switchroom 0.19.27 → 0.19.29

package/telegram-plugin/dist/gateway/gateway.js

@@ -21552,10 +21552,22 @@ var require_dist = __commonJS((exports) => {
   exports.visitAsync = visit.visitAsync;
 });
 
+// ../src/memory/observation-scopes.ts
+var OBSERVATION_SCOPES;
+var init_observation_scopes = __esm(() => {
+  OBSERVATION_SCOPES = [
+    "per_tag",
+    "combined",
+    "all_combinations",
+    "shared"
+  ];
+});
+
 // ../src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
+  init_observation_scopes();
   CodeRepoEntrySchema = exports_external.object({
     name: exports_external.string().describe("Short alias used when claiming (e.g. 'switchroom')"),
     source: exports_external.string().describe("Absolute or home-relative path to the repo (e.g. ~/code/switchroom)"),
@@ -21667,6 +21679,7 @@ var init_schema = __esm(() => {
     allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
     deny: exports_external.array(exports_external.string()).default([]).describe("Denied tools (overrides allow)")
   }).optional();
+  ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Per-row observation scope stamped on every memory this agent " + `retains. "shared" makes Hindsight's consolidation write the ` + "resulting observations into ONE global untagged scope instead of a " + "scope per tag \u2014 what several agents pooling one bank need so their " + "observations actually merge rather than sitting in parallel " + "per-tag silos. OMITTED BY DEFAULT: unset means the field never goes " + "on the wire and the engine's own default stands, which is the " + "shipped behaviour. Applies to every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
@@ -21701,6 +21714,7 @@ var init_schema = __esm(() => {
       empathy: exports_external.number().int().min(1).max(5).optional().describe("How much the bank weights emotional/relational context (1-5; engine default 3).")
     }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis \u2014 a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
     directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true \u2014 Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never \u2026", "from now on \u2026", ' + `"stop doing \u2026", a stated preference, "that's wrong, it's \u2026") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex \u2014 the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
+    observation_scopes: ObservationScopesSchema,
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
       cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
@@ -21944,7 +21958,10 @@ var init_schema = __esm(() => {
     admin_key: exports_external.string().optional().describe("LiteLLM master/admin key used at apply time to provision the team + " + "virtual key. Supports a vault reference (e.g. " + "'vault:litellm/master-key') \u2014 resolution happens at apply time via " + "the vault-broker. Never injected into the agent container."),
     team: exports_external.string().optional().describe("LiteLLM team alias the per-agent key is created under. Defaults to " + "'switchroom' (applied in code, not as a schema default)."),
     small_fast_model: exports_external.string().optional().describe("Model id exported as ANTHROPIC_SMALL_FAST_MODEL for the claude CLI's " + "background/fast lane, e.g. 'claude-haiku-4-5-20251001'."),
-    tags: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Extra key/value metadata tags attached to the provisioned LiteLLM " + "virtual key. Merged per-key across cascade layers (agent wins).")
+    tags: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Extra key/value metadata tags attached to the provisioned LiteLLM " + "virtual key. Merged per-key across cascade layers (agent wins)."),
+    max_budget: exports_external.number().positive().optional().describe("HARD spend cap in USD for this agent's virtual key over one " + "`budget_duration` window. LiteLLM refuses the request once the key's " + "tracked spend exceeds it, so a runaway loop costs at most this much " + "before it is stopped. Defaults to " + "DEFAULT_KEY_MAX_BUDGET_USD (see src/litellm/budget.ts) \u2014 deliberately " + "conservative; raise it per-agent rather than removing it. Set 0 or " + "omit `budget_duration` at your own risk: an uncapped key is only as " + "bounded as the upstream account balance."),
+    soft_budget: exports_external.number().positive().optional().describe("ADVISORY spend threshold in USD. LiteLLM keeps serving past it and " + "raises a budget alert instead. Must be < max_budget. NOTE: LiteLLM " + "accepts soft_budget only on POST /key/generate (GenerateKeyRequest); " + "UpdateKeyRequest does NOT carry it, so changing this value only takes " + "effect on a key that is (re)generated, not on an existing one."),
+    budget_duration: exports_external.string().regex(/^\d+(s|m|h|d|mo)$/, "budget_duration must be a LiteLLM duration like '30d', '24h', '1mo'").optional().describe("Rolling window the budget resets on, in LiteLLM duration syntax " + "('30d', '24h', '1mo'). Defaults to DEFAULT_KEY_BUDGET_DURATION. " + "WITHOUT a duration LiteLLM treats max_budget as a LIFETIME cap that " + "never resets \u2014 the key silently dies for good once it is hit.")
   }).optional().describe("LiteLLM routing config \u2014 opt-in per-agent virtual-key auto-provisioning " + "+ routing env. Default OFF. See LiteLLMConfigSchema doc for the full flow.");
   HindsightPerOpLlmSchema = exports_external.object({
     model: exports_external.string().min(1).optional().describe("Per-op model (upstream `HINDSIGHT_API_<OP>_LLM_MODEL`). Absent \u2192 " + "inherit the global `hindsight.llm.model`."),
@@ -21963,7 +21980,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent \u2192 uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent \u2192 global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_MAX_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY \u2014 a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP \u2014 the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS \u2014 a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED \u2014 a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_MAX_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS \u2014 switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY \u2014 a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP \u2014 the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS \u2014 only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS \u2014 the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_MAX_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_MAX_SLOTS \u2014 the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS \u2014 a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED \u2014 a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -22096,6 +22113,7 @@ var init_schema = __esm(() => {
       file: exports_external.boolean().optional(),
       isolation: exports_external.enum(["default", "strict"]).optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
+      observation_scopes: ObservationScopesSchema,
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),
         cache_ttl_secs: exports_external.number().int().min(0).optional(),
@@ -46601,24 +46619,62 @@ async function applyTapAnnotationEdit(io, text) {
     }
   }
 }
+function extractCallbackChatId(callbackQuery) {
+  const msg = callbackQuery?.message;
+  const chat = msg?.chat;
+  const id = chat?.id;
+  if (typeof id === "number" && Number.isFinite(id))
+    return String(id);
+  if (typeof id === "string" && id !== "")
+    return id;
+  return;
+}
+var DEAD_CARD_NOTICE = "\u26a0\ufe0f Your tap was applied, but this card could not be updated. " + "The buttons on it are STALE \u2014 tapping them again will not change anything. " + "Scroll down for the outcome, or ask the agent to re-send the card.";
+async function disarmDeadCard(ctx, apiCall, scope, log) {
+  try {
+    await apiCall(() => ctx.editMessageReplyMarkup({ reply_markup: { inline_keyboard: [] } }), { ...scope, verb: "editMessageReplyMarkup" });
+    log("finalizeCallback: repaint failed but the keyboard was stripped \u2014 " + `the card shows stale text and is no longer tappable
+`);
+    return;
+  } catch (err) {
+    log(`finalizeCallback: editMessageReplyMarkup fallback failed: ${err.message}
+`);
+  }
+  try {
+    await apiCall(() => ctx.reply(DEAD_CARD_NOTICE, { link_preview_options: { is_disabled: true } }), { ...scope, verb: "sendMessage" });
+  } catch (err) {
+    log(`finalizeCallback: dead-card notice failed: ${err.message}
+`);
+  }
+}
 async function finalizeCallback(ctx, opts) {
   const log = opts.log ?? ((line) => process.stderr.write(line));
-  ctx.answerCallbackQuery({
+  const apiCall = opts.apiCall;
+  const chatId = extractCallbackChatId(ctx.callbackQuery);
+  const scope = {
+    ...chatId != null ? { chat_id: chatId } : {},
+    priorityClass: "critical"
+  };
+  apiCall(() => ctx.answerCallbackQuery({
     text: opts.ackText,
     ...opts.alert ? { show_alert: true } : {}
-  }).catch((err) => {
+  }), { ...scope, verb: "answerCallbackQuery" }).catch((err) => {
     log(`finalizeCallback: answerCallbackQuery failed: ${err.message}
 `);
   });
+  let repainted = true;
   try {
-    await ctx.editMessageText(opts.literalText ? opts.newText : { markdown: opts.newText }, {
+    await apiCall(() => ctx.editMessageText(opts.literalText ? opts.newText : { markdown: opts.newText }, {
       reply_markup: { inline_keyboard: [] },
       link_preview_options: { is_disabled: true }
-    });
+    }), { ...scope, verb: "editMessageText" });
   } catch (err) {
+    repainted = false;
     log(`finalizeCallback: editMessageText failed: ${err.message}
 `);
   }
+  if (!repainted)
+    await disarmDeadCard(ctx, apiCall, scope, log);
   if (opts.synthInbound != null) {
     try {
       const r = opts.synthInbound();
@@ -50153,6 +50209,7 @@ function createCallbackQueryHandlers(deps) {
 
