switchroom 0.19.19 → 0.19.22

package/telegram-plugin/dist/gateway/gateway.js

@@ -7379,7 +7379,17 @@ var init_text_voice_scrub = __esm(() => {
 });
 
 // card-format.ts
-function stackCardLines(lines) {
+function normalizeLineTail(line, collapseSafe) {
+  let out = line.replace(/[ \t\r]+$/, "");
+  if (!collapseSafe || COLLAPSE_SAFE_SEPARATOR.length === 0)
+    return out;
+  while (out.endsWith(COLLAPSE_SAFE_SEPARATOR)) {
+    out = out.slice(0, -COLLAPSE_SAFE_SEPARATOR.length).replace(/[ \t\r]+$/, "");
+  }
+  return out;
+}
+function stackCardLines(lines, opts) {
+  const collapseSafe = opts?.collapseSafe === true;
   const pieces = [];
   for (let i = 0;i < lines.length; i++) {
     const line = lines[i];
@@ -7389,11 +7399,14 @@ function stackCardLines(lines) {
     const cur = line.trim();
     const next = lines[i + 1].trim();
     if (cur === "" || next === "") {
+      if (collapseSafe && cur !== "") {
+        pieces[pieces.length - 1] = normalizeLineTail(line, true) + COLLAPSE_SAFE_SEPARATOR;
+      }
       pieces.push(`
 `);
       continue;
     }
-    pieces[pieces.length - 1] = line.replace(/[ \t\r]+$/, "");
+    pieces[pieces.length - 1] = normalizeLineTail(line, collapseSafe) + (collapseSafe ? COLLAPSE_SAFE_SEPARATOR : "");
     pieces.push(`  
 `);
   }
@@ -7439,6 +7452,7 @@ function cleanWorkerResultParagraph(s) {
   }
   return kept.join(" ").replace(/\s+/g, " ").trim();
 }
+var COLLAPSE_SAFE_SEPARATOR = "\u00a0";
 var init_card_format = __esm(() => {
   init_format();
   init_text_voice_scrub();
@@ -35381,7 +35395,7 @@ function renderAuthLine(state7, agentName3, now = Date.now()) {
 
 // gateway/quota-cache.ts
 import { existsSync as existsSync45, readFileSync as readFileSync43, writeFileSync as writeFileSync36, mkdirSync as mkdirSync38 } from "fs";
-import { join as join51, dirname as dirname17 } from "path";
+import { join as join51, dirname as dirname18 } from "path";
 function defaultCachePath() {
   return process.env.SWITCHROOM_QUOTA_CACHE_PATH ?? join51(process.env.HOME ?? "/tmp", ".switchroom", "quota-cache.json");
 }
@@ -35418,7 +35432,7 @@ function writeQuotaCache(result, opts = {}) {
     result
   };
   try {
-    mkdirSync38(dirname17(path3), { recursive: true });
+    mkdirSync38(dirname18(path3), { recursive: true });
     writeFileSync36(path3, JSON.stringify(entry, null, 2), { mode: 384 });
   } catch {}
 }
@@ -36291,7 +36305,7 @@ var init_boot_probes = __esm(() => {
 
 // gateway/boot-issue-cache.ts
 import { existsSync as existsSync47, readFileSync as readFileSync45, writeFileSync as writeFileSync37, mkdirSync as mkdirSync39, renameSync as renameSync21 } from "fs";
-import { dirname as dirname18 } from "path";
+import { dirname as dirname19 } from "path";
 function fingerprintProbe(key, r) {
   if (r.status === "ok")
     return `${key}:ok`;
@@ -36417,7 +36431,7 @@ function applyAndSave(path3, cache, diff) {
     }
   }
   try {
-    mkdirSync39(dirname18(path3), { recursive: true });
+    mkdirSync39(dirname19(path3), { recursive: true });
     const tmp = `${path3}.tmp`;
     writeFileSync37(tmp, JSON.stringify(next), { mode: 384 });
     renameSync21(tmp, path3);
@@ -36434,7 +36448,7 @@ var init_boot_issue_cache = __esm(() => {
 // gateway/config-snapshot.ts
 import { createHash as createHash6 } from "crypto";
 import { existsSync as existsSync48, readFileSync as readFileSync46, writeFileSync as writeFileSync38, mkdirSync as mkdirSync40, renameSync as renameSync22 } from "fs";
-import { dirname as dirname19 } from "path";
+import { dirname as dirname20 } from "path";
 function hashStringArray(items) {
   if (!items || items.length === 0)
     return null;
@@ -36532,7 +36546,7 @@ function loadSnapshot(path3, now = Date.now) {
 }
 function persistSnapshot(path3, snapshot) {
   try {
-    mkdirSync40(dirname19(path3), { recursive: true });
+    mkdirSync40(dirname20(path3), { recursive: true });
     const tmp = `${path3}.tmp`;
     writeFileSync38(tmp, JSON.stringify(snapshot), { mode: 384 });
     renameSync22(tmp, path3);
@@ -38714,7 +38728,7 @@ import {
   unlinkSync as unlinkSync28,
   appendFileSync as appendFileSync9
 } from "fs";
-import { homedir as homedir20 } from "os";
+import { homedir as homedir19 } from "os";
 import { join as join65, sep as sep4, basename as basename17 } from "path";
 
 // plugin-logger.ts
@@ -43330,13 +43344,27 @@ async function interceptVault(p, deps) {
         deps.vaultPassphraseCache.set(p.chat_id, { passphrase, expiresAt: Date.now() + deps.vaultPassphraseTtlMs });
         if (p.msgId != null)
           await deps.deleteSensitiveMessage(p.chat_id, p.msgId, "vault passphrase");
+        const mismatched = [];
+        let mismatchMsg = "";
         for (const item of pendingVault.items) {
           const stagedAccess = deps.pendingVaultRequestAccesses.get(item.stageId);
           if (!stagedAccess) {
             await p.ctx.api.editMessageText(item.cardChatId, item.cardMessageId, richMessage(`\u231b _Vault unlocked, but this access-request card expired or was denied before you replied. Ask the agent to re-issue if still needed._`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
             continue;
           }
-          await deps.callbackQueryHandlers().performVaultAccessApproval(p.ctx, stagedAccess, item.stageId, item.senderId, { kind: "passphrase", passphrase });
+          const outcome = await deps.callbackQueryHandlers().performVaultAccessApproval(p.ctx, stagedAccess, item.stageId, item.senderId, { kind: "passphrase", passphrase });
+          if (outcome?.kind === "passphrase-mismatch") {
+            mismatched.push(item);
+            mismatchMsg = outcome.msg;
+          }
+        }
+        if (mismatched.length > 0) {
+          await deps.callbackQueryHandlers().resolveAccessApprovalPassphraseMismatch(p.ctx, {
+            chat_id: p.chat_id,
+            failed: mismatched,
+            priorAttempts: pendingVault.attempts ?? 0,
+            brokerMsg: mismatchMsg
+          });
         }
       } else if (pendingVault.kind === "grant-wizard" && pendingVault.awaitingCustomDuration) {
         const input = p.text.trim();
@@ -43965,13 +43993,27 @@ async function interceptVault2(p, deps) {
         deps.vaultPassphraseCache.set(p.chat_id, { passphrase, expiresAt: Date.now() + deps.vaultPassphraseTtlMs });
         if (p.msgId != null)
           await deps.deleteSensitiveMessage(p.chat_id, p.msgId, "vault passphrase");
+        const mismatched = [];
+        let mismatchMsg = "";
         for (const item of pendingVault.items) {
           const stagedAccess = deps.pendingVaultRequestAccesses.get(item.stageId);
           if (!stagedAccess) {
             await p.ctx.api.editMessageText(item.cardChatId, item.cardMessageId, richMessage(`\u231b _Vault unlocked, but this access-request card expired or was denied before you replied. Ask the agent to re-issue if still needed._`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
             continue;
           }
-          await deps.callbackQueryHandlers().performVaultAccessApproval(p.ctx, stagedAccess, item.stageId, item.senderId, { kind: "passphrase", passphrase });
+          const outcome = await deps.callbackQueryHandlers().performVaultAccessApproval(p.ctx, stagedAccess, item.stageId, item.senderId, { kind: "passphrase", passphrase });
+          if (outcome?.kind === "passphrase-mismatch") {
+            mismatched.push(item);
+            mismatchMsg = outcome.msg;
+          }
+        }
+        if (mismatched.length > 0) {
+          await deps.callbackQueryHandlers().resolveAccessApprovalPassphraseMismatch(p.ctx, {
+            chat_id: p.chat_id,
+            failed: mismatched,
+            priorAttempts: pendingVault.attempts ?? 0,
+            brokerMsg: mismatchMsg
+          });
         }
       } else if (pendingVault.kind === "grant-wizard" && pendingVault.awaitingCustomDuration) {
         const input = p.text.trim();
@@ -46435,6 +46477,7 @@ var WORKER_HISTORY_MAX = 6;
 var STATUS_LINE_MAX = 200;
 var STATUS_CARD_CHAR_BUDGET = RICH_MESSAGE_MAX_CHARS;
 var NESTED_PREFIX = "   \u21b3 ";
+var WORKER_STEP_INDENT = "\u2800\u2800\u2800";
 
