@ouro.bot/cli 0.1.0-alpha.903 → 0.1.0-alpha.904

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.904",
+      "changes": [
+        "The Butler no longer throws away its answer when someone is picking a movie, never sends a rejected draft or the runtime's note about it, says a title is on the shelf only when a lookup this turn found it there, and holds house notices while Ari's chat is handed to someone else."
+      ]
+    },
     {
       "version": "0.1.0-alpha.903",
       "changes": [

package/deploy/unraid/sanctuary-replay-gate.mjs

@@ -306,6 +306,9 @@ const WORK_WORDS = "channel more dross from cradle energy. name the Cradle chara
 const CLICK_ASK = /\bclick(?:ing)?\b|\bopen (?:up )?(?:the )?(?:radarr|sonarr|settings|ui|web ?ui|dashboard)\b|\b(?:settings|config(?:uration)?)[- ](?:screen|page|ui)\b|\bten[- ]second\b|\bmanual(?:ly)? (?:step|change|click)/i
 const BOLD_LABEL = /(?:^|\n)\s*(?:[-*\u2022]\s+)?\*\*[^*\n]{1,60}\*\*[ \t]*(?::|\u2014|-|\n|$)|\*\*[^*\n]{1,60}:\*\*/
 const BRIEF_LIMIT = 600
+const HANDOFF_WORDS = "hello pal! I’m going to hand you to my wife, Rachel. I’d love for you to help her pick a movie from our Jellyfin library. Keep your responses brief to the point and have a really fun time interviewing her to find exactly what she wants to watch. She’s the boss, do what she says :)  say hi to her!"
+const GREETING = /\b(?:hi|hey|hello|hiya|howdy|welcome)\b/i
+const RUNTIME_NOTE_ECHO = /\b(?:markdown|bold\s+(?:section\s+)?labels?|section\s+labels?|question\s+at\s+the\s+end|closing\s+question|settle\s+again|rewrite\s+the\s+reply|cap\s+it|runtime\s+note|private\s+note)\b/i
 /** A request filed with Claude Code: a failure report, or a message whose recipient or body names Claude Code. */
 // The change reaches him through a release, not mid-conversation. Any honest description of that path counts; alpha.883 live: "personality changes live in the files that ship with each release, so they arrive in the next update".
 export const describesReleasePath = (text) => /\breleases?\b|\bnext update\b|\bengineers?\b|claude code|pull request|\bPRs?\b/i.test(text)
@@ -534,7 +537,22 @@ export const CASES = [
         check(`the reply is at most ${BRIEF_LIMIT} characters`, text.length > 0 && text.length <= BRIEF_LIMIT, `${text.length} characters`),
         check("the reply has no markdown headers", !/^#{1,6}\s/m.test(text)),
         check("the reply has no bold section labels", !BOLD_LABEL.test(text)),
-        check("the reply does not end with a question", !text.trimEnd().endsWith("?")),
+      ]
+    },
+  },
+  {
+    // 2026-10-11: Ari handed his chat to Rachel and asked the Butler to say hi and interview her. It sent a title with no
+    // greeting, and later its own note about the brevity rules. A handoff gets a greeting and a question.
+    id: "rach-handoff",
+    words: HANDOFF_WORDS,
+    sender: "principal",
+    delegated: false,
+    readback: ({ reply, said }) => {
+      const text = String(said || reply || "")
+      return [
+        check("the reply greets her", GREETING.test(text), text.slice(0, 120)),
+        check("the reply asks her a question", text.includes("?")),
+        check("the reply carries no runtime note", !RUNTIME_NOTE_ECHO.test(text), (RUNTIME_NOTE_ECHO.exec(text) ?? [""])[0]),
       ]
     },
   },
@@ -853,6 +871,13 @@ export function selfTestFixtures() {
       pass: { trace: [], reply: "A movie is one film. A series has seasons of episodes.", before: emptyObservation(), after: emptyObservation() },
       fail: { trace: [], reply: `## Difference\n**Movies**: ${"long ".repeat(130)}\nWant me to go on?`, before: emptyObservation(), after: emptyObservation() },
     },
+    "rach-handoff": {
+      pass: { trace: [], reply: "Hi Rachel! Silly and cosy, or loud and dumb-fun tonight?", before: emptyObservation(), after: emptyObservation() },
+      // The live turn-1 reply: a title, no greeting, no question.
+      fail: { trace: [], reply: "**The Love Hypothesis** (2026) is on the shelf and ready to play.", before: emptyObservation(), after: emptyObservation() },
+      // The live turn-4 reply: the runtime's note, sent to her.
+      failNote: { trace: [], reply: "hi! got it. dummy bad, no markdown, no question at the end. just plain answer, cap it. what are you after?", before: emptyObservation(), after: emptyObservation() },
+    },
   }
   return { friends, fx }
 }

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.903",
+  "runtimeVersion": "0.1.0-alpha.904",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.ouro/psyche/LORE.md

@@ -24,4 +24,6 @@ What I say about a book, show, film or its characters comes from a source I read
 
 I never tell Ari to click, open a settings page, or do a ten-second manual step. When Radarr or Sonarr rejects a better release with "Quality Profile does not allow upgrades", `media_quality_profile` changes that: `action read` shows the profiles, `action set_upgrade` changes upgrade_allowed and the cutoff of one profile, and `action assign` moves one title to another profile. Prefer `assign` when Ari asked about one title: `set_upgrade` changes a profile every title on it shares, and its dry run says how many that is. Writes are a dry run until `dry_run` is false, and applying needs `owner_words`, Ari's own words asking for the change, from Ari himself. So show Ari the before and after in one line, apply it once he has asked, then run `media_search_now`. If no tool can do what he asks, I file it with Claude Code and say I did.
 
