switchroom 0.18.29 → 0.18.31

package/telegram-plugin/dist/server.js

@@ -17019,6 +17019,81 @@ function truncateDetailPreservingRequestId(detail, max) {
   return `${detail.slice(0, headBudget)}${suffix}`;
 }
 
+// quota-check.ts
+var init_quota_check = () => {};
+
+// text-voice-scrub.ts
+var NULL = "\x00", FENCE_PH, INLINE_PH, HTML_CODE_PH, HTML_PRE_PH, URL_PH;
+var init_text_voice_scrub = __esm(() => {
+  FENCE_PH = `${NULL}VS_FENCE`;
+  INLINE_PH = `${NULL}VS_INLINE`;
+  HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+  HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+  URL_PH = `${NULL}VS_URL`;
+});
+
+// card-format.ts
+var init_card_format = __esm(() => {
+  init_format();
+  init_text_voice_scrub();
+});
+
+// model-unavailable.ts
+function isTransientUpstreamSignal(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  return transientUpstreamSignals.some((s) => lower.includes(s));
+}
+function isLitellmProxyLocal429(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  if (litellmProxyLocal429Signals.some((s) => lower.includes(s)))
+    return true;
+  return litellmV3LimiterSignalPair.every((s) => lower.includes(s));
+}
+function isLitellmProxyAuthMisconfig(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  if (lower.includes("x-api-key header is required"))
+    return true;
+  const isAuthErr = lower.includes("authentication_error") || lower.includes("authenticationerror");
+  if (!isAuthErr)
+    return false;
+  return lower.includes("fallback") && lower.includes("x-api-key");
+}
+var transientUpstreamSignals, litellmProxyLocal429Signals, litellmV3LimiterSignalPair;
+var init_model_unavailable = __esm(() => {
+  init_quota_check();
+  init_card_format();
+  transientUpstreamSignals = [
+    "not your usage limit",
+    "not your account",
+    "not your account's",
+    "temporarily limiting requests",
+    "temporarily rate",
+    "server is temporarily",
+    "would exceed your account\u2019s rate limit",
+    "would exceed your account's rate limit"
+  ];
+  litellmProxyLocal429Signals = [
+    "deployment over user-defined ratelimit",
+    "model rate limit exceeded. tpm limit",
+    "model rate limit exceeded. rpm limit",
+    "deployment over defined rpm limit",
+    "no deployments available for selected model",
+    "litellm rate limit handler",
+    "crossed tpm / rpm",
+    "max parallel request limit reached"
+  ];
+  litellmV3LimiterSignalPair = ["rate limit exceeded for ", "limit type:"];
+});
+
 // operator-events.ts
 function classifyClaudeError(raw) {
   try {
@@ -17036,6 +17111,12 @@ function classifyInner(raw) {
   const message = extractString(obj, "message") ?? extractString(getNestedObj(obj, "error"), "message") ?? (typeof raw === "string" ? raw : "") ?? "";
   const status = extractNumber(obj, "status") ?? extractNumber(obj, "statusCode") ?? extractNumber(obj, "status_code") ?? null;
   const sdkCode = extractString(obj, "error_code") ?? "";
+  if (isLitellmProxyAuthMisconfig(`${errorType}
+${errorCode}
+${sdkCode}
+${message}`)) {
+    return "proxy-misconfig";
+  }
   if (errorType === "authentication_error" || errorCode === "authentication_error" || sdkCode === "authentication_error" || message.toLowerCase().includes("authentication_error")) {
     const msg = message.toLowerCase();
     if (msg.includes("expired") || msg.includes("refresh")) {
@@ -17081,74 +17162,18 @@ function getNestedObj(obj, key) {
   const v = obj[key];
   return typeof v === "object" && v != null ? v : {};
 }
-var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS, cooldownMap;
+var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS, cooldownMap, OPERATOR_ACTIONABLE_KINDS;
 var init_operator_events = __esm(() => {
   init_format();
+  init_model_unavailable();
   DEFAULT_OPERATOR_EVENT_COOLDOWN_MS = 5 * 60000;
   cooldownMap = new Map;
-});
-
-// quota-check.ts
-var init_quota_check = () => {};
-
-// text-voice-scrub.ts
-var NULL = "\x00", FENCE_PH, INLINE_PH, HTML_CODE_PH, HTML_PRE_PH, URL_PH;
-var init_text_voice_scrub = __esm(() => {
-  FENCE_PH = `${NULL}VS_FENCE`;
-  INLINE_PH = `${NULL}VS_INLINE`;
