switchroom 0.17.10 → 0.18.6

package/telegram-plugin/gateway/inbound-delivery-gate.ts

@@ -116,3 +116,29 @@ export function decideInboundDelivery(
   if (input.turnInFlight) return 'buffer-until-idle'
   return 'deliver'
 }
+
+/**
+ * #2917 — atomic check-and-reserve for per-chat outbound FIFO.
+ *
+ * `decideInboundDelivery` decides deliver-vs-buffer, but on the concurrent
+ * `handleInbound` path that decision and the busy-mark that records "a turn is
+ * now in flight for this chat" are separated by an `await` (attachment
+ * download, composer-clear). Two same-chat inbounds can therefore each read
+ * "idle" during the other's async lead-in and both deliver — the replies then
+ * come back reordered. This helper couples the decision with a `reserve` flag:
+ * a FRESH-TURN deliver must reserve the chat's busy key SYNCHRONOUSLY (before
+ * any await) so the next same-chat inbound sees it and buffers behind it.
+ *
+ * `reserve` is true ONLY for a fresh-turn deliver. Steering / interrupt
+ * inbounds deliver mid-turn WITHOUT starting a turn, so they must not reserve
+ * (reserving would wedge the running turn's key). A buffered decision never
+ * reserves.
+ */
+export function reserveInboundDelivery(
+  input: InboundDeliveryGateInput,
+): { decision: InboundDeliveryDecision; reserve: boolean } {
+  const decision = decideInboundDelivery(input)
+  const reserve =
+    decision === 'deliver' && !input.isSteering && input.isInterrupt !== true
+  return { decision, reserve }
+}

package/telegram-plugin/gateway/model-command.ts

@@ -52,11 +52,14 @@ export const MODEL_ALIASES = ['opus', 'sonnet', 'haiku', 'fable', 'default'] as
  * Shape gate for the model argument. This string is typed literally
  * into the agent's tmux pane, so the gate is strict by construction:
  * one token, alphanumeric start, then alphanumerics plus the chars
- * that appear in real model ids (`.` `_` `-` and the `[1m]`-style
- * variant brackets). No whitespace means no second token can ride
+ * that appear in real model ids (`.` `_` `-` `/` and the `[1m]`-style
+ * variant brackets). `/` is allowed for OpenRouter-style
+ * `sr-vendor/model` ids; it is not a shell metachar inside the
+ * double-quoted `claude --model "$_EFFECTIVE_MODEL"` usage, so it can't
+ * break the launch. No whitespace means no second token can ride
  * along; no control characters means no newline/Enter smuggling.
  */
-const MODEL_ARG_RE = /^[A-Za-z0-9][A-Za-z0-9._\[\]-]{0,99}$/
+const MODEL_ARG_RE = /^[A-Za-z0-9][A-Za-z0-9._/\[\]-]{0,99}$/
 
 export function isValidModelArg(arg: string): boolean {
   return MODEL_ARG_RE.test(arg)
@@ -133,6 +136,18 @@ export interface ModelCommandDeps {
    * mechanism as the `/restart` command (hostd-first, SIGTERM fallback).
    */
   scheduleRestart: (reason: string) => Promise<void>
+  /**
+   * Schedule a session-only switch TO a non-Claude (`sr-*` LiteLLM/OpenRouter)
+   * model. claude's in-REPL `/model` picker rejects unknown `sr-*` ids, so an
+   * inject can't set them. Instead the gateway writes the chosen token to the
+   * `.session-model-override` carrier file and gracefully restarts the agent;
+   * the next boot launches `claude --model <token>` directly (LiteLLM routes
+   * it, no picker validation). Session-only: reverts to the configured default
+   * on the following restart. Wired to the same restart dispatch as
+   * `scheduleRestart`, plus the carrier write. `model` is the full `sr-*` id
+   * (already alias-expanded); `reason` is stamped as the restart reason.
+   */
+  scheduleModelRelaunch: (model: string, reason: string) => Promise<void>
 }
 
 export interface ModelCommandReply {
@@ -152,6 +167,7 @@ function helpText(deps: ModelCommandDeps, reason?: string): ModelCommandReply {
     '\`/model\` — show the configured model',
     `\`/model <name>\` — switch the live session (${MODEL_ALIASES.map(a => `\`${a}\``).join(' · ')} or a full model id)`,
     `_OpenRouter shortcuts:_ ${srAliasExamples}`,
+    '_OpenRouter (sr-\\*) switches restart the session (~30s); Claude switches apply instantly._',
     PERSIST_NOTE,
   )
   return { text: lines.join('\n'), html: true }
@@ -214,6 +230,30 @@ export async function handleModelCommand(
     }
   }
 
