polygram 0.37.1 → 0.38.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.37.1",
+  "version": "0.38.0",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/db.js

@@ -553,6 +553,13 @@ function wrap(db) {
        AND bot_name = ?
        AND ts > ?
   `);
+  const completeAcceptedClaudeAutosteerStmt = db.prepare(`
+    UPDATE messages SET handler_status = 'replied'
+     WHERE chat_id = ?
+       AND msg_id = ?
+       AND direction = 'in'
+       AND handler_status IN ('dispatched', 'replay-attempted')
+  `);
   const clearCleanShutdownMarkerStmt = db.prepare(`
     UPDATE polling_state SET clean_shutdown_at = NULL
      WHERE bot_name = ?
@@ -4174,6 +4181,27 @@ function wrap(db) {
           AND handler_status NOT IN ('codex-ambiguous', 'failed')
       `).run(status, chat_id, msg_id);
     },
+    completeAcceptedClaudeAutosteer({ chat_id, msg_id }) {
+      let result;
+      try {
+        result = completeAcceptedClaudeAutosteerStmt.run(chat_id, msg_id);
+      } catch (cause) {
+        const error = new Error(
+          'accepted Claude follow-up handler status could not be persisted',
+          { cause },
+        );
+        error.code = 'CLAUDE_AUTOSTEER_STATUS_PERSIST_FAILED';
+        throw error;
+      }
+      if (result.changes !== 1) {
+        const error = new Error(
+          'accepted Claude follow-up did not own one live inbound row',
+        );
+        error.code = 'CLAUDE_AUTOSTEER_STATUS_CONFLICT';
+        throw error;
+      }
+      return result;
+    },
 
     // 0.9.0: True when a specific inbound msg is still being processed
     // by the SDK turn loop (handler_status in dispatched/processing).

package/lib/handlers/claude-autosteer-ownership.js

@@ -0,0 +1,70 @@
+'use strict';
+
+const PRIMARY_BLOCKING_CODEX_DECISIONS = new Set([
+  'duplicate',
+  'ambiguous',
+  'unavailable',
+]);
+
+/**
+ * Complete ownership of a follow-up that the Claude injection path accepted.
+ *
+ * Codex acceptance is deliberately a no-op here: its linked target turn and
+ * Telegram delivery checkpoint own the eventual terminal status.
+ */
+function settleAcceptedAutosteerOwnership({
+  selectedProvider,
+  steered,
+  db,
+  chatId,
+  msgId,
+  sessionKey,
+  logLabel = sessionKey,
+  logEvent = () => {},
+  logger = console,
+} = {}) {
+  if (selectedProvider !== 'claude' || steered?.autosteered !== true) {
+    return steered;
+  }
+
+  try {
+    db.completeAcceptedClaudeAutosteer({
+      chat_id: chatId,
+      msg_id: msgId,
+    });
+    return steered;
+  } catch (error) {
+    const errorCode = error?.code || error?.name || 'unknown';
+    logger.error(
+      `[${logLabel}] accepted Claude follow-up persistence failed: ${errorCode}`,
+    );
+    logEvent('autosteer-handler-status-failed', {
+      chat_id: chatId,
+      msg_id: msgId,
+      session_key: sessionKey,
+      code: errorCode,
+    });
+    return {
+      ...steered,
+      autosteered: false,
+      outcome: 'accepted-persistence-ambiguous',
+      errorCode,
+    };
+  }
+}
+
+function shouldDispatchPrimaryAfterAutosteer({
+  steered,
+  codexDispatchDecision = null,
+} = {}) {
+  return (
+    steered?.autosteered !== true
+    && steered?.outcome !== 'accepted-persistence-ambiguous'
+    && !PRIMARY_BLOCKING_CODEX_DECISIONS.has(codexDispatchDecision)
+  );
+}
+
+module.exports = {
+  settleAcceptedAutosteerOwnership,
+  shouldDispatchPrimaryAfterAutosteer,
+};

