polygram 0.10.0-rc.41 → 0.10.0-rc.43

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.10.0-rc.41",
+  "version": "0.10.0-rc.43",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/process/hook-event-tail.js

@@ -121,15 +121,26 @@ function pipeHookParser(tail) {
 
 /**
  * One-shot helper: build a LogTail at the given path with the
- * H1-typical config (watch mode, no skipExisting because a fresh
- * spawn's ndjson is empty), wire the hook parser, and return it.
- * Caller calls `.start()` and `.on('event', ...)`.
+ * H1-typical config (watch mode), wire the hook parser, and return
+ * it. Caller calls `.start()` and `.on('event', ...)`.
+ *
+ * `skipExisting`:
+ *   - false (default) for a FRESH spawn — the ndjson was just
+ *     touched at start time and is empty, so any future write IS a
+ *     new event.
+ *   - true for a `--resume` spawn — `writeHookFiles` uses 'a' mode
+ *     (append) and never truncates, so the prior session's hook
+ *     events are still on disk. Without skipExisting they replay
+ *     into the fresh process, arming a Stop synth against the
+ *     fresh turn (H4) and heartbeating it (H3) from stale events.
+ *     rc.42 #5 (review-driven): mirror what `_armSessionLogTail`
+ *     already does for the JSONL tail.
  */
-function createHookTail({ path: filePath, logger = console } = {}) {
+function createHookTail({ path: filePath, skipExisting = false, logger = console } = {}) {
   const tail = new LogTail({
     path: filePath,
     intervalMs: 50,
-    skipExisting: false,
+    skipExisting,
     useWatch: 'auto',
     logger,
   });

package/lib/process/tmux-process.js

@@ -225,6 +225,32 @@ const DEFAULT_STOP_GRACE_MS    = 2_000;               // 2 s
 // block, but `_waitForReady` runs only at startup before any turn).
 const DEFAULT_READY_DEBUG_QUIET_MS = 1000;
 
+// rc.43 (shumorobot Music topic, 2026-05-22 21:11): claude TUI on
+// `--resume` of a session that has crossed an age/token threshold
+// (~8h / ~120k tokens observed) renders an INTERACTIVE menu instead
+// of the chat input:
+//
+//   This session is 8h 38m old and 117.6k tokens.
+//   Resuming the full session will consume a substantial portion of
+//   your usage limits. We recommend resuming from a summary.
+//   ❯ 1. Resume from summary (recommended)
+//     2. Resume full session as-is
+//     3. Don't ask me again
+//   Enter to confirm · Esc to cancel
+//
+// `_waitForReady` doesn't recognise this menu — there's no
+// `? for shortcuts` / `accept edits on` / `bypass permissions on`
+// hint visible. It times out at `readyTimeoutMs` (120 s) and polygram
+// fails the user's message with a generic "TUI did not signal ready"
+// error. Detection in the pane and pressing Enter dismisses the menu
+// (selects option 1 = resume from summary, the safe default).
+//
+// The detection regex matches a distinctive substring from the menu
+// header that doesn't appear during normal turns or other startup
+// banners — looking for the literal "Resume from summary" option
+// combined with the "Resuming the full session" rationale.
+const SESSION_AGE_PROMPT_RE = /Resuming the full session.*Resume from summary/s;
+
 // R7: sentinel returned by _awaitTurnComplete when its poll loop is
 // stopped by the caller's absolute-deadline abort (rather than by a
 // real READY quiescence or its own internal timeout). _runTurn maps
@@ -302,6 +328,22 @@ class TmuxProcess extends Process {
 
