switchroom 0.18.12 → 0.18.14

package/telegram-plugin/gateway/gateway.ts

@@ -34,6 +34,7 @@ import {
   type AskUserArgs,
   type AskUserOutcome,
 } from '../ask-user.js'
+import { redactAskUserFields, redactChecklistFields } from '../outbound-field-redact.js'
 import { parseInterruptMarker } from '../interrupt-marker.js'
 import {
   ToolFlightTracker,
@@ -93,6 +94,13 @@ import {
   buildExtraAttachmentMeta,
   resolveCoalesceMaxAttachments,
 } from './coalesce-attachments.js'
+import {
+  parseForwardOrigin,
+  dedupeForwardOrigins,
+  buildForwardOriginMeta,
+  forwardOriginDateIso,
+  type ForwardOriginInfo,
+} from './forward-origin.js'
 import { StatusReactionController } from '../status-reactions.js'
 import { DeferredDoneReactions } from '../reaction-defer.js'
 import { createWorkerActivityFeed, isWorkerActivityFeedEnabled } from '../worker-activity-feed.js'
@@ -309,7 +317,14 @@ import { recordOperatorEvent } from '../operator-events-history.js'
 import {
   formatModelUnavailableCard,
   resolveModelUnavailableFromOperatorEvent,
+  type ModelUnavailableDetection,
 } from '../model-unavailable.js'
+import {
+  decideThrottleTier,
+  isAccountScopedThrottle,
+  throttleRetryInPlaceMaxMs,
+} from '../throttle-tier.js'
+import { createThrottleTierRunner } from './throttle-tier-wiring.js'
 import { runFleetAutoFallback, renderFallbackFailureNotice, evaluateFallbackFailureNotice, evaluateAllBlockedNotice, type FallbackFailureNoticeState, type FallbackAllBlockedNoticeState } from '../auto-fallback-fleet.js'
 import { startRestartWatchdog } from './restart-watchdog.js'
 import { validateStringArray } from './access-validator.js'
@@ -340,6 +355,7 @@ import {
 } from '../telegram-button-constraints.js'
 import {
   wrapAgentCallbacks,
+  redactAgentKeyboard,
   parseAgentCallback,
   extractAgentButtonMeta,
   keyboardIsSingleUse,
@@ -691,8 +707,8 @@ import {
   startSubagentWatcher,
   type SubagentWatcherHandle,
 } from '../subagent-watcher.js'
-import { listRecords as listWorktreeRecords } from '../../src/worktree/registry.js'
-import { ownedWorktreeCwds } from '../worktree-watch-cwds.js'
+import { listRecords as listWorktreeRecords, touchHeartbeat as touchWorktreeHeartbeat } from '../../src/worktree/registry.js'
+import { makeWorktreeWatchProvider } from '../worktree-watch-cwds.js'
 import {
   startBootCard,
   resolvePersonaName,
@@ -5466,9 +5482,10 @@ const recordFloodWindow = makeFloodWindowRecorder(FLOOD_WINDOWS_PATH)
 // edit floor + no-op-edit skip + PRIORITY SHEDDING + DEGRADED MODE). Wrapped
 // HERE at the robustApiCall layer so every Bot API call routed through the
 // standard retry policy also transits one scheduler (no call site can bypass
-// it). Feature-flagged, default OFF: when SWITCHROOM_TELEGRAM_SEND_GATE !== '1'
-// the gate is a pure passthrough and the retry policy behaves exactly as
-// before. Composes with #3094's pre-call flood gate and #3097's non-essential
+// it). ON BY DEFAULT (escape hatch): only when SWITCHROOM_TELEGRAM_SEND_GATE is
+// explicitly set to 0/false/off/no is the gate a pure passthrough and the retry
+// policy behaves exactly as before. Composes with #3094's pre-call flood gate
+// and #3097's non-essential
 // drop policy — those decide whether a call happens at all; this paces the
 // calls that do.
 //
@@ -5527,6 +5544,65 @@ const swallowingApiCall = createSwallowingRetryApiCall(
   (line) => process.stderr.write(line),
 )
 
+/**
+ * The ONE seam every `setMessageReaction` in this gateway goes through (#3155).
+ *
+ * Reactions are cosmetic outbound traffic. Before this seam, ~13 raw
+ * `bot.api.setMessageReaction(...)` / `lockedBot.api.setMessageReaction(...)`
+ * call sites fired reactions OUTSIDE the send gate AND the flood circuit
+ * breaker, so:
+ *
+ *   (a) reaction spam was never PACED/SHED by the gate when it's on — a busy
+ *       turn's status-reaction churn added straight onto the per-bot flood
+ *       budget the REPLIES need; and
+ *   (b) a 429 from a reaction was INVISIBLE to the breaker — the flood window
+ *       is only learned through the retry module's `onFloodWait` hook, which a
+ *       raw `bot.api` call never reaches. Reactions were a residual flood
+ *       vector even with the gate ON.
+ *
+ * Routing through `robustApiCall` (= chat-lock → send-gate → retry/breaker,
+ * the SAME path every other outbound call takes) with
+ * `priorityClass: 'cosmetic'` fixes both: the gate paces/sheds reactions under
+ * pressure, and a 429 runs `onFloodWait` so the window is recorded. Callers
+ * keep their own fire-and-forget / `.catch(() => {})` / `await` semantics —
+ * this returns the promise and does NOT swallow.
+ */
+const gatedSetMessageReaction = (
+  chatId: string,
+  messageId: number,
+  reaction: ReactionTypeEmoji[],
+): Promise<unknown> =>
+  robustApiCall(() => lockedBot.api.setMessageReaction(chatId, messageId, reaction), {
+    chat_id: chatId,
+    verb: 'set-message-reaction',
+    priorityClass: 'cosmetic',
+  })
+
+/** React with a single emoji through the gate (cosmetic). Wraps {@link gatedSetMessageReaction}. */
+const sendReaction = (
+  chatId: string,
+  messageId: number,
+  emoji: ReactionTypeEmoji['emoji'],
+): Promise<unknown> => gatedSetMessageReaction(chatId, messageId, [{ type: 'emoji', emoji }])
+
+/**
+ * Bot-API surface handed to `redactAuthCodeMessage` (#488) so its 🔑 reaction
+ * routes through the send gate + flood breaker like every other reaction
+ * (#3155). The OAuth-code DELETE stays raw/best-effort exactly as before — its
+ * own `.then(onOk, onErr)` logging (the "token may still be visible" breadcrumb)
+ * must keep firing, which a swallowing wrapper would suppress.
+ */
+const redactAuthCodeApi = {
+  deleteMessage: (chatId: string, messageId: number) =>
+    // allow-raw-bot-api: auth-code redact delete stays raw/best-effort (behavior unchanged, #488); #3155 gates only the reaction.
+    bot.api.deleteMessage(chatId, messageId),
+  setMessageReaction: (
+    chatId: string,
+    messageId: number,
+    reaction: Array<{ type: 'emoji'; emoji: string }>,
+  ) => gatedSetMessageReaction(chatId, messageId, reaction as ReactionTypeEmoji[]),
+}
+
 /**
  * The wrapper for NON-ESSENTIAL sends that must NEVER retry (#3084).
  *
@@ -7525,6 +7601,14 @@ type CoalescePayload = {
   attachment?: AttachmentMeta
   // Set only by `merge`: the 2nd..Nth attachments folded into this turn.
   extraAttachments?: CoalesceAttachment[]
+  // Forwarded-message origin of THIS entry (parsed at enqueue time from
+  // message.forward_origin). merged.ctx is the LAST entry's ctx, so a
+  // coalesced burst would otherwise lose the earlier entries' origins —
+  // each entry carries its own.
+  forwardOrigin?: ForwardOriginInfo
+  // Set only by `merge`: the distinct origins of the whole burst, arrival
+  // order, deduped (a single-origin album collapses to one entry).
+  forwardOrigins?: ForwardOriginInfo[]
 }
 
