switchroom 0.20.22 → 0.21.1

package/telegram-plugin/gateway/always-allow-persist-queue.ts

@@ -60,7 +60,7 @@
 
 import { writeFileSync, unlinkSync } from 'node:fs'
 import { join } from 'node:path'
-import { atomicWriteFileSync } from '../../src/util/atomic.js'
+import { atomicWriteStateFileSync } from '../../src/util/state-owner.js'
 import {
   preserveUnreadableStoreFile,
   quarantineCorruptStoreFile,
@@ -182,7 +182,7 @@ export function computeBackoffMs(attempts: number, retryAfterMs?: number): numbe
  */
 export const atomicWriteSeam = ((path, data, opts) => {
   const mode = typeof opts === 'object' && opts !== null && typeof opts.mode === 'number' ? opts.mode : 0o600
-  atomicWriteFileSync(path as string, data as string, mode)
+  atomicWriteStateFileSync(path as string, data as string, mode)
 }) as typeof writeFileSync
 
 export function createAlwaysAllowPersistQueue(

package/telegram-plugin/gateway/boot-beacon.ts

@@ -68,7 +68,6 @@ import { randomUUID } from 'node:crypto'
 import {
   closeSync,
   fsyncSync,
-  mkdirSync,
   openSync,
   readFileSync,
   renameSync,
@@ -76,6 +75,7 @@ import {
   writeFileSync,
 } from 'node:fs'
 import { join } from 'node:path'
+import { adoptStateOwnershipFd, mkdirStateSync } from '../../src/util/state-owner.js'
 
 /** Filename under `TELEGRAM_STATE_DIR`. */
 export const BOOT_BEACON_FILE = 'gateway-beacon.json'
@@ -297,12 +297,19 @@ export function writeBootBeaconFile(stateDir: string, beacon: BootBeacon): boole
     // gateway creates it 0o700 at boot. If it were ever missing here, a
     // default-mode recreate by this 5s tick would silently loosen the
     // permissions on that whole directory.
-    mkdirSync(stateDir, { recursive: true, mode: 0o700 })
+    mkdirStateSync(stateDir, { recursive: true, mode: 0o700 })
     fd = openSync(tmp, 'w', 0o600)
     // writeFileSync (not writeSync) on the fd: it loops internally, so a short
     // write can't leave a truncated beacon that we then fsync and rename into
     // place as if it were whole.
     writeFileSync(fd, serializeBootBeacon(beacon))
+    // Ownership on the TEMPFILE FD, before the rename: a root-running gateway
+    // re-creates this file every 5s, so it is the loudest source of root-owned
+    // state in an agent-owned dir. Doing it on the fd (never a path) means no
+    // symlink can be raced in, and doing it before the rename means the file
+    // is never visible at its final name under the wrong owner. No-op off the
+    // root path.
+    adoptStateOwnershipFd(fd, stateDir)
     fsyncSync(fd)
     closeSync(fd)
     fd = undefined

package/telegram-plugin/gateway/gateway-heartbeat.ts

@@ -21,8 +21,9 @@
  * conservatively BLOCKS (re-prompt), which is the safe direction.
  */
 
-import { mkdirSync, utimesSync, writeFileSync } from 'node:fs'
+import { utimesSync } from 'node:fs'
 import { join } from 'node:path'
+import { mkdirStateSync, writeStateFileSync } from '../../src/util/state-owner.js'
 
 /** Filename under `TELEGRAM_STATE_DIR`. MUST stay in sync with
  * `GATEWAY_HEARTBEAT_FILE` in `hooks/silent-end-scan.mjs`. */
@@ -47,8 +48,8 @@ export function touchGatewayHeartbeat(stateDir: string): void {
   } catch {
     // File doesn't exist yet (or unstattable) — create it.
     try {
-      mkdirSync(stateDir, { recursive: true })
-      writeFileSync(path, `${Date.now()}\n`, { mode: 0o600 })
+      mkdirStateSync(stateDir, { recursive: true })
+      writeStateFileSync(path, `${Date.now()}\n`, { mode: 0o600 })
     } catch {
       // Best-effort — a heartbeat write failure makes the hook BLOCK
       // (re-prompt), which is the safe direction.