package/lib/handlers/config-ui.js

@@ -18,10 +18,10 @@
 
 const MODEL_OPTIONS = ['opus', 'sonnet', 'haiku'];
 const EFFORT_OPTIONS = ['low', 'medium', 'high', 'xhigh', 'max'];
-const CODEX_MODEL_OPTIONS = new Set([
-  'gpt-5.6-sol',
-  'gpt-5.6-terra',
-  'gpt-5.6-luna',
+const CODEX_MODEL_OPTIONS = Object.freeze([
+  Object.freeze({ model: 'gpt-5.6-sol', label: 'Sol' }),
+  Object.freeze({ model: 'gpt-5.6-terra', label: 'Terra' }),
+  Object.freeze({ model: 'gpt-5.6-luna', label: 'Luna' }),
 ]);
 // Which runtimes the card offers. The sdk backend stays fully supported in
 // code and config files — it is per-token and nobody picks it from a chat, so
@@ -63,20 +63,30 @@ function getCodexCatalogModels(runtimeView) {
   if (!isCodexRuntimeView(runtimeView) || !Array.isArray(runtimeView.models)) {
     return [];
   }
-  const seen = new Set();
-  return runtimeView.models.filter((entry) => {
-    if (
-      !entry
-      || typeof entry.model !== 'string'
-      || entry.model.length === 0
-      || !CODEX_MODEL_OPTIONS.has(entry.model)
-      || seen.has(entry.model)
-    ) {
-      return false;
+  const catalogByModel = new Map();
+  for (const entry of runtimeView.models) {
+    if (entry && typeof entry.model === 'string' && entry.model.length > 0) {
+      if (!catalogByModel.has(entry.model)) {
+        catalogByModel.set(entry.model, entry);
+      }
     }
-    seen.add(entry.model);
-    return true;
-  });
+  }
+  return CODEX_MODEL_OPTIONS.flatMap(({ model }) => (
+    catalogByModel.has(model) ? [catalogByModel.get(model)] : []
+  ));
+}
+
+function codexModelLabel(model) {
+  return CODEX_MODEL_OPTIONS.find((entry) => entry.model === model)?.label
+    ?? model;
+}
+
+function hasCodexCatalogModels(runtimeView) {
+  return isCodexRuntimeView(runtimeView)
+    && Array.isArray(runtimeView.models)
+    && runtimeView.models.some(
+      (entry) => typeof entry?.model === 'string' && entry.model.length > 0,
+    );
 }
 
 function getCodexCatalogEfforts(runtimeView, model = runtimeView?.model) {
@@ -262,10 +272,15 @@ function buildConfigKeyboard(
   }
   if ((show === 'model' || show === 'all') && modelOptions.length > 0) {
     rows.push(modelOptions.map((entry) => {
-      const label = (
+      let label = entry.model;
+      if (codex) {
+        label = codexModelLabel(entry.model);
+      } else if (
         typeof entry.displayName === 'string'
         && entry.displayName.length > 0
-      ) ? entry.displayName : entry.model;
+      ) {
+        label = entry.displayName;
+      }
       return {
         text: entry.model === model ? `✓ ${label}` : label,
         callback_data: `cfg:model:${entry.model}`,
@@ -325,33 +340,30 @@ function createFormatConfigInfoText({
       ? codexModels.length > 0 ? [
         '',
         '**Models**',
-        ...codexModels.map((entry) => {
-          const displayName = (
-            typeof entry.displayName === 'string'
-            && entry.displayName.length > 0
-            && entry.displayName !== entry.model
-          ) ? ` — ${entry.displayName}` : '';
-          return `• **${entry.model}**${displayName}`;
-        }),
+        ...codexModels.map(
+          (entry) => `• **${codexModelLabel(entry.model)}** — ${entry.model}`,
+        ),
       ].join('\n') : [
         '',
         '**Models**',
-        'Models are unavailable until Codex preflight succeeds.',
+        hasCodexCatalogModels(runtimeView)
+          ? 'Sol, Terra, and Luna are unavailable for this account.'
+          : 'Models are unavailable until Codex preflight succeeds.',
       ].join('\n')
       : [
         '',
         '**Models**',
-        '🧠 **opus** — deep analysis, code refactor, multi-source reconciliation. ~1.7× sonnet cost.',
-        '🤖 **sonnet** — default. Most ops, code review, document summary.',
-        '⚡ **haiku** — quick simple tasks, classification, lookup.',
+        '🧠 **opus** — deepest reasoning',
+        '🤖 **sonnet** — balanced default',
+        '⚡ **haiku** — fastest',
       ].join('\n');
 