-  HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
-  HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
-  URL_PH = `${NULL}VS_URL`;
-});
-
-// card-format.ts
-var init_card_format = __esm(() => {
-  init_format();
-  init_text_voice_scrub();
-});
-
-// model-unavailable.ts
-function isTransientUpstreamSignal(text) {
-  if (typeof text !== "string" || text.length === 0)
-    return false;
-  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
-  const lower = sample.toLowerCase();
-  return transientUpstreamSignals.some((s) => lower.includes(s));
-}
-function isLitellmProxyLocal429(text) {
-  if (typeof text !== "string" || text.length === 0)
-    return false;
-  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
-  const lower = sample.toLowerCase();
-  if (litellmProxyLocal429Signals.some((s) => lower.includes(s)))
-    return true;
-  return litellmV3LimiterSignalPair.every((s) => lower.includes(s));
-}
-var transientUpstreamSignals, litellmProxyLocal429Signals, litellmV3LimiterSignalPair;
-var init_model_unavailable = __esm(() => {
-  init_quota_check();
-  init_card_format();
-  transientUpstreamSignals = [
-    "not your usage limit",
-    "not your account",
-    "not your account's",
-    "temporarily limiting requests",
-    "temporarily rate",
-    "server is temporarily",
-    "would exceed your account\u2019s rate limit",
-    "would exceed your account's rate limit"
-  ];
-  litellmProxyLocal429Signals = [
-    "deployment over user-defined ratelimit",
-    "model rate limit exceeded. tpm limit",
-    "model rate limit exceeded. rpm limit",
-    "deployment over defined rpm limit",
-    "no deployments available for selected model",
-    "litellm rate limit handler",
-    "crossed tpm / rpm",
-    "max parallel request limit reached"
-  ];
-  litellmV3LimiterSignalPair = ["rate limit exceeded for ", "limit type:"];
+  OPERATOR_ACTIONABLE_KINDS = new Set([
+    "credentials-expired",
+    "credentials-invalid",
+    "credit-exhausted",
+    "proxy-misconfig"
+  ]);
 });
 
 // tool-label-sidecar.ts

package/telegram-plugin/gateway/gateway.ts

@@ -102,7 +102,11 @@ import {
   forwardOriginDateIso,
   type ForwardOriginInfo,
 } from './forward-origin.js'
-import { fmtLocalStamp, resolveEnvTimezone } from '../shared/local-time.js'
+import {
+  installUpdateTap,
+  installUnhandledMessageCatchAll,
+} from './unhandled-message.js'
+import { fmtLocalStamp, resolveEnvTimezone, renderLogTimestampsLocal } from '../shared/local-time.js'
 import { StatusReactionController } from '../status-reactions.js'
 import { DeferredDoneReactions } from '../reaction-defer.js'
 import { createWorkerActivityFeed, isWorkerActivityFeedEnabled } from '../worker-activity-feed.js'
@@ -324,9 +328,12 @@ import { autoClassifyMidTurnInbound } from './auto-classify-mid-turn.js'
 import {
   renderOperatorEvent,
   shouldEmitOperatorEvent,
+  decideOperatorEventAudience,
+  renderUserFacingFailureNotice,
   type OperatorEvent,
   type OperatorEventKind,
 } from '../operator-events.js'
+import { pendingUserNoticeGate } from '../pending-user-notice.js'
 import { recordOperatorEvent } from '../operator-events-history.js'
 import {
   parseLlmError,
@@ -472,6 +479,7 @@ import {
   resolveStaleAwareBusy,
   modelCommandReceiptLine,
   handleModelCommand,
+  classifyModelSwitchConfirmation,
   buildModelMenu,
   handleModelMenuCallback,
   isValidModelArg,
@@ -495,6 +503,7 @@ import {
   readSessionModelFileRaw,
   restoreSessionModelFileRaw,
   clearSessionModelFile,
+  consumeSessionModelCarrierOnHealthyBoot,
   readConfiguredDefaultModel,
   writeSessionEffortFile,
   clearSessionEffortFile,
@@ -1290,6 +1299,14 @@ const AGENT_ADMIN = process.env.SWITCHROOM_AGENT_ADMIN === 'true'
 const bot = new Bot(TOKEN)
 installTgPostLogger(bot)
 
+// ─── Diagnostic update tap (#3300) ────────────────────────────────────────
+// One compact line per received update, logged BEFORE any specific handler
+// runs, so a drop at the grammy-routing layer is always diagnosable from the
+// logs. Pass-through middleware — never consumes an update or alters routing.
