switchroom 0.17.10 → 0.18.3

package/telegram-plugin/gateway/gateway.ts

@@ -294,6 +294,7 @@ import {
   shouldArmOrphanedReplyTimeout,
   ORPHANED_REPLY_TIMEOUT_MS,
   ORPHANED_REPLY_MAX_REARMS,
+  LivenessTracker,
 } from '../context-exhaustion.js'
 import {
   decideTurnFlush,
@@ -346,6 +347,7 @@ import {
   buildModelMenu,
   handleModelMenuCallback,
   isSrToClaudeTransition,
+  isValidModelArg,
   MODEL_CALLBACK_PREFIX,
   MODEL_CALLBACK_HEADER,
   MODEL_CALLBACK_SR,
@@ -357,6 +359,7 @@ import {
   type ModelMenuReply,
 } from './model-command.js'
 import { discoverModels, selectModel } from '../../src/agents/model-picker.js'
+import { resolveMainModel } from '../../src/agents/scaffold.js'
 import {
   parseEffortCommand,
   handleEffortCommand,
@@ -419,6 +422,7 @@ import {
   writeActivityCardRecord,
   clearActivityCardRecord,
   runActivityCardBootReaper,
+  runActivityCardMidSessionReaper,
   restartOrphanCardFinalizeText,
   type ActivityCardStoreFsSeam,
 } from './activity-card-store.js'
@@ -427,7 +431,7 @@ import { shouldSuppressRepresent } from './represent-guard.js'
 import { shouldDeferEscalationForBridge } from './escalation-bridge-gate.js'
 import { createInboundSpool } from './inbound-spool.js'
 import { purgeStaleTurnsForChat } from './turn-state-purge.js'
-import { decideInboundDelivery } from './inbound-delivery-gate.js'
+import { decideInboundDelivery, reserveInboundDelivery } from './inbound-delivery-gate.js'
 import { mayDrainBufferedInbound, shouldArmNoReplyDrain } from './serialize-drain-gate.js'
 import { decideFeedReopen } from './feed-reopen-gate.js'
 import {
@@ -662,6 +666,7 @@ import {
   findRecentTurnsForChat,
   getTurnByKey,
   markTurnResumed,
+  reapStaleOpenTurns,
 } from '../registry/turns-schema.js'
 import {
   buildResumeInterruptedInbound,
@@ -1949,6 +1954,25 @@ const obligationEscalateInFlight = new Set<string>()
 // drain on the bare turn-end signal.
 const SERIALIZE_UNTIL_REPLIED_ENABLED =
   process.env.SWITCHROOM_SERIALIZE_UNTIL_REPLIED !== '0'
+// #2917 — rapid-fire per-chat FIFO. The #1556 delivery gate documents its
+// `turnInFlight` input as a LIVE read ("evaluated at delivery time — not a
+// receipt-time snapshot"), but handleInbound passes a receipt-time snapshot
+// (`turnInFlightAtReceipt`) taken at function entry. Under rapid-fire two
+// same-chat inbounds each snapshot "idle" during the other's async lead-in
+// (attachment download, composer-clear), both pass the gate, and both are
+// delivered — so replies come back reordered (observed 1,2,4,5,3,7,8,6). The
+// fix reads the gate LIVE off `claudeBusyKeys` (which does NOT yet contain
+// THIS inbound's own key — that is only marked at delivery — so it can't
+// self-block) AND reserves the key synchronously BEFORE the composer-clear
+// await, so a concurrent same-chat inbound observes the reservation and
+// buffers behind it, preserving FIFO. Nothing is dropped: a buffered inbound
+// drains on turn-complete / idle exactly as before. Kill switch (=0) restores
+// the receipt-snapshot behaviour. Only the non-cutover path is affected — the
+// delivery-machine cutover keeps its own at-receipt machine snapshot (reading
+// the machine live WOULD self-block, since its inbound event already advanced
+// it for this key).
+const SERIALIZE_INBOUND_DELIVERY_ENABLED =
+  process.env.SWITCHROOM_SERIALIZE_INBOUND_DELIVERY !== '0'
 // Component 2 (bounded no-reply escape hatch). A turn that legitimately
 // ends with NO reply (handback ack, NO_REPLY marker, silent-end) sets
 // finalAnswerDelivered=false and would block the serialize gate forever.
@@ -2348,13 +2372,15 @@ type CurrentTurn = {
   silentAnchorText: string
   capturedText: string[]
   orphanedReplyTimeoutId: ReturnType<typeof setTimeout> | null
-  // How many times the orphaned-reply backstop timer has been re-armed
-  // mid-tool-call instead of firing a synthetic turn_end. Bounded so a
-  // genuinely wedged single long-running tool still surfaces: the cap is
-  // ORPHANED_REPLY_MAX_REARMS (20 × 30 s = 10 min of genuine tool activity).
-  // Reset to 0 on a fresh enqueue; NOT reset on text/tool_label re-arms —
-  // only a new turn resets the budget.
-  orphanedReplyRearmCount: number
+  // Per-turn liveness tracker for the orphaned-reply backstop. Owns
+  // `lastStreamEventAt` (stamped on ANY genuine stream event so a model
+  // reasoning pause keeps the turn "recently streaming" and re-arms the fuse
+  // instead of firing) and the rearm counter (bounded by
+  // ORPHANED_REPLY_MAX_REARMS so a genuinely wedged single tool that never
+  // streams still surfaces after the cap). The counter is zeroed on every
+  // genuine stream event, so the cap only bites CONSECUTIVE silent expiries.
