switchroom 0.18.9 → 0.18.10

package/telegram-plugin/dist/gateway/gateway.js

@@ -20887,6 +20887,7 @@ var init_schema = __esm(() => {
         uid: exports_external.number().int().nonnegative().optional().describe("Optional UID to chown the consumer socket to (defaults to 0 = root, " + "suitable for sibling containers running as root)."),
         mirror_dir: exports_external.string().optional().describe("Optional host-side directory path. When set, the broker actively " + "writes the consumer's effective-account `.credentials.json` mirror " + "here \u2014 in addition to serving creds on demand via `get-credentials`. " + "Use this to eliminate the pull-latency gap: without a mirror the " + "consumer only gets failover creds at its next scheduled re-fetch " + "(up to 30 min). With a mirror the broker pushes failover creds " + "immediately when it detects exhaustion (consumer-quota-sensor tick, " + "or a mark-exhausted RPC on the pinned account). The directory must " + "be accessible to the broker container (bind-mounted from the host) " + "and to the consumer container; the broker writes " + "`<mirror_dir>/.credentials.json` atomically. Chown is attempted to " + "`uid` (default 0) \u2014 swallowed when CAP_CHOWN is absent.")
       })).optional().describe("Non-agent peers that hold a broker socket (RFC H \u00a74.8). Each gets " + "its own `/run/switchroom/auth-broker/<name>/sock` chowned to its UID. " + "Consumers cannot be admins; a consumer name that collides with an " + "agent (whether that agent has `admin: true` or not) is a config " + "error caught at schema validation."),
+      proactive_failover_pct: exports_external.number().min(1).max(99).optional().describe("Soft-avoid threshold (percent) for proactive auth failover (#3031). " + "When set (e.g. 95), an account whose fresh 7-day utilization is at/" + "above this value \u2014 or whose 5h utilization is at/above min(pct+3, " + "98) \u2014 enters the SOFT-AVOID preference tier: the broker prefers a " + "fully-eligible fallback account on the serving path, without ever " + "blocking the account (the hard wall stays 99.5). Enter/exit uses " + "hysteresis (exit below pct-5 or on window reset) so the preference " + "does not flap between probe ticks. Accounts serving past the wall " + "via `allow_overage_accounts` are never soft-avoided. UNSET (the " + "default) disables the tier entirely \u2014 behavior is identical to a " + "fleet without this field."),
       allow_overage_accounts: exports_external.array(exports_external.string().min(1)).optional().describe("Opt-in list of account labels (bare strings matching `auth.active` / " + "`auth.fallback_order` entries) that may be served PAST the weekly " + "utilization wall when Anthropic overage billing is available for the " + "account (`overageStatus === 'allowed'`). Overage is REAL MONEY \u2014 " + "default is empty (no account gets this). An account in this list is " + "only kept eligible when its fresh quota snapshot reports " + "`overageStatus: 'allowed'` AND `overageDisabledReason` is NOT " + "'out_of_credits' (i.e. the overage credit has not been exhausted). " + "As soon as `overageDisabledReason` becomes 'out_of_credits', the " + "account is blocked immediately regardless of this flag. Overage lifts " + "ONLY the utilization wall \u2014 it cannot lift an active exhaustion mark " + "written by a real 429 (`mark-exhausted`).")
     }).optional().describe("Switchroom-auth-broker configuration (RFC H). Fleet-wide active account, " + "fallback order, admin-agent ACL, and ephemeral-consumer surface. " + "Required from the v0.8+ schema onwards; pre-v0.8 fleets are migrated " + "in-place by `switchroom apply` (see src/auth/migrate-schema.ts)."),
     drive: GoogleWorkspaceConfigSchema.describe("RFC D legacy key \u2014 use `google_workspace:` instead. Optional Google " + "Workspace onboarding configuration. When set, supplies Google OAuth " + "client credentials, the approver allowlist for `switchroom drive " + "connect`, and the optional tier knob. Env vars " + "(SWITCHROOM_GOOGLE_CLIENT_ID, SWITCHROOM_GOOGLE_CLIENT_SECRET, " + "SWITCHROOM_APPROVER_USER_ID) take precedence over this block when " + "set, preserving back-compat with the env-only flow shipped in #766."),
@@ -27284,8 +27285,8 @@ import {
   mkdirSync as mkdirSync15,
   unlinkSync as unlinkSync7,
   fsyncSync,
-  openSync as openSync2,
-  closeSync as closeSync2,
+  openSync as openSync3,
+  closeSync as closeSync3,
   lstatSync,
   realpathSync
 } from "node:fs";
@@ -27371,10 +27372,10 @@ var init_vault = __esm(() => {
 // ../src/vault/resolver.ts
 import {
   chmodSync as chmodSync2,
-  closeSync as closeSync3,
+  closeSync as closeSync4,
   mkdirSync as mkdirSync16,
   mkdtempSync,
-  openSync as openSync3,
+  openSync as openSync4,
   rmSync,
   statSync as statSync5,
   writeSync as writeSync3
@@ -27442,11 +27443,11 @@ function materializationRoot() {
 }
 function writeFileExclusive(filePath, content3) {
   const buf = typeof content3 === "string" ? Buffer.from(content3, "utf8") : content3;
-  const fd = openSync3(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+  const fd = openSync4(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
   try {
     writeSync3(fd, buf);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function materializeFilesEntry(key, files) {
@@ -37415,7 +37416,7 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
       return { messageId: -1, complete: () => {} };
     }
   }
-  const ackText = renderBootCard({
+  const ackText2 = renderBootCard({
     agentName: opts.agentName,
     agentSlug: opts.agentSlug,
     version: opts.version,
@@ -37429,7 +37430,7 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
   let messageId = -1;
   if (reuseId != null && bot.editMessageTextStrict != null) {
     try {
-      const outcome = await bot.editMessageTextStrict(chatId, reuseId, ackText, {
+      const outcome = await bot.editMessageTextStrict(chatId, reuseId, ackText2, {
         link_preview_options: { is_disabled: true },
         ...threadId != null ? { message_thread_id: threadId } : {}
       });
@@ -37445,7 +37446,7 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
   }
   if (messageId < 0) {
     try {
-      const sent = await bot.sendMessage(chatId, ackText, {
+      const sent = await bot.sendMessage(chatId, ackText2, {
         link_preview_options: { is_disabled: true },
         ...threadId != null ? { message_thread_id: threadId } : {},
         ...ackMessageId != null ? { reply_parameters: { message_id: ackMessageId } } : {},
@@ -37544,7 +37545,7 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
           ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {},
           ...configChanges.length > 0 ? { configChanges } : {}
         });
-        if (currentText !== ackText) {
+        if (currentText !== ackText2) {
           try {
             await bot.editMessageText(chatId, messageId, currentText, {
               link_preview_options: { is_disabled: true },
@@ -38164,7 +38165,7 @@ __export(exports_materialize_bot_token, {
   materializeBotToken: () => materializeBotToken,
   BotTokenMaterializeError: () => BotTokenMaterializeError
 });
-import { existsSync as existsSync48 } from "node:fs";
+import { existsSync as existsSync49 } from "node:fs";
 function pickConfiguredToken(config, agentName3) {
   if (agentName3) {
     const agent = config.agents?.[agentName3];
@@ -38178,7 +38179,7 @@ function tryDirectVaultRead3(ref, config, passphrase) {
   if (!passphrase)
     return null;
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync48(vaultPath))
+  if (!existsSync49(vaultPath))
     return null;
   try {
     const secrets = openVault(passphrase, vaultPath);
@@ -38270,7 +38271,7 @@ __export(exports_tmux, {
   captureAgentPane: () => captureAgentPane
 });
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { mkdirSync as mkdirSync38, readdirSync as readdirSync10, statSync as statSync15, unlinkSync as unlinkSync19, writeFileSync as writeFileSync40 } from "node:fs";
+import { mkdirSync as mkdirSync38, readdirSync as readdirSync11, statSync as statSync15, unlinkSync as unlinkSync20, writeFileSync as writeFileSync41 } from "node:fs";
 import { resolve as resolve10 } from "node:path";
 function captureAgentPane(opts) {
   const { agentName: agentName3, agentDir, reason } = opts;
@@ -38316,7 +38317,7 @@ function captureAgentPane(opts) {
 ` + `
 `;
   try {
-    writeFileSync40(outPath, Buffer.concat([Buffer.from(header, "utf8"), body]), {
+    writeFileSync41(outPath, Buffer.concat([Buffer.from(header, "utf8"), body]), {
       mode: 420
     });
   } catch (err) {
@@ -38386,7 +38387,7 @@ function sleepSync2(ms) {
 function pruneOldReports(dir, retain) {
   let entries;
   try {
-    entries = readdirSync10(dir);
+    entries = readdirSync11(dir);
   } catch {
     return;
   }
@@ -38400,7 +38401,7 @@ function pruneOldReports(dir, retain) {
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   for (const stale of files.slice(retain)) {
     try {
-      unlinkSync19(stale.full);
+      unlinkSync20(stale.full);
     } catch {}
   }
 }
@@ -39020,19 +39021,19 @@ var import_runner3 = __toESM(require_mod3(), 1);
 import { randomBytes as randomBytes9, createHash as createHash3 } from "crypto";
 import { execFileSync as execFileSync8, execSync as execSync2, spawn } from "child_process";
 import {
-  readFileSync as readFileSync51,
-  writeFileSync as writeFileSync41,
+  readFileSync as readFileSync53,
+  writeFileSync as writeFileSync42,
   mkdirSync as mkdirSync39,
-  readdirSync as readdirSync11,
+  readdirSync as readdirSync12,
   rmSync as rmSync5,
   statSync as statSync16,
-  renameSync as renameSync16,
+  renameSync as renameSync17,
   realpathSync as realpathSync4,
   chmodSync as chmodSync8,
-  openSync as openSync10,
-  closeSync as closeSync10,
-  existsSync as existsSync49,
-  unlinkSync as unlinkSync20,
+  openSync as openSync11,
+  closeSync as closeSync11,
+  existsSync as existsSync50,
+  unlinkSync as unlinkSync21,
   appendFileSync as appendFileSync6
 } from "fs";
 import { homedir as homedir17 } from "os";
@@ -39326,6 +39327,22 @@ function resolveSafeBoundaryEnabled(configured) {
   return configured !== false;
 }
 
+// gateway/stop-command.ts
+function parseStopKeyword(text) {
+  return /^stop[.!]?$/i.test(text.trim());
+}
+function buildStopReply(turnInFlight, queuedSessionCmds) {
+  if (!turnInFlight) {
+    return { text: "Nothing running \u2014 no in-flight turn to cancel." };
+  }
+  const lines = ["\u23f9 Turn cancelled."];
+  if (queuedSessionCmds.length > 0) {
+    lines.push(`Queued command${queuedSessionCmds.length > 1 ? "s" : ""} (${queuedSessionCmds.join(", ")}) survive${queuedSessionCmds.length > 1 ? "" : "s"} and will apply once the session is idle.`);
+  }
+  return { text: lines.join(`
+`) };
+}
+
 // gateway/busy-ack.ts
 var BUSY_ACK_STEP_AGE_THRESHOLD_MS = 12000;
 function shouldPostBusyAck(input) {
@@ -42199,6 +42216,17 @@ function createWorkerActivityFeed(opts) {
       markFinalized(agentId);
       handles.delete(agentId);
     },
+    resurrect(agentId) {
+      const wasFinalized = finalized.delete(agentId);
+      const h = handles.get(agentId);
+      if (h != null) {
+        h.finished = false;
+        h.pendingFinish = null;
+      }
+      if (wasFinalized || h != null) {
+        log(`worker-feed: resurrect agent=${agentId} \u2014 cleared finalized gate; card will repaint on next running cue`);
+      }
+    },
     heartbeatTick,
     stop() {
       if (heartbeatTimer != null) {
@@ -42568,6 +42596,17 @@ function buildTimedOutCardEdits(cardText, cards) {
     stripKeyboard: true
   }));
 }
+var CANCELLED_FOOTER = `
+
+\u23f9 Cancelled \u2014 the turn was stopped`;
+function buildCancelledCardEdits(cardText, cards) {
+  return cards.map(({ chatId, messageId }) => ({
+    chatId,
+    messageId,
+    text: `${cardText}${CANCELLED_FOOTER}`,
+    stripKeyboard: true
+  }));
+}
 var STALE_TAP_NOTICE = "This request already resolved (timed out) \u2014 ask again to act.";
 
 // shared/bot-runtime.ts
@@ -56238,6 +56277,7 @@ function createChatLock() {
       if (chains.get(key) === tracked)
         chains.delete(key);
     });
+    tracked.catch(() => {});
     chains.set(key, tracked);
     return next;
   }
@@ -56378,6 +56418,146 @@ async function retryWithThreadFallback2(retry, send, opts) {
     throw err;
   }
 }
+function isPhotoDimensionRejectError(err) {
+  if (!(err instanceof import_grammy6.GrammyError) || err.error_code !== 400)
+    return false;
+  const d = (err.description || "").toLowerCase();
+  return d.includes("photo_invalid_dimensions") || d.includes("photo_save_file_invalid") || d.includes("photo dimensions") || d.includes("image_process_failed") || d.includes("photo is too big") || d.includes("too big for a photo") || d.includes("image is too big") || d.includes("file is too big");
+}
+
+// photo-precheck.ts
+import { closeSync as closeSync2, fstatSync, openSync as openSync2, readSync } from "node:fs";
+var PHOTO_MAX_DIMENSION_SUM = 1e4;
+var PHOTO_MAX_ASPECT_RATIO = 10;
+var PHOTO_MAX_BYTES = 10 * 1024 * 1024;
+function pngDimensions(buf) {
+  if (buf.length < 24)
+    return null;
+  if (buf.readUInt32BE(0) !== 2303741511 || buf.readUInt32BE(4) !== 218765834)
+    return null;
+  if (buf.toString("ascii", 12, 16) !== "IHDR")
+    return null;
+  return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+}
+function jpegDimensions(buf) {
+  if (buf.length < 4 || buf[0] !== 255 || buf[1] !== 216)
+    return null;
+  let off = 2;
+  while (off + 9 < buf.length) {
+    if (buf[off] !== 255) {
+      off++;
+      continue;
+    }
+    const marker = buf[off + 1];
+    if (marker === 216 || marker >= 208 && marker <= 215 || marker === 1 || marker === 255) {
+      off += 2;
+      continue;
+    }
+    const len = buf.readUInt16BE(off + 2);
+    if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) {
+      return { height: buf.readUInt16BE(off + 5), width: buf.readUInt16BE(off + 7) };
+    }
+    if (len < 2)
+      return null;
+    off += 2 + len;
+  }
+  return null;
+}
+function gifDimensions(buf) {
+  if (buf.length < 10)
+    return null;
+  const sig = buf.toString("ascii", 0, 6);
+  if (sig !== "GIF87a" && sig !== "GIF89a")
+    return null;
+  return { width: buf.readUInt16LE(6), height: buf.readUInt16LE(8) };
+}
+function webpDimensions(buf) {
+  if (buf.length < 30)
+    return null;
+  if (buf.toString("ascii", 0, 4) !== "RIFF" || buf.toString("ascii", 8, 12) !== "WEBP")
+    return null;
+  const chunk = buf.toString("ascii", 12, 16);
+  if (chunk === "VP8X") {
+    const width = 1 + (buf[24] | buf[25] << 8 | buf[26] << 16);
+    const height = 1 + (buf[27] | buf[28] << 8 | buf[29] << 16);
+    return { width, height };
+  }
+  if (chunk === "VP8L") {
+    if (buf[20] !== 47)
+      return null;
+    const b0 = buf[21], b1 = buf[22], b2 = buf[23], b3 = buf[24];
+    const width = 1 + ((b1 & 63) << 8 | b0);
+    const height = 1 + ((b3 & 15) << 10 | b2 << 2 | (b1 & 192) >> 6);
+    return { width, height };
+  }
+  if (chunk === "VP8 ") {
+    if (buf[23] !== 157 || buf[24] !== 1 || buf[25] !== 42)
+      return null;
+    const width = buf.readUInt16LE(26) & 16383;
+    const height = buf.readUInt16LE(28) & 16383;
+    return { width, height };
+  }
+  return null;
+}
+function probeImageDimensions(buf) {
+  return pngDimensions(buf) ?? jpegDimensions(buf) ?? gifDimensions(buf) ?? webpDimensions(buf);
+}
+var HEADER_PROBE_BYTES = 32;
+var JPEG_PROBE_BYTES = 64 * 1024;
+function probeImageFile(path2) {
+  let fd;
+  try {
+    fd = openSync2(path2, "r");
+    const bytes = fstatSync(fd).size;
+    const headBuf = Buffer.alloc(HEADER_PROBE_BYTES);
+    const headRead = readSync(fd, headBuf, 0, HEADER_PROBE_BYTES, 0);
+    let probe = headBuf.subarray(0, headRead);
+    if (headRead >= 2 && probe[0] === 255 && probe[1] === 216) {
+      const jpegBuf = Buffer.alloc(Math.min(JPEG_PROBE_BYTES, bytes));
+      const jpegRead = readSync(fd, jpegBuf, 0, jpegBuf.length, 0);
+      probe = jpegBuf.subarray(0, jpegRead);
+    }
+    const dims = probeImageDimensions(probe);
+    if (!dims || dims.width <= 0 || dims.height <= 0)
+      return null;
+    return { ...dims, bytes };
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync2(fd);
+      } catch {}
+    }
+  }
+}
+function photoSendViolation(probe) {
+  const { width, height, bytes } = probe;
+  if (width + height > PHOTO_MAX_DIMENSION_SUM) {
+    return `dimensions ${width}x${height} exceed width+height<=${PHOTO_MAX_DIMENSION_SUM}`;
+  }
+  const ratio = Math.max(width, height) / Math.min(width, height);
+  if (ratio > PHOTO_MAX_ASPECT_RATIO) {
+    return `aspect ratio ${ratio.toFixed(1)}:1 (${width}x${height}) exceeds ${PHOTO_MAX_ASPECT_RATIO}:1 photo bound`;
+  }
+  if (bytes > PHOTO_MAX_BYTES) {
+    return `file size ${(bytes / (1024 * 1024)).toFixed(1)}MB exceeds ${PHOTO_MAX_BYTES / (1024 * 1024)}MB photo ceiling`;
+  }
+  return null;
+}
+function rerouteResultSuffix(reroutes) {
+  if (reroutes.length === 0)
+    return "";
+  const details = reroutes.map((r) => `${r.path.split("/").pop() ?? r.path}: ${r.reason}`).join("; ");
+  return ` (${reroutes.length} file(s) sent as document, not inline photo: ${details})`;
+}
+function classifyPhotoFile(path2) {
+  const probe = probeImageFile(path2);
+  if (!probe)
+    return { route: "photo" };
+  const violation = photoSendViolation(probe);
+  return violation ? { route: "document", reason: violation } : { route: "photo" };
+}
 