-When Ari asks me to be brief, my replies are plain sentences with no headers or bold labels, about 600 characters at most, and they do not end with a question he already answered. The runtime holds me to this once he has asked.
+When Ari asks me to be brief, my replies are plain sentences with no headers or bold labels, about 600 characters at most. The runtime holds me to this once he has asked.
+
+I say a title is on the shelf only when a library lookup in the same turn found it there; otherwise I say I can check whether we have it.

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.903</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.904</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/core.js

@@ -22,6 +22,7 @@ exports.runAgent = runAgent;
 const config_1 = require("./config");
 const identity_1 = require("./identity");
 const source_grounding_1 = require("./source-grounding");
+const shelf_claims_1 = require("./shelf-claims");
 const reply_style_1 = require("./reply-style");
 const tools_1 = require("../repertoire/tools");
 const tool_arguments_1 = require("../repertoire/tool-arguments");
@@ -657,6 +658,19 @@ function historicalFailedEffectsForExactRepeatedRequest(messages, selection) {
     return [...failedEffects.values()];
 }
 const ANSWER_GATE_MAX_REJECTIONS = 2;
+/** Brevity and shelf claims are retried once; after that the reply goes out (an unbacked shelf claim with a disclosure), because a real draft beats another lap. */
+const ANSWER_STYLE_MAX_RETRIES = 1;
+function privateGateNote(reason) {
+    return `[private runtime note, not from the person: do not mention, quote or acknowledge it; send the person only the corrected reply] ${reason}`;
+}
+/** A reply that talks about the runtime's correction (its formatting rules, the retry itself) instead of answering the person. */
+const GATE_NOTE_ECHO = /\b(?:markdown|bold\s+(?:section\s+)?labels?|section\s+labels?|question\s+at\s+the\s+end|closing\s+question|settle\s+again|rewrite\s+the\s+reply|cap\s+it|runtime\s+note|private\s+note)\b/i;
+/** The settle call as delivered, so the history holds what the person got rather than a draft the runtime replaced. */
+function withSettleAnswer(msg, settleArgs, answer) {
+    const call = msg.tool_calls[0];
+    const args = { ...settleArgs, answer };
+    return { ...msg, tool_calls: [{ ...call, function: { ...call.function, arguments: JSON.stringify(args) } }, ...msg.tool_calls.slice(1)] };
+}
 function userTexts(messages) {
     return messages.filter((message) => message.role === "user").map((message) => messageContentText(message.content));
 }
@@ -1170,6 +1184,8 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     const turnStartLength = messages.length;
     let groundingRejections = 0;
     let brevityRejections = 0;
+    let shelfRejections = 0;
+    let lastRealDraft = null;
     const privateReturnHeldTokens = new Set();
     // Once-per-turn flag for the fresh-work rest gate. Without this, an agent
     // that called rest, was told "fresh work arrived", processed the items,
@@ -1212,9 +1228,31 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     // and a plain-text reply with no tool call alike (alpha.886 replay: a plain-text reply skipped them and an invented cast went out).
     // A request-specific contract (options.requiredToolCalls) already validates its own terminal answer. Each gate has its own bounded
     // retry, and none spends the last provider iteration.
+    // A rejected reply never reaches the person, and neither does the runtime's note about it: the retry gets the reason as a private
+    // note, and a retry that only talks about that note is replaced by the last real draft (2026-10-11: "got it. dummy bad, no markdown,
+    // no question at the end. just plain answer, cap it." went to Rachel).
+    // `replacement` is the text to deliver instead of the answer, with any disclosure already applied; null delivers the answer as is.
     const answerGateVerdict = (answer, intent) => {
+        if (lastRealDraft !== null && GATE_NOTE_ECHO.test(answer)) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_echo_replaced", message: "a retry talked about the runtime's note instead of answering; delivering the last real draft", meta: { length: answer.length } });
+            return { error: null, replacement: disclosed(lastRealDraft, answerGateCheck(lastRealDraft, intent, true)) };
+        }
+        const verdict = answerGateCheck(answer, intent, false);
+        if (verdict.error) {
+            lastRealDraft = answer;
+            return { error: privateGateNote(verdict.error), replacement: null };
+        }
+        const delivered = disclosed(answer, verdict);
+        return { error: null, replacement: delivered === answer ? null : delivered };
+    };
+    const disclosed = (answer, verdict) => {
+        const shelfChecked = verdict.shelfUnverified ? (0, shelf_claims_1.withShelfDisclosure)(answer, turnToolRecords) : answer;
+        return verdict.unverifiedNames ? (0, source_grounding_1.withUnverifiedDisclosure)(shelfChecked, verdict.unverifiedNames) : shelfChecked;
+    };
+    // `final` grades a draft that is going out regardless: nothing is rejected, and what would have been is disclosed instead.
+    const answerGateCheck = (answer, intent, final) => {
         const gates = options?.requiredToolCalls ? undefined : options?.toolContext?.answerGates;
-        const retriesLeft = providerIterations < stepBudget - 1;
+        const retriesLeft = !final && providerIterations < stepBudget - 1;
         let groundingError = null;
         let unverifiedNames = null;
         const grounding = gates?.sourceGrounding ? (0, source_grounding_1.sourceGroundingFinding)({ answer, userText: userTexts(messages).join("\n"), latestUserText: latestUserMessageText(messages.slice(0, turnStartLength)), knownText: priorTurnsText(messages.slice(0, turnStartLength)), tools: turnToolRecords }) : null;
@@ -1229,16 +1267,28 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_disclosed", message: "unsourced names survived the retries; delivering with a disclosure", meta: { gate: "source_grounding", names: grounding.names.length } });
             }
         }
+        let shelfError = null;
+        let shelfUnverified = false;
+        const shelfFinding = !groundingError && gates?.shelfClaims ? (0, shelf_claims_1.shelfClaimError)(answer, turnToolRecords) : null;
