switchroom 0.18.28 → 0.18.30

package/telegram-plugin/dist/gateway/gateway.js

@@ -20036,7 +20036,8 @@ var init_protocol2 = __esm(() => {
     v: exports_external.literal(PROTOCOL_VERSION),
     op: exports_external.literal("get-credentials"),
     id: exports_external.string().min(1),
-    provider: ProviderNameSchema.optional()
+    provider: ProviderNameSchema.optional(),
+    account: exports_external.string().min(1).optional()
   });
   ListStateRequestSchema = exports_external.object({
     v: exports_external.literal(PROTOCOL_VERSION),
@@ -20351,13 +20352,17 @@ class AuthBrokerClient {
       sock.destroy();
     }
   }
-  async getCredentials(provider) {
+  async getCredentials(provider, account) {
     const base = {
       v: PROTOCOL_VERSION,
       id: randomUUID(),
       op: "get-credentials"
     };
-    const req = provider !== undefined ? { ...base, provider } : base;
+    let req = base;
+    if (provider !== undefined)
+      req = { ...req, provider };
+    if (account !== undefined)
+      req = { ...req, account };
     const data = await this.send(req);
     return data;
   }
@@ -20632,7 +20637,7 @@ var init_client2 = __esm(() => {
 });
 
 // ../src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, ReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, ReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -21030,11 +21035,52 @@ var init_schema = __esm(() => {
     approvers: exports_external.array(ApproverIdSchema).min(1).optional().describe("Per-agent approver override. When set, replaces (does not extend) " + "the top-level drive.approvers list for this agent's onboarding card."),
     tier: GoogleWorkspaceTierSchema.optional().describe("Per-agent tier override (RFC G Phase 1). When set, replaces the " + "top-level google_workspace.tier for this agent. Common case: most " + "agents on `core`, one specialist on `extended` for Slides access.")
   }).optional();
+  MicrosoftAccountEmailSchema = exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
+    message: "microsoft_workspace.account must be a Microsoft account email like " + "'alice@outlook.com' or 'alice@contoso.com' (colons not allowed)"
+  }).transform((v) => v.trim().toLowerCase());
+  MicrosoftToolTokenSchema = exports_external.string().min(1).regex(/^[a-z0-9-]+$/, {
+    message: "microsoft_workspace tools[] tokens are forwarded to softeria's " + "--enabled-tools regex; each must be lowercase kebab-case " + "([a-z0-9-]+, e.g. 'mail', 'calendar', 'send-mail') so an unescaped " + "regex metacharacter can't crash the launcher"
+  });
+  MicrosoftAccountBindingSchema = exports_external.object({
+    account: MicrosoftAccountEmailSchema.describe("The Microsoft account this binding uses. Must be a key in top-level " + "`microsoft_accounts:` with this agent in its `enabled_for[]`."),
+    tools: exports_external.array(MicrosoftToolTokenSchema).min(1).optional().describe("Per-account tool allowlist \u2192 softeria `--enabled-tools <regex>` " + "(tokens joined with `|`). Omitted = all tools exposed for this account."),
+    org_mode: exports_external.boolean().optional().describe("Per-binding org_mode override (RFC #1873 \u00a76.4).")
+  });
   AgentMicrosoftWorkspaceConfigSchema = exports_external.object({
-    account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
-      message: "microsoft_workspace.account must be a Microsoft account email like " + "'alice@outlook.com' or 'alice@contoso.com' (colons not allowed)"
-    }).transform((v) => v.trim().toLowerCase()).optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized)."),
-    org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 \u00a76.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false).")
+    account: MicrosoftAccountEmailSchema.optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized). Mutually exclusive with `accounts` (plural)."),
+    tools: exports_external.array(MicrosoftToolTokenSchema).min(1).optional().describe("Per-account tool allowlist for the SINGULAR `account` form \u2192 " + "softeria `--enabled-tools <regex>`. Omitted = all tools. Only " + "valid with the singular `account`; using it together with the " + "plural `accounts` (which carries per-binding `tools`) is an error."),
+    org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 \u00a76.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false)."),
+    accounts: exports_external.array(MicrosoftAccountBindingSchema).min(1).optional().describe("Plural multi-account form: bind MULTIPLE Microsoft accounts to " + "this agent, each with its own tool scope. Mutually exclusive with " + "the singular `account`. Each account gets its own `ms-365-<slug>` " + "MCP server.")
+  }).superRefine((v, ctx) => {
+    const hasSingular = v.account !== undefined;
+    const hasPlural = v.accounts !== undefined;
+    if (hasSingular && hasPlural) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: "microsoft_workspace: use EITHER `account` (singular) OR " + "`accounts` (plural array), not both",
+        path: ["accounts"]
+      });
+    }
+    if (hasPlural && v.tools !== undefined) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: "microsoft_workspace: block-level `tools` applies to the singular " + "`account` only; with `accounts` put `tools` inside each binding",
+        path: ["tools"]
+      });
+    }
+    if (hasPlural) {
+      const seen = new Set;
+      for (const b of v.accounts) {
+        if (seen.has(b.account)) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `microsoft_workspace: duplicate account '${b.account}' in accounts[]`,
+            path: ["accounts"]
+          });
+        }
+        seen.add(b.account);
+      }
+    }
   }).optional();
   AgentNotionWorkspaceConfigSchema = exports_external.object({
     databases: exports_external.array(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/, {
@@ -21409,6 +21455,26 @@ var init_schema = __esm(() => {
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       checkServes(a.serves, ["agents", name, "serves"]);
     }
+    const microsoftAccounts = cfg.microsoft_accounts;
+    for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+      const mw = a.microsoft_workspace;
+      const accounts = mw?.accounts;
+      if (!accounts)
+        continue;
+      accounts.forEach((b, i) => {
+        const acct = b?.account?.trim().toLowerCase();
+        if (!acct)
+          return;
+        const enabledFor = microsoftAccounts?.[acct]?.enabled_for ?? [];
+        if (!enabledFor.includes(name)) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `agent '${name}' binds Microsoft account '${acct}' but is not in ` + `microsoft_accounts['${acct}'].enabled_for[] \u2014 operator must run ` + `\`switchroom auth microsoft enable ${acct} ${name}\``,
+            path: ["agents", name, "microsoft_workspace", "accounts", i, "account"]
+          });
+        }
+      });
+    }
   });
 });
 
@@ -22024,6 +22090,25 @@ function validateNotionWorkspaceConfig(config) {
   return issues;
 }
 
+// ../src/config/timezone.ts
+function isResolvableTimezone(zone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: zone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var CONTAINER_DEFAULT_UTC_ZONES;
+var init_timezone = __esm(() => {
+  CONTAINER_DEFAULT_UTC_ZONES = new Set([
+    "UTC",
+    "Etc/UTC",
+    "Etc/Universal",
+    "Universal"
+  ]);
+});
+
 // ../src/config/loader.ts
 import { readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
@@ -22142,8 +22227,30 @@ function loadConfig(configPath) {
   if (notionIssues.length > 0) {
     throw new ConfigError(`Invalid notion_workspace configuration in ${filePath}`, notionIssues);
   }
+  validateAllTimezones(config, filePath);
   return config;
 }
+function validateAllTimezones(config, filePath) {
+  const issues = [];
+  const check = (zone, where) => {
+    if (zone == null)
+      return;
+    if (!isResolvableTimezone(zone)) {
+      issues.push(`  ${where}: "${zone}" is not a resolvable IANA timezone ` + `(shape is valid but no such zone exists \u2014 check for a typo, ` + `e.g. "Australia/Melbourne", "America/New_York", "UTC").`);
+    }
+  };
+  check(config.switchroom?.timezone, "switchroom.timezone");
+  check(config.defaults?.timezone, "defaults.timezone");
+  for (const [profileName, profile] of Object.entries(config.profiles ?? {})) {
+    check(profile?.timezone, `profiles.${profileName}.timezone`);
+  }
+  for (const [agentName, agentRaw] of Object.entries(config.agents)) {
+    check(agentRaw?.timezone, `agents.${agentName}.timezone`);
+  }
+  if (issues.length > 0) {
+    throw new ConfigError(`Invalid timezone configuration in ${filePath}`, issues);
+  }
+}
 function validateAllCronTopicAliases(config, filePath) {
   const issues = [];
   for (const [agentName, agentRaw] of Object.entries(config.agents)) {
@@ -22179,6 +22286,7 @@ var init_loader = __esm(() => {
   init_paths();
   init_overlay_loader();
   init_merge();
+  init_timezone();
   import_yaml3 = __toESM(require_dist(), 1);
   ConfigError = class ConfigError extends Error {
     details;
@@ -28638,6 +28746,7 @@ var init_redact = __esm(() => {
 // history.ts
 var exports_history = {};
 __export(exports_history, {
+  verifyHistoryWritable: () => verifyHistoryWritable,
   recordReaction: () => recordReaction,
   recordOutbound: () => recordOutbound,
   recordInbound: () => recordInbound,
@@ -28676,6 +28785,15 @@ function loadDatabaseClass() {
     throw new Error(`history.ts requires Bun runtime (bun:sqlite). Caller: ${err.message}`);
   }
 }
+function warnHistory(msg) {
+  try {
+    process.stderr.write(`telegram history: ${msg}
+`);
+  } catch {}
+}
+function isValidMessageId(id) {
+  return typeof id === "number" && Number.isInteger(id) && id > 0;
+}
 function initHistory(stateDir, retentionDays = 30) {
   if (db != null)
     return;
@@ -28757,6 +28875,33 @@ function initHistory(stateDir, retentionDays = 30) {
     const cutoff = Math.floor(Date.now() / 1000) - retentionDays * 86400;
     db.prepare("DELETE FROM messages WHERE ts < ?").run(cutoff);
   }
+  const check = verifyHistoryWritable();
+  if (!check.ok) {
+    warnHistory(`WRITER SELF-CHECK FAILED at boot (path=${path2}): ${check.error ?? "unknown"} \u2014 ` + `history recording is NOT durable; get_recent_messages recovery and the ` + `reply-backstop already-replied suppression will be blind. Investigate the ` + `DB path/mount/permissions before trusting delivery accounting.`);
+  }
+}
+function verifyHistoryWritable() {
+  if (db == null)
+    return { ok: false, error: "initHistory() not called" };
+  const SENTINEL_CHAT = "__history_selfcheck__";
+  const sentinelId = Date.now();
+  try {
+    db.prepare("DELETE FROM messages WHERE chat_id = ?").run(SENTINEL_CHAT);
+    db.prepare(`INSERT OR REPLACE INTO messages
+         (chat_id, thread_id, message_id, role, ts, text)
+       VALUES (?, NULL, ?, 'assistant', ?, ?)`).run(SENTINEL_CHAT, sentinelId, Math.floor(Date.now() / 1000), "selfcheck");
+    const row = db.prepare("SELECT text FROM messages WHERE chat_id = ? AND message_id = ?").get(SENTINEL_CHAT, sentinelId);
+    if (row?.text !== "selfcheck") {
+      return { ok: false, error: "sentinel row not read back after insert" };
+    }
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    try {
+      db.prepare("DELETE FROM messages WHERE chat_id = ?").run(SENTINEL_CHAT);
+    } catch {}
+  }
 }
 function _resetForTests() {
   if (db != null) {
@@ -28815,6 +28960,10 @@ function requireDb() {
 function recordInbound(args) {
   if (args.message_id == null)
     return;
+  if (!isValidMessageId(args.message_id)) {
+    warnHistory(`recordInbound: dropping row with invalid message_id=${String(args.message_id)} ` + `(chat=${args.chat_id}) \u2014 a delivered inbound will be absent from history`);
+    return;
+  }
   const stmt = requireDb().prepare(`
     INSERT OR REPLACE INTO messages
       (chat_id, thread_id, message_id, role, user, user_id, ts, text, attachment_kind, group_id, reply_to_message_id, reply_to_text, forwarded_from, forwarded_from_type, forwarded_from_id, forwarded_date, forwarded_message_id)
@@ -28826,23 +28975,38 @@ function recordOutbound(args) {
   if (args.message_ids.length === 0)
     return;
   const ts = args.ts ?? Math.floor(Date.now() / 1000);
-  const groupId = args.message_ids[0];
+  const validRows = [];
+  for (let i = 0;i < args.message_ids.length; i++) {
+    const id = args.message_ids[i];
+    if (!isValidMessageId(id)) {
+      warnHistory(`recordOutbound: dropping chunk ${i} with invalid message_id=${String(id)} ` + `(chat=${args.chat_id}) \u2014 a delivered outbound will be absent from history, ` + `blinding the reply-backstop already-replied suppression`);
+      continue;
+    }
+    validRows.push({
+      id,
+      text: redact(args.texts[i] ?? ""),
+      attachKind: args.attachment_kinds?.[i] ?? null
+    });
+  }
+  if (validRows.length === 0)
+    return;
+  const groupId = validRows[0].id;
   const stmt = requireDb().prepare(`
     INSERT OR REPLACE INTO messages
       (chat_id, thread_id, message_id, role, user, user_id, ts, text, attachment_kind, group_id)
     VALUES (?, ?, ?, 'assistant', NULL, NULL, ?, ?, ?, ?)
   `);
-  const tx = requireDb().transaction((rows2) => {
-    for (const [msgId, text4, attachKind] of rows2) {
-      stmt.run(args.chat_id, args.thread_id ?? null, msgId, ts, text4, attachKind, groupId);
+  const tx = requireDb().transaction((rows) => {
+    for (const r of rows) {
+      stmt.run(args.chat_id, args.thread_id ?? null, r.id, ts, r.text, r.attachKind, groupId);
     }
   });
-  const rows = args.message_ids.map((id, i) => [
-    id,
-    redact(args.texts[i] ?? ""),
-    args.attachment_kinds?.[i] ?? null
-  ]);
-  tx(rows);
+  try {
+    tx(validRows);
+  } catch (err) {
+    warnHistory(`recordOutbound: INSERT failed (chat=${args.chat_id} ids=[${validRows.map((r) => r.id).join(",")}]): ` + `${err instanceof Error ? err.message : String(err)} \u2014 this outbound will be absent from history`);
+    throw err;
+  }
 }
 function recordEdit(args) {
   requireDb().prepare(`
@@ -39831,6 +39995,64 @@ function buildExtraAttachmentMeta(resolved) {
   return out;
 }
 