 // shared/bot-runtime.ts
 var import_grammy7 = __toESM(require_mod2(), 1);
@@ -67772,7 +67952,7 @@ function parseModelCommand(text4) {
   }
   return { kind: "set", model: arg };
 }
-var PERSIST_NOTE = "_Sticky across switchroom-managed relaunches (`/new`, watchdog recovery); reverts on `/restart`, agent restart, crash, or external container restart. `/model default` clears it. To persist, set `model:` in switchroom.yaml._";
+var PERSIST_NOTE = "_Sticky \u2014 persists across restarts, deploys, and crashes until `/model default` clears it (or the configured `model:` in switchroom.yaml changes, which resets it and notifies you). To change the default, set `model:` in switchroom.yaml._";
 function helpText2(deps, reason) {
   const srAliasExamples = Object.keys(SR_MODEL_ALIASES).map((a) => `\`${a}\``).join(" \u00b7 ");
   const lines = [];
@@ -67808,7 +67988,7 @@ async function handleModelCommand(parsed, deps) {
   const model = expandSrAlias(parsed.model);
   if (deps.isBusy()) {
     return {
-      text: "\u23f3 The agent is mid-turn \u2014 a model switch needs an idle session. Try again in a moment.",
+      text: "\u23f3 The agent is mid-turn \u2014 a model switch needs an idle session. The switch was not applied.",
       html: true
     };
   }
@@ -67967,6 +68147,13 @@ var SR_MODEL_ALIASES = {
   glm: "sr-glm-5",
   codex: "sr-codex-5.5"
 };
+function isOfflineTrustedModelToken(token) {
+  if (MODEL_ALIASES.includes(token))
+    return true;
+  if (token in SR_MODEL_ALIASES)
+    return true;
+  return Object.values(SR_MODEL_ALIASES).includes(token);
+}
 function expandSrAlias(arg) {
   return SR_MODEL_ALIASES[arg.toLowerCase()] ?? arg;
 }
@@ -67982,10 +68169,49 @@ function classifyDiscoveredOptions(options) {
 function modelSelectCallbackData(label) {
   return `${MODEL_CALLBACK_SELECT}${labelTag(label)}`;
 }
-function busyReply(deps) {
+var BUSY_REFUSAL_TEXT = "\u23f3 The agent is mid-turn \u2014 the model picker needs an idle prompt. Your tap was not applied.";
+function isBusyRefusalText(text4) {
+  return text4.includes("The agent is mid-turn");
+}
+function busyStaticMenu(deps, page) {
+  const externalNames = externalModelNames([]);
+  if (page === "external") {
+    return {
+      text: [
+        `**Model \u2014 ${deps.escapeHtml(deps.getAgentName())}** \u00b7 \uD83C\uDF10 External`,
+        "_Agent is mid-turn \u2014 taps are queued and apply the moment the turn ends._",
+        "These models are **billed separately** via OpenRouter. Tap one to switch the **live session**:",
+        PERSIST_NOTE
+      ].join(`
+`),
+      html: true,
+      keyboard: externalPageKeyboard(externalNames)
+    };
+  }
+  const rows = [];
+  for (const alias of MODEL_ALIASES) {
+    if (alias === "default")
+      continue;
+    rows.push([{
+      text: alias.charAt(0).toUpperCase() + alias.slice(1),
+      callback_data: `${MODEL_CALLBACK_ALIAS}${alias}`
+    }]);
+  }
+  rows.push([{ text: "Default (configured)", callback_data: `${MODEL_CALLBACK_ALIAS}default` }]);
+  if (externalNames.length > 0) {
+    rows.push([{ text: "\uD83C\uDF10 External models \u25b8", callback_data: MODEL_CALLBACK_PAGE_EXTERNAL }]);
+  }
+  rows.push([{ text: "\uD83D\uDD04 Refresh", callback_data: MODEL_CALLBACK_REFRESH }]);
   return {
-    text: "\u23f3 The agent is mid-turn \u2014 the model picker needs an idle prompt. Try again in a moment.",
-    html: true
+    text: [
+      `**Model \u2014 ${deps.escapeHtml(deps.getAgentName())}**`,
+      "_Agent is mid-turn, so the live picker can\u2019t be read right now \u2014 this is the quick list. A tap is queued and applies the moment the turn ends._",
+      "Tap a model to switch the **live session**:",
+      PERSIST_NOTE
+    ].join(`
+`),
+    html: true,
+    keyboard: rows
   };
 }
 function headerRow(label) {
@@ -68034,7 +68260,7 @@ function externalPageKeyboard(externalNames) {
 }
 async function buildModelMenu(deps, page = "main") {
   if (deps.isBusy())
-    return busyReply(deps);
+    return busyStaticMenu(deps, page);
   const [discovered, quota, srNames] = await Promise.all([
     deps.discover(deps.getAgentName()),
     deps.getQuotaBrief().catch(() => null),
@@ -68099,8 +68325,9 @@ async function handleModelMenuCallback(data, deps) {
     if (deps.isBusy()) {
       return {
         answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-        reply: busyReply(deps),
-        toastOnly: true
+        reply: { text: BUSY_REFUSAL_TEXT, html: true },
+        toastOnly: true,
+        busyRefusal: true
       };
     }
     let aliasResult;
@@ -68142,8 +68369,9 @@ async function handleModelMenuCallback(data, deps) {
     if (deps.isBusy()) {
       return {
         answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-        reply: busyReply(deps),
-        toastOnly: true
+        reply: { text: BUSY_REFUSAL_TEXT, html: true },
+        toastOnly: true,
+        busyRefusal: true
       };
     }
     try {
@@ -68168,8 +68396,9 @@ ${PERSIST_NOTE}`),
   if (deps.isBusy()) {
     return {
       answer: "\u23f3 Agent is mid-turn \u2014 tap again when it\u2019s idle",
-      reply: busyReply(deps),
-      toastOnly: true
+      reply: { text: BUSY_REFUSAL_TEXT, html: true },
+      toastOnly: true,
+      busyRefusal: true
     };
   }
   const tag = data.slice(MODEL_CALLBACK_SELECT.length);
@@ -68278,9 +68507,8 @@ function isValidModelArg2(arg) {
 var SESSION_MODEL_FILE = ".session-model";
 var RELAUNCH_MODEL_INTENT_FILE = ".relaunch-model-intent";
 var CONFIGURED_DEFAULT_MODEL_FILE = ".configured-default-model";
-var REVERT_RESTART_REASONS = new Set(["inline-button-restart"]);
-function intentForRestartReason(reason) {
-  return REVERT_RESTART_REASONS.has(reason) ? "revert" : "keep";
+function intentForRestartReason(_reason) {
+  return "keep";
 }
 function atomicWrite(path2, content3) {
   const tmp = `${path2}.tmp-${process.pid}-${Date.now()}`;
@@ -68295,6 +68523,17 @@ function serializeSessionModel(rec) {
   })}
 `;
 }
+function parseSessionModel(text4) {
+  try {
+    const raw = JSON.parse(text4);
+    if (typeof raw.model !== "string" || typeof raw.configuredDefaultAtWrite !== "string" || typeof raw.ts !== "number" || !isValidModelArg2(raw.model)) {
+      return null;
+    }
+    return { model: raw.model, configuredDefaultAtWrite: raw.configuredDefaultAtWrite, ts: raw.ts };
+  } catch {
+    return null;
+  }
+}
 function writeSessionModelFile(agentDir, model, configuredDefaultAtWrite) {
   if (!isValidModelArg2(model)) {
     throw new Error(`refusing to persist non-canonical session model token: ${JSON.stringify(model)}`);
@@ -68308,9 +68547,15 @@ function readSessionModelFileRaw(agentDir) {
     return null;
   }
 }
+function readSessionModelFile(agentDir) {
+  const raw = readSessionModelFileRaw(agentDir);
+  return raw == null ? null : parseSessionModel(raw);
+}
 function clearSessionModelFile(agentDir) {
   try {
     rmSync4(join28(agentDir, SESSION_MODEL_FILE), { force: true });
+    rmSync4(join28(agentDir, ".session-model-kept-notified"), { force: true });
+    rmSync4(join28(agentDir, ".session-model-boot-attempts"), { force: true });
   } catch {}
 }
 function restoreSessionModelFileRaw(agentDir, raw) {
@@ -68331,6 +68576,26 @@ function writeRelaunchModelIntent(agentDir, intent, reason) {
 `);
   }
 }
+var GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX = "gateway-shutdown:";
+function readRelaunchModelIntent(agentDir) {
+  try {
+    const raw = readFileSync24(join28(agentDir, RELAUNCH_MODEL_INTENT_FILE), "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.intent !== "keep" && parsed.intent !== "revert" || typeof parsed.reason !== "string" || typeof parsed.ts !== "number") {
+      return null;
+    }
+    return { intent: parsed.intent, reason: parsed.reason, ts: parsed.ts };
+  } catch {
+    return null;
+  }
+}
+function clearStaleGatewayShutdownIntent(agentDir) {
+  const rec = readRelaunchModelIntent(agentDir);
+  if (rec == null || !rec.reason.startsWith(GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX))
+    return false;
+  clearRelaunchModelIntent(agentDir);
+  return true;
+}
 function clearRelaunchModelIntent(agentDir) {
   try {
     rmSync4(join28(agentDir, RELAUNCH_MODEL_INTENT_FILE), { force: true });
@@ -68344,6 +68609,38 @@ function readConfiguredDefaultModel(agentDir) {
     return null;
   }
 }
+var SESSION_EFFORT_FILE = ".session-effort";
+var EFFORT_LEVEL_RE = /^(low|medium|high|xhigh|max)$/;
+function parseSessionEffort(text4) {
+  try {
+    const raw = JSON.parse(text4);
+    if (typeof raw.level !== "string" || typeof raw.configuredDefaultAtWrite !== "string" || typeof raw.ts !== "number" || !EFFORT_LEVEL_RE.test(raw.level)) {
+      return null;
+    }
+    return { level: raw.level, configuredDefaultAtWrite: raw.configuredDefaultAtWrite, ts: raw.ts };
+  } catch {
+    return null;
+  }
+}
+function writeSessionEffortFile(agentDir, level, configuredDefaultAtWrite) {
+  if (!EFFORT_LEVEL_RE.test(level)) {
+    throw new Error(`refusing to persist non-allowlisted effort level: ${JSON.stringify(level)}`);
+  }
+  atomicWrite(join28(agentDir, SESSION_EFFORT_FILE), `${JSON.stringify({ level, configuredDefaultAtWrite: configuredDefaultAtWrite ?? "", ts: Date.now() })}
+`);
+}
+function readSessionEffortFile(agentDir) {
+  try {
+    return parseSessionEffort(readFileSync24(join28(agentDir, SESSION_EFFORT_FILE), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function clearSessionEffortFile(agentDir) {
+  try {
+    rmSync4(join28(agentDir, SESSION_EFFORT_FILE), { force: true });
+  } catch {}
+}
 
 // ../src/agents/model-picker.ts
 var HEADER_RE = /Select model/;
@@ -68608,7 +68905,7 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join30(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
   if (existsSync26(fragPath)) {
@@ -68662,6 +68959,7 @@ init_paths();
 // ../src/agents/scaffold.ts
 var REPO_ROOT = resolve6(import.meta.dirname, "../..");
 var SWITCHROOM_DEFAULT_MAIN_MODEL = "claude-sonnet-5";
+var SWITCHROOM_DEFAULT_THINKING_EFFORT = "low";
 function resolveMainModel(model) {
   if (model === undefined || model === "default")
     return SWITCHROOM_DEFAULT_MAIN_MODEL;
@@ -68696,31 +68994,56 @@ function parseEffortCommand(text4) {
   const arg = parts[0];
   if (arg.toLowerCase() === "help")
     return { kind: "help" };
+  if (arg.toLowerCase() === "default")
+    return { kind: "default" };
   if (!isValidEffortArg(arg)) {
     return { kind: "help", reason: `not a valid effort level: ${arg}` };
   }
   return { kind: "set", level: arg.toLowerCase() };
 }
-var PERSIST_NOTE2 = "_Session-only \u2014 reverts to the configured default on restart. To change the default, set `thinking_effort:` in switchroom.yaml and restart._";
+var PERSIST_NOTE2 = "_Sticky \u2014 persists across restarts and deploys until `/effort default` clears it. To change the configured default, set `thinking_effort:` in switchroom.yaml._";
 var LEVELS_INLINE = EFFORT_LEVELS.map((l) => `\`${l}\``).join(" \u00b7 ");
 function helpText3(deps, reason) {
   const lines = [];
   if (reason)
     lines.push(`\u26a0\ufe0f ${deps.escapeHtml(reason)}`);
-  lines.push("**/effort** \u2014 show or switch the reasoning effort (faster\u2192smarter)", "`/effort` \u2014 show the configured effort + a tap menu", `\`/effort <level>\` \u2014 switch the live session (${LEVELS_INLINE})`, PERSIST_NOTE2);
+  lines.push("**/effort** \u2014 show or switch the reasoning effort (faster\u2192smarter)", "`/effort` \u2014 show the configured effort + a tap menu", `\`/effort <level>\` \u2014 switch the live session (${LEVELS_INLINE})`, "`/effort default` \u2014 clear the override, back to the configured default", PERSIST_NOTE2);
   return { text: lines.join(`
 `), html: true };
 }
 async function handleEffortCommand(parsed, deps) {
   if (parsed.kind === "help")
     return helpText3(deps, parsed.reason);
+  if (parsed.kind === "default") {
+    const configured = deps.getConfiguredEffort();
+    const restoreLevel = configured && isValidEffortArg(configured) ? configured.toLowerCase() : "low";
+    let restored = null;
+    try {
+      restored = await deps.applyEffort(deps.getAgentName(), restoreLevel);
+    } catch {
+      restored = null;
+    }
+    deps.clearSessionEffort?.();
+    const cfgHtml = `\`${deps.escapeHtml(restoreLevel)}\``;
+    if (restored?.ok) {
+      return {
+        text: `\u2705 Effort override cleared \u2014 back on the configured default ${cfgHtml}. It will also boot on ${cfgHtml} from now on.`,
+        html: true
+      };
+    }
+    return {
+      text: `\u2705 Effort override cleared \u2014 the agent boots on the configured default ${cfgHtml} from now on. (Couldn't switch the live session right now; it may already be on ${cfgHtml}, or will be after the next restart.)`,
+      html: true
+    };
+  }
   if (parsed.kind === "show") {
     const configured = deps.getConfiguredEffort();
     const shown = configured && configured.length > 0 ? configured : "low";
+    const override = deps.getSessionEffort?.() ?? null;
     return {
       text: [
         `**Effort \u2014 ${deps.escapeHtml(deps.getAgentName())}**`,
-        `Configured default: \`${deps.escapeHtml(shown)}\``,
+        `Configured default: \`${deps.escapeHtml(shown)}\`${override ? ` \u00b7 session override: \`${deps.escapeHtml(override)}\`` : ""}`,
         `Switch the live session: ${EFFORT_LEVELS.map((l) => `\`/effort ${l}\``).join(" \u00b7 ")}`,
         PERSIST_NOTE2
       ].join(`
@@ -68776,7 +69099,7 @@ function menuKeyboard(highlight) {
 }
 function buildEffortMenu(deps, highlight) {
   const configured = deps.getConfiguredEffort() || "low";
-  const live = highlight ?? configured;
+  const live = highlight ?? deps.getSessionEffort?.() ?? configured;
   return {
     text: [
       `**Effort \u2014 ${deps.escapeHtml(deps.getAgentName())}**`,
@@ -68823,6 +69146,122 @@ ${menu.text}` },
   };
 }
 
+// gateway/pending-session-command.ts
+function createPendingSessionCommandSlots() {
+  const slots = new Map;
+  return {
+    get: (kind) => slots.get(kind) ?? null,
+    set(cmd) {
+      const displaced = slots.get(cmd.kind) ?? null;
+      slots.delete(cmd.kind);
+      slots.set(cmd.kind, cmd);
+      return displaced;
+    },
+    take(kind) {
+      const cur = slots.get(kind) ?? null;
+      slots.delete(kind);
+      return cur;
+    },
+    takeAll() {
+      const all2 = [...slots.values()];
+      slots.clear();
+      return all2;
+    },
+    list: () => [...slots.values()],
+    clear() {
+      slots.clear();
+    },
+    get size() {
+      return slots.size;
+    }
+  };
+}
+async function drainTakenCommands(taken, io) {
+  for (let i = 0;i < taken.length; i++) {
+    const cmd = taken[i];
+    if (io.restartPending()) {
+      await io.editCard(cmd, io.resolveForRestartText(cmd));
+      continue;
+    }
+    if (io.turnInFlight()) {
+      for (const rest of taken.slice(i))
+        io.reEnqueue(rest);
+      return;
+    }
+    let body;
+    try {
+      body = await io.apply(cmd);
+    } catch (err) {
+      await io.editCard(cmd, io.failureText(cmd, err));
+      continue;
+    }
+    if (io.isBusyRefusal(body)) {
+      for (const rest of taken.slice(i))
+        io.reEnqueue(rest);
+      return;
+    }
+    await io.editCard(cmd, body);
+  }
+}
+function drainCapDecision(queued, now, capMs, turnInFlight) {
+  const overdue = queued.some((c) => now - c.requestedAt > capMs);
+  if (!overdue)
+    return "wait";
+  return turnInFlight ? "defer-turn-in-flight" : "force";
+}
+var EFFORT_MENU_SELECT_PREFIX = "eff:s:";
+function classifyShutdownPersist(cmd) {
+  if (cmd.kind === "effort") {
+    const level = cmd.origin === "menu" && cmd.arg.startsWith(EFFORT_MENU_SELECT_PREFIX) ? cmd.arg.slice(EFFORT_MENU_SELECT_PREFIX.length) : cmd.arg;
+    if (level === "default")
+      return { persist: "clear-effort", arg: level };
+    return { persist: "effort", arg: level };
+  }
+  if (cmd.origin === "menu")
+    return { persist: null, arg: cmd.arg };
+  if (cmd.arg === "default")
+    return { persist: "clear-model", arg: cmd.arg };
+  return { persist: "model", arg: cmd.arg };
+}
+function persistedText(cmd, escapeHtml5) {
+  const noun = KIND_NOUN[cmd.kind];
+  const isClear = cmd.arg === "default" || cmd.targetLabel === "default";
+  if (isClear) {
+    return `\uD83D\uDCBE The session is restarting \u2014 your ${noun} override was cleared as requested; the agent boots on the configured default.`;
+  }
+  return `\uD83D\uDCBE The session is restarting \u2014 your \`${escapeHtml5(cmd.targetLabel)}\` ${noun} choice is saved and applies as the agent boots.`;
+}
+function shutdownResolutionActions(slots, escapeHtml5) {
+  return slots.takeAll().map((cmd) => resolveForRestart(cmd, escapeHtml5));
+}
+function resolveForRestart(cmd, escapeHtml5) {
+  const { persist, arg } = classifyShutdownPersist(cmd);
+  return {
+    cmd,
+    persist,
+    arg,
+    persistedText: persistedText(cmd, escapeHtml5),
+    reissueText: restartSupersededText(cmd, escapeHtml5)
+  };
+}
+var KIND_NOUN = {
+  model: "model",
+  effort: "effort"
+};
+var KIND_VERB = {
+  model: "switch to",
+  effort: "set effort to"
+};
+function ackText(kind, targetLabel, escapeHtml5) {
+  return `\uD83D\uDCE5 Agent is mid-turn \u2014 I'll ${KIND_VERB[kind]} \`${escapeHtml5(targetLabel)}\` the moment this turn finishes.`;
+}
+function supersededText(displaced, next, escapeHtml5) {
+  return `\u21a9\ufe0f Superseded \u2014 queued \`${escapeHtml5(next.targetLabel)}\` instead (your earlier \`${escapeHtml5(displaced.targetLabel)}\` ${KIND_NOUN[displaced.kind]} request was replaced before it applied).`;
+}
+function restartSupersededText(cmd, escapeHtml5) {
+  return `\u21a9\ufe0f The session is restarting before your \`${escapeHtml5(cmd.targetLabel)}\` ${KIND_NOUN[cmd.kind]} change could apply \u2014 re-issue \`/${cmd.kind} ${escapeHtml5(cmd.targetLabel)}\` once the agent is back.`;
+}
+
 // welcome-text.ts
 init_demo_mask();
 init_card_format();
@@ -68866,11 +69305,12 @@ function switchroomHelpText(agentName3) {
     `\`/deny [id]\` \u2014 deny pending tool permission`,
     `\`/pending\` \u2014 list pending permission prompts`,
     `\`/interrupt [name]\` \u2014 interrupt an agent turn`,
+    `\`/stop\` \u2014 cancel my in-flight turn (bare "stop" works too)`,
     ``,
     `**Agents**`,
     `\`/agents\` \u2014 list all agents`,
     `\`/agentstart [name]\` \u2014 start an agent`,
-    `\`/stop [name]\` \u2014 stop an agent`,
+    `\`/agentstop [name]\` \u2014 stop an agent's container`,
     `\`/logs [name] [lines]\` \u2014 show agent logs`,
     `\`/memory <query>\` \u2014 search agent memory`,
     ``,
@@ -74127,10 +74567,10 @@ function skillProposalKeyboard(id) {
 
 // ../src/self-improve/skill-proposals.ts
 import {
-  closeSync as closeSync4,
+  closeSync as closeSync5,
   existsSync as existsSync33,
   mkdirSync as mkdirSync26,
-  openSync as openSync4,
+  openSync as openSync5,
   readFileSync as readFileSync30,
   writeSync as writeSync4
 } from "node:fs";
@@ -74152,12 +74592,12 @@ function ensureDir3(stateDir) {
   }
 }
 function appendLine2(path2, obj) {
-  const fd = openSync4(path2, "a");
+  const fd = openSync5(path2, "a");
   try {
     writeSync4(fd, JSON.stringify(obj) + `
 `);
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function readLines2(path2, isValid2) {
@@ -75582,7 +76022,7 @@ var ADMIN_COMMAND_NAMES = new Set([
   "agents",
   "logs",
   "restart",
-  "stop",
+  "agentstop",
   "agentstart",
   "update",
   "reconcile",
@@ -75629,10 +76069,10 @@ function classifyAdminGate(text4, myAgentName) {
 // subagent-watcher.ts
 import {
   existsSync as existsSync35,
-  openSync as openSync6,
-  readSync,
+  openSync as openSync7,
+  readSync as readSync2,
   statSync as statSync10,
-  closeSync as closeSync6,
+  closeSync as closeSync7,
   watch,
   readdirSync as readdirSync6,
   readFileSync as readFileSync36
@@ -76056,12 +76496,13 @@ function recordSubagentStall(db2, args) {
 }
 function reapStuckRunningRows(db2, args) {
   const cutoff = args.now - args.ttlMs;
-  const candidates = db2.prepare(`
-      SELECT id FROM subagents
+  const rows = db2.prepare(`
+      SELECT id, jsonl_agent_id FROM subagents
       WHERE status = 'running'
         AND background = 1
         AND COALESCE(last_activity_at, started_at) < ?
     `).all(cutoff);
+  const candidates = args.isLive ? rows.filter((r) => !args.isLive(r.jsonl_agent_id)) : rows;
   for (const row of candidates) {
     recordSubagentStall(db2, {
       id: row.id,
@@ -76116,10 +76557,10 @@ function recordNestedSubagentDispatch(db2, args) {
 
