@inetafrica/open-claudia 3.0.42 → 3.0.44

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v3.0.44 — Safety refusals explain themselves, and one refusal no longer poisons every turn after it
+
+- **A Claude safety refusal now tells you why instead of dumping a raw API error.** When the model declines a request (`stop_reason: "refusal"`), the API attaches a category and sometimes an explanation — but all you saw was "API Error … appears to violate our Usage Policy" with a request id buried inside. The refusal is now detected structurally from the stream (`stop_details` category/explanation, with a text-parse fallback when the CLI flattens it into the error string) and surfaced as a clear ⛔ diagnostic: the reason, the request ID (for support), and your options (/new, rephrase, /model or /backend).
+- **One refusal no longer bricks the whole conversation.** The safety classifier scores the *entire* conversation, so resuming a session whose context tripped it re-sent the flagged material and refused again — every turn, even for innocent new messages; the only escape was knowing to type /new. Now the poisoned session is **quarantined** the moment a resumed turn is refused: its id is recorded in user state (bounded to 20, survives restarts), the stale active pointer is healed, and nothing resumes it again — the natural next turn and even an explicit `/continue <id>` are forced fresh. Session ids the CLI rotates mid-run are quarantined too.
+- **Your refused message is retried for you, once, in a fresh session.** After quarantining, the same prompt is automatically replayed in a brand-new session — you see "♻️ That refusal came from flagged context in the old session — quarantined it, retrying your message in a fresh one" and then the actual answer, so you keep working without re-typing anything. Strictly one-shot: if the fresh run is also refused, the new message itself is the problem and you get the full diagnostic with no retry loop; capture/background runs never auto-retry.
+- **Agent-space / OpenClaw:** no new deps, env, or schema change (a `quarantinedSessions` map is added to per-user state; old state files load cleanly); Docker image builds FROM the existing `:base`. Changes span `core/providers/events.js`/`claude-events.js` (detection), `core/state.js` (quarantine bookkeeping), `core/run-context.js` (resume guard), `core/runner.js` (diagnostic + one-shot retry); covered by new `test-provider-refusal-recovery.js`, a fake-agent `refusal` scenario, and runner e2e cases. Existing pods pick it up on their next approved upgrade.
+
+## v3.0.43 — Telegram stops rebooting into a dead network: outages now pause-and-wait instead of restart-storming
+
+- **A host-wide network blip no longer triggers a reboot storm.** v3.0.42 fixed the *in-loop* poll wedge (a poisoned reused poller) so it heals in place — but it still kept the 10-minute `process.exit(1)` backstop, which fired even when the *entire host* had lost the network (a laptop sleep/wake, or pod egress starvation where Telegram poll+send, Kazee WS and Spaces WS all drop together). Exiting into a dead network just relaunched straight back into the same outage, so you'd see "Back online and ready! Running v3.0.42" every ~14 minutes, busting the prompt cache and spamming the chat. Now the self-exit is **reachability-gated**: before it ever restarts the process it runs a fresh, connection-fresh HEAD probe to `api.telegram.org`, and only exits if that probe genuinely **succeeds** — proving the API is reachable and it's a real in-process wedge worth a clean restart, not the host being offline.
+- **When the host is actually offline, the bot now pauses and waits instead of hammering.** On a confirmed-unreachable probe the adapter enters an *outage pause*: it **stops polling entirely** (so `node-telegram-bot-api` no longer respins `getUpdates` every ~300ms into a dead socket — the "not waiting between reconnects" hammering) and re-probes on a calm **30-second** cadence. The instant connectivity returns it resumes polling cleanly from a fresh poller (the update offset is preserved, so nothing is refetched or skipped) — no process restart, no "Back online" spam. The pause also suspends the health watchdog and hiccup handler so they don't fight the slow re-probe. Poll-health transitions are now timestamped for easier post-mortem.
+- **Agent-space / OpenClaw:** no new deps, env, or schema change; Docker image builds FROM the existing `:base`. Change is confined to `channels/telegram/adapter.js` (the `_heal` backstop plus the new `_enterOutagePause`/`_armHealthyCheck` paths); covered by new cases in `test-telegram-poll-recovery.js` (the gated exit defers on a live host, pauses instead of rebooting on a dead one, and resumes when the network returns). Existing pods pick it up on their next approved upgrade.
+
 ## v3.0.42 — Telegram stops rebooting itself: the long-poll wedge now heals in place
 
 - **The bot no longer restarts the whole process to recover from a stuck Telegram long-poll.** When the network stalls a poll mid-flight (a half-open socket after a laptop sleep/wake, or a NAT/IPv6 connection eviction), `node-telegram-bot-api` was left holding one reused internal poller whose abort flag got stuck "on". Restarting polling *in place* revived that same poisoned object, which fired a single `getUpdates` and then silently refused to schedule the next one — a dead loop that threw no error, so the heal looked like it "worked" while nothing was actually polling. The only thing that ever truly recovered was the 10-minute backstop calling `process.exit(1)` and letting the supervisor relaunch — i.e. the reboot storm you'd see. The heal now **discards the poisoned poller so a fresh one is built** (the update offset is preserved, so no messages are refetched or skipped), and it only declares polling "healthy again" once a `getUpdates` has genuinely **completed since the restart** — otherwise it re-arms another heal instead of blindly declaring victory. Net effect: transient poll wedges recover in seconds without a process restart; the 10-min self-exit becomes the rare true-last-resort it was meant to be.

package/channels/telegram/adapter.js

@@ -44,6 +44,8 @@ class TelegramAdapter {
     this._deferredExitLogAt = 0; // throttle the "deferring restart, turn in progress" log (1/min)
     this._lastHiccupLog = 0;     // throttle the transient-error log (1/min)
     this._healBackoff = 0;       // grows per consecutive heal, capped
+    this._pausedForOutage = false; // host-network outage: poll loop stopped, slow re-probe owns recovery
+    this._outageProbeTimer = null; // the ~30s re-probe loop that runs while paused
     this._pollWatchdogTimer = null; // detects a silent first/active getUpdates stall
     this._pollStartedAt = 0;
     this._conflictSince = 0;         // start of the current 409 streak
@@ -83,6 +85,7 @@ class TelegramAdapter {
   }
 
   _checkPollingHealth() {
+    if (this._pausedForOutage) return; // outage pause runs its own slow re-probe
     if (this._conflictTimer || this._conflictSince) return; // 409 backoff owns recovery
     const lastCompletedPoll = this.bot?._polling?._lastUpdate || this._pollStartedAt;
     if (!lastCompletedPoll || Date.now() - lastCompletedPoll <= 75000) return;
@@ -95,6 +98,8 @@ class TelegramAdapter {
     if (this._healthyTimer) { clearTimeout(this._healthyTimer); this._healthyTimer = null; }
     if (this._conflictTimer) { clearTimeout(this._conflictTimer); this._conflictTimer = null; }
     if (this._conflictClearTimer) { clearTimeout(this._conflictClearTimer); this._conflictClearTimer = null; }
+    if (this._outageProbeTimer) { clearTimeout(this._outageProbeTimer); this._outageProbeTimer = null; }
+    this._pausedForOutage = false;
     try { await this._stopPollingClean("adapter stop"); } catch (e) {}
   }
 
