switchroom 0.18.29 → 0.18.30

package/telegram-plugin/dist/server.js

@@ -17019,6 +17019,81 @@ function truncateDetailPreservingRequestId(detail, max) {
   return `${detail.slice(0, headBudget)}${suffix}`;
 }
 
+// quota-check.ts
+var init_quota_check = () => {};
+
+// text-voice-scrub.ts
+var NULL = "\x00", FENCE_PH, INLINE_PH, HTML_CODE_PH, HTML_PRE_PH, URL_PH;
+var init_text_voice_scrub = __esm(() => {
+  FENCE_PH = `${NULL}VS_FENCE`;
+  INLINE_PH = `${NULL}VS_INLINE`;
+  HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+  HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+  URL_PH = `${NULL}VS_URL`;
+});
+
+// card-format.ts
+var init_card_format = __esm(() => {
+  init_format();
+  init_text_voice_scrub();
+});
+
+// model-unavailable.ts
+function isTransientUpstreamSignal(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  return transientUpstreamSignals.some((s) => lower.includes(s));
+}
+function isLitellmProxyLocal429(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  if (litellmProxyLocal429Signals.some((s) => lower.includes(s)))
+    return true;
+  return litellmV3LimiterSignalPair.every((s) => lower.includes(s));
+}
+function isLitellmProxyAuthMisconfig(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  if (lower.includes("x-api-key header is required"))
+    return true;
+  const isAuthErr = lower.includes("authentication_error") || lower.includes("authenticationerror");
+  if (!isAuthErr)
+    return false;
+  return lower.includes("fallback") && lower.includes("x-api-key");
+}
+var transientUpstreamSignals, litellmProxyLocal429Signals, litellmV3LimiterSignalPair;
+var init_model_unavailable = __esm(() => {
+  init_quota_check();
+  init_card_format();
+  transientUpstreamSignals = [
+    "not your usage limit",
+    "not your account",
+    "not your account's",
+    "temporarily limiting requests",
+    "temporarily rate",
+    "server is temporarily",
+    "would exceed your account\u2019s rate limit",
+    "would exceed your account's rate limit"
+  ];
+  litellmProxyLocal429Signals = [
+    "deployment over user-defined ratelimit",
+    "model rate limit exceeded. tpm limit",
+    "model rate limit exceeded. rpm limit",
+    "deployment over defined rpm limit",
+    "no deployments available for selected model",
+    "litellm rate limit handler",
+    "crossed tpm / rpm",
+    "max parallel request limit reached"
+  ];
+  litellmV3LimiterSignalPair = ["rate limit exceeded for ", "limit type:"];
+});
+
 // operator-events.ts
 function classifyClaudeError(raw) {
   try {
@@ -17036,6 +17111,12 @@ function classifyInner(raw) {
   const message = extractString(obj, "message") ?? extractString(getNestedObj(obj, "error"), "message") ?? (typeof raw === "string" ? raw : "") ?? "";
   const status = extractNumber(obj, "status") ?? extractNumber(obj, "statusCode") ?? extractNumber(obj, "status_code") ?? null;
   const sdkCode = extractString(obj, "error_code") ?? "";
+  if (isLitellmProxyAuthMisconfig(`${errorType}
+${errorCode}
+${sdkCode}
+${message}`)) {
+    return "proxy-misconfig";
+  }