+  // Claude → sr-*: an in-place inject can't set a non-Anthropic model — claude's
+  // native `/model` picker rejects the unknown `sr-*` id ("Model not found").
+  // Carry the token across a graceful restart and relaunch `claude --model
+  // sr-*` directly (LiteLLM routes it). Session-only: reverts to the configured
+  // default on the next restart. The sr-* → Claude direction is handled above.
+  if (isSrModel(model)) {
+    try {
+      await deps.scheduleModelRelaunch(model, `user: /model ${model} (session-only relaunch)`)
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err)
+      return {
+        text: `❌ Could not schedule model switch: ${deps.escapeHtml(msg)}`,
+        html: true,
+      }
+    }
+    return {
+      text: [
+        `Switching to \`${deps.escapeHtml(model)}\` — restarting session (~30s).`,
+        '_Session-only — reverts to the configured default on the next restart._',
+      ].join('\n'),
+      html: true,
+    }
+  }
+
   const verbHtml = `\`/model ${deps.escapeHtml(model)}\``
   let result: InjectResult
   try {
@@ -358,16 +398,31 @@ export const EXTRA_CLAUDE_ALIASES: ReadonlyArray<{ alias: string; label: string
  * Friendly display names for sr-* synthetic model names. An sr-* model in
  * LiteLLM has no entry in `model_group_settings.*.forward_client_headers_to_llm_api`
  * so the Anthropic OAuth credential is NEVER forwarded — safe to route to
- * OpenRouter. Names here are display-only; the raw `sr-*` id is what gets
- * injected into the agent's session. See reference/rfcs/litellm-max-subscription-invariants.md § I6.
+ * OpenRouter. Names here are display-only (used by srFriendlyLabel for /status
+ * and switch confirmations); the raw `sr-*` id is what gets injected into the
+ * agent's session. This table is a SUPERSET of the menu-reachable set
+ * (SR_MODEL_ALIASES): it also labels models that are only reachable by typing
+ * the full `/model sr-<name>` (manual passthrough), so those still get a
+ * friendly name without appearing as a keyboard button.
+ * See reference/rfcs/litellm-max-subscription-invariants.md § I6.
  */
 export const SR_MODEL_LABELS: Record<string, string> = {
   'sr-gemini-2.5-pro': 'Gemini 2.5 Pro',
   'sr-gemini-2.5-flash': 'Gemini 2.5 Flash',
   'sr-deepseek-r1': 'DeepSeek R1',
   'sr-deepseek-v3': 'DeepSeek V3',
-  'sr-glm-5': 'GLM-5',
+  // sr-glm-5 now targets glm-5.2 in the live litellm config — label bumped to match.
+  'sr-glm-5': 'GLM-5.2',
   'sr-codex-5.5': 'Codex 5.5',
+  // OpenRouter coverage (pairs with the live litellm sr-* model_name additions).
+  'sr-gpt-oss-20b': 'GPT-OSS 20B',
+  'sr-gpt-oss-120b': 'GPT-OSS 120B',
+  'sr-gpt-5.5': 'GPT-5.5',
+  'sr-gpt-5-codex': 'GPT-5 Codex',
+  'sr-gpt-5.2-codex': 'GPT-5.2 Codex',
+  'sr-gemini-flash-lite': 'Gemini 3.1 Flash Lite',
+  'sr-minimax-m3': 'MiniMax M3',
+  'sr-deepseek-v4-flash': 'DeepSeek V4 Flash',
 }
 