+// Rate-limited inside installUpdateTap (per-minute cap + suppression summary
+// line so even a flood is never invisible).
+installUpdateTap(bot, line => process.stderr.write(line))
+
 // ─── getUpdates heartbeat ─────────────────────────────────────────────────
 // Tracks the last time getUpdates completed (success OR error). Used by
 // the poll health check as a secondary stall signal: if getMe succeeds but
@@ -2382,6 +2399,13 @@ async function deliverAnswer(args: {
   text: string
   turnId: string
   cardMessageId: number | null
+  /** S4 (fable red-team 2026-07-17) — the inbound message this turn answers
+   *  (`turn.sourceMessageId`). When present, the FIRST chunk is sent as a
+   *  native quote-reply so the flushed answer anchors to the user's question,
+   *  matching `executeReply`'s default. `allow_sending_without_reply` keeps
+   *  the send alive if the user deleted their message. Null for synthesized
+   *  turns (cron/handback) — those send bare, as before. */
+  replyToMessageId: number | null
 }): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean }> {
   const { chatId, turnId } = args
   // Inject visible blank-line spacers into `\n\n` gaps, then split — exactly as
@@ -2430,8 +2454,17 @@ async function deliverAnswer(args: {
   // landed message id(s) (a length-resplit chunk may land >1); throws on an
   // unrecoverable send failure so the retry orchestrator can resume.
   let liveThreadId = args.threadId
-  const sendChunk = async (_chunkIndex: number, text: string): Promise<number[]> => {
+  const sendChunk = async (chunkIndex: number, text: string): Promise<number[]> => {
     const chunkIds: number[] = []
+    // S4 — quote-anchor the FIRST chunk only (chunkIndex is the OVERALL chunk
+    // index across the retry orchestrator; each sendReplyChunks call here
+    // carries exactly one chunk, so the inner index is always 0). Mirrors
+    // executeReply's first-chunk-only default. The ledger resumes retries at
+    // the first UNSENT chunk, so chunk 0 keeps its anchor across retries.
+    const anchor =
+      chunkIndex === 0 && args.replyToMessageId != null
+        ? { reply_parameters: { message_id: args.replyToMessageId, allow_sending_without_reply: true } }
+        : {}
     const res = await sendReplyChunks(deps, {
       chatId,
       chunks: [text],
@@ -2441,6 +2474,7 @@ async function deliverAnswer(args: {
       previewMessageId: null,
       sentIds: chunkIds,
       buildSendOpts: (_i, _isLast, tid) => ({
+        ...anchor,
         ...(tid != null ? { message_thread_id: tid } : {}),
         link_preview_options: { is_disabled: true },
       }),
@@ -5341,6 +5375,13 @@ function endCurrentTurnAtomic(
   // wedging forever. No-op when this turn delivered, when nothing is
   // buffered, or when the serialize feature is off.
   armNoReplyDrainTimer(turn)
+  // #3293 finding 1 — resolve any deferred non-operator failure notice against
+  // this turn's outcome: replied → the turn recovered from the error line, the
+  // gate drops the notice; reply-less → the turn genuinely died, the notice is
+  // sent now. replyCalled covers the short-answer/#2624 shape where
+  // finalAnswerDelivered stays false despite an explicit reply. No-op when
+  // nothing is pending (the overwhelmingly common path).