 // hooks/tool-label-pretool.mjs
 import { readFileSync as readFileSync9, mkdirSync as mkdirSync10, appendFileSync as appendFileSync2, existsSync as existsSync9 } from "node:fs";
@@ -46858,16 +46901,16 @@ function escapeStepLine(raw) {
   const cleaned = stripMarkdown(raw).replace(/\s+/g, " ").trim();
   return escapeMarkdown(truncate(cleaned, STATUS_LINE_MAX));
 }
-function renderStepFeed(out, steps, allDone, liveSuffix = "", window2 = STATUS_ROLLING_LINES) {
+function renderStepFeed(out, steps, allDone, liveSuffix = "", window2 = STATUS_ROLLING_LINES, indent = "") {
   if (steps.length === 0)
     return;
   const shown = steps.slice(-Math.max(1, window2));
   const hidden = steps.length - shown.length;
   if (hidden > 0)
-    out.push(`_\u2713 +${hidden} earlier\u2026_`);
+    out.push(`${indent}_\u2713 +${hidden} earlier\u2026_`);
   const lastIdx = shown.length - 1;
   shown.forEach((s, i) => {
-    out.push(!allDone && i === lastIdx ? `**\u2192 ${s}${liveSuffix}**` : `~~_\u2713 ${s}_~~`);
+    out.push(!allDone && i === lastIdx ? `${indent}**\u2192 ${s}${liveSuffix}**` : `${indent}~~_\u2713 ${s}_~~`);
   });
 }
 function renderStatusCard(opts) {
@@ -46907,7 +46950,7 @@ function renderStatusCard(opts) {
   }
   if (out.length === 0)
     return null;
-  const joined = stackCardLines(out);
+  const joined = stackCardLines(out, { collapseSafe: true });
   if (joined.length <= STATUS_CARD_CHAR_BUDGET)
     return joined;
   return fitCardToBudget(opts, headerLines);
@@ -46942,7 +46985,7 @@ function fitCardToBudget(opts, headerLines) {
     const lastIdx = shown.length - 1;
     shown.forEach((esc, i) => lines2.push(buildBullet(esc, i === lastIdx)));
     lines2.push(...footerLines);
-    const candidate = stackCardLines(lines2);
+    const candidate = stackCardLines(lines2, { collapseSafe: true });
     if (candidate.length <= STATUS_CARD_CHAR_BUDGET)
       return candidate;
   }
@@ -46963,7 +47006,7 @@ function fitCardToBudget(opts, headerLines) {
     lines.push(parentMarker);
   lines.push(newestLine);
   lines.push(...footerLines);
-  return stackCardLines(lines);
+  return stackCardLines(lines, { collapseSafe: true });
 }
 function renderActivityFeed(lines, final = false, liveSuffix = "", stepCount, header) {
   if (lines.length === 0 && header == null)
@@ -47016,6 +47059,13 @@ function combinedHistoryDepth(w) {
   return Math.min(WORKER_HISTORY_MAX, Math.max(MIN_WORKER_DEPTH, 7 - w));
 }
 var workerHistoryDepth = combinedHistoryDepth;
+function glanceLine(rows) {
+  const oldestMs = rows.reduce((m, r) => Math.max(m, r.elapsedMs), 0);
+  const tools = rows.reduce((n, r) => n + r.toolCount, 0);
+  const tok = rows.reduce((n, r) => n + (r.totalTokens ?? 0), 0);
+  const toolWord = tools === 1 ? "tool" : "tools";
+  return `\uD83D\uDEE0 **Workers** \u00b7 _${rows.length} running \u00b7 oldest ${formatFeedElapsed(oldestMs)}` + ` \u00b7 ${tools} ${toolWord}${tokenSegment(tok)}_`;
+}
 function renderCombinedWorkerFeed(rows, opts) {
   if (rows.length === 0)
     return null;
@@ -47038,22 +47088,22 @@ function renderCombinedWorkerFeed(rows, opts) {
     const shown = rows.slice(0, visibleCount);
     const hidden = rows.length - shown.length;
     const depth = combinedHistoryDepth(shown.length);
-    const chrome = [`\uD83D\uDEE0 **Workers** \u00b7 _${rows.length} running_`];
+    const chrome = [glanceLine(rows)];
     const bodyOut = [];
     for (const r of shown) {
       bodyOut.push(rowHeader(r));
       const hist = rowHistory(r);
       if (hist.length === 0) {
-        bodyOut.push("\u2192 _starting\u2026_");
+        bodyOut.push(`${WORKER_STEP_INDENT}\u2192 _starting\u2026_`);
         continue;
       }
       const esc = hist.slice(-depth).map(escapeStepLine);
-      renderStepFeed(bodyOut, esc, false, "", depth);
+      renderStepFeed(bodyOut, esc, false, "", depth, WORKER_STEP_INDENT);
     }
     const out = [...chrome, ...bodyOut];
     if (hidden > 0)
       out.push(`_+${hidden} more working\u2026_`);
-    return { body: stackCardLines(out), bodyLines: bodyOut.length };
+    return { body: stackCardLines(out, { collapseSafe: true }), bodyLines: bodyOut.length };
   };
   let visible = Math.min(rows.length, maxRows);
   let { body, bodyLines } = compose(visible);
@@ -47074,6 +47124,10 @@ function appendActivityLabel(lines, label) {
 }
 
 // send-gate.ts
+var systemClock = {
+  now: () => Date.now(),
+  sleep: (ms) => new Promise((r) => setTimeout(r, ms))
+};
 var SEND_GATE_SHED = Symbol.for("switchroom.send-gate.shed");
 function isSendGateShed(value) {
   return value === SEND_GATE_SHED;
@@ -47131,7 +47185,7 @@ function renderWorkerActivity(v, liveSuffix = "") {
     return `\uD83D\uDEE0 **Worker** \u00b7 _starting\u2026_`;
   }
   if (!finished && steps.length === 0) {
-    return `${card}  
+    return `${card}${COLLAPSE_SAFE_SEPARATOR}  
 _starting\u2026_`;
   }
   return card;
@@ -48032,6 +48086,16 @@ function errorDescription(err) {
 function isPinRightsError(err) {
   return errorDescription(err).includes("not enough rights");
 }
+function isUnpinTerminalError(err) {
+  if (isPinRightsError(err))
+    return true;
+  if (err != null && typeof err === "object") {
+    const code = err.error_code;
+    if (typeof code === "number")
+      return code >= 400 && code < 500 && code !== 429;
+  }
+  return false;
+}
 
 class PinRightsCache {
   blocked = new Set;
@@ -48055,18 +48119,20 @@ async function reconcilePin(args) {
   if (action.kind === "noop")
     return args.prevState;
   if (action.kind === "unpin") {
-    if (!args.rightsCache?.isBlocked(args.chatId)) {
-      try {
-        await args.api.unpinChatMessage(args.chatId, action.messageId);
-      } catch (err) {
-        if (args.rightsCache && isPinRightsError(err)) {
-          const firstTime = args.rightsCache.block(args.chatId);
-          if (firstTime)
-            args.onPinRightsDisabled?.(args.chatId);
-        } else {
-          args.onError?.("unpin", err);
-        }
+    if (args.rightsCache?.isBlocked(args.chatId))
+      return null;
+    try {
+      await args.api.unpinChatMessage(args.chatId, action.messageId);
+    } catch (err) {
+      if (args.rightsCache && isPinRightsError(err)) {
+        const firstTime = args.rightsCache.block(args.chatId);
+        if (firstTime)
+          args.onPinRightsDisabled?.(args.chatId);
+      } else {
+        args.onError?.("unpin", err);
       }
+      if (!isUnpinTerminalError(err))
+        return args.prevState;
     }
     return null;
   }
@@ -48498,8 +48564,7 @@ init_rich_send();
 var import_grammy4 = __toESM(require_mod2(), 1);
 import { execFileSync as execFileSync3 } from "child_process";
 import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join13 } from "path";
+import { dirname as dirname5 } from "path";
 init_client();
 
 // gateway/vault-grant-inbound-builders.ts
@@ -49532,6 +49597,48 @@ var _deprecationSeen = new Set;
 