 // gateway/turn-active-marker.ts
 import {
-  closeSync as closeSync5,
+  closeSync as closeSync6,
   existsSync as existsSync34,
   mkdirSync as mkdirSync27,
-  openSync as openSync5,
+  openSync as openSync6,
   readFileSync as readFileSync35,
   statSync as statSync9,
   unlinkSync as unlinkSync15,
@@ -76137,8 +76578,8 @@ function touchTurnActiveMarker(stateDir) {
     utimesSync(path2, now, now);
   } catch {
     try {
-      const fd = openSync5(path2, "r+");
-      closeSync5(fd);
+      const fd = openSync6(path2, "r+");
+      closeSync6(fd);
     } catch {}
   }
 }
@@ -76148,7 +76589,10 @@ var DEFAULT_RESCAN_MS = 1000;
 var DEFAULT_STALL_THRESHOLD_MS = 60000;
 var DEFAULT_SILENT_SYNTHESIS_STALL_THRESHOLD_MS = 300000;
 var DEFAULT_SILENT_STALL_TERMINAL_MS = 300000;
+var DEFAULT_INFLIGHT_TERMINAL_CAP_MS = 45 * 60000;
 var LONG_RUNNING_TOOLS = new Set(["Bash"]);
+var MAX_RESURRECTIONS = 1;
+var FALSE_FINISH_TRACKER_CAP = 512;
 function isLongRunningTool(name) {
   return name != null && LONG_RUNNING_TOOLS.has(name);
 }
@@ -76403,6 +76847,9 @@ function readSubTail(entry, tail, now, onDescriptionUpdate, fs2, log, db2, paren
             entry.lastReplyText = ev.input.text;
           }
           entry.toolCount++;
+          if (ev.toolUseId != null && ev.toolUseId !== "") {
+            entry.inflightToolUseIds.add(ev.toolUseId);
+          }
           entry.lastTool = {
             name: ev.toolName,
             sanitisedArg: sanitiseToolArg(ev.toolName, ev.input ?? {})
@@ -76431,6 +76878,9 @@ function readSubTail(entry, tail, now, onDescriptionUpdate, fs2, log, db2, paren
             }
           }
         } else if (ev.kind === "sub_agent_nested_spawn") {
+          if (ev.toolUseId != null && ev.toolUseId.length > 0) {
+            entry.inflightToolUseIds.add(ev.toolUseId);
+          }
           if (db2 != null && ev.toolUseId != null && ev.toolUseId.length > 0) {
             try {
               const nestedInput = ev.input ?? {};
@@ -76454,7 +76904,12 @@ function readSubTail(entry, tail, now, onDescriptionUpdate, fs2, log, db2, paren
             fireNarrativeProgress();
           }
           entry.pendingNarrative = { text: ev.text };
+        } else if (ev.kind === "sub_agent_tool_result") {
+          if (ev.toolUseId != null && ev.toolUseId !== "") {
+            entry.inflightToolUseIds.delete(ev.toolUseId);
+          }
         } else if (ev.kind === "sub_agent_turn_end") {
+          entry.inflightToolUseIds.clear();
           resolvePendingSubNarrative(null, undefined);
           if (entry.state === "running") {
             entry.state = "done";
@@ -76495,6 +76950,7 @@ function startSubagentWatcher(config) {
   const stallThresholdMs = config.stallThresholdMs ?? parseEnvMs("SWITCHROOM_SUBAGENT_STALL_MS") ?? DEFAULT_STALL_THRESHOLD_MS;
   const silentSynthesisStallThresholdMs = config.silentSynthesisStallThresholdMs ?? parseEnvMs("SWITCHROOM_SUBAGENT_SILENT_SYNTH_STALL_MS") ?? DEFAULT_SILENT_SYNTHESIS_STALL_THRESHOLD_MS;
   const silentStallTerminalMs = config.silentStallTerminalMs ?? parseEnvMs("SWITCHROOM_SUBAGENT_STALL_TERMINAL_MS") ?? DEFAULT_SILENT_STALL_TERMINAL_MS;
+  const inflightTerminalCapMs = config.inflightTerminalCapMs ?? parseEnvMs("SWITCHROOM_SUBAGENT_INFLIGHT_TERMINAL_CAP_MS") ?? DEFAULT_INFLIGHT_TERMINAL_CAP_MS;
   const inflightPromoteMaxAgeMs = config.inflightPromoteMaxAgeMs ?? parseEnvMs("SWITCHROOM_SUBAGENT_INFLIGHT_MAX_AGE_MS") ?? DEFAULT_INFLIGHT_PROMOTE_MAX_AGE_MS;
   const terminatedAgentIdsCap = config.terminatedAgentIdsCap ?? TERMINATED_AGENT_IDS_CAP;
   const bootPromoteEnabled = config.bootPromoteEnabled ?? process.env.SWITCHROOM_SUBAGENT_BOOT_PROMOTE !== "0";
@@ -76523,9 +76979,9 @@ function startSubagentWatcher(config) {
     existsSync: existsSync35,
     readdirSync: readdirSync6,
     statSync: statSync10,
-    openSync: openSync6,
-    closeSync: closeSync6,
-    readSync,
+    openSync: openSync7,
+    closeSync: closeSync7,
+    readSync: readSync2,
     watch
   };
   const registry = new Map;
@@ -76535,6 +76991,7 @@ function startSubagentWatcher(config) {
   const pendingCloses = new Map;
   const historicalFiles = new Set;
   const terminatedAgentIds = new Set;
+  const falseFinishTracker = new Map;
   let bootScanInProgress = true;
   let stopped = false;
   function registerAgent(filePath, agentId) {
@@ -76559,6 +77016,7 @@ function startSubagentWatcher(config) {
       lastResultText: "",
       lastProgressBucketIdx: null,
       lastTool: null,
+      inflightToolUseIds: new Set,
       historical: isHistorical
     };
     registry.set(agentId, entry);
@@ -76739,6 +77197,93 @@ function startSubagentWatcher(config) {
     terminatedAgentIds.add(agentId);
     log?.(`subagent-watcher: cleaned up terminal agent ${agentId}`);
   }
+  function recordFalseFinish(agentId, filePath, n) {
+    let size = 0;
+    try {
+      size = fs2.statSync(filePath).size;
+    } catch {}
+    const prior = falseFinishTracker.get(agentId);
+    if (prior == null && falseFinishTracker.size >= FALSE_FINISH_TRACKER_CAP) {
+      const oldest = falseFinishTracker.keys().next().value;
+      if (oldest != null)
+        falseFinishTracker.delete(oldest);
+    }
+    falseFinishTracker.set(agentId, {
+      filePath,
+      synthesisedAt: n,
+      sizeAtSynthesis: size,
+      resurrectionCount: prior?.resurrectionCount ?? 0,
+      resurrectedForThisFinish: false,
+      lost: prior?.lost ?? false
+    });
+  }
+  function resurrectAgent(agentId, filePath) {
+    const pc = pendingCloses.get(agentId);
+    if (pc != null) {
+      clearT(pc);
+      pendingCloses.delete(agentId);
+    }
+    terminatedAgentIds.delete(agentId);
+    historicalFiles.delete(filePath);
+    const existing = registry.get(agentId);
+    if (existing != null) {
+      existing.state = "running";
+      existing.historical = false;
+      existing.stallNotified = false;
+      existing.stalledAt = null;
+      existing.stallTerminalSynthesised = false;
+      existing.completionNotified = false;
+      existing.errored = false;
+      existing.errorDetail = undefined;
+      existing.lastActivityAt = nowFn();
+      knownFiles.add(filePath);
+      return;
+    }
+    knownFiles.add(filePath);
+    registerAgent(filePath, agentId);
+  }
+  function checkResurrections() {
+    const n = nowFn();
+    for (const [agentId, rec] of falseFinishTracker) {
+      if (rec.lost)
+        continue;
+      if (rec.resurrectedForThisFinish)
+        continue;
+      let size;
+      try {
+        size = fs2.statSync(rec.filePath).size;
+      } catch {
+        continue;
+      }
+      if (size <= rec.sizeAtSynthesis)
+        continue;
+      const entry = registry.get(agentId);
+      const description = entry?.description ?? "sub-agent";
+      if (rec.resurrectionCount >= MAX_RESURRECTIONS) {
+        rec.lost = true;
+        log?.(`subagent-watcher: worker ${agentId} FALSELY finalised again after a prior resurrection (resurrectionCount=${rec.resurrectionCount} >= ${MAX_RESURRECTIONS}) \u2014 NAMED AS LOST, not resurrecting again (bounded resurrection chain, issue #3023)`);
+        if (config.onWorkerLost != null) {
+          try {
+            config.onWorkerLost(agentId, description);
+          } catch (cbErr) {
+            log?.(`subagent-watcher: onWorkerLost callback error ${agentId}: ${cbErr.message}`);
+          }
+        }
+        continue;
+      }
+      rec.resurrectionCount++;
+      rec.resurrectedForThisFinish = true;
+      log?.(`subagent-watcher: RESURRECTING worker ${agentId} \u2014 JSONL resumed growing (${rec.sizeAtSynthesis} \u2192 ${size} bytes) after a false terminal synthesis; the worker is still alive, reviving its card (resurrection #${rec.resurrectionCount}, issue #3023)`);
+      if (config.onResurrect != null) {
+        try {
+          config.onResurrect(agentId, description);
+        } catch (cbErr) {
+          log?.(`subagent-watcher: onResurrect callback error ${agentId}: ${cbErr.message}`);
+        }
+      }
+      resurrectAgent(agentId, rec.filePath);
+    }
+  }
   function checkStalls() {
     const n = nowFn();
     for (const entry of registry.values()) {
@@ -76786,11 +77331,20 @@ function startSubagentWatcher(config) {
         continue;
       if (n - entry.stalledAt < silentStallTerminalMs)
         continue;
+      if (entry.inflightToolUseIds.size > 0) {
+        const totalIdleMs = n - entry.lastActivityAt;
+        if (totalIdleMs < inflightTerminalCapMs) {
+          log?.(`subagent-watcher: silent-stall terminal synthesis deferred for ${entry.agentId} \u2014 ${entry.inflightToolUseIds.size} tool call(s) still in flight, ${Math.floor(totalIdleMs / 1000)}s idle < ${Math.floor(inflightTerminalCapMs / 1000)}s cap (long-running tool, not a dead worker)`);
+          continue;
+        }
+        log?.(`subagent-watcher: in-flight deferral cap reached for ${entry.agentId} (${Math.floor(totalIdleMs / 1000)}s idle >= ${Math.floor(inflightTerminalCapMs / 1000)}s cap with ${entry.inflightToolUseIds.size} tool call(s) still unresolved) \u2014 treating as died-mid-tool, proceeding with terminal synthesis`);
+      }
       entry.stallTerminalSynthesised = true;
       entry.state = "done";
       const postStallSec = Math.floor((n - entry.stalledAt) / 1000);
       const totalIdleSec = Math.floor((n - entry.lastActivityAt) / 1000);
       log?.(`subagent-watcher: silent-stall terminal synthesis for ${entry.agentId} (stalled ${postStallSec}s post-notify, ${totalIdleSec}s total idle) \u2014 bg worker JSONL lacks turn_end; synthesising sub_agent_turn_end so deferred-completion gate releases`);
+      recordFalseFinish(entry.agentId, entry.filePath, n);
       if (db2 != null) {
         try {
           const rowRef = db2.prepare("SELECT id FROM subagents WHERE jsonl_agent_id = ?").get(entry.agentId);
@@ -76947,6 +77501,7 @@ function startSubagentWatcher(config) {
       maybySendStateTransition(agentId);
     }
     checkStalls();
+    checkResurrections();
   }
   rescanSubagentDirs();
   bootScanInProgress = false;
@@ -76954,7 +77509,16 @@ function startSubagentWatcher(config) {
     if (db2 == null)
       return;
     try {
-      const result = reapStuckRunningRows(db2, { ttlMs: reaperTtlMs, now: nowFn() });
+      const result = reapStuckRunningRows(db2, {
+        ttlMs: reaperTtlMs,
+        now: nowFn(),
+        isLive: (jsonlAgentId) => {
+          if (jsonlAgentId == null)
+            return false;
+          const entry = registry.get(jsonlAgentId);
+          return entry != null && entry.state === "running" && !entry.historical;
+        }
+      });
       if (result.reaped > 0) {
         log?.(`subagent-watcher: reaper transitioned ${result.reaped} stuck-running row(s) to stalled (ttl=${Math.round(reaperTtlMs / 60000)}min)`);
       }
@@ -77125,7 +77689,7 @@ function determineRestartReason(opts) {
 init_boot_card();
 
 // gateway/update-announce.ts
-import { existsSync as existsSync41, mkdirSync as mkdirSync32, openSync as openSync7, closeSync as closeSync7, readFileSync as readFileSync43 } from "node:fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync32, openSync as openSync8, closeSync as closeSync8, readFileSync as readFileSync43 } from "node:fs";
 import { join as join44 } from "node:path";
 import { homedir as homedir15 } from "node:os";
 
@@ -77326,8 +77890,8 @@ function claimUpdateAnnouncement(requestId, opts = {}) {
   const safeId = requestId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 200);
   const path2 = join44(dir, safeId);
   try {
-    const fd = openSync7(path2, "wx");
-    closeSync7(fd);
+    const fd = openSync8(path2, "wx");
+    closeSync8(fd);
     return true;
   } catch {
     return false;
@@ -77550,10 +78114,10 @@ import { join as join46 } from "node:path";
 
 // ../src/issues/store.ts
 import {
-  closeSync as closeSync8,
+  closeSync as closeSync9,
   existsSync as existsSync42,
   mkdirSync as mkdirSync33,
-  openSync as openSync8,
+  openSync as openSync9,
   readdirSync as readdirSync9,
   readFileSync as readFileSync45,
   renameSync as renameSync15,
@@ -77675,7 +78239,7 @@ function withLock(stateDir, fn) {
   let fd = null;
   while (fd === null) {
     try {
-      fd = openSync8(lockPath, "wx");
+      fd = openSync9(lockPath, "wx");
       try {
         writeSync5(fd, String(process.pid));
       } catch {}
@@ -77695,7 +78259,7 @@ function withLock(stateDir, fn) {
     return fn();
   } finally {
     try {
-      closeSync8(fd);
+      closeSync9(fd);
     } catch {}
     try {
       unlinkSync17(lockPath);
@@ -79117,6 +79681,40 @@ function resolveQuotaWatchTuning(env) {
 function buildQuotaClaimKey(accountLabel, transition2, chatId) {
   return `quota-watch:${accountLabel}:${transition2}:${chatId}`;
 }
+var FLEET_ROLL_ANNOUNCE_KEY = "__fleet_roll_announce__";
+var FLEET_ROLL_MAX_AGE_MS = QUOTA_WATCH_CLAIM_WINDOW_MS;
+var QUOTA_WATCH_ROLL_DEDUP_MS = QUOTA_WATCH_CLAIM_WINDOW_MS;
+function evaluateFleetRollAnnounce(args) {
+  const { roll, prev, now } = args;
+  const maxAgeMs = args.maxAgeMs ?? FLEET_ROLL_MAX_AGE_MS;
+  if (!roll)
+    return { kind: "skip", reason: "no-roll" };
+  if (prev.lastNotifiedAt >= roll.at)
+    return { kind: "skip", reason: "already-announced" };
+  if (now - roll.at > maxAgeMs)
+    return { kind: "skip", reason: "stale-roll" };
+  return {
+    kind: "notify",
+    message: buildFleetRollMessage(roll, now),
+    newState: { lastNotifiedHealth: "healthy", lastNotifiedAt: roll.at }
+  };
+}
+function buildFleetRollMessage(roll, now) {
+  const winLabel = roll.window === "5h" ? "5-hour window" : roll.window === "7d" ? "7-day window" : "quota window";
+  const pctPart = typeof roll.pct === "number" ? ` at ${fmtPct(roll.pct)}` : "";
+  const resetPart = typeof roll.exhausted_until === "number" && roll.exhausted_until > now ? ` (resets ${formatRelative(new Date(roll.exhausted_until), new Date(now))})` : "";
+  const softAvoid = roll.reason === "soft-avoid";
+  const causeLine = softAvoid ? `Proactive switch \u2014 \`${codeSpanSafe(roll.from)}\` is approaching its limits (${winLabel}${pctPart})${resetPart}, so the fleet moved early instead of hitting the wall.` : `${winLabel}${pctPart} on \`${codeSpanSafe(roll.from)}\`${resetPart}.`;
+  return [
+    `\uD83D\uDD01 **Switched fleet to \`${codeSpanSafe(roll.to)}\`**`,
+    ``,
+    causeLine,
+    `Work continues uninterrupted \u2014 agents and scheduled jobs now serve from \`${codeSpanSafe(roll.to)}\`.`,
+    ``,
+    `_Automatic broker failover${softAvoid ? " (proactive, before exhaustion)" : ""}. Run /auth for fleet status; \`/auth use ${codeSpanSafe(roll.from)}\` to switch back once it ${softAvoid ? "has headroom again" : "refills"}._`
+  ].join(`
+`);
+}
 function isLiveCorroboration(entry) {
   return entry?.result.ok === true && entry.served === "live";
 }
@@ -79142,6 +79740,16 @@ function evaluateQuotaWatchAccount(args) {
       lastNotifiedHealth: "throttling",
       lastNotifiedAt: now
     };
+    const lastRoll = args.lastRoll;
+    if (lastRoll && lastRoll.from === label && now - lastRoll.at <= QUOTA_WATCH_ROLL_DEDUP_MS && prev.lastNotifiedAt < lastRoll.at) {
+      return {
+        kind: "reconcile",
+        accountLabel: label,
+        newAccountState: newState,
+        transition: "entered-throttling",
+        reason: "roll-announced"
+      };
+    }
     return {
       kind: "notify",
       accountLabel: label,
@@ -79255,7 +79863,7 @@ function buildThrottlingMessage(agentName3, snap) {
   const activeNote = snap.isActive ? "" : `
 This is a non-active account. Consider \`/auth use ${codeSpanSafe(snap.label)}\` to switch, or keep it as a fallback reserve.`;
   const altNote = snap.isActive ? `
-Consider \`/auth use <other-account>\` if you have a healthier account, or wait for the ${winLabel} window to refill${resetStr}.` : "";
+No action needed: if usage keeps climbing, the fleet will prefer another account once this reaches the failover threshold (you'll get a switch announcement). Or switch early with \`/auth use <other-account>\`, or wait for the ${winLabel} window to refill${resetStr}.` : "";
   return [
     `\uD83D\uDFE1 **Quota approaching limit** \u2014 \`${codeSpanSafe(snap.label)}\``,
     ``,
@@ -79313,15 +79921,50 @@ function patchQuotaWatchState(current, accountLabel, accountState) {
   return { ...current, [accountLabel]: accountState };
 }
 
+// fallback-card-collapse.ts
+var CARD_COLLAPSE_MAX_AGE_MS = 5 * 60000;
+function createModelUnavailableCardRegistry(maxAgeMs = CARD_COLLAPSE_MAX_AGE_MS) {
+  const cards = new Map;
+  return {
+    record(chatId, rec) {
+      cards.set(chatId, rec);
+    },
+    take(chatId, now) {
+      const rec = cards.get(chatId);
+      if (!rec)
+        return null;
+      cards.delete(chatId);
+      if (!rec.promisedFallback)
+        return null;
+      if (now - rec.atMs > maxAgeMs)
+        return null;
+      return rec;
+    },
+    size() {
+      return cards.size;
+    }
+  };
+}
+function decideAnnouncementDelivery(outcomeKind, card) {
+  if (outcomeKind !== "switched")
+    return "send";
+  return card !== null ? "edit" : "send";
+}
+function foldAnnouncementIntoCard(cardText, announcement) {
+  return `${cardText}
+
+${announcement}`;
+}
+
 // gateway/gateway.ts
 init_auth_snapshot_format2();
 