+// shared/local-time.ts
+function fmtLocalClock(ms, tz) {
+  return new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    hour: "numeric",
+    minute: "2-digit",
+    hour12: true
+  }).format(new Date(ms)).replace(/\s([AP])M$/, (_m, p) => `${p.toLowerCase()}m`);
+}
+function fmtLocalDate(ms, tz) {
+  return new Intl.DateTimeFormat("en-GB", {
+    timeZone: tz,
+    day: "numeric",
+    month: "short"
+  }).format(new Date(ms));
+}
+function localDay(ms, tz) {
+  return new Intl.DateTimeFormat("en-CA", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  }).format(new Date(ms));
+}
+function tzAbbrev(ms, tz) {
+  const at = new Date(ms);
+  for (const loc of ["en-US", "en-AU", "en-GB"]) {
+    const v = new Intl.DateTimeFormat(loc, { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
+    if (v && !/^(?:GMT|UTC)/i.test(v))
+      return v;
+  }
+  return new Intl.DateTimeFormat("en-US", { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value ?? tz;
+}
+function resolveEnvTimezone(env = process.env) {
+  return env.SWITCHROOM_TIMEZONE ?? env.TZ ?? "UTC";
+}
+function fmtLocalStamp(ms, tz) {
+  try {
+    const at = new Date(ms);
+    const weekday = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      weekday: "long"
+    }).format(at);
+    const date = localDay(ms, tz);
+    const time = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour: "2-digit",
+      minute: "2-digit",
+      hour12: true
+    }).format(at);
+    return `${weekday} ${date} ${time} ${tzAbbrev(ms, tz)}`;
+  } catch {
+    if (tz !== "UTC")
+      return fmtLocalStamp(ms, "UTC");
+    return new Date(ms).toISOString();
+  }
+}
+
 // steering.ts
 function escapeXmlAttribute(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
@@ -39947,7 +40169,7 @@ function buildForwardOriginMeta(origins) {
     if (o.id != null)
       out[`forwarded_from_id${suffix}`] = String(o.id);
     if (o.date != null) {
-      out[`forwarded_date${suffix}`] = new Date(o.date * 1000).toISOString();
+      out[`forwarded_date${suffix}`] = fmtLocalStamp(o.date * 1000, resolveEnvTimezone());
     }
   });
   return out;
@@ -39958,6 +40180,190 @@ function forwardOriginDateIso(o) {
   return new Date(o.date * 1000).toISOString();
 }
 
+// gateway/unhandled-message.ts
+var MESSAGE_ENVELOPE_KEYS = new Set([
+  "message_id",
+  "message_thread_id",
+  "date",
+  "chat",
+  "from",
+  "sender_chat",
+  "forward_origin",
+  "reply_to_message",
+  "external_reply",
+  "quote",
+  "reply_to_story",
+  "edit_date",
+  "media_group_id",
+  "author_signature",
+  "is_topic_message",
+  "is_automatic_forward",
+  "via_bot",
+  "sender_boost_count",
+  "business_connection_id",
+  "effect_id",
+  "has_protected_content",
+  "is_from_offline",
+  "link_preview_options",
+  "show_caption_above_media",
+  "entities",
+  "caption_entities",
+  "paid_star_count"
+]);
+var SERVICE_NOISE_KEYS = new Set([
+  "new_chat_members",
+  "left_chat_member",
+  "new_chat_title",
+  "new_chat_photo",
+  "delete_chat_photo",
+  "group_chat_created",
+  "supergroup_chat_created",
+  "channel_chat_created",
+  "message_auto_delete_timer_changed",
+  "migrate_to_chat_id",
+  "migrate_from_chat_id",
+  "forum_topic_created",
+  "forum_topic_edited",
+  "forum_topic_closed",
+  "forum_topic_reopened",
+  "general_forum_topic_hidden",
+  "general_forum_topic_unhidden",
+  "video_chat_scheduled",
+  "video_chat_started",
+  "video_chat_ended",
+  "video_chat_participants_invited",
+  "giveaway_created",
+  "giveaway",
+  "giveaway_winners",
+  "giveaway_completed",
+  "boost_added",
+  "chat_background_set",
+  "write_access_allowed",
+  "proximity_alert_triggered",
+  "chat_set_theme",
+  "connected_website",
+  "direct_message_price_changed"
+]);
+function messageContentKeys(msg) {
+  return Object.keys(msg).filter((k) => !MESSAGE_ENVELOPE_KEYS.has(k));
+}
+function planUnhandledMessage(msg) {
+  const contentKeys = messageContentKeys(msg);
+  if (contentKeys.length > 0 && contentKeys.every((k) => SERVICE_NOISE_KEYS.has(k))) {
+    return { action: "log-only", contentKeys };
+  }
+  const contentType = contentKeys[0] ?? "unknown";
+  const text = (typeof msg.text === "string" ? msg.text : undefined) ?? (typeof msg.caption === "string" ? msg.caption : undefined) ?? `(unhandled message content: ${contentType})`;
+  return { action: "turn", text, contentKeys };
+}
+var TAP_MAX_LINES_PER_MINUTE = 300;
+function installUpdateTap(bot, log, nowMs = Date.now) {
+  let windowStart = 0;
+  let windowCount = 0;
+  let suppressed = 0;
+  bot.use(async (ctx, next) => {
+    try {
+      const now = nowMs();
+      if (now - windowStart >= 60000) {
+        if (suppressed > 0) {
+          log(`telegram gateway: rx tap suppressed ${suppressed} update lines in the last minute (cap ${TAP_MAX_LINES_PER_MINUTE}/min)
+`);
+        }
+        windowStart = now;
+        windowCount = 0;
+        suppressed = 0;
+      }
+      if (windowCount < TAP_MAX_LINES_PER_MINUTE) {
+        windowCount++;
+        const upd = ctx.update;
+        const updateType = Object.keys(upd).find((k) => k !== "update_id") ?? "unknown";
+        const msg = ctx.message;
+        const detail = msg ? ` content=[${messageContentKeys(msg).join(",")}]` : "";
+        log(`telegram gateway: rx update_id=${ctx.update.update_id} type=${updateType}${detail}
+`);
+      } else {
+        suppressed++;
+      }
+    } catch {}
+    await next();
+  });
+}
+function installUnhandledMessageCatchAll(bot, onInbound, log) {
+  bot.on("message", async (ctx) => {
+    try {
+      const msg = ctx.message;
+      const plan = planUnhandledMessage(msg);
+      log(`telegram gateway: catch-all inbound (no specific handler) ` + `update_id=${ctx.update.update_id} chat_id=${ctx.chat?.id ?? "?"} ` + `message_id=${ctx.message?.message_id ?? "?"} ` + `content_keys=[${plan.contentKeys.join(",")}] action=${plan.action}
+`);
+      if (plan.action === "turn") {
+        await onInbound(ctx, plan.text);
+      }
+    } catch (err) {
+      log(`telegram gateway: catch-all handler error: ${err.message}
+`);
+    }
+  });
+}
+
+// shared/local-time.ts
+function localDay2(ms, tz) {
+  return new Intl.DateTimeFormat("en-CA", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  }).format(new Date(ms));
+}
+function tzAbbrev2(ms, tz) {
+  const at = new Date(ms);
+  for (const loc of ["en-US", "en-AU", "en-GB"]) {
+    const v = new Intl.DateTimeFormat(loc, { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
+    if (v && !/^(?:GMT|UTC)/i.test(v))
+      return v;
+  }
+  return new Intl.DateTimeFormat("en-US", { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value ?? tz;
+}
+function resolveEnvTimezone2(env = process.env) {
+  return env.SWITCHROOM_TIMEZONE ?? env.TZ ?? "UTC";
+}
+function fmtLocalStamp2(ms, tz) {
+  try {
+    const at = new Date(ms);
+    const weekday = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      weekday: "long"
+    }).format(at);
+    const date = localDay2(ms, tz);
+    const time = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour: "2-digit",
+      minute: "2-digit",
+      hour12: true
+    }).format(at);
+    return `${weekday} ${date} ${time} ${tzAbbrev2(ms, tz)}`;
+  } catch {
+    if (tz !== "UTC")
+      return fmtLocalStamp2(ms, "UTC");
+    return new Date(ms).toISOString();
+  }
+}
+var LEADING_ISO_Z = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z)(\s|$)/;
+function renderLogTimestampsLocal(text, tz) {
+  if (!text)
+    return text;
+  return text.split(`
+`).map((line) => {
+    const m = LEADING_ISO_Z.exec(line);
+    if (!m)
+      return line;
+    const ms = Date.parse(m[1]);
+    if (Number.isNaN(ms))
+      return line;
+    return `${fmtLocalStamp2(ms, tz)}${m[2] === "" ? "" : " "}${line.slice(m[0].length)}`;
+  }).join(`
+`);
+}
+
 // status-reactions.ts
 var TELEGRAM_REACTION_WHITELIST = new Set([
   "\uD83D\uDC4D",
@@ -57171,40 +57577,6 @@ function sendGateConfigFromEnv(env = process.env) {
   return out;
 }
 
-// shared/local-time.ts
-function fmtLocalClock(ms, tz) {
-  return new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    hour: "numeric",
-    minute: "2-digit",
-    hour12: true
-  }).format(new Date(ms)).replace(/\s([AP])M$/, (_m, p) => `${p.toLowerCase()}m`);
-}
-function fmtLocalDate(ms, tz) {
-  return new Intl.DateTimeFormat("en-GB", {
-    timeZone: tz,
-    day: "numeric",
-    month: "short"
-  }).format(new Date(ms));
-}
-function localDay(ms, tz) {
-  return new Intl.DateTimeFormat("en-CA", {
-    timeZone: tz,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit"
-  }).format(new Date(ms));
-}
-function tzAbbrev(ms, tz) {
-  const at = new Date(ms);
-  for (const loc of ["en-US", "en-AU", "en-GB"]) {
-    const v = new Intl.DateTimeFormat(loc, { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
-    if (v && !/^(?:GMT|UTC)/i.test(v))
-      return v;
-  }
-  return new Intl.DateTimeFormat("en-US", { timeZone: tz, timeZoneName: "short" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value ?? tz;
-}
-
 // send-gate-observability.ts
 function formatStatsLine(stats) {
   const c = stats.global;
@@ -57239,7 +57611,7 @@ function createStatsLogger(config) {
 function isAlertableScope(scopeKey) {
   return scopeKey === "global" || scopeKey.startsWith("chat:") || scopeKey.startsWith("group:");
 }
-function fmtLocalStamp(ms, tz, refMs) {
+function fmtLocalStamp3(ms, tz, refMs) {
   const clock = fmtLocalClock(ms, tz);
   const sameDay = refMs != null && localDay(ms, tz) === localDay(refMs, tz);
   const body = sameDay ? clock : `${fmtLocalDate(ms, tz)} ${clock}`;
@@ -57283,7 +57655,7 @@ function createFloodWindowObserver(config) {
   }
   function openAlertText(w, now) {
     const openFor = fmtDur(now - w.observedAt);
-    return `\u26a0\ufe0f Telegram flood ban active (scope \`${w.scopeKey}\`). ` + `Open for ${openFor}, expected to clear at ${fmtLocalStamp(w.untilTs, tz, now)}. ` + `Outbound to that scope is being suppressed.`;
+    return `\u26a0\ufe0f Telegram flood ban active (scope \`${w.scopeKey}\`). ` + `Open for ${openFor}, expected to clear at ${fmtLocalStamp3(w.untilTs, tz, now)}. ` + `Outbound to that scope is being suppressed.`;
   }
   function closeAlertText(recs) {
     const observedAt = Math.min(...recs.map((r) => r.observedAt));
@@ -63314,6 +63686,7 @@ function endsWithSilentMarker(text4) {
     return false;
   return isSilentFlushMarker(lines[lines.length - 1]);
 }
+var FLUSH_SUBSTANTIVE_MIN_CHARS = 200;
 function selectFlushDeliveryText(blocks) {
   const candidates = blocks.map((b) => b.trim()).filter((b) => b.length > 0);
   if (candidates.length === 0)
@@ -63328,8 +63701,18 @@ function selectFlushDeliveryText(blocks) {
 `);
 }
 var NARRATION_OPENER = /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i;
+var NARRATION_TRAILER = /(?:\.{3}|\u2026|:)\s*$/;
+function isTrailingNarrationLine(block) {
+  const t = block.trim();
+  if (t.length === 0 || t.length >= FLUSH_SUBSTANTIVE_MIN_CHARS)
+    return false;
+  if (t.includes(`
+`))
+    return false;
+  return NARRATION_TRAILER.test(t);
+}
 function isNarrationBlock(block) {
-  return NARRATION_OPENER.test(block.trimStart());
+  return NARRATION_OPENER.test(block.trimStart()) || isTrailingNarrationLine(block);
 }
 function decideTurnFlush(input) {
   const flushEnabled = input.flushEnabled !== false;
@@ -63657,71 +64040,6 @@ function extractRequestId(raw) {
   return m ? m[1] : undefined;
 }
 
