switchroom 0.18.15 → 0.18.18

package/telegram-plugin/gateway/gateway.ts

@@ -184,6 +184,7 @@ import {
   selectHeldForRedelivery,
   holdReasonFor,
   heldRetryBackoffMs,
+  applyDeliveredHoldReset,
   type UndeliverableMark,
 } from './approval-hold.js'
 import { isTelegramReplyTool, isTelegramSurfaceTool } from '../tool-names.js'
@@ -207,7 +208,7 @@ import {
   isPhotoDimensionRejectError,
   isFloodWaitActiveError,
 } from '../retry-api-call.js'
-import { createSendGate, sendGateEnabledFromEnv } from '../send-gate.js'
+import { createSendGate, sendGateConfigFromEnv } from '../send-gate.js'
 import { createStatsLogger, createFloodWindowObserver } from '../send-gate-observability.js'
 import { classifyPhotoFile, rerouteResultSuffix } from '../photo-precheck.js'
 import { installTgPostLogger, withTgPostTags } from '../shared/bot-runtime.js'
@@ -314,6 +315,11 @@ import {
   type OperatorEventKind,
 } from '../operator-events.js'
 import { recordOperatorEvent } from '../operator-events-history.js'
+import {
+  parseLlmError,
+  renderLlmError,
+  decideErrorSurface,
+} from '../llm-error-present.js'
 import {
   formatModelUnavailableCard,
   resolveModelUnavailableFromOperatorEvent,
@@ -326,6 +332,8 @@ import {
   throttleRetryInPlaceMaxMs,
 } from '../throttle-tier.js'
 import { createThrottleTierRunner } from './throttle-tier-wiring.js'
+import { parseLitellmNoticeWindowMs } from '../litellm-local-notice.js'
+import { createLitellmLocalNoticeRunner, decideRateLimitedSurface } from './litellm-local-notice-wiring.js'
 import { runFleetAutoFallback, renderFallbackFailureNotice, evaluateFallbackFailureNotice, evaluateAllBlockedNotice, type FallbackFailureNoticeState, type FallbackAllBlockedNoticeState } from '../auto-fallback-fleet.js'
 import { startRestartWatchdog } from './restart-watchdog.js'
 import { validateStringArray } from './access-validator.js'
@@ -436,6 +444,8 @@ import { injectSlashCommand as injectSlashCommandImpl } from '../../src/agents/i
 import { handleInjectCommand, type InjectDeps } from './inject-handler.js'
 import {
   parseModelCommand,
+  planModelCommand,
+  modelCommandReceiptLine,
   handleModelCommand,
   buildModelMenu,
   handleModelMenuCallback,
@@ -461,19 +471,16 @@ import {
   readSessionModelFileRaw,
   restoreSessionModelFileRaw,
   clearSessionModelFile,
-  clearSessionModelBootAttempts,
   readConfiguredDefaultModel,
-  writeRelaunchModelIntent,
-  clearRelaunchModelIntent,
-  intentForRestartReason,
-  readSessionModelFile,
-  RELAUNCH_MODEL_INTENT_FILE,
-  GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX,
-  clearStaleGatewayShutdownIntent,
   writeSessionEffortFile,
   clearSessionEffortFile,
-  readSessionEffortFile,
+  writePremiumRecoveryFile,
+  readPremiumRecoveryFile,
+  clearPremiumRecoveryFile,
 } from './session-model-file.js'
+import { runTierDowngrade } from './tier-downgrade-wiring.js'
+import { runPremiumRecoveryPing } from './premium-recovery-wiring.js'
+import { decidePremiumRecovery } from '../premium-recovery.js'
 import { discoverModels, selectModel } from '../../src/agents/model-picker.js'
 import { resolveMainModel, SWITCHROOM_DEFAULT_THINKING_EFFORT } from '../../src/agents/scaffold.js'
 import {
@@ -1097,16 +1104,10 @@ function triggerSelfRestart(
       )
       return false
     }
-    // Session-model stickiness (reference/rfcs/session-model-stickiness.md):
-    // boot default is REVERT, so every switchroom-managed bounce must stamp
-    // its intent BEFORE the SIGTERM is even scheduled (write-before-kill
-    // invariant — pinned by gateway-session-model-relaunch.test.ts). The
-    // per-reason table classifies recovery/model-switch bounces as "keep"
-    // and the deliberate inline restart button as "revert".
-    {
-      const smDir = resolveAgentDirFromEnv()
-      if (smDir) writeRelaunchModelIntent(smDir, intentForRestartReason(reason), reason)
-    }
+    // Session-scoped /model (reference/rfcs/session-model-stickiness.md §0.1):
+    // a `.session-model` carrier is consume-once — start.sh applies it on the
+    // apply-relaunch and deletes it, so no boot needs a keep/revert intent. A
+    // switchroom-managed bounce simply reverts to the configured default.
     process.stderr.write(
       `telegram gateway: restart-via-SIGTERM-PID1 agent=${targetAgent} reason=${reason} (docker)\n`,
     )
@@ -1118,10 +1119,6 @@ function triggerSelfRestart(
     return true
   }
   // Legacy systemd path.
-  if (targetAgent === selfAgent) {
-    const smDir = resolveAgentDirFromEnv()
-    if (smDir) writeRelaunchModelIntent(smDir, intentForRestartReason(reason), reason)
-  }
   process.stderr.write(
     `telegram gateway: restart-via-systemctl agent=${targetAgent} reason=${reason}\n`,
   )
@@ -1141,24 +1138,6 @@ function triggerSelfRestart(
   }
 }
 
-// #3018 finding 4: a gateway-only bounce (supervisor relaunch, bare gateway
-// unit restart) leaves the shutdown handler's deploy-survival keep-intent
-// stamp on disk UNCONSUMED — start.sh only runs on a container-level boot.
-// If this gateway boot still sees a gateway-shutdown-stamped intent, the
-// preceding bounce was gateway-only: clear it so a genuine crash inside the
-// 10-min freshness window can't be converted into a "keep" (crash-reverts
-// policy intact). A real container stop/deploy consumes the file in start.sh
-// before any gateway boots, so a legitimate deploy stamp is never touched;
-// triggerSelfRestart / user-slash stamps use un-prefixed reasons.
-{
-  const bootSmDir = resolveAgentDirFromEnv()
-  if (bootSmDir != null && clearStaleGatewayShutdownIntent(bootSmDir)) {
-    process.stderr.write(
-      'telegram gateway: cleared stale gateway-shutdown relaunch-model intent (previous bounce was gateway-only — container never restarted)\n',
-    )
-  }
-}
-
 // Cached lazily — the claude CLI binary doesn't change inside a running
 // gateway process; on `switchroom update` the gateway restarts, refreshing this.
 let cachedClaudeCliVersion: string | null | undefined = undefined
@@ -1410,6 +1389,11 @@ type Access = {
   parseMode?: 'html' | 'markdownv2' | 'text'
   disableLinkPreview?: boolean
   coalescingGapMs?: number
+  /** Cooldown window (ms) for the litellm-local 429 notice — the debounced
+   *  "fleet token limiter engaged" message (litellm-local-notice.ts). Default
+   *  15 min when unset/invalid (parseLitellmNoticeWindowMs). Projected from
+   *  channels.telegram.litellm_notice.window_ms by scaffold. */
+  litellmNoticeWindowMs?: number
   /** A2: max media attachments folded into one coalesced turn. Default 10
    *  (a full Telegram album / forwarded burst arrives as one turn). Set 1 to
    *  restore single-attachment behaviour. Projected from
@@ -1564,6 +1548,7 @@ function readAccessFile(): Access {
       parseMode: parsed.parseMode,
       disableLinkPreview: parsed.disableLinkPreview,
       coalescingGapMs: parsed.coalescingGapMs,
+      litellmNoticeWindowMs: parsed.litellmNoticeWindowMs,
       coalesceMaxAttachments: parsed.coalesceMaxAttachments,
       interruptSafeBoundary: parsed.interruptSafeBoundary,
       interruptMaxWaitMs: parsed.interruptMaxWaitMs,
@@ -5495,8 +5480,14 @@ const recordFloodWindow = makeFloodWindowRecorder(FLOOD_WINDOWS_PATH)
 // ban never resends into an open window. onWindowOpen write-throughs every
 // runtime-opened window to FLOOD_WINDOWS_PATH; bootRamp starts the global
 // bucket at half capacity for 10s to absorb the boot-card burst.
+// Resolve enabled + the tunable rate limits (channels.telegram.send_gate.* →
+// SWITCHROOM_TG_SEND_GATE_* env) ONCE at boot. Unset knobs are absent, so
+// createSendGate applies SEND_GATE_DEFAULTS — omitting config = today's exact
+// behaviour. The SWITCHROOM_TELEGRAM_SEND_GATE break-glass valve still wins on
+// `enabled` when explicitly set (see sendGateConfigFromEnv precedence).
+const sendGateConfig = sendGateConfigFromEnv()
 const sendGate = createSendGate({
-  enabled: sendGateEnabledFromEnv(),
+  ...sendGateConfig,
   initialWindows: loadInitialFloodWindows(FLOOD_STATE_PATH, FLOOD_WINDOWS_PATH, Date.now()),
   bootRamp: {},
   onWindowOpen: (scopeKey, untilTs) => recordFloodWindow(scopeKey, untilTs),
@@ -5509,15 +5500,20 @@ const sendGate = createSendGate({
 const probeFloodWaitRemainingMs = makeFloodWaitProbe(FLOOD_STATE_PATH)
 const rawRobustApiCall = createRetryApiCall({
   log: (line) => process.stderr.write(line),
-  onFloodWait: (retryAfterSec) => {
+  onFloodWait: (retryAfterSec, opts) => {
     // #2923/#3094 — persist the single-object global window (probe reads this).
     makeFloodWaitRecorder(FLOOD_STATE_PATH)(retryAfterSec)
-    // #3084 PR 2 — also open a GLOBAL send-gate window so cosmetic traffic sheds
-    // for the ban's duration even on a SHORT (slept-and-retried) 429 that never
-    // throws FLOOD_WAIT_ACTIVE. Scope-precise windows are opened by the gate's
-    // own FLOOD_WAIT_ACTIVE catch (which has the call's opts).
+    // #3084 PR 2 / #3111 — also open SCOPE-PRECISE send-gate window(s) so cosmetic
+    // traffic sheds for the ban's duration even on a SHORT (slept-and-retried)
+    // 429 that never throws FLOOD_WAIT_ACTIVE. The retry policy now passes the
+    // call's `opts` (#3111) so this opens the FINEST scope the 429 implies —
+    // `chat:`/`group:`/`msg-edit:` for a chat-bound call, `global` only when the
+    // call carries no chat scope (genuinely global) — instead of a blanket
+    // `global` window that would suppress unrelated chats. This mirrors the
+    // gate's own FLOOD_WAIT_ACTIVE catch, which uses the same scope-precise
+    // opener for LONG bans.
     try {
-      sendGate.openFloodWindow('global', Date.now() + Math.max(0, retryAfterSec) * 1000)
+      sendGate.openScopedFloodWindows(opts, Date.now() + Math.max(0, retryAfterSec) * 1000)
     } catch {
       /* best-effort — never let the window hook break the retry path */
     }
@@ -5661,6 +5657,9 @@ const sendGateStatsLogger = createStatsLogger({
 const floodWindowObserver = createFloodWindowObserver({
   clock: { now: () => Date.now(), sleep: (ms) => new Promise((r) => setTimeout(r, ms)) },
   log: (line) => process.stderr.write(line),
+  // Render the operator-facing flood alerts in the configured local timezone
+  // (same env the config cascade bakes into every agent — see timezone.ts).
+  tz: process.env.SWITCHROOM_TIMEZONE ?? process.env.TZ ?? 'UTC',
   stats: () => sendGate.stats(),
   readWindows: (now) => readFloodWindows(FLOOD_WINDOWS_PATH, now),
   markAlerted: (scopeKey, alertedAt) =>
@@ -5681,7 +5680,7 @@ const floodWindowObserver = createFloodWindowObserver({
     )
   },
 })
-if (sendGateEnabledFromEnv()) {
+if (sendGateConfig.enabled) {
   const observeTimer = setInterval(() => {
     try {
       sendGateStatsLogger.tick()
@@ -6753,10 +6752,19 @@ function isAutoFallbackCooldownActive(_agentName: string, now: number): boolean
 