 // gateway/callback-query-handlers.ts
 var AUTH_REFRESH_THROTTLE_MS = 5000;
+var MAX_VAULT_PASSPHRASE_ATTEMPTS = 3;
+function isPassphraseMismatchBrokerError(msg) {
+  const m = msg.toLowerCase();
+  if (!m.includes("passphrase"))
+    return false;
+  return m.includes("does not match") || m.includes("mismatch");
+}
+function buildAccessPassphrasePromptText(opts) {
+  const header = `**\uD83D\uDEA8\uD83D\uDD10 ACTION NEEDED: passphrase required**`;
+  if (opts.kind === "retry") {
+    const plural = opts.retryRemaining === 1 ? "attempt" : "attempts";
+    return `${header}
+
+` + `Wrong passphrase. ${opts.retryRemaining} ${plural} remaining.
+` + `Type your vault passphrase again as your **next message**.
+` + (opts.itemCount > 1 ? `One entry covers **${opts.itemCount}** pending approvals in this chat.
+` : ``) + `
+_We delete the passphrase message the moment we read it._`;
+  }
+  if (opts.variant === "batch") {
+    return `${header}
+
+` + `Type your vault passphrase as your **next message**.
+` + `One entry covers **${opts.itemCount}** pending approvals in this chat, no re-type per card.
+
+` + `_We delete the passphrase message the moment we read it._`;
+  }
+  if (opts.variant === "admin-only") {
+    return `${header}
+
+` + `\`${opts.key}\` is an **admin-only credential**.
+` + `Type your vault passphrase as your **next message** to mint the grant for **${opts.agentEscaped}**.
+
+` + `_The passphrase is what proves it's you. An agent can never mint this key on its own. We delete the passphrase message the moment we read it._`;
+  }
+  return `${header}
+
+` + `Your vault is locked.
+` + `Reply with your passphrase as your **next message** to unlock and mint the grant for **${opts.agentEscaped}**.
+
+` + `_Mint authority stays operator-only: the broker only accepts the grant when the passphrase matches. We delete the passphrase message the moment we read it._`;
+}
 function createCallbackQueryHandlers(deps) {
   const {
     loadAccess,
@@ -49574,6 +49681,10 @@ function createCallbackQueryHandlers(deps) {
   } = deps;
   const bot = deps.bot;
   const lockedBot = deps.lockedBot;
+  const mintGrantViaBroker2 = deps.brokerMintGrant ?? mintGrantViaBroker;
+  const listViaBroker2 = deps.brokerList ?? listViaBroker;
+  const listGrantsViaBroker2 = deps.brokerListGrants ?? listGrantsViaBroker;
+  const vaultTokenFilePath2 = deps.brokerVaultTokenFilePath ?? vaultTokenFilePath;
   async function handleVaultRecentDenialCallback(ctx, data) {
     const senderId = String(ctx.from?.id ?? "");
     const access = loadAccess();
@@ -49596,7 +49707,7 @@ function createCallbackQueryHandlers(deps) {
       return;
     }
     await ctx.answerCallbackQuery({ text: "\u23f3 Minting 30-day read grant\u2026" }).catch(() => {});
-    const result = await mintGrantViaBroker({
+    const result = await mintGrantViaBroker2({
       agent: agentName,
       keys: [keyName],
       ttl_seconds: 30 * 24 * 60 * 60,
@@ -49611,9 +49722,9 @@ function createCallbackQueryHandlers(deps) {
       return;
     }
     const { token, id } = result;
-    const tokenPath = join13(homedir5(), ".switchroom", "agents", agentName, ".vault-token");
+    const tokenPath = vaultTokenFilePath2(agentName);
     try {
-      mkdirSync13(join13(homedir5(), ".switchroom", "agents", agentName), { recursive: true });
+      mkdirSync13(dirname5(tokenPath), { recursive: true });
       writeFileSync9(tokenPath, token, { mode: 384 });
     } catch (err) {
       await switchroomReply(ctx, `**Grant created (${escapeHtmlForTg2(id)}) but token write failed:** ` + `${escapeHtmlForTg2(String(err))}
@@ -49630,25 +49741,93 @@ function createCallbackQueryHandlers(deps) {
       newText: baseText ? `${baseText}${statusLine}` : statusLine
     });
   }
+  async function editResolvedCard(ctx, target, messageId, markdown, label) {
+    if (messageId > 0) {
+      try {
+        await robustApiCall(() => ctx.api.editMessageText(target.chat_id, messageId, richMessage(markdown), {
+          reply_markup: { inline_keyboard: [] }
+        }), { chat_id: target.chat_id, verb: `vault_request_access.${label}_edit` });
+        return;
+      } catch (err) {
+        process.stderr.write(`telegram gateway: vault card resolution edit FAILED (${label}) ` + `chat=${target.chat_id} msg=${messageId}: ${String(err)} \u2014 sending fallback message
+`);
+      }
+    }
+    try {
+      await retryWithThreadFallback(robustApiCall, (tid) => lockedBot.api.sendRichMessage(target.chat_id, richMessage(markdown), {
+        ...tid != null && Number.isFinite(tid) ? { message_thread_id: tid } : {}
+      }), {
+        threadId: target.threadId,
+        chat_id: target.chat_id,
+        verb: `vault_request_access.${label}_fallback`
+      });
+    } catch (err) {
+      process.stderr.write(`telegram gateway: vault card resolution FALLBACK SEND failed (${label}) ` + `chat=${target.chat_id}: ${String(err)}
+`);
+    }
+  }
+  async function sendAccessPassphrasePrompt(target, spec) {
+    const promptText = buildAccessPassphrasePromptText(spec);
+    await retryWithThreadFallback(robustApiCall, (tid) => lockedBot.api.sendRichMessage(target.chat_id, richMessage(promptText), {
+      ...tid != null && Number.isFinite(tid) ? { message_thread_id: tid } : {}
+    }), {
+      threadId: target.threadId,
+      chat_id: target.chat_id,
+      verb: "vault_request_access.passphrase_prompt"
+    }).catch((err) => {
+      process.stderr.write(`telegram gateway: vault passphrase prompt send FAILED chat=${target.chat_id} ` + `kind=${spec.kind}: ${String(err)}
+`);
+    });
+  }
+  async function resolveAccessApprovalPassphraseMismatch(ctx, args) {
+    const { chat_id, failed, priorAttempts, brokerMsg } = args;
+    if (failed.length === 0)
+      return;
+    vaultPassphraseCache.delete(chat_id);
+    const attempts = priorAttempts + 1;
+    const remaining = MAX_VAULT_PASSPHRASE_ATTEMPTS - attempts;
+    const threadId = failed.find((it) => it.threadId != null)?.threadId;
+    process.stderr.write(`telegram gateway: vault_request_access passphrase mismatch chat=${chat_id} ` + `stages=${failed.map((f) => f.stageId).join(",")} attempts=${attempts}/${MAX_VAULT_PASSPHRASE_ATTEMPTS}
+`);
+    if (remaining > 0) {
+      const open = pendingVaultOps.get(chat_id);
+      const carried = open?.kind === "passphrase-for-access-approve" ? open.items.filter((it) => !failed.some((f) => f.stageId === it.stageId)) : [];
+      const requeued = [...failed, ...carried];
+      pendingVaultOps.set(chat_id, {
+        kind: "passphrase-for-access-approve",
+        items: requeued,
+        attempts,
+        startedAt: Date.now()
+      });
+      await sendAccessPassphrasePrompt({ chat_id, ...threadId != null ? { threadId } : {} }, { kind: "retry", retryRemaining: remaining, itemCount: requeued.length });
+      return;
+    }
+    for (const item of failed) {
+      pendingVaultRequestAccesses.delete(item.stageId);
+      pendingCardStore.remove(item.stageId);
+      await editResolvedCard(ctx, { chat_id: item.cardChatId, ...item.threadId != null ? { threadId: item.threadId } : {} }, item.cardMessageId, `\u274c **Too many wrong passphrase attempts** (${MAX_VAULT_PASSPHRASE_ATTEMPTS}). ` + `This request was cancelled \u2014 ask the agent to re-issue it.
+` + `_Broker: ${escapeHtmlForTg2(brokerMsg)}_`, "passphrase_lockout");
+    }
+  }
   async function performVaultAccessApproval(ctx, pending, stageId, senderId, attestation) {
     const brokerAuthOpts = attestation.kind === "passphrase" ? { passphrase: attestation.passphrase } : { attest_via_posture: true };
     if (pending.scope === "read") {
       try {
-        const visible = await listViaBroker();
+        const visible = await listViaBroker2();
         if (visible !== null && visible.includes(pending.key)) {
           pendingVaultRequestAccesses.delete(stageId);
           pendingCardStore.remove(stageId);
           if (pending.card_message_id != null) {
-            await ctx.api.editMessageText(pending.chat_id, pending.card_message_id, `\u2139\ufe0f **${escapeHtmlForTg2(pending.agent)}** already has standing-ACL access to ` + `\`${pending.key}\` (schedule.secrets[]). ` + `**No grant minted** \u2014 a token would shadow the standing ACL. ` + richMessage(`The agent can read it directly.`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
+            await editResolvedCard(ctx, pending, pending.card_message_id, `\u2139\ufe0f **${escapeHtmlForTg2(pending.agent)}** already has standing-ACL access to ` + `\`${pending.key}\` (schedule.secrets[]). ` + `**No grant minted** \u2014 a token would shadow the standing ACL. ` + `The agent can read it directly.`, "standing_acl");
           }
-          return;
+          return { kind: "ok" };
         }
       } catch {}
     }
     let existingReadKeys = [];
     let existingWriteKeys = [];
     if (pending.scope === "read" || pending.scope === "write") {
-      const list = await listGrantsViaBroker(pending.agent, brokerAuthOpts);
+      const list = await listGrantsViaBroker2(pending.agent, brokerAuthOpts);
       if (list.kind === "ok") {
         const now = Math.floor(Date.now() / 1000);
         const active = list.grants.filter((g) => g.expires_at === null || g.expires_at > now).sort((a, b) => {
@@ -49677,28 +49856,31 @@ function createCallbackQueryHandlers(deps) {
       ...writeKeys.size > 0 ? { write_keys: Array.from(writeKeys) } : {},
       ...brokerAuthOpts
     };
-    const result = await mintGrantViaBroker(mintArgs);
+    const result = await mintGrantViaBroker2(mintArgs);
     if (result.kind === "unreachable") {
       await switchroomReply(ctx, `\uD83D\uDD34 Broker unreachable: ${escapeHtmlForTg2(result.msg)}`, { html: true });
-      return;
+      return { kind: "failed", msg: result.msg };
     }
     if (result.kind === "error") {
