pi-roundtable 0.8.0 → 0.9.1

package/src/core/discord/owner-command.ts

@@ -7,7 +7,13 @@ import {
 	SlashCommandSubcommandGroupBuilder,
 } from "discord.js";
 import { messages } from "../i18n/index.ts";
+import type { IdentityService } from "../identity/identity-service.ts";
 import type { Logger } from "../log.ts";
+import {
+	type DiscordActor,
+	DiscordOwners,
+	discordUser,
+} from "./discord-owners.ts";
 import type {
 	CommandGuard,
 	CommandRoot,
@@ -33,31 +39,36 @@ export const groupOption = (
 ): RootOption => build(new SlashCommandSubcommandGroupBuilder()).toJSON();
 
 /**
- * Only the owner may use the root command, checked by user ID; every answer is visible only to them,
- * and a failure becomes a panel instead of a hanging interaction.
+ * Only an owner may use the root command: the primary owner by user ID, and, with the identity
+ * service, every other owner principal's Discord identity, checked again each time. Every answer
+ * is visible only to them, and a failure becomes a panel instead of a hanging interaction.
  */
-// pi-lens-ignore: large-class — two methods: the owner check and the failure panel
+// pi-lens-ignore: large-class — three methods: the owner checks and the failure panel
 export class OwnerGuard implements CommandGuard {
-	readonly #ownerId: string;
+	readonly #owners: DiscordOwners;
 	readonly #logger: Logger;
 	/** The name of the root command the guard serves, without the slash. */
 	readonly root: string;
 	readonly refusalHint: string | undefined;
 
 	constructor(
-		ownerId: string,
+		owners: DiscordOwners,
 		logger: Logger,
 		root: string,
 		refusalHint?: string,
 	) {
-		this.#ownerId = ownerId;
+		this.#owners = owners;
 		this.#logger = logger;
 		this.root = root;
 		this.refusalHint = refusalHint;
 	}
 
+	allows(actor: DiscordActor): Promise<boolean> {
+		return this.#owners.isOwner(discordUser(actor));
+	}
+
 	isOwner(actor: { user: { id: string } }): boolean {
-		return actor.user.id === this.#ownerId;
+		return actor.user.id === this.#owners.primary;
 	}
 
 	/** Runs a handler; failures become a panel instead of a hanging interaction. */
@@ -82,8 +93,10 @@ export class OwnerGuard implements CommandGuard {
 
 /** What `commandGuard` needs. */
 export interface CommandGuardOptions {
-	/** The one user who may use the owner's commands. */
+	/** The primary owner's Discord user id, who may always use the owner's commands. */
 	ownerId: string;
+	/** Which other owners there are and whether they still are; without it only `ownerId` may. */
+	identity?: Pick<IdentityService, "resolve" | "owners" | "identities">;
 	/** The name of the root command the guard serves, without the slash. */
 	root: string;
 	/** Where a failing command is logged. */
@@ -94,9 +107,10 @@ export interface CommandGuardOptions {
 
 /** A guard for the owner's commands, such as the one a test hands a module; the Discord plugin makes its own. */
 export function commandGuard(options: CommandGuardOptions): CommandGuard {
+	const { ownerId, identity, logger } = options;
 	return new OwnerGuard(
-		options.ownerId,
-		options.logger,
+		new DiscordOwners({ ownerId, ...(identity ? { identity } : {}), logger }),
+		logger,
 		options.root,
 		options.refusalHint,
 	);
@@ -121,7 +135,7 @@ const refusal = (hint: string | undefined) =>
 		sections: [`${messages().ownerRefusalBody}${hint ?? ""}`],
 	});
 
