switchroom 0.18.11 → 0.18.13

package/telegram-plugin/gateway/hostd-dispatch.ts

@@ -125,6 +125,29 @@ export function hostdRequestId(prefix: string): string {
   return `${prefix}-${Date.now()}-${randomBytes(4).toString("hex")}`;
 }
 
+/**
+ * #1841 — attach an operator-passphrase attestation to a hostd request.
+ *
+ * Mirrors the existing gateway→broker plaintext-forward used for
+ * `vault_request_save`: after `/vault unlock` the gateway caches the
+ * operator passphrase per-chat, and forwards it on the wire when an admin
+ * agent invokes a privileged hostd verb. hostd never holds the passphrase —
+ * it re-forwards this value to the vault broker and treats a broker DENIED
+ * as a gate failure (see `AttestVerifier` in `src/host-control/server.ts`).
+ *
+ * Returns the request unchanged when no passphrase is cached (the
+ * feature-off / not-yet-unlocked posture stays byte-identical to today).
+ * Pure — returns a new object rather than mutating in place, so a caller
+ * can pass a request literal.
+ */
+export function withOperatorAttestation<T extends HostdRequest>(
+  req: T,
+  passphrase: string | undefined,
+): T {
+  if (!passphrase) return req;
+  return { ...req, operator_passphrase: passphrase };
+}
+
 /**
  * Single-shot `get_status` snapshot for `targetRequestId` (NOT a
  * poll-until-terminal — {@link pollHostdStatus} does that). Used by

package/telegram-plugin/gateway/idle-clear.ts

@@ -4,22 +4,63 @@
  * instead of resuming a stale, context-heavy thread. Long-term memory lives in
  * Hindsight, so a clear loses only the in-session scratch.
  *
+ * WHAT "IDLE" MEANS HERE (the #3084/#3107 semantics, fixed 2026-07-11):
+ *
+ *   Idle = nothing has happened since the last thing happened.
+ *
+ * "Something happened" is ANY observable event on this agent:
+ *   - an inbound Telegram message,
+ *   - a cron / inject_inbound fire,
+ *   - ANY event off the claude session stream — turn start, thinking, a tool
+ *     call, a tool result, streamed text, a sub-agent event, turn end.
+ *
+ * It emphatically does NOT mean "no turn has *started* recently". That was the
+ * original reading and it inverted the invariant: the idle window was measured
+ * from a turn's START, so the longer and harder an agent worked, the more
+ * certain the wipe. On 2026-07-11 `overlord` worked for three hours straight
+ * (subagents, ~25 PRs) after its last recorded turn boundary and was `/clear`ed
+ * the moment the window elapsed — its whole working context destroyed for being
+ * productive. See `reference/jobs/always-available.md`.
+ *
+ * Two independent clocks feed the decision, and the window is measured from
+ * whichever is later:
+ *   - `lastActivityAt`  — stamped on every event above (the load-bearing fix:
+ *     an agent that is DOING something is not idle, turn boundaries or not).
+ *   - `lastTurnEndedAt` — stamped when a turn ends (defence in depth: the
+ *     instant a turn ends, `turnInFlight` stops suppressing the clear, so a
+ *     turn that ran longer than the window would otherwise be wiped on the very
+ *     next tick — the timer must never be "already expired" at turn end).
+ *
+ * A genuinely idle session — no inbound, no cron, no model activity for the
+ * whole window — is still cleared. That is the feature and it stays.
+ *
  * Sibling of proactive-compact.ts (occupancy-driven /compact at the turn-end
  * idle gate). This one is wall-clock-driven: it fires `/clear` from a periodic
  * interval because a fully-idle agent never ends a turn, so the turn-end gate
  * alone would never see it. Both inject via the same primitive and both refuse
  * to fire mid-turn (turnInFlight guard).
  *
- * The decider is pure so the fire-once / re-arm / not-mid-turn / disabled logic
- * is unit-tested without the gateway.
+ * The decider and the event classifier are pure so the whole
+ * fire-once / re-arm / not-mid-turn / not-just-worked / disabled logic is
+ * unit-tested without the gateway.
  */
 
