are paced sends.
+    void stripWelcomeKeyboards(key, outdatedWelcomeIds);
+    void closeOpenBindMessages(key);
 }
 // `open_sessions` callback wires the [📋 Resume…] button to the `/sessions`
 // flow — same `handleSessionsList` helper the slash command calls into, so
@@ -5740,10 +6398,9 @@ async function handleAgentStart(key, adapterName, args) {
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
-    // "Claude Code" is one user-facing choice with two backends (tmux-scrape vs
-    // json-stream); open the thread's picked backend, default tmux-scrape (for now).
-    if (adapterName === 'claude')
-        adapterName = (0, createAdapter_1.resolveClaudeBackendName)(key);
+    // "Claude Code" is one user-facing choice with several backends (json-stream,
+    // per-turn, the deprecated tmux-scrape); open the thread's picked backend, else the default.
+    adapterName = (0, createAdapter_1.resolveStartAdapterName)(key, adapterName);
     // The other backend, with a conversation to hand over: ask first; the answer makes the switch.
     const targetFamily = (0, backendSwitchPlan_1.getBackendFamily)(adapterName);
     if (targetFamily !== null && await askBeforeCrossBackendSwitch(key, targetFamily, args))
@@ -5785,19 +6442,32 @@ command('claude', (_ctx, key, parsed) => handleStartCommand(parsed, key, 'claude
 command(['opencode', 'oc'], (_ctx, key, parsed) => handleStartCommand(parsed, key, 'opencode'));
 command('terminal', (_ctx, key, parsed) => handleStartCommand(parsed, key, 'terminal'));
 registerProviderCommands();
-/** Human label for a Claude backend name (the two adapters share `label`
+/** Human label for a Claude backend name (the adapters share `label`
  *  "Claude Code", so the picker/notices need a distinguishing name). */
 function getClaudeBackendLabel(name) {
     if (name === adapterNames_1.claudeJsonStreamAdapterName)
         return '⚡ JSON-stream';
     if (name === adapterNames_1.claudePerTurnAdapterName)
         return '🔁 Per-turn';
-    return '🖥 Terminal-scrape';
+    return '🖥 tmux';
+}
+/** The `/claude_mode` button text of a backend: its label, the deprecated tmux backend marked as such. A notice
+ *  keeps the plain label instead — the deprecation hint under it already says it. */
+function getClaudeBackendButtonLabel(name) {
+    return name === adapterNames_1.claudeTmuxAdapterName ? (0, i18n_1.t)('claudeMode.tmuxButtonLabel') : getClaudeBackendLabel(name);
+}
+/** The one-line hint that the tmux backend is deprecated and which backend to use instead. */
+function getTmuxDeprecatedHint() {
+    return (0, i18n_1.t)('claudeMode.tmuxDeprecatedHint', { recommended: getClaudeBackendLabel((0, createAdapter_1.getDefaultClaudeBackendName)()) });
+}
+/** `text` with the tmux deprecation hint under it when `backendName` is the tmux backend; unchanged otherwise. */
+function appendTmuxDeprecatedHint(backendName, text) {
+    return backendName === adapterNames_1.claudeTmuxAdapterName ? `${text}\n${getTmuxDeprecatedHint()}` : text;
 }
 /** Build the `/claude_mode` picker: one button per Claude backend, `✓` on the
  *  current one. Callback data `ccmode_<adapterName>`. */
 function buildClaudeModeKeyboard(current) {
-    const buttons = [adapterNames_1.claudeJsonStreamAdapterName, adapterNames_1.claudePerTurnAdapterName, 'claude'].map((name) => telegraf_1.Markup.button.callback(name === current ? `${getClaudeBackendLabel(name)} ✓` : getClaudeBackendLabel(name), `ccmode_${name}`));
+    const buttons = [adapterNames_1.claudeJsonStreamAdapterName, adapterNames_1.claudePerTurnAdapterName, adapterNames_1.claudeTmuxAdapterName].map((name) => telegraf_1.Markup.button.callback(name === current ? `${getClaudeBackendButtonLabel(name)} ✓` : getClaudeBackendButtonLabel(name), `ccmode_${name}`));
     return telegraf_1.Markup.inlineKeyboard(buttons, { columns: 1 });
 }
 /**
@@ -5864,14 +6534,14 @@ command('claude_mode', async (_ctx, key, parsed) => {
         return;
     }
     if (action.kind === 'already') {
-        await replyToThread(key, (0, i18n_1.t)('claudeMode.already', { label: getClaudeBackendLabel(action.backendName) }));
+        await replyToThread(key, appendTmuxDeprecatedHint(action.backendName, (0, i18n_1.t)('claudeMode.already', { label: getClaudeBackendLabel(action.backendName) })));
         return;
     }
     if (action.kind === 'switch') {
-        await replyToThread(key, await applyClaudeBackendSwitch(key, action.backendName));
+        await replyToThread(key, appendTmuxDeprecatedHint(action.backendName, await applyClaudeBackendSwitch(key, action.backendName)));
         return;
     }
-    await replyToThread(key, (0, i18n_1.t)('claudeMode.pick', { label: getClaudeBackendLabel(action.currentBackendName) }), buildClaudeModeKeyboard(action.currentBackendName));
+    await replyToThread(key, (0, i18n_1.t)('claudeMode.pick', { label: getClaudeBackendLabel(action.currentBackendName), hint: getTmuxDeprecatedHint() }), buildClaudeModeKeyboard(action.currentBackendName));
 });
 registerModelCommands();
 const { registerDisplayModeCommands, registerDisplayModeCallbacks, } = (0, displayModes_1.createDisplayModes)(botCore);
@@ -5909,6 +6579,44 @@ const { applyAutoContinueLimits, consumeAutoContinueLimitsPicker, registerAutoCo
     getRequestWakeUpEngine: () => requestWakeUpEngine,
 });
 registerAutoContinueLimitsCommands();
+// ── «Bot skills» switch (`/bot_skills`): `connectors/telegram/commands/botSkills.ts`, `utils/botSkills.ts` ──
+const { registerBotSkillsCommands, registerBotSkillsCallbacks } = (0, botSkills_2.createBotSkills)({
+    ...botCore,
+    readBotSkills: botSkillsReader,
+    readBotSkillsInstanceValue: () => (0, botSkills_1.readBotSkillsInstanceValue)(botSkillsSources),
+    checkIsOpenCodeTopic: (key) => ((0, createAdapter_1.getThreadAdapterNameRaw)(key) ?? state.getAgent(key)?.name) === adapterNames_1.openCodeAdapterName,
+});
+registerBotSkillsCommands();
+// ── The cap on tracker task agents (`/task_agents`): `connectors/telegram/commands/taskAgents.ts`, `trackers/` ──
+const { registerTaskAgentsCommands, registerTaskAgentsCallbacks } = (0, taskAgents_1.createTaskAgents)({
+    ...botCore,
+    readTaskAgentLimit: () => (0, taskAgentLimit_1.readTaskAgentLimit)(taskAgentLimitSources),
+    // A General value just written may raise the cap: the waiting issues start at once.
+    noteTaskAgentLimitChanged: () => taskAgentSlots?.noteLimitMayHaveChanged(),
+    // The slots decide nothing on an instance that serves no tracker: its screen says nothing of them.
+    readTaskAgentStatus: () => ([...ENV.servedPlatforms].some((platform) => platform !== 'telegram') ? taskAgentSlots?.getStatus() ?? null : null),
+});
+registerTaskAgentsCommands();
+// ── Paired runners (`/runners`): `connectors/telegram/commands/runners.ts`, the hub in `runners/` ──
+const runnersHub = (0, hubPaths_1.createHubContext)();
+const runnersCacheDir = (0, ssh_1.getRemoteRunCacheDir)();
+const { registerRunnersCommands, registerRunnersCallbacks, handleRunnersAddressText, cancelRunnersAddressWait, startRunnersWatcher } = (0, runners_1.createRunners)({
+    ...botCore,
+    hub: runnersHub,
+    // The pairing messages this instance sent: its own record (the hub registry is shared by every instance of the OS user).
+    pairingMessagesPath: path.join((0, state_1.resolveDataDir)(), 'runner-pairing-messages.json'),
+    sweepExpiredCodes: async (nowMs) => { await (0, hubPairing_1.sweepExpiredPairings)(runnersHub, nowMs); },
+    readRunnerHost: (0, instanceSettings_1.createRunnerHostReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line)),
+    saveRunnerHost: (address) => (0, instanceSettings_1.saveInstanceSettingsChange)((0, instanceSettings_1.getInstanceSettingsPath)(), { runnerHost: address }),
+    getBotLabel: () => (bot.botInfo?.username === undefined ? os.hostname() : `@${bot.botInfo.username}`),
+    readOverview: (nowMs) => (0, runnersOverview_1.readRunnersOverview)(runnersHub, runnersCacheDir, nowMs),
+    probeOverview: (overview, nowMs) => (0, runnersOverview_1.probeRunnersOverview)(runnersHub, overview, runnersCacheDir, nowMs),
+    listAddressCandidates: () => (0, hubAddressCandidates_1.listPublicAddressCandidates)(),
+    scanHostKey: hubAddress_1.scanHostKey,
+    ensureGateWrapper: () => { (0, gateWrapper_1.ensureGateWrapper)(runnersHub); },
+    now: Date.now,
+});
+registerRunnersCommands();
 // ── Claude account profiles (`/account`): `utils/claudeProfiles.ts`, `commands/claudeAccounts.ts` ──
 /**
  * @description The Claude config directory a conversation's NEXT process starts with: its resolved account
@@ -5941,7 +6649,13 @@ async function readClaudeAuthStatusUnder(configDir) {
     }
     catch (e) {
         // A logged-out directory makes the CLI exit non-zero WITH its JSON on stdout: that is the answer.
-        return (0, claudeProfiles_1.parseClaudeAuthStatus)((0, claudeProfiles_1.readProcessErrorStdout)(e));
+        const status = (0, claudeProfiles_1.parseClaudeAuthStatus)((0, claudeProfiles_1.readProcessErrorStdout)(e));
+        // No answer at all (a probe killed by its timeout on a loaded host, a CLI that did not start): one line, so a
+        // missing status can be told from a signed-out one.
+        if (status === null) {
+            console.log(`[accounts] the auth status probe under ${configDir ?? 'the default directory'} gave no status: ${(0, claudeProfiles_1.getProcessFailureReason)(e, claudeAuthStatusProbeTimeoutMs)}`);
+        }
+        return status;
     }
 }
 const claudeAuthStatusProbeTimeoutMs = 5000;
@@ -6153,12 +6867,39 @@ function getTopicFallbackPosition(key) {
     const parsed = label ? (0, fallbackChain_1.parseOpenCodeModelLabel)(label) : null;
     return parsed ? { backend: 'opencode', ...parsed } : null;
 }
+/**
+ * @description Whether the account or model `key` runs on is marked limited now, and whether it is billed to API
+ * credits — what the todo list's standalone reminder never fires into (D12).
+ */
+function getConversationAccountState(key) {
+    const position = getTopicFallbackPosition(key);
+    if (position === null)
+        return { isLimited: false, isApiBilled: false };
+    const nowMs = Date.now();
+    const checkIsFuture = (instant) => instant !== undefined && Date.parse(instant) > nowMs;
+    if (position.backend === 'opencode')
+        return { isLimited: checkIsFuture(state.getOpenCodeModelLimitedUntil((0, fallbackChain_1.buildOpenCodeModelLabel)(position))), isApiBilled: false };
+    const info = state.getClaudeProfileInfo(position.profile);
+    return { isLimited: checkIsFuture(info?.limitedUntil) || info?.creditExhaustedAt !== undefined, isApiBilled: info?.billing === 'api' };
+}
+/**
+ * @description A person wrote in the conversation (a message, voice, file, album; an issue's request): the
+ * compact-on-idle latch clears (D2), the todo reminder's silence after ignored reminders ends (D13), and a question the
+ * idle compaction re-asked is closed as unanswered — they wrote something else instead of tapping it, like a live
+ * question a message cancels, and its buttons must not be tapped later onto whatever the agent asks next. A tap on the
+ * re-asked question takes its record before it gets here, so it is not closed by its own answer.
+ */
+function notePersonActivity(key) {
+    noteThreadUserActivity(key);
+    getTodoRegistry().notePersonActivity(key);
+    closeReAskedQuestion(key);
+}
 /**
  * @description What a usage limit on `key` leads to (`utils/fallbackChain.ts`): the rung the topic is on is
  * marked limited until the reset the error named (a Claude profile: else its session window, else the retry's
  * blind delay; an OpenCode model: else the blind delay), the usage snapshots are brought up to date, and the
  * chain's AVAILABLE rungs are listed in priority order. Without a configured chain a Claude topic falls back to
- * the within-Claude headroom ranking (`utils/claudeLimitSwitch.ts`) — the behaviour before the chain existed. An
+ * the within-Claude ranking by the soonest weekly reset (`utils/claudeLimitSwitch.ts`) — the behaviour before the chain existed. An
  * offer is remembered per thread under its episode so only ITS buttons can act on it. `none` for a non-Telegram
  * conversation, a topic with no account to switch from, or when no rung can take over.