 async function editCardExpired(chatId: string, messageId: number | undefined, body: string): Promise<void> {
   if (messageId == null) return
-  await lockedBot.api
-    // allow-raw-bot-api: message-id-targeted edit (no thread to lose); best-effort card-expiry strip from the reaper (no grammy ctx). Dropping reply_markup strips the stale keyboard atomically with the text edit.
-    .editMessageText(chatId, messageId, richMessage(body), { reply_markup: { inline_keyboard: [] } })
-    .catch(() => {})
+  // #3084 bypass audit: this best-effort card-expiry strip (reaper + lazy
+  // sweeps, no grammy ctx) previously fired a RAW `lockedBot.api.editMessageText`
+  // OUTSIDE the send gate — a residual flood vector (a 429 here never reached
+  // `onFloodWait`, so the breaker stayed blind). Routed through `robustApiCall`
+  // (chat-lock → send-gate → retry/breaker) as a `cosmetic` edit carrying
+  // messageId+editPayload so it paces/sheds under pressure and its 429 records
+  // the flood window. Dropping reply_markup strips the stale keyboard atomically
+  // with the text edit; message-id-targeted so no thread to lose.
+  const text = richMessage(body)
+  await robustApiCall(
+    () => lockedBot.api.editMessageText(chatId, messageId, text, { reply_markup: { inline_keyboard: [] } }),
+    { chat_id: chatId, verb: 'card-expired.strip', priorityClass: 'cosmetic', messageId, editPayload: body },
+  ).catch(() => {})
 }
 
 function recordMissedApproval(opts: {
@@ -7100,20 +7108,13 @@ function postPermissionCard(
         const landedThreadId = sent.message_thread_id ?? undefined
         live.cards.push({ chatId, messageId: sent.message_id, threadId: landedThreadId })
         // The card LANDED — the operator can see and tap it, so the block is over.
-        // Drop the hold mark and reconcile the off-Telegram surface. (PR 3 also
-        // resets `startedAt` here: the TTL measures how long the operator had to
-        // answer, and until this moment they had nothing to answer.)
-        if (live.undeliverable != null) {
-          live.undeliverable = null
-          live.redeliveryFailures = 0
-          // RESET THE TTL CLOCK. Load-bearing, not cosmetic. `startedAt` is when
-          // the agent asked; the TTL measures how long the operator had to
-          // answer. Until this instant they had NOTHING to answer — the card did
-          // not exist in any chat. Without the reset, a card held through a 4.6h
-          // ban lands already-expired against a 60-min TTL and the very next
-          // reaper tick auto-denies it: we would have MOVED the silent denial,
-          // not removed it.
-          live.startedAt = Date.now()
+        // Drop the hold mark, reset the TTL clock, and reconcile the off-Telegram
+        // surface — as ONE shared decision (`applyDeliveredHoldReset`, #3128) that
+        // the outcome test's harness ALSO drives, so deleting the `startedAt` reset
+        // turns the behavioural `(d2)` test red instead of only a fragile grep.
+        // PR 3: the reset is load-bearing — the TTL measures how long the operator
+        // had to answer, and until this moment they had nothing to answer.
+        if (applyDeliveredHoldReset(live, Date.now())) {
           reconcileBlockedApprovals()
           process.stderr.write(
             `telegram gateway: permission-card RE-DELIVERED request=${requestId} ` +
@@ -7713,11 +7714,14 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
   // account-scoped 429s with fleet TPM even when the card is suppressed.
   let throttleEscalation: ModelUnavailableDetection | null = null
   let escalationFired = false
+  // True when decideRateLimitedSurface already consulted (and armed) the
+  // shared per-kind card cooldown for this event — the gate below must not
+  // re-consult it, or the arm from the first consult would self-suppress.
+  let rateLimitedCooldownConsulted = false
   const rateLimit429Classification =
     kind === 'rate-limited' ? classify429Detail(event.detail) : null
   if (rateLimit429Classification != null && rateLimit429Classification !== 'account-scoped') {
-    // litellm-local / generic-transient: the existing calm rate-limited
-    // path (fall through to renderOperatorEvent below). NO broker
+    // litellm-local / generic-transient: the calm path. NO broker
     // mark-throttled, NO throttle-tier runner, NO failover — for a
     // proxy-local cap trip those would bench an account that was never
     // touched.
@@ -7730,12 +7734,49 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
         now: Date.now(),
       }),
     )
-    if (rateLimit429Classification === 'litellm-local') {
+    // Surface decision — extracted (decideRateLimitedSurface,
+    // litellm-local-notice-wiring.ts) so the ordering contract with the
+    // shared per-kind card cooldown is pinnable by tests: litellm-local
+    // resolves BEFORE the gate (never arms `${agent}:rate-limited`, never
+    // suppressed by a cooldown a recent 529/generic card armed);
+    // generic-transient consults the gate exactly once HERE.
+    const surface = decideRateLimitedSurface({
+      classification: rateLimit429Classification,
+      agent,
+      shouldEmitCard: (a) => shouldEmitOperatorEvent(a, 'rate-limited'),
+    })
+    if (surface === 'litellm-local-notice') {
       process.stderr.write(
         `telegram gateway: 429 classified litellm-proxy-local agent=${agent} — ` +
           `calm path, no account attribution, no failover\n`,
       )
+      // The dedicated debounced notice REPLACES the generic "🚦 Rate limited"
+      // card for this classification only: one calm message naming the fleet
+      // token limiter (LiteLLM tpm_limit/rpm_limit) instead of a card that
+      // reads like an Anthropic account problem. Classification, quota-ledger,
+      // and failover behavior are untouched (nothing fired above on this
+      // branch). Record into history ONLY when a notice actually posted — a
+      // suppressed low-stakes proxy throttle must not overwrite a more
+      // important most-recent event (e.g. credentials-expired) in the
+      // /status enrichment (operator-events-history keeps the most recent
+      // event per agent).
+      const outcome = litellmLocalNoticeRunner.onRateLimited('litellm-local', agent)
+      if (outcome === 'sent') {
+        try {
+          recordOperatorEvent(event)
+        } catch { /* history is best-effort */ }
+      }
+      return
+    }
+    if (surface === 'cooldown-suppressed') {
+      process.stderr.write(
+        `telegram gateway: operator-event suppressed (cooldown) agent=${agent} kind=${kind}\n`,
+      )
+      return
     }
+    // 'generic-card' — the gate passed (and armed) above; fall through to
+    // the existing calm rate-limited card without re-consulting it.
+    rateLimitedCooldownConsulted = true
   }
   if (rateLimit429Classification === 'account-scoped') {
     const throttleDecision = decideThrottleTier({
@@ -7800,7 +7841,7 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     }
   }
 