 /** Default idle window when `session.idle_clear_after` is unset (3h). ON by default. */
 export const DEFAULT_IDLE_CLEAR_MS = 3 * 60 * 60 * 1000;
 
 export interface IdleClearState {
-  /** Epoch ms of the last activity (inbound, turn start, cron fire). */
+  /**
+   * Epoch ms of the last activity: inbound, cron fire, or ANY claude session
+   * stream event (turn start, tool call, tool result, text, sub-agent event,
+   * turn end). Not just turn starts — see the header.
+   */
   lastActivityAt: number;
+  /**
+   * Epoch ms when a turn last ended (null = no turn has ended this process).
+   * The window is measured from `max(lastActivityAt, lastTurnEndedAt)` so a turn
+   * that outran the idle window is not cleared the instant it finishes.
+   */
+  lastTurnEndedAt: number | null;
   /** Idle window in ms. <= 0 disables auto-clear. */
   idleClearMs: number;
   /** Already auto-cleared since the last activity? Prevents re-clearing every tick. */
@@ -32,11 +73,17 @@ export interface IdleClearDecision {
   clear: boolean;
 }
 
+/** Epoch ms of the last thing that happened — activity or a turn ending. */
+export function lastEventAt(state: IdleClearState): number {
+  return Math.max(state.lastActivityAt, state.lastTurnEndedAt ?? 0);
+}
+
 /**
  * Decide whether to auto-clear this evaluation. Fires exactly once per idle
  * period: only when enabled, not mid-turn, not already cleared, and the idle
- * window has elapsed. The caller sets `alreadyCleared` on fire and resets it
- * (with `lastActivityAt`) on the next activity to re-arm.
+ * window has elapsed since the last thing that happened. The caller sets
+ * `alreadyCleared` on fire and resets it (with `lastActivityAt`) on the next
+ * activity to re-arm.
  */
 export function decideIdleClear(
   state: IdleClearState,
@@ -45,10 +92,47 @@ export function decideIdleClear(
   if (state.idleClearMs <= 0) return { clear: false }; // disabled
   if (state.turnInFlight) return { clear: false }; // never mid-turn
   if (state.alreadyCleared) return { clear: false }; // once per idle period
-  if (now - state.lastActivityAt < state.idleClearMs) return { clear: false };
+  // Measured from the LAST thing that happened — activity or a turn ending —
+  // never from a turn's start. A turn that ran longer than the window ends with
+  // a fresh turn-end stamp, so it is not idle the moment it finishes.
+  if (now - lastEventAt(state) < state.idleClearMs) return { clear: false };
   return { clear: true };
 }
 
+/** What a claude session-stream event means for the idle clocks. */
+export interface IdleEventSignal {
+  /** Genuine agent activity → stamp `lastActivityAt` (and re-arm). */
+  activity: boolean;
+  /** A turn ended → stamp `lastTurnEndedAt`. */
+  turnEnded: boolean;
+}
+
+/**
+ * Classify a session-stream event for the idle clocks. Pure, so the gateway's
+ * dispatcher stays a one-liner and the semantics are testable.
+ *
+ * EVERY genuine stream event is activity — thinking, tool_use, tool_result,
+ * text, model, enqueue (turn start), turn_end, and all `sub_agent_*` kinds.
+ * The claude session emits nothing at all while the agent is truly idle, so
+ * "any event = activity" is exactly the intended reading and cannot keep a
+ * dormant session alive forever.
+ *
+ * The one exception is the gateway's OWN synthetic `turn_end` (durationMs ===
+ * -1), re-dispatched by the orphaned-reply backstop: it is the gateway talking
+ * to itself, not the model doing something, so it does not stamp activity — but
+ * it DOES end the turn (the in-flight gate opens), so it stamps the turn-end
+ * clock. Same `!(turn_end && durationMs === -1)` predicate the per-turn liveness
+ * stamp already uses for "genuine stream event".
+ */
+export function classifyIdleEvent(
+  kind: string,
+  durationMs?: number,
+): IdleEventSignal {
+  const turnEnded = kind === "turn_end";
+  const synthetic = turnEnded && durationMs === -1;
+  return { activity: !synthetic, turnEnded };
+}
+
 /**
  * Parse a `^\d+[smh]$` duration (the SessionSchema format, e.g. "3h", "30m",
  * "7200s") to ms. Returns null on a malformed string so the caller can fall