 // Count of attachment-bearing entries currently buffered per coalesce key.
@@ -7557,6 +7641,11 @@ const inboundCoalescer = createInboundCoalescer<CoalescePayload>({
       (e) => e.downloadImage != null || e.attachment != null,
       coalesceMaxAttachments(),
     )
+    // Distinct forwarded-message origins across the burst, arrival order.
+    // A forwarded album (one origin, N parts) collapses to a single entry
+    // so the attrs are emitted once; a burst forwarded from two different
+    // senders keeps both (numbered forwarded_from_2 siblings downstream).
+    const forwardOrigins = dedupeForwardOrigins(entries.map((e) => e.forwardOrigin))
     return {
       // Drop empty texts (e.g. caption-less album parts) so the join doesn't
       // emit blank lines between attachments.
@@ -7567,6 +7656,7 @@ const inboundCoalescer = createInboundCoalescer<CoalescePayload>({
       extraAttachments: extras.length > 0
         ? extras.map((e) => ({ downloadImage: e.downloadImage, attachment: e.attachment }))
         : undefined,
+      forwardOrigins: forwardOrigins.length > 0 ? forwardOrigins : undefined,
     }
   },
   onFlush: (key, merged) => {
@@ -7577,6 +7667,7 @@ const inboundCoalescer = createInboundCoalescer<CoalescePayload>({
       merged.downloadImage,
       merged.attachment,
       merged.extraAttachments,
+      merged.forwardOrigins,
     )
   },
 })
@@ -7597,6 +7688,72 @@ const inboundCoalescer = createInboundCoalescer<CoalescePayload>({
 function emitGatewayOperatorEvent(event: OperatorEvent): void {
   const { agent, kind } = event
 