+  // Fresh instance per enqueue (below). See context-exhaustion.ts.
+  liveness: LivenessTracker
   // Component 3 (turn-origin reply routing). A stable per-turn identity,
   // `${registryKey-or-chatKey}#${startedAt}`, assigned when the turn
   // starts and stamped into the inbound meta (`origin_turn_id`) so a reply
@@ -6230,6 +6256,127 @@ async function activityCardBootReaper(): Promise<void> {
     )
   }
 }
+// ─── Mid-session stale-card reaper (#2918) ──────────────────────────────────
+// The boot reapers (markOrphanedWithTimeoutClassification + activityCardBoot-
+// Reaper) run ONCE at startup. A turn whose owning SDK subprocess dies
+// mid-session (SIGKILL / OOM / crash) without a clean end leaves its turns-DB
+// row `ended_at IS NULL` and its activity card frozen on "working…" until the
+// NEXT gateway boot — often many hours. This periodic sweep, running inside the
+// live gateway, finalizes those orphans without waiting for a restart.
+//
+// LIVENESS (the critical correctness guard): a turn/card is reaped ONLY when no
+// live in-flight turn owns it. The live set is derived from `currentTurnMap`
+// (per-topic byKey) PLUS the singleton `currentTurn` mirror, so it is correct
+// whether or not the per-topic-isolation flag is on. A healthy long-running
+// turn is always in that set and is never swept. A TTL gate is a secondary
+// guard against the just-started-not-yet-tracked race.
+//
+// Kill switch: set SWITCHROOM_MID_SESSION_CARD_REAPER=0 to disable (clean
+// revert, mirrors #2919). TTL/interval overridable via env for tuning.
+const MID_SESSION_CARD_REAPER_ENABLED =
+  process.env.SWITCHROOM_MID_SESSION_CARD_REAPER !== '0'
+const MID_SESSION_CARD_REAPER_TTL_MS = (() => {
+  const v = Number(process.env.SWITCHROOM_MID_SESSION_CARD_REAPER_TTL_MS)
+  return Number.isFinite(v) && v > 0 ? v : 15 * 60_000 // 15 min
+})()
+const MID_SESSION_CARD_REAPER_INTERVAL_MS = (() => {
+  const v = Number(process.env.SWITCHROOM_MID_SESSION_CARD_REAPER_INTERVAL_MS)
+  return Number.isFinite(v) && v > 0 ? v : 5 * 60_000 // 5 min
+})()
+
+// Snapshot the turn_keys / topic keys owned by a live in-flight turn right now.
+function liveTurnKeySets(): { registryKeys: Set<string>; topicKeys: Set<string> } {
+  const registryKeys = new Set<string>()
+  const topicKeys = new Set<string>()
+  const add = (t: CurrentTurn | null | undefined): void => {
+    if (t == null) return
+    if (t.registryKey != null && t.registryKey.length > 0) registryKeys.add(t.registryKey)
+    topicKeys.add(statusKey(t.sessionChatId, t.sessionThreadId))
+  }
+  for (const t of currentTurnMap.byKey.values()) add(t)
+  add(currentTurn) // flag-OFF store + most-recent mirror
+  return { registryKeys, topicKeys }
+}
+
+async function runMidSessionCardReaper(): Promise<void> {
+  if (!MID_SESSION_CARD_REAPER_ENABLED) return
+  const now = Date.now()
+  const { registryKeys, topicKeys } = liveTurnKeySets()
+
+  // 1) Stamp ownerless open turns-DB rows (the durable spinner signal).
+  if (turnsDb != null) {
+    try {
+      const { reaped, reapedTurnKeys } = reapStaleOpenTurns(turnsDb, {
+        activeTurnKeys: registryKeys,
+        ttlMs: MID_SESSION_CARD_REAPER_TTL_MS,
+        now,
+      })
+      if (reaped > 0) {
+        process.stderr.write(
+          `telegram gateway: mid-session reaper stamped ${reaped} orphaned turn(s) ` +
+            `as 'restart' (${reapedTurnKeys.join(',')})\n`,
+        )
+      }
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: mid-session turn reaper error: ${(err as Error).message}\n`,
+      )
+    }
+  }
+
+  // 2) Finalize the leftover visible activity card(s) for those dead turns.
