instar 1.3.1658 → 1.3.1660

package/dashboard/console/services-model.js

@@ -9,6 +9,8 @@ const BACKUP_WORDS = {
 };
 
 function choiceWord(s) {
+  if (s.stalled) return 'Setup stopped';
+  if (s.verified && s.verified.result === 'pass') return 'Working';
   if (s.choice === 'yes') return 'You said yes';
   if (s.choice === 'no' || s.legacyDeclined) return 'You said no';
   return s.available ? 'Not decided' : 'Not available yet';

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAkIA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA+J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAqmBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;4BAIwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAkajB;AA8xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA85BN;AAwsBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8s3BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAkIA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA+J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAymBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;4BAIwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAoajB;AA8xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA85BN;AAwsBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgz3BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}

package/dist/commands/server.js

@@ -1136,6 +1136,10 @@ let _quotaAwareScheduler = null;
 // Subscription & Auth Standard P1.3 — pre-limit proactive swap monitor. Null
 // until wired (requires the scheduler; gated behind subscriptionPool.proactiveSwap).
 let _proactiveSwapMonitor = null;
+// usage-wall-rescue — moves a session off a walled account (tagged or not) and
+// tags spawns. Null until wired next to the scheduler; read late by the
+// PresenceProxy wording hook.
+let _usageWallRescue = null;
 // swap-continuity-antithrash §3/§4 — the anti-thrash spine. The ledger + engine
 // load and hydrate UNCONDITIONALLY at boot (R4-L3: reactive rows append
 // regardless of antiThrash.enabled, so the index is warm at a mid-run flag
@@ -1411,7 +1415,9 @@ spawnOpts) {
         _topicResumeMap?.remove(topicId);
         console.log(`[spawnSessionForTopic] Context-exhaustion latch active for topic ${topicId} — forcing fresh spawn`);
     }
-    let resumeSessionId = _topicResumeMap?.get(topicId) ?? undefined;
+    // A group default can change the resolved framework without a per-topic pin
+    // event. Never pass a saved Claude UUID to Codex (or vice versa) at restart.
+    let resumeSessionId = _topicResumeMap?.getForFramework(topicId, framework) ?? undefined;
     if (resumeSessionId) {
         console.log(`[spawnSessionForTopic] Found resume UUID for topic ${topicId}: ${resumeSessionId} (source: TopicResumeMap — trusted)`);
     }
@@ -6577,23 +6583,64 @@ export async function startServer(options) {
             telegramOriginBoot = await bootTelegramOrigin({ config, token: typeof originBotToken === 'string' && originBotToken ? originBotToken : undefined,
                 onRecoveredMessage: entry => {
                     telegram?.logRecoveredOriginMessage(entry);
+                    // A late acceptance is reported by the durable exception scan. Only
+                    // an on-time acceptance can close the held Attention item here.
+                    if (entry.acceptedAt - entry.preparedAt >= 300_000)
+                        return;
                     const attentionId = `telegram-origin-held-reply:${entry.operationId}`;
                     if (telegram?.clearAttentionCondition({ id: attentionId }, `Telegram accepted recovered message ${entry.messageId}.`).closed === 0) {
                         void telegram?.updateAttentionStatus(attentionId, 'DONE', { silent: true,
                             closedBy: 'cause-cleared', resolution: `Telegram accepted recovered message ${entry.messageId}.` });
                     }
                 },
-                onSessionDeliveryHeld: entry => {
+                onSessionDeliveryHeld: async (entry) => {
                     if (!telegram || !entry.chatId)
                         return;
+                    const { sessionDeliveryNotice, lateRecoveredReplyNotice } = await import('../messaging/telegram-origin/SessionDeliveryNotice.js');
                     const topicId = entry.chatId === String(originTelegramConfig.config.issuesChatId)
                         ? 10_000_000_000 + (entry.threadId ?? 1) : entry.threadId;
-                    void telegram.createAttentionItem({ id: `telegram-origin-held-reply:${entry.operationId}`,
-                        category: 'telegram-origin', priority: 'HIGH', title: 'A session reply is delayed',
-                        sourceContext: 'telegram-origin-session-hold',
-                        summary: `A reply to topic ${topicId ?? 'unknown'} is still in the delivery queue. Telegram was unreachable before this attempt connected; the server will retry the same message.`,
-                        description: `Operation ${entry.operationId}. The advisory preflight does not confirm delivery.` }, { hubOnly: true })