  */
@@ -6261,35 +7002,58 @@ function getBalanceSpentLine(from) {
 function readRunningModelBeforeMove(key, from, to) {
     return from?.backend === 'claude' && to.backend === 'claude' ? getThreadClaudeModel(key) : null;
 }
+/** Where the topic's agent keeps its conversation: its adapter, the bound folder (`null` when unbound) and the persisted session id (`null` when it holds none yet). */
+function getConversationSource(key) {
+    const adapter = (0, createAdapter_1.getThreadAdapter)(key);
+    const decision = getWorkDirStartDecision(key);
+    const sessionId = (0, ensureSessionPlan_1.getPersistedSessionIdForAdapter)(state.getAgent(key) ?? null, adapter.name, (0, createAdapter_1.checkIsClaudeBackend)(adapter.name));
+    return { adapter, workDir: decision.ok ? decision.workDir : null, sessionId };
+}
 /**
  * @description The last `limit` turns (oldest first) of the conversation the topic's agent holds, off its own
  * transcript. `[]` when it has none yet (no session id persisted); `null` when they cannot be read (no bound
  * folder, an adapter without a transcript reader, a read that failed).
  */
 async function readConversationTurns(key, limit) {
-    const adapter = (0, createAdapter_1.getThreadAdapter)(key);
-    const decision = getWorkDirStartDecision(key);
-    const sessionId = (0, ensureSessionPlan_1.getPersistedSessionIdForAdapter)(state.getAgent(key) ?? null, adapter.name, (0, createAdapter_1.checkIsClaudeBackend)(adapter.name));
+    const { adapter, workDir, sessionId } = getConversationSource(key);
     if (!sessionId)
         return [];
-    if (!decision.ok || !adapter.getRecentTurns)
+    if (workDir === null || !adapter.getRecentTurns)
         return null;
     try {
-        return await adapter.getRecentTurns(key, decision.workDir, sessionId, limit);
+        return await adapter.getRecentTurns(key, workDir, sessionId, limit);
     }
     catch (e) {
         console.warn(`[fallback] ${(0, sessionKey_1.keyToString)(key)}: the previous agent's turns are unreadable:`, e instanceof Error ? e.message : e);
         return null;
     }
 }
+/**
+ * @description The summary the topic's agent's own compaction left in its conversation (`AgentAdapter.getSessionCompactionSummary`),
+ * for the context bridge to hand on beside the turns; `null` when it has none, the backend keeps none, or it cannot be read.
+ */
+async function readConversationCompactionSummary(key) {
+    const { adapter, workDir, sessionId } = getConversationSource(key);
+    if (!sessionId || workDir === null || !adapter.getSessionCompactionSummary)
+        return null;
+    try {
+        return await adapter.getSessionCompactionSummary(key, workDir, sessionId);
+    }
+    catch (e) {
+        console.warn(`[fallback] ${(0, sessionKey_1.keyToString)(key)}: the previous agent's compaction summary is unreadable:`, e instanceof Error ? e.message : e);
+        return null;
+    }
+}
 /**
  * @description The context bridge for a cross-backend switch (`utils/fallbackBridge.ts`), built BEFORE the old
- * adapter is stopped: its last turns off its own transcript (an unreadable one yields a bridge without turns).
+ * adapter is stopped: its last turns off its own transcript (an unreadable one yields a bridge without turns) and the
+ * summary of its own earlier compaction, if any.
  * `reason` is why the agent changes — a usage limit or the operator's own switch.
  */
 async function buildFallbackBridge(key, input) {
     const turns = await readConversationTurns(key, fallbackBridge_1.fallbackBridgeTurnLimit) ?? [];
-    return (0, fallbackBridge_1.buildFallbackBridgePrompt)({ ...input, turns, replyLanguage: (0, i18n_1.getLocaleEndonym)((0, i18n_1.getActiveLang)()) });
+    const compactionSummary = await readConversationCompactionSummary(key);
+    return (0, fallbackBridge_1.buildFallbackBridgePrompt)({ ...input, turns, compactionSummary, replyLanguage: (0, i18n_1.getLocaleEndonym)((0, i18n_1.getActiveLang)()) });
 }
 /** The backend the topic's agent runs on, by name (`Claude` / `OpenCode`), for a label whose rung is unknown. */
 function formatThreadBackend(key) {
@@ -6372,19 +7136,31 @@ async function switchTopicToFallbackEntry(key, from, to, options) {
         }
         firstPrompt = { text: bridge, isRequestPrompt: false };
     }
-    cancelApiRetry(key); // retires the offer too: the switch consumed it
-    const notice = `${getFallbackSwitchedNotice(from, to, runningModel)}${isStoppingBackground ? `\n${(0, i18n_1.t)('fallback.backgroundStopped')}` : ''}`;
-    console.log(`[fallback] ${k}: switched from ${fromLabel} to ${toLabel} after a usage limit${firstPrompt ? ' (cross-backend, bridged)' : ''}; resuming`);
-    await say(notice);
-    await resumeTopicOnNewSession(key, {
-        modelToPin: (0, fallbackChain_1.getFallbackModelToPin)(to, runningModel),
-        // Read after the session is up: the open requests may have changed while it started.
-        getFirstPrompt: () => firstPrompt ?? (0, limitHeldPrompts_1.getLimitResumeMessage)({
-            continueNudge: (0, i18n_1.t)('apiRetry.continueNudge'),
-            untakenRequestPrompt: (0, requestHeader_1.joinPromptsNotTakenIn)(requestLimitWaitAnswerDeps?.ledger.listOpenRequestsOf(key) ?? []),
-        }),
-    });
-    return { isSwitched: true, notice };
+    // From the end of the wait until the continue prompt is forwarded, the idle the limit left behind is not a turn end (the
+    // same hold a retry kick has): the model pin below re-spawns the session for seconds, and a wake-up engine that polled
+    // then would remind the agent on top of the prompt this move is about to send. A kick that moved the topic holds it already.
+    const isHoldingTurnEnd = !apiRetryKicksInFlight.has(k);
+    if (isHoldingTurnEnd)
+        apiRetryKicksInFlight.add(k);
+    try {
+        cancelApiRetry(key); // retires the offer too: the switch consumed it
+        const notice = `${getFallbackSwitchedNotice(from, to, runningModel)}${isStoppingBackground ? `\n${(0, i18n_1.t)('fallback.backgroundStopped')}` : ''}`;
+        console.log(`[fallback] ${k}: switched from ${fromLabel} to ${toLabel} after a usage limit${firstPrompt ? ' (cross-backend, bridged)' : ''}; resuming`);
+        await say(notice);
+        await resumeTopicOnNewSession(key, {
+            modelToPin: (0, fallbackChain_1.getFallbackModelToPin)(to, runningModel),
+            // Read after the session is up: the open requests may have changed while it started.
+            getFirstPrompt: () => firstPrompt ?? (0, limitHeldPrompts_1.getLimitResumeMessage)({
+                continueNudge: (0, i18n_1.t)('apiRetry.continueNudge'),
+                untakenRequestPrompt: (0, requestHeader_1.joinPromptsNotTakenIn)(requestLimitWaitAnswerDeps?.ledger.listOpenRequestsOf(key) ?? []),
+            }),
+        });
+        return { isSwitched: true, notice };
+    }
+    finally {
+        if (isHoldingTurnEnd)
+            apiRetryKicksInFlight.delete(k);
+    }
 }
 /**
  * @description The move ACROSS backends both the usage-limit switch and the operator's manual switch make, first
@@ -6611,10 +7387,14 @@ async function takeFallbackSwitchOffer(key, episodeId, index) {
     const { notice } = await switchTopicToFallbackEntry(key, offer.from, decision.to, { isAnnounced: false });
     return notice;
 }
-/** The `claude_profiles` MCP tool's answer: snapshots refreshed on demand (a minute's cache), then the ranking. */
-async function listClaudeProfilesForAgent(model) {
-    await claudeUsageRefresher.refreshAll({ maxAgeMs: claudeUsageRefresher_1.claudeUsageOnDemandMaxAgeMs });
-    return (0, claudeUsage_1.buildClaudeProfilesReport)((0, claudeUsage_1.buildClaudeProfileUsageViews)({ dataDir: (0, state_1.resolveDataDir)(), records: state.getAllClaudeProfileInfos() }), model, Date.now());
+/**
+ * The `claude_profiles` MCP tool's answer: snapshots refreshed on demand (a minute's cache; the account a resumed session
+ * was stopped on is re-read at once), then the launch pick — a new agent, or the session's own account when it is warm.
+ * The accounts the operator switched off in the `/limits` list are never picked for a new agent.
+ */
+async function listClaudeProfilesForAgent(query) {
+    await (0, claudeUsageRefresher_1.refreshClaudeUsageForLaunch)(claudeUsageRefresher, { currentProfile: query.currentProfile, isStoppedByLimit: query.isStoppedByLimit, maxAgeMs: claudeUsageRefresher_1.claudeUsageOnDemandMaxAgeMs });
+    return (0, claudeUsage_1.buildClaudeProfilesReport)((0, claudeUsage_1.buildClaudeProfileUsageViews)({ dataDir: (0, state_1.resolveDataDir)(), records: state.getAllClaudeProfileInfos() }), query.model, Date.now(), { currentProfile: query.currentProfile, isStoppedByLimit: query.isStoppedByLimit, excludedNames: (0, fallbackChain_1.getDisabledClaudeProfileNames)(state.getFallbackChain()) });
 }
 const { registerFallbackChainCommands, registerFallbackChainCallbacks, openAutoSwitchView, runAutoSwitchCommand, applyAutoSwitch } = (0, fallbackChain_2.createFallbackChain)({
     ...botCore,
@@ -6626,6 +7406,15 @@ const { registerFallbackChainCommands, registerFallbackChainCallbacks, openAutoS
     getTopicPosition: getTopicFallbackPosition,
     takeSwitchOffer: takeFallbackSwitchOffer,
 });
+const { registerTodoCommands, registerTodoCallbacks } = (0, todo_1.createTodo)({
+    ...botCore,
+    getTodoRegistry,
+    readTodoSettings,
+    getSettingsPath: () => (0, instanceSettings_1.getInstanceSettingsPath)(),
+    listTodoProjects,
+    getConversationLabel: getTodoConversationLabel,
+    checkIsConversationAsleep: (conversationKey) => getTodoSessionActivity(conversationKey) === 'asleep',
+});
 const { registerLimitsBoardCommands, registerLimitsBoardCallbacks } = (0, limitsBoard_1.createLimitsBoard)({
     ...botCore,
     getInstanceTimezone: getCurrentTimezone,
@@ -6685,6 +7474,7 @@ registerClaudeAccountCommands();
 registerTopicCommand();
 registerFallbackChainCommands();
 registerLimitsBoardCommands();
+registerTodoCommands();
 registerSttCommands();
 const { registerSelfUpdateCommands, registerSelfUpdateCallbacks } = (0, selfUpdate_1.createSelfUpdate)({
     ...botCore,
@@ -6801,8 +7591,10 @@ async function resumeSessionByIndex(key, idx, onExpired) {
         // The ONLY resume path that posts the "last N messages" context block —
         // silent re-attach (bot restart) and crash recovery must stay quiet.
         await adapter.resumeSession(key, workDir, sessionId, { isWithRecentContext: true });
-        // Another session took over this topic; it does not know the open request.
+        // Another session took over this topic; it does not know the open request, and the question the idle compaction re-asked
+        // for the conversation it replaces would send its label into the picked one.
         cancelConversationRequest(key);
+        closeReAskedQuestion(key);
         // Persist the PICKED id — without this the next restart re-attaches to
         // whatever id the last fresh start wrote, silently dropping the user's
         // pick (live incident 2026-06-10).
@@ -6819,7 +7611,7 @@ async function resumeSessionByIndex(key, idx, onExpired) {
 }
 command(['sessions', 'resume'], (_ctx, key) => handleSessionsList(key));
 /**
- * @description `/quit-all` — kill every active agent across every thread.
+ * @description `/quitall` — kill every active agent across every thread.
  *
  * General-only because it's a workspace-wide operation that's easy to
  * fire by mistake; restricting to General + needing an explicit command
@@ -6832,7 +7624,7 @@ command(['sessions', 'resume'], (_ctx, key) => handleSessionsList(key));
  * adapter that thread is configured for and stop only if it's active —
  * idempotent, so re-running is safe.
  */
-command(['quit-all', 'quitall'], async (_ctx, key) => {
+command('quitall', async (_ctx, key) => {
     if (!checkIsGeneral(key)) {
         await replyToThread(key, (0, i18n_1.t)('quit_all.general_only'));
         return;
@@ -6852,7 +7644,7 @@ command(['quit-all', 'quitall'], async (_ctx, key) => {
         active += result.attempted;
         stopped += result.stopped.length;
         // Same release-for-good semantics as `/quit`, per swept thread.