     const effortHelp = codex
       ? codexEfforts.length > 0 ? [
         '',
-        `**Effort** — authenticated options for ${codexModel}:`,
-        ...codexEfforts.map((value) => `• **${value}**`),
-        'Model and effort changes apply to the next turn; an active turn is unchanged.',
+        `**Effort for ${codexModelLabel(codexModel)}**`,
+        codexEfforts.map((value) => `**${value}**`).join(' · '),
+        'Changes apply on the next turn; an active turn is unchanged.',
       ].join('\n') : [
         '',
         '**Effort**',
@@ -359,11 +371,9 @@ function createFormatConfigInfoText({
       ].join('\n')
       : [
         '',
-        '**Effort** — ceiling on how much Claude can think. Simple questions get fast replies; hard ones spend more tokens. Safe to set higher — Claude scales down automatically when it doesn\'t need to think.',
-        '• **low** — fast replies, minimum reasoning. Casual chat, simple lookups.',
-        '• **medium** — balanced default. Fits most use cases.',
-        '• **high** — multi-step tasks. Audit, debug, multi-source analysis.',
-        '• **xhigh** / **max** — heaviest. Hard reasoning, edge cases.',
+        '**Effort**',
+        '**low** · **medium** · **high** · **xhigh** · **max**',
+        'Higher values allow more reasoning when needed.',
       ].join('\n');
 
     // The card is its buttons. Everything the body used to state — model,
@@ -373,11 +383,10 @@ function createFormatConfigInfoText({
     // button to live on.
     let body = '⚙️ Settings';
     if (codex) {
-      body += '\n\nNative Codex beta: command network and web search are disabled. '
-        + 'Product MCP tools and interactive approvals are unavailable. '
-        + 'Detached/background servers are unsupported and may survive hard runtime loss. '
-        + 'Native goals are disabled for Polygram-managed Codex sessions until '
-        + 'native goal support is implemented.';
+      body += '\n\n_Codex beta: no command network, web search, product MCP tools, '
+        + 'or interactive approvals. Detached/background servers are unsupported '
+        + 'and may survive hard runtime loss. '
+        + 'Native goals are currently disabled._';
     }
     if (show === 'model' || show === 'all') body += '\n' + modelHelp;
     if (show === 'effort' || show === 'all') body += '\n' + effortHelp;

package/lib/ipc/restart-request-id.js

@@ -0,0 +1,17 @@
+'use strict';
+
+function requireRestartRequestId(value) {
+  if (
+    typeof value !== 'string'
+    || value.length === 0
+    || Buffer.byteLength(value, 'utf8') > 128
+    || /[\x00-\x1f\x7f]/.test(value)
+  ) {
+    const error = new Error('deploy restart request ID is invalid');
+    error.code = 'INVALID_DEPLOY_RESTART_REQUEST_ID';
+    throw error;
+  }
+  return value;
+}
+
+module.exports = { requireRestartRequestId };