+      if (attestation.kind === "passphrase" && isPassphraseMismatchBrokerError(result.msg)) {
+        return { kind: "passphrase-mismatch", msg: result.msg };
+      }
       pendingVaultRequestAccesses.delete(stageId);
       pendingCardStore.remove(stageId);
       if (pending.card_message_id != null) {
-        await ctx.api.editMessageText(pending.chat_id, pending.card_message_id, richMessage(`**mint_grant failed:** ${escapeHtmlForTg2(result.msg)}`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
+        await editResolvedCard(ctx, pending, pending.card_message_id, `**mint_grant failed:** ${escapeHtmlForTg2(result.msg)}`, "mint_failed");
       }
-      return;
+      return { kind: "failed", msg: result.msg };
     }
     const { token, id } = result;
-    const tokenPath = join13(homedir5(), ".switchroom", "agents", pending.agent, ".vault-token");
+    const tokenPath = vaultTokenFilePath2(pending.agent);
     try {
-      mkdirSync13(join13(homedir5(), ".switchroom", "agents", pending.agent), { recursive: true });
+      mkdirSync13(dirname5(tokenPath), { recursive: true });
       writeFileSync9(tokenPath, token, { mode: 384 });
     } catch (err) {
       await switchroomReply(ctx, `**Grant created (${escapeHtmlForTg2(id)}) but token write failed:** ` + `${escapeHtmlForTg2(String(err))}
 ` + `_Recover with: \`switchroom vault grant ${escapeHtmlForTg2(pending.agent)} ` + `--keys ${escapeHtmlForTg2(pending.key)} --duration ${Math.round(pending.ttl_seconds / 86400)}d\` on the host._`, { html: true });
-      return;
+      return { kind: "failed", msg: String(err) };
     }
     pendingVaultRequestAccesses.delete(stageId);
     pendingCardStore.remove(stageId);
@@ -49707,7 +49889,7 @@ function createCallbackQueryHandlers(deps) {
       const reasonNormalized = normalizeGrantReason(pending.reason);
       const footer = getVaultApprovalAuthMode() === "telegram-id" ? `
 _Approver verified by Telegram identity \u2014 broker auto-unlocked at startup._` : "";
-      await ctx.api.editMessageText(pending.chat_id, pending.card_message_id, richMessage(buildVaultGrantApprovedCardText({
+      await editResolvedCard(ctx, pending, pending.card_message_id, buildVaultGrantApprovedCardText({
         agentEscaped: escapeHtmlForTg2(pending.agent),
         scope: pending.scope,
         key: pending.key,
@@ -49715,7 +49897,7 @@ _Approver verified by Telegram identity \u2014 broker auto-unlocked at startup._
         grantId: id,
         reasonEscaped: reasonNormalized.length > 0 ? escapeHtmlForTg2(reasonNormalized) : undefined,
         footer
-      })), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
+      }), "grant_approved");
     }
     const synthetic = buildVaultGrantApprovedInbound({
       ctx: {
@@ -49733,6 +49915,7 @@ _Approver verified by Telegram identity \u2014 broker auto-unlocked at startup._
     const delivered = deliverResumeSyntheticOrBuffer(pending.agent, synthetic);
     process.stderr.write(`telegram gateway: vault_grant_approved injection agent=${pending.agent} ` + `key=${pending.key} stage=${stageId} delivered=${delivered}
 `);
+    return { kind: "ok" };
   }
   async function handleSkillProposalCallback(ctx, data) {
     const senderId = String(ctx.from?.id ?? "");
@@ -50025,40 +50208,53 @@ _Approver verified by Telegram identity \u2014 broker auto-unlocked at startup._
           stageId,
           cardChatId: pending.chat_id,
           cardMessageId: pending.card_message_id,
-          senderId
+          senderId,
+          ...pending.threadId != null ? { threadId: pending.threadId } : {}
         };
         const items = existing?.kind === "passphrase-for-access-approve" ? [...existing.items.filter((it) => it.stageId !== stageId), newItem] : [newItem];
         pendingVaultOps.set(pending.chat_id, {
           kind: "passphrase-for-access-approve",
           items,
+          ...existing?.kind === "passphrase-for-access-approve" && existing.attempts ? { attempts: existing.attempts } : {},
           startedAt: existing?.kind === "passphrase-for-access-approve" ? existing.startedAt : Date.now()
         });
         const joiningBatch = items.length > 1;
         await ctx.answerCallbackQuery({ text: joiningBatch ? `\uD83D\uDD10 Queued \u2014 one passphrase covers ${items.length} cards` : "\uD83D\uDD10 Send your passphrase\u2026" }).catch(() => {});
         await ctx.api.editMessageText(pending.chat_id, pending.card_message_id, richMessage(`\uD83D\uDD10 _Approved \u2014 waiting for your vault passphrase. See the prompt below._`), { reply_markup: { inline_keyboard: [] } }).catch(() => {});
-        const promptText = joiningBatch ? `**\u26a0\ufe0f\uD83D\uDD10 ACTION NEEDED: passphrase required**
-
-` + `Type your vault passphrase as your **next message**.
-` + `One entry covers **${items.length}** pending approvals in this chat, no re-type per card.
-
-` + `_We delete the passphrase message the moment we read it._` : isAdminOnly ? `**\u26a0\ufe0f\uD83D\uDD10 ACTION NEEDED: passphrase required**
-
-` + `\`${pending.key}\` is an **admin-only credential**.
-` + `Type your vault passphrase as your **next message** to mint the grant for **${escapeHtmlForTg2(pending.agent)}**.
-
-` + `_The passphrase is what proves it's you. An agent can never mint this key on its own. We delete the passphrase message the moment we read it._` : `**\u26a0\ufe0f\uD83D\uDD10 ACTION NEEDED: passphrase required**
-
-` + `Your vault is locked.
-` + `Reply with your passphrase as your **next message** to unlock and mint the grant for **${escapeHtmlForTg2(pending.agent)}**.
-
-` + `_Mint authority stays operator-only: the broker only accepts the grant when the passphrase matches. We delete the passphrase message the moment we read it._`;
-        await retryWithThreadFallback(robustApiCall, (tid) => lockedBot.api.sendRichMessage(pending.chat_id, richMessage(promptText), {
-          ...tid != null && Number.isFinite(tid) ? { message_thread_id: tid } : {}
-        }), { threadId: pending.threadId, chat_id: pending.chat_id, verb: "vault_request_access.passphrase_prompt" }).catch(() => {});
+        await sendAccessPassphrasePrompt({
+          chat_id: pending.chat_id,
+          ...pending.threadId != null ? { threadId: pending.threadId } : {}
+        }, {
+          kind: "first",
+          variant: joiningBatch ? "batch" : isAdminOnly ? "admin-only" : "locked",
+          itemCount: items.length,
+          agentEscaped: escapeHtmlForTg2(pending.agent),
+          key: pending.key
+        });
         return;
       }
       await ctx.answerCallbackQuery({ text: "\u23f3 Minting grant\u2026" }).catch(() => {});
-      await performVaultAccessApproval(ctx, pending, stageId, senderId, { kind: "passphrase", passphrase: cached.passphrase });
+      const outcome = await performVaultAccessApproval(ctx, pending, stageId, senderId, {
+        kind: "passphrase",
+        passphrase: cached.passphrase
+      });
+      if (outcome.kind === "passphrase-mismatch") {
+        const openOp = pendingVaultOps.get(pending.chat_id);
+        await resolveAccessApprovalPassphraseMismatch(ctx, {
+          chat_id: pending.chat_id,
+          failed: [
+            {
+              stageId,
+              cardChatId: pending.chat_id,
+              cardMessageId: pending.card_message_id ?? 0,
+              senderId,
+              ...pending.threadId != null ? { threadId: pending.threadId } : {}
+            }
+          ],
+          priorAttempts: openOp?.kind === "passphrase-for-access-approve" ? openOp.attempts ?? 0 : 0,
+          brokerMsg: outcome.msg
+        });
+      }
       return;
     }
     await ctx.answerCallbackQuery({ text: "Unknown action" }).catch(() => {});
@@ -50399,7 +50595,7 @@ Which agent?`, { html: true, reply_markup: kb });
     });
   }
   async function grantWizardStep2(ctx, chatId, agent, wizardMsgId) {
-    const keys = await listViaBroker();
+    const keys = await listViaBroker2();
     if (!keys) {
       await switchroomReply(ctx, "\uD83D\uDD34 Broker is not running (or unreachable). Cannot list vault keys.", { html: true });
       pendingVaultOps.delete(chatId);
@@ -50490,7 +50686,7 @@ ${keyList}`,
     } catch {
       return;
     }
-    const result = await mintGrantViaBroker({
+    const result = await mintGrantViaBroker2({
       agent: state.agent,
       keys: state.selectedKeys,
       ttl_seconds: state.ttlSeconds ?? null,
@@ -50505,9 +50701,9 @@ ${keyList}`,
       return;
     }
     const { token, id } = result;
-    const tokenPath = join13(homedir5(), ".switchroom", "agents", state.agent, ".vault-token");
+    const tokenPath = vaultTokenFilePath2(state.agent);
     try {
-      mkdirSync13(join13(homedir5(), ".switchroom", "agents", state.agent), { recursive: true });
+      mkdirSync13(dirname5(tokenPath), { recursive: true });
       writeFileSync9(tokenPath, token, { mode: 384 });
     } catch (err) {
       await switchroomReply(ctx, `**Grant created but token write failed:** ${escapeHtmlForTg2(String(err))}`, { html: true });
@@ -50534,7 +50730,7 @@ ${keyList}`,
     const revokeMatch = /^vg:revoke:(.+)$/.exec(data);
     if (revokeMatch) {
       const grantId = revokeMatch[1];
-      const result = await listGrantsViaBroker(undefined);
+      const result = await listGrantsViaBroker2(undefined);
       if (result.kind !== "ok") {
         await ctx.answerCallbackQuery({ text: "Broker unreachable." }).catch(() => {});
         return;
@@ -50983,6 +51179,7 @@ ${trimmed.replace(/```/g, "`\u200b``")}
   return {
     handleVaultRecentDenialCallback,
     performVaultAccessApproval,
+    resolveAccessApprovalPassphraseMismatch,
     handleSkillProposalCallback,
     handleMentalModelProposeCallback,
     handleVaultRequestAccessCallback,
@@ -51955,7 +52152,7 @@ function pickRecoveredPermissionOrigin(recentTurns, now, maxAgeMs) {
 