-        await state.clearAgentSessionIds(bKey);
+        await releaseConversationIds(bKey);
     }
     if (active === 0) {
         await replyToThread(key, (0, i18n_1.t)('quit_all.none_active'));
@@ -6907,7 +7699,7 @@ command(['quit', 'q'], async (_ctx, key) => {
     if (!primaryActive) {
         // A sleeping conversation is released for good: the next message starts a fresh one.
         if (getResumableSessionId(key) !== null) {
-            await state.clearAgentSessionIds(key);
+            await releaseConversationIds(key);
             await replyToThread(key, (0, i18n_1.t)('agent.sleeping_released'));
             return;
         }
@@ -6928,8 +7720,14 @@ command(['quit', 'q'], async (_ctx, key) => {
         await replyToThread(key, (0, i18n_1.t)('agent.exit_signal_sent', { label: adapter.label }));
         return;
     }
-    // OpenCode, terminal, any future adapter: tear down via stopSession.
-    adapter.stopSession(key);
+    // OpenCode, terminal, any future adapter: tear down via stopSession. «Stopped» is said once it is: a `/claude` sent on the
+    // reply must find the session gone, not «already running» — as one transition, so a start or resume waits behind it.
+    await sessionTransitions.run((0, sessionKey_1.keyToString)(key), async () => {
+        if (adapter.stopSessionAndWait)
+            await adapter.stopSessionAndWait(key);
+        else
+            adapter.stopSession(key);
+    });
     // Explicit quit releases the session for good — no auto-reattach later.
     await state.clearAgentSessionIds(key);
     await replyToThread(key, (0, i18n_1.t)('agent.stopped', { label: adapter.label }));
@@ -7198,8 +7996,8 @@ command('schedule', async (ctx, key, parsed) => {
         await replyToThread(key, result.message);
     const isStarting = startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key));
     const opening = await openTopicRequest(key, wrappedPrompt, { source: 'schedule', requesterId: (0, topicRequest_1.getTopicRequesterId)(ctx.from) });
-    await deliverPromptOrBuffer(key, `${opening.header}${wrappedPrompt}`, isStarting);
-    trackTopicRequestTurn(key, opening);
+    const delivery = await deliverPromptOrBuffer(key, `${opening.header}${wrappedPrompt}`, isStarting);
+    await settleTopicRequestAfterDelivery(key, opening, delivery);
 });
 const reminderWizards = new Map();
 const { cancelReminderWizard, claimReminderTextCapture, expireReminderWizard, finishReminderWizard, registerReminderCommands, registerReminderCallbacks, } = (0, reminders_1.createReminders)({
@@ -7278,16 +8076,18 @@ command('clear_messages', async (ctx, key) => {
 // ═══════════════════════════════════════════════════════════════════════════════
 // Slash tokens the text handler must NOT forward to the agent. Covers every
 // bot-owned command (incl. the raw-key controls c/y/n/enter/up/down/tab/esc)
-// PLUS the retired commands (agent/cancel/unbind/where/stop/stopall/stop-all):
-// their handlers were removed, but keeping the tokens here makes a stray
-// `/where` (or `/stop`) inert instead of typing a meaningless prompt into the
-// agent.
+// PLUS the retired commands (agent/cancel/unbind/where/stop/stopall/stop-all)
+// and the spelling `quit-all`: their handlers were removed (`quit-all` never
+// worked — Telegram ends a command at the hyphen, so a typed `/quit-all` is
+// routed as `/quit`), but keeping the tokens here makes a stray `/where` (or
+// `/stop`, or an entity-less `/quit-all`) inert instead of typing a meaningless
+// prompt into the agent.
 const botCommands = new Set([
     'start', 'claude', 'opencode', 'oc', 'terminal', 'agent', 'sessions', 'resume', 'cancel', 'model', 'connect',
-    'disconnect', 'stop', 'stopall', 'stop-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'interrupt', 'output', 'clear_messages',
-    'bind', 'topic', 'unbind', 'where', 'ls', 'list', 'new', 'clear_session', 'whoami', 'version', 'help', 'language', 'lang',
-    'doctor', 'mcp', 'rename_session', 'compact', 'compact_on_idle', 'compact_summary', 'auto_continue_limits', 'limits', 'limits_autoswitch', 'trace', 'timestamps', 'timezone', 'schedule', 'reminders', 'thinking', 'tool_results',
-    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech', 'update',
+    'disconnect', 'stop', 'stopall', 'stop-all', 'quit-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'interrupt', 'output', 'clear_messages',
+    'bind', 'topic', 'unbind', 'where', 'ls', 'list', 'new', 'whoami', 'version', 'help', 'language', 'lang',
+    'doctor', 'mcp', 'rename_session', 'compact', 'compact_on_idle', 'compact_summary', 'bot_skills', 'task_agents', 'runners', 'auto_continue_limits', 'limits', 'limits_autoswitch', 'trace', 'timestamps', 'timezone', 'schedule', 'reminders', 'todo', 'thinking', 'tool_results',
+    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech', 'update',
 ]);
 /**
  * @description The bare `/clear` is no longer bot-owned (it was renamed to
@@ -7323,6 +8123,8 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         cancelTopicInput(key);
         // ... and an armed `/stt` address or key step.
         await cancelSttInput(key);
+        // ... and the `/runners` address step.
+        cancelRunnersAddressWait(key);
         if (botCommands.has(cmd))
             return;
         // `/login` on a json-stream Claude thread (idle or per-turn lifecycle) has no
@@ -7426,12 +8228,18 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
             return;
         }
     }
+    // `/runners` → «Enter another address»: this General message is the address runners dial. A slash command wins over the wait.
+    if (await handleRunnersAddressText(key, text))
+        return;
     // Session is mid-startup → buffer the prompt and replay it once the agent is
     // ready, instead of dropping it into the "no agent running" guidance below.
     if (startupPromptBuffer.checkIsStarting(kStr)) {
         await bufferPromptDuringStartup(key, text, { source: 'text', requesterId: (0, topicRequest_1.getTopicRequesterId)(ctx.from) }, getReplyQuoteBlock(key, ctx.message));
         return;
     }
+    // Set when this very message bound the topic: its welcome is already the answer, so the idle-thread hint at the end
+    // stays out — but the message itself is still read as what it is (a start phrase starts the agent).
+    let isJustAutoBound = false;
     // Audit S2 / #5: if `forum_topic_created` was emitted by a non-allowed
     // admin, we stashed the topic name in `pendingTopicNames` without
     // binding. Now that an allowed user is engaging this thread, retry the
@@ -7441,29 +8249,28 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
     // explicitly chose to create a new folder, so this message is the name —
     // don't let a stale topic-name cache hijack it into a different bind.
     if (!checkIsGeneral(key) && !state.getBinding(key) && !awaitingFolderName.has(kStr)) {
-        const pending = pendingTopicNames.get(kStr);
-        if (pending && Date.now() - pending.ts < PENDING_TOPIC_NAME_TTL_MS) {
+        const pendingEntry = pendingTopicNames.get(kStr);
+        const pending = (0, pendingTopicName_1.getFreshPendingTopicName)(pendingEntry, Date.now(), PENDING_TOPIC_NAME_TTL_MS);
+        if (pending) {
             const match = (0, validation_1.findAutobindSubdir)(pending.name, listAvailableSubdirs(ENV.workRoot));
             if (match) {
                 try {
-                    const subdir = (0, validation_1.validateSubdir)(ENV.workRoot, match);
-                    // The pending entry carries the topic name (cached at creation) —
-                    // copy it onto the binding for the thread-context preamble (S1).
-                    await state.setBinding(key, subdir, pending.name ? { topicName: pending.name } : {});
                     pendingTopicNames.delete(kStr);
-                    await replyToThread(key, (0, i18n_1.t)('thread.welcome_bound', { subdir }));
-                    await sendBindingWelcome(key, subdir);
+                    // The name rides on the binding for the thread-context preamble (S1): an authorised user's as given, a member's
+                    // replaced by the folder's own name — the match is all the bot vets of it.
+                    isJustAutoBound = await autoBindTopicByName(key, match, (0, pendingTopicName_1.getAutoBindTopicName)(pending, match));
                 }
                 catch (e) {
                     console.warn(`[deferred-autobind] failed for "${match}":`, e);
-                    pendingTopicNames.delete(kStr);
                 }
             }
-            else {
+            else if (!pending.isFromAdmin) {
+                // No folder matches: a name only a non-admin gave has nothing else to do. An authorised user's stays for the
+                // bind the picker leads to, which keeps it (until it is bound or the TTL runs out).
                 pendingTopicNames.delete(kStr);
             }
         }
-        else if (pending) {
+        else if (pendingEntry) {
             // TTL expired — clean the entry.
             pendingTopicNames.delete(kStr);
         }
@@ -7533,12 +8340,13 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
             if (requestedFamily !== null && state.getBinding(key) && await askBeforeCrossBackendSwitch(key, requestedFamily, startMatch.args))
                 return;
             // The shared `ensureAgentSession` does the bind-check + switch + start.
-            // The explicit matched adapter wins (`preferredAdapterName`); the phrase's
-            // trailing args ride along. On `unbound` we keep this path's own reply:
-            // the folder picker (plan §11 Этап 4 — starting without a binding would
-            // silently launch against WORK_ROOT, which is almost never wanted).
+            // The explicit matched adapter wins (`preferredAdapterName`), named the way
+            // `/claude` names it: `claude` is the topic's Claude backend, never the bare
+            // tmux one. The phrase's trailing args ride along. On `unbound` we keep this
+            // path's own reply: the folder picker (plan §11 Этап 4 — starting without a
+            // binding would silently launch against WORK_ROOT, which is almost never wanted).
             const result = await ensureAgentSession(key, {
-                preferredAdapterName: startMatch.adapterName,
+                preferredAdapterName: (0, createAdapter_1.resolveStartAdapterName)(key, startMatch.adapterName),
                 args: startMatch.args,
             });
             if (!result.ok && result.reason === 'unbound') {
@@ -7628,6 +8436,8 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
+    if (isJustAutoBound)
+        return;
     await replyToThread(key, (0, i18n_1.t)('thread.no_agent_with_binding', { subdir: binding.subdir }));
 });
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -7750,7 +8560,7 @@ async function processVoiceJob(key, fileId, durationSeconds, requesterId, sentAt
                 // Same choke point as the text trigger (L-D4): a sleeping conversation is
                 // woken, never replaced by a fresh start; `unbound` keeps the folder picker.
                 const result = await ensureAgentSession(key, {
-                    preferredAdapterName: startMatch.adapterName,
+                    preferredAdapterName: (0, createAdapter_1.resolveStartAdapterName)(key, startMatch.adapterName),
                     args: startMatch.args,
                 });
                 if (!result.ok && result.reason === 'unbound') {
@@ -7946,12 +8756,12 @@ const albumCollector = (0, mediaGroupCollector_1.createMediaGroupCollector)({
             // cancel it silently, like the text/voice handlers.
             cancelApiRetry(key);
             // A user album is genuine user activity → clear the compact-on-idle latch (D2).
-            noteThreadUserActivity(key);
+            notePersonActivity(key);
             try {
                 const opening = await openTopicRequest(key, promptText, { source: 'album', requesterId: orderedItems[0].requesterId });
                 const quotedPrompt = getPromptWithThreadReplyQuote(key, promptText, replyContext);
-                await deliverPromptOrBuffer(key, `${opening.header}${quotedPrompt}`, isStarting);
-                trackTopicRequestTurn(key, opening);
+                const delivery = await deliverPromptOrBuffer(key, `${opening.header}${quotedPrompt}`, isStarting);
+                await settleTopicRequestAfterDelivery(key, opening, delivery);
             }
             catch (err) {
                 console.error('[Bot] album flush failed:', err);
@@ -8030,12 +8840,12 @@ async function handleIncomingFile(ctx, key) {
     // cancel it silently, like the text/voice handlers.
     cancelApiRetry(key);
     // A user file is genuine user activity → clear the compact-on-idle latch (D2).
-    noteThreadUserActivity(key);
+    notePersonActivity(key);
     const opening = await openTopicRequest(key, promptText, { source: 'file', requesterId: (0, topicRequest_1.getTopicRequesterId)(ctx.from) });
     // A file sent as a REPLY carries the message it answers, as a typed or spoken reply does.
     const quotedPrompt = getPromptWithThreadReplyQuote(key, promptText, getReplyQuoteBlock(key, ctx.message));
-    await deliverPromptOrBuffer(key, `${opening.header}${quotedPrompt}`, isStarting);
-    trackTopicRequestTurn(key, opening);
+    const delivery = await deliverPromptOrBuffer(key, `${opening.header}${quotedPrompt}`, isStarting);
+    await settleTopicRequestAfterDelivery(key, opening, delivery);
 }
 bot.on(
 // anyOf-composed per-kind filter — `message('photo', 'document', …)` would
@@ -8139,7 +8949,7 @@ bot.on((0, filters_1.message)('forum_topic_created'), async (ctx) => {
     const existing = state.getBinding(key);
     // Already bound — service event arrived after the user's first message
     // (or on restart). Don't overwrite; quietly skip the welcome too, the
-    // user has already seen the binding ack.