 \u2705 **${escapeHtmlForTg2(agentName)}** granted read access to ` + `\`${keyName}\` for 30 days ` + `(grant \`${id}\`). ` + `Re-run /vault audit to act on remaining denials.`;
     await finalizeCallback(ctx, {
+      apiCall: robustApiCall,
       ackText: "\u2705 Grant minted",
       newText: baseText ? `${baseText}${statusLine}` : statusLine
     });
@@ -50731,6 +50788,7 @@ _Approver verified by Telegram identity \u2014 broker auto-unlocked at startup._
 
 \u270f\ufe0f **Rename mode** \u2014 send the new key name as your next message. ` + `The current proposed key is \`${pending.key}\`.`;
       await finalizeCallback(ctx, {
+        apiCall: robustApiCall,
         ackText: "Send the new key name as your next message.",
         newText: baseText ? `${baseText}${statusLine}` : statusLine
       });
@@ -51129,6 +51187,7 @@ ${keyList}`,
     const successText = `\u2705 Grant \`${id}\` created. Written to \`~/.switchroom/agents/${escapeHtmlForTg2(state.agent)}/.vault-token\``;
     if (msgId != null) {
       await finalizeCallback(ctx, {
+        apiCall: robustApiCall,
         ackText: "\u2705 Grant created",
         newText: successText
       });
@@ -51405,6 +51464,7 @@ Reply \`rename NEW_NAME\` to relabel.`), { reply_markup: { inline_keyboard: [] }
 
 \u2717 _Dismissed by operator._`;
         await finalizeCallback(ctx, {
+          apiCall: robustApiCall,
           ackText: "Dismissed",
           newText: sourceMsgText ? `${sourceMsgText}${status}` : status
         });
@@ -51417,6 +51477,7 @@ Reply \`rename NEW_NAME\` to relabel.`), { reply_markup: { inline_keyboard: [] }
 
 \uD83D\uDD04 _**${escapeHtmlForTg2(agent)}** restart requested by operator._`;
           await finalizeCallback(ctx, {
+            apiCall: robustApiCall,
             ackText: `Restarting ${agent}\u2026`,
             newText: sourceMsgText ? `${sourceMsgText}${status}` : status
           });
@@ -51433,6 +51494,7 @@ Reply \`rename NEW_NAME\` to relabel.`), { reply_markup: { inline_keyboard: [] }
 