+  if (activityCardPersistEnabled) {
+    try {
+      const { finalized, vanished, total } = await runActivityCardMidSessionReaper({
+        path: ACTIVITY_CARD_STORE_PATH,
+        fs: activityCardStoreFs,
+        isLive: (record) => topicKeys.has(record.turnKey),
+        ttlMs: MID_SESSION_CARD_REAPER_TTL_MS,
+        now,
+        finalizeCard: (record) =>
+          robustApiCall(
+            () =>
+              lockedBot.api.editMessageText(
+                record.chatId,
+                record.activityMessageId,
+                richMessage(restartOrphanCardFinalizeText(record.startedAt)),
+                {},
+              ),
+            {
+              chat_id: record.chatId,
+              ...(record.threadId != null ? { threadId: record.threadId } : {}),
+              verb: 'activity-card.mid-session-reap-finalize',
+            },
+          ),
+        unpinCard: (record) =>
+          robustApiCall(
+            () => lockedBot.api.unpinChatMessage(record.chatId, record.activityMessageId),
+            {
+              chat_id: record.chatId,
+              ...(record.threadId != null ? { threadId: record.threadId } : {}),
+              verb: 'activity-card.mid-session-reap-unpin',
+            },
+          ),
+      })
+      if (total > 0) {
+        process.stderr.write(
+          `telegram gateway: activity-card: mid-session finalized ${finalized}/${total} ` +
+            `(vanished ${vanished}/${total}) orphaned card(s) (at-most-once)\n`,
+        )
+      }
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: mid-session card reaper error: ${(err as Error).message}\n`,
+      )
+    }
+  }
+}
+
+const midSessionCardReaper = setInterval(() => {
+  void runMidSessionCardReaper()
+}, MID_SESSION_CARD_REAPER_INTERVAL_MS)
+midSessionCardReaper.unref()
+
 // NOTE: statusPinBootCleanup() is deliberately NOT invoked here at import time.
 // The status-pin store is a SHARED per-agent file, and cleanup issues real
 // unpinChatMessage calls. On a double-boot the losing gateway must NOT touch
@@ -6596,6 +6743,11 @@ function parsePositiveMsEnv(name: string, fallbackMs: number): number {
   const n = Number(raw)
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallbackMs
 }
+// Orphaned-reply "recently streaming" window (thinking-pause fix). If a genuine
+// stream event landed within this window, the fuse re-arms instead of firing —
+// so a long model reasoning pause (which emits no text/tool events) is
+// survivable while a genuine multi-minute hang still surfaces. Default 120 s.
+const ORPHANED_REPLY_STREAM_WINDOW_MS = parsePositiveMsEnv('SWITCHROOM_ORPHANED_REPLY_STREAM_WINDOW_MS', 120_000)
 const SILENCE_FALLBACK_MS = parsePositiveMsEnv('SWITCHROOM_SILENCE_FALLBACK_MS', 300_000)
 const SILENCE_FALLBACK_HARD_MS = parsePositiveMsEnv('SWITCHROOM_SILENCE_FALLBACK_HARD_MS', 900_000)
 // #2527 — mid-turn liveness floor threshold (default 45s). Still gates the
@@ -12411,20 +12563,32 @@ function resetOrphanedReplyTimeout(): void {
           }
           return false
         })()
-        if (working || humanWaiting) {
-          const underCap = t.orphanedReplyRearmCount < ORPHANED_REPLY_MAX_REARMS
-          if (humanWaiting || underCap) {
-            t.orphanedReplyRearmCount++
-            process.stderr.write(
-              `telegram gateway: orphaned-reply fuse expired — re-arming` +
-              ` (rearm ${t.orphanedReplyRearmCount}/${ORPHANED_REPLY_MAX_REARMS},` +
-              ` in_flight=${toolFlightTracker.inFlightCount()},` +
-              ` human_wait=${humanWaiting},` +
-              ` bg_work=${pendingProgress.hasPendingAsyncDispatch(turnKey)})\n`,
-            )
-            resetOrphanedReplyTimeout()
-            return
-          }
+        // Route the rearm decision through the per-turn LivenessTracker. It
+        // rearms when working OR recently-streaming (thinking-pause survival)
+        // OR human-waiting; working/recently-streaming rearms count against
+        // ORPHANED_REPLY_MAX_REARMS while human-wait rearms stay uncapped.
+        const now = Date.now()
+        const recentlyStreaming = t.liveness.recentlyStreaming(now, ORPHANED_REPLY_STREAM_WINDOW_MS)
+        const decision = t.liveness.decideOnExpiry({
+          working,
+          humanWaiting,
+          now,
+          windowMs: ORPHANED_REPLY_STREAM_WINDOW_MS,
+          maxRearms: ORPHANED_REPLY_MAX_REARMS,
+        })
+        if (decision.rearm) {
+          process.stderr.write(
+            `telegram gateway: orphaned-reply fuse expired — re-arming` +
+            ` (rearm ${t.liveness.orphanedReplyRearmCount}/${ORPHANED_REPLY_MAX_REARMS},` +
+            ` in_flight=${toolFlightTracker.inFlightCount()},` +
+            ` human_wait=${humanWaiting},` +
+            ` recently_streaming=${recentlyStreaming},` +
+            ` bg_work=${pendingProgress.hasPendingAsyncDispatch(turnKey)})\n`,
+          )
+          resetOrphanedReplyTimeout()
+          return
+        }
+        if (decision.countsAgainstCap) {
           process.stderr.write(
             `telegram gateway: orphaned-reply rearm cap reached (${ORPHANED_REPLY_MAX_REARMS}) — forcing backstop despite working state\n`,
           )
@@ -12900,11 +13064,19 @@ function feedHeartbeatTick(): void {
     //               durable record once it completes.
     //   - 'emit'  → genuine in-flight post-answer activity; render the card below.
     const subagentAt = turn.subagentActivityAt
+    // Fix 3 (sub-agent-delegation freeze): a foreground `Task`/`Agent` still
+    // tracked in `turn.foregroundSubAgents` is POSITIVE evidence the worker
+    // has not reported finished — see the doc comment on
+    // `PostAnswerLivenessInput.stillDispatched` in turn-liveness-floor.ts for
+    // why this must bypass the staleness cap rather than let a single long
+    // silent step freeze the card mid-delegation.