     // Tunables
     this.readyTimeoutMs = readyTimeoutMs;
+    // rc.42 #7 (review-driven): validate timer config at construction
+    // so a misconfigured process fails loud here instead of silently
+    // mid-turn (NaN → setInterval ≈1 ms spin; 0/negative → instant
+    // idle-timeout).
+    for (const [name, v] of [
+      ['turnTimeoutMs', turnTimeoutMs],
+      ['hardBackstopMs', hardBackstopMs],
+      ['stopGraceMs', stopGraceMs],
+    ]) {
+      if (!Number.isFinite(v) || v < 0) {
+        throw Object.assign(
+          new TypeError(`TmuxProcess: ${name} must be a finite non-negative number (got ${v})`),
+          { code: 'TMUX_INVALID_TIMEOUT_CONFIG', field: name, value: v },
+        );
+      }
+    }
     this.turnTimeoutMs = turnTimeoutMs;
     this.hardBackstopMs = hardBackstopMs;
     this.stopGraceMs = stopGraceMs;
@@ -645,8 +687,10 @@ class TmuxProcess extends Process {
         this._armSessionLogTail({ resuming: Boolean(ctx.existingSessionId) });
         // H1 — same-pattern hook tail. Only arm when the settings
         // write succeeded above (otherwise there's nothing to tail).
+        // rc.42 #5: on `--resume`, pass skipExisting through so
+        // prior-process hook events aren't replayed into this turn.
         if (this._hookNdjsonPath) {
-          this._armHookTail();
+          this._armHookTail({ resuming: Boolean(ctx.existingSessionId) });
         }
 
         // G6 — block until TUI is responsive.
@@ -777,7 +821,22 @@ class TmuxProcess extends Process {
     this.inFlight = true;
     turn.state = 'pasted';
     turn.startedAt = this._now();
-    const turnTimeoutMs = turn.opts.timeoutMs || this.turnTimeoutMs;
+    // rc.42 #7 (review-driven): validate the resolved turnTimeoutMs.
+    // NaN would coerce setInterval cadence to ≈1 ms (spin-loop);
+    // 0 or negative would trip the idle-ceiling on the first poll.
+    // Neither is reachable via current defaults, but a config override
+    // can produce them. Fall back to the instance default (already
+    // validated as a finite positive number at construction time).
+    const rawTimeoutMs = turn.opts.timeoutMs || this.turnTimeoutMs;
+    const turnTimeoutMs = (Number.isFinite(rawTimeoutMs) && rawTimeoutMs > 0)
+      ? rawTimeoutMs
+      : this.turnTimeoutMs;
+    if (turnTimeoutMs !== rawTimeoutMs) {
+      this.logger.warn?.(
+        `[${this.label}] invalid turn timeoutMs (${rawTimeoutMs}); `
+        + `falling back to ${turnTimeoutMs} ms`,
+      );
+    }
     // Internal turn-done signal — settled by _flushActiveGroup when
     // this turn's group is flushed on a terminal `result`.
     turn.resultPromise = new Promise((resolve) => { turn.settleResult = resolve; });
@@ -845,15 +904,46 @@ class TmuxProcess extends Process {
       //                   outstanding (subsumes B10 — capture can no
       //                   longer settle a turn mid-subagent, so the old
       //                   nested re-wait is unnecessary)
-      //   - timeout     : W1 absolute deadline (one setTimeout, not a
-      //                   racer)
+      //   - timeout     : EITHER idle-ceiling poller (#5a) OR
+      //                   hard-backstop setTimeout (#5b) — see H3
+      //                   in `_awaitSettle`. The `reason` field on
+      //                   the outcome carries which racer fired so
+      //                   operators can distinguish a wedged-silent
+      //                   turn (idle-ceiling) from a 4-hour runaway
+      //                   tool loop (hard-backstop).
       const outcome = await this._awaitSettle(turn, { turnTimeoutMs, confirmP });
 