-  if (!shouldEmitOperatorEvent(agent, kind)) {
+  if (!rateLimitedCooldownConsulted && !shouldEmitOperatorEvent(agent, kind)) {
     process.stderr.write(
       `telegram gateway: operator-event suppressed (cooldown) agent=${agent} kind=${kind}\n`,
     )
@@ -7897,6 +7938,28 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
       // the old account fails — honest reset messaging on the enriched card.
       void fireFleetAutoFallback(agent, untilMs, modelUnavailable.resetAt)
     }
+  } else if (kind === 'rate-limited' || kind === 'unknown-5xx') {
+    // #llm-error-surfacing — surface #2 (the "🚦 Rate limited" operator card).
+    // The transient rate-limit / overload family used to render the raw
+    // synthetic-error `detail` (bytes and all) via renderOperatorEvent. Route
+    // it through the humanized card instead: JSON-stripped coreText + reset in
+    // LOCAL time. The ErrorPresenceGate is the cross-surface dedup authority —
+    // the reply/done-card surfaces are already suppressed at the transcript
+    // source (session-tail), so the operator card is the sole renderer and
+    // wins the claim; a redundant burst within the collapse window is
+    // suppressed here in addition to the existing 5-min per-kind cooldown.
+    const parsed = parseLlmError(event.detail)
+    const now = Date.now()
+    if (decideErrorSurface(parsed, agent, { claim: true, now }) === 'suppress') {
+      process.stderr.write(
+        `telegram gateway: operator-event collapsed (error-presence-gate) agent=${agent} kind=${kind}\n`,
+      )
+      return
+    }
+    const tz = process.env.SWITCHROOM_TIMEZONE ?? process.env.TZ ?? 'UTC'
+    const r = renderLlmError(parsed, agent, tz, new Date(now))
+    renderedText = r.text
+    renderedKeyboard = r.keyboard
   } else {
     try {
       const r = renderOperatorEvent(event)
@@ -8565,6 +8628,17 @@ async function runMidSessionCardReaper(): Promise<void> {
       const reaps = decideWorkerPinReaps({
         pins: candidates,
         statusOf: (agentId) => {
+          // #3207: coalesced feed pins are GROUP-level (`wk:group:<feedKey>`),
+          // so `workerAgentIdOfPinKey` yields `group:<feedKey>`, not a real
+          // jsonl agent id. Vouch for these off the live feed instead of the
+          // registry: a group the feed still tracks is 'running' (exempt from
+          // the TTL); a lingering group pin the feed no longer knows about is a
+          // missed unpin → 'terminal' (reap now). The feed's own group-empty
+          // unpin is the primary path; this is the missed-unpin backstop.
+          if (agentId.startsWith('group:')) {
+            const feedKey = agentId.slice('group:'.length)
+            return workerActivityFeed?.hasRunningInFeed(feedKey) ? 'running' : 'terminal'
+          }
           if (turnsDb == null) return 'unknown'
           try {
             const row = getSubagentByJsonlId(turnsDb, agentId)
@@ -8723,34 +8797,14 @@ async function reconcileStatusPinInner(
   }
 }
 
-/**
- * Background-worker desired-pin, driven off the live `🛠 Worker` message.
- * Reads the worker feed's current message_id (the EXISTING message — we pin
- * what the feed already rendered, never a new send) and reconciles a silent
- * pin while it's running / an unpin on completion. No-op until the feed has
- * actually painted a message for this worker (trivial sub-second workers stay
- * silent and are never pinned). Keyed `wk:<agentId>`.
- */
-function reconcileWorkerPin(
-  agentId: string,
-  chatId: string | null,
-  running: boolean,
-): void {
-  if (!PIN_STATUS_WHILE_WORKING) return
-  const key = `wk:${agentId}`
-  if (!running) {
-    // Unpin: recover the chat we pinned in (caller may not have it at
-    // completion). No-op when nothing was pinned for this worker.
-    const unpinChat = chatId ?? statusPinChatIds.get(key)
-    if (unpinChat == null) return
-    void reconcileStatusPin(key, unpinChat, { pinned: false })
-    return
-  }
-  if (chatId == null) return
-  const messageId = workerActivityFeed?.messageIdOf(agentId) ?? null
-  if (messageId == null) return // no message painted yet — nothing to pin
-  void reconcileStatusPin(key, chatId, { pinned: true, messageId })
-}
+// #3207: the per-worker `reconcileWorkerPin(agentId, …)` (keyed `wk:<agentId>`)
+// was removed. Now that background workers COALESCE into one shared message per
+// chat/thread, the pin is driven at the GROUP level by the feed itself
+// (`reconcilePin` → `wk:group:<feedKey>`, wired at createWorkerActivityFeed):
+// it pins when the group's first worker paints and unpins only when the group
+// empties. A per-worker unpin used to physically unpin a message a sibling
+// still needed, after which the survivor's re-pin NO-OP'd (its claim still
+// named that id) — leaving live work unpinned (review blocker).
 
 /** Unpin every owned status pin — used by the pre-restart sweep so a
  *  crash / interrupt never leaves a permanent pin behind. Best-effort;
@@ -10334,6 +10388,13 @@ const bridgeDeadWatchdog = createBridgeDeadWatchdog({
   // consecutive-escalation count. At the cap, arm() stands down loudly
   // instead of restart-looping a deterministically-failing bridge.
   priorStreak: bridgeDeadPriorStreak,
+  // #3086 — only THIS gateway's own primary bridge (registering under
+  // $SWITCHROOM_AGENT_NAME) drives the watchdog. A secondary/relay client
+  // (e.g. `overlord-relay`) registering a different name into this socket
+  // is named + non-cron but must NOT mark the (still-alive) primary bridge
+  // dead when it disconnects. Empty string ⟹ fall back to the pre-#3086
+  // "any named non-cron client" test inside the watchdog.
+  selfAgentName: process.env.SWITCHROOM_AGENT_NAME ?? '',
 })
 if (BRIDGE_DEAD_ESCALATION_ENABLED) {
   bridgeDeadWatchdog.arm()
@@ -10373,21 +10434,12 @@ const ipcServer: IpcServer = createIpcServer({
       : []
     // #3038 — a REAL (named, non-cron) bridge registered: stand the
     // bridge-dead watchdog down. Anonymous clients (recall.py, mcp
-    // handshakes) and cron-session bridges must NOT satisfy it — the
-    // watchdog gates on the identity INTERNALLY (isRealBridgeIdentity), so
-    // this call is safe wherever it sits relative to the cron early-return
-    // above (#3038 review finding 5).
+    // handshakes), cron-session bridges, and secondary/relay clients
+    // registering a name other than this gateway's own agent (#3086) must
+    // NOT satisfy it — the watchdog gates on the identity INTERNALLY
+    // (isRealBridgeIdentity vs selfAgentName), so this call is safe wherever
+    // it sits relative to the cron early-return above (#3038 review finding 5).
     bridgeDeadWatchdog.noteBridgeRegistered(client.agentName)
-    // #3043 item 2: a REAL bridge registering is proof the boot came all the
-    // way up healthy — clear start.sh's crashloop boot-attempts counter so only
-    // boots that genuinely fail BEFORE the bridge registers accumulate toward
-    // the 3-strike override clear. Without this, three quick operator
-    // hand-bounces of a healthy agent (each <150s apart) spuriously wipe a
-    // working model override. Best-effort; no-op when the file is absent.
-    if (client.agentName != null) {
-      const smBootDir = resolveAgentDirFromEnv()
-      if (smBootDir != null) clearSessionModelBootAttempts(smBootDir)
-    }
     client.send({ type: 'status', status: 'agent_connected' })
 
     // Phase 2b PR 3a — bridgeUp cutover. The state machine's `bridgeUp`
@@ -10580,8 +10632,10 @@ const ipcServer: IpcServer = createIpcServer({
       // #3038 — the real bridge went away mid-life. Re-arm the grace
       // window: a normal claude restart re-registers within seconds and
       // stands it down; a bridge that died for good escalates once (the
-      // once-per-boot fuse inside the watchdog caps it). Cron/anonymous
-      // identities are ignored inside the watchdog itself (finding 5).
+      // once-per-boot fuse inside the watchdog caps it). Cron/anonymous and
+      // secondary/relay identities (a name other than this gateway's own
+      // agent, #3086) are ignored inside the watchdog itself (finding 5) —
+      // so a transient relay disconnect never bounces a healthy container.
       if (BRIDGE_DEAD_ESCALATION_ENABLED) bridgeDeadWatchdog.noteBridgeDisconnected(client.agentName)
     }
 