 // gateway/approval-hold.ts
 import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync11, readFileSync as readFileSync13, unlinkSync as unlinkSync9, chmodSync as chmodSync4, lstatSync as lstatSync2 } from "node:fs";
-import { join as join16, dirname as dirname5 } from "node:path";
+import { join as join16, dirname as dirname6 } from "node:path";
 var BLOCKED_APPROVAL_FILE_MODE = 420;
 var BLOCKED_APPROVAL_DIR_MODE = 1023;
 var HELD_RETRY_BACKOFF_MS = 60000;
@@ -51988,7 +52185,7 @@ function createBlockedApprovalStore(dir, agent, fallbackDir) {
   const fallback = fallbackDir != null ? join16(fallbackDir, "blocked-approval.json") : null;
   let active = primary;
   function tryWrite(target, body, dirMode) {
-    const parent = dirname5(target);
+    const parent = dirname6(target);
     try {
       mkdirSync14(parent, { recursive: true });
       try {
@@ -62658,9 +62855,249 @@ async function retryWithThreadFallback2(retry, send, opts) {
   }
 }
 
+// edit-flood-fuse.ts
+var EDIT_METHODS = new Set([
+  "editMessageText",
+  "editMessageCaption",
+  "editMessageMedia",
+  "editMessageReplyMarkup",
+  "editMessageLiveLocation",
+  "editMessageChecklist"
+]);
+var SEND_METHODS = new Set([
+  "sendMessage",
+  "sendPhoto",
+  "sendDocument",
+  "sendMediaGroup",
+  "sendAnimation",
+  "sendVideo",
+  "sendVoice",
+  "sendAudio",
+  "sendSticker",
+  "sendLocation",
+  "forwardMessage",
+  "forwardMessages",
+  "copyMessage",
+  "copyMessages",
+  "sendRichMessage"
+]);
+var EDIT_FLOOD_FUSE_DEFAULTS = {
+  perMessageMaxPerWindow: 20,
+  perMessageWindowMs: 60000,
+  perChatEditMaxPerWindow: 30,
+  perChatSendMaxPerWindow: 25,
+  perChatWindowMs: 60000,
+  maxDeferMs: 30000,
+  tightenFactor: 0.5,
+  tightenMs: 600000
+};
+var DROPPED_RESULT = true;
+function createEditFloodFuse(config = {}) {
+  const enabled2 = config.enabled ?? true;
+  const clock = config.clock ?? systemClock;
+  const D = EDIT_FLOOD_FUSE_DEFAULTS;
+  const perMessageMax = config.perMessageMaxPerWindow ?? D.perMessageMaxPerWindow;
+  const perMessageWindowMs = config.perMessageWindowMs ?? D.perMessageWindowMs;
+  const perChatEditMax = config.perChatEditMaxPerWindow ?? D.perChatEditMaxPerWindow;
+  const perChatSendMax = config.perChatSendMaxPerWindow ?? D.perChatSendMaxPerWindow;
+  const perChatWindowMs = config.perChatWindowMs ?? D.perChatWindowMs;
+  const maxDeferMs = config.maxDeferMs ?? D.maxDeferMs;
+  const tightenFactor = config.tightenFactor ?? D.tightenFactor;
+  const tightenMs = config.tightenMs ?? D.tightenMs;
+  const onTrip = config.onTrip;
+  const windows = new Map;
+  const counters = { deferred: 0, dropped: 0, superseded: 0, floodObserved: 0 };
+  let tightenedUntil = 0;
+  function isTightened(now) {
+    return tightenedUntil > now;
+  }
+  function ceiling(base, now) {
+    if (!isTightened(now))
+      return base;
+    return Math.max(1, Math.floor(base * tightenFactor));
+  }
+  function win(key) {
+    let w = windows.get(key);
+    if (w === undefined) {
+      w = { ts: [], waiter: null, inflight: 0 };
+      windows.set(key, w);
+    }
+    return w;
+  }
+  function prune(w, now, windowMs) {
+    const cutoff = now - windowMs;
+    while (w.ts.length > 0 && w.ts[0] <= cutoff)
+      w.ts.shift();
+  }
+  let sinceEvict = 0;
+  function evict(now) {
+    if (windows.size < 4096)
+      return;
+    if (++sinceEvict < 1024)
+      return;
+    sinceEvict = 0;
+    const widest = Math.max(perMessageWindowMs, perChatWindowMs);
+    for (const [k, w] of windows) {
+      if (w.waiter === null && w.inflight === 0 && (w.ts.length === 0 || w.ts[w.ts.length - 1] <= now - widest)) {
+        windows.delete(k);
+      }
+    }
+  }
+  function waitFor(w, now, windowMs, max) {
+    prune(w, now, windowMs);
+    if (w.ts.length < max)
+      return 0;
+    return Math.max(1, w.ts[0] + windowMs - now);
+  }
+  function payloadKeys(payload) {
+    const p = payload ?? {};
+    const chat = p.chat_id != null ? String(p.chat_id) : null;
+    const msg = p.message_id != null ? String(p.message_id) : null;
+    return { chat, msg };
+  }
+  function noteFlood(now) {
+    counters.floodObserved++;
+    tightenedUntil = now + tightenMs;
+  }
+  function looksLikeFlood(err) {
+    const e = err;
+    if (e != null && typeof e === "object") {
+      if (e.error_code === 429)
+        return true;
+      if (e.parameters != null && typeof e.parameters.retry_after === "number")
+        return true;
+    }
+    const msg = err instanceof Error ? err.message : String(err ?? "");
+    return /too many requests/i.test(msg) || /retry[ _-]?after/i.test(msg);
+  }
+  function unreserve(key, at) {
+    const w = windows.get(key);
+    if (w === undefined)
+      return;
+    const i = w.ts.lastIndexOf(at);
+    if (i >= 0)
+      w.ts.splice(i, 1);
+  }
+  async function awaitRoom(key, windowMs, max, method, mode, dropGuard) {
+    const w = win(key);
+    const deadline = clock.now() + maxDeferMs;
+    let counted = false;
+    for (;; ) {
+      const now = clock.now();
+      const wait = waitFor(w, now, windowMs, ceiling(max, now));
+      if (wait === 0) {
+        w.ts.push(now);
+        return now;
+      }
+      if (now >= deadline) {
+        if (mode !== "release" && (dropGuard === undefined || dropGuard())) {
+          counters.dropped++;
+          onTrip?.({ method, key, action: "dropped" });
+          return null;
+        }
+        w.ts.push(now);
+        return now;
+      }
+      if (!counted) {
+        counters.deferred++;
+        counted = true;
+        onTrip?.({ method, key, action: "deferred" });
+      }
+      let killed = false;
+      if (mode === "supersede") {
+        w.waiter?.kill();
+        const superseded = new Promise((resolve6) => {
+          w.waiter = { kill: () => {
+            killed = true;
+            resolve6();
+          } };
+        });
+        await Promise.race([clock.sleep(Math.min(wait, deadline - now)), superseded]);
+        if (killed) {
+          counters.superseded++;
+          onTrip?.({ method, key, action: "superseded" });
+          return null;
+        }
+        w.waiter = null;
+      } else {
+        await clock.sleep(Math.min(wait, deadline - now));
+      }
+    }
+  }
+  async function apply(method, payload, next) {
+    if (!enabled2)
+      return next();
+    const isEdit = EDIT_METHODS.has(method);
+    const isSend = SEND_METHODS.has(method);
+    if (!isEdit && !isSend)
+      return runObserved(next);
+    const { chat, msg } = payloadKeys(payload);
+    if (chat == null)
+      return runObserved(next);
+    const now = clock.now();
+    evict(now);
+    if (isEdit) {
+      if (msg == null)
+        return runObserved(next);
+      const msgKey = `m:${chat}:${msg}`;
+      const mw = win(msgKey);
+      mw.inflight++;
+      try {
+        const msgSlot = await awaitRoom(msgKey, perMessageWindowMs, perMessageMax, method, "supersede");
+        if (msgSlot === null)
+          return DROPPED_RESULT;
+        const chatKey3 = `ce:${chat}`;
+        const chatSlot = await awaitRoom(chatKey3, perChatWindowMs, perChatEditMax, method, "drop", () => mw.inflight > 1);
+        if (chatSlot === null) {
+          unreserve(msgKey, msgSlot);
+          return DROPPED_RESULT;
+        }
+        return runObserved(next);
+      } finally {
+        mw.inflight--;
+      }
+    }
+    const chatKey2 = `cs:${chat}`;
+    await awaitRoom(chatKey2, perChatWindowMs, perChatSendMax, method, "release");
+    return runObserved(next);
+  }
+  async function runObserved(next) {
+    try {
+      const res = await next();
+      const r = res;
+      if (r != null && typeof r === "object" && r.ok === false && r.error_code === 429) {
+        noteFlood(clock.now());
+      }
+      return res;
+    } catch (err) {
+      if (looksLikeFlood(err))
+        noteFlood(clock.now());
+      throw err;
+    }
+  }
+  function stats() {
+    const now = clock.now();
+    return {
+      enabled: enabled2,
+      deferred: counters.deferred,
+      dropped: counters.dropped,
+      superseded: counters.superseded,
+      floodObserved: counters.floodObserved,
+      tightened: isTightened(now),
+      perMessageCeiling: ceiling(perMessageMax, now)
+    };
+  }
+  return { apply, stats };
+}
+function installEditFloodFuse(bot, config = {}) {
+  const fuse = createEditFloodFuse(config);
+  bot.api.config.use(async (prev, method, payload, signal) => fuse.apply(method, payload, () => prev(method, payload, signal)));
+  return fuse;
+}
+
 // send-gate.ts
 import { createHash } from "node:crypto";
-var systemClock = {
+var systemClock2 = {
   now: () => Date.now(),
   sleep: (ms) => new Promise((r) => setTimeout(r, ms))
 };
@@ -62761,7 +63198,7 @@ var SEND_GATE_DEFAULTS = {
 };
 function createSendGate(config) {
   const enabled2 = config.enabled;
-  const clock = config.clock ?? systemClock;
+  const clock = config.clock ?? systemClock2;
   const globalPerSec = config.globalPerSec ?? SEND_GATE_DEFAULTS.globalPerSec;
   const globalBurst = config.globalBurst ?? SEND_GATE_DEFAULTS.globalBurst;
   const perChatPerSec = config.perChatPerSec ?? SEND_GATE_DEFAULTS.perChatPerSec;
@@ -63491,7 +63928,7 @@ import {
   unlinkSync as unlinkSync10,
   renameSync as renameSync9
 } from "node:fs";
-import { dirname as dirname6, join as join17 } from "node:path";
+import { dirname as dirname7, join as join17 } from "node:path";
 var FLOOD_STATE_FILE = "flood-wait.json";
 var FLOOD_STATE_MODE = 420;
 function floodStatePath(stateDir) {
@@ -63544,7 +63981,7 @@ function readFloodState(path2) {
 function writeFloodState(path2, state, log = (l) => process.stderr.write(l)) {
   const payload = JSON.stringify(state);
   try {
-    mkdirSync15(dirname6(path2), { recursive: true });
+    mkdirSync15(dirname7(path2), { recursive: true });
   } catch {}
   try {
     writeFileSync12(path2, payload, { mode: FLOOD_STATE_MODE });
@@ -63675,7 +64112,7 @@ function readFloodWindows(path2, now, log = (l) => process.stderr.write(l)) {
 }
 function writeFloodWindow(path2, record, now) {
   try {
-    mkdirSync15(dirname6(path2), { recursive: true });
+    mkdirSync15(dirname7(path2), { recursive: true });
     const existing = readFloodWindows(path2, now);
     const byScope = new Map;
     for (const r of existing)
@@ -63850,7 +64287,7 @@ function __resetAllForTests() {
 }
 
 // ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
-import { dirname as dirname7, posix, sep as sep3 } from "path";
+import { dirname as dirname8, posix, sep as sep3 } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
   return async (frames) => {
@@ -63859,7 +64296,7 @@ function createModulerModifier() {
     return frames;
   };
 }
-function createGetModuleFromFilename(basePath = process.argv[1] ? dirname7(process.argv[1]) : process.cwd(), isWindows = sep3 === "\\") {
+function createGetModuleFromFilename(basePath = process.argv[1] ? dirname8(process.argv[1]) : process.cwd(), isWindows = sep3 === "\\") {
   const normalizedBase = isWindows ? normalizeWindowsPath(basePath) : basePath;
   return (filename) => {
     if (!filename)
@@ -68291,7 +68728,7 @@ class PostHog extends PostHogBackendClient {
 
 // analytics-posthog.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync16, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname8, join as join19 } from "node:path";
+import { dirname as dirname9, join as join19 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 var DEFAULT_KEY = "phc_qKY87cKWZm6ZyCtk7LcRd2cU8Sg42u7Ywhui5stYCegd";
 var DEFAULT_HOST = "https://us.i.posthog.com";
@@ -68330,7 +68767,7 @@ function getDistinctId() {
   const id = randomUUID2();
   cachedDistinctId = id;
   try {
-    mkdirSync16(dirname8(fallbackPath), { recursive: true });
+    mkdirSync16(dirname9(fallbackPath), { recursive: true });
     writeFileSync13(fallbackPath, id, "utf-8");
   } catch {}
   return id;
@@ -68403,11 +68840,11 @@ function installGlobalErrorHandlers() {
 
 // runtime-metrics.ts
 import { mkdirSync as mkdirSync18, appendFileSync as appendFileSync3 } from "node:fs";
-import { dirname as dirname10, join as join21 } from "node:path";
+import { dirname as dirname11, join as join21 } from "node:path";
 
 // analytics-posthog.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync17, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "node:fs";
-import { dirname as dirname9, join as join20 } from "node:path";
+import { dirname as dirname10, join as join20 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var DEFAULT_KEY2 = "phc_qKY87cKWZm6ZyCtk7LcRd2cU8Sg42u7Ywhui5stYCegd";
 var DEFAULT_HOST2 = "https://us.i.posthog.com";
@@ -68445,7 +68882,7 @@ function getDistinctId2() {
   const id = randomUUID3();
   cachedDistinctId2 = id;
   try {
-    mkdirSync17(dirname9(fallbackPath), { recursive: true });
+    mkdirSync17(dirname10(fallbackPath), { recursive: true });
     writeFileSync14(fallbackPath, id, "utf-8");
   } catch {}
   return id;
@@ -68500,7 +68937,7 @@ function resolveJsonlPath() {
 function appendJsonl(line) {
   const path2 = resolveJsonlPath();
   try {
-    mkdirSync18(dirname10(path2), { recursive: true });
+    mkdirSync18(dirname11(path2), { recursive: true });
     appendFileSync3(path2, line + `
 `, "utf-8");
   } catch (err) {
@@ -69169,8 +69606,8 @@ function __resetAllForTests3() {
 
 // silent-end.ts
 import { existsSync as existsSync16, readFileSync as readFileSync17, writeFileSync as writeFileSync15, unlinkSync as unlinkSync11, mkdirSync as mkdirSync19 } from "node:fs";
-import { dirname as dirname11, join as join22 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { dirname as dirname12, join as join22 } from "node:path";
+import { homedir as homedir5 } from "node:os";
 var SILENT_END_MAX_RETRIES = 2;
 var SILENT_END_STALE_RECORD_MAX_AGE_MS = 30 * 60000;
 function resolveStateDir(deps) {
@@ -69179,7 +69616,7 @@ function resolveStateDir(deps) {
   const env = process.env.TELEGRAM_STATE_DIR;
   if (env != null && env !== "")
     return env;
-  const home2 = process.env.HOME ?? homedir6();
+  const home2 = process.env.HOME ?? homedir5();
   return join22(home2, ".claude", "channels", "telegram");
 }
 function resolveStatePath2(deps) {
@@ -69212,7 +69649,7 @@ function writeSilentEndState(args, deps) {
     timestamp: Date.now()
   };
   try {
-    mkdirSync19(dirname11(statePath), { recursive: true });
+    mkdirSync19(dirname12(statePath), { recursive: true });
     writeFileSync15(statePath, JSON.stringify(state3), "utf8");
     emitLog(deps, `silent-end: wrote state file turnKey=${args.turnKey} retryCount=${retryCount}
 `);
@@ -69301,7 +69738,7 @@ function resolveAnswerLaneConfig(input) {
 }
 