+  // ── 429 throttle tier (operator spec: "retry in place under 5 min, else
+  // mark + failover, honest reset messaging") ────────────────────────────
+  // A terminal TRANSIENT ACCOUNT-scoped 429 — kind `rate-limited` carrying
+  // wording that affirms the account's own rate limit ("would exceed your
+  // account's rate limit") — is decided BEFORE the per-kind cooldown gate:
+  // every hit must reach the broker's mark-throttled escalation counter, and
+  // the >threshold failover ACTION must fire, even when the user-facing card
+  // is cooldown-suppressed (a calm 529 card two minutes earlier arms that
+  // cooldown). Server-side transients (529 / "server is temporarily…") fall
+  // through to the existing calm rate-limited card unchanged — an
+  // account-scoped throttle would be the wrong action for a server-wide
+  // condition.
+  let throttleEscalation: ModelUnavailableDetection | null = null
+  let escalationFired = false
+  if (kind === 'rate-limited' && isAccountScopedThrottle(event.detail)) {
+    const throttleDecision = decideThrottleTier({
+      detail: event.detail,
+      now: Date.now(),
+      thresholdMs: throttleRetryInPlaceMaxMs(),
+    })
+    if (throttleDecision.action === 'throttle') {
+      // Reset is near (≤ threshold) or unparseable (60s default): DO NOT
+      // fail over. Record throttled_until broker-side, post ONE lightweight
+      // notice (per-account + fleet-wide dedup), nudge a retry after the
+      // reset. The runner owns the sequencing (throttle-tier-wiring.ts).
+      process.stderr.write(
+        `telegram gateway: throttle-tier staying-put agent=${agent} ` +
+          `until=${new Date(throttleDecision.throttledUntilMs).toISOString()} ` +
+          `parsedReset=${throttleDecision.resetParsed}\n`,
+      )
+      try {
+        recordOperatorEvent(event)
+      } catch { /* history is best-effort */ }
+      void throttleTierRunner.fire(
+        agent,
+        throttleDecision.throttledUntilMs,
+        throttleDecision.resetParsed,
+      )
+      return
+    }
+    if (throttleDecision.action === 'failover') {
+      // Reset beyond the retry-in-place threshold: the account is benched
+      // until then anyway, so escalate to the standard mark-exhausted +
+      // fleet-failover machinery — honest 'rate_limited' wording, parsed
+      // reset as the mark expiry. The ACTION fires HERE, before the
+      // per-kind card cooldown below can swallow it (the fleetFallbackGate
+      // provides the action-level dedup); only the card stays
+      // cooldown-bounded. The 'rate-limit' trigger tells the dispatcher to
+      // trust this terminal parsed-reset signal over the utilization probe
+      // (a transient 429 negates the usage-limit reading, so utilization
+      // typically looks healthy — the idempotency guard would self-cancel
+      // the swap).
+      const resetAt = new Date(throttleDecision.resetAtMs)
+      throttleEscalation = { kind: 'rate_limited', resetAt, raw: event.detail }
+      if (wouldFireFleetAutoFallback()) {
+        escalationFired = true
+        void fireFleetAutoFallback(
+          agent,
+          resolveExhaustUntil(resetAt.getTime()),
+          resetAt,
+          'rate-limit',
+        )
+      }
+    }
+  }
+
   if (!shouldEmitOperatorEvent(agent, kind)) {
     process.stderr.write(
       `telegram gateway: operator-event suppressed (cooldown) agent=${agent} kind=${kind}\n`,
@@ -7625,7 +7782,10 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
   //     by the upstream classifier
   //   - detail string contains one of the model-unavailable text patterns
   //     (covers raw stderr that slipped past structured classification)
-  const modelUnavailable = resolveModelUnavailableFromOperatorEvent(event)
+  // Throttle-tier escalation (long-reset transient 429) takes precedence:
+  // resolveModelUnavailableFromOperatorEvent deliberately returns null for a
+  // bare rate-limited event, but this one is auto-fallback-eligible.
+  const modelUnavailable = throttleEscalation ?? resolveModelUnavailableFromOperatorEvent(event)
   let renderedText: string
   let renderedKeyboard: ReturnType<typeof renderOperatorEvent>['keyboard'] | undefined
   // #3031 PR 3 — when the card promises an in-flight auto-failover, record
@@ -7647,8 +7807,18 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     // it just produces a self-cancelling "probed healthy / Stale event?"
     // loop on every 529. Overload is handled by Claude Code's own
     // internal retry, not by switching accounts.
-    const isAutoKind = modelUnavailable.kind === 'quota_exhausted'
-    const willActuallyFire = isAutoKind && wouldFireFleetAutoFallback()
+    // 'rate_limited' is the throttle-tier escalation (transient 429 whose
+    // reset exceeds the retry-in-place threshold) — same failover mechanics
+    // as a quota wall, honest wording on the card. Its fire already happened
+    // ABOVE the cooldown gate (escalationFired) so the action can't be
+    // swallowed by the per-kind card cooldown; the card here only reports it.
+    const isAutoKind =
+      modelUnavailable.kind === 'quota_exhausted' ||
+      modelUnavailable.kind === 'rate_limited'
+    const willActuallyFire =
+      throttleEscalation != null
+        ? escalationFired
+        : isAutoKind && wouldFireFleetAutoFallback()
     process.stderr.write(
       `telegram gateway: operator-event suppressing-raw-stderr-for-model-unavailable agent=${agent} kind=${kind} detected=${modelUnavailable.kind} autoKind=${isAutoKind} willFire=${willActuallyFire}\n`,
     )
@@ -7672,9 +7842,14 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     // Pre-fix this called fireFleetAutoFallback(agent) with no until, so a
     // weekly wall that surfaced as a 429 got markExhausted's ~5h default and
     // the broker re-mirrored the still-walled account onto the fleet after 5h.
-    if (willActuallyFire) {
+    // Throttle-tier escalations (throttleEscalation != null) already fired
+    // above the cooldown gate — don't double-fire here.
+    if (willActuallyFire && throttleEscalation == null) {
       const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime())
-      void fireFleetAutoFallback(agent, untilMs)
+      // Thread the RAW parsed reset (distinct from the floor-applied untilMs)
+      // so the fallback announcement can name it even when the live probe of
+      // the old account fails — honest reset messaging on the enriched card.
+      void fireFleetAutoFallback(agent, untilMs, modelUnavailable.resetAt)
     }
   } else {
     try {
@@ -11312,7 +11487,13 @@ const ipcServer: IpcServer = createIpcServer({
         (msg.resetAt == null ? ' (reset unparsed → +7d default)' : '') +
         ' — triggering fleet auto-fallback\n',
     )
-    void fireFleetAutoFallback(msg.agentName, untilMs)
+    void fireFleetAutoFallback(
+      msg.agentName,
+      untilMs,
+      // Enriched announcement: the sidecar-parsed reset (when present) keeps
+      // the recovery line honest even when the old account's probe fails.
+      msg.resetAt != null ? new Date(msg.resetAt) : undefined,
+    )
   },
 
   // Issue #2971 — read-only wedge-watchdog probe: is there a live pending
@@ -11724,10 +11905,21 @@ async function executeSendChecklist(args: Record<string, unknown>): Promise<{ co
 
   assertAllowedChat(chat_id)
 
-  const sent = await rawSendChecklist({
-    chat_id,
+  // #2044 outbound secret scrub. Checklist title + task strings are
+  // agent-authored free text sent to Telegram, same class as the reply
+  // `text` path and ask_user — route both through the SAME redactor before
+  // send (via the pure, unit-tested redactChecklistFields helper) so an
+  // echoed token / DATABASE_URL is masked.
+  const { title: redactedTitle, tasks: redactedTasks } = redactChecklistFields(
     title,
     tasks,
+    (t) => redactOutboundText(t, 'send_checklist'),
+  )
+
+  const sent = await rawSendChecklist({
+    chat_id,
+    title: redactedTitle!,
+    tasks: redactedTasks!,
     ...(threadId != null ? { message_thread_id: threadId } : {}),
     ...(replyTo != null ? { reply_to_message_id: replyTo } : {}),
     ...(protectContent ? { protect_content: true } : {}),
@@ -11809,7 +12001,19 @@ async function executeUpdateChecklist(args: Record<string, unknown>): Promise<{
 
   assertAllowedChat(chat_id)
 
-  await rawEditMessageChecklist({ chat_id, message_id, title, tasks })
+  // #2044 outbound secret scrub. update_checklist forwards the same
+  // agent-authored title + task text to Telegram as send_checklist, so it
+  // shares the identical leak class — redact both through the reply-path
+  // redactor (via the shared redactChecklistFields helper) before the edit
+  // lands. title / tasks may be undefined here (partial patch); the helper
+  // passes undefined through untouched.
+  const { title: redactedTitle, tasks: redactedTasks } = redactChecklistFields(
+    title,
+    tasks,
+    (t) => redactOutboundText(t, 'update_checklist'),
+  )
+
+  await rawEditMessageChecklist({ chat_id, message_id, title: redactedTitle, tasks: redactedTasks })
 
   process.stderr.write(`telegram gateway: update_checklist: updated chatId=${chat_id} messageId=${message_id}\n`)
   return { content: [{ type: 'text', text: `checklist updated (id: ${message_id})` }] }
@@ -12537,8 +12741,18 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
         .join('; ')
       throw new Error(`inline_keyboard validation failed: ${summary}`)
     }
-    replyButtonMeta = extractAgentButtonMeta(rawKeyboard)
-    replyMarkup = { inline_keyboard: wrapAgentCallbacks(rawKeyboard) }
+    // #3148 fast-follow: mask any secret an agent put in a visible button
+    // `text` label, its `ack_text` toast, or a `copy_text.text` clipboard
+    // payload BEFORE the keyboard is sent — the same outbound scrub the reply
+    // `text` body uses. `callback_data` (the routing key) is left exact.
+    // Feeding BOTH the meta extraction and the callback wrap from the redacted
+    // copy means the stashed toast, the tap echo (`button_text`), and the
+    // "✅ You chose: <label>" annotation (#789) all read already-masked bytes.
+    const redactedKeyboard = redactAgentKeyboard(rawKeyboard, (s) =>
+      redactOutboundText(s, 'reply_inline_keyboard'),
+    )
+    replyButtonMeta = extractAgentButtonMeta(redactedKeyboard)
+    replyMarkup = { inline_keyboard: wrapAgentCallbacks(redactedKeyboard) }
   }
 
   // on-demand voice: append a single '🔊 Listen' button that synthesizes the
@@ -13509,6 +13723,21 @@ async function executeAskUser(rawArgs: Record<string, unknown>): Promise<unknown
   const args = validateAskUserArgs(rawArgs as unknown as AskUserArgs)
   assertAllowedChat(args.chatId)
 
+  // #2044 outbound secret scrub. The question text and each option/button
+  // label are agent-authored free text sent to Telegram, exactly like the
+  // reply `text` path — an agent that echoes a token or DATABASE_URL it just
+  // read into a question or a button label would transmit it unmasked. Route
+  // both through the SAME redactor as reply (via the pure, unit-tested
+  // redactAskUserFields helper), assigning back onto the validated args so
+  // every downstream consumer — the send, the timeout-edit re-render, and
+  // the tap-echo of the chosen label stored in pendingAskUser — sees the
+  // masked value.
+  const scrubbed = redactAskUserFields(args.question, args.options, (t) =>
+    redactOutboundText(t, 'ask_user'),
+  )
+  args.question = scrubbed.question
+  args.options = scrubbed.options
+
   // Resolve thread + reply-to using the same auto-thread heuristic
   // executeReply uses, so an agent that omits message_thread_id still
   // routes into the right forum topic and quotes the user's last
@@ -14609,9 +14838,11 @@ async function executeReact(args: Record<string, unknown>): Promise<unknown> {
   if (!args.message_id) throw new Error('react: message_id is required')
   if (!args.emoji) throw new Error('react: emoji is required')
   assertAllowedChat(String(args.chat_id ?? ''))
-  await lockedBot.api.setMessageReaction(String(args.chat_id ?? ''), Number(args.message_id), [
-    { type: 'emoji', emoji: args.emoji as ReactionTypeEmoji['emoji'] },
-  ])
+  await sendReaction(
+    String(args.chat_id ?? ''),
+    Number(args.message_id),
+    args.emoji as ReactionTypeEmoji['emoji'],
+  )
   return { content: [{ type: 'text', text: 'reacted' }] }
 }
 
@@ -17590,6 +17821,17 @@ function handleSessionEvent(ev: SessionEvent): void {
 
 // ─── PTY partial handler ─────────────────────────────────────────────────
 function handlePtyPartial(text: string): void {
+  // #2044 outbound secret scrub. The PTY-tail partial is the assistant's
+  // reply text extracted from Claude Code's TUI as it renders — an agent
+  // that echoes a secret shows it here (in the live draft-preview stream)
+  // BEFORE the reply tool ever fires, and this path forwards the text
+  // straight to Telegram with no other redaction. Mask at the gateway
+  // boundary through the SAME reply-path redactor so the draft stream, its
+  // dedup key, and lastPtyPreviewByChat all compare redacted-against-
+  // redacted — the identical in-place-mutation invariant the answer stream
+  // relies on. Idempotent: replaying a buffered (already-masked) partial
+  // re-masks to itself.
+  text = redactOutboundText(text, 'pty_preview')
   // #1067: build the PtyHandlerState from a snapshot of currentTurn.
   // The pty-partial-handler module keeps its own state-shape contract
   // (currentSessionChatId / currentSessionThreadId) because it's
@@ -17624,6 +17866,13 @@ function handlePtyPartial(text: string): void {
 }
 