+        if (shelfFinding && shelfRejections < ANSWER_STYLE_MAX_RETRIES && retriesLeft) {
+            shelfRejections += 1;
+            shelfError = shelfFinding;
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_rejected", message: "answer said something is on the shelf that no lookup this turn found there; sending the model back", meta: { gate: "shelf_claims", rejection: shelfRejections, cap: ANSWER_STYLE_MAX_RETRIES } });
+        }
+        else if (shelfFinding) {
+            shelfUnverified = true;
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_disclosed", message: "an unbacked shelf claim survived the retry; delivering with a disclosure", meta: { gate: "shelf_claims" } });
+        }
         let brevityError = null;
-        if (!groundingError && gates?.brevity && !options?.toolContext?.context?.isGroupChat && brevityRejections < ANSWER_GATE_MAX_REJECTIONS && retriesLeft
+        if (!groundingError && !shelfError && gates?.brevity && !options?.toolContext?.context?.isGroupChat && brevityRejections < ANSWER_STYLE_MAX_RETRIES && retriesLeft
             && (0, reply_style_1.briefStyleRequested)(userTexts(messages), (0, reply_style_1.savedCommunicationPreference)(options?.toolContext?.context?.friend))) {
             brevityError = (0, reply_style_1.briefStyleViolation)(answer, intent);
             if (brevityError) {
                 brevityRejections += 1;
-                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_rejected", message: "answer broke the person's brevity request; sending the model back", meta: { gate: "brevity", rejection: brevityRejections, cap: ANSWER_GATE_MAX_REJECTIONS } });
+                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_rejected", message: "answer broke the person's brevity request; sending the model back", meta: { gate: "brevity", rejection: brevityRejections, cap: ANSWER_STYLE_MAX_RETRIES } });
             }
         }
-        return { error: groundingError ?? brevityError, unverifiedNames };
+        return { error: groundingError ?? shelfError ?? brevityError, unverifiedNames, shelfUnverified };
     };
     const rejectToolBatch = (assistant, reasons) => {
         rejectAttempt(assistant, assistant.tool_calls.map((call, index) => ({
@@ -1815,12 +1865,11 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         rejectAttempt(msg, [{ role: "user", content: textVerdict.error }]);
                         continue;
                     }
-                    if (textVerdict?.unverifiedNames) {
-                        const disclosed = (0, source_grounding_1.withUnverifiedDisclosure)(textAnswer, textVerdict.unverifiedNames);
+                    if (textVerdict?.replacement) {
                         streamCallbackBuffer?.discard();
                         callbacks.onClearText?.();
-                        callbacks.onTextChunk(disclosed);
-                        pushGenerated({ ...msg, content: disclosed });
+                        callbacks.onTextChunk(textVerdict.replacement);
+                        pushGenerated({ ...msg, content: textVerdict.replacement });
                         done = true;
                         continue;
                     }
@@ -2026,7 +2075,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             sawSettleContentMismatch = true;
                             (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.settle_content_mismatch", message: "settle answer differs from the reply text written beside it; asking once for the reply as the answer", meta: { answerLength: deliveredAnswer.length, contentLength: msg.content.length } });
                         }
-                        const { error: answerGateError, unverifiedNames } = answerGateVerdict(deliveredAnswer, intent);
+                        const { error: answerGateError, replacement } = answerGateVerdict(deliveredAnswer, intent);
                         const retryError = contentMismatch
                             ?? answerGateError
                             ?? privateReturnAckLeakError(deliveredAnswer, privateReturnHeldTokens)
@@ -2038,11 +2087,12 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             ?? getSettleRetryError(mustResolveBeforeHandoffActive, intent, sawSteeringFollowUp, options?.delegationDecision, sawSendMessageSelf, sawPonder, sawQuerySession, options?.currentObligation ?? null, options?.activeWorkFrame?.inner?.job, sawExternalStateQuery);
                         const validDirectReply = mustResolveBeforeHandoffActive && intent === "direct_reply" && sawSteeringFollowUp;
                         if (retryError === null) {
-                            const finalAnswer = unverifiedNames ? (0, source_grounding_1.withUnverifiedDisclosure)(deliveredAnswer, unverifiedNames) : deliveredAnswer;
+                            const finalAnswer = replacement ?? deliveredAnswer;
+                            const rewritten = replacement !== null;
                             try {
-                                if (unverifiedNames && result.settleStreamed)
+                                if (rewritten && result.settleStreamed)
                                     callbacks.onClearText?.();
-                                if (unverifiedNames || !result.settleStreamed) {
+                                if (rewritten || !result.settleStreamed) {
                                     const acceptedOutputCallbacks = streamCallbackBuffer?.callbacks ?? callbacks;
                                     acceptedOutputCallbacks.onTextChunk(finalAnswer);
                                 }
@@ -2061,7 +2111,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             };
                             // Retractable owners already hold the validated answer. Final-only
                             // owners receive it here, after every semantic continuation gate.
-                            pushGenerated(msg);
+                            pushGenerated(rewritten ? withSettleAnswer(msg, settleArgs, finalAnswer) : msg);
                             if (validDirectReply) {
                                 const resumeWork = "direct reply delivered. resume the unresolved obligation now and keep working until you can finish or clearly report that you are blocked.";
                                 pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: resumeWork });

package/dist/heart/reply-style.js

@@ -13,7 +13,7 @@ exports.savedCommunicationPreference = savedCommunicationPreference;
  */
 const runtime_1 = require("../nerves/runtime");
 exports.BRIEF_MAX_CHARS = 600;
-const ASK_BRIEF = /\b(?:be|keep(?:\s+(?:it|things|replies|answers|your\s+(?:replies|answers|messages)))?|stay)\s+(?:more\s+)?(?:brief|briefer|concise|terse|short|shorter|tight|compact)\b|\bbrevity\b|\bno\s+sections\b|\bshort\s+(?:answers|replies|messages)\b/i;
+const ASK_BRIEF = /\b(?:be|keep(?:\s+(?:it|things|replies|responses|answers|your\s+(?:replies|responses|answers|messages)))?|stay)\s+(?:more\s+)?(?:brief|briefer|concise|terse|short|shorter|tight|compact)\b|\bbrevity\b|\bno\s+sections\b|\bshort\s+(?:answers|replies|messages)\b/i;
 const ASK_LONGER = /\b(?:be\s+(?:more\s+)?(?:detailed|thorough|verbose|longer)|(?:more|full)\s+detail|elaborate|longer\s+(?:answers|replies)|you\s+can\s+be\s+longer|in\s+depth)\b/i;
 const NEGATED_BRIEF = /\b(?:don['’]?t|do\s+not|stop\s+being|no\s+more|not\s+so|less|never)\s+(?:be\s+|being\s+|so\s+|that\s+)*(?:brief|concise|terse|short|brevity|tight)\b/i;
 /** A reply that asks for a confirmation or a choice the person must make: the question is the point, so brevity does not apply. */
@@ -31,7 +31,6 @@ function briefStyleRequested(userTexts, savedPreference) {
 }
 const HEADER = /^#{1,6}\s/m;
 const BOLD_LABEL = /(?:^|\n)\s*(?:[-*•]\s+)?\*\*[^*\n]{1,60}\*\*[ \t]*(?::|—|-|\n|$)|\*\*[^*\n]{1,60}:\*\*/;
-const SENTENCE_END = /[.!?]+(?:\s+|$)/;
 /** What is wrong with an answer that should be brief, or null when it is fine. */
 function briefStyleViolation(answer, intent) {
     // A blocked reply must say what is blocking, and a reply that asks for a confirmation or a choice must ask it.
@@ -42,9 +41,6 @@ function briefStyleViolation(answer, intent) {
         problems.push("no markdown headers or bold section labels, just plain sentences");
     if (answer.length > exports.BRIEF_MAX_CHARS)
         problems.push(`about ${exports.BRIEF_MAX_CHARS} characters at most (this one is ${answer.length})`);
-    const sentences = answer.split(SENTENCE_END).filter((part) => part.trim());
-    if (sentences.length > 1 && answer.trimEnd().endsWith("?"))
-        problems.push("no closing question tacked onto an answer; answer and stop");
     if (problems.length > 0)
         (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.brief_style_violation", message: "a reply broke the person's brevity request", meta: { problems: problems.length, length: answer.length } });
     return problems.length === 0 ? null : `the person asked you to be brief. rewrite the reply: ${problems.join("; ")}. say the answer once, in your own voice, keep every warning, uncertainty and required confirmation, cut everything else, and settle again.`;