+  flushPendingUserFailureNotices(turn.finalAnswerDelivered || turn.replyCalled)
   return turnEndedAt
 }
 
@@ -8544,7 +8585,24 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     `telegram gateway: operator-event posting agent=${agent} kind=${kind} to ${access.allowFrom.length} chat(s)` +
       (opEventTopic != null ? ` topic=${opEventTopic}` : '') + '\n',
   )
-  for (const chat_id of access.allowFrom) {
+  // Ken's deterministic error-surfacing policy: an OPERATOR-ACTIONABLE fault
+  // (credentials / credit / proxy-misconfig) must not reach non-operator users
+  // as a raw or misleading card they can't act on. Split the audience — the
+  // operator (allowlist head) gets the full card; every other allowlist chat
+  // gets, at most, a brief plain-language "it's on our side" notice. Non-
+  // actionable kinds keep their existing broadcast (all chats are operatorChats).
+  const { operatorChats, userNoticeChats } = decideOperatorEventAudience(
+    kind,
+    access.allowFrom,
+    access.allowFrom[0],
+  )
+  if (userNoticeChats.length > 0) {
+    process.stderr.write(
+      `telegram gateway: operator-event operator-only routing agent=${agent} kind=${kind} operatorChats=${operatorChats.length} userNoticeChats=${userNoticeChats.length}\n`,
+    )
+  }
+
+  for (const chat_id of operatorChats) {
     // The resolved topic is valid ONLY in the agent's supergroup — attaching
     // it to an operator DM recipient yields 400 "message thread not found" and
     // the event silently fails to deliver (the marko #2096 class). Guard it:
@@ -8581,6 +8639,63 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
         )
       })
   }
+
+  // Non-operator users: only the plain-language failure notice, and ONLY when
+  // the turn genuinely dies (userNoticeChats is empty for every non-actionable
+  // kind — see decideOperatorEventAudience). #3293 review finding 1: an error
+  // line is NOT proof of turn failure — the LiteLLM fallback can 401 while a
+  // retry / another deployment still serves the turn, and sending "couldn't
+  // complete that" for a turn that completed is a false failure report. So the
+  // notice is never sent here: it is SCHEDULED on the pendingUserNoticeGate and
+  // resolved at the turn-end funnel (endCurrentTurnAtomic) — dropped when the
+  // turn delivered a reply (recovered), sent when it ended reply-less (died).
+  // Un-resolved notices expire after PENDING_USER_NOTICE_TTL_MS (bias to
+  // silence over a false failure claim). Operator cards above stay immediate.
+  if (userNoticeChats.length > 0) {
+    pendingUserNoticeGate.schedule({
+      chatIds: userNoticeChats,
+      text: renderUserFacingFailureNotice(),
+      agent,
+      kind,
+      atMs: Date.now(),
+    })
+    process.stderr.write(
+      `telegram gateway: operator-event user-notice deferred to turn-end agent=${agent} kind=${kind} chats=${userNoticeChats.length}\n`,
+    )
+  }
+}
+
+/**
+ * Turn-end resolution of deferred user failure notices (#3293 finding 1).
+ * Called from `endCurrentTurnAtomic` — the ONE funnel every turn-end path
+ * passes through. `turnDeliveredReply` is `finalAnswerDelivered || replyCalled`
+ * (the model explicitly replied → the turn recovered → notices are dropped by
+ * the gate). Only a reply-less turn end flushes the pending notices to the
+ * non-operator chats, so the user notice fires IFF the turn genuinely died.
