switchroom 0.18.27 → 0.18.29

package/telegram-plugin/dist/gateway/gateway.js

@@ -28638,6 +28638,7 @@ var init_redact = __esm(() => {
 // history.ts
 var exports_history = {};
 __export(exports_history, {
+  verifyHistoryWritable: () => verifyHistoryWritable,
   recordReaction: () => recordReaction,
   recordOutbound: () => recordOutbound,
   recordInbound: () => recordInbound,
@@ -28676,6 +28677,15 @@ function loadDatabaseClass() {
     throw new Error(`history.ts requires Bun runtime (bun:sqlite). Caller: ${err.message}`);
   }
 }
+function warnHistory(msg) {
+  try {
+    process.stderr.write(`telegram history: ${msg}
+`);
+  } catch {}
+}
+function isValidMessageId(id) {
+  return typeof id === "number" && Number.isInteger(id) && id > 0;
+}
 function initHistory(stateDir, retentionDays = 30) {
   if (db != null)
     return;
@@ -28757,6 +28767,33 @@ function initHistory(stateDir, retentionDays = 30) {
     const cutoff = Math.floor(Date.now() / 1000) - retentionDays * 86400;
     db.prepare("DELETE FROM messages WHERE ts < ?").run(cutoff);
   }
+  const check = verifyHistoryWritable();
+  if (!check.ok) {
+    warnHistory(`WRITER SELF-CHECK FAILED at boot (path=${path2}): ${check.error ?? "unknown"} \u2014 ` + `history recording is NOT durable; get_recent_messages recovery and the ` + `reply-backstop already-replied suppression will be blind. Investigate the ` + `DB path/mount/permissions before trusting delivery accounting.`);
+  }
+}
+function verifyHistoryWritable() {
+  if (db == null)
+    return { ok: false, error: "initHistory() not called" };
+  const SENTINEL_CHAT = "__history_selfcheck__";
+  const sentinelId = Date.now();
+  try {
+    db.prepare("DELETE FROM messages WHERE chat_id = ?").run(SENTINEL_CHAT);
+    db.prepare(`INSERT OR REPLACE INTO messages
+         (chat_id, thread_id, message_id, role, ts, text)
+       VALUES (?, NULL, ?, 'assistant', ?, ?)`).run(SENTINEL_CHAT, sentinelId, Math.floor(Date.now() / 1000), "selfcheck");
+    const row = db.prepare("SELECT text FROM messages WHERE chat_id = ? AND message_id = ?").get(SENTINEL_CHAT, sentinelId);
+    if (row?.text !== "selfcheck") {
+      return { ok: false, error: "sentinel row not read back after insert" };
+    }
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    try {
+      db.prepare("DELETE FROM messages WHERE chat_id = ?").run(SENTINEL_CHAT);
+    } catch {}
+  }
 }
 function _resetForTests() {
   if (db != null) {
@@ -28815,6 +28852,10 @@ function requireDb() {
 function recordInbound(args) {
   if (args.message_id == null)
     return;
+  if (!isValidMessageId(args.message_id)) {
+    warnHistory(`recordInbound: dropping row with invalid message_id=${String(args.message_id)} ` + `(chat=${args.chat_id}) \u2014 a delivered inbound will be absent from history`);
+    return;
+  }
   const stmt = requireDb().prepare(`
     INSERT OR REPLACE INTO messages
       (chat_id, thread_id, message_id, role, user, user_id, ts, text, attachment_kind, group_id, reply_to_message_id, reply_to_text, forwarded_from, forwarded_from_type, forwarded_from_id, forwarded_date, forwarded_message_id)
@@ -28826,23 +28867,38 @@ function recordOutbound(args) {
   if (args.message_ids.length === 0)
     return;
   const ts = args.ts ?? Math.floor(Date.now() / 1000);
-  const groupId = args.message_ids[0];
+  const validRows = [];
+  for (let i = 0;i < args.message_ids.length; i++) {
+    const id = args.message_ids[i];
+    if (!isValidMessageId(id)) {
+      warnHistory(`recordOutbound: dropping chunk ${i} with invalid message_id=${String(id)} ` + `(chat=${args.chat_id}) \u2014 a delivered outbound will be absent from history, ` + `blinding the reply-backstop already-replied suppression`);
+      continue;
+    }
+    validRows.push({
+      id,
+      text: redact(args.texts[i] ?? ""),
+      attachKind: args.attachment_kinds?.[i] ?? null
+    });
+  }
+  if (validRows.length === 0)
+    return;
+  const groupId = validRows[0].id;
   const stmt = requireDb().prepare(`
     INSERT OR REPLACE INTO messages
       (chat_id, thread_id, message_id, role, user, user_id, ts, text, attachment_kind, group_id)
     VALUES (?, ?, ?, 'assistant', NULL, NULL, ?, ?, ?, ?)
   `);
-  const tx = requireDb().transaction((rows2) => {
-    for (const [msgId, text4, attachKind] of rows2) {
-      stmt.run(args.chat_id, args.thread_id ?? null, msgId, ts, text4, attachKind, groupId);
+  const tx = requireDb().transaction((rows) => {
+    for (const r of rows) {
+      stmt.run(args.chat_id, args.thread_id ?? null, r.id, ts, r.text, r.attachKind, groupId);
     }
   });
-  const rows = args.message_ids.map((id, i) => [
-    id,
-    redact(args.texts[i] ?? ""),
-    args.attachment_kinds?.[i] ?? null
-  ]);
-  tx(rows);
+  try {
+    tx(validRows);
+  } catch (err) {
+    warnHistory(`recordOutbound: INSERT failed (chat=${args.chat_id} ids=[${validRows.map((r) => r.id).join(",")}]): ` + `${err instanceof Error ? err.message : String(err)} \u2014 this outbound will be absent from history`);
+    throw err;
+  }
 }
 function recordEdit(args) {
   requireDb().prepare(`
@@ -39831,6 +39887,64 @@ function buildExtraAttachmentMeta(resolved) {
   return out;
 }
 
+// shared/local-time.ts
+function fmtLocalClock(ms, tz) {
+  return new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    hour: "numeric",
+    minute: "2-digit",
+    hour12: true
+  }).format(new Date(ms)).replace(/\s([AP])M$/, (_m, p) => `${p.toLowerCase()}m`);
+}
+function fmtLocalDate(ms, tz) {
+  return new Intl.DateTimeFormat("en-GB", {
+    timeZone: tz,
+    day: "numeric",
+    month: "short"
+  }).format(new Date(ms));
+}
+function localDay(ms, tz) {
+  return new Intl.DateTimeFormat("en-CA", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  }).format(new Date(ms));
+}
+function tzAbbrev(ms, tz) {
+  const at = new Date(ms);
+  for (const loc of ["en-US", "en-AU", "en-GB"]) {
+    const v = new Intl.DateTimeFormat(loc, { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
+    if (v && !/^(?:GMT|UTC)/i.test(v))
+      return v;
+  }
+  return new Intl.DateTimeFormat("en-US", { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value ?? tz;
+}
+function resolveEnvTimezone(env = process.env) {
+  return env.SWITCHROOM_TIMEZONE ?? env.TZ ?? "UTC";
+}
+function fmtLocalStamp(ms, tz) {
+  try {
+    const at = new Date(ms);
+    const weekday = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      weekday: "long"
+    }).format(at);
+    const date = localDay(ms, tz);
+    const time = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour: "2-digit",
+      minute: "2-digit",
+      hour12: true
+    }).format(at);
+    return `${weekday} ${date} ${time} ${tzAbbrev(ms, tz)}`;
+  } catch {
+    if (tz !== "UTC")
+      return fmtLocalStamp(ms, "UTC");
+    return new Date(ms).toISOString();
+  }
+}
+
 // steering.ts
 function escapeXmlAttribute(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
@@ -39947,7 +40061,7 @@ function buildForwardOriginMeta(origins) {
     if (o.id != null)
       out[`forwarded_from_id${suffix}`] = String(o.id);
     if (o.date != null) {
-      out[`forwarded_date${suffix}`] = new Date(o.date * 1000).toISOString();
+      out[`forwarded_date${suffix}`] = fmtLocalStamp(o.date * 1000, resolveEnvTimezone());
     }
   });
   return out;
@@ -39958,6 +40072,49 @@ function forwardOriginDateIso(o) {
   return new Date(o.date * 1000).toISOString();
 }
 
+// shared/local-time.ts
+function localDay2(ms, tz) {
+  return new Intl.DateTimeFormat("en-CA", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  }).format(new Date(ms));
+}
+function tzAbbrev2(ms, tz) {
+  const at = new Date(ms);
+  for (const loc of ["en-US", "en-AU", "en-GB"]) {
+    const v = new Intl.DateTimeFormat(loc, { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
+    if (v && !/^(?:GMT|UTC)/i.test(v))
+      return v;
+  }
+  return new Intl.DateTimeFormat("en-US", { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value ?? tz;