 /**
@@ -448,10 +503,15 @@ function headerRow(label: string): ModelMenuKeyboardButton[] {
  * requires ANTHROPIC_CUSTOM_HEADERS (a litellm key) to be set on the gateway
  * process. switchroom never sets that env on the gateway, so in production
  * discoverSrModels() always returns [] and the external group was silently
- * empty. The six SR_MODEL_ALIASES targets are the sr-* names the litellm
- * config actually exposes, so seeding from them makes the group reliable
- * without the missing env — while still merging any live results on hosts
- * that do configure discovery.
+ * empty. The six SR_MODEL_ALIASES targets are the CURATED main sr-* set, so
+ * seeding from them makes the group reliable without the missing env — while
+ * still merging any live results on hosts that do configure discovery.
+ *
+ * Deliberately a SUBSET: the litellm config exposes more sr-* models than this
+ * (the full OpenRouter catalogue). Those extras are display-labelled in
+ * SR_MODEL_LABELS and remain typeable via `/model <full-sr-name>` (manual
+ * passthrough — the set path is a shape gate, no whitelist), but they are kept
+ * OUT of SR_MODEL_ALIASES on purpose so the keyboard stays small and curated.
  *
  * Subscription-honest: ONLY the curated sr-* aliases surface as buttons. Raw
  * gpt-4o / openrouter/* dupes / voyage-* embeddings never do.