@@ -21821,15 +21875,10 @@ function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & M
         })
       }
       stampUserRestartReason(reason)
-      // Model-switch restarts are switchroom-managed relaunches: the session
-      // override (written by the caller before this dispatch) must survive
-      // the bounce, so stamp keep-intent BEFORE dispatch (boot default is
-      // revert). hostd shells through `switchroom agent restart`, which
-      // deliberately writes no intent of its own.
-      {
-        const smDir = resolveAgentDirFromEnv()
-        if (smDir) writeRelaunchModelIntent(smDir, 'keep', reason)
-      }
+      // Model-switch restarts are the APPLY-relaunch for a `.session-model`
+      // carrier the caller wrote immediately above: start.sh consumes it on
+      // the very next boot (this dispatch's boot), then reverts thereafter.
+      // No keep/revert intent is needed — the carrier is consume-once.
       await sweepBeforeSelfRestart()
       const hostdResp = await tryHostdDispatch(name, {
         v: 1,
@@ -21850,14 +21899,11 @@ function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & M
         return
       }
       // hostd is configured but returned an error/denied result. No restart
-      // is coming, so the keep-intent stamped above must not linger — a
-      // crash within its 10-min freshness window would wrongly KEEP.
+      // is coming, so the carrier the caller wrote must not linger to be
+      // consumed by an unrelated later boot — scheduleModelRelaunch's catch
+      // rolls it back on this throw.
       if (hostdResp.result !== 'started' && hostdResp.result !== 'completed') {
         clearRestartMarker()
-        {
-          const smDir = resolveAgentDirFromEnv()
-          if (smDir) clearRelaunchModelIntent(smDir)
-        }
         throw new Error(
           `hostd restart failed (result=${hostdResp.result}): ${hostdResp.error ?? '(no details)'}`,
         )
@@ -21866,11 +21912,11 @@ function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & M
     /**
      * Switch TO a model that needs a relaunch (sr-* LiteLLM/OpenRouter ids,
      * which claude's native `/model` picker rejects, and the sr-to-claude
-     * direction). Write the DURABLE `.session-model` override (start.sh
-     * applies it on every keep-relaunch boot and launches `claude --model
-     * <token>`), set the in-memory session-model so /status stays honest
-     * across the restart window, then run the SAME restart dispatch as
-     * scheduleRestart above — which stamps the keep-intent this boot needs.
+     * direction). Write the CONSUME-ONCE `.session-model` carrier (start.sh
+     * applies it on the very next boot — this dispatch's apply-relaunch — and
+     * deletes it, so it reverts on any subsequent restart), set the in-memory
+     * session-model so /status stays honest across the restart window, then
+     * run the SAME restart dispatch as scheduleRestart above.
      */
     scheduleModelRelaunch: async (model: string, reason: string) => {
       const agentDir = resolveAgentDirFromEnv()
@@ -21887,20 +21933,15 @@ function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & M
       try {
         await deps.scheduleRestart(reason)
       } catch (err) {
-        // A restart already in flight OWNS the override we just wrote — its
-        // boot (stamped keep by the in-flight path's own intent, last-writer-
-        // wins) will apply our token, so the switch is queued, not lost: keep
-        // the file + override and let the caller tell the operator "~15s".
-        // Any OTHER dispatch failure means no restart is coming, so roll BOTH
-        // back — a lingering file/override would lie to /status and
-        // mis-launch the NEXT relaunch. The keep-intent goes with them
-        // (belt-and-braces: scheduleRestart's failure branch clears it too):
-        // a fresh keep on disk with no restart coming would wrongly KEEP
-        // across a crash inside its 10-min window.
+        // A restart already in flight OWNS the carrier we just wrote — its
+        // boot will consume+apply our token, so the switch is queued, not
+        // lost: keep the file + override and let the caller tell the operator
+        // "~15s". Any OTHER dispatch failure means no restart is coming, so
+        // roll BOTH back — a lingering carrier would lie to /status and be
+        // consumed (mis-applied) by an unrelated later boot.
         if ((err as { code?: string })?.code !== 'restart_in_flight') {
           restoreSessionModelFileRaw(agentDir, prevFileRaw)
           sessionModelSource.setOverride(prevOverride)
-          clearRelaunchModelIntent(agentDir)
         }
         throw err
       }
@@ -21921,19 +21962,24 @@ function modelMenuReplyMarkup(reply: ModelMenuReply): InlineKeyboard | undefined
 
 /**
  * Record a POSITIVELY-CONFIRMED typed `/model` switch: set the in-memory
- * override so `/status` reflects the live model and persist the sticky
- * `.session-model` carrier. Shared by the live `bot.command('model')` handler
- * and the deferred (queued mid-turn) apply so both record identically. Returns
- * a persist-warning suffix to append to the reply body (empty when clean).
+ * override so `/status` reflects the live model. Shared by the live
+ * `bot.command('model')` handler and the deferred (queued mid-turn) apply so
+ * both record identically. Returns a warning suffix to append to the reply
+ * body (currently always empty — kept for a stable signature).
  *
- * The `/status` honesty invariant lives here: only `reply.selectedModel`
- * (present only on a confirmed switch) records; an unverified inject records
- * nothing. `/model default` clears the carrier idempotently.
+ * Session-scoped (rev 4): a live Claude `/model` switch writes NO
+ * `.session-model` carrier — it applies in-session and the explicit
+ * `claude --model <configured>` flag reverts it on the next boot, so it lasts
+ * exactly until the next restart with no durable state. (sr-* switches never
+ * reach here — they go through scheduleModelRelaunch, which owns the
+ * consume-once carrier.) The `/status` honesty invariant lives here: only
+ * `reply.selectedModel` records; an unverified inject records nothing.
+ * `/model default` clears any in-memory override and any leftover carrier.
  */
 function recordTypedModelSwitch(
   reply: { text: string; selectedModel?: string },
   requestedModelArg: string | null,
-  deps: ModelCommandDeps,
+  _deps: ModelCommandDeps,
 ): string {
   const requested = requestedModelArg != null ? expandSrAlias(requestedModelArg) : null
   if (requested?.toLowerCase() === 'default') {
@@ -21944,28 +21990,18 @@ function recordTypedModelSwitch(
   }
   if (!reply.selectedModel) return ''
   sessionModelSource.setOverride(reply.selectedModel)
-  const smDir = resolveAgentDirFromEnv()
-  if (smDir && requested && isValidModelArg(requested) && !isSrModel(requested)) {
-    try {
-      writeSessionModelFile(
-        smDir,
-        requested,
-        readConfiguredDefaultModel(smDir) ??
-          resolveMainModel(deps.getConfiguredModel() ?? undefined),
-      )
-    } catch (err) {
-      process.stderr.write(
-        `telegram gateway: session-model persist failed (typed /model): ${(err as Error)?.message ?? String(err)}\n`,
-      )
-      return '\n⚠️ Couldn’t persist the sticky override — the switch is live now but won’t survive a relaunch.'
-    }
-  }
+  // A manual /model apply to the dropped premium clears any pending recovery
+  // marker so the "available again" ping can't still fire after the user has
+  // already switched back themselves.
+  clearPremiumRecoveryOnManualSwitch(reply.selectedModel)
   return ''
 }
 