       if (outcome.kind === 'submit-fail') throw outcome.err;
       if (outcome.kind === 'timeout') {
+        // rc.42 #1 (review-driven): thread the racer-specific
+        // `reason` + observed `idleMs` onto the thrown Error AND
+        // emit a `turn-timeout` event (mirrors sdk-process.js's
+        // pattern at line 532) so the events DB records WHICH
+        // racer fired. Pre-rc.42 the diagnostic value of H3 was
+        // silently dropped — operators couldn't distinguish a
+        // wedged-silent subagent (idle-ceiling) from a 4-hour
+        // runaway tool loop (hard-backstop).
+        this.logger.warn?.(
+          `[${this.label}] turn timeout (${outcome.reason || 'unknown'}`
+          + `${outcome.idleMs != null ? `, idle ${Math.round(outcome.idleMs)} ms` : ''})`,
+        );
+        this.emit('turn-timeout', {
+          turnId: turn.turnId,
+          reason: outcome.reason || null,
+          idleMs: outcome.idleMs ?? null,
+          turnTimeoutMs,
+          hardBackstopMs: this.hardBackstopMs,
+          sessionId: this.claudeSessionId,
+          backend: 'tmux',
+        });
         throw Object.assign(
           new Error('TmuxProcess: turn did not complete in time'),
-          { code: 'TMUX_TURN_TIMEOUT', tmuxName: this.tmuxName },
+          {
+            code: 'TMUX_TURN_TIMEOUT',
+            tmuxName: this.tmuxName,
+            reason: outcome.reason || null,
+            idleMs: outcome.idleMs ?? null,
+          },
         );
       }
 