package/telegram-plugin/gateway/inbound-delivery-machine-shadow.ts

@@ -27,6 +27,16 @@
  * buffer: agent=X buffered ...` etc.) is the validation that the
  * machine is bit-identical with reality.
  *
+ * Trace verbosity (#3025): the TTL `tick` event fires every ~30s and on a
+ * healthy idle agent emits a zero-signal `event=tick effects=[]
+ * global=bridge_alive_idle` line. Those no-op ticks are SUPPRESSED by
+ * default (they filled gateway-supervisor.log to 555MB on clerk). Set
+ * `SWITCHROOM_GW_TRACE=1` to restore the full firehose — every tick, poll,
+ * and event line — when debugging the delivery/poll path. The gate lives
+ * in `../shared/gw-trace-gate.ts` and also governs the `tg-post` poll
+ * heartbeats. Real events, turn-expiring ticks, and in-turn ticks always
+ * log regardless of the flag.
+ *
  * Toggle off via `SWITCHROOM_DELIVERY_MACHINE_SHADOW=0` — a kill
  * switch for the case where the shadow emits prove problematic
  * (e.g., trace volume too high). The default is ON.
@@ -39,6 +49,7 @@ import {
   initialState,
   transition,
 } from './inbound-delivery-machine.js'
+import { shouldEmitShadowTrace } from '../shared/gw-trace-gate.js'
 
 let state: State = initialState()
 const enabled = process.env.SWITCHROOM_DELIVERY_MACHINE_SHADOW !== '0'
@@ -101,11 +112,21 @@ export function shadowEmit(event: Event): readonly Effect[] {
     // low volume (one line per gateway event, not per effect). The
     // format matches gateway.ts's existing `tg-post method=...` shape
     // so log aggregation can pick it up without a new parser.
-    const effectKinds = result.effects.map((e) => e.kind).join(',')
-    const eventDetail = formatEventDetail(event)
-    process.stderr.write(
-      `gw-trace shadow event=${event.kind}${eventDetail} effects=[${effectKinds}] global=${state.global.kind} perKeySize=${state.perKey.size}\n`,
-    )
+    // #3025: the TTL `tick` event fires every ~30s. On a healthy idle
+    // agent it produces no effects and leaves the machine idle — a
+    // zero-signal heartbeat that (unrotated) grew this log to 555MB on
+    // clerk. Suppress those no-op ticks unless the operator opted into
+    // the full firehose (SWITCHROOM_GW_TRACE=1). Real events, ticks that
+    // expire a turn (non-empty effects), and in-turn ticks still log.
+    if (
+      shouldEmitShadowTrace(event.kind, result.effects.length, state.global.kind)
+    ) {
+      const effectKinds = result.effects.map((e) => e.kind).join(',')
+      const eventDetail = formatEventDetail(event)
+      process.stderr.write(
+        `gw-trace shadow event=${event.kind}${eventDetail} effects=[${effectKinds}] global=${state.global.kind} perKeySize=${state.perKey.size}\n`,
+      )
+    }
     return result.effects
   } catch (err) {
     process.stderr.write(