+    // user has already seen the welcome.
     if (existing)
         return;
     // Audit S2 / #5: topic creation may be open to all members (group setting),
@@ -8156,7 +8966,7 @@ bot.on((0, filters_1.message)('forum_topic_created'), async (ctx) => {
         return;
     if (action === 'cacheNameOnly') {
         if (topicName) {
-            pendingTopicNames.set((0, sessionKey_1.keyToString)(key), { name: topicName, ts: Date.now() });
+            pendingTopicNames.set((0, sessionKey_1.keyToString)(key), { name: topicName, ts: Date.now(), isFromAdmin: false });
         }
         console.warn(`[security] forum_topic_created in chat ${ctx.chat.id} by user ${userId ?? '?'} (not a group admin) — name cached, no auto-bind`);
         return;
@@ -8169,19 +8979,20 @@ bot.on((0, filters_1.message)('forum_topic_created'), async (ctx) => {
     const match = (0, validation_1.findAutobindSubdir)(topicName, subdirs);
     if (match) {
         try {
-            const subdir = (0, validation_1.validateSubdir)(ENV.workRoot, match);
-            // The creation event carries the topic name — persist it on the binding
-            // for the thread-context preamble (S1).
-            await state.setBinding(key, subdir, topicName ? { topicName } : {});
-            await replyToThread(key, (0, i18n_1.t)('thread.welcome_bound', { subdir }));
-            await sendBindingWelcome(key, subdir);
-            return;
+            // The creation event carries the topic name — it rides on the binding for the thread-context preamble (S1).
+            if (await autoBindTopicByName(key, match, topicName))
+                return;
         }
         catch (e) {
             console.warn(`[forum_topic_created] auto-bind failed for "${match}":`, e);
             // Fall through to picker.
         }
     }
+    // The picker is the way on, and the bind through it is the topic's first: set the name an authorised user gave aside, so
+    // that bind keeps it (the shared-folder row of a later topic names this one by it).
+    if (topicName && !state.getBinding(key)) {
+        pendingTopicNames.set((0, sessionKey_1.keyToString)(key), { name: topicName, ts: Date.now(), isFromAdmin: true });
+    }
     const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
     await replyToThread(key, (0, i18n_1.t)('thread.welcome_pick'), extra);
 });
@@ -8213,7 +9024,7 @@ bot.on((0, filters_1.message)('forum_topic_edited'), async (ctx) => {
     }
     else {
         // No binding yet — keep the freshest name for a later fuzzy auto-bind.
-        pendingTopicNames.set((0, sessionKey_1.keyToString)(key), { name: newName, ts: Date.now() });
+        pendingTopicNames.set((0, sessionKey_1.keyToString)(key), { name: newName, ts: Date.now(), isFromAdmin: true });
     }
 });
 // Audit S2 / #5: closed/reopened events can come from a member who isn't an
@@ -8297,16 +9108,11 @@ bot.action(/^bind_page_(\d+)$/, async (ctx) => {
     const page = parseInt(ctx.match[1], 10);
     const subdirs = listAvailableSubdirs(ENV.workRoot);
     const keyboard = (0, bindPicker_1.buildBindKeyboard)(subdirs, page, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
-    try {
-        await ctx.editMessageReplyMarkup(keyboard.reply_markup);
-    }
-    catch (e) {
-        const desc = (0, sendErrorClassifier_1.checkIsApiError)(e) ? (0, sendErrorClassifier_1.getErrorDescription)(e) : '';
-        if (!/message is not modified/i.test(desc)) {
-            console.warn(`[bind_page] edit failed:`, desc || e);
-        }
-    }
+    // Answered BEFORE the edit: the edit waits in the paced send queue, which can outlive the callback.
     await ctx.answerCbQuery();
+    const pickerMessageId = (0, callbackMessage_1.getCallbackMessageId)(ctx);
+    if (pickerMessageId !== null)
+        await editThreadKeyboard(key, pickerMessageId, keyboard.reply_markup, 'bind_page');
 });
 // Middle "N/M" pill in the nav row — pure UI, no state change.
 bot.action(bindPicker_1.bindPageNoopCallback, async (ctx) => {
@@ -8326,9 +9132,18 @@ bot.action(bindPicker_1.bindCreateFolderCallback, async (ctx) => {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.bind_only_topical'));
         return;
     }
+    const pickerMessageId = (0, callbackMessage_1.getCallbackMessageId)(ctx);
+    // A picker a bind (or a leave) holds is spent: a name asked for now would bind a second time.
+    if (pickerMessageId !== null && bindPickerClaims.has(key, pickerMessageId)) {
+        await (0, callbackToast_1.answerCallbackQuerySafely)(ctx, (0, i18n_1.t)('cb.bind_picker_used'));
+        return;
+    }
     await ctx.answerCbQuery((0, i18n_1.t)('bind.create_cb'));
-    armFolderCreation(key);
-    await replyToThread(key, (0, i18n_1.t)('bind.create_prompt'));
+    armFolderCreation(key, pickerMessageId);
+    // Remembered like a picker: the bind this question leads to deletes it (a refused name keeps it, the question stays open).
+    const promptMessageId = await replyToThread(key, (0, i18n_1.t)('bind.create_prompt'));
+    if (promptMessageId !== null)
+        openBindMessages.remember((0, sessionKey_1.keyToString)(key), promptMessageId, Date.now());
 });
 // «Leave current dir» — the folded-in `/unbind`, shown only in a bound topic.
 // Callback id deliberately avoids the `bind_` prefix so it can't be matched by
@@ -8343,8 +9158,20 @@ bot.action(bindPicker_1.bindLeaveCurrentCallback, async (ctx) => {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.bind_only_topical'));
         return;
     }
-    await ctx.answerCbQuery();
-    await unbindThread(key);
+    // Claimed like a bind: two taps in a row unbind once, and a picker a bind holds is no more a place to leave from.
+    const pickerMessageId = (0, callbackMessage_1.getCallbackMessageId)(ctx);
+    const run = await bindPickerClaims.runClaimed(key, pickerMessageId, async () => {
+        await (0, callbackToast_1.answerCallbackQuerySafely)(ctx);
+        await unbindThread(key);
+        if (pickerMessageId !== null)
+            await removeBindPicker(key, pickerMessageId);
+        await closeOpenBindMessages(key);
+        // The welcome's buttons have no folder to act on now.
+        await stripWelcomeKeyboards(key, openWelcomeMessages.take((0, sessionKey_1.keyToString)(key)).map((entry) => entry.messageId));
+        return true;
+    });
+    if (run === 'busy')
+        await (0, callbackToast_1.answerCallbackQuerySafely)(ctx, (0, i18n_1.t)('cb.bind_picker_used'));
 });
 // `/topic`'s buttons: patterns of their own (`topic_…`), disjoint from the `bind_<subdir>` regex below.
 registerTopicCallbacks();
@@ -8358,12 +9185,26 @@ bot.action(/^bind_(.+)$/, async (ctx) => {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.bind_only_topical'));
         return;
     }
+    // The picker is claimed before any await: a bind takes seconds (the folder's facts are probed, the sends are paced), and a
+    // second tap landing meanwhile must not bind — or welcome — a second time. A bind that does not happen (a refused folder,
+    // a failure on the way) gives the picker back.
     const subdir = ctx.match[1];
-    await ctx.answerCbQuery((0, i18n_1.t)('cb.binding_to', { subdir }));
-    const result = await applyBinding(key, subdir);
-    await replyToThread(key, result.message);
-    if (result.ok)
-        await sendBindingWelcome(key, result.subdir);
+    const pickerMessageId = (0, callbackMessage_1.getCallbackMessageId)(ctx);
+    const run = await bindPickerClaims.runClaimed(key, pickerMessageId, async () => {
+        // A toast that comes too late (the query expired) changes nothing about the bind the person asked for.
+        await (0, callbackToast_1.answerCallbackQuerySafely)(ctx, (0, i18n_1.t)('cb.binding_to', { subdir }));
+        const result = await applyBinding(key, subdir);
+        if (!result.ok) {
+            await replyToBindResult(key, result);
+            return false;
+        }
+        if (pickerMessageId !== null)
+            await removeBindPicker(key, pickerMessageId);
+        await replyToBindResult(key, result);
+        return true;
+    });
+    if (run === 'busy')
+        await (0, callbackToast_1.answerCallbackQuerySafely)(ctx, (0, i18n_1.t)('cb.bind_picker_used'));
 });
 // ─── /language inline picker callbacks ───────────────────────────────────────
 //
@@ -8501,10 +9342,14 @@ bot.action(timezonePicker_1.zonePickCallbackRe, async (ctx) => {
 registerModelCallbacks();
 registerCompactionCallbacks();
 registerAutoContinueLimitsCallbacks();
+registerBotSkillsCallbacks();
+registerTaskAgentsCallbacks();
+registerRunnersCallbacks();
 registerBackendSwitchCallbacks();
 registerClaudeAccountCallbacks();
 registerFallbackChainCallbacks();
 registerLimitsBoardCallbacks();
+registerTodoCallbacks();
 registerSttCallbacks();
 registerSelfUpdateCallbacks();
 // «⏭ Skip once» on the `/limits` board and the `/limits_autoswitch` screen: drop THIS armed resume and
@@ -8535,43 +9380,6 @@ bot.action(new RegExp(`^${autoContinueOnLimit_1.skipArmedRetryCallbackPrefix}(\\
         await consumeAutoContinueLimitsPicker(key, ctx.callbackQuery?.message, (0, i18n_1.t)('autoContinueLimits.skippedNotice'));
     });
 });
-// D1: a tap on an idle-compaction RE-ASKED question button. The original request
-// was rejected server-side during the compaction, so the chosen option label is
-// delivered to the (now compacted) session as a FRESH prompt, not answered.
-bot.action(/^reask_(\d+)$/, async (ctx) => {
-    const key = await authoriseContext(ctx);
-    if (!key) {
-        await ctx.answerCbQuery((0, i18n_1.t)('cb.access_denied'));
-        return;
-    }
-    const optIdx = parseInt(ctx.match[1], 10);
-    const labels = reAskedQuestionOptions.get((0, sessionKey_1.keyToString)(key));
-    const label = labels?.[optIdx];
-    if (!label) {
-        await ctx.answerCbQuery((0, i18n_1.t)('cb.no_pending_question'));
-        return;
-    }
-    // The idle fire posts the re-asked question just BEFORE it stops the process, and a stopping process still reads as
-    // active: a tap inside that window (or inside a start) is buffered like a typed prompt and replayed once a session is up.
-    const isStarting = startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key));
-    // The answer to a re-asked question wakes a sleeping conversation (L-D4) — the question is its own.
-    if (!isStarting && !(0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key) && !(await resumeSleepingSessionForPrompt(key))) {
-        await ctx.answerCbQuery((0, i18n_1.t)('agent.no_session'));
-        return;
-    }
-    const adapter = (0, createAdapter_1.getThreadAdapter)(key);
-    reAskedQuestionOptions.delete((0, sessionKey_1.keyToString)(key));
-    // The label goes to the agent as a prompt and nothing else in the topic shows it whole (the buttons clip long
-    // labels): a label too long for the toast is posted in full, as the record of the answer that was sent.
-    await (0, callbackToast_1.answerCallbackWithWholeText)(ctx, label, (wholeLabel) => replyToThread(key, wholeLabel));
-    // An answer to the agent's own question is never a request (S7), even delivered as a prompt. Routed at delivery,
-    // not on the `isStarting` read above: the stop may have ended during the toast, and a label buffered into its closed
-    // window was never replayed.
-    const outcome = await withThreadLocale(key, () => deliverActivePrompt(key, adapter, label, null));
-    // The label reached no session (the topic was told why): the question is still open, so are its buttons.
-    if (outcome === 'noSession' && labels && !reAskedQuestionOptions.has((0, sessionKey_1.keyToString)(key)))
-        reAskedQuestionOptions.set((0, sessionKey_1.keyToString)(key), labels);
-});
 registerReminderCallbacks();
 bot.action(/^ccmode_(.+)$/, async (ctx) => {
     const key = await authoriseContext(ctx);
@@ -8593,18 +9401,11 @@ bot.action(/^ccmode_(.+)$/, async (ctx) => {
         return;
     }
     await ctx.answerCbQuery((0, i18n_1.t)('cb.claudeMode_switching'));
-    await replyToThread(key, await applyClaudeBackendSwitch(key, target));
+    await replyToThread(key, appendTmuxDeprecatedHint(target, await applyClaudeBackendSwitch(key, target)));
     // Re-render the picker so the `✓` follows the new backend (mirrors effort_cb).