@@ -107,6 +112,7 @@ class TelegramAdapter {
   // old exit-for-relaunch *was* the restart the bot kept doing on every idle
   // timeout (a sleep/wake burst could exhaust all 6 attempts in seconds).
   _onPollingHiccup(msg) {
+    if (this._pausedForOutage) return; // paused for a host outage; the slow re-probe owns recovery
     // During a 409 streak the conflict handler owns the poll lifecycle; a heal
     // here would startPolling straight back into the conflict and its errors
     // would keep _wedgedSince pinned until the 10-min backstop killed us (the
@@ -116,7 +122,7 @@ class TelegramAdapter {
     if (!this._wedgedSince) this._wedgedSince = now;
     if (now - this._lastHiccupLog > 60000) {
       this._lastHiccupLog = now;
-      console.log(`Polling hiccup (${msg}) — retrying on a fresh connection.`);
+      console.log(`${this._stamp()} Polling hiccup (${msg}) — retrying on a fresh connection.`);
     }
     if (this._healTimer) return; // a heal is already scheduled; let it run
     this._healBackoff = Math.min(this._healBackoff + 1, 5);
@@ -148,31 +154,74 @@ class TelegramAdapter {
     catch (e) { return false; }
   }
 
+  _stamp() {
+    return new Date().toISOString();
+  }
+
+  // Can this HOST reach Telegram AT ALL right now? A one-shot HEAD-ish probe on
+  // a brand-new connection (agent:false so it never rides our possibly-wedged
+  // poll agent), bounded so the probe itself can't hang. Any HTTP response —
+  // even a 404 — proves the TCP+TLS path is alive; a reset/timeout means it
+  // isn't. This is the fresh-process-equivalent check that lets the wedge
+  // backstop tell a genuine in-loop poll wedge (a restart fixes it) from a
+  // host-wide network outage (every outbound connection is failing together —
+  // Telegram polls + sends AND the Kazee/Spaces websockets — so a reboot just
+  // relaunches into the same dead network and spams "Back online"). Never rejects.
+  _probeTelegramReachable() {
+    return new Promise((resolve) => {
+      let settled = false;
+      const done = (v) => { if (!settled) { settled = true; resolve(v); } };
+      try {
+        const req = https.get(
+          { hostname: "api.telegram.org", port: 443, path: "/", agent: false, timeout: 8000 },
+          (res) => { res.resume(); done(true); },
+        );
+        req.on("timeout", () => { try { req.destroy(); } catch (e) {} done(false); });
+        req.on("error", () => done(false));
+      } catch (e) { done(false); }
+    });
+  }
+
   async _heal() {
     this._healTimer = null;
-    // Backstop only: if polling has been unbroken-wedged for 10 minutes, a
-    // restart-in-place won't fix it — exit for a clean launchd relaunch. On a
-    // healthy network this never fires (heals recover in seconds); it replaces
-    // the old hair-trigger ~90s exit that caused the restart storm.
-    if (this._wedgedSince && !this._conflictSince && Date.now() - this._wedgedSince > 600000) {
-      // Never fires during a 409 streak: that's a token fight, not a network
-      // wedge, and exiting busts the prompt cache (full uncached re-bill of the
-      // conversation window on the next turn).
-      if (this._anyTurnActive()) {
-        // A turn is in flight — never reboot mid-turn: it kills in-progress work
-        // and breaks the seamless resume the user expects. Defer the exit, keep
-        // attempting in-place recovery below, and let a later heal exit once the
-        // process is idle. If polling self-heals meanwhile, the wedge clears and
-        // no exit ever happens. (Recovery only touches the poll socket — the
-        // running turn's subprocess and its outbound sends dial their own.)
-        if (!this._deferredExitLogAt || Date.now() - this._deferredExitLogAt > 60000) {
-          this._deferredExitLogAt = Date.now();
-          console.error("Polling wedged >10min but a turn is in progress — deferring restart until idle.");
+    // A sustained wedge (>60s, and not a 409 streak): probe ONE fresh connection
+    // to learn WHY before we keep restarting. This both distinguishes a genuine
+    // in-loop poll wedge from a host-network outage AND lets us stop hammering
+    // when the network itself is down. On a healthy network wedges clear in
+    // seconds and never reach this branch. (Never during a 409 streak: that's a
+    // token fight, not a network wedge, and the conflict handler owns the loop.)
+    if (this._wedgedSince && !this._conflictSince && Date.now() - this._wedgedSince > 60000) {
+      if (!(await this._probeTelegramReachable())) {
+        // A fresh connection to Telegram fails too: a host-wide network outage,
+        // not a poll wedge (we've watched the Telegram poll, Telegram sends, and
+        // the Kazee + Spaces websockets all drop in lockstep). A reboot can't fix
+        // a dead network — the fresh process can't reach Telegram either and just
+        // spams "Back online". Restarting the poll loop is equally futile and only
+        // hammers getUpdates every ~300ms (which can trip a 429 the instant the
+        // link flickers back). Stop polling entirely and wait it out on a slow
+        // re-probe; resume the moment connectivity returns. Never exits.
+        this._enterOutagePause();
+        return;
+      }
+      // Telegram answers a fresh connection, yet our poll loop still hasn't
+      // completed a getUpdates. If that's dragged past 10 minutes a restart-in-
+      // place plainly isn't clearing it — exit for a clean launchd relaunch. On a
+      // healthy network this never fires (the null-restart below clears an in-loop
+      // wedge in seconds); it replaces the old hair-trigger ~90s restart storm.
+      if (Date.now() - this._wedgedSince > 600000) {
+        if (this._anyTurnActive()) {
+          // A turn is in flight — never reboot mid-turn: it kills in-progress work
+          // and breaks the seamless resume. Defer the exit, fall through to another
+          // in-place recovery attempt, and let a later idle heal exit if needed.
+          if (!this._deferredExitLogAt || Date.now() - this._deferredExitLogAt > 60000) {
+            this._deferredExitLogAt = Date.now();
+            console.error(`${this._stamp()} Polling wedged >10min but a turn is in progress — deferring restart until idle.`);
+          }
+        } else {
+          console.error(`${this._stamp()} Polling wedged >10min and Telegram is reachable — exiting for a clean restart.`);
+          try { require("../../core/restart-reason").recordExitReason("Telegram polling wedged >10min while API reachable — self-exit for a clean restart", { code: 1 }); } catch (e) {}
+          process.exit(1);
         }
-      } else {
-        console.error("Polling wedged >10min — exiting for a clean restart.");
-        try { require("../../core/restart-reason").recordExitReason("Telegram polling wedged >10min (long-poll unrecoverable) — self-exit for a clean restart", { code: 1 }); } catch (e) {}
-        process.exit(1);
       }
     }
     try {
@@ -197,27 +246,69 @@ class TelegramAdapter {
     } catch (e) {
       return; // restart didn't take — the next hiccup reschedules a heal
     }
-    // Recovery is real only if a getUpdates has actually COMPLETED since the
-    // restart — not merely "no throw for 35s". A dead one-shot loop throws
-    // nothing, so the old blind timer declared it healthy and reset _wedgedSince,
-    // hiding the wedge until the 10-min backstop rebooted. Gate the reset on a
-    // completed poll; otherwise re-arm a heal.
-    const restartedAt = this._pollStartedAt;
+    this._armHealthyCheck(this._pollStartedAt, "restart completed but no getUpdates within 35s");
+  }
+
+  // Recovery is real only if a getUpdates has actually COMPLETED since the
+  // (re)start — not merely "no throw for 35s". A dead one-shot loop throws
+  // nothing, so a blind timer would declare it healthy and reset _wedgedSince,
+  // hiding the wedge until the 10-min backstop rebooted. Gate the reset on a
+  // completed poll; otherwise re-arm a heal.
+  _armHealthyCheck(restartedAt, reArmMsg) {
     if (this._healthyTimer) clearTimeout(this._healthyTimer);
     this._healthyTimer = setTimeout(() => {
       this._healthyTimer = null;
       const lastCompletedPoll = this.bot?._polling?._lastUpdate || 0;
       if (lastCompletedPoll >= restartedAt) {
-        if (this._wedgedSince) console.log("Polling healthy again.");
+        if (this._wedgedSince) console.log(`${this._stamp()} Polling healthy again.`);
         this._wedgedSince = 0;
         this._healBackoff = 0;
         this._deferredExitLogAt = 0;
       } else {
-        this._onPollingHiccup("restart completed but no getUpdates within 35s");
+        this._onPollingHiccup(reArmMsg);
       }
     }, 35000);
   }
 