package/telegram-plugin/gateway/inject-handler.ts

@@ -103,6 +103,14 @@ function shapeReply(
       accent: 'issue',
     }
   }
+  if (code === 'args_not_allowed') {
+    // #730 — a bare-verb-only command was injected with trailing args.
+    // errorMessage is already actionable ("args not permitted for /memory …").
+    return {
+      body: `${verbHtml} — ${deps.escapeHtml(msg)}`,
+      accent: 'issue',
+    }
+  }
   if (code === 'session_missing') {
     return {
       body: 'tmux session not found — agent must be running under the tmux supervisor (the default). Remove \`experimental.legacy_pty: true\` if set.',

package/telegram-plugin/gateway/ipc-protocol.ts

@@ -153,6 +153,22 @@ export interface PendingPermissionStatusEvent {
   requestId?: string;
 }
 
+/**
+ * #2975 Stage 2 — the gateway's answer to a hostd `check_pre_approved` query.
+ * Read-only: `preApproved: true` means the queried `(agentName, unifiedDiff)`
+ * pair byte-matches a correlation the gateway pre-registered when the operator
+ * approved a mental-model proposal (or "🔁 Always allow"), so hostd may skip
+ * the `config_propose_edit` rate limit for that persist. Sourced from the
+ * gateway's in-memory correlation maps WITHOUT mutating them (the single-use
+ * auto-resolve delete happens later on the real `request_config_approval`).
+ */
+export interface PreApprovedResultEvent {
+  type: "pre_approved_result";
+  /** Echoes the correlationId from the originating check_pre_approved query. */
+  correlationId: string;
+  preApproved: boolean;
+}
+
 export type GatewayToClient =
   | InboundMessage
   | PermissionEvent
@@ -163,7 +179,8 @@ export type GatewayToClient =
   | Ms365ApprovalPostedEvent
   | ConfigApprovalResolvedEvent
   | RolloutStatusPostedEvent
-  | PendingPermissionStatusEvent;
+  | PendingPermissionStatusEvent
+  | PreApprovedResultEvent;
 
 // === Bridge (Client) -> Gateway messages ===
 
@@ -421,7 +438,7 @@ export interface RequestConfigApprovalMessage {
 export interface RequestConfigFinalizeMessage {
   type: "request_config_finalize";
   requestId: string;
-  outcome: "applied" | "reconcile_failed_rolled_back";
+  outcome: "applied" | "aborted_config_changed" | "reconcile_failed_rolled_back";
   /** Optional short diagnostic appended to the card body. */
   detail?: string;
   /**
@@ -596,6 +613,31 @@ export interface QueryPendingPermissionMessage {
   correlationId: string;
 }
 
+/**
+ * #2975 Stage 2 — hostd → gateway read-only pre-approval query. hostd asks
+ * whether this EXACT `(agentName, unifiedDiff)` pair is already operator-
+ * consented (pre-registered on the gateway when the operator approved a
+ * mental-model proposal / tapped "🔁 Always allow"), so it can skip the
+ * `config_propose_edit` per-hour rate limit for that persist.
+ *
+ * Trust model: identical to `query_pending_permission` — the socket is
+ * per-agent inside the container; `agentName` is validated server-side AND
+ * checked against the gateway's own SWITCHROOM_AGENT_NAME in the handler. This
+ * message can NEVER mutate gateway state: the handler only *reads* the
+ * correlation maps (byte-exact match), the same forge-resistance gate the
+ * auto-resolve path enforces. hostd answers `pre_approved_result`; the query
+ * is not reachable via any agent-facing hostd verb (it only ever travels
+ * hostd → gateway over the approval-gateway socket).
+ */
+export interface CheckPreApprovedMessage {
+  type: "check_pre_approved";
+  agentName: string;
+  /** Caller-generated correlation id, echoed in the reply. */
+  correlationId: string;
+  /** Full unified diff to byte-match against the pre-registered correlations. */
+  unifiedDiff: string;
+}
+
 export type ClientToGateway =
   | RegisterMessage
   | ToolCallMessage
@@ -616,4 +658,5 @@ export type ClientToGateway =
   | PostSkillProposalMessage
   | RolloutStatusPostMessage
   | RolloutStatusEditMessage
-  | QueryPendingPermissionMessage;
+  | QueryPendingPermissionMessage
+  | CheckPreApprovedMessage;