+    const stillDispatched = turn.foregroundSubAgents.size > 0
     const livenessVerdict = evaluatePostAnswerLiveness({
       subagentActivityAt: subagentAt,
       finalAnswerDeliveredAt: turn.finalAnswerDeliveredAt,
       now: Date.now(),
       staleCapMs: POST_ANSWER_LIVENESS_STALE_MS,
+      stillDispatched,
     })
     if (livenessVerdict !== 'emit' || subagentAt == null) return // idle gap or stale worker → stay silent (the `== null` also narrows subagentAt for the elapsed below)
     // A background worker is genuinely active after the answer. Open or maintain
@@ -13278,6 +13450,22 @@ function surfaceConsolidationLegibility(
 }
 
 function handleSessionEvent(ev: SessionEvent): void {
+  // Per-turn liveness stamp (orphaned-reply thinking-pause fix). Stamp
+  // lastStreamEventAt AND reset the rearm counter on ANY genuine stream event,
+  // under ONE shared predicate: a live turn is present and this is not the
+  // synthetic durationMs===-1 turn_end (the fire callback's own re-dispatch).
+  // The counter reset MUST live here at the dispatcher — NOT inside
+  // resetOrphanedReplyTimeout() (which is called from the fire callback one
+  // line after the counter increments) and NOT tied to a single case (e.g.
+  // tool_result does not call resetOrphanedReplyTimeout). onStreamEvent applies
+  // the `!(turn_end && -1)` half of the predicate internally.
+  {
+    const liveTurn = currentTurn
+    if (liveTurn != null) {
+      const durationMs = ev.kind === 'turn_end' ? ev.durationMs : undefined
+      liveTurn.liveness.onStreamEvent(ev.kind, durationMs, Date.now())
+    }
+  }
   switch (ev.kind) {
     case 'enqueue': {
       // Drain any orphaned typing-wrap entries left over from a crashed
@@ -13314,6 +13502,14 @@ function handleSessionEvent(ev: SessionEvent): void {
           prior.answerStream.stop()
           prior.answerStream = null
         }
+        // Bounded-leak hardening (A5): clear the prior turn's orphaned-reply
+        // fuse before it is superseded. The fire callback re-reads currentTurn
+        // and no-ops on a stale turn, but proactively clearing the timer avoids
+        // a bounded pile-up of dangling timers across rapid steer/queue turns.
+        if (prior?.orphanedReplyTimeoutId != null) {
+          clearTimeout(prior.orphanedReplyTimeoutId)
+          prior.orphanedReplyTimeoutId = null
+        }
         // #1067: swap the entire turn atom in one assignment. Every
         // handler captures `const turn = currentTurn` at entry, so a
         // captured-then-awaited read can't reattribute to the new turn.
@@ -13373,7 +13569,9 @@ function handleSessionEvent(ev: SessionEvent): void {
           silentAnchorText: '',
           capturedText: [],
           orphanedReplyTimeoutId: null,
-          orphanedReplyRearmCount: 0,
+          // Fresh liveness tracker: lastStreamEventAt seeded to the turn start
+          // so a turn that never streams still trips the fuse after windowMs.
+          liveness: new LivenessTracker(startedAt),
           turnId,
           registryKey: null,
           noReplyDrainTimer: null,
@@ -14043,10 +14241,25 @@ function handleSessionEvent(ev: SessionEvent): void {
       if (ev.durationMs === -1) {
         const turn = currentTurn
         const key = turn != null ? statusKey(turn.sessionChatId, turn.sessionThreadId) : ''
-        if (isLegitimatelyWorking(key)) {
+        // Widened to also suppress while the turn is RECENTLY STREAMING — a
+        // model reasoning pause emits no tool/text events (so
+        // isLegitimatelyWorking is false) but a genuine stream landed within
+        // the window, so the turn is alive and must not be torn down.
+        // ACCEPTED TRADE-OFF (F3): the context-exhaustion recovery latency via
+        // THIS backstop path grows from ~30 s to ~120-150 s, because the
+        // "Prompt is too long" marker is itself a genuine `text` event that
+        // stamps recentlyStreaming. This is acceptable — the primary
+        // context-exhaustion teardown is the immediate `endCurrentTurnAtomic`
+        // in `case 'text'` (isContextExhaustionText) above; this backstop only
+        // matters if that path is missed, and it still COMPLETES once the
+        // window lapses. Recovery is delayed, never suppressed forever.
+        const recentlyStreaming =
+          turn != null && turn.liveness.recentlyStreaming(Date.now(), ORPHANED_REPLY_STREAM_WINDOW_MS)
+        if (isLegitimatelyWorking(key) || recentlyStreaming) {
           process.stderr.write(
             `telegram gateway: synthetic turn_end suppressed — legitimately working` +
             ` (in_flight=${toolFlightTracker.inFlightCount()},` +
+            ` recently_streaming=${recentlyStreaming},` +
             ` bg_work=${turn != null ? pendingProgress.hasPendingAsyncDispatch(key) : false})\n`,
           )
           return
@@ -15340,30 +15553,32 @@ async function handleInbound(
   // network RTT) but not a user-perceived end-to-end measurement.
   const inboundReceivedAt = Date.now()
 
-  // Phase 2b shadow: inbound arrival. Emit BEFORE the snapshot/gate
-  // logic so the machine sees the event at the same point in time the
-  // imperative code would. The machine internally handles fresh-turn
-  // vs mid-turn — its decision will be visible in the gw-trace shadow
-  // line emitted to stderr.