+ */
+function flushPendingUserFailureNotices(turnDeliveredReply: boolean): void {
+  const notices = pendingUserNoticeGate.resolveTurnEnd(turnDeliveredReply)
+  if (notices.length === 0) return
+  const noticeTopic = resolveAgentOutboundTopic({ kind: 'compact-watchdog' })
+  const noticeSupergroup = resolveAgentSupergroupChatId()
+  for (const notice of notices) {
+    process.stderr.write(
+      `telegram gateway: user-notice flush (turn died reply-less) agent=${notice.agent} kind=${notice.kind} chats=${notice.chatIds.length}\n`,
+    )
+    for (const chat_id of notice.chatIds) {
+      const thread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: noticeTopic, supergroupChatId: noticeSupergroup })
+      const opts = {
+        ...(thread != null ? { message_thread_id: thread } : {}),
+      }
+      // allow-raw-bot-api: deferred user-notice flush loop; topic-aware opts
+      void bot.api.sendRichMessage(chat_id, richMessage(notice.text), opts as never)
+        .catch(e => {
+          process.stderr.write(
+            `telegram gateway: user-notice send to ${chat_id} failed agent=${notice.agent} kind=${notice.kind}: ${e}\n`,
+          )
+        })
+    }
+  }
 }
 
 /**
@@ -9678,6 +9793,18 @@ function ensureIssuesCard(chatId: string, threadId: number | undefined): void {
     process.stderr.write(
       `telegram gateway: wrote PID file ${GATEWAY_PID_PATH} pid=${process.pid} startedAt=${GATEWAY_STARTED_AT_MS}\n`,
     )
+    // #3284 — this boot ACQUIRED the boot lock, so it is the surviving healthy
+    // session. Consume the session-model carrier now (delete the carrier + the
+    // bounded-retry attempt counter). start.sh no longer deletes the carrier
+    // before apply: an apply-boot that wedged before reaching this point leaves
+    // the carrier in place so the retry boot RE-APPLIES the intended model
+    // instead of silently reverting to the configured default (the marko/klanker
+    // boot.lock_stale_recovered_boot_mismatch revert). Best-effort, gated on
+    // lock ownership so a LOSING double-boot never clears the winner's carrier.
+    {
+      const carrierAgentDir = resolveAgentDirFromEnv()
+      if (carrierAgentDir != null) consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir)
+    }
     // We WON the startup mutex — this gateway is the sole live owner of the
     // shared per-agent status-pin store, so it's now safe to clean up orphaned
     // pins from a prior (dead) session. Gated here (not at import time) so a
@@ -9701,6 +9828,13 @@ function ensureIssuesCard(chatId: string, threadId: number | undefined): void {
       // probe + 409-retry loop is still the liveness guard on this path. A
       // successful writePidFile here means no live holder was detected, so
       // running orphan cleanup is consistent with the pre-mutex behaviour.
+      // #3284: same healthy-boot carrier consume as the mutex-acquired path —
+      // a successful writePidFile means no live holder was detected, so this is
+      // the surviving session.
+      {
+        const carrierAgentDir = resolveAgentDirFromEnv()
+        if (carrierAgentDir != null) consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir)
+      }
       // #3026: same sequenced cleanup + DM stale-pin sweep as the mutex path.
       void runBootPinCleanupAndDmSweep()
     } catch (writeErr) {
@@ -17980,6 +18114,16 @@ function handleSessionEvent(ev: SessionEvent): void {
       // — read `turn` once, don't re-read currentTurn after any await.
       const turn = currentTurn
       if (turn == null) return
+      // S2 fix (fable red-team 2026-07-17) — a thinking block means the model
+      // is still working, not quiescent. Without this, "prose → >1s thinking
+      // pause → trailing NO_REPLY" let the answer-ready quiescence timer fire
+      // mid-pause and deliver a turn the model was about to mark silent
+      // (#2053 in miniature). Re-arm (not just clear): `reset()` re-verifies
+      // via `decideTurnFlush` and pushes the debounce out by a fresh window,
+      // so the trailing sentinel gets to land before any fire; if no further
+      // text arrives, the flush still fires one window after the LAST
+      // thinking event — the fast path is deferred, never lost.