package/telegram-plugin/gateway/ipc-server.ts

@@ -7,6 +7,7 @@ import type {
   SendOutboundMessage,
   QuotaWallDetectedMessage,
   QueryPendingPermissionMessage,
+  CheckPreApprovedMessage,
   PostSkillProposalMessage,
   OperatorEventForward,
   PermissionRequestForward,
@@ -80,6 +81,15 @@ export interface IpcServerOptions {
    * feature (mixed-version safety).
    */
   onQueryPendingPermission?: (client: IpcClient, msg: QueryPendingPermissionMessage) => void;
+  /**
+   * #2975 Stage 2 — hostd's read-only pre-approval query. Handler answers from
+   * the gateway's correlation maps by EXACT diff byte-match and replies with a
+   * `pre_approved_result` event. MUST NOT mutate gateway state. Optional: when
+   * no handler is wired (older gateway build, or a fixture that doesn't need
+   * it), the server replies `preApproved: false` immediately so hostd fails
+   * closed to today's rate-limited behaviour (mixed-version safety).
+   */
+  onCheckPreApproved?: (client: IpcClient, msg: CheckPreApprovedMessage) => void;
   /**
    * #2670 one-tap self-improvement — persist a skill-improvement proposal
    * and post its Approve/Dismiss card. Handler persists the draft bundle to
@@ -352,6 +362,19 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
         || (m.correlationId as string).length > 64) return false;
       return true;
     }
+    case "check_pre_approved": {
+      // #2975 Stage 2 — hostd read-only pre-approval query. Wire shape only;
+      // the handler byte-matches the diff against the correlation maps and
+      // never mutates state.
+      if (typeof m.agentName !== "string"
+        || !AGENT_NAME_RE.test(m.agentName as string)) return false;
+      if (typeof m.correlationId !== "string"
+        || (m.correlationId as string).length === 0
+        || (m.correlationId as string).length > 64) return false;
+      if (typeof m.unifiedDiff !== "string"
+        || (m.unifiedDiff as string).length === 0) return false;
+      return true;
+    }
     case "request_config_approval": {
       // #1623 — hostd-initiated config-edit approval card. Wire shape
       // only; the handler module validates the diff content.
@@ -375,6 +398,7 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
         || (m.requestId as string).length === 0
         || (m.requestId as string).length > 64) return false;
       if (m.outcome !== "applied"
+        && m.outcome !== "aborted_config_changed"
         && m.outcome !== "reconcile_failed_rolled_back") return false;
       if (m.detail !== undefined
         && (typeof m.detail !== "string"
@@ -472,6 +496,7 @@ export function createIpcServer(options: IpcServerOptions): IpcServer {
     onSendOutbound,
     onQuotaWallDetected,
     onQueryPendingPermission,
+    onCheckPreApproved,
     onPostSkillProposal,
     onRequestDriveApproval,
     onRequestMs365Approval,
@@ -609,6 +634,24 @@ export function createIpcServer(options: IpcServerOptions): IpcServer {
           }
         }
         break;
+      case "check_pre_approved":
+        if (onCheckPreApproved) {
+          onCheckPreApproved(client, msg as CheckPreApprovedMessage);
+        } else {
+          // No handler wired — fail closed to "not pre-approved" so hostd
+          // applies the ordinary rate limit (byte-identical to pre-#2975-S2
+          // behaviour; the Stage 1 retry then covers an approved persist).
+          try {
+            client.send({
+              type: "pre_approved_result",
+              correlationId: (msg as CheckPreApprovedMessage).correlationId,
+              preApproved: false,
+            });
+          } catch {
+            /* best effort */
+          }
+        }
+        break;
       case "request_drive_approval":
         if (onRequestDriveApproval) {
           // Handler is async — fire-and-forget here; the handler