   if (errorType === "authentication_error" || errorCode === "authentication_error" || sdkCode === "authentication_error" || message.toLowerCase().includes("authentication_error")) {
     const msg = message.toLowerCase();
     if (msg.includes("expired") || msg.includes("refresh")) {
@@ -17081,74 +17162,18 @@ function getNestedObj(obj, key) {
   const v = obj[key];
   return typeof v === "object" && v != null ? v : {};
 }
-var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS, cooldownMap;
+var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS, cooldownMap, OPERATOR_ACTIONABLE_KINDS;
 var init_operator_events = __esm(() => {
   init_format();
+  init_model_unavailable();
   DEFAULT_OPERATOR_EVENT_COOLDOWN_MS = 5 * 60000;
   cooldownMap = new Map;
-});
-
-// quota-check.ts
-var init_quota_check = () => {};
-
-// text-voice-scrub.ts
-var NULL = "\x00", FENCE_PH, INLINE_PH, HTML_CODE_PH, HTML_PRE_PH, URL_PH;
-var init_text_voice_scrub = __esm(() => {
-  FENCE_PH = `${NULL}VS_FENCE`;
-  INLINE_PH = `${NULL}VS_INLINE`;
-  HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
-  HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
-  URL_PH = `${NULL}VS_URL`;
-});
-
-// card-format.ts
-var init_card_format = __esm(() => {
-  init_format();
-  init_text_voice_scrub();
-});
-
-// model-unavailable.ts
-function isTransientUpstreamSignal(text) {
-  if (typeof text !== "string" || text.length === 0)
-    return false;
-  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
-  const lower = sample.toLowerCase();
-  return transientUpstreamSignals.some((s) => lower.includes(s));
-}
-function isLitellmProxyLocal429(text) {
-  if (typeof text !== "string" || text.length === 0)
-    return false;
-  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
-  const lower = sample.toLowerCase();
-  if (litellmProxyLocal429Signals.some((s) => lower.includes(s)))
-    return true;
-  return litellmV3LimiterSignalPair.every((s) => lower.includes(s));
-}
-var transientUpstreamSignals, litellmProxyLocal429Signals, litellmV3LimiterSignalPair;
-var init_model_unavailable = __esm(() => {
-  init_quota_check();
-  init_card_format();
-  transientUpstreamSignals = [
-    "not your usage limit",
-    "not your account",
-    "not your account's",
-    "temporarily limiting requests",
-    "temporarily rate",
-    "server is temporarily",
-    "would exceed your account\u2019s rate limit",
-    "would exceed your account's rate limit"
-  ];
-  litellmProxyLocal429Signals = [
-    "deployment over user-defined ratelimit",
-    "model rate limit exceeded. tpm limit",
-    "model rate limit exceeded. rpm limit",
-    "deployment over defined rpm limit",
-    "no deployments available for selected model",
-    "litellm rate limit handler",
-    "crossed tpm / rpm",
-    "max parallel request limit reached"
-  ];
-  litellmV3LimiterSignalPair = ["rate limit exceeded for ", "limit type:"];
+  OPERATOR_ACTIONABLE_KINDS = new Set([
+    "credentials-expired",
+    "credentials-invalid",
+    "credit-exhausted",
+    "proxy-misconfig"
+  ]);
 });
 
 // tool-label-sidecar.ts

package/telegram-plugin/gateway/gateway.ts

@@ -102,7 +102,11 @@ import {
   forwardOriginDateIso,
   type ForwardOriginInfo,
 } from './forward-origin.js'
-import { fmtLocalStamp, resolveEnvTimezone } from '../shared/local-time.js'
+import {
+  installUpdateTap,
+  installUnhandledMessageCatchAll,
+} from './unhandled-message.js'
+import { fmtLocalStamp, resolveEnvTimezone, renderLogTimestampsLocal } from '../shared/local-time.js'
 import { StatusReactionController } from '../status-reactions.js'
 import { DeferredDoneReactions } from '../reaction-defer.js'
 import { createWorkerActivityFeed, isWorkerActivityFeedEnabled } from '../worker-activity-feed.js'
@@ -324,9 +328,12 @@ import { autoClassifyMidTurnInbound } from './auto-classify-mid-turn.js'
 import {
   renderOperatorEvent,
   shouldEmitOperatorEvent,
+  decideOperatorEventAudience,
+  renderUserFacingFailureNotice,
   type OperatorEvent,
   type OperatorEventKind,
 } from '../operator-events.js'
+import { pendingUserNoticeGate } from '../pending-user-notice.js'
 import { recordOperatorEvent } from '../operator-events-history.js'
 import {
   parseLlmError,
@@ -472,6 +479,7 @@ import {
   resolveStaleAwareBusy,
   modelCommandReceiptLine,
   handleModelCommand,
+  classifyModelSwitchConfirmation,
   buildModelMenu,
   handleModelMenuCallback,
   isValidModelArg,
@@ -495,6 +503,7 @@ import {
   readSessionModelFileRaw,
   restoreSessionModelFileRaw,
   clearSessionModelFile,
+  consumeSessionModelCarrierOnHealthyBoot,
   readConfiguredDefaultModel,
   writeSessionEffortFile,
   clearSessionEffortFile,
@@ -1290,6 +1299,14 @@ const AGENT_ADMIN = process.env.SWITCHROOM_AGENT_ADMIN === 'true'
 const bot = new Bot(TOKEN)
 installTgPostLogger(bot)
 
+// ─── Diagnostic update tap (#3300) ────────────────────────────────────────
+// One compact line per received update, logged BEFORE any specific handler
+// runs, so a drop at the grammy-routing layer is always diagnosable from the
+// logs. Pass-through middleware — never consumes an update or alters routing.
+// Rate-limited inside installUpdateTap (per-minute cap + suppression summary
+// line so even a flood is never invisible).
+installUpdateTap(bot, line => process.stderr.write(line))
+
 // ─── getUpdates heartbeat ─────────────────────────────────────────────────
 // Tracks the last time getUpdates completed (success OR error). Used by
 // the poll health check as a secondary stall signal: if getMe succeeds but
@@ -5341,6 +5358,13 @@ function endCurrentTurnAtomic(
   // wedging forever. No-op when this turn delivered, when nothing is
   // buffered, or when the serialize feature is off.
   armNoReplyDrainTimer(turn)
+  // #3293 finding 1 — resolve any deferred non-operator failure notice against
+  // this turn's outcome: replied → the turn recovered from the error line, the
+  // gate drops the notice; reply-less → the turn genuinely died, the notice is
+  // sent now. replyCalled covers the short-answer/#2624 shape where
+  // finalAnswerDelivered stays false despite an explicit reply. No-op when
+  // nothing is pending (the overwhelmingly common path).
+  flushPendingUserFailureNotices(turn.finalAnswerDelivered || turn.replyCalled)
   return turnEndedAt
 }
 
@@ -8544,7 +8568,24 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     `telegram gateway: operator-event posting agent=${agent} kind=${kind} to ${access.allowFrom.length} chat(s)` +
       (opEventTopic != null ? ` topic=${opEventTopic}` : '') + '\n',
   )
-  for (const chat_id of access.allowFrom) {
+  // Ken's deterministic error-surfacing policy: an OPERATOR-ACTIONABLE fault
+  // (credentials / credit / proxy-misconfig) must not reach non-operator users
+  // as a raw or misleading card they can't act on. Split the audience — the
+  // operator (allowlist head) gets the full card; every other allowlist chat
+  // gets, at most, a brief plain-language "it's on our side" notice. Non-
+  // actionable kinds keep their existing broadcast (all chats are operatorChats).
+  const { operatorChats, userNoticeChats } = decideOperatorEventAudience(
+    kind,
+    access.allowFrom,
+    access.allowFrom[0],
+  )
+  if (userNoticeChats.length > 0) {
+    process.stderr.write(
+      `telegram gateway: operator-event operator-only routing agent=${agent} kind=${kind} operatorChats=${operatorChats.length} userNoticeChats=${userNoticeChats.length}\n`,
+    )
+  }
+
+  for (const chat_id of operatorChats) {
     // The resolved topic is valid ONLY in the agent's supergroup — attaching
     // it to an operator DM recipient yields 400 "message thread not found" and
     // the event silently fails to deliver (the marko #2096 class). Guard it:
@@ -8581,6 +8622,63 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
         )
       })
   }
+
+  // Non-operator users: only the plain-language failure notice, and ONLY when
+  // the turn genuinely dies (userNoticeChats is empty for every non-actionable
+  // kind — see decideOperatorEventAudience). #3293 review finding 1: an error
+  // line is NOT proof of turn failure — the LiteLLM fallback can 401 while a
+  // retry / another deployment still serves the turn, and sending "couldn't
+  // complete that" for a turn that completed is a false failure report. So the
+  // notice is never sent here: it is SCHEDULED on the pendingUserNoticeGate and
+  // resolved at the turn-end funnel (endCurrentTurnAtomic) — dropped when the
+  // turn delivered a reply (recovered), sent when it ended reply-less (died).
+  // Un-resolved notices expire after PENDING_USER_NOTICE_TTL_MS (bias to
+  // silence over a false failure claim). Operator cards above stay immediate.
+  if (userNoticeChats.length > 0) {
+    pendingUserNoticeGate.schedule({
+      chatIds: userNoticeChats,
+      text: renderUserFacingFailureNotice(),
+      agent,
+      kind,
+      atMs: Date.now(),
+    })
+    process.stderr.write(
+      `telegram gateway: operator-event user-notice deferred to turn-end agent=${agent} kind=${kind} chats=${userNoticeChats.length}\n`,
+    )
+  }
+}
+
+/**
+ * Turn-end resolution of deferred user failure notices (#3293 finding 1).
+ * Called from `endCurrentTurnAtomic` — the ONE funnel every turn-end path
+ * passes through. `turnDeliveredReply` is `finalAnswerDelivered || replyCalled`
+ * (the model explicitly replied → the turn recovered → notices are dropped by
+ * the gate). Only a reply-less turn end flushes the pending notices to the
+ * non-operator chats, so the user notice fires IFF the turn genuinely died.
+ */
+function flushPendingUserFailureNotices(turnDeliveredReply: boolean): void {
+  const notices = pendingUserNoticeGate.resolveTurnEnd(turnDeliveredReply)
+  if (notices.length === 0) return
+  const noticeTopic = resolveAgentOutboundTopic({ kind: 'compact-watchdog' })
+  const noticeSupergroup = resolveAgentSupergroupChatId()
+  for (const notice of notices) {
+    process.stderr.write(
+      `telegram gateway: user-notice flush (turn died reply-less) agent=${notice.agent} kind=${notice.kind} chats=${notice.chatIds.length}\n`,
+    )
+    for (const chat_id of notice.chatIds) {
+      const thread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: noticeTopic, supergroupChatId: noticeSupergroup })
+      const opts = {
+        ...(thread != null ? { message_thread_id: thread } : {}),
+      }
+      // allow-raw-bot-api: deferred user-notice flush loop; topic-aware opts
+      void bot.api.sendRichMessage(chat_id, richMessage(notice.text), opts as never)
+        .catch(e => {
+          process.stderr.write(
+            `telegram gateway: user-notice send to ${chat_id} failed agent=${notice.agent} kind=${notice.kind}: ${e}\n`,
+          )
+        })
+    }
+  }
 }
 
 /**
@@ -9678,6 +9776,18 @@ function ensureIssuesCard(chatId: string, threadId: number | undefined): void {
     process.stderr.write(
       `telegram gateway: wrote PID file ${GATEWAY_PID_PATH} pid=${process.pid} startedAt=${GATEWAY_STARTED_AT_MS}\n`,
     )
+    // #3284 — this boot ACQUIRED the boot lock, so it is the surviving healthy
+    // session. Consume the session-model carrier now (delete the carrier + the
+    // bounded-retry attempt counter). start.sh no longer deletes the carrier
+    // before apply: an apply-boot that wedged before reaching this point leaves
+    // the carrier in place so the retry boot RE-APPLIES the intended model
+    // instead of silently reverting to the configured default (the marko/klanker
+    // boot.lock_stale_recovered_boot_mismatch revert). Best-effort, gated on
+    // lock ownership so a LOSING double-boot never clears the winner's carrier.
+    {
+      const carrierAgentDir = resolveAgentDirFromEnv()
+      if (carrierAgentDir != null) consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir)
+    }
     // We WON the startup mutex — this gateway is the sole live owner of the
     // shared per-agent status-pin store, so it's now safe to clean up orphaned
     // pins from a prior (dead) session. Gated here (not at import time) so a
@@ -9701,6 +9811,13 @@ function ensureIssuesCard(chatId: string, threadId: number | undefined): void {
       // probe + 409-retry loop is still the liveness guard on this path. A
       // successful writePidFile here means no live holder was detected, so
       // running orphan cleanup is consistent with the pre-mutex behaviour.
+      // #3284: same healthy-boot carrier consume as the mutex-acquired path —
+      // a successful writePidFile means no live holder was detected, so this is
+      // the surviving session.
+      {
+        const carrierAgentDir = resolveAgentDirFromEnv()
+        if (carrierAgentDir != null) consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir)
+      }
       // #3026: same sequenced cleanup + DM stale-pin sweep as the mutex path.
       void runBootPinCleanupAndDmSweep()
     } catch (writeErr) {
@@ -22890,9 +23007,14 @@ async function runSwitchroomCommand(
   // commands) preserve in-place reply behavior. /logs /audit
   // /upgradestatus /memory pass 'heavy' to route to admin alias.
   classification: 'query' | 'mutation' | 'heavy' = 'query',
+  // Optional DISPLAY-ONLY transform applied to the stripped command output
+  // before formatting (never mutates the underlying stored logs). /logs uses
+  // this to render leading UTC ISO docker-log timestamps in local am/pm.
+  transformOutput?: (raw: string) => string,
 ): Promise<void> {
   try {
-    const output = stripAnsi(switchroomExec(args))
+    const stripped = stripAnsi(switchroomExec(args))
+    const output = transformOutput ? transformOutput(stripped) : stripped
     const formatted = formatSwitchroomOutput(output)
     if (formatted) { await switchroomReply(ctx, preBlock(formatted), { html: true, classification }) }
     else { await switchroomReply(ctx, `${label}: done (no output)`, { classification }) }
@@ -26961,7 +27083,23 @@ bot.command('logs', async ctx => {
   const lines = linesArg ? parseInt(linesArg, 10) : 20
   const lineCount = isNaN(lines) || lines < 1 ? 20 : Math.min(lines, 200)
   // PR5 — heavy-output → admin alias in supergroup mode (CPO #4).
-  await runSwitchroomCommand(ctx, ['agent', 'logs', name, '--lines', String(lineCount)], `logs ${name}`, 'heavy')
+  // #tz-fix audit (MEDIUM gap 2): `--timestamps` makes docker prefix every
+  // line with its own UTC ISO-8601-Z stamp — the only deterministic per-line
+  // timestamp (raw app lines often carry no stamp, or a local-zone one that
+  // must NOT be re-shifted). We then render that stamp in local am/pm at
+  // DISPLAY time so `/logs` doesn't surface UTC (competing with the
+  // local-time hint). The zone is the GATEWAY/operator zone
+  // (resolveEnvTimezone of this process), not the target agent's zone —
+  // intended: /logs is an operator surface. Stored logs are untouched —
+  // the transform runs only on the text sent to chat.
+  const tz = resolveEnvTimezone()
+  await runSwitchroomCommand(
+    ctx,
+    ['agent', 'logs', name, '--lines', String(lineCount), '--timestamps'],
+    `logs ${name}`,
+    'heavy',
+    (raw) => renderLogTimestampsLocal(raw, tz),
+  )
 })
 
 bot.command('memory', async ctx => {
@@ -29292,6 +29430,34 @@ bot.on('message:pinned_message', async ctx => {
   }
 })
 
+// ─── Terminal catch-all for unhandled message content types (#3300) ───────
+//
+// MUST stay registered LAST among the `message`/`message:*` handlers.
+//
+// grammy's `bot.on('message:<type>')` is filtering middleware: internally
+// `on → filter(pred, handler) → branch(pred, handler, pass)`. When the filter
+// matches, grammy runs the leaf handler, which never calls `next()`, so the
+// chain STOPS — a specific `message:text`/`:photo`/… match above consumes the
+// update and this catch-all never sees it (specific handler always wins; no
+// "already handled" guard is needed, the ordering is the guarantee). When NO
+// specific `message:*` filter matches, grammy ^1.44 would otherwise SILENTLY
+// drop the update — no log, no ack, no history row (the zero-observability
+// failure class behind the 2026-07-16 dropped-message incident: message_id
+// 19090 allocated in the DM with no gateway trace at all). This handler
+// closes the class: every inbound `message` is either delivered as a turn or
+// explicitly logged (known-noise service messages → log-only, no turn — see
+// SERVICE_NOISE_KEYS), so nothing is silently dropped at this layer again.
+//
+// Access gating is NOT re-implemented here — routing through
+// handleInboundCoalesced (the exact path `message:text` uses) applies the
+// same gate()/allowFrom checks, and parseForwardOrigin runs inside it so
+// forwarded-message provenance is preserved.
+installUnhandledMessageCatchAll(
+  bot,
+  (ctx, text) => handleInboundCoalesced(ctx, text, undefined),
+  line => process.stderr.write(line),
+)
+
 // ─── Reaction-trigger runtime state (#1074) ──────────────────────────────
 //
 // Bot-message reactions in the configured allowlist trigger a synthetic
@@ -30737,20 +30903,49 @@ void (async () => {
                 // this is the single card the operator sees for the switch.
                 if (modelSwitchReason != null && modelSwitchMarkerChat) {
                   const chat = modelSwitchMarkerChat
-                  const body = isApplyBoot
-                    ? `✅ Now running \`${launched}\` — session-only, reverts to the configured model on the next restart. Fresh session; memory and the handoff briefing carry the context.`
-                    : `✅ Now running \`${launched || configured}\` (the configured default) — fresh session; memory and the handoff briefing carry the context.`
-                  // allow-raw-bot-api: one-shot boot confirmation, same shape as the session-model alert relay below
-                  void lockedBot.api
-                    .sendMessage(chat.chatId, body, {
-                      parse_mode: 'Markdown',
-                      ...(chat.threadId != null ? { message_thread_id: chat.threadId } : {}),
-                    })
-                    .catch((err: unknown) =>
-                      process.stderr.write(
-                        `telegram gateway: model-switch confirmation send failed: ${(err as Error)?.message ?? String(err)}\n`,
-                      ),
+                  // Derive the confirmation from the DETERMINISTIC post-boot
+                  // signals. A non-default switch that reverted to the configured
+                  // default (a wedged/consumed apply-boot — the silent-revert bug)
+                  // must WARN, not print a misleading green "✅ Now running
+                  // <default>" card. `applied` / `default` keep the honest green
+                  // card (N4: the default/revert case still confirms).
+                  const confirmation = classifyModelSwitchConfirmation({
+                    reason: modelSwitchReason,
+                    launched,
+                    configured,
+                  })
+                  // LOW-2 dedup: the config-default-changed / proxy-down revert
+                  // paths in start.sh write a TAILORED `.session-model-alert`
+                  // (relayed to operators below) that already explains why the
+                  // switch didn't apply and how to re-issue it. Suppress the
+                  // generic not-applied card when such an alert is present for
+                  // this boot so the operator isn't double-warned — the alert is
+                  // the more specific message. The not-applied card still fires
+                  // for the plain wedge/revert case (no alert on disk).
+                  const hasSessionModelAlert = existsSync(join(smAgentDir, '.session-model-alert'))
+                  if (confirmation.kind === 'not-applied' && hasSessionModelAlert) {
+                    process.stderr.write(
+                      `telegram gateway: gw /model relaunch applied — suppressing not-applied confirmation (a .session-model-alert is present and will be relayed) agent=${getMyAgentName()} target=${confirmation.target}\n`,
                     )
+                  } else {
+                    const body =
+                      confirmation.kind === 'applied'
+                        ? `✅ Now running \`${confirmation.launched}\` — session-only, reverts to the configured model on the next restart. Fresh session; memory and the handoff briefing carry the context.`
+                        : confirmation.kind === 'not-applied'
+                          ? `⚠️ Your switch to \`${confirmation.target}\` didn't apply — the agent reverted to \`${confirmation.revertedTo}\` (the apply-boot didn't complete). Re-issue \`/model ${confirmation.target}\` to try again.`
+                          : `✅ Now running \`${confirmation.launched}\` (the configured default) — fresh session; memory and the handoff briefing carry the context.`
+                    // allow-raw-bot-api: one-shot boot confirmation, same shape as the session-model alert relay below
+                    void lockedBot.api
+                      .sendMessage(chat.chatId, body, {
+                        parse_mode: 'Markdown',
+                        ...(chat.threadId != null ? { message_thread_id: chat.threadId } : {}),
+                      })
+                      .catch((err: unknown) =>
+                        process.stderr.write(
+                          `telegram gateway: model-switch confirmation send failed: ${(err as Error)?.message ?? String(err)}\n`,
+                        ),
+                      )
+                  }
                 }
               } catch { /* leave override as-is on a bad read */ }
             }

package/telegram-plugin/gateway/model-command.ts

@@ -84,6 +84,110 @@ export function isClaudeModel(name: string): boolean {
   return lower.startsWith('claude-')
 }
 
+/**
+ * The outcome of a `/model` apply-boot, derived purely from the DETERMINISTIC
+ * post-boot signals (never optimistic):
+ *
+ *   - `reason`     — the clean-shutdown marker reason that keyed this boot as a
+ *                    `/model` apply-boot, e.g.
+ *                    `user: /model fable (session-only relaunch, menu)`.
+ *   - `launched`   — the contents of `.active-session-model`: the model start.sh
+ *                    actually passed to `claude --model` this boot.
+ *   - `configured` — the resolved configured default model.
+ *
+ * Three outcomes:
+ *   - `applied`      — the launched model differs from the configured default, so
+ *                      the switch landed (a session-only override).
+ *   - `default`      — the operator asked for the configured default (`/model
+ *                      default`, or `/model <configured>`) and got it.
+ *   - `not-applied`  — the operator asked for a NON-default model, but the boot
+ *                      came back on the configured default: the switch SILENTLY
+ *                      failed to apply. The consume-once carrier was consumed by a
+ *                      boot that never launched the target (e.g. a wedged apply-boot
+ *                      that hit boot.lock_stale_recovered_boot_mismatch and reverted
+ *                      to the default). This is the case that previously emitted a
+ *                      MISLEADING green "✅ Now running <default> (the configured
+ *                      default)" card with no signal that the requested switch was
+ *                      lost. It self-corrects across boots: a later boot that
+ *                      genuinely launches the target reports `applied`.
+ */
+export type ModelSwitchConfirmation =
+  | { kind: 'applied'; launched: string }
+  | { kind: 'default'; launched: string }
+  | { kind: 'not-applied'; target: string; revertedTo: string }
+
+/**
+ * Extract the requested `/model <target>` token from a clean-shutdown reason
+ * (e.g. `user: /model fable (session-only relaunch, menu)` → `fable`). Returns
+ * null when the reason carries no `/model <token>` (a non-switch reason).
+ */
+export function parseModelSwitchTarget(reason: string): string | null {
+  const m = reason.match(/\/model\s+(\S+)/)
+  return m ? m[1] : null
+}
+
+/**
+ * Reduce a model token to a comparable FAMILY key so an alias and its resolved
+ * full id compare equal (`sonnet` ≡ `claude-sonnet-5` ≡ `claude-sonnet-5-<date>`).
+ *
+ * This is the normalization the silent-revert classifier needs: `target` from
+ * the clean-shutdown reason is the RAW user token (an alias like `sonnet`),
+ * while `.active-session-model` / the configured default may be the RESOLVED
+ * full id start.sh wrote on a revert-with-alert path (config-default-changed at
+ * start.sh.hbs:1228, proxy-down at :1234). A naive string compare would flag
+ * `/model sonnet` on a `claude-sonnet-5`-default agent as "didn't apply" even
+ * though sonnet IS the default.
+ *
+ * NB `resolveMainModel` (scaffold.ts:1358) is NOT sufficient here — it only
+ * remaps the `default` alias / unset to the switchroom default; it passes
+ * `sonnet`/`opus`/etc. through unchanged. The alias↔full-id equivalence is a
+ * FAMILY reduction (same rule model-label.ts uses one-way), done here:
+ *   - `claude-<family>-…` → `<family>`  (e.g. `claude-sonnet-5` → `sonnet`)
+ *   - a bare alias / any other token     → itself, lowercased (`sonnet`, `sr-glm-5`)
+ * sr-* ids never carry a `claude-` prefix, so they stay verbatim — correct,
+ * since the reason token and `.active-session-model` both hold the same
+ * already-expanded sr-* id and compare equal directly.
+ */
+export function modelFamilyToken(token: string): string {
+  const t = token.trim().toLowerCase()
+  if (t.startsWith('claude-')) {
+    const family = t.slice('claude-'.length).split('-').filter((p) => p.length > 0)[0]
+    return family ?? t
+  }
+  return t
+}
+
+/**
+ * Classify a `/model` apply-boot outcome from the post-boot signals. Pure so the
+ * confirmation-card decision is unit-testable without booting the gateway. The
+ * `not-applied` branch is the fix for the silent-revert bug: a non-default switch
+ * that reverted to the configured default must warn, not print a green ✅.
+ */
+export function classifyModelSwitchConfirmation(input: {
+  reason: string
+  launched: string
+  configured: string
+}): ModelSwitchConfirmation {
+  const { reason, launched, configured } = input
+  const isApplyBoot = launched.length > 0 && launched !== configured
+  if (isApplyBoot) return { kind: 'applied', launched }
+  // launched === configured (or empty): either an intended default/revert, or a
+  // NON-default switch that silently reverted to the configured default.
+  const target = parseModelSwitchTarget(reason)
+  const revertedTo = launched.length > 0 ? launched : configured
+  // Family-normalize both sides so an alias target (`sonnet`) matches its
+  // resolved full-id revert (`claude-sonnet-5`) — otherwise a `/model sonnet`
+  // that reverted to the sonnet default would emit a WRONG "didn't apply" card.
+  if (
+    target != null &&
+    target.toLowerCase() !== 'default' &&
+    modelFamilyToken(target) !== modelFamilyToken(revertedTo)
+  ) {
+    return { kind: 'not-applied', target, revertedTo }
+  }
+  return { kind: 'default', launched: revertedTo }
+}
+
 export type ParsedModelCommand =
   | { kind: 'show' }
   | { kind: 'set'; model: string }