+      resetAnswerReadyFlushTimeout()
       const ctrl = activeStatusReactions.get(statusKey(turn.sessionChatId, turn.sessionThreadId))
       if (ctrl) ctrl.setThinking()
       return
@@ -19091,10 +19235,28 @@ function handleSessionEvent(ev: SessionEvent): void {
           await new Promise<void>(resolve => setTimeout(resolve, 500))
           if (HISTORY_ENABLED) {
             try {
-              const { getRecentOutboundCount } = await import('../history.js')
-              const recentCount = getRecentOutboundCount(backstopChatId, 2)
-              if (recentCount > 0) {
-                process.stderr.write(`telegram gateway: turn-flush suppressed — reply tool sent ${recentCount} message(s) within 2s\n`)
+              // S1 fix (fable red-team 2026-07-17) — the old predicate here,
+              // `getRecentOutboundCount(chatId, 2) > 0`, counted ANY assistant
+              // row in the WHOLE chat: a worker `progress_update`, a command
+              // ack / restart notice, or a reply in a DIFFERENT forum topic all
+              // suppressed the flush and (worse) CLOSED the obligation below —
+              // silently dropping the user's real answer. The scoped predicate
+              // (same thread, length ≥ min(answerLength, 200)) lives in
+              // `turn-flush-suppression.ts`; `hasOutboundDeliveredSince` is the
+              // durable oracle whose thread/length semantics history tests pin.
+              const { hasOutboundDeliveredSince } = await import('../history.js')
+              const { shouldSuppressTurnFlush } = await import('./turn-flush-suppression.js')
+              const suppress = shouldSuppressTurnFlush(
+                { hasSubstantiveOutbound: hasOutboundDeliveredSince },
+                {
+                  chatId: backstopChatId,
+                  threadId: backstopThreadId ?? null,
+                  answerLength: capturedText.length,
+                  nowMs: Date.now(),
+                },
+              )
+              if (suppress) {
+                process.stderr.write(`telegram gateway: turn-flush suppressed — a substantive same-thread outbound landed within 2s\n`)
                 // Do NOT finalize the status reaction here. As of #1713
                 // the reaction is only finalized by the `turn_end` IPC
                 // handler — mid-turn delivery proofs (local history,
@@ -19106,19 +19268,23 @@ function handleSessionEvent(ev: SessionEvent): void {
                 // here re-fired on an already-cleared key WITHOUT `endingTurn`,
                 // emitting an inconsistent shadow trace. Removed.
                 //
-                // PR B — the reply tool already delivered this turn's answer, so
-                // the flush was legitimately suppressed. Emit the deferred record
-                // as 'suppressed' (→ `complete`, since the reply path set
-                // finalAnswerDelivered). Not a failure.
+                // PR B — a substantive same-thread outbound just delivered this
+                // turn's answer, so the flush was legitimately suppressed. Emit
+                // the deferred record as 'suppressed'. Not a failure.
                 if (backstopTurnEndedAt != null) {
                   turn.deliveryOutcome = 'suppressed'
-                  // #3276 finding 1 — obligation close was DEFERRED out of
-                  // endCurrentTurnAtomic. The reply tool already delivered this
-                  // turn's answer (recentCount>0), so resolve it as satisfied
-                  // here (idempotent with the reply path's own close). Without
-                  // this the deferred obligation would linger OPEN and spuriously
-                  // re-present a turn that WAS answered.
-                  if (OBLIGATION_LEDGER_ENABLED) obligationLedger.close(turn.turnId)
+                  // S1 fix — do NOT close the obligation here. When the recent
+                  // outbound is genuinely this turn's answer (a raced reply /
+                  // stream materialization), the reply path closes its own
+                  // obligation idempotently; when the suppression is a false
+                  // positive (a long same-thread non-answer inside the 2s
+                  // window — the residual the scoped predicate can't
+                  // discriminate), closing here made the drop PERMANENT.
+                  // Leaving it open lets the obligation sweep arbitrate: it
+                  // stands down silently if a substantive outbound answered
+                  // the user, and re-presents otherwise. `noteTurnEnded` arms
+                  // the liveness floor exactly as the send-failed path does.
+                  if (OBLIGATION_LEDGER_ENABLED) obligationLedger.noteTurnEnded(turn.turnId, Date.now())
                   emitTurnRecord(turn, backstopTurnEndedAt)
                 }
                 return
@@ -19166,6 +19332,9 @@ function handleSessionEvent(ev: SessionEvent): void {
               text: capturedText,
               turnId: turn.turnId,
               cardMessageId: backstopCardMessageId,
+              // S4 — anchor the flushed answer to the inbound it answers
+              // (null for synthesized turns, which send bare as before).