@@ -877,6 +967,20 @@ class TmuxProcess extends Process {
         resultSubtype = outcome.ev.subtype || 'success';
         stopReason = outcome.ev.stopReason || null;
         if (outcome.ev.sessionId) this.claudeSessionId = outcome.ev.sessionId;
+        // rc.42 #15 (review-driven): if the settle came via the H4
+        // Stop-hook synth (not the JSONL `result`), surface that
+        // distinction. Track it on `resolvedVia` so the result event
+        // downstream consumers see the provenance, and emit a
+        // `stop-hook-resolved` event for forensic count of how often
+        // Stop actually rescued a JSONL-stuck turn.
+        if (outcome.ev.via === 'stop-hook') {
+          resolvedVia = 'stop-hook';
+          this.emit('stop-hook-resolved', {
+            turnId: turn.turnId,
+            sessionId: this.claudeSessionId,
+            backend: 'tmux',
+          });
+        }
         // R10: a genuinely-empty terminal `result` — end_turn, no
         // reply text, AND no tool ran this turn — is the agent
         // producing literally nothing (a thinking-only terminal
@@ -1048,7 +1152,12 @@ class TmuxProcess extends Process {
    *                                TMUX_SUBMIT_FAILED (B7)
    *   { kind: 'quiesced' }       — capture-pane idle AND the predicate
    *                                says it is SAFE to conclude
-   *   { kind: 'timeout' }        — W1 absolute deadline
+   *   { kind: 'timeout',
+   *     reason: 'idle-ceiling'    — H3 idle-poller (#5a)
+   *           | 'hard-backstop'   — H3 absolute backstop (#5b)
+   *           | 'idle-poller-error' — defensive: throw inside the
+   *                                   idle-poller callback (rc.42 #3)
+   *     idleMs? }                 — observed idle for idle-ceiling
    *
    * The structural win over the old race:
    *   - B7 gate: capture quiescence is ignored until
@@ -1149,9 +1258,21 @@ class TmuxProcess extends Process {
         Math.min(IDLE_POLL_INTERVAL_MS, Math.floor(turnTimeoutMs / 4)),
       );
       idlePoller = setInterval(() => {
-        const idleMs = this._now() - turn.lastActivityAt;
-        if (idleMs >= turnTimeoutMs) {
-          finish({ kind: 'timeout', reason: 'idle-ceiling', idleMs });
+        // rc.42 #3 (review-driven): try/catch around the body.
+        // Adaptive poll cadence can fire as often as every 50 ms;
+        // a repeating throw here would trip process-guard's
+        // 100-in-5s sliding-window panicExit(2) and kill the
+        // daemon. Catch + finish-on-error fails fast instead.
+        try {
+          const idleMs = this._now() - turn.lastActivityAt;
+          if (idleMs >= turnTimeoutMs) {
+            finish({ kind: 'timeout', reason: 'idle-ceiling', idleMs });
+          }
+        } catch (err) {
+          this.logger.warn?.(
+            `[${this.label}] idle-poller error: ${err.message}`,
+          );
+          finish({ kind: 'timeout', reason: 'idle-poller-error' });
         }
       }, pollIntervalMs);
       idlePoller.unref?.();
@@ -1164,10 +1285,19 @@ class TmuxProcess extends Process {
       //     from turn start.
       const backstopRemaining = Math.max(
         0, (turn.startedAt + this.hardBackstopMs) - this._now());
-      hardBackstopTimer = setTimeout(
-        () => finish({ kind: 'timeout', reason: 'hard-backstop' }),
-        backstopRemaining,
-      );
+      // rc.42 #3 (review-driven): try/catch in the one-shot
+      // setTimeout callback. Symmetric with the idle-poller +
+      // Stop-synth fixes — protects against any future change
+      // that introduces a throw surface here.
+      hardBackstopTimer = setTimeout(() => {
+        try {
+          finish({ kind: 'timeout', reason: 'hard-backstop' });
+        } catch (err) {
+          this.logger.warn?.(
+            `[${this.label}] hard-backstop error: ${err.message}`,
+          );
+        }
+      }, backstopRemaining);
       hardBackstopTimer.unref?.();
     });
   }
@@ -1188,6 +1318,15 @@ class TmuxProcess extends Process {
     // rejects in `_runTurn`, never resolving `resultPromise`) would
     // otherwise leave a dangling Map entry. Defensive + cheap.
     if (turn?.token) this._submitConfirms.delete(turn.token);
+    // rc.42 #6 (review-driven): clear the H4 Stop-synth setTimeout
+    // when the turn retires through any other path. Idempotency
+    // makes a post-retirement settleResult call harmless, but the
+    // timer handle would otherwise sit in the event loop for up to
+    // `stopGraceMs` past the turn's death.
+    if (turn?._stopSynthTimer) {
+      clearTimeout(turn._stopSynthTimer);
+      turn._stopSynthTimer = null;
+    }
     const qi = this.pendingQueue.indexOf(turn);
     if (qi >= 0) this.pendingQueue.splice(qi, 1);
     this._dropFromActiveGroup(turn);
@@ -1595,16 +1734,36 @@ class TmuxProcess extends Process {
    *
    * See docs/0.10.0-tmux-hook-observability.md.
    */
-  _armHookTail() {
+  _armHookTail({ resuming = false } = {}) {
     if (this._hookTail) return; // idempotent
     if (!this._hookNdjsonPath) {
       this.logger.warn?.(`[${this.label}] _armHookTail: no ndjson path, skipping`);
       return;
     }
-    const tail = createHookTail({ path: this._hookNdjsonPath, logger: this.logger });
+    // rc.42 #5 (review-driven): on `--resume`, the per-session hook
+    // ndjson kept by `writeHookFiles` (opened in append mode) still
+    // carries the prior process's events. `skipExisting:true`
+    // mirrors `_armSessionLogTail`'s handling so historic Stop
+    // events don't replay into the fresh turn (would arm a synth
+    // settle on a freshly-pasted prompt with stale text) and stale
+    // heartbeats don't reset the new turn's idle clock.
+    const tail = createHookTail({
+      path: this._hookNdjsonPath,
+      skipExisting: resuming,
+      logger: this.logger,
+    });
     tail.on('event', (ev) => this._handleHookEvent(ev));
     tail.on('error', (err) => {
       this.logger.warn?.(`[${this.label}] hook-tail error: ${err.message}`);
+      // rc.42 #8 (review-driven): make the tail-degradation
+      // observable so msg-884-shaped silent regressions surface in
+      // the events DB instead of just the daemon log.
+      this.emit('hook-tail-error', {
+        message: err.message,
+        path: this._hookNdjsonPath,
+        sessionId: this.claudeSessionId,
+        backend: 'tmux',
+      });
     });
     tail.start();
     this._hookTail = tail;
@@ -1635,54 +1794,97 @@ class TmuxProcess extends Process {
    * forwarded — observer-only metrics for stream-reliability soak.
    */
   _handleHookEvent(ev) {
-    // H3: every hook event (except the diagnostic types) is liveness
-    // evidence. Heartbeat every turn we can identify as in-flight so
-    // the idle-ceiling poller resets. We don't differentiate by event
-    // type — even Notification or UserPromptSubmit prove claude is
-    // active in this session.
-    //
-    // Two scopes are searched (deduped via Set): active group turns
-    // (the steady state once `user-message` has landed) AND the
-    // pendingQueue head (the PRE-active window between turn start
-    // and the first `user-message`). Hook events can fire in either
-    // window — e.g. `UserPromptSubmit` arrives just after claude
-    // receives the paste but BEFORE the `user-message` is echoed
-    // back into the JSONL. Without the pendingQueue fallback, that
-    // window leaves the turn un-heartbeated and the idle poller
-    // could fire on a turn that's actively starting up.
-    if (ev?.type && ev.type !== 'parse-error' && ev.type !== 'unknown') {
-      const turns = new Set(this._activeGroup?.turns || []);
-      const head = this.pendingQueue[0];
-      if (head) turns.add(head);
-      for (const t of turns) {
-        this._heartbeat(t, `hook:${ev.type}`);
+    // rc.42 #2 (review-driven): wrap the whole body in try/catch.
+    // pipeHookParser emits 'event' synchronously inside LogTail's
+    // `for (const line of parts)` loop in _readNew; a throw here
+    // would propagate back into that loop AFTER _offset is already
+    // advanced past the unread lines, silently dropping every
+    // remaining line in the batch. With H3 making hook events
+    // load-bearing for liveness, lost events cause false idle
+    // timeouts. Catch + warn + continue keeps the rest of the
+    // batch flowing.
+    try {
+      // H3: every hook event (except the diagnostic types) is liveness
+      // evidence. Heartbeat every turn we can identify as in-flight so
+      // the idle-ceiling poller resets. We don't differentiate by event
+      // type — even Notification or UserPromptSubmit prove claude is
+      // active in this session.
+      //
+      // Two scopes are searched (deduped via Set): active group turns
+      // (the steady state once `user-message` has landed) AND the
+      // pendingQueue head (the PRE-active window between turn start
+      // and the first `user-message`). Hook events can fire in either
+      // window — e.g. `UserPromptSubmit` arrives just after claude
+      // receives the paste but BEFORE the `user-message` is echoed
+      // back into the JSONL. Without the pendingQueue fallback, that
+      // window leaves the turn un-heartbeated and the idle poller
+      // could fire on a turn that's actively starting up.
+      if (ev?.type && ev.type !== 'parse-error' && ev.type !== 'unknown') {
+        const turns = new Set(this._activeGroup?.turns || []);
+        const head = this.pendingQueue[0];
+        if (head) turns.add(head);
+        for (const t of turns) {
+          this._heartbeat(t, `hook:${ev.type}`);
+        }
       }
-    }
-    // H4: Stop hook → synthesize a settle for the primary turn after
-    // a grace, so JSONL `result` (which carries richer metadata)
-    // wins when both fire. If JSONL never arrives — broken stream,
-    // stuck parser — the Stop synth settles the turn instead of
-    // stranding it. Idempotent: a later JSONL settleResult call is
-    // a no-op once the promise has resolved.
-    if (ev?.type === 'Stop') {
-      const primary = (this._activeGroup?.turns || [])
-        .find((t) => t.kind === 'primary');
-      if (primary && typeof primary.settleResult === 'function') {
-        const synth = {
-          text: primary.text || ev.lastAssistantMessage || '',
-          subtype: 'success',
-          stopReason: 'stop_hook',
-          sessionId: this.claudeSessionId,
-          via: 'stop-hook',
-        };
-        const timer = setTimeout(
-          () => primary.settleResult(synth),
-          this.stopGraceMs,
-        );
-        timer.unref?.();
+      // H4: Stop hook → synthesize a settle for the primary turn after
+      // a grace, so JSONL `result` (which carries richer metadata)
+      // wins when both fire. If JSONL never arrives — broken stream,
+      // stuck parser — the Stop synth settles the turn instead of
+      // stranding it. Idempotent: a later JSONL settleResult call is
+      // a no-op once the promise has resolved.
+      //
+      // rc.42 #6 (review-driven): per-primary `_stopSynthScheduled`
+      // guard + stored timer ref so kill()/`_finishTurn` can clear
+      // the pending synth. Without these, repeated Stop events
+      // accumulate N independent timers (rare in production, but a
+      // possible memory leak), and a synth scheduled against a
+      // primary that retires via another path (timeout, interrupt)
+      // fires post-mortem against a freed promise. Idempotency
+      // makes both harmless TODAY; defensive future-proofing.
+      if (ev?.type === 'Stop') {
+        const primary = (this._activeGroup?.turns || [])
+          .find((t) => t.kind === 'primary');
+        if (primary
+          && typeof primary.settleResult === 'function'
+          && !primary._stopSynthScheduled) {
+          const synth = {
+            text: primary.text || ev.lastAssistantMessage || '',
+            subtype: 'success',
+            stopReason: 'stop_hook',
+            sessionId: this.claudeSessionId,
+            via: 'stop-hook',
+          };
+          primary._stopSynthScheduled = true;
+          // rc.42 #3 (review-driven): try/catch in the timer callback.
+          // settleResult is a Promise resolver (cannot throw under
+          // current spec), but a future refactor where settleResult
+          // gates on instance state could; the surrounding setTimeout
+          // has no recovery path otherwise.
+          primary._stopSynthTimer = setTimeout(() => {
+            try {
+              // Recheck the turn is still in a state where the synth
+              // is meaningful — if `_finishTurn` already retired it,
+              // settleResult is idempotent but skipping is cleaner.
+              if (typeof primary.settleResult === 'function') {
+                primary.settleResult(synth);
+              }
+            } catch (err) {
+              this.logger.warn?.(
+                `[${this.label}] Stop-synth settle error: ${err.message}`,
+              );
+            }
+          }, this.stopGraceMs);
+          primary._stopSynthTimer.unref?.();
+        }
       }
+      this.emit('hook-event', ev);
+    } catch (err) {
+      this.logger.warn?.(
+        `[${this.label}] _handleHookEvent error (${ev?.type || 'unknown'}): `
+        + `${err.message}`,
+      );
     }
-    this.emit('hook-event', ev);
   }
 
