switchroom 0.19.30 → 0.19.31

package/telegram-plugin/gateway/gateway.ts

@@ -19,6 +19,7 @@ import {
   statSync, renameSync, realpathSync, chmodSync, openSync, closeSync,
   existsSync, unlinkSync, appendFileSync,
 } from 'fs'
+import { fsyncPathSync } from '../../src/util/atomic.js'
 import { homedir } from 'os'
 import { join, sep, basename } from 'path'
 
@@ -642,12 +643,9 @@ import { runStatusPinReconcile, type StatusPinClaim } from './status-pin-retarge
 import { createPeriodicSweepGuard } from './periodic-sweep-guard.js'
 import { withDeadline } from './with-deadline.js'
 import { createStatusPinApi, type PinCapableBot, type RobustApiSeam } from './status-pin-api.js'
-import {
-  createDmPinSweeper,
-  collectDmChatIdsFromStores,
-  unexpiredStoreRepinIds,
-  type DmPinSweeper,
-} from './dm-pin-sweep.js'
+import { collectSweepTargets, type StalePinSweeper, type SweepTarget } from './stale-pin-sweep.js'
+import { createGatewayStalePinSweeper } from './stale-pin-sweep-wiring.js'
+import { atomicWriteFileSync } from '../../src/util/atomic.js'
 import { startWebhookIngestServer } from './webhook-ingest-server.js'
 import { recordWebhookEvent } from '../../src/web/webhook-gateway-record.js'
 
@@ -849,11 +847,10 @@ import { listRecords as listWorktreeRecords, touchHeartbeat as touchWorktreeHear
 import { makeWorktreeWatchProvider } from '../worktree-watch-cwds.js'
 import {
   startBootCard,
-  resolvePersonaName,
-  type BootCardHandle,
+  resolvePersonaName, shouldSkipDuplicateBootCard,
+  type BootCardHandle, type RestartReason,
 } from './boot-card.js'
 import { determineRestartReason } from './boot-reason.js'
-import { shouldSkipDuplicateBootCard, type RestartReason } from './boot-card.js'
 import { maybeRenderUpdateAnnouncement } from './update-announce.js'
 import { createIssuesCardHandle, type IssuesCardHandle } from '../issues-card.js'
 import { startIssuesWatcher, type IssuesWatcherHandle } from '../issues-watcher.js'
@@ -914,6 +911,7 @@ import {
   TURN_ACTIVE_IDLE_SWEEP_MS,
 } from './turn-active-marker.js'
 import { startGatewayHeartbeat } from './gateway-heartbeat.js'
+import { attachBootBeacon } from './boot-beacon.js'
 import { startOutboxSweep } from './outbox-sweep.js'
 import {
   VERSION,
@@ -2345,7 +2343,7 @@ function checkApprovals(): void {
     )
   }
 }
-if (isGatewayMain && !STATIC) setInterval(checkApprovals, 5000).unref()
+if (isGatewayMain && !STATIC) setInterval(attachBootBeacon(STATE_DIR, checkApprovals), 5000).unref() // beacon rides this EXISTING tick — boot-beacon.ts
 // Gateway liveness heartbeat — touches `<STATE_DIR>/gateway-heartbeat` while
 // the gateway lives so the silent-end Stop hook's single-writer election can
 // confirm the gateway is alive (and WILL run its turn_end delivery) before
@@ -2838,6 +2836,7 @@ const obligationStoreFs = {
   writeFileSync: (p: string, d: string) => writeFileSync(p, d),
   renameSync: (a: string, b: string) => renameSync(a, b),
   existsSync: (p: string) => existsSync(p),
+  fsyncFileSync: fsyncPathSync, fsyncDirSync: fsyncPathSync,
 }
 const obligationLedger = new ObligationLedger(OBLIGATION_REPRESENT_MAX, {
   onChange:
@@ -9102,6 +9101,10 @@ async function reconcileStatusPin(
   pinKey: string,
   chatId: string,
   desired: DesiredPin,
+  /** Forum topic the pinned message lives in, when the caller knows it. Keyed
+   *  into the claim + the durable row so a post-crash sweep can aim
+   *  `unpinAllForumTopicMessages` at the right topic. */
+  threadId?: number,
 ): Promise<void> {
   // Fire-and-forget hard boundary. Most callers invoke this as
   // `void reconcileStatusPin(...)` (auto status-pin is best-effort — it must
@@ -9119,7 +9122,7 @@ async function reconcileStatusPin(
     // Serialize per pinKey (F2): reconcileStatusPinInner reads `prev` from the
     // in-memory claim map at its top, so overlapping same-key reconciles must
     // run one-at-a-time or a stale `prev` clears the disk row under a live pin.
-    await withPinReconcileLock(pinKey, () => reconcileStatusPinInner(pinKey, chatId, desired))
+    await withPinReconcileLock(pinKey, () => reconcileStatusPinInner(pinKey, chatId, desired, threadId))
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err)
     process.stderr.write(
@@ -9133,6 +9136,7 @@ async function reconcileStatusPinInner(
   pinKey: string,
   chatId: string,
   desired: DesiredPin,
+  threadId?: number,
 ): Promise<void> {
   if (!PIN_STATUS_WHILE_WORKING) return
   if (chatId.length === 0) return
@@ -9172,6 +9176,7 @@ async function reconcileStatusPinInner(
   await runStatusPinReconcile({
     pinKey,
     chatId,
+    threadId,
     prev,
     desired,
     // persist:null ⇒ no durable row (STATIC / feature-off).
@@ -9203,81 +9208,62 @@ async function unpinAllStatusPins(): Promise<void> {
   }
 }
 
-// ─── DM stale-pin sweep (#3026) ─────────────────────────────────────────────
-// In a user DM the Bot API skips the boot getChat() probe (positive chat IDs
-// return `400 chat not found` until the user messages) AND getChat() exposes
-// only the NEWEST pin — DMs STACK pins and there is no list-pins method, so
-// older orphan pins are invisible to the probe-based sweep forever. The durable
-// fix: once per DM chat per boot, `unpinAllChatMessages` (safe in a DM — every
-// pin is bot-authored) then re-pin the live tracked cards. Groups keep the
-// probe path (unpin-all there would nuke human pins).
+// ─── Stale-pin stack sweep ──────────────────────────────────────────────────
+// A Telegram chat holds a STACK of pins; `getChat().pinned_message` exposes only
+// the TOP and there is no list-pins method, so a probe-based cleanup never sees
+// the rest. Worse (verified live 2026-07-29): a bare `unpinChatMessage` on a
+// stale entry is a SILENT NO-OP that returns ok:true, so the gateway logged a
+// clean sweep on every boot while the stack grew unbounded — 37 orphans across
+// 5 agents, 21 in one chat. The drain, the rate gates and the durable
+// obligation cursor live in stale-pin-sweep.ts; this is just the binding.
 //
 // Eligibility mirrors statusPinBootCleanup's mutex gate: set true ONLY after
 // this gateway wins the startup lock, so a losing double-boot never clears the
 // live holder's pins.
-let dmPinSweepEligible = false
-const dmPinSweeper: DmPinSweeper = createDmPinSweeper({
-  unpinAll: (chatId) =>
-    robustApiCall(() => lockedBot.api.unpinAllChatMessages(chatId), { // allow-raw-pin: DM-only boot sweep — clears pins this process cannot enumerate (pre-restart orphans) and immediately re-pins the live tracked ids below.
-      chat_id: chatId,
-      verb: 'dm-pin-sweep.unpin-all',
-    }),
-  pinSilent: (chatId, messageId) =>
-    robustApiCall(
-      () =>
-        lockedBot.api.pinChatMessage(chatId, messageId, { // allow-raw-pin: the re-pin half of the DM boot sweep — restores ids the sweep just cleared; the claims themselves are untouched.
-          disable_notification: true,
-        }),
-      { chat_id: chatId, verb: 'dm-pin-sweep.repin' },
-    ),
-  // Pins that must survive the unpin-all: live in-memory status-pin claims
-  // for this chat (fg:/wk:/tool:/banner: — non-empty for a first-inbound
-  // sweep landing mid-turn) UNIONED with the deliberately-retained store
-  // rows — unexpired `tool:` pins (#3001) survive statusPinBootCleanup by
-  // design and must survive this sweep too. Read LIVE from the store so
-  // both the boot sweep (in-memory maps still empty then) and a later
-  // first-inbound sweep see them. Best-effort: a store read failure
-  // degrades to in-memory-only. The sweeper dedupes.
-  liveTrackedMessageIds: (chatId) => {
-    const ids: number[] = []
-    for (const claim of statusPinClaims.values()) {
-      if (claim.chatId === chatId) ids.push(claim.messageId)
-    }
-    if (statusPinPersistEnabled || bannerPinPersistEnabled || toolPinPersistEnabled) {
-      try {
-        ids.push(
-          ...unexpiredStoreRepinIds(
-            loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs),
-            chatId,
-            Date.now(),
-          ),
-        )
-      } catch (err) {
-        process.stderr.write(
-          `telegram gateway: dm-pin-sweep: store repin scan failed ` +
-            `(chat=${chatId}): ${(err as Error).message}\n`,
-        )
-      }
-    }
-    return ids
+let stalePinSweepEligible = false
+// Durable ledger: fsync'd tempfile + atomic rename, so a power cut leaves either
+// the previous complete ledger or the new one — never a truncated file that
+// forgets an in-flight drain.
+const STALE_PIN_SWEEP_STORE_PATH = join(STATE_DIR, 'stale-pin-sweep.json')
+const stalePinSweeper: StalePinSweeper = createGatewayStalePinSweeper({
+  telegram: { handle: () => lockedBot, call: robustApiCall },
+  claims: () => statusPinClaims.values(),
+  loadPinRows: () =>
+    statusPinPersistEnabled || bannerPinPersistEnabled || toolPinPersistEnabled
+      ? loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs)
+      : [],
+  eligible: () => stalePinSweepEligible,
+  store: {
+    path: STALE_PIN_SWEEP_STORE_PATH,
+    fs: {
+      readFileSync: (p) => readFileSync(p, 'utf-8'),
+      writeFileSync: (p, data) => atomicWriteFileSync(p, data, 0o600),
+      existsSync: (p) => existsSync(p),
+    },
   },
-  eligible: () => dmPinSweepEligible,
-  log: (line) => process.stderr.write(line),
+  // Per-deployment override only. UNSET (the normal case) means "take the
+  // standing policy" — UNPIN_ALL_FORUM_TOPIC_ENABLED in stale-pin-sweep.ts,
+  // i.e. the WHOLESALE topic drain stays off because it also removes pins this
+  // gateway never placed. Set the env var to 1 to opt a deployment in.
+  allowUnpinAllForumTopic:
+    process.env.SWITCHROOM_PIN_SWEEP_UNPIN_ALL_TOPIC == null
+      ? undefined
+      : process.env.SWITCHROOM_PIN_SWEEP_UNPIN_ALL_TOPIC === '1',
 })
 
