switchroom 0.18.3 → 0.18.7

package/dist/host-control/main.js

@@ -21495,6 +21495,7 @@ var SessionContinuitySchema = exports_external.object({
   max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
   resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+  boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart — a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart — but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
   session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
   session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
 }).optional();
@@ -21959,7 +21960,8 @@ var CronConfigSchema = exports_external.object({
 var UserSchema = exports_external.object({
   name: exports_external.string().optional().describe("Display name for the user."),
   telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-  profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+  profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+  person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
 });
 var SwitchroomConfigSchema = exports_external.object({
   switchroom: exports_external.object({
@@ -28736,7 +28738,7 @@ import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:f
 import { dirname as dirname4, join as join6 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.3";
+var VERSION = "0.18.7";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/dist/vault/approvals/kernel-server.js

@@ -4212,6 +4212,7 @@ var init_schema = __esm(() => {
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart — a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart — but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
     session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
     session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();
@@ -4676,7 +4677,8 @@ var init_schema = __esm(() => {
   UserSchema = exports_external.object({
     name: exports_external.string().optional().describe("Display name for the user."),
     telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+    person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({

package/dist/vault/broker/server.js

@@ -4212,6 +4212,7 @@ var init_schema = __esm(() => {
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart — a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart — but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
     session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
     session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();
@@ -4676,7 +4677,8 @@ var init_schema = __esm(() => {
   UserSchema = exports_external.object({
     name: exports_external.string().optional().describe("Display name for the user."),
     telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+    person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({
@@ -19569,7 +19571,7 @@ function allocateAgentUid(name) {
 var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 
 // src/vault/broker/server.ts
-import { dirname as dirname4, resolve as resolve8, basename as basename4 } from "node:path";
+import { dirname as dirname5, resolve as resolve8, basename as basename4 } from "node:path";
 import * as os3 from "node:os";
 import * as path3 from "node:path";
 
@@ -19957,10 +19959,38 @@ function rotateAuditLog(logPath, maxFiles) {
       return;
     }
   }
+  const snapshotPath = `${logPath}.1`;
   try {
-    fs.renameSync(logPath, `${logPath}.1`);
+    fs.copyFileSync(logPath, snapshotPath);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not rotate active audit log ${logPath}: ${err.message}
+    process.stderr.write(`[vault-audit] ERROR: could not snapshot active audit log ${logPath} → ${snapshotPath}: ${err.message}
+`);
+    return;
+  }
+  try {
+    const fd = fs.openSync(snapshotPath, "r");
+    try {
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+  } catch (err) {
+    process.stderr.write(`[vault-audit] ERROR: could not fsync audit snapshot ${snapshotPath}; leaving active log intact to avoid data loss: ${err.message}
+`);
+    return;
+  }
+  try {
+    const dirFd = fs.openSync(path.dirname(snapshotPath), "r");
+    try {
+      fs.fsyncSync(dirFd);
+    } finally {
+      fs.closeSync(dirFd);
+    }
+  } catch {}
+  try {
+    fs.truncateSync(logPath, 0);
+  } catch (err) {
+    process.stderr.write(`[vault-audit] ERROR: could not truncate active audit log ${logPath}: ${err.message}
 `);
   }
 }
@@ -22369,7 +22399,7 @@ class VaultBroker {
       this.passphrase = this.testOpts._testPassphrase;
     }
     process.umask(63);
-    const parentDir = dirname4(this.socketPath);
+    const parentDir = dirname5(this.socketPath);
     mkdirSync6(parentDir, { recursive: true, mode: 448 });
     try {
       chmodSync4(parentDir, 448);
@@ -23850,15 +23880,15 @@ class VaultBroker {
   }
 }
 function detectVaultLayoutDrift(vaultPath) {
-  const dir = dirname4(vaultPath);
+  const dir = dirname5(vaultPath);
   if (basename4(dir) !== "vault")
     return;
   if (basename4(vaultPath) !== "vault.enc")
     return;
-  const switchroomDir = dirname4(dir);
+  const switchroomDir = dirname5(dir);
   if (basename4(switchroomDir) !== ".switchroom")
     return;
-  const home2 = dirname4(switchroomDir);
+  const home2 = dirname5(switchroomDir);
   const result = inspectVaultLayout(home2);
   if (result.kind === "divergent") {
     throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.3",
+  "version": "0.18.7",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -24,9 +24,9 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
     "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
     "lint:tsc": "tsc --noEmit",