-                        .catch(error => console.warn('[telegram-origin] held reply attention unavailable', error instanceof Error ? error.name : 'unknown-error'));
+                    const late = entry.state === 'accepted' && entry.preparedAt !== undefined && entry.acceptedAt !== null && entry.acceptedAt !== undefined
+                        ? lateRecoveredReplyNotice(entry.preparedAt, entry.acceptedAt, entry.outOfOrder) : null;
+                    const attentionId = `telegram-origin-held-reply:${entry.operationId}`;
+                    const previous = telegram.getAttentionItem(attentionId);
+                    if (entry.state === 'accepted' && !late) {
+                        if (previous && previous.status !== 'DONE')
+                            await telegram.updateAttentionStatus(attentionId, 'DONE', { silent: true,
+                                closedBy: 'cause-cleared', resolution: 'Telegram accepted the original reply.' });
+                        return;
+                    }
+                    const copy = entry.state === 'accepted'
+                        ? { summary: 'An earlier reply was confirmed after a delay and may be out of order with newer answers.', topicText: late }
+                        : sessionDeliveryNotice(entry.state ?? 'held', entry.uncertain);
+                    if (entry.state === 'accepted' && previous?.status === 'DONE' && previous.summary === copy.summary)
+                        return;
+                    await telegram.upsertAttentionItem({ id: attentionId,
+                        category: 'telegram-origin', priority: 'HIGH', title: 'A reply needs delivery attention',
+                        sourceContext: 'telegram-origin-session-hold', summary: copy.summary,
+                        description: `Original reply to topic ${topicId ?? 'unknown'}; delivery state ${entry.state ?? 'held'}.` });
+                    if (topicId === null)
+                        return;
+                    // A stable logical send id lets the origin outbox answer a repeated
+                    // notice with its original receipt, including after a server restart.
+                    // A held/uncertain notice is retried by the next durable scan.
+                    if (!telegramOriginBoot)
+                        throw new Error('origin notice sender not ready');
+                    const { postOriginAutomationReply } = await import('../messaging/telegram-origin/OriginAutomationReply.js');
+                    const noticeState = entry.state === 'accepted' ? 'late'
+                        : entry.uncertain || entry.state === 'outcome-unknown' ? 'uncertain'
+                            : entry.state === 'expired' || entry.state === 'known-failed' ? 'failed' : 'delayed';
+                    const response = await postOriginAutomationReply({ service: telegramOriginBoot.runtime.service,
+                        port: config.port, authToken: config.authToken ?? '', producerId: 'reply-delivery-notice',
+                        topicId, body: { text: copy.topicText, metadata: { messageKind: 'health-alert' } },
+                        logicalSendId: `reply-delivery-notice:${entry.operationId}:${noticeState}` });
+                    if (response.status !== 200)
+                        throw new Error(`origin notice not confirmed: HTTP ${response.status}`);
+                    if (entry.state === 'accepted') {
+                        if (telegram.clearAttentionCondition({ id: attentionId }, 'The late reply and its explanation reached the conversation.').closed === 0) {
+                            await telegram.updateAttentionStatus(attentionId, 'DONE', { silent: true,
+                                closedBy: 'cause-cleared', resolution: 'The late reply and its explanation reached the conversation.' });
+                        }
+                    }
                 },
                 noticeOwner: typeof originBotToken === 'string' && !!originBotToken && !lifelineOwnsTelegramPoll(config.stateDir, originBotToken) && options.telegram !== false,
                 holdsLease: () => coordinator.holdsLease(),
@@ -6824,6 +6871,7 @@ export async function startServer(options) {
                     defaultFramework: () => _defaultFramework,
                     configTopicFrameworks: () => _topicFrameworks,
                     configProfileDefaults: () => topicProfilesCfg?.defaults ?? {},
+                    configGroupDefaults: () => topicProfilesCfg?.groupDefaults ?? {},
                     frameworkDefaultModels: () => config.sessions?.frameworkDefaultModels ?? {},
                     tierEscalationConfig: () => normalizeTierEscalationConfig(config.models?.tierEscalation),
                     localModelBinding: (topicKey) => _topicLocalModelStore?.get(Number(topicKey)) ?? null,
@@ -16060,6 +16108,9 @@ export async function startServer(options) {
                     hasContextExhaustionLatch: sessionRecovery
                         ? (topicId) => sessionRecovery.hasContextWedgedSeen(topicId)
                         : undefined,
+                    // usage-wall-rescue: when another account has room, the standby says
+                    // the session is being moved — never "paused until reset".