package/telegram-plugin/gateway/gateway.ts

@@ -303,6 +303,7 @@ import { installEditFloodFuse, editFloodFuseConfigFromEnv } from '../edit-flood-
 import { createSendGate, sendGateConfigFromEnv, isSendGateShed } from '../send-gate.js'
 import { createStatsLogger, createFloodWindowObserver } from '../send-gate-observability.js'
 import { installTgPostLogger, installRichMarkdownGuard, withTgPostTags } from '../shared/bot-runtime.js'
+import { installSentTextCapture } from '../shared/sent-text-capture.js'
 import {
   floodStatePath,
   floodWindowsPath,
@@ -395,7 +396,9 @@ import {
   pruneMessagesOlderThanDays,
   hasOutboundDeliveredSince,
   hasOutboundWithText,
+  recordSystemOutbound, updateSystemOutboundText,
 } from '../history.js'
+import { makeSystemMessageObserver } from './system-message-observer.js'
 import {
   runRegistryReaper,
   resolveRetentionDays as resolveRegistryRetentionDays,
@@ -658,7 +661,8 @@ import { createStatusPinApi, type PinCapableBot, type RobustApiSeam } from './st
 import { collectSweepTargets, type StalePinSweeper, type SweepTarget } from './stale-pin-sweep.js'
 import { createGatewayStalePinSweeper } from './stale-pin-sweep-wiring.js'
 import { reseedSweepLedger } from './stale-pin-sweep-store.js'
-import { atomicWriteFileSync } from '../../src/util/atomic.js'
+// Ownership choke point for every state-dir write; zero-syscall no-op off the root path. Rationale: src/util/state-owner.ts.
+import { appendStateFileSync, atomicWriteStateFileSync, mkdirStateSync, reconcileStateDirOwnershipLogged, writeStateFileSync } from '../../src/util/state-owner.js'
 import { startWebhookIngestServer } from './webhook-ingest-server.js'
 import { recordWebhookEvent } from '../../src/web/webhook-gateway-record.js'
 
@@ -2148,6 +2152,8 @@ function runHistoryReaperNow(reason: 'boot' | 'periodic'): void {
       process.stderr.write(`telegram gateway: history-reaper (${reason}) failed: ${(err as Error).message}\n`)
     }
   }
+  // State-dir ownership backfill (never throws; rides this EXISTING boot/6h tick). See src/util/state-owner.ts.
+  reconcileStateDirOwnershipLogged(STATE_DIR, reason, { prefix: 'telegram gateway' })
 }
 // Run once at boot to catch up long-stopped agents. (#2996 P0c: gated.)
 if (isGatewayMain) runHistoryReaperNow('boot')
@@ -2668,7 +2674,7 @@ function noteAgentOutputAt(key: string, ts: number): void {
 const OBLIGATION_STORE_PATH = join(STATE_DIR, 'obligations.json')
 const obligationStoreFs = {
   readFileSync: (p: string) => readFileSync(p, 'utf8'),
-  writeFileSync: (p: string, d: string) => writeFileSync(p, d),
+  writeFileSync: (p: string, d: string) => writeStateFileSync(p, d),
   renameSync: (a: string, b: string) => renameSync(a, b),
   existsSync: (p: string) => existsSync(p),
   fsyncFileSync: fsyncPathSync, fsyncDirSync: fsyncPathSync, unlinkSync,
@@ -5595,10 +5601,28 @@ const rawRobustApiCall = createRetryApiCall({
   floodWaitRemainingMs: probeFloodWaitRemainingMs,
 })
 
+// #4571 — card/system-surface history lane. Every card the gateway posts
+// (activity card, status pin, approval/boot/issues/worker-feed cards, progress
+// lines, notices) goes through `robustApiCall`, so observing its RESOLVED
+// result is the one chokepoint that makes every posted message id resolvable
+// when the operator quote-replies to it. Never throws; see
+// system-message-observer.ts for the send-vs-edit and throttling contract.
+// Gated on the SAME condition as `initHistory` above — a non-main gateway
+// process never opens the DB, so an observer there would be pure noise.
+// The empty-body alarm (#4576) is the observer's own default — see
+// `defaultEmptyCardTextWarning` in system-message-observer.ts.
+const observeSentMessage = isGatewayMain && HISTORY_ENABLED
+  ? makeSystemMessageObserver({ insert: recordSystemOutbound, updateText: updateSystemOutboundText })
+  : undefined
+
 const robustApiCall = <T>(
   fn: () => Promise<T>,
   opts?: Parameters<typeof rawRobustApiCall<T>>[1],
-): Promise<T> => sendGate.gate(() => rawRobustApiCall(fn, opts), opts)
+): Promise<T> => {
+  const p = sendGate.gate(() => rawRobustApiCall(fn, opts), opts)
+  if (observeSentMessage == null) return p
+  return p.then((res) => { observeSentMessage(res, opts); return res })
+}
 