package/dist/heart/shelf-claims.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shelfClaimError = shelfClaimError;
+exports.withShelfDisclosure = withShelfDisclosure;
+/**
+ * "On the shelf" is a promise that a title is in the house library and ready to play. A reply may make it only for a
+ * title a library lookup in this turn found there (2026-10-11: the Butler told Rachel lists were "all on the shelf"
+ * with no lookup, and named titles its own search had just shown were missing). Pure functions; the runtime calls
+ * them at settle for agents that opt in (see ToolContext.answerGates).
+ */
+const runtime_1 = require("../nerves/runtime");
+const SHELF_CLAIM = /\b(?:on\s+(?:the|our)\s+shelf|shelf[- ]ready|ready\s+to\s+(?:play|watch)|in\s+(?:the|our)\s+(?:library|jellyfin))\b/i;
+/** "isn't on the shelf", "check if it's in our library": the same words, but not a claim that something is there. */
+const NOT_A_CLAIM = /\bnot\b|n['’]t\b|\bno\s+longer\b|\bnever\b|\bif\b|\bwhether\b/i;
+/** How far before a claim a denial word still governs it ("Dune isn't on the shelf"; not "No worries, Dune is on the shelf"). */
+const DENIAL_REACH_WORDS = 4;
+const LIBRARY_LOOKUP_TOOLS = new Set(["media_search", "sanctuary_search_media_catalog"]);
+const MIN_TITLE_LENGTH = 3;
+function normalize(text) {
+    return ` ${text.toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g, "").replace(/&/g, " and ").replace(/[^\p{L}\p{N}]+/gu, " ").trim()} `;
+}
+function titlesFrom(records) {
+    const onShelf = [];
+    const offShelf = [];
+    const add = (list, title) => { if (typeof title === "string" && normalize(title).trim().length >= MIN_TITLE_LENGTH)
+        list.push({ name: title.trim(), key: normalize(title) }); };
+    for (const record of records) {
+        if (!LIBRARY_LOOKUP_TOOLS.has(record.name))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(record.result);
+        }
+        catch {
+            continue;
+        }
+        const list = (value) => (Array.isArray(value) ? value.filter((item) => item && typeof item === "object") : []);
+        for (const item of list(parsed.items))
+            add(item.on_shelf === true ? onShelf : item.on_shelf === false ? offShelf : [], item.title);
+        for (const item of list(parsed.library_matches))
+            add(item.in_jellyfin === true ? onShelf : [], item.title);
+        for (const item of list(parsed.lookup_candidates))
+            add(offShelf, item.title);
+        // The legacy catalog read lists only what is already in the library.
+        for (const item of list(parsed.data?.items))
+            add(onShelf, item.untrustedTitle);
+    }
+    return { onShelf, offShelf: offShelf.filter((title) => !onShelf.some((found) => found.key === title.key)) };
+}
+/** Null when the reply's shelf claims are backed; otherwise the titles this turn's lookup showed missing (empty: nothing found). */
+function unbackedClaim(answer, tools) {
+    const clauses = answer.split(/[.!?,;\n]+/);
+    const denied = (clause) => NOT_A_CLAIM.test(clause.slice(0, clause.search(SHELF_CLAIM)).trim().split(/\s+/).slice(-DENIAL_REACH_WORDS).join(" "));
+    if (!clauses.some((clause) => SHELF_CLAIM.test(clause) && !denied(clause)))
+        return null;
+    // Titles count from everything but the denials, so "Dune isn't on the shelf" never reads as a claim about Dune.
+    const said = normalize(clauses.filter((clause) => !SHELF_CLAIM.test(clause) || !denied(clause)).join(" "));
+    const { onShelf, offShelf } = titlesFrom(tools);
+    const missing = offShelf.filter((title) => said.includes(title.key)).map((title) => title.name);
+    return onShelf.some((title) => said.includes(title.key)) && missing.length === 0 ? null : { missing };
+}
+/** The correction for a reply that says something is on the shelf without this turn's lookup finding it there, or null. */
+function shelfClaimError(answer, tools) {
+    const claim = unbackedClaim(answer, tools);
+    if (!claim)
+        return null;
+    (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.shelf_claim_unbacked", message: "a reply said something is on the shelf that no lookup this turn found there", meta: { missing: claim.missing.length } });
+    const why = claim.missing.length > 0
+        ? `your library lookup this turn shows ${claim.missing.join(", ")} not on the shelf`
+        : "no library lookup this turn found what you named";
+    return `you said something is on the shelf, but ${why}. say "on the shelf" only for a title a lookup in this turn found there. otherwise say it plainly, like "I can check if we have it", or look it up first.`;
+}
+/** An unbacked shelf claim that survived its retry goes out with the truth in front: what the lookup showed missing, or that nothing was checked. */
+function withShelfDisclosure(answer, tools) {
+    const { missing } = unbackedClaim(answer, tools);
+    const note = missing.length > 0 ? `My lookup shows ${missing.join(", ")} isn't on the shelf.` : "I haven't checked the library for that yet, so I can't promise it's on the shelf.";
+    return `${note}\n\n${answer}`;
+}