 // session-tail.ts
-import { homedir as homedir7 } from "os";
+import { homedir as homedir6 } from "os";
 import { basename as basename8, join as join24 } from "path";
 
 // operator-events.ts
@@ -69704,7 +70141,7 @@ var OPERATOR_ACTIONABLE_KINDS = new Set([
 function sanitizeCwdToProjectName(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
-function getProjectsDirForCwd(cwd = process.cwd(), claudeHome = process.env.CLAUDE_CONFIG_DIR ?? join24(homedir7(), ".claude")) {
+function getProjectsDirForCwd(cwd = process.cwd(), claudeHome = process.env.CLAUDE_CONFIG_DIR ?? join24(homedir6(), ".claude")) {
   return join24(claudeHome, "projects", sanitizeCwdToProjectName(cwd));
 }
 function parseChannelMeta(content3) {
@@ -71048,7 +71485,7 @@ function defaultAddAccount(label, credentials, opts) {
 // ../src/auth/broker/client.ts
 init_protocol2();
 import * as net3 from "node:net";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { join as join26 } from "node:path";
 var DEFAULT_TIMEOUT_MS3 = 5000;
@@ -71060,7 +71497,7 @@ function reviveDate2(v) {
   const d = new Date(v);
   return Number.isNaN(d.getTime()) ? null : d;
 }
-function operatorSocketPath2(home2 = homedir8()) {
+function operatorSocketPath2(home2 = homedir7()) {
   return join26(home2, ".switchroom", "state", "auth-broker-operator", "sock");
 }
 function resolveAuthBrokerSocketPath2(opts) {
@@ -71629,7 +72066,7 @@ function resolveExhaustUntil(resetAtMs, now = Date.now()) {
 // gateway/auth-add-flow.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync22, mkdirSync as mkdirSync23, readFileSync as readFileSync21, readdirSync as readdirSync6, rmSync as rmSync5, statSync as statSync9, writeFileSync as writeFileSync19 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { join as join27 } from "node:path";
 import { randomBytes as randomBytes8 } from "node:crypto";
 
@@ -71735,7 +72172,7 @@ function makeAuthAddTmuxOps(tmuxBin = "tmux") {
   };
 }
 var pendingAuthAddFlows = new Map;
-function pickScratchDir(label, home2 = homedir9()) {
+function pickScratchDir(label, home2 = homedir8()) {
   const suffix = randomBytes8(8).toString("hex");
   return join27(home2, ".switchroom", "accounts", ".in-progress", `${label}-${suffix}`);
 }
@@ -71786,7 +72223,7 @@ async function startAccountAuthSession(label, opts = {}) {
   if (process.env.SWITCHROOM_TMUX_SUPERVISOR !== "1" && !opts.tmuxOps) {
     throw new Error('tmux supervisor required for /auth add: SWITCHROOM_TMUX_SUPERVISOR is not set to "1". ' + "Legacy pipe-based setup-token is unsupported (setup-token writes to /dev/tty, not stdout/stderr).");
   }
-  const home2 = opts.home ?? homedir9();
+  const home2 = opts.home ?? homedir8();
   const urlTimeoutMs = opts.urlTimeoutMs ?? 30000;
   const agentName3 = opts.agentName ?? process.env.SWITCHROOM_AGENT_NAME ?? "gateway";
   const tmux = opts.tmuxOps ?? makeAuthAddTmuxOps(opts.tmuxBin);
@@ -74756,7 +75193,7 @@ import {
   appendFileSync as appendFileSync4
 } from "node:fs";
 import { join as join29 } from "node:path";
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 function sha256Hex(s) {
   return createHash3("sha256").update(s, "utf8").digest("hex");
 }
@@ -74766,7 +75203,7 @@ function resolveStateDir2(explicit) {
   const env = process.env.TELEGRAM_STATE_DIR;
   if (env != null && env !== "")
     return env;
-  const home2 = process.env.HOME ?? homedir10();
+  const home2 = process.env.HOME ?? homedir9();
   return join29(home2, ".claude", "channels", "telegram");
 }
 function resolveOutboxDir(stateDir) {
@@ -75620,8 +76057,8 @@ function monotonicNowMs2() {
 
 // silent-end.ts
 import { existsSync as existsSync26, readFileSync as readFileSync24, writeFileSync as writeFileSync22, unlinkSync as unlinkSync13, mkdirSync as mkdirSync27 } from "node:fs";
-import { dirname as dirname12, join as join31 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { dirname as dirname13, join as join31 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 var SILENT_END_MAX_RETRIES2 = 2;
 var SILENT_END_STALE_RECORD_MAX_AGE_MS2 = 30 * 60000;
 function silentEndFallbackText(turnDurationMs) {
@@ -75634,7 +76071,7 @@ function resolveStateDir3(deps) {
   const env = process.env.TELEGRAM_STATE_DIR;
   if (env != null && env !== "")
     return env;
-  const home2 = process.env.HOME ?? homedir11();
+  const home2 = process.env.HOME ?? homedir10();
   return join31(home2, ".claude", "channels", "telegram");
 }
 function resolveStatePath3(deps) {
@@ -75667,7 +76104,7 @@ function writeSilentEndState2(args, deps) {
     timestamp: Date.now()
   };
   try {
-    mkdirSync27(dirname12(statePath), { recursive: true });
+    mkdirSync27(dirname13(statePath), { recursive: true });
     writeFileSync22(statePath, JSON.stringify(state3), "utf8");
     emitLog2(deps, `silent-end: wrote state file turnKey=${args.turnKey} retryCount=${retryCount}
 `);
@@ -77261,7 +77698,7 @@ init_rich_send();
 
 // runtime-metrics.ts
 import { mkdirSync as mkdirSync29, appendFileSync as appendFileSync6 } from "node:fs";
-import { dirname as dirname13, join as join33 } from "node:path";
+import { dirname as dirname14, join as join33 } from "node:path";
 function resolveJsonlPath2() {
   const override = process.env.SWITCHROOM_RUNTIME_METRICS_PATH;
   if (override && override.trim() !== "")
@@ -77272,7 +77709,7 @@ function resolveJsonlPath2() {
 function appendJsonl2(line) {
   const path2 = resolveJsonlPath2();
   try {
-    mkdirSync29(dirname13(path2), { recursive: true });
+    mkdirSync29(dirname14(path2), { recursive: true });
     appendFileSync6(path2, line + `
 `, "utf-8");
   } catch (err) {
@@ -79230,7 +79667,16 @@ function createNarrativeLane(deps) {
             reconcileStatusPin(`fg:${statusKey(chat, thread)}`, chat, { pinned: true, messageId: sent.message_id });
           } else {
             const id = turn.activityMessageId;
-            await robustApiCall(() => bot.api.editMessageText(chat, id, richMessage(html), {}), { chat_id: chat, ...thread != null ? { threadId: thread } : {}, verb: "activity-summary.edit" });
+            const editRes = await robustApiCall(() => bot.api.editMessageText(chat, id, richMessage(html), {}), {
+              chat_id: chat,
+              ...thread != null ? { threadId: thread } : {},
+              verb: "activity-summary.edit",
+              priorityClass: "cosmetic",
+              messageId: id,
+              editPayload: html
+            });
+            if (isSendGateShed(editRes))
+              break;
           }
           turn.activityLastSentRender = target;
         } catch (err) {
@@ -79431,7 +79877,14 @@ function createNarrativeLane(deps) {
       if (finalHtml == null)
         return;
       try {
-        await robustApiCall(() => bot.api.editMessageText(chat, id, richMessage(finalHtml), {}), { chat_id: chat, ...thread != null ? { threadId: thread } : {}, verb: "activity-summary.finalize" });
+        await robustApiCall(() => bot.api.editMessageText(chat, id, richMessage(finalHtml), {}), {
+          chat_id: chat,
+          ...thread != null ? { threadId: thread } : {},
+          verb: "activity-summary.finalize",
+          priorityClass: "useful",
+          messageId: id,
+          editPayload: finalHtml
+        });
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         const low = msg.toLowerCase();
@@ -79738,12 +80191,12 @@ class AnswerReadyFlushController {
 }
 
 // agent-dir.ts
-import { dirname as dirname14 } from "node:path";
+import { dirname as dirname15 } from "node:path";
 function resolveAgentDirFromEnv() {
   const state6 = process.env.TELEGRAM_STATE_DIR;
   if (!state6 || state6.trim().length === 0)
     return null;
-  return dirname14(state6);
+  return dirname15(state6);
 }
 
 // active-reactions.ts
@@ -82450,7 +82903,7 @@ async function discoverModels(agentName3, opts = {}) {
 }
 
 // ../src/agents/scaffold.ts
-import { dirname as dirname15, isAbsolute, join as join42, relative, resolve as resolve8 } from "node:path";
+import { dirname as dirname16, isAbsolute, join as join42, relative, resolve as resolve8 } from "node:path";
 init_atomic();
 
 // ../src/agents/agent-uid.ts
@@ -82469,7 +82922,7 @@ init_timezone();
 
 // ../src/cli/agent-config.ts
 import { join as join40 } from "node:path";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 
 // ../src/cli/helpers.ts
 init_loader();
@@ -82489,7 +82942,7 @@ var WEBKITE_VAULT_KEYS = new Set([
 init_overlay_loader();
 
 // ../src/cli/agent-config.ts
-var AUDIT_ROOT = join40(homedir12(), ".switchroom", "audit");
+var AUDIT_ROOT = join40(homedir11(), ".switchroom", "audit");
 
 // ../src/agents/profiles.ts
 var import_handlebars = __toESM(require_lib(), 1);
@@ -82527,6 +82980,47 @@ for (const name of SHARED_FRAGMENTS) {
   }
 }
 