+                    describeQuotaWall: (sessionName) => _usageWallRescue?.describeWall(sessionName) ?? null,
                     // Shared per-topic mutex — coordinates with PromiseBeacon.
                     acquireProxyMutex: (topicId, holder) => proxyCoordinator.tryAcquire(topicId, holder),
                     releaseProxyMutex: (topicId, holder) => proxyCoordinator.release(topicId, holder),
@@ -21143,8 +21194,8 @@ export async function startServer(options) {
                 onNoAlternate: telegramRef ? (sessionName, exhaustedAccountId) => {
                     void telegramRef.createAttentionItem({
                         id: `subpool-no-alternate-${exhaustedAccountId}`,
-                        title: 'Subscription pool — no alternate account to swap to',
-                        summary: `Session "${sessionName}" hit account "${exhaustedAccountId}"'s quota and there's no other eligible account in the pool. The session falls back to the existing rate-limit back-off; consider enrolling another account.`,
+                        title: 'Every subscription account is at its usage limit',
+                        summary: `Session "${sessionName}" reached the usage limit on account "${exhaustedAccountId}", and no other connected account has room. It will carry on by itself when the limit resets. Connecting another account would let it carry on sooner.`,
                         category: 'subscription-pool',
                         priority: 'HIGH',
                         sourceContext: 'subscription-pool:no-alternate',
@@ -21152,36 +21203,84 @@ export async function startServer(options) {
                 } : undefined,
                 logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
             });
-            // DARK auto-trigger: only when explicitly enabled does a rate-limit
-            // escalation drive an account swap. Default off — opt-in per Justin's
-            // tier-2 sign-off (auto-swapping live sessions is real authority).
-            if (config.subscriptionPool?.autoSwapOnRateLimit) {
-                rateLimitSentinel.on('rate-limit:escalated', (rlState) => {
-                    const sessionName = rlState?.sessionName;
-                    if (!sessionName)
-                        return;
-                    // Resolve which account this session is running under; only pool-managed
-                    // sessions are swap-eligible (others fall back to the existing back-off).
-                    const session = state.listSessions({ status: 'running' })
-                        .find(s => s.tmuxSession === sessionName);
-                    const accountId = session?.subscriptionAccountId;
-                    if (!accountId)
-                        return;
-                    void _quotaAwareScheduler?.onQuotaPressure({
-                        sessionName,
-                        exhaustedAccountId: accountId,
-                        nowMs: Date.now(),
-                        framework: session?.framework ?? 'claude-code',
-                    });
+            // usage-wall-rescue (docs/specs/usage-wall-rescue.md). ONE switch,
+            // `subscriptionPool.wallRescue.enabled` (default true, operator-approved
+            // 2026-11-04), read LIVE; effective only while the pool has 2+ usable
+            // accounts of the session's framework. Covers untagged sessions by
+            // resolving the account the session is actually on.
+            const { UsageWallRescue } = await import('../core/UsageWallRescue.js');
+            const readWallRescueConfig = () => liveConfig.get('subscriptionPool', config.subscriptionPool);
+            _usageWallRescue = new UsageWallRescue({
+                readConfig: readWallRescueConfig,
+                listAccounts: () => subscriptionPool.list(),
+                getSession: (name) => state.listSessions({ status: 'running' }).find((s) => s.tmuxSession === name),
+                configHomeForSession: (name) => sessionManager.configHomeForSession(name),
+                resolveDefaultAccountId: async () => (await inUseAccountResolver.resolve(subscriptionPool.list())).activeAccountId,
+                swap: (a) => _quotaAwareScheduler
+                    ? _quotaAwareScheduler.onQuotaPressure(a)
+                    : Promise.resolve({ swapped: false, toAccountId: null, reason: 'scheduler-unavailable' }),
+                // Plain notice to the conversation, only when the session cannot be
+                // moved (no account has room, or moves kept failing).