-/** Answers a feature's root subcommands and components, for the owner only. */
+/** Answers a feature's root subcommands and components, for the owners only. */
 export function ownerCommandModule(
 	guard: CommandGuard,
 	handlers: OwnerCommandHandlers,
@@ -139,14 +153,14 @@ export function ownerCommandModule(
 		async handle(interaction) {
 			if (interaction.isAutocomplete()) {
 				if (!owned(interaction)) return false;
-				if (!guard.isOwner(interaction)) await interaction.respond([]);
+				if (!(await guard.allows(interaction))) await interaction.respond([]);
 				else await handlers.autocomplete?.(interaction);
 				return true;
 			}
 			if (await handlers.component?.(interaction)) return true;
 			if (!interaction.isChatInputCommand() || !owned(interaction))
 				return false;
-			if (!guard.isOwner(interaction)) {
+			if (!(await guard.allows(interaction))) {
 				await interaction.reply(refusal(guard.refusalHint));
 				return true;
 			}

package/src/core/discord/stop-button.ts

@@ -12,7 +12,7 @@ import type { CommandGuard, InteractionModule } from "./interaction-module.ts";
 
 export const STOP_BUTTON_ID = "roundtable:stop";
 
-/** The message a long turn shows: a stop button only the owner may press. */
+/** The message a long turn shows: a stop button only an owner may press. */
 export function stopPanel() {
 	return {
 		content: messages().stopNote,
@@ -29,13 +29,13 @@ export function stopPanel() {
 }
 
 export interface StopButtonOptions {
-	guard: Pick<CommandGuard, "isOwner">;
+	guard: Pick<CommandGuard, "allows">;
 	/** Stops the running turn of the channel the button was pressed in, through its claim. */
 	conversations: Pick<ConversationPort, "stop">;
 }
 
 /**
- * Answers a press of the stop button: only the owner stops the channel's turn, and the answer,
+ * Answers a press of the stop button: only an owner stops the channel's turn, and the answer,
  * visible only to whoever pressed, says whether one was running.
  */
 export function stopButtonModule(
@@ -46,7 +46,7 @@ export function stopButtonModule(
 		handle: async (interaction: Interaction) => {
 			if (!interaction.isButton() || interaction.customId !== STOP_BUTTON_ID)
 				return false;
-			const owner = options.guard.isOwner(interaction);
+			const owner = await options.guard.allows(interaction);
 			const stopped =
 				owner &&
 				options.conversations.stop(

package/src/core/domain/conversation.ts

@@ -27,10 +27,15 @@ export interface PendingConfirmation {
 	heldAt: Date;
 	calls: HeldCall[];
 	/**
-	 * The speaker whose turn held the calls. Besides the owner, only they may approve them, at a
-	 * tier that holds them; without one, the owner alone may.
+	 * The speaker whose turn held the calls, by their id on the surface. Besides the owners, only
+	 * they may approve them, at a tier that holds them; without one, the owners alone may.
 	 */
 	speakerId?: string;
+	/**
+	 * The principal of that speaker, who approves them on any of their identities; absent for
+	 * calls held before 0.9, which are matched by `speakerId`.
+	 */
+	principalId?: string;
 }
 
 /** A file produced for a reply; data is raw bytes, not a path or base64. */

package/src/core/domain/errors.ts

@@ -29,3 +29,8 @@ export class DelegationError extends Error {
 export class AgentError extends Error {
 	override name = "AgentError";
 }
+
+/** A principal, identity link, or role change that cannot be made; its message names what to fix. */
+export class IdentityError extends Error {
+	override name = "IdentityError";
+}

package/src/core/domain/ports.ts

@@ -7,6 +7,11 @@ import type { TurnProgress } from "./progress.ts";
 
 export type { AgentTurnScope };
 
+/** Who a turn's conversation belongs to. */
+export type TurnConversation =
+	| { visibility: "private"; principalId: string }
+	| { visibility: "shared" };
+
 export interface TurnRequest {
 	/** Where the turn's message arrived and its attachments are saved. */
 	channel: ChannelKey;
@@ -19,8 +24,18 @@ export interface TurnRequest {
 	confirmed?: boolean;
 	/** Set for a turn of an agent-server agent. */
 	agent?: AgentTurnScope;
-	/** The person the turn is for: who wrote the message, or who set up the work. */
-	speaker?: Speaker;
+	/**
+	 * The person the turn is for: who wrote the message, or who set up the work; the turn runs at
+	 * their tier. Required: a turn without one is refused, never run as the owner's. A plugin that
+	 * starts a turn on someone's behalf gets theirs from `IDENTITY.speakerFor`.
+	 */
+	speaker: Speaker;
+	/**
+	 * Who the conversation belongs to, as the host records it: `private` to one principal, or
+	 * `shared` by whoever its claim admits, which it is taken to be when absent. A private
+	 * conversation's prompts are its person's alone; a shared one's escalate to the owners.
+	 */
+	conversation?: TurnConversation;
 	/**
 	 * The conversation's kind, fixed when its session is made: the string a claim's `startFresh`
 	 * returns, which picks the persona of a non-agent conversation. "owner" when absent.
@@ -54,6 +69,16 @@ export type {
 	YesNoQuestion,
 } from "../contract/providers.ts";
 
+/** Sends a person a notice through their own channel; resolves false when they have none. */
+export interface Notifier {
+	notify(principalId: string, text: string): Promise<boolean>;
+}
+
+/**
+ * Sends the primary owner a direct message.
+ * @deprecated Since 0.9 there may be more than one owner: reach a person with a `Notifier`, such as
+ * `context.directChannels`. Goes away in 1.0.
+ */
 export interface OwnerNotifier {
 	notifyOwner(text: string): Promise<void>;
 }

package/src/core/drain.ts

@@ -1,19 +1,32 @@
-/** How long a shutdown waits for running work before aborting it (self-maintenance spec behavior 11). */
-export const DRAIN_LIMIT_MS = 60 * 60_000;
+import type { Logger } from "./log.ts";
+
+/**
+ * How long a shutdown waits for running work before aborting it: long enough for a usual turn to
+ * answer, short enough that a hung one never holds a restart for an hour.
+ */
+export const DRAIN_LIMIT_MS = 3 * 60_000;
+
+/** How long work that was told to stop gets to end before the shutdown goes on without it. */
+const ABORT_GRACE_MS = 10_000;
 
 export interface DrainOptions {
 	/** What still runs or waits, one entry per piece of work; empty when idle. */
 	busy: () => string[];
+	/** The most the drain waits for running work; DRAIN_LIMIT_MS by default. */
 	limitMs?: number;
+	/** How often it looks again; one second by default. */
 	intervalMs?: number;
+	/** The most work told to stop at the limit gets to end; ABORT_GRACE_MS by default. */
+	abortGraceMs?: number;
 	sleep?: (ms: number) => Promise<void>;
 	now?: () => number;
 }
 
 /**
- * Waits until nothing runs or waits, checking every interval, for at most the limit. Work that
- * arrives meanwhile is served as usual and waited for too. Returns what was still busy when the
- * limit ran out, or an empty list once idle.
+ * Waits until nothing runs or waits, checking every interval, for at most the limit. Returns what
+ * was still busy when the limit ran out, or an empty list once idle. It only waits: the host stops
+ * work from starting before it calls this, and a caller that does not must expect work that
+ * arrives meanwhile to be waited for too.
  */
 export async function waitUntilIdle(options: DrainOptions): Promise<string[]> {
 	const {
@@ -31,3 +44,41 @@ export async function waitUntilIdle(options: DrainOptions): Promise<string[]> {
 		await sleep(intervalMs);
 	}
 }
+
+/**
+ * Waits for running work up to the limit; if some is left, tells it to stop (`abort` says whether
+ * it told any) and gives it the abort grace to end. Returns what the limit ran out on, even when stopping it worked, so the
+ * caller can hand it over as cut short.
+ */
+export async function drainWork(
+	options: DrainOptions & { abort: (left: string[]) => boolean },
+): Promise<string[]> {
+	const { abort, abortGraceMs = ABORT_GRACE_MS, ...waiting } = options;
+	const left = await waitUntilIdle(waiting);
+	if (left.length === 0) return left;
+	// Work nothing could be told to stop would only be waited for in vain.
+	if (abort(left)) await waitUntilIdle({ ...waiting, limitMs: abortGraceMs });
+	return left;
+}
+
+/**
+ * Tells each channel's running turn to stop, as the owner's stop does; a failure is logged and the
+ * rest are still told. Whether any turn was running to be told.
+ */
+export function stopTurns(
+	channels: readonly string[],
+	stop: (channel: string) => boolean,
+	logger: Logger,
+): boolean {
+	let stopped = false;
+	for (const channel of new Set(channels)) {
+		try {
+			const told = stop(channel);
+			logger.warn({ channel, told }, "stopping the turn");
+			stopped ||= told;
+		} catch (error) {
+			logger.error({ channel, err: error }, "the turn could not be stopped");
+		}
+	}
+	return stopped;
+}

package/src/core/errors.ts

@@ -27,3 +27,16 @@ export class JudgeError extends Error {
 export class ProviderError extends Error {
 	override name = "ProviderError";
 }
+
+/**
+ * Work refused because the host is shutting down: once the drain starts, no turn, queue task, or
+ * background run starts any more, and what was waiting behind a running one is dropped.
+ */
+export class HostStoppingError extends Error {
+	override name = "HostStoppingError";
+	constructor() {
+		super(
+			"the host is shutting down and starts no new work; try again once it is back",
+		);
+	}
+}

package/src/core/host-background.ts

@@ -0,0 +1,56 @@
+import type { Logger } from "./log.ts";
+import type { ServiceStartedEvent } from "./plugin.ts";
+import type { Registry } from "./registry/contributions.ts";
+
+type Attempt = { ok: true } | { ok: false; error: unknown };
+
+/** Runs one step whose failure the caller reports and moves past. */
+export async function attempt(
+	step: () => Promise<void> | void,
+): Promise<Attempt> {
+	try {
+		await step();
+		return { ok: true };
+	} catch (error) {
+		return { ok: false, error };
+	}
+}
+
+/**
+ * Runs every service's background start at once and tells every plugin, as each ends, how it
+ * went; the rest of the process runs either way, and a failing start or handler never stops the
+ * others.
+ */
+export async function startInBackground(
+	registry: Registry,
+	logger: Logger,
+): Promise<void> {
+	const { services, servicePlugins, handlers } = registry;
+	await Promise.all(
+		// pi-lens-ignore: array-callback-return — an async callback returns its promise on every path; map only starts the tasks for Promise.all, and the early return skips a service with no background start
+		services.map(async (service) => {
+			if (!service.startInBackground) return;
+			const plugin = servicePlugins.get(service) ?? "unknown";
+			const started = await attempt(() => service.startInBackground?.());
+			if (started.ok) logger.info({ plugin, service: service.name }, "ready");
+			else
+				logger.error(
+					{ plugin, service: service.name, err: started.error },
+					"service did not start in the background",
+				);
+			const event: ServiceStartedEvent = {
+				plugin,
+				service: service.name,
+				outcome: started.ok ? "ready" : "failed",
+			};
+			for (const { plugin: heard, events } of handlers) {
+				const handled = await attempt(() => events.serviceStarted?.(event));
+				if (!handled.ok)
+					logger.error(
+						{ plugin: heard, err: handled.error },
+						"service started handler failed",
+					);
+			}
+		}),
+	);
+}

package/src/core/host.ts

@@ -2,11 +2,13 @@ import type { SQL } from "bun";
 import type { ConversationPort } from "./contract/channels.ts";
 import type { SurfacePort } from "./contract/surface.ts";
 import { openPool, runMigrations } from "./db/migrations.ts";
-import { type DrainOptions, waitUntilIdle } from "./drain.ts";
+import { type DrainOptions, drainWork, stopTurns } from "./drain.ts";
 import { MigrationError, NotLinkedError, PluginError } from "./errors.ts";
 import { EventBus } from "./events.ts";
+import { attempt, startInBackground } from "./host-background.ts";
 import { HttpListeners, type ListenerConfig } from "./http/listeners.ts";
 import { type Locale, setLocale } from "./i18n/index.ts";
+import { contactsOf } from "./identity/identity-view.ts";
 import type { JudgeModel } from "./judging/model-judge.ts";
 import type { Logger } from "./log.ts";
 import type {
@@ -14,7 +16,6 @@ import type {
 	LinkedSessions,
 	RoundtablePlugin,
 	Service,
-	ServiceStartedEvent,
 } from "./plugin.ts";
 import { refuseRemovedFields } from "./plugin.ts";
 import {
@@ -32,7 +33,8 @@ import {
 	conversationTurns,
 } from "./routing/conversation-turns.ts";
 import { surfacePort } from "./routing/surface-port.ts";
-import { CONVERSATIONS, RUNTIME } from "./services.ts";
+import { CONVERSATIONS, IDENTITY, RUNTIME } from "./services.ts";
+import type { ChannelKey } from "./sessions.ts";
 import { setTimeZone } from "./time.ts";
 import { type ToolTierTable, toolTiers } from "./tool-tiers.ts";
 
@@ -77,7 +79,11 @@ export interface RoundtableOptions {
 	database?: { url: string };
 	/** Receives the work a shutdown drain gave up on, before any service stops. */
 	aborted?: (left: string[]) => Promise<void>;
-	/** The drain's limit and clock; tests shorten them. */
+	/**
+	 * The shutdown drain: it waits up to `limitMs` (3 minutes by default) for the turns already
+	 * running, then stops them, gives them `abortGraceMs` (10 seconds) to end, and goes on without
+	 * them. Nothing new starts once it begins. Tests shorten the limits and the clock.
+	 */
 	drain?: Omit<DrainOptions, "busy">;
 	/** What `listen()` calls with the shutdown's exit code; the process's own exit by default. */
 	exit?: (code: number) => void;
@@ -86,63 +92,13 @@ export interface RoundtableOptions {
 /** The host running in this process; the text catalog, time zone and environment are process-wide. */
 let running: Roundtable | undefined;
 
-type Attempt = { ok: true } | { ok: false; error: unknown };
-
-/** Runs one step whose failure the caller reports and moves past. */
-async function attempt(step: () => Promise<void> | void): Promise<Attempt> {
-	try {
-		await step();
-		return { ok: true };
-	} catch (error) {
-		return { ok: false, error };
-	}
-}
-
-/**
- * Runs every service's background start at once and tells every plugin, as each ends, how it
- * went; the rest of the process runs either way, and a failing start or handler never stops the
- * others.
- */
-async function startInBackground(
-	registry: Registry,
-	logger: Logger,
-): Promise<void> {
-	const { services, servicePlugins, handlers } = registry;
-	await Promise.all(
-		// pi-lens-ignore: array-callback-return — an async callback returns its promise on every path; map only starts the tasks for Promise.all, and the early return skips a service with no background start
-		services.map(async (service) => {
-			if (!service.startInBackground) return;
-			const plugin = servicePlugins.get(service) ?? "unknown";
-			const started = await attempt(() => service.startInBackground?.());
-			if (started.ok) logger.info({ plugin, service: service.name }, "ready");
-			else
-				logger.error(
-					{ plugin, service: service.name, err: started.error },
-					"service did not start in the background",
-				);
-			const event: ServiceStartedEvent = {
-				plugin,
-				service: service.name,
-				outcome: started.ok ? "ready" : "failed",
-			};
-			for (const { plugin: heard, events } of handlers) {
-				const handled = await attempt(() => events.serviceStarted?.(event));
-				if (!handled.ok)
-					logger.error(
-						{ plugin: heard, err: handled.error },
-						"service started handler failed",
-					);
-			}
-		}),
-	);
-}
-
 /**
  * The process around the plugins: it sets them all up, links what they add (session parts,
  * HTTP routes) and runs the preflight, then starts their services in order and the
  * HTTP listeners last, then runs the services' background starts. Nothing reaches Discord or a listener unless
- * every setup, link, and the preflight succeeded. On shutdown it waits until no work runs or
- * waits before closing the listeners and stopping the services in reverse.
+ * every setup, link, and the preflight succeeded. On shutdown it starts no new work, waits for
+ * what runs for at most the drain limit, then closes the listeners and stops the services in
+ * reverse.
  */
 // pi-lens-ignore: large-class
 export class Roundtable {
@@ -154,6 +110,7 @@ export class Roundtable {
 	#listeners: HttpListeners | undefined;
 	#pool: SQL | undefined;
 	readonly #queue = new ChannelQueue();
+	readonly #warned = new Set<string>();
 	readonly #tiers: ToolTierTable;
 	readonly #events: EventBus;
 	#services: ServiceRegistry | undefined;
@@ -191,6 +148,7 @@ export class Roundtable {
 		return {
 			handle: (message) => router().handle(message),
 			background: (turn) => router().background(turn),
+			runsAs: (turn) => router().runsAs(turn),
 			target: (name) => router().target(name),
 			startFresh: (channel) => router().startFresh(channel),
 			deleteConversation: (channel) => router().deleteConversation(channel),
@@ -198,18 +156,29 @@ export class Roundtable {
 			postsInPlace: (channel) => router().postsInPlace(channel),
 			owns: (channel) => router().owns(channel),
 			takesBackground: (channel) => router().takesBackground(channel),
+			takesSystemReports: (channel) => router().takesSystemReports(channel),
 		};
 	}
 
 	/** The contributed surfaces by channel prefix; every call before linking throws NotLinkedError. */
 	#surfaces(): SurfacePort {
-		return surfacePort(() => {
-			if (!this.#sessions)
-				throw new NotLinkedError(
-					"chat surfaces are linked once every plugin is set up. Use surfaces from a service's start or from a handler, not during setup.",
-				);
-			return this.#registry.surfaces;
-		});
+		return surfacePort(
+			() => {
+				if (!this.#sessions)
+					throw new NotLinkedError(
+						"chat surfaces are linked once every plugin is set up. Use surfaces from a service's start or from a handler, not during setup.",
+					);
+				return this.#registry.surfaces;
+			},
+			{ deprecated: (message) => this.#deprecated(message) },
+		);
+	}
+
+	/** Logs a deprecation once per host. */
+	#deprecated(message: string): void {
+		if (this.#warned.has(message)) return;
+		this.#warned.add(message);
+		this.#options.logger.warn(message);
 	}
 
 	/** Turns over the runtime plugin's runtime and the surfaces; every call before linking is refused with NotLinkedError. */
@@ -229,6 +198,7 @@ export class Roundtable {
 			registry: () => this.#services?.find(CONVERSATIONS),
 			surfaces: this.#surfaces(),
 			events: this.#events.sink,
+			stopping: () => this.#queue.closed,
 			selection: () => {
 				if (!this.#sessions)
 					throw new NotLinkedError("session parts are not linked yet.");
@@ -328,11 +298,16 @@ export class Roundtable {
 		const { routes, channels } = this.#registry;
 		this.#sessions = linkSessions(this.#registry);
 		this.#events.link(this.#registry.handlers);
+		const identity = this.#services.find(IDENTITY);
 		this.#router = new ChannelRouter({
 			claims: channels,
+			...(identity
+				? { contacts: contactsOf(identity), principals: identity }
+				: {}),
 			targets: (name) =>
 				this.#registry.backgroundTargets.find((t) => t.name === name),
 			queue: this.#queue,
+			surfaces: this.#surfaces(),
 			logger,
 			...(this.#options.conversations?.forwardJoinMs === undefined
 				? {}
@@ -404,7 +379,8 @@ export class Roundtable {
 	}
 
 	/**
-	 * Stops the host once no work runs or waits and returns the exit code: 0, or 1 when the
+	 * Stops the host once no work runs or waits, or the drain limit has passed, and returns the
+	 * exit code: 0, or 1 when the
 	 * boot had failed or a listener, service or the pool did not stop. Every call shares the one
 	 * shutdown.
 	 */
@@ -418,19 +394,27 @@ export class Roundtable {
 		// A signal during the boot waits for it to settle; a failed boot has already stopped.
 		await this.#booting?.catch(() => undefined);
 		if (running !== this) return this.#bootFailed ? 1 : 0;
-		// Everything keeps serving until nothing runs or waits, so a deploy never cuts a turn short.
+		// Turns already running finish, but nothing new starts from here on, whoever asks.
 		logger.info({ signal }, "shutting down once idle");
-		const left = await waitUntilIdle({
+		this.#queue.close();
+		const left = await drainWork({
 			...drain,
 			busy: () => [
 				...this.#queue.busy(),
 				...this.#started.flatMap((service) => service.busy?.() ?? []),
 			],
+			// A turn the limit finds still running is stopped, as the owner's stop would.
+			abort: () =>
+				stopTurns(
+					this.#queue.busy(),
+					(channel) => this.#router?.stop(channel as ChannelKey) ?? false,
+					logger,
+				),
 		});
 		if (left.length > 0) {
 			logger.warn(
 				{ aborted: left },
-				"still busy after the drain limit; aborting",
+				"still busy after the drain limit; aborted",
 			);
 			const recorded = await attempt(() => aborted?.(left));
 			if (!recorded.ok)

package/src/core/i18n/cards.ts

@@ -11,10 +11,12 @@ export function cardsEn(ctx: CatalogContext) {
 		cardStopped: "⏹️ This round was stopped.",
 		cardExpired: "⌛ Timed out with no answer.",
 		cardOwnerOnly: `Only ${ctx.assistant}'s owner can answer this card.`,
-		cardApproversNote: (userId: string) => `-# Who can approve: <@${userId}>`,
+		cardApproversNote: (...userIds: readonly string[]) =>
+			`-# Who can approve: ${userIds.map((id) => `<@${id}>`).join(" ")}`,
 		cardApproversRefusal:
 			"This approval is for the speaker whose turn asked for it.",
-		cardAskerNote: (userId: string) => `-# Who can answer: <@${userId}>`,
+		cardAskerNote: (...userIds: readonly string[]) =>
+			`-# Who can answer: ${userIds.map((id) => `<@${id}>`).join(" ")}`,
 		cardAskerRefusal: "This question is for another speaker.",
 		cardInactive: `This card is no longer active (it timed out, or ${ctx.assistant} restarted); reply in text if you need to.`,
 		cardApproved: "✅ Approved to run.",
@@ -41,9 +43,11 @@ export function cardsZhTW(ctx: CatalogContext): ReturnType<typeof cardsEn> {
 		cardStopped: "⏹️ 這一輪已停止。",
 		cardExpired: "⌛ 已逾時，沒有回答。",
 		cardOwnerOnly: `只有 ${ctx.assistant} 的擁有者能回答這張卡片。`,
-		cardApproversNote: (userId: string) => `-# 可以核准的人：<@${userId}>`,
+		cardApproversNote: (...userIds: readonly string[]) =>
+			`-# 可以核准的人：${userIds.map((id) => `<@${id}>`).join(" ")}`,
 		cardApproversRefusal: "這張核准卡是給提出這一輪的發話者的。",
-		cardAskerNote: (userId: string) => `-# 可以回答的人：<@${userId}>`,
+		cardAskerNote: (...userIds: readonly string[]) =>
+			`-# 可以回答的人：${userIds.map((id) => `<@${id}>`).join(" ")}`,
 		cardAskerRefusal: "這張問題是問另一位發話者的。",
 		cardInactive: `這張卡片已經失效（逾時，或 ${ctx.assistant} 重新啟動過）；需要的話直接打字回覆。`,
 		cardApproved: "✅ 已核准執行。",

package/src/core/i18n/conversation.ts

@@ -6,6 +6,7 @@ export function conversationEn(ctx: CatalogContext) {
 		failureNotice:
 			"Sorry, this reply did not go through. Please try again later.",
 		stoppedNotice: "-# Stopped.",
+		restartingNotice: `-# ${ctx.assistant} is restarting and takes no new messages right now; please send this again in a few minutes.`,
 		roundLimitNotice:
 			"-# This round already has 8 replies, so it stops here; call us again if you need more.",
 		restartNotice: `-# ${ctx.assistant} restarted before this job finished, so nothing more will be reported here.`,
@@ -30,6 +31,7 @@ export function conversationZhTW(
 	return {
 		failureNotice: "抱歉，這次沒能完成回覆，請稍後再試一次。",
 		stoppedNotice: "-# 已停止。",
+		restartingNotice: `-# ${ctx.assistant} 正在重新啟動，暫時不接新訊息；請過幾分鐘再傳一次。`,
 		roundLimitNotice:
 			"-# 這一輪已經有 8 則回覆，先停在這裡；需要的話請再叫我們。",
 		restartNotice: `-# ${ctx.assistant} 在這項工作結束前重新啟動了，這裡不會再有回報。`,