+// ../src/litellm/timeout-budget.ts
+var LITELLM_ROUTER_MARGIN_S = 10;
+var LITELLM_TIMEOUT_TIERS = {
+  interactive: {
+    group: "gpt-oss-20b",
+    localTimeoutS: 90,
+    fallbackGroup: "gpt-oss-20b-openrouter",
+    fallbackTimeoutS: 60
+  },
+  retain: {
+    group: "gpt-oss-20b-retain",
+    localTimeoutS: 200,
+    fallbackGroup: "gpt-oss-20b-retain-openrouter",
+    fallbackTimeoutS: 90
+  },
+  consolidation: {
+    group: "gpt-oss-20b-consolidation",
+    localTimeoutS: 200,
+    fallbackGroup: "gpt-oss-20b-consolidation-openrouter",
+    fallbackTimeoutS: 90
+  }
+};
+function litellmChainSeconds(tier) {
+  assertPositive(tier.localTimeoutS, `${tier.group} localTimeoutS`);
+  if (tier.fallbackGroup === null)
+    return tier.localTimeoutS;
+  assertPositive(tier.fallbackTimeoutS, `${tier.fallbackGroup} fallbackTimeoutS`);
+  return tier.localTimeoutS + tier.fallbackTimeoutS;
+}
+function minimumClientBudgetSeconds(tier, marginS = LITELLM_ROUTER_MARGIN_S) {
+  return litellmChainSeconds(tier) + marginS;
+}
+function clientBudgetSeconds(tier, floorS = 0, marginS = LITELLM_ROUTER_MARGIN_S) {
+  return Math.max(Math.ceil(floorS), minimumClientBudgetSeconds(tier, marginS));
+}
+function assertPositive(value, label) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`litellm timeout budget: ${label} must be a positive number, got ${value}`);
+  }
+}
+
 // ../src/setup/hindsight.ts
 var HINDSIGHT_DEFAULT_API_PORT = 18888;
 var HINDSIGHT_DEFAULT_MCP_URL = `http://127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}/mcp/`;
@@ -82536,6 +83030,18 @@ var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
 var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
+var HINDSIGHT_DEFAULT_RETAIN_MAX_COMPLETION_TOKENS = 16384;
+var HINDSIGHT_RETAIN_MIN_TOKENS_PER_SECOND = 80.6;
+function hindsightRetainLlmTimeoutSeconds(maxCompletionTokens = HINDSIGHT_DEFAULT_RETAIN_MAX_COMPLETION_TOKENS, tokensPerSecond = HINDSIGHT_RETAIN_MIN_TOKENS_PER_SECOND) {
+  if (!(maxCompletionTokens > 0) || !(tokensPerSecond > 0)) {
+    throw new Error(`hindsight retain budget: maxCompletionTokens (${maxCompletionTokens}) and ` + `tokensPerSecond (${tokensPerSecond}) must both be positive`);
+  }
+  return Math.ceil(maxCompletionTokens / tokensPerSecond);
+}
+function hindsightRetainClientTimeoutSeconds() {
+  return clientBudgetSeconds(LITELLM_TIMEOUT_TIERS.retain, hindsightRetainLlmTimeoutSeconds());
+}
+var HINDSIGHT_RETAIN_CLIENT_DEADLINE_S = hindsightRetainClientTimeoutSeconds() + LITELLM_ROUTER_MARGIN_S;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
@@ -83149,7 +83655,7 @@ init_merge();
 init_timezone();
 var import_yaml4 = __toESM(require_dist(), 1);
 import { readFileSync as readFileSync32, existsSync as existsSync35 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
+import { homedir as homedir12 } from "node:os";
 import { resolve as resolve9 } from "node:path";
 
 class ConfigError2 extends Error {
@@ -83206,7 +83712,7 @@ function coerceLegacyGoogleWorkspaceKeys2(parsed, filePath) {
 }
 function findConfigFile2(startDir) {
   const envPath = process.env.SWITCHROOM_CONFIG;
-  const home2 = homedir13();
+  const home2 = homedir12();
   const userDir = resolve9(home2, ".switchroom");
   const searchPaths = [
     envPath ? resolve9(envPath) : null,
@@ -84156,6 +84662,94 @@ function shouldSweepChatAtBoot(chatId) {
   return n < 0;
 }
 
+// gateway/boot-sweep-gate.ts
+function createBootSweepGate(args) {
+  let armed = false;
+  let ready = false;
+  let started = false;
+  const maybeRun = () => {
+    if (started || !armed || !ready)
+      return;
+    started = true;
+    (async () => {
+      try {
+        await args.run();
+      } catch (err) {
+        args.onError?.(err);
+      }
+    })();
+  };
+  return {
+    arm() {
+      armed = true;
+      maybeRun();
+    },
+    botReady() {
+      ready = true;
+      maybeRun();
+    },
+    hasRun() {
+      return started;
+    }
+  };
+}
+async function step(name, fn, log) {
+  try {
+    await fn();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    try {
+      log(`telegram gateway: boot pin sweep step '${name}' failed: ${msg}
+`);
+    } catch {}
+  }
+}
+async function runBootPinSweepSteps(deps) {
+  const log = deps.log ?? ((l) => process.stderr.write(l));
+  let dmChatIds = [];
+  await step("dm-chat-scan", async () => {
+    dmChatIds = deps.scanDmChatIds();
+  }, log);
+  await step("status-pin-cleanup", deps.statusPinCleanup, log);
+  await step("activity-card-reaper", deps.activityCardReaper, log);
+  await step("queued-card-reaper", deps.queuedCardReaper, log);
+  await step("enable-dm-sweep", async () => deps.enableDmSweep(), log);
+  for (const id of dmChatIds)
+    await step(`dm-sweep:${id}`, () => deps.sweepDm(id), log);
+}
+
+// gateway/status-pin-api.ts
+class BotNotReadyError extends Error {
+  constructor(what) {
+    super(`STATUS_PIN_BOT_NOT_READY: ${what} used before initGatewayBot() assigned ` + `lockedBot \u2014 the boot sweep must run behind the boot-sweep gate`);
+    this.name = "BotNotReadyError";
+  }
+}
+function assertBotReady(bot, what) {
+  if (bot == null)
+    throw new BotNotReadyError(what);
+  return bot;
+}
+
+class SendGateShedError extends Error {
+  constructor(verb) {
+    super(`STATUS_PIN_SEND_SHED: ${verb} was shed by the send gate and never reached Telegram`);
+    this.name = "SendGateShedError";
+  }
+}
+function assertLanded(result, verb) {
+  if (result === SEND_GATE_SHED)
+    throw new SendGateShedError(verb);
+  return result;
+}
+function createStatusPinApi(getBot, robust) {
+  const call = (verb, fn, chatId) => robust(() => fn(assertBotReady(getBot(), verb)), { chat_id: chatId, verb }).then((r) => assertLanded(r, verb));
+  return {
+    pinChatMessage: (chat_id, message_id, opts) => call("status-pin.pin", (bot) => bot.api.pinChatMessage(chat_id, message_id, opts), String(chat_id)),
+    unpinChatMessage: (chat_id, message_id) => call("status-pin.unpin", (bot) => bot.api.unpinChatMessage(chat_id, message_id), String(chat_id))
+  };
+}
+
 // gateway/dm-pin-sweep.ts
 function isDmChatId(chatId) {
   const n = Number(chatId);
@@ -84339,7 +84933,7 @@ function startWebhookIngestServer(opts) {
 // ../src/web/webhook-gateway-record.ts
 import { appendFileSync as appendFileSync8, mkdirSync as mkdirSync35 } from "fs";
 import { join as join47 } from "path";
-import { homedir as homedir15 } from "os";
+import { homedir as homedir14 } from "os";
 
 // ../src/web/webhook-handler.ts
 import { appendFileSync as appendFileSync7, existsSync as existsSync40, mkdirSync as mkdirSync33, readFileSync as readFileSync34, writeFileSync as writeFileSync30 } from "fs";
@@ -84493,21 +85087,21 @@ function sweepStaleParks(lockPath) {
   } catch {}
 }
 function fsyncAndMeasure(snapshotPath, logPath, tag) {
-  let step = "open";
+  let step2 = "open";
   try {
     const fd = fs2.openSync(snapshotPath, "r");
     try {
-      step = "fsync";
+      step2 = "fsync";
       fs2.fsyncSync(fd);
-      step = "measure";
+      step2 = "measure";
       const size = fs2.fstatSync(fd).size;
-      step = "close";
+      step2 = "close";
       return size;
     } finally {
       fs2.closeSync(fd);
     }
   } catch (err) {
-    process.stderr.write(`[${tag}] ERROR: could not ${step} snapshot ${snapshotPath}; leaving active log ${logPath} intact to avoid data loss: ${err.message}
+    process.stderr.write(`[${tag}] ERROR: could not ${step2} snapshot ${snapshotPath}; leaving active log ${logPath} intact to avoid data loss: ${err.message}
 `);
     return null;
   }
@@ -84729,7 +85323,7 @@ var throttleIssueWindow = new Map;
 // ../src/web/webhook-dispatch.ts
 import { existsSync as existsSync41, mkdirSync as mkdirSync34, readFileSync as readFileSync35, writeFileSync as writeFileSync31 } from "fs";
 import { join as join46 } from "path";
-import { homedir as homedir14 } from "os";
+import { homedir as homedir13 } from "os";
 
 // ../src/agent-scheduler/ipc-client.ts
 import { createConnection as createConnection2 } from "node:net";
@@ -85106,7 +85700,7 @@ async function defaultInject(socketPath, agentName3, inbound) {
 }
 function injectWebhookInbound(agent, prompt, ctx, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join46(homedir14(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join46(homedir13(), ".switchroom", "agents", a));
   const now = (deps.now ?? Date.now)();
   const socketPath = join46(resolveAgentDir(agent), "telegram", "gateway.sock");
   const inbound = {
@@ -85180,7 +85774,7 @@ function evaluateDispatch(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = (deps.now ?? Date.now)();
   const nowDate = deps.nowDate ?? (() => new Date(now));
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join46(homedir14(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join46(homedir13(), ".switchroom", "agents", a));
   const cooldownStore = deps.cooldownStore ?? createFileCooldownStore(resolveAgentDir);
   if (!DISPATCH_SOURCES.includes(args.source))
     return 0;
@@ -85258,7 +85852,7 @@ var CONSOLIDATION_COMPLETED_EVENT = "consolidation.completed";
 function recordWebhookEvent(rec, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = rec.ts || (deps.now ?? Date.now)();
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join47(homedir15(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join47(homedir14(), ".switchroom", "agents", a));
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
   const agent = rec.agent;
   const telegramDir = join47(resolveAgentDir(agent), "telegram");
@@ -93053,9 +93647,9 @@ import {
   renameSync as renameSync20
 } from "node:fs";
 import { join as join50, resolve as resolve10 } from "node:path";
-import { homedir as homedir16 } from "node:os";
+import { homedir as homedir15 } from "node:os";
 function registryDir() {
-  return resolve10(process.env.SWITCHROOM_WORKTREE_DIR ?? join50(homedir16(), ".switchroom", "worktrees"));
+  return resolve10(process.env.SWITCHROOM_WORKTREE_DIR ?? join50(homedir15(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
   return join50(registryDir(), `${id}.json`);
@@ -93238,17 +93832,17 @@ init_boot_card();
 // gateway/update-announce.ts
 import { existsSync as existsSync49, mkdirSync as mkdirSync41, openSync as openSync10, closeSync as closeSync10, readFileSync as readFileSync49 } from "node:fs";
 import { join as join55 } from "node:path";
-import { homedir as homedir18 } from "node:os";
+import { homedir as homedir17 } from "node:os";
 