+                // Coalesced: one in-flight poll at a time and at most one per minute, so
+                // many sessions holding on a stale reading cannot fan out pool polls.
+                requestQuotaRefresh: (() => {
+                    let inFlight = false;
+                    let lastAt = 0;
+                    return () => {
+                        const now = Date.now();
+                        if (inFlight || now - lastAt < 60_000)
+                            return;
+                        inFlight = true;
+                        lastAt = now;
+                        void Promise.resolve(quotaPoller.pollAll())
+                            .catch(() => { })
+                            .finally(() => { inFlight = false; });
+                    };
+                })(),
+                notifyUser: (sessionName, text) => {
+                    const raw = telegram?.getTopicForSession(sessionName);
+                    const topicId = typeof raw === 'number' ? raw : Number(raw);
+                    if (raw == null || !Number.isFinite(topicId))
+                        return false;
+                    // Resolves true only on a confirmed send; anything else leaves the
+                    // standby to report the wall.
+                    return sendAutomationReply('usage-wall-rescue', topicId, { text, metadata: { provenance: 'automation' } }, deterministicAutomationAuthor())
+                        .then((resp) => resp.ok === true)
+                        .catch(() => false);
+                },
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            const wallRescue = _usageWallRescue;
+            void wallRescue.refreshDefaultAccount();
+            const wallRescueDefaultTimer = setInterval(() => { void wallRescue.refreshDefaultAccount(); }, 60_000);
+            wallRescueDefaultTimer.unref?.();
+            // The trigger: the watchdog's settled usage-wall signal.
+            if (watchdog) {
+                watchdog.on('usage-wall', (sessionName) => {
+                    void wallRescue.onUsageWall(sessionName);
+                });
+                watchdog.on('usage-wall-cleared', (sessionName) => {
+                    wallRescue.onWallCleared(sessionName);
                 });
             }
-            // Subscription-pool session PINNING (Subscription & Auth Standard): when
-            // enabled, new claude-code spawns launch on the scheduler-picked optimal
-            // account (reset-date / headroom score) and carry its id. This is the
-            // prerequisite that makes auto-swap functional — without a session→account
-            // tag, the swap engine has nothing to move. Default off → spawns use the
-            // default config exactly as before (the resolver stays unwired).
-            if (config.subscriptionPool?.pinSessionsToPool) {
+            // Legacy opt-in: an explicit autoSwapOnRateLimit:true also moves a session
+            // on a server-throttle escalation (a throttle is shared capacity, so the
+            // default-on rescue does not move sessions for it). It goes through the
+            // SAME funnel and brakes as the wall; untagged sessions are resolved
+            // instead of skipped. The live config is checked per event.
+            rateLimitSentinel.on('rate-limit:escalated', (rlState) => {
+                const sessionName = rlState?.sessionName;
+                if (!sessionName)
+                    return;
+                void wallRescue.onThrottleEscalated(sessionName);
+            });
+            // Session PINNING / tagging. An explicit pinSessionsToPool:true pins
+            // every claude-code spawn (as before). Otherwise the rescue's resolver
+            // tags spawns when the pool has 2+ usable accounts (so no session is
+            // untagged) and, with pinning explicitly off, still refuses to launch on
+            // a default login the pool knows is walled. 0/1 usable accounts → null →
+            // the default login, exactly as before.