-  const _shadowKey = statusKey(ctx.chat?.id != null ? String(ctx.chat.id) : '0', ctx.message?.message_thread_id) as _ChatKey
-  // PR3b-cutover: snapshot the machine's in-turn state BEFORE the
-  // inbound event advances it. A fresh-turn inbound transitions the
-  // machine idle→in_turn; reading after the emit would see THIS
-  // message's own just-started turn and self-block it (the same
-  // self-block hazard the claudeBusyKeys snapshot below guards). When
-  // the kill-switch is off this is null and the gate uses the legacy
+  // PR3b-cutover: snapshot the machine's in-turn state AT RECEIPT, before
+  // this handler emits the `inbound` event (that emit is DEFERRED below to
+  // the delivery-commit point — search DEFERRED_INBOUND_EMIT). A fresh-turn
+  // inbound transitions the machine idle→in_turn; reading after the emit
+  // would see THIS message's own just-started turn and self-block it (the
+  // same self-block hazard the claudeBusyKeys snapshot below guards). Null
+  // when the kill-switch is off, in which case the gate uses the legacy
   // claudeBusyKeys read.
+  //
+  // WHY THE INBOUND EMIT IS DEFERRED (overlord /usage wedge, 2026-07-08):
+  // the `inbound` event drives the now-AUTHORITATIVE turn-in-flight gate
+  // (turnInFlightForGate → isMachineInTurn). Emitting it HERE — at handler
+  // entry, before the intercept gauntlet below (permission-reply, /auth
+  // paste-back, interrupt-empty, secret-detect drop, …) — drove the machine
+  // into `bridge_alive_in_turn` for messages that then EARLY-RETURN as an
+  // intercept and never become a turn. No delivery, no claudeBusyKeys mark,
+  // and critically no `turnEnd` ever fires, so the machine held the gate
+  // closed until the 5-min TTL tick force-cleared it — buffering every
+  // subsequent inbound (including /usage) the whole time. That is exactly
+  // the dangerous `machine_over_holds` divergence gate-parity-probe.ts
+  // flags. The imperative claudeBusyKeys tracker got it right (never marked
+  // busy for the intercepted message); the machine was mis-fed. Fix: emit
+  // `inbound` only once the message clears every intercept and reaches the
+  // deliver-or-buffer decision, keeping the machine in lockstep with the
+  // imperative delivery lifecycle it models.
   const machineInTurnAtReceipt = isDeliveryCutoverEnabled() ? isMachineInTurn() : null
-  shadowEmit({
-    kind: 'inbound',
-    key: _shadowKey,
-    msg: {
-      msgId: ctx.message?.message_id ?? 0,
-      isSteering: false, // refined in PR 3 — for now shadow conservatively classifies as non-steering
-      payload: null,
-    },
-    at: Date.now(),
-  })
 
   // #1556 self-blocking fix (v0.12.22): snapshot the live turn-state
   // BEFORE the fresh-turn branch (line ~7357) sets activeTurnStartedAt
@@ -16560,6 +16775,29 @@ async function handleInbound(
     return
   }
 
+  // DEFERRED_INBOUND_EMIT — drive the delivery state machine's `inbound`
+  // event HERE, not at handler entry. Every intercept/early-return above
+  // (permission-reply, /auth paste-back, interrupt-empty, secret-detect
+  // drop, drop/pair) has been passed, so any message reaching this point is
+  // a genuine turn the imperative code is about to deliver or buffer. That
+  // keeps the machine's authoritative turn-in-flight state in lockstep with
+  // the imperative delivery it models and can never be advanced into
+  // `bridge_alive_in_turn` by a message that never becomes a turn — the
+  // overlord /usage wedge of 2026-07-08 (see machineInTurnAtReceipt above).
+  // isSteering is now the real classification (computed at ~line 16289), so
+  // the machine correctly distinguishes a mid-turn steer (delivered, no new
+  // turn) from a fresh turn.
+  shadowEmit({
+    kind: 'inbound',
+    key: statusKey(chat_id, messageThreadId) as _ChatKey,
+    msg: {
+      msgId: msgId ?? 0,
+      isSteering,
+      payload: null,
+    },
+    at: Date.now(),
+  })
+
   // PR2 obligation-ledger OPEN — BEFORE the buffer-until-idle / deliver split so
   // a mid-turn cross-topic inbound (the 715 case) is tracked whether it is
   // buffered or delivered now. Idempotent + gated; no-op when the flag is off.
@@ -16569,21 +16807,32 @@ async function handleInbound(
     effectiveText,
   })
 
-  if (
-    decideInboundDelivery({
-      turnInFlight: turnInFlightAtReceipt,
-      isSteering,
-      // Interrupt-marker carve-out (2026-05-24): the `!`-prefixed body
-      // must bypass the "buffer-until-turn-complete" gate because the
-      // SIGINT'd turn often doesn't emit turn_complete, leaving the
-      // body stranded in pendingInboundBuffer indefinitely. The
-      // `interrupt` const is computed at the start of handleInbound
-      // (line ~7606) and remains in scope here. When the user fires
-      // `!`-with-body, this delivers the body as a fresh inbound to
-      // the freshly-killed bridge.