-    const cbMsg = ctx.callbackQuery?.message;
-    if (cbMsg) {
-        try {
-            await (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.editMessageReplyMarkup((0, sessionKeyCodec_1.getTelegramChatId)(key), cbMsg.message_id, undefined, buildClaudeModeKeyboard((0, createAdapter_1.resolveClaudeBackendName)(key)).reply_markup));
-        }
-        catch (e) {
-            const desc = (0, sendErrorClassifier_1.checkIsApiError)(e) ? (0, sendErrorClassifier_1.getErrorDescription)(e) : '';
-            if (!/message is not modified/i.test(desc))
-                console.warn('[ccmode_cb] re-render:', desc || e);
-        }
+    const pickerMessageId = (0, callbackMessage_1.getCallbackMessageId)(ctx);
+    if (pickerMessageId !== null) {
+        await editThreadKeyboard(key, pickerMessageId, buildClaudeModeKeyboard((0, createAdapter_1.resolveClaudeBackendName)(key)).reply_markup, 'ccmode_cb');
     }
 });
 registerDisplayModeCallbacks();
@@ -8632,18 +9433,9 @@ bot.action(/^agent_(.+)$/, async (ctx) => {
         // instead of staying stuck on the previous one (B16, mirrors B12). The
         // start keeps the picker message visible (it is neither edited nor deleted),
         // so the stale marker would otherwise persist.
-        const cbMsg = ctx.callbackQuery?.message;
-        if (cbMsg) {
-            const keyboard = buildAgentKeyboard((0, createAdapter_1.getAvailableAdapters)(), adapterName);
-            try {
-                await (0, rateLimiter_1.enqueueSend)(key, () => bot.telegram.editMessageReplyMarkup((0, sessionKeyCodec_1.getTelegramChatId)(key), cbMsg.message_id, undefined, keyboard.reply_markup));
-            }
-            catch (e) {
-                const desc = (0, sendErrorClassifier_1.checkIsApiError)(e) ? (0, sendErrorClassifier_1.getErrorDescription)(e) : '';
-                if (!/message is not modified/i.test(desc)) {
-                    console.warn('[agent_cb] keyboard re-render failed:', desc || e);
-                }
-            }
+        const pickerMessageId = (0, callbackMessage_1.getCallbackMessageId)(ctx);
+        if (pickerMessageId !== null) {
+            await editThreadKeyboard(key, pickerMessageId, buildAgentKeyboard((0, createAdapter_1.getAvailableAdapters)(), adapterName).reply_markup, 'agent_cb');
         }
     }
     catch {
@@ -8716,14 +9508,14 @@ bot.action(/^qa_(\d+)_(\d+)$/, async (ctx) => {
     const selectedLabel = question.options[optIdx].label;
     const isAnswerShown = await applyQuestionAnswer(key, [selectedLabel]);
     if (isAnswerShown) {
-        // The question message was just edited to "✅ <header>: <answer>", which carries the whole answer: the toast only
+        // The question message was just edited to carry the whole answer under the question: the toast only
         // confirms the tap, so a label too long for it is cut there and not posted a second time.
-        await (0, callbackToast_1.answerCallbackWithFittedText)(ctx, selectedLabel);
+        await (0, callbackToast_2.answerCallbackWithFittedText)(ctx, selectedLabel);
     }
     else {
         // The message could not be edited (it is gone, or the edit failed): nothing in the topic shows the answer, so a
         // label too long for the toast is posted in full.
-        await (0, callbackToast_1.answerCallbackWithWholeText)(ctx, selectedLabel, (wholeLabel) => replyToThread(key, wholeLabel));
+        await (0, callbackToast_2.answerCallbackWithWholeText)(ctx, selectedLabel, (wholeLabel) => replyToThread(key, wholeLabel));
     }
 });
 /**
@@ -8735,6 +9527,13 @@ bot.action(/^qa_(\d+)_(\d+)$/, async (ctx) => {
  * the agent without the message it points at.
  */
 async function bufferPromptDuringStartup(key, text, intake, replyContext) {
+    // The same for a bare option number typed in that window: it answers the question asked again.
+    if (await answerReAskedQuestionByNumber(key, text))
+        return;
+    // A person wrote, in a window where the session is starting or being stopped: it counts like a message that reaches
+    // `deliverActivePrompt` — the idle latch clears, and a question the idle compaction re-asked is closed (the idle fire
+    // posts it just before the stop, so this window is where a message instead of a tap most often lands).
+    notePersonActivity(key);
     const opening = await openTopicRequest(key, text, intake);
     const quotedText = getPromptWithThreadReplyQuote(key, text, replyContext);
     await deliverPromptOrBuffer(key, `${opening.header}${quotedText}`, true);
@@ -8753,15 +9552,18 @@ async function bufferPromptDuringStartup(key, text, intake, replyContext) {
  *     user before forwarding so the prompt doesn't queue behind it forever.
  *  3. Forward the prompt (a bare `/clear` first purges thread context + files).
  *
- * Claude/terminal never reach step 1 (their routing returns earlier in the text
- * handler, and `pendingQuestions`/`answerQuestion` are OpenCode-only). For them
+ * Step 1 is the OpenCode AND the Claude stream-json backends (both raise the `question` event and implement
+ * `answerQuestion`). The tmux-scrape Claude and the terminal never reach it (no `pendingQuestions` entry): for them
  * `forwardPromptToAgent` interrupts the TUI selector itself.
  */
 async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyContext) {
+    // A bare option number answers the question the idle compaction asked again (a tap's own label comes in with no intake).
+    if (intake !== null && await answerReAskedQuestionByNumber(key, text))
+        return null;
     // A genuine USER message (text or voice) — clear the compact-on-idle latch so
     // the next idle period can compact again (D2), whether it answers a pending
     // question or is a fresh prompt.
-    noteThreadUserActivity(key);
+    notePersonActivity(key);
     const pending = pendingQuestions.get((0, sessionKey_1.keyToString)(key));
     if (pending && adapter.answerQuestion) {
         const currentQuestion = pending.data.questions[pending.currentIndex];
@@ -8775,8 +9577,8 @@ async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyCo
         }
         // Free-form text cancels the question and is a fresh prompt — a request (S7).
         const opening = await openTopicRequest(key, text, intake);
-        await cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, opening.header);
-        trackTopicRequestTurn(key, opening);
+        const delivery = await cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, opening.header);
+        await settleTopicRequestAfterDelivery(key, opening, delivery);
         return null;
     }
     // A bare `/clear` forwarded to the agent wipes its context (Claude TUI), so
@@ -8805,6 +9607,8 @@ async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyCo
     // durable by the time the agent reads it.
     const opening = await openTopicRequest(key, text, intake);
     // Routed now, not when the message arrived: the idle stop may have begun or ended during the awaits since.
+    // The forward can itself end in no session — a prompt that waited for an adopt replay found the session gone and nothing to wake;
+    // it has told the person already (`forwardPromptToAgent`), so what is left here is the request this prompt opened.
     const outcome = await (0, promptDelivery_1.deliverLatePrompt)({
         checkIsWindowOpen: () => startupPromptBuffer.checkIsStarting((0, sessionKey_1.keyToString)(key)),
         checkIsSessionActive: () => adapter.checkIsActive(key),
@@ -8814,36 +9618,44 @@ async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyCo
         wake: () => wakeSleepingSessionForPrompt(key),
         forward: () => forwardPromptToAgent(key, (0, createAdapter_1.getThreadAdapter)(key), text, sentAtMs, { replyContext, requestHeader: opening.header }),
         reportNoSession: async (isAlreadyTold) => {
-            // The prompt reaches no agent: the request it opened would only wait for a turn that never comes.
-            if (opening.requestId !== null)
-                await topicRequestLedger?.closeRequest(opening.requestId, 'cancelled');
             if (!isAlreadyTold)
                 await replyToThread(key, (0, i18n_1.t)('agent.no_session'));
         },
     });
-    if (outcome !== 'noSession')
-        trackTopicRequestTurn(key, opening);
+    await settleTopicRequestAfterDelivery(key, opening, outcome);
     return outcome;
 }
 /**
- * @description Retire the on-screen state of a pending OpenCode question the user walked away from: clear the bot's
- * pending-question state and neutralize the stale buttons message (edit it to a "cancelled" label so a late tap can't
- * re-answer an aborted question). Closing the question on the server is the caller's, before it aborts the turn.
- * Returns whether the buttons message itself was relabelled — it IS the cancellation notice then.
+ * @description Close the on-screen state of a pending question that ends without an answer: clear the bot's
+ * pending-question state (which unpins it) and edit the question's message so its buttons are gone and a note says that
+ * nobody answered it. The message is never deleted — the question and its options
+ * stay readable. Closing the question on the agent is the caller's, before it stops or aborts the turn.
+ * Returns whether the message itself was edited — it IS the notice then.
  *
  * The edit runs through `runQuestionLifecycleOp` (same serializer as the answer path) so it can't race a concurrent
- * re-post-to-bottom. The `messageId` + header are captured BEFORE clearing, since `clearPendingQuestion` drops the state.
+ * re-post-to-bottom. The `messageId` + question are captured BEFORE clearing, since `clearPendingQuestion` drops the state.
  */
 async function retirePendingQuestion(key) {
     const pending = pendingQuestions.get((0, sessionKey_1.keyToString)(key));
-    const cancelledMessageId = pending?.messageId ?? null;
-    const cancelledQuestion = pending?.data.questions[pending.currentIndex];
     clearPendingQuestion(key);
-    if (cancelledMessageId === null || !cancelledQuestion)
+    return closeCapturedQuestionMessage(key, pending?.messageId ?? null, pending?.data.questions[pending.currentIndex]);
+}
+/**
+ * @description The edit half of {@link retirePendingQuestion}, for a question whose id and text were captured before its
+ * state was cleared (also: read from the saved state at boot, where no memory entry ever existed). `false` when there is no
+ * message to edit, else whether the edit landed.
+ */
+async function closeCapturedQuestionMessage(key, messageId, question) {
+    if (messageId === null || !question)
         return false;
-    const header = cancelledQuestion.header || cancelledQuestion.question;
-    await runQuestionLifecycleOp(key, () => editThreadMessage(key, cancelledMessageId, (0, i18n_1.t)('agent.question_cancelled_msg_label', { header })));
-    return true;
+    return runQuestionLifecycleOp(key, () => closeQuestionMessage(key, messageId, question, 'unanswered'));
+}
+/**
+ * @description {@link retirePendingQuestion} for the teardown and boot paths that do not wait for the edit (it goes through
+ * the send pacer): a failure is logged, never an unhandled rejection.
+ */
+function retirePendingQuestionInBackground(key) {
+    retirePendingQuestion(key).catch((e) => console.error('[pendingQuestion] retire failed:', e));
 }
 /**
  * @description Cancel a pending OpenCode question because the user sent free-form
@@ -8853,7 +9665,7 @@ async function retirePendingQuestion(key) {
  * abort`), post the "previous question cancelled" notice, then forward.
  */
 async function cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, requestHeader) {
-    // When the question bubble itself was relabelled to "❌ … cancelled", that IS the
+    // When the question bubble itself was closed with its «not answered» note, that IS the
     // cancellation notice — a second standalone "previous question cancelled" line is
     // pure noise (the reported triple message). The standalone notice is kept only
     // for the no-bubble case.
@@ -8871,7 +9683,7 @@ async function cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, rep
     if (!didLabelQuestionMessage) {
         await replyToThread(key, (0, i18n_1.t)('agent.question_cancelled_for_prompt'));
     }
-    await forwardPromptToAgent(key, adapter, text, sentAtMs, { replyContext, requestHeader });
+    return forwardPromptToAgent(key, adapter, text, sentAtMs, { replyContext, requestHeader });
 }
 /**
  * @description Record one answer for the CURRENTLY shown OpenCode question and
@@ -8895,8 +9707,9 @@ async function applyQuestionAnswerInner(key, answerForCurrent) {
         return false;
     const answeredQuestion = pending.data.questions[pending.currentIndex];
     const { nextState, action } = (0, openCodeQuestionFlow_1.recordAnswerAndAdvance)(pending, answerForCurrent);
-    // Mark the answered question's message as done (the chosen answer in place).
-    const isAnswerShown = pending.messageId !== null && answeredQuestion !== undefined && await editThreadMessage(key, pending.messageId, `✅ ${answeredQuestion.header || answeredQuestion.question}: ${answerForCurrent.join(', ')}`);
+    // Mark the answered question's message as done: the question stays as asked, the chosen answer takes the place of
+    // its buttons.