+              replyToMessageId: turn.sourceMessageId,
             })
             sentIds = delivery.sentIds
             chunkCount = delivery.chunkCount
@@ -22890,9 +23059,14 @@ async function runSwitchroomCommand(
   // commands) preserve in-place reply behavior. /logs /audit
   // /upgradestatus /memory pass 'heavy' to route to admin alias.
   classification: 'query' | 'mutation' | 'heavy' = 'query',
+  // Optional DISPLAY-ONLY transform applied to the stripped command output
+  // before formatting (never mutates the underlying stored logs). /logs uses
+  // this to render leading UTC ISO docker-log timestamps in local am/pm.
+  transformOutput?: (raw: string) => string,
 ): Promise<void> {
   try {
-    const output = stripAnsi(switchroomExec(args))
+    const stripped = stripAnsi(switchroomExec(args))
+    const output = transformOutput ? transformOutput(stripped) : stripped
     const formatted = formatSwitchroomOutput(output)
     if (formatted) { await switchroomReply(ctx, preBlock(formatted), { html: true, classification }) }
     else { await switchroomReply(ctx, `${label}: done (no output)`, { classification }) }
@@ -26961,7 +27135,23 @@ bot.command('logs', async ctx => {
   const lines = linesArg ? parseInt(linesArg, 10) : 20
   const lineCount = isNaN(lines) || lines < 1 ? 20 : Math.min(lines, 200)
   // PR5 — heavy-output → admin alias in supergroup mode (CPO #4).
-  await runSwitchroomCommand(ctx, ['agent', 'logs', name, '--lines', String(lineCount)], `logs ${name}`, 'heavy')
+  // #tz-fix audit (MEDIUM gap 2): `--timestamps` makes docker prefix every
+  // line with its own UTC ISO-8601-Z stamp — the only deterministic per-line
+  // timestamp (raw app lines often carry no stamp, or a local-zone one that
+  // must NOT be re-shifted). We then render that stamp in local am/pm at
+  // DISPLAY time so `/logs` doesn't surface UTC (competing with the
+  // local-time hint). The zone is the GATEWAY/operator zone
+  // (resolveEnvTimezone of this process), not the target agent's zone —
+  // intended: /logs is an operator surface. Stored logs are untouched —
+  // the transform runs only on the text sent to chat.
+  const tz = resolveEnvTimezone()
+  await runSwitchroomCommand(
+    ctx,
+    ['agent', 'logs', name, '--lines', String(lineCount), '--timestamps'],
+    `logs ${name}`,
+    'heavy',
+    (raw) => renderLogTimestampsLocal(raw, tz),
+  )
 })
 
 bot.command('memory', async ctx => {
@@ -29292,6 +29482,34 @@ bot.on('message:pinned_message', async ctx => {
   }
 })
 
+// ─── Terminal catch-all for unhandled message content types (#3300) ───────
+//
+// MUST stay registered LAST among the `message`/`message:*` handlers.
+//
+// grammy's `bot.on('message:<type>')` is filtering middleware: internally
+// `on → filter(pred, handler) → branch(pred, handler, pass)`. When the filter
+// matches, grammy runs the leaf handler, which never calls `next()`, so the
+// chain STOPS — a specific `message:text`/`:photo`/… match above consumes the
+// update and this catch-all never sees it (specific handler always wins; no
+// "already handled" guard is needed, the ordering is the guarantee). When NO
+// specific `message:*` filter matches, grammy ^1.44 would otherwise SILENTLY
+// drop the update — no log, no ack, no history row (the zero-observability
+// failure class behind the 2026-07-16 dropped-message incident: message_id
+// 19090 allocated in the DM with no gateway trace at all). This handler
+// closes the class: every inbound `message` is either delivered as a turn or
+// explicitly logged (known-noise service messages → log-only, no turn — see
+// SERVICE_NOISE_KEYS), so nothing is silently dropped at this layer again.
+//
+// Access gating is NOT re-implemented here — routing through
+// handleInboundCoalesced (the exact path `message:text` uses) applies the
+// same gate()/allowFrom checks, and parseForwardOrigin runs inside it so
+// forwarded-message provenance is preserved.
+installUnhandledMessageCatchAll(
+  bot,
+  (ctx, text) => handleInboundCoalesced(ctx, text, undefined),
+  line => process.stderr.write(line),
+)
+
 // ─── Reaction-trigger runtime state (#1074) ──────────────────────────────
 //
 // Bot-message reactions in the configured allowlist trigger a synthetic
@@ -30737,20 +30955,49 @@ void (async () => {
                 // this is the single card the operator sees for the switch.
                 if (modelSwitchReason != null && modelSwitchMarkerChat) {
                   const chat = modelSwitchMarkerChat
-                  const body = isApplyBoot
-                    ? `✅ Now running \`${launched}\` — session-only, reverts to the configured model on the next restart. Fresh session; memory and the handoff briefing carry the context.`
-                    : `✅ Now running \`${launched || configured}\` (the configured default) — fresh session; memory and the handoff briefing carry the context.`
-                  // allow-raw-bot-api: one-shot boot confirmation, same shape as the session-model alert relay below
-                  void lockedBot.api
-                    .sendMessage(chat.chatId, body, {
-                      parse_mode: 'Markdown',
-                      ...(chat.threadId != null ? { message_thread_id: chat.threadId } : {}),
-                    })
-                    .catch((err: unknown) =>
-                      process.stderr.write(
-                        `telegram gateway: model-switch confirmation send failed: ${(err as Error)?.message ?? String(err)}\n`,
-                      ),
+                  // Derive the confirmation from the DETERMINISTIC post-boot
+                  // signals. A non-default switch that reverted to the configured
+                  // default (a wedged/consumed apply-boot — the silent-revert bug)
+                  // must WARN, not print a misleading green "✅ Now running
+                  // <default>" card. `applied` / `default` keep the honest green
+                  // card (N4: the default/revert case still confirms).
+                  const confirmation = classifyModelSwitchConfirmation({
+                    reason: modelSwitchReason,
+                    launched,
+                    configured,
+                  })
+                  // LOW-2 dedup: the config-default-changed / proxy-down revert
+                  // paths in start.sh write a TAILORED `.session-model-alert`
+                  // (relayed to operators below) that already explains why the
+                  // switch didn't apply and how to re-issue it. Suppress the
+                  // generic not-applied card when such an alert is present for
+                  // this boot so the operator isn't double-warned — the alert is
+                  // the more specific message. The not-applied card still fires
+                  // for the plain wedge/revert case (no alert on disk).
+                  const hasSessionModelAlert = existsSync(join(smAgentDir, '.session-model-alert'))
+                  if (confirmation.kind === 'not-applied' && hasSessionModelAlert) {
+                    process.stderr.write(
+                      `telegram gateway: gw /model relaunch applied — suppressing not-applied confirmation (a .session-model-alert is present and will be relayed) agent=${getMyAgentName()} target=${confirmation.target}\n`,
                     )
+                  } else {
+                    const body =
+                      confirmation.kind === 'applied'
+                        ? `✅ Now running \`${confirmation.launched}\` — session-only, reverts to the configured model on the next restart. Fresh session; memory and the handoff briefing carry the context.`
+                        : confirmation.kind === 'not-applied'
+                          ? `⚠️ Your switch to \`${confirmation.target}\` didn't apply — the agent reverted to \`${confirmation.revertedTo}\` (the apply-boot didn't complete). Re-issue \`/model ${confirmation.target}\` to try again.`
+                          : `✅ Now running \`${confirmation.launched}\` (the configured default) — fresh session; memory and the handoff briefing carry the context.`
+                    // allow-raw-bot-api: one-shot boot confirmation, same shape as the session-model alert relay below
+                    void lockedBot.api
+                      .sendMessage(chat.chatId, body, {
+                        parse_mode: 'Markdown',
+                        ...(chat.threadId != null ? { message_thread_id: chat.threadId } : {}),
+                      })
+                      .catch((err: unknown) =>
+                        process.stderr.write(
+                          `telegram gateway: model-switch confirmation send failed: ${(err as Error)?.message ?? String(err)}\n`,
+                        ),
+                      )
+                  }
                 }
               } catch { /* leave override as-is on a bad read */ }
             }