 /**
- * Record a model-MENU callback outcome (persist/clear sticky override) and
- * drive an sr-*→Claude graceful restart when the tap crosses that boundary.
+ * Record a model-MENU callback outcome (set the live in-memory override, clear
+ * a leftover carrier on a Default tap) and drive an sr-*→Claude graceful
+ * restart when the tap crosses that boundary — the only menu path that writes a
+ * consume-once `.session-model` carrier (a live Claude tap writes none, rev 4).
  * Extracted from the live `mdl:*` dispatcher so the deferred (queued mid-turn)
  * apply records + restarts identically. Does NOT edit any Telegram message —
  * callers own the card edit. Returns a restart notice when a session restart
@@ -21979,29 +22015,18 @@ function recordModelMenuSideEffects(
   prevSessionModel: string | null,
 ): { restartNotice?: string } {
   // Record a successful session switch so /status reflects what's actually
-  // running, and persist the STICKY override
-  // (reference/rfcs/session-model-stickiness.md): the canonical token (never
-  // the display label) goes to the durable `.session-model`; a confirmed
-  // "Default (recommended)" selection clears it instead.
+  // running. Session-scoped (rev 4): a live Claude menu tap writes NO
+  // `.session-model` carrier — it applies in-session (native picker) and
+  // reverts on the next boot. Only the sr→Claude transition below (which
+  // relaunches) writes the consume-once carrier. A confirmed "Default
+  // (recommended)" selection clears any leftover carrier.
   if (outcome.selectedModel) {
     sessionModelSource.setOverride(outcome.selectedModel)
-    const smDir = resolveAgentDirFromEnv()
-    if (smDir && outcome.selectedModelToken) {
-      try {
-        writeSessionModelFile(
-          smDir,
-          outcome.selectedModelToken,
-          readConfiguredDefaultModel(smDir) ??
-            resolveMainModel(modelDeps.getConfiguredModel() ?? undefined),
-        )
-      } catch (err) {
-        outcome.reply.text +=
-          '\n⚠️ Couldn’t persist the sticky override — the switch is live now but won’t survive a relaunch.'
-        process.stderr.write(
-          `telegram gateway: session-model persist failed (menu): ${(err as Error)?.message ?? String(err)}\n`,
-        )
-      }
-    }
+    // Clear a pending premium-recovery marker when the tap re-selects the
+    // dropped premium (menu OR the recovery ping's own switch-back button):
+    // no stale "available again" ping once we're back on it. Idempotent — the
+    // ping-send path already consumed the marker, so this is a no-op there.
+    clearPremiumRecoveryOnManualSwitch(outcome.selectedModel)
   }
   if (outcome.clearedDefault) {
     const smDir = resolveAgentDirFromEnv()
@@ -22013,9 +22038,11 @@ function recordModelMenuSideEffects(
   // torn down — a graceful restart (same mechanism as /restart) is required.
   if (outcome.selectedModel && isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)) {
     const agentName = getMyAgentName()
-    // Carry the requested Claude model across the restart via the SAME durable
-    // `.session-model` override a Claude → sr-* switch uses — otherwise boot
-    // launches the CONFIGURED default and the tapped model is silently dropped.
+    // Carry the requested Claude model across the restart via the SAME
+    // consume-once `.session-model` carrier a Claude → sr-* switch uses —
+    // otherwise this transition's apply-relaunch boots the CONFIGURED default
+    // and the tapped model is silently dropped. Applied on that one boot,
+    // then reverts on the next restart (rev 4).
     const agentDir = resolveAgentDirFromEnv()
     const token = outcome.selectedModelToken
     if (agentDir && token) {
@@ -22178,20 +22205,19 @@ function persistQueuedCommandForRestart(action: ShutdownResolutionAction): strin
     switch (action.persist) {
       case 'model': {
         // #3042 blocker 2a: this token was QUEUED, never confirmed by claude.
-        // Under the keep-by-default boot a garbage-but-shape-valid token
-        // persisted here would crashloop `claude --model <garbage>` with the
-        // gateway dead. Only offline-trustable tokens (static Claude aliases,
-        // curated sr-* alias targets) may be persisted unconfirmed; anything
-        // else gets the honest "couldn't verify — re-issue" card instead.
+        // The carrier is written immediately before the bounce, so the next
+        // boot IS its apply-relaunch: consume-once means a garbage token can
+        // crash at most one boot before it reverts, but we still gate on
+        // offline-trustable tokens (static Claude aliases, curated sr-* alias
+        // targets) to avoid even that one crash-boot; anything else gets the
+        // honest "couldn't verify — re-issue" card instead.
         if (!isOfflineTrustedModelToken(action.arg)) {
           return `↩️ Couldn’t verify \`${escapeHtmlForTg(action.cmd.targetLabel || action.arg)}\` as a known model without the live session — it was NOT saved. Re-issue \`/model ${escapeHtmlForTg(action.arg)}\` once the agent is back.`
         }
         const configured =
           readConfiguredDefaultModel(agentDir) ?? resolveMainModel(undefined)
+        // Consume-once carrier: applied by the next boot, then reverts.
         writeSessionModelFile(agentDir, expandSrAlias(action.arg), configured)
-        // Boot default is keep (#3039), but stamp explicit keep-intent for
-        // reason-honesty in the boot notice.
-        writeRelaunchModelIntent(agentDir, 'keep', 'queued /model carried across restart')
         break
       }
       case 'clear-model':
@@ -22281,17 +22307,50 @@ bot.command('model', async ctx => {
   const parsed = parseModelCommand(text) ?? { kind: 'show' as const }
   const chatId = String(ctx.chat!.id)
   const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id)
+  // #3177 — durable receipt FIRST. A typed /model must NEVER be invisible: even
+  // if every downstream reply is shed/dropped, or the session is in a
+  // phantom-idle window (turn atom cleared while claude is still busy), the
+  // command leaves a greppable log line + a history row before any branch. This
+  // is the fix for the finn 2026-07-12 zero-trace swallow (no log, no reply, no
+  // ack, no deferred apply). `busyNow` folds BOTH busy signals (turn atom AND
+  // the authoritative delivery-machine/approval gate).
+  const busyNow = currentTurn !== null || turnInFlightForGate()
+  process.stderr.write(modelCommandReceiptLine(getMyAgentName(), parsed, busyNow) + '\n')
+  if (HISTORY_ENABLED && ctx.message?.message_id != null) {
+    try {
+      recordInbound({
+        chat_id: chatId,
+        thread_id: threadId ?? null,
+        message_id: ctx.message.message_id,
+        user: ctx.from?.username ?? (ctx.from?.id != null ? String(ctx.from.id) : null),
+        user_id: ctx.from?.id != null ? String(ctx.from.id) : null,
+        ts: ctx.message.date ?? Math.floor(Date.now() / 1000),
+        text,
+      })
+    } catch (err) {
+      process.stderr.write(`telegram gateway: /model recordInbound failed: ${(err as Error)?.message ?? String(err)}\n`)
+    }
+  }
   const deps = buildModelDeps({ chatId, threadId })
-  if (parsed.kind === 'show' && process.env.SWITCHROOM_MODEL_MENU !== '0') {
+  // Route on a pure disposition (#3177) that folds BOTH busy signals so a
+  // session busy by EITHER measure ack+queues instead of silently injecting
+  // into a busy pane. Every branch below produces a visible action.
+  const disposition = planModelCommand(parsed, {
+    currentTurnActive: currentTurn !== null,
+    turnInFlight: turnInFlightForGate(),
+    menuEnabled: process.env.SWITCHROOM_MODEL_MENU !== '0',
+  })
+  if (disposition.kind === 'menu') {
     const menu = await buildModelMenu(deps)
     await switchroomReply(ctx, menu.text, { html: true, reply_markup: modelMenuReplyMarkup(menu) })
     return
   }
-  // Mid-turn: instead of dead-ending ("Try again in a moment"), ACK + QUEUE +
-  // apply-on-idle + confirm (#3017). The typed set path either injects into
-  // claude's input box or triggers a carrier restart — both unsafe mid-turn.
-  if (parsed.kind === 'set' && deps.isBusy()) {
-    const target = expandSrAlias(parsed.model)
+  // Mid-turn (by either busy signal): instead of dead-ending ("Try again in a
+  // moment") or silently injecting into a busy pane, ACK + QUEUE + apply-on-idle
+  // + confirm (#3017/#3177). The typed set path either injects into claude's
+  // input box or triggers a carrier restart — both unsafe while busy.
+  if (disposition.kind === 'queue') {
+    const target = disposition.target
     const sent = await ctx.replyWithRichMessage(
       richMessage(hardenCardBreaks(pendingCmdAckText('model', target, escapeHtmlForTg))),
       threadId != null ? { message_thread_id: threadId } : {},
@@ -22331,39 +22390,38 @@ bot.command('model', async ctx => {
 // is blocklisted for `/effort` since #2471), session-scoped — boot re-pins
 // the configured default via start.sh's `--effort`. Implementation in
 // effort-command.ts so it's unit-testable without booting the bot.
+
+// The live session-effort override, in memory only (#3186, session-scoped
+// like /model rev 4). A confirmed live apply records here — NOT to the
+// `.session-effort` carrier — so it lasts exactly until the next restart
+// (start.sh's explicit `--effort <configured>` reverts it for free). Seeded
+// at boot from `.active-session-effort` (the effort sibling of
+// `.active-session-model`) so a queued-carrier apply-boot still shows the
+// honest live level on the /effort menu.
+let sessionEffortOverride: string | null = null
+
 function buildEffortDeps(): EffortCommandDeps {
   return {
-    // #3039: single persistence choke point — EVERY positively-confirmed
-    // effort apply (typed, menu tap, queued drain) durably records the level
-    // to `.session-effort`, which start.sh resolves into `--effort` on every
-    // boot. `/effort default` clears it via clearSessionEffort (the handler
-    // clears AFTER its restore-apply, so the wrapper's write is undone).
+    // Session-scoped (#3186): a positively-confirmed live apply records the
+    // level IN MEMORY only — no durable carrier. The `.session-effort`
+    // carrier is written solely by persistQueuedCommandForRestart (a queued
+    // mid-turn /effort carried across the bounce) and is consume-once at
+    // boot. `/effort default` clears via clearSessionEffort below.
     applyEffort: async (agent, level) => {
       const result = await applyEffort(agent, level)
-      if (result.ok) {
-        const agentDir = resolveAgentDirFromEnv()
-        if (agentDir) {
-          try {
-            writeSessionEffortFile(agentDir, level, getConfiguredEffortForPersist())
-          } catch (err) {
-            process.stderr.write(
-              `telegram gateway: session-effort persist failed level=${level}: ${(err as Error)?.message ?? String(err)}\n`,
-            )
-          }
-        }
-      }
+      if (result.ok) sessionEffortOverride = level
       return result
     },
     getAgentName: getMyAgentName,
     getConfiguredEffort: () => getConfiguredEffortForPersist(),
     clearSessionEffort: () => {
+      sessionEffortOverride = null
+      // Also drop any leftover queued-command carrier so the next boot can't
+      // consume a stale level the user just cleared.
       const agentDir = resolveAgentDirFromEnv()
       if (agentDir) clearSessionEffortFile(agentDir)
     },
-    getSessionEffort: () => {
-      const agentDir = resolveAgentDirFromEnv()
-      return agentDir ? (readSessionEffortFile(agentDir)?.level ?? null) : null
-    },
+    getSessionEffort: () => sessionEffortOverride,
     escapeHtml: escapeHtmlForTg,
   }
 }
@@ -22508,14 +22566,10 @@ bot.command('restart', async ctx => {
     // greeting card shows "Restarted  user: /restart from chat" instead
     // of whatever reason the downstream CLI would default to.
     stampUserRestartReason('user: /restart from chat')
-    // #3039: /restart is "bounce the session", NOT "clear my model" — the
-    // durable override survives every restart and is cleared only by
-    // `/model default`. Stamp keep for reason-honesty in the boot notice
-    // (absence of intent keeps anyway under the keep-by-default boot).
-    {
-      const smDir = resolveAgentDirFromEnv()
-      if (smDir) writeRelaunchModelIntent(smDir, 'keep', 'user: /restart from chat')
-    }
+    // Session-scoped (rev 4): /restart reverts any live /model override to the
+    // configured default. A consume-once `.session-model` carrier (if one was
+    // in flight) was already consumed by its own apply-relaunch, so nothing to
+    // do here — start.sh boots the configured default.
     await sweepBeforeSelfRestart()
     const hostdResp = await tryHostdDispatch(getMyAgentName(), {
       v: 1,
@@ -22674,12 +22728,8 @@ async function handleNewCommand(ctx: Context): Promise<void> {
   // Stamp user attribution so the next greeting shows "Restarted  user:
   // /new" / "user: /reset" rather than the downstream CLI default.
   stampUserRestartReason(`user: /${kind} from chat`)
-  // /new and /reset start a fresh CONVERSATION, not a fresh model choice:
-  // the sticky session-model override KEEPS across them (contract row 7).
-  // Boot default is revert, so the keep-intent must land before dispatch.
-  if (agentDir != null) {
-    writeRelaunchModelIntent(agentDir, 'keep', `user: /${kind} from chat`)
-  }
+  // Session-scoped (rev 4): /new and /reset are restarts, so they revert any
+  // live /model override to the configured default — no carrier to preserve.
   await sweepBeforeSelfRestart()
   const hostdResp = await tryHostdDispatch(getMyAgentName(), {
     v: 1,
@@ -23459,6 +23509,46 @@ const throttleTierRunner = createThrottleTierRunner({
   log: (m) => process.stderr.write(`telegram gateway: ${m}\n`),
 })
 