 \uD83D\uDD10 _Reauth started for **${escapeHtmlForTg2(agent)}** \u2014 follow the login URL below._`;
         await finalizeCallback(ctx, {
+          apiCall: robustApiCall,
           ackText: `Starting reauth for ${agent}\u2026`,
           newText: sourceMsgText ? `${sourceMsgText}${status}` : status,
           synthInbound: async () => {
@@ -63318,6 +63380,7 @@ var EDIT_FLOOD_FUSE_DEFAULTS = {
   cosmeticPerChatMaxPerWindow: 6,
   perChatTotalMaxPerWindow: 20,
   perChatReplyReserve: 8,
+  perChatCriticalMinPerWindow: 3,
   perTokenMaxPerWindow: 25,
   perTokenWindowMs: 1000,
   chatActionMaxDeferMs: 3000,
@@ -63335,6 +63398,12 @@ function envInt(raw) {
   const n = Number(raw);
   return Number.isFinite(n) && n >= 0 ? Math.floor(n) : undefined;
 }
+function envFactor(raw) {
+  if (raw == null || raw.trim() === "")
+    return;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 && n <= 1 ? n : undefined;
+}
 function editFloodFuseConfigFromEnv(env) {
   const cfg = { enabled: env.SWITCHROOM_EDIT_FUSE !== "0" };
   const assign = (k, v) => {
@@ -63345,8 +63414,11 @@ function editFloodFuseConfigFromEnv(env) {
   assign("cosmeticPerChatMaxPerWindow", envInt(env.SWITCHROOM_FEED_EDIT_MAX_PER_CHAT_PER_MIN));
   assign("perChatTotalMaxPerWindow", envInt(env.SWITCHROOM_CHAT_TOTAL_MAX_PER_MIN));
   assign("perChatReplyReserve", envInt(env.SWITCHROOM_CHAT_REPLY_RESERVE));
+  assign("perChatCriticalMinPerWindow", envInt(env.SWITCHROOM_CHAT_CRITICAL_MIN_PER_MIN));
   assign("perTokenMaxPerWindow", envInt(env.SWITCHROOM_TOKEN_MAX_PER_SEC));
   assign("maxDeferMs", envInt(env.SWITCHROOM_EDIT_FUSE_MAX_DEFER_MS));
+  assign("maxTightenLevel", envInt(env.SWITCHROOM_EDIT_FUSE_MAX_TIGHTEN_LEVEL));
+  assign("tightenFactor", envFactor(env.SWITCHROOM_EDIT_FUSE_TIGHTEN_FACTOR));
   const stateDir = env.TELEGRAM_STATE_DIR;
   if (stateDir != null && stateDir !== "") {
     cfg.floodWaitRemainingMs = makeFloodWaitProbe(floodStatePath(stateDir));
@@ -63367,6 +63439,8 @@ function createEditFloodFuse(config = {}) {
   const perChatTotalMax = config.perChatTotalMaxPerWindow ?? D.perChatTotalMaxPerWindow;
   const perChatWindowMs = config.perChatWindowMs ?? D.perChatWindowMs;
   const perChatReplyReserve = Math.min(Math.max(0, config.perChatReplyReserve ?? D.perChatReplyReserve), Math.max(0, perChatTotalMax - 1));
+  const replyReserveFraction = perChatTotalMax > 0 ? perChatReplyReserve / perChatTotalMax : 0;
+  const perChatCriticalMin = Math.max(0, config.perChatCriticalMinPerWindow ?? D.perChatCriticalMinPerWindow);
   const perTokenMax = Math.max(1, config.perTokenMaxPerWindow ?? D.perTokenMaxPerWindow);
   const perTokenWindowMs = Math.max(1, config.perTokenWindowMs ?? D.perTokenWindowMs);
   const tokenKey = `g:${config.botScopeKey ?? "unknown"}`;
@@ -63412,8 +63486,10 @@ function createEditFloodFuse(config = {}) {
       tightenLevel--;
       tightenedUntil = tightenLevel > 0 ? tightenedUntil + tightenMs : 0;
     }
-    if (persistedFloodRemainingMs(now) > 0)
-      return maxTightenLevel;
+    const remainingMs = persistedFloodRemainingMs(now);
+    if (remainingMs > 0) {
+      return Math.max(tightenLevel, Math.min(maxTightenLevel, tightenStepFor(remainingMs / 1000)));
+    }
     return tightenLevel;
   }
   function isTightened(now) {
@@ -63425,6 +63501,24 @@ function createEditFloodFuse(config = {}) {
       return base;
     return Math.max(1, Math.floor(base * Math.pow(tightenFactor, level)));
   }
+  function classCeiling(base, cls, now) {
+    const eff = ceiling(base, now);
+    if (cls !== "critical")
+      return eff;
+    return Math.max(eff, Math.min(base, perChatCriticalMin));
+  }
+  function cosmeticTotalMax(now) {
+    const eff = ceiling(perChatTotalMax, now);
+    if (replyReserveFraction <= 0)
+      return eff;
+    const reserve = Math.min(eff, Math.max(1, Math.round(eff * replyReserveFraction)));
+    return Math.max(0, eff - reserve);
+  }
+  function totalMaxFor(cls) {
+    if (cls === "cosmetic")
+      return cosmeticTotalMax;
+    return (now) => classCeiling(perChatTotalMax, cls, now);
+  }
   function win(key) {
     let w = windows.get(key);
     if (w === undefined) {
@@ -63454,6 +63548,9 @@ function createEditFloodFuse(config = {}) {
   }
   function waitFor(w, now, windowMs, max) {
     prune(w, now, windowMs);
+    if (max <= 0) {
+      return w.ts.length > 0 ? Math.max(1, w.ts[0] + windowMs - now) : Math.max(1, windowMs);
+    }
     if (w.ts.length < max)
       return 0;
     return Math.max(1, w.ts[0] + windowMs - now);
@@ -63502,12 +63599,12 @@ function createEditFloodFuse(config = {}) {
     if (i >= 0)
       w.ts.splice(i, 1);
   }
-  async function awaitRoom(key, windowMs, max, method, mode, cls, dropGuard, deadline, lateReleaseKey) {
+  async function awaitRoom(key, windowMs, maxFor, method, mode, cls, dropGuard, deadline, lateReleaseKey) {
     const w = win(key);
     let counted = false;
     for (;; ) {
       const now = clock.now();
-      const wait = waitFor(w, now, windowMs, ceiling(max, now));
+      const wait = waitFor(w, now, windowMs, maxFor(now));
       if (wait === 0) {
