2026-09-03 incident: a silently-failed pip install (Tsinghua mirror
transient) left the gateway WebSocket-only for 3.5 days while /health
stayed green. New gates:
- dep gate: verify venv imports (telegram, websockets) BEFORE restart;
abort without touching the service on failure, one reinstall attempt
Tsinghua -> PyPI (explicit package names; 'telegram' on PyPI is squat)
- channel check: post-restart journal must have no 'Unknown channel'
and 'Channels enabled:' must list every required channel, else
auto-rollback (also applied on rollback path)