 // gateway/turn-active-marker.ts
 import {
-  closeSync as closeSync9,
+  closeSync as closeSync10,
   existsSync as existsSync46,
   mkdirSync as mkdirSync36,
-  openSync as openSync9,
+  openSync as openSync10,
   readFileSync as readFileSync49,
   statSync as statSync13,
   unlinkSync as unlinkSync18,
@@ -79346,8 +79989,8 @@ function touchTurnActiveMarker2(stateDir) {
     utimesSync2(path2, now, now);
   } catch {
     try {
-      const fd = openSync9(path2, "r+");
-      closeSync9(fd);
+      const fd = openSync10(path2, "r+");
+      closeSync10(fd);
     } catch {}
   }
 }
@@ -79398,10 +80041,10 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.18.9";
-var COMMIT_SHA = "436289c9";
-var COMMIT_DATE = "2026-07-10T22:33:10Z";
-var LATEST_PR = 3015;
+var VERSION = "0.18.10";
+var COMMIT_SHA = "1f778844";
+var COMMIT_DATE = "2026-07-11T13:26:53+10:00";
+var LATEST_PR = 3044;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -80616,6 +81259,13 @@ When the restart hit, ${count} sub-agent${count === 1 ? " was" : "s were"} still
 ` + lines.join(`
 `) + overflow + closing;
 }
+function renderRestartCauseBlock(cause) {
+  if (!cause || cause.note.trim().length === 0)
+    return "";
+  return `
+
+Why this restart happened: ${cause.note.trim()}`;
+}
 var RESUME_SYNTHETIC_PROMPT_PREFIX = "You just restarted.";
 function isResumeSyntheticTurn(turn) {
   const p = turn.user_prompt_preview;
@@ -80648,6 +81298,8 @@ function buildResumeInterruptedInbound(ctx) {
   };
   if (ctx.turn.user_prompt_preview)
     meta.original_prompt = ctx.turn.user_prompt_preview;
+  if (ctx.restartCause)
+    meta.restart_cause = ctx.restartCause.reason;
   return {
     type: "inbound",
     chatId: ctx.turn.chat_id,
@@ -80656,7 +81308,7 @@ function buildResumeInterruptedInbound(ctx) {
     user: "switchroom",
     userId: 0,
     ts,
-    text: `You just restarted. Your previous turn was interrupted ${elapsed} ago, ` + `before it finished \u2014 it was cut off by a restart, not completed.` + promptClause(ctx.turn) + ` That quoted text is only the first ~200 characters of the original ` + `request, and you've lost your in-memory context across the restart \u2014 so ` + `BEFORE you continue, call get_recent_messages for this chat to read your ` + `full original message and the surrounding conversation, so you resume the ` + `COMPLETE task (including any instructions in the tail of a long request), ` + `not just the truncated preview. Then pick that work back up and carry it ` + `through to completion. In your first message, briefly let the user know ` + `you're resuming what was interrupted (mention roughly how long ago in ` + `plain language) so they're not left wondering \u2014 then carry on with the ` + `actual task. Do not ask whether to resume; just resume. If even after ` + `reading the recent messages you genuinely can't tell what the work was, ` + `say so and ask.` + renderInterruptedSubagentsBlock(ctx.subagents),
+    text: `You just restarted. Your previous turn was interrupted ${elapsed} ago, ` + `before it finished \u2014 it was cut off by a restart, not completed.` + promptClause(ctx.turn) + ` That quoted text is only the first ~200 characters of the original ` + `request, and you've lost your in-memory context across the restart \u2014 so ` + `BEFORE you continue, call get_recent_messages for this chat to read your ` + `full original message and the surrounding conversation, so you resume the ` + `COMPLETE task (including any instructions in the tail of a long request), ` + `not just the truncated preview. Then pick that work back up and carry it ` + `through to completion. In your first message, briefly let the user know ` + `you're resuming what was interrupted (mention roughly how long ago in ` + `plain language) so they're not left wondering \u2014 then carry on with the ` + `actual task. Do not ask whether to resume; just resume. If even after ` + `reading the recent messages you genuinely can't tell what the work was, ` + `say so and ask.` + renderInterruptedSubagentsBlock(ctx.subagents) + renderRestartCauseBlock(ctx.restartCause),
     meta
   };
 }
@@ -80679,6 +81331,8 @@ function buildResumeWatchdogReportInbound(ctx) {
     meta.tool_call_count = String(ctx.turn.tool_call_count);
   if (ctx.turn.user_prompt_preview)
     meta.original_prompt = ctx.turn.user_prompt_preview;
+  if (ctx.restartCause)
+    meta.restart_cause = ctx.restartCause.reason;
   return {
     type: "inbound",
     chatId: ctx.turn.chat_id,
@@ -80687,7 +81341,7 @@ function buildResumeWatchdogReportInbound(ctx) {
     user: "switchroom",
     userId: 0,
     ts,
-    text: `You just restarted. Your previous turn (started ${since} ago) was ` + `killed by the hang-watchdog: it made no observable progress for ${idle} ` + `and the watchdog restarts a turn that goes that long without activity.` + toolClause + promptClause(ctx.turn) + ` Do NOT silently resume it \u2014 it may hang again the same way. Instead, ` + `tell the user plainly what happened: that your last turn was killed ` + `after ${idle} of no progress, and roughly what it was doing. Then ask ` + `whether they want you to retry it or take a different angle. Report ` + `only the honest cause \u2014 no observable progress for that long \u2014 don't ` + `speculate about a deeper root cause you can't see.` + renderInterruptedSubagentsBlock(ctx.subagents, { assertive: false }),
+    text: `You just restarted. Your previous turn (started ${since} ago) was ` + `killed by the hang-watchdog: it made no observable progress for ${idle} ` + `and the watchdog restarts a turn that goes that long without activity.` + toolClause + promptClause(ctx.turn) + ` Do NOT silently resume it \u2014 it may hang again the same way. Instead, ` + `tell the user plainly what happened: that your last turn was killed ` + `after ${idle} of no progress, and roughly what it was doing. Then ask ` + `whether they want you to retry it or take a different angle. Report ` + `only the honest cause \u2014 no observable progress for that long \u2014 don't ` + `speculate about a deeper root cause you can't see.` + renderInterruptedSubagentsBlock(ctx.subagents, { assertive: false }) + renderRestartCauseBlock(ctx.restartCause),
     meta
   };
 }
@@ -80716,6 +81370,8 @@ function buildResumeDeferredReportInbound(ctx) {
   };
   if (ctx.turn.user_prompt_preview)
     meta.original_prompt = ctx.turn.user_prompt_preview;
+  if (ctx.restartCause)
+    meta.restart_cause = ctx.restartCause.reason;
   const cause = ctx.reason === "loop-guard" ? `Your previous turn was ALREADY a resume of earlier interrupted work, ` + `and it was interrupted again by another restart ${elapsed} ago. To ` + `avoid an endless restart\u2192resume loop (and re-running work that may ` + `have already partly executed), the framework has stopped ` + `auto-resuming this chain.` : `Your previous turn was interrupted ${elapsed} ago by a deliberate ` + `restart, before it finished. This agent is configured NOT to ` + `auto-resume work across deliberate restarts (boot_resume: never), so ` + `it was not replayed automatically.`;
   return {
     type: "inbound",
@@ -80725,7 +81381,7 @@ function buildResumeDeferredReportInbound(ctx) {
     user: "switchroom",
     userId: 0,
     ts,
-    text: `${RESUME_SYNTHETIC_PROMPT_PREFIX} ${cause}` + promptClause(ctx.turn) + ` Do NOT silently resume it. Instead, briefly tell the user what was in ` + `flight (call get_recent_messages for this chat if you need the full ` + `original request \u2014 the quoted preview is only the first ~200 ` + `characters), then ask whether they want you to pick it back up or drop ` + `it. If you genuinely can't tell what the work was, say so and ask.` + renderInterruptedSubagentsBlock(ctx.subagents, { assertive: false }),
+    text: `${RESUME_SYNTHETIC_PROMPT_PREFIX} ${cause}` + promptClause(ctx.turn) + ` Do NOT silently resume it. Instead, briefly tell the user what was in ` + `flight (call get_recent_messages for this chat if you need the full ` + `original request \u2014 the quoted preview is only the first ~200 ` + `characters), then ask whether they want you to pick it back up or drop ` + `it. If you genuinely can't tell what the work was, say so and ask.` + renderInterruptedSubagentsBlock(ctx.subagents, { assertive: false }) + renderRestartCauseBlock(ctx.restartCause),
     meta
   };
 }
@@ -80745,6 +81401,282 @@ function selectResumeBuilder(endedVia, opts) {
   return kind;
 }
 