   _handleSessionEvent(ev) {
@@ -2415,6 +2617,10 @@ class TmuxProcess extends Process {
     // next polls, which is what resets the clock.
     let prevDebugSize = null;
     let lastGrowthAt = null;
+    // rc.43: track whether we've already dismissed the session-age
+    // prompt this wait, so we don't fire Enter every poll if claude
+    // is slow to re-render after dismissing it.
+    let sessionAgePromptDismissed = false;
     if (this.pollScheduler) this.pollScheduler.acquire();
     try {
       while (this._now() < deadline) {
@@ -2422,6 +2628,41 @@ class TmuxProcess extends Process {
         // pane. Polling 1000 lines each tick is wasteful — cap at 80
         // for a ~12× cheaper tmux subprocess.
         lastBuf = await this.runner.captureWide(this.tmuxName, { lines: 80 });
+        // rc.43: if claude rendered the session-age "resume from
+        // summary" prompt (only happens on `--resume` of an aged
+        // session, see SESSION_AGE_PROMPT_RE comment), press Enter
+        // once to confirm the default selection (option 1 — resume
+        // from summary) and emit a `session-age-prompt-dismissed`
+        // event for forensics. The TUI then proceeds to load the
+        // summary and the ready hint appears normally; subsequent
+        // polls take the standard B6/B8 path.
+        if (!sessionAgePromptDismissed
+          && SESSION_AGE_PROMPT_RE.test(lastBuf)) {
+          this.logger.warn?.(
+            `[${this.label}] claude TUI showed session-age resume prompt; `
+            + `auto-dismissing with Enter (select option 1 — resume from summary)`,
+          );
+          this.emit('session-age-prompt-dismissed', {
+            sessionId: this.claudeSessionId,
+            backend: 'tmux',
+          });
+          try {
+            await this.runner.sendControl(this.tmuxName, 'Enter');
+          } catch (err) {
+            this.logger.warn?.(
+              `[${this.label}] sendControl(Enter) for session-age dismissal failed: `
+              + `${err.message}`,
+            );
+          }
+          sessionAgePromptDismissed = true;
+          // Reset readiness clock + prev-pane so the menu's content
+          // doesn't satisfy the byte-stability check while claude is
+          // reloading from the summary.
+          readySinceAt = null;
+          prevBuf = null;
+          await this._waitForNextTick();
+          continue;
+        }
         // Ready ⇔ the hint is on the pane AND the pane is identical to
         // the previous poll (the MCP-loading repaint storm has
         // stopped). The first poll has no previous buffer to compare,
@@ -3008,6 +3249,16 @@ class TmuxProcess extends Process {
     for (const finish of [...this._submitConfirms.values()]) {
       try { finish(); } catch { /* swallow */ }
     }
+    // rc.42 #6 (review-driven): drop pending H4 Stop-synth timers
+    // across every turn the ledger still holds. Symmetric with the
+    // _finishTurn cleanup — kill() bypasses _finishTurn for the
+    // drainQueue'd turns, so do it here.
+    for (const turn of this._ledger) {
+      if (turn?._stopSynthTimer) {
+        try { clearTimeout(turn._stopSynthTimer); } catch { /* swallow */ }
+        turn._stopSynthTimer = null;
+      }
+    }
     if (this._sessionLogTail) {
       try { this._sessionLogTail.close(); } catch { /* swallow */ }
       this._sessionLogTail = null;
@@ -3039,4 +3290,6 @@ class TmuxProcess extends Process {
 module.exports = {
   TmuxProcess,
   CLAUDE_CLI_PINNED_VERSION,
+  // rc.43 — exported for unit-test coverage of the menu pattern.
+  SESSION_AGE_PROMPT_RE,
 };