package/telegram-plugin/gateway/mental-model-propose-resolve.ts

@@ -46,6 +46,14 @@ export interface MentalModelPendingProposal {
 export type ConfigEditDispatchResult =
   | { state: "applied" }
   | { state: "denied"; reason: string }
+  /**
+   * hostd threw `E_RATE_LIMITED` (the agent's config_propose_edit bucket is
+   * exhausted). `retryAtMs` is the epoch-ms parsed from the structured
+   * `fix.retry_after` hostd emits — the moment the sliding window frees a
+   * slot. #2975 Stage 1 schedules exactly ONE re-dispatch at that time so an
+   * operator-APPROVED persist is never silently lost to the throttle.
+   */
+  | { state: "rate_limited"; reason: string; retryAtMs: number }
   | { state: "error"; reason: string };
 
 export interface ResolveDeps {
@@ -79,6 +87,33 @@ export interface ResolveDeps {
   ensureModel?: (spec: MentalModelProposeSpec) => Promise<void>;
   /** Deliver a synthetic inbound to wake the agent with the outcome. */
   injectInbound: (inbound: InboundMessage) => void;
+  /**
+   * #2975 Stage 1 — schedule EXACTLY ONE bounded re-dispatch of an
+   * operator-approved persist that hostd rate-limited (`E_RATE_LIMITED`).
+   * `delayMs` is the wait until hostd's `fix.retry_after` window opens; `fn`
+   * re-runs the persist ONCE (it never re-schedules — bounded, no loop).
+   * Injectable so tests drive it with a mocked clock. When absent, a rate-
+   * limited persist can't be retried and falls straight to the loud-failure
+   * path (no silent loss).
+   *
+   * Stage-1 caveat (documented, accepted): the timer lives only in gateway
+   * memory. A gateway restart between schedule and fire LOSES the retry —
+   * acceptable for Stage 1; Stage 2 (hostd `checkPreApproved` bypass) removes
+   * the rate-limit collision entirely so no retry is needed.
+   */
+  scheduleRetry?: (delayMs: number, fn: () => void | Promise<void>) => void;
+  /**
+   * #2975 Stage 1 — edit the operator's proposal card to the
+   * "approved — applying at HH:MM (rate window)" state so a rate-deferred
+   * (but approved) change is visibly not lost while the retry is pending.
+   */
+  editProposalCardRateWindow?: (retryAtMs: number) => void;
+  /**
+   * #2975 Stage 1 — loud, operator-visible failure (operator-events path)
+   * when the single scheduled retry ALSO fails, so an approved change is
+   * never silently dropped. Must not throw.
+   */
+  notifyPersistFailed?: (reason: string) => void;
   /** Injectable clock for deterministic tests. */
   now?: () => number;
   /** Injectable git binary for the diff subprocess (tests). */
@@ -90,7 +125,14 @@ export type ResolveOutcome =
   | { outcome: "applied" }
   | { outcome: "denied" }
   | { outcome: "rejected"; reason: string }
-  | { outcome: "failed"; reason: string };
+  | { outcome: "failed"; reason: string }
+  /**
+   * #2975 Stage 1 — the persist was rate-limited but the operator already
+   * approved, so exactly one re-dispatch is scheduled at `retryAtMs`. The
+   * proposal card was edited to the "applying at HH:MM" state; the agent's
+   * turn resolves later when the retry injects its own applied/failed inbound.
+   */
+  | { outcome: "scheduled_retry"; retryAtMs: number };
 
 /**
  * Resolve an operator's Approve / Deny decision on a mental-model proposal.
@@ -145,57 +187,123 @@ export async function resolveMentalModelProposal(
     return { outcome: "rejected", reason: built.detail };
   }
 