+// ─── litellm-local 429 notice — side-effect wiring ──────────────────────────
+// State machine + text + config parsing live in litellm-local-notice.ts
+// (pure); the sequencing (classification guard → per-agent cooldown →
+// broadcast + metric) lives in litellm-local-notice-wiring.ts so it is
+// unit-testable with injected deps. This block only binds the real gateway
+// dependencies. Deliberately NO broker surface: the litellm-local calm
+// path's invariant is that account state is never touched.
+const litellmLocalNoticeRunner = createLitellmLocalNoticeRunner({
+  listNoticeChats: () => loadAccess().allowFrom,
+  sendNotice: (chat_id, markdown) => {
+    // Topic routing — this notice REPLACES the generic operator-event card
+    // for the litellm-local classification, so it must land where that card
+    // would have: supergroup-mode agents route system notifications into the
+    // alerts/admin alias topic ('compact-watchdog' kind, same resolution as
+    // the emitGatewayOperatorEvent broadcast loop), while DM recipients get
+    // a thread-less send (topicForRecipient guards the #2096 "message
+    // thread not found" misrouting class).
+    const noticeTopic = resolveAgentOutboundTopic({ kind: 'compact-watchdog' })
+    const noticeSupergroup = resolveAgentSupergroupChatId()
+    const noticeThread = topicForRecipient({
+      recipientChatId: chat_id,
+      resolvedTopic: noticeTopic,
+      supergroupChatId: noticeSupergroup,
+    })
+    // Status notice, not the user's answer — silence the ping (same posture
+    // as the throttle-tier / fleet-fallback announcements).
+    void swallowingApiCall(
+      // allow-raw-bot-api: wrapped in swallowingApiCall (retry policy)
+      () => bot.api.sendRichMessage(chat_id, richMessage(markdown), {
+        disable_notification: true,
+        ...(noticeThread != null ? { message_thread_id: noticeThread } : {}),
+      }),
+      { chat_id: String(chat_id), verb: 'litellm-local-notice:notify' },
+    )
+  },
+  windowMs: () => parseLitellmNoticeWindowMs(loadAccess().litellmNoticeWindowMs),
+  emitMetric: (event) => emitRuntimeMetric(event),
+  log: (m) => process.stderr.write(`telegram gateway: ${m}\n`),
+})
+
 /**
  * Broadcast a fleet-fallback FAILURE notice to every authorized chat.
  *
@@ -23516,6 +23606,173 @@ function broadcastFleetFallbackFailure(triggerAgent: string, reason: string): vo
   }
 }
 
+/**
+ * Broadcast a status notice to every authorized chat (system notice posture:
+ * silenced ping, wrapped send). Shared by the tier-downgrade notices below.
+ */
+function broadcastTierNotice(markdown: string): void {
+  const access = loadAccess()
+  if (access.allowFrom.length === 0) return
+  for (const chat_id of access.allowFrom) {
+    void swallowingApiCall(
+      // allow-raw-bot-api: wrapped in swallowingApiCall (retry policy)
+      () => bot.api.sendRichMessage(chat_id, richMessage(markdown), { disable_notification: true }),
+      { chat_id: String(chat_id), verb: 'tier-downgrade:notify' },
+    )
+  }
+}
+
+/**
+ * MODEL-TIER downgrade failover (second recovery tier). Consulted ONLY from the
+ * `all-blocked` branch of doFireFleetAutoFallback — i.e. AFTER account-swap has
+ * been tried and found no account still serving the walled premium model
+ * (precedence A: account-swap first). When a PREMIUM /model override is active
+ * (distinct from the configured default), downgrade to the configured default
+ * and resume the dead turn via a self-restart, rather than let the turn stall.
+ *
+ *   - NO automatic return to the premium model. The /model override is
+ *     session-scoped and in-memory only (recordTypedModelSwitch writes no
+ *     carrier), so it dies on the downgrade SIGTERM. The consume-once
+ *     `.session-model` carrier written here targets the CONFIGURED DEFAULT:
+ *     start.sh applies+deletes it on the resume boot, and every later restart
+ *     also boots the default. The premium tier is never restored on its own —
+ *     the user must re-issue `/model <premium>`, which the notice says plainly.
+ *   - Effort is NATIVE: no `.session-effort` carrier is written, so the restart
+ *     sheds any live /effort override and the downgraded default boots at the
+ *     configured `thinking_effort` (the fleet `low` pin, #1978).
+ *   - Loop-bounded by the NATURAL on-default guard: after the downgrade boot the
+ *     session runs the configured default (override gone), so a re-entry returns
+ *     `skip` ('on-default') and never re-downgrades — even if the default is
+ *     itself walled (then the normal all-blocked card fires, no loop). Pacing
+ *     reuses the fleetFallbackResumeGate single-flight + 3h staleness.
+ *
+ * Returns:
+ *   'downgraded'      — carrier written, latch armed, restart fired; caller must
+ *                       NOT also emit the all-blocked give-up card (we are
+ *                       recovering, not giving up).
+ *   'restart-pending' — a resume restart was ALREADY armed in this process (a
+ *                       concurrent turn's downgrade or account-swap); that
+ *                       restart replays the interrupted turn, so caller must NOT
+ *                       emit a give-up card (avoids the contradictory "could not
+ *                       be recovered" race).
+ *   'skip'            — not applicable (on the configured default, unresolved
+ *                       default, or the turn is too stale to resume); caller
+ *                       falls through to the all-blocked card.
+ */
+function maybeTierDowngrade(triggerAgent: string): 'downgraded' | 'restart-pending' | 'skip' {
+  // Thin adapter: the order-sensitive glue lives in runTierDowngrade
+  // (tier-downgrade-wiring.ts) behind injected deps so it is unit-testable
+  // without importing the gateway. This wires the real seams.
+  return runTierDowngrade(triggerAgent, {
+    getAgentDir: () => resolveAgentDirFromEnv() ?? null,
+    getConfiguredDefault: () => {
+      const dir = resolveAgentDirFromEnv()
+      if (!dir) return null
+      return resolveMainModel(readConfiguredDefaultModel(dir) ?? undefined)
+    },
+    getSessionOverride: () => sessionModelSource.getOverride(),
+    resolve: (t) => resolveMainModel(t),
+    // PEEK the resume gate WITHOUT arming (single-flight within this process +
+    // 3h staleness), the same gate the account-swap resume path uses.
+    peekResumeGate: () => fleetFallbackResumeGate.peek(newestActiveTurnStartedAtMs()),
+    writeCarrier: (dir, toModel, cfg) => writeSessionModelFile(dir, toModel, cfg),
+    armResumeGate: () => fleetFallbackResumeGate.arm(),
+    // Records the DROPPED premium token + the notice's allowFrom chats; start.sh
+    // never consumes `.premium-recovery`, so it survives the self-restart.
+    writeRecoveryMarker: (dir, premiumModel) => {
+      const chats = loadAccess().allowFrom.map((c) => String(c))
+      if (chats.length > 0) writePremiumRecoveryFile(dir, premiumModel, chats)
+    },
+    broadcastNotice: (md) => broadcastTierNotice(md),
+    selfRestart: (agent) => triggerSelfRestart(agent, 'tier-downgrade-resume'),
+    selfAgent: (t) => process.env.SWITCHROOM_AGENT_NAME ?? t,
+    log: (msg) => process.stderr.write(`telegram gateway: ${msg}\n`),
+  })
+}
+
+/**
+ * "Premium model recovered" ping (tier-downgrade companion). Consulted from the
+ * gateway's existing `runQuotaWatch` tick (every 15 min, on the cheap
+ * `list-state` IPC read it already does — NO new poller, NO broker change).
+ * When a `.premium-recovery` marker is pending (a downgrade dropped a premium
+ * `/model` selection fleet-wide) AND the broker's live-authoritative per-account
+ * eligibility shows the premium tier servable again — at least one account
+ * neither `exhausted` nor `premium_walled` — fire EXACTLY ONE ping to the
+ * recorded chats with a one-tap "switch back" button, then consume the marker.
+ *
+ * DETERMINISTIC: `exhausted` / `premium_walled` are the broker's own verdicts
+ * (`isAccountExhausted` / `isAccountPremiumWalled` → `isModelTierWalled`, a pure
+ * timestamp compare). No model judgement, no clock of our own.
+ *
+ * AT-MOST-ONCE: a fleet-wide `claim-notification` gates against a bounce or a
+ * concurrent tick, and the marker is cleared BEFORE the send (never-storm). The
+ * button routes through the SAME session-scoped `/model` apply path as the
+ * model menu (`mdl:alias:<premium>` → handleModelMenuCallback +
+ * recordModelMenuSideEffects) — it does not bypass it.
+ */
+async function maybePremiumRecoveryPing(
+  brokerClient: NonNullable<Awaited<ReturnType<typeof getAuthBrokerClient>>>,
+  accounts: ReadonlyArray<{ exhausted: boolean; premium_walled?: boolean }>,
+): Promise<void> {
+  // Thin adapter: the order-sensitive never-storm glue lives in
+  // runPremiumRecoveryPing (premium-recovery-wiring.ts) behind injected deps so
+  // it is unit-testable without importing the gateway. This wires the real seams
+  // (marker FS, fleet claim, send) — behaviour is preserved exactly.
+  return runPremiumRecoveryPing({
+    getAgentDir: () => resolveAgentDirFromEnv() ?? null,
+    readMarker: (dir) => readPremiumRecoveryFile(dir),
+    clearMarker: (dir) => clearPremiumRecoveryFile(dir),
+    getAgent: () => getMyAgentName(),
+    // The pure recovery predicate, bound to THIS tick's live per-account
+    // eligibility (the broker's own verdicts; `premium_walled` may be absent).
+    decide: () =>
+      decidePremiumRecovery({
+        hasMarker: true,
+        accounts: accounts.map((a) => ({
+          exhausted: a.exhausted,
+          premiumWalled: a.premium_walled === true,
+        })),
+      }).fire,
+    // Fail-open (claimQuotaNotification returns true on any broker error) — a
+    // convenience ping degrades to at-least-once, never lost.
+    claimNotification: (key) => claimQuotaNotification(brokerClient, key),
+    fallbackChats: () => loadAccess().allowFrom.map((c) => String(c)),
+    sendToChat: (chat_id, ping, keyboard) => {
+      void swallowingApiCall(
+        // allow-raw-bot-api: wrapped in swallowingApiCall (retry policy)
+        () =>
+          bot.api.sendRichMessage(chat_id, richMessage(ping.text), {
+            disable_notification: true,
+            reply_markup: keyboard,
+          }),
+        { chat_id: String(chat_id), verb: 'premium-recovery:notify' },
+      )
+    },
+    log: (msg) => process.stderr.write(`telegram gateway: ${msg}\n`),
+  })
+}
+
+/**
+ * Clear a pending premium-recovery marker when the user MANUALLY re-selects the
+ * dropped premium model before the recovery ping fires — no stale "available
+ * again" ping after they've already switched back. Called from every `/model`
+ * apply chokepoint (typed + menu/callback). Matches on the canonicalized token
+ * so an alias vs resolved-id spelling of the same model still clears it.
+ */
+function clearPremiumRecoveryOnManualSwitch(appliedToken: string | null | undefined): void {
+  if (appliedToken == null || appliedToken.length === 0) return
+  const agentDir = resolveAgentDirFromEnv()
+  if (!agentDir) return
+  const marker = readPremiumRecoveryFile(agentDir)
+  if (marker == null) return
+  if (resolveMainModel(appliedToken) === resolveMainModel(marker.premiumModel)) {
+    clearPremiumRecoveryFile(agentDir)
+    process.stderr.write(
+      `telegram gateway: [premium-recovery] marker cleared — user manually re-issued /model ${marker.premiumModel}\n`,
+    )
+  }
+}
+
 /** Returns true iff the dispatcher actually performed a swap (and the
  *  user-visible announcement was broadcast). False on no-op /
  *  error / idempotent-skip — caller uses this to decide whether to
@@ -23598,6 +23855,21 @@ async function doFireFleetAutoFallback(
     if (outcome.kind === 'switched') {
       fallbackAllBlockedNoticeState = { lastSentAtMs: 0 }
     } else if (outcome.kind === 'all-blocked') {
+      // ── Second recovery tier: MODEL-TIER downgrade (precedence A) ──────────
+      // Account-swap just came back all-blocked (no account still serves the
+      // walled model). Before giving up, if a PREMIUM /model override is active,
+      // downgrade to the configured default and resume the dead turn rather than
+      // stall. Only reachable here — a `switched` outcome never enters this
+      // branch, so a model throttled on one account is always recovered by
+      // account-swap first, never by a downgrade. Loop-bounded by the natural
+      // on-default guard; effort revert is native (see maybeTierDowngrade).
+      const tier = maybeTierDowngrade(triggerAgent)
+      if (tier === 'downgraded' || tier === 'restart-pending') {
+        // Either this turn armed a downgrade restart, or a concurrent turn
+        // already armed a resume restart. Do NOT emit the all-blocked give-up
+        // card — a restart is coming that replays the interrupted turn.
+        return false
+      }
       const verdict = evaluateAllBlockedNotice(fallbackAllBlockedNoticeState, Date.now())
       if (!verdict.send) {
         process.stderr.write(
@@ -23830,6 +24102,16 @@ async function runQuotaWatch(opts: { bootTick?: boolean } = {}): Promise<void> {
     return // No accounts — nothing to watch.
   }
 