+  // Host-network outage recovery: STOP the poll loop entirely (kill the lib's
+  // ~300ms getUpdates retry spin) and re-probe Telegram on a slow ~30s cadence,
+  // resuming the instant a fresh connection succeeds. Nothing outbound can get
+  // through while the host has no network, so spinning only burns CPU and risks a
+  // 429 when the link flickers back — this is the "wait between reconnects"
+  // backoff. Polling and the socket.io adapters all auto-recover together when
+  // connectivity returns. Never exits.
+  _enterOutagePause() {
+    if (this._pausedForOutage) return;
+    this._pausedForOutage = true;
+    if (this._healthyTimer) { clearTimeout(this._healthyTimer); this._healthyTimer = null; }
+    console.error(`${this._stamp()} Telegram unreachable — host-network outage; pausing polls, re-probing every 30s (no reboot, no reconnect hammering).`);
+    // Stop the fast retry loop now (clean stop: no zombie loop, socket severed).
+    Promise.resolve(this._stopPollingClean("host-network outage pause")).catch(() => {});
+    const tick = async () => {
+      this._outageProbeTimer = null;
+      if (!this._pausedForOutage) return;
+      if (!(await this._probeTelegramReachable())) {
+        if (this._pausedForOutage) this._outageProbeTimer = setTimeout(tick, 30000);
+        return;
+      }
+      // Connectivity is back. Resume on a FRESH poll loop object (the offset
+      // survives in bot.options.polling params, so no updates are missed or
+      // refetched), then confirm a getUpdates actually completes.
+      this._pausedForOutage = false;
+      console.log(`${this._stamp()} Telegram reachable again — resuming polling after outage.`);
+      try {
+        this.bot._polling = null;
+        this._pollStartedAt = Date.now();
+        await this.bot.startPolling({ restart: false });
+      } catch (e) {
+        this._onPollingHiccup("resume after outage failed to start");
+        return;
+      }
+      this._armHealthyCheck(this._pollStartedAt, "resume after outage completed but no getUpdates within 35s");
+    };
+    this._outageProbeTimer = setTimeout(tick, 30000);
+  }
+
   // Telegram 409s a getUpdates call while ANOTHER one holds the token: a
   // ghost long-poll left by an uncleanly-killed predecessor (clears within
   // its ≤30s poll timeout), or a genuinely running second poller. We hold

package/core/providers/claude-events.js

@@ -4,6 +4,7 @@ const {
   normalizeDecoderError,
   normalizedUsage,
   providerErrorFlags,
+  refusalDetailsFromMessage,
 } = require("./events");
 
 function createClaudeParserState() {
@@ -14,6 +15,7 @@ function createClaudeParserState() {
     tools: new Map(),
     seenUsage: new Set(),
     totalCostUsd: 0,
+    refusal: null,
   };
 }
 
@@ -30,6 +32,27 @@ function claudeErrorMessage(rawEvent) {
   return "Claude provider failed";
 }
 
+function captureRefusal(state, stopReason, stopDetails) {
+  if (stopReason !== "refusal") return;
+  state.refusal = {
+    category: stopDetails?.category ?? null,
+    explanation: stopDetails?.explanation ?? null,
+  };
+}
+
+function claudeFailureEvent(message, state) {
+  const flags = providerErrorFlags(message);
+  const event = { type: "error", message, ...flags };
+  if (flags.refusal || state.refusal) {
+    const parsed = refusalDetailsFromMessage(message);
+    event.refusal = true;
+    event.refusalCategory = state.refusal?.category ?? null;
+    event.refusalExplanation = state.refusal?.explanation || parsed.explanation || null;
+    event.requestId = parsed.requestId;
+  }
+  return event;
+}
+
 function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
   if (!rawEvent || typeof rawEvent !== "object") return [];
   const decoderFailure = normalizeDecoderError(rawEvent);
@@ -41,6 +64,9 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
   }
 
   if (rawEvent.type === "stream_event") {
+    if (rawEvent.event?.type === "message_delta") {
+      captureRefusal(state, rawEvent.event.delta?.stop_reason, rawEvent.event.delta?.stop_details ?? rawEvent.event.stop_details);
+    }
     const delta = rawEvent.event?.type === "content_block_delta" ? rawEvent.event.delta : null;
     if (delta?.type === "text_delta" && typeof delta.text === "string" && delta.text) {
       state.sawText = true;
@@ -51,6 +77,7 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
 
   if (rawEvent.type === "assistant") {
     const events = [];
+    captureRefusal(state, rawEvent.message?.stop_reason, rawEvent.message?.stop_details);
     for (const block of rawEvent.message?.content || []) {
       if (block?.type === "text" && typeof block.text === "string" && block.text) {
         state.sawText = true;
@@ -95,8 +122,7 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
     state.terminal = true;
     if (Number.isFinite(rawEvent.total_cost_usd)) state.totalCostUsd = rawEvent.total_cost_usd;
     if (rawEvent.is_error || /^error/.test(String(rawEvent.subtype || ""))) {
-      const message = claudeErrorMessage(rawEvent);
-      return [{ type: "error", message, ...providerErrorFlags(message) }];
+      return [claudeFailureEvent(claudeErrorMessage(rawEvent), state)];
     }
     const events = [];
     const session = sessionEvent(rawEvent.session_id, state);
@@ -104,12 +130,19 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
     const usage = normalizedUsage(rawEvent.usage, "turn", state.seenUsage);
     if (usage) events.push(usage);
     const hasStructuredOutput = Object.prototype.hasOwnProperty.call(rawEvent, "structured_output");
+    const resultText = typeof rawEvent.result === "string" ? rawEvent.result : "";
+    if (state.refusal && !hasStructuredOutput && !state.sawText && !resultText.trim()) {
+      // A refusal the CLI reports as a "successful" empty turn would otherwise
+      // surface as "(no output)" — fail it with the real reason instead.
+      events.push(claudeFailureEvent('The model refused this request (stop_reason "refusal").', state));
+      return events;
+    }
     const structuredText = hasStructuredOutput ? JSON.stringify(rawEvent.structured_output) : "";
     events.push({
       type: "result",
       text: hasStructuredOutput
         ? (structuredText === undefined ? "" : structuredText)
-        : (state.sawText ? "" : (typeof rawEvent.result === "string" ? rawEvent.result : "")),
+        : (state.sawText ? "" : resultText),
       sessionId: rawEvent.session_id || state.sessionId || null,
     });
     return events;