+    const isAnswerShown = pending.messageId !== null && answeredQuestion !== undefined && await editQuestionMessageToClosed(key, pending.messageId, answeredQuestion, (0, i18n_1.t)('agent.question_answered_note', { answer: answerForCurrent.join(', ') }));
     if (action.kind === 'submit') {
         const adapter = (0, createAdapter_1.getThreadAdapter)(key);
         clearPendingQuestion(key);
@@ -8910,7 +9723,8 @@ async function applyQuestionAnswerInner(key, answerForCurrent) {
     }
     // More questions remain: persist the advanced state, then post the next one
     // (which re-owns `messageId`). DO NOT reply to the agent yet.
-    setPendingQuestion(key, nextState);
+    // The next question is a new message of its own: it has no original yet, the one of the question answered is not its record.
+    setPendingQuestion(key, { ...nextState, originalMessageId: null });
     await postPendingQuestionAt(key);
     return isAnswerShown;
 }
@@ -9922,6 +10736,9 @@ function handleAgentQuestion(key, questionData) {
     if (persistedQuestion && persistedQuestion.data.requestId === questionData.requestId) {
         return;
     }
+    // The agent asks anew: a question the idle compaction re-asked earlier is superseded, and its buttons would now answer
+    // the wrong question — it is closed as unanswered.
+    closeReAskedQuestion(key);
     // A pending status frame is now stale — the question UI replaces it. Stop the
     // liveness loop first so it can't recreate a frame under the question prompt
     // (Claude-only; a no-op for OpenCode threads, which never arm it).
@@ -10037,6 +10854,7 @@ async function postPendingQuestionAt(key) {
             const existing = pendingQuestions.get(kStr);
             if (existing && existing.data === pending.data && existing.currentIndex === qIdx) {
                 existing.messageId = messageId;
+                existing.originalMessageId ??= messageId;
                 setPendingQuestion(key, existing);
                 markQuestionMessageSent(key, messageId);
                 // Pin the question so the muted topic fires a notification (S2). The
@@ -10048,11 +10866,12 @@ async function postPendingQuestionAt(key) {
                     void pinThreadQuestion(key, messageId);
             }
             else {
-                // The question advanced / was answered while our send sat in the
+                // The question advanced / was answered / was closed while our send sat in the
                 // queue (a fast digit reply can beat the post — seen live 2026-06-10:
                 // a stale unanswered-looking "❓" landed and lingered). The message we
-                // just sent describes a question that no longer exists — remove it.
-                void deleteThreadMessage(key, messageId);
+                // just sent describes a question that no longer exists: it is closed as
+                // unanswered (its buttons would be dead), never deleted.
+                await closeQuestionMessage(key, messageId, question, 'unanswered');
             }
         }
     }
@@ -10090,7 +10909,7 @@ function handleAgentClosed(key) {
     clearThinkingMessage(key);
     // A closed session has no running delegation — remove the sub-agent status.
     clearSubagentStatus(key);
-    clearPendingQuestion(key);
+    retirePendingQuestionInBackground(key);
     // A closed session has nothing to resume — drop any armed retry silently.
     cancelApiRetry(key);
     clearAuthNotice(key); // session closed → retire any pinned logged-out notice
@@ -10197,7 +11016,7 @@ function handleAgentError(key, error) {
     deleteStatusMessage(key).catch(() => { });
     clearThinkingMessage(key);
     clearSubagentStatus(key);
-    clearPendingQuestion(key);
+    retirePendingQuestionInBackground(key);
     replyToThread(key, `Error: ${error.message}`).catch(() => { });
 }
 /**
@@ -10245,8 +11064,8 @@ function handleAgentStarted(key) {
  * the delete); the "thinking …" frame and the sub-agent status for the same reason;
  * and the pending question (F1): no stop path fires the adapter's `questionGone`
  * (Claude's pane is killed; OpenCode emits no resolve), so a pinned question would
- * leak forever — clearing it chains `unpinThreadQuestion`, matching
- * `handleAgentClosed` / `handleAgentError`.
+ * leak forever — retiring it chains `unpinThreadQuestion` and closes its message as unanswered (the question stays
+ * in the topic, its buttons would be dead), matching `handleAgentClosed` / `handleAgentError`.
  */
 function clearGoneProcessFrames(key) {
     clearThreadQueues(key);
@@ -10254,11 +11073,11 @@ function clearGoneProcessFrames(key) {
     deleteStatusMessage(key).catch(() => { });
     clearThinkingMessage(key);
     clearSubagentStatus(key);
-    clearPendingQuestion(key);
+    retirePendingQuestionInBackground(key);
 }
 function handleAgentStopped(key) {
     // Single convergence point for every `stopSession`-driven stop path —
-    // `/quit` (OpenCode/terminal), `/quit-all`, `/new`, `/unbind`, and adapter
+    // `/quit` (OpenCode/terminal), `/quitall`, `/new`, `/unbind`, and adapter
     // switch all emit `stopped`.
     clearGoneProcessFrames(key);
     // Session ended — a future session starts with empty context, so forget the
@@ -10321,9 +11140,8 @@ exports.COMMANDS_MENU = [
     { command: 'claude', description: '▶️ Start Claude Code' },
     { command: 'opencode', description: '▶️ Start OpenCode' },
     { command: 'terminal', description: '🖥 Open a raw shell in the bound folder' },
-    { command: 'claude_mode', description: '🔀 Claude backend: json-stream ⇄ per-turn ⇄ tmux-scrape' },
-    { command: 'new', description: '🆕 Restart session (alias /clear_session)' },
-    { command: 'clear_session', description: '🆕 Restart session (alias /new)' },
+    { command: 'claude_mode', description: '🔀 Claude backend: json-stream ⇄ per-turn ⇄ tmux (deprecated)' },
+    { command: 'new', description: '🆕 Restart session' },
     { command: 'model', description: '🧠 Switch model' },
     { command: 'effort', description: '⚙️ Reasoning effort' },
     { command: 'verbosity', description: '🔊 Output verbosity (thinking+tools+sub-agents)' },
@@ -10338,6 +11156,9 @@ exports.COMMANDS_MENU = [
     { command: 'compact', description: '🧹 Compact agent context' },
     { command: 'compact_on_idle', description: '🧹 Auto-compact after idle (toggle)' },
     { command: 'compact_summary', description: '📄 Post the compaction summary (toggle)' },
+    { command: 'bot_skills', description: '🧰 The bot\'s own skills for agents (on/off)' },
+    { command: 'task_agents', description: '🧵 How many tracker task agents work at once' },
+    { command: 'runners', description: '🖥 Runners — machines for the agents\' tests and builds' },
     { command: 'accounts', description: '👤 Claude accounts and OpenCode providers (switch, add, re-login, remove, connect, disconnect)' },
     { command: 'limits', description: '🚧 Usage limits — switch this topic' },
     { command: 'limits_autoswitch', description: '🔁 Automatic switching on a usage limit' },
@@ -10345,6 +11166,7 @@ exports.COMMANDS_MENU = [
     { command: 'update', description: '🔄 Bot updates: automatic, notify only, off' },
     { command: 'schedule', description: '⏰ Schedule a prompt (agent does the work)' },
     { command: 'reminders', description: '🔔 Reminders — add, list, delete (no agent)' },
+    { command: 'todo', description: '📋 Agents\' published todo lists' },
     { command: 'status', description: '📊 Show status' },
     { command: 'output', description: '📜 Last 500 lines' },
     { command: 'trace', description: '🛰 Output-trace recorder on/off' },
@@ -10650,7 +11472,7 @@ async function reattachExistingSessions(opts = { quietReattach: false }) {
                             // A per-turn process that outlived the bot is stopped as soon as its turn (if any) ends (L5).
                             stopAdoptedPerTurnSessionWhenIdle(key, ownerAdapter);
                         }
-                        if ((0, adoptedToolList_1.checkIsAdoptedToolListStale)({ persistedDigest: agent.mcpToolDigest, currentDigest: botMcpToolDigestReader?.(key.platform) ?? '' })) {
+                        if ((0, adoptedToolList_1.checkIsAdoptedToolListStale)({ persistedDigest: agent.mcpToolDigest, currentDigest: botMcpToolDigestReader?.(key) ?? '' })) {
                             console.log(`[reattach] ${(0, sessionKey_1.keyToString)(key)}: adopted with a stale tool list; it gets the current tools when it resumes after its idle stop`);
                         }
                         // The surviving process keeps the account it was spawned with. A switch the user picked while it worked is
@@ -10797,7 +11619,8 @@ async function reattachExistingSessions(opts = { quietReattach: false }) {
  * A persisted question is restored ONLY when its thread's session reattached
  * and is currently active (`adapter.checkIsActive`). Otherwise the question is
  * unreachable — the agent that asked it is gone — so it is dropped from the
- * store, preventing a stale entry from lingering across boots. The persisted
+ * store, preventing a stale entry from lingering across boots; its message is
+ * kept, closed as unanswered, and its pin released. The persisted
  * `messageId` is preserved, so the OLD buttons resolve correctly; the question
  * is never re-posted.
  *
@@ -10830,12 +11653,62 @@ function restorePendingQuestions() {
             restored += 1;
         }
         else {
+            // The agent that asked it is gone, so nobody can answer it: it is closed like any question that ends unanswered —
+            // its message stays with the «not answered» note in place of the buttons and its pin is released. The pin map is
+            // lost with the restart, so it is seeded from the saved message id for the clear to unpin that message.
+            const orphaned = (0, openCodeQuestionFlow_1.migratePendingQuestionState)(value);
+            if (orphaned.messageId !== null)
+                questionPinnedMessageId.set(keyStr, orphaned.messageId);
             clearPendingQuestion(key);
+            closeCapturedQuestionMessage(key, orphaned.messageId, orphaned.data.questions[orphaned.currentIndex])
+                .catch((e) => console.error('[pendingQuestion] closing the dropped question failed:', e));
             dropped += 1;
         }
     }
     console.log(`[reattach] pending questions: restored ${restored}, dropped ${dropped}`);
 }
+/**
+ * @description Bring back the questions the idle compaction re-asked, at boot. One whose conversation can still be
+ * resumed (a live adopted process, or a sleeping conversation whose id is kept) gets its buttons working again — a tap
+ * wakes it, as before the restart. One whose conversation is gone (released while the bot was down), or beside which a newer
+ * question waits already, cannot be answered / must not be: its message is closed as unanswered, never left with buttons that
+ * do nothing or that would answer the wrong question, and the saved record is dropped.
+ * MUST run AFTER {@link reattachExistingSessions} so session activity is known. A platform this instance does not serve
+ * is left alone, like {@link restorePendingQuestions}. A record saved BEFORE its re-ask was posted (`isPosted: false`: the bot
+ * stopped during the idle compaction) names the message the question waited in: when the conversation can be resumed the
+ * question is asked again now (nobody has had the chance to answer it) and that message says so; otherwise it is closed as
+ * unanswered like any other.
+ */
+function restoreReAskedQuestions() {
+    for (const [keyStr, saved] of Object.entries(state.getReAskedQuestions())) {
+        let key;
+        try {
+            key = (0, sessionKey_1.keyFromString)(keyStr);
+        }
+        catch {
+            continue;
+        }
+        if (!(0, connectorSet_1.checkIsServedConversation)(key, ENV.servedPlatforms))
+            continue;
+        // A question waits already (restored a moment ago, or asked anew by the agent that reattached): the copy's buttons would
+        // deliver their label into IT, and a question asked again now would sit beside it. Nor is there anything to deliver a label
+        // to once the conversation is gone.
+        const isConversationResumable = !pendingQuestions.has(keyStr) && ((0, createAdapter_1.getThreadAdapter)(key).checkIsActive(key) || getResumableSessionId(key) !== null);
+        if (isConversationResumable) {
+            if (saved.isPosted === false) {
+                // The bot stopped between the start of an idle compaction and its re-ask: the question was rejected on the agent's side
+                // and nobody has answered it — it is asked again now, and the message it waited in (what is saved) says so.
+                reAskInterruptedQuestion(key, saved).catch((e) => console.error('[reAskedQuestion] asking the interrupted question again failed:', e));
+            }
+            else {
+                restoreReAskedQuestion(key, saved);
+            }
+            continue;
+        }
+        // The copy is closed, never brought back; an interrupted question's message ends as unanswered, the one thing known of it.
+        closeSavedReAskedQuestion(key, saved);
+    }
+}
 /**
  * @description Re-arm persisted API-error retries (S6) so a pending kick —
  * especially a multi-hour usage-limit wait — survives a bot restart. MUST run
@@ -10905,23 +11778,20 @@ function markLimitEpisodeSettled(key) {
 }
 /**
  * @description When the parked `errorText` of a json-stream conversation was written, from its Claude transcript's
- * API-error entry ({@link getParkedErrorWrittenAtMs}); `null` when the transcript tail cannot be read or holds no such
+ * API-error entry ({@link readTranscriptErrorWrittenAtMs}); `null` when the transcript tail cannot be read or holds no such
  * entry — the recovery then goes by the stdout log's mtime.