package/lib/telegram/display-hint.js

@@ -90,6 +90,7 @@ const richSection = (inlineMedia) => [
   '- A numbered sequence (steps, ranked facts, top-N) → a real ordered list (`1.` at line start, continuation lines indented under their item), not bold pseudo-items like `**1. First thing.**` on their own paragraphs. A real list renders with native numbering and hanging indentation; the bold fake renders as flat paragraphs that merely start with a digit.',
   '- A list of items each with a yes/no/pending state (approve this? confirm that?) → a real task list (`- [ ] item`), not `• item` with an emoji glued on.',
   '- A comparison or key/value summary → a real markdown table.',
+  '- Rows and columns you are laying out yourself → a real markdown table, never hand-aligned columns inside a ``` fence. A fence is not a table: its columns are just whitespace you typed, so the client cannot re-lay-out them to fit and on a narrow screen the rows break mid-row and the alignment collapses into noise. Keep fences for code, logs, and command output you are quoting verbatim — including output that is already table-shaped, which you reproduce exactly rather than retype as a markdown table.',
   '- A quoted aside, caveat, or callout you want visually set apart → a real blockquote (`> like this`), not a bold prefix.',
   '- A visual break between distinct sections of a long reply → a real divider (`---` on its own line), the same way you already reach for it, but now it renders as a divider instead of literal dashes.',
   '- Verbose supporting detail (a diff, a log, raw output) you want available but not front-and-center → `<details><summary>Label</summary>...</details>`.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.37.1",
+  "version": "0.38.0",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {

package/polygram.js

@@ -31,6 +31,9 @@ const {
 const { buildPrompt, resolvePromptBackend } = require('./lib/prompt');
 const { countInFlight } = require('./lib/queue-utils');
 const { createIpcHandlers } = require('./lib/ipc/handlers');
+const {
+  requireRestartRequestId,
+} = require('./lib/ipc/restart-request-id');
 const { classifyOrphanSweep } = require('./lib/ops/tmux-preflight');
 const {
   parseSystemdInvocationId,
@@ -98,6 +101,10 @@ const { createDownloadAttachments } = require('./lib/handlers/download');
 const { createHandleConfigCallback } = require('./lib/handlers/config-callback');
 const { createHandleAbort } = require('./lib/handlers/abort');
 const { createAutosteerHandlers } = require('./lib/handlers/autosteer');
+const {
+  settleAcceptedAutosteerOwnership,
+  shouldDispatchPrimaryAfterAutosteer,
+} = require('./lib/handlers/claude-autosteer-ownership');
 const { createEditCorrectionInjector } = require('./lib/handlers/edit-correction');
 const { createEditRedelivery } = require('./lib/handlers/edit-redelivery');
 const { createGateInbound, ADMIN_CMD_RE, PAIR_CLAIM_RE } = require('./lib/handlers/gate-inbound');
@@ -475,6 +482,13 @@ let richEditMessageText;
 // classification, but it never throws: its caller holds the only copy of the
 // reply and owns the plain fallback.
 let richSendMessage;
+// The rich half of the reply-tool delivery chain, hoisted so the interactive
+// turn path can reuse the same instance rather than configure a second one.
+// Two instances would be two capability latches, two styling verdicts and two
+// sets of ceilings to keep in step; one is the only way they cannot drift.
+// Null until main() wires it — callers fall back to plain, which is what a
+// chat without rich gets anyway.
+let makeRichDeliverText = null;
 let richMediaFileIdCache;
 