-  // Pre-register the single-tap correlation so hostd auto-approves the edit
-  // (operator already approved on this proposal card — no second card).
-  deps.registerPreApproval(pending.agent, built.diff);
-  let dispatch: ConfigEditDispatchResult;
-  try {
-    dispatch = await deps.dispatchConfigEdit({
-      agent: pending.agent,
-      diff: built.diff,
-      reason:
-        `Declare agent-proposed mental model "${pending.spec.name}"` +
-        (pending.reason ? ` — ${pending.reason}` : ""),
-    });
-  } catch (err) {
-    dispatch = { state: "error", reason: (err as Error).message };
-  } finally {
-    // Single-shot: drop the correlation whether or not hostd consumed it.
-    deps.clearPreApproval(pending.agent, built.diff);
-  }
+  const persistReason =
+    `Declare agent-proposed mental model "${pending.spec.name}"` +
+    (pending.reason ? ` — ${pending.reason}` : "");
+  const clock = deps.now ?? Date.now;
 
-  if (dispatch.state !== "applied") {
+  // ONE dispatch attempt. Atomically re-registers the single-tap correlation
+  // with the SAME diff bytes each call BEFORE dispatching — the register and
+  // dispatch MUST use identical bytes (forge-resistance contract, file header
+  // lines 54-63): hostd's config-approval callback auto-resolves only on an
+  // exact byte-match, so a rebuilt/whitespace-drifted diff would fail to
+  // auto-approve and post a SECOND operator card. Because the initial and the
+  // #2975 retry both re-run this closure over the same captured `built.diff`,
+  // they are byte-identical by construction.
+  const dispatchOnce = async (): Promise<ConfigEditDispatchResult> => {
+    deps.registerPreApproval(pending.agent, built.diff);
+    try {
+      return await deps.dispatchConfigEdit({
+        agent: pending.agent,
+        diff: built.diff,
+        reason: persistReason,
+      });
+    } catch (err) {
+      return { state: "error", reason: (err as Error).message };
+    } finally {
+      // Single-shot: drop the correlation whether or not hostd consumed it.
+      deps.clearPreApproval(pending.agent, built.diff);
+    }
+  };
+
+  // Applied — belt-and-suspenders ensure (reconcile already ensures via #2874;
+  // this makes the model available without waiting for the restart). Never let
+  // an ensure failure flip a successful declaration into a "failed" inbound —
+  // the model IS declared and will be ensured at reconcile regardless.
+  const finishApplied = async (): Promise<void> => {
+    if (deps.ensureModel) {
+      try {
+        await deps.ensureModel(pending.spec);
+      } catch (err) {
+        deps.log?.(
+          `mental_model_propose: best-effort ensure threw (declaration still applied) for ${pending.agent} "${pending.spec.name}": ${(err as Error).message}`,
+        );
+      }
+    }
+    deps.injectInbound(
+      buildMentalModelProposeAppliedInbound({
+        ctx,
+        stageId,
+        operatorId,
+        nowMs: clock(),
+      }),
+    );
+  };
+
+  const finishFailed = (reason: string, loud: boolean): void => {
     deps.log?.(
-      `mental_model_propose: config edit ${dispatch.state} for ${pending.agent} "${pending.spec.name}": ${dispatch.reason}`,
+      `mental_model_propose: config edit failed for ${pending.agent} "${pending.spec.name}": ${reason}`,
     );
+    // Loud, operator-visible failure only on the RETRY exhaustion path — the
+    // initial-failure path already surfaces via the card edit + agent inbound.
+    if (loud) {
+      try {
+        deps.notifyPersistFailed?.(reason);
+      } catch {
+        // notify must never break the failed-inbound delivery below.
+      }
+    }
     deps.injectInbound(
       buildMentalModelProposeFailedInbound({
         ctx,
         stageId,
         operatorId,
-        reason: dispatch.reason,
-        nowMs,
+        reason,
+        nowMs: clock(),
       }),
     );
-    return { outcome: "failed", reason: dispatch.reason };
-  }
+  };
 