 /**
- * Boot-time pin cleanup + DM stale-pin sweep. Collects the DM chat IDs with a
- * prior-session pin record BEFORE the store reapers empty the stores, runs the
- * three boot reapers, marks the DM sweep eligible, then unpin-alls each
- * recorded DM chat. Ordering and per-step isolation live in
+ * Boot-time pin cleanup + stale-pin stack sweep. Collects the `(chat, thread)`
+ * targets with a prior-session pin record BEFORE the store reapers empty the
+ * stores, runs the three boot reapers, marks the sweep eligible, then drains
+ * each recorded target. Ordering and per-step isolation live in
  * `runBootPinSweepSteps` (boot-sweep-gate.ts) — a throwing reaper must not
- * strand `enableDmSweep`. Dispatched only via `bootPinSweepGate` below (mutex
+ * strand `enableSweep`. Dispatched only via `bootPinSweepGate` below (mutex
  * won AND `lockedBot` constructed); fire-and-forget — never blocks boot.
  */
-function runBootPinCleanupAndDmSweep(): Promise<void> {
+function runBootPinCleanupAndStalePinSweep(): Promise<void> {
   return runBootPinSweepSteps({
-    scanDmChatIds: () =>
-      collectDmChatIdsFromStores({
+    scanSweepTargets: () =>
+      collectSweepTargets({
         statusPins:
           statusPinPersistEnabled || bannerPinPersistEnabled || toolPinPersistEnabled
             ? loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs)
@@ -9292,19 +9278,19 @@ function runBootPinCleanupAndDmSweep(): Promise<void> {
     statusPinCleanup: statusPinBootCleanup,
     activityCardReaper: activityCardBootReaper,
     queuedCardReaper: queuedCardBootReaper,
-    // This gateway owns the shared pin state — enable the DM unpin-all path
-    // (this sweep AND lazy first-inbound sweeps).
-    enableDmSweep: () => {
-      dmPinSweepEligible = true
+    // This gateway owns the shared pin state — enable the drain (this sweep
+    // AND lazy first-inbound sweeps).
+    enableSweep: () => {
+      stalePinSweepEligible = true
     },
-    sweepDm: (id) => dmPinSweeper.sweep(id),
+    sweepTarget: (t: SweepTarget) => stalePinSweeper.sweepTarget(t),
     log: (line) => process.stderr.write(line),
   })
 }
 
