talon-agent 5.18.2 → 5.19.1

package/src/frontend/native/bridge/server.ts

@@ -22,9 +22,14 @@ import {
 } from "node:http";
 import { createServer as createTlsServer } from "node:https";
 import { createHash, timingSafeEqual } from "node:crypto";
-import { createReadStream } from "node:fs";
+import { createReadStream, type ReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
-import { log, logError, logDebug } from "../../../util/log.js";
+import { log, logError, logDebug, logWarn } from "../../../util/log.js";
+import {
+  raiseAlert,
+  resolveAlert,
+} from "../../../core/frontend-runtime/alerts.js";
+import { errorText } from "../../health/outage.js";
 import {
   formatFingerprint,
   isLoopbackHost,
@@ -63,6 +68,14 @@ type StreamSession = {
 };
 
 const SSE_PING_MS = 25_000;
+/**
+ * Unsent bytes a stream may hold before it counts as dead. A client that
+ * stops reading without closing (phone asleep, network switch) otherwise
+ * buffers every broadcast in memory until TCP gives up on it, minutes later.
+ * Far past anything a live client falls behind by; evicted, it reconnects
+ * and gets a fresh `hello`.
+ */
+const SSE_MAX_BACKLOG_BYTES = 16 * 1024 * 1024;
 const MAX_BODY_BYTES = 256 * 1024;
 const PORT_FALLBACKS = 5;
 
@@ -94,6 +107,15 @@ export const DEFAULT_BRIDGE_TIMEOUTS: BridgeTimeouts = {
   checkIntervalMs: 30_000,
 };
 
+/**
+ * `pipe` never closes its source when the destination goes away, so a
+ * client that hangs up mid-download (app backgrounded, image scrolled
+ * away) would leave the paused read stream holding its fd forever.
+ */
+function releaseOnClose(res: ServerResponse, stream: ReadStream): void {
+  res.once("close", () => stream.destroy());
+}
+
 export class BridgeServer {
   private server: Server | null = null;
   /**
@@ -225,14 +247,14 @@ export class BridgeServer {
    *
    * Device commands are not public: their params carry one-time transfer
    * tokens, exec command lines, remote paths, and — on the chunked fallback —
-   * whole base64 file bodies. Broadcasting them handed every connected client
-   * another device's secrets and relied on each client discarding what wasn't
-   * addressed to it, which is courtesy, not enforcement.
+   * whole base64 file bodies. Broadcasting them would hand every connected
+   * client another device's secrets and rely on each client discarding what
+   * isn't addressed to it, which is courtesy, not enforcement.
    *
    * A claim is an ADDRESS, not a credential: any client holding the bridge
    * token could claim any id, and the bridge token is (still) the only trust
-   * boundary here. What this buys is that a device no longer passively
-   * receives traffic meant for its peers.
+   * boundary here. What this buys is that a device does not passively
+   * receive traffic meant for its peers.
    *
    * Clients that claimed nothing are the fallback audience, and only when the
    * target claimed nothing either: a companion build that predates the claim
@@ -265,12 +287,24 @@ export class BridgeServer {
 
   private write(targets: Iterable<ServerResponse>, event: BridgeEvent): void {
     const payload = `data: ${JSON.stringify(event)}\n\n`;
-    for (const res of targets) {
-      try {
-        res.write(payload);
-      } catch {
-        // Write on a half-closed socket — the 'close' handler will evict it.
-      }
+    for (const res of targets) this.send(res, payload);
+  }
+
+  /** Write one frame to a stream, evicting it if its backlog never drains. */
+  private send(res: ServerResponse, frame: string): void {
+    if (res.writableLength > SSE_MAX_BACKLOG_BYTES) {
+      this.clients.delete(res);
+      logWarn(
+        "native",
+        `Dropped an SSE client that stopped reading (${res.writableLength} bytes unsent)`,
+      );
+      res.destroy();
+      return;
+    }
+    try {
+      res.write(frame);
+    } catch {
+      // Write on a half-closed socket — the 'close' handler will evict it.
     }
   }
 
@@ -281,7 +315,7 @@ export class BridgeServer {
       loopback: isLoopbackHost(this.opts.host),
       allowWeakToken: this.opts.allowWeakToken,
     });
-    this.tlsIdentity = this.opts.tls ? await this.opts.tls() : null;
+    this.tlsIdentity = this.opts.tls ? await this.loadTls(this.opts.tls) : null;
     const onRequest = (req: IncomingMessage, res: ServerResponse): void => {
       this.handle(req, res).catch((err) => {
         logError("native", "Bridge request handler threw", err);
@@ -312,29 +346,70 @@ export class BridgeServer {
       : createServer(serverOpts, onRequest);
 
     this.pingTimer = setInterval(() => {
-      for (const res of this.clients.keys()) {
-        try {
-          res.write(": ping\n\n");
-        } catch {
-          /* evicted on close */
-        }
-      }
+      for (const res of this.clients.keys()) this.send(res, ": ping\n\n");
     }, SSE_PING_MS);
     this.pingTimer.unref?.();
     this.unsubscribeRevocations = this.opts.credentials?.authority.onRevoked(
       (ids) => this.dropCredentialSessions(ids),
     );
 
+    return this.bind(server);
+  }
+
+  /**
+   * The TLS identity, or a thrown boot failure the operator hears about:
+   * without it no companion app can connect.
+   */
+  private async loadTls(
+    load: () => Promise<BridgeTlsIdentity>,
+  ): Promise<BridgeTlsIdentity> {
+    try {
+      const identity = await load();
+      resolveAlert(
+        "bridge.tls",
+        "The client bridge TLS certificate loads again.",
+      );
+      return identity;
+    } catch (err) {
+      logError("native", `bridge.tls.fail err=${errorText(err)}`, err);
+      raiseAlert(
+        "bridge.tls",
+        `The client bridge could not load its TLS certificate: ${errorText(err)}. Companion apps cannot connect.`,
+        { severity: "critical" },
+      );
+      throw err;
+    }
+  }
+
+  /**
+   * Listen on the configured port, stepping up to PORT_FALLBACKS ports past
+   * it when one is taken. A bind that fails for good raises `bridge.listen`
+   * — the frontend has no surface at all without it.
+   */
+  private bind(server: Server): Promise<number> {
     return new Promise<number>((resolve, reject) => {
       let attempt = 0;
       const tryPort = (p: number): void => {
         server.once("error", (err: NodeJS.ErrnoException) => {
           if (err.code === "EADDRINUSE" && attempt < PORT_FALLBACKS) {
             attempt++;
+            logWarn(
+              "native",
+              `bridge.listen port=${p} in use — trying port=${p + 1} attempt=${attempt}/${PORT_FALLBACKS}`,
+            );
             server.removeAllListeners("error");
             server.removeAllListeners("listening");
             tryPort(p + 1);
           } else {
+            logError(
+              "native",
+              `bridge.listen.fail host=${this.opts.host} port=${p} attempt=${attempt} err=${errorText(err)}`,
+            );
+            raiseAlert(
+              "bridge.listen",
+              `The client bridge could not listen on ${this.opts.host}:${p}: ${errorText(err)}. Companion apps cannot connect.`,
+              { severity: "critical" },
+            );
             reject(err);
           }
         });
@@ -362,6 +437,10 @@ export class BridgeServer {
               `Bridge certificate fingerprint ${formatFingerprint(this.tlsIdentity.fingerprint)}`,
             );
           }
+          resolveAlert(
+            "bridge.listen",
+            "The client bridge is listening again.",
+          );
           resolve(this.port);
         });
       };
@@ -507,6 +586,7 @@ export class BridgeServer {
     });
     const stream = createReadStream(file.path);
     stream.on("error", () => res.destroy());
+    releaseOnClose(res, stream);
     stream.pipe(res);
   }
 
@@ -532,6 +612,7 @@ export class BridgeServer {
         if (!res.headersSent) res.writeHead(500);
         res.end();
       });
+      releaseOnClose(res, stream);
       stream.pipe(res);
     } catch {
       return this.json(res, 404, { ok: false, error: "No such media" });
@@ -599,6 +680,10 @@ export class BridgeServer {
     const ms = Math.round(max * (0.9 + Math.random() * 0.2));
     const timer = setTimeout(() => {
       logDebug("native", "bridge.sse event=max_lifetime reason=expired");
+      // Out of the fan-out before end(): a stream still flushing a backlog
+      // stays open until it drains, and a broadcast in that window is a
+      // write after end — an unhandled 'error' that takes the daemon down.
+      this.clients.delete(res);
       res.end();
     }, ms);
     timer.unref?.();

package/src/frontend/native/index.ts

@@ -191,7 +191,7 @@ export function createNativeFrontend(
       await mesh.load();
       unregisterMeshTransport = registerMeshTransport(runtime, server);
       // Mesh tool actions (list_devices / get_device_location) are shared
-      // gateway actions now — no native-only cases here.
+      // gateway actions — no native-only cases here.
       gateway.registerFrontendHandler(
         "native",
         createNativeActionHandler({

package/src/frontend/native/media/media.ts

@@ -20,13 +20,17 @@ import type { NativeRuntime } from "../runtime.js";
  */
 export const MAX_UPLOAD_BYTES = 512 * 1024 * 1024;
 
-/** Register a file for serving and return its short media id. */
+/** Register a file for serving and return its short media id (stable per
+ *  path for the life of the daemon). */
 export function registerMedia(
   runtime: NativeRuntime,
   filePath: string,
 ): string {
+  const known = runtime.mediaIds.get(filePath);
+  if (known) return known;
   const id = `m${runtime.nextId().toString(36)}`;
   runtime.media.set(id, filePath);
+  runtime.mediaIds.set(filePath, id);
   return id;
 }
 

package/src/frontend/native/runtime.ts

@@ -1,11 +1,9 @@
 /**
- * Native frontend runtime — the state every bridge module shares.
- *
- * `createNativeFrontend` used to hold all of this as closure variables with
- * every handler nested inside it. It is now one explicit object, constructed
- * once, that each module (chat-wire, context, emit, turn, …) takes as its
- * first parameter. The runtime carries state plus two primitives — the
- * message-id minter and the broadcast sink; the modules own the behaviour.
+ * Native frontend runtime — the state every bridge module shares: one
+ * object, constructed once, that each module (chat-wire, context, emit,
+ * turn, …) takes as its first parameter. It carries state plus two
+ * primitives — the message-id minter and the broadcast sink; the modules
+ * own the behaviour.
  */
 
 import type { TalonConfig } from "../../core/config/index.js";
@@ -55,6 +53,12 @@ export type NativeRuntime = {
    * frontends behave).
    */
   readonly media: Map<string, string>;
+  /**
+   * `media` reversed (path → id). Every history page re-registers its
+   * attachments, so without this each fetch — and every client reconnect
+   * re-fetches — grew `media` by one entry per attachment, forever.
+   */
+  readonly mediaIds: Map<string, string>;
   /**
    * Uploads this daemon run has accepted, keyed by their media id. `/send`
    * resolves a client's attachment references through here rather than
@@ -110,6 +114,7 @@ export function createNativeRuntime(
     chats: new NativeChats(),
     mesh: getMeshService(),
     media: new Map(),
+    mediaIds: new Map(),
     uploads: new Map(),
     contextByChat: new Map(),
     liveTurns: new Map(),

package/src/frontend/native/surface/handlers.ts

@@ -79,7 +79,7 @@ function resolveAttachments(
     }
   }
   // A dropped reference is how "I attached a file and the agent never saw it"
-  // happens, and it used to be entirely silent. The usual cause is a media id
+  // happens, so it must not be silent. The usual cause is a media id
   // minted by a previous daemon run — `runtime.uploads` is per-run, so a
   // client that staged a file before a restart and sent it after points at
   // nothing.

package/src/frontend/native/surface/memory.ts

@@ -5,7 +5,7 @@
  *
  * Read-only on purpose: a bridge client can ask what Talon remembers and
  * why, and nothing more. Asserting, superseding and dropping stay with
- * the write path (rollout PR 6), so a paired phone can never quietly
+ * the write path, so a paired phone can never quietly
  * rewrite the operator's memory.
  *
  * The one piece of policy here is the limit cap: whatever a client asks

package/src/frontend/native/surface/models.ts

@@ -35,9 +35,9 @@ export async function listModels(
 ): Promise<{ active: string; models: ModelOption[] }> {
   const { config } = runtime;
   // Resolve the chat's *own* backend so the model list tracks whatever
-  // backend the chat is currently bound to (fixes the list staying on the
-  // previous backend's models after a switch). Fall back to the global
-  // default backend when there's no chat / the pool isn't ready yet.
+  // backend the chat is currently bound to, not the one before a switch.
+  // Fall back to the global default backend when there's no chat / the
+  // pool isn't ready yet.
   let backendId: string = config.backend;
   let active = config.model;
   if (chatId) {

package/src/frontend/native/surface/settings.ts

@@ -186,19 +186,31 @@ export function applyConfigUpdate(
  * Merge a partial update into talon.json on disk, preserving everything
  * else. Shared by every bridge surface that persists config changes
  * (settings sync here, plugin toggles in extensions.ts).
+ *
+ * An existing file that can't be read or isn't a JSON object throws and
+ * is left untouched: merging into `{}` would replace the operator's whole
+ * config (tokens included) with just this patch.
  */
 export function persistConfigPatch(update: Record<string, unknown>): void {
   const file = pathFiles.config;
   let current: Record<string, unknown> = {};
-  try {
-    if (existsSync(file)) {
-      current = JSON.parse(readFileSync(file, "utf-8")) as Record<
-        string,
-        unknown
-      >;
+  if (existsSync(file)) {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(readFileSync(file, "utf-8"));
+    } catch (err) {
+      throw new Error(
+        `Refusing to write ${file}: cannot read the existing file ` +
+          `(${err instanceof Error ? err.message : err}). It was left untouched.`,
+      );
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(
+        `Refusing to write ${file}: the top level is not a JSON object. ` +
+          `It was left untouched.`,
+      );
     }
-  } catch {
-    /* corrupt/absent — start from empty */
+    current = parsed as Record<string, unknown>;
   }
   for (const [k, v] of Object.entries(update)) {
     if (v === undefined) delete current[k];

package/src/frontend/native/turn/context.ts

@@ -88,14 +88,12 @@ export async function refreshContext(
 /**
  * Fill the context cache for chats restored at startup.
  *
- * The readout is served from an in-memory map that was only ever written at
- * turn end, so after a restart every existing chat reported no context at
- * all — the header chip vanished until that chat ran another turn, which
- * read as "context usage doesn't save". The numbers themselves are
- * persisted with the session; only the cache was cold. This re-reads them
- * for the most recently active chats (bounded, and on the cheap path that
- * never touches the backend pool); anything it skips or can't resolve is
- * filled in the moment the chat is opened.
+ * The readout is served from an in-memory map otherwise written only at
+ * turn end, so after a restart every chat would show no context until its
+ * next turn, though the numbers are persisted with the session. This
+ * re-reads them for the most recently active chats (bounded, and on the
+ * cheap path that never touches the backend pool); anything it skips or
+ * can't resolve is filled in the moment the chat is opened.
  */
 const CONTEXT_WARM_LIMIT = 40;
 

package/src/frontend/native/turn/turn-meta.ts

@@ -2,11 +2,8 @@
  * Turn-meta sidecar — thin native-frontend façade over the shared
  * storage/turn-meta store. It owns the TurnMeta *shape* (tool calls,
  * duration, token usage — the companion app's tool timeline and stats
- * footer); the storage layer treats each record as opaque JSON.
- *
- * The data used to live in a debounced JSON file under the data dir;
- * it now rides the `turn_meta` SQLite table shared by every frontend.
- * SQLite commits on every write, so the old flush timer is gone.
+ * footer); the storage layer treats each record as opaque JSON in the
+ * `turn_meta` SQLite table shared by every frontend.
  */
 
 import {

package/src/frontend/native/turn/turn.ts

@@ -102,10 +102,8 @@ export function liveTurnEvents(runtime: NativeRuntime): BridgeEvent[] {
 
 /**
  * Safety net: any tool the backend announced but never resolved (a crash can
- * eat a tool_result; callback backends historically never emitted one —
- * handler-to-events now pairs each tool_call with an immediate synthetic
- * result) gets a synthetic result at turn end — a spinner the app opened on
- * phase:"call" must always see a phase:"result".
+ * eat a tool_result) gets a synthetic result at turn end — a spinner the app
+ * opened on phase:"call" must always see a phase:"result".
  */
 function flushOpenTools(
   runtime: NativeRuntime,
@@ -312,14 +310,14 @@ async function runTurn(
     // clients. Any late tool spinner has already been flushed above.
     runtime.liveTurns.delete(entry.id);
     // Flush a queued follow-up as a fresh turn: "once it's done it will
-    // send". Deferred so we don't re-enter runTurn inside its own finally.
+    // send". Started synchronously so the chat never looks idle in between —
+    // a /send landing in a deferred gap would start its own turn and run
+    // ahead of the message that was queued first.
     const queued = takeQueued(runtime, entry);
     if (queued) {
-      setImmediate(() =>
-        startTurn(runtime, entry, queued.text, {
-          attachments: queued.attachments,
-        }),
-      );
+      startTurn(runtime, entry, queued.text, {
+        attachments: queued.attachments,
+      });
     }
   }
 }

package/src/frontend/presentation/format.ts

@@ -1,10 +1,8 @@
 /**
  * Frontend-agnostic display formatters shared by all chat frontends.
  *
- * These were previously duplicated per-frontend (the old
- * telegram/helpers/format.ts, discord/helpers.ts) and had started to drift —
- * parseInterval accepted days on Discord but not Telegram. One definition
- * here keeps them in lockstep; frontends import this module directly.
+ * One definition here keeps the frontends in lockstep — per-frontend copies
+ * drift (parseInterval once accepted days on Discord but not Telegram).
  */
 
 import { resolveModel } from "../../core/models/catalog.js";

package/src/frontend/presentation/session-status.ts

@@ -1,12 +1,8 @@
 /**
  * Shared /reset and /status logic for chat frontends.
  *
- * Telegram and Discord previously each carried a full copy of the session
- * reset sequence and the /status data-gathering pipeline, and the copies had
- * drifted (Discord's /status no longer re-fetched the context window for the
- * model that actually served the session). All the frontend-agnostic work
- * lives here now; frontends only render `SessionStatusData` in their native
- * markup.
+ * All the frontend-agnostic work lives here so per-frontend copies can't
+ * drift; frontends only render `SessionStatusData` in their native markup.
  */
 
 import type { TalonConfig } from "../../core/config/index.js";

package/src/frontend/teams/actions.ts

@@ -7,6 +7,9 @@ import type { Gateway } from "../../core/engine/gateway.js";
 import { buildAdaptiveCard, splitTeamsMessage } from "./formatting.js";
 import { log, logError } from "../../util/log.js";
 import { proxyFetch } from "./proxy-fetch.js";
+import { createDeliveryTracker, trackDeliveries } from "../health/delivery.js";
+
+const delivery = createDeliveryTracker("teams", "Teams", "teams");
 
 /**
  * POST an Adaptive Card to the Power Automate workflow webhook URL.
@@ -32,7 +35,10 @@ export function createTeamsActionHandler(
   webhookUrl: string,
   gateway: Gateway,
 ): FrontendActionHandler {
-  return async (body, chatId): Promise<ActionResult | null> => {
+  const dispatch: FrontendActionHandler = async (
+    body,
+    chatId,
+  ): Promise<ActionResult | null> => {
     const action = body.action as string;
 
     switch (action) {
@@ -100,6 +106,7 @@ export function createTeamsActionHandler(
         return null;
     }
   };
+  return trackDeliveries(delivery, dispatch);
 }
 
 export { postToTeams };

package/src/frontend/teams/graph.ts

@@ -302,7 +302,6 @@ export class GraphClient {
  * Initialize the Graph client — loads stored tokens or runs device code flow.
  */
 export async function initGraphClient(): Promise<GraphClient> {
-  // Clear old tokens that used channel scopes
   const stored = loadTokens();
 
   if (stored && stored.refreshToken) {

package/src/frontend/teams/index.ts

@@ -76,9 +76,7 @@ export function createTeamsFrontend(
       const graphClient = await initGraphClient();
       runtime.graphClient = graphClient;
 
-      // Get our own user ID (to filter out our own messages)
       const me = await graphClient.getMe();
-      runtime.myUserId = me.id;
       log("teams", `Authenticated as: ${me.displayName} (${me.id})`);
 
       const chatId = await resolveChatId(runtime, graphClient, me.id);
@@ -99,8 +97,7 @@ export function createTeamsFrontend(
 
       // The receive side is a timer on the runtime, not a loop to sit in:
       // once the first poll is done the frontend is listening, and
-      // start() is finished. (It used to park on a promise that never
-      // resolved, which made the boot end at shutdown.)
+      // start() is finished.
       await startPolling(runtime, chatId);
     },
 

package/src/frontend/teams/poll.ts

@@ -6,6 +6,7 @@
  */
 
 import { log, logError } from "../../util/log.js";
+import { errorText } from "../health/outage.js";
 import { handleSlashCommand } from "./commands.js";
 import type { ChatMessage } from "./graph.js";
 import type { TeamsRuntime } from "./runtime.js";
@@ -51,13 +52,47 @@ async function handleMessage(
   runTurn(runtime, msg, talonChatId);
 }
 
+/**
+ * Fetch the newest messages, feeding the poll outage: failures are logged
+ * with their attempt number and time down, and the first success after
+ * them logs the recovery. Returns null when the fetch failed.
+ */
+async function fetchMessages(
+  runtime: TeamsRuntime,
+  graph: NonNullable<TeamsRuntime["graphClient"]>,
+  chatId: string,
+): Promise<ChatMessage[] | null> {
+  let messages: ChatMessage[];
+  try {
+    messages = await graph.getChatMessages(chatId, 20);
+  } catch (err) {
+    const { attempt, downMs } = runtime.pollOutage.fail(err);
+    logError(
+      "teams",
+      `Poll error: poll.fail chat=${chatId} attempt=${attempt} down_ms=${downMs} ` +
+        `next_poll_ms=${runtime.pollIntervalMs} err=${errorText(err)}`,
+    );
+    return null;
+  }
+  const ended = runtime.pollOutage.ok();
+  if (ended) {
+    log(
+      "teams",
+      `poll.recovered chat=${chatId} failed_attempts=${ended.attempts} down_ms=${ended.downMs}`,
+    );
+  }
+  return messages;
+}
+
 async function poll(runtime: TeamsRuntime, chatId: string): Promise<void> {
   if (runtime.polling) return;
   runtime.polling = true;
+  let current: ChatMessage | null = null;
 
   try {
     if (!runtime.graphClient) return;
-    const messages = await runtime.graphClient.getChatMessages(chatId, 20);
+    const messages = await fetchMessages(runtime, runtime.graphClient, chatId);
+    if (!messages) return;
     const newMessages = selectNewMessages(messages, runtime.lastSeenMessageId);
 
     if (newMessages.length > 0) {
@@ -69,12 +104,14 @@ async function poll(runtime: TeamsRuntime, chatId: string): Promise<void> {
       if (!msg.text.trim()) continue;
       if (msg.edited) continue;
       if (isBotEcho(runtime, msg)) continue;
+      current = msg;
       await handleMessage(runtime, msg);
     }
   } catch (err) {
     logError(
       "teams",
-      `Poll error: ${err instanceof Error ? err.message : err}`,
+      `Poll error: message=${current?.id ?? "?"} chat=${current?.chatId ?? chatId} ` +
+        `${err instanceof Error ? err.message : err}`,
     );
   } finally {
     runtime.polling = false;
@@ -94,6 +131,7 @@ export async function startPolling(
 }
 
 export function stopPolling(runtime: TeamsRuntime): void {
+  runtime.pollOutage.dispose();
   if (runtime.pollTimer) {
     clearInterval(runtime.pollTimer);
     runtime.pollTimer = null;

package/src/frontend/teams/runtime.ts

@@ -1,15 +1,17 @@
 /**
  * Teams frontend runtime — the state every module shares.
  *
- * `createTeamsFrontend` used to hold all of this as closure variables, with
- * the poll loop and the slash commands nested inside `.start`. It is now one
- * explicit object, constructed once, that each module (chat-discovery,
+ * One explicit object, constructed once, that each module (chat-discovery,
  * poll, commands, turn, outbound) takes as its first parameter.
  */
 
 import type { TalonConfig } from "../../core/config/index.js";
 import type { Gateway } from "../../core/engine/gateway.js";
 import type { GraphClient } from "./graph.js";
+import { createOutage, type Outage } from "../health/outage.js";
+
+/** Graph polling must fail this long before `teams.poll` is raised. */
+const POLL_OUTAGE_MS = 10 * 60_000;
 
 export type TeamsRuntime = {
   readonly config: TalonConfig;
@@ -25,9 +27,10 @@ export type TeamsRuntime = {
   pollTimer: ReturnType<typeof setInterval> | null;
   /** Newest message id already handled — the poll loop cuts at it. */
   lastSeenMessageId: string | null;
-  myUserId: string | null;
   /** Re-entrancy guard: a slow poll never overlaps the next tick. */
   polling: boolean;
+  /** Failed Graph fetches, and the `teams.poll` alert they raise. */
+  readonly pollOutage: Outage;
 };
 
 export function createTeamsRuntime(
@@ -45,7 +48,13 @@ export function createTeamsRuntime(
     graphClient: null,
     pollTimer: null,
     lastSeenMessageId: null,
-    myUserId: null,
     polling: false,
+    pollOutage: createOutage({
+      key: "teams.poll",
+      thresholdMs: POLL_OUTAGE_MS,
+      describe: (err, mins) =>
+        `Teams polling has failed for ${mins} min: ${err}. Messages are not being received.`,
+      recovered: "Teams polling is working again.",
+    }),
   };
 }