-      isInterrupt: interrupt.isInterrupt,
-    }) === 'buffer-until-idle'
-  ) {
+  // #2917: read the gate LIVE (not the receipt snapshot) on the default path
+  // so a sibling same-chat inbound delivered during THIS handler's async
+  // lead-in is observed here. Reading `claudeBusyKeys` live is self-block-safe:
+  // THIS inbound's own key is only added at delivery (below), never by the
+  // fresh-turn init bundle — so the live read never sees its own key. The
+  // delivery-machine cutover keeps its at-receipt machine snapshot (a live
+  // machine read WOULD self-block, since the inbound event already advanced
+  // the machine for this key). Kill switch (=0) restores the pure snapshot.
+  const gateTurnInFlight =
+    SERIALIZE_INBOUND_DELIVERY_ENABLED && machineInTurnAtReceipt == null
+      ? claudeBusyKeys.size > 0
+      : turnInFlightAtReceipt
+  const deliveryGate = reserveInboundDelivery({
+    turnInFlight: gateTurnInFlight,
+    isSteering,
+    // Interrupt-marker carve-out (2026-05-24): the `!`-prefixed body
+    // must bypass the "buffer-until-turn-complete" gate because the
+    // SIGINT'd turn often doesn't emit turn_complete, leaving the
+    // body stranded in pendingInboundBuffer indefinitely. The
+    // `interrupt` const is computed at the start of handleInbound
+    // (line ~7606) and remains in scope here. When the user fires
+    // `!`-with-body, this delivers the body as a fresh inbound to
+    // the freshly-killed bridge.
+    isInterrupt: interrupt.isInterrupt,
+  })
+  if (deliveryGate.decision === 'buffer-until-idle') {
     pendingInboundBuffer.push(selfAgent, inboundMsg)
     process.stderr.write(
       `telegram gateway: inbound held mid-turn agent=${selfAgent} ` +
@@ -16607,6 +16856,18 @@ async function handleInbound(
     return
   }
 
+  // #2917: reserve the chat's busy key SYNCHRONOUSLY here — before the
+  // composer-clear await below — so a concurrent same-chat inbound reaching
+  // the LIVE gate above observes this in-flight delivery and buffers behind it
+  // (per-chat FIFO). Without this, both handlers pass the gate during each
+  // other's async lead-in and race to the bridge, reordering the replies.
+  // Only fresh-turn deliveries reserve (steering/interrupt amend a running
+  // turn and must not). Released below if the send misses (bridge offline).
+  let reservedBusyKey: string | null = null
+  if (deliveryGate.reserve && SERIALIZE_INBOUND_DELIVERY_ENABLED && machineInTurnAtReceipt == null) {
+    reservedBusyKey = markClaudeBusyForInbound(inboundMsg)
+  }
+
   // Pre-send composer clear (the marko wedge). The inbound is about to be
   // delivered as an MCP `notifications/claude/channel` notification, which
   // the unmodified CLI appends into its composer and auto-submits ONLY when
@@ -16636,7 +16897,10 @@ async function handleInbound(
 
   const delivered = ipcServer.sendToAgent(selfAgent, inboundMsg)
   if (delivered) {
-    const busyKey = markClaudeBusyForInbound(inboundMsg)
+    // Reuse the key reserved synchronously above (#2917) when present, else
+    // mark now — markClaudeBusyForInbound is idempotent (lockstep re-stamp),
+    // so a re-mark is safe and returns the same chat key.
+    const busyKey = reservedBusyKey ?? markClaudeBusyForInbound(inboundMsg)
     // Track until claude acks via `enqueue` (the marko drop-wedge): if no ack
     // lands, the message stranded in the composer and the sweep re-delivers
     // it. Track ONLY messages that produce an `enqueue` to ack against —
@@ -16658,6 +16922,15 @@ async function handleInbound(
     }
   }
   if (!delivered) {
+    // #2917: the synchronous reservation assumed delivery; the send missed
+    // (bridge offline), so release it in lockstep — otherwise the orphaned
+    // busy key would gate every subsequent inbound into the buffer until the
+    // orphan reaper clears it. The message itself is buffered below, so FIFO
+    // is still preserved (it drains in order on the next bridge register).
+    if (reservedBusyKey != null) {
+      claudeBusyKeys.delete(reservedBusyKey)
+      claudeBusyKeySince.delete(reservedBusyKey)
+    }
     // Only persist fresh user turns to the durable spool. Steering / `!`
     // interrupt / empty bodies are mid-turn amendments or no-ops that would
     // arrive orphaned if replayed as a fresh turn after a restart — drop them
@@ -18223,7 +18496,7 @@ interface ModelDepsRestartContext {
 }
 
 function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & ModelCommandDeps {
-  return {
+  const deps: ModelMenuDeps & ModelCommandDeps = {
     discover: (a) => discoverModels(a),
     discoverSrModels: async () => {
       // /model/info lives on the ROOT proxy (model-mapped surface), NOT the
@@ -18329,7 +18602,25 @@ function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & M
         )
       }
     },
+    /**
+     * Session-only switch TO an sr-* (LiteLLM/OpenRouter) model. claude's
+     * native `/model` picker rejects unknown sr-* ids, so we can't inject.