 // #3664: needs BOTH the mutex (arm) and a constructed `lockedBot` (botReady,
 // end of initGatewayBot) before it may run — see boot-sweep-gate.ts.
-const bootPinSweepGate = createBootSweepGate({ run: runBootPinCleanupAndDmSweep, onError: (err) => process.stderr.write(`telegram gateway: boot pin cleanup / DM sweep failed: ${(err as Error).message}\n`) })
+const bootPinSweepGate = createBootSweepGate({ run: runBootPinCleanupAndStalePinSweep, onError: (err) => process.stderr.write(`telegram gateway: boot pin cleanup / stale-pin sweep failed: ${(err as Error).message}\n`) })
 
 // Activity feed. The gateway streams a live "what it's doing" tool-activity
 // feed for every turn. The PreToolUse sidecar emits a `tool_label` per tool
@@ -9926,6 +9912,7 @@ if (isGatewayMain) inboundSpool = STATIC
         renameSync: (a, b) => renameSync(a, b),
         existsSync: (p) => existsSync(p),
         statSizeSync: (p) => statSync(p).size,
+        fsyncFileSync: fsyncPathSync, fsyncDirSync: fsyncPathSync,
       },
       // #2789 B: durability degradation must be visible, not silent. When
       // spool appends start failing we're back to in-memory-only — a
@@ -14750,14 +14737,26 @@ export async function handleInbound(
   // #2862 — operator is back; re-offer any approvals that timed out meanwhile.
   maybePostMissedApprovalDigest('operator inbound')
 
-  // #3026 — first inbound from a DM after boot: clear any stale STACKED pins
-  // the boot getChat() probe can't see (DMs skip the probe AND getChat only
-  // exposes the newest pin). unpin-all once per DM chat per boot, then re-pin
-  // live tracked cards. once-guarded (dedups with the boot sweep); no-op for
-  // groups and until the startup mutex is won. Fire-and-forget.
+  // First inbound after boot: drain any stale STACKED pins in this exact
+  // (chat, thread) that the boot getChat() probe can't see (DMs skip the probe
+  // AND getChat exposes only the newest pin). The durable obligation cursor
+  // dedups with the boot sweep and with a prior drain of the same target; the
+  // rights precheck and rate gates apply as usual, and a non-forum supergroup
+  // is skipped. No-op until the startup mutex is won. Fire-and-forget.
+  //
+  // This runs on EVERY inbound; `sweepTarget` is at-most-once per target per
+  // process (and coalesces concurrent callers), so a busy chat cannot
+  // re-attempt a partial drain once per message. That guard lives in the
+  // sweeper, not here, so the boot caller inherits it too.
   {
     const inboundChatId = ctx.chat?.id
-    if (inboundChatId != null) void dmPinSweeper.sweep(String(inboundChatId))
+    if (inboundChatId != null) {
+      void stalePinSweeper.sweepTarget({
+        chatId: String(inboundChatId),
+        threadId: ctx.message?.message_thread_id,
+        isForum: ctx.chat?.is_forum === true,
+      })
+    }
     // Outbox envelope-less routing (F2) is scoped to each record's OWN stamped
     // per-session origin chat (captured at Stop), not a gateway-global stamp.
   }
@@ -24049,11 +24048,11 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
               // (its claim still names that id), leaving live work unpinned. The
               // feed drives this: pin `wk:group:<feedKey>` when the group first
               // paints, unpin only when the group empties (messageId === null).
-              reconcilePin: ({ feedKey, chatId, messageId }) => {
+              reconcilePin: ({ feedKey, chatId, threadId, messageId }) => {
                 if (!PIN_STATUS_WHILE_WORKING) return
                 const key = `wk:group:${feedKey}`
                 if (messageId != null) {
-                  void reconcileStatusPin(key, chatId, { pinned: true, messageId })
+                  void reconcileStatusPin(key, chatId, { pinned: true, messageId }, threadId)
                 } else {
                   const unpinChat = chatId || statusPinClaims.get(key)?.chatId
                   if (unpinChat != null && unpinChat.length > 0) {

package/telegram-plugin/gateway/inbound-spool.ts

@@ -41,6 +41,7 @@
  * gateway (mirrors the #1544/#1546/#1549 pure-seam idiom).
  */
 
+import { dirname } from 'node:path'
 import type { InboundMessage } from './ipc-protocol.js'
 
 /** Stable dedup id for an inbound. Real Telegram messages have a
@@ -161,6 +162,17 @@ export interface InboundSpoolFsSeam {
   renameSync: (from: string, to: string) => void
   existsSync: (path: string) => boolean
   statSizeSync: (path: string) => number
+  /** fsync the FILE at `path` — flush its bytes to stable storage.
+   *  `appendFileSync` returning only means the page cache took the write;
+   *  without this a host power cut loses the record even though every
+   *  syscall succeeded. */
+  fsyncFileSync: (path: string) => void
+  /** fsync the DIRECTORY at `path` — makes a completed `renameSync`
+   *  durable. rename(2) is atomic (never a torn file) but that is an
+   *  ordering guarantee, not a durability one: the new directory entry
+   *  lives in the parent's own cached metadata and can vanish in a power
+   *  cut. Call AFTER the rename. */
+  fsyncDirSync: (path: string) => void
 }
 
 export interface InboundSpoolOptions {
@@ -345,6 +357,13 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   function appendRecord(rec: SpoolRecord): void {
     try {
       fs.appendFileSync(path, JSON.stringify(rec) + '\n')
+      // Durability barrier. The whole point of this file is that the
+      // record survives the process dying, and `appendFileSync` alone
+      // only guarantees the page cache holds it — enough for a SIGKILL,
+      // not for a host power cut. fsync before we report success, so a
+      // failure here is treated as the durability loss it is (latched
+      // `degraded`) rather than a silent downgrade to in-memory.
+      fs.fsyncFileSync(path)
       // #2789 B: a successful append after a failure run means the spool
       // is durable again — un-latch degraded state and surface recovery
       // so the health signal clears.
@@ -435,12 +454,32 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
     const tmp = path + '.compact.tmp'
     try {
       fs.writeFileSync(tmp, lines.length ? lines.join('\n') + '\n' : '')
+      // fsync the tmp file BEFORE publishing it: rename orders the
+      // metadata, it does not put the DATA on the platter. Renaming an
+      // unsynced tmp over the log can leave the spool naming a file whose
+      // contents were never written — worse than not compacting at all.
+      fs.fsyncFileSync(tmp)
       fs.renameSync(tmp, path)
       log(`inbound-spool: compacted path=${path} live=${live.size}\n`)
     } catch (err) {
       // Compaction is opportunistic — a failure keeps the (larger but
       // correct) append-only log; never lose data trying to shrink it.
       log(`inbound-spool: compact FAILED path=${path}: ${(err as Error).message}\n`)
+      return
+    }
+    // ...then fsync the containing DIRECTORY, which is what makes the rename
+    // itself survive a power cut. Separate try: the rename has already
+    // landed, so this failing is a weaker durability claim, NOT a failed
+    // compaction — logging it as one would send an operator hunting a
+    // rewrite that actually worked.
+    try {
+      fs.fsyncDirSync(dirname(path))
+    } catch (err) {
+      log(
+        `inbound-spool: compact directory fsync FAILED path=${path}: ` +
+        `${(err as Error).message} — compacted log written but the rename ` +
+        `may not survive a power cut\n`,
+      )
     }
   }
 