 // 0.15 secret redaction (agent-flagged path): the agent marks a secret it saw
@@ -1547,12 +1561,15 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
   // path — same contract for "not opted in", "capability known
   // unsupported", and "content doesn't need it" (needsRichRendering
   // inside toTelegramRichBlocks handles the last one).
-  // Rich delivery is limited to this interactive streamer instance.
-  // A reply that never crosses minChars (stays idle → delivered via
-  // deliverReplies) and any non-streaming send path — autonomous-wakeup/
+  // This callback covers the streamed bubble only. A turn that ends with
+  // text instead of streaming it renders rich too, through the reply tool's
+  // own factory reused at the non-streamed branch below — one gate, one
+  // sender, one latch, so the same markdown cannot format two ways
+  // depending on how the answer arrived.
+  // Still plain: the non-streaming send paths — autonomous-wakeup/
   // auto-resume/autosteer via lib/telegram/process-agent-reply.js, cron/
-  // IPC sends — never render rich even when richText is on and the
-  // content qualifies. Those delivery paths intentionally remain plain.
+  // IPC sends. Those render plain even when richText is on and the content
+  // qualifies.
   // Re-read both controls for every flush so a config change or a
   // capability result applies to the turn already in progress.
   // Typed media resolution for rich replies. Same
@@ -2024,6 +2041,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
   let sendPromise = null;
   let codexDispatch = null;
   let codexDispatchDecision = null;
+  let acceptedAutosteerProvider = null;
   try {
     const current = pm.get(sessionKey);
     const liveCodexGeneration = Boolean(
@@ -2070,6 +2088,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
               msg,
               prompt,
             });
+            acceptedAutosteerProvider = 'codex';
             if (steered.outcome === 'accepted') {
               try {
                 codexRuntimeController.finalizeAcceptedSteer({
@@ -2196,12 +2215,23 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         msg,
         prompt,
       });
+      acceptedAutosteerProvider = 'claude';
     }
-    if (
-      !steered.autosteered
-      && !['duplicate', 'ambiguous', 'unavailable']
-        .includes(codexDispatchDecision)
-    ) {
+    steered = settleAcceptedAutosteerOwnership({
+      selectedProvider: acceptedAutosteerProvider,
+      steered,
+      db,
+      chatId,
+      msgId: msg.message_id,
+      sessionKey,
+      logLabel: label,
+      logEvent,
+      logger: console,
+    });
+    if (shouldDispatchPrimaryAfterAutosteer({
+      steered,
+      codexDispatchDecision,
+    })) {
       if (codexDispatchDecision === 'queue') {
         reactor.setState('THINKING');
       }
@@ -2279,6 +2309,31 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
     }
     return;
   }
+  if (steered.outcome === 'accepted-persistence-ambiguous') {
+    stopTyping();
+    await finishStreamer();
+    await reactor.clear().catch(() => {});
+    reactor.stop();
+    await tg(bot, 'sendMessage', {
+      chat_id: chatId,
+      text: 'This follow-up may have been incorporated. Please wait for the current turn to finish before retrying it.',
+      ...replyOpts(threadId),
+    }, {
+      source: 'claude-autosteer-notice',
+      botName: BOT_NAME,
+    }).catch((error) => {
+      console.error(
+        `[${label}] failed to send Claude autosteer ambiguity notice: ${error.message}`,
+      );
+      logEvent('autosteer-ambiguity-notice-failed', {
+        chat_id: chatId,
+        msg_id: msg.message_id,
+        session_key: sessionKey,
+        code: error?.code || error?.name || 'unknown',
+      });
+    });
+    return;
+  }
   if (['ambiguous', 'unavailable'].includes(codexDispatchDecision)) {
     stopTyping();
     await finishStreamer();
@@ -2862,27 +2917,78 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         console.error(`[${label}] sendSticker failed: ${err.message}`);
       });
     } else if (parsed.text) {
-      // 0.7.0: use markdown-aware chunker + deliverReplies primitive.
-      // The old chunkText was newline/byte-only; chunkMarkdownText also
-      // respects code-fence boundaries (closes + reopens across chunks).
-      // Short replies never went live-rich, so image markdown from a
-      // rich-enabled chat degrades to caption text here too — never a
-      // raw local path in the bubble.
-      const shortText = resolveRichTextEnabled(config, chatId, threadId)
-        ? stripMediaMarkdown(parsed.text)
-        : parsed.text;
-      const chunks = chunkMarkdownText(shortText, TG_CHUNK_BUDGET);
-      const deliveryResult = await deliverReplies({
-        bot,
-        send: (b, method, params, m) => tg(b, method, params, m),
-        chatId,
-        threadId,
-        chunks,
-        replyToMessageId: msg.message_id,
-        meta: outMeta,
-        logger: { error: (m) => console.error(`[${label}] ${m}`) },
-      });
-      mediaContext.recordTextFailures(deliveryResult.failed.length);
+      // A turn that ends with text instead of calling the reply tool lands
+      // here. It is the same agent writing the same markdown as the reply
+      // tool, so it renders through the same gate and the same sender —
+      // otherwise a table is a table or a wall of pipes depending only on
+      // which way the answer happened to arrive, which is not a distinction
+      // the reader can see or act on.
+      //
+      // Text-only by construction: no allowedRoots, so media stays degraded
+      // to caption text exactly as it was here before, and this path opens no
+      // upload surface of its own.
+      // Wrapped even though the factory is contracted not to throw: that
+      // contract is convention, and its styling-retry ladder evaluates
+      // blocksAreStyled/flattenStyledBlocks outside any try. A throw escaping
+      // here would skip the plain arm and cost the whole reply, so this catch
+      // is the difference between a flat answer and no answer.
+      let richOut = null;
+      try {
+        richOut = makeRichDeliverText
+          ? await makeRichDeliverText({ chatId, threadId })({
+            text: parsed.text,
+            replyToMessageId: msg.message_id,
+            // Its own source, because rich-message-sent carries none and the
+            // streamed rich open reports as bot-reply-stream-open-rich.
+            // Without a distinct tag nothing downstream can tell this branch
+            // from the other sites writing the bare streamer tag.
+            meta: { ...outMeta, source: 'bot-reply-final-rich' },
+          })
+          : null;
+      } catch (richErr) {
+        // Named apart from the turn's own `err` on purpose: this is the
+        // rich attempt failing, not the turn, and the completion tail is
+        // located in tests by scanning for the turn handler's catch.
+        console.error(`[${label}] rich delivery threw, falling back to plain: ${richErr.message}`);
+        richOut = null;
+      }
+      if (richOut?.handled) {
+        // One bubble, no chunks, nothing failed — but still report, because
+        // this is the same incomplete-delivery gate the plain arm feeds and
+        // it must hear from whichever arm ran.
+        mediaContext.recordTextFailures(richOut.failed.length);
+      } else {
+        // 0.7.0: use markdown-aware chunker + deliverReplies primitive.
+        // The old chunkText was newline/byte-only; chunkMarkdownText also
+        // respects code-fence boundaries (closes + reopens across chunks).
+        // Image markdown from a rich-enabled chat degrades to caption text
+        // here too — never a raw local path in the bubble.
+        //
+        // The `??` arm is load-bearing: a chat with rich off declines with
+        // no body at all, and chunking `undefined` would drop the reply
+        // entirely for most of the fleet. Both arms strip through the same
+        // call, so the delivered text is byte-identical either way.
+        const shortText = richOut?.text ?? (resolveRichTextEnabled(config, chatId, threadId)
+          ? stripMediaMarkdown(parsed.text)
+          : parsed.text);
+        const chunks = chunkMarkdownText(shortText, TG_CHUNK_BUDGET);
+        const deliveryResult = await deliverReplies({
+          bot,
+          send: (b, method, params, m) => tg(b, method, params, m),
+          chatId,
+          threadId,
+          chunks,
+          replyToMessageId: msg.message_id,
+          // Tagged like its rich sibling. Five call sites write the bare
+          // 'bot-reply-stream' tag and three of them deliver reply bodies,
+          // so a row carrying it says nothing about which one produced it.
+          // Naming both arms makes this branch identifiable from the
+          // messages table whichever way the reply went out.
+          meta: { ...outMeta, source: 'bot-reply-final' },
+          logger: { error: (m) => console.error(`[${label}] ${m}`) },
+        });
+        mediaContext.recordTextFailures(deliveryResult.failed.length);
+      }
     }
 
