switchroom 0.18.15 → 0.18.18

package/telegram-plugin/gateway/session-model-file.ts

@@ -1,32 +1,31 @@
 /**
- * Durable session-model stickiness — file helpers shared by the gateway.
+ * Session-scoped `/model` carrier — file helpers shared by the gateway.
  *
- * Two files in the bind-mounted agent state dir carry the contract
- * (reference/rfcs/session-model-stickiness.md):
+ * Contract: reference/rfcs/session-model-stickiness.md §0.1 (rev 4, operator
+ * decision 2026-07-12 — SESSION-SCOPED, superseding the rev-3 keep-by-default).
+ * Files in the bind-mounted agent state dir:
  *
- *   - `.session-model` — the DURABLE session override written on every
- *     positively-confirmed `/model` switch. One-line JSON
- *     `{"model","configuredDefaultAtWrite","ts"}`. It is NOT consumed by a
- *     keep-path boot; it survives every restart/deploy/crash and is cleared
- *     only by explicit user action (`/model default`) or invalidation
- *     (corruption / the configured yaml default changed) — every clearing
- *     path notifies the operator chat via `.session-model-alert` (#3039).
+ *   - `.session-model` — a CONSUME-ONCE carrier written ONLY immediately
+ *     before a relaunch that applies the switch (the sr-* / sr→Claude paths
+ *     and a queued /model persisted at graceful shutdown). One-line JSON
+ *     `{"model","configuredDefaultAtWrite","ts"}`. start.sh applies it on the
+ *     single boot that reads it and then deletes it; every SUBSEQUENT restart
+ *     (deploy, /restart, /new, watchdog recovery, crash, raw docker restart)
+ *     finds no carrier and boots the configured default. Live Claude switches
+ *     do NOT write a carrier — they apply in-session and the explicit
+ *     `claude --model <configured>` flag reverts them on the next boot.
+ *     Cleared live by `/model default`; invalidation (corruption / the
+ *     configured yaml default changed at the apply-boot) drops it and notifies
+ *     the operator chat via `.session-model-alert`.
  *
- *   - `.relaunch-model-intent` — the ONE-SHOT intent bit for the next boot.
- *     One-line JSON `{"intent":"keep"|"revert","reason","ts"}`, atomic
- *     write, last-writer-wins. Boot default is KEEP (#3039 — operator
- *     decision 2026-07-11, superseding the earlier revert-by-default): a
- *     raw `docker restart` / host reboot / deploy / crash keeps a valid
- *     override. Only an explicit fresh "revert" intent reverts. start.sh
- *     consumes the file (rm -f) every boot; a stale (>10 min by the
- *     embedded ts) or corrupt intent counts as no intent (→ keep).
- *
- *   - `.session-effort` — the DURABLE effort override (#3039), same shape
- *     and lifecycle as `.session-model` with `level` in place of `model`:
- *     `{"level","configuredDefaultAtWrite","ts"}`. Written on every
- *     positively-confirmed `/effort` apply, resolved by start.sh into the
- *     relaunch's `--effort`, cleared only by `/effort default` or
- *     invalidation (with a boot alert).
+ *   - `.session-effort` — the CONSUME-ONCE effort carrier (#3186, session-
+ *     scoped like `.session-model`). Same shape with `level` in place of
+ *     `model`: `{"level","configuredDefaultAtWrite","ts"}`. Written ONLY by
+ *     the queued-command shutdown persist (a mid-turn `/effort` carried
+ *     across the bounce); start.sh resolves it into the apply-boot's
+ *     `--effort` and deletes it, so any subsequent restart reverts to the
+ *     configured `thinking_effort`. Live `/effort` applies record in memory
+ *     only. Cleared live by `/effort default`; invalidation alerts at boot.
  *
  * The `model` token is always a canonical `claude --model` token (alias,
  * `claude-*` id, or `sr-*` id) — NEVER a display label like "Opus 4.8".
@@ -38,12 +37,7 @@ import { join } from 'node:path'
 import { isValidModelArg } from './model-command.js'
 
 export const SESSION_MODEL_FILE = '.session-model'
-export const RELAUNCH_MODEL_INTENT_FILE = '.relaunch-model-intent'
 export const CONFIGURED_DEFAULT_MODEL_FILE = '.configured-default-model'
-/** Crashloop self-heal counter (start.sh stamps `<count> <epoch>` per fast boot). */
-export const SESSION_MODEL_BOOT_ATTEMPTS_FILE = '.session-model-boot-attempts'
-
-export type RelaunchModelIntent = 'keep' | 'revert'
 
 export interface SessionModelRecord {
   model: string
@@ -51,21 +45,6 @@ export interface SessionModelRecord {
   ts: number
 }
 
-/**
- * Classify a triggerSelfRestart reason into the intent the boot should honor.
- *
- * Since #3039 (operator contract 2026-07-11) EVERY restart reason keeps the
- * override: a restart — user-tapped, watchdog, deploy, or crash — is not
- * "clear my model". The override is cleared only by explicit user action
- * (`/model default`) or invalidation at boot, both of which run their own
- * paths. The 'revert' intent value remains recognised by start.sh (and this
- * classifier's signature keeps it) so an older gateway's stamp still parses,
- * but current code never emits it.
- */
-export function intentForRestartReason(_reason: string): RelaunchModelIntent {
-  return 'keep'
-}
-
 function atomicWrite(path: string, content: string): void {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`
   writeFileSync(tmp, content, 'utf8')
@@ -104,8 +83,8 @@ export function parseSessionModel(text: string): SessionModelRecord | null {
 }
 
 /**
- * Write the durable session override. Throws on a non-canonical token —
- * callers must pass a `claude --model` token, never a display label
+ * Write the consume-once session-model carrier. Throws on a non-canonical
+ * token — callers must pass a `claude --model` token, never a display label
  * (regression guard for the "Opus 4.5 persisted" class).
  */
 export function writeSessionModelFile(
@@ -137,37 +116,10 @@ export function readSessionModelFile(agentDir: string): SessionModelRecord | nul
   return raw == null ? null : parseSessionModel(raw)
 }
 
-/** Delete the durable override (`/model default`, rollback). Best-effort. */
+/** Delete the session-model carrier (`/model default`, rollback). Best-effort. */
 export function clearSessionModelFile(agentDir: string): void {
   try {
     rmSync(join(agentDir, SESSION_MODEL_FILE), { force: true })
-    // #3042 item 4: also drop the kept-alert dedup sentinel so a future
-    // override of the same name re-alerts on its first kept boot.
-    rmSync(join(agentDir, '.session-model-kept-notified'), { force: true })
-    rmSync(join(agentDir, SESSION_MODEL_BOOT_ATTEMPTS_FILE), { force: true })
-  } catch {
-    /* best-effort */
-  }
-}
-
-/**
- * #3043 item 2: clear ONLY the crashloop boot-attempts counter — a positive
- * health signal from the gateway, not a carrier change.
- *
- * start.sh's self-heal (start.sh.hbs "Override crashloop self-heal") increments
- * the counter on every boot that re-enters within 150s with the override still
- * active, and clears a healthy override after 3 fast boots. That window can't
- * tell a genuine crashloop from three quick OPERATOR hand-bounces of a healthy
- * agent — both look like fast successive boots — so three deliberate restarts
- * would spuriously wipe a working override. A boot that reaches bridge
- * registration is proven healthy (the session came all the way up and the
- * bridge connected), so the gateway deletes the counter there. Only boots that
- * genuinely FAIL before the bridge registers now accumulate toward the 3-strike
- * clear. Best-effort; absent file is fine.
- */
-export function clearSessionModelBootAttempts(agentDir: string): void {
-  try {
-    rmSync(join(agentDir, SESSION_MODEL_BOOT_ATTEMPTS_FILE), { force: true })
   } catch {
     /* best-effort */
   }
@@ -186,94 +138,6 @@ export function restoreSessionModelFileRaw(agentDir: string, raw: string | null)
   }
 }
 
-/**
- * Stamp the one-shot relaunch intent. MUST be called synchronously BEFORE
- * the restart signal/dispatch it describes (write-before-kill invariant —
- * the next start.sh boot reads this to decide keep vs revert). Best-effort:
- * a failed write means the boot falls back to the default (keep, #3039) —
- * the user's choice is preserved either way.
- */
-export function writeRelaunchModelIntent(
-  agentDir: string,
-  intent: RelaunchModelIntent,
-  reason: string,
-): void {
-  try {
-    atomicWrite(
-      join(agentDir, RELAUNCH_MODEL_INTENT_FILE),
-      `${JSON.stringify({ intent, reason, ts: Date.now() })}\n`,
-    )
-  } catch (err) {
-    process.stderr.write(
-      `telegram gateway: relaunch-model-intent write failed (boot will revert): ${(err as Error)?.message ?? String(err)}\n`,
-    )
-  }
-}
-
-/**
- * Reason prefix the gateway's SIGTERM/SIGINT shutdown handler stamps on its
- * deploy-survival keep-intent (#3017/#3018). Distinguishable on purpose:
- * a gateway-only bounce (supervisor relaunch, bare gateway-unit restart)
- * leaves that stamp UNCONSUMED on disk — start.sh only runs on a container
- * boot — and the next gateway boot uses this prefix to recognise and clear
- * the stale stamp (see clearStaleGatewayShutdownIntent).
- */
-export const GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX = 'gateway-shutdown:'
-
-export interface RelaunchModelIntentRecord {
-  intent: RelaunchModelIntent
-  reason: string
-  ts: number
-}
-
-/** Parsed `.relaunch-model-intent`, or null when absent / corrupt / malformed. */
-export function readRelaunchModelIntent(agentDir: string): RelaunchModelIntentRecord | null {
-  try {
-    const raw = readFileSync(join(agentDir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')
-    const parsed = JSON.parse(raw) as Partial<RelaunchModelIntentRecord>
-    if (
-      (parsed.intent !== 'keep' && parsed.intent !== 'revert') ||
-      typeof parsed.reason !== 'string' ||
-      typeof parsed.ts !== 'number'
-    ) {
-      return null
-    }
-    return { intent: parsed.intent, reason: parsed.reason, ts: parsed.ts }
-  } catch {
-    return null
-  }
-}
-
-/**
- * Boot-time cleanup for the gateway-only-bounce hole (#3018 finding 4).
- *
- * A container-level stop/deploy consumes `.relaunch-model-intent` in start.sh
- * BEFORE any gateway boots. So if a freshly-booting GATEWAY still sees an
- * intent that a gateway shutdown handler stamped (reason carries
- * GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX), the preceding bounce was
- * gateway-only — the container never restarted and the stamp is stale.
- * Left in place, it could convert a genuine crash within the 10-min
- * freshness window into a "keep", breaking the crash-reverts policy.
- * Clear it. Never touches a triggerSelfRestart / user-slash stamp (those
- * use their own un-prefixed reasons and precede a container bounce).
- * Returns true when a stale stamp was cleared.
- */
-export function clearStaleGatewayShutdownIntent(agentDir: string): boolean {
-  const rec = readRelaunchModelIntent(agentDir)
-  if (rec == null || !rec.reason.startsWith(GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX)) return false
-  clearRelaunchModelIntent(agentDir)
-  return true
-}
-
-/** Remove a stamped intent (rollback of a failed dispatch). Best-effort. */
-export function clearRelaunchModelIntent(agentDir: string): void {
-  try {
-    rmSync(join(agentDir, RELAUNCH_MODEL_INTENT_FILE), { force: true })
-  } catch {
-    /* best-effort */
-  }
-}
-
 /**
  * The resolved configured default start.sh recorded this boot
  * (`.configured-default-model`, written before override resolution — the
@@ -288,12 +152,13 @@ export function readConfiguredDefaultModel(agentDir: string): string | null {
   }
 }
 
-// ─── Durable session-effort override (#3039) ────────────────────────────────
+// ─── Consume-once session-effort carrier (#3186) ────────────────────────────
 //
-// The `/effort` sibling of `.session-model`. Same lifecycle: written on every
-// positively-confirmed effort apply, honored by start.sh on every boot
-// (`--effort <level>`), cleared only by `/effort default` or invalidation
-// (configured `thinking_effort:` changed / corrupt file — both alert once).
+// The `/effort` sibling of `.session-model`, session-scoped. Written ONLY by
+// the queued-command shutdown persist (a mid-turn /effort carried across the
+// bounce); start.sh applies it on the single boot that reads it (`--effort
+// <level>`) and deletes it. Cleared live by `/effort default`; invalidation
+// (configured `thinking_effort:` changed / corrupt file) alerts once at boot.
 
 export const SESSION_EFFORT_FILE = '.session-effort'
 
@@ -330,8 +195,9 @@ export function parseSessionEffort(text: string): SessionEffortRecord | null {
 }
 
 /**
- * Write the durable effort override. Throws on a non-allowlisted level —
- * the value is passed verbatim to `claude --effort` at the next boot.
+ * Write the consume-once effort carrier. Throws on a non-allowlisted level —
+ * the value is passed verbatim to `claude --effort` at the next boot (the
+ * apply-boot, which consumes the file).
  */
 export function writeSessionEffortFile(
   agentDir: string,
@@ -347,7 +213,7 @@ export function writeSessionEffortFile(
   )
 }
 
-/** Parsed durable effort override, or null when absent/corrupt. */
+/** Parsed effort carrier, or null when absent/corrupt. */
 export function readSessionEffortFile(agentDir: string): SessionEffortRecord | null {
   try {
     return parseSessionEffort(readFileSync(join(agentDir, SESSION_EFFORT_FILE), 'utf8'))
@@ -356,7 +222,7 @@ export function readSessionEffortFile(agentDir: string): SessionEffortRecord | n
   }
 }
 
-/** Delete the durable effort override (`/effort default`). Best-effort. */
+/** Delete the effort carrier (`/effort default`, leftover hygiene). Best-effort. */
 export function clearSessionEffortFile(agentDir: string): void {
   try {
     rmSync(join(agentDir, SESSION_EFFORT_FILE), { force: true })
@@ -364,3 +230,106 @@ export function clearSessionEffortFile(agentDir: string): void {
     /* best-effort */
   }
 }
+
+// ─── Consume-once premium-recovery marker (tier-downgrade companion) ─────────
+//
+// A DURABLE marker the tier-downgrade writes when it walls a premium `/model`
+// selection fleet-wide. It records the DROPPED premium token + the chats to
+// notify, and survives the downgrade self-restart (start.sh never touches this
+// name — unlike `.session-model`, which is consumed at boot). The gateway's
+// `runQuotaWatch` tick reads it, and when the broker's `list-state` shows the
+// premium tier servable again (deterministic per-account eligibility), fires
+// EXACTLY ONE "available again" ping with a one-tap switch-back button, then
+// clears the marker (at-most-once). Also cleared the instant the user re-issues
+// `/model <premium>` manually (no stale ping). Shape-gated like the carriers
+// above — the model token passes the same MODEL_ARG_RE gate.
+
+export const PREMIUM_RECOVERY_FILE = '.premium-recovery'
+
+export interface PremiumRecoveryRecord {
+  /** The dropped premium `/model` token (e.g. `fable`) to offer switching back to. */
+  premiumModel: string
+  /** Telegram chat ids to ping on recovery (the downgrade notice's allowFrom). */
+  chats: string[]
+  ts: number
+}
+
+/**
+ * Parse `.premium-recovery` content. Null on corrupt JSON, a missing/wrong-typed
+ * field, a model token that fails the MODEL_ARG_RE shape gate, or a `chats`
+ * array that is not a non-empty list of non-empty strings.
+ */
+export function parsePremiumRecovery(text: string): PremiumRecoveryRecord | null {
+  try {
+    const raw = JSON.parse(text) as Partial<PremiumRecoveryRecord>
+    if (
+      typeof raw.premiumModel !== 'string' ||
+      !isValidModelArg(raw.premiumModel) ||
+      typeof raw.ts !== 'number' ||
+      !Array.isArray(raw.chats) ||
+      raw.chats.length === 0 ||
+      !raw.chats.every((c) => typeof c === 'string' && c.length > 0)
+    ) {
+      return null
+    }
+    return { premiumModel: raw.premiumModel, chats: raw.chats, ts: raw.ts }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Write the premium-recovery marker. Throws on a non-canonical token (parity
+ * with the carriers) or an empty chat list — a marker with nowhere to ping is a
+ * bug, not a silent no-op.
+ */
+export function writePremiumRecoveryFile(
+  agentDir: string,
+  premiumModel: string,
+  chats: string[],
+): void {
+  if (!isValidModelArg(premiumModel)) {
+    throw new Error(`refusing to persist non-canonical premium-recovery token: ${JSON.stringify(premiumModel)}`)
+  }
+  const clean = chats.filter((c) => typeof c === 'string' && c.length > 0)
+  if (clean.length === 0) {
+    throw new Error('refusing to persist premium-recovery marker with no chats to notify')
+  }
+  atomicWrite(
+    join(agentDir, PREMIUM_RECOVERY_FILE),
+    `${JSON.stringify({ premiumModel, chats: clean, ts: Date.now() })}\n`,
+  )
+}
+
+/**
+ * Parsed premium-recovery marker, or null when absent/corrupt. A present-but-
+ * corrupt marker (null parse of a file that exists) is SWEPT on read: neither
+ * the ping path nor `clearPremiumRecoveryOnManualSwitch` can act on a null
+ * parse, so a garbled file would otherwise linger forever. Deleting it here is
+ * best-effort hygiene — the read still returns null either way.
+ */
+export function readPremiumRecoveryFile(agentDir: string): PremiumRecoveryRecord | null {
+  let raw: string
+  try {
+    raw = readFileSync(join(agentDir, PREMIUM_RECOVERY_FILE), 'utf8')
+  } catch {
+    return null // absent / unreadable — nothing on disk to sweep.
+  }
+  const parsed = parsePremiumRecovery(raw)
+  if (parsed == null) {
+    // Corrupt marker present on disk — garbage-collect it so it can't wedge the
+    // recovery path (best-effort; a failed unlink still returns null).
+    clearPremiumRecoveryFile(agentDir)
+    return null
+  }
+  return parsed
+}
+
+/** Delete the premium-recovery marker (consumed on ping / manual re-issue). Best-effort. */
+export function clearPremiumRecoveryFile(agentDir: string): void {
+  try {
+    rmSync(join(agentDir, PREMIUM_RECOVERY_FILE), { force: true })
+  } catch {
+    /* best-effort */
+  }
+}

package/telegram-plugin/gateway/tier-downgrade-wiring.ts

@@ -0,0 +1,121 @@
+/**
+ * tier-downgrade-wiring.ts — the gateway GLUE for the model-tier downgrade,
+ * behind injected deps so the orchestration is unit-testable without importing
+ * the whole gateway (mirrors throttle-tier-wiring.ts).
+ *
+ * The pure decision (`decideTierDowngrade`), the give-up/suppress routing
+ * (`planTierDowngrade`), and the user-facing wording (`renderTierDowngradeNotice`)
+ * all live in tier-downgrade.ts. This module owns the ORDER-SENSITIVE side
+ * effects the gateway performs off those verdicts — and the invariants a review
+ * cares about:
+ *
+ *   - the resume gate is PEEKed (not armed) first, so the fallible carrier write
+ *     happens before the single-flight latch is committed;
+ *   - the consume-once `.session-model` carrier is written BEFORE the arm; a
+ *     throwing write aborts the downgrade and leaves NO armed latch;
+ *   - the latch is armed only AFTER a successful carrier write;
+ *   - the durable premium-recovery marker write is best-effort (a failure never
+ *     aborts the downgrade — the recovery ping simply doesn't arm);
+ *   - the broadcast notice is the HONEST resume-on-default text (never a
+ *     revert-to-premium promise) and is sent only on a real downgrade;
+ *   - a `skip-inflight` resume-gate verdict returns `restart-pending` and emits
+ *     NO notice and NO restart (the concurrent turn's armed restart resumes).
+ */
+
+import {
+  decideTierDowngrade,
+  planTierDowngrade,
+  type ResumeGateVerdict,
+} from '../tier-downgrade.js'
+
+export type TierDowngradeOutcome = 'downgraded' | 'restart-pending' | 'skip'
+
+export interface TierDowngradeRunnerDeps {
+  /** Bind-mounted agent state dir, or null when unresolvable (→ skip). */
+  getAgentDir: () => string | null
+  /** Resolved configured-default token; '' / null → unresolved (never downgrade blind). */
+  getConfiguredDefault: () => string | null
+  /** Live session `/model` override, or null on the plain configured default. */
+  getSessionOverride: () => string | null
+  /** Model canonicalizer (the gateway passes resolveMainModel). */
+  resolve: (token: string) => string
+  /** PEEK the resume gate WITHOUT arming it. */
+  peekResumeGate: () => ResumeGateVerdict
+  /** Write the consume-once `.session-model` carrier for the default. May throw. */
+  writeCarrier: (agentDir: string, toModel: string, configuredDefault: string) => void
+  /** Commit the single-flight arm — called ONLY after a successful carrier write. */
+  armResumeGate: () => void
+  /** Persist the durable premium-recovery marker (best-effort; may throw — caught). */
+  writeRecoveryMarker: (agentDir: string, premiumModel: string) => void
+  /** Broadcast the honest downgrade notice to the operator chats. */
+  broadcastNotice: (markdown: string) => void
+  /** Fire the resume self-restart for `agent`. */
+  selfRestart: (agent: string) => void
+  /** The agent whose session self-restarts (SWITCHROOM_AGENT_NAME ?? triggerAgent). */
+  selfAgent: (triggerAgent: string) => string
+  /** Structured logger (stderr in prod, captured in test). */
+  log: (msg: string) => void
+}
+
+/**
+ * Run the tier-downgrade glue. Returns:
+ *   'downgraded'      — carrier written, latch armed, notice broadcast, restart fired.
+ *   'restart-pending' — a resume restart is already armed (concurrent turn); no
+ *                       notice, no restart (its restart replays the dead turn).
+ *   'skip'            — not applicable / carrier write failed; caller falls
+ *                       through to its all-blocked give-up card.
+ */
+export function runTierDowngrade(
+  triggerAgent: string,
+  deps: TierDowngradeRunnerDeps,
+): TierDowngradeOutcome {
+  const agentDir = deps.getAgentDir()
+  if (!agentDir) return 'skip'
+  const configuredDefault = deps.getConfiguredDefault() ?? ''
+  const decision = decideTierDowngrade({
+    sessionOverride: deps.getSessionOverride(),
+    configuredDefault,
+    resolve: deps.resolve,
+  })
+  // PEEK (no arm): the fallible carrier write must precede the latch commit.
+  const gateVerdict = deps.peekResumeGate()
+  const plan = planTierDowngrade(decision, gateVerdict, triggerAgent)
+  if (plan.kind === 'skip') {
+    if (decision.action === 'downgrade') {
+      deps.log(`[tier-downgrade] restart suppressed (${gateVerdict}) agent=${triggerAgent}`)
+    }
+    return 'skip'
+  }
+  if (plan.kind === 'suppress') {
+    deps.log(
+      `[tier-downgrade] give-up suppressed — a resume restart is already armed agent=${triggerAgent}`,
+    )
+    return 'restart-pending'
+  }
+  // plan.kind === 'downgrade'. Carrier BEFORE arm: a throwing write must not
+  // leave an armed latch with no pending restart.
+  try {
+    deps.writeCarrier(agentDir, plan.toModel, configuredDefault)
+  } catch (err) {
+    deps.log(
+      `[tier-downgrade] failed to write session-model carrier — aborting downgrade: ${(err as Error)?.message ?? err}`,
+    )
+    return 'skip'
+  }
+  deps.armResumeGate()
+  deps.log(
+    `[tier-downgrade] downgrading ${plan.fromModel} → ${plan.toModel} and resuming via self-restart agent=${triggerAgent}`,
+  )
+  // Durable premium-recovery marker — best-effort (survives the restart; the
+  // downgrade is the critical path and must not abort on a marker failure).
+  try {
+    deps.writeRecoveryMarker(agentDir, plan.fromModel)
+  } catch (err) {
+    deps.log(
+      `[tier-downgrade] premium-recovery marker write failed (non-fatal): ${(err as Error)?.message ?? err}`,
+    )
+  }
+  deps.broadcastNotice(plan.notice)
+  deps.selfRestart(deps.selfAgent(triggerAgent))
+  return 'downgraded'
+}

package/telegram-plugin/gateway/unhandled-rejection-policy.ts

@@ -12,7 +12,7 @@
 
 import { GrammyError, HttpError } from 'grammy'
 
-import { FLOOD_WAIT_ACTIVE } from '../retry-api-call.js'
+import { FLOOD_WAIT_ACTIVE, LOCAL_RESOURCE_EXHAUSTED } from '../retry-api-call.js'
 
 export type RejectionAction = 'shutdown' | 'log_only'
 
@@ -78,6 +78,19 @@ export function classifyRejection(
   // exact amplification the #2923 circuit breaker exists to stop.
   if (err instanceof Error && err.message === FLOOD_WAIT_ACTIVE) return 'log_only'
 
+  // LOCAL_RESOURCE_EXHAUSTED (#3099, sibling of FLOOD_WAIT_ACTIVE above):
+  // retry-api-call throws this plain Error marker when a send fails on a LOCAL
+  // disk/memory exhaustion (ENOSPC/EDQUOT/EIO/ENOMEM) rather than retrying it
+  // (#2923) — retrying a local-resource failure in a tight loop is what tripped
+  // the per-bot flood ban in the first place. A leaked one (a fire-and-forget
+  // send that wasn't wrapped in swallowingApiCall) must NOT crash the gateway:
+  // the box is ALREADY out of disk/memory, and a crash→restart drives a fresh
+  // round of boot-time sends and staging writes at a resource that is already
+  // exhausted — the exact amplification the #2923 marker exists to avoid. The
+  // degraded-state marker already carries this signal; a crash loop is the
+  // wrong way to surface a full disk. Same log_only posture as its sibling.
+  if (err instanceof Error && err.message === LOCAL_RESOURCE_EXHAUSTED) return 'log_only'
+
   if (!isGrammy) return 'shutdown'
 
   const e = err as { error_code?: number; description?: string }