package/core/providers/events.js

@@ -131,9 +131,19 @@ function providerErrorFlags(message) {
   return {
     authError: /unauthori[sz]ed|not (?:logged in|authenticated)|unauthenticated|login required|authentication failed|auth failed|invalid api key|no credentials|401/.test(text),
     usageLimit: /usage limit|spend limit|monthly cycle|quota|rate limit/.test(text),
+    refusal: /refusals-and-fallback|usage policy|safety classifier|stop_reason['":\s]*refusal/.test(text),
   };
 }
 
+// The CLI flattens the API's stop_details into the error text; recover the
+// human-readable pieces so the chat message can lead with the actual reason.
+function refusalDetailsFromMessage(message) {
+  const text = String(message || "");
+  const requestId = text.match(/\breq_[A-Za-z0-9]+\b/)?.[0] || null;
+  const explanation = text.match(/This request triggered[^.]+\./i)?.[0]?.trim() || null;
+  return { requestId, explanation };
+}
+
 function normalizeDecoderError(rawEvent) {
   if (!rawEvent || rawEvent.type !== "decoder.error") return null;
   // Warning, not error: a single oversized or malformed record is skippable.
@@ -171,6 +181,7 @@ module.exports = {
   normalizeDecoderError,
   normalizedUsage,
   providerErrorFlags,
+  refusalDetailsFromMessage,
   selectTerminalText,
   usageFingerprint,
 };

package/core/run-context.js

@@ -97,9 +97,14 @@ function captureRunContext({
   }
   const project = projectSnapshot(state, cwd, opts.project);
   const activeSessionId = state.activeSessions?.[project.name]?.[provider] || null;
-  const admittedSessionId = opts.fresh
+  const requestedSessionId = opts.fresh
     ? null
     : (opts.resumeSessionId || activeSessionId || null);
+  // A quarantined session's provider-side context tripped a safety refusal;
+  // resuming would re-send the flagged context and refuse again. Force the
+  // turn fresh instead (explicit resume requests included).
+  const quarantinedResume = !!(requestedSessionId && state.quarantinedSessions?.[requestedSessionId]);
+  const admittedSessionId = quarantinedResume ? null : requestedSessionId;
   const origin = serializableOrigin(opts.origin, store || {});
   const resolvedChannelId = channelId != null
     ? String(channelId)
@@ -128,9 +133,10 @@ function captureRunContext({
     cwd: cwd || project.dir || null,
     replyToMsgId: replyToMsgId == null ? null : String(replyToMsgId),
     userPrompt: prompt,
-    fresh: !!opts.fresh,
-    continueSession: !!opts.continueSession,
-    resumeSessionId: opts.resumeSessionId || null,
+    fresh: !!opts.fresh || quarantinedResume,
+    continueSession: quarantinedResume ? false : !!opts.continueSession,
+    resumeSessionId: quarantinedResume ? null : (opts.resumeSessionId || null),
+    quarantinedResume,
     skipAutoCompact: !!opts.skipAutoCompact,
     timeoutMs: Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : null,
     maxTurns: Number.isFinite(opts.maxTurns) ? opts.maxTurns : null,

package/core/runner.js

@@ -14,7 +14,7 @@ const {
 const {
   currentState, saveState, recordSession,
   resetSessionUsage, acquireRunLock, getActiveProvider, getProjectKey,
-  getProviderSession, setProviderSession, clearProviderSession, getUsageForSession, commitProviderCompaction,
+  getProviderSession, setProviderSession, clearProviderSession, quarantineProviderSession, getUsageForSession, commitProviderCompaction,
 } = require("./state");
 const { chatContext, currentChannelId, currentAdapter } = require("./context");
 const { buildTurnPrompt } = require("./system-prompt");
@@ -525,7 +525,11 @@ async function executeProviderInvocation(options = {}) {
   else if (closeInfo.signal) failure = stableRunError(`Provider process exited on signal ${closeInfo.signal}`, "PROVIDER_SIGNAL_EXIT", { signal: closeInfo.signal });
   else if (rawErrors.length) {
     const event = rawErrors[0];
-    failure = stableRunError(event.message || "Provider reported an error", event.authError ? "PROVIDER_UNAUTHENTICATED" : (event.usageLimit ? "PROVIDER_USAGE_LIMIT" : "PROVIDER_EVENT_ERROR"), event);
+    failure = stableRunError(
+      event.message || "Provider reported an error",
+      event.refusal ? "PROVIDER_REFUSAL" : (event.authError ? "PROVIDER_UNAUTHENTICATED" : (event.usageLimit ? "PROVIDER_USAGE_LIMIT" : "PROVIDER_EVENT_ERROR")),
+      event,
+    );
   } else if (closeInfo.code !== 0) failure = stableRunError(`Provider process exited with code ${closeInfo.code}`, "PROVIDER_NONZERO_EXIT", { exitCode: closeInfo.code });
   else if (!terminalSeen) failure = stableRunError("Provider stream ended without a terminal event", "PROVIDER_MISSING_TERMINAL");
   else if (!cleanupOutcome.ok) failure = cleanupOutcome.error;
@@ -1394,6 +1398,26 @@ function providerRunDiagnostic(result, runContext) {
   if (code === "PROVIDER_USAGE_LIMIT") {
     return `${label} reported a usage or rate limit. Check that provider's account status or select another configured provider.`;
   }
+  if (code === "PROVIDER_REFUSAL") {
+    const details = result.error?.details || {};
+    const reason = [
+      details.refusalCategory ? `[${details.refusalCategory}]` : null,
+      details.refusalExplanation || null,
+    ].filter(Boolean).join(" ");
+    const lines = [
+      `⛔ ${label} declined this turn — the model's safety classifier refused the request (a policy block, not a crash).`,
+    ];
+    if (reason) lines.push(`Reason: ${reason}`);
+    if (details.requestId) lines.push(`Request ID: ${details.requestId}`);
+    lines.push(
+      "",
+      "The classifier scores the whole conversation, not just your last message — so retrying in this session usually refuses again. Options:",
+      "• /new — fresh session without the flagged context",
+      "• Rephrase, or drop the material that tripped it",
+      "• /model or /backend — a different model can usually serve the same request",
+    );
+    return lines.join("\n");
+  }
   const detail = result.stderr ? `\n\nStderr:\n${result.stderr.slice(-1200)}` : "";
   return `${label} run failed: ${result.error?.message || "unknown provider failure"}${detail}`;
 }
@@ -1899,6 +1923,57 @@ function drainQueuedMessages(state) {
   return Promise.resolve();
 }
 
+// A refusal on a RESUMED session is almost always the safety classifier
+// rejecting flagged material in the old context — which every resume re-sends
+// — not the user's new message. Recovery: quarantine the poisoned session so
+// nothing resumes it again, then replay the same prompt once in a fresh
+// session. A refusal on already-fresh context gets no retry (the new message
+// itself is the problem), and the retry run never retries again.
+function shouldRetryRefusedRun(result, runContext, { capture = false, refusalRetried = false } = {}) {
+  return !capture
+    && !refusalRetried
+    && runContext?.purpose === "foreground"
+    && !!runContext?.sessionId
+    && !!result
+    && !result.ok
+    && result.error?.code === "PROVIDER_REFUSAL";
+}
+
+function quarantineRefusedRun(result, runContext, state) {
+  const details = result.error?.details || {};
+  const record = { reason: "refusal", requestId: details.requestId || null };
+  try {
+    quarantineProviderSession(state, runContext.provider, runContext.project?.name, runContext.sessionId, record);
+    // The CLI rotates session ids on resume; the rotated id observed this run
+    // carries the same poisoned context, so quarantine it too.
+    if (result.sessionId && result.sessionId !== runContext.sessionId) {
+      quarantineProviderSession(state, runContext.provider, runContext.project?.name, result.sessionId, record);
+    }
+    saveState({ strict: true });
+    return true;
+  } catch (error) {
+    console.error("refusal quarantine failed:", redactSensitive(String(error.message || error)));
+    return false;
+  }
+}
+
+function refusalRetryContext(runContext, state) {
+  return deepFreeze({
+    ...runContext,
+    runId: typeof crypto.randomUUID === "function"
+      ? crypto.randomUUID()
+      : `run-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`,
+    admittedAt: Date.now(),
+    sessionId: null,
+    admittedSessionId: null,
+    previousSessionId: getProviderSession(state, runContext.provider, runContext.project?.name) || null,
+    fresh: true,
+    continueSession: false,
+    resumeSessionId: null,
+    quarantinedResume: true,
+  });
+}
+
 async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissionLock, executionOptions = {}) {
   const tracksMainRun = ownsAdmissionLock && !capture;
   if (tracksMainRun) state.activeRunContext = runContext;
@@ -1928,6 +2003,16 @@ async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissi
     stopTyping();
   }
 
+  if (shouldRetryRefusedRun(result, runContext, { capture, refusalRetried: executionOptions.refusalRetried })
+    && quarantineRefusedRun(result, runContext, state)) {
+    try { service.turnObserver?.onTurnSettled(false); } catch (e) { /* best-effort */ }
+    // Re-arm the admission lock across the notice's async gap so a racing
+    // incoming message queues behind the retry instead of interleaving.
+    if (ownsAdmissionLock) state.preparingRun = true;
+    await send("♻️ That refusal came from flagged context in the old session — quarantined it, retrying your message in a fresh one.").catch(() => {});
+    return executeAdmittedRun(refusalRetryContext(runContext, state), state, store, capture, ownsAdmissionLock, { ...executionOptions, refusalRetried: true });
+  }
+
   if (tracksMainRun) {
     sideChatCoordinator.noteMainResult(runContext, result);
     for (const item of state.messageQueue) {
@@ -2114,6 +2199,9 @@ module.exports = {
   runAgent,
   runAgentCapture,
   runAgentSilent,
+  shouldRetryRefusedRun,
+  quarantineRefusedRun,
+  refusalRetryContext,
   shouldStartSideChat,
   runSideChatRequest,
   enqueueSideChatRequest,

package/core/state.js

@@ -428,6 +428,50 @@ function clearProviderSession(state, providerId, projectName) {
   return true;
 }
 
+const MAX_QUARANTINED_SESSIONS = 20;
+
+function boundQuarantinedSessions(source) {
+  if (!isRecord(source)) return {};
+  return Object.fromEntries(
+    Object.entries(source)
+      .filter(([sessionId, record]) => sessionId && isRecord(record))
+      .sort((a, b) => (a[1].at || 0) - (b[1].at || 0))
+      .slice(-MAX_QUARANTINED_SESSIONS)
+      .map(([sessionId, record]) => [sessionId, { ...record }]),
+  );
+}
+
+// A quarantined session is one whose provider-side context tripped the model's
+// safety classifier (stop_reason "refusal"). Resuming it re-sends the flagged
+// context and refuses again, so it must never be resumed — the run-context
+// capture forces such turns fresh. Quarantining also drops the active pointer
+// when it still points at the poisoned session.
+function quarantineProviderSession(state, providerId, projectName, sessionId, details = {}) {
+  const provider = normalizeProviderId(providerId, null);
+  if (!state || !provider || typeof sessionId !== "string" || !sessionId) return false;
+  if (!isRecord(state.quarantinedSessions)) state.quarantinedSessions = {};
+  state.quarantinedSessions[sessionId] = {
+    provider,
+    project: projectNameFrom(projectName) || getProjectKey(state, projectName) || null,
+    reason: String(details.reason || "refusal"),
+    requestId: details.requestId || null,
+    at: Number.isFinite(details.at) ? details.at : Date.now(),
+  };
+  state.quarantinedSessions = boundQuarantinedSessions(state.quarantinedSessions);
+  const project = getProjectKey(state, projectName);
+  if (project && getProviderSession(state, provider, project) === sessionId) {
+    clearProviderSession(state, provider, project);
+  }
+  return true;
+}
+
+function isSessionQuarantined(state, sessionId) {
+  return !!(sessionId
+    && typeof sessionId === "string"
+    && isRecord(state?.quarantinedSessions)
+    && isRecord(state.quarantinedSessions[sessionId]));
+}
+
 function getProviderSettings(state, providerId) {
   if (!state || typeof state !== "object") throw new TypeError("state is required");
   const provider = normalizeProviderId(providerId || getActiveProvider(state), null);
@@ -542,6 +586,7 @@ function createUserState(userId) {
     streamBuffer: "",
     streamInterval: null,
     activeSessions: normalizeActiveSessions(saved.activeSessions),
+    quarantinedSessions: boundQuarantinedSessions(saved.quarantinedSessions),
     providerSettings: normalizeProviderSettings(saved.providerSettings),
     usageBySession: boundUsageBySession(saved.usageBySession),
     messageQueue: [],
@@ -693,6 +738,7 @@ function serializeUserState(state, existing = {}) {
     ...existing,
     currentSession: state.currentSession,
     activeSessions: normalizeActiveSessions(state.activeSessions),
+    quarantinedSessions: boundQuarantinedSessions(state.quarantinedSessions),
     providerSettings: normalizeProviderSettings(state.providerSettings),
     usageBySession: boundUsageBySession(state.usageBySession),
     settings: serializeCommonSettings(state.settings),
@@ -1367,6 +1413,8 @@ module.exports = {
   getProviderSession,
   setProviderSession,
   clearProviderSession,
+  quarantineProviderSession,
+  isSessionQuarantined,
   getProviderSettings,
   getActiveUsage,
   getUsageForSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.42",
+  "version": "3.0.44",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
+    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-refusal-recovery.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
     "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-walker-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-score-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cokept-warming.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-search.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-extractive-injection.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-spaces-autoenable.js"
   },
   "files": [

package/test-fixtures/fake-agent-cli.js

@@ -252,6 +252,28 @@ function inferSessionId() {
 
 function claudeEvents(sessionId) {
   const init = { type: "system", subtype: "init", session_id: sessionId };
+  if (scenario === "refusal") {
+    return [
+      init,
+      {
+        type: "assistant",
+        message: {
+          role: "assistant",
+          content: [],
+          stop_reason: "refusal",
+          stop_details: { type: "refusal", category: "cyber", explanation: "This request was declined because it could enable cyber harm." },
+        },
+        session_id: sessionId,
+      },
+      {
+        type: "result",
+        subtype: "error_during_execution",
+        is_error: true,
+        session_id: sessionId,
+        result: "API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Request ID: req_fixture123",
+      },
+    ];
+  }
   if (scenario === "auth-failure") {
     return [
       init,
@@ -332,6 +354,12 @@ function claudeEvents(sessionId) {
 
 function codexEvents(sessionId) {
   const started = { type: "thread.started", thread_id: sessionId };
+  if (scenario === "refusal") {
+    return [
+      started,
+      { type: "turn.failed", error: { message: "Your request was rejected by the safety classifier under the usage policy." } },
+    ];
+  }
   if (scenario === "auth-failure") {
     return [
       started,
@@ -491,7 +519,7 @@ async function main() {
     setInterval(() => {}, 1000);
     return;
   }
-  if (scenario === "auth-failure") {
+  if (scenario === "auth-failure" || scenario === "refusal") {
     process.exitCode = 1;
     return;
   }

package/test-fixtures/sim-no-sqlite.js

@@ -0,0 +1,14 @@
+// Preload shim: makes require("node:sqlite") throw, reproducing CI's node:20
+// where the module is absent. Release lesson (v3.0.39): run changed tests with
+//   NODE_OPTIONS=--require ./test-fixtures/sim-no-sqlite.js
+// before cutting a version, or node22-vs-node20 graph divergences slip through.
+"use strict";
+
+const Module = require("module");
+const originalLoad = Module._load;
+Module._load = function patchedLoad(request, ...rest) {
+  if (request === "node:sqlite" || request === "sqlite") {
+    throw new Error("node:sqlite unavailable (sim-no-sqlite shim)");
+  }
+  return originalLoad.call(this, request, ...rest);
+};

package/test-provider-events.js

@@ -117,8 +117,78 @@ assert.deepStrictEqual(claudeAuth, [{
   message: "Authentication failed",
   authError: true,
   usageLimit: false,
+  refusal: false,
 }]);
 
+// Refusal surfaced only through the CLI's flattened error text (no structured
+// stop_details): flagged, reason sentence + request id recovered from the text.
+const refusalText = "API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To learn more, see https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback. Try rephrasing the request or attempting a different approach.\n\nRequest ID: req_011CdCrJnhWPXeW3PsPFJEb5";
+const claudeRefusal = normalizeClaudeEvent({
+  type: "result",
+  is_error: true,
+  subtype: "error_during_execution",
+  result: refusalText,
+}, createClaudeParserState());
+assert.strictEqual(claudeRefusal.length, 1);
+assert.strictEqual(claudeRefusal[0].type, "error");
+assert.strictEqual(claudeRefusal[0].refusal, true);
+assert.strictEqual(claudeRefusal[0].authError, false);
+assert.strictEqual(claudeRefusal[0].usageLimit, false);
+assert.strictEqual(claudeRefusal[0].requestId, "req_011CdCrJnhWPXeW3PsPFJEb5");
+assert.match(claudeRefusal[0].refusalExplanation, /violative cyber content/);
+
+// Structured stop_details from the assistant message wins over text parsing.
+const refusalState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: {
+    content: [],
+    stop_reason: "refusal",
+    stop_details: { type: "refusal", category: "cyber", explanation: "This request was declined because it could enable cyber harm." },
+  },
+}, refusalState);
+const structuredRefusal = normalizeClaudeEvent({
+  type: "result",
+  is_error: true,
+  subtype: "error_during_execution",
+  result: "API Error: request blocked",
+}, refusalState);
+assert.strictEqual(structuredRefusal[0].refusal, true);
+assert.strictEqual(structuredRefusal[0].refusalCategory, "cyber");
+assert.match(structuredRefusal[0].refusalExplanation, /cyber harm/);
+
+// A refusal the CLI reports as a "successful" empty turn must fail with the
+// reason instead of settling as an empty "(no output)" result.
+const silentState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: { content: [], stop_reason: "refusal", stop_details: { type: "refusal", category: null, explanation: null } },
+}, silentState);
+const silent = normalizeClaudeEvent({
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  session_id: "claude-refusal-session",
+  result: "",
+}, silentState);
+assert.strictEqual(silent.at(-1).type, "error");
+assert.strictEqual(silent.at(-1).refusal, true);
+
+// A refusal stop_reason with answer text already streamed must NOT hijack the
+// successful result path.
+const partialState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: { content: [{ type: "text", text: "partial answer" }], stop_reason: "refusal" },
+}, partialState);
+assert.strictEqual(normalizeClaudeEvent({
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  session_id: "claude-partial-session",
+  result: "",
+}, partialState).at(-1).type, "result");
+
 const codexState = createCodexParserState();
 assert.deepStrictEqual(normalizeCodexEvent(samples.codex.session, codexState), [
   { type: "session", sessionId: "codex-thread-1" },
@@ -151,6 +221,7 @@ assert.deepStrictEqual(codexAuth, [{
   message: "401 Unauthorized",
   authError: true,
   usageLimit: false,
+  refusal: false,
 }]);
 
 const decoderError = { type: "decoder.error", code: "MALFORMED_JSON", message: "Malformed provider JSONL record" };

package/test-provider-language.js

@@ -74,7 +74,32 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // builds a fresh object (offset survives via the shared params), and the
 // "healthy" reset requires a getUpdates that actually COMPLETED since the restart
 // (else it re-arms a heal) instead of blindly declaring victory after 35s.
-assert.strictEqual(pkg.version, "3.0.42", "release version must remain unchanged without explicit approval");
+// 3.0.43 approved by Sumeet 2026-07-18 ("Yeh push"): reachability-gated self-exit
+// + outage-pause backoff, so a host-wide network blip no longer triggers a
+// reboot storm. v3.0.42 healed the in-loop wedge but STILL rebooted after 10min
+// even when the whole host had lost the network (laptop sleep, pod egress
+// starvation) — exiting into a dead network just relaunched into the same
+// outage, spamming "Back online" every ~14min. The 10-min self-exit is now gated
+// on a fresh HEAD probe to api.telegram.org actually SUCCEEDING (proves a genuine
+// in-loop wedge, not a dead host); if the probe fails the adapter enters an
+// outage pause — it STOPS polling (no 300ms lib reconnect spin) and re-probes
+// every 30s, resuming cleanly the moment connectivity returns. Poll-health logs
+// are timestamped. Confined to channels/telegram/adapter.js; new cases in
+// test-telegram-poll-recovery.js cover the pause+resume and the gated exit.
+// 3.0.44 approved by Sumeet 2026-07-20 ("push"): safety-refusal handling +
+// poisoned-session recovery. The API's stop_reason "refusal" scores the WHOLE
+// conversation, so a session whose context tripped the classifier refused every
+// resumed turn (the flagged material was re-sent each time) and the user only
+// saw a raw AUP error dump with no way forward but knowing to type /new.
+// Refusals are now detected structurally (stop_details category/explanation,
+// text-parse fallback on the flattened CLI error) and mapped to PROVIDER_REFUSAL
+// with a clear diagnostic (reason, request ID, /new + rephrase + model options).
+// Recovery: the refused session is QUARANTINED (bounded persisted map in user
+// state; never resumed again — natural turns, explicit /continue, and rotated
+// ids all forced fresh) and the refused prompt is auto-retried exactly ONCE in
+// a fresh session behind a ♻️ notice. A refusal on already-fresh context gets
+// no retry (the new message itself is the problem); capture runs never retry.
+assert.strictEqual(pkg.version, "3.0.44", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-runner.js

@@ -262,6 +262,56 @@ async function main() {
   assert.strictEqual(authFailure.error.code, "PROVIDER_UNAUTHENTICATED");
   assert.match(authFailure.diagnostic, /Authentication failed/i);
 
+  // A safety refusal on a resumed session must surface as PROVIDER_REFUSAL
+  // with the structured reason (category/explanation/request id) intact — the
+  // inputs the poisoned-session recovery quarantines and retries on.
+  const refusalCapture = path.join(root, "refusal-capture.json");
+  const refusalProviders = makeProviders(
+    { claude: refusalCapture, codex: captures.codex },
+    { claude: { FAKE_AGENT_SCENARIO: "refusal" } },
+  );
+  mutable.activeSessions["project-a"].claude = "claude-poisoned-session";
+  const refusalService = createRunnerService({
+    getState: () => mutable,
+    getStore: () => ({ channelId: "fixture-channel", transport: "telegram" }),
+    resolveProvider: (id) => refusalProviders[id],
+    buildTurnPrompt: simpleBundle,
+    cleanup: async () => {},
+  });
+  const refused = await refusalService.runAgentCapture("REFUSAL SENTINEL", projectA);
+  assert.strictEqual(refused.ok, false);
+  assert.strictEqual(refused.admittedSessionId, "claude-poisoned-session", "refusal run resumed the poisoned session");
+  assert.strictEqual(refused.error.code, "PROVIDER_REFUSAL");
+  assert.strictEqual(refused.error.details.refusal, true);
+  assert.strictEqual(refused.error.details.refusalCategory, "cyber");
+  assert.match(refused.error.details.refusalExplanation, /cyber harm/);
+  assert.strictEqual(refused.error.details.requestId, "req_fixture123");
+  assert.match(refused.diagnostic, /Usage Policy/);
+  assert.match(refused.diagnostic, /req_fixture123/);
+  const refusalArgv = JSON.parse(fs.readFileSync(refusalCapture, "utf8")).argv;
+  assert.ok(refusalArgv.includes("claude-poisoned-session"), "refusal run resumed via --resume");
+
+  // The quarantine guard: once the session is quarantined, the SAME turn shape
+  // is admitted fresh — no --resume, healthy success in a new session.
+  mutable.quarantinedSessions = {
+    "claude-poisoned-session": { provider: "claude", project: "project-a", reason: "refusal", at: Date.now() },
+  };
+  const recoveredProviders = makeProviders({ claude: refusalCapture, codex: captures.codex });
+  const recoveredService = createRunnerService({
+    getState: () => mutable,
+    getStore: () => ({ channelId: "fixture-channel", transport: "telegram" }),
+    resolveProvider: (id) => recoveredProviders[id],
+    buildTurnPrompt: simpleBundle,
+    cleanup: async () => {},
+  });
+  const recovered = await recoveredService.runAgentCapture("RECOVERY SENTINEL", projectA);
+  assert.strictEqual(recovered.ok, true);
+  assert.strictEqual(recovered.admittedSessionId, null, "quarantined session must not be admitted");
+  assert.strictEqual(recovered.sessionId, "claude-fresh-session");
+  const recoveredArgv = JSON.parse(fs.readFileSync(refusalCapture, "utf8")).argv;
+  assert.ok(!recoveredArgv.includes("--resume"), "quarantined resume is forced fresh");
+  assert.ok(!recoveredArgv.includes("claude-poisoned-session"));
+
   console.log("provider runner OK");
 }
 

package/test-telegram-poll-recovery.js

@@ -190,6 +190,7 @@ async function testWedgeExitDefersWhileTurnInFlight() {
   adapter._deferredExitLogAt = 0;
   adapter._healBackoff = 0;
   adapter._anyTurnActive = () => true; // a turn is running/queued
+  adapter._probeTelegramReachable = async () => true; // reachable ⇒ genuine wedge; defer path
   adapter._agent = { destroy() { calls.push("destroy"); } };
   adapter.bot = {
     async stopPolling() { calls.push("stop"); },
@@ -217,8 +218,10 @@ async function testWedgeExitDefersWhileTurnInFlight() {
   assert.ok(adapter._deferredExitLogAt > 0, "the deferral must be logged (throttle stamp set)");
 }
 
-// Once the process is idle (no turn running/queued), the same backstop exits for
-// a clean restart exactly as before — the deferral only postpones, never cancels.
+// Once the process is idle (no turn running/queued) AND Telegram answers a fresh
+// connection — proving this is a real in-loop poll wedge, not a host-network
+// outage — the backstop exits for a clean restart exactly as before. The
+// deferral only postpones, never cancels.
 async function testWedgeExitFiresWhenIdle() {
   let exitCode;
   const adapter = Object.create(TelegramAdapter.prototype);
@@ -227,6 +230,7 @@ async function testWedgeExitFiresWhenIdle() {
   adapter._wedgedSince = Date.now() - 11 * 60 * 1000; // wedged >10min
   adapter._deferredExitLogAt = 0;
   adapter._anyTurnActive = () => false; // idle
+  adapter._probeTelegramReachable = async () => true; // Telegram reachable ⇒ genuine poll wedge
   adapter._agent = { destroy() {} };
   adapter.bot = { async stopPolling() {}, async startPolling() {} };
 
@@ -244,6 +248,116 @@ async function testWedgeExitFiresWhenIdle() {
   assert.strictEqual(exitCode, 1, "the idle wedge backstop must exit(1) for a clean restart");
 }
 
+// THE REBOOT-STORM regression, now resolved by an OUTAGE PAUSE. When the wedge is
+// a host-wide network outage — every outbound connection failing together
+// (Telegram polls + sends AND the Kazee/Spaces websockets) — a reboot can't help:
+// the fresh process can't reach Telegram either and just relaunches into the same
+// dead network, spamming "Back online". So even when idle, the backstop must NOT
+// exit while a fresh connection to Telegram also fails. Instead it STOPS the poll
+// loop entirely (no ~300ms getUpdates hammering that can trip a 429 when the link
+// flickers back) and waits on a slow re-probe. Fails before the fix because the
+// idle backstop exits unconditionally.
+async function testWedgeExitPausesInsteadOfRebootingOnHostOutage() {
+  const calls = [];
+  let exited = false;
+  const adapter = Object.create(TelegramAdapter.prototype);
+  adapter._healTimer = null;
+  adapter._healthyTimer = null;
+  adapter._conflictSince = 0;
+  adapter._wedgedSince = Date.now() - 11 * 60 * 1000; // wedged >10min
+  adapter._deferredExitLogAt = 0;
+  adapter._healBackoff = 0;
+  adapter._pausedForOutage = false;
+  adapter._outageProbeTimer = null;
+  adapter._anyTurnActive = () => false; // idle
+  adapter._probeTelegramReachable = async () => false; // host can't reach Telegram at all
+  adapter._agent = { destroy() { calls.push("destroy"); } };
+  adapter.bot = {
+    async stopPolling() { calls.push("stop"); },
+    async startPolling() { calls.push("start"); },
+  };
+
+  const realExit = process.exit;
+  process.exit = () => { exited = true; throw new Error("process.exit must not be called during a host-network outage"); };
+  const realSetTimeout = global.setTimeout;
+  const realClearTimeout = global.clearTimeout;
+  global.setTimeout = (fn, ms) => { if (ms === 500) fn(); return { ms }; };
+  global.clearTimeout = () => {};
+
+  try {
+    await adapter._heal();
+    await new Promise((r) => realSetTimeout(r, 5)); // let the fire-and-forget stop settle
+  } finally {
+    process.exit = realExit;
+    global.setTimeout = realSetTimeout;
+    global.clearTimeout = realClearTimeout;
+  }
+
+  assert.strictEqual(exited, false, "a host-network outage must NOT trigger a reboot (the fresh process can't reach the network either)");
+  assert.strictEqual(adapter._pausedForOutage, true, "an unreachable host must pause polling instead of rebooting");
+  assert.ok(calls.includes("stop") && calls.includes("destroy"),
+    "entering the outage pause must stop the poll loop and sever the socket");
+  assert.ok(!calls.includes("start"),
+    "while the host is unreachable the bot must NOT keep reconnecting (no ~300ms getUpdates hammering)");
+  assert.ok(adapter._outageProbeTimer, "the pause must schedule a slow re-probe to resume when the network returns");
+}
+
+// Companion: once the network returns, the outage pause's slow re-probe must
+// RESUME polling on a FRESH loop object (offset preserved via bot.options.polling
+// params) and leave the paused state — the bot recovers on its own, no reboot.
+async function testOutagePauseResumesPollingWhenNetworkReturns() {
+  const calls = [];
+  let reachable = false;
+  let tickFn;
+  const adapter = Object.create(TelegramAdapter.prototype);
+  adapter._healTimer = null;
+  adapter._healthyTimer = null;
+  adapter._wedgedSince = Date.now() - 2 * 60 * 1000;
+  adapter._healBackoff = 0;
+  adapter._deferredExitLogAt = 0;
+  adapter._pausedForOutage = false;
+  adapter._outageProbeTimer = null;
+  adapter._pollStartedAt = 0;
+  adapter._onPollingHiccup = () => {};
+  adapter._probeTelegramReachable = async () => reachable;
+  adapter._agent = { destroy() { calls.push("destroy"); } };
+  adapter.bot = {
+    _polling: { _abort: true, _lastUpdate: 0 },
+    async stopPolling() { calls.push("stop"); },
+    async startPolling() {
+      calls.push("start");
+      if (!this._polling) this._polling = { _abort: false, _lastUpdate: Date.now() };
+    },
+  };
+
+  const realSetTimeout = global.setTimeout;
+  const realClearTimeout = global.clearTimeout;
+  global.setTimeout = (fn, ms) => {
+    if (ms === 500 || ms === 5000) fn();            // stop-clean internals fire inline
+    else if (ms === 30000 && !tickFn) tickFn = fn;  // capture the outage re-probe tick
+    return { ms };
+  };
+  global.clearTimeout = () => {};
+
+  try {
+    adapter._enterOutagePause();
+    await new Promise((r) => realSetTimeout(r, 5)); // let the fire-and-forget stop settle
+    assert.strictEqual(adapter._pausedForOutage, true, "an unreachable host pauses polling");
+    assert.ok(!calls.includes("start"), "no reconnecting while paused (network is down)");
+    assert.strictEqual(typeof tickFn, "function", "the pause must schedule a slow re-probe");
+
+    reachable = true;
+    adapter.bot._polling = { _abort: true, _lastUpdate: 0 }; // stale object present before resume
+    await tickFn();
+    assert.strictEqual(adapter._pausedForOutage, false, "a successful re-probe must leave the pause");
+    assert.ok(calls.includes("start"), "a successful re-probe must resume polling");
+    assert.strictEqual(adapter.bot._polling._abort, false, "resume must build a FRESH poll loop object (offset preserved)");
+  } finally {
+    global.setTimeout = realSetTimeout;
+    global.clearTimeout = realClearTimeout;
+  }
+}
+
 // THE RESTART STORM regression. A wedge (half-open getUpdates after sleep/wake
 // or a NAT/IPv6 eviction) leaves the lib's REUSED _polling object with `_abort`
 // stuck true: the hung request never settled within our stop cap, so stop()'s
@@ -266,6 +380,7 @@ async function testHealNullsPoisonedPollingSoLibRebuildsFresh() {
   adapter._healBackoff = 0;
   adapter._pollStartedAt = ancient;
   adapter._onPollingHiccup = () => {};
+  adapter._probeTelegramReachable = async () => true; // reachable ⇒ normal in-place heal path
   adapter._agent = { destroy() {} };
   adapter.bot = {
     _polling: poisoned,
@@ -310,6 +425,7 @@ async function testHealthySignalReArmsWhenNoPollCompleted() {
   adapter._healBackoff = 2;
   adapter._deferredExitLogAt = 0;
   adapter._pollStartedAt = 0;
+  adapter._probeTelegramReachable = async () => true; // reachable ⇒ normal in-place heal path
   adapter._agent = { destroy() {} };
   adapter.bot = {
     _polling: { _abort: true, _lastUpdate: 0 },
@@ -360,6 +476,7 @@ async function testHealthySignalClearsWedgeOnceAPollCompletes() {
   adapter._healBackoff = 3;
   adapter._deferredExitLogAt = 12345;
   adapter._pollStartedAt = 0;
+  adapter._probeTelegramReachable = async () => true; // reachable ⇒ normal in-place heal path
   adapter._agent = { destroy() {} };
   adapter.bot = {
     _polling: { _abort: true, _lastUpdate: 0 },
@@ -401,6 +518,8 @@ async function testHealthySignalClearsWedgeOnceAPollCompletes() {
   await test409ConflictSeversGhostSocketAndRestartsIdle();
   await testWedgeExitDefersWhileTurnInFlight();
   await testWedgeExitFiresWhenIdle();
+  await testWedgeExitPausesInsteadOfRebootingOnHostOutage();
+  await testOutagePauseResumesPollingWhenNetworkReturns();
   await testHealNullsPoisonedPollingSoLibRebuildsFresh();
   await testHealthySignalReArmsWhenNoPollCompleted();
   await testHealthySignalClearsWedgeOnceAPollCompletes();