+  // Premium-model recovery ping (tier-downgrade companion). Reuses THIS tick's
+  // list-state read (no extra IPC): if a downgrade left a `.premium-recovery`
+  // marker and the broker now shows the premium tier servable again, ping once
+  // with a one-tap switch-back button. At-most-once + fleet-claim-deduped.
+  await maybePremiumRecoveryPing(brokerClient, listStateData.accounts).catch((err) => {
+    process.stderr.write(
+      `telegram gateway: [premium-recovery] ping check failed (non-fatal): ${(err as Error)?.message ?? err}\n`,
+    )
+  })
+
   // Build AccountSnapshot[] from cached broker state only — no live probe.
   // Accounts with null last_quota produce quota=null snapshots; classifyHealth
   // returns 'unknown'; evaluateQuotaWatchAccount skips — no false alarms.
@@ -25597,7 +25879,7 @@ bot.on('callback_query:data', async ctx => {
     // sr-* TARGET tap: switch TO a non-Claude (LiteLLM/OpenRouter) model.
     // Parity with the text `/model sr-*` path — claude's native picker rejects
     // unknown sr-* ids, so an in-place inject can't set them. Carry the token
-    // across a graceful restart (the durable `.session-model` override) and
+    // across a graceful restart (the consume-once `.session-model` carrier) and
     // relaunch `claude --model sr-*`. Session-only; reverts to the configured
     // default on the next restart. The sr-* → Claude direction is handled below
     // via the SELECT/alias outcome + isSrToClaudeTransition.
@@ -28006,46 +28288,36 @@ async function shutdown(signal: string): Promise<void> {
     } catch (err) {
       process.stderr.write(`telegram gateway: shutdown.clean_marker_write_failed err=${(err as Error).message}\n`)
     }
-    // #3017 — persist a Telegram-set model across a GRACEFUL deploy/restart.
-    // Boot default is REVERT, and an EXTERNAL deploy (SIGTERM to PID 1 from
-    // `switchroom apply` / `docker compose up`) never routes through
-    // triggerSelfRestart, so it stamps no `.relaunch-model-intent` and start.sh
-    // drops the user's `/model` choice (the overlord `fable`→`opus` revert on
-    // the v0.18.9 roll). A graceful OS-signal shutdown IS a clean, planned
-    // bounce — stamp keep-intent for an active `.session-model` override so the
-    // chosen model survives and start.sh re-confirms it via `.session-model-alert`
-    // on boot. Respect an intent an initiator already stamped (a /restart stamps
-    // 'revert' before SIGTERM): only stamp when none exists. A crash routes
-    // through the non-OS-signal branch and still reverts (safe side preserved).
-    try {
-      const smDir = resolveAgentDirFromEnv()
-      if (smDir != null) {
-        const hasOverride = readSessionModelFile(smDir) != null
-        const intentAlreadyStamped = existsSync(join(smDir, RELAUNCH_MODEL_INTENT_FILE))
-        if (hasOverride && !intentAlreadyStamped) {
-          // The GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX makes this stamp
-          // recognisable at the next GATEWAY boot: a gateway-only bounce never
-          // runs start.sh, so a leftover stamp with this prefix is cleared at
-          // boot (clearStaleGatewayShutdownIntent) instead of lingering to
-          // convert a later genuine crash into a "keep" (#3018 finding 4).
-          writeRelaunchModelIntent(smDir, 'keep', `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful ${signal} shutdown (deploy/rolling restart) — preserving user-chosen session model`)
-          process.stderr.write(`telegram gateway: shutdown.session_model_keep_stamped signal=${signal}\n`)
-        }
-      }
-    } catch (err) {
-      process.stderr.write(`telegram gateway: shutdown.session_model_keep_stamp_failed err=${(err as Error).message}\n`)
-    }
+    // Session-scoped (rev 4): a graceful deploy/restart REVERTS a live /model
+    // override to the configured default — there is no keep-intent to stamp.
+    // (A live Claude override never had a `.session-model` carrier; an in-flight
+    // sr-* carrier was already consumed by its own apply-relaunch.) A queued —
+    // not-yet-applied — /model IS still persisted just below so it applies as
+    // the agent boots (its apply-relaunch), then reverts on the next restart.
   } else {
     process.stderr.write(`telegram gateway: shutdown.clean_marker_skipped signal=${signal} (crash path — banner will fire on next boot)\n`)
   }
 