package/profiles/_base/cron-session.sh.hbs

@@ -87,36 +87,75 @@ CRON_APPEND_PROMPT="You are the cheap background cron worker for {{name}}. You r
 # claude's project key matches the pre-seeded trust state (.claude-cron).
 cd "{{agentDir}}" || exit 1
 
-# LiteLLM routing for the cron session — mirrors start.sh's boot block.
+# LiteLLM routing for the cron session — ports start.sh's boot contract.
 # IMPORTANT: the vault key is provisioned under the BASE agent name ({{name}}),
 # NOT the cron identity ({{name}}-cron). Use the Handlebars template var so the
-# lookup is a compile-time literal — no fragile runtime suffix-stripping.
-# Attribution headers carry $SWITCHROOM_AGENT_NAME (= {{name}}-cron) so LiteLLM
-# can distinguish cron spend from main-session spend per agent.
-# FAIL-OPEN: missing key OR unreachable proxy → strip routing env, fall back to
-# direct OAuth. An outage must never take the cron session dark.
+# lookup is a compile-time literal — no fragile runtime suffix-stripping. The
+# attribution headers use the SAME compile-time-literal form ({{name}}-cron,
+# identical to $SWITCHROOM_AGENT_NAME here — line 69 exports it) so this block
+# refers to the agent one consistent way instead of mixing a template literal
+# for the key with a runtime env var for the tags. Cron spend is attributed to
+# {{name}}-cron so LiteLLM distinguishes it from main-session spend per agent.
+#
+# Two boot failure modes, handled DIFFERENTLY (ported 2026-07 from start.sh so
+# cron no longer fails OPEN on a transient blip and silently runs UNTRACKED
+# direct OAuth for the fire — the product invariant is all model traffic stays
+# proxy-routed for cost/token tracking):
+#   - MISSING KEY → fail-open: strip routing, fall back to direct OAuth, LOUD
+#     log. Without a key there is no metered route to reach — correct here.
+#   - PROXY UNREACHABLE with key in hand → do NOT strip. Keep routing pointed at
+#     the proxy AND export the auth header so the session authenticates the
+#     moment the proxy recovers (the socat forwarder reconnects per-connection),
+#     LOUD log. Never a silent untracked direct-OAuth fallback.
+# Retry budget is DELIBERATELY short — 3 attempts, worst-case ~25s (3×5s curl
+# timeouts + 2×5s sleeps) — vs start.sh's 120s: a cron fire is
+# latency-sensitive and short-lived, and unreachable now KEEPS routing anyway,
+# so a long boot-probe would only add dead latency for no gain.
 if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; then
   sr_ll_key="$(switchroom vault get "litellm/{{name}}/api-key" 2>/dev/null || true)"
   sr_ll_ok=""
+  sr_ll_unreachable=""
   if [ -z "$sr_ll_key" ]; then
-    echo "litellm: no virtual key for cron '{{name}}' — falling back to direct OAuth (no tracking/guardrail)" >&2
-  elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ] \
-       && ! curl -fsS -m 5 -o /dev/null "${SWITCHROOM_LITELLM_BASE:-${ANTHROPIC_BASE_URL%/anthropic}}/health/liveliness" 2>/dev/null; then
-    echo "litellm: proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} — falling back to direct OAuth (no tracking/guardrail this session)" >&2
+    echo "litellm(cron): no virtual key for '{{name}}' — falling back to direct OAuth (untracked, unguarded)" >&2
+  elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
+    # Bounded retry probe — short budget for cron latency (3 attempts,
+    # worst-case ~25s: 3×5s curl timeouts + 2×5s sleeps).
+    sr_ll_url="${SWITCHROOM_LITELLM_BASE:-${ANTHROPIC_BASE_URL%/anthropic}}/health/liveliness"
+    sr_ll_try=0
+    sr_ll_up=""
+    while :; do
+      if curl -fsS -m 5 -o /dev/null "$sr_ll_url" 2>/dev/null; then sr_ll_up="1"; break; fi
+      sr_ll_try=$(( sr_ll_try + 1 ))
+      [ "$sr_ll_try" -ge 3 ] && break
+      sleep 5
+    done
+    if [ -z "$sr_ll_up" ]; then
+      # Proxy unreachable but the key is present. Do NOT strip: keep routing so
+      # the cron session self-heals once the proxy is back.
+      sr_ll_unreachable="1"
+      echo "litellm(cron): proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 3 retries — routing LEFT IN PLACE so it self-heals; NOT falling back to untracked direct Anthropic OAuth." >&2
+    else
+      sr_ll_ok="1"
+    fi
+    unset sr_ll_url sr_ll_try sr_ll_up
   else
     sr_ll_ok="1"
   fi
-  if [ -n "$sr_ll_ok" ]; then
+  if [ -n "$sr_ll_ok" ] || [ -n "$sr_ll_unreachable" ]; then
+    # Key fetched successfully — export the auth header REGARDLESS of the probe
+    # outcome so the virtual key reaches the process env. On unreachable this is
+    # what lets the session authenticate the moment the proxy recovers instead
+    # of 401-ing (the same self-heal fix as start.sh's inner/outer blocks).
     export ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: Bearer $sr_ll_key
-x-litellm-customer-id: $SWITCHROOM_AGENT_NAME
-x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:-default}"
+x-litellm-customer-id: {{name}}-cron
+x-litellm-tags: agent:{{name}}-cron,profile:${SWITCHROOM_AGENT_PROFILE:-default}"
     export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
   else
-    # Fail-open: drop every routing var so the claude CLI talks to Anthropic
-    # directly on its OAuth credential (subscription path), unproxied.
+    # Missing-key fail-open: drop every routing var so the claude CLI talks to
+    # Anthropic directly on its OAuth credential (subscription path), unproxied.
     unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM SWITCHROOM_LITELLM_BASE
   fi
-  unset sr_ll_key sr_ll_ok
+  unset sr_ll_key sr_ll_ok sr_ll_unreachable
 fi
 