+     * Write the token to the `.session-model-override` carrier file (start.sh
+     * consumes it on the next boot and launches `claude --model <token>`), set
+     * the in-memory session-model so /status stays honest across the restart
+     * window, then run the SAME restart dispatch as scheduleRestart above.
+     */
+    scheduleModelRelaunch: async (model: string, reason: string) => {
+      const agentDir = resolveAgentDirFromEnv()
+      if (!agentDir) throw new Error('agent dir unresolvable — cannot write session-model carrier')
+      // Carrier: single line, token + newline, no quoting (start.sh strips
+      // whitespace and shape-gates). One-shot — consumed on the next boot.
+      writeFileSync(join(agentDir, '.session-model-override'), `${model}\n`, 'utf8')
+      activeSessionModelOverride = model
+      await deps.scheduleRestart(reason)
+    },
   }
+  return deps
 }
 
 function modelMenuReplyMarkup(reply: ModelMenuReply): InlineKeyboard | undefined {
@@ -19804,25 +20095,21 @@ async function runQuotaWatch(opts: { bootTick?: boolean } = {}): Promise<void> {
     }
   } catch (err) {
     process.stderr.write(`telegram gateway: quota-watch: probe for crossing accounts failed: ${err}\n`)
-    if (!tuning.sendOnProbeFail) {
-      // A quota notification must never carry numbers we could not verify
-      // live. Leave the crossing accounts' state untouched — the
-      // transition re-evaluates (and re-probes) on the next 15-min tick.
-      // Persist any reconciles already applied, then bail.
-      if (reconciledCount > 0) {
-        try {
-          saveQuotaWatchState(stateDir, mutatedState)
-        } catch (saveErr) {
-          process.stderr.write(`telegram gateway: quota-watch state persist failed: ${saveErr}\n`)
-        }
+    // A quota notification must never carry numbers we could not verify
+    // live. Leave the crossing accounts' state untouched — the
+    // transition re-evaluates (and re-probes) on the next 15-min tick.
+    // Persist any reconciles already applied, then bail.
+    if (reconciledCount > 0) {
+      try {
+        saveQuotaWatchState(stateDir, mutatedState)
+      } catch (saveErr) {
+        process.stderr.write(`telegram gateway: quota-watch state persist failed: ${saveErr}\n`)
       }
-      process.stderr.write(
-        `telegram gateway: quota-watch: deferring ${pendingTransitions.length} notification(s) until probe succeeds\n`,
-      )
-      return
     }
-    // Legacy (SWITCHROOM_QUOTA_WATCH_SEND_ON_PROBE_FAIL=1): fall through
-    // and send from cached data.
+    process.stderr.write(
+      `telegram gateway: quota-watch: deferring ${pendingTransitions.length} notification(s) until probe succeeds\n`,
+    )
+    return
   }
 
   // Build final notifications, enriching the snapshot with fresh probe
@@ -19872,7 +20159,7 @@ async function runQuotaWatch(opts: { bootTick?: boolean } = {}): Promise<void> {
         // State normalised by the time of the probe — don't notify.
         continue
       }
-    } else if (!tuning.sendOnProbeFail) {
+    } else {
       // No verified fresh data for this account (per-account probe failure
       // or label missing from the batch result). Same rule as the batch
       // throw above: never send unverified numbers. State untouched —
@@ -23385,14 +23672,41 @@ bot.on('callback_query:data', async ctx => {
     // We track whether we applied the interim edit so we can skip the
     // toastOnly short-circuit if we did — a toastOnly return after the interim
     // edit would leave the menu stuck button-less.
-    let didInterimSrEdit = false
+    // sr-* TARGET tap: switch TO a non-Claude (LiteLLM/OpenRouter) model.
+    // Parity with the text `/model sr-*` path — claude's native picker rejects
+    // unknown sr-* ids, so an in-place inject can't set them. Carry the token
+    // across a graceful restart (the `.session-model-override` carrier) and
+    // relaunch `claude --model sr-*`. Session-only; reverts to the configured
+    // default on the next restart. The sr-* → Claude direction is handled below
+    // via the SELECT/alias outcome + isSrToClaudeTransition.
     if (data.startsWith(MODEL_CALLBACK_SR)) {
-      const srLabel = escapeHtmlForTg(srFriendlyLabel(data.slice(MODEL_CALLBACK_SR.length)))
+      const srName = data.slice(MODEL_CALLBACK_SR.length)
+      const srLabel = escapeHtmlForTg(srFriendlyLabel(srName))
+      if (!isValidModelArg(srName)) {
+        await ctx
+          .editMessageText(richMessage('❌ Invalid model name'), { reply_markup: { inline_keyboard: [] } })
+          .catch(() => {})
+        return
+      }
       await ctx
-        .editMessageText(richMessage(`⏳ Switching session to **${srLabel}**…`), { reply_markup: { inline_keyboard: [] } })
+        .editMessageText(
+          richMessage(`🔄 Switching session to **${srLabel}** — restarting (~30s). _Session-only; reverts to the configured default on the next restart._`),
+          { reply_markup: { inline_keyboard: [] } },
+        )
         .catch(() => {})
-      didInterimSrEdit = true
+      try {
+        await modelDeps.scheduleModelRelaunch(srName, `user: /model ${srName} (session-only relaunch, menu)`)
+      } catch (err) {
+        await ctx
+          .editMessageText(
+            richMessage(`❌ Could not switch to **${srLabel}**: ${escapeHtmlForTg((err as Error)?.message ?? String(err))}`),
+            { reply_markup: { inline_keyboard: [] } },
+          )
+          .catch(() => {})
+      }
+      return
     }
+    const didInterimSrEdit = false
     try {
       const prevSessionModel = activeSessionModelOverride
       const outcome = await handleModelMenuCallback(data, modelDeps)
@@ -26376,6 +26690,73 @@ void (async () => {
           }
         } catch {}
 
+        // ─── Session-model re-hydration + LiteLLM-down alert (session relaunch) ───
+        //
+        // start.sh writes the EFFECTIVE launched model to `.active-session-model`
+        // on every boot (the model actually passed to `claude --model`). Re-hydrate
+        // the in-memory session-model override from it so `/status` and the welcome
+        // card stay honest after a session-relaunch restart. Only treat it as an
+        // override when it differs from the configured/default model — a plain boot
+        // on the configured model leaves the override null.