package/telegram-plugin/gateway/resolve-person.ts

@@ -0,0 +1,304 @@
+/**
+ * Boot-time-only, chat-scoped resolution of a raw Telegram id/username into
+ * a human `person_id` (e.g. "Lisa") for display in the `<channel>` tag's
+ * `user` attribute.
+ *
+ * Design (converged after adversarial review — see the PR description for
+ * the tradeoffs, do not re-litigate here):
+ *
+ *   - No MCP tool. Not callable by agents — display-only, gateway-internal.
+ *   - No hot-reload. `PersonDirectory` is built ONCE at gateway boot from
+ *     the static in-memory `people.json` the scaffold projected from
+ *     `switchroom.yaml`'s `users:` block. A config change requires an agent
+ *     restart to take effect — this file never re-reads anything.
+ *   - `access.json` (the fail-CLOSED allow-list) is a completely separate
+ *     concern and is never touched here. This feature is fail-OPEN: an
+ *     unresolved id/username falls back to today's behavior (the caller
+ *     keeps using the raw id/username) — it never blocks or denies
+ *     anything.
+ *   - Chat-scoped: a resolved name is only ever returned for a chat/group
+ *     the person is actually a member of. In a DM the chat IS the sender,
+ *     so resolution always applies. In a group, resolution only applies if
+ *     the sender's id or username is explicitly present in that group's
+ *     `allowFrom` (read from the EXISTING `access.json`/`loadAccess()`
+ *     data — no new membership source). An empty/unset group `allowFrom`
+ *     means membership can't be positively confirmed, so we conservatively
+ *     do NOT resolve (the raw id/username is shown instead) — a name safe
+ *     in a 1:1 DM could be a bigger leak in a shared group.
+ *   - Per-entry validation: a malformed `users:` entry (duplicate
+ *     `person_id` claimed by two different keys, empty/invalid
+ *     `person_id`, no `telegram_ids`) drops ONLY that one entry — it never
+ *     blanks resolution for the whole fleet. `buildPersonDirectory` never
+ *     throws; every failure mode is reported via its `dropped` return
+ *     value instead, so the caller can route it through the existing
+ *     fleet-alert path (`emitGatewayOperatorEvent` in gateway.ts) at
+ *     low/config severity — this must never page like a real outage.
+ *
+ * Fix note (accepted soft mitigation — see docs/configuration.md): there is
+ * no automated enforcement that a configured `person_id` stays safe to show
+ * if a group's membership changes AFTER the entry is written. This is an
+ * operator-discipline convention, not a closed gap. Low severity today —
+ * only two `person_id`s are configured fleet-wide.
+ */
+
+export interface RawPersonEntry {
+  /** The `users:` map key (e.g. "lisa") — carried through for alert text. */
+  key: string
+  person_id: string
+  telegram_ids: string[]
+}
+
+export interface PersonDirectoryEntry {
+  key: string
+  personId: string
+  /** Normalized (lowercased, no leading "@") telegram ids/usernames. */
+  telegramKeys: string[]
+}
+
+export interface PersonDirectory {
+  /** normalized telegram id/username -> directory entry */
+  byTelegramKey: Record<string, PersonDirectoryEntry>
+}
+
+export interface DroppedPersonEntry {
+  key: string
+  reason: string
+  /**
+   * Name-scrubbed reason CLASS — the same rejection without the embedded
+   * `person_id` human-name value or the colliding telegram id. Used to
+   * build the broadcast `alertDetail` so a config-warning card (which
+   * `emitGatewayOperatorEvent` sends to EVERY `allowFrom` chat, including
+   * group chats where the named person may NOT be a member) never surfaces
+   * a human name that the display path (`resolvePersonName`) deliberately
+   * chat-scopes. The verbose `reason` is still carried for the operator's
+   * own stderr `logLine` (private, not broadcast).
+   */
+  reasonClass: string
+}
+
+export interface BuildPersonDirectoryResult {
+  directory: PersonDirectory
+  dropped: DroppedPersonEntry[]
+}
+
+/** Normalize a telegram id or @username for keying: trim, strip a leading
+ * "@", lowercase (Telegram usernames are case-insensitive). */
+function normalizeTelegramKey(raw: string): string {
+  return raw.trim().replace(/^@/, '').toLowerCase()
+}
+
+/**
+ * Validate and dedupe raw `users:` `person_id` entries into a lookup
+ * directory. Never throws — every rejection is reported via `dropped`
+ * instead, per the fail-open / drop-only-that-entry design.
+ *
+ * Drop reasons:
+ *   - missing/blank `key` or `person_id`
+ *   - `telegram_ids` missing or empty (nothing to key the entry by)
+ *   - `person_id` already claimed by an earlier (different) entry key —
+ *     first-declared entry wins, the later duplicate is dropped whole
+ *     (not just the colliding id) so the alert is unambiguous about which
+ *     entry lost
+ *   - a `telegram_id`/username already claimed by an earlier (different)
+ *     entry key — same first-declared-wins convention: the later duplicate
+ *     is dropped whole so the alert is unambiguous about which entry lost
+ *     and we never silently last-write-wins a numeric id into the wrong
+ *     person's name
+ */
+export function buildPersonDirectory(entries: readonly RawPersonEntry[]): BuildPersonDirectoryResult {
+  const byTelegramKey: Record<string, PersonDirectoryEntry> = {}
+  const dropped: DroppedPersonEntry[] = []
+  const personIdOwner = new Map<string, string>() // person_id (lowercased) -> owning entry key
+  const telegramKeyOwner = new Map<string, string>() // normalized telegram id/username -> owning entry key
+
+  for (const raw of entries) {
+    const key = typeof raw.key === 'string' ? raw.key.trim() : ''
+    const personId = typeof raw.person_id === 'string' ? raw.person_id.trim() : ''
+
+    if (key.length === 0) {
+      dropped.push({ key: raw.key || '(unknown)', reason: 'missing users: map key', reasonClass: 'missing users: map key' })
+      continue
+    }
+    if (personId.length === 0) {
+      dropped.push({ key, reason: 'empty or missing person_id', reasonClass: 'empty or missing person_id' })
+      continue
+    }
+    if (!Array.isArray(raw.telegram_ids) || raw.telegram_ids.length === 0) {
+      dropped.push({ key, reason: 'no telegram_ids to resolve against', reasonClass: 'no telegram_ids to resolve against' })
+      continue
+    }
+
+    const personIdLower = personId.toLowerCase()
+    const existingOwner = personIdOwner.get(personIdLower)
+    if (existingOwner != null && existingOwner !== key) {
+      dropped.push({
+        key,
+        // Verbose reason (stderr logLine only — private to the operator):
+        // names the person_id value + the owning config key.
+        reason: `duplicate person_id "${personId}" already claimed by users.${existingOwner}`,
+        // reasonClass (broadcast alertDetail): scrubs the human-name
+        // person_id value; keeps the entry key + collision class. A
+        // config-warning card fans out to every allowFrom chat, so the
+        // name must not travel further than the display path allows.
+        reasonClass: `duplicate person_id already claimed by users.${existingOwner}`,
+      })
+      continue
