polygram 0.12.0-rc.9 → 0.12.0

package/migrations/012-pending-questions.sql

@@ -0,0 +1,30 @@
+-- 0.12 interactive questions: AskUserQuestion → Telegram inline keyboards.
+-- Mirrors pending_approvals (per-row 128-bit callback token, status lifecycle,
+-- audit-kept rows). One OPEN question per session at a time (idx_pq_open).
+-- The answer routes back to claude on tool_call_id via a question_answer message.
+
+CREATE TABLE pending_questions (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  bot_name          TEXT NOT NULL,
+  session_key       TEXT NOT NULL,     -- chat:thread that asked (claude session)
+  chat_id           TEXT NOT NULL,
+  thread_id         TEXT,
+  turn_id           TEXT,              -- echoed for routing
+  tool_call_id      TEXT NOT NULL,     -- the question_answer routes back on this
+  from_id           INTEGER,           -- Telegram user_id allowed to answer; claimed on first tap
+  callback_token    TEXT NOT NULL,     -- 128-bit; defeats forged/guessed callback_data
+  questions_json    TEXT NOT NULL,     -- the ask call's questions array
+  state_json        TEXT NOT NULL,     -- the question-state machine state
+  message_ids_json  TEXT,              -- Telegram msg_id(s) of the keyboard message to edit/strip
+  awaiting_other    INTEGER NOT NULL DEFAULT 0,  -- 1 while capturing a free-text "Other"
+  status            TEXT NOT NULL
+    CHECK(status IN ('pending','answered','cancelled','timeout','expired'))
+    DEFAULT 'pending',
+  created_ts        INTEGER NOT NULL,
+  timeout_ts        INTEGER NOT NULL,
+  answered_ts       INTEGER
+);
+
+CREATE INDEX idx_pq_open      ON pending_questions(session_key, status) WHERE status = 'pending';
+CREATE INDEX idx_pq_timeout   ON pending_questions(status, timeout_ts)  WHERE status = 'pending';
+CREATE INDEX idx_pq_tool_call ON pending_questions(tool_call_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.12.0-rc.9",
+  "version": "0.12.0",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {

package/polygram.js

@@ -56,12 +56,21 @@ const { sweepTmuxOrphans } = require('./lib/tmux/orphan-sweep');
 const { createAutosteeredRefs } = require('./lib/autosteered-refs');
 const { createBuildSdkOptions } = require('./lib/sdk/build-options');
 const { createSdkCallbacks } = require('./lib/sdk/callbacks');
+const { createQuestionStore } = require('./lib/questions/store');
+const { createQuestionHandlers } = require('./lib/handlers/questions');
+const { isRewindCommand, createRewindHandler } = require('./lib/rewind/rewind');
+const { createRewindExecutor } = require('./lib/rewind/execute');
 const { createTranscribeVoiceAttachments } = require('./lib/handlers/voice');
 const { createDownloadAttachments } = require('./lib/handlers/download');
 const { createHandleConfigCallback } = require('./lib/handlers/config-callback');
 const { createHandleAbort } = require('./lib/handlers/abort');
 const { createAutosteerHandlers } = require('./lib/handlers/autosteer');
 const { createEditCorrectionInjector } = require('./lib/handlers/edit-correction');
+const { createEditRedelivery } = require('./lib/handlers/edit-redelivery');
+const { createGateInbound } = require('./lib/handlers/gate-inbound');
+const { createRedeliver } = require('./lib/handlers/redeliver');
+const { createDropRedeliverer } = require('./lib/handlers/drop-redeliver');
+const { createSessionFeedback } = require('./lib/feedback/session-feedback');
 const { createSlashCommands } = require('./lib/handlers/slash-commands');
 const { createApprovals } = require('./lib/handlers/approvals');
 const { canonicalizeToolInput } = require('./lib/canonical-json');
@@ -97,6 +106,7 @@ const { startTyping } = require('./lib/telegram/typing');
 // consumer is lib/handlers/download.js.
 const { createReactionManager, classifyToolName } = require('./lib/telegram/reactions');
 const { createMediaGroupBuffer } = require('./lib/media-group-buffer');
+const { applyReactionToMessages } = require('./lib/telegram/album-reactions');
 const { classify: classifyError, detectWedgedSessionError, isTransientHttpError } = require('./lib/error/classify');
 const { createAutoResumeTracker, isAutoResumable } = require('./lib/db/auto-resume');
 const { resolveReplayWindowMs } = require('./lib/db/replay-window');
@@ -334,6 +344,9 @@ function formatPrompt(msg, sessionCtx, attachments = [], { sessionKey = null } =
           db,
           chatId,
           threadId: threadId || null,
+          // Per-topic sessions must only preload their OWN thread — else a message
+          // in one topic gets fed other topics' history (2026-06-09 cross-topic bleed).
+          isolateTopics: chatConfig?.isolateTopics === true,
           excludeMsgId: msg.message_id,
           logger: console,
         });
@@ -635,6 +648,13 @@ let handleAbortIfRequested = null;
 let autosteer = null;
 let dispatchSlashCommand = null;
 let maybeInjectEditCorrection = null;
+let maybePostTurnEdit = null;
+// 0.13 D5/D4: the ONE intake gate (assigned in createBot, where botUsername/
+// mentionRe live) + the ONE redelivery tail (assigned in main once the
+// dispatcher exists). See lib/handlers/gate-inbound.js / redeliver.js.
+let gateInbound = null;
+let redeliverAsFreshTurn = null;
+let dropRedeliverer = null;   // 0.13 D2→D4 glue; assigned once redeliver exists
 
 // rc.20: approvalCardText + safeParse moved to lib/approvals/ui.js.
 // 0.9.0 commit 29: makeCanUseTool / handleApprovalCallback /
@@ -643,6 +663,10 @@ let maybeInjectEditCorrection = null;
 // approvals store are available.
 let makeCanUseTool = null;
 let handleApprovalCallback = null;
+// 0.12 interactive questions — assigned in main() once db.raw + pm exist; the
+// createSdkCallbacks onQuestionAsked closure + the callback router read it late.
+let questionHandlers = null;
+let rewindHandler = null;   // 0.13 /rewind (P1); late-bound, assigned in main() after pm exists
 let resolveApprovalWaiter = null;
 let startApprovalSweeper = null;
 let cancelAllWaiters = null;
@@ -739,8 +763,13 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
 
   if (botAllowsCommands && (text === '/model' || text === '/config' || text === '/effort')) {
     const show = text === '/effort' ? 'effort' : text === '/model' ? 'model' : 'all';
-    const info = formatConfigInfoText(chatConfig, show, sessionKey);
-    const reply_markup = buildConfigKeyboard(chatConfig, show);
+    // Resolve per-topic overrides so a topic's card shows its REAL
+    // agent/model/effort, not the chat-level default — Music topic (thread 3)
+    // showed "Agent: shumabit" instead of music-curation:music-curator
+    // (2026-06-03). getTopicConfig returns {} when there's no active topic.
+    const _cardTopicCfg = getTopicConfig(chatConfig, threadIdStr || null);
+    const info = formatConfigInfoText(chatConfig, show, sessionKey, _cardTopicCfg);
+    const reply_markup = buildConfigKeyboard(chatConfig, show, _cardTopicCfg);
     await sendReply(info, { params: { reply_markup } });
     return;
   }
@@ -998,13 +1027,17 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
   const availableEmojis = await getReactionAllowlist(bot, chatId);
   const reactor = createReactionManager({
     apply: async (emoji) => {
-      const params = {
-        chat_id: chatId,
-        message_id: msg.message_id,
-        reaction: emoji ? [{ type: 'emoji', emoji }] : [],
-      };
-      await tg(bot, 'setMessageReaction', params,
-        { source: 'status-reaction', botName: BOT_NAME });
+      // rc.16: mirror the reaction onto album siblings too, so a multi-file
+      // send shows the same status emoji on EVERY item, not just the anchor.
+      // For a normal single message, _albumSiblingMsgIds is undefined and this
+      // is exactly the prior single setMessageReaction. Anchor is awaited
+      // (failure surfaces to the reactor); siblings are best-effort.
+      await applyReactionToMessages({
+        tg, bot, chatId,
+        msgIds: [msg.message_id, ...(msg._albumSiblingMsgIds || [])],
+        emoji,
+        botName: BOT_NAME,
+      });
     },
     availableEmojis,
     logError: (m) => console.error(`[${label}] ${m}`),
@@ -1097,7 +1130,10 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
       // pick them off entry.pendingQueue[0].context.
       await new Promise((dispatched) => {
         sendPromise = sendToProcess(sessionKey, prompt, {
-          streamer, reactor, sourceMsgId: msg.message_id,
+          // 0.13 D1 (S8): the typing controller rides the per-turn context so
+          // the question lifecycle (callbacks.js onQuestionAsked/-Resumed) can
+          // pause it while the bot waits on the USER and resume on the answer.
+          streamer, reactor, typing: stopTyping, sourceMsgId: msg.message_id,
           // 0.7.4 (item B): fire THINKING when Claude actually starts
           // emitting — not the moment we wrote stdin.
           onFirstStream: () => reactor.setState('THINKING'),
@@ -1698,7 +1734,14 @@ function createBot(token) {
   const apiRoot = config.bot?.apiRoot;
   const bot = new Bot(token, {
     client: {
-      timeoutSeconds: 60,
+      // rc.15: with the local Bot API server, getFile DOWNLOADS the file
+      // synchronously (server fetches it from Telegram's DC, then responds) —
+      // a large lossless WAV can take >60s, so the cloud-tuned 60s timeout
+      // fired before the download finished (the file still landed on the
+      // server's disk, but polygram's getFile call already errored). The
+      // local server is localhost, so non-download calls stay fast; the
+      // higher ceiling only matters for big getFile downloads.
+      timeoutSeconds: apiRoot ? 180 : 60,
       ...(apiRoot ? { apiRoot } : {}),
     },
   });
@@ -1708,9 +1751,6 @@ function createBot(token) {
   let botUsername = '';
   // Cached once @botUsername is known — was recompiling per inbound msg.
   let mentionRe = null;
-  // Hoisted admin-command matcher; was re-allocated per message.
-  const ADMIN_CMD_RE = /^\/(model|effort|config|pair-code|pairings|unpair|new|reset|context|compact)(\s|$)/;
-  const PAIR_CLAIM_RE = /^\/pair\s+\S+/;
 
   // The filter in main() guarantees config.chats only contains chats owned
   // by BOT_NAME, so any update for a chat not in config.chats is unknown —
@@ -1808,45 +1848,38 @@ function createBot(token) {
     return newChat;
   }
 
+  // 0.13 D5: the intake chain (abort → admin/pair → rewind → ownsOpenOther ‖
+  // shouldHandle → question-consume → dispatch) moved verbatim into the ONE
+  // gate, lib/handlers/gate-inbound.js, with a tier×stage side-effect table —
+  // the edited_message path and every redelivery now run the SAME chain
+  // (pre-0.13 they ran divergent subsets; the divergences were bugs — an edit
+  // to "/stop" was injected into the very turn it tried to kill, an edit
+  // during an open "Other" capture never became the answer, and any group
+  // member's bare "stop" aborted others' turns pre-gate). Late-bound deps are
+  // getters because this runs at createBot time, before main() wires the
+  // dispatcher/handlers.
+  gateInbound = createGateInbound({
+    config,
+    getBotUsername: () => botUsername,
+    getMentionRe: () => mentionRe,
+    pairings: { hasLivePairing: (args) => !!pairings?.hasLivePairing(args) },
+    isAbortRequest,
+    handleAbortIfRequested: (...a) => handleAbortIfRequested(...a),
+    getRewindHandler: () => rewindHandler,
+    isRewindCommand,
+    getQuestionHandlers: () => questionHandlers,
+    shouldHandle,
+    getSessionKey,
+    dispatchHandleMessage: (...a) => dispatchHandleMessage(...a),
+    bot,
+    botName: BOT_NAME,
+    logEvent,
+    logger: console,
+  });
+
   // Shared post-validation dispatch. Called directly for single messages
   // and for the synthesised "primary" of a media-group bundle.
-  const dispatchRegularMessage = async (msg) => {
-    const chatId = msg.chat.id.toString();
-    const chatConfig = config.chats[chatId];
-    if (!chatConfig) return;
-
-    const rawText = msg.text || '';
-    const cleanText = mentionRe ? rawText.replace(mentionRe, '').trim() : rawText.trim();
-
-    // Abort: skip the queue entirely. Matches bilingual natural-
-    // language cues + slash variants. handleAbortIfRequested
-    // (lib/handlers/abort.js) returns true when handled — short-
-    // circuit out of dispatch.
-    if (await handleAbortIfRequested(msg, chatId, chatConfig, cleanText)) {
-      return;
-    }
-
-    const botAllowsCommands = !!config.bot?.allowConfigCommands;
-    const isAdminCmd = botAllowsCommands && ADMIN_CMD_RE.test(cleanText);
-    const isPairClaim = PAIR_CLAIM_RE.test(cleanText);
-    if (isAdminCmd || isPairClaim) {
-      msg.text = cleanText;
-      const threadId = msg.message_thread_id?.toString();
-      const sessionKey = getSessionKey(chatId, threadId, chatConfig);
-      await handleMessage(sessionKey, chatId, msg, bot);
-      return;
-    }
-
-    if (!shouldHandle(msg, chatConfig, botUsername)) return;
-
-    if (botUsername) {
-      msg.text = cleanText;
-    }
-
-    const threadId = msg.message_thread_id?.toString();
-    const sessionKey = getSessionKey(chatId, threadId, chatConfig);
-    dispatchHandleMessage(sessionKey, chatId, msg, bot);
-  };
+  const dispatchRegularMessage = async (msg) => gateInbound(msg, { tier: 'fresh' });
 
   // Media-group buffer: coalesce multi-photo uploads (Telegram delivers
   // each attachment as a separate Message sharing a `media_group_id`) into
@@ -1885,6 +1918,10 @@ function createBot(token) {
       }
 
       const synthetic = { ...primary, _mergedAttachments: merged };
+      // rc.16: carry the album sibling msg_ids so the status reactor can mirror
+      // its emoji onto every item (not just the anchor) — see the reactor
+      // `apply` closure + lib/telegram/album-reactions.js.
+      if (siblingMsgIds.length) synthetic._albumSiblingMsgIds = siblingMsgIds;
       // Carry the primary's text verbatim (dispatchRegularMessage re-cleans
       // the mention). Caption → text so downstream sees it uniformly.
       if (!synthetic.text && synthetic.caption) synthetic.text = synthetic.caption;
@@ -1954,6 +1991,8 @@ function createBot(token) {
       const data = ctx.callbackQuery.data;
       if (data.startsWith('cfg:')) {
         await handleConfigCallback(ctx);
+      } else if (data.startsWith('q:')) {
+        if (questionHandlers) await questionHandlers.handleQuestionCallback(ctx);
       } else {
         await handleApprovalCallback(ctx);
       }
@@ -1973,6 +2012,10 @@ function createBot(token) {
     }
     const chatId = ctx.editedMessage.chat.id.toString();
     if (!knownChat(chatId)) return;
+    // 0.12.0 spec §3 (HARD): read the OLD text BEFORE recordInbound overwrites the row — the
+    // post-turn changed-guard compares it, and the re-dispatch quotes it in reply_to so claude sees
+    // the before/after. Reading after recordInbound would yield the new text (useless).
+    const oldText = db.getMessage(chatId, ctx.editedMessage.message_id)?.text ?? null;
     recordInbound(ctx.editedMessage);
     logEvent('message-edited', {
       chat_id: chatId,
@@ -1981,16 +2024,29 @@ function createBot(token) {
     });
     console.log(`[${BOT_NAME}] edited ${chatId}/${ctx.editedMessage.message_id}`);
 
-    // 0.9.0: typo-correction injection. If the SDK still has this turn
-    // in flight (handler_status in dispatched/processing AND
-    // pm.get(sk).inFlight), inject a `[edit] corrected: <NEW>` note
-    // via the same channel autosteer uses. Lets users fix typos
-    // mid-turn without /stop + resend. No-op when the turn already
-    // completed.
+    // 0.13 D5: gate FIRST (tier 'edit') — the edited message's CURRENT text
+    // runs the same abort/admin/question-consume/shouldHandle chain as a fresh
+    // message. Closes the S11 holes: an edit-to-"stop" now ABORTS (identity-
+    // gated) instead of being injected into the very turn it tries to kill; an
+    // edit while that user owns an open free-text "Other" capture becomes the
+    // answer; a bystander's un-addressed edit is blocked BEFORE any inject.
+    // Only a 'pass' proceeds to the fold/redeliver machinery below.
     try {
-      maybeInjectEditCorrection?.(ctx.editedMessage);
+      const gateRes = await gateInbound(ctx.editedMessage, { tier: 'edit' });
+      if (gateRes.action !== 'pass') {
+        logEvent('edit-gated', {
+          chat_id: chatId, msg_id: ctx.editedMessage.message_id,
+          action: gateRes.action, stage: gateRes.stage ?? null,
+        });
+        return;
+      }
+      // Mid-turn (turn still in flight) → fold into the running turn via the 0.9.0
+      // injector. Post-turn (idle) — OR the injector no-ops because the turn just
+      // settled at the boundary — → re-dispatch as a NEW turn (edit re-delivery).
+      const injected = maybeInjectEditCorrection?.(ctx.editedMessage);
+      if (!injected) maybePostTurnEdit?.(ctx.editedMessage, oldText, botUsername, mentionRe);
     } catch (err) {
-      console.error(`[${BOT_NAME}] edit-correction injector error: ${err.message}`);
+      console.error(`[${BOT_NAME}] edit handler error: ${err.message}`);
     }
   });
 
@@ -2204,8 +2260,17 @@ async function main() {
 
   bot = createBot(config.bot.token);
 
+  // 0.13 D3: session-scoped feedback for cycles with NO pending turn
+  // (ScheduleWakeup, fireUserMessage self-checks, injected messages picked up
+  // as their own cycle) — typing for the cycle's duration + a 🤔 anchored to
+  // the picked-up message when the input ledger names one.
+  const sessionFeedback = createSessionFeedback({
+    bot, tg, getChatIdFromKey, getThreadIdFromKey, botName: BOT_NAME,
+    logEvent, logger: console,
+  });
+
   const sdkCallbacks = createSdkCallbacks({
-    db, dbWrite, config, bot, botName: BOT_NAME, tg, logEvent,
+    db, dbWrite, config, bot, botName: BOT_NAME, tg, logEvent, sessionFeedback,
     classifyToolName, announce, shouldAnnounce, contextHintShown,
     extractAssistantText, getChatIdFromKey, getThreadIdFromKey,
     // F#23: enable parse/sanitize/sticker/react on the autonomous-wakeup path.
@@ -2213,6 +2278,9 @@ async function main() {
     // `[react:EMOJI]`, `No response requested.` all leaked as literal text.
     parseResponse, sanitizeAssistantReply, chunkMarkdownText, deliverReplies,
     processAndDeliverAgentText,
+    // 0.12 interactive questions: 'question-asked' (claude called the ask tool)
+    // → render the Telegram keyboard. Late-bound; questionHandlers is assigned below.
+    renderQuestion: (payload) => questionHandlers?.renderAsk(payload),
     logger: console,
   });
   // 0.10.0: sdkCallbacks (the polygram-side lifecycle handlers — status
@@ -2232,6 +2300,32 @@ async function main() {
     config, db, bot, botName: BOT_NAME, tg, logEvent,
     approvals, getChatIdFromKey, logger: console,
   }));
+
+  // 0.12 interactive questions: store + handlers + timeout sweep. answerQuestion
+  // is late-bound to pm (a tap can land minutes later, pm is live by then).
+  const questionStore = createQuestionStore(db.raw);
+  questionHandlers = createQuestionHandlers({
+    questions: questionStore, tg, bot, botName: BOT_NAME, logEvent,
+    answerQuestion: (sk, tc, result) => pm.answerQuestion(sk, tc, result),
+    logger: console,
+  });
+  // Resolve expired questions with {timedout} so claude never hangs on an ignored ask.
+  setInterval(() => {
+    try {
+      for (const row of questionStore.sweepTimedOut()) {
+        questionHandlers.expireQuestion(row).catch((e) => console.error(`[${BOT_NAME}] question expire: ${e.message}`));
+      }
+    } catch (e) { console.error(`[${BOT_NAME}] question sweep: ${e.message}`); }
+  }, 30_000).unref?.();
+
+  // 0.13 /rewind: detect + operator/ownership gate + turn-end defer + confirm (P1), backed by
+  // the copy-only transcript-fork executor (P2/P3: fork → repoint the session → kill → delete
+  // orphaned bot messages). channels/cli only; the fork mechanism was proven in P0.6.
+  // See docs/0.13-rewind-design.md.
+  const executeRewind = createRewindExecutor({ db, pm, tg, bot, botName: BOT_NAME, logEvent, logger: console });
+  rewindHandler = createRewindHandler({
+    pm, tg, bot, botName: BOT_NAME, logEvent, logger: console, executeRewind,
+  });
   buildSdkOptions = createBuildSdkOptions({
     config,
     botName: BOT_NAME,
@@ -2322,6 +2416,11 @@ async function main() {
   //                    the verdict back via tmux send-keys "1"/"3"+Enter.
   // makeCanUseTool handles admin card, chat_tool_decisions persistence,
   // and timeout race — all reused from SDK.
+  // 0.13 D2: 'input-dropped' → redeliver once via the D4 tail. Stable wrapper:
+  // pm spread-copies the callbacks object at construction, and the redeliver
+  // tail is wired later in main() — the wrapper late-binds it.
+  sdkCallbacks.onInputDropped = (sessionKey, payload) => dropRedeliverer?.(sessionKey, payload);
+
   sdkCallbacks.onApprovalRequired = async (sessionKey, payload) => {
     const { toolName, toolInput, id, respond } = payload || {};
     if (typeof respond !== 'function') return;
@@ -2360,7 +2459,7 @@ async function main() {
   });
   handleConfigCallback = createHandleConfigCallback({
     config, db, dbWrite, pm, getSessionKey,
-    formatConfigInfoText, buildConfigKeyboard,
+    formatConfigInfoText, buildConfigKeyboard, saveConfig,
     botName: BOT_NAME, logger: console,
   });
   handleAbortIfRequested = createHandleAbort({
@@ -2396,6 +2495,34 @@ async function main() {
     getIsShuttingDown: () => isShuttingDown,
     logger: console,
   }));
+  // 0.12.0 post-turn edit re-delivery: constructed AFTER dispatchHandleMessage is assigned (above).
+  // An edit while a turn is in flight folds via maybeInjectEditCorrection; an edit after the turn
+  // (or when the injector no-ops at the boundary) re-dispatches as a new turn. The on-edit 👀 is a
+  // pre-turn ack for the cold-spawn gap; the synthetic turn's own reactor then takes over the msg.
+  maybePostTurnEdit = createEditRedelivery({
+    pm, config, getSessionKey, shouldHandle, dispatchHandleMessage, bot,
+    react: (chatId, msgId) => applyReactionToMessages({
+      tg, bot, chatId, msgIds: [msgId], emoji: '👀', botName: BOT_NAME,
+    }).catch(() => {}),
+    logEvent, logger: console,
+  });
+  // 0.13 D4: the ONE redelivery tail — boot-replay (below) and the P3
+  // drop-redeliverer converge on it (once-only + _isReplay + redelivery-tier
+  // gate + 👀 ack + dispatch). startup-auto-retry deliberately stays a
+  // same-process re-dispatch (its error path must SURFACE the friendly reset
+  // reply, which the _isReplay tag would suppress); compact-replay stays a
+  // system re-push outside the user-message gate (design §6.7).
+  redeliverAsFreshTurn = createRedeliver({
+    gateInbound: (...a) => gateInbound(...a),
+    dispatchHandleMessage, getSessionKey, config, db, dbWrite,
+    react: (chatId, msgId) => applyReactionToMessages({
+      tg, bot, chatId, msgIds: [msgId], emoji: '👀', botName: BOT_NAME,
+    }).catch(() => {}),
+    bot, logEvent, logger: console,
+  });
+  dropRedeliverer = createDropRedeliverer({
+    db, redeliver: redeliverAsFreshTurn, logEvent, logger: console,
+  });
   ({ pollBot, startPollWatchdog } = createPollLoop({
     db, dbWrite, config, botName: BOT_NAME,
     isWellFormedMessage, getTopicName,
@@ -2405,7 +2532,7 @@ async function main() {
     config, db, dbWrite, pm, pairings, parsePairingTtl,
     contextHintShown, formatContextReply, getClaudeSessionId,
     getOrSpawnForChat, parsePairCodeArgs,
-    modelVersionsDesc: MODEL_VERSIONS_DESC,
+    modelVersionsDesc: MODEL_VERSIONS_DESC, saveConfig,
     botName: BOT_NAME, logEvent, logger: console,
   });
   console.log('[polygram] using SDK ProcessManager');
@@ -2448,6 +2575,28 @@ async function main() {
     // 1. Stop accepting new inbound first so nothing new queues behind the drain.
     if (bot && bot._stop) bot._stop();
 
+    // 1.5 (0.13 D1): expire open interactive questions {cancelled} BEFORE the
+    // drain. With D1 the asking turn stays in flight for the whole wait, so a
+    // deploy during a question would otherwise eat the entire 30s drain and
+    // mark the inbound replay-pending mid-ask. Cancelling unblocks claude's
+    // ask so the cycle can end inside the drain; the boot-replay re-ask is the
+    // documented recovery path (design §3 D1 ask-wait semantics).
+    try {
+      const openQuestions = questionStore.listOpen?.(BOT_NAME) || [];
+      for (const row of openQuestions) {
+        // eslint-disable-next-line no-await-in-loop
+        await questionHandlers.expireQuestion(row, {
+          status: 'cancelled',
+          message: 'Bot is restarting — this question was cancelled. It may be re-asked in a moment.',
+        }).catch(() => {});
+      }
+      if (openQuestions.length) {
+        logEvent('shutdown-questions-cancelled', { count: openQuestions.length });
+      }
+    } catch (err) {
+      console.error(`[shutdown] question expiry failed: ${err.message}`);
+    }
+
     // 2. Drain in-flight handlers. Wait for inFlightHandlers to empty or
     //    SHUTDOWN_DRAIN_MS to elapse. pm handlers resolve naturally when
     //    result events arrive; the dispatcher's .finally decrements.
@@ -2610,22 +2759,19 @@ async function main() {
         }
         const chatConfig = config.chats[row.chat_id];
         if (!chatConfig) { skipped += 1; continue; }
-        // Tag the reconstructed message so dispatchHandleMessage knows
-        // (a) to suppress the "Sorry I couldn't process" error reply on
-        // failure and (b) to flag handler-error events as replay.
-        reconstructed._isReplay = true;
-        // Pre-mark 'replay-attempted' so even if this attempt is killed
-        // mid-turn by yet another restart, the next boot won't replay it
-        // again. Replay is one-shot — handleMessage will overwrite to
-        // 'replied' on success, or the catch will overwrite to 'failed'.
-        // Worst case (polygram dies before either): row stays
-        // 'replay-attempted', getReplayCandidates skips it, no loop.
-        dbWrite(() => db.setInboundHandlerStatus({
-          chat_id: row.chat_id, msg_id: row.msg_id, status: 'replay-attempted',
-        }), 'set handler_status=replay-attempted');
-        const sessionKey = getSessionKey(row.chat_id, row.thread_id, chatConfig);
-        dispatchHandleMessage(sessionKey, row.chat_id, reconstructed, bot);
-        replayed += 1;
+        // 0.13 D4: through the unified redelivery tail — _isReplay tag (error
+        // reply suppressed, not replay-eligible), 'replay-attempted' pre-mark
+        // (one-shot: even if THIS attempt dies mid-turn, the next boot won't
+        // loop), the D5 gate at tier 'redelivery' (abort/admin-shaped rows are
+        // never auto-re-executed; a row whose chat lost its pairing since is
+        // re-checked), a 👀 ack so the recovery is visible, then dispatch.
+        // eslint-disable-next-line no-await-in-loop
+        const r = await redeliverAsFreshTurn({
+          chatId: row.chat_id, msg: reconstructed,
+          source: 'boot-replay', preMark: 'replay-attempted',
+        });
+        if (r.ok) replayed += 1;
+        else skipped += 1;
       }
       if (candidates.length > 0) {
         console.log(`[replay] ${replayed} turns re-dispatched, ${skipped} skipped (already replied or no chat config)`);