package/lib/process-manager.js

@@ -98,6 +98,31 @@ const CALLBACK_TO_EVENT = {
   // unification). SDK backend never emits — hooks are tmux-specific.
   // See docs/0.10.0-tmux-hook-observability.md.
   onHookEvent:                  'hook-event',
+  // 0.10.0 rc.42 (review-driven #1): tmux backend turn-timeout event.
+  // Mirrors sdk-process.js's `_logEvent('turn-timeout', ...)` so both
+  // backends emit the same diagnostic. Payload distinguishes
+  // `idle-ceiling` vs `hard-backstop` (the H3 racers) so operators can
+  // tell a wedged-silent subagent from a runaway tool loop.
+  onTurnTimeout:                'turn-timeout',
+  // 0.10.0 rc.42 (review-driven #8): tmux backend hook-tail
+  // degradation event. The hook ndjson is load-bearing for H3 idle
+  // heartbeats; a persistently broken tail silently resurrects
+  // msg-884-class kills. Emitting the event surfaces the degradation
+  // in the events DB so it's visible in forensics, not just
+  // logger.warn.
+  onHookTailError:              'hook-tail-error',
+  // 0.10.0 rc.42 (review-driven #15): tmux backend stop-hook-resolved
+  // event. Fires when a turn settled via the H4 Stop-hook synth path
+  // instead of the canonical JSONL `result` (i.e. JSONL was broken or
+  // stuck and Stop rescued the turn). The synth's `via: 'stop-hook'`
+  // field was previously dead — only the tests read it. Persisting
+  // the event lets the soak count how often H4 actually fires its
+  // rescue contract.
+  onStopHookResolved:           'stop-hook-resolved',
+  // 0.10.0 rc.43: claude TUI's "This session is N old…" interactive
+  // menu auto-dismissed by `_waitForReady`. Surfacing the event so
+  // soak can count how often aged-session resumes hit this path.
+  onSessionAgePromptDismissed:  'session-age-prompt-dismissed',
 };
 