-  // Applied. Belt-and-suspenders ensure (reconcile already ensures via #2874;
-  // this makes the model available without waiting for the restart). Never let
-  // an ensure failure flip a successful declaration into a "failed" inbound —
-  // the model IS declared and will be ensured at reconcile regardless.
-  if (deps.ensureModel) {
-    try {
-      await deps.ensureModel(pending.spec);
-    } catch (err) {
+  const dispatch = await dispatchOnce();
+
+  // #2975 Stage 1 backstop — an operator-APPROVED persist that hostd rate-
+  // limited must NOT be silently lost. Schedule EXACTLY ONE re-dispatch at the
+  // window-open time hostd handed back in `fix.retry_after`, and flip the card
+  // to the "applying at HH:MM (rate window)" state so the operator sees it's
+  // deferred, not dropped.
+  if (dispatch.state === "rate_limited") {
+    if (deps.scheduleRetry) {
+      const { retryAtMs } = dispatch;
+      deps.editProposalCardRateWindow?.(retryAtMs);
+      const delayMs = Math.max(0, retryAtMs - clock());
       deps.log?.(
-        `mental_model_propose: best-effort ensure threw (declaration still applied) for ${pending.agent} "${pending.spec.name}": ${(err as Error).message}`,
+        `mental_model_propose: config edit rate-limited for ${pending.agent} "${pending.spec.name}"; scheduling one retry in ${delayMs}ms (window opens ${new Date(retryAtMs).toISOString()})`,
       );
+      deps.scheduleRetry(delayMs, async () => {
+        // Bounded: this is the ONE and ONLY retry — it never re-schedules.
+        const retryResult = await dispatchOnce();
+        if (retryResult.state === "applied") {
+          await finishApplied();
+        } else {
+          // Every non-applied state (denied / rate_limited / error) carries a
+          // reason. A second rate_limit is treated as a terminal failure — the
+          // retry is bounded to one; we do NOT re-schedule.
+          finishFailed(retryResult.reason, true);
+        }
+      });
+      return { outcome: "scheduled_retry", retryAtMs };
     }
+    // No scheduler wired — can't defer the retry; fail loudly rather than
+    // silently drop the approved change.
+    finishFailed(dispatch.reason, true);
+    return { outcome: "failed", reason: dispatch.reason };
+  }
+
+  if (dispatch.state !== "applied") {
+    finishFailed(dispatch.reason, false);
+    return { outcome: "failed", reason: dispatch.reason };
   }
 
-  deps.injectInbound(
-    buildMentalModelProposeAppliedInbound({ ctx, stageId, operatorId, nowMs }),
-  );
+  await finishApplied();
   return { outcome: "applied" };
 }

package/telegram-plugin/gateway/model-command.ts

@@ -521,9 +521,15 @@ export const SR_MODEL_ALIASES: Record<string, string> = {
  * session to verify, so the operator is asked to re-issue after boot.
  */
 export function isOfflineTrustedModelToken(token: string): boolean {
-  if ((MODEL_ALIASES as readonly string[]).includes(token)) return true
-  if (token in SR_MODEL_ALIASES) return true
-  return Object.values(SR_MODEL_ALIASES).includes(token)
+  // #3043 item 1: the live accept path normalizes case (isClaudeModel /
+  // expandSrAlias lowercase before matching), so a queued `/model OPUS` is
+  // accepted live — but this persist-time gate compared case-sensitively and
+  // then refused it with the over-conservative "couldn't verify" card. Lowercase
+  // once so the persist decision matches what the live path already accepted.
+  const lower = token.toLowerCase()
+  if ((MODEL_ALIASES as readonly string[]).includes(lower)) return true
+  if (lower in SR_MODEL_ALIASES) return true
+  return Object.values(SR_MODEL_ALIASES).includes(lower)
 }
 
 export function expandSrAlias(arg: string): string {