+// gateway/bridge-dead-watchdog.ts
+import { readFileSync as readFileSync51, writeFileSync as writeFileSync40, renameSync as renameSync16, unlinkSync as unlinkSync19 } from "node:fs";
+
+// gateway/cron-session.ts
+var CRON_IDENTITY_SUFFIX2 = "-cron";
+function isCronIdentity2(name) {
+  return typeof name === "string" && name.endsWith(CRON_IDENTITY_SUFFIX2);
+}
+
+// gateway/bridge-dead-watchdog.ts
+var BRIDGE_DEAD_RESTART_REASON = "bridge-dead-resume";
+var DEFAULT_BRIDGE_DEAD_GRACE_MS = 90000;
+var ESCALATION_MARKER_MAX_AGE_MS = 10 * 60000;
+var MAX_CONSECUTIVE_ESCALATIONS = 2;
+var CRASH_LOG_FRESH_WINDOW_MS = 15 * 60000;
+var CRASH_LOG_TAIL_LINES = 3;
+function decideBridgeDeadEscalation(s) {
+  if (s.bridgeRegistered)
+    return { action: "skip", why: "bridge-registered" };
+  if (s.shuttingDown)
+    return { action: "skip", why: "shutting-down" };
+  if (s.alreadyEscalated)
+    return { action: "skip", why: "already-escalated" };
+  if (!s.bridgeEverRegistered && s.priorStreak >= s.maxConsecutive) {
+    return { action: "skip", why: "streak-capped" };
+  }
+  if (!s.sessionAlive)
+    return { action: "retry", why: "session-not-alive" };
+  return { action: "escalate" };
+}
+function readFreshCrashLogTail(path2, opts = {}) {
+  const nowMs2 = opts.nowMs ?? Date.now();
+  const freshWindowMs = opts.freshWindowMs ?? CRASH_LOG_FRESH_WINDOW_MS;
+  const maxLines = opts.maxLines ?? CRASH_LOG_TAIL_LINES;
+  const readFile = opts.readFile ?? ((p) => readFileSync51(p, "utf8"));
+  let raw;
+  try {
+    raw = readFile(path2);
+  } catch {
+    return null;
+  }
+  const fresh = raw.split(`
+`).filter((line) => {
+    const m = line.match(/^(\d{4}-\d{2}-\d{2}T[0-9:.]+Z)\s/);
+    if (!m)
+      return false;
+    const t = Date.parse(m[1]);
+    return Number.isFinite(t) && nowMs2 - t >= 0 && nowMs2 - t <= freshWindowMs;
+  }).slice(-maxLines);
+  if (fresh.length === 0)
+    return null;
+  return fresh.map((l) => l.slice(0, 500)).join(" || ");
+}
+function writeBridgeDeadEscalationMarker(path2, marker) {
+  const tmp = `${path2}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync40(tmp, JSON.stringify(marker), "utf8");
+  renameSync16(tmp, path2);
+}
+function consumeBridgeDeadEscalationMarker(path2, nowMs2 = Date.now(), maxAgeMs = ESCALATION_MARKER_MAX_AGE_MS) {
+  let marker = null;
+  try {
+    const parsed = JSON.parse(readFileSync51(path2, "utf8"));
+    if (typeof parsed.ts === "number" && Number.isFinite(parsed.ts) && typeof parsed.reason === "string") {
+      const age = nowMs2 - parsed.ts;
+      if (age >= 0 && age < maxAgeMs) {
+        marker = { ts: parsed.ts, reason: parsed.reason };
+        marker.count = typeof parsed.count === "number" && Number.isFinite(parsed.count) && parsed.count >= 1 ? Math.floor(parsed.count) : 1;
+        if (typeof parsed.crashTail === "string")
+          marker.crashTail = parsed.crashTail;
+      }
+    }
+  } catch {}
+  try {
+    unlinkSync19(path2);
+  } catch {}
+  return marker;
+}
+function buildBridgeDeadIdleNoticeInbound(args) {
+  const ts = args.nowMs ?? Date.now();
+  return {
+    type: "inbound",
+    chatId: args.chatId,
+    messageId: ts,
+    user: "switchroom",
+    userId: 0,
+    ts,
+    text: `You just restarted. The framework itself triggered this restart: your Telegram ` + `MCP bridge process had died (chat tools were unavailable \u2014 you could not send ` + `replies), so the container was bounced to restore the chat surface. No work was ` + `in flight when it happened. Briefly let the user know the messaging bridge died ` + `and the framework restarted you to fix it \u2014 one short message, no drama. This was ` + `NOT an operator-initiated restart and NOT a hang-watchdog kill; report only that ` + `honest cause.`,
+    meta: {
+      source: "bridge_dead_restart",
+      chat_id: args.chatId,
+      message_id: String(ts),
+      restart_cause: args.marker.reason
+    }
+  };
+}
+function isRealBridgeIdentity(agentName3) {
+  return agentName3 != null && agentName3.length > 0 && !isCronIdentity2(agentName3);
+}
+function createBridgeDeadWatchdog(opts) {
+  const setTimer = opts.setTimer ?? ((fn, ms) => {
+    const t = setTimeout(fn, ms);
+    t.unref?.();
+    return t;
+  });
+  const clearTimer = opts.clearTimer ?? ((h) => clearTimeout(h));
+  const nowMs2 = opts.nowMs ?? (() => Date.now());
+  const writeMarker = opts.writeMarker ?? writeBridgeDeadEscalationMarker;
+  const readCrashTail = opts.readCrashTail ?? ((p, t) => readFreshCrashLogTail(p, { nowMs: t }));
+  const priorStreak = opts.priorStreak ?? 0;
+  const maxConsecutive = opts.maxConsecutive ?? MAX_CONSECUTIVE_ESCALATIONS;
+  let timer3 = null;
+  let bridgeRegistered = false;
+  let bridgeEverRegistered = false;
+  let escalated = false;
+  const cancel = () => {
+    if (timer3 != null) {
+      clearTimer(timer3);
+      timer3 = null;
+    }
+  };
+  const effectiveGraceMs = () => !bridgeEverRegistered && priorStreak >= 1 ? opts.graceMs * 2 : opts.graceMs;
+  const armInternal = () => {
+    if (escalated)
+      return;
+    if (!bridgeEverRegistered && priorStreak >= maxConsecutive) {
+      opts.log(`telegram gateway: [bridge-dead-watchdog] STANDING DOWN \u2014 ${priorStreak} consecutive ` + `bridge-dead escalations already restarted this container without the bridge coming ` + `back (cap=${maxConsecutive}). The bridge is failing deterministically; a further ` + `restart will not fix it. Investigate the bridge (plugin bundle, .mcp.json, ` + `STATE_DIR/bridge-crash.log). Manual recovery: fix the cause, then restart the ` + `container. SWITCHROOM_BRIDGE_DEAD_ESCALATION=0 disables this watchdog entirely.`);
+      return;
+    }
+    cancel();
+    timer3 = setTimer(() => {
+      timer3 = null;
+      check();
+    }, effectiveGraceMs());
+  };
+  const check = () => {
+    const decision = decideBridgeDeadEscalation({
+      bridgeRegistered,
+      bridgeEverRegistered,
+      sessionAlive: opts.isSessionAlive(),
+      shuttingDown: opts.isShuttingDown(),
+      alreadyEscalated: escalated,
+      priorStreak,
+      maxConsecutive
+    });
+    if (decision.action === "retry") {
+      opts.log(`telegram gateway: [bridge-dead-watchdog] no bridge registered after ${effectiveGraceMs()}ms ` + `but claude session not found \u2014 re-arming (no escalation)`);
+      armInternal();
+      return decision;
+    }
+    if (decision.action === "skip") {
+      if (decision.why !== "bridge-registered") {
+        opts.log(`telegram gateway: [bridge-dead-watchdog] bridge missing but skipping escalation (${decision.why})`);
+      }
+      return decision;
+    }
+    escalated = true;
+    const t = nowMs2();
+    const crashTail = (() => {
+      try {
+        return readCrashTail(opts.crashLogPath, t);
+      } catch {
+        return null;
+      }
+    })();
+    const streakCount = bridgeEverRegistered ? 1 : priorStreak + 1;
+    try {
+      const marker = {
+        ts: t,
+        reason: BRIDGE_DEAD_RESTART_REASON,
+        count: streakCount
+      };
+      if (crashTail != null)
+        marker.crashTail = crashTail;
+      writeMarker(opts.markerPath, marker);
+    } catch (err) {
+      opts.log(`telegram gateway: [bridge-dead-watchdog] escalation marker write failed: ${err.message}`);
+    }
+    opts.log(`telegram gateway: [bridge-dead-watchdog] ESCALATING reason=${BRIDGE_DEAD_RESTART_REASON} ` + `consecutive=${streakCount}/${maxConsecutive} \u2014 ` + `no MCP bridge registered within ${effectiveGraceMs()}ms grace window while the claude session is alive ` + `(Claude Code never respawns a dead MCP server; bouncing the container to restore the chat surface). ` + (crashTail != null ? `bridge-crash.log tail: ${crashTail}` : `no fresh bridge-crash.log entries`));
+    const fired = opts.escalate(BRIDGE_DEAD_RESTART_REASON);
+    if (!fired) {
+      opts.log(`telegram gateway: [bridge-dead-watchdog] escalate() reported failure \u2014 ` + `restart not dispatched (fuse stays blown; no retry this boot)`);
+    }
+    return decision;
+  };
+  return {
+    arm: armInternal,
+    noteBridgeRegistered: (agentName3) => {
+      if (!isRealBridgeIdentity(agentName3))
+        return;
+      bridgeRegistered = true;
+      bridgeEverRegistered = true;
+      cancel();
+    },
+    noteBridgeDisconnected: (agentName3) => {
+      if (!isRealBridgeIdentity(agentName3))
+        return;
+      bridgeRegistered = false;
+      armInternal();
+    },
+    check,
+    stop: cancel,
+    hasEscalated: () => escalated
+  };
+}
+
+// gateway/boot-probes.ts
+import { readFileSync as readFileSync52, readdirSync as readdirSync10, existsSync as existsSync48 } from "fs";
+init_quota_cache();
+init_quota_check();
+import { execFile as execFileCb2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCb2);
+var realProcFs2 = {
+  readdir: (p) => readdirSync10(p),
+  readFile: (p) => readFileSync52(p, "utf-8")
+};
+function findAgentProcessInContainer2(fs3 = realProcFs2) {
+  let entries;
+  try {
+    entries = fs3.readdir("/proc");
+  } catch {
+    return null;
+  }
+  const candidates = [];
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry))
+      continue;
+    const pid = Number(entry);
+    if (!Number.isFinite(pid) || pid <= 0)
+      continue;
+    if (pid === process.pid)
+      continue;
+    let comm = "";
+    try {
+      comm = fs3.readFile(`/proc/${pid}/comm`).trim();
+    } catch {
+      continue;
+    }
+    let rssKb = 0;
+    try {
+      const status = fs3.readFile(`/proc/${pid}/status`);
+      const m = status.match(/^VmRSS:\s+(\d+)/m);
+      if (m)
+        rssKb = parseInt(m[1], 10) || 0;
+    } catch {
+      continue;
+    }
+    let starttime = 0;
+    try {
+      const stat = fs3.readFile(`/proc/${pid}/stat`);
+      const close = stat.lastIndexOf(")");
+      const tail = close >= 0 ? stat.slice(close + 2) : stat;
+      const fields = tail.trim().split(/\s+/);
+      const st = Number(fields[19]);
+      if (Number.isFinite(st) && st > 0)
+        starttime = st;
+    } catch {
+      continue;
+    }
+    candidates.push({ pid, rssKb, comm, starttime });
+  }
+  if (candidates.length === 0)
+    return null;
+  const isAgent = (c) => c.comm === "claude";
+  const isWrapper = (c) => c.comm === "tmux" || c.comm.startsWith("tmux:") || c.comm === "expect" || c.comm === "script" || c.comm === "bash" || c.comm === "sh" || c.comm === "tini" || c.comm === "sleep";
+  const claudeMatches = candidates.filter(isAgent);
+  if (claudeMatches.length > 0) {
+    claudeMatches.sort((a, b) => b.rssKb - a.rssKb);
+    return claudeMatches[0];
+  }
+  const nodeMatches = candidates.filter((c) => c.comm === "node" && !isWrapper(c)).sort((a, b) => b.rssKb - a.rssKb);
+  if (nodeMatches.length > 0)
+    return nodeMatches[0];
+  return null;
+}
+
 // registry/subagents-schema.ts
 var SUBAGENTS_SCHEMA_SQL = `
   CREATE TABLE IF NOT EXISTS subagents (
@@ -80900,7 +81832,7 @@ function alwaysAllowDrainDeps() {
   return {
     readConfigText: () => {
       const cfgPath = process.env.SWITCHROOM_CONFIG ?? SWITCHROOM_CONFIG ?? findConfigFile2();
-      return readFileSync51(cfgPath, "utf8");
+      return readFileSync53(cfgPath, "utf8");
     },
     resolveAllowList: (_configText, agentName3) => {
       const cfg = loadConfig2();
@@ -81011,6 +81943,13 @@ function triggerSelfRestart(targetAgent, reason, delayMs = 300) {
     return false;
   }
 }
+{
+  const bootSmDir = resolveAgentDirFromEnv();
+  if (bootSmDir != null && clearStaleGatewayShutdownIntent(bootSmDir)) {
+    process.stderr.write(`telegram gateway: cleared stale gateway-shutdown relaunch-model intent (previous bounce was gateway-only \u2014 container never restarted)
+`);
+  }
+}
 var cachedClaudeCliVersion = undefined;
 function getClaudeCliVersion() {
   if (cachedClaudeCliVersion !== undefined)
@@ -81040,7 +81979,7 @@ function formatBootVersion() {
 }
 try {
   chmodSync8(ENV_FILE, 384);
-  for (const line of readFileSync51(ENV_FILE, "utf8").split(`
+  for (const line of readFileSync53(ENV_FILE, "utf8").split(`
 `)) {
     const m = line.match(/^(\w+)=(.*)$/);
     if (m && process.env[m[1]] === undefined)
@@ -81105,7 +82044,7 @@ bot.api.config.use(async (prev, method, payload, signal) => {
 });
 var GRAMMY_VERSION = (() => {
   try {
-    const raw = readFileSync51(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
+    const raw = readFileSync53(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -81191,7 +82130,7 @@ function assertSendable(f) {
 }
 function readAccessFile() {
   try {
-    const raw = readFileSync51(ACCESS_FILE, "utf8");
+    const raw = readFileSync53(ACCESS_FILE, "utf8");
     const parsed = JSON.parse(raw);
     const allowFrom = validateStringArray("allowFrom", parsed.allowFrom ?? []);
     const groups = {};
@@ -81229,7 +82168,7 @@ function readAccessFile() {
     if (err.code === "ENOENT")
       return defaultAccess();
     try {
-      renameSync16(ACCESS_FILE, `${ACCESS_FILE}.corrupt-${Date.now()}`);
+      renameSync17(ACCESS_FILE, `${ACCESS_FILE}.corrupt-${Date.now()}`);
     } catch {}
     process.stderr.write(`telegram gateway: access.json is corrupt, moved aside. Starting fresh.
 `);
@@ -81251,7 +82190,7 @@ function loadAccess() {
 }
 function readPeopleFile() {
   try {
-    const raw = readFileSync51(PEOPLE_FILE, "utf8");
+    const raw = readFileSync53(PEOPLE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.entries))
       return [];
@@ -81275,9 +82214,9 @@ function saveAccess(a) {
     return;
   mkdirSync39(STATE_DIR, { recursive: true, mode: 448 });
   const tmp = ACCESS_FILE + ".tmp";
-  writeFileSync41(tmp, JSON.stringify(a, null, 2) + `
+  writeFileSync42(tmp, JSON.stringify(a, null, 2) + `
 `, { mode: 384 });
-  renameSync16(tmp, ACCESS_FILE);
+  renameSync17(tmp, ACCESS_FILE);
 }
 function pruneExpired(a) {
   const now = Date.now();
@@ -81304,6 +82243,7 @@ if (HISTORY_ENABLED) {
 }
 var turnsDb = null;
 var bootResumeInbound = null;
+var bridgeDeadPriorStreak = 0;
 try {
   const agentDir = STATE_DIR.endsWith("/telegram") ? STATE_DIR.slice(0, -"/telegram".length) : STATE_DIR;
   turnsDb = openTurnsDb(agentDir);
@@ -81312,11 +82252,11 @@ try {
   let markerAgeMs = null;
   try {
     const markerPath = join53(STATE_DIR, TURN_ACTIVE_MARKER_FILE2);
-    if (existsSync49(markerPath)) {
+    if (existsSync50(markerPath)) {
       const st = statSync16(markerPath);
       markerAgeMs = Date.now() - st.mtimeMs;
       try {
-        const payload = JSON.parse(readFileSync51(markerPath, "utf8"));
+        const payload = JSON.parse(readFileSync53(markerPath, "utf8"));
         if (typeof payload.turnKey === "string" && payload.turnKey.length > 0) {
           markerTurnKey = payload.turnKey;
         }
@@ -81339,6 +82279,16 @@ try {
     process.stderr.write(`telegram gateway: turn-registry initialized at ${join53(agentDir, "telegram", "registry.db")}
 `);
   }
+  const bridgeDeadMarker = consumeBridgeDeadEscalationMarker(join53(STATE_DIR, "bridge-dead-escalation.json"));
+  if (bridgeDeadMarker != null) {
+    bridgeDeadPriorStreak = bridgeDeadMarker.count ?? 1;
+    process.stderr.write(`telegram gateway: boot: prior restart was a bridge-dead escalation (reason=${bridgeDeadMarker.reason}, consecutive=${bridgeDeadPriorStreak}${bridgeDeadMarker.crashTail ? `, crashTail=${bridgeDeadMarker.crashTail}` : ""})
+`);
+  }
+  const bridgeDeadRestartCause = bridgeDeadMarker != null ? {
+    reason: bridgeDeadMarker.reason,
+    note: "The framework itself triggered this restart: your Telegram MCP bridge process had died " + "(chat tools were unavailable \u2014 you could not send replies), so the container was bounced " + "to restore the chat surface. This was NOT an operator-initiated restart and NOT a hang-watchdog kill."
+  } : undefined;
   const pending2 = findLatestTurnIfInterrupted(turnsDb);
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? "";
   if (pending2 != null && selfAgent) {
@@ -81370,7 +82320,11 @@ try {
     if (bootResumeKind === "resume") {
       bootResumeInbound = {
         agent: selfAgent,
-        msg: buildResumeInterruptedInbound({ turn: pending2, subagents: interruptedSubagents })
+        msg: buildResumeInterruptedInbound({
+          turn: pending2,
+          subagents: interruptedSubagents,
+          restartCause: bridgeDeadRestartCause
+        })
       };
     } else if (bootResumeKind === "report") {
       let idleMs = pending2.turn_key === timeoutTurnKey && markerAgeMs != null ? markerAgeMs : null;
@@ -81385,7 +82339,12 @@ try {
         idleMs = Math.max(0, Date.now() - pending2.started_at);
       bootResumeInbound = {
         agent: selfAgent,
-        msg: buildResumeWatchdogReportInbound({ turn: pending2, idleMs, subagents: interruptedSubagents })
+        msg: buildResumeWatchdogReportInbound({
+          turn: pending2,
+          idleMs,
+          subagents: interruptedSubagents,
+          restartCause: bridgeDeadRestartCause
+        })
       };
     } else if (bootResumeKind === "defer-loop" || bootResumeKind === "defer-suppressed") {
       bootResumeInbound = {
@@ -81393,7 +82352,8 @@ try {
         msg: buildResumeDeferredReportInbound({
           turn: pending2,
           reason: bootResumeKind === "defer-loop" ? "loop-guard" : "clean-restart-suppressed",
-          subagents: interruptedSubagents
+          subagents: interruptedSubagents,
+          restartCause: bridgeDeadRestartCause
         })
       };
     }
@@ -81406,6 +82366,29 @@ try {
     }
     if (bootResumeInbound != null) {
       process.stderr.write(`telegram gateway: boot-resume queued kind=${bootResumeKind} mode=${bootResumeMode} turnKey=${pending2.turn_key} endedVia=${pending2.ended_via ?? "open"} chat=${pending2.chat_id}
+`);
+    }
+  }
+  if (bridgeDeadMarker != null && bootResumeInbound == null && selfAgent) {
+    const idleNoticeChat = (() => {
+      try {
+        return loadAccess().allowFrom[0] ?? null;
+      } catch {
+        return null;
+      }
+    })();
+    if (idleNoticeChat != null) {
+      bootResumeInbound = {
+        agent: selfAgent,
+        msg: buildBridgeDeadIdleNoticeInbound({
+          chatId: String(idleNoticeChat),
+          marker: bridgeDeadMarker
+        })
+      };
+      process.stderr.write(`telegram gateway: boot: bridge-dead idle notice queued chat=${idleNoticeChat} (no turn was in flight)
+`);
+    } else {
+      process.stderr.write(`telegram gateway: boot: bridge-dead idle notice skipped \u2014 no allowFrom chat to surface it in
 `);
     }
   }
@@ -81423,13 +82406,13 @@ try {
         pending2.interrupt_reason != null ? `SWITCHROOM_PENDING_INTERRUPT_REASON=${pending2.interrupt_reason}` : `SWITCHROOM_PENDING_INTERRUPT_REASON=`
       ];
       const pendingEnvTmp = `${pendingEnvPath}.tmp-${process.pid}`;
-      writeFileSync41(pendingEnvTmp, lines.join(`
+      writeFileSync42(pendingEnvTmp, lines.join(`
 `) + `
 `, { mode: 384 });
-      renameSync16(pendingEnvTmp, pendingEnvPath);
+      renameSync17(pendingEnvTmp, pendingEnvPath);
       process.stderr.write(`telegram gateway: pending-turn env written to ${pendingEnvPath} turnKey=${pending2.turn_key} endedVia=${pending2.ended_via ?? "open"}
 `);
-    } else if (existsSync49(pendingEnvPath)) {
+    } else if (existsSync50(pendingEnvPath)) {
       rmSync5(pendingEnvPath, { force: true });
       process.stderr.write(`telegram gateway: pending-turn env cleared (clean previous shutdown)
 `);
@@ -81520,7 +82503,7 @@ if (!STATIC) {
 function checkApprovals() {
   let files;
   try {
-    files = readdirSync11(APPROVED_DIR);
+    files = readdirSync12(APPROVED_DIR);
   } catch {
     return;
   }
@@ -81631,10 +82614,10 @@ function noteAgentOutputAt(key, ts) {
 }
 var OBLIGATION_STORE_PATH = join53(STATE_DIR, "obligations.json");
 var obligationStoreFs = {
-  readFileSync: (p) => readFileSync51(p, "utf8"),
-  writeFileSync: (p, d) => writeFileSync41(p, d),
-  renameSync: (a, b) => renameSync16(a, b),
-  existsSync: (p) => existsSync49(p)
+  readFileSync: (p) => readFileSync53(p, "utf8"),
+  writeFileSync: (p, d) => writeFileSync42(p, d),
+  renameSync: (a, b) => renameSync17(a, b),
+  existsSync: (p) => existsSync50(p)
 };
 var obligationLedger = new ObligationLedger(OBLIGATION_REPRESENT_MAX, {
   onChange: STATIC || !OBLIGATION_LEDGER_ENABLED ? undefined : (snapshot) => persistObligations(OBLIGATION_STORE_PATH, obligationStoreFs, snapshot)
@@ -81741,6 +82724,8 @@ async function deliverButtonTapInbound(agent, inbound) {
   return "buffered-bridge-offline";
 }
 var pendingRestarts = new Map;
+var pendingSessionCommand = createPendingSessionCommandSlots();
+var PENDING_CMD_DRAIN_CAP_MS = 60000;
 var lastSessionActiveFile = null;
 var compactState = initialCompactState();
 var compactDispatching = false;
@@ -82072,6 +83057,119 @@ async function fireDeferredInterrupt(reason) {
 `);
   }
 }
+var haltBoundaryWaiters = new Set;
+function notifyHaltBoundaryWaiters() {
+  if (haltBoundaryWaiters.size === 0)
+    return;
+  for (const check of [...haltBoundaryWaiters])
+    check();
+}
+function waitForSafeBoundary(maxWaitMs) {
+  if (!toolFlightTracker.isMidToolCall())
+    return Promise.resolve("boundary");
+  return new Promise((resolve11) => {
+    let done = false;
+    const finish = (reason) => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer3);
+      haltBoundaryWaiters.delete(check);
+      resolve11(reason);
+    };
+    const timer3 = setTimeout(() => finish("timeout"), maxWaitMs);
+    const check = () => {
+      if (!toolFlightTracker.isMidToolCall())
+        finish("boundary");
+    };
+    haltBoundaryWaiters.add(check);
+  });
+}
+function cancelPendingPermissionsForHalt(origin) {
+  if (pendingPermissions.size === 0)
+    return;
+  for (const [requestId, details] of pendingPermissions) {
+    dispatchPermissionVerdict({
+      type: "permission",
+      requestId,
+      behavior: "deny",
+      message: "Cancelled \u2014 the operator stopped this turn. Do not retry."
+    });
+    stripCancelledPermissionCards(details.card_text, details.cards);
+    pendingPermissions.delete(requestId);
+    permCardStore.remove(requestId);
+    process.stderr.write(`telegram gateway: halt-now cancelled pending permission origin=${origin} request=${requestId} tool=${details.tool_name}
+`);
+  }
+}
+async function stripCancelledPermissionCards(cardText, cards) {
+  for (const edit of buildCancelledCardEdits(cardText, cards)) {
+    await swallowingApiCall(() => bot.api.editMessageText(edit.chatId, edit.messageId, richMessage2(edit.text), {}), { chat_id: edit.chatId, verb: "permission_halt.strip" });
+  }
+}
+async function executeHaltNow(origin) {
+  const agentName3 = process.env.SWITCHROOM_AGENT_NAME;
+  if (!agentName3)
+    return;
+  const haltTarget = currentTurn;
+  const haltTargetKey = haltTarget?.registryKey ?? null;
+  const access = loadAccess();
+  const timing = decideInterruptTiming({
+    safeBoundaryEnabled: resolveSafeBoundaryEnabled(access.interruptSafeBoundary),
+    midToolCall: toolFlightTracker.isMidToolCall()
+  });
+  const startedAt = Date.now();
+  if (timing === "defer") {
+    const maxWaitMs = resolveInterruptMaxWaitMs(access.interruptMaxWaitMs);
+    const reason = await waitForSafeBoundary(maxWaitMs);
+    process.stderr.write(`telegram gateway: halt-now boundary-wait origin=${origin} reason=${reason} waited_ms=${Date.now() - startedAt} in_flight=${toolFlightTracker.inFlightCount()}
+`);
+  }
+  if (currentTurn !== haltTarget) {
+    process.stderr.write(`telegram gateway: halt-now skipped \u2014 turn changed during boundary wait ` + `origin=${origin} target_key=${haltTargetKey ?? "none"} current_key=${currentTurn?.registryKey ?? "none"}
+`);
+    return;
+  }
+  try {
+    const { sendAgentInterrupt: sendAgentInterrupt2 } = await Promise.resolve().then(() => (init_tmux(), exports_tmux));
+    const r = sendAgentInterrupt2({ agentName: agentName3 });
+    if ("ok" in r) {
+      process.stderr.write(`telegram gateway: halt-now SIGINT delivered via tmux send-keys origin=${origin} agent=${agentName3}
+`);
+    } else {
+      process.stderr.write(`telegram gateway: halt-now SIGINT via tmux failed origin=${origin} agent=${agentName3}: ${r.error}
+`);
+    }
+  } catch (err) {
+    process.stderr.write(`telegram gateway: halt-now SIGINT failed origin=${origin}: ${err.message}
+`);
+  }
+  cancelInterruptedObligation();
+  cancelPendingPermissionsForHalt(origin);
+  const turn = currentTurn;
+  if (turn != null) {
+    if (turnsDb != null && turn.registryKey != null) {
+      const _turnKey = turn.registryKey;
+      try {
+        recordTurnEnd(turnsDb, {
+          turnKey: _turnKey,
+          endedVia: "stop",
+          lastAssistantMsgId: turn.lastAssistantMsgId,
+          lastAssistantDone: turn.lastAssistantDone,
+          toolCallCount: turn.toolCallCount
+        });
+      } catch (err) {
+        process.stderr.write(`telegram gateway: recordTurnEnd(halt) failed turnKey=${_turnKey}: ${err.message}
+`);
+      }
+    }
+    const key = statusKey(turn.sessionChatId, turn.sessionThreadId);
+    endCurrentTurnAtomic(turn);
+    releaseTurnBufferGate(key, turn);
+  }
+  if (!turnInFlightForGate())
+    drainPendingSessionCommand();
+}
 var preambleSuppressor = new PreambleSuppressor({
   emitAnswer: (cumulative) => {
     const stream = currentTurn?.answerStream ?? null;
@@ -82194,6 +83292,7 @@ function purgeReactionTracking(key, endingTurn) {
   }
   drainBufferedIfAllowed(endingTurn, "turn-complete");
   if (!turnInFlightForGate()) {
+    drainPendingSessionCommand();
     if (pendingRestarts.size > 0) {
       for (const [agentName3, _timestamp] of pendingRestarts.entries()) {
         triggerSelfRestart(agentName3, "turn-complete-pending-restart");
@@ -82258,7 +83357,7 @@ function emitTurnRecord(turn, endedAt) {
           return;
         }
       },
-      rename: (from, to) => renameSync16(from, to)
+      rename: (from, to) => renameSync17(from, to)
     });
     appendFileSync6(turnsPath, rec);
   } catch {}
@@ -83357,6 +84456,17 @@ var pendingStateReaper = setInterval(() => {
       triggerSelfRestart(agentName3, "restart-drain-cap-forced", 100);
     }
   }
+  const queuedCmds = pendingSessionCommand.list();
+  const cmdDecision = drainCapDecision(queuedCmds, now, PENDING_CMD_DRAIN_CAP_MS, turnInFlightForGate());
+  if (cmdDecision === "defer-turn-in-flight") {
+    process.stderr.write(`telegram gateway: [pending-cmd-drain] deferred reason=turn-in-flight queued=${queuedCmds.map((c) => c.kind).join(",")}
+`);