+        //
+        // Also consume the `.session-model-alert` sentinel: start.sh drops it when
+        // it had to DROP an sr-* override because LiteLLM was unreachable at boot
+        // (booting on the configured default instead of 4xx-ing against Anthropic).
+        // We turn it into a loud Telegram message to the operator, then delete it.
+        try {
+          const smAgentDir = resolveAgentDirFromEnv()
+          if (smAgentDir) {
+            const activePath = join(smAgentDir, '.active-session-model')
+            if (existsSync(activePath)) {
+              try {
+                const launched = readFileSync(activePath, 'utf8').trim()
+                const configured = (() => {
+                  type AgentListResp = { agents: Array<{ name: string; model?: string | null }> }
+                  const d = switchroomExecJson<AgentListResp>(['agent', 'list'])
+                  const raw = d?.agents?.find(a => a.name === getMyAgentName())?.model ?? null
+                  // Resolve through the SAME resolver start.sh's scaffold uses, so an
+                  // unset (`null`) or `model: "default"` config value maps to the
+                  // switchroom default model id — matching the EFFECTIVE model start.sh
+                  // wrote to `.active-session-model`. Comparing the raw (unresolved)
+                  // value would flag every ordinary restart of a default-model agent as
+                  // a phantom session override.
+                  return resolveMainModel(raw ?? undefined)
+                })()
+                activeSessionModelOverride =
+                  launched.length > 0 && launched !== configured ? launched : null
+              } catch { /* leave override as-is on a bad read */ }
+            }
+
+            const alertPath = join(smAgentDir, '.session-model-alert')
+            if (existsSync(alertPath)) {
+              let alertText: string | null = null
+              try {
+                alertText = readFileSync(alertPath, 'utf8').trim()
+              } catch { alertText = null }
+              try { unlinkSync(alertPath) } catch { /* best-effort */ }
+              if (alertText && alertText.length > 0) {
+                // Notify EVERY operator, not just allowFrom[0]. Each send is wrapped
+                // in its own catch so one operator's failure (blocked bot, bad chat
+                // id) never stops the rest, and the outer boot flow never crashes.
+                const operators = loadAccess().allowFrom
+                for (const operator of operators) {
+                  if (!operator) continue
+                  void lockedBot.api
+                    .sendMessage(operator, `⚠️ ${alertText}`)
+                    .catch((err: unknown) =>
+                      process.stderr.write(
+                        `telegram gateway: session-model alert send failed for ${operator}: ${(err as Error)?.message ?? String(err)}\n`,
+                      ),
+                    )
+                }
+                process.stderr.write(`telegram gateway: session-model: LiteLLM-down override drop — ${alertText}\n`)
+              }
+            }
+          }
+        } catch (err) {
+          process.stderr.write(`telegram gateway: session-model re-hydration failed: ${(err as Error)?.message ?? String(err)}\n`)
+        }
+
         // Credit-exhaustion watcher (#348). Reads `<agentDir>/.claude/.claude.json`
         // for `cachedExtraUsageDisabledReason`. Fires a Telegram notification
         // on transition into / out of fatal billing states (out_of_credits,
@@ -26593,6 +26974,20 @@ void (async () => {
                 ownedWorktreeCwds({
                   self: process.env.SWITCHROOM_AGENT_NAME,
                   listRecords: listWorktreeRecords,
+                  // Durable, non-env identity fallback (#1116 / #2893): when
+                  // SWITCHROOM_AGENT_NAME is somehow unset, derive this
+                  // agent's own identity from its own directory so worktree
+                  // ownership still resolves (env is only the fast path).
+                  // `watcherAgentDir` is guaranteed non-null in this branch
+                  // (the whole watcher is gated on it above). Kill-switch
+                  // SWITCHROOM_WORKTREE_IDENTITY_FALLBACK=0 restores the
+                  // pre-fix env-only behaviour.
+                  agentDir:
+                    process.env.SWITCHROOM_WORKTREE_IDENTITY_FALLBACK === '0'
+                      ? undefined
+                      : watcherAgentDir,
+                  log: (msg) =>
+                    process.stderr.write(`telegram gateway: ${msg}\n`),
                 }),
               // Bug 0 fix: previously omitted, leaving the watcher unable to
               // write liveness/stall/turn_end updates to the registry DB.