         w.ts.push(now);
         return now;
@@ -63570,15 +63667,16 @@ function createEditFloodFuse(config = {}) {
     evict(now);
     const deadline = now + maxDeferMs;
     const cls = currentOutboundClass() ?? (isChatAction ? "cosmetic" : defaultOutboundClass(isEdit));
+    const tokenMaxFor = (t) => ceiling(perTokenMax, t);
     if (chat == null) {
       counters.chatless++;
-      await awaitRoom(tokenKey, perTokenWindowMs, perTokenMax, method, "release", cls, undefined, deadline);
+      await awaitRoom(tokenKey, perTokenWindowMs, tokenMaxFor, method, "release", cls, undefined, deadline);
       return runObserved(next);
     }
     const totalKey = `t:${chat}`;
-    const totalMaxFor = (c) => c === "cosmetic" ? Math.max(1, perChatTotalMax - perChatReplyReserve) : perChatTotalMax;
+    const chatTotalMax = totalMaxFor(cls);
     const passToken = async () => {
-      await awaitRoom(tokenKey, perTokenWindowMs, perTokenMax, method, "release", cls, undefined, deadline);
+      await awaitRoom(tokenKey, perTokenWindowMs, tokenMaxFor, method, "release", cls, undefined, deadline);
       return runObserved(next);
     };
     if (isEdit && msg != null) {
@@ -63586,7 +63684,7 @@ function createEditFloodFuse(config = {}) {
       const mw = win(msgKey);
       mw.inflight++;
       try {
-        const msgSlot = await awaitRoom(msgKey, perMessageWindowMs, cls === "cosmetic" ? cosmeticPerMessageMax : perMessageMax, method, "supersede", cls, undefined, deadline);
+        const msgSlot = await awaitRoom(msgKey, perMessageWindowMs, cls === "cosmetic" ? (t) => ceiling(cosmeticPerMessageMax, t) : (t) => classCeiling(perMessageMax, cls, t), method, "supersede", cls, undefined, deadline);
         if (msgSlot === null)
           return DROPPED_RESULT;
         const dropGuard = () => mw.inflight > 1;
@@ -63597,13 +63695,13 @@ function createEditFloodFuse(config = {}) {
             unreserve(k, at);
         };
         const chatKey2 = `ce:${chat}`;
-        const chatSlot = await awaitRoom(chatKey2, perChatWindowMs, cls === "cosmetic" ? cosmeticPerChatMax : perChatEditMax, method, "drop", cls, dropGuard, deadline, lateKey);
+        const chatSlot = await awaitRoom(chatKey2, perChatWindowMs, cls === "cosmetic" ? (t) => ceiling(cosmeticPerChatMax, t) : (t) => classCeiling(perChatEditMax, cls, t), method, "drop", cls, dropGuard, deadline, lateKey);
         if (chatSlot === null) {
           giveBack();
           return DROPPED_RESULT;
         }
         reserved.push([chatKey2, chatSlot]);
-        const totalSlot = await awaitRoom(totalKey, perChatWindowMs, totalMaxFor(cls), method, cls === "cosmetic" ? "drop" : "release", cls, dropGuard, deadline, lateKey);
+        const totalSlot = await awaitRoom(totalKey, perChatWindowMs, chatTotalMax, method, cls === "cosmetic" ? "drop" : "release", cls, dropGuard, deadline, lateKey);
         if (totalSlot === null) {
           giveBack();
           return DROPPED_RESULT;
@@ -63614,19 +63712,19 @@ function createEditFloodFuse(config = {}) {
       }
     }
     if (isSend) {
-      await awaitRoom(`cs:${chat}`, perChatWindowMs, perChatSendMax, method, "release", cls, undefined, deadline);
-      await awaitRoom(totalKey, perChatWindowMs, totalMaxFor(cls), method, "release", cls, undefined, deadline);
+      await awaitRoom(`cs:${chat}`, perChatWindowMs, (t) => classCeiling(perChatSendMax, cls, t), method, "release", cls, undefined, deadline);
+      await awaitRoom(totalKey, perChatWindowMs, chatTotalMax, method, "release", cls, undefined, deadline);
       return passToken();
     }
     counters.meteredByDefault++;
     if (isChatAction) {
       const actionDeadline = Math.min(deadline, now + chatActionMaxDeferMs);
-      const slot = await awaitRoom(totalKey, perChatWindowMs, totalMaxFor(cls), method, "drop", cls, undefined, actionDeadline);
+      const slot = await awaitRoom(totalKey, perChatWindowMs, chatTotalMax, method, "drop", cls, undefined, actionDeadline);
       if (slot === null)
         return DROPPED_RESULT;
       return passToken();
     }
-    await awaitRoom(totalKey, perChatWindowMs, totalMaxFor(cls), method, "release", cls, undefined, deadline);
+    await awaitRoom(totalKey, perChatWindowMs, chatTotalMax, method, "release", cls, undefined, deadline);
     return passToken();
   }
   async function runObserved(next) {
@@ -63657,6 +63755,8 @@ function createEditFloodFuse(config = {}) {
       perMessageCeiling: ceiling(perMessageMax, now),
       cosmeticPerMessageCeiling: ceiling(cosmeticPerMessageMax, now),
       cosmeticPerChatCeiling: ceiling(cosmeticPerChatMax, now),
+      cosmeticPerChatTotalCeiling: cosmeticTotalMax(now),
+      criticalPerChatTotalCeiling: classCeiling(perChatTotalMax, "critical", now),
       meteredByDefault: counters.meteredByDefault,
       chatless: counters.chatless,
       perTokenCeiling: ceiling(perTokenMax, now),
@@ -70869,6 +70969,7 @@ var OPERATOR_ACTIONABLE_KINDS = new Set([
   "credentials-invalid",
   "credit-exhausted",
   "provider-credit-exhausted",
+  "mcp-dependency-blocked",
   "proxy-misconfig"
 ]);
 
@@ -73898,6 +73999,19 @@ function renderOperatorEvent(ev) {
         }
       };
     }
+    case "mcp-dependency-blocked":
+      return {
+        text: [
+          `\uD83D\uDD0C **Paid dependency blocked**`,
+          stripRawErrorBytes(ev.detail)
+        ].filter(Boolean).join(`
+`),
+        keyboard: {
+          inline_keyboard: [
+            [{ text: "\u274c Dismiss", callback_data: `op:dismiss:${encodeURIComponent(ev.agent)}` }]
+          ]
+        }
+      };
     case "quota-exhausted":
       return {
         text: [
@@ -74049,6 +74163,7 @@ var OPERATOR_ACTIONABLE_KINDS2 = new Set([
   "credentials-invalid",
   "credit-exhausted",
   "provider-credit-exhausted",
+  "mcp-dependency-blocked",
   "proxy-misconfig"
 ]);
 function isOperatorActionableKind(kind) {
@@ -74067,6 +74182,265 @@ function renderUserFacingFailureNotice() {
   return "\u26a0\ufe0f Sorry \u2014 I couldn't complete that just now. It's a problem on our side, not anything you did. Please try again shortly.";
 }
 
+// mcp-credential-failure.ts
+var MCP_SERVER_VAULT_KEYS = {
+  eraser: { label: "Eraser", vaultKey: "eraser/api-key", consoleUrl: "https://app.eraser.io/settings/api" },
+  brevo: { label: "Brevo", vaultKey: "brevo/api-key", consoleUrl: "https://app.brevo.com/settings/keys/api" },
+  postiz: { label: "Postiz", vaultKey: "postiz/api-key", consoleUrl: "https://platform.postiz.com/settings" },
+  "meta-ads": { label: "Meta Ads", vaultKey: "meta-ads/access-token", consoleUrl: "https://business.facebook.com/settings" },
+  "google-ads": { label: "Google Ads", vaultKey: "google-ads/developer-token", consoleUrl: "https://ads.google.com/aw/apicenter" },
+  cloudflare: { label: "Cloudflare", vaultKey: "cloudflare/api-token", consoleUrl: "https://dash.cloudflare.com/profile/api-tokens" },
+  context7: { label: "Context7", vaultKey: "context7/api-key", consoleUrl: "https://context7.com/dashboard" }
+};
+function parseMcpServerFromToolName(toolName) {
+  if (typeof toolName !== "string")
+    return null;
+  if (!toolName.startsWith("mcp__"))
+    return null;
+  const rest = toolName.slice("mcp__".length);
+  const end = rest.indexOf("__");
+  const server = end === -1 ? rest : rest.slice(0, end);
+  return server.length > 0 ? server : null;
+}
+function describeMcpServer(server) {
+  const direct = MCP_SERVER_VAULT_KEYS[server];
+  if (direct != null)
+    return direct;
+  const entry = PROVIDER_CREDIT_REGISTRY.find((e) => e.id === server);
+  if (entry != null) {
+    return { label: entry.label, vaultKey: entry.vaultKey, consoleUrl: entry.consoleUrl };
+  }
+  return null;
+}
+function isAlertingClass(c) {
+  return c !== "ordinary";
+}
+var CLASS_RULES = [
+  {
+    cls: "credential",
+    statuses: [401, 403],
+    signals: [
+      "invalid api key",
+      "invalid_api_key",
+      "incorrect api key",
+      "invalid authentication",
+      "authentication_error",
+      "authentication failed",
+      "unauthorized",
+      "unauthorised",
+      "forbidden",
+      "api key not found",
+      "no api key provided",
+      "missing api key",
+      "api key expired",
+      "key has been disabled",
+      "key has been revoked",
+      "key is disabled",
+      "account has been blocked",
+      "account is blocked",
+      "account suspended",
+      "permission_denied",
+      "token expired",
+      "invalid token"
+    ]
+  },
+  {
+    cls: "quota",
+    statuses: [],
+    signals: [
+      "quota exceeded",
+      "quota_exceeded",
+      "over quota",
+      "usage limit reached",
+      "usage limit exceeded",
+      "monthly limit",
+      "monthly quota",
+      "plan limit",
+      "plan_limit",
+      "limit reached for your plan",
+      "upgrade your plan",
+      "spending limit"
+    ]
+  }
+];
+var TRANSIENT_SIGNALS = [
+  "rate limit",
+  "rate_limit",
+  "too many requests",
+  "retry after",
+  "retry-after",
+  "slow down",
+  "timeout",
+  "timed out",
+  "etimedout",
+  "econnreset",
+  "econnrefused",
+  "socket hang up",
+  "network error",
+  "service unavailable",
+  "bad gateway",
+  "temporarily unavailable"
+];
+var MAX_SCAN_CHARS2 = 16384;
+function sample2(text4) {
+  if (typeof text4 !== "string" || text4.length === 0)
+    return "";
+  return (text4.length > MAX_SCAN_CHARS2 ? text4.slice(0, MAX_SCAN_CHARS2) : text4).toLowerCase();
+}
+function extractHttpStatus(text4) {
+  const lower = sample2(text4);
+  if (lower.length === 0)
+    return null;
+  const m = /\b(?:http[ _-]?status|status[ _-]?code|statuscode|status|http|code|error)\b\D{0,4}\b([1-5]\d\d)\b/.exec(lower) ?? /\b([1-5]\d\d)\s+(?:unauthorized|unauthorised|forbidden|payment required|too many requests)\b/.exec(lower);
+  if (m == null)
+    return null;
+  const n = Number(m[1]);
+  return Number.isFinite(n) ? n : null;
+}
+function classifyMcpFailure(text4, status) {
+  const lower = sample2(text4);
+  const httpStatus = typeof status === "number" ? status : extractHttpStatus(text4);
+  if (isProviderCreditStatus(httpStatus) || hasCreditExhaustionWording(lower))
+    return "credit";
+  for (const rule of CLASS_RULES) {
+    if (rule.signals.some((s) => lower.includes(s)))
+      return rule.cls;
+  }
+  if (TRANSIENT_SIGNALS.some((s) => lower.includes(s)))
+    return "ordinary";
+  for (const rule of CLASS_RULES) {
+    if (httpStatus != null && rule.statuses.includes(httpStatus))
+      return rule.cls;
+  }
+  return "ordinary";
+}
+var RENOTIFY_MS = 6 * 60 * 60 * 1000;
+
+class McpFailureLedger {
+  renotifyMs;
+  rows = new Map;
+  constructor(renotifyMs = RENOTIFY_MS) {
+    this.renotifyMs = renotifyMs;
+  }
+  note(input) {
+    if (!isAlertingClass(input.cls))
+      return null;
+    const cls = input.cls;
+    const key = `${input.server}::${cls}`;
+    const row = this.rows.get(key) ?? { agents: new Set, occurrences: 0, lastAlertAt: -Infinity };
+    row.agents.add(input.agent);
+    row.occurrences += 1;
+    this.rows.set(key, row);
+    const due = input.now - row.lastAlertAt >= this.renotifyMs;
+    if (!due)
+      return null;
+    const renotify = Number.isFinite(row.lastAlertAt);
+    const meta = describeMcpServer(input.server);
+    const alert = {
+      server: input.server,
+      label: meta?.label ?? input.server,
+      vaultKey: meta?.vaultKey ?? `${input.server}/api-key`,
+      consoleUrl: meta?.consoleUrl ?? "",
+      cls,
+      agents: [...row.agents].sort(),
+      occurrences: row.occurrences,
+      renotify
+    };
+    row.lastAlertAt = input.now;
+    row.agents = new Set;
+    row.occurrences = 0;
+    return alert;
+  }
+  size() {
+    return this.rows.size;
+  }
+}
+var PENDING_TOOL_NAMES_MAX = 512;
+
+class McpFailureWatcher {
+  pending = new Map;
+  ledger;
+  constructor(renotifyMs = RENOTIFY_MS) {
+    this.ledger = new McpFailureLedger(renotifyMs);
+  }
+  onToolUse(toolUseId, toolName) {
+    if (typeof toolUseId !== "string" || toolUseId.length === 0)
+      return;
+    if (parseMcpServerFromToolName(toolName) == null)
+      return;
+    if (this.pending.size >= PENDING_TOOL_NAMES_MAX) {
+      const oldest = this.pending.keys().next();
+      if (!oldest.done)
+        this.pending.delete(oldest.value);
+    }
+    this.pending.set(toolUseId, toolName);
+  }
+  onToolResult(input) {
+    const id = typeof input.toolUseId === "string" ? input.toolUseId : "";
+    const toolName = id.length > 0 ? this.pending.get(id) : undefined;
+    if (id.length > 0)
+      this.pending.delete(id);
+    if (input.isError !== true)
+      return null;
+    if (toolName == null)
+      return null;
+    const server = parseMcpServerFromToolName(toolName);
+    if (server == null)
+      return null;
+    const cls = classifyMcpFailure(input.errorText);
+    return this.ledger.note({ server, agent: input.agent, cls, now: input.now });
+  }
+}
+var CLASS_HEADLINE = {
+  credit: "is out of credit",
+  credential: "key is being rejected",
+  quota: "has hit its usage quota"
+};
+var CLASS_ACTION = {
+  credit: "Top up the balance",
+  credential: "Re-issue the key and update the vault entry",
+  quota: "Raise the plan limit or wait for the quota to reset"
+};
+function renderMcpFailureDetail(alert) {
+  const agents = alert.agents.length > 0 ? alert.agents.map((a) => a.replace(/[^A-Za-z0-9._-]/g, "")).filter(Boolean).join(", ") : "unknown agent";
+  const console_ = alert.consoleUrl.length > 0 ? ` \u2192 ${alert.consoleUrl}` : "";
+  const repeat = alert.renotify ? " (still failing)" : "";
+  const times = alert.occurrences === 1 ? "1 failure" : `${alert.occurrences} failures`;
+  return `${alert.label} ${CLASS_HEADLINE[alert.cls]}${repeat} \u2014 ${times}, affecting: ${agents}. ` + `${CLASS_ACTION[alert.cls]}. Vault key: \`${alert.vaultKey}\`${console_}`;
+}
+
+// gateway/mcp-failure-hook.ts
+function createMcpFailureHook(deps) {
+  const watcher = new McpFailureWatcher;
+  const clock = deps.now ?? (() => Date.now());
+  return function noteMcpDependencyFailure(ev) {
+    try {
+      if (ev.kind === "tool_use") {
+        watcher.onToolUse(ev.toolUseId, ev.toolName);
+        return;
+      }
+      if (ev.kind !== "tool_result")
+        return;
+      const alert = watcher.onToolResult({
+        toolUseId: ev.toolUseId,
+        isError: ev.isError,
+        errorText: ev.errorText,
+        agent: deps.agent,
+        now: clock()
+      });
+      if (alert == null)
+        return;
+      deps.emit({
+        kind: "mcp-dependency-blocked",
+        agent: deps.agent,
+        detail: renderMcpFailureDetail(alert),
+        suggestedActions: [],
+        firstSeenAt: new Date(clock())
+      });
+    } catch {}
+  };
+}
+
 // pending-user-notice.ts
 var PENDING_USER_NOTICE_TTL_MS = 10 * 60000;
 
@@ -74120,8 +74494,8 @@ var accountScopedThrottleSignals = [
 function isAccountScopedThrottle(text4) {
   if (typeof text4 !== "string" || text4.length === 0)
     return false;
-  const sample2 = text4.length > 16384 ? text4.slice(0, 16384) : text4;
-  const lower = sample2.toLowerCase();
+  const sample3 = text4.length > 16384 ? text4.slice(0, 16384) : text4;
+  const lower = sample3.toLowerCase();
   return accountScopedThrottleSignals.some((s) => lower.includes(s));
 }
 function classify429Detail(text4) {
@@ -74458,8 +74832,8 @@ var litellmV3LimiterSignalPair2 = ["rate limit exceeded for ", "limit type:"];
 function isLitellmProxyLocal4292(text4) {
   if (typeof text4 !== "string" || text4.length === 0)
     return false;
-  const sample2 = text4.length > 16384 ? text4.slice(0, 16384) : text4;
-  const lower = sample2.toLowerCase();
+  const sample3 = text4.length > 16384 ? text4.slice(0, 16384) : text4;
+  const lower = sample3.toLowerCase();
   if (litellmProxyLocal429Signals2.some((s) => lower.includes(s)))
     return true;
   return litellmV3LimiterSignalPair2.every((s) => lower.includes(s));
@@ -74467,14 +74841,14 @@ function isLitellmProxyLocal4292(text4) {
 function detectModelUnavailable2(stderr) {
   if (typeof stderr !== "string" || stderr.length === 0)
     return null;
-  const sample2 = stderr.length > 16384 ? stderr.slice(0, 16384) : stderr;
-  const lower = sample2.toLowerCase();
+  const sample3 = stderr.length > 16384 ? stderr.slice(0, 16384) : stderr;
+  const lower = sample3.toLowerCase();
   if (transientUpstreamSignals2.some((s) => lower.includes(s))) {
-    const resetAt = parseResetTime2(sample2);
+    const resetAt = parseResetTime2(sample3);
     return resetAt !== undefined ? { kind: "overload", resetAt, raw: stderr } : { kind: "overload", raw: stderr };
   }
-  if (isLitellmProxyLocal4292(sample2)) {
-    const resetAt = parseResetTime2(sample2);
+  if (isLitellmProxyLocal4292(sample3)) {
+    const resetAt = parseResetTime2(sample3);
     return resetAt !== undefined ? { kind: "overload", resetAt, raw: stderr } : { kind: "overload", raw: stderr };
   }
   const quotaSignals = [
@@ -74494,7 +74868,7 @@ function detectModelUnavailable2(stderr) {
     "session cap"
   ];
   if (quotaSignals.some((s) => lower.includes(s))) {
-    const resetAt = parseResetTime2(sample2);
+    const resetAt = parseResetTime2(sample3);
     return resetAt !== undefined ? { kind: "quota_exhausted", resetAt, raw: stderr } : { kind: "quota_exhausted", raw: stderr };
   }
   const overloadSignals = [
@@ -74514,7 +74888,7 @@ function detectModelUnavailable2(stderr) {
     " 529 "
   ];
   if (overloadSignals.some((s) => lower.includes(s))) {
-    const resetAt = parseResetTime2(sample2);
+    const resetAt = parseResetTime2(sample3);
     return resetAt !== undefined ? { kind: "overload", resetAt, raw: stderr } : { kind: "overload", raw: stderr };
   }
   const networkSignals = [
@@ -74715,8 +75089,8 @@ var accountScopedThrottleSignals2 = [
 function isAccountScopedThrottle2(text4) {
   if (typeof text4 !== "string" || text4.length === 0)
     return false;
-  const sample2 = text4.length > 16384 ? text4.slice(0, 16384) : text4;
-  const lower = sample2.toLowerCase();
+  const sample3 = text4.length > 16384 ? text4.slice(0, 16384) : text4;
+  const lower = sample3.toLowerCase();
   return accountScopedThrottleSignals2.some((s) => lower.includes(s));
 }
 function classify429Detail2(text4) {
@@ -75795,8 +76169,8 @@ function resolveYear(parsed, todayY, todayIdx) {
   }
   return best;
 }
-function matchCase(sample2, replacement) {
-  if (sample2.length > 0 && sample2[0] === sample2[0].toUpperCase() && sample2[0] !== sample2[0].toLowerCase()) {
+function matchCase(sample3, replacement) {
+  if (sample3.length > 0 && sample3[0] === sample3[0].toUpperCase() && sample3[0] !== sample3[0].toLowerCase()) {
     return replacement.charAt(0).toUpperCase() + replacement.slice(1);
   }
   return replacement;
@@ -80873,24 +81247,62 @@ function createNarrativeLane(deps) {
 // inline-keyboard-callbacks.ts
 var AGENT_CALLBACK_PREFIX2 = "agent:";
 var AGENT_CALLBACK_DATA_MAX2 = 64 - AGENT_CALLBACK_PREFIX2.length;
+function extractCallbackChatId2(callbackQuery) {
+  const msg = callbackQuery?.message;
+  const chat = msg?.chat;
+  const id = chat?.id;
+  if (typeof id === "number" && Number.isFinite(id))
+    return String(id);
+  if (typeof id === "string" && id !== "")
+    return id;
+  return;
+}
+var DEAD_CARD_NOTICE2 = "\u26a0\ufe0f Your tap was applied, but this card could not be updated. " + "The buttons on it are STALE \u2014 tapping them again will not change anything. " + "Scroll down for the outcome, or ask the agent to re-send the card.";
+async function disarmDeadCard2(ctx, apiCall, scope, log) {
+  try {
+    await apiCall(() => ctx.editMessageReplyMarkup({ reply_markup: { inline_keyboard: [] } }), { ...scope, verb: "editMessageReplyMarkup" });
+    log("finalizeCallback: repaint failed but the keyboard was stripped \u2014 " + `the card shows stale text and is no longer tappable
+`);
+    return;
+  } catch (err) {
+    log(`finalizeCallback: editMessageReplyMarkup fallback failed: ${err.message}
+`);
+  }
+  try {
+    await apiCall(() => ctx.reply(DEAD_CARD_NOTICE2, { link_preview_options: { is_disabled: true } }), { ...scope, verb: "sendMessage" });
+  } catch (err) {
+    log(`finalizeCallback: dead-card notice failed: ${err.message}
+`);
+  }
+}
 async function finalizeCallback2(ctx, opts) {
   const log = opts.log ?? ((line) => process.stderr.write(line));
-  ctx.answerCallbackQuery({
+  const apiCall = opts.apiCall;
+  const chatId = extractCallbackChatId2(ctx.callbackQuery);
+  const scope = {
+    ...chatId != null ? { chat_id: chatId } : {},
+    priorityClass: "critical"
+  };
+  apiCall(() => ctx.answerCallbackQuery({
     text: opts.ackText,
     ...opts.alert ? { show_alert: true } : {}
-  }).catch((err) => {
+  }), { ...scope, verb: "answerCallbackQuery" }).catch((err) => {
     log(`finalizeCallback: answerCallbackQuery failed: ${err.message}
 `);
   });
+  let repainted = true;
   try {
-    await ctx.editMessageText(opts.literalText ? opts.newText : { markdown: opts.newText }, {
+    await apiCall(() => ctx.editMessageText(opts.literalText ? opts.newText : { markdown: opts.newText }, {
       reply_markup: { inline_keyboard: [] },
       link_preview_options: { is_disabled: true }
-    });
+    }), { ...scope, verb: "editMessageText" });
   } catch (err) {
+    repainted = false;
     log(`finalizeCallback: editMessageText failed: ${err.message}
 `);
   }
+  if (!repainted)
+    await disarmDeadCard2(ctx, apiCall, scope, log);
   if (opts.synthInbound != null) {
     try {
       const r = opts.synthInbound();
@@ -84017,7 +84429,13 @@ var HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S = 2;
 var HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT = "low";
 var HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4;
 var HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1;
-var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT = 1;
+function hindsightConsolidationLlmMaxConcurrentDefault(globalMaxConcurrent = HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT, retainMaxConcurrent = HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT) {
+  const globalCap = Number.isFinite(globalMaxConcurrent) && globalMaxConcurrent >= 1 ? Math.floor(globalMaxConcurrent) : HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT;
+  const retainCap = Number.isFinite(retainMaxConcurrent) && retainMaxConcurrent >= 0 ? Math.floor(retainMaxConcurrent) : HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT;
+  const headroomBound = Math.max(1, globalCap - 1);
+  return Math.min(headroomBound, Math.max(1, globalCap - retainCap - 1));
+}
+var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT = hindsightConsolidationLlmMaxConcurrentDefault();
 var HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true";
 var HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128;
 var HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true";
@@ -84032,6 +84450,8 @@ var HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 500;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_SLOT_LIMIT = 6;
 var HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1;
+var HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION = "exponential";
+var HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS = 30;
 var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
   [
     "HINDSIGHT_API_RECALL_MAX_CANDIDATES_PER_SOURCE",
@@ -84085,6 +84505,14 @@ var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
   [
     "HINDSIGHT_API_CONSOLIDATION_MAX_MEMORIES_PER_ROUND",
     String(HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND)
+  ],
+  [
+    "HINDSIGHT_API_RECENCY_DECAY_FUNCTION",
+    HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION
+  ],
+  [
+    "HINDSIGHT_API_RECENCY_DECAY_HALFLIFE_DAYS",
+    String(HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS)
   ]
 ];
 var HINDSIGHT_PERF_DEFAULTS_GPU = [
@@ -84109,7 +84537,10 @@ var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
 ];
 var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY",
-  "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP"
+  "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP",
+  "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS",
+  "HINDSIGHT_API_WORKER_MAX_SLOTS",
+  "HINDSIGHT_API_WORKER_RETAIN_MAX_SLOTS"
 ]);
 var HINDSIGHT_PERF_ENV_KEYS = new Set([
   ...[
@@ -84175,6 +84606,16 @@ var DEFAULT_RETAIN_MISSION = `Extract durable facts that will still be true and
 ` + `- Hindsight's own errors, retries, backlogs, or internal state \u2014 the memory
 ` + `  system's self-reports are not memories.
 ` + `- Restatements of the user's current request or the task in progress.
+` + `- Volatile state written as a timeless assertion. A version, count, size,
+` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
+` + `  claim is true only at the instant it was said. Concretely, never produce a
+` + `  fact whose text resembles any of these: "Switchroom fleet is running image
+` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
+` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
+` + `  currently green". If the claim is worth keeping, put the date INSIDE the
+` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
+` + `  cannot date it, drop it. An undated one is recalled forever as though it
+` + `  were still true, which is worse than not remembering it at all.
 ` + `- Transient state (unread counts, build status, what is running right now) unless
 ` + `  the fact is explicitly dated, in which case record it as a dated observation.
 ` + `- Greetings, acknowledgements, and routine operational chatter.
@@ -84196,18 +84637,108 @@ var SUPERSEDED_RETAIN_MISSIONS = [
 ` + "- Transient state (unread counts, build status, what is running right now) " + "unless the fact is explicitly dated, in which case record it as a dated " + `observation.
 ` + `- Greetings, acknowledgements, and routine operational chatter.
 
-` + "If a candidate fact matches an exclusion, drop it rather than rewording " + "it. If nothing durable remains, return an empty facts list."
+` + "If a candidate fact matches an exclusion, drop it rather than rewording " + "it. If nothing durable remains, return an empty facts list.",
+  `Extract durable facts that will still be true and useful weeks from now: user preferences and standing rules, ongoing projects and recurring commitments, technical and architectural decisions with their rationale, and people/tool relationships. A preference revealed by a request is durable \u2014 record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it \u2014 it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) \u2014 retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state \u2014 the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + "nothing durable remains, return an empty facts list."
+];
+var DEFAULT_OBSERVATIONS_MISSION = `Synthesise durable, standing knowledge about the people, projects, and systems this agent works with: preferences and standing rules, roles and relationships, skills and recurring patterns, technical and operational decisions with their rationale, and the state of long-running work once it lands.
+` + `
+` + `The test is durability, not notability: an observation must still be worth reading weeks from now. A single dated event belongs in an observation only when it establishes or changes a standing fact.
+` + `
+` + `Do NOT synthesise observations from:
+` + `- Transcript exhaust \u2014 tool calls and their results, file paths, temp or scratchpad directories, where some output was written, or narration of what an assistant did.
+` + `- Identifiers with no standing meaning: session, agent, request, batch or command IDs, UUIDs, hashes, error codes.
+` + `- In-flight process narration \u2014 a task started, paused, or still running. Record the outcome once it lands, not the running state.
+` + `- The memory system's own errors, retries, backlogs, or internal state.
+` + `- Transient state (what is running right now, unread counts, build status) unless the fact is explicitly dated, in which case record it as dated.
+` + `
+` + "If the new facts contain nothing durable, record nothing rather than synthesising a weak observation.";
+var SUPERSEDED_OBSERVATIONS_MISSIONS = [
+  "Synthesise the person's wellbeing patterns, motivations, and emotional " + "context \u2014 how habits, setbacks, and encouragement connect over time."
 ];
 var PROFILE_MEMORY_DEFAULTS = {
   "health-coach": {
     disposition: { skepticism: 2, literalism: 2, empathy: 5 },
-    observations_mission: "Synthesise the person's wellbeing patterns, motivations, and emotional " + "context \u2014 how habits, setbacks, and encouragement connect over time."
+    observations_mission: `You consolidate the memory of a health and fitness coach working with one person. This bank records how that person actually lives and trains.
+` + `
+` + `Synthesise into durable observations:
+` + `- Goals, targets, and the plan currently in force, with the reasoning behind each.
+` + `- Training, nutrition, sleep, and alcohol patterns as they hold over weeks \u2014 what the person reliably does, not what they did once.
+` + `- Constraints that shape the plan: injuries, medical guidance, schedule, equipment, foods and sessions they refuse.
+` + `- Motivations, and what actually helps or backfires when they slip.
+` + `- Trends in the numbers: direction and range over time, not any single reading.
+` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
+` + `
+` + `A single day's log, weight reading, or session is evidence, not an observation. Record one only when it establishes or changes a standing pattern, target, or constraint \u2014 then fold it into the observation for that pattern and say what changed and roughly when.
+` + `
+` + `Granularity: one observation per habit, target, constraint, or trend. Aggregate repeated daily evidence into the observation for that pattern rather than creating one per day, and keep training, nutrition, and sleep as separate observations.
+` + `
+` + "Word observations as the person's own pattern and framing, never as a verdict on them."
   },
   "executive-assistant": {
-    disposition: { skepticism: 4, literalism: 4, empathy: 3 }
+    disposition: { skepticism: 4, literalism: 4, empathy: 3 },
+    observations_mission: `You consolidate the memory of an executive assistant working for one person. This bank records that person's commitments, people, and standing arrangements.
+` + `
+` + `Synthesise into durable observations:
+` + `- Standing rules and preferences: how they want things scheduled, written, and filed, and when they want to be interrupted.
+` + `- People and organisations, and the relationship: who they are, what they are involved in, how to reach them.
+` + `- Recurring commitments and routines, and the constraints around them.
+` + `- Obligations and their state: what was promised to whom, the deadline, and what is still outstanding.
+` + `- Decisions made and decisions deferred, with the reasoning and the trade accepted.
+` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
+` + `
+` + `Live commitment state IS durable knowledge here, not ephemeral chatter. An outstanding obligation, a travel window, an unanswered request, a "currently X" arrangement \u2014 these are precisely what this agent must recall later. Keep them, and embed the date inside the observation text so a later reader can judge staleness. Do not drop them as ephemeral.
+` + `
+` + `Granularity: one observation per person, arrangement, or obligation. Aggregate repeated mentions into that observation rather than creating siblings; never merge two different people or two different commitments into one.
+` + `
+` + "Do not synthesise from transcript exhaust: tool calls and their results, message or event identifiers, or narration of what the assistant did."
   },
   coding: {
-    disposition: { skepticism: 4, literalism: 5, empathy: 2 }
+    disposition: { skepticism: 4, literalism: 5, empathy: 2 },
+    observations_mission: `You consolidate the memory of a software-engineering agent. This bank records real work on real codebases.
+` + `
+` + `Synthesise into durable observations:
+` + `- Architecture and design decisions, each with its rationale and the trade accepted.
+` + `- Root causes, with the evidence chain, and negative results \u2014 what was ruled out matters as much as what was found.
+` + `- How the repository works: build, test, and lint commands, conventions, CI gates, and where things live.
+` + `- Outcomes of code work: issue and PR numbers, what changed, whether it merged, what review found.
+` + `- The user's standing rules, preferences, and corrections to this agent's behaviour.
+` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
+` + `
+` + `Repository and service state IS durable knowledge here, not ephemeral chatter. Versions, a failing gate, an open PR, a measured number, a "currently X" claim \u2014 these are precisely what this agent must recall later. Keep them, and embed the date inside the observation text so a later reader can judge staleness. Do not drop them as ephemeral.
+` + `
+` + `Granularity: one observation per distinct decision, cause, convention, or work item. Aggregate repeated evidence about the same one into that observation rather than creating siblings; never merge two separate decisions into a single summary.
+` + `
+` + "Do not synthesise from transcript exhaust: tool calls and their results, scratch paths, session or request identifiers, or narration of what the agent did. Prefer specific and falsifiable \u2014 naming the file, the number, the commit, or the decision beats summarising the topic."
   }
 };
 // ../src/agents/reconcile-default-skills.ts
@@ -97654,10 +98185,10 @@ function startOutboxSweep(deps) {
 }
 
 // ../src/build-info.ts
-var VERSION2 = "0.19.27";
-var COMMIT_SHA = "42779242";
-var COMMIT_DATE = "2026-07-27T23:25:46Z";
-var LATEST_PR = 3877;
+var VERSION2 = "0.19.29";
+var COMMIT_SHA = "c618451c";
+var COMMIT_DATE = "2026-07-28T17:39:27Z";
+var LATEST_PR = 3918;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -105584,7 +106115,9 @@ function surfaceConsolidationLegibility(rec, target) {
 `);
   });
 }
+var noteMcpDependencyFailure = createMcpFailureHook({ agent: AGENT_NAME, emit: emitGatewayOperatorEvent });
 function handleSessionEvent2(ev) {
+  noteMcpDependencyFailure(ev);
   handleSessionEvent(gatewayStreamRenderDeps(), ev);
 }
 function gatewayStreamRenderDeps() {
@@ -109966,6 +110499,7 @@ ${preBlock(formatSwitchroomOutput(err.message ?? "unknown error"))}`, { html: tr
       const baseText2 = sourceMsg && "text" in sourceMsg && sourceMsg.text ? escapeHtmlForTg2(sourceMsg.text) : "";
       const interimLabel = `\u23F3 **Rule applied for this session** \u2014 ${escapeHtmlForTg2(agentName3)} can ${escapeHtmlForTg2(grantPhrase)} ` + `without asking for now; saving durably in background\u2026`;
       await finalizeCallback2(ctx, {
+        apiCall: robustApiCall,
         ackText: "Rule applied for this session; saving durably in background\u2026".slice(0, 200),
         newText: baseText2 ? `${baseText2}
 
@@ -110131,6 +110665,7 @@ ${editLabel}` : editLabel), {
 
 ${resumeLine}` : htmlLabel;
     await finalizeCallback2(ctx, {
+      apiCall: robustApiCall,
       ackText: ackText3.slice(0, 200),
       newText: baseText ? `${baseText}