package/dist/senses/sanctuary-media-catalog-contract.js

@@ -5,10 +5,8 @@ const runtime_1 = require("../nerves/runtime");
 const sanctuary_media_optimization_1 = require("./sanctuary-media-optimization");
 const LEGACY_CATALOG_TOOL = "sanctuary_search_media_catalog";
 const MEDIA_SEARCH_TOOL = "media_search";
-const MEDIA_REQUEST_TOOL = "media_request";
 const HOUSEHOLD_JARGON = /\b(?:bounded|catalog|inventory|endpoint|backend|data shape|pars(?:e|ed|ing)|json|jellyfin|unmanic|sanctuary_search_media_catalog)\b/iu;
 const NEGATED_MEDIA_ACCESS = /\b(?:not|never|none|nothing|zero|inaccessible|invisible|unavailable|broken|failed|failing)\b|\b(?:isn[’']t|won[’']t)\b|\bno\s+access\b|\b(?:lost|lacks?|lacking|without)\s+access\b|\bonly\s+\d|\bfewer\s+than\b|\bsome\s+of\b|\b(?:part|portion|subset)\s+of\b|\bi\s+(?:can(?:not|[’']t)|do\s+not|don[’']t|have\s+no)\b|\bi[’']m\s+not\b/iu;
-const UNSOLICITED_PIVOT = /\b(?:what would you like|what are you in the mood for|would you like me to|do you want me to|want me to|recommend we add)\b/iu;
 const REPORT_LABEL = /(?:^|\n)\s*(?:version|house|the house|render check|status|result)\s*:/iu;
 const TITLE_LIST_GLUE = new Set(["and", "are", "catalog", "film", "films", "from", "have", "here", "in", "is", "library", "movie", "movies", "on", "shelf", "show", "shows", "the", "these", "titles", "we"]);
 const COUNT_ANSWER_GLUE = new Set(["and", "are", "currently", "episodes", "film", "films", "have", "in", "items", "library", "movie", "movies", "on", "shelf", "show", "shows", "the", "there", "tv", "we"]);
@@ -86,7 +84,6 @@ function parseCatalogEvidence(result, args) {
             totalItems: parsed.data.totalItems,
             matchedItems: parsed.data.matchedItems,
             titles,
-            offShelfTitles: [],
             fromMediaSearch: false,
         };
     }
@@ -105,7 +102,6 @@ function parseMediaSearchEvidence(result, args) {
         if (!Number.isSafeInteger(parsed.matched) || !Array.isArray(parsed.items))
             return null;
         const titles = [];
-        const offShelfTitles = [];
         for (const entry of parsed.items) {
             if (!entry || typeof entry !== "object" || Array.isArray(entry))
                 continue;
@@ -113,15 +109,12 @@ function parseMediaSearchEvidence(result, args) {
             if (typeof item.title !== "string" || !item.title.trim())
                 continue;
             titles.push(item.title.trim());
-            if (item.on_shelf === false)
-                offShelfTitles.push(item.title.trim());
         }
         return {
             query: (0, sanctuary_media_optimization_1.normalizeSanctuaryMediaText)(args.query ?? ""),
             totalItems: parsed.matched,
             matchedItems: parsed.matched,
             titles,
-            offShelfTitles,
             fromMediaSearch: true,
         };
     }
@@ -150,14 +143,9 @@ function hasGroundedFirstPersonVisibility(answer, formattedCount) {
     return firstPersonAccess.some((pattern) => pattern.test(answer)) && groundedCount.test(answer);
 }
 function commonAnswerRejection(answer, technicalDetailRequested) {
-    if (/\b(?:just|only|actually|merely)\s+(?:a\s+)?(?:bot|ai|assistant)\b|\bi\s+(?:can[’']?t|cannot|don[’']?t|do not)\s+(?:actually\s+)?watch\b|\bif i had to pick\b/iu.test(answer)) {
-        return "Answer from the catalog evidence with a confident, personable choice; do not retreat into an AI or 'I cannot watch' disclaimer.";
-    }
     if (/\b(?:you'?d|you\s+would|you\s+need\s+to|please)\b.*\b(?:check|look at|poke|nudge)\b.*\b(?:log|logs|dashboard|jellyfin|unmanic)\b/iu.test(answer)) {
         return "Do not send Ari to check Jellyfin, Unmanic, dashboards, or logs for ordinary library visibility while safe catalog tools are available. Use the catalog evidence, or if the catalog read itself fails, say exactly what I could and could not verify.";
     }
-    if (UNSOLICITED_PIVOT.test(answer))
-        return "Answer the media question that was asked, then stop; do not append an unsolicited question or recommendation pivot.";
     if (REPORT_LABEL.test(answer))
         return "Answer conversationally; do not use status-report labels such as version:, house:, render check:, status:, or result:.";
     if (!technicalDetailRequested && HOUSEHOLD_JARGON.test(answer))
@@ -168,7 +156,6 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
     // Prefer media_search when the media surface is installed: it grounds both what is
     // on the shelf and what is worth adding. Fall back to the legacy restricted read.
     const catalogTool = advertisedToolNames.includes(MEDIA_SEARCH_TOOL) ? MEDIA_SEARCH_TOOL : LEGACY_CATALOG_TOOL;
-    const canRequestMedia = advertisedToolNames.includes(MEDIA_REQUEST_TOOL);
     if (!advertisedToolNames.includes(catalogTool))
         return undefined;
     const normalized = (0, sanctuary_media_optimization_1.normalizeSanctuaryMediaText)(request);
@@ -181,9 +168,12 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
     if (operationalOnly || (!mentionsMedia && !requestedTitleQuery) || !asksCatalog)
         return undefined;
     const kind = requestKind(normalized, requestedTitleQuery);
-    const asksForAddition = /\b(?:add|missing from|must get)\b/u.test(normalized);
     const asksForCount = /\b(?:how many|count)\b/u.test(normalized);
     const listCount = requestedListCount(normalized);
+    // Picking something to watch is a conversation, not a catalog read. Forcing a lookup and a title into every reply threw away
+    // the greeting and the questions (2026-10-11, Rach handoff); the shelf-claim answer gate holds whatever a reply says is on the shelf.
+    if (kind === "taste_recommendation" || (kind === "other" && !listCount && !asksForCount))
+        return undefined;
     const technicalDetailRequested = /\b(?:technical|technically|implementation|endpoint|backend|debug|detail|internals?)\b/u.test(normalized);
     let latestEvidence;
     const names = [catalogTool];
@@ -202,11 +192,7 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
                 ? `Use ${catalogTool} before answering. Lead with the direct answer from current catalog evidence, report the shelf count in ordinary household language, and stop without sampled titles or a follow-up question.`
                 : kind === "title_lookup"
                     ? `Use ${catalogTool} with the requested title before answering. Confirm its presence or absence directly from current catalog evidence.`
-                    : kind === "taste_recommendation"
-                        ? `Use ${catalogTool} before answering. Make one concise, decisive choice grounded in returned catalog evidence; do not volunteer an AI or 'I cannot watch' disclaimer.`
-                        : listCount
-                            ? `Use ${catalogTool} with limit ${listCount} before answering, then name exactly the returned catalog titles.`
-                            : `Use ${catalogTool} before answering and base any named titles on the returned catalog evidence.`,
+                    : `Use ${catalogTool} with limit ${listCount} before answering, then name exactly the returned catalog titles.`,
         validateRequiredToolResult(name, result, args) {
             if (name !== catalogTool)
                 return false;
@@ -224,10 +210,6 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
                 return "Search for the requested title by name before answering whether it is on the shelf.";
             if (kind === "title_lookup" && query !== requestedTitleQuery)
                 return `Search for the requested title ${requestedTitleQuery} before answering whether it is on the shelf.`;
-            // media_search browses by genre, keyword and year and reports shelf state per
-            // title, so an addition question does not need a per-candidate title query.
-            if (asksForAddition && !query && catalogTool !== MEDIA_SEARCH_TOOL)
-                return "Search for one candidate title by name before recommending it as an addition.";
             if (listCount && Number(args.limit) !== listCount && catalogTool !== MEDIA_SEARCH_TOOL)
                 return `Set the catalog limit to ${listCount} so the answer is grounded in exactly the requested number of titles.`;
             return undefined;
@@ -264,26 +246,6 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
                 if (!includesNormalizedPhrase(answer, requestedTitleQuery))
                     return "Name the requested title in the direct answer.";
             }
-            if (kind === "taste_recommendation" && latest) {
-                if (asksForAddition) {
-                    if (latest.fromMediaSearch) {
-                        // media_search states shelf membership per title, so a recommendation is
-                        // grounded when the named candidate came back marked absent.
-                        if (!latest.offShelfTitles.some((title) => includesNormalizedPhrase(answer, title))) {
-                            return "Recommend only a title the current search returned as not on the shelf.";
-                        }
-                    }
-                    else if (!latest.query || latest.matchedItems !== 0 || !includesNormalizedPhrase(answer, latest.query)) {
-                        return "Recommend an addition only after an exact current catalog search shows that candidate is absent.";
-                    }
-                    if (!canRequestMedia && /\b(?:i|we)\s+(?:added|requested|submitted|queued)\b/iu.test(answer)) {
-                        return "Do not claim the title was added or requested when no media-request action was available.";
-                    }
-                }
-                else if (!latest.titles.some((title) => includesNormalizedPhrase(answer, title))) {
-                    return "Make the choice from a title returned by the current catalog evidence.";
-                }
-            }
             if (kind === "other" && latest) {
                 if (!latest.fromMediaSearch)
                     return catalogTitleGroundingRejection(answer, latest, listCount);

package/dist/senses/sanctuary-runtime.js

@@ -301,8 +301,8 @@ function createSanctuaryToolContext(agentName) {
     });
     return {
         agentRoot,
-        // The Sanctuary profile opts in to the settle-time checks: replies about a work are held to what the turn looked up, and a brevity request is honored.
-        answerGates: { sourceGrounding: true, brevity: true },
+        // The Sanctuary profile opts in to the settle-time checks: replies about a work are held to what the turn looked up, "on the shelf" to what a library lookup found, and a brevity request is honored.
+        answerGates: { sourceGrounding: true, brevity: true, shelfClaims: true },
         sanctuary: {
             // The model-facing list carries the steward policy's desired state beside docker's: a container kept stopped on purpose is not a fault. The restart path reads the plain list.
             listContainers: acceptanceRead("unraid_list_containers", async (signal) => (0, sanctuary_container_policy_1.annotateContainers)(signal ? await reads.listContainers(signal) : await reads.listContainers(), currentStewardPolicy(agentRoot), Date.now())),

package/dist/senses/telegram-handoff.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OWNER_CHAT_HANDOFF_MS = void 0;
+exports.ownerChatHandedOff = ownerChatHandedOff;
+exports.readHeldNotices = readHeldNotices;
+exports.writeHeldNotices = writeHeldNotices;
+/**
+ * Ari sometimes hands his Telegram chat to someone else ("I'm going to hand you to my wife, Rachel"). For a while after that,
+ * the chat is that person's conversation, so house notices (an outage, a recovery) wait instead of landing in it
+ * (2026-10-11: two Jellyfin outage notes went into Rachel's movie chat). The window runs until the chat has been quiet for two
+ * hours, so a long conversation is never interrupted. Pure functions plus a small held-notice file; the Telegram sense wires them in.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const session_events_1 = require("../heart/session-events");
+const runtime_1 = require("../nerves/runtime");
+exports.OWNER_CHAT_HANDOFF_MS = 2 * 60 * 60 * 1000;
+const HANDOFF_CUE = /\b(?:hand(?:ing)?|pass(?:ing)?)\s+you\s+(?:(?:over|off)\s+)?to\b|\bsay\s+(?:hi|hello)\s+to\s+(?:her|him|them)\b/i;
+/** True when the owner's chat was handed to someone else and has had a message from them within the window. */
+function ownerChatHandedOff(events, now) {
+    let lastMessageAt = null;
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.role !== "user")
+            continue;
+        lastMessageAt ??= Date.parse(event.time.observedAt ?? event.time.recordedAt);
+        if (HANDOFF_CUE.test((0, session_events_1.extractEventText)(event)))
+            return Number.isFinite(lastMessageAt) && now - lastMessageAt < exports.OWNER_CHAT_HANDOFF_MS;
+    }
+    return false;
+}
+function readHeldNotices(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        return Array.isArray(parsed) ? parsed.filter((entry) => typeof entry?.key === "string" && typeof entry?.text === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeHeldNotices(filePath, notices) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const temporary = `${filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, JSON.stringify(notices), { mode: 0o600 });
+    fs.renameSync(temporary, filePath);
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.telegram_held_notices_saved", message: "saved the house notices held during a handoff", meta: { held: notices.length } });
+}