package/telegram-plugin/gateway/narrative-lane.ts

@@ -133,6 +133,15 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
       // The parent's OWN running token total → `· N tok` on the metrics line.
       // 0 → tokenSegment omits it (clean, same as the worker feed).
       totalTokens: turn.totalTokens,
+      // Terminal `✅ <summary>` footer, rendered through the SAME
+      // `deriveCardResult` the 🛠 worker card uses. The agent's analogue of the
+      // worker's `latestSummary` is the answer it actually delivered this turn
+      // (`lastReplyText`, stamped on the reply/stream_reply tool_use just
+      // before the first-reply `clearActivitySummary` hand-off). Only supplied
+      // on a FINAL render; empty (a turn that finalised before any reply — the
+      // foreground handoff-clear path — or a genuinely silent turn) → the
+      // shared derivation omits the block, exactly as the worker card does.
+      resultText: final ? turn.lastReplyText : undefined,
     }
     return renderActivityFeedWithNested(turn.mirrorLines, childLines, final, liveSuffix, stepCount, header)
   }
@@ -892,6 +901,9 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
         const livenessHeader: SessionActivityHeader = {
           label: 'Agent', elapsedMs: livenessElapsed, toolCount: turn.labeledToolCount, state: 'done',
           model: turn.currentModel,
+          // Same terminal `✅ <summary>` footer as the normal final render —
+          // this liveness-only card is still a FINAL agent card.
+          resultText: turn.lastReplyText,
         }
         finalHtml = renderActivityFeedWithNested(['Working…'], [], true, '', undefined, livenessHeader)
       }

package/telegram-plugin/gateway/obligation-store.ts

@@ -25,6 +25,7 @@
  * unbounded. PURE w.r.t. the injected fs seam ⇒ unit-testable.
  */
 
+import { dirname } from 'node:path'
 import type { Obligation } from './obligation-ledger.js'
 
 export interface ObligationStoreFsSeam {
@@ -34,6 +35,14 @@ export interface ObligationStoreFsSeam {
    *  the snapshot. */
   renameSync: (from: string, to: string) => void
   existsSync: (path: string) => boolean
+  /** fsync the FILE at `path`. Atomicity ≠ durability: rename orders the
+   *  metadata, it does not put the tmp file's DATA on stable storage. Call
+   *  on the tmp file BEFORE the rename. */
+  fsyncFileSync: (path: string) => void
+  /** fsync the DIRECTORY at `path`, AFTER the rename — the new directory
+   *  entry lives in the parent's own cached metadata and is otherwise lost
+   *  in a power cut. */
+  fsyncDirSync: (path: string) => void
 }
 
 interface SnapshotEnvelope {
@@ -133,11 +142,30 @@ export function persistObligations(
   const tmp = path + '.tmp'
   try {
     fs.writeFileSync(tmp, JSON.stringify(env))
+    // Order matters: fsync the tmp file's DATA, THEN publish it by rename.
+    // Renaming first would let a power cut leave the snapshot path pointing
+    // at an inode whose bytes never reached the platter — a zero-length or
+    // stale snapshot that reads as "no open obligations", which is exactly
+    // the silent-drop this store exists to prevent.
+    fs.fsyncFileSync(tmp)
     fs.renameSync(tmp, path)
   } catch (err) {
     log(
       `obligation-store: persist FAILED path=${path}: ${(err as Error).message} — ` +
         `durability degraded to in-memory\n`,
     )
+    return
+  }
+  // The rename landed, so the snapshot is already correct for a process
+  // crash; this last barrier only upgrades it to survive a power cut. Kept
+  // in its own try so a directory-fsync failure isn't mislabelled as a
+  // failed persist — the data IS written, just not provably on the platter.
+  try {
+    fs.fsyncDirSync(dirname(path))
+  } catch (err) {
+    log(
+      `obligation-store: directory fsync FAILED path=${path}: ${(err as Error).message} — ` +
+        `snapshot written but the rename may not survive a power cut\n`,
+    )
   }
 }