 class ProcessManager {

package/lib/sdk/callbacks.js

@@ -459,6 +459,84 @@ function createSdkCallbacks({
       }
     },
 
+    // 0.10.0 rc.42 #1: tmux backend turn-timeout observability.
+    // H3 introduced two timeout racers (idle-ceiling, hard-backstop)
+    // but their `reason`/`idleMs` were silently dropped at the throw
+    // site, so the events DB couldn't distinguish a wedged-silent
+    // subagent (msg-884 shape) from a 4-hour runaway tool loop. The
+    // handler persists the distinguisher.
+    onTurnTimeout: (sessionKey, payload /* , entry */) => {
+      try {
+        logEvent('turn-timeout', {
+          chat_id: getChatIdFromKey(sessionKey),
+          session_key: sessionKey,
+          backend: 'tmux',
+          turn_id:             payload?.turnId ?? null,
+          reason:              payload?.reason ?? null,
+          idle_ms:             payload?.idleMs ?? null,
+          turn_timeout_ms:     payload?.turnTimeoutMs ?? null,
+          hard_backstop_ms:    payload?.hardBackstopMs ?? null,
+          claude_session_id:   payload?.sessionId ?? null,
+        });
+      } catch (err) {
+        logger.error?.(`[${botName}] turn-timeout handler: ${err.message}`);
+      }
+    },
+
+    // 0.10.0 rc.42 #8: tmux backend hook-tail error observability.
+    // Persistent failures of the hook ndjson tail degrade H3 idle-
+    // ceiling accuracy and H4 Stop-synth coverage with no surface
+    // signal. Record one event per error so post-mortem can correlate
+    // unexpected idle-timeouts to a broken tail.
+    onHookTailError: (sessionKey, payload /* , entry */) => {
+      try {
+        logEvent('hook-tail-error', {
+          chat_id: getChatIdFromKey(sessionKey),
+          session_key: sessionKey,
+          backend: 'tmux',
+          message:           (payload?.message || '').slice(0, 200),
+          path:              payload?.path ?? null,
+          claude_session_id: payload?.sessionId ?? null,
+        });
+      } catch (err) {
+        logger.error?.(`[${botName}] hook-tail-error handler: ${err.message}`);
+      }
+    },
+
+    // 0.10.0 rc.42 #15: H4 Stop-hook synth fired and won the race
+    // against JSONL `result` (or JSONL never landed). Forensic count
+    // of how often Stop actually rescues a stuck JSONL stream.
+    onStopHookResolved: (sessionKey, payload /* , entry */) => {
+      try {
+        logEvent('stop-hook-resolved', {
+          chat_id: getChatIdFromKey(sessionKey),
+          session_key: sessionKey,
+          backend: 'tmux',
+          turn_id:           payload?.turnId ?? null,
+          claude_session_id: payload?.sessionId ?? null,
+        });
+      } catch (err) {
+        logger.error?.(`[${botName}] stop-hook-resolved handler: ${err.message}`);
+      }
+    },
+
+    // 0.10.0 rc.43: claude TUI session-age resume prompt was
+    // auto-dismissed by `_waitForReady`. Counting these helps decide
+    // whether to push the "Don't ask me again" option globally vs
+    // keep the auto-dismiss as a safety net.
+    onSessionAgePromptDismissed: (sessionKey, payload /* , entry */) => {
+      try {
+        logEvent('session-age-prompt-dismissed', {
+          chat_id: getChatIdFromKey(sessionKey),
+          session_key: sessionKey,
+          backend: 'tmux',
+          claude_session_id: payload?.sessionId ?? null,
+        });
+      } catch (err) {
+        logger.error?.(`[${botName}] session-age-prompt-dismissed handler: ${err.message}`);
+      }
+    },
+
     onInjectFail: (sessionKey, payload /* , entry */) => {
       try {
         const msgId = payload?.msgId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.10.0-rc.41",
+  "version": "0.10.0-rc.43",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {