- Drop SEED_OPERATOR_TELEGRAM_ID (legacy from the Telegram era).
- Add SEED_OPERATOR_USERNAME + a comment pointing to
scripts/set-password.sh as the bootstrap path.
- Add OPERATOR_TOKEN_VERSION as the documented kill switch for the
AES-GCM session cookie.
- Document AUTH_SECRET more explicitly: refuse to leave blank, and
point at scripts/gen_auth_secret.sh as the generator.
- Add the bot fan-out tuning trio that's been in env.ts but not in
the example: BOT_FIRE_CONCURRENCY / BOT_GROUP_CONCURRENCY /
BOT_MAX_SEND_PER_MINUTE with the same comments as the schema.
- Add a Docker Registry section for scripts/publish.sh:
DOCKER_IMAGE_TAG and CM_IMAGE_PLATFORMS, mirroring the
cm_bot_v2 .env.example shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Local dev WEB_PORT now 9000 to match the planned dev/staging domain
test.04080616.xyz. Production deployment uses port 8100 mapped to
rexwa.04080616.xyz (configured in plan 4).
- apps/bot/tsconfig.json: exclude src/**/*.test.ts from the production
build (vitest types only present at dev time, mirrors the same fix we
made earlier for packages/shared).