+            if (config.subscriptionPool?.pinSessionsToPool === true) {
                 const { selectAccount } = await import('../core/QuotaAwareScheduler.js');
                 sessionManager.setSpawnAccountResolver(() => {
                     const acct = selectAccount(subscriptionPool.list(), { nowMs: Date.now(), framework: 'claude-code' });
@@ -21189,12 +21288,16 @@ export async function startServer(options) {
                 });
                 console.log(pc.green('  Subscription-pool session pinning enabled'));
             }
+            else {
+                sessionManager.setSpawnAccountResolver(() => wallRescue.spawnAccount());
+            }
             // ProactiveSwapMonitor (Subscription & Auth Standard P1.3 — the PRE-LIMIT
             // half). Moves a session OFF an account BEFORE it walls, at a lag-aware
-            // measured threshold. Complements the reactive autoSwapOnRateLimit (which
-            // only fires AFTER the wall) and covers UNTAGGED sessions by resolving the
-            // default-config login — so the primary interactive session is swap-visible
-            // instead of wedging (the 2026-06-09 failure). DARK by default: only runs
+            // measured threshold. Complements the reactive usage-wall rescue (which
+            // only fires AFTER the wall). It does NOT move untagged sessions (Q3):
+            // those are reached by the default-slot repoint arm, and on a pool with
+            // 2+ usable accounts the wall rescue tags new spawns so few stay
+            // untagged. DARK by default: only runs
             // when subscriptionPool.proactiveSwap.enabled is true (moving live sessions
             // is real authority).
             const proactiveCfg = config.subscriptionPool?.proactiveSwap;
@@ -30372,7 +30475,7 @@ export async function startServer(options) {
         const server = new AgentServer({ config, ecosystemLedger: _ecosystemLedger ?? undefined, recommendedServicesLedger: _recommendedServicesLedger ?? undefined, singleInstanceLock, agentIdentity: _agentIdentityDeps, terminateSessionAuthority: terminateWithAuthority, subscriptionEmailBinding: credentialLocationLedger, subscriptionEmailBarrier, subscriptionIdentityOracle, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, telegramOrigin: telegramOriginBoot?.runtime, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, jobAnomalySendAutomationReply: sendAutomationReply, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographerRoots: cartographerRoots ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, verifiedEntityName(m.machineId, m.nickname) ?? ''])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? '', url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: verifiedEntityName(m.machineId, m.nickname) ?? '', url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, localVerify: localVerifyService ?? undefined, localVerifyStatus: localVerifyStatus ?? undefined, guardLatchStore: guardLatchStore ?? undefined, agentStopSurfacer: agentStopSurfacer ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, appConversations: _appConversationService ?? undefined, slackInboundDispatch: () => _slackInboundDispatch, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, peerHomebaseRelay, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, pairingInvites: threadlinePairingInvites, getLastRelayEvent: threadlineGetLastRelayEvent, a2aRelayForward: _a2aRelayForwardCtx ?? undefined, threadlineReplyWaiters, threadlineMcpHttp, memoryPrivacy: _memoryPrivacyWired ?? undefined, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, replicatedStoreReconciler, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, claimTopicOwnershipOnSpawn: (topicId) => _claimOwnershipForAutonomousSpawn ? _claimOwnershipForAutonomousSpawn(topicId) : 'unwired', topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, recordRopeResult: _recordRopeResult ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, codexArmSessionSweeper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx });
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, usageWallRescue: _usageWallRescue ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, localVerify: localVerifyService ?? undefined, localVerifyStatus: localVerifyStatus ?? undefined, guardLatchStore: guardLatchStore ?? undefined, agentStopSurfacer: agentStopSurfacer ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, appConversations: _appConversationService ?? undefined, slackInboundDispatch: () => _slackInboundDispatch, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, peerHomebaseRelay, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, pairingInvites: threadlinePairingInvites, getLastRelayEvent: threadlineGetLastRelayEvent, a2aRelayForward: _a2aRelayForwardCtx ?? undefined, threadlineReplyWaiters, threadlineMcpHttp, memoryPrivacy: _memoryPrivacyWired ?? undefined, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, replicatedStoreReconciler, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, claimTopicOwnershipOnSpawn: (topicId) => _claimOwnershipForAutonomousSpawn ? _claimOwnershipForAutonomousSpawn(topicId) : 'unwired', topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, recordRopeResult: _recordRopeResult ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, codexArmSessionSweeper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx });
         if (_pendingCompactionEvidence)
             featureEvidence.record('multiMachine.coherenceJournal.replication.compaction', _pendingCompactionEvidence); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         const readIdentityProjectionPeerRows = async () => {