 // ../src/host-control/audit-reader.ts
-import { homedir as homedir17 } from "node:os";
+import { homedir as homedir16 } from "node:os";
 import { join as join54 } from "node:path";
 
 // ../src/host-control/audit-rotation-config.ts
 var DEFAULT_HOSTD_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
 
 // ../src/host-control/audit-reader.ts
-function defaultAuditLogPath(home2 = homedir17()) {
+function defaultAuditLogPath(home2 = homedir16()) {
   return join54(home2, ".switchroom", "host-control-audit.log");
 }
 var AUDIT_READ_WINDOW_BYTES = 4 * 1024 * 1024;
@@ -93435,7 +94029,7 @@ function renderUpdateOutcomeLine(entry) {
 `);
 }
 function claimUpdateAnnouncement(requestId, opts = {}) {
-  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join55(homedir18(), ".switchroom");
+  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join55(homedir17(), ".switchroom");
   const dir = join55(stateDir, "update-announced");
   try {
     mkdirSync41(dir, { recursive: true });
@@ -95737,10 +96331,10 @@ function startOutboxSweep(deps) {
 }
 
 // ../src/build-info.ts
-var VERSION2 = "0.19.19";
-var COMMIT_SHA = "0bdb34ec";
-var COMMIT_DATE = "2026-07-26T08:27:14+10:00";
-var LATEST_PR = 3618;
+var VERSION2 = "0.19.22";
+var COMMIT_SHA = "50ef9fb5";
+var COMMIT_DATE = "2026-07-26T06:22:32Z";
+var LATEST_PR = 3696;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -95817,12 +96411,12 @@ init_protocol();
 init_peercred();
 import * as net5 from "node:net";
 import * as fs3 from "node:fs";
-import { homedir as homedir19 } from "node:os";
+import { homedir as homedir18 } from "node:os";
 import { join as join63 } from "node:path";
 var DEFAULT_TIMEOUT_MS4 = 2000;
 var UNLOCK_TIMEOUT_MS = 30000;
-var LEGACY_SOCKET_PATH2 = join63(homedir19(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH2 = join63(homedir19(), ".switchroom", "broker-operator", "sock");
+var LEGACY_SOCKET_PATH2 = join63(homedir18(), ".switchroom", "vault-broker.sock");
+var OPERATOR_SOCKET_PATH2 = join63(homedir18(), ".switchroom", "broker-operator", "sock");
 function defaultBrokerSocketPath2() {
   if (fs3.existsSync(OPERATOR_SOCKET_PATH2))
     return OPERATOR_SOCKET_PATH2;
@@ -97596,7 +98190,7 @@ if (isGatewayMain) {
     shutdownAnalytics();
   });
 }
-var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join65(homedir20(), ".claude", "channels", "telegram");
+var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join65(homedir19(), ".claude", "channels", "telegram");
 var permCardStore = createPermissionCardStore(STATE_DIR);
 var BLOCKED_APPROVALS_DIR = process.env.SWITCHROOM_BLOCKED_APPROVALS_DIR ?? "/state/blocked-approvals";
 var AGENT_NAME = process.env.SWITCHROOM_AGENT_NAME ?? "agent";
@@ -98853,9 +99447,9 @@ function maybePostBusyAck(gateDecision, chatId, threadId) {
   const inFlight = currentTurn;
   const inFlightKey = inFlight != null ? statusKey(inFlight.sessionChatId, inFlight.sessionThreadId) : key;
   const now = Date.now();
-  const step = longestInFlightTool(inFlightKey, now);
+  const step2 = longestInFlightTool(inFlightKey, now);
   const midToolCall = toolFlightTracker.isMidToolCall();
-  const stepAgeMs = step?.durationMs ?? null;
+  const stepAgeMs = step2?.durationMs ?? null;
   const alreadyAcked = queuedStatusMsgIds.has(key) || busyAckPostedKeys.has(key);
   const fire = shouldPostBusyAck({ gateDecision, midToolCall, stepAgeMs, alreadyAcked });
   if (!fire) {
@@ -98879,10 +99473,10 @@ function maybePostBusyAck(gateDecision, chatId, threadId) {
   busyAckPostedKeys.add(key);
   const text5 = formatBusyAckText({
     gateDecision,
-    toolName: step?.name ?? null,
-    toolLabel: step?.label ?? null
+    toolName: step2?.name ?? null,
+    toolLabel: step2?.label ?? null
   });
-  process.stderr.write(`telegram gateway: mid-flight busy ack chat=${chatId} thread=${threadId ?? "-"} decision=${gateDecision} step=${step?.name ?? "-"} step_age_ms=${step?.durationMs ?? "-"}
+  process.stderr.write(`telegram gateway: mid-flight busy ack chat=${chatId} thread=${threadId ?? "-"} decision=${gateDecision} step=${step2?.name ?? "-"} step_age_ms=${step2?.durationMs ?? "-"}
 `);
   postBusyAck(chatId, threadId, text5);
 }
@@ -100842,10 +101436,7 @@ var TOOL_PIN_TTL_MS = (() => {
   return Number.isFinite(v) && v > 0 ? v : 604800000;
 })();
 function statusPinApi() {
-  return {
-    pinChatMessage: (chat_id, message_id, opts) => robustApiCall(() => lockedBot.api.pinChatMessage(chat_id, message_id, opts), { chat_id: String(chat_id), verb: "status-pin.pin" }),
-    unpinChatMessage: (chat_id, message_id) => robustApiCall(() => lockedBot.api.unpinChatMessage(chat_id, message_id), { chat_id: String(chat_id), verb: "status-pin.unpin" })
-  };
+  return createStatusPinApi(() => lockedBot, robustApiCall);
 }
 async function statusPinBootCleanup() {
   if (!statusPinPersistEnabled && !bannerPinPersistEnabled && !toolPinPersistEnabled)
@@ -101165,25 +101756,25 @@ var dmPinSweeper = createDmPinSweeper({
   eligible: () => dmPinSweepEligible,
   log: (line) => process.stderr.write(line)
 });
-async function runBootPinCleanupAndDmSweep() {
-  let dmChatIds = [];
-  try {
-    dmChatIds = collectDmChatIdsFromStores({
+function runBootPinCleanupAndDmSweep() {
+  return runBootPinSweepSteps({
+    scanDmChatIds: () => collectDmChatIdsFromStores({
       statusPins: statusPinPersistEnabled || bannerPinPersistEnabled || toolPinPersistEnabled ? loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs) : [],
       activityCards: activityCardPersistEnabled ? loadActivityCards2(ACTIVITY_CARD_STORE_PATH, activityCardStoreFs) : [],
       queuedCards: queuedCardPersistEnabled ? loadQueuedCards(QUEUED_CARD_STORE_PATH, queuedCardStoreFs) : []
-    });
-  } catch (err) {
-    process.stderr.write(`telegram gateway: dm-pin-sweep: store scan failed: ${err.message}
-`);
-  }
-  await statusPinBootCleanup();
-  await activityCardBootReaper();
-  await queuedCardBootReaper();
-  dmPinSweepEligible = true;
-  for (const id of dmChatIds)
-    await dmPinSweeper.sweep(id);
+    }),
+    statusPinCleanup: statusPinBootCleanup,
+    activityCardReaper: activityCardBootReaper,
+    queuedCardReaper: queuedCardBootReaper,
+    enableDmSweep: () => {
+      dmPinSweepEligible = true;
+    },
+    sweepDm: (id) => dmPinSweeper.sweep(id),
+    log: (line) => process.stderr.write(line)
+  });
 }
+var bootPinSweepGate = createBootSweepGate({ run: runBootPinCleanupAndDmSweep, onError: (err) => process.stderr.write(`telegram gateway: boot pin cleanup / DM sweep failed: ${err.message}
+`) });
 var progressDriver = null;
 var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
@@ -101255,7 +101846,7 @@ if (isGatewayMain) {
       if (carrierAgentDir != null)
         consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir);
     }
-    runBootPinCleanupAndDmSweep();
+    bootPinSweepGate.arm();
   } catch (err) {
     process.stderr.write(`telegram gateway: boot.lock_acquire_failed err=${err.message} agent=${SWITCHROOM_AGENT_NAME}
 `);
@@ -101268,7 +101859,7 @@ if (isGatewayMain) {
         if (carrierAgentDir != null)
           consumeSessionModelCarrierOnHealthyBoot(carrierAgentDir);
       }
-      runBootPinCleanupAndDmSweep();
+      bootPinSweepGate.arm();
     } catch (writeErr) {
       process.stderr.write(`telegram gateway: writePidFile failed: ${writeErr}
 `);
@@ -105097,7 +105688,7 @@ ${preBlock(formatSwitchroomOutput(detail))}`, { html: true });
 }
 function readRecentDenialsForAgent(agentName3, windowMs, limit) {
   try {
-    const auditPath = join65(homedir20(), ".switchroom", "vault-audit.log");
+    const auditPath = join65(homedir19(), ".switchroom", "vault-audit.log");
     if (!existsSync58(auditPath))
       return [];
     const raw = readFileSync58(auditPath, "utf8");
@@ -108608,6 +109199,11 @@ async function initGatewayBot() {
   bot = new import_grammy16.Bot(TOKEN);
   installTgPostLogger(bot);
   installRichMarkdownGuard(bot);
+  installEditFloodFuse(bot, {
+    enabled: process.env.SWITCHROOM_EDIT_FUSE !== "0",
+    onTrip: (i) => process.stderr.write(`edit-flood-fuse ${i.action} method=${i.method} key=${i.key}
+`)
+  });
   installUpdateTap(bot, (line) => process.stderr.write(line));
   bot.api.config.use(async (prev, method, payload, signal) => {
     try {
@@ -108698,6 +109294,7 @@ async function initGatewayBot() {
     MENTAL_MODEL_PROPOSE_MAX_PER_WINDOW
   });
   registerGatewayHandlers(bot, {});
+  bootPinSweepGate.botReady();
 }
 var didOneTimeSetup = false;
 async function startGateway() {
@@ -108960,7 +109557,7 @@ async function startGateway() {
                         return;
                       }
                     })();
-                    const resolvedAgentDirForBootCard = agentDir ?? join65(homedir20(), ".switchroom", "agents", agentSlug);
+                    const resolvedAgentDirForBootCard = agentDir ?? join65(homedir19(), ".switchroom", "agents", agentSlug);
                     const handle = await startBootCard(chatId, threadId, botApiForCard, {
                       agentName: agentDisplayName,
                       agentSlug,