     // A turn whose final output was a solo sticker/reaction skips the
@@ -4017,6 +4123,38 @@ async function main() {
   //
   // Neither feature may switch the other off, which a single strategy slot
   // could not express.
+  // Built before the chain rather than inline in it, because the interactive
+  // turn path reuses this exact instance for its non-streamed replies. See
+  // the makeRichDeliverText declaration for why it must be one instance.
+  // Injected rather than imported by the dispatcher: rich-media.js requires
+  // the dispatcher module, so the reverse direction would be a require cycle.
+  makeRichDeliverText = createRichDeliveryFactory({
+    bot,
+    sendRich: (args) => richSendMessage(args),
+    isRichTextEnabled: (chatId, threadId) => resolveRichTextEnabled(config, chatId, threadId),
+    getRichKnownUnsupported: () => richSendKnownUnsupported,
+    // No config knob: the automatic flatten-and-retry below IS the control,
+    // and it needs no operator to notice anything. A knob would add a state
+    // where styling is off while the server accepts it, which nothing in
+    // the system can detect or correct.
+    isInlineStylingEnabled: () => !richInlineStylingUnsupported,
+    onStylingRejected: () => richStylingLatch?.recordStylingRejection(),
+    onStylingAccepted: () => richStylingLatch?.recordHealthyOutcome(),
+    redactError: redactBotToken,
+    // Media for one reply. The envelope itself (no URL media, the `files:`
+    // fan-out ceiling, the shared stat) lives in rich-media.js so it is
+    // pinned by behavior rather than by this literal — nothing executes
+    // this file. `allowedRoots` arrives per call from the dispatcher, which
+    // computed it once and validates `files:` against that very array, so a
+    // path the reply tool may upload is exactly a path image syntax may
+    // upload. The interactive path passes none, so it renders text-only.
+    makeMediaWiring: makeReplyMediaWiring({
+      config,
+      fileIdCache: richMediaFileIdCache,
+      logEvent,
+      botName: BOT_NAME,
+    }),
+  });
   const makeDeliverText = composeDeliverTextFactories([
     createDeliverTextFactory({
       registry: streamerRegistry,
@@ -4034,35 +4172,7 @@ async function main() {
         resolveRichTextEnabled(config, chatId, threadId) ? stripMediaMarkdown(text) : text
       ),
     }),
-    // Injected rather than imported by the dispatcher: rich-media.js requires
-    // the dispatcher module, so the reverse direction would be a require cycle.
-    createRichDeliveryFactory({
-      bot,
-      sendRich: (args) => richSendMessage(args),
-      isRichTextEnabled: (chatId, threadId) => resolveRichTextEnabled(config, chatId, threadId),
-      getRichKnownUnsupported: () => richSendKnownUnsupported,
-      // No config knob: the automatic flatten-and-retry below IS the control,
-      // and it needs no operator to notice anything. A knob would add a state
-      // where styling is off while the server accepts it, which nothing in
-      // the system can detect or correct.
-      isInlineStylingEnabled: () => !richInlineStylingUnsupported,
-      onStylingRejected: () => richStylingLatch?.recordStylingRejection(),
-      onStylingAccepted: () => richStylingLatch?.recordHealthyOutcome(),
-      redactError: redactBotToken,
-      // Media for one reply. The envelope itself (no URL media, the `files:`
-      // fan-out ceiling, the shared stat) lives in rich-media.js so it is
-      // pinned by behavior rather than by this literal — nothing executes
-      // this file. `allowedRoots` arrives per call from the dispatcher, which
-      // computed it once and validates `files:` against that very array, so a
-      // path the reply tool may upload is exactly a path image syntax may
-      // upload.
-      makeMediaWiring: makeReplyMediaWiring({
-        config,
-        fileIdCache: richMediaFileIdCache,
-        logEvent,
-        botName: BOT_NAME,
-      }),
-    }),
+    makeRichDeliverText,
   ]);
 
   // The edit tool's counterpart to the reply chain above. An agent that posts
@@ -4419,7 +4529,11 @@ async function main() {
   // replay picks it up. Prevents "Sorry, I couldn't process that message"
   // from showing on every restart.
   const SHUTDOWN_DRAIN_MS = 30_000;
-  const shutdown = async ({ continuationAuthorized = false, trigger = 'signal' } = {}) => {
+  const shutdown = async ({
+    continuationAuthorized = false,
+    trigger = 'signal',
+    restartRequestId = null,
+  } = {}) => {
     if (isShuttingDown) return;
     const shutdownObservation = cgroupOomObserver.sample();
     // Sample in-flight work at SIGNAL time, alongside the OOM observation and
@@ -4611,6 +4725,12 @@ async function main() {
           elapsed_ms: drainElapsed,
           clean: res.clean,
           shutdown_reason: res.shutdownReason,
+          restart_trigger: trigger,
+          continuation_authorized: continuationAuthorized === true,
+          resume_intents_recorded: res.intentsRecorded ?? 0,
+          restart_request_id: trigger === 'deploy-ipc'
+            ? restartRequestId
+            : null,
           ...(res.oomKillDelta != null ? { oom_kill_delta: res.oomKillDelta } : {}),
         }, invocationId));
         console.log(`[shutdown] ${res.clean ? 'clean' : 'crash-like'} shutdown recorded (${res.shutdownReason}); ${inFlightAtSignal} in-flight at signal, drained ${drainElapsed}ms, ${remaining} still in-flight, ${res.replayMarked} marked replay-pending`);
@@ -4684,16 +4804,18 @@ async function main() {
         botName: BOT_NAME,
         getInFlightHandlers: () => inFlightHandlers,
         handleSendOverIpc: (req) => handleSendOverIpc(req),
-        requestDeployRestart: () => {
+        requestDeployRestart: (req) => {
           if (isShuttingDown) {
             const error = new Error('shutdown already in progress');
             error.code = 'SHUTDOWN_IN_PROGRESS';
             throw error;
           }
+          const restartRequestId = requireRestartRequestId(req.id);
           const oldPid = process.pid;
           shutdown({
             continuationAuthorized: true,
             trigger: 'deploy-ipc',
+            restartRequestId,
           }).catch((error) => {
             console.error(`[shutdown] deploy restart failed: ${error.message}`);
           });

package/scripts/ipc-smoke.js

@@ -1,10 +1,18 @@
 #!/usr/bin/env node
 /**
  * Quick IPC round-trip probe.
- * Usage: node scripts/ipc-smoke.js <bot-name> [busy|restart]
+ * Usage: node scripts/ipc-smoke.js <bot-name> [busy|restart] [restart-request-id]
  */
 
+const crypto = require('node:crypto');
 const { call, readSecret, socketPathFor } = require('../lib/ipc/client');
+const {
+  requireRestartRequestId,
+} = require('../lib/ipc/restart-request-id');
+
+function restartRequestId(value) {
+  return requireRestartRequestId(value || crypto.randomUUID());
+}
 
 (async () => {
   const bot = process.argv[2] || 'shumabit';
@@ -33,15 +41,18 @@ const { call, readSecret, socketPathFor } = require('../lib/ipc/client');
   }
 
   if (command === 'restart') {
+    const requestId = restartRequestId(process.argv[4]);
     const result = await call({
       path,
       op: 'deploy_restart',
+      id: requestId,
       secret: readSecret(bot),
       callTimeoutMs: 60_000,
     });
     if (
       result.ok !== true
       || result.accepted !== true
+      || result.id !== requestId
       || !Number.isSafeInteger(result.old_pid)
       || result.old_pid <= