switchroom 0.18.15 → 0.18.17

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.18.15", COMMIT_SHA = "2fa611a1";
+var VERSION = "0.18.17", COMMIT_SHA = "372a4968";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13843,6 +13843,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 \u2014 a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, \u2026). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing \u2014 how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 \u2014 see docs/auth.md \u00a7 " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice \u2014 the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short \u2014 the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -28995,6 +28998,9 @@ function buildAccessJson2(agentConfig, telegramConfig, resolvedTopicId, userId)
   if (typeof tg?.coalesce?.max_attachments === "number") {
     access.coalesceMaxAttachments = tg.coalesce.max_attachments;
   }
+  if (typeof tg?.litellm_notice?.window_ms === "number") {
+    access.litellmNoticeWindowMs = tg.litellm_notice.window_ms;
+  }
   if (typeof tg?.interrupt?.safe_boundary === "boolean") {
     access.interruptSafeBoundary = tg.interrupt.safe_boundary;
   }
@@ -69654,6 +69660,36 @@ function printConsumersTable(state) {
     console.log(`  ${c.name.padEnd(10)} ${acct} ${status}`);
   }
 }
+function usageHeadroomCell(t) {
+  const noColor = (s) => s;
+  if (t == null)
+    return { plain: "no data", color: source_default.gray };
+  if (t.headroomPct == null)
+    return { plain: "unknown", color: source_default.gray };
+  const left = Math.round(t.headroomPct);
+  const peak = t.peakUtilizationPct == null ? "?" : `${Math.round(t.peakUtilizationPct)}`;
+  const base = `${left}% left (peak ${peak}%, n=${t.observations})`;
+  if (t.walled)
+    return { plain: `WALLED - ${base}`, color: source_default.red };
+  if (t.refilled)
+    return { plain: `refilled - ${base}`, color: source_default.green };
+  if (left <= 10)
+    return { plain: base, color: source_default.yellow };
+  return { plain: base, color: noColor };
+}
+function printUsageTable(state) {
+  console.log(source_default.bold("  ACCOUNT                           PREMIUM (Fable) HEADROOM                    STANDARD HEADROOM"));
+  const WIDTH = 44;
+  for (const a of state.accounts) {
+    const marker = a.label === state.active ? source_default.green("*") : " ";
+    const label = a.label.padEnd(32);
+    const premium = usageHeadroomCell(a.usage_ledger?.premium ?? null);
+    const standard = usageHeadroomCell(a.usage_ledger?.standard ?? null);
+    const premiumCol = premium.color(premium.plain.padEnd(WIDTH));
+    const standardCol = standard.color(standard.plain);
+    console.log(`  ${marker} ${label} ${premiumCol} ${standardCol}`);
+  }
+}
 function printAgentDetail(state, agent) {
   console.log();
   console.log(source_default.bold(`  ${agent.name}`));
@@ -69832,6 +69868,19 @@ function registerAuthCommand(program3) {
     printAccountsTable(state);
     console.log();
   }));
+  auth.command("usage").description("Per-account premium (Fable) + standard usage headroom, from the durable ledger").option("--json", "Output the raw per-account usage_ledger summaries as JSON").action(withConfigError(async (opts) => {
+    const state = await brokerCall((client) => client.listState());
+    if (opts.json) {
+      console.log(JSON.stringify(state.accounts.map((a) => ({ label: a.label, usage_ledger: a.usage_ledger ?? null })), null, 2));
+      return;
+    }
+    console.log();
+    printUsageTable(state);
+    console.log();
+    console.log(source_default.gray("  Premium = flagship (Fable) 7d_oi tier; standard = 5h/7d. Passive: harvested from probe headers, no extra requests."));
+    console.log(source_default.gray("  'X% left' is current (refill-aware); 'peak' is the max over retained history (~48h) and may predate the latest reset."));
+    console.log();
+  }));
   function pinAuthActiveInYaml(label, quiet = false) {
     try {
       const yamlPath = getConfigPath(program3);

package/dist/host-control/main.js

@@ -18861,6 +18861,9 @@ var TelegramChannelSchema = exports_external.object({
     window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
     max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
   }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+  litellm_notice: exports_external.object({
+    window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+  }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
   interrupt: exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -26589,7 +26592,7 @@ import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:f
 import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.15";
+var VERSION = "0.18.17";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/dist/vault/approvals/kernel-server.js

@@ -4281,6 +4281,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")

package/dist/vault/broker/server.js

@@ -4281,6 +4281,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.15",
+  "version": "0.18.17",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/start.sh.hbs

@@ -1130,23 +1130,28 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   unset sr_ll_key sr_ll_ok sr_ll_unreachable
 fi
 
-# --- Session model resolution (durable .session-model + .relaunch-model-intent) ---
+# --- Session model resolution (consume-once .session-model carrier) ---
 #
-# Contract: reference/rfcs/session-model-stickiness.md (#3039 revision). A
-# positively-confirmed `/model X` switch persists as
-# `{{agentDir}}/.session-model` (one-line JSON written by the gateway) and is
-# honored on EVERY boot — deploy, watchdog bounce, raw `docker restart`,
-# host reboot, crash. It is cleared only by:
+# Contract: reference/rfcs/session-model-stickiness.md §0.1 (rev 4, operator
+# decision 2026-07-12 — SESSION-SCOPED, superseding rev 3 keep-by-default). A
+# `/model` override lasts only for the current session:
 #
-#   - explicit user action (`/model default` deletes it live; a fresh
-#     (<10 min) explicit "revert" `.relaunch-model-intent` reverts at boot)
-#   - invalidation: corrupt/malformed file, or the configured yaml `model:`
-#     changed since the switch
+#   - Claude switches apply LIVE in-session (claude's native picker) and write
+#     NO carrier — the explicit `claude --model {{{modelQ}}}` this script execs
+#     reverts them for free on the next boot.
+#   - sr-* / sr→Claude switches and a queued /model persisted at shutdown need
+#     a relaunch to take effect, so the gateway writes `{{agentDir}}/.session-model`
+#     (one-line JSON) IMMEDIATELY before that relaunch. This block APPLIES the
+#     carrier on the single boot that reads it and then DELETES it (consume-once).
+#     Any SUBSEQUENT restart — deploy, `/restart`, `/new`, watchdog recovery,
+#     crash, raw `docker restart`, host reboot — finds no carrier and boots the
+#     configured default. That deletion is the marker distinguishing the
+#     model-apply relaunch from every later restart.
 #
-# Every clearing path writes `.session-model-alert`, which the gateway
-# relays to the operator chat once at boot — an override is never dropped
-# silently. Default (no intent / stale / corrupt intent) is KEEP (operator
-# decision 2026-07-11, superseding the earlier revert-by-default).
+# `/model default` deletes the carrier live. Invalidation paths (corrupt file,
+# configured yaml `model:` changed) also delete + write `.session-model-alert`,
+# which the gateway relays to the operator chat once at boot. The normal apply
+# path is silent here — the gateway already acked the `/model` in chat.
 #
 # NB {{{modelQ}}} is already shell-single-quoted by the scaffold (it renders as
 # a quoted token, e.g. 'claude-sonnet-5'), so it is assigned BARE here — never
@@ -1154,63 +1159,42 @@ fi
 # the value and break `claude --model`.
 _EFFECTIVE_MODEL={{{modelQ}}}
 # Record the RESOLVED configured default (raw, unquoted) every boot, before
-# override resolution. The gateway copies this into the override's
+# override resolution. The gateway copies this into the carrier's
 # `configuredDefaultAtWrite`, so both sides of the invalidation compare below
 # come from the same resolver. Overwrite, not consumed.
 printf '%s\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.configured-default-model" 2>/dev/null || true
 
-# Migration shim (one release, RFC §7): a leftover one-shot
-# `.session-model-override` carrier means an OLD gateway wrote it immediately
-# before this very bounce — it is the newest user intent and WINS over any
-# `.session-model` on disk. Convert (overwrite) + consume, and apply THIS
-# boot (the carrier's presence is itself the keep signal).
-_sm_keep=""
+# Rev-4 hygiene (#3184 review LOW-2): remove the files retired with the
+# keep/revert intent subsystem and the crashloop self-heal. Nothing reads them
+# anymore; without this rm they would linger in the bind-mounted state dir
+# forever after rollout. Idempotent — a cheap no-op once clean.
+rm -f "{{agentDir}}/.relaunch-model-intent" "{{agentDir}}/.session-model-boot-attempts" "{{agentDir}}/.session-model-kept-notified"
+
+# Migration shim (one release): a leftover one-shot `.session-model-override`
+# carrier from a pre-consume-once gateway means an OLD gateway wrote it
+# immediately before this very bounce — convert it to `.session-model` so the
+# block below applies + consumes it this boot (same one-shot semantics).
 if [ -f "{{agentDir}}/.session-model-override" ]; then
   _mig="$(tr -d '[:space:]' < "{{agentDir}}/.session-model-override" 2>/dev/null || true)"
   rm -f "{{agentDir}}/.session-model-override"
   if printf '%s' "$_mig" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
     printf '{"model":"%s","configuredDefaultAtWrite":"%s","ts":%s}\n' "$_mig" "$_EFFECTIVE_MODEL" "$(( $(date +%s) * 1000 ))" > "{{agentDir}}/.session-model" 2>/dev/null || true
-    _sm_keep="1"
-    echo "session-model: migrated legacy one-shot carrier '$_mig' to durable .session-model (applying this boot)" >&2
+    echo "session-model: migrated legacy one-shot carrier '$_mig' to .session-model (applying + consuming this boot)" >&2
   else
     echo "session-model: ignoring malformed legacy .session-model-override (failed shape gate)" >&2
   fi
   unset _mig
 fi
 
-# One-shot intent: consume unconditionally, honor only a fresh "keep".
-# Freshness clock is the EMBEDDED ts (ms), never file mtime — same clock the
-# gateway writes with.
-_sm_reason=""
-_sm_revert=""
-if [ -f "{{agentDir}}/.relaunch-model-intent" ]; then
-  _int_raw="$(cat "{{agentDir}}/.relaunch-model-intent" 2>/dev/null || true)"
-  rm -f "{{agentDir}}/.relaunch-model-intent"
-  _int="$(printf '%s' "$_int_raw" | sed -n 's/.*"intent"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p')"
-  _int_ts="$(printf '%s' "$_int_raw" | sed -n 's/.*"ts"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p')"
-  _sm_reason="$(printf '%s' "$_int_raw" | sed -n 's/.*"reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-  # #3039: boot default is KEEP. Only a FRESH explicit "revert" intent
-  # (stamped by an explicit user/gateway revert path) clears the override.
-  # A stale or corrupt intent counts as no intent → keep.
-  if [ "$_int" = "revert" ] && [ -n "$_int_ts" ] && [ $(( $(date +%s) * 1000 - _int_ts )) -lt 600000 ]; then
-    _sm_revert="1"
-  fi
-  unset _int_raw _int _int_ts
-fi
-
 if [ -f "{{agentDir}}/.session-model" ]; then
   _smf="$(cat "{{agentDir}}/.session-model" 2>/dev/null || true)"
   _sm_model="$(printf '%s' "$_smf" | sed -n 's/.*"model"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
   _sm_cfg="$(printf '%s' "$_smf" | sed -n 's/.*"configuredDefaultAtWrite"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-  _sm_ts="$(printf '%s' "$_smf" | sed -n 's/.*"ts"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p')"
-  if [ -n "$_sm_revert" ]; then
-    # Explicit fresh revert intent — the ONLY boot path that clears a valid
-    # override by design (#3039). Everything else keeps.
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
-    _sm_why="${_sm_reason:-explicit revert intent}"
-    echo "session-model: reverting to configured default '$_EFFECTIVE_MODEL' — $_sm_why (session override '$_sm_model' cleared)" >&2
-    printf 'Session model override `%s` was cleared as requested (%s) — this relaunch booted the configured default `%s`. Re-issue /model %s to switch back.\n' "$_sm_model" "$_sm_why" "$_EFFECTIVE_MODEL" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-    unset _sm_why
+  # CONSUME-ONCE: delete the carrier now, before any apply/exec. The carrier
+  # governs exactly this one boot; a bad token can therefore crash at most one
+  # boot (the next boot has no carrier and reverts), so no crashloop self-heal
+  # is needed. Every branch below has already removed the file.
+  rm -f "{{agentDir}}/.session-model"
   # Shape gate — kept BYTE-IDENTICAL with MODEL_ARG_RE in
   # telegram-plugin/gateway/model-command.ts. `/` is allowed for
   # OpenRouter-style `sr-vendor/model` ids; it is not a shell metachar inside
@@ -1219,116 +1203,69 @@ if [ -f "{{agentDir}}/.session-model" ]; then
   # extraction above emits one match per matching LINE, and `grep -Eq`
   # passes if ANY line matches — a multiline value must never reach
   # `claude --model` (parity with parseSessionModel's single-string check).
-  elif [ "$(printf '%s' "$_sm_model" | wc -c)" -eq 0 ] || [ "$(printf '%s' "$_sm_model" | wc -l)" -ne 0 ] || ! printf '%s' "$_sm_model" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
-    # Invalid carrier (#3039): fall back to the configured default AND tell
-    # the operator once — never a silent stderr-only drop.
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
+  if [ "$(printf '%s' "$_sm_model" | wc -c)" -eq 0 ] || [ "$(printf '%s' "$_sm_model" | wc -l)" -ne 0 ] || ! printf '%s' "$_sm_model" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
+    # Invalid carrier: fall back to the configured default AND tell the
+    # operator once — never a silent stderr-only drop.
     echo "session-model: ignoring malformed .session-model (failed shape gate) — using configured default '$_EFFECTIVE_MODEL'" >&2
     printf 'Your saved session model override could not be read (invalid or corrupt), so the agent booted on its configured default `%s`. Re-issue /model <name> if you want a different model.\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   elif [ "$_sm_cfg" != "$_EFFECTIVE_MODEL" ]; then
-    # switchroom.yaml `model:` changed since the switch → the override is
-    # against a default that no longer exists (it may name a retired model).
-    # Invalidate + announce once (#3039 invalid-carrier fallback).
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
-    echo "session-model: configured default changed ('$_sm_cfg' → '$_EFFECTIVE_MODEL') — clearing session override '$_sm_model'" >&2
-    printf 'The configured default model changed (`%s` → `%s`), so your session override to `%s` was cleared — the agent booted on the new configured default. Re-issue /model %s if you still want it.\n' "$_sm_cfg" "$_EFFECTIVE_MODEL" "$_sm_model" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+    # switchroom.yaml `model:` changed between the switch and this apply-boot →
+    # the carrier is against a default that no longer exists. Invalidate +
+    # announce once.
+    echo "session-model: configured default changed ('$_sm_cfg' → '$_EFFECTIVE_MODEL') — dropping session override '$_sm_model'" >&2
+    printf 'The configured default model changed (`%s` → `%s`), so your session override to `%s` was not applied — the agent booted on the new configured default. Re-issue /model %s if you still want it.\n' "$_sm_cfg" "$_EFFECTIVE_MODEL" "$_sm_model" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+  elif [ "${_sm_model#sr-}" != "$_sm_model" ] && [ -z "$_LITELLM_OK" ]; then
+    # sr-* + LiteLLM unreachable at the apply-boot: booting the override would
+    # 4xx against Anthropic, and consume-once means we can't retain it for a
+    # later relaunch. Boot the configured default and tell the operator to
+    # re-issue once the proxy is back.
+    echo "session-model: LiteLLM proxy unreachable at boot — NOT applying sr-* override '$_sm_model'; booting configured default '$_EFFECTIVE_MODEL' (re-issue /model when the proxy is back)" >&2
+    printf 'LiteLLM proxy was unreachable at boot, so the session model override `%s` was not applied — the agent booted on its configured default `%s`. Re-issue /model %s once the proxy is reachable.\n' "$_sm_model" "$_EFFECTIVE_MODEL" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   else
-    case "$_sm_model" in
-      sr-*)
-        if [ -z "$_LITELLM_OK" ]; then
-          # sr-* + LiteLLM unreachable: booting the override would 4xx against
-          # Anthropic. Boot the configured default but RETAIN the durable file
-          # — it re-applies on the next keep relaunch once the proxy is back.
-          echo "session-model: LiteLLM proxy unreachable at boot — NOT applying sr-* override '$_sm_model' this boot; booting configured default '$_EFFECTIVE_MODEL' (override retained, re-applies next relaunch)" >&2
-          printf 'LiteLLM proxy was unreachable at boot, so the session model override `%s` was not applied — the agent booted on its configured default `%s`. The override is retained and will re-apply on the next switchroom-managed relaunch once LiteLLM is reachable; /model default drops it.\n' "$_sm_model" "$_EFFECTIVE_MODEL" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-        else
-          _EFFECTIVE_MODEL="$_sm_model"
-        fi
-        ;;
-      *)
-        _EFFECTIVE_MODEL="$_sm_model"
-        ;;
-    esac
-    if [ "$_EFFECTIVE_MODEL" = "$_sm_model" ]; then
-      echo "session-model: keeping session override '$_sm_model' across this relaunch${_sm_reason:+ ($_sm_reason)}" >&2
-      # #3042 item 4: notify the chat ONCE per kept value — a watchdog bounce
-      # loop must not storm the operator with identical "kept" alerts. The
-      # sentinel is cleared on every path that clears the override.
-      if [ "$(cat "{{agentDir}}/.session-model-kept-notified" 2>/dev/null || true)" != "$_sm_model" ]; then
-        printf 'Session model override `%s` kept across this relaunch%s. It persists across restarts and deploys; /model default clears it.\n' "$_sm_model" "${_sm_reason:+ ($_sm_reason)}" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-        printf '%s\n' "$_sm_model" > "{{agentDir}}/.session-model-kept-notified" 2>/dev/null || true
-      fi
-    fi
+    # Apply the carrier for THIS session. No boot alert — the gateway already
+    # acked the /model switch in chat, and the override reverts on next restart.
+    _EFFECTIVE_MODEL="$_sm_model"
+    echo "session-model: applying session override '$_sm_model' this boot (consume-once — reverts on next restart)" >&2
   fi
-  unset _smf _sm_model _sm_cfg _sm_ts
+  unset _smf _sm_model _sm_cfg
 fi
-unset _sm_keep _sm_reason _sm_revert
 
-# --- Override crashloop self-heal (#3042 review blocker 2b) ---
+# --- Session effort resolution (consume-once .session-effort carrier, #3186) ---
 #
-# Under keep-by-default an invalid-but-shape-valid persisted model (a typo
-# persisted at shutdown, or a confirmed model later retired) would make every
-# boot exec `claude --model <bad>` and die with the gateway dead — recovery
-# would need a host shell. Detect the loop from inside: when an override is
-# ACTIVE, stamp a boot-attempt counter just before exec; a healthy run makes
-# the next boot arrive much later (stamp stale → counter resets), while a
-# fast crashloop re-enters here within seconds (docker backoff caps ≈1 min).
-# Three consecutive fast boots with the same override → clear the carrier,
-# boot the configured default, and alert the chat once.
-_SM_CFG_RECORDED="$(cat "{{agentDir}}/.configured-default-model" 2>/dev/null | tr -d '[:space:]' || true)"
-if [ -n "$_SM_CFG_RECORDED" ] && [ "$_EFFECTIVE_MODEL" != "$_SM_CFG_RECORDED" ] && [ -f "{{agentDir}}/.session-model" ]; then
-  _bl_now="$(date +%s)"
-  _bl_cnt=0
-  _bl_prev=0
-  if [ -f "{{agentDir}}/.session-model-boot-attempts" ]; then
-    read -r _bl_cnt _bl_prev < "{{agentDir}}/.session-model-boot-attempts" 2>/dev/null || true
-  fi
-  case "$_bl_cnt" in (''|*[!0-9]*) _bl_cnt=0;; esac
-  case "$_bl_prev" in (''|*[!0-9]*) _bl_prev=0;; esac
-  if [ $(( _bl_now - _bl_prev )) -lt 150 ]; then _bl_cnt=$(( _bl_cnt + 1 )); else _bl_cnt=1; fi
-  if [ "$_bl_cnt" -ge 3 ]; then
-    echo "session-model: override '$_EFFECTIVE_MODEL' appears to be crashlooping the session ($_bl_cnt fast boots) — clearing it, booting configured default '$_SM_CFG_RECORDED'" >&2
-    printf 'Session model override `%s` was cleared automatically: the agent failed to stay up %s boots in a row with it active (the model may be invalid or retired). Booting the configured default `%s`. Re-issue /model <name> if you want a different model.\n' "$_EFFECTIVE_MODEL" "$_bl_cnt" "$_SM_CFG_RECORDED" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-boot-attempts" "{{agentDir}}/.session-model-kept-notified"
-    _EFFECTIVE_MODEL="$_SM_CFG_RECORDED"
-  else
-    printf '%s %s\n' "$_bl_cnt" "$_bl_now" > "{{agentDir}}/.session-model-boot-attempts" 2>/dev/null || true
-  fi
-  unset _bl_now _bl_cnt _bl_prev
-else
-  # No active override this boot — a stale counter must not bite a future one.
-  rm -f "{{agentDir}}/.session-model-boot-attempts"
-fi
-unset _SM_CFG_RECORDED
-
-# --- Session effort resolution (durable .session-effort, #3039) ---
+# The `/effort` sibling of the block above, session-scoped like /model
+# (rev 4). A live `/effort <level>` applies in-session via the applyEffort
+# driver and writes NO carrier — the explicit `--effort <configured>` below
+# reverts it on the next boot. The ONLY boot-applied case is a queued
+# mid-turn `/effort` the gateway persisted at shutdown: this block APPLIES
+# that carrier on the single boot that reads it and then DELETES it
+# (consume-once), so any subsequent restart reverts to the configured
+# `thinking_effort`. Invalidation (corrupt file / configured default
+# changed) appends to `.session-model-alert` so the gateway's boot relay
+# tells the operator once.
 #
-# The `/effort` sibling of the block above. A positively-confirmed `/effort`
-# apply persists `{{agentDir}}/.session-effort` (one-line JSON
-# {"level","configuredDefaultAtWrite","ts"} written by the gateway). It is
-# honored on every boot and cleared only by `/effort default` (live delete)
-# or invalidation here (corrupt file / configured `thinking_effort:` changed)
-# — each invalidation appends to `.session-model-alert` so the gateway's
-# boot relay tells the operator once.
+# NB: the CONFIGURED default resolution is untouched (#3186 constraint) —
+# the fleet `thinking_effort: low` pin (see #1978 /
+# src/config/thinking-effort-risk.ts) resolves exactly as before.
 _EFFECTIVE_EFFORT={{#if thinkingEffort}}'{{thinkingEffort}}'{{else}}''{{/if}}
 if [ -f "{{agentDir}}/.session-effort" ]; then
   _sef="$(cat "{{agentDir}}/.session-effort" 2>/dev/null || true)"
   _se_level="$(printf '%s' "$_sef" | sed -n 's/.*"level"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
   _se_cfg="$(printf '%s' "$_sef" | sed -n 's/.*"configuredDefaultAtWrite"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+  # CONSUME-ONCE: delete the carrier now, before any apply/exec — it governs
+  # exactly this one boot (parity with the .session-model block above).
+  rm -f "{{agentDir}}/.session-effort"
   # Allowlist gate — kept in sync with EFFORT_LEVELS in
   # telegram-plugin/gateway/effort-command.ts. The level is passed verbatim
   # to `claude --effort`.
   if [ "$(printf '%s' "$_se_level" | wc -l)" -ne 0 ] || ! printf '%s' "$_se_level" | grep -Eq '^(low|medium|high|xhigh|max)$'; then
-    rm -f "{{agentDir}}/.session-effort"
     echo "session-effort: ignoring malformed .session-effort (failed allowlist gate) — using configured default '${_EFFECTIVE_EFFORT:-<unset>}'" >&2
     printf 'Your saved session effort override could not be read (invalid or corrupt), so the agent booted on its configured default effort. Re-issue /effort <level> if you want a different one.\n' >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   elif [ "$_se_cfg" != "$_EFFECTIVE_EFFORT" ]; then
-    rm -f "{{agentDir}}/.session-effort"
-    echo "session-effort: configured thinking_effort changed ('$_se_cfg' → '${_EFFECTIVE_EFFORT:-<unset>}') — clearing session override '$_se_level'" >&2
-    printf 'The configured default effort changed (`%s` → `%s`), so your session effort override `%s` was cleared — the agent booted on the new configured default. Re-issue /effort %s if you still want it.\n' "${_se_cfg:-<unset>}" "${_EFFECTIVE_EFFORT:-<unset>}" "$_se_level" "$_se_level" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+    echo "session-effort: configured thinking_effort changed ('$_se_cfg' → '${_EFFECTIVE_EFFORT:-<unset>}') — dropping session override '$_se_level'" >&2
+    printf 'The configured default effort changed (`%s` → `%s`), so your session effort override `%s` was not applied — the agent booted on the new configured default. Re-issue /effort %s if you still want it.\n' "${_se_cfg:-<unset>}" "${_EFFECTIVE_EFFORT:-<unset>}" "$_se_level" "$_se_level" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   else
     _EFFECTIVE_EFFORT="$_se_level"
-    echo "session-effort: keeping session effort override '$_se_level' across this relaunch" >&2
+    echo "session-effort: applying session effort override '$_se_level' this boot (consume-once — reverts on next restart)" >&2
   fi
   unset _sef _se_level _se_cfg
 fi
@@ -1337,6 +1274,11 @@ if [ -n "$_EFFECTIVE_EFFORT" ]; then
 else
   _EFFORT_ARG=""
 fi
+# Record the EFFECTIVE launched effort so the gateway can re-hydrate its
+# in-memory session-effort state after a queued-apply boot, keeping the
+# /effort menu highlight honest. Overwrite (not consumed) — the effort
+# sibling of `.active-session-model` below.
+printf '%s\n' "$_EFFECTIVE_EFFORT" > "{{agentDir}}/.active-session-effort" 2>/dev/null || true
 
 # sr-* passthrough→router repoint — ONE post-resolution gate covering BOTH the
 # /model override path AND the configured-default path (`model: sr-*` in