+}
+function resolveEnvTimezone2(env = process.env) {
+  return env.SWITCHROOM_TIMEZONE ?? env.TZ ?? "UTC";
+}
+function fmtLocalStamp2(ms, tz) {
+  try {
+    const at = new Date(ms);
+    const weekday = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      weekday: "long"
+    }).format(at);
+    const date = localDay2(ms, tz);
+    const time = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour: "2-digit",
+      minute: "2-digit",
+      hour12: true
+    }).format(at);
+    return `${weekday} ${date} ${time} ${tzAbbrev2(ms, tz)}`;
+  } catch {
+    if (tz !== "UTC")
+      return fmtLocalStamp2(ms, "UTC");
+    return new Date(ms).toISOString();
+  }
+}
+
 // status-reactions.ts
 var TELEGRAM_REACTION_WHITELIST = new Set([
   "\uD83D\uDC4D",
@@ -41118,6 +41275,12 @@ function createWorkerActivityFeed(opts) {
     agentIndex.delete(agentId);
     maybeDeleteGroup(g);
   }
+  function evictRowFromGroup(g, agentId) {
+    g.workers.delete(agentId);
+    if (agentIndex.get(agentId) === g.feedKey)
+      agentIndex.delete(agentId);
+    maybeDeleteGroup(g);
+  }
   function maybeDeleteGroup(g) {
     if (g.workers.size === 0 && g.pendingFinalize.size === 0)
       groups.delete(g.feedKey);
@@ -41309,7 +41472,7 @@ function createWorkerActivityFeed(opts) {
         if (row.finished)
           staleFinished.push({ g, agentId: row.agentId, reason });
         else
-          staleAgentIds.push({ agentId: row.agentId, reason });
+          staleAgentIds.push({ g, agentId: row.agentId, reason });
       }
     }
     for (const { g, agentId, reason } of staleFinished) {
@@ -41323,15 +41486,22 @@ function createWorkerActivityFeed(opts) {
       removeWorker(g, agentId);
       syncPin(g);
     }
-    for (const { agentId, reason } of staleAgentIds) {
-      const row = groupOfAgent(agentId)?.workers.get(agentId);
+    for (const { g, agentId, reason } of staleAgentIds) {
+      const row = g.workers.get(agentId);
       if (reason === "absolute") {
         const age = Math.floor((now - (row?.createdAtMs ?? now)) / 1000);
         log(`worker-feed: ABSOLUTE cap reap agent=${agentId} \u2014 row age ${age}s (>= ${Math.floor(absoluteRowLifetimeCapMs / 1000)}s); force-terminating immortal row (survives lastUpdateAt reset)`);
       } else {
         log(`worker-feed: TTL reap agent=${agentId} \u2014 no update in ${Math.floor((now - (row?.lastUpdateAt ?? now)) / 1000)}s (>= ${Math.floor(staleWorkerTtlMs / 1000)}s); force-terminating leaked row`);
       }
-      terminateWorker(agentId);
+      if (groupOfAgent(agentId) === g) {
+        terminateWorker(agentId);
+      } else {
+        log(`worker-feed: force-evicting leaked row agent=${agentId} feed=${g.feedKey} \u2014 agentIndex desynced (points elsewhere); removing directly`);
+        markFinalized(agentId);
+        evictRowFromGroup(g, agentId);
+        syncPin(g);
+      }
     }
     for (const g of [...groups.values()]) {
       if (g.pendingFinalize.size > 0 && now >= g.cooldownUntil) {
@@ -41378,6 +41548,14 @@ function createWorkerActivityFeed(opts) {
     }
   }
   heartbeatTimer = setIntervalFn(heartbeatTick, heartbeatTickMs);
+  opts.exposeTestControls?.({
+    repointAgentIndex: (agentId, feedKey) => {
+      if (feedKey == null)
+        agentIndex.delete(agentId);
+      else
+        agentIndex.set(agentId, feedKey);
+    }
+  });
   return {
     has(agentId) {
       const g = groupOfAgent(agentId);
@@ -41405,6 +41583,14 @@ function createWorkerActivityFeed(opts) {
       if (existingRow?.finished === true)
         return Promise.resolve();
       const feedKey = feedKeyOf(chatId, threadId);
+      const priorFeedKey = agentIndex.get(agentId);
+      if (priorFeedKey != null && priorFeedKey !== feedKey) {
+        const priorGroup = groups.get(priorFeedKey);
+        if (priorGroup != null) {
+          evictRowFromGroup(priorGroup, agentId);
+          syncPin(priorGroup);
+        }
+      }
       let g = groups.get(feedKey);
       if (g == null) {
         g = {
@@ -57142,40 +57328,6 @@ function sendGateConfigFromEnv(env = process.env) {
   return out;
 }
 
-// shared/local-time.ts
-function fmtLocalClock(ms, tz) {
-  return new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    hour: "numeric",
-    minute: "2-digit",
-    hour12: true
-  }).format(new Date(ms)).replace(/\s([AP])M$/, (_m, p) => `${p.toLowerCase()}m`);
-}
-function fmtLocalDate(ms, tz) {
-  return new Intl.DateTimeFormat("en-GB", {
-    timeZone: tz,
-    day: "numeric",
-    month: "short"
-  }).format(new Date(ms));
-}
-function localDay(ms, tz) {
-  return new Intl.DateTimeFormat("en-CA", {
-    timeZone: tz,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit"
-  }).format(new Date(ms));
-}
-function tzAbbrev(ms, tz) {
-  const at = new Date(ms);
-  for (const loc of ["en-US", "en-AU", "en-GB"]) {
-    const v = new Intl.DateTimeFormat(loc, { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
-    if (v && !/^(?:GMT|UTC)/i.test(v))
-      return v;
-  }
-  return new Intl.DateTimeFormat("en-US", { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value ?? tz;
-}
-
 // send-gate-observability.ts
 function formatStatsLine(stats) {
   const c = stats.global;
@@ -57210,7 +57362,7 @@ function createStatsLogger(config) {
 function isAlertableScope(scopeKey) {
   return scopeKey === "global" || scopeKey.startsWith("chat:") || scopeKey.startsWith("group:");
 }
-function fmtLocalStamp(ms, tz, refMs) {
+function fmtLocalStamp3(ms, tz, refMs) {
   const clock = fmtLocalClock(ms, tz);
   const sameDay = refMs != null && localDay(ms, tz) === localDay(refMs, tz);
   const body = sameDay ? clock : `${fmtLocalDate(ms, tz)} ${clock}`;
@@ -57254,7 +57406,7 @@ function createFloodWindowObserver(config) {
   }
   function openAlertText(w, now) {
     const openFor = fmtDur(now - w.observedAt);
-    return `\u26a0\ufe0f Telegram flood ban active (scope \`${w.scopeKey}\`). ` + `Open for ${openFor}, expected to clear at ${fmtLocalStamp(w.untilTs, tz, now)}. ` + `Outbound to that scope is being suppressed.`;
+    return `\u26a0\ufe0f Telegram flood ban active (scope \`${w.scopeKey}\`). ` + `Open for ${openFor}, expected to clear at ${fmtLocalStamp3(w.untilTs, tz, now)}. ` + `Outbound to that scope is being suppressed.`;
   }
   function closeAlertText(recs) {
     const observedAt = Math.min(...recs.map((r) => r.observedAt));
@@ -63285,6 +63437,7 @@ function endsWithSilentMarker(text4) {
     return false;
   return isSilentFlushMarker(lines[lines.length - 1]);
 }
+var FLUSH_SUBSTANTIVE_MIN_CHARS = 200;
 function selectFlushDeliveryText(blocks) {
   const candidates = blocks.map((b) => b.trim()).filter((b) => b.length > 0);
   if (candidates.length === 0)
@@ -63299,8 +63452,18 @@ function selectFlushDeliveryText(blocks) {
 `);
 }
 var NARRATION_OPENER = /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i;
+var NARRATION_TRAILER = /(?:\.{3}|\u2026|:)\s*$/;
+function isTrailingNarrationLine(block) {
+  const t = block.trim();
+  if (t.length === 0 || t.length >= FLUSH_SUBSTANTIVE_MIN_CHARS)
+    return false;
+  if (t.includes(`
+`))
+    return false;
+  return NARRATION_TRAILER.test(t);
+}
 function isNarrationBlock(block) {
-  return NARRATION_OPENER.test(block.trimStart());
+  return NARRATION_OPENER.test(block.trimStart()) || isTrailingNarrationLine(block);
 }
 function decideTurnFlush(input) {
   const flushEnabled = input.flushEnabled !== false;
@@ -69185,7 +69348,7 @@ function endsWithSilentMarker2(text4) {
     return false;
   return isSilentFlushMarker2(lines[lines.length - 1]);
 }
-var FLUSH_SUBSTANTIVE_MIN_CHARS = 200;
+var FLUSH_SUBSTANTIVE_MIN_CHARS2 = 200;
 function selectFlushDeliveryText2(blocks) {
   const candidates = blocks.map((b) => b.trim()).filter((b) => b.length > 0);
   if (candidates.length === 0)
@@ -69200,8 +69363,18 @@ function selectFlushDeliveryText2(blocks) {
 `);
 }
 var NARRATION_OPENER2 = /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i;
+var NARRATION_TRAILER2 = /(?:\.{3}|\u2026|:)\s*$/;
+function isTrailingNarrationLine2(block) {
+  const t = block.trim();
+  if (t.length === 0 || t.length >= FLUSH_SUBSTANTIVE_MIN_CHARS2)
+    return false;
+  if (t.includes(`
+`))
+    return false;
+  return NARRATION_TRAILER2.test(t);
+}
 function isNarrationBlock2(block) {
-  return NARRATION_OPENER2.test(block.trimStart());
+  return NARRATION_OPENER2.test(block.trimStart()) || isTrailingNarrationLine2(block);
 }
 function decideTurnFlush2(input) {
   const flushEnabled = input.flushEnabled !== false;
@@ -71136,16 +71309,6 @@ Allowed: \`${deps.escapeHtml(allow)}\``, { html: true });
   await deps.reply(ctx, finalText, { html: true, accent });
 }
 
-// ../src/agents/model-picker.ts
-function labelTag(label) {
-  let h = 2166136261;
-  for (const ch of label) {
-    h ^= ch.codePointAt(0);
-    h = Math.imul(h, 16777619) >>> 0;
-  }
-  return h.toString(16).padStart(8, "0");
-}
-
 // gateway/model-command.ts
 var MODEL_ALIASES = ["opus", "sonnet", "haiku", "fable", "default"];
 var MODEL_ARG_RE = /^[A-Za-z0-9][A-Za-z0-9._/\[\]-]{0,99}$/;
@@ -71155,12 +71318,6 @@ function isValidModelArg(arg) {
 function isSrModel(name) {
   return name.startsWith("sr-");
 }
-function isClaudeModel(name) {
-  const lower = name.toLowerCase();
-  if (MODEL_ALIASES.includes(lower))
-    return true;
-  return lower.startsWith("claude-");
-}
 function parseModelCommand(text4) {
   const m = text4.match(/^\/model(?:@[A-Za-z0-9_]+)?(?:\s+([\s\S]*))?$/);
   if (!m)
@@ -71204,13 +71361,13 @@ function modelCommandReceiptLine(agent, parsed, busy) {
   const arg = parsed.kind === "set" ? parsed.model : parsed.kind === "show" ? "(show)" : "(help)";
   return `telegram gateway: gw /model received agent=${agent} kind=${parsed.kind} arg=${arg} busy=${busy}`;
 }
-var PERSIST_NOTE = "_Session-only \u2014 this override lasts until the agent\u2019s next restart, then reverts to the configured `model:`. `/model default` clears it now. To change the default permanently, set `model:` in switchroom.yaml._";
+var PERSIST_NOTE = "_A `/model` switch relaunches the session (~30s) on the chosen model. Session-only \u2014 reverts to the configured `model:` on the next restart. `/model default` reverts now. Live scrollback is replaced by a fresh session; memory and the handoff briefing carry the context. To change the default permanently, set `model:` in switchroom.yaml._";
 function helpText2(deps, reason) {
   const srAliasExamples = Object.keys(SR_MODEL_ALIASES).map((a) => `\`${a}\``).join(" \u00b7 ");
   const lines = [];
   if (reason)
     lines.push(`\u26a0\ufe0f ${deps.escapeHtml(reason)}`);
-  lines.push("**/model** \u2014 show or switch the Claude model", "`/model` \u2014 show the configured model", `\`/model <name>\` \u2014 switch the live session (${MODEL_ALIASES.map((a) => `\`${a}\``).join(" \u00b7 ")} or a full model id)`, `_OpenRouter shortcuts:_ ${srAliasExamples}`, "_OpenRouter (sr-\\*) switches restart the session (~30s); Claude switches apply instantly._", PERSIST_NOTE);
+  lines.push("**/model** \u2014 show or switch the Claude model", "`/model` \u2014 show the configured model", `\`/model <name>\` \u2014 switch the live session (${MODEL_ALIASES.map((a) => `\`${a}\``).join(" \u00b7 ")} or a full model id)`, `_OpenRouter shortcuts:_ ${srAliasExamples}`, "_Every switch relaunches the session (~30s) on the chosen model \u2014 Claude and OpenRouter (sr-\\*) alike._", PERSIST_NOTE);
   return { text: lines.join(`
 `), html: true };
 }
@@ -71244,132 +71401,46 @@ async function handleModelCommand(parsed, deps) {
       html: true
     };
   }
-  const currentSession = deps.getActiveSessionModel();
-  if (currentSession !== null && isSrModel(currentSession) && isClaudeModel(model)) {
-    try {
-      await deps.scheduleModelRelaunch(model, `user: /model ${model} (sr-to-claude restart)`);
-    } catch (err) {
-      if (isRestartInFlight(err)) {
-        return {
-          text: `\u23f3 A restart is already in flight \u2014 your switch to \`${deps.escapeHtml(model)}\` will apply as it completes (~15s).`,
-          html: true
-        };
-      }
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        text: `\u274c Could not schedule restart: ${deps.escapeHtml(msg)}`,
-        html: true
-      };
-    }
-    return {
-      text: [
-        `Switching from \`${deps.escapeHtml(currentSession)}\` back to Claude \u2014 restarting session cleanly. Claude will be ready in ~30s.`,
-        PERSIST_NOTE
-      ].join(`
-`),
-      html: true
-    };
+  if (model.toLowerCase() === "default") {
+    return scheduleDefaultRelaunchReply(deps, "user: /model default (revert relaunch)");
   }
-  if (isSrModel(model)) {
-    try {
-      await deps.scheduleModelRelaunch(model, `user: /model ${model} (session-only relaunch)`);
-    } catch (err) {
-      if (isRestartInFlight(err)) {
-        return {
-          text: `\u23f3 A restart is already in flight \u2014 your switch to \`${deps.escapeHtml(model)}\` will apply as it completes (~15s).`,
-          html: true
-        };
-      }
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        text: `\u274c Could not schedule model switch: ${deps.escapeHtml(msg)}`,
-        html: true
-      };
-    }
+  return scheduleRelaunchReply(deps, model, `user: /model ${model} (session-only relaunch)`);
+}
+function switchingLine(deps, model) {
+  const friendly = isSrModel(model) ? srFriendlyLabel(model) : model;
+  return `\uD83D\uDD04 Switching to \`${deps.escapeHtml(friendly)}\` \u2014 relaunching the session (~30s).`;
+}
+function relaunchErrorReply(deps, model, err) {
+  if (isRestartInFlight(err)) {
     return {
-      text: [
-        `Switching to \`${deps.escapeHtml(model)}\` \u2014 restarting session (~30s).`,
-        PERSIST_NOTE
-      ].join(`
-`),
+      text: `\u23f3 A restart is already in flight \u2014 your switch to \`${deps.escapeHtml(model)}\` will apply as it completes (~15s).`,
       html: true
     };
   }
-  const verbHtml = `\`/model ${deps.escapeHtml(model)}\``;
-  let result;
+  const msg = err instanceof Error ? err.message : String(err);
+  return { text: `\u274c Could not schedule model switch: ${deps.escapeHtml(msg)}`, html: true };
+}
+async function scheduleRelaunchReply(deps, model, reason) {
   try {
-    result = await deps.inject(deps.getAgentName(), `/model ${model}`, {
-      successPattern: MODEL_SWITCH_CONFIRMATION_PREFIX,
-      errorPattern: MODEL_SWITCH_ERROR_RE,
-      settleBeforeSendMs: 1500
-    });
+    await deps.scheduleModelRelaunch(model, reason);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return {
-      text: `\u274c ${verbHtml} \u2014 inject failed: ${deps.escapeHtml(msg)}`,
-      html: true
-    };
+    return relaunchErrorReply(deps, model, err);
   }
-  if (result.outcome === "ok" || result.outcome === "ok_no_output") {
-    const confirmation = result.outcome === "ok" ? modelSwitchConfirmationLine(result.output) : null;
-    if (confirmation) {
-      if (isKeptModelConfirmation(confirmation)) {
-        return {
-          text: [
-            `${verbHtml}`,
-            deps.preBlock(confirmation),
-            ...result.truncated ? ["_truncated_"] : [],
-            PERSIST_NOTE
-          ].join(`
-`),
-          html: true
-        };
-      }
-      const confirmed = sessionModelFromConfirmation(confirmation) ?? model;
-      return {
-        text: [
-          `${verbHtml}`,
-          deps.preBlock(confirmation),
-          ...result.truncated ? ["_truncated_"] : [],
-          PERSIST_NOTE
-        ].join(`
-`),
-        html: true,
-        selectedModel: confirmed
-      };
-    }
-    const errLine = result.outcome === "ok" ? modelSwitchErrorLine(result.output) : null;
-    if (errLine) {
-      return {
-        text: [
-          `\u274c ${verbHtml} \u2014 the switch did not take:`,
-          deps.preBlock(errLine),
-          "Check `/model` for a valid, available model."
-        ].join(`
-`),
-        html: true
-      };
-    }
-    const optimisticLabel = optimisticModelRecordLabel(model);
-    return {
-      text: [
-        `${verbHtml} \u2014 sent, but couldn't read a confirmation line. \`/status\` will show the live model once it's confirmed.`,
-        PERSIST_NOTE
-      ].join(`
-`),
-      html: true,
-      selectedModel: optimisticLabel,
-      optimistic: true
-    };
-  }
-  if (result.errorCode === "session_missing") {
-    return {
-      text: "\u274c tmux session not found \u2014 the agent must be running under the tmux supervisor (the default). Remove `experimental.legacy_pty: true` if set.",
-      html: true
-    };
+  return { text: [switchingLine(deps, model), PERSIST_NOTE].join(`
+`), html: true };
+}
+async function scheduleDefaultRelaunchReply(deps, reason) {
+  try {
+    await deps.scheduleModelDefaultRelaunch(reason);
+  } catch (err) {
+    return relaunchErrorReply(deps, "default", err);
   }
   return {
-    text: `\u274c ${verbHtml} \u2014 ${deps.escapeHtml(result.errorMessage ?? "inject failed")}`,
+    text: [
+      "\uD83D\uDD04 Reverting to the configured default model \u2014 relaunching the session (~30s).",
+      PERSIST_NOTE
+    ].join(`
+`),
     html: true
   };
 }
@@ -71422,15 +71493,6 @@ function expandSrAlias(arg) {
 function srFriendlyLabel(srName) {
   return SR_MODEL_LABELS[srName] ?? srName.replace(/^sr-/, "").replace(/-/g, " ");
 }
-function optimisticModelRecordLabel(token) {
-  if (isSrModel(token))
-    return token;
-  const lower = token.toLowerCase();
-  if (MODEL_ALIASES.includes(lower)) {
-    return lower.charAt(0).toUpperCase() + lower.slice(1);
-  }
-  return token;
-}
 function classifyDiscoveredOptions(options) {
   return {
     claude: options.filter((o) => !o.label.startsWith("sr-") && !o.label.includes("/") && (/^[A-Z]/.test(o.label) || o.label.startsWith("claude-"))),
@@ -71438,7 +71500,19 @@ function classifyDiscoveredOptions(options) {
   };
 }
 function modelSelectCallbackData(label) {
-  return `${MODEL_CALLBACK_SELECT}${labelTag(label)}`;
+  const token = canonicalClaudeToken(label);
+  if (token)
+    return `${MODEL_CALLBACK_SELECT}${token}`;
+  if (/^default\b/i.test(label.trim()))
+    return `${MODEL_CALLBACK_SELECT}default`;
+  return MODEL_CALLBACK_SELECT;
+}
+function isRecognizedSwitchToken(token) {
+  if (token.toLowerCase() === "default")
+    return true;
+  if (isSrModel(token))
+    return true;
+  return canonicalClaudeToken(token) !== null;
 }
 var BUSY_REFUSAL_TEXT = "\u23f3 The agent is mid-turn \u2014 the model picker needs an idle prompt. Your tap was not applied.";
 function isBusyRefusalText(text4) {
@@ -71588,75 +71662,28 @@ async function handleModelMenuCallback(data, deps) {
   if (data === MODEL_CALLBACK_PAGE_MAIN) {
     return { answer: "Back", reply: await buildModelMenu(deps, "main") };
   }
-  if (data.startsWith(MODEL_CALLBACK_ALIAS)) {
-    const alias = data.slice(MODEL_CALLBACK_ALIAS.length);
-    if (!isValidModelArg(alias)) {
-      return { answer: "Invalid model name", reply: await buildModelMenu(deps) };
-    }
-    if (deps.isBusy()) {
-      return {
-        answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-        reply: { text: BUSY_REFUSAL_TEXT, html: true },
-        toastOnly: true,
-        busyRefusal: true
-      };
-    }
-    let aliasResult;
-    try {
-      aliasResult = await deps.inject(deps.getAgentName(), `/model ${alias}`, {
-        successPattern: MODEL_SWITCH_CONFIRMATION_PREFIX,
-        errorPattern: MODEL_SWITCH_ERROR_RE,
-        settleBeforeSendMs: 1500
-      });
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        answer: "Switch failed",
-        reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(alias)}** failed: ${deps.escapeHtml(msg)}`)
-      };
-    }
-    if (aliasResult.outcome === "ok" || aliasResult.outcome === "ok_no_output") {
-      const confirmation = aliasResult.outcome === "ok" ? modelSwitchConfirmationLine(aliasResult.output) : null;
-      if (confirmation) {
-        const kept = isKeptModelConfirmation(confirmation);
-        return {
-          answer: confirmation,
-          reply: await menuWithBannerStatic(deps, `\u2705 ${deps.escapeHtml(confirmation)}`),
-          ...kept ? {} : {
-            selectedModel: sessionModelFromConfirmation(confirmation) ?? optimisticModelRecordLabel(alias),
-            selectedModelToken: alias
-          }
-        };
-      }
-      const aliasErr = aliasResult.outcome === "ok" ? modelSwitchErrorLine(aliasResult.output) : null;
-      if (aliasErr) {
-        return {
-          answer: "Switch failed",
-          reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(alias)}** did not take: ${deps.escapeHtml(aliasErr)}`)
-        };
-      }
-      const optimisticLabel = optimisticModelRecordLabel(alias);
-      return {
-        answer: `Sent /model ${alias} \u2014 check /status`,
-        reply: await menuWithBannerStatic(deps, `Sent \`/model ${deps.escapeHtml(alias)}\` \u2014 couldn\u2019t read a confirmation line. \`/status\` will show the live model once it\u2019s confirmed.`),
-        selectedModel: optimisticLabel,
-        selectedModelToken: alias
-      };
-    }
-    return {
-      answer: "Switch failed",
-      reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(alias)}** failed \u2014 agent may be mid-turn`)
-    };
-  }
   if (data === MODEL_CALLBACK_HEADER) {
     return { answer: "Tap a model in this section to switch", reply: { text: "", html: true }, toastOnly: true };
   }
-  if (data.startsWith(MODEL_CALLBACK_SR)) {
-    const srName = data.slice(MODEL_CALLBACK_SR.length);
-    const friendlyName = srFriendlyLabel(srName);
-    if (!isValidModelArg(srName)) {
+  if (data.startsWith(MODEL_CALLBACK_ALIAS) || data.startsWith(MODEL_CALLBACK_SR) || data.startsWith(MODEL_CALLBACK_SELECT)) {
+    let token;
+    let label;
+    if (data.startsWith(MODEL_CALLBACK_ALIAS)) {
+      token = data.slice(MODEL_CALLBACK_ALIAS.length);
+      label = token;
+    } else if (data.startsWith(MODEL_CALLBACK_SR)) {
+      token = data.slice(MODEL_CALLBACK_SR.length);
+      label = srFriendlyLabel(token);
+    } else {
+      token = data.slice(MODEL_CALLBACK_SELECT.length);
+      label = token;
+    }
+    if (!isValidModelArg(token)) {
       return { answer: "Invalid model name", reply: await buildModelMenu(deps) };
     }
+    if (!isRecognizedSwitchToken(token)) {
+      return { answer: "Model list changed \u2014 menu refreshed", reply: await buildModelMenu(deps) };
+    }
     if (deps.isBusy()) {
       return {
         answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
@@ -71665,87 +71692,38 @@ async function handleModelMenuCallback(data, deps) {
         busyRefusal: true
       };
     }
-    try {
-      await deps.scheduleModelRelaunch(srName, `user: /model ${srName} (session-only relaunch, menu)`);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+    return menuRelaunchOutcome(deps, token, label);
+  }
+  return { answer: "Unknown action", reply: await buildModelMenu(deps) };
+}
+async function menuRelaunchOutcome(deps, token, label) {
+  const isDefault = token.toLowerCase() === "default";
+  try {
+    if (isDefault) {
+      await deps.scheduleModelDefaultRelaunch("user: /model default (revert relaunch, menu)");
+    } else {
+      await deps.scheduleModelRelaunch(token, `user: /model ${token} (session-only relaunch, menu)`);
+    }
+  } catch (err) {
+    if (isRestartInFlight(err)) {
       return {
-        answer: "Switch failed",
-        reply: await menuWithBannerStatic(deps, `\u274c Switch to **${deps.escapeHtml(friendlyName)}** failed: ${deps.escapeHtml(msg)}`)
+        answer: "A restart is already in flight (~15s)",
+        reply: await menuWithBannerStatic(deps, `\u23f3 A restart is already in flight \u2014 your switch to **${deps.escapeHtml(label)}** will apply as it completes (~15s).`)
       };
     }
+    const msg = err instanceof Error ? err.message : String(err);
     return {
-      answer: `Switching to ${friendlyName} \u2014 restarting (~30s)`,
-      reply: await menuWithBannerStatic(deps, `\uD83D\uDD04 Switching session to **${deps.escapeHtml(friendlyName)}** \u2014 restarting (~30s).
-${PERSIST_NOTE}`),
-      selectedModel: srName
-    };
-  }
-  if (!data.startsWith(MODEL_CALLBACK_SELECT)) {
-    return { answer: "Unknown action", reply: await buildModelMenu(deps) };
-  }
-  if (deps.isBusy()) {
-    return {
-      answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-      reply: { text: BUSY_REFUSAL_TEXT, html: true },
-      toastOnly: true,
-      busyRefusal: true
-    };
-  }
-  const tag = data.slice(MODEL_CALLBACK_SELECT.length);
-  const discovered = await deps.discover(deps.getAgentName());
-  if (!discovered.ok) {
-    return {
-      answer: "Picker unavailable",
-      reply: await menuWithBanner(deps, `\u274c Could not open the model picker: ${deps.escapeHtml(discovered.reason)}`)
-    };
-  }
-  const target = discovered.options.find((o) => labelTag(o.label) === tag);
-  if (!target) {
-    const fresh = await buildModelMenu(deps);
-    return { answer: "Model list changed \u2014 menu refreshed", reply: fresh };
-  }
-  const result = await deps.select(deps.getAgentName(), target.label);
-  if (!result.ok) {
-    return {
-      answer: "Switch failed \u2014 see the menu",
-      reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(target.label)}** failed: ${deps.escapeHtml(result.reason)}`)
-    };
-  }
-  if (isKeptModelConfirmation(result.confirmation)) {
-    return {
-      answer: deps.escapeHtml(result.confirmation),
-      reply: await menuWithBanner(deps, `\u2705 ${deps.escapeHtml(result.confirmation)}`)
+      answer: "Switch failed",
+      reply: await menuWithBannerStatic(deps, `\u274c Switch to **${deps.escapeHtml(label)}** failed: ${deps.escapeHtml(msg)}`)
     };
   }
-  const token = canonicalClaudeToken(target.label);
-  const selectedModel = sessionModelFromConfirmation(result.confirmation) ?? token ?? undefined;
-  const clearedDefault = token == null && /^default\b/i.test(target.label.trim());
+  const friendly = isDefault ? "the configured default" : label;
   return {
-    answer: deps.escapeHtml(result.confirmation),
-    reply: await menuWithBanner(deps, `\u2705 ${deps.escapeHtml(result.confirmation)}`),
-    ...selectedModel ? { selectedModel } : {},
-    ...token ? { selectedModelToken: token } : {},
-    ...clearedDefault ? { clearedDefault: true } : {}
+    answer: `Switching to ${isDefault ? "default" : label} \u2014 relaunching (~30s)`,
+    reply: await menuWithBannerStatic(deps, `\uD83D\uDD04 Switching session to **${deps.escapeHtml(friendly)}** \u2014 relaunching (~30s).
+${PERSIST_NOTE}`)
   };
 }
-function isSrToClaudeTransition(prevModel, nextModel) {
-  return !!prevModel?.startsWith("sr-") && !nextModel.startsWith("sr-");
-}
-function modelSwitchConfirmationLine(output) {
-  const line = output.split(`
-`).map((l) => l.trim()).find((l) => MODEL_SWITCH_CONFIRMATION_PREFIX.test(l));
-  return line && line.length > 0 ? line : null;
-}
-var MODEL_SWITCH_ERROR_RE = /^\s*[\u23fa\u25cf\u2022>\u23bf-]?\s*(?:Error:\s*)?(?:Model(?:\s+'[^']+')?\s+not found|Invalid model|Unknown model|No such model|(?:[\w'\u2019.\-]+\s+){0,4}(?:(?:is |are )?(?:not available|unavailable|not enabled|not supported)|access denied|requires\b[^\n]{0,40}\b(?:subscription|plan)|no access)\b)/i;
-function modelSwitchErrorLine(output) {
-  const line = output.split(`
-`).map((l) => l.trim()).find((l) => MODEL_SWITCH_ERROR_RE.test(l));
-  return line && line.length > 0 ? line : null;
-}
-function isKeptModelConfirmation(confirmation) {
-  return /^\s*[\u23fa\u25cf\u2022>\u23bf-]?\s*Kept model as\b/i.test(confirmation.trim());
-}
 function canonicalClaudeToken(label) {
   const l = label.trim();
   if (l.toLowerCase().startsWith("claude-"))
@@ -71760,21 +71738,6 @@ function canonicalClaudeToken(label) {
 function isRestartInFlight(err) {
   return !!err && typeof err === "object" && err.code === "restart_in_flight";
 }
-var MODEL_SWITCH_CONFIRMATION_PREFIX = /^\s*[\u23fa\u25cf\u2022>\u23bf-]?\s*(?:Set model to|Switched to|Kept model as)\b/i;
-function sessionModelFromConfirmation(confirmation) {
-  const m = /(?:Set model to|Switched to)\s+(.+?)(?:\s+for (?:this|the) session|\s+and saved\b|\s*\(|\s*$)/i.exec(confirmation.trim());
-  const name = m?.[1]?.trim();
-  return name && name.length > 0 ? name : null;
-}
-async function menuWithBanner(deps, banner) {
-  const fresh = await buildModelMenu(deps);
-  return {
-    text: [banner, "", fresh.text].join(`
-`),
-    html: true,
-    ...fresh.keyboard ? { keyboard: fresh.keyboard } : {}
-  };
-}
 async function menuWithBannerStatic(deps, banner) {
   const v1 = await handleModelCommand({ kind: "show" }, deps);
   return {
@@ -72186,70 +72149,6 @@ async function discoverModels(agentName3, opts = {}) {
     return { ok: true, options: parsed.options, currentLabel: current?.label ?? null, ...tail };
   });
 }
-async function selectModel(agentName3, targetLabel, opts = {}) {
-  const io = makeIo(agentName3, opts);
-  if (!io.runner.hasSession(io.socket, io.session)) {
-    return { ok: false, reason: "tmux session not found" };
-  }
-  return withPaneLock(`${io.socket}:${io.session}`, async () => {
-    io.startedAt = Date.now();
-    let selected = false;
-    try {
-      const parsed = await openPickerWithRetry(io);
-      if (!parsed || !parsed.footerSeen) {
-        return { ok: false, reason: "picker did not render \u2014 agent may be mid-turn" };
-      }
-      const target = parsed.options.find((o) => o.label === targetLabel);
-      if (!target) {
-        const have = parsed.options.map((o) => o.label).join(", ");
-        return { ok: false, reason: `option "${targetLabel}" not offered (have: ${have})` };
-      }
-      if (parsed.cursorIndex < 0) {
-        return { ok: false, reason: "cursor marker not visible \u2014 refusing blind navigation" };
-      }
-      const delta = target.index - parsed.cursorIndex;
-      const key = delta > 0 ? "Down" : "Up";
-      for (let i = 0;i < Math.abs(delta); i++) {
-        if (expired(io))
-          return { ok: false, reason: "timed out navigating picker" };
-        sendKey(io, key);
-        await io.sleep(Math.min(io.stepMs, 250));
-      }
-      await io.sleep(io.stepMs);
-      const verifyPane = io.runner.capture(io.socket, io.session) ?? "";
-      const verify = parseModelPicker(verifyPane);
-      const atRow = verify?.options.find((o) => o.index === verify.cursorIndex);
-      if (!verify || !atRow || atRow.label !== targetLabel) {
-        return {
-          ok: false,
-          reason: `cursor verification failed (on "${atRow?.label ?? "?"}", wanted "${targetLabel}")`
-        };
-      }
-      sendLiteral(io, "s");
-      selected = true;
-      await io.sleep(io.stepMs);
-      const after = io.runner.capture(io.socket, io.session) ?? "";
-      const confirmation = extractConfirmation(after) ?? `Switched to ${targetLabel} (session)`;
-      return { ok: true, confirmation };
-    } catch (err) {
-      return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    } finally {
-      if (!selected) {
-        await dismissOrWarn(io, "select");
-      }
-    }
-  });
-}
-function extractConfirmation(pane) {
-  const lines = pane.split(`
-`);
-  for (let i = lines.length - 1;i >= 0; i--) {
-    const t = lines[i].replace(/^\s*\u23bf\s*/, "").trim();
-    if (/^(Set model to|Kept model as|Switched to)/i.test(t))
-      return t;
-  }
-  return null;
-}
 
 // ../src/agents/scaffold.ts
 import { join as join33, resolve as resolve6 } from "node:path";
@@ -76759,6 +76658,28 @@ function workerAgentIdOfPinKey(pinKey) {
   const agentId = pinKey.slice(WORKER_PIN_KEY_PREFIX.length);
   return agentId.length > 0 ? agentId : null;
 }
+function storeOnlyWorkerPinCandidates(args) {
+  const out = [];
+  for (const r of args.rows) {
+    if (workerAgentIdOfPinKey(r.pinKey) == null)
+      continue;
+    if (r.pending)
+      continue;
+    if (r.expiresAt != null)
+      continue;
+    if (r.chatId.length === 0)
+      continue;
+    if (args.inMemoryPinKeys.has(r.pinKey))
+      continue;
+    out.push({
+      pinKey: r.pinKey,
+      chatId: r.chatId,
+      pinnedAt: args.now,
+      messageId: r.messageId
+    });
+  }
+  return out;
+}
 function decideWorkerPinReaps(args) {
   const reaps = [];
   for (const pin of args.pins) {
@@ -77497,17 +77418,20 @@ function computeTurnStatus(turn) {
       return turn.finalAnswerDelivered ? "complete" : "no_reply";
   }
 }
-function backstopSendOutcome(args) {
+function backstopSendOutcomeGated(args) {
   if (args.threw)
     return "failed";
   if (args.chunkCount === 0)
     return "failed";
-  if (args.sentCount < args.chunkCount)
+  const freshCount = args.sentIds.filter((id) => args.cardMessageId == null || id !== args.cardMessageId).length;
+  if (freshCount === 0)
+    return "failed";
+  if (freshCount < args.chunkCount)
     return "failed";
   return "delivered";
 }
-function finalizeBackstopSend(turn, send) {
-  const outcome = backstopSendOutcome(send);
+function finalizeBackstopSendGated(turn, send) {
+  const outcome = backstopSendOutcomeGated(send);
   turn.deliveryOutcome = outcome;
   return outcome;
 }
@@ -77522,6 +77446,120 @@ function buildTurnRecord(turn, endedAt) {
   };
 }
 
+// gateway/backstop-delivery.ts
+class BackstopDeliveryLedger {
+  latched = new Set;
+  chunks = new Map;
+  pending = new Map;
+  claim(turnId) {
+    if (this.latched.has(turnId))
+      return false;
+    this.latched.add(turnId);
+    return true;
+  }
+  release(turnId) {
+    this.latched.delete(turnId);
+  }
+  markPending(turnId, index2) {
+    let set = this.pending.get(turnId);
+    if (set == null) {
+      set = new Set;
+      this.pending.set(turnId, set);
+    }
+    set.add(index2);
+  }
+  recordChunk(turnId, index2, messageIds) {
+    let m = this.chunks.get(turnId);
+    if (m == null) {
+      m = new Map;
+      this.chunks.set(turnId, m);
+    }
+    m.set(index2, messageIds.slice());
+    this.pending.get(turnId)?.delete(index2);
+  }
+  hasChunk(turnId, index2) {
+    return (this.chunks.get(turnId)?.get(index2)?.length ?? 0) > 0;
+  }
+  sentIds(turnId) {
+    const m = this.chunks.get(turnId);
+    if (m == null)
+      return [];
+    const out = [];
+    for (const index2 of Array.from(m.keys()).sort((a, b) => a - b)) {
+      out.push(...m.get(index2) ?? []);
+    }
+    return out;
+  }
+  entries(turnId) {
+    const m = this.chunks.get(turnId);
+    if (m == null)
+      return [];
+    return Array.from(m.keys()).sort((a, b) => a - b).map((index2) => ({ index: index2, messageIds: (m.get(index2) ?? []).slice() }));
+  }
+  unsentIndices(turnId, chunkCount) {
+    const out = [];
+    for (let i = 0;i < chunkCount; i++) {
+      if (!this.hasChunk(turnId, i))
+        out.push(i);
+    }
+    return out;
+  }
+  clear(turnId) {
+    this.latched.delete(turnId);
+    this.chunks.delete(turnId);
+    this.pending.delete(turnId);
+  }
+}
+function backstopReceiptIds(sentIds, cardMessageId) {
+  return sentIds.filter((id) => cardMessageId == null || id !== cardMessageId);
+}
+async function runBackstopDelivery(ledger, turnId, chunks, cardMessageId, deps, maxAttempts = 3) {
+  const stderr = deps.stderr ?? (() => {});
+  const chunkCount = chunks.length;
+  let attempts = 0;
+  for (let attempt = 1;attempt <= Math.max(1, maxAttempts); attempt++) {
+    attempts = attempt;
+    const resume = ledger.unsentIndices(turnId, chunkCount);
+    if (resume.length === 0)
+      break;
+    if (attempt > 1) {
+      stderr(`telegram gateway: backstop delivery retry ${attempt}/${maxAttempts} \u2014 ` + `resuming at unsent chunk(s) [${resume.join(", ")}] for turn ${turnId}
+`);
+    }
+    let attemptThrew = false;
+    try {
+      for (const i of resume) {
+        if (ledger.hasChunk(turnId, i))
+          continue;
+        ledger.markPending(turnId, i);
+        const ids = await deps.sendChunk(i, chunks[i]);
+        ledger.recordChunk(turnId, i, ids);
+      }
+    } catch (err) {
+      attemptThrew = true;
+      stderr(`telegram gateway: backstop delivery attempt ${attempt}/${maxAttempts} failed: ` + `${err instanceof Error ? err.message : String(err)}
+`);
+    }
+    if (!attemptThrew && ledger.unsentIndices(turnId, chunkCount).length === 0)
+      break;
+  }
+  const sentIds = ledger.sentIds(turnId);
+  const delivered = chunkCount > 0 && ledger.unsentIndices(turnId, chunkCount).length === 0 && backstopReceiptIds(sentIds, cardMessageId).length > 0;
+  const exhausted = !delivered;
+  if (deps.recordOutbound && sentIds.length > 0) {
+    const texts = [];
+    const ids = [];
+    for (const { index: index2, messageIds } of ledger.entries(turnId)) {
+      for (const id of messageIds) {
+        ids.push(id);
+        texts.push(chunks[index2] ?? "");
+      }
+    }
+    deps.recordOutbound(ids, texts);
+  }
+  return { sentIds, chunkCount, delivered, attempts, exhausted };
+}
+
 // gateway/inbound-delivery-confirm.ts
 function createDeliveryQueue() {
   return { pending: new Map };
@@ -84131,10 +84169,10 @@ function effectiveTurnAgeMs(markerAgeMs, turnStartedAt, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.18.27";
-var COMMIT_SHA = "93871829";
-var COMMIT_DATE = "2026-07-16T01:31:20Z";
-var LATEST_PR = 3273;
+var VERSION = "0.18.29";
+var COMMIT_SHA = "8f9b38b3";
+var COMMIT_DATE = "2026-07-16T21:47:27+10:00";
+var LATEST_PR = 3281;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -86692,6 +86730,73 @@ var deferredDoneReactions = new DeferredDoneReactions({
 });
 var outboundDedup = new OutboundDedupCache;
 var flushedTurnSupersede = new FlushedTurnSupersedeRegistry;
+var backstopDeliveryLedger = new BackstopDeliveryLedger;
+var BACKSTOP_DELIVERY_MAX_ATTEMPTS = (() => {
+  const raw = Number(process.env.SWITCHROOM_BACKSTOP_DELIVERY_MAX_ATTEMPTS);
+  return Number.isFinite(raw) && raw >= 1 ? Math.floor(raw) : 3;
+})();
+async function deliverAnswer(args) {
+  const { chatId, turnId } = args;
+  const rendered = addParagraphSpacers2(args.text);
+  const chunks = splitMarkdownChunks2(rendered, RICH_MESSAGE_MAX_CHARS2);
+  const deps = {
+    sendRich: (opts, body, tid) => robustApiCall(() => bot.api.sendRichMessage(chatId, body, opts), { threadId: tid, chat_id: chatId, priorityClass: "critical" }),
+    sendLiteral: (opts, txt, tid) => robustApiCall(() => bot.api.sendMessage(chatId, txt, opts), { threadId: tid, chat_id: chatId, priorityClass: "critical" }),
+    sendLiteralRaw: (opts, txt) => bot.api.sendMessage(chatId, txt, opts),
+    sendRichRaw: (opts, body) => bot.api.sendRichMessage(chatId, body, opts),
+    editPreview: (mid, body, opts, tid) => robustApiCall(() => bot.api.editMessageText(chatId, mid, body, opts), { threadId: tid, chat_id: chatId, priorityClass: "critical", messageId: mid, editPayload: body }),
+    richMessage: richMessage2,
+    logOutbound,
+    deleteStalePreview: async (id) => {
+      await swallowingApiCall(() => bot.api.deleteMessage(chatId, id), { chat_id: chatId, verb: "deliverAnswer.deleteStalePreview" });
+    },
+    stderr: (s) => {
+      process.stderr.write(s);
+    }
+  };
+  let liveThreadId = args.threadId;
+  const sendChunk = async (_chunkIndex, text5) => {
+    const chunkIds = [];
+    const res = await sendReplyChunks(deps, {
+      chatId,
+      chunks: [text5],
+      literalText: false,
+      suppressText: false,
+      threadId: liveThreadId,
+      previewMessageId: null,
+      sentIds: chunkIds,
+      buildSendOpts: (_i, _isLast, tid) => ({
+        ...tid != null ? { message_thread_id: tid } : {},
+        link_preview_options: { is_disabled: true }
+      }),
+      buildPreviewEditOpts: () => ({})
+    });
+    liveThreadId = res.threadId;
+    return chunkIds;
+  };
+  const result = await runBackstopDelivery(backstopDeliveryLedger, turnId, chunks, args.cardMessageId, {
+    sendChunk,
+    recordOutbound: HISTORY_ENABLED ? (messageIds, texts) => {
+      try {
+        recordOutbound({
+          chat_id: chatId,
+          thread_id: args.threadId ?? null,
+          message_ids: messageIds,
+          texts
+        });
+      } catch {}
+    } : undefined,
+    stderr: (s) => {
+      process.stderr.write(s);
+    }
+  }, BACKSTOP_DELIVERY_MAX_ATTEMPTS);
+  return {
+    sentIds: result.sentIds,
+    chunkCount: result.chunkCount,
+    delivered: result.delivered,
+    exhausted: result.exhausted
+  };
+}
 var chatAvailableReactions = new Map;
 var chatProbesInFlight = new Set;
 var activeTurnStartedAt = new Map;
@@ -87593,7 +87698,7 @@ function endCurrentTurnAtomic(turn, opts) {
     process.stderr.write(`telegram gateway: status-surface DEGRADED reason=${degraded.reason} turnId=${turn.turnId} chat=${turn.sessionChatId} thread=${turn.sessionThreadId ?? "-"} ${degraded.detail}
 `);
   }
-  if (OBLIGATION_LEDGER_ENABLED) {
+  if (OBLIGATION_LEDGER_ENABLED && opts?.deferObligationClose !== true) {
     if (decideObligationTurnEnd(turn.finalAnswerDelivered, turn.replyCalled) === "close") {
       obligationLedger.close(turn.turnId);
     } else {
@@ -89325,11 +89430,19 @@ async function runMidSessionCardReaper() {
   }
   if (WORKER_PIN_REAPER_ENABLED && PIN_STATUS_WHILE_WORKING) {
     try {
-      const candidates = [...statusPinState.keys()].filter((k) => k.startsWith("wk:")).map((k) => ({
+      const inMemoryKeys = new Set([...statusPinState.keys()].filter((k) => k.startsWith("wk:")));
+      const inMemoryCandidates = [...inMemoryKeys].map((k) => ({
         pinKey: k,
         chatId: statusPinChatIds.get(k) ?? "",
         pinnedAt: statusPinPinnedAt.get(k) ?? now
       }));
+      const storeOnlyCandidates = statusPinPersistEnabled ? storeOnlyWorkerPinCandidates({
+        rows: loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs),
+        inMemoryPinKeys: inMemoryKeys,
+        now
+      }) : [];
+      const storeOnlyKeys = new Set(storeOnlyCandidates.map((c) => c.pinKey));
+      const candidates = [...inMemoryCandidates, ...storeOnlyCandidates];
       const reaps = decideWorkerPinReaps({
         pins: candidates,
         statusOf: (agentId) => {
@@ -89356,9 +89469,20 @@ async function runMidSessionCardReaper() {
         now
       });
       for (const reap of reaps) {
-        process.stderr.write(`telegram gateway: worker-pin reaper unpinning ${reap.pinKey} (chat=${reap.chatId} reason=${reap.reason})
+        const storeOnly = storeOnlyKeys.has(reap.pinKey);
+        process.stderr.write(`telegram gateway: worker-pin reaper unpinning ${reap.pinKey} (chat=${reap.chatId} reason=${reap.reason}${storeOnly ? " source=store-orphan" : ""})
+`);
+        if (storeOnly && reap.messageId != null) {
+          try {
+            await statusPinApi().unpinChatMessage(reap.chatId, reap.messageId);
+          } catch (err) {
+            process.stderr.write(`telegram gateway: worker-pin reaper store-orphan unpin failed (${reap.pinKey} chat=${reap.chatId} msg=${reap.messageId}): ${err.message}
 `);
-        await reconcileStatusPin(reap.pinKey, reap.chatId, { pinned: false });
+          }
+          await mutateStatusPinRow(STATUS_PIN_STORE_PATH, statusPinStoreFs, reap.pinKey, null);
+        } else {
+          await reconcileStatusPin(reap.pinKey, reap.chatId, { pinned: false });
+        }
       }
     } catch (err) {
       process.stderr.write(`telegram gateway: worker-pin reaper error: ${err.message}
@@ -93086,7 +93210,7 @@ async function executeGetRecentMessages(args) {
   const rows = query({ chat_id, thread_id, limit, before_message_id });
   const summary = rows.map((r) => {
     const who = r.role === "user" ? r.user ?? "user" : "assistant";
-    const time = new Date(r.ts * 1000).toISOString();
+    const time = fmtLocalStamp2(r.ts * 1000, resolveEnvTimezone2());
     const attach = r.attachment_kind ? ` [${r.attachment_kind}]` : "";
     const replyCtx = r.reply_to_message_id != null ? ` \u21AA\uFE0F#${r.reply_to_message_id}${r.reply_to_text ? `:"${r.reply_to_text.slice(0, 60)}${r.reply_to_text.length > 60 ? "\u2026" : ""}"` : ""}` : "";
     const reactionTag = r.user_reaction ? ` [reaction: ${r.user_reaction}]` : "";
@@ -94218,16 +94342,15 @@ function handleSessionEvent(ev) {
           }
           turn.finalAnswerDelivered = true;
           turn.finalAnswerSubstantive = true;
-          if (capturedText.trim().length >= FLUSH_SUBSTANTIVE_MIN_CHARS) {
-            turn.answerDelivered = true;
-          }
+          turn.answerDelivered = true;
+          const backstopLatchClaimed = backstopDeliveryLedger.claim(turn.turnId);
           const cardTakeover = progressDriver?.takeOverCard({
             chatId: backstopChatId,
             threadId: backstopThreadId != null ? String(backstopThreadId) : undefined
           }) ?? { wasEmitted: false, turnKey: null };
           const backstopCardMessageId = cardTakeover.wasEmitted && cardTakeover.turnKey != null ? getPinnedProgressCardMessageId?.(cardTakeover.turnKey) ?? null : null;
           const backstopCardTurnKey = cardTakeover.turnKey;
-          const backstopTurnEndedAt = endCurrentTurnAtomic(turn, { deferRecord: true });
+          const backstopTurnEndedAt = endCurrentTurnAtomic(turn, { deferRecord: true, deferObligationClose: true });
           preambleSuppressor.dropNow();
           {
             const tKey = statusKey(chatId, threadId);
@@ -94246,80 +94369,47 @@ function handleSessionEvent(ev) {
 `);
                   if (backstopTurnEndedAt != null) {
                     turn.deliveryOutcome = "suppressed";
+                    if (OBLIGATION_LEDGER_ENABLED)
+                      obligationLedger.close(turn.turnId);
                     emitTurnRecord(turn, backstopTurnEndedAt);
                   }
                   return;
                 }
               } catch {}
             }
+            if (!backstopLatchClaimed) {
+              process.stderr.write(`telegram gateway: turn-flush skipped \u2014 turn ${turn.turnId} already claimed the delivery latch
+`);
+              return;
+            }
             process.stderr.write(`telegram gateway: turn-flush firing \u2014 ${capturedText.length} chars without reply tool (chat=${backstopChatId} cardMsgId=${backstopCardMessageId ?? "none"})
 `);
-            const sendOpts = {
-              ...backstopThreadId != null ? { message_thread_id: backstopThreadId } : {},
-              link_preview_options: { is_disabled: true }
-            };
-            const limit = RICH_MESSAGE_MAX_CHARS2;
-            let htmlChunks = [];
-            const sentIds = [];
-            let sendThrew = false;
+            let sentIds = [];
+            let chunkCount = 0;
+            let delivered = false;
             try {
-              const renderedText = addParagraphSpacers2(capturedText);
-              htmlChunks = splitMarkdownChunks2(renderedText, limit);
-              let firstSendUsedEdit = false;
-              let liveThreadId = backstopThreadId;
-              if (backstopCardMessageId != null && htmlChunks.length > 0) {
-                try {
-                  await robustApiCall(() => bot.api.editMessageText(backstopChatId, backstopCardMessageId, richMessage2(htmlChunks[0]), sendOpts), {
-                    chat_id: backstopChatId,
-                    verb: "turn-flush.editMessageText",
-                    ...liveThreadId != null ? { threadId: liveThreadId } : {}
-                  });
-                  sentIds.push(backstopCardMessageId);
-                  firstSendUsedEdit = true;
-                } catch (err) {
-                  process.stderr.write(`telegram gateway: turn-flush card-takeover edit failed: ${err.message} \u2014 falling back to sendMessage
-`);
-                  if (err instanceof Error && err.message === "THREAD_NOT_FOUND") {
-                    liveThreadId = undefined;
-                  }
-                }
-              }
-              const remainingChunks = firstSendUsedEdit ? htmlChunks.slice(1) : htmlChunks;
-              for (const c of remainingChunks) {
-                const sent = await retryWithThreadFallback2(robustApiCall, (tid) => {
-                  const opts = {
-                    link_preview_options: { is_disabled: true },
-                    ...tid != null ? { message_thread_id: tid } : {}
-                  };
-                  return bot.api.sendRichMessage(backstopChatId, richMessage2(c), opts);
-                }, {
-                  threadId: liveThreadId,
-                  chat_id: backstopChatId,
-                  verb: "turn-flush.sendMessage"
-                });
-                if (liveThreadId != null) {
-                  const sentMsg = sent;
-                  if (sentMsg.message_thread_id == null)
-                    liveThreadId = undefined;
-                }
-                sentIds.push(sent.message_id);
-              }
-              if (HISTORY_ENABLED && sentIds.length > 0) {
-                try {
-                  recordOutbound({
-                    chat_id: backstopChatId,
-                    thread_id: backstopThreadId ?? null,
-                    message_ids: sentIds,
-                    texts: htmlChunks
-                  });
-                } catch {}
-              }
+              const delivery = await deliverAnswer({
+                chatId: backstopChatId,
+                threadId: backstopThreadId,
+                text: capturedText,
+                turnId: turn.turnId,
+                cardMessageId: backstopCardMessageId
+              });
+              sentIds = delivery.sentIds;
+              chunkCount = delivery.chunkCount;
+              delivered = delivery.delivered;
               outboundDedup.record(backstopChatId, backstopThreadId, capturedText, Date.now(), currentTurn?.registryKey ?? null);
               if (sentIds.length > 0) {
                 flushedTurnSupersede.record(backstopChatId, backstopThreadId, { turnId: turn.turnId, messageIds: sentIds, text: capturedText }, Date.now());
               }
-              if (backstopCtrl)
+              if (!delivered) {
+                if (backstopCtrl)
+                  backstopCtrl.finalize("error");
+                backstopDeliveryLedger.release(turn.turnId);
+                turn.answerDelivered = false;
+              } else if (backstopCtrl) {
                 backstopCtrl.finalize("done");
+              }
               if (backstopCardTurnKey != null) {
                 completeProgressCardTurn?.({
                   chatId: backstopChatId,
@@ -94330,21 +94420,33 @@ function handleSessionEvent(ev) {
                 unpinProgressCardForChat?.(backstopChatId, backstopThreadId);
               }
             } catch (err) {
-              sendThrew = true;
-              process.stderr.write(`telegram gateway: turn-flush send failed: ${err.message}
+              process.stderr.write(`telegram gateway: turn-flush post-delivery bookkeeping failed: ${err.message}
 `);
-              turn.answerDelivered = false;
-              if (backstopCtrl)
-                backstopCtrl.finalize("error");
+              if (!delivered) {
+                turn.answerDelivered = false;
+                backstopDeliveryLedger.release(turn.turnId);
+                if (backstopCtrl)
+                  backstopCtrl.finalize("error");
+              }
             } finally {
               if (backstopTurnEndedAt != null) {
-                finalizeBackstopSend(turn, {
-                  threw: sendThrew,
-                  sentCount: sentIds.length,
-                  chunkCount: htmlChunks.length
+                finalizeBackstopSendGated(turn, {
+                  threw: !delivered,
+                  sentIds,
+                  chunkCount,
+                  cardMessageId: backstopCardMessageId
                 });
+                if (OBLIGATION_LEDGER_ENABLED) {
+                  if (delivered) {
+                    obligationLedger.close(turn.turnId);
+                  } else {
+                    turn.finalAnswerDelivered = false;
+                    obligationLedger.noteTurnEnded(turn.turnId, Date.now());
+                  }
+                }
                 emitTurnRecord(turn, backstopTurnEndedAt);
               }
+              backstopDeliveryLedger.clear(turn.turnId);
             }
           })();
           return;
@@ -95399,7 +95501,7 @@ ${preBlock(write.output)}`;
       ...msgId != null ? { message_id: String(msgId) } : {},
       user: displayUser,
       user_id: String(from.id),
-      ts: new Date((ctx.message?.date ?? 0) * 1000).toISOString(),
+      ts: fmtLocalStamp2((ctx.message?.date ?? 0) * 1000, resolveEnvTimezone2()),
       ...messageThreadId != null ? { message_thread_id: String(messageThreadId) } : {},
       ...originTurnId != null ? { origin_turn_id: originTurnId } : {},
       ...topicScope != null ? { topic_scope: topicScope } : {},
@@ -96541,7 +96643,6 @@ function buildModelDeps(restartCtx) {
         return [];
       }
     },
-    select: (a, label) => selectModel(a, label),
     isBusy: () => currentTurn !== null,
     getAgentName: getMyAgentName,
     getQuotaBrief: async () => {
@@ -96560,14 +96661,12 @@ function buildModelDeps(restartCtx) {
       } catch {}
       return null;
     },
-    inject: injectSlashCommand,
     getConfiguredModel: () => {
       const data = switchroomExecJson(["agent", "list"]);
       return data?.agents?.find((a) => a.name === getMyAgentName())?.model ?? null;
     },
     escapeHtml: escapeHtmlForTg2,
     preBlock,
-    getActiveSessionModel: () => sessionModelSource.getOverride(),
     scheduleRestart: async (reason) => {
       const name = getMyAgentName();
       const existing = readRestartMarker();
@@ -96610,6 +96709,30 @@ function buildModelDeps(restartCtx) {
       const prevFileRaw = readSessionModelFileRaw(agentDir);
       writeSessionModelFile(agentDir, model, readConfiguredDefaultModel(agentDir) ?? resolveMainModel(deps.getConfiguredModel() ?? undefined));
       sessionModelSource.setOverride(model);
+      process.stderr.write(`telegram gateway: gw /model relaunch scheduled agent=${getMyAgentName()} token=${model} reason=${JSON.stringify(reason)}
+`);
+      clearPremiumRecoveryOnManualSwitch(model);
+      try {
+        await deps.scheduleRestart(reason);
+      } catch (err) {
+        if (err?.code !== "restart_in_flight") {
+          restoreSessionModelFileRaw(agentDir, prevFileRaw);
+          sessionModelSource.setOverride(prevOverride);
+        }
+        throw err;
+      }
+    },
+    scheduleModelDefaultRelaunch: async (reason) => {
+      const agentDir = resolveAgentDirFromEnv();
+      if (!agentDir)
+        throw new Error("agent dir unresolvable \u2014 cannot clear session-model file");
+      const prevOverride = sessionModelSource.getOverride();
+      const prevFileRaw = readSessionModelFileRaw(agentDir);
+      clearSessionModelFile(agentDir);
+      sessionModelSource.setOverride(null);
+      process.stderr.write(`telegram gateway: gw /model relaunch scheduled agent=${getMyAgentName()} token=(default) reason=${JSON.stringify(reason)}
+`);
+      clearPremiumRecoveryOnManualSwitch(null);
       try {
         await deps.scheduleRestart(reason);
       } catch (err) {
@@ -96634,60 +96757,6 @@ function modelMenuReplyMarkup(reply) {
   }
   return kb;
 }
-function recordTypedModelSwitch(reply, requestedModelArg, _deps) {
-  const requested = requestedModelArg != null ? expandSrAlias(requestedModelArg) : null;
-  if (requested?.toLowerCase() === "default") {
-    const smDir = resolveAgentDirFromEnv();
-    if (smDir)
-      clearSessionModelFile(smDir);
-    if (reply.selectedModel)
-      sessionModelSource.setOverride(null);
-    return "";
-  }
-  if (!reply.selectedModel)
-    return "";
-  sessionModelSource.setOverride(reply.selectedModel);
-  clearPremiumRecoveryOnManualSwitch(reply.selectedModel);
-  return "";
-}
-function recordModelMenuSideEffects(outcome, modelDeps, cbChatId, cbThreadId, prevSessionModel) {
-  if (outcome.selectedModel) {
-    sessionModelSource.setOverride(outcome.selectedModel);
-    clearPremiumRecoveryOnManualSwitch(outcome.selectedModel);
-  }
-  if (outcome.clearedDefault) {
-    const smDir = resolveAgentDirFromEnv();
-    if (smDir)
-      clearSessionModelFile(smDir);
-  }
-  if (outcome.selectedModel && isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)) {
-    const agentName3 = getMyAgentName();
-    const agentDir = resolveAgentDirFromEnv();
-    const token = outcome.selectedModelToken;
-    if (agentDir && token) {
-      try {
-        writeSessionModelFile(agentDir, token, readConfiguredDefaultModel(agentDir) ?? resolveMainModel(modelDeps.getConfiguredModel() ?? undefined));
-        sessionModelSource.setOverride(token);
-      } catch (e) {
-        process.stderr.write(`telegram gateway: sr-to-claude session-model write failed: ${e?.message ?? String(e)}
-`);
-      }
-    } else if (agentDir) {
-      clearSessionModelFile(agentDir);
-    }
-    writeRestartMarker({ chat_id: cbChatId, thread_id: cbThreadId ?? null, ack_message_id: null, ts: Date.now() });
-    stampUserRestartReason("user: sr-to-claude model switch (menu)");
-    if (turnInFlightForGate()) {
-      pendingRestarts.set(agentName3, Date.now());
-    } else {
-      sweepBeforeSelfRestart().finally(() => triggerSelfRestart(agentName3, "sr-to-claude-model-switch", 1500));
-    }
-    return {
-      restartNotice: `\uD83D\uDD04 Switching from **${escapeHtmlForTg2(prevSessionModel)}** back to Claude \u2014 restarting session cleanly. Claude will be ready in ~30s.`
-    };
-  }
-  return {};
-}
 async function editPendingCommandCard(chatId, messageId, text5) {
   try {
     await robustApiCall(() => lockedBot.api.editMessageText(chatId, messageId, richMessage2(hardenCardBreaks2(text5)), {
@@ -96709,14 +96778,11 @@ function enqueueSessionCommand(cmd) {
 async function applyQueuedModelCommand(cmd) {
   const deps = buildModelDeps({ chatId: cmd.chatId, threadId: cmd.threadId });
   if (cmd.origin === "menu") {
-    const prevSessionModel = sessionModelSource.getOverride();
     const outcome = await handleModelMenuCallback(cmd.arg, deps);
-    const { restartNotice } = recordModelMenuSideEffects(outcome, deps, cmd.chatId, cmd.threadId, prevSessionModel);
-    return restartNotice ?? outcome.reply.text;
+    return outcome.reply.text;
   }
   const reply = await handleModelCommand({ kind: "set", model: cmd.arg }, deps);
-  const warning = recordTypedModelSwitch(reply, cmd.arg, deps);
-  return reply.text + warning;
+  return reply.text;
 }
 async function applyQueuedEffortCommand(cmd) {
   const deps = buildEffortDeps();
@@ -96854,8 +96920,7 @@ bot.command("model", async (ctx) => {
     return;
   }
   const reply = await handleModelCommand(parsed, deps);
-  const persistWarning = recordTypedModelSwitch(reply, parsed.kind === "set" ? parsed.model : null, deps);
-  await switchroomReply(ctx, reply.text + persistWarning, { html: reply.html });
+  await switchroomReply(ctx, reply.text, { html: reply.html });
 });
 var sessionEffortOverride = null;
 function buildEffortDeps() {
@@ -98909,31 +98974,10 @@ bot.on("callback_query:data", async (ctx) => {
     }
     const isPageNav = data === MODEL_CALLBACK_PAGE_EXTERNAL || data === MODEL_CALLBACK_PAGE_MAIN;
     await ctx.answerCallbackQuery({ text: isPageNav ? "Loading\u2026" : "Switching\u2026" }).catch(() => {});
-    if (data.startsWith(MODEL_CALLBACK_SR)) {
-      const srName = data.slice(MODEL_CALLBACK_SR.length);
-      const srLabel = escapeHtmlForTg2(srFriendlyLabel(srName));
-      if (!isValidModelArg(srName)) {
-        await ctx.editMessageText(richMessage2("\u274C Invalid model name"), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-        return;
-      }
-      await ctx.editMessageText(richMessage2(`\uD83D\uDD04 Switching session to **${srLabel}** \u2014 restarting (~30s). _Session-only; reverts to the configured default on the next restart._`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-      try {
-        await modelDeps.scheduleModelRelaunch(srName, `user: /model ${srName} (session-only relaunch, menu)`);
-      } catch (err) {
-        await ctx.editMessageText(richMessage2(`\u274C Could not switch to **${srLabel}**: ${escapeHtmlForTg2(err?.message ?? String(err))}`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-      }
-      return;
-    }
     try {
-      const prevSessionModel = sessionModelSource.getOverride();
       const outcome = await handleModelMenuCallback(data, modelDeps);
       if (outcome.toastOnly)
         return;
-      const { restartNotice } = recordModelMenuSideEffects(outcome, modelDeps, cbChatId, cbThreadId, prevSessionModel);
-      if (restartNotice) {
-        await ctx.editMessageText(richMessage2(restartNotice), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-        return;
-      }
       await ctx.editMessageText(richMessage2(outcome.reply.text), {
         reply_markup: modelMenuReplyMarkup(outcome.reply) ?? { inline_keyboard: [] }
       }).catch(() => {});
@@ -100638,6 +100682,8 @@ var didOneTimeSetup = false;
 `);
           }
         } catch {}
+        let modelSwitchMarkerChat = null;
+        let modelSwitchReason = null;
         try {
           const nowMs2 = Date.now();
           const marker = readRestartMarker();
@@ -100667,6 +100713,12 @@ var didOneTimeSetup = false;
             const ageSec = Math.max(1, Math.round(ageMs / 1000));
             process.stderr.write(`telegram gateway: boot: restart-marker present, chat_id=${marker.chat_id} age=${ageSec}s within5min=${ageMs < 300000}
 `);
+            if (ageMs < 300000) {
+              modelSwitchMarkerChat = { chatId: marker.chat_id, threadId: marker.thread_id };
+              if (typeof cleanMarker?.reason === "string" && cleanMarker.reason.startsWith("user: /model")) {
+                modelSwitchReason = cleanMarker.reason;
+              }
+            }
             clearRestartMarker();
           }
           if (!isRealRestart) {
@@ -100692,7 +100744,11 @@ var didOneTimeSetup = false;
                 firstSeenAt: new Date
               });
             }
-            if (target) {
+            const suppressBootCardForModelSwitch = modelSwitchReason != null && modelSwitchMarkerChat != null;
+            if (target && suppressBootCardForModelSwitch) {
+              process.stderr.write(`telegram gateway: boot: suppressing generic boot card \u2014 /model switch apply-boot (reason=${JSON.stringify(modelSwitchReason)}); the confirmation card replaces it
+`);
+            } else if (target) {
               const { chatId, threadId, ackMsgId } = target;
               const bootDedupe = shouldSkipDuplicateBootCard({ activeBootCard, bootCardPending }, "boot");
               if (bootDedupe.skip) {
@@ -100771,7 +100827,19 @@ var didOneTimeSetup = false;
                   const raw = d?.agents?.find((a) => a.name === getMyAgentName())?.model ?? null;
                   return resolveMainModel(raw ?? undefined);
                 })();
-                sessionModelSource.setOverride(launched.length > 0 && launched !== configured ? launched : null);
+                const isApplyBoot = launched.length > 0 && launched !== configured;
+                sessionModelSource.setOverride(isApplyBoot ? launched : null);
+                process.stderr.write(`telegram gateway: gw /model relaunch applied agent=${getMyAgentName()} launched=${launched || "(none)"} configured=${configured} override=${isApplyBoot ? "set" : "cleared"}
+`);
+                if (modelSwitchReason != null && modelSwitchMarkerChat) {
+                  const chat = modelSwitchMarkerChat;
+                  const body = isApplyBoot ? `\u2705 Now running \`${launched}\` \u2014 session-only, reverts to the configured model on the next restart. Fresh session; memory and the handoff briefing carry the context.` : `\u2705 Now running \`${launched || configured}\` (the configured default) \u2014 fresh session; memory and the handoff briefing carry the context.`;
+                  lockedBot.api.sendMessage(chat.chatId, body, {
+                    parse_mode: "Markdown",
+                    ...chat.threadId != null ? { message_thread_id: chat.threadId } : {}
+                  }).catch((err) => process.stderr.write(`telegram gateway: model-switch confirmation send failed: ${err?.message ?? String(err)}
+`));
+                }
               } catch {}
             }
             const activeEffortPath = join55(smAgentDir, ".active-session-effort");