 # Create the cron tmux session DETACHED (-d), not in attach mode. This is a

package/profiles/_base/start.sh.hbs

@@ -46,6 +46,17 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # compose env and the inner-pass export. Pinned by the scaffold-order test.
   export SWITCHROOM_AGENT_NAME="{{name}}"
 
+  # Boot-resume policy (session_continuity.boot_resume; default 'in-flight').
+  # The gateway's boot-resume block reads SWITCHROOM_BOOT_RESUME to decide
+  # whether a genuinely in-flight turn is auto-resumed across a deliberate
+  # restart ('in-flight' — default), always ('always'), or downgraded to a
+  # passive notice ('never'). MUST be exported here, before the gateway fork
+  # below, or the daemon never sees it and every agent defaults silently — same
+  # start.sh env-fork landmine as the channels.telegram knobs. The later
+  # SWITCHROOM_RESUME_MODE block is set AFTER the fork (it drives the inner
+  # `claude` --continue path, not the gateway), so this needs its own hoist.
+  export SWITCHROOM_BOOT_RESUME="{{#if bootResumeMode}}{{{bootResumeMode}}}{{else}}in-flight{{/if}}"
+
   # Gateway-consumed env MUST be exported HERE, before the gateway fork
   # below. The gateway daemon reads channels.telegram.* knobs (and any
   # agent env) from process.env at startup — e.g. SWITCHROOM_TG_STREAM_
@@ -120,17 +131,19 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
     else
       sr_ll_ok="1"
     fi
-    if [ -n "$sr_ll_ok" ]; then
+    if [ -n "$sr_ll_ok" ] || [ -n "$sr_ll_unreachable" ]; then
+      # Key fetched successfully — export the proxy auth header REGARDLESS of the
+      # reachability probe outcome. The header is what carries the virtual key
+      # into the process env; without it the gateway's sr-* discovery
+      # (gateway.ts discoverSrModels) is dead and, once the proxy recovers,
+      # every request 401s until a manual restart. Since routing is LEFT IN
+      # PLACE on unreachable (below/above), the header must be too so the
+      # session actually self-heals when litellm returns. The probe result gates
+      # only log wording + inner-pass _LITELLM_OK, never the header.
       export ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: Bearer $sr_ll_key
 x-litellm-customer-id: $SWITCHROOM_AGENT_NAME
 x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:-default}"
       export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
-    elif [ -n "$sr_ll_unreachable" ]; then
-      # Proxy unreachable at boot: routing intentionally LEFT IN PLACE (loud
-      # warning already emitted) so it survives into the inner pass and
-      # self-heals once litellm returns. NO unset — the permanent strip here
-      # was what made the inner self-heal fix inert on docker.
-      :
     else
       # Missing-key fail-open: gateway talks direct OAuth, unproxied.
       unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM SWITCHROOM_LITELLM_BASE
@@ -1016,8 +1029,15 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
   else
     sr_ll_ok="1"
   fi
-  if [ -n "$sr_ll_ok" ]; then
-    _LITELLM_OK="1"
+  if [ -n "$sr_ll_ok" ] || [ -n "$sr_ll_unreachable" ]; then
+    # Key fetched successfully — export the proxy auth header REGARDLESS of the
+    # reachability probe outcome. Routing is LEFT IN PLACE on unreachable so the
+    # session self-heals when litellm returns; the header MUST survive with it,
+    # otherwise every request 401s once the proxy recovers (the "self-heals"
+    # promise below was inert without this) and gateway sr-* discovery stays
+    # dead. The probe outcome gates ONLY the _LITELLM_OK flag (sr-* override
+    # drop) and the log wording above — never the header.
+    #
     # Newline-separated Name: Value pairs (claude CLI ANTHROPIC_CUSTOM_HEADERS format).
     # Tags: agent:<name> for per-agent spend tracking; profile:<profile> for
     # fleet-level cost breakdown by role. Per-turn tags (cron vs telegram) are
@@ -1031,13 +1051,12 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
     # models configured in the proxy appear in the /model picker and can be
     # selected via --model. Without this, the CLI only knows its bundled list.
     export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
-  elif [ -n "$sr_ll_unreachable" ]; then
-    # Proxy unreachable at boot: routing intentionally LEFT IN PLACE (loud
-    # warning already emitted above) so it self-heals when litellm returns.
-    # _LITELLM_OK stays empty so any sr-* session model override is still
-    # dropped below (claude would 4xx an unknown model against a down endpoint).
-    # NO unset here — that permanent strip was the bug this branch fixes.
-    :
+    if [ -n "$sr_ll_ok" ]; then
+      # Probe succeeded: proxy is live, so honor any sr-* session model override
+      # below. On unreachable, _LITELLM_OK stays empty so the override is dropped
+      # (claude would 4xx an unknown model against a down endpoint).
+      _LITELLM_OK="1"
+    fi
   else
     # Missing key fail-open: drop every routing var so the claude CLI talks to
     # Anthropic directly on its OAuth credential (subscription path), unproxied.

package/profiles/default/CLAUDE.md.hbs

@@ -105,7 +105,7 @@ By default, every restart starts a **fresh `claude` session** — the in-flight
   - **`resume_interrupted`** (operator restart / SIGTERM / crash): pick the work back up and carry it to completion. Briefly tell the user you're resuming and roughly how long ago it was interrupted — then just do it. Do NOT ask whether to resume.
   - **`resume_watchdog_timeout`** (hang-watchdog killed it after no progress): do NOT silently resume — it may hang the same way. Tell the user plainly that your last turn was killed after N minutes of no progress, roughly what it was doing, and ask whether to retry or take a different angle. Report only the honest cause; don't invent a deeper root cause.
   The one-shot `SWITCHROOM_PENDING_*` env vars are passive forensic context for the wake-audit / "why did you restart" protocols — not the resume trigger.
-- **`.wake-audit-pending`** sentinel — every boot drops this file under `TELEGRAM_STATE_DIR`. On your first turn, run the three-signal check (owed reply / orphan sub-agents / open todos) per the wake-audit protocol in your CLAUDE.md, then `rm -f` the sentinel.
+- **`.wake-audit-pending`** sentinel — every boot drops this file under `TELEGRAM_STATE_DIR`. On your first turn, run the three-signal check (owed reply / orphan sub-agents / open todos) per the wake-audit protocol in the `switchroom-runtime` skill (`skills/switchroom-runtime/SKILL.md`), then `rm -f` the sentinel.
 
 A config-summary greeting card is sent automatically by the SessionStart hook — you don't need to announce yourself. If your context feels thin (after compaction or any fresh session), proactively recall from Hindsight before proceeding.
 

package/skills/switchroom-release/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: switchroom-release
+description: "Cut and ship a switchroom release end-to-end: CHANGELOG consolidation, tag, npm publish, image build, and the fleet rollout gate. Use when the user says 'cut a release', 'ship a release', 'release vX', 'publish a new version', 'roll out the latest', or otherwise wants the merged work on main to go live for the fleet. This is the ONLY skill that authorizes a fleet rollout, and it enforces the npm-publish + image-build gates that were historically skipped (v0.18.4/v0.18.5 shipped to the fleet but never hit npm). Do NOT use for adding agents (switchroom-manage), diagnostics (switchroom-health), or a plain `switchroom update` on one agent (switchroom-cli)."
+allowed-tools: Bash(git *) Bash(gh *) Bash(npm view *) Bash(npm pack *) Bash(docker manifest inspect *) Bash(docker buildx imagetools inspect *)
+---
+
+# Switchroom release
+
+Cut a release of `switchroom/switchroom` and get it live on the fleet. This is a **gated, ordered checklist** — do not skip steps, do not reorder. The whole point of this skill is that two steps that used to be skipped silently (npm publish, image-build verification) are now **hard gates before rollout**.
+
+## What a release actually is
+
+- A release = a `vX.Y.Z` **git tag** on `main` (the merge commit of the CHANGELOG PR).
+- The tag is the version source of truth (`scripts/build.mjs:resolveVersion()`). `package.json` `version` is a **stale placeholder by design** — never bump it in a commit (the `//version` comment + #2733 discipline). The uncommitted pack-time bump happens in CI now, not by hand.
+- Cutting the tag fires TWO workflows in parallel on tag push: `docker-images` (builds + pushes the 6 ghcr images) and `npm-publish` (builds, packs, verifies, publishes to npm). **Rollout is gated on BOTH going green.**
+
+## Before you start — pre-flight (verify, don't assume)
+
+1. `git fetch origin`, confirm `main` is at the commit you want released.
+2. `gh pr list --state open` — confirm no PR meant for this release is still open. Ask the operator if unsure.
+3. Confirm CI on `main` is green (`gh run list --branch main --limit 3`).
+4. Read `CHANGELOG.md` — the `## Unreleased` section is the staging area for this release's notes. If it's empty, there's nothing to release.
+5. Pick the next version: read the latest tag (`git tag --list 'v*' --sort=-v:refname | head -1`) and bump the patch (or minor if the operator asks). Confirm with the operator which.
+
+## Step 1 — Consolidate the changelog (the release commit is CHANGELOG-only)
+
+- Move the `## Unreleased` entries under a new `## vX.Y.Z — <one-line summary>` heading.
+- The release commit touches **CHANGELOG.md only**. Do NOT bump `package.json` (placeholder discipline).
+- Branch protection blocks direct push to `main`, so: create a `release/vX.Y.Z` branch, push it, open a `chore: release vX.Y.Z` PR (base `main`), arm auto-merge (squash, delete-branch) on green CI.
+
+## Step 2 — Cut the tag (on the merge commit, not the PR branch)
+
+Once the changelog PR is merged:
+- `git fetch origin && git checkout main && git pull --ff-only`
+- Tag the merge commit and create the GitHub Release:
+  - `gh release create vX.Y.Z -R switchroom/switchroom --target main --title 'vX.Y.Z — <summary>' --notes-file <notes-file>`
+- **Notes extraction gotcha (historical):** the naive `awk '/^## vX/,/^## v/' CHANGELOG` range collapses to a single line. Use a start-flag awk: `awk 'f{print} /^## vX\.Y\.Z/{print; f=1} f && /^## v/ && !/^## vX\.Y\.Z/{exit}'` — or extract the section to a temp file by line range.
+- **`gh release create` has been silently dropped in past runs.** After running it, verify: `gh release view vX.Y.Z` must return the release. If it didn't create, re-run.
+
+## Step 3 — Wait for BOTH tag-push workflows (hard gates)
+
+The tag push triggers `docker-images` AND `npm-publish` in parallel. **Do not proceed to rollout until both are green AND verified.**
+
+### Gate A — npm publish (`npm-publish.yml`)
+- `gh run list --workflow=npm-publish.yml --limit 1` — wait for it to reach `completed` / `success`.
+- Verify the publish is live: `npm view switchroom version` must return `X.Y.Z` (not the old version). Retry a few times — npm registry propagation can lag a few seconds.
+- If this workflow fails: **the release is not published.** Do NOT roll. Diagnose (NPM_TOKEN unset? npm 5xx? empty dist?). Re-run via `gh workflow run npm-publish.yml --ref vX.Y.Z` after fixing.
+
+### Gate B — docker images (`docker-images.yml`)
+- `gh run list --workflow=docker-images.yml --limit 1` — wait for `completed` / `success`.
+- Verify all 6 images are published: `docker manifest inspect ghcr.io/switchroom/<image>:vX.Y.Z` for `agent`, `auth-broker`, `kernel`, `broker`, `web`, `hostd`. Each must resolve.
+- If any image is missing: do NOT roll — the rollout canary version-assert fails on an unpublished tag. Wait + re-check.
+
+**Only when Gate A AND Gate B are green + verified** do you proceed.
+
+## Step 4 — Fleet rollout (operator-gated, canary-first)
+
+- Fire the rollout via the hostd rollout path (`mcp__hostd__rollout`), which pops an **approval card**. Do NOT roll without the operator tapping approve.
+- Canary discipline: roll the release-critical canary agent first (the test-harness agent, per CLAUDE.md > Release canary discipline), monitor its logs + a smoke check, then stagger the rest per-agent with a `--version` assertion each (guards the `:latest` pull-race).
+- For a release that changes agent runtime behavior (a CLI pin bump, a behavioral template change), offer the operator a canary-first path (one agent → monitor → sweep) vs all-at-once; let them choose.
+
+## What you must NOT do
+
+- **Never bump `package.json` `version` in a commit.** It's a stale placeholder; the tag is the source of truth and `npm-publish.yml` does the uncommitted pack-time bump.
+- **Never run `npm publish` by hand from the agent container.** You can't reach the operator's npm auth, and the workflow is the reliable path. If the workflow is broken, fix the workflow — don't side-step it.
+- **Never roll the fleet before Gate A (npm) AND Gate B (images) are both green + verified.** A release that's on the fleet but not on npm is the exact regression this skill exists to prevent.
+- **Never push directly to `main`.** The CHANGELOG PR goes through auto-merge on green.
+- **Never force-push `main` or bypass hooks (`--no-verify`).**
+
+## If something goes wrong
+
+- **npm-publish failed but the tag is already pushed:** fix + `gh workflow run npm-publish.yml --ref vX.Y.Z`. Do NOT roll until it's green + `npm view` confirms.
+- **Images failed but npm succeeded:** the npm package is live but the fleet can't roll yet. Fix the image workflow / re-run. (npm being ahead of images is fine — the CLI is published for npm consumers; the fleet waits on images.)
+- **Rollout started before publish verified (the old bug):** abort the rollout, publish, then re-roll. Do not let a half-published release sit on the fleet.
+
+## Operator one-time setup (tell them once, not every release)
+
+The `npm-publish.yml` workflow needs an `NPM_TOKEN` repo secret (automation-scoped npm access token with publish rights on `switchroom`). Set it once in repo settings → Secrets and variables → Actions → `NPM_TOKEN`. Without it, Gate A fails loudly on the first release — that's the design (loud > silent).

package/telegram-plugin/auth-snapshot-format.ts

@@ -273,6 +273,16 @@ export interface SnapshotRenderOpts {
    * Takes precedence over `liveProbedAtMs`.
    */
   staleCachedAtMs?: number;
+  /**
+   * True when the live probe returned no usable data for ANY account (probe
+   * threw / timed out / returned zero rows) AND nothing was served from
+   * cache either. The footer renders `⚠ probe failed — no live data`
+   * instead of a false bare `_Live_`. Subscription-honesty: a "Live" footer
+   * next to "no data" rows is the exact lie this closes. `staleCachedAtMs`
+   * (cache-served data) takes precedence over this; this takes precedence
+   * over the bare-`Live` fallback.
+   */
+  probeFailed?: boolean;
   /**
    * Demo mode (the `/usage demo` / `/auth demo` suffix). When true, every
    * account label is run through `maskEmail` before rendering so a screen
@@ -521,11 +531,15 @@ export function renderAuthSnapshotFormat2(
   lines.push(`_${recommendation(snapshots, now, opts.demo ?? false)}_`);
   // #2495 Change 2 — a failed probe-on-open renders an explicit "cached Nm
   // ago" warning, never a false live stamp. The degraded variant takes
-  // precedence over the live stamp.
+  // precedence over the live stamp. A TOTAL probe failure (no rows, no
+  // cache) renders an explicit "probe failed" marker — without it the
+  // bare-else rendered `_Live_` next to no-data rows (the honesty gap).
   if (opts.staleCachedAtMs != null) {
     lines.push(`_⚠ cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
   } else if (opts.liveProbedAtMs != null) {
     lines.push(`_Live · refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
+  } else if (opts.probeFailed) {
+    lines.push('_⚠ probe failed — no live data_');
   } else {
     lines.push('_Live_');
   }

package/telegram-plugin/dist/bridge/bridge.js

@@ -23132,6 +23132,20 @@ function createToolLabelSidecar(opts) {
   };
 }
 
+// model-label.ts
+function isModelSentinel(model) {
+  if (typeof model !== "string")
+    return true;
+  const m = model.trim();
+  if (m.length === 0)
+    return true;
+  if (m.startsWith("<"))
+    return true;
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(m))
+    return true;
+  return false;
+}
+
 // session-tail.ts
 function isMultiAgentEnabled(env = process.env) {
   return env.PROGRESS_CARD_MULTI_AGENT !== "0";
@@ -23263,6 +23277,10 @@ function projectTranscriptLine(line) {
     if (!Array.isArray(content))
       return [];
     const events = [];
+    const mainModel = message?.model;
+    if (typeof mainModel === "string" && !isModelSentinel(mainModel)) {
+      events.push({ kind: "model", model: mainModel });
+    }
     const textEvents = projectAssistantTextBlocks(content, (text, blockIndex, lastInMessage) => ({ kind: "text", text, blockIndex, lastInMessage }));
     content.forEach((c, i) => {
       const ct = c.type;
@@ -23365,6 +23383,10 @@ function projectSubagentLine(line, agentId, state) {
     if (!Array.isArray(content))
       return [];
     const events = [];
+    const subModel = message?.model;
+    if (typeof subModel === "string" && !isModelSentinel(subModel)) {
+      events.push({ kind: "sub_agent_model", agentId, model: subModel });
+    }
     const textEvents = projectAssistantTextBlocks(content, (text, blockIndex, lastInMessage) => ({
       kind: "sub_agent_text",
       agentId,