  */
 function readParkedErrorWrittenAtMs(key, claudeSessionId, errorText) {
     const workDirDecision = getWorkDirStartDecision(key);
     if (!workDirDecision.ok)
         return null;
-    const transcriptPath = (0, claudeCliAdapter_1.getClaudeTranscriptPath)(workDirDecision.workDir, claudeSessionId);
-    try {
-        const sizeBytes = fs.statSync(transcriptPath).size;
-        const tail = (0, jsonStreamHost_1.readFileByteRange)(transcriptPath, Math.max(0, sizeBytes - limitEpisodeRecovery_1.limitEpisodeTailMaxBytes), sizeBytes);
-        return (0, limitEpisodeRecovery_1.getParkedErrorWrittenAtMs)(tail.toString('utf8'), errorText);
-    }
-    catch {
-        return null; // no transcript on disk — the mtime decides
-    }
+    return (0, transcriptErrorTime_1.readTranscriptErrorWrittenAtMs)((0, claudeCliAdapter_1.getClaudeTranscriptPath)(workDirDecision.workDir, claudeSessionId), errorText);
 }
+/**
+ * @description The threads whose limit episode the boot recovery armed and whose adopt is still replaying the downtime tail
+ * ({@link handleApiError} leaves the replay's copy of that error alone). An entry lives until the replay is over.
+ */
+const limitEpisodesOwnedByRecovery = new Set();
 /**
  * @description Recover a usage/session-limit episode that ENDED BEFORE this boot
  * and left no armed retry behind — the case {@link restoreApiRetries} cannot help
@@ -11005,6 +11875,10 @@ function recoverLimitEpisodesFromDisk() {
         void state
             .setLimitEpisodeRecovered(key, log)
             .catch(e => console.error('[limitRecovery] marker persist failed:', e));
+        // This episode is the recovery's alone: the adopt replays the same error a moment later (the tail was read from the
+        // saved offset), and `handleApiError` leaves that copy out until the replay is over.
+        limitEpisodesOwnedByRecovery.add(keyStr);
+        void ((0, createAdapter_1.getAdapter)(agent.name).whenAdoptReplayed?.(key) ?? Promise.resolve()).then(() => limitEpisodesOwnedByRecovery.delete(keyStr));
         void withThreadLocale(key, () => handleApiError(key, decision.cls, { isRecoveredEpisode: true }));
         recovered += 1;
     }
@@ -11204,6 +12078,8 @@ let connectorConversationHooks = new Map();
  * {@link clearThreadContextMarker}, which a stop clears too.
  */
 function noteConversationContextReset(key, reason) {
+    // A completed compaction or a fresh session: the agent forgot the board too (D20).
+    noteTodoFreshContext(key);
     connectorConversationHooks.get(key.platform)?.onContextReset(key, reason);
 }
 /**
@@ -11267,6 +12143,36 @@ async function remindAnswerTail(key, text) {
     await forwardPromptToAgent(key, (0, createAdapter_1.getThreadAdapter)(key), text, undefined, { isRequestReminder: true });
     return true;
 }
+/**
+ * @description How a conversation's session stands right now (`requests/sessionTurnProbe.ts`) — the one probe the
+ * wake-up engine and the todo reminder both poll.
+ */
+const probeThreadTurn = (0, sessionTurnProbe_1.createSessionTurnProbe)({
+    getAdapter: createAdapter_1.getThreadAdapter,
+    checkHasPendingQuestion: (keyString) => pendingQuestions.has(keyString),
+    checkHasQuestionPin: (keyString) => questionPinnedMessageId.has(keyString),
+    checkIsCompacting: (keyString) => threadsCompacting.has(keyString),
+    getApiRetryTimer: (keyString) => apiRetryTimers.get(keyString)?.timer,
+    checkIsWedgeRecoveryInFlight: (keyString) => wedgeRecoveriesInFlight.has(keyString),
+    checkIsRetryKickInFlight: (keyString) => apiRetryKicksInFlight.has(keyString),
+    checkIsSessionStarting: (keyString) => startupPromptBuffer.checkIsStarting(keyString),
+    serializeKey: sessionKey_1.keyToString,
+});
+/**
+ * @description The todo list's standalone reminder (D11 form b): a technical prompt, posted only into a live session
+ * that is idle right now — never a resume, never an interrupt (`postToIdleSession`). It opens no request and is never
+ * replayed; in a Jira conversation it is no hand-over and nothing of its turn reaches the issue (D58).
+ */
+async function postTodoReminder(key, text) {
+    const adapter = (0, createAdapter_1.getThreadAdapter)(key);
+    // A reminder dropped after an adopt replay (the session was no longer live and idle) was not posted.
+    let isDropped = false;
+    const isPosted = await (0, postToSession_1.postToIdleSession)({
+        checkIsIdle: () => adapter.checkIsActive(key) && !(adapter.checkIsBusy?.(key) ?? false),
+        forward: async () => { isDropped = (await forwardPromptToAgent(key, adapter, text, undefined, { isTechnicalPrompt: true })) === 'dropped'; },
+    });
+    return isPosted && !isDropped;
+}
 /**
  * @description The person took over the conversation (interrupt, quit, restart,
  * switch or resume of the session, a switch to another agent or a shell, leaving
@@ -11302,8 +12208,8 @@ function createSessionPostDeps() {
             // A scheduled run in a topic with requests on is a request (S7); a tracker's
             // post arrives with its request already open and its header in the text.
             const opening = await openTopicRequest(key, text, { source: 'scheduledRun', requesterId: topicRequest_1.scheduledRunRequester });
-            await deliverPromptOrBuffer(key, `${opening.header}${text}`, startupPromptBuffer.checkIsStarting(conversationKey));
-            trackTopicRequestTurn(key, opening);
+            const delivery = await deliverPromptOrBuffer(key, `${opening.header}${text}`, startupPromptBuffer.checkIsStarting(conversationKey));
+            await settleTopicRequestAfterDelivery(key, opening, delivery);
         },
         now: () => Date.now(),
         sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -11342,6 +12248,15 @@ function wireScheduler(wiring) {
             await state.upsertSchedule({ ...record, isCheckFailing: isFailing, updatedAt: new Date().toISOString() });
             await state.flush();
         },
+        recordAlertPin: async (jobId, messageId) => {
+            const record = state.getSchedules()[jobId];
+            if (!record)
+                return;
+            const alertPinMessageIds = [...(record.alertPinMessageIds ?? []), messageId];
+            await state.upsertSchedule({ ...record, alertPinMessageIds, updatedAt: new Date().toISOString() });
+            // Saved at once, like the failing flag: an id lost in a crash would leave its alert pinned for good.
+            await state.flush();
+        },
     });
     /**
      * The engine's deliver callback: the S4 pipeline plus the S8 unbound-pause
@@ -11377,6 +12292,11 @@ function wireScheduler(wiring) {
             const key = (0, sessionKey_1.keyFromString)(threadKeyStr);
             return (0, createAdapter_1.getThreadAdapterNameRaw)(key) ?? state.getAgent(key)?.name;
         },
+        unpinMessages: async (threadKeyStr, messageIds) => {
+            const key = (0, sessionKey_1.keyFromString)(threadKeyStr);
+            for (const messageId of messageIds)
+                await unpinMessageQuiet(key, messageId);
+        },
         // Routed through the outbound seam: the agent-facing file tool is a
         // connector delivery, not a direct call into the Telegram send pipeline.
         // The MCP surface is string-keyed (its `threadKey` arrives as text), so the
@@ -11391,13 +12311,26 @@ function wireScheduler(wiring) {
         sendMessagesToThread,
         compactConversation: (threadKeyStr) => armDeferredCompaction((0, sessionKey_1.keyFromString)(threadKeyStr)),
         listClaudeProfiles: listClaudeProfilesForAgent,
+        getRemoteRunRunnerLines: () => (0, runnerSummary_1.getRunnerSummaryLines)(),
+        // A refused tool call leaves one line in the bounded diagnostic log (agent-diag.log): the SDK refuses before the bot sees it.
+        logDiagnostic: diagLog_1.appendDiagLog,
         ...(jiraConnector
             ? { fetchJiraAttachment: (threadKeyStr, attachmentId) => jiraConnector.fetchAttachment((0, sessionKey_1.keyFromString)(threadKeyStr), attachmentId) }
             : {}),
+        // Read per request: General can turn the shared lists off, and the tools go with them.
+        get todos() {
+            return readTodoSettings().isEnabled
+                ? {
+                    update: (threadKeyStr, args) => getTodoTools().update((0, sessionKey_1.keyFromString)(threadKeyStr), args),
+                    read: (threadKeyStr, args) => getTodoTools().read((0, sessionKey_1.keyFromString)(threadKeyStr), args),
+                }
+                : undefined;
+        },
         answerRequest: (args) => (0, answerRequest_1.answerRequest)({
             ledger: wiring.requestLedger,
             answerSinks: wiring.answerSinks,
             onAnswerDelivered: (key, requestId, kind) => requestWakeUpEngine?.noteAnswerDelivered(key, requestId, kind),
+            getFinalAnswerNote: (key, requestCreatedAt) => (readTodoSettings().isEnabled ? getTodoRegistry().getFinalAnswerNote(key, requestCreatedAt) : null),
         }, args),
         whenSessionsRestored: wiring.whenSessionsRestored,
         getSecret: () => state.getSchedulerMcpSecret(),
@@ -11616,10 +12549,11 @@ async function prepareJiraConnectorOrExit() {
  * J5): the issue's binding, the request ledger, and the shared session post —
  * after which the wake-up engine watches the turn the request started.
  */
-function createJiraSessionDeps(requestLedger, adapterName) {
+function createJiraSessionDeps(requestLedger, slots, adapterName) {
     // D5: one conversation per issue — a session that sleeps between requests is resumed by the ensure (L-D4).
     const sessionPostDeps = createSessionPostDeps();
     return {
+        slots,
         bindConversation: async (key, folder) => {
             if (state.getBinding(key)?.subdir !== folder)
                 await state.setBinding(key, folder);
@@ -11629,7 +12563,7 @@ function createJiraSessionDeps(requestLedger, adapterName) {
         postRequest: async (key, requestId, prompt) => {
             // A request is the issue's "user message" (L-D5): it clears the spent idle-compaction
             // latch like a topic's message does, or the issue would never compact again.
-            noteThreadUserActivity(key);
+            notePersonActivity(key);
             const posted = await (0, postToSession_1.postToSession)(sessionPostDeps, (0, sessionKey_1.keyToString)(key), prompt, adapterName);
             if (!posted.ok) {
                 // R28: retried at about 1, 5 and 15 min, outside the wake-up cap.
@@ -11652,7 +12586,7 @@ async function startBot() {
     console.log(`Default Claude backend: ${(0, createAdapter_1.getDefaultClaudeBackendName)()}`);
     console.log(`Available agents: ${(0, createAdapter_1.getAvailableAdapters)().map(a => a.name).join(', ')}`);
     // 1. State store. The `[startup] DATA_DIR=` shape is load-bearing: the
-    // README's two-instances troubleshooting tells the operator to compare this
+    // docs/troubleshooting.md's two-instances section tells the operator to compare this
     // exact line across instances.
     state = await (0, state_1.getStateStore)({ saveDebounceMs: ENV.testTimings.stateSaveDebounceMs });
     console.log(`[startup] DATA_DIR=${path.dirname(state.stateFilePath)}`);
@@ -11682,6 +12616,8 @@ async function startBot() {
     //     It starts polling once the sessions are restored.
     // Every Claude spawn from here on reads the conversation's account profile (`/account`).
     (0, createAdapter_1.registerClaudeConfigDirReader)(resolveThreadClaudeConfigDir);
+    // The «Bot skills» switch (`/bot_skills`): every agent start, the OpenCode server's start and the bot MCP's instructions read it.
+    (0, botSkills_1.setBotSkillsReader)(botSkillsReader);
     (0, createAdapter_1.registerClaudeRateLimitSink)(onClaudeRateLimitEvent);
     (0, createAdapter_1.registerClaudeTurnCostSink)(onClaudeTurnCost);
     if (ENV.testTimings.openCodeServerUpBudgetMs !== undefined)
@@ -11690,6 +12626,7 @@ async function startBot() {
     claudeUsageRefresher.start();
     void claudeUsageRefresher.refreshAll();
     const jiraConnector = ENV.servedPlatforms.has('jira') ? await prepareJiraConnectorOrExit() : null;
+    todoJiraConversations = jiraConnector;
     if (jiraConnector) {
         const { launchDefaults } = jiraConnector;
         (0, createAdapter_1.registerSessionLaunchDefaultsReader)((key) => (key.platform === 'jira' ? launchDefaults : null));
@@ -11709,24 +12646,26 @@ async function startBot() {
         onRequestCreated: (key) => announceLimitWaitToNewRequest(key),
         // C4: a connector counts what a prompt carried as sent only once its agent took it in.
         onPromptSettled: (key, requestId, outcome) => connectorConversationHooks.get(key.platform)?.onPromptSettled(key, requestId, outcome),
+        // D10: a closed hand-over may free a task-agent slot for a waiting issue.
+        onRequestClosed: (record) => taskAgentSlots?.noteRequestClosed(record),
+        // D10: a request the wake-up engine gave up on no longer holds a slot either.
+        onRequestWakeStopped: (_key, request) => taskAgentSlots?.noteRequestWakeStopped(request),
     });
     await requestLedger.load();
+    const slots = new taskAgentSlots_1.TaskAgentSlots({
+        getMaxConcurrent: () => (0, taskAgentLimit_1.readTaskAgentLimit)(taskAgentLimitSources).maxConcurrent,
+        ledger: requestLedger,
+        store: state,
+    });
+    // A place held for a connector this process no longer serves could never start, and would hold up the others.
+    slots.dropUnserved((key) => (0, connectorSet_1.checkIsServedConversation)(key, ENV.servedPlatforms));
+    taskAgentSlots = slots;
     topicRequestLedger = requestLedger;
     // The wake-up engine (S4) watches the turns requests start. It is created now
     // but started only once the sessions are restored (its sweep reads them).
     requestWakeUpEngine = new wakeUpEngine_1.RequestWakeUpEngine({
         ledger: requestLedger,
-        probeTurn: (0, sessionTurnProbe_1.createSessionTurnProbe)({
-            getAdapter: createAdapter_1.getThreadAdapter,
-            checkHasPendingQuestion: (keyString) => pendingQuestions.has(keyString),
-            checkHasQuestionPin: (keyString) => questionPinnedMessageId.has(keyString),
-            checkIsCompacting: (keyString) => threadsCompacting.has(keyString),
-            getApiRetryTimer: (keyString) => apiRetryTimers.get(keyString)?.timer,
-            checkIsWedgeRecoveryInFlight: (keyString) => wedgeRecoveriesInFlight.has(keyString),
-            checkIsRetryKickInFlight: (keyString) => apiRetryKicksInFlight.has(keyString),
-            checkIsSessionStarting: (keyString) => startupPromptBuffer.checkIsStarting(keyString),
-            serializeKey: sessionKey_1.keyToString,
-        }),
+        probeTurn: probeThreadTurn,
         prepareWakeUpSession: (key, message) => prepareRequestWakeUpSession(key, message, key.platform === 'jira' ? jiraConnector?.adapterName : undefined),
         forwardWakeUp: forwardRequestWakeUp,
         deliverAlert: async (key, request, reason) => {
@@ -11739,6 +12678,7 @@ async function startBot() {
             return result.ok ? (result.alertRef ?? null) : null;
         },
         backstopMs: (0, wakeUpRules_1.getRequestBackstopMs)(process.env.REQUEST_BACKSTOP_MINUTES),
+        pollIntervalMs: ENV.testTimings.requestTurnPollMs,
         sweepIntervalMs: ENV.testTimings.requestSweepIntervalMs,
         firstPostRetryDelayMs: ENV.testTimings.requestFirstPostRetryDelayMs,
         // Only a Telegram topic in the answers-only view hides the stream from someone who expects to see the work.
@@ -11746,6 +12686,25 @@ async function startBot() {
         remindAnswerTail,
     });
     requestLimitWaitAnswerDeps = { ledger: requestLedger, engine: requestWakeUpEngine, answerSinks };
+    // The todo list's staleness reminder (D10–D12) polls the same turns; started once the sessions are restored.
+    todoReminderEngine = new reminderEngine_1.TodoReminderEngine({
+        registry: getTodoRegistry(),
+        listConversations: () => state.listBindings().map(({ key }) => key),
+        probeTurn: probeThreadTurn,
+        getGate: (key) => ({
+            hasOpenRequest: requestLedger.listOpenRequestsOf(key).length > 0,
+            isStoppingAfterTurn: (0, createAdapter_1.getThreadAdapter)(key).name === adapterNames_1.claudePerTurnAdapterName,
+            isAnswerTailFollowed: requestWakeUpEngine?.checkIsAnswerTailFollowed(key) ?? false,
+            ...getConversationAccountState(key),
+        }),
+        getIntervalMs: getTodoReminderIntervalMsNow,
+        checkIsEnabled: () => readTodoSettings().isEnabled,
+        postReminder: postTodoReminder,
+        midTurn: getTodoMidTurn(),
+        pollIntervalMs: ENV.testTimings.todoReminderPollMs,
+    });
+    getTodoMidTurn().clearInboxes();
+    warmTodoProjects();
     // Snapshot the persisted transient status-frame ids (S2) NOW, before reattach
     // can run any frame-id setter. A reattached session's first frame lifecycle
     // call persists the FRESH (all-null) in-memory state and would otherwise
@@ -11801,8 +12760,9 @@ async function startBot() {
     // that gives a conversation of another platform only its request-side handling
     // (Jira connector plan J2b, R2 — the routing table is unit-tested per event).
     const noteTurnOutput = (key) => {
-        // Output means a turn is under way — the wake-up engine's busy-onset signal.
+        // Output means a turn is under way — the wake-up engine's busy-onset signal, and the todo reminder's.
         requestWakeUpEngine?.noteAgentOutput(key);
+        todoReminderEngine?.noteAgentOutput(key);
     };
     (0, createAdapter_1.registerAdapterEventHandlers)({
         onOutput: (key, output, meta) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'output', () => {
@@ -11841,7 +12801,12 @@ async function startBot() {
         }),
         onStopped: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'stopped', () => withThreadLocale(key, () => handleAgentStopped(key)), () => clearForeignSessionState(key)),
         onSuspended: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'suspended', () => withThreadLocale(key, () => handleAgentSuspended(key)), () => scheduleLostWorkNote(key, takeLostWorkOf(key), 'holdExpired')),
-        onTurnEnded: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'turnEnded', () => handleAgentTurnEnded(key)),
+        onTurnEnded: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'turnEnded', () => {
+            // Every platform's (the route is `all`): the todo reminder's turn end, which the per-turn stop below would
+            // otherwise hide from its poll.
+            void todoReminderEngine?.noteAdapterTurnEnd(key).catch((e) => console.warn(`[todos] the turn end of ${(0, sessionKey_1.keyToString)(key)} was not noted:`, e instanceof Error ? e.message : e));
+            handleAgentTurnEnded(key);
+        }),
         onContextCompacted: (key, trigger) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'contextCompacted', () => noteConversationContextReset(key, `compaction (${trigger ?? 'bot'})`)),
         onConversationLost: (key) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'conversationLost', () => withThreadLocale(key, () => handleConversationLost(key)), () => { dropLostConversationWatermark(key); noteConversationContextReset(key, 'its transcript was lost'); }),
         onError: (key, error) => (0, adapterEventRouting_1.dispatchAdapterEvent)(key, 'error', () => withThreadLocale(key, () => handleAgentError(key, error)), () => {
@@ -11943,7 +12908,7 @@ async function startBot() {
     });
     // Known before any session starts or is adopted: every json-stream start persists the digest of the
     // tools it connected to, and the reattach compares an adopted process's against it (L4).
-    botMcpToolDigestReader = (platform) => schedulerMcpHandle.getToolDigest(platform);
+    botMcpToolDigestReader = (key) => schedulerMcpHandle.getToolDigest(key.platform, (0, botSkills_1.checkIsBotSkillsEnabled)(key));
     const isSchedulerMcpStarted = await (0, mcpBoot_1.runSessionBootPhase)({
         startBotMcp: () => (0, mcpBoot_1.startSchedulerMcpForBoot)({
             handle: schedulerMcpHandle,
@@ -11964,6 +12929,9 @@ async function startBot() {
             // existing option buttons keep working. A question is restored only for a
             // thread whose session came back; otherwise it is unreachable, dropped.
             restorePendingQuestions();
+            // The questions the idle compaction re-asked: their buttons come back while the conversation can be resumed,
+            // else the message is closed.
+            restoreReAskedQuestions();
             // Re-arm persisted API-error retries (S6) so a pending kick survives the
             // restart. AFTER restorePendingQuestions so the kick lands in a live
             // session; a past fireAt fires one delayed catch-up.
@@ -11986,7 +12954,8 @@ async function startBot() {
             markSessionsRestored();
             // From here the engine can tell a live turn from a dead session.
             requestWakeUpEngine?.start();
-            jiraConnector?.start(createJiraSessionDeps(requestLedger, jiraConnector.adapterName));
+            todoReminderEngine?.start();
+            jiraConnector?.start(createJiraSessionDeps(requestLedger, slots, jiraConnector.adapterName));
         },
         healActiveSessions: () => {
             // When this boot ADOPTED an already-running opencode, that server may
@@ -11994,11 +12963,13 @@ async function startBot() {
             // generation pointing at a now-dead port. Reconcile against the live MCP
             // status and force-refresh any directory that is not `connected`.
             // Fire-and-forget: boot must not block on opencode HTTP round-trips
-            // before `bot.launch()`. The compaction-plugin step goes FIRST: recreating
-            // a directory instance so it loads the plugin drops that directory's MCP
+            // before `bot.launch()`. The skills step (a server started without the
+            // bot's skills folder is replaced) and the compaction-plugin step go FIRST:
+            // a replaced server or a recreated directory instance drops the MCP
             // registration, which this same reconcile then restores.
             const openCodeAdapter = (0, createAdapter_1.getAdapter)('opencode');
             void (async () => {
+                await openCodeAdapter.activateAgentSkillsForServer?.();
                 await openCodeAdapter.activateCompactionPluginForActiveSessions?.();
                 await openCodeAdapter.reconcileSchedulerMcpForActiveSessions?.();
             })().catch((e) => console.warn('[scheduler] MCP reconcile failed:', e instanceof Error ? e.message : e));
@@ -12127,12 +13098,10 @@ async function startBot() {
         // thread that no longer owns a json-stream session (the normal stop /
         // release paths delete the dir themselves; reattach's adopt/orphan-kill
         // covers live tmux sessions — this covers their dirs).
-        void (0, jsonStreamHost_1.sweepOrphanJsonStreamDirs)((0, jsonStreamHost_1.resolveJsonStreamRoot)(getDataDir()), (key) => {
-            if ((0, createAdapter_1.getAdapter)(adapterNames_1.claudeJsonStreamAdapterName).checkIsActive(key))
-                return true;
-            const agent = state.getAgent(key);
-            return agent?.name === adapterNames_1.claudeJsonStreamAdapterName && !!agent.claudeSessionId;
-        })
+        void (0, jsonStreamHost_1.sweepOrphanJsonStreamDirs)((0, jsonStreamHost_1.resolveJsonStreamRoot)(getDataDir()), (key) => (0, jsonStreamHost_1.checkIsJsonStreamHostOwned)({
+            isSessionActive: [adapterNames_1.claudeJsonStreamAdapterName, adapterNames_1.claudePerTurnAdapterName].some((name) => (0, createAdapter_1.getAdapter)(name).checkIsActive(key)),
+            agent: state.getAgent(key),
+        }))
             .then((removedCount) => {
             if (removedCount > 0)
                 console.log(`[fileSweep] removed ${removedCount} orphan jsonstream dirs`);
@@ -12175,7 +13144,7 @@ async function startBot() {
         console.error('[bot.catch] unhandled error:', err, 'update:', ctx.updateType);
     });
     // 7. Shutdown — preserve active agents for restart/reattach. Use /quit
-    //    (or /quit-all) for an intentional agent stop; process signals only
+    //    (or /quitall) for an intentional agent stop; process signals only
     //    stop the bot itself. Ordering (bot.stop → state.flush →
     //    releaseLock → exit) is enforced by `gracefulShutdown` so the
     //    previous race against `lock.ts`'s synchronous `process.exit(0)`
@@ -12206,6 +13175,7 @@ async function startBot() {
             // means the next boot's rearmAll picks them back up (catch-up replay).
             schedulerEngine?.shutdown();
             requestWakeUpEngine?.stop();
+            todoReminderEngine?.stop();
             jiraConnector?.stop();
             if (isSchedulerMcpStarted)
                 void schedulerMcpHandle.stop().catch(() => { });
@@ -12291,6 +13261,9 @@ async function startBot() {
         console.warn('[platform] native Windows notice failed:', e instanceof Error ? e.message : e);
     }
     await startUpdates();
+    // Pairing messages of `/runners` turn into «paired» / «expired» (and survive this restart through the registry's notes).
+    if (ENV.servedPlatforms.has('telegram'))
+        startRunnersWatcher();
     // The local speech engine: clean up after an earlier run, re-attach to / start its install. Starts no process.
     void bootSttLocalEngine().catch((e) => console.warn('[STT] boot step failed:', e instanceof Error ? e.message : e));
     console.log(`Launching Telegraf bot (long polling, dropPendingUpdates=${bootMode.dropPendingUpdates})...`);