+  } else if (cmdDecision === "force") {
+    const oldest = Math.min(...queuedCmds.map((c) => c.requestedAt));
+    process.stderr.write(`telegram gateway: [pending-cmd-drain] forcing queued=${queuedCmds.map((c) => `${c.kind}:${c.targetLabel}`).join(",")} waited=${Math.round((now - oldest) / 1000)}s threshold=${Math.round(PENDING_CMD_DRAIN_CAP_MS / 1000)}s
+`);
+    drainPendingSessionCommand();
+  }
 }, 60000);
 pendingStateReaper.unref();
 function looksLikeAuthCode(text5) {
@@ -83410,6 +84520,7 @@ function emitGatewayOperatorEvent(event) {
   const modelUnavailable = resolveModelUnavailableFromOperatorEvent(event);
   let renderedText;
   let renderedKeyboard;
+  let cardPromisedFallback = false;
   if (modelUnavailable) {
     const isAutoKind = modelUnavailable.kind === "quota_exhausted";
     const willActuallyFire = isAutoKind && wouldFireFleetAutoFallback();
@@ -83419,6 +84530,7 @@ function emitGatewayOperatorEvent(event) {
       autoFallbackInFlight: willActuallyFire
     });
     renderedKeyboard = undefined;
+    cardPromisedFallback = willActuallyFire;
     if (willActuallyFire) {
       const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime());
       fireFleetAutoFallback(agent, untilMs);
@@ -83450,7 +84562,16 @@ function emitGatewayOperatorEvent(event) {
       ...renderedKeyboard ? { reply_markup: renderedKeyboard } : {},
       ...opEventThread != null ? { message_thread_id: opEventThread } : {}
     };
-    bot.api.sendRichMessage(chat_id, richMessage2(renderedText), opts).catch((e) => {
+    bot.api.sendRichMessage(chat_id, richMessage2(renderedText), opts).then((sent) => {
+      if (cardPromisedFallback) {
+        modelUnavailableCardRegistry.record(String(chat_id), {
+          messageId: sent.message_id,
+          text: renderedText,
+          atMs: Date.now(),
+          promisedFallback: true
+        });
+      }
+    }).catch((e) => {
       process.stderr.write(`telegram gateway: operator-event send to ${chat_id} failed agent=${agent} kind=${kind}: ${e}
 `);
     });
@@ -83512,18 +84633,18 @@ var statusPinChatIds = new Map;
 var statusPinPinnedAt = new Map;
 var STATUS_PIN_STORE_PATH = join53(STATE_DIR, "status-pins.json");
 var statusPinStoreFs = {
-  readFileSync: (p) => readFileSync51(p, "utf8"),
-  writeFileSync: (p, d) => writeFileSync41(p, d),
-  renameSync: (a, b) => renameSync16(a, b),
-  existsSync: (p) => existsSync49(p)
+  readFileSync: (p) => readFileSync53(p, "utf8"),
+  writeFileSync: (p, d) => writeFileSync42(p, d),
+  renameSync: (a, b) => renameSync17(a, b),
+  existsSync: (p) => existsSync50(p)
 };
 var statusPinPersistEnabled = !STATIC && PIN_STATUS_WHILE_WORKING;
 var ACTIVITY_CARD_STORE_PATH = join53(STATE_DIR, "activity-cards-pending.json");
 var activityCardStoreFs = {
-  readFileSync: (p) => readFileSync51(p, "utf8"),
-  writeFileSync: (p, d) => writeFileSync41(p, d),
-  renameSync: (a, b) => renameSync16(a, b),
-  existsSync: (p) => existsSync49(p)
+  readFileSync: (p) => readFileSync53(p, "utf8"),
+  writeFileSync: (p, d) => writeFileSync42(p, d),
+  renameSync: (a, b) => renameSync17(a, b),
+  existsSync: (p) => existsSync50(p)
 };
 var activityCardPersistEnabled = !STATIC;
 var bannerPinPersistEnabled = !STATIC;
@@ -84167,10 +85288,10 @@ var inboundSpool = STATIC ? undefined : createInboundSpool({
   path: join53(STATE_DIR, "inbound-spool.jsonl"),
   fs: {
     appendFileSync: (p, d) => appendFileSync6(p, d),
-    readFileSync: (p) => readFileSync51(p, "utf8"),
-    writeFileSync: (p, d) => writeFileSync41(p, d),
-    renameSync: (a, b) => renameSync16(a, b),
-    existsSync: (p) => existsSync49(p),
+    readFileSync: (p) => readFileSync53(p, "utf8"),
+    writeFileSync: (p, d) => writeFileSync42(p, d),
+    renameSync: (a, b) => renameSync17(a, b),
+    existsSync: (p) => existsSync50(p),
     statSizeSync: (p) => statSync16(p).size
   },
   onDegraded: (info) => {
@@ -84351,6 +85472,27 @@ async function stripStalePermissionCard(card) {
 `);
   }
 }
+var BRIDGE_DEAD_ESCALATION_ENABLED = process.env.SWITCHROOM_BRIDGE_DEAD_ESCALATION !== "0";
+var BRIDGE_DEAD_GRACE_MS = (() => {
+  const v = Number(process.env.SWITCHROOM_BRIDGE_DEAD_GRACE_MS);
+  return Number.isFinite(v) && v > 0 ? v : DEFAULT_BRIDGE_DEAD_GRACE_MS;
+})();
+var bridgeDeadWatchdog = createBridgeDeadWatchdog({
+  graceMs: BRIDGE_DEAD_GRACE_MS,
+  isSessionAlive: () => findAgentProcessInContainer2()?.comm === "claude",
+  isShuttingDown: () => shuttingDown,
+  escalate: (reason) => triggerSelfRestart(process.env.SWITCHROOM_AGENT_NAME ?? "", reason, 1500),
+  crashLogPath: join53(STATE_DIR, "bridge-crash.log"),
+  markerPath: join53(STATE_DIR, "bridge-dead-escalation.json"),
+  log: (line) => process.stderr.write(`${line}
+`),
+  priorStreak: bridgeDeadPriorStreak
+});
+if (BRIDGE_DEAD_ESCALATION_ENABLED) {
+  bridgeDeadWatchdog.arm();
+  process.stderr.write(`telegram gateway: [bridge-dead-watchdog] armed (grace=${BRIDGE_DEAD_GRACE_MS}ms)
+`);
+}
 var ipcServer = createIpcServer({
   socketPath: SOCKET_PATH,
   onClientRegistered(client3) {
@@ -84367,6 +85509,7 @@ var ipcServer = createIpcServer({
       return;
     }
     const bridgeUpEffects = client3.agentName != null ? shadowEmit({ kind: "bridgeUp", at: Date.now() }) : [];
+    bridgeDeadWatchdog.noteBridgeRegistered(client3.agentName);
     client3.send({ type: "status", status: "agent_connected" });
     if (client3.agentName != null) {
       if (isDispatchEnabled()) {
@@ -84498,6 +85641,8 @@ var ipcServer = createIpcServer({
       process.stderr.write(`telegram gateway: bridge disconnected \u2014 agent=${client3.agentName}
 `);
       shadowEmit({ kind: "bridgeDown", at: Date.now() });
+      if (BRIDGE_DEAD_ESCALATION_ENABLED)
+        bridgeDeadWatchdog.noteBridgeDisconnected(client3.agentName);
     }
     flushOnAgentDisconnect({
       agentName: client3.agentName,
@@ -84552,6 +85697,7 @@ var ipcServer = createIpcServer({
     if (pendingDeferredInterrupt != null && !toolFlightTracker.isMidToolCall()) {
       fireDeferredInterrupt("boundary");
     }
+    notifyHaltBoundaryWaiters();
     if (currentTurn != null) {
       const key = statusKey(currentTurn.sessionChatId, currentTurn.sessionThreadId);
       if (ev.kind === "thinking") {
@@ -85948,20 +87094,58 @@ ${url}`;
       turn2.silentAnchorText = effectiveText;
     }
   }
-  const allPhotos = files.length >= 2 && files.length <= 10 && files.every((f) => PHOTO_EXTS.has(extname(f).toLowerCase()));
+  const photoPrecheck = new Map;
+  const documentReroutes = [];
+  const sentAsDocument = new Set;
+  for (const f of files) {
+    if (!PHOTO_EXTS.has(extname(f).toLowerCase()))
+      continue;
+    const cls = classifyPhotoFile(f);
+    photoPrecheck.set(f, cls);
+    if (cls.route === "document") {
+      documentReroutes.push({ path: f, reason: cls.reason });
+      sentAsDocument.add(f);
+      process.stderr.write(`telegram gateway: photo-precheck rerouting ${f} as document (${cls.reason})
+`);
+    }
+  }
+  const sendableAsPhoto = (f) => PHOTO_EXTS.has(extname(f).toLowerCase()) && photoPrecheck.get(f)?.route !== "document";
+  const allPhotos = files.length >= 2 && files.length <= 10 && files.every(sendableAsPhoto);
   const replyParams = reply_to != null && replyMode !== "off" ? { reply_parameters: { message_id: reply_to } } : {};
+  const sendAsDocument = (f) => retryWithThreadFallback2(robustApiCall, (tid) => {
+    const baseOpts = {
+      ...replyParams,
+      ...tid != null ? { message_thread_id: tid } : {}
+    };
+    return lockedBot.api.sendDocument(chat_id, new import_grammy13.InputFile(f), baseOpts);
+  }, { threadId, chat_id, verb: "sendDocument" });
   if (allPhotos) {
     const media = files.map((f) => ({
       type: "photo",
       media: new import_grammy13.InputFile(f)
     }));
-    const sent = await retryWithThreadFallback2(robustApiCall, (tid) => {
-      const baseOpts = {
-        ...replyParams,
-        ...tid != null ? { message_thread_id: tid } : {}
-      };
-      return lockedBot.api.sendMediaGroup(chat_id, media, baseOpts);
-    }, { threadId, chat_id, verb: "sendMediaGroup" });
+    let sent;
+    try {
+      sent = await retryWithThreadFallback2(robustApiCall, (tid) => {
+        const baseOpts = {
+          ...replyParams,
+          ...tid != null ? { message_thread_id: tid } : {}
+        };
+        return lockedBot.api.sendMediaGroup(chat_id, media, baseOpts);
+      }, { threadId, chat_id, verb: "sendMediaGroup" });
+    } catch (err) {
+      if (!isPhotoDimensionRejectError(err))
+        throw err;
+      process.stderr.write(`telegram gateway: sendMediaGroup rejected the photo album (${err instanceof Error ? err.message : String(err)}); falling back to per-file sendDocument
+`);
+      sent = [];
+      const albumReason = "Telegram rejected the photo album; whole album re-sent as documents";
+      for (const f of files) {
+        sent.push(await sendAsDocument(f));
+        sentAsDocument.add(f);
+        documentReroutes.push({ path: f, reason: albumReason });
+      }
+    }
     if (threadId != null) {
       const first = sent[0];
       if (first && first.message_thread_id == null)
@@ -85971,23 +87155,33 @@ ${url}`;
       sentIds.push(m.message_id);
   } else {
     for (const f of files) {
-      const ext = extname(f).toLowerCase();
       const input = new import_grammy13.InputFile(f);
-      const isPhoto = PHOTO_EXTS.has(ext);
-      const sent = await retryWithThreadFallback2(robustApiCall, (tid) => {
-        const baseOpts = {
-          ...replyParams,
-          ...tid != null ? { message_thread_id: tid } : {}
-        };
-        return isPhoto ? lockedBot.api.sendPhoto(chat_id, input, baseOpts) : lockedBot.api.sendDocument(chat_id, input, baseOpts);
-      }, { threadId, chat_id, verb: isPhoto ? "sendPhoto" : "sendDocument" });
+      const isPhoto = sendableAsPhoto(f);
+      let sent;
+      try {
+        sent = await retryWithThreadFallback2(robustApiCall, (tid) => {
+          const baseOpts = {
+            ...replyParams,
+            ...tid != null ? { message_thread_id: tid } : {}
+          };
+          return isPhoto ? lockedBot.api.sendPhoto(chat_id, input, baseOpts) : lockedBot.api.sendDocument(chat_id, input, baseOpts);
+        }, { threadId, chat_id, verb: isPhoto ? "sendPhoto" : "sendDocument" });
+      } catch (err) {
+        if (!(isPhoto && isPhotoDimensionRejectError(err)))
+          throw err;
+        process.stderr.write(`telegram gateway: sendPhoto rejected ${f} (${err instanceof Error ? err.message : String(err)}); falling back to sendDocument
+`);
+        sent = await sendAsDocument(f);
+        sentAsDocument.add(f);
+        documentReroutes.push({ path: f, reason: "Telegram rejected it as a photo; re-sent as document" });
+      }
       if (threadId != null && sent.message_thread_id == null) {
         threadId = undefined;
       }
       sentIds.push(sent.message_id);
     }
   }
-  const result = sentIds.length === 1 ? `sent (id: ${sentIds[0]})` : `sent ${sentIds.length} parts (ids: ${sentIds.join(", ")})`;
+  const result = (sentIds.length === 1 ? `sent (id: ${sentIds[0]})` : `sent ${sentIds.length} parts (ids: ${sentIds.join(", ")})`) + rerouteResultSuffix(documentReroutes);
   if (HISTORY_ENABLED && sentIds.length > 0) {
     try {
       const fileCount = files.length;
@@ -85999,9 +87193,11 @@ ${url}`;
         attachKinds.push(null);
       }
       for (let i = 0;i < fileCount; i++) {
-        const ext = extname(files[i] ?? "").toLowerCase();
-        texts.push(`(${PHOTO_EXTS.has(ext) ? "photo" : "document"}: ${files[i]})`);
-        attachKinds.push(PHOTO_EXTS.has(ext) ? "photo" : "document");
+        const f = files[i] ?? "";
+        const ext = extname(f).toLowerCase();
+        const kind = PHOTO_EXTS.has(ext) && !sentAsDocument.has(f) ? "photo" : "document";
+        texts.push(`(${kind}: ${f})`);
+        attachKinds.push(kind);
       }
       recordOutbound({ chat_id, thread_id: threadId ?? null, message_ids: sentIds, texts, attachment_kinds: attachKinds });
     } catch (err) {
@@ -86262,8 +87458,8 @@ async function publishToTelegraph(text5, shortName, authorName) {
   const accountPath = join53(STATE_DIR, "telegraph-account.json");
   let account = null;
   try {
-    if (existsSync49(accountPath)) {
-      const raw = readFileSync51(accountPath, "utf-8");
+    if (existsSync50(accountPath)) {
+      const raw = readFileSync53(accountPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.shortName && parsed.accessToken) {
         account = parsed;
@@ -86283,7 +87479,7 @@ async function publishToTelegraph(text5, shortName, authorName) {
     account = created.value;
     try {
       mkdirSync39(STATE_DIR, { recursive: true, mode: 448 });
-      writeFileSync41(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
+      writeFileSync42(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
     } catch (err) {
       process.stderr.write(`telegram gateway: telegraph cache write failed: ${err.message}
 `);
@@ -86723,7 +87919,7 @@ async function executeVaultRequestAccess(args) {
 }
 function readLiveSwitchroomConfigText() {
   const cfgPath = process.env.SWITCHROOM_CONFIG ?? findConfigFile2();
-  return readFileSync51(cfgPath, "utf8");
+  return readFileSync53(cfgPath, "utf8");
 }
 var MENTAL_MODEL_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 function buildMentalModelProposeKeyboard(stageId) {
@@ -86894,7 +88090,7 @@ async function executeDownloadAttachment(args) {
   });
   mkdirSync39(INBOX_DIR, { recursive: true, mode: 448 });
   assertInsideInbox(INBOX_DIR, dlPath);
-  writeFileSync41(dlPath, buf, { mode: 384 });
+  writeFileSync42(dlPath, buf, { mode: 384 });
   return { content: [{ type: "text", text: dlPath }] };
 }
 async function executeEditMessage(args) {
@@ -88401,6 +89597,9 @@ async function handleInboundCoalesced(ctx, text5, downloadImage, attachment) {
   if (parseInterruptMarker(text5).isInterrupt) {
     return handleInbound(ctx, text5, downloadImage, attachment);
   }
+  if (parseStopKeyword(text5) && downloadImage == null && attachment == null) {
+    return handleInbound(ctx, text5, downloadImage, attachment);
+  }
   const hasAttachment = downloadImage != null || attachment != null;
   const maxAttachments = coalesceMaxAttachments();
   if (hasAttachment && ctx.message?.media_group_id != null && maxAttachments <= 1) {
@@ -88509,6 +89708,27 @@ async function handleInbound(ctx, text5, downloadImage, attachment, extraAttachm
     process.stderr.write(`telegram gateway: inbound classifier error: ${err.message}
 `);
   }
+  if (parseStopKeyword(text5) && downloadImage == null && attachment == null && (extraAttachments == null || extraAttachments.length === 0)) {
+    const queuedLabels = pendingSessionCommand.list().map((c) => `/${c.kind} ${c.targetLabel}`);
+    const inFlight = turnInFlightForGate();
+    process.stderr.write(`telegram gateway: stop-keyword received chat_id=${chat_id} in_flight_turn=${inFlight} queued_cmds=${queuedLabels.length}
+`);
+    if (inFlight) {
+      if (msgId != null) {
+        bot.api.setMessageReaction(chat_id, msgId, [
+          { type: "emoji", emoji: "\u26A1" }
+        ]).catch(() => {});
+      }
+      await executeHaltNow("stop-keyword");
+    }
+    const stopReply = buildStopReply(inFlight, queuedLabels);
+    await swallowingApiCall(() => bot.api.sendMessage(chat_id, stopReply.text, messageThreadId != null ? { message_thread_id: messageThreadId } : {}), {
+      chat_id,
+      verb: "stop-keyword-reply",
+      ...messageThreadId != null ? { threadId: messageThreadId } : {}
+    });
+    return;
+  }
   const interrupt = parseInterruptMarker(text5);
   let deferInterrupt = false;
   if (interrupt.isInterrupt) {
@@ -88525,6 +89745,15 @@ async function handleInbound(ctx, text5, downloadImage, attachment, extraAttachm
         { type: "emoji", emoji: "\u26A1" }
       ]).catch(() => {});
     }
+    if (interrupt.emptyBody) {
+      await executeHaltNow("bang-empty");
+      await swallowingApiCall(() => bot.api.sendMessage(chat_id, "\u26A1 Interrupted. Send your replacement instruction now.", messageThreadId != null ? { message_thread_id: messageThreadId } : {}), {
+        chat_id,
+        verb: "interrupt-empty-body",
+        ...messageThreadId != null ? { threadId: messageThreadId } : {}
+      });
+      return;
+    }
     if (agentName3 && !deferInterrupt) {
       try {
         const { sendAgentInterrupt: sendAgentInterrupt2 } = await Promise.resolve().then(() => (init_tmux(), exports_tmux));
@@ -88542,14 +89771,6 @@ async function handleInbound(ctx, text5, downloadImage, attachment, extraAttachm
       }
       cancelInterruptedObligation();
     }
-    if (interrupt.emptyBody) {
-      await swallowingApiCall(() => bot.api.sendMessage(chat_id, "\u26A1 Interrupted. Send your replacement instruction now.", messageThreadId != null ? { message_thread_id: messageThreadId } : {}), {
-        chat_id,
-        verb: "interrupt-empty-body",
-        ...messageThreadId != null ? { threadId: messageThreadId } : {}
-      });
-      return;
-    }
     text5 = interrupt.body;
   }
   if (STATUS_QUERY_RE.test(text5)) {
@@ -89420,7 +90641,7 @@ function writeRestartMarker(marker) {
   if (!p)
     return;
   try {
-    writeFileSync41(p, JSON.stringify(marker));
+    writeFileSync42(p, JSON.stringify(marker));
     lastPlannedRestartAt = Date.now();
     process.stderr.write(`telegram gateway: restart-marker: write chat_id=${marker.chat_id} thread_id=${marker.thread_id ?? "-"} ack=${marker.ack_message_id ?? "-"} path=${p}
 `);
@@ -89439,7 +90660,7 @@ function readRestartMarker() {
   if (!p)
     return null;
   try {
-    return JSON.parse(readFileSync51(p, "utf8"));
+    return JSON.parse(readFileSync53(p, "utf8"));
   } catch {
     return null;
   }
@@ -89588,7 +90809,7 @@ var _dockerReachable;
 function isDockerReachable() {
   if (_dockerReachable !== undefined)
     return _dockerReachable;
-  if (!existsSync49("/var/run/docker.sock")) {
+  if (!existsSync50("/var/run/docker.sock")) {
     _dockerReachable = false;
     return _dockerReachable;
   }
@@ -89609,8 +90830,8 @@ function spawnSwitchroomDetached(args, onFailure) {
   let outFd = null;
   try {
     mkdirSync39(STATE_DIR, { recursive: true });
-    outFd = openSync10(logPath, "a");
-    writeFileSync41(logPath, `
+    outFd = openSync11(logPath, "a");
+    writeFileSync42(logPath, `
 [${new Date().toISOString()}] spawn ${SWITCHROOM_CLI} ${fullArgs.join(" ")}
 `, { flag: "a" });
   } catch {}
@@ -89624,7 +90845,7 @@ function spawnSwitchroomDetached(args, onFailure) {
   });
   if (outFd != null) {
     try {
-      closeSync10(outFd);
+      closeSync11(outFd);
     } catch {}
   }
   if (onFailure) {
@@ -89636,7 +90857,7 @@ function spawnSwitchroomDetached(args, onFailure) {
         return;
       let tail = "";
       try {
-        const full = readFileSync51(logPath, "utf8");
+        const full = readFileSync53(logPath, "utf8");
         tail = full.split(`
 `).slice(-30).join(`
 `).trim();
@@ -90004,9 +91225,9 @@ bot.use(async (ctx, next) => {
 function readRecentDenialsForAgent(agentName3, windowMs, limit) {
   try {
     const auditPath = join53(homedir17(), ".switchroom", "vault-audit.log");
-    if (!existsSync49(auditPath))
+    if (!existsSync50(auditPath))
       return [];
-    const raw = readFileSync51(auditPath, "utf8");
+    const raw = readFileSync53(auditPath, "utf8");
     return recentDenialsFromAuditLog(raw, { agentName: agentName3, windowMs, limit });
   } catch {
     return [];
@@ -90057,7 +91278,7 @@ async function buildAgentMetadata(agentName3) {
   try {
     const agentDir = resolveAgentDirFromEnv();
     if (agentDir) {
-      const raw = readFileSync51(join53(agentDir, ".claude", ".claude.json"), "utf8");
+      const raw = readFileSync53(join53(agentDir, ".claude", ".claude.json"), "utf8");
       claudeJson = JSON.parse(raw);
     }
   } catch {}
@@ -90327,6 +91548,192 @@ function modelMenuReplyMarkup(reply) {
   }
   return kb;
 }
+function recordTypedModelSwitch(reply, requestedModelArg, deps) {
+  const requested = requestedModelArg != null ? expandSrAlias(requestedModelArg) : null;
+  if (requested?.toLowerCase() === "default") {
+    const smDir2 = resolveAgentDirFromEnv();
+    if (smDir2)
+      clearSessionModelFile(smDir2);
+    if (reply.selectedModel)
+      sessionModelSource.setOverride(null);
+    return "";
+  }
+  if (!reply.selectedModel)
+    return "";
+  sessionModelSource.setOverride(reply.selectedModel);
+  const smDir = resolveAgentDirFromEnv();
+  if (smDir && requested && isValidModelArg(requested) && !isSrModel(requested)) {
+    try {
+      writeSessionModelFile(smDir, requested, readConfiguredDefaultModel(smDir) ?? resolveMainModel(deps.getConfiguredModel() ?? undefined));
+    } catch (err) {
+      process.stderr.write(`telegram gateway: session-model persist failed (typed /model): ${err?.message ?? String(err)}
+`);
+      return `
+\u26A0\uFE0F Couldn\u2019t persist the sticky override \u2014 the switch is live now but won\u2019t survive a relaunch.`;
+    }
+  }
+  return "";
+}
+function recordModelMenuSideEffects(outcome, modelDeps, cbChatId, cbThreadId, prevSessionModel) {
+  if (outcome.selectedModel) {
+    sessionModelSource.setOverride(outcome.selectedModel);
+    const smDir = resolveAgentDirFromEnv();
+    if (smDir && outcome.selectedModelToken) {
+      try {
+        writeSessionModelFile(smDir, outcome.selectedModelToken, readConfiguredDefaultModel(smDir) ?? resolveMainModel(modelDeps.getConfiguredModel() ?? undefined));
+      } catch (err) {
+        outcome.reply.text += `
+\u26A0\uFE0F Couldn\u2019t persist the sticky override \u2014 the switch is live now but won\u2019t survive a relaunch.`;
+        process.stderr.write(`telegram gateway: session-model persist failed (menu): ${err?.message ?? String(err)}
+`);
+      }
+    }
+  }
+  if (outcome.clearedDefault) {
+    const smDir = resolveAgentDirFromEnv();
+    if (smDir)
+      clearSessionModelFile(smDir);
+  }
+  if (outcome.selectedModel && isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)) {
+    const agentName3 = getMyAgentName();
+    const agentDir = resolveAgentDirFromEnv();
+    const token = outcome.selectedModelToken;
+    if (agentDir && token) {
+      try {
+        writeSessionModelFile(agentDir, token, readConfiguredDefaultModel(agentDir) ?? resolveMainModel(modelDeps.getConfiguredModel() ?? undefined));
+        sessionModelSource.setOverride(token);
+      } catch (e) {
+        process.stderr.write(`telegram gateway: sr-to-claude session-model write failed: ${e?.message ?? String(e)}
+`);
+      }
+    } else if (agentDir) {
+      clearSessionModelFile(agentDir);
+    }
+    writeRestartMarker({ chat_id: cbChatId, thread_id: cbThreadId ?? null, ack_message_id: null, ts: Date.now() });
+    stampUserRestartReason("user: sr-to-claude model switch (menu)");
+    if (turnInFlightForGate()) {
+      pendingRestarts.set(agentName3, Date.now());
+    } else {
+      sweepBeforeSelfRestart().finally(() => triggerSelfRestart(agentName3, "sr-to-claude-model-switch", 1500));
+    }
+    return {
+      restartNotice: `\uD83D\uDD04 Switching from **${escapeHtmlForTg2(prevSessionModel)}** back to Claude \u2014 restarting session cleanly. Claude will be ready in ~30s.`
+    };
+  }
+  return {};
+}
+async function editPendingCommandCard(chatId, messageId, text5) {
+  try {
+    await robustApiCall(() => lockedBot.api.editMessageText(chatId, messageId, richMessage2(hardenCardBreaks2(text5)), {
+      reply_markup: { inline_keyboard: [] }
+    }), { chat_id: chatId, verb: "pending-cmd-card" });
+  } catch (err) {
+    process.stderr.write(`telegram gateway: pending-command card edit failed chat=${chatId} msg=${messageId}: ${err?.message ?? String(err)}
+`);
+  }
+}
+function enqueueSessionCommand(cmd) {
+  const displaced = pendingSessionCommand.set(cmd);
+  if (displaced) {
+    editPendingCommandCard(displaced.ackChatId, displaced.ackMessageId, supersededText(displaced, cmd, escapeHtmlForTg2));
+  }
+  if (!turnInFlightForGate())
+    drainPendingSessionCommand();
+}
+async function applyQueuedModelCommand(cmd) {
+  const deps = buildModelDeps({ chatId: cmd.chatId, threadId: cmd.threadId });
+  if (cmd.origin === "menu") {
+    const prevSessionModel = sessionModelSource.getOverride();
+    const outcome = await handleModelMenuCallback(cmd.arg, deps);
+    const { restartNotice } = recordModelMenuSideEffects(outcome, deps, cmd.chatId, cmd.threadId, prevSessionModel);
+    return restartNotice ?? outcome.reply.text;
+  }
+  const reply = await handleModelCommand({ kind: "set", model: cmd.arg }, deps);
+  const warning = recordTypedModelSwitch(reply, cmd.arg, deps);
+  return reply.text + warning;
+}
+async function applyQueuedEffortCommand(cmd) {
+  const deps = buildEffortDeps();
+  if (cmd.origin === "menu") {
+    const outcome = await handleEffortMenuCallback(cmd.arg, deps);
+    return outcome.reply.text;
+  }
+  const parsed = cmd.arg === "default" ? { kind: "default" } : { kind: "set", level: cmd.arg };
+  const reply = await handleEffortCommand(parsed, deps);
+  return reply.text;
+}
+function reEnqueueUnlessSuperseded(cmd) {
+  const newer = pendingSessionCommand.get(cmd.kind);
+  if (newer != null) {
+    editPendingCommandCard(cmd.ackChatId, cmd.ackMessageId, supersededText(cmd, newer, escapeHtmlForTg2));
+    return;
+  }
+  pendingSessionCommand.set(cmd);
+}
+function persistQueuedCommandForRestart(action) {
+  if (action.persist == null)
+    return action.reissueText;
+  const agentDir = resolveAgentDirFromEnv();
+  if (agentDir == null)
+    return action.reissueText;
+  try {
+    switch (action.persist) {
+      case "model": {
+        if (!isOfflineTrustedModelToken(action.arg)) {
+          return `\u21A9\uFE0F Couldn\u2019t verify \`${escapeHtmlForTg2(action.cmd.targetLabel || action.arg)}\` as a known model without the live session \u2014 it was NOT saved. Re-issue \`/model ${escapeHtmlForTg2(action.arg)}\` once the agent is back.`;
+        }
+        const configured = readConfiguredDefaultModel(agentDir) ?? resolveMainModel(undefined);
+        writeSessionModelFile(agentDir, expandSrAlias(action.arg), configured);
+        writeRelaunchModelIntent(agentDir, "keep", "queued /model carried across restart");
+        break;
+      }
+      case "clear-model":
+        clearSessionModelFile(agentDir);
+        break;
+      case "effort":