   // #3018 finding 3 + #3039: resolve any queued /model|/effort ack cards. The
   // gateway (and with it the in-memory queue) is going away — persist each
-  // typed choice to the durable boot carriers (`.session-model` /
-  // `.session-effort`) so it still deterministically applies as the agent
-  // boots, and edit the ack card to say so. Only an unresolvable menu-tag
-  // selection falls back to a re-issue note. Best-effort and time-bounded so
-  // a wedged Telegram API can't block shutdown.
+  // typed choice to the consume-once boot carriers (`.session-model` /
+  // `.session-effort`, #3184/#3186) so it still deterministically applies as
+  // the agent boots (that boot consumes the carrier; later restarts revert),
+  // and edit the ack card to say so. Only an unresolvable menu-tag selection
+  // falls back to a re-issue note. Best-effort and time-bounded so a wedged
+  // Telegram API can't block shutdown.
+  //
+  // DELIBERATE (rev 4, #3184 review LOW-3 — applies to BOTH carriers): this
+  // runs on EVERY shutdown path, including crashes (uncaughtException/
+  // unhandledRejection route here), not just the isOsSignal branch above. So
+  // a mid-turn queued /model or /effort + crash can apply on the
+  // crash-recovery boot — technically at odds with a literal "crash reverts"
+  // reading of the session-scoped contract. Intended: it preserves #3178's
+  // "a queued command never silently vanishes" guarantee (the ack card
+  // promised the switch), the model side is gated to offline-trusted tokens
+  // (the effort side is allowlist-gated at write, so a garbage level can't
+  // even cost one crash-boot), and the consume-once carriers bound it to
+  // exactly that one recovery boot — the following restart reverts to config.
   const orphanedCmdActions = pendingCmdShutdownResolutionActions(pendingSessionCommand, escapeHtmlForTg)
   const orphanedCmdEdits = orphanedCmdActions.map(a => ({
     chatId: a.cmd.ackChatId,
@@ -28890,6 +29162,23 @@ void (async () => {
               } catch { /* leave override as-is on a bad read */ }
             }
 
+            // Effort sibling (#3186): start.sh records the EFFECTIVE launched
+            // effort to `.active-session-effort` every boot. Re-hydrate the
+            // in-memory session-effort override so the /effort menu highlight
+            // stays honest after a queued-carrier apply-boot. Only an effort
+            // differing from the configured default counts as an override.
+            const activeEffortPath = join(smAgentDir, '.active-session-effort')
+            if (existsSync(activeEffortPath)) {
+              try {
+                const launchedEffort = readFileSync(activeEffortPath, 'utf8').trim()
+                const configuredEffort = getConfiguredEffortForPersist()
+                sessionEffortOverride =
+                  launchedEffort.length > 0 && launchedEffort !== configuredEffort
+                    ? launchedEffort
+                    : null
+              } catch { /* leave override as-is on a bad read */ }
+            }
+
             const alertPath = join(smAgentDir, '.session-model-alert')
             if (existsSync(alertPath)) {
               let alertText: string | null = null
@@ -29063,6 +29352,12 @@ void (async () => {
             // supersedes the coarse 5-min bucket relay below to avoid
             // double-surfacing the same progress beat.
             const workerFeedEnabled = isWorkerActivityFeedEnabled(process.env.SWITCHROOM_WORKER_ACTIVITY_FEED)
+            // Combined-feed row cap (channels.telegram.worker_feed.max_rows).
+            // Unset / non-positive → the feed's built-in default (8).
+            const workerFeedMaxRows = (() => {
+              const raw = Number(process.env.SWITCHROOM_TG_WORKER_FEED_MAX_ROWS)
+              return Number.isInteger(raw) && raw > 0 ? raw : undefined
+            })()
             // Model A — foreground sub-agent nesting in the parent's live
             // activity draft. ON by default; this edits the SAME activity-
             // summary message the tool_label feed already owns (not the
@@ -29112,6 +29407,40 @@ void (async () => {
                     },
                   ),
               },
+              // #3084 follow-up: the feed's send/edit adapters transit the send
+              // gate, which SHEDS (resolves undefined) any call made during an
+              // open flood window. Give the feed the SAME on-disk window probe
+              // robustApiCall + the held-card sweep read, so a running/first-
+              // paint tick parks in cooldown instead of re-firing a shed send
+              // every ~6s for the whole ban (the worker-feed shed-contract bug:
+              // 565 `sent.message_id` crashes in one 6h ban).
+              floodWaitRemainingMs: probeFloodWaitRemainingMs,
+              // #3084 follow-up: 2+ background workers in one chat/thread coalesce
+              // into ONE combined feed message. `maxRows` caps the visible rows
+              // (compact `+M more working…` spill) so the body stays under the
+              // rich-message wire ceiling (STATUS_CARD_CHAR_BUDGET). Sourced from
+              // channels.telegram.worker_feed.max_rows via the config cascade
+              // (scaffold emits SWITCHROOM_TG_WORKER_FEED_MAX_ROWS); unset → 8.
+              maxRows: workerFeedMaxRows,
+              // #3207 review: GROUP-level status pin. Workers now coalesce into
+              // ONE shared message, so the pin must follow the GROUP lifecycle,
+              // not a single worker's — otherwise a sibling's finish unpins a
+              // message the survivors still need and the survivor's re-pin NOOPs
+              // (its claim still names that id), leaving live work unpinned. The
+              // feed drives this: pin `wk:group:<feedKey>` when the group first
+              // paints, unpin only when the group empties (messageId === null).
+              reconcilePin: ({ feedKey, chatId, messageId }) => {
+                if (!PIN_STATUS_WHILE_WORKING) return
+                const key = `wk:group:${feedKey}`
+                if (messageId != null) {
+                  void reconcileStatusPin(key, chatId, { pinned: true, messageId })
+                } else {
+                  const unpinChat = chatId || statusPinChatIds.get(key)
+                  if (unpinChat != null && unpinChat.length > 0) {
+                    void reconcileStatusPin(key, unpinChat, { pinned: false })
+                  }
+                }
+              },
               log: (msg) => process.stderr.write(`telegram gateway: ${msg}\n`),
             })
             subagentWatcher = startSubagentWatcher({
@@ -29228,9 +29557,9 @@ void (async () => {
               // anything. The actual repaint + re-pin happen DOWNSTREAM on the
               // next replayed `running` cue: the watcher's re-registration
               // replays `onProgress`, which calls `workerActivityFeed.update()`
-              // (now un-gated) to first-paint a FRESH `🛠 Worker` message, and
-              // its `.then(reconcileWorkerPin(agentId, wkChat, true))` pins that
-              // new message via the `wk:<agentId>` status-pin. Clearing the gate
+              // (now un-gated) to first-paint a FRESH message, and the feed's
+              // own `reconcilePin` (#3207) re-pins that message at the GROUP
+              // level (`wk:group:<feedKey>`). Clearing the gate
               // here FIRST is the ordering requirement — without it those first
               // replayed ticks would be swallowed by the finalized gate and no
               // new card would ever paint. Net effect restores the operator
@@ -29336,7 +29665,7 @@ void (async () => {
                       // card keeps the model tag even with no live entry.
                       model: dispatch.feedModel ?? undefined,
                     })
-                    reconcileWorkerPin(agentId, null, false)
+                    // #3207: group-level pin dropped by the feed on group-empty.
                   }
                   return
                 }
@@ -29414,8 +29743,9 @@ void (async () => {
                       state: outcome === 'failed' ? 'failed' : 'done',
                       model: dispatch.feedModel ?? undefined,
                     })
-                    // Status-pin: worker done — drop its pin.
-                    reconcileWorkerPin(agentId, null, false)
+                    // #3207: the group-level pin is dropped by the feed itself
+                    // when this group's LAST worker finishes (reconcilePin →
+                    // `wk:group:<feedKey>`); no per-worker unpin here.
                   }
                   return
                 }
@@ -29434,8 +29764,8 @@ void (async () => {
                     state: outcome === 'failed' ? 'failed' : 'done',
                     model: dispatch.feedModel ?? undefined,
                   })
-                  // Status-pin: worker done — drop its pin.
-                  reconcileWorkerPin(agentId, null, false)
+                  // #3207: the group-level pin is dropped by the feed itself
+                  // when this group's LAST worker finishes; no per-worker unpin.
                 }
 
                 const handbackOrigin = resolveSubagentOriginChat(agentId)
@@ -29602,7 +29932,10 @@ void (async () => {
                         model: feedModel,
                       },
                       wk.threadId,
-                    )?.then(() => reconcileWorkerPin(agentId, wkChat, true))
+                    )
+                  // #3207: the feed pins the group's shared message itself when
+                  // it first paints (reconcilePin → `wk:group:<feedKey>`); no
+                  // per-worker pin chained here.
                     return
                   }
                   if (surface !== 'nest') return // 'skip' — orphan-status off
@@ -29744,7 +30077,10 @@ void (async () => {
                       model: feedModel,
                     },
                     wk.threadId,
-                  )?.then(() => reconcileWorkerPin(agentId, wkChat, true))
+                  )
+                  // #3207: the feed pins the group's shared message itself when
+                  // it first paints (reconcilePin → `wk:group:<feedKey>`); no
+                  // per-worker pin chained here.
                   return
                 }