+    }
+    personIdOwner.set(personIdLower, key)
+
+    const telegramKeys = [...new Set(raw.telegram_ids.map(normalizeTelegramKey).filter((k) => k.length > 0))]
+    if (telegramKeys.length === 0) {
+      dropped.push({ key, reason: 'telegram_ids contained no usable id/username', reasonClass: 'telegram_ids contained no usable id/username' })
+      personIdOwner.delete(personIdLower)
+      continue
+    }
+
+    const collidingTelegramKey = telegramKeys.find((tk) => {
+      const existingTkOwner = telegramKeyOwner.get(tk)
+      return existingTkOwner != null && existingTkOwner !== key
+    })
+    if (collidingTelegramKey != null) {
+      const existingTkOwner = telegramKeyOwner.get(collidingTelegramKey)
+      dropped.push({
+        key,
+        reason: `duplicate telegram_id "${collidingTelegramKey}" already claimed by users.${existingTkOwner}`,
+        // Scrub the colliding telegram id/username from the broadcast
+        // reason; keep the owning config key (operator-chosen slug).
+        reasonClass: `duplicate telegram_id already claimed by users.${existingTkOwner}`,
+      })
+      personIdOwner.delete(personIdLower)
+      continue
+    }
+
+    const entry: PersonDirectoryEntry = { key, personId, telegramKeys }
+    for (const tk of telegramKeys) {
+      telegramKeyOwner.set(tk, key)
+      byTelegramKey[tk] = entry
+    }
+  }
+
+  return { directory: { byTelegramKey }, dropped }
+}
+
+export interface PersonDirectoryBootResult {
+  directory: PersonDirectory
+  /** Non-null when the caller should route an alert through the fleet
+   * alert path (`emitGatewayOperatorEvent`, kind: 'config-warning'). */
+  alertDetail: string | null
+  /** Always present — one human-readable line for stderr. */
+  logLine: string
+}
+
+/**
+ * Orchestrate the ONE-TIME boot-time check (requirement: boot-time-only,
+ * NOT periodic — call this exactly once, at gateway boot, never on a
+ * timer/interval). Extracted as a pure(ish) function — taking the file
+ * read as an injected dependency and RETURNING what to log/alert rather
+ * than performing the I/O itself — so it's unit-testable without booting
+ * the real gateway process.
+ *
+ * Dead-man's-switch: wraps the whole check in try/catch. If anything
+ * throws before completing (including `readEntries` itself), that failure
+ * is ALSO surfaced via `alertDetail` — mirrors a past incident where
+ * `access.json` validation failed silently in the wrong (fail-open)
+ * direction, undetected for hours. `PERSON_DIRECTORY` falls back to an
+ * empty directory on crash (fail-open: raw ids/usernames keep showing).
+ */
+export function runPersonDirectoryBootCheck(readEntries: () => RawPersonEntry[]): PersonDirectoryBootResult {
+  try {
+    const rawEntries = readEntries()
+    const { directory, dropped } = buildPersonDirectory(rawEntries)
+
+    if (dropped.length > 0) {
+      // Broadcast-safe summary for `alertDetail` (fans out to EVERY
+      // allowFrom chat via emitGatewayOperatorEvent, including group chats
+      // where the named person may not be a member): built from
+      // `reasonClass`, which scrubs the embedded person_id human-name
+      // value and the colliding telegram id. The verbose `reason`
+      // (names the values) is kept for the operator's own stderr
+      // `logLine` — private, never broadcast.
+      const alertSummary = dropped.map((d) => `${d.key} (${d.reasonClass})`).join('; ')
+      const logSummary = dropped.map((d) => `${d.key} (${d.reason})`).join('; ')
+      const plural = dropped.length === 1 ? 'y' : 'ies'
+      return {
+        directory,
+        alertDetail: `person_id: dropped ${dropped.length} malformed users: entr${plural} at boot — ${alertSummary}`,
+        logLine: `telegram gateway: person_id boot validation dropped ${dropped.length} entr${plural}: ${logSummary}`,
+      }
+    }
+
+    return {
+      directory,
+      alertDetail: null,
+      logLine: rawEntries.length > 0
+        ? `telegram gateway: person_id boot validation ok — ${Object.keys(directory.byTelegramKey).length} telegram id/username(s) resolved`
+        : `telegram gateway: person_id boot validation ok — no person_id entries configured`,
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return {
+      directory: { byTelegramKey: {} },
+      // Crash alertDetail scrubs the raw error message too — it can
+      // carry a filesystem path or other host detail that shouldn't fan
+      // out to every allowFrom chat. The full message stays in logLine.
+      alertDetail: `person_id boot validation crashed — name resolution disabled this boot (fail-open, raw ids/usernames will show); see gateway stderr for detail`,
+      logLine: `telegram gateway: person_id boot validation CRASHED (name resolution disabled this boot, raw ids will show — fail-open): ${msg}`,
+    }
+  }
+}
+
+export interface ResolvePersonOptions {
+  telegramId: string
+  username?: string | undefined
+  isDm: boolean
+  /** That chat's/group's configured allowFrom, if any (from access.json). */
+  groupAllowFrom?: readonly string[] | undefined
+}
+
+/**
+ * Resolve a sender's display name for THIS chat, chat-scoped per the
+ * module doc above. Returns undefined (fall back to raw id/username) when
+ * unresolved OR when membership in a group chat can't be positively
+ * confirmed.
+ */
+export function resolvePersonName(directory: PersonDirectory, opts: ResolvePersonOptions): string | undefined {
+  const idKey = normalizeTelegramKey(opts.telegramId)
+  const usernameKey = opts.username ? normalizeTelegramKey(opts.username) : undefined
+
+  const entry = directory.byTelegramKey[idKey] ?? (usernameKey ? directory.byTelegramKey[usernameKey] : undefined)
+  if (!entry) return undefined
+
+  // DM: the chat IS the sender, so resolution always applies.
+  if (opts.isDm) return entry.personId
+
+  // Group: only resolve if the sender is explicitly present in that
+  // chat's allowFrom (the existing membership source) — conservative
+  // fallback (undefined) otherwise, since we can't positively confirm
+  // membership from an empty/unset list.
+  const allowFrom = opts.groupAllowFrom ?? []
+  const allowFromNormalized = allowFrom.map(normalizeTelegramKey)
+  const memberConfirmed =
+    allowFromNormalized.includes(idKey) || (usernameKey != null && allowFromNormalized.includes(usernameKey))
+  return memberConfirmed ? entry.personId : undefined
+}
+
+/**
+ * Fail-open call-site wrapper around `resolvePersonName`, for use at the
+ * `handleInbound` call site (gateway.ts). This feature's whole design
+ * point is "never blocks or denies anything" (module doc above) — a throw
+ * from resolution must fall back to the raw id/username, not abort message
+ * handling. Mirrors the same defensive pattern already used for
+ * `readPeopleFile` (gateway.ts) and `runPersonDirectoryBootCheck` (this
+ * file): catch, fall back, never propagate.
+ */
+export function safeResolvePersonName(
+  directory: PersonDirectory,
+  opts: ResolvePersonOptions,
+  rawFallback: string,
+): string {
+  try {
+    return resolvePersonName(directory, opts) ?? rawFallback
+  } catch {
+    return rawFallback
+  }
+}