+        writeSessionEffortFile(agentDir, action.arg, getConfiguredEffortForPersist());
+        break;
+      case "clear-effort":
+        clearSessionEffortFile(agentDir);
+        break;
+    }
+    return action.persistedText;
+  } catch (err) {
+    process.stderr.write(`telegram gateway: queued-command persist-for-restart failed kind=${action.cmd.kind} arg=${action.arg}: ${err?.message ?? String(err)}
+`);
+    return action.reissueText;
+  }
+}
+function getConfiguredEffortForPersist() {
+  try {
+    const data = switchroomExecJson(["agent", "list"]);
+    return data?.agents?.find((a) => a.name === getMyAgentName())?.thinking_effort ?? SWITCHROOM_DEFAULT_THINKING_EFFORT;
+  } catch {
+    return SWITCHROOM_DEFAULT_THINKING_EFFORT;
+  }
+}
+var pendingCmdDraining = false;
+async function drainPendingSessionCommand() {
+  if (pendingCmdDraining)
+    return;
+  if (pendingSessionCommand.size === 0)
+    return;
+  pendingCmdDraining = true;
+  try {
+    await drainTakenCommands(pendingSessionCommand.takeAll(), {
+      restartPending: () => pendingRestarts.size > 0,
+      turnInFlight: () => turnInFlightForGate(),
+      apply: (cmd) => cmd.kind === "model" ? applyQueuedModelCommand(cmd) : applyQueuedEffortCommand(cmd),
+      isBusyRefusal: isBusyRefusalText,
+      resolveForRestartText: (cmd) => persistQueuedCommandForRestart(resolveForRestart(cmd, escapeHtmlForTg2)),
+      editCard: (cmd, text5) => editPendingCommandCard(cmd.ackChatId, cmd.ackMessageId, text5),
+      reEnqueue: reEnqueueUnlessSuperseded,
+      failureText: (cmd, err) => `\u274C Couldn\u2019t apply the queued ${cmd.kind} switch to \`${escapeHtmlForTg2(cmd.targetLabel)}\`: ${escapeHtmlForTg2(err?.message ?? String(err))}`
+    });
+  } finally {
+    pendingCmdDraining = false;
+  }
+}
 bot.command("model", async (ctx) => {
   if (!isAuthorizedSender(ctx))
     return;
@@ -90340,38 +91747,53 @@ bot.command("model", async (ctx) => {
     await switchroomReply(ctx, menu.text, { html: true, reply_markup: modelMenuReplyMarkup(menu) });
     return;
   }
-  const reply = await handleModelCommand(parsed, deps);
-  const requested = parsed.kind === "set" ? expandSrAlias(parsed.model) : null;
-  let persistWarning = "";
-  if (requested?.toLowerCase() === "default") {
-    const smDir = resolveAgentDirFromEnv();
-    if (smDir)
-      clearSessionModelFile(smDir);
-    if (reply.selectedModel)
-      sessionModelSource.setOverride(null);
-  } else if (reply.selectedModel) {
-    sessionModelSource.setOverride(reply.selectedModel);
-    const smDir = resolveAgentDirFromEnv();
-    if (smDir && requested && isValidModelArg(requested) && !isSrModel(requested)) {
-      try {
-        writeSessionModelFile(smDir, requested, readConfiguredDefaultModel(smDir) ?? resolveMainModel(deps.getConfiguredModel() ?? undefined));
-      } catch (err) {
-        persistWarning = `
-\u26A0\uFE0F Couldn\u2019t persist the sticky override \u2014 the switch is live now but won\u2019t survive a relaunch.`;
-        process.stderr.write(`telegram gateway: session-model persist failed (typed /model): ${err?.message ?? String(err)}
-`);
-      }
-    }
+  if (parsed.kind === "set" && deps.isBusy()) {
+    const target = expandSrAlias(parsed.model);
+    const sent = await ctx.replyWithRichMessage(richMessage2(hardenCardBreaks2(ackText("model", target, escapeHtmlForTg2))), threadId != null ? { message_thread_id: threadId } : {});
+    enqueueSessionCommand({
+      kind: "model",
+      origin: "typed",
+      arg: target,
+      targetLabel: target,
+      chatId,
+      threadId,
+      ackChatId: chatId,
+      ackMessageId: sent.message_id,
+      requestedAt: Date.now()
+    });
+    return;
   }
+  const reply = await handleModelCommand(parsed, deps);
+  const persistWarning = recordTypedModelSwitch(reply, parsed.kind === "set" ? parsed.model : null, deps);
   await switchroomReply(ctx, reply.text + persistWarning, { html: reply.html });
 });
 function buildEffortDeps() {
   return {
-    applyEffort: (agent, level) => applyEffort(agent, level),
+    applyEffort: async (agent, level) => {
+      const result = await applyEffort(agent, level);
+      if (result.ok) {
+        const agentDir = resolveAgentDirFromEnv();
+        if (agentDir) {
+          try {
+            writeSessionEffortFile(agentDir, level, getConfiguredEffortForPersist());
+          } catch (err) {
+            process.stderr.write(`telegram gateway: session-effort persist failed level=${level}: ${err?.message ?? String(err)}
+`);
+          }
+        }
+      }
+      return result;
+    },
     getAgentName: getMyAgentName,
-    getConfiguredEffort: () => {
-      const data = switchroomExecJson(["agent", "list"]);
-      return data?.agents?.find((a) => a.name === getMyAgentName())?.thinking_effort ?? null;
+    getConfiguredEffort: () => getConfiguredEffortForPersist(),
+    clearSessionEffort: () => {
+      const agentDir = resolveAgentDirFromEnv();
+      if (agentDir)
+        clearSessionEffortFile(agentDir);
+    },
+    getSessionEffort: () => {
+      const agentDir = resolveAgentDirFromEnv();
+      return agentDir ? readSessionEffortFile(agentDir)?.level ?? null : null;
     },
     escapeHtml: escapeHtmlForTg2
   };
@@ -90398,6 +91820,24 @@ bot.command("effort", async (ctx) => {
     await switchroomReply(ctx, menu.text, { html: true, reply_markup: effortMenuReplyMarkup(menu) });
     return;
   }
+  if ((parsed.kind === "set" || parsed.kind === "default") && currentTurn !== null) {
+    const requestedLevel = parsed.kind === "set" ? parsed.level : "default";
+    const chatId = String(ctx.chat.id);
+    const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id);
+    const sent = await ctx.replyWithRichMessage(richMessage2(hardenCardBreaks2(ackText("effort", requestedLevel, escapeHtmlForTg2))), threadId != null ? { message_thread_id: threadId } : {});
+    enqueueSessionCommand({
+      kind: "effort",
+      origin: "typed",
+      arg: requestedLevel,
+      targetLabel: requestedLevel,
+      chatId,
+      threadId,
+      ackChatId: chatId,
+      ackMessageId: sent.message_id,
+      requestedAt: Date.now()
+    });
+    return;
+  }
   const reply = await handleEffortCommand(parsed, deps);
   await switchroomReply(ctx, reply.text, { html: reply.html });
 });
@@ -90413,7 +91853,7 @@ bot.command("agentstart", async (ctx) => {
   }
   await dispatchShortVerbViaHostd(ctx, { v: 1, op: "agent_start", request_id: hostdRequestId2("gw-start"), args: { name } }, `start ${name}`, ["agent", "start", name]);
 });
-bot.command("stop", async (ctx) => {
+bot.command("agentstop", async (ctx) => {
   if (!isAuthorizedSender(ctx))
     return;
   const name = ctx.match?.trim() || getMyAgentName();
@@ -90425,6 +91865,23 @@ bot.command("stop", async (ctx) => {
   }
   await dispatchShortVerbViaHostd(ctx, { v: 1, op: "agent_stop", request_id: hostdRequestId2("gw-stop"), args: { name } }, `stop ${name}`, ["agent", "stop", name]);
 });
+bot.command("stop", async (ctx) => {
+  if (!isAuthorizedSender(ctx))
+    return;
+  const arg = ctx.match?.trim();
+  if (arg) {
+    await switchroomReply(ctx, `/stop takes no argument \u2014 it cancels MY in-flight turn. ` + `To stop a container, use /agentstop ${arg}. Nothing was stopped.`);
+    return;
+  }
+  const queuedLabels = pendingSessionCommand.list().map((c) => `/${c.kind} ${c.targetLabel}`);
+  const inFlight = turnInFlightForGate();
+  if (!inFlight) {
+    await switchroomReply(ctx, buildStopReply(false, queuedLabels).text);
+    return;
+  }
+  await executeHaltNow("stop-command");
+  await switchroomReply(ctx, buildStopReply(true, queuedLabels).text);
+});
 bot.command("restart", async (ctx) => {
   if (!isAuthorizedSender(ctx))
     return;
@@ -90443,10 +91900,10 @@ bot.command("restart", async (ctx) => {
     }
     const chatId = String(ctx.chat.id);
     const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id);
-    const ackText = restartAckText(name);
+    const ackText2 = restartAckText(name);
     let ackId = null;
     try {
-      const sent = await retryWithThreadFallback2(robustApiCall, (tid) => lockedBot.api.sendRichMessage(chatId, richMessage2(ackText), {
+      const sent = await retryWithThreadFallback2(robustApiCall, (tid) => lockedBot.api.sendRichMessage(chatId, richMessage2(ackText2), {
         disable_notification: true,
         ...tid != null ? { message_thread_id: tid } : {}
       }), { threadId, chat_id: chatId, verb: "restart.ack" });
@@ -90462,7 +91919,7 @@ bot.command("restart", async (ctx) => {
     {
       const smDir = resolveAgentDirFromEnv();
       if (smDir)
-        writeRelaunchModelIntent(smDir, "revert", "user: /restart from chat");
+        writeRelaunchModelIntent(smDir, "keep", "user: /restart from chat");
     }
     await sweepBeforeSelfRestart();
     const hostdResp = await tryHostdDispatch2(getMyAgentName(), {
@@ -90496,8 +91953,8 @@ function flushAgentHandoff(agentDir) {
   for (const fname of [".handoff.md", ".handoff-topic"]) {
     const p = join53(agentDir, fname);
     try {
-      if (existsSync49(p)) {
-        unlinkSync20(p);
+      if (existsSync50(p)) {
+        unlinkSync21(p);
         removed++;
       }
     } catch (err) {
@@ -90535,24 +91992,24 @@ async function handleNewCommand(ctx) {
   const flushed = agentDir != null ? flushAgentHandoff(agentDir) : 0;
   const chatId = String(ctx.chat.id);
   const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id);
-  const ackText = newSessionAckText(name, flushed > 0);
+  const ackText2 = newSessionAckText(name, flushed > 0);
   let ackId = null;
   try {
-    const sent = await retryWithThreadFallback2(robustApiCall, (tid) => lockedBot.api.sendRichMessage(chatId, richMessage2(ackText), {
+    const sent = await retryWithThreadFallback2(robustApiCall, (tid) => lockedBot.api.sendRichMessage(chatId, richMessage2(ackText2), {
       disable_notification: true,
       ...tid != null ? { message_thread_id: tid } : {}
     }), { threadId, chat_id: chatId, verb: "new-or-reset.ack" });
     ackId = sent.message_id;
     if (HISTORY_ENABLED) {
       try {
-        recordOutbound({ chat_id: chatId, thread_id: threadId ?? null, message_ids: [sent.message_id], texts: [ackText], attachment_kinds: [] });
+        recordOutbound({ chat_id: chatId, thread_id: threadId ?? null, message_ids: [sent.message_id], texts: [ackText2], attachment_kinds: [] });
       } catch {}
     }
   } catch {}
   writeRestartMarker({ chat_id: chatId, thread_id: threadId ?? null, ack_message_id: ackId, ts: Date.now() });
   if (agentDir != null) {
     try {
-      writeFileSync41(join53(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
+      writeFileSync42(join53(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
 `, "utf8");
     } catch (err) {
       process.stderr.write(`telegram gateway: failed to write force-fresh marker: ${err}
@@ -90628,7 +92085,7 @@ Either run \`switchroom update\` from the host shell, or set \`host_control.enab
   }
   const chatId = String(ctx.chat.id);
   const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id);
-  const ackText = `\uD83D\uDE80 **update started** \u2014 running ${[
+  const ackText2 = `\uD83D\uDE80 **update started** \u2014 running ${[
     "`switchroom update`",
     ...passthrough.map((t) => `\`${t}\``)
   ].join(" ")}
@@ -90636,7 +92093,7 @@ Either run \`switchroom update\` from the host shell, or set \`host_control.enab
 The gateway will restart as part of the recreate step; watch for the post-restart greeting card to confirm completion.`;
   let ackId = null;
   try {
-    const sent = await retryWithThreadFallback2(robustApiCall, (tid) => lockedBot.api.sendRichMessage(chatId, richMessage2(ackText), {
+    const sent = await retryWithThreadFallback2(robustApiCall, (tid) => lockedBot.api.sendRichMessage(chatId, richMessage2(ackText2), {
       disable_notification: true,
       ...tid != null ? { message_thread_id: tid } : {}
     }), { threadId, chat_id: chatId, verb: "update.ack" });
@@ -90919,16 +92376,16 @@ bot.command("interrupt", async (ctx) => {
   await runSwitchroomCommand(ctx, ["agent", "interrupt", name], `interrupt ${name}`);
 });
 var lockoutOps = {
-  readFileSync: (p, enc) => readFileSync51(p, enc),
-  writeFileSync: (p, data, opts) => writeFileSync41(p, data, opts),
-  existsSync: (p) => existsSync49(p),
+  readFileSync: (p, enc) => readFileSync53(p, enc),
+  writeFileSync: (p, data, opts) => writeFileSync42(p, data, opts),
+  existsSync: (p) => existsSync50(p),
   mkdirSync: (p, opts) => mkdirSync39(p, opts),
   joinPath: (...parts) => join53(...parts)
 };
 var FLEET_FALLBACK_DEDUP_MS = 30000;
 function isAuthBrokerSocketReachable() {
   try {
-    return existsSync49(resolveAuthBrokerSocketPath2());
+    return existsSync50(resolveAuthBrokerSocketPath2());
   } catch {
     return false;
   }
@@ -90937,6 +92394,7 @@ var fleetFallbackGate = createFleetFallbackGate({
   dedupMs: FLEET_FALLBACK_DEDUP_MS,
   brokerReachable: isAuthBrokerSocketReachable
 });
+var modelUnavailableCardRegistry = createModelUnavailableCardRegistry();
 var fleetFallbackResumeGate = createFleetFallbackResumeGate({
   maxAgeMs: (() => {
     const v = Number(process.env.SWITCHROOM_RESUME_MAX_AGE_MS);
@@ -91024,6 +92482,16 @@ async function doFireFleetAutoFallback(triggerAgent, untilMs) {
       return outcome.kind === "switched";
     const opts = { disable_notification: true };
     for (const chat_id of access.allowFrom) {
+      const card = modelUnavailableCardRegistry.take(String(chat_id), Date.now());
+      if (decideAnnouncementDelivery(outcome.kind, card) === "edit" && card) {
+        try {
+          await bot.api.editMessageText(chat_id, card.messageId, richMessage2(foldAnnouncementIntoCard(card.text, outcome.announcement)), {});
+          continue;
+        } catch (err) {
+          process.stderr.write(`telegram gateway: [fleet-fallback] card edit failed chat=${chat_id} \u2014 sending announcement separately: ${err?.message ?? err}
+`);
+        }
+      }
       swallowingApiCall(() => bot.api.sendRichMessage(chat_id, richMessage2(outcome.announcement), opts), { chat_id, verb: "fleet-fallback:notify" });
     }
     if (outcome.kind === "switched") {
@@ -91144,6 +92612,38 @@ async function runQuotaWatch(opts = {}) {
 `);
       }
       process.stderr.write(`telegram gateway: quota-watch: fleet all-exhausted ${fleetDecision.transition}
+`);
+    }
+  }
+  {
+    const rollPrev = watchState[FLEET_ROLL_ANNOUNCE_KEY] ?? emptyAccountState();
+    const rollDecision = evaluateFleetRollAnnounce({
+      roll: listStateData.last_fleet_roll ?? null,
+      prev: rollPrev,
+      now
+    });
+    if (rollDecision.kind === "notify") {
+      for (const chat_id of access.allowFrom) {
+        if (tuning.fleetDedup) {
+          const granted = await claimQuotaNotification(brokerClient, buildQuotaClaimKey(FLEET_ROLL_ANNOUNCE_KEY, String(listStateData.last_fleet_roll.at), chat_id));
+          if (!granted) {
+            process.stderr.write(`telegram gateway: quota-watch: fleet-roll claim denied chat=${chat_id} \u2014 another agent notified
+`);
+            continue;
+          }
+        }
+        await swallowingApiCall(() => bot.api.sendRichMessage(chat_id, richMessage2(rollDecision.message), {
+          disable_notification: true
+        }), { chat_id, verb: "quota-watch.fleet-roll" });
+      }
+      watchState = patchQuotaWatchState(watchState, FLEET_ROLL_ANNOUNCE_KEY, rollDecision.newState);
+      try {
+        saveQuotaWatchState(stateDir, watchState);
+      } catch (err) {
+        process.stderr.write(`telegram gateway: quota-watch: fleet-roll state save failed: ${err}
+`);
+      }
+      process.stderr.write(`telegram gateway: quota-watch: announced broker fleet roll ${listStateData.last_fleet_roll.from} \u2192 ${listStateData.last_fleet_roll.to}
 `);
     }
   }
@@ -91151,9 +92651,10 @@ async function runQuotaWatch(opts = {}) {
   const labelToSnapIndex = new Map(snapshots.map((s, i) => [s.label, i]));
   let reconciledCount = 0;
   let mutatedState = watchState;
+  const lastRoll = listStateData.last_fleet_roll ?? null;
   for (const snap of snapshots) {
     const prev = watchState[snap.label] ?? emptyAccountState();
-    const decision = evaluateQuotaWatchAccount({ agentName: agentName3, snap, prev, now, bootTick, tuning });
+    const decision = evaluateQuotaWatchAccount({ agentName: agentName3, snap, prev, now, bootTick, tuning, lastRoll });
     if (decision.kind === "reconcile") {
       mutatedState = patchQuotaWatchState(mutatedState, decision.accountLabel, decision.newAccountState);
       reconciledCount++;
@@ -91209,7 +92710,7 @@ async function runQuotaWatch(opts = {}) {
     if (isLiveCorroboration(freshEntry) && freshEntry.result.ok && snapIndex >= 0) {
       const enrichedSnap = { ...snapshots[snapIndex], quota: freshEntry.result.data, capturedAtMs: undefined };
       const prev = watchState[accountLabel] ?? emptyAccountState();
-      const re = evaluateQuotaWatchAccount({ agentName: agentName3, snap: enrichedSnap, prev, now, bootTick, tuning });
+      const re = evaluateQuotaWatchAccount({ agentName: agentName3, snap: enrichedSnap, prev, now, bootTick, tuning, lastRoll });
       if (re.kind === "notify" && re.transition === decision.transition) {
         enrichedDecision = re;
       } else if (re.kind === "reconcile") {
@@ -92045,6 +93546,28 @@ bot.on("callback_query:data", async (ctx) => {
       await ctx.answerCallbackQuery({ text: "Not authorized." });
       return;
     }
+    const effLevel = data.startsWith("eff:s:") ? data.slice("eff:s:".length) : null;
+    const effCardMsgId = ctx.callbackQuery?.message?.message_id;
+    if (effLevel != null && currentTurn !== null && effCardMsgId != null) {
+      await ctx.answerCallbackQuery({ text: "\uD83D\uDCE5 Queued \u2014 applies when the turn ends" }).catch(() => {});
+      const effChatId = String(ctx.chat?.id ?? "");
+      const effThreadId = resolveThreadId(effChatId, ctx.callbackQuery?.message?.message_thread_id);
+      await ctx.editMessageText(richMessage2(hardenCardBreaks2(ackText("effort", effLevel, escapeHtmlForTg2))), {
+        reply_markup: { inline_keyboard: [] }
+      }).catch(() => {});
+      enqueueSessionCommand({
+        kind: "effort",
+        origin: "menu",
+        arg: data,
+        targetLabel: effLevel,
+        chatId: effChatId,
+        threadId: effThreadId,
+        ackChatId: effChatId,
+        ackMessageId: effCardMsgId,
+        requestedAt: Date.now()
+      });
+      return;
+    }
     await ctx.answerCallbackQuery({ text: "Setting effort\u2026" }).catch(() => {});
     try {
       const outcome = await handleEffortMenuCallback(data, buildEffortDeps());
@@ -92075,6 +93598,46 @@ bot.on("callback_query:data", async (ctx) => {
     const cbThreadId = resolveThreadId(cbChatId, ctx.callbackQuery?.message?.message_thread_id);
     const modelDeps = buildModelDeps({ chatId: cbChatId, threadId: cbThreadId });
     if (modelDeps.isBusy()) {
+      const cardMsgId = ctx.callbackQuery?.message?.message_id;
+      let queueArg = null;
+      let queueOrigin = "menu";
+      let queueLabel = "the selected model";
+      if (data.startsWith(MODEL_CALLBACK_SR)) {
+        const srName = data.slice(MODEL_CALLBACK_SR.length);
+        if (isValidModelArg(srName)) {
+          queueArg = srName;
+          queueOrigin = "typed";
+          queueLabel = srFriendlyLabel(srName);
+        }
+      } else if (data.startsWith(MODEL_CALLBACK_ALIAS)) {
+        const alias = data.slice(MODEL_CALLBACK_ALIAS.length);
+        if (isValidModelArg(alias)) {
+          queueArg = alias;
+          queueOrigin = "typed";
+          queueLabel = alias;
+        }
+      } else if (data.startsWith("mdl:s:")) {
+        queueArg = data;
+        queueOrigin = "menu";
+      }
+      if (queueArg != null && cardMsgId != null) {
+        await ctx.answerCallbackQuery({ text: "\uD83D\uDCE5 Queued \u2014 applies when the turn ends" }).catch(() => {});
+        await ctx.editMessageText(richMessage2(hardenCardBreaks2(ackText("model", queueLabel, escapeHtmlForTg2))), {
+          reply_markup: { inline_keyboard: [] }
+        }).catch(() => {});
+        enqueueSessionCommand({
+          kind: "model",
+          origin: queueOrigin,
+          arg: queueArg,
+          targetLabel: queueLabel,
+          chatId: cbChatId,
+          threadId: cbThreadId,
+          ackChatId: cbChatId,
+          ackMessageId: cardMsgId,
+          requestedAt: Date.now()
+        });
+        return;
+      }
       await ctx.answerCallbackQuery({ text: "\u23F3 Agent is mid-turn \u2014 tap again when it\u2019s idle", show_alert: false }).catch(() => {});
       return;
     }
@@ -92099,56 +93662,14 @@ bot.on("callback_query:data", async (ctx) => {
       }
       return;
     }
-    const didInterimSrEdit = false;
     try {
       const prevSessionModel = sessionModelSource.getOverride();
       const outcome = await handleModelMenuCallback(data, modelDeps);
-      if (outcome.selectedModel) {
-        sessionModelSource.setOverride(outcome.selectedModel);
-        const smDir = resolveAgentDirFromEnv();
-        if (smDir && outcome.selectedModelToken) {
-          try {
-            writeSessionModelFile(smDir, outcome.selectedModelToken, readConfiguredDefaultModel(smDir) ?? resolveMainModel(modelDeps.getConfiguredModel() ?? undefined));
-          } catch (err) {
-            outcome.reply.text += `
-\u26A0\uFE0F Couldn\u2019t persist the sticky override \u2014 the switch is live now but won\u2019t survive a relaunch.`;
-            process.stderr.write(`telegram gateway: session-model persist failed (menu): ${err?.message ?? String(err)}
-`);
-          }
-        }
-      }
-      if (outcome.clearedDefault) {
-        const smDir = resolveAgentDirFromEnv();
-        if (smDir)
-          clearSessionModelFile(smDir);
-      }
-      if (outcome.toastOnly && !didInterimSrEdit)
+      if (outcome.toastOnly)
         return;
-      if (outcome.selectedModel && isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)) {
-        const agentName3 = getMyAgentName();
-        await ctx.editMessageText(richMessage2(`\uD83D\uDD04 Switching from **${escapeHtmlForTg2(prevSessionModel)}** back to Claude \u2014 restarting session cleanly. Claude will be ready in ~30s.`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-        {
-          const agentDir = resolveAgentDirFromEnv();
-          const token = outcome.selectedModelToken;
-          if (agentDir && token) {
-            try {
-              writeSessionModelFile(agentDir, token, readConfiguredDefaultModel(agentDir) ?? resolveMainModel(modelDeps.getConfiguredModel() ?? undefined));
-              sessionModelSource.setOverride(token);
-            } catch (e) {
-              process.stderr.write(`telegram gateway: sr-to-claude session-model write failed: ${e?.message ?? String(e)}
-`);
-            }
-          } else if (agentDir) {
-            clearSessionModelFile(agentDir);
-          }
-        }
-        writeRestartMarker({ chat_id: cbChatId, thread_id: cbThreadId ?? null, ack_message_id: null, ts: Date.now() });
-        stampUserRestartReason("user: sr-to-claude model switch (menu)");
-        if (turnInFlightForGate()) {
-          pendingRestarts.set(agentName3, Date.now());
-        } else {
-          sweepBeforeSelfRestart().finally(() => triggerSelfRestart(agentName3, "sr-to-claude-model-switch", 1500));
-        }
+      const { restartNotice } = recordModelMenuSideEffects(outcome, modelDeps, cbChatId, cbThreadId, prevSessionModel);
+      if (restartNotice) {
+        await ctx.editMessageText(richMessage2(restartNotice), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
         return;
       }
       await ctx.editMessageText(richMessage2(outcome.reply.text), {
@@ -92365,7 +93886,7 @@ ${preBlock(formatSwitchroomOutput(err.message ?? "unknown error"))}`, { html: tr
       let audio = null;
       if (entry.filePath != null) {
         try {
-          audio = readFileSync51(entry.filePath);
+          audio = readFileSync53(entry.filePath);
         } catch {
           audio = null;
         }
@@ -92443,8 +93964,8 @@ ${preBlock(formatSwitchroomOutput(err.message ?? "unknown error"))}`, { html: tr
     const cbMessageId = ctx.callbackQuery?.message?.message_id;
     const metaForMessage = cbMessageId != null ? agentButtonMeta.get(`${cbChatId}:${cbMessageId}`) : undefined;
     const tapMeta = metaForMessage?.get(agentCb.raw);
-    const ackText2 = typeof tapMeta?.ack_text === "string" && tapMeta.ack_text.length > 0 ? tapMeta.ack_text : "\u2713 received";
-    await ctx.answerCallbackQuery({ text: ackText2 }).catch(() => {});
+    const ackText3 = typeof tapMeta?.ack_text === "string" && tapMeta.ack_text.length > 0 ? tapMeta.ack_text : "\u2713 received";
+    await ctx.answerCallbackQuery({ text: ackText3 }).catch(() => {});
     const buttonText = (() => {
       const msg2 = ctx.callbackQuery?.message;
       const kb = msg2 && "reply_markup" in msg2 ? msg2.reply_markup : undefined;
@@ -92596,7 +94117,7 @@ ${interimLabel}` : interimLabel
         const unifiedDiff = (() => {
           try {
             const cfgPath = process.env.SWITCHROOM_CONFIG ?? SWITCHROOM_CONFIG ?? findConfigFile2();
-            const raw = readFileSync51(cfgPath, "utf8");
+            const raw = readFileSync53(cfgPath, "utf8");
             return synthesizeAllowRuleDiff({ agentName: agentName3, rule: chosen.rule, configText: raw });
           } catch (err) {
             process.stderr.write(`telegram gateway: always-allow diff synth failed: ${err.message}
@@ -92732,7 +94253,7 @@ ${editLabel}` : editLabel), {
   }
   const scopedMins = Math.max(1, Math.round(scopedTtl / 60000));
   const windowGranted = timeBox != null && grantAgent !== "";
-  const ackText = behavior === "deny" ? "\u274C Denied" : windowGranted ? `\u2705 Allowed (${scopedMins} min)` : "\u2705 Allowed once";
+  const ackText2 = behavior === "deny" ? "\u274C Denied" : windowGranted ? `\u2705 Allowed (${scopedMins} min)` : "\u2705 Allowed once";
   const htmlLabel = behavior === "deny" ? "\u274C **Denied**" : windowGranted ? `\u2705 **Allowed \u2014 won't ask again about ${escapeHtmlForTg2(timeBox.breadth)} for ${scopedMins} min**` : "\u2705 **Allowed once**";
   const msg = ctx.callbackQuery?.message;
   const baseText = msg && "text" in msg && msg.text ? escapeHtmlForTg2(msg.text) : "";
@@ -92745,7 +94266,7 @@ ${editLabel}` : editLabel), {
 