 function handlePtyActivity(text: string): void {
+  // #2044 outbound secret scrub. PTY-activity is agent-derived free text
+  // forwarded to Telegram via handleStreamReply — same leak class as the
+  // draft preview above. Redact through the reply-path redactor before it
+  // streams. (This handler is currently unwired in the gateway — the live
+  // PTY path is handlePtyPartial — but the mask is kept here so the fix is
+  // durable if the activity lane is ever re-armed.)
+  text = redactOutboundText(text, 'pty_activity')
   // #1067: snapshot at entry. handleStreamReply is async and runs in
   // the background via void; the closure already captures `chatId` /
   // `threadId` locals, so the supersession is correctly scoped.
@@ -17940,7 +18189,15 @@ async function handleInboundCoalesced(
     ctx.message?.message_thread_id,
     String(from.id),
   )
-  const result = inboundCoalescer.enqueue(key, { text, ctx, downloadImage, attachment })
+  const result = inboundCoalescer.enqueue(key, {
+    text,
+    ctx,
+    downloadImage,
+    attachment,
+    // Parsed HERE (not in merge) because merge only sees the last ctx —
+    // each buffered entry keeps its own forwarded-message origin.
+    forwardOrigin: parseForwardOrigin(ctx.message?.forward_origin),
+  })
   // Coalescing disabled (window <= 0): flush immediately, preserving any
   // media this message carried.
   if (result.bypass) return handleInbound(ctx, text, downloadImage, attachment)
@@ -17976,9 +18233,7 @@ function maybeEarlyAckReaction(ctx: Context, from: NonNullable<Context['from']>)
   if (activeTurnStartedAt.has(statusKey(chatId, threadId))) return
   const access = loadAccess()
   if (!access.allowFrom.includes(String(from.id))) return
-  void bot.api.setMessageReaction(chatId, msgId, [
-    { type: 'emoji', emoji: '👀' as ReactionTypeEmoji['emoji'] },
-  ]).catch(() => {})
+  void sendReaction(chatId, msgId, '👀' as ReactionTypeEmoji['emoji']).catch(() => {})
   // #2527: log the early-ack fire so operators can see how often the
   // fast pre-coalesce DM path triggers vs. the controller path.
   logStreamingEvent({ kind: 'early_ack_reaction', chatId, messageId: msgId, emoji: '👀' })
@@ -18021,6 +18276,11 @@ async function handleInbound(
   // resolved (photos downloaded) and surfaced as numbered meta fields
   // (image_path_2, attachment_file_id_2, …) alongside the primary.
   extraAttachments?: CoalesceAttachment[],
+  // Forwarded-message origins for a coalesced burst (deduped, arrival
+  // order — see the coalescer's merge). Left undefined by the direct /
+  // bypass call sites; handleInbound then parses THIS ctx's
+  // forward_origin itself, so single-message forwards work on every path.
+  coalescedForwardOrigins?: ForwardOriginInfo[],
 ): Promise<void> {
   markIdleActivity() // any inbound resets the idle auto-clear timer + re-arms
   const isTopicMessage = ctx.message?.is_topic_message ?? false
@@ -18219,9 +18479,7 @@ async function handleInbound(
     )
     if (inFlight) {
       if (msgId != null) {
-        void bot.api.setMessageReaction(chat_id, msgId, [
-          { type: 'emoji', emoji: '⚡' as ReactionTypeEmoji['emoji'] },
-        ]).catch(() => {})
+        void sendReaction(chat_id, msgId, '⚡' as ReactionTypeEmoji['emoji']).catch(() => {})
       }
       await executeHaltNow('stop-keyword')
     }
@@ -18266,9 +18524,7 @@ async function handleInbound(
       `in_flight=${toolFlightTracker.inFlightCount()}\n`,
     )
     if (msgId != null) {
-      void bot.api.setMessageReaction(chat_id, msgId, [
-        { type: 'emoji', emoji: '⚡' as ReactionTypeEmoji['emoji'] },
-      ]).catch(() => {})
+      void sendReaction(chat_id, msgId, '⚡' as ReactionTypeEmoji['emoji']).catch(() => {})
     }
     if (interrupt.emptyBody) {
       // #3020: empty `!` is a pure halt (no replacement body) — same shared
@@ -18402,9 +18658,7 @@ async function handleInbound(
     })
     if (msgId != null) {
       const emoji = behavior === 'allow' ? '✅' : '❌'
-      void bot.api.setMessageReaction(chat_id, msgId, [
-        { type: 'emoji', emoji: emoji as ReactionTypeEmoji['emoji'] },
-      ]).catch(() => {})
+      void sendReaction(chat_id, msgId, emoji as ReactionTypeEmoji['emoji']).catch(() => {})
     }
     return
   }
@@ -18460,7 +18714,7 @@ async function handleInbound(
         )
       }
       // Redact the OAuth code paste from chat history (#488).
-      redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+      redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
       return
     }
     // Stale — drop the pending entry but let the message fall through
@@ -18492,7 +18746,7 @@ async function handleInbound(
           '_Still finishing the previous paste — one moment._',
           { html: true },
         )
-        redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+        redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
         return
       }
       const result = await submitLoopbackRedirect(pendingLoop, text.trim())
@@ -18505,7 +18759,7 @@ async function handleInbound(
           { html: true },
         )
         // Redact the pasted redirect (carries the OAuth code) from history.
-        redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+        redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
         return
       }
       if (result.retryable) {
@@ -18518,7 +18772,7 @@ async function handleInbound(
           { html: true },
         )
         // Redact even a rejected paste — it may still carry a live code.
-        redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+        redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
         return
       }
       // Non-retryable — the flow is spent. Kill the CLI child before
@@ -18533,7 +18787,7 @@ async function handleInbound(
         `**/auth ${pendingLoop.provider} add failed:** ${escapeHtmlForTg(result.reason)}`,
         { html: true },
       )
-      redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+      redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
       return
     }
     // Stale — the intercept window has closed. Kill the child and drop the
@@ -18553,7 +18807,7 @@ async function handleInbound(
   // reference AND a code/error param), so ordinary chatter mentioning
   // localhost flows through untouched. Redact and drop rather than forward.
   if (shouldConsumeLoopbackPaste(text)) {
-    redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+    redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
     await switchroomReply(
       ctx,
       '_That looked like an OAuth redirect/code, so I removed it from chat and did not forward it. ' +
@@ -18588,7 +18842,7 @@ async function handleInbound(
       // Single-use code so a third party can't replay it after exchange,
       // but plaintext OAuth tokens in chat history are still poor
       // hygiene. The helper handles delete + 🔑 reaction silently.
-      redactAuthCodeMessage(bot.api as never, chat_id, msgId ?? null, line => process.stderr.write(line))
+      redactAuthCodeMessage(redactAuthCodeApi as never, chat_id, msgId ?? null, line => process.stderr.write(line))
       return
     }
     pendingReauthFlows.delete(interceptKey)
@@ -19051,12 +19305,12 @@ async function handleInbound(
       if (isSteering) {
         // Explicit steer: mark with 🤝 on the inbound message; leave the
         // existing StatusReactionController running for the in-flight turn.
-        void bot.api.setMessageReaction(chat_id, msgId, [{ type: 'emoji', emoji: '🤝' }]).catch(() => {})
+        void sendReaction(chat_id, msgId, '🤝').catch(() => {})
       } else if (priorTurnInFlight) {
         // Queued mid-turn message (new default): don't touch the existing
         // controller; just ack the inbound message with 👀 so the user
         // knows we received it, without disrupting the in-flight reaction.
-        void bot.api.setMessageReaction(chat_id, msgId, [{ type: 'emoji', emoji: '👀' }]).catch(() => {})
+        void sendReaction(chat_id, msgId, '👀').catch(() => {})
         // #203: time-to-ack metric — measure gateway-receive → ack-post delta.
         logStreamingEvent({ kind: 'inbound_ack', chatId: chat_id, messageId: msgId, ackDelayMs: Date.now() - inboundReceivedAt })
       } else {
@@ -19099,9 +19353,7 @@ async function handleInbound(
         // msgId here and use it as the reaction-session token in log events.
         const ctrlTurnToken = `${chat_id}:${msgId}`
         const ctrl = new StatusReactionController(async (emoji) => {
-          await bot.api.setMessageReaction(chat_id, msgId, [
-            { type: 'emoji', emoji: emoji as ReactionTypeEmoji['emoji'] },
-          ])
+          await sendReaction(chat_id, msgId, emoji as ReactionTypeEmoji['emoji'])
           // #203: every status-reaction transition is a user-visible signal.
           signalTracker.noteSignal(key, Date.now())
         }, allowedReactions, {
@@ -19184,9 +19436,7 @@ async function handleInbound(
         }
       }
     } else if (access.ackReaction) {
-      void bot.api.setMessageReaction(chat_id, msgId, [
-        { type: 'emoji', emoji: access.ackReaction as ReactionTypeEmoji['emoji'] },
-      ]).catch(() => {})
+      void sendReaction(chat_id, msgId, access.ackReaction as ReactionTypeEmoji['emoji']).catch(() => {})
       // #203: time-to-ack metric for the custom-ack-reaction path.
       logStreamingEvent({ kind: 'inbound_ack', chatId: chat_id, messageId: msgId, ackDelayMs: Date.now() - inboundReceivedAt })
     }
@@ -19249,6 +19499,19 @@ async function handleInbound(
     : undefined
   const replyToTextEscaped = formatReplyToText(replyToTextRaw, REPLY_TO_TEXT_MAX)
 
+  // Forwarded-message origin context. `forward_origin` is stamped by
+  // Telegram's servers (Bot API 7.0+) — the forwarding user cannot forge
+  // it via the message body, so it rides the trusted attrs lane and is
+  // NEVER folded into the body text. Coalesced bursts pass their deduped
+  // per-entry origins; direct/bypass paths parse this ctx's own origin.
+  // Same raw-vs-escaped split as reply_to_text: `forwardOrigins` carries
+  // raw (truncated) names for SQLite, `buildForwardOriginMeta` escapes at
+  // the channel-meta boundary.
+  const forwardOrigins = coalescedForwardOrigins
+    ?? dedupeForwardOrigins([parseForwardOrigin(ctx.message?.forward_origin)])
+  const forwardOriginMeta = buildForwardOriginMeta(forwardOrigins)
+  const primaryForwardOrigin = forwardOrigins[0]
+
   if (HISTORY_ENABLED) {
     try {
       recordInbound({
@@ -19262,6 +19525,11 @@ async function handleInbound(
         attachment_kind: attachment?.kind,
         reply_to_message_id: replyToMessageId ?? null,
         reply_to_text: replyToText ?? null,
+        forwarded_from: primaryForwardOrigin?.name ?? null,
+        forwarded_from_type: primaryForwardOrigin?.type ?? null,
+        forwarded_from_id: primaryForwardOrigin?.id != null ? String(primaryForwardOrigin.id) : null,
+        forwarded_date: forwardOriginDateIso(primaryForwardOrigin),
+        forwarded_message_id: primaryForwardOrigin?.messageId ?? null,
       })
     } catch (err) {
       process.stderr.write(`telegram gateway: history recordInbound failed: ${err}\n`)
@@ -19367,6 +19635,11 @@ async function handleInbound(
       // Use the XML-escaped form for the meta — the raw form is in the
       // SQLite buffer for verbatim retrieval via get_recent_messages.
       ...(replyToTextEscaped != null && replyToTextEscaped.length > 0 ? { reply_to_text: replyToTextEscaped } : {}),
+      // Forwarded-message origin (server-stamped, attrs-only — see above).
+      // forwarded_from / forwarded_from_type / forwarded_from_id /
+      // forwarded_date, plus numbered _2.. siblings for a multi-origin
+      // burst. Names are XML-escaped inside buildForwardOriginMeta.
+      ...forwardOriginMeta,
       // queued="true" when mid-turn with no steer prefix (new default), or
       // with explicit /queue or /q prefix (legacy alias).
       ...((isQueuedMidTurn || isQueuedPrefix) ? { queued: 'true' } : {}),
@@ -20529,7 +20802,7 @@ async function sweepBeforeSelfRestart(): Promise<void> {
   try {
     await sweepActiveReactions(
       agentDir,
-      (chatId, messageId) => lockedBot.api.setMessageReaction(chatId, messageId, [{ type: 'emoji', emoji: '👍' as ReactionTypeEmoji['emoji'] }]),
+      (chatId, messageId) => sendReaction(chatId, messageId, '👍' as ReactionTypeEmoji['emoji']),
       { log: (msg) => process.stderr.write(`telegram gateway: pre-restart reaction sweep — ${msg}\n`) },
     )
   } catch (err) {
@@ -23085,9 +23358,14 @@ function wouldFireFleetAutoFallback(): boolean {
  * so the user sees the outcome inline with the original "Model
  * unavailable" card.
  */
-async function fireFleetAutoFallback(triggerAgent: string, untilMs?: number): Promise<void> {
+async function fireFleetAutoFallback(
+  triggerAgent: string,
+  untilMs?: number,
+  parsedResetAt?: Date,
+  trigger?: 'rate-limit',
+): Promise<void> {
   return fleetFallbackGate.fire(
-    () => doFireFleetAutoFallback(triggerAgent, untilMs),
+    () => doFireFleetAutoFallback(triggerAgent, untilMs, parsedResetAt, trigger),
     (err) => {
       process.stderr.write(
         `telegram gateway: [fleet-fallback] error agent=${triggerAgent}: ${(err as Error)?.message ?? err}\n`,
@@ -23096,6 +23374,45 @@ async function fireFleetAutoFallback(triggerAgent: string, untilMs?: number): Pr
   )
 }
 
+// ─── 429 throttle tier — side-effect wiring ─────────────────────────────────
+// Decision + notice text live in throttle-tier.ts (pure); the SEQUENCING
+// (broker mark → fleet-deduped notice → jittered retry nudge with the
+// live-turn safety guards) lives in throttle-tier-wiring.ts so it is
+// unit-testable with injected deps. This block only binds the real gateway
+// dependencies.
+const throttleTierRunner = createThrottleTierRunner({
+  agentName: process.env.SWITCHROOM_AGENT_NAME ?? '',
+  getBrokerClient: () =>
+    getAuthBrokerClient(process.env.SWITCHROOM_AGENT_NAME ?? ''),
+  listNoticeChats: () => loadAccess().allowFrom,
+  sendNotice: (chat_id, markdown) => {
+    // Status notice, not the user's answer — silence the ping (same posture
+    // as the fleet-fallback announcement).
+    void swallowingApiCall(
+      // allow-raw-bot-api: wrapped in swallowingApiCall (retry policy)
+      () => bot.api.sendRichMessage(chat_id, richMessage(markdown), { disable_notification: true }),
+      { chat_id: String(chat_id), verb: 'throttle-tier:notify' },
+    )
+  },
+  resumeDecide: (ts) => fleetFallbackResumeGate.decide(ts),
+  newestActiveTurnStartedAtMs,
+  turnInFlight: () => turnInFlightForGate(),
+  deferRestartToTurnComplete: (agentName, reason) => {
+    // Same lever the schedule_restart IPC uses: the restart drains at the
+    // turn-complete gate (never SIGTERM-now under a live turn). Note the
+    // pending-restart drain cap (PENDING_RESTART_DRAIN_CAP_MS) still bounds
+    // a never-idling session — deliberate, matching scheduled restarts.
+    process.stderr.write(
+      `telegram gateway: [throttle-tier] restart deferred to turn-complete agent=${agentName} reason=${reason}\n`,
+    )
+    pendingRestarts.set(agentName, Date.now())
+  },
+  restartNow: (agentName, reason) => {
+    triggerSelfRestart(agentName, reason)
+  },
+  log: (m) => process.stderr.write(`telegram gateway: ${m}\n`),
+})
+
 /**
  * Broadcast a fleet-fallback FAILURE notice to every authorized chat.
  *
@@ -23157,7 +23474,12 @@ function broadcastFleetFallbackFailure(triggerAgent: string, reason: string): vo
  *  user-visible announcement was broadcast). False on no-op /
  *  error / idempotent-skip — caller uses this to decide whether to
  *  arm the post-fire suppression window. */
-async function doFireFleetAutoFallback(triggerAgent: string, untilMs?: number): Promise<boolean> {
+async function doFireFleetAutoFallback(
+  triggerAgent: string,
+  untilMs?: number,
+  parsedResetAt?: Date,
+  trigger?: 'rate-limit',
+): Promise<boolean> {
   try {
     const client = await getAuthBrokerClient(triggerAgent)
     if (!client) {
@@ -23206,6 +23528,16 @@ async function doFireFleetAutoFallback(triggerAgent: string, untilMs?: number):
       },
       triggerAgent,
       tz,
+      // Enriched card (429 throttle tier): the RAW reset parsed from the
+      // error prose, so the announcement names when the old account frees
+      // even when its live probe returned nothing.
+      parsedResetAt,
+      // Throttle-tier escalation: a terminal transient 429 with a long
+      // parsed reset NEGATES the usage-limit reading, so the old account's
+      // utilization probe typically classifies healthy — the idempotency
+      // guard would self-cancel the swap ("probed healthy / Stale event?").
+      // Trust the terminal parsed-reset signal over the utilization probe.
+      rateLimitTrigger: trigger === 'rate-limit',
     })
     process.stderr.write(
       `telegram gateway: [fleet-fallback] outcome=${outcome.kind} agent=${triggerAgent}` +
@@ -24905,7 +25237,18 @@ bot.command('usage', async ctx => {
         // /auth snapshot does. switchroomReply routes through the rich path
         // (replyWithRichMessage), which accepts reply_markup. Build a grammy
         // InlineKeyboard so the markup type matches switchroomReply's contract.
-        const kbRows = buildSnapshotKeyboard(snapshots, { now: new Date(), demo })
+        // Defense-in-depth (mirrors the operator-private `/auth` treatment,
+        // gateway.ts ~24036): outside a private chat, strip the
+        // `auth:use:<label>` "Switch fleet" rows so the fleet-wide account-
+        // swap button is never even offered in a group/forum. The dispatch-
+        // site allowFrom gate is the load-bearing control; this just avoids
+        // dangling a privileged button in front of non-operators.
+        let kbRows = buildSnapshotKeyboard(snapshots, { now: new Date(), demo })
+        if (ctx.chat?.type !== 'private') {
+          kbRows = kbRows.filter(
+            (row) => !row.some((b) => b.callbackData?.startsWith('auth:use:')),
+          )
+        }
         const keyboard = new InlineKeyboard()
         kbRows.forEach((row, ri) => {
           if (ri > 0) keyboard.row()
@@ -25033,7 +25376,19 @@ bot.on('callback_query:data', async ctx => {
   // Auth dashboard buttons (`auth:<verb>:<agent>[:<slot>]`). Route
   // through a dedicated handler that maps each action onto the
   // existing CLI invocations plus dashboard refresh.
+  //
+  // Strict allowFrom gate like every other mutating callback family
+  // (`eff:`/`apv:`/`cfg:`/`cn:`/`mdl:`). Its absence was a vulnerability:
+  // `auth:use:<label>` drives `client.setActive(label)`, a fleet-wide
+  // OAuth account swap — on an admin forum/supergroup agent with an empty
+  // group allowFrom, any member could tap it and swap the active account.
   if (data.startsWith('auth:')) {
+    const access = loadAccess()
+    const senderId = String(ctx.from?.id ?? '')
+    if (!access.allowFrom.includes(senderId)) {
+      await ctx.answerCallbackQuery({ text: 'Not authorized.' })
+      return
+    }
     await handleAuthDashboardCallback(ctx)
     return
   }
@@ -26735,9 +27090,7 @@ async function handleAckOnly(
     const chat_id = String(ctx.chat!.id)
     const msgId = ctx.message?.message_id
     if (msgId != null) {
-      void bot.api.setMessageReaction(chat_id, msgId, [
-        { type: 'emoji', emoji: (opts.emoji ?? '👀') as ReactionTypeEmoji['emoji'] },
-      ]).catch(() => {})
+      void sendReaction(chat_id, msgId, (opts.emoji ?? '👀') as ReactionTypeEmoji['emoji']).catch(() => {})
     }
     const prefix = opts.warn ? 'WARN ' : ''
     process.stderr.write(`telegram gateway: ${prefix}inbound ${kind} ack-only chat_id=${chat_id} from=${ctx.from?.id ?? '?'}\n`)
@@ -26770,9 +27123,7 @@ async function handleRefusal(
     const msgId = ctx.message?.message_id
     const messageThreadId = ctx.message?.message_thread_id
     if (msgId != null) {
-      void bot.api.setMessageReaction(chat_id, msgId, [
-        { type: 'emoji', emoji: '🚫' as ReactionTypeEmoji['emoji'] },
-      ]).catch(() => {})
+      void sendReaction(chat_id, msgId, '🚫' as ReactionTypeEmoji['emoji']).catch(() => {})
     }
     // #1075: thread-id-bearing — swallow on THREAD_NOT_FOUND so a
     // deleted topic doesn't crash the refusal handler.
@@ -27831,7 +28182,7 @@ process.on('SIGINT', () => void shutdown('SIGINT'))
   if (startupAgentDir != null) {
     void sweepActiveReactions(
       startupAgentDir,
-      (chatId, messageId) => lockedBot.api.setMessageReaction(chatId, messageId, [{ type: 'emoji', emoji: '👍' as ReactionTypeEmoji['emoji'] }]),
+      (chatId, messageId) => sendReaction(chatId, messageId, '👍' as ReactionTypeEmoji['emoji']),
       { log: (msg) => process.stderr.write(`telegram gateway: startup reaction sweep — ${msg}\n`) },
     )
   }
@@ -28740,30 +29091,41 @@ void (async () => {
               // Best-effort: a registry read failure (e.g. no worktree dir
               // on an agent that never claims one) must not affect the
               // primary agentCwd watch.
-              extraWatchCwdsProvider: () =>
-                // Fail-CLOSED ownership filter (unset identity ⇒ nothing;
-                // ownerless records excluded; registry throw ⇒ []). Extracted
-                // to telegram-plugin/worktree-watch-cwds.ts so the #1116 /
-                // Gap-2 ownership predicate is under direct unit test — see
-                // telegram-plugin/tests/worktree-watch-cwds.test.ts.
-                ownedWorktreeCwds({
-                  self: process.env.SWITCHROOM_AGENT_NAME,
-                  listRecords: listWorktreeRecords,
-                  // Durable, non-env identity fallback (#1116 / #2893): when
-                  // SWITCHROOM_AGENT_NAME is somehow unset, derive this
-                  // agent's own identity from its own directory so worktree
-                  // ownership still resolves (env is only the fast path).
-                  // `watcherAgentDir` is guaranteed non-null in this branch
-                  // (the whole watcher is gated on it above). Kill-switch
-                  // SWITCHROOM_WORKTREE_IDENTITY_FALLBACK=0 restores the
-                  // pre-fix env-only behaviour.
-                  agentDir:
-                    process.env.SWITCHROOM_WORKTREE_IDENTITY_FALLBACK === '0'
-                      ? undefined
-                      : watcherAgentDir,
-                  log: (msg) =>
-                    process.stderr.write(`telegram gateway: ${msg}\n`),
-                }),
+              // On every ~1s rescan tick the provider does BOTH:
+              //   1. advances the heartbeat of every worktree THIS agent owns
+              //      — the F1/H3 production driver that keeps `touchHeartbeat`
+              //      alive (it had ZERO callers, so every claim read "stale"
+              //      10 min after creation and the reaper's staleness
+              //      guarantee collapsed); throttled to ≤1 write / 2 min per
+              //      record, and
+              //   2. returns the fail-CLOSED set of owned worktree cwds for the
+              //      watcher to also watch (#1116 / Gap-2 ownership predicate).
+              // Extracted to telegram-plugin/worktree-watch-cwds.ts as
+              // `makeWorktreeWatchProvider` so the wiring — specifically that
+              // the provider ACTUALLY drives heartbeats, not just cwds — is
+              // under direct unit test (see the provider behaviour test in
+              // telegram-plugin/tests/worktree-watch-cwds.test.ts). Fully
+              // best-effort: it never throws out of the provider.
+              extraWatchCwdsProvider: makeWorktreeWatchProvider({
+                self: process.env.SWITCHROOM_AGENT_NAME,
+                // Durable, non-env identity fallback (#1116 / #2893): when
+                // SWITCHROOM_AGENT_NAME is somehow unset, derive this agent's
+                // own identity from its own directory so worktree ownership
+                // still resolves (env is only the fast path). `watcherAgentDir`
+                // is guaranteed non-null in this branch (the whole watcher is
+                // gated on it above). Kill-switch
+                // SWITCHROOM_WORKTREE_IDENTITY_FALLBACK=0 restores the pre-fix
+                // env-only behaviour. One `agentDir` governs BOTH the heartbeat
+                // refresh and the cwd derivation.
+                agentDir:
+                  process.env.SWITCHROOM_WORKTREE_IDENTITY_FALLBACK === '0'
+                    ? undefined
+                    : watcherAgentDir,
+                listRecords: listWorktreeRecords,
+                touchHeartbeat: touchWorktreeHeartbeat,
+                log: (msg) =>
+                  process.stderr.write(`telegram gateway: ${msg}\n`),
+              }),
               // Bug 0 fix: previously omitted, leaving the watcher unable to
               // write liveness/stall/turn_end updates to the registry DB.
               // Liveness writes are now persisted across the gateway lifetime.