package/dist/senses/telegram.js

@@ -85,6 +85,7 @@ const sanctuary_grounding_1 = require("./sanctuary-grounding");
 const telegram_approval_runtime_1 = require("./telegram-approval-runtime");
 const telegram_audit_ledger_1 = require("./telegram-audit-ledger");
 const session_events_1 = require("../heart/session-events");
+const telegram_handoff_1 = require("./telegram-handoff");
 const router_1 = require("../heart/external-events/router");
 const session_transaction_1 = require("../mind/session-transaction");
 const approval_files_1 = require("../heart/approval-files");
@@ -1128,6 +1129,45 @@ function createTelegramSenseApp(options) {
             ...(onMessageDelivered ? { onMessageDelivered } : {}),
         });
     };
+    // House notices wait while Ari's chat is handed to someone else, then go out with the next notice, message or reconcile pass
+    // (see telegram-handoff). Releases run one at a time so two callers never send the same held notice twice, and a notice leaves the
+    // held file before it is sent: from then on the effect journal owns it, exactly like a notice that was never held.
+    const heldNoticesPath = path.join(agentRoot, "state", "telegram", "held-owner-notices.json");
+    const ownerChatIsHandedOff = () => {
+        const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
+        return (0, telegram_handoff_1.ownerChatHandedOff)((0, session_events_1.loadSessionEnvelopeFile)(sessionPath)?.events ?? [], Date.now());
+    };
+    const holdNoticeDuringHandoff = (text, key) => {
+        if (!ownerChatIsHandedOff())
+            return false;
+        const held = (0, telegram_handoff_1.readHeldNotices)(heldNoticesPath);
+        if (!held.some((notice) => notice.key === key))
+            (0, telegram_handoff_1.writeHeldNotices)(heldNoticesPath, [...held, { key, text }]);
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.telegram_notice_held_for_handoff", message: "held a house notice while the owner's chat is handed to someone else", meta: { agentName: options.agentName } });
+        return true;
+    };
+    let heldNoticeRelease = Promise.resolve();
+    const releaseHeldNotices = async (signal) => {
+        // Nearly always nothing is held: return without queueing, so ordinary turns and the reconcile tick pay nothing.
+        if ((0, telegram_handoff_1.readHeldNotices)(heldNoticesPath).length === 0)
+            return;
+        const release = heldNoticeRelease.then(async () => {
+            const held = (0, telegram_handoff_1.readHeldNotices)(heldNoticesPath);
+            if (ownerChatIsHandedOff())
+                return;
+            const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
+            for (const notice of held) {
+                (0, telegram_handoff_1.writeHeldNotices)(heldNoticesPath, (0, telegram_handoff_1.readHeldNotices)(heldNoticesPath).filter((entry) => entry.key !== notice.key));
+                await recordAcceptedEffects(sessionPath, [await deliverButlerEffect(notice.text, notice.key, signal)]);
+            }
+        });
+        heldNoticeRelease = release.catch(() => undefined);
+        await release;
+    };
+    /** For callers that must not fail because a held notice failed to send; the effect journal keeps the failed send. */
+    const releaseHeldNoticesQuietly = () => releaseHeldNotices().catch((error) => {
+        (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.telegram_held_notice_release_error", message: "a held house notice failed to send; the effect journal has it", meta: { agentName: options.agentName, subject, error: transportError(error) } });
+    });
     recordAcceptedEffects = async (sessionPath, artifacts, bootstrapInbound, causalEventIds) => {
         await (0, telegram_effect_adapter_1.recordTelegramEffectsInSession)({ store: getEffectJournal(), sessionPath, artifacts, ...(bootstrapInbound ? { inbound: bootstrapInbound } : {}), ...(causalEventIds ? { causalEventIds } : {}) });
         for (const artifact of artifacts) {
@@ -1179,6 +1219,7 @@ function createTelegramSenseApp(options) {
     });
     const failsafeScanCache = new router_1.ExternalEventScanCache();
     reconcileSystemFailsafes = async () => {
+        await releaseHeldNoticesQuietly();
         if (!options.privilegedFailsafe)
             return;
         const target = configuredOwnerTarget();
@@ -1503,6 +1544,7 @@ function createTelegramSenseApp(options) {
         const turnEffects = [];
         let deliveryOrdinal = 0;
         await recoverEffectOutbox();
+        await releaseHeldNoticesQuietly();
         let ingressRelations = { replyToEventId: null, threadRootEventId: null, references: [inboundReference] };
         if (message.replyToMessageId && /^[1-9][0-9]*$/u.test(message.replyToMessageId)) {
             const replyMessageId = Number(message.replyToMessageId);
@@ -1902,7 +1944,11 @@ function createTelegramSenseApp(options) {
                     });
                     return;
                 }
-                const effect = await deliverButlerEffect(proactiveText, `proactive:${(0, node_crypto_1.randomUUID)()}`, signal);
+                const key = `proactive:${(0, node_crypto_1.randomUUID)()}`;
+                if (holdNoticeDuringHandoff(proactiveText, key))
+                    return;
+                await releaseHeldNotices(signal);
+                const effect = await deliverButlerEffect(proactiveText, key, signal);
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 await recordAcceptedEffects(sessionPath, [effect]);
             });
@@ -1914,7 +1960,11 @@ function createTelegramSenseApp(options) {
                 throw new Error("Telegram external event identity is invalid");
             await runWithAcceptanceAuditOwner(async () => {
                 const receiptIdentity = JSON.stringify([source, eventId, input.generation]);
-                const effect = await deliverButlerEffect(requiredText(input.text, "external event decision"), `external-event:${receiptIdentity}`, input.signal);
+                const text = requiredText(input.text, "external event decision");
+                if (holdNoticeDuringHandoff(text, `external-event:${receiptIdentity}`))
+                    return;
+                await releaseHeldNotices(input.signal);
+                const effect = await deliverButlerEffect(text, `external-event:${receiptIdentity}`, input.signal);
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 await recordAcceptedEffects(sessionPath, [effect]);
             });
@@ -1927,7 +1977,11 @@ function createTelegramSenseApp(options) {
             if (Buffer.byteLength(noticeId) > 512)
                 throw new Error("Telegram owner notice id is invalid");
             await runWithAcceptanceAuditOwner(async () => {
-                const effect = await deliverButlerEffect(requiredText(input.text, "owner notice"), `owner-notice:${noticeId}`, input.signal);
+                const text = requiredText(input.text, "owner notice");
+                if (holdNoticeDuringHandoff(text, `owner-notice:${noticeId}`))
+                    return;
+                await releaseHeldNotices(input.signal);
+                const effect = await deliverButlerEffect(text, `owner-notice:${noticeId}`, input.signal);
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 await recordAcceptedEffects(sessionPath, [effect]);
             });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.903",
+  "version": "0.1.0-alpha.904",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.903",
+      "version": "0.1.0-alpha.904",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.903",
+  "version": "0.1.0-alpha.904",
   "engines": {
     "node": ">=22"
   },