-// operator-events.ts
-function classifyClaudeError(raw) {
-  try {
-    return classifyInner(raw);
-  } catch {
-    return "unknown-4xx";
-  }
-}
-function classifyInner(raw) {
-  if (raw == null)
-    return "unknown-4xx";
-  const obj = typeof raw === "object" ? raw : {};
-  const errorType = extractString(obj, "error_type") ?? extractString(obj, "type") ?? extractString(getNestedObj(obj, "error"), "type") ?? "";
-  const errorCode = extractString(obj, "code") ?? extractString(getNestedObj(obj, "error"), "code") ?? "";
-  const message = extractString(obj, "message") ?? extractString(getNestedObj(obj, "error"), "message") ?? (typeof raw === "string" ? raw : "") ?? "";
-  const status = extractNumber(obj, "status") ?? extractNumber(obj, "statusCode") ?? extractNumber(obj, "status_code") ?? null;
-  const sdkCode = extractString(obj, "error_code") ?? "";
-  if (errorType === "authentication_error" || errorCode === "authentication_error" || sdkCode === "authentication_error" || message.toLowerCase().includes("authentication_error")) {
-    const msg = message.toLowerCase();
-    if (msg.includes("expired") || msg.includes("refresh")) {
-      return "credentials-expired";
-    }
-    return "credentials-invalid";
-  }
-  if (errorType === "invalid_api_key" || errorCode === "invalid_api_key" || sdkCode === "invalid_api_key" || message.toLowerCase().includes("invalid_api_key") || message.toLowerCase().includes("invalid api key")) {
-    return "credentials-invalid";
-  }
-  if (errorType === "credit_balance_too_low" || errorCode === "credit_balance_too_low" || sdkCode === "credit_balance_too_low" || message.toLowerCase().includes("credit_balance_too_low") || message.toLowerCase().includes("credit balance")) {
-    return "credit-exhausted";
-  }
-  if (errorType === "rate_limit_error" || errorCode === "rate_limit_error" || sdkCode === "rate_limit_error" || message.toLowerCase().includes("rate_limit_error") || message.toLowerCase().includes("rate limit")) {
-    return "rate-limited";
-  }
-  if (errorType === "overloaded_error" || errorCode === "overloaded_error" || sdkCode === "overloaded_error" || message.toLowerCase().includes("overloaded_error") || message.toLowerCase().includes("overloaded")) {
-    return "rate-limited";
-  }
-  if (errorType === "agent-crashed" || errorCode === "agent-crashed") {
-    return "agent-crashed";
-  }
-  if (errorType === "agent-restarted-unexpectedly" || errorCode === "agent-restarted-unexpectedly") {
-    return "agent-restarted-unexpectedly";
-  }
-  if (status != null) {
-    if (status >= 400 && status < 500)
-      return "unknown-4xx";
-    if (status >= 500 && status < 600)
-      return "unknown-5xx";
-  }
-  return "unknown-4xx";
-}
-function extractString(obj, key) {
-  const v = obj[key];
-  return typeof v === "string" && v.length > 0 ? v : null;
-}
-function extractNumber(obj, key) {
-  const v = obj[key];
-  return typeof v === "number" ? v : null;
-}
-function getNestedObj(obj, key) {
-  const v = obj[key];
-  return typeof v === "object" && v != null ? v : {};
-}
-var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS = 5 * 60000;
-var cooldownMap = new Map;
-
 // model-unavailable.ts
 init_quota_check();
 init_card_format();
@@ -63762,6 +64080,18 @@ function isLitellmProxyLocal429(text4) {
     return true;
   return litellmV3LimiterSignalPair.every((s) => lower.includes(s));
 }
+function isLitellmProxyAuthMisconfig(text4) {
+  if (typeof text4 !== "string" || text4.length === 0)
+    return false;
+  const sample = text4.length > 16384 ? text4.slice(0, 16384) : text4;
+  const lower = sample.toLowerCase();
+  if (lower.includes("x-api-key header is required"))
+    return true;
+  const isAuthErr = lower.includes("authentication_error") || lower.includes("authenticationerror");
+  if (!isAuthErr)
+    return false;
+  return lower.includes("fallback") && lower.includes("x-api-key");
+}
 function parseLitellmLimitDetail(text4, parseTimeNow = new Date) {
   const empty2 = { limitType: null, limit: null, currentUsage: null, resetAtMs: null };
   if (typeof text4 !== "string" || text4.length === 0)
@@ -64006,6 +64336,83 @@ function parseRelativeDuration(s) {
   return matched && total > 0 ? total : null;
 }
 
+// operator-events.ts
+function classifyClaudeError(raw) {
+  try {
+    return classifyInner(raw);
+  } catch {
+    return "unknown-4xx";
+  }
+}
+function classifyInner(raw) {
+  if (raw == null)
+    return "unknown-4xx";
+  const obj = typeof raw === "object" ? raw : {};
+  const errorType = extractString(obj, "error_type") ?? extractString(obj, "type") ?? extractString(getNestedObj(obj, "error"), "type") ?? "";
+  const errorCode = extractString(obj, "code") ?? extractString(getNestedObj(obj, "error"), "code") ?? "";
+  const message = extractString(obj, "message") ?? extractString(getNestedObj(obj, "error"), "message") ?? (typeof raw === "string" ? raw : "") ?? "";
+  const status = extractNumber(obj, "status") ?? extractNumber(obj, "statusCode") ?? extractNumber(obj, "status_code") ?? null;
+  const sdkCode = extractString(obj, "error_code") ?? "";
+  if (isLitellmProxyAuthMisconfig(`${errorType}
+${errorCode}
+${sdkCode}
+${message}`)) {
+    return "proxy-misconfig";
+  }
+  if (errorType === "authentication_error" || errorCode === "authentication_error" || sdkCode === "authentication_error" || message.toLowerCase().includes("authentication_error")) {
+    const msg = message.toLowerCase();
+    if (msg.includes("expired") || msg.includes("refresh")) {
+      return "credentials-expired";
+    }
+    return "credentials-invalid";
+  }
+  if (errorType === "invalid_api_key" || errorCode === "invalid_api_key" || sdkCode === "invalid_api_key" || message.toLowerCase().includes("invalid_api_key") || message.toLowerCase().includes("invalid api key")) {
+    return "credentials-invalid";
+  }
+  if (errorType === "credit_balance_too_low" || errorCode === "credit_balance_too_low" || sdkCode === "credit_balance_too_low" || message.toLowerCase().includes("credit_balance_too_low") || message.toLowerCase().includes("credit balance")) {
+    return "credit-exhausted";
+  }
+  if (errorType === "rate_limit_error" || errorCode === "rate_limit_error" || sdkCode === "rate_limit_error" || message.toLowerCase().includes("rate_limit_error") || message.toLowerCase().includes("rate limit")) {
+    return "rate-limited";
+  }
+  if (errorType === "overloaded_error" || errorCode === "overloaded_error" || sdkCode === "overloaded_error" || message.toLowerCase().includes("overloaded_error") || message.toLowerCase().includes("overloaded")) {
+    return "rate-limited";
+  }
+  if (errorType === "agent-crashed" || errorCode === "agent-crashed") {
+    return "agent-crashed";
+  }
+  if (errorType === "agent-restarted-unexpectedly" || errorCode === "agent-restarted-unexpectedly") {
+    return "agent-restarted-unexpectedly";
+  }
+  if (status != null) {
+    if (status >= 400 && status < 500)
+      return "unknown-4xx";
+    if (status >= 500 && status < 600)
+      return "unknown-5xx";
+  }
+  return "unknown-4xx";
+}
+function extractString(obj, key) {
+  const v = obj[key];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function extractNumber(obj, key) {
+  const v = obj[key];
+  return typeof v === "number" ? v : null;
+}
+function getNestedObj(obj, key) {
+  const v = obj[key];
+  return typeof v === "object" && v != null ? v : {};
+}
+var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS = 5 * 60000;
+var cooldownMap = new Map;
+var OPERATOR_ACTIONABLE_KINDS = new Set([
+  "credentials-expired",
+  "credentials-invalid",
+  "credit-exhausted",
+  "proxy-misconfig"
+]);
+
 // session-tail.ts
 function sanitizeCwdToProjectName(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
@@ -65407,13 +65814,17 @@ class AuthBrokerClient2 {
       sock.destroy();
     }
   }
-  async getCredentials(provider) {
+  async getCredentials(provider, account) {
     const base = {
       v: PROTOCOL_VERSION,
       id: randomUUID4(),
       op: "get-credentials"
     };
-    const req = provider !== undefined ? { ...base, provider } : base;
+    let req = base;
+    if (provider !== undefined)
+      req = { ...req, provider };
+    if (account !== undefined)
+      req = { ...req, account };
     const data = await this.send(req);
     return data;
   }
@@ -66623,6 +67034,20 @@ function renderOperatorEvent(ev) {
           ]
         }
       };
+    case "proxy-misconfig":
+      return {
+        text: [
+          `\uD83D\uDEE0\ufe0f **Model-gateway auth misconfig** for **${agent}**.`,
+          detail ? `_${detail}_` : "",
+          `The local LiteLLM proxy re-dispatched a fallback without forwarding the OAuth header (keyless deployment \u2192 Anthropic 401). Fix the proxy fallback config \u2014 this is NOT a login problem.`
+        ].filter(Boolean).join(`
+`),
+        keyboard: {
+          inline_keyboard: [
+            [{ text: "\u274c Dismiss", callback_data: `op:dismiss:${encodeURIComponent(ev.agent)}` }]
+          ]
+        }
+      };
     case "credit-exhausted":
       return {
         text: [
@@ -66783,6 +67208,55 @@ function shouldEmitOperatorEvent(agent, kind, now = Date.now(), cooldownMs = DEF
   cooldownMap2.set(key, now);
   return true;
 }
+var OPERATOR_ACTIONABLE_KINDS2 = new Set([
+  "credentials-expired",
+  "credentials-invalid",
+  "credit-exhausted",
+  "proxy-misconfig"
+]);
+function isOperatorActionableKind(kind) {
+  return OPERATOR_ACTIONABLE_KINDS2.has(kind);
+}
+function decideOperatorEventAudience(kind, allowFrom, operatorChatId) {
+  if (!isOperatorActionableKind(kind)) {
+    return { operatorChats: [...allowFrom], userNoticeChats: [] };
+  }
+  const operator = operatorChatId != null && allowFrom.includes(operatorChatId) ? operatorChatId : allowFrom[0];
+  const operatorChats = operator != null ? [operator] : [];
+  const userNoticeChats = allowFrom.filter((c) => c !== operator);
+  return { operatorChats, userNoticeChats };
+}
+function renderUserFacingFailureNotice() {
+  return "\u26a0\ufe0f Sorry \u2014 I couldn't complete that just now. It's a problem on our side, not anything you did. Please try again shortly.";
+}
+
+// pending-user-notice.ts
+var PENDING_USER_NOTICE_TTL_MS = 10 * 60000;
+
+class PendingUserNoticeGate {
+  pending = [];
+  schedule(notice) {
+    this.prune(notice.atMs);
+    this.pending = this.pending.filter((p) => p.agent !== notice.agent);
+    this.pending.push(notice);
+  }
+  resolveTurnEnd(turnDeliveredReply, now = Date.now()) {
+    this.prune(now);
+    const out = turnDeliveredReply ? [] : [...this.pending];
+    this.pending = [];
+    return out;
+  }
+  hasPending(now = Date.now()) {
+    return this.pending.some((p) => now - p.atMs < PENDING_USER_NOTICE_TTL_MS);
+  }
+  prune(now) {
+    this.pending = this.pending.filter((p) => now - p.atMs < PENDING_USER_NOTICE_TTL_MS);
+  }
+  reset() {
+    this.pending = [];
+  }
+}
+var pendingUserNoticeGate = new PendingUserNoticeGate;
 
 // operator-events-history.ts
 var EVENT_TTL_MS = 60 * 60 * 1000;
@@ -66896,7 +67370,13 @@ function parseLlmError(raw, retryState) {
 }
 function classifyKindAndSource(text4) {
   const lower = text4.toLowerCase();
+  if (isLitellmProxyAuthMisconfig(text4)) {
+    return { kind: "infra_misconfig", source: "litellm-local" };
+  }
   const claudeKind = classifyClaudeError({ message: text4, type: text4 });
+  if (claudeKind === "proxy-misconfig") {
+    return { kind: "infra_misconfig", source: "litellm-local" };
+  }
   if (claudeKind === "credentials-expired" || claudeKind === "credentials-invalid") {
     return { kind: "auth", source: "anthropic" };
   }
@@ -66939,6 +67419,8 @@ function buildCoreText(kind, source) {
       return "Usage limit reached on this Claude subscription.";
     case "auth":
       return "Claude login needs re-authentication.";
+    case "infra_misconfig":
+      return "Local model-gateway auth misconfig (proxy fallback dropped the OAuth header).";
     case "transient":
       return source === "network" ? "Couldn't reach Anthropic (network) \u2014 retrying automatically." : "A temporary upstream hiccup \u2014 retrying automatically.";
     case "unknown":
@@ -66984,6 +67466,8 @@ function buildRecommendation(parsed, tz) {
   switch (parsed.kind) {
     case "auth":
       return "\u2192 Re-authenticate this account to continue.";
+    case "infra_misconfig":
+      return "\u2192 Fix the LiteLLM proxy fallback config (deployment missing OAuth passthrough).";
     case "quota_wall": {
       const reset2 = formatResetClock(parsed.resetAt, tz);
       return reset2 ? `\u2192 Switch to another account, or wait for the quota to reset at ${reset2}.` : "\u2192 Switch to another account, or wait for the quota to reset.";
@@ -67025,6 +67509,8 @@ function kindEmoji(kind) {
       return "\u26a0\ufe0f";
     case "auth":
       return "\uD83D\uDD11";
+    case "infra_misconfig":
+      return "\uD83D\uDEE0\ufe0f";
     case "transient":
       return "\uD83C\uDF10";
     case "unknown":
@@ -69214,7 +69700,7 @@ function endsWithSilentMarker2(text4) {
     return false;
   return isSilentFlushMarker2(lines[lines.length - 1]);
 }
-var FLUSH_SUBSTANTIVE_MIN_CHARS = 200;
+var FLUSH_SUBSTANTIVE_MIN_CHARS2 = 200;
 function selectFlushDeliveryText2(blocks) {
   const candidates = blocks.map((b) => b.trim()).filter((b) => b.length > 0);
   if (candidates.length === 0)
@@ -69229,8 +69715,18 @@ function selectFlushDeliveryText2(blocks) {
 `);
 }
 var NARRATION_OPENER2 = /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i;
+var NARRATION_TRAILER2 = /(?:\.{3}|\u2026|:)\s*$/;
+function isTrailingNarrationLine2(block) {
+  const t = block.trim();
+  if (t.length === 0 || t.length >= FLUSH_SUBSTANTIVE_MIN_CHARS2)
+    return false;
+  if (t.includes(`
+`))
+    return false;
+  return NARRATION_TRAILER2.test(t);
+}
 function isNarrationBlock2(block) {
-  return NARRATION_OPENER2.test(block.trimStart());
+  return NARRATION_OPENER2.test(block.trimStart()) || isTrailingNarrationLine2(block);
 }
 function decideTurnFlush2(input) {
   const flushEnabled = input.flushEnabled !== false;
@@ -71165,16 +71661,6 @@ Allowed: \`${deps.escapeHtml(allow)}\``, { html: true });
   await deps.reply(ctx, finalText, { html: true, accent });
 }
 
-// ../src/agents/model-picker.ts
-function labelTag(label) {
-  let h = 2166136261;
-  for (const ch of label) {
-    h ^= ch.codePointAt(0);
-    h = Math.imul(h, 16777619) >>> 0;
-  }
-  return h.toString(16).padStart(8, "0");
-}
-
 // gateway/model-command.ts
 var MODEL_ALIASES = ["opus", "sonnet", "haiku", "fable", "default"];
 var MODEL_ARG_RE = /^[A-Za-z0-9][A-Za-z0-9._/\[\]-]{0,99}$/;
@@ -71184,11 +71670,29 @@ function isValidModelArg(arg) {
 function isSrModel(name) {
   return name.startsWith("sr-");
 }
-function isClaudeModel(name) {
-  const lower = name.toLowerCase();
-  if (MODEL_ALIASES.includes(lower))
-    return true;
-  return lower.startsWith("claude-");
+function parseModelSwitchTarget(reason) {
+  const m = reason.match(/\/model\s+(\S+)/);
+  return m ? m[1] : null;
+}
+function modelFamilyToken(token) {
+  const t = token.trim().toLowerCase();
+  if (t.startsWith("claude-")) {
+    const family = t.slice("claude-".length).split("-").filter((p) => p.length > 0)[0];
+    return family ?? t;
+  }
+  return t;
+}
+function classifyModelSwitchConfirmation(input) {
+  const { reason, launched, configured } = input;
+  const isApplyBoot = launched.length > 0 && launched !== configured;
+  if (isApplyBoot)
+    return { kind: "applied", launched };
+  const target = parseModelSwitchTarget(reason);
+  const revertedTo = launched.length > 0 ? launched : configured;
+  if (target != null && target.toLowerCase() !== "default" && modelFamilyToken(target) !== modelFamilyToken(revertedTo)) {
+    return { kind: "not-applied", target, revertedTo };
+  }
+  return { kind: "default", launched: revertedTo };
 }
 function parseModelCommand(text4) {
   const m = text4.match(/^\/model(?:@[A-Za-z0-9_]+)?(?:\s+([\s\S]*))?$/);
@@ -71233,13 +71737,13 @@ function modelCommandReceiptLine(agent, parsed, busy) {
   const arg = parsed.kind === "set" ? parsed.model : parsed.kind === "show" ? "(show)" : "(help)";
   return `telegram gateway: gw /model received agent=${agent} kind=${parsed.kind} arg=${arg} busy=${busy}`;
 }
-var PERSIST_NOTE = "_Session-only \u2014 this override lasts until the agent\u2019s next restart, then reverts to the configured `model:`. `/model default` clears it now. To change the default permanently, set `model:` in switchroom.yaml._";
+var PERSIST_NOTE = "_A `/model` switch relaunches the session (~30s) on the chosen model. Session-only \u2014 reverts to the configured `model:` on the next restart. `/model default` reverts now. Live scrollback is replaced by a fresh session; memory and the handoff briefing carry the context. To change the default permanently, set `model:` in switchroom.yaml._";
 function helpText2(deps, reason) {
   const srAliasExamples = Object.keys(SR_MODEL_ALIASES).map((a) => `\`${a}\``).join(" \u00b7 ");
   const lines = [];
   if (reason)
     lines.push(`\u26a0\ufe0f ${deps.escapeHtml(reason)}`);
-  lines.push("**/model** \u2014 show or switch the Claude model", "`/model` \u2014 show the configured model", `\`/model <name>\` \u2014 switch the live session (${MODEL_ALIASES.map((a) => `\`${a}\``).join(" \u00b7 ")} or a full model id)`, `_OpenRouter shortcuts:_ ${srAliasExamples}`, "_OpenRouter (sr-\\*) switches restart the session (~30s); Claude switches apply instantly._", PERSIST_NOTE);
+  lines.push("**/model** \u2014 show or switch the Claude model", "`/model` \u2014 show the configured model", `\`/model <name>\` \u2014 switch the live session (${MODEL_ALIASES.map((a) => `\`${a}\``).join(" \u00b7 ")} or a full model id)`, `_OpenRouter shortcuts:_ ${srAliasExamples}`, "_Every switch relaunches the session (~30s) on the chosen model \u2014 Claude and OpenRouter (sr-\\*) alike._", PERSIST_NOTE);
   return { text: lines.join(`
 `), html: true };
 }
@@ -71273,132 +71777,46 @@ async function handleModelCommand(parsed, deps) {
       html: true
     };
   }
-  const currentSession = deps.getActiveSessionModel();
-  if (currentSession !== null && isSrModel(currentSession) && isClaudeModel(model)) {
-    try {
-      await deps.scheduleModelRelaunch(model, `user: /model ${model} (sr-to-claude restart)`);
-    } catch (err) {
-      if (isRestartInFlight(err)) {
-        return {
-          text: `\u23f3 A restart is already in flight \u2014 your switch to \`${deps.escapeHtml(model)}\` will apply as it completes (~15s).`,
-          html: true
-        };
-      }
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        text: `\u274c Could not schedule restart: ${deps.escapeHtml(msg)}`,
-        html: true
-      };
-    }
-    return {
-      text: [
-        `Switching from \`${deps.escapeHtml(currentSession)}\` back to Claude \u2014 restarting session cleanly. Claude will be ready in ~30s.`,
-        PERSIST_NOTE
-      ].join(`
-`),
-      html: true
-    };
+  if (model.toLowerCase() === "default") {
+    return scheduleDefaultRelaunchReply(deps, "user: /model default (revert relaunch)");
   }
-  if (isSrModel(model)) {
-    try {
-      await deps.scheduleModelRelaunch(model, `user: /model ${model} (session-only relaunch)`);
-    } catch (err) {
-      if (isRestartInFlight(err)) {
-        return {
-          text: `\u23f3 A restart is already in flight \u2014 your switch to \`${deps.escapeHtml(model)}\` will apply as it completes (~15s).`,
-          html: true
-        };
-      }
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        text: `\u274c Could not schedule model switch: ${deps.escapeHtml(msg)}`,
-        html: true
-      };
-    }
+  return scheduleRelaunchReply(deps, model, `user: /model ${model} (session-only relaunch)`);
+}
+function switchingLine(deps, model) {
+  const friendly = isSrModel(model) ? srFriendlyLabel(model) : model;
+  return `\uD83D\uDD04 Switching to \`${deps.escapeHtml(friendly)}\` \u2014 relaunching the session (~30s).`;
+}
+function relaunchErrorReply(deps, model, err) {
+  if (isRestartInFlight(err)) {
     return {
-      text: [
-        `Switching to \`${deps.escapeHtml(model)}\` \u2014 restarting session (~30s).`,
-        PERSIST_NOTE
-      ].join(`
-`),
+      text: `\u23f3 A restart is already in flight \u2014 your switch to \`${deps.escapeHtml(model)}\` will apply as it completes (~15s).`,
       html: true
     };
   }
-  const verbHtml = `\`/model ${deps.escapeHtml(model)}\``;
-  let result;
+  const msg = err instanceof Error ? err.message : String(err);
+  return { text: `\u274c Could not schedule model switch: ${deps.escapeHtml(msg)}`, html: true };
+}
+async function scheduleRelaunchReply(deps, model, reason) {
   try {
-    result = await deps.inject(deps.getAgentName(), `/model ${model}`, {
-      successPattern: MODEL_SWITCH_CONFIRMATION_PREFIX,
-      errorPattern: MODEL_SWITCH_ERROR_RE,
-      settleBeforeSendMs: 1500
-    });
+    await deps.scheduleModelRelaunch(model, reason);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return {
-      text: `\u274c ${verbHtml} \u2014 inject failed: ${deps.escapeHtml(msg)}`,
-      html: true
-    };
+    return relaunchErrorReply(deps, model, err);
   }
-  if (result.outcome === "ok" || result.outcome === "ok_no_output") {
-    const confirmation = result.outcome === "ok" ? modelSwitchConfirmationLine(result.output) : null;
-    if (confirmation) {
-      if (isKeptModelConfirmation(confirmation)) {
-        return {
-          text: [
-            `${verbHtml}`,
-            deps.preBlock(confirmation),
-            ...result.truncated ? ["_truncated_"] : [],
-            PERSIST_NOTE
-          ].join(`
-`),
-          html: true
-        };
-      }
-      const confirmed = sessionModelFromConfirmation(confirmation) ?? model;
-      return {
-        text: [
-          `${verbHtml}`,
-          deps.preBlock(confirmation),
-          ...result.truncated ? ["_truncated_"] : [],
-          PERSIST_NOTE
-        ].join(`
-`),
-        html: true,
-        selectedModel: confirmed
-      };
-    }
-    const errLine = result.outcome === "ok" ? modelSwitchErrorLine(result.output) : null;
-    if (errLine) {
-      return {
-        text: [
-          `\u274c ${verbHtml} \u2014 the switch did not take:`,
-          deps.preBlock(errLine),
-          "Check `/model` for a valid, available model."
-        ].join(`
-`),
-        html: true
-      };
-    }
-    const optimisticLabel = optimisticModelRecordLabel(model);
-    return {
-      text: [
-        `${verbHtml} \u2014 sent, but couldn't read a confirmation line. \`/status\` will show the live model once it's confirmed.`,
-        PERSIST_NOTE
-      ].join(`
-`),
-      html: true,
-      selectedModel: optimisticLabel,
-      optimistic: true
-    };
-  }
-  if (result.errorCode === "session_missing") {
-    return {
-      text: "\u274c tmux session not found \u2014 the agent must be running under the tmux supervisor (the default). Remove `experimental.legacy_pty: true` if set.",
-      html: true
-    };
+  return { text: [switchingLine(deps, model), PERSIST_NOTE].join(`
+`), html: true };
+}
+async function scheduleDefaultRelaunchReply(deps, reason) {
+  try {
+    await deps.scheduleModelDefaultRelaunch(reason);
+  } catch (err) {
+    return relaunchErrorReply(deps, "default", err);
   }
   return {
-    text: `\u274c ${verbHtml} \u2014 ${deps.escapeHtml(result.errorMessage ?? "inject failed")}`,
+    text: [
+      "\uD83D\uDD04 Reverting to the configured default model \u2014 relaunching the session (~30s).",
+      PERSIST_NOTE
+    ].join(`
+`),
     html: true
   };
 }
@@ -71451,15 +71869,6 @@ function expandSrAlias(arg) {
 function srFriendlyLabel(srName) {
   return SR_MODEL_LABELS[srName] ?? srName.replace(/^sr-/, "").replace(/-/g, " ");
 }
-function optimisticModelRecordLabel(token) {
-  if (isSrModel(token))
-    return token;
-  const lower = token.toLowerCase();
-  if (MODEL_ALIASES.includes(lower)) {
-    return lower.charAt(0).toUpperCase() + lower.slice(1);
-  }
-  return token;
-}
 function classifyDiscoveredOptions(options) {
   return {
     claude: options.filter((o) => !o.label.startsWith("sr-") && !o.label.includes("/") && (/^[A-Z]/.test(o.label) || o.label.startsWith("claude-"))),
@@ -71467,7 +71876,19 @@ function classifyDiscoveredOptions(options) {
   };
 }
 function modelSelectCallbackData(label) {
-  return `${MODEL_CALLBACK_SELECT}${labelTag(label)}`;
+  const token = canonicalClaudeToken(label);
+  if (token)
+    return `${MODEL_CALLBACK_SELECT}${token}`;
+  if (/^default\b/i.test(label.trim()))
+    return `${MODEL_CALLBACK_SELECT}default`;
+  return MODEL_CALLBACK_SELECT;
+}
+function isRecognizedSwitchToken(token) {
+  if (token.toLowerCase() === "default")
+    return true;
+  if (isSrModel(token))
+    return true;
+  return canonicalClaudeToken(token) !== null;
 }
 var BUSY_REFUSAL_TEXT = "\u23f3 The agent is mid-turn \u2014 the model picker needs an idle prompt. Your tap was not applied.";
 function isBusyRefusalText(text4) {
@@ -71617,75 +72038,28 @@ async function handleModelMenuCallback(data, deps) {
   if (data === MODEL_CALLBACK_PAGE_MAIN) {
     return { answer: "Back", reply: await buildModelMenu(deps, "main") };
   }
-  if (data.startsWith(MODEL_CALLBACK_ALIAS)) {
-    const alias = data.slice(MODEL_CALLBACK_ALIAS.length);
-    if (!isValidModelArg(alias)) {
-      return { answer: "Invalid model name", reply: await buildModelMenu(deps) };
-    }
-    if (deps.isBusy()) {
-      return {
-        answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-        reply: { text: BUSY_REFUSAL_TEXT, html: true },
-        toastOnly: true,
-        busyRefusal: true
-      };
-    }
-    let aliasResult;
-    try {
-      aliasResult = await deps.inject(deps.getAgentName(), `/model ${alias}`, {
-        successPattern: MODEL_SWITCH_CONFIRMATION_PREFIX,
-        errorPattern: MODEL_SWITCH_ERROR_RE,
-        settleBeforeSendMs: 1500
-      });
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        answer: "Switch failed",
-        reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(alias)}** failed: ${deps.escapeHtml(msg)}`)
-      };
-    }
-    if (aliasResult.outcome === "ok" || aliasResult.outcome === "ok_no_output") {
-      const confirmation = aliasResult.outcome === "ok" ? modelSwitchConfirmationLine(aliasResult.output) : null;
-      if (confirmation) {
-        const kept = isKeptModelConfirmation(confirmation);
-        return {
-          answer: confirmation,
-          reply: await menuWithBannerStatic(deps, `\u2705 ${deps.escapeHtml(confirmation)}`),
-          ...kept ? {} : {
-            selectedModel: sessionModelFromConfirmation(confirmation) ?? optimisticModelRecordLabel(alias),
-            selectedModelToken: alias
-          }
-        };
-      }
-      const aliasErr = aliasResult.outcome === "ok" ? modelSwitchErrorLine(aliasResult.output) : null;
-      if (aliasErr) {
-        return {
-          answer: "Switch failed",
-          reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(alias)}** did not take: ${deps.escapeHtml(aliasErr)}`)
-        };
-      }
-      const optimisticLabel = optimisticModelRecordLabel(alias);
-      return {
-        answer: `Sent /model ${alias} \u2014 check /status`,
-        reply: await menuWithBannerStatic(deps, `Sent \`/model ${deps.escapeHtml(alias)}\` \u2014 couldn\u2019t read a confirmation line. \`/status\` will show the live model once it\u2019s confirmed.`),
-        selectedModel: optimisticLabel,
-        selectedModelToken: alias
-      };
-    }
-    return {
-      answer: "Switch failed",
-      reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(alias)}** failed \u2014 agent may be mid-turn`)
-    };
-  }
   if (data === MODEL_CALLBACK_HEADER) {
     return { answer: "Tap a model in this section to switch", reply: { text: "", html: true }, toastOnly: true };
   }
-  if (data.startsWith(MODEL_CALLBACK_SR)) {
-    const srName = data.slice(MODEL_CALLBACK_SR.length);
-    const friendlyName = srFriendlyLabel(srName);
-    if (!isValidModelArg(srName)) {
+  if (data.startsWith(MODEL_CALLBACK_ALIAS) || data.startsWith(MODEL_CALLBACK_SR) || data.startsWith(MODEL_CALLBACK_SELECT)) {
+    let token;
+    let label;
+    if (data.startsWith(MODEL_CALLBACK_ALIAS)) {
+      token = data.slice(MODEL_CALLBACK_ALIAS.length);
+      label = token;
+    } else if (data.startsWith(MODEL_CALLBACK_SR)) {
+      token = data.slice(MODEL_CALLBACK_SR.length);
+      label = srFriendlyLabel(token);
+    } else {
+      token = data.slice(MODEL_CALLBACK_SELECT.length);
+      label = token;
+    }
+    if (!isValidModelArg(token)) {
       return { answer: "Invalid model name", reply: await buildModelMenu(deps) };
     }
+    if (!isRecognizedSwitchToken(token)) {
+      return { answer: "Model list changed \u2014 menu refreshed", reply: await buildModelMenu(deps) };
+    }
     if (deps.isBusy()) {
       return {
         answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
@@ -71694,87 +72068,38 @@ async function handleModelMenuCallback(data, deps) {
         busyRefusal: true
       };
     }
-    try {
-      await deps.scheduleModelRelaunch(srName, `user: /model ${srName} (session-only relaunch, menu)`);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+    return menuRelaunchOutcome(deps, token, label);
+  }
+  return { answer: "Unknown action", reply: await buildModelMenu(deps) };
+}
+async function menuRelaunchOutcome(deps, token, label) {
+  const isDefault = token.toLowerCase() === "default";
+  try {
+    if (isDefault) {
+      await deps.scheduleModelDefaultRelaunch("user: /model default (revert relaunch, menu)");
+    } else {
+      await deps.scheduleModelRelaunch(token, `user: /model ${token} (session-only relaunch, menu)`);
+    }
+  } catch (err) {
+    if (isRestartInFlight(err)) {
       return {
-        answer: "Switch failed",
-        reply: await menuWithBannerStatic(deps, `\u274c Switch to **${deps.escapeHtml(friendlyName)}** failed: ${deps.escapeHtml(msg)}`)
+        answer: "A restart is already in flight (~15s)",
+        reply: await menuWithBannerStatic(deps, `\u23f3 A restart is already in flight \u2014 your switch to **${deps.escapeHtml(label)}** will apply as it completes (~15s).`)
       };
     }
+    const msg = err instanceof Error ? err.message : String(err);
     return {
-      answer: `Switching to ${friendlyName} \u2014 restarting (~30s)`,
-      reply: await menuWithBannerStatic(deps, `\uD83D\uDD04 Switching session to **${deps.escapeHtml(friendlyName)}** \u2014 restarting (~30s).
-${PERSIST_NOTE}`),
-      selectedModel: srName
-    };
-  }
-  if (!data.startsWith(MODEL_CALLBACK_SELECT)) {
-    return { answer: "Unknown action", reply: await buildModelMenu(deps) };
-  }
-  if (deps.isBusy()) {
-    return {
-      answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-      reply: { text: BUSY_REFUSAL_TEXT, html: true },
-      toastOnly: true,
-      busyRefusal: true
-    };
-  }
-  const tag = data.slice(MODEL_CALLBACK_SELECT.length);
-  const discovered = await deps.discover(deps.getAgentName());
-  if (!discovered.ok) {
-    return {
-      answer: "Picker unavailable",
-      reply: await menuWithBanner(deps, `\u274c Could not open the model picker: ${deps.escapeHtml(discovered.reason)}`)
-    };
-  }
-  const target = discovered.options.find((o) => labelTag(o.label) === tag);
-  if (!target) {
-    const fresh = await buildModelMenu(deps);
-    return { answer: "Model list changed \u2014 menu refreshed", reply: fresh };
-  }
-  const result = await deps.select(deps.getAgentName(), target.label);
-  if (!result.ok) {
-    return {
-      answer: "Switch failed \u2014 see the menu",
-      reply: await menuWithBanner(deps, `\u274c Switch to **${deps.escapeHtml(target.label)}** failed: ${deps.escapeHtml(result.reason)}`)
-    };
-  }
-  if (isKeptModelConfirmation(result.confirmation)) {
-    return {
-      answer: deps.escapeHtml(result.confirmation),
-      reply: await menuWithBanner(deps, `\u2705 ${deps.escapeHtml(result.confirmation)}`)
+      answer: "Switch failed",
+      reply: await menuWithBannerStatic(deps, `\u274c Switch to **${deps.escapeHtml(label)}** failed: ${deps.escapeHtml(msg)}`)
     };
   }
-  const token = canonicalClaudeToken(target.label);
-  const selectedModel = sessionModelFromConfirmation(result.confirmation) ?? token ?? undefined;
-  const clearedDefault = token == null && /^default\b/i.test(target.label.trim());
+  const friendly = isDefault ? "the configured default" : label;
   return {
-    answer: deps.escapeHtml(result.confirmation),
-    reply: await menuWithBanner(deps, `\u2705 ${deps.escapeHtml(result.confirmation)}`),
-    ...selectedModel ? { selectedModel } : {},
-    ...token ? { selectedModelToken: token } : {},
-    ...clearedDefault ? { clearedDefault: true } : {}
+    answer: `Switching to ${isDefault ? "default" : label} \u2014 relaunching (~30s)`,
+    reply: await menuWithBannerStatic(deps, `\uD83D\uDD04 Switching session to **${deps.escapeHtml(friendly)}** \u2014 relaunching (~30s).
+${PERSIST_NOTE}`)
   };
 }
-function isSrToClaudeTransition(prevModel, nextModel) {
-  return !!prevModel?.startsWith("sr-") && !nextModel.startsWith("sr-");
-}
-function modelSwitchConfirmationLine(output) {
-  const line = output.split(`
-`).map((l) => l.trim()).find((l) => MODEL_SWITCH_CONFIRMATION_PREFIX.test(l));
-  return line && line.length > 0 ? line : null;
-}
-var MODEL_SWITCH_ERROR_RE = /^\s*[\u23fa\u25cf\u2022>\u23bf-]?\s*(?:Error:\s*)?(?:Model(?:\s+'[^']+')?\s+not found|Invalid model|Unknown model|No such model|(?:[\w'\u2019.\-]+\s+){0,4}(?:(?:is |are )?(?:not available|unavailable|not enabled|not supported)|access denied|requires\b[^\n]{0,40}\b(?:subscription|plan)|no access)\b)/i;
-function modelSwitchErrorLine(output) {
-  const line = output.split(`
-`).map((l) => l.trim()).find((l) => MODEL_SWITCH_ERROR_RE.test(l));
-  return line && line.length > 0 ? line : null;
-}
-function isKeptModelConfirmation(confirmation) {
-  return /^\s*[\u23fa\u25cf\u2022>\u23bf-]?\s*Kept model as\b/i.test(confirmation.trim());
-}
 function canonicalClaudeToken(label) {
   const l = label.trim();
   if (l.toLowerCase().startsWith("claude-"))
@@ -71789,21 +72114,6 @@ function canonicalClaudeToken(label) {
 function isRestartInFlight(err) {
   return !!err && typeof err === "object" && err.code === "restart_in_flight";
 }
-var MODEL_SWITCH_CONFIRMATION_PREFIX = /^\s*[\u23fa\u25cf\u2022>\u23bf-]?\s*(?:Set model to|Switched to|Kept model as)\b/i;
-function sessionModelFromConfirmation(confirmation) {
-  const m = /(?:Set model to|Switched to)\s+(.+?)(?:\s+for (?:this|the) session|\s+and saved\b|\s*\(|\s*$)/i.exec(confirmation.trim());
-  const name = m?.[1]?.trim();
-  return name && name.length > 0 ? name : null;
-}
-async function menuWithBanner(deps, banner) {
-  const fresh = await buildModelMenu(deps);
-  return {
-    text: [banner, "", fresh.text].join(`
-`),
-    html: true,
-    ...fresh.keyboard ? { keyboard: fresh.keyboard } : {}
-  };
-}
 async function menuWithBannerStatic(deps, banner) {
   const v1 = await handleModelCommand({ kind: "show" }, deps);
   return {
@@ -71827,6 +72137,7 @@ var MODEL_CALLBACK_ALIAS2 = "mdl:alias:";
 // gateway/session-model-file.ts
 var SESSION_MODEL_FILE = ".session-model";
 var CONFIGURED_DEFAULT_MODEL_FILE = ".configured-default-model";
+var SESSION_MODEL_BOOT_ATTEMPTS_FILE = ".session-model-boot-attempts";
 function atomicWrite(path2, content3) {
   const tmp = `${path2}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync21(tmp, content3, "utf8");
@@ -71858,6 +72169,14 @@ function clearSessionModelFile(agentDir) {
     rmSync4(join30(agentDir, SESSION_MODEL_FILE), { force: true });
   } catch {}
 }
+function consumeSessionModelCarrierOnHealthyBoot(agentDir) {
+  try {
+    rmSync4(join30(agentDir, SESSION_MODEL_FILE), { force: true });
+  } catch {}
+  try {
+    rmSync4(join30(agentDir, SESSION_MODEL_BOOT_ATTEMPTS_FILE), { force: true });
+  } catch {}
+}
 function restoreSessionModelFileRaw(agentDir, raw) {
   if (raw == null) {
     clearSessionModelFile(agentDir);
@@ -72215,70 +72534,6 @@ async function discoverModels(agentName3, opts = {}) {
     return { ok: true, options: parsed.options, currentLabel: current?.label ?? null, ...tail };
   });
 }
-async function selectModel(agentName3, targetLabel, opts = {}) {
-  const io = makeIo(agentName3, opts);
-  if (!io.runner.hasSession(io.socket, io.session)) {
-    return { ok: false, reason: "tmux session not found" };
-  }
-  return withPaneLock(`${io.socket}:${io.session}`, async () => {
-    io.startedAt = Date.now();
-    let selected = false;
-    try {
-      const parsed = await openPickerWithRetry(io);
-      if (!parsed || !parsed.footerSeen) {
-        return { ok: false, reason: "picker did not render \u2014 agent may be mid-turn" };
-      }
-      const target = parsed.options.find((o) => o.label === targetLabel);
-      if (!target) {
-        const have = parsed.options.map((o) => o.label).join(", ");
-        return { ok: false, reason: `option "${targetLabel}" not offered (have: ${have})` };
-      }
-      if (parsed.cursorIndex < 0) {
-        return { ok: false, reason: "cursor marker not visible \u2014 refusing blind navigation" };
-      }
-      const delta = target.index - parsed.cursorIndex;
-      const key = delta > 0 ? "Down" : "Up";
-      for (let i = 0;i < Math.abs(delta); i++) {
-        if (expired(io))
-          return { ok: false, reason: "timed out navigating picker" };
-        sendKey(io, key);
-        await io.sleep(Math.min(io.stepMs, 250));
-      }
-      await io.sleep(io.stepMs);
-      const verifyPane = io.runner.capture(io.socket, io.session) ?? "";
-      const verify = parseModelPicker(verifyPane);
-      const atRow = verify?.options.find((o) => o.index === verify.cursorIndex);
-      if (!verify || !atRow || atRow.label !== targetLabel) {
-        return {
-          ok: false,
-          reason: `cursor verification failed (on "${atRow?.label ?? "?"}", wanted "${targetLabel}")`
-        };
-      }
-      sendLiteral(io, "s");
-      selected = true;
-      await io.sleep(io.stepMs);
-      const after = io.runner.capture(io.socket, io.session) ?? "";
-      const confirmation = extractConfirmation(after) ?? `Switched to ${targetLabel} (session)`;
-      return { ok: true, confirmation };
-    } catch (err) {
-      return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    } finally {
-      if (!selected) {
-        await dismissOrWarn(io, "select");
-      }
-    }
-  });
-}
-function extractConfirmation(pane) {
-  const lines = pane.split(`
-`);
-  for (let i = lines.length - 1;i >= 0; i--) {
-    const t = lines[i].replace(/^\s*\u23bf\s*/, "").trim();
-    if (/^(Set model to|Kept model as|Switched to)/i.test(t))
-      return t;
-  }
-  return null;
-}
 
 // ../src/agents/scaffold.ts
 import { join as join33, resolve as resolve6 } from "node:path";
@@ -72295,14 +72550,7 @@ init_merge();
 
 // ../src/agents/scaffold.ts
 init_merge();
-
-// ../src/config/timezone.ts
-var CONTAINER_DEFAULT_UTC_ZONES = new Set([
-  "UTC",
-  "Etc/UTC",
-  "Etc/Universal",
-  "Universal"
-]);
+init_timezone();
 
 // ../src/cli/agent-config.ts
 import { join as join31 } from "node:path";
@@ -73052,6 +73300,7 @@ init_schema();
 init_paths();
 init_overlay_loader();
 init_merge();
+init_timezone();
 var import_yaml4 = __toESM(require_dist(), 1);
 import { readFileSync as readFileSync27, existsSync as existsSync27 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
@@ -73179,8 +73428,30 @@ function loadConfig2(configPath) {
   if (notionIssues.length > 0) {
     throw new ConfigError2(`Invalid notion_workspace configuration in ${filePath}`, notionIssues);
   }
+  validateAllTimezones2(config, filePath);
   return config;
 }
+function validateAllTimezones2(config, filePath) {
+  const issues = [];
+  const check = (zone, where) => {
+    if (zone == null)
+      return;
+    if (!isResolvableTimezone(zone)) {
+      issues.push(`  ${where}: "${zone}" is not a resolvable IANA timezone ` + `(shape is valid but no such zone exists \u2014 check for a typo, ` + `e.g. "Australia/Melbourne", "America/New_York", "UTC").`);
+    }
+  };
+  check(config.switchroom?.timezone, "switchroom.timezone");
+  check(config.defaults?.timezone, "defaults.timezone");
+  for (const [profileName, profile] of Object.entries(config.profiles ?? {})) {
+    check(profile?.timezone, `profiles.${profileName}.timezone`);
+  }
+  for (const [agentName3, agentRaw] of Object.entries(config.agents)) {
+    check(agentRaw?.timezone, `agents.${agentName3}.timezone`);
+  }
+  if (issues.length > 0) {
+    throw new ConfigError2(`Invalid timezone configuration in ${filePath}`, issues);
+  }
+}
 function validateAllCronTopicAliases2(config, filePath) {
   const issues = [];
   for (const [agentName3, agentRaw] of Object.entries(config.agents)) {
@@ -77548,17 +77819,20 @@ function computeTurnStatus(turn) {
       return turn.finalAnswerDelivered ? "complete" : "no_reply";
   }
 }
-function backstopSendOutcome(args) {
+function backstopSendOutcomeGated(args) {
   if (args.threw)
     return "failed";
   if (args.chunkCount === 0)
     return "failed";
-  if (args.sentCount < args.chunkCount)
+  const freshCount = args.sentIds.filter((id) => args.cardMessageId == null || id !== args.cardMessageId).length;
+  if (freshCount === 0)
+    return "failed";
+  if (freshCount < args.chunkCount)
     return "failed";
   return "delivered";
 }
-function finalizeBackstopSend(turn, send) {
-  const outcome = backstopSendOutcome(send);
+function finalizeBackstopSendGated(turn, send) {
+  const outcome = backstopSendOutcomeGated(send);
   turn.deliveryOutcome = outcome;
   return outcome;
 }
@@ -77573,6 +77847,120 @@ function buildTurnRecord(turn, endedAt) {
   };
 }
 
+// gateway/backstop-delivery.ts
+class BackstopDeliveryLedger {
+  latched = new Set;
+  chunks = new Map;
+  pending = new Map;
+  claim(turnId) {
+    if (this.latched.has(turnId))
+      return false;
+    this.latched.add(turnId);
+    return true;
+  }
+  release(turnId) {
+    this.latched.delete(turnId);
+  }
+  markPending(turnId, index2) {
+    let set = this.pending.get(turnId);
+    if (set == null) {
+      set = new Set;
+      this.pending.set(turnId, set);
+    }
+    set.add(index2);
+  }
+  recordChunk(turnId, index2, messageIds) {
+    let m = this.chunks.get(turnId);
+    if (m == null) {
+      m = new Map;
+      this.chunks.set(turnId, m);
+    }
+    m.set(index2, messageIds.slice());
+    this.pending.get(turnId)?.delete(index2);
+  }
+  hasChunk(turnId, index2) {
+    return (this.chunks.get(turnId)?.get(index2)?.length ?? 0) > 0;
+  }
+  sentIds(turnId) {
+    const m = this.chunks.get(turnId);
+    if (m == null)
+      return [];
+    const out = [];
+    for (const index2 of Array.from(m.keys()).sort((a, b) => a - b)) {
+      out.push(...m.get(index2) ?? []);
+    }
+    return out;
+  }
+  entries(turnId) {
+    const m = this.chunks.get(turnId);
+    if (m == null)
+      return [];
+    return Array.from(m.keys()).sort((a, b) => a - b).map((index2) => ({ index: index2, messageIds: (m.get(index2) ?? []).slice() }));
+  }
+  unsentIndices(turnId, chunkCount) {
+    const out = [];
+    for (let i = 0;i < chunkCount; i++) {
+      if (!this.hasChunk(turnId, i))
+        out.push(i);
+    }
+    return out;
+  }
+  clear(turnId) {
+    this.latched.delete(turnId);
+    this.chunks.delete(turnId);
+    this.pending.delete(turnId);
+  }
+}
+function backstopReceiptIds(sentIds, cardMessageId) {
+  return sentIds.filter((id) => cardMessageId == null || id !== cardMessageId);
+}
+async function runBackstopDelivery(ledger, turnId, chunks, cardMessageId, deps, maxAttempts = 3) {
+  const stderr = deps.stderr ?? (() => {});
+  const chunkCount = chunks.length;
+  let attempts = 0;
+  for (let attempt = 1;attempt <= Math.max(1, maxAttempts); attempt++) {
+    attempts = attempt;
+    const resume = ledger.unsentIndices(turnId, chunkCount);
+    if (resume.length === 0)
+      break;
+    if (attempt > 1) {
+      stderr(`telegram gateway: backstop delivery retry ${attempt}/${maxAttempts} \u2014 ` + `resuming at unsent chunk(s) [${resume.join(", ")}] for turn ${turnId}
+`);
+    }
+    let attemptThrew = false;
+    try {
+      for (const i of resume) {
+        if (ledger.hasChunk(turnId, i))
+          continue;
+        ledger.markPending(turnId, i);
+        const ids = await deps.sendChunk(i, chunks[i]);
+        ledger.recordChunk(turnId, i, ids);
+      }
+    } catch (err) {
+      attemptThrew = true;
+      stderr(`telegram gateway: backstop delivery attempt ${attempt}/${maxAttempts} failed: ` + `${err instanceof Error ? err.message : String(err)}
+`);
+    }
+    if (!attemptThrew && ledger.unsentIndices(turnId, chunkCount).length === 0)
+      break;
+  }
+  const sentIds = ledger.sentIds(turnId);
+  const delivered = chunkCount > 0 && ledger.unsentIndices(turnId, chunkCount).length === 0 && backstopReceiptIds(sentIds, cardMessageId).length > 0;
+  const exhausted = !delivered;
+  if (deps.recordOutbound && sentIds.length > 0) {
+    const texts = [];
+    const ids = [];
+    for (const { index: index2, messageIds } of ledger.entries(turnId)) {
+      for (const id of messageIds) {
+        ids.push(id);
+        texts.push(chunks[index2] ?? "");
+      }
+    }
+    deps.recordOutbound(ids, texts);
+  }
+  return { sentIds, chunkCount, delivered, attempts, exhausted };
+}
+
 // gateway/inbound-delivery-confirm.ts
 function createDeliveryQueue() {
   return { pending: new Map };
@@ -84182,10 +84570,10 @@ function effectiveTurnAgeMs(markerAgeMs, turnStartedAt, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.18.28";
-var COMMIT_SHA = "ef0be9a2";
-var COMMIT_DATE = "2026-07-16T14:42:35+10:00";
-var LATEST_PR = 3274;
+var VERSION = "0.18.30";
+var COMMIT_SHA = "7729c674";
+var COMMIT_DATE = "2026-07-17T10:52:43+10:00";
+var LATEST_PR = 3293;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -86216,6 +86604,7 @@ var TOPIC_ID = process.env.TELEGRAM_TOPIC_ID ? Number(process.env.TELEGRAM_TOPIC
 var AGENT_ADMIN = process.env.SWITCHROOM_AGENT_ADMIN === "true";
 var bot = new import_grammy13.Bot(TOKEN);
 installTgPostLogger(bot);
+installUpdateTap(bot, (line) => process.stderr.write(line));
 var lastGetUpdatesHeartbeatMs = Date.now();
 bot.api.config.use(async (prev, method, payload, signal) => {
   try {
@@ -86743,6 +87132,73 @@ var deferredDoneReactions = new DeferredDoneReactions({
 });
 var outboundDedup = new OutboundDedupCache;
 var flushedTurnSupersede = new FlushedTurnSupersedeRegistry;
+var backstopDeliveryLedger = new BackstopDeliveryLedger;
+var BACKSTOP_DELIVERY_MAX_ATTEMPTS = (() => {
+  const raw = Number(process.env.SWITCHROOM_BACKSTOP_DELIVERY_MAX_ATTEMPTS);
+  return Number.isFinite(raw) && raw >= 1 ? Math.floor(raw) : 3;
+})();
+async function deliverAnswer(args) {
+  const { chatId, turnId } = args;
+  const rendered = addParagraphSpacers2(args.text);
+  const chunks = splitMarkdownChunks2(rendered, RICH_MESSAGE_MAX_CHARS2);
+  const deps = {
+    sendRich: (opts, body, tid) => robustApiCall(() => bot.api.sendRichMessage(chatId, body, opts), { threadId: tid, chat_id: chatId, priorityClass: "critical" }),
+    sendLiteral: (opts, txt, tid) => robustApiCall(() => bot.api.sendMessage(chatId, txt, opts), { threadId: tid, chat_id: chatId, priorityClass: "critical" }),
+    sendLiteralRaw: (opts, txt) => bot.api.sendMessage(chatId, txt, opts),
+    sendRichRaw: (opts, body) => bot.api.sendRichMessage(chatId, body, opts),
+    editPreview: (mid, body, opts, tid) => robustApiCall(() => bot.api.editMessageText(chatId, mid, body, opts), { threadId: tid, chat_id: chatId, priorityClass: "critical", messageId: mid, editPayload: body }),
+    richMessage: richMessage2,
+    logOutbound,
+    deleteStalePreview: async (id) => {
+      await swallowingApiCall(() => bot.api.deleteMessage(chatId, id), { chat_id: chatId, verb: "deliverAnswer.deleteStalePreview" });
+    },
+    stderr: (s) => {
+      process.stderr.write(s);
+    }
+  };
+  let liveThreadId = args.threadId;
+  const sendChunk = async (_chunkIndex, text5) => {
+    const chunkIds = [];
+    const res = await sendReplyChunks(deps, {
+      chatId,
+      chunks: [text5],
+      literalText: false,
+      suppressText: false,
+      threadId: liveThreadId,
+      previewMessageId: null,
+      sentIds: chunkIds,
+      buildSendOpts: (_i, _isLast, tid) => ({
+        ...tid != null ? { message_thread_id: tid } : {},
+        link_preview_options: { is_disabled: true }
+      }),
+      buildPreviewEditOpts: () => ({})
+    });
+    liveThreadId = res.threadId;
+    return chunkIds;
+  };
+  const result = await runBackstopDelivery(backstopDeliveryLedger, turnId, chunks, args.cardMessageId, {
+    sendChunk,
+    recordOutbound: HISTORY_ENABLED ? (messageIds, texts) => {
+      try {
+        recordOutbound({
+          chat_id: chatId,
+          thread_id: args.threadId ?? null,
+          message_ids: messageIds,
+          texts
+        });
+      } catch {}
+    } : undefined,
+    stderr: (s) => {
+      process.stderr.write(s);
+    }
+  }, BACKSTOP_DELIVERY_MAX_ATTEMPTS);
+  return {
+    sentIds: result.sentIds,
+    chunkCount: result.chunkCount,
+    delivered: result.delivered,
+    exhausted: result.exhausted
+  };
+}
 var chatAvailableReactions = new Map;
 var chatProbesInFlight = new Set;
 var activeTurnStartedAt = new Map;
@@ -87644,7 +88100,7 @@ function endCurrentTurnAtomic(turn, opts) {
     process.stderr.write(`telegram gateway: status-surface DEGRADED reason=${degraded.reason} turnId=${turn.turnId} chat=${turn.sessionChatId} thread=${turn.sessionThreadId ?? "-"} ${degraded.detail}
 `);
   }
-  if (OBLIGATION_LEDGER_ENABLED) {
+  if (OBLIGATION_LEDGER_ENABLED && opts?.deferObligationClose !== true) {
     if (decideObligationTurnEnd(turn.finalAnswerDelivered, turn.replyCalled) === "close") {
       obligationLedger.close(turn.turnId);
     } else {
@@ -87658,6 +88114,7 @@ function endCurrentTurnAtomic(turn, opts) {
   turn.narrativeGate?.teardown();
   purgeReactionTracking(statusKey(turn.sessionChatId, turn.sessionThreadId), turn);
   armNoReplyDrainTimer(turn);
+  flushPendingUserFailureNotices(turn.finalAnswerDelivered || turn.replyCalled);
   return turnEndedAt;
 }
 function maybeProactiveCompact() {
@@ -89103,7 +89560,12 @@ function emitGatewayOperatorEvent(event) {
   const opEventSupergroup = resolveAgentSupergroupChatId();
   process.stderr.write(`telegram gateway: operator-event posting agent=${agent} kind=${kind} to ${access.allowFrom.length} chat(s)` + (opEventTopic != null ? ` topic=${opEventTopic}` : "") + `
 `);
-  for (const chat_id of access.allowFrom) {
+  const { operatorChats, userNoticeChats } = decideOperatorEventAudience(kind, access.allowFrom, access.allowFrom[0]);
+  if (userNoticeChats.length > 0) {
+    process.stderr.write(`telegram gateway: operator-event operator-only routing agent=${agent} kind=${kind} operatorChats=${operatorChats.length} userNoticeChats=${userNoticeChats.length}
+`);
+  }
+  for (const chat_id of operatorChats) {
     const opEventThread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: opEventTopic, supergroupChatId: opEventSupergroup });
     const opts = {
       ...renderedKeyboard ? { reply_markup: renderedKeyboard } : {},
@@ -89123,6 +89585,38 @@ function emitGatewayOperatorEvent(event) {
 `);
     });
   }
+  if (userNoticeChats.length > 0) {
+    pendingUserNoticeGate.schedule({
+      chatIds: userNoticeChats,
+      text: renderUserFacingFailureNotice(),
+      agent,
+      kind,
+      atMs: Date.now()
+    });
+    process.stderr.write(`telegram gateway: operator-event user-notice deferred to turn-end agent=${agent} kind=${kind} chats=${userNoticeChats.length}
+`);
+  }
+}
+function flushPendingUserFailureNotices(turnDeliveredReply) {
+  const notices = pendingUserNoticeGate.resolveTurnEnd(turnDeliveredReply);
+  if (notices.length === 0)
+    return;
+  const noticeTopic = resolveAgentOutboundTopic({ kind: "compact-watchdog" });
+  const noticeSupergroup = resolveAgentSupergroupChatId();
+  for (const notice of notices) {
+    process.stderr.write(`telegram gateway: user-notice flush (turn died reply-less) agent=${notice.agent} kind=${notice.kind} chats=${notice.chatIds.length}
+`);
+    for (const chat_id of notice.chatIds) {
+      const thread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: noticeTopic, supergroupChatId: noticeSupergroup });
+      const opts = {
+        ...thread != null ? { message_thread_id: thread } : {}
+      };
+      bot.api.sendRichMessage(chat_id, richMessage2(notice.text), opts).catch((e) => {
+        process.stderr.write(`telegram gateway: user-notice send to ${chat_id} failed agent=${notice.agent} kind=${notice.kind}: ${e}
+`);
+      });
+    }
+  }
 }
 function postLegacyBanner(chatId, threadId, ackMessageId, ageSec, site) {
   const text5 = `\uD83C\uDF9B\uFE0F Switchroom restarted \u2014 ready. (took ~${ageSec}s)`;
@@ -89633,6 +90127,11 @@ function ensureIssuesCard(chatId, threadId) {
     }
     process.stderr.write(`telegram gateway: wrote PID file ${GATEWAY_PID_PATH} pid=${process.pid} startedAt=${GATEWAY_STARTED_AT_MS}
 `);
+    {
+      const carrierAgentDir = resolveAgentDirFromEnv();
+      if (carrierAgentDir != null)
+        consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir);
+    }
     runBootPinCleanupAndDmSweep();
   } catch (err) {
     process.stderr.write(`telegram gateway: boot.lock_acquire_failed err=${err.message} agent=${SWITCHROOM_AGENT_NAME}
@@ -89641,6 +90140,11 @@ function ensureIssuesCard(chatId, threadId) {
       writePidFile(GATEWAY_PID_PATH, { pid: process.pid, startedAtMs: GATEWAY_STARTED_AT_MS });
       process.stderr.write(`telegram gateway: wrote PID file ${GATEWAY_PID_PATH} pid=${process.pid} startedAt=${GATEWAY_STARTED_AT_MS} (mutex-fallback)
 `);
+      {
+        const carrierAgentDir = resolveAgentDirFromEnv();
+        if (carrierAgentDir != null)
+          consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir);
+      }
       runBootPinCleanupAndDmSweep();
     } catch (writeErr) {
       process.stderr.write(`telegram gateway: writePidFile failed: ${writeErr}
@@ -93156,7 +93660,7 @@ async function executeGetRecentMessages(args) {
   const rows = query({ chat_id, thread_id, limit, before_message_id });
   const summary = rows.map((r) => {
     const who = r.role === "user" ? r.user ?? "user" : "assistant";
-    const time = new Date(r.ts * 1000).toISOString();
+    const time = fmtLocalStamp2(r.ts * 1000, resolveEnvTimezone2());
     const attach = r.attachment_kind ? ` [${r.attachment_kind}]` : "";
     const replyCtx = r.reply_to_message_id != null ? ` \u21AA\uFE0F#${r.reply_to_message_id}${r.reply_to_text ? `:"${r.reply_to_text.slice(0, 60)}${r.reply_to_text.length > 60 ? "\u2026" : ""}"` : ""}` : "";
     const reactionTag = r.user_reaction ? ` [reaction: ${r.user_reaction}]` : "";
@@ -94288,16 +94792,15 @@ function handleSessionEvent(ev) {
           }
           turn.finalAnswerDelivered = true;
           turn.finalAnswerSubstantive = true;
-          if (capturedText.trim().length >= FLUSH_SUBSTANTIVE_MIN_CHARS) {
-            turn.answerDelivered = true;
-          }
+          turn.answerDelivered = true;
+          const backstopLatchClaimed = backstopDeliveryLedger.claim(turn.turnId);
           const cardTakeover = progressDriver?.takeOverCard({
             chatId: backstopChatId,
             threadId: backstopThreadId != null ? String(backstopThreadId) : undefined
           }) ?? { wasEmitted: false, turnKey: null };
           const backstopCardMessageId = cardTakeover.wasEmitted && cardTakeover.turnKey != null ? getPinnedProgressCardMessageId?.(cardTakeover.turnKey) ?? null : null;
           const backstopCardTurnKey = cardTakeover.turnKey;
-          const backstopTurnEndedAt = endCurrentTurnAtomic(turn, { deferRecord: true });
+          const backstopTurnEndedAt = endCurrentTurnAtomic(turn, { deferRecord: true, deferObligationClose: true });
           preambleSuppressor.dropNow();
           {
             const tKey = statusKey(chatId, threadId);
@@ -94316,80 +94819,47 @@ function handleSessionEvent(ev) {
 `);
                   if (backstopTurnEndedAt != null) {
                     turn.deliveryOutcome = "suppressed";
+                    if (OBLIGATION_LEDGER_ENABLED)
+                      obligationLedger.close(turn.turnId);
                     emitTurnRecord(turn, backstopTurnEndedAt);
                   }
                   return;
                 }
               } catch {}
             }
+            if (!backstopLatchClaimed) {
+              process.stderr.write(`telegram gateway: turn-flush skipped \u2014 turn ${turn.turnId} already claimed the delivery latch
+`);
+              return;
+            }
             process.stderr.write(`telegram gateway: turn-flush firing \u2014 ${capturedText.length} chars without reply tool (chat=${backstopChatId} cardMsgId=${backstopCardMessageId ?? "none"})
 `);
-            const sendOpts = {
-              ...backstopThreadId != null ? { message_thread_id: backstopThreadId } : {},
-              link_preview_options: { is_disabled: true }
-            };
-            const limit = RICH_MESSAGE_MAX_CHARS2;
-            let htmlChunks = [];
-            const sentIds = [];
-            let sendThrew = false;
+            let sentIds = [];
+            let chunkCount = 0;
+            let delivered = false;
             try {
-              const renderedText = addParagraphSpacers2(capturedText);
-              htmlChunks = splitMarkdownChunks2(renderedText, limit);
-              let firstSendUsedEdit = false;
-              let liveThreadId = backstopThreadId;
-              if (backstopCardMessageId != null && htmlChunks.length > 0) {
-                try {
-                  await robustApiCall(() => bot.api.editMessageText(backstopChatId, backstopCardMessageId, richMessage2(htmlChunks[0]), sendOpts), {
-                    chat_id: backstopChatId,
-                    verb: "turn-flush.editMessageText",
-                    ...liveThreadId != null ? { threadId: liveThreadId } : {}
-                  });
-                  sentIds.push(backstopCardMessageId);
-                  firstSendUsedEdit = true;
-                } catch (err) {
-                  process.stderr.write(`telegram gateway: turn-flush card-takeover edit failed: ${err.message} \u2014 falling back to sendMessage
-`);
-                  if (err instanceof Error && err.message === "THREAD_NOT_FOUND") {
-                    liveThreadId = undefined;
-                  }
-                }
-              }
-              const remainingChunks = firstSendUsedEdit ? htmlChunks.slice(1) : htmlChunks;
-              for (const c of remainingChunks) {
-                const sent = await retryWithThreadFallback2(robustApiCall, (tid) => {
-                  const opts = {
-                    link_preview_options: { is_disabled: true },
-                    ...tid != null ? { message_thread_id: tid } : {}
-                  };
-                  return bot.api.sendRichMessage(backstopChatId, richMessage2(c), opts);
-                }, {
-                  threadId: liveThreadId,
-                  chat_id: backstopChatId,
-                  verb: "turn-flush.sendMessage"
-                });
-                if (liveThreadId != null) {
-                  const sentMsg = sent;
-                  if (sentMsg.message_thread_id == null)
-                    liveThreadId = undefined;
-                }
-                sentIds.push(sent.message_id);
-              }
-              if (HISTORY_ENABLED && sentIds.length > 0) {
-                try {
-                  recordOutbound({
-                    chat_id: backstopChatId,
-                    thread_id: backstopThreadId ?? null,
-                    message_ids: sentIds,
-                    texts: htmlChunks
-                  });
-                } catch {}
-              }
+              const delivery = await deliverAnswer({
+                chatId: backstopChatId,
+                threadId: backstopThreadId,
+                text: capturedText,
+                turnId: turn.turnId,
+                cardMessageId: backstopCardMessageId
+              });
+              sentIds = delivery.sentIds;
+              chunkCount = delivery.chunkCount;
+              delivered = delivery.delivered;
               outboundDedup.record(backstopChatId, backstopThreadId, capturedText, Date.now(), currentTurn?.registryKey ?? null);
               if (sentIds.length > 0) {
                 flushedTurnSupersede.record(backstopChatId, backstopThreadId, { turnId: turn.turnId, messageIds: sentIds, text: capturedText }, Date.now());
               }
-              if (backstopCtrl)
+              if (!delivered) {
+                if (backstopCtrl)
+                  backstopCtrl.finalize("error");
+                backstopDeliveryLedger.release(turn.turnId);
+                turn.answerDelivered = false;
+              } else if (backstopCtrl) {
                 backstopCtrl.finalize("done");
+              }
               if (backstopCardTurnKey != null) {
                 completeProgressCardTurn?.({
                   chatId: backstopChatId,
@@ -94400,21 +94870,33 @@ function handleSessionEvent(ev) {
                 unpinProgressCardForChat?.(backstopChatId, backstopThreadId);
               }
             } catch (err) {
-              sendThrew = true;
-              process.stderr.write(`telegram gateway: turn-flush send failed: ${err.message}
+              process.stderr.write(`telegram gateway: turn-flush post-delivery bookkeeping failed: ${err.message}
 `);
-              turn.answerDelivered = false;
-              if (backstopCtrl)
-                backstopCtrl.finalize("error");
+              if (!delivered) {
+                turn.answerDelivered = false;
+                backstopDeliveryLedger.release(turn.turnId);
+                if (backstopCtrl)
+                  backstopCtrl.finalize("error");
+              }
             } finally {
               if (backstopTurnEndedAt != null) {
-                finalizeBackstopSend(turn, {
-                  threw: sendThrew,
-                  sentCount: sentIds.length,
-                  chunkCount: htmlChunks.length
+                finalizeBackstopSendGated(turn, {
+                  threw: !delivered,
+                  sentIds,
+                  chunkCount,
+                  cardMessageId: backstopCardMessageId
                 });
+                if (OBLIGATION_LEDGER_ENABLED) {
+                  if (delivered) {
+                    obligationLedger.close(turn.turnId);
+                  } else {
+                    turn.finalAnswerDelivered = false;
+                    obligationLedger.noteTurnEnded(turn.turnId, Date.now());
+                  }
+                }
                 emitTurnRecord(turn, backstopTurnEndedAt);
               }
+              backstopDeliveryLedger.clear(turn.turnId);
             }
           })();
           return;
@@ -95469,7 +95951,7 @@ ${preBlock(write.output)}`;
       ...msgId != null ? { message_id: String(msgId) } : {},
       user: displayUser,
       user_id: String(from.id),
-      ts: new Date((ctx.message?.date ?? 0) * 1000).toISOString(),
+      ts: fmtLocalStamp2((ctx.message?.date ?? 0) * 1000, resolveEnvTimezone2()),
       ...messageThreadId != null ? { message_thread_id: String(messageThreadId) } : {},
       ...originTurnId != null ? { origin_turn_id: originTurnId } : {},
       ...topicScope != null ? { topic_scope: topicScope } : {},
@@ -96256,9 +96738,10 @@ async function dispatchShortVerbViaHostd(ctx, req, label, legacyArgs) {
   await switchroomReply(ctx, `\u274C **${escapeHtmlForTg2(label)} failed via hostd** (result=${escapeHtmlForTg2(hostdResp.result)}):
 ` + preBlock(stripAnsi3(errBody)), { html: true });
 }
-async function runSwitchroomCommand(ctx, args, label, classification = "query") {
+async function runSwitchroomCommand(ctx, args, label, classification = "query", transformOutput) {
   try {
-    const output = stripAnsi3(switchroomExec(args));
+    const stripped = stripAnsi3(switchroomExec(args));
+    const output = transformOutput ? transformOutput(stripped) : stripped;
     const formatted = formatSwitchroomOutput(output);
     if (formatted) {
       await switchroomReply(ctx, preBlock(formatted), { html: true, classification });
@@ -96611,7 +97094,6 @@ function buildModelDeps(restartCtx) {
         return [];
       }
     },
-    select: (a, label) => selectModel(a, label),
     isBusy: () => currentTurn !== null,
     getAgentName: getMyAgentName,
     getQuotaBrief: async () => {
@@ -96630,14 +97112,12 @@ function buildModelDeps(restartCtx) {
       } catch {}
       return null;
     },
-    inject: injectSlashCommand,
     getConfiguredModel: () => {
       const data = switchroomExecJson(["agent", "list"]);
       return data?.agents?.find((a) => a.name === getMyAgentName())?.model ?? null;
     },
     escapeHtml: escapeHtmlForTg2,
     preBlock,
-    getActiveSessionModel: () => sessionModelSource.getOverride(),
     scheduleRestart: async (reason) => {
       const name = getMyAgentName();
       const existing = readRestartMarker();
@@ -96680,6 +97160,30 @@ function buildModelDeps(restartCtx) {
       const prevFileRaw = readSessionModelFileRaw(agentDir);
       writeSessionModelFile(agentDir, model, readConfiguredDefaultModel(agentDir) ?? resolveMainModel(deps.getConfiguredModel() ?? undefined));
       sessionModelSource.setOverride(model);
+      process.stderr.write(`telegram gateway: gw /model relaunch scheduled agent=${getMyAgentName()} token=${model} reason=${JSON.stringify(reason)}
+`);
+      clearPremiumRecoveryOnManualSwitch(model);
+      try {
+        await deps.scheduleRestart(reason);
+      } catch (err) {
+        if (err?.code !== "restart_in_flight") {
+          restoreSessionModelFileRaw(agentDir, prevFileRaw);
+          sessionModelSource.setOverride(prevOverride);
+        }
+        throw err;
+      }
+    },
+    scheduleModelDefaultRelaunch: async (reason) => {
+      const agentDir = resolveAgentDirFromEnv();
+      if (!agentDir)
+        throw new Error("agent dir unresolvable \u2014 cannot clear session-model file");
+      const prevOverride = sessionModelSource.getOverride();
+      const prevFileRaw = readSessionModelFileRaw(agentDir);
+      clearSessionModelFile(agentDir);
+      sessionModelSource.setOverride(null);
+      process.stderr.write(`telegram gateway: gw /model relaunch scheduled agent=${getMyAgentName()} token=(default) reason=${JSON.stringify(reason)}
+`);
+      clearPremiumRecoveryOnManualSwitch(null);
       try {
         await deps.scheduleRestart(reason);
       } catch (err) {
@@ -96704,60 +97208,6 @@ function modelMenuReplyMarkup(reply) {
   }
   return kb;
 }
-function recordTypedModelSwitch(reply, requestedModelArg, _deps) {
-  const requested = requestedModelArg != null ? expandSrAlias(requestedModelArg) : null;
-  if (requested?.toLowerCase() === "default") {
-    const smDir = resolveAgentDirFromEnv();
-    if (smDir)
-      clearSessionModelFile(smDir);
-    if (reply.selectedModel)
-      sessionModelSource.setOverride(null);
-    return "";
-  }
-  if (!reply.selectedModel)
-    return "";
-  sessionModelSource.setOverride(reply.selectedModel);
-  clearPremiumRecoveryOnManualSwitch(reply.selectedModel);
-  return "";
-}
-function recordModelMenuSideEffects(outcome, modelDeps, cbChatId, cbThreadId, prevSessionModel) {
-  if (outcome.selectedModel) {
-    sessionModelSource.setOverride(outcome.selectedModel);
-    clearPremiumRecoveryOnManualSwitch(outcome.selectedModel);
-  }
-  if (outcome.clearedDefault) {
-    const smDir = resolveAgentDirFromEnv();
-    if (smDir)
-      clearSessionModelFile(smDir);
-  }
-  if (outcome.selectedModel && isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)) {
-    const agentName3 = getMyAgentName();
-    const agentDir = resolveAgentDirFromEnv();
-    const token = outcome.selectedModelToken;
-    if (agentDir && token) {
-      try {
-        writeSessionModelFile(agentDir, token, readConfiguredDefaultModel(agentDir) ?? resolveMainModel(modelDeps.getConfiguredModel() ?? undefined));
-        sessionModelSource.setOverride(token);
-      } catch (e) {
-        process.stderr.write(`telegram gateway: sr-to-claude session-model write failed: ${e?.message ?? String(e)}
-`);
-      }
-    } else if (agentDir) {
-      clearSessionModelFile(agentDir);
-    }
-    writeRestartMarker({ chat_id: cbChatId, thread_id: cbThreadId ?? null, ack_message_id: null, ts: Date.now() });
-    stampUserRestartReason("user: sr-to-claude model switch (menu)");
-    if (turnInFlightForGate()) {
-      pendingRestarts.set(agentName3, Date.now());
-    } else {
-      sweepBeforeSelfRestart().finally(() => triggerSelfRestart(agentName3, "sr-to-claude-model-switch", 1500));
-    }
-    return {
-      restartNotice: `\uD83D\uDD04 Switching from **${escapeHtmlForTg2(prevSessionModel)}** back to Claude \u2014 restarting session cleanly. Claude will be ready in ~30s.`
-    };
-  }
-  return {};
-}
 async function editPendingCommandCard(chatId, messageId, text5) {
   try {
     await robustApiCall(() => lockedBot.api.editMessageText(chatId, messageId, richMessage2(hardenCardBreaks2(text5)), {
@@ -96779,14 +97229,11 @@ function enqueueSessionCommand(cmd) {
 async function applyQueuedModelCommand(cmd) {
   const deps = buildModelDeps({ chatId: cmd.chatId, threadId: cmd.threadId });
   if (cmd.origin === "menu") {
-    const prevSessionModel = sessionModelSource.getOverride();
     const outcome = await handleModelMenuCallback(cmd.arg, deps);
-    const { restartNotice } = recordModelMenuSideEffects(outcome, deps, cmd.chatId, cmd.threadId, prevSessionModel);
-    return restartNotice ?? outcome.reply.text;
+    return outcome.reply.text;
   }
   const reply = await handleModelCommand({ kind: "set", model: cmd.arg }, deps);
-  const warning = recordTypedModelSwitch(reply, cmd.arg, deps);
-  return reply.text + warning;
+  return reply.text;
 }
 async function applyQueuedEffortCommand(cmd) {
   const deps = buildEffortDeps();
@@ -96924,8 +97371,7 @@ bot.command("model", async (ctx) => {
     return;
   }
   const reply = await handleModelCommand(parsed, deps);
-  const persistWarning = recordTypedModelSwitch(reply, parsed.kind === "set" ? parsed.model : null, deps);
-  await switchroomReply(ctx, reply.text + persistWarning, { html: reply.html });
+  await switchroomReply(ctx, reply.text, { html: reply.html });
 });
 var sessionEffortOverride = null;
 function buildEffortDeps() {
@@ -98682,7 +99128,8 @@ bot.command("logs", async (ctx) => {
   }
   const lines = linesArg ? parseInt(linesArg, 10) : 20;
   const lineCount = isNaN(lines) || lines < 1 ? 20 : Math.min(lines, 200);
-  await runSwitchroomCommand(ctx, ["agent", "logs", name, "--lines", String(lineCount)], `logs ${name}`, "heavy");
+  const tz = resolveEnvTimezone2();
+  await runSwitchroomCommand(ctx, ["agent", "logs", name, "--lines", String(lineCount), "--timestamps"], `logs ${name}`, "heavy", (raw) => renderLogTimestampsLocal(raw, tz));
 });
 bot.command("memory", async (ctx) => {
   if (!isAuthorizedSender(ctx))
@@ -98979,31 +99426,10 @@ bot.on("callback_query:data", async (ctx) => {
     }
     const isPageNav = data === MODEL_CALLBACK_PAGE_EXTERNAL || data === MODEL_CALLBACK_PAGE_MAIN;
     await ctx.answerCallbackQuery({ text: isPageNav ? "Loading\u2026" : "Switching\u2026" }).catch(() => {});
-    if (data.startsWith(MODEL_CALLBACK_SR)) {
-      const srName = data.slice(MODEL_CALLBACK_SR.length);
-      const srLabel = escapeHtmlForTg2(srFriendlyLabel(srName));
-      if (!isValidModelArg(srName)) {
-        await ctx.editMessageText(richMessage2("\u274C Invalid model name"), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-        return;
-      }
-      await ctx.editMessageText(richMessage2(`\uD83D\uDD04 Switching session to **${srLabel}** \u2014 restarting (~30s). _Session-only; reverts to the configured default on the next restart._`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-      try {
-        await modelDeps.scheduleModelRelaunch(srName, `user: /model ${srName} (session-only relaunch, menu)`);
-      } catch (err) {
-        await ctx.editMessageText(richMessage2(`\u274C Could not switch to **${srLabel}**: ${escapeHtmlForTg2(err?.message ?? String(err))}`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-      }
-      return;
-    }
     try {
-      const prevSessionModel = sessionModelSource.getOverride();
       const outcome = await handleModelMenuCallback(data, modelDeps);
       if (outcome.toastOnly)
         return;
-      const { restartNotice } = recordModelMenuSideEffects(outcome, modelDeps, cbChatId, cbThreadId, prevSessionModel);
-      if (restartNotice) {
-        await ctx.editMessageText(richMessage2(restartNotice), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-        return;
-      }
       await ctx.editMessageText(richMessage2(outcome.reply.text), {
         reply_markup: modelMenuReplyMarkup(outcome.reply) ?? { inline_keyboard: [] }
       }).catch(() => {});
@@ -100099,6 +100525,7 @@ bot.on("message:pinned_message", async (ctx) => {
 `);
   }
 });
+installUnhandledMessageCatchAll(bot, (ctx, text5) => handleInboundCoalesced(ctx, text5, undefined), (line) => process.stderr.write(line));
 var reactionsCfg = null;
 var reactionHourCap = null;
 var reactionDebounce = null;
@@ -100708,6 +101135,8 @@ var didOneTimeSetup = false;
 `);
           }
         } catch {}
+        let modelSwitchMarkerChat = null;
+        let modelSwitchReason = null;
         try {
           const nowMs2 = Date.now();
           const marker = readRestartMarker();
@@ -100737,6 +101166,12 @@ var didOneTimeSetup = false;
             const ageSec = Math.max(1, Math.round(ageMs / 1000));
             process.stderr.write(`telegram gateway: boot: restart-marker present, chat_id=${marker.chat_id} age=${ageSec}s within5min=${ageMs < 300000}
 `);
+            if (ageMs < 300000) {
+              modelSwitchMarkerChat = { chatId: marker.chat_id, threadId: marker.thread_id };
+              if (typeof cleanMarker?.reason === "string" && cleanMarker.reason.startsWith("user: /model")) {
+                modelSwitchReason = cleanMarker.reason;
+              }
+            }
             clearRestartMarker();
           }
           if (!isRealRestart) {
@@ -100762,7 +101197,11 @@ var didOneTimeSetup = false;
                 firstSeenAt: new Date
               });
             }
-            if (target) {
+            const suppressBootCardForModelSwitch = modelSwitchReason != null && modelSwitchMarkerChat != null;
+            if (target && suppressBootCardForModelSwitch) {
+              process.stderr.write(`telegram gateway: boot: suppressing generic boot card \u2014 /model switch apply-boot (reason=${JSON.stringify(modelSwitchReason)}); the confirmation card replaces it
+`);
+            } else if (target) {
               const { chatId, threadId, ackMsgId } = target;
               const bootDedupe = shouldSkipDuplicateBootCard({ activeBootCard, bootCardPending }, "boot");
               if (bootDedupe.skip) {
@@ -100841,7 +101280,30 @@ var didOneTimeSetup = false;
                   const raw = d?.agents?.find((a) => a.name === getMyAgentName())?.model ?? null;
                   return resolveMainModel(raw ?? undefined);
                 })();
-                sessionModelSource.setOverride(launched.length > 0 && launched !== configured ? launched : null);
+                const isApplyBoot = launched.length > 0 && launched !== configured;
+                sessionModelSource.setOverride(isApplyBoot ? launched : null);
+                process.stderr.write(`telegram gateway: gw /model relaunch applied agent=${getMyAgentName()} launched=${launched || "(none)"} configured=${configured} override=${isApplyBoot ? "set" : "cleared"}
+`);
+                if (modelSwitchReason != null && modelSwitchMarkerChat) {
+                  const chat = modelSwitchMarkerChat;
+                  const confirmation = classifyModelSwitchConfirmation({
+                    reason: modelSwitchReason,
+                    launched,
+                    configured
+                  });
+                  const hasSessionModelAlert = existsSync50(join55(smAgentDir, ".session-model-alert"));
+                  if (confirmation.kind === "not-applied" && hasSessionModelAlert) {
+                    process.stderr.write(`telegram gateway: gw /model relaunch applied \u2014 suppressing not-applied confirmation (a .session-model-alert is present and will be relayed) agent=${getMyAgentName()} target=${confirmation.target}
+`);
+                  } else {
+                    const body = confirmation.kind === "applied" ? `\u2705 Now running \`${confirmation.launched}\` \u2014 session-only, reverts to the configured model on the next restart. Fresh session; memory and the handoff briefing carry the context.` : confirmation.kind === "not-applied" ? `\u26A0\uFE0F Your switch to \`${confirmation.target}\` didn't apply \u2014 the agent reverted to \`${confirmation.revertedTo}\` (the apply-boot didn't complete). Re-issue \`/model ${confirmation.target}\` to try again.` : `\u2705 Now running \`${confirmation.launched}\` (the configured default) \u2014 fresh session; memory and the handoff briefing carry the context.`;
+                    lockedBot.api.sendMessage(chat.chatId, body, {
+                      parse_mode: "Markdown",
+                      ...chat.threadId != null ? { message_thread_id: chat.threadId } : {}
+                    }).catch((err) => process.stderr.write(`telegram gateway: model-switch confirmation send failed: ${err?.message ?? String(err)}
+`));
+                  }
+                }
               } catch {}
             }
             const activeEffortPath = join55(smAgentDir, ".active-session-effort");