 ${resumeLine}` : htmlLabel;
   await finalizeCallback2(ctx, {
-    ackText: ackText.slice(0, 200),
+    ackText: ackText2.slice(0, 200),
     newText: baseText ? `${baseText}
 
 ${labelWithResume}` : labelWithResume,
@@ -92787,7 +94308,7 @@ bot.on("message:photo", async (ctx) => {
       });
       mkdirSync39(INBOX_DIR, { recursive: true, mode: 448 });
       assertInsideInbox(INBOX_DIR, dlPath);
-      writeFileSync41(dlPath, buf, { mode: 384 });
+      writeFileSync42(dlPath, buf, { mode: 384 });
       return dlPath;
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
@@ -93487,6 +95008,7 @@ bot.catch((err) => {
 `);
 });
 var SHUTDOWN_DRAIN_BUDGET_MS = 35000;
+var SHUTDOWN_PROGRESS_FLUSH_BUDGET_MS = 1500;
 function countInFlight() {
   return pendingPermissions.size + pendingVaultOps.size + inboundCoalescer.size() + pendingReauthFlows.size;
 }
@@ -93498,6 +95020,7 @@ async function shutdown(signal) {
   const agentName3 = process.env.SWITCHROOM_AGENT_NAME ?? "-";
   process.stderr.write(`telegram gateway: shutting down
 `);
+  bridgeDeadWatchdog.stop();
   const isOsSignal = signal === "SIGTERM" || signal === "SIGINT";
   if (isOsSignal) {
     try {
@@ -93508,12 +95031,43 @@ async function shutdown(signal) {
 `);
     } catch (err) {
       process.stderr.write(`telegram gateway: shutdown.clean_marker_write_failed err=${err.message}
+`);
+    }
+    try {
+      const smDir = resolveAgentDirFromEnv();
+      if (smDir != null) {
+        const hasOverride = readSessionModelFile(smDir) != null;
+        const intentAlreadyStamped = existsSync50(join53(smDir, RELAUNCH_MODEL_INTENT_FILE));
+        if (hasOverride && !intentAlreadyStamped) {
+          writeRelaunchModelIntent(smDir, "keep", `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful ${signal} shutdown (deploy/rolling restart) \u2014 preserving user-chosen session model`);
+          process.stderr.write(`telegram gateway: shutdown.session_model_keep_stamped signal=${signal}
+`);
+        }
+      }
+    } catch (err) {
+      process.stderr.write(`telegram gateway: shutdown.session_model_keep_stamp_failed err=${err.message}
 `);
     }
   } else {
     process.stderr.write(`telegram gateway: shutdown.clean_marker_skipped signal=${signal} (crash path \u2014 banner will fire on next boot)
 `);
   }
+  const orphanedCmdActions = shutdownResolutionActions(pendingSessionCommand, escapeHtmlForTg2);
+  const orphanedCmdEdits = orphanedCmdActions.map((a) => ({
+    chatId: a.cmd.ackChatId,
+    messageId: a.cmd.ackMessageId,
+    text: persistQueuedCommandForRestart(a)
+  }));
+  if (orphanedCmdEdits.length > 0) {
+    process.stderr.write(`telegram gateway: shutdown.pending_cmd_resolved count=${orphanedCmdEdits.length}
+`);
+    await Promise.race([
+      Promise.allSettled(orphanedCmdEdits.map((e) => editPendingCommandCard(e.chatId, e.messageId, e.text))),
+      new Promise((resolve11) => {
+        setTimeout(resolve11, SHUTDOWN_PROGRESS_FLUSH_BUDGET_MS).unref();
+      })
+    ]);
+  }
   const shutdownTurn = currentTurn;
   if (turnsDb != null && shutdownTurn?.registryKey != null) {
     const wasScheduledRestart = pendingRestarts.size > 0;
@@ -93927,9 +95481,9 @@ var didOneTimeSetup = false;
           const smAgentDir = resolveAgentDirFromEnv();
           if (smAgentDir) {
             const activePath = join53(smAgentDir, ".active-session-model");
-            if (existsSync49(activePath)) {
+            if (existsSync50(activePath)) {
               try {
-                const launched = readFileSync51(activePath, "utf8").trim();
+                const launched = readFileSync53(activePath, "utf8").trim();
                 const configured = (() => {
                   const d = switchroomExecJson(["agent", "list"]);
                   const raw = d?.agents?.find((a) => a.name === getMyAgentName())?.model ?? null;
@@ -93939,15 +95493,15 @@ var didOneTimeSetup = false;
               } catch {}
             }
             const alertPath = join53(smAgentDir, ".session-model-alert");
-            if (existsSync49(alertPath)) {
+            if (existsSync50(alertPath)) {
               let alertText = null;
               try {
-                alertText = readFileSync51(alertPath, "utf8").trim();
+                alertText = readFileSync53(alertPath, "utf8").trim();
               } catch {
                 alertText = null;
               }
               try {
-                unlinkSync20(alertPath);
+                unlinkSync21(alertPath);
               } catch {}
               if (alertText && alertText.length > 0) {
                 const operators = loadAccess().allowFrom;
@@ -94067,6 +95621,20 @@ var didOneTimeSetup = false;
               parentStateDir: STATE_DIR,
               log: (msg) => process.stderr.write(`telegram gateway: ${msg}
 `),
+              onResurrect: (agentId, _description) => {
+                try {
+                  workerActivityFeed?.resurrect(agentId);
+                } catch (err) {
+                  process.stderr.write(`telegram gateway: worker resurrect error agent=${agentId}: ${err.message}
+`);
+                }
+                process.stderr.write(`telegram gateway: worker ${agentId} card RESURRECTED \u2014 false terminal finish reversed, worker resumed (issue #3023)
+`);
+              },
+              onWorkerLost: (agentId, _description) => {
+                process.stderr.write(`telegram gateway: worker ${agentId} NAMED AS LOST \u2014 falsely finalised twice, resurrection chain bound reached (issue #3023)
+`);
+              },
               onFinish: ({ agentId, outcome, description, resultText, toolCount, durationMs, background: entryBackground }) => {
                 deferredDoneReactions.promote();
                 let fleetChatId = "";