 // Fire-and-forget wrapper for outbound surfaces that previously had
 // `.catch(() => {})` directly on `bot.api.*` calls. Resolves to undefined
@@ -8384,7 +8408,7 @@ const statusPinRightsCache = new PinRightsCache()
 const STATUS_PIN_STORE_PATH = join(STATE_DIR, 'status-pins.json')
 const statusPinStoreFs = {
   readFileSync: (p: string) => readFileSync(p, 'utf8'),
-  writeFileSync: (p: string, d: string) => writeFileSync(p, d),
+  writeFileSync: (p: string, d: string) => writeStateFileSync(p, d),
   renameSync: (a: string, b: string) => renameSync(a, b),
   existsSync: (p: string) => existsSync(p),
 }
@@ -8400,7 +8424,7 @@ const statusPinPersistEnabled = !STATIC && PIN_STATUS_WHILE_WORKING
 const ACTIVITY_CARD_STORE_PATH = join(STATE_DIR, 'activity-cards-pending.json')
 const activityCardStoreFs: ActivityCardStoreFsSeam = {
   readFileSync: (p: string) => readFileSync(p, 'utf8'),
-  writeFileSync: (p: string, d: string) => writeFileSync(p, d),
+  writeFileSync: (p: string, d: string) => writeStateFileSync(p, d),
   renameSync: (a: string, b: string) => renameSync(a, b),
   existsSync: (p: string) => existsSync(p),
 }
@@ -8419,7 +8443,7 @@ const activityCardPersistEnabled = !STATIC
 const QUEUED_CARD_STORE_PATH = join(STATE_DIR, 'queued-cards-pending.json')
 const queuedCardStoreFs: QueuedCardStoreFsSeam = {
   readFileSync: (p: string) => readFileSync(p, 'utf8'),
-  writeFileSync: (p: string, d: string) => writeFileSync(p, d),
+  writeFileSync: (p: string, d: string) => writeStateFileSync(p, d),
   renameSync: (a: string, b: string) => renameSync(a, b),
   existsSync: (p: string) => existsSync(p),
 }
@@ -9054,7 +9078,7 @@ let stalePinSweepEligible = false
 const STALE_PIN_SWEEP_STORE_PATH = join(STATE_DIR, 'stale-pin-sweep.json')
 const sweepStoreFs = {
   readFileSync: (p: string) => readFileSync(p, 'utf-8'),
-  writeFileSync: (p: string, data: string) => atomicWriteFileSync(p, data, 0o600),
+  writeFileSync: (p: string, data: string) => atomicWriteStateFileSync(p, data, 0o600),
   existsSync: (p: string) => existsSync(p),
 }
 const stalePinSweeper: StalePinSweeper = createGatewayStalePinSweeper({
@@ -9152,7 +9176,7 @@ let workerActivityFeed: ReturnType<typeof createWorkerActivityFeed> | null = nul
 // ─── IPC server ───────────────────────────────────────────────────────────
 const SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join(STATE_DIR, 'gateway.sock')
 // Ensure the directory for the socket exists (#2996 P0c: gated — disk write).
-if (isGatewayMain) mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 })
+if (isGatewayMain) mkdirStateSync(STATE_DIR, { recursive: true, mode: 0o700 })
 
 // PID file + session marker. See pid-file.ts and session-marker.ts for
 // the 2026-04-22 incident that motivates these. The PID file lets the
@@ -9739,9 +9763,9 @@ if (isGatewayMain) inboundSpool = STATIC
   : createInboundSpool({
       path: join(STATE_DIR, 'inbound-spool.jsonl'),
       fs: {
-        appendFileSync: (p, d) => appendFileSync(p, d),
+        appendFileSync: (p, d) => appendStateFileSync(p, d),
         readFileSync: (p) => readFileSync(p, 'utf8'),
-        writeFileSync: (p, d) => writeFileSync(p, d),
+        writeFileSync: (p, d) => writeStateFileSync(p, d),
         renameSync: (a, b) => renameSync(a, b),
         existsSync: (p) => existsSync(p),
         statSizeSync: (p) => statSync(p).size,
@@ -12848,7 +12872,7 @@ async function publishToTelegraph(
     }
     account = created.value
     try {
-      mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 })
+      mkdirStateSync(STATE_DIR, { recursive: true, mode: 0o700 })
       writeFileSync(accountPath, JSON.stringify(account, null, 2), { mode: 0o600 })
     } catch (err) {
       process.stderr.write(`telegram gateway: telegraph cache write failed: ${(err as Error).message}\n`)
@@ -15048,13 +15072,18 @@ export async function handleInbound(
     replyToText,
     replyToTextEscaped,
     replyToRole,
+    replyToKind,
   } = resolveReplyToFromBuffer({
     replyToMessageId,
     replyToText: replyForwardCtx.replyToText,
     replyToTextEscaped: replyForwardCtx.replyToTextEscaped,
     historyEnabled: HISTORY_ENABLED,
     replyToTextMax: REPLY_TO_TEXT_MAX,
-    lookup: (messageId) => lookupMessageRoleAndText(chat_id, messageId),
+    // includeSystem (#4571): a quote-reply to the live activity card / a status
+    // pin / an approval card must resolve. Scoped to THIS lookup — the
+    // reaction-trigger's bot-authored predicate keeps the default (cards
+    // invisible), so its behaviour is unchanged.
+    lookup: (messageId) => lookupMessageRoleAndText(chat_id, messageId, { includeSystem: true }),
   })
 
   if (HISTORY_ENABLED) {
@@ -15132,6 +15161,7 @@ export async function handleInbound(
     replyToMessageId,
     replyToTextEscaped,
     replyToRole,
+    replyToKind,
     forwardOriginMeta,
     topicFramingEnabled: TOPIC_FRAMING_ENABLED,
     personDirectory: PERSON_DIRECTORY,
@@ -16061,7 +16091,7 @@ function spawnSwitchroomDetached(
   const logPath = join(STATE_DIR, 'detached-spawn.log')
   let outFd: number | null = null
   try {
-    mkdirSync(STATE_DIR, { recursive: true })
+    mkdirStateSync(STATE_DIR, { recursive: true })
     outFd = openSync(logPath, 'a')
     writeFileSync(logPath, `\n[${new Date().toISOString()}] spawn ${SWITCHROOM_CLI} ${fullArgs.join(' ')}\n`, { flag: 'a' })
   } catch {}
@@ -17577,9 +17607,9 @@ function buildFolderPickerDeps(): FolderPickerHandlerDeps {
 // existing on-disk lockouts age out via DEFAULT_FALLBACK_COOLDOWN_MS.
 const lockoutOps: LockoutPersistOps = {
   readFileSync: (p, enc) => readFileSync(p, enc),
-  writeFileSync: (p, data, opts) => writeFileSync(p, data, opts),
+  writeFileSync: (p, data, opts) => writeStateFileSync(p, data, opts),
   existsSync: (p) => existsSync(p),
-  mkdirSync: (p, opts) => mkdirSync(p, opts),
+  mkdirSync: (p, opts) => mkdirStateSync(p, opts),
   joinPath: (...parts) => join(...parts),
 }
 
@@ -22850,6 +22880,11 @@ async function initGatewayBot(): Promise<void> {
 
   bot = new Bot(TOKEN)
   installTgPostLogger(bot); installRichMarkdownGuard(bot) // #3252/#3463: universal fmt guard installed after logger (composes outermost); see installRichMarkdownGuard docblock
+  // #4576 follow-up: FALLBACK card body. The observer takes the stored body off
+  // the RESPONSE (`rich_message` → `text`/`caption`); this stamps the REQUEST body
+  // on the resolved Message for the shapes a response can't supply. After the fmt
+  // guard so it composes OUTSIDE it. See sent-text-capture.ts.
+  installSentTextCapture(bot)
   // #3620 flood fuse — installed LAST so it composes OUTERMOST: the one seam no
   // outbound call can bypass (grammY has no route to the network that skips the
   // transformer stack). Kill-switch SWITCHROOM_EDIT_FUSE=0; see edit-flood-fuse.ts.

package/telegram-plugin/gateway/inbound-router.ts

@@ -208,8 +208,14 @@ export interface ReplyToBufferFallbackParams {
   /** REPLY_TO_TEXT_MAX. */
   replyToTextMax: number
   /** `lookupMessageRoleAndText` bound to the chat, or any equivalent. May
-   *  throw (e.g. requireDb when history disabled mid-run) — this is caught. */
-  lookup: (messageId: number) => { role: 'user' | 'assistant'; text: string } | null
+   *  throw (e.g. requireDb when history disabled mid-run) — this is caught.
+   *
+   *  Bind it with `includeSystem: true` (#4571) so a reply that points at a
+   *  CARD — the activity card, a status pin, an approval card — resolves
+   *  instead of returning null. `kind` carries the card family. */
+  lookup: (
+    messageId: number,
+  ) => { role: 'user' | 'assistant' | 'system'; text: string; kind?: string | null } | null
 }
 
 /**
@@ -232,15 +238,22 @@ export interface ReplyToBufferFallbackParams {
 export function resolveReplyToFromBuffer(p: ReplyToBufferFallbackParams): {
   replyToText: string | undefined
   replyToTextEscaped: string | undefined
-  replyToRole: 'user' | 'assistant' | undefined
+  replyToRole: 'user' | 'assistant' | 'system' | undefined
+  /** Card family (`activity-summary`, `approval-card`, …) when the antecedent
+   *  is a system-lane row. Undefined otherwise. #4571. */
+  replyToKind: string | undefined
 } {
   let replyToText = p.replyToText
   let replyToTextEscaped = p.replyToTextEscaped
-  let replyToRole: 'user' | 'assistant' | undefined
+  let replyToRole: 'user' | 'assistant' | 'system' | undefined
+  let replyToKind: string | undefined
   const liveTextEmpty = replyToTextEscaped == null || replyToTextEscaped.length === 0
   if (p.historyEnabled && p.replyToMessageId != null && liveTextEmpty) {
     try {
       const recovered = p.lookup(p.replyToMessageId)
+      if (recovered != null && recovered.role === 'system' && recovered.kind) {
+        replyToKind = recovered.kind
+      }
       if (recovered && recovered.text.length > 0) {
         replyToText =
           recovered.text.length > p.replyToTextMax
@@ -258,7 +271,7 @@ export function resolveReplyToFromBuffer(p: ReplyToBufferFallbackParams): {
       // silently to the id-only inputs (current behavior).
     }
   }
-  return { replyToText, replyToTextEscaped, replyToRole }
+  return { replyToText, replyToTextEscaped, replyToRole, replyToKind }
 }
 
 /** Inputs for {@link buildInboundEnvelope} — every field is an at-call
@@ -288,7 +301,11 @@ export interface EnvelopeBuildParams {
    * message, 'user' = a person's), when known — recovered from the history
    * buffer by handleInbound's reply-to fallback. Undefined when the role
    * can't be determined (e.g. text came live off the update, not the DB). */
-  replyToRole: 'user' | 'assistant' | undefined
+  replyToRole: 'user' | 'assistant' | 'system' | undefined
+  /** #4571 — when the antecedent is a CARD the gateway posted (activity card,
+   * status pin, approval card…), the card family. Emitted as `reply_to_kind`
+   * alongside `reply_to_role="system"`. */
+  replyToKind?: string | undefined
   forwardOriginMeta: Record<string, string>
   /** TOPIC_FRAMING_ENABLED — fixed constant. */
   topicFramingEnabled: boolean
@@ -390,6 +407,14 @@ export function buildInboundEnvelope(p: EnvelopeBuildParams): InboundMessage {
       // guessing the antecedent. Free: the history-buffer lookup that recovers
       // reply_to_text already returns the role. Emitted only when known.
       ...(p.replyToRole != null ? { reply_to_role: p.replyToRole } : {}),
+      // #4571 — the antecedent is one of the bot's own CARDS, not a reply.
+      // `reply_to_role="system"` + `reply_to_kind="activity-summary"` tells the
+      // agent the operator tapped the live working card (the most recent thing
+      // on their screen for most of a turn) rather than an answer, so it can
+      // read `reply_to_text` as the card body instead of reporting amnesia.
+      ...(p.replyToKind != null && p.replyToKind.length > 0
+        ? { reply_to_kind: p.replyToKind }
+        : {}),
       // Forwarded-message origin (server-stamped, attrs-only — see above).
       // forwarded_from / forwarded_from_type / forwarded_from_id /
       // forwarded_date, plus numbered _2.. siblings for a multi-origin

package/telegram-plugin/gateway/missed-approvals-store.ts

@@ -31,7 +31,7 @@
 
 import { unlinkSync } from 'node:fs'
 import { join } from 'node:path'
-import { atomicWriteFileSync } from '../../src/util/atomic.js'
+import { atomicWriteStateFileSync } from '../../src/util/state-owner.js'
 import {
   preserveUnreadableStoreFile,
   quarantineCorruptStoreFile,
@@ -149,7 +149,7 @@ export function createMissedApprovalsStore(
         unreadable = false
       }
       // tmp + fsync + rename — never truncate the destination in place.
-      atomicWriteFileSync(filePath, JSON.stringify(f), 0o600)
+      atomicWriteStateFileSync(filePath, JSON.stringify(f), 0o600)
     } catch (err) {
       log(`telegram gateway: missed-approvals-store write failed: ${(err as Error).message}\n`)
     }

package/telegram-plugin/gateway/pending-card-store.ts

@@ -44,7 +44,7 @@
 
 import { unlinkSync } from 'node:fs'
 import { join } from 'node:path'
-import { atomicWriteFileSync } from '../../src/util/atomic.js'
+import { atomicWriteStateFileSync } from '../../src/util/state-owner.js'
 import {
   preserveUnreadableStoreFile,
   quarantineCorruptStoreFile,
@@ -162,7 +162,7 @@ export function createPendingCardStore(
       // tmp + fsync + rename, mode pinned to 0600 on the tempfile fd (so an
       // existing file can't keep laxer perms, and a crash mid-write leaves
       // the previous good file untouched).
-      atomicWriteFileSync(filePath, JSON.stringify(entries), 0o600)
+      atomicWriteStateFileSync(filePath, JSON.stringify(entries), 0o600)
     } catch (err) {
       log(`telegram gateway: pending-card-store write failed: ${(err as Error).message}\n`)
     }

package/telegram-plugin/gateway/privacy-state.ts

@@ -39,7 +39,7 @@ import { readFileSync, mkdirSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 
-import { atomicWriteFileSync } from '../../src/util/atomic.js'
+import { atomicWriteStateFileSync } from '../../src/util/state-owner.js'
 
 /** One half-open privacy interval. `end: null` = still open ("private now"). */
 export interface PrivacyInterval {
@@ -130,7 +130,7 @@ function writePrivacyState(state: PrivacyState, stateDir: string): void {
     /* dir may already exist / be unwritable — the write below reports */
   }
   try {
-    atomicWriteFileSync(privacyStatePath(stateDir), JSON.stringify(state), 0o600)
+    atomicWriteStateFileSync(privacyStatePath(stateDir), JSON.stringify(state), 0o600)
   } catch (err) {
     process.stderr.write(
       `telegram gateway: privacy-state write failed: ${err instanceof Error ? err.message : String(err)}\n`,

package/telegram-plugin/gateway/scoped-grant-store.ts

@@ -28,7 +28,7 @@
  */
 
 import { join } from 'node:path'
-import { atomicWriteFileSync } from '../../src/util/atomic.js'
+import { atomicWriteStateFileSync } from '../../src/util/state-owner.js'
 import {
   preserveUnreadableStoreFile,
   quarantineCorruptStoreFile,
@@ -105,7 +105,7 @@ export function createScopedGrantStore(
         }
         // tmp + fsync + rename — a crash mid-persist leaves the previous
         // grant set intact rather than a torn file that reads as "no grants".
-        atomicWriteFileSync(filePath, JSON.stringify(serializeScopedGrants(store)), 0o600)
+        atomicWriteStateFileSync(filePath, JSON.stringify(serializeScopedGrants(store)), 0o600)
       } catch (err) {
         log(`telegram gateway: scoped-grant-store write failed: ${(err as Error).message}\n`)
       }