package/telegram-plugin/gateway/unhandled-rejection-policy.ts

@@ -126,7 +126,27 @@ export function classifyRejection(
     // handler shut the process down. reconcileStatusPin now absorbs its own
     // errors (primary fix); this entry is defense-in-depth so ANY leaked
     // pin-rights 400 from any path is log-only, not fatal.
-    desc.includes('not enough rights')
+    desc.includes('not enough rights') ||
+    // 'group chat was upgraded to a supergroup chat' fires when a send
+    // targets a basic-group chat_id that Telegram has since migrated to
+    // a supergroup (new id format -100xxxxxxxxxx). Telegram sometimes
+    // surfaces the replacement id via `error.parameters.migrate_to_chat_id`
+    // but not reliably for every send method, so this handler can't always
+    // auto-repair the stale id — it can only make the failure non-fatal.
+    // This crashed marko's gateway on 2026-07-09 (and recurred from the
+    // same stale-id root cause on 2026-06-07 and 2026-06-09): a send to an
+    // old pre-migration group id crashed the WHOLE gateway process for
+    // every agent/chat, not just the one stale chat. A single unmigrated
+    // chat_id in cached state must never be fatal — log it so the stale id
+    // can be tracked down and fixed, but keep serving every other chat.
+    desc.includes('group chat was upgraded to a supergroup chat') ||
+    // Broader class: any 400 whose description signals the target
+    // chat_id itself is no longer valid (migrated, deactivated, or
+    // otherwise unresolvable). These are all "this one destination is
+    // broken", never "the gateway is broken" — same log-only posture as
+    // 'chat not found' above.
+    desc.includes('chat_id is empty') ||
+    desc.includes('group chat was deactivated')
   ) {
     return 'log_only'
   }