diff --git a/sac-client.sh b/sac-client.sh
index 3da83e3..e4c163f 100644
--- a/sac-client.sh
+++ b/sac-client.sh
@@ -333,6 +333,27 @@ sac_is_heartbeat_only_event() {
  [ "${1:-}" = "agent.heartbeat" ]
 }
 
+# Добавляет generated_by / telegram_via в JSON details для ingest.
+sac_merge_notify_details() {
+ local details_json="${1:-}"
+ local telegram_via="${2:-}"
+ DETAILS_IN="$details_json" TG_VIA="$telegram_via" python3 <<'PY'
+import json, os
+d = {}
+raw = os.environ.get("DETAILS_IN", "").strip()
+if raw:
+ try:
+  d = json.loads(raw)
+ except Exception:
+  d = {}
+d.setdefault("generated_by", "agent")
+via = os.environ.get("TG_VIA", "").strip()
+if via:
+ d.setdefault("telegram_via", via)
+print(json.dumps(d, ensure_ascii=False))
+PY
+}
+
 # notify_or_sac type severity title summary telegram_message [details_json]
 notify_or_sac() {
  local event_type="$1"
@@ -347,6 +368,14 @@ notify_or_sac() {
  unset SAC_D_USER SAC_D_IP SAC_D_COMMAND SAC_D_ATTEMPT SAC_D_MAX SAC_D_RUN_AS SAC_D_PWD 2>/dev/null || true
  local mode
  mode="$(sac_normalize_mode "${UseSAC:-off}")"
+ local tg_via=""
+ case "$mode" in
+ exclusive|fallback) tg_via="sac" ;;
+ dual) tg_via="agent" ;;
+ esac
+ if [ -n "$tg_via" ]; then
+  details_json="$(sac_merge_notify_details "$details_json" "$tg_via")"
+ fi
 
  # Периодический heartbeat — только SAC (браузер), без Telegram/email в любом режиме.
  if sac_is_heartbeat_only_event "$event_type"; then
diff --git a/ssh-monitor b/ssh-monitor
index 8f50d6a..cb54578 100644
--- a/ssh-monitor
+++ b/ssh-monitor
@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="1.2.11-SAC"
+SSH_MONITOR_VERSION="1.2.12-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then
@@ -1963,7 +1963,9 @@ send_startup_notification() {
  message="${message}❤️ Heartbeat будет отправляться каждые 12 часов"$'\n'
  message="${message}📢 Каналы уведомлений (все по списку): $(notify_chain_human)"
 
- notify_or_sac "agent.lifecycle" "info" "Мониторинг запущен" "ssh-monitor started" "$message"
+ local lifecycle_details
+ lifecycle_details='{"lifecycle":"started","trigger":"boot"}'
+ notify_or_sac "agent.lifecycle" "info" "Мониторинг запущен" "ssh-monitor started" "$message" "$lifecycle_details"
  write_log "Скрипт мониторинга запущен (белый список: $whitelist_count записей)"
 }
 
@@ -1976,7 +1978,7 @@ send_shutdown_notification() {
  local message=" ⚠️ СКРИПТ МОНИТОРИНГА ОСТАНОВЛЕН "$'\n'
  message="${message}🕐 Время остановки: ${timestamp}"
 
- notify_or_sac "agent.lifecycle" "warning" "Мониторинг остановлен" "ssh-monitor stopped" "$message"
+ notify_or_sac "agent.lifecycle" "info" "Мониторинг остановлен" "ssh-monitor stopped" "$message" '{"lifecycle":"stopped","trigger":"shutdown"}'
  write_log "Скрипт мониторинга остановлен"
 }
 
diff --git a/version.txt b/version.txt
index 766bd5a..4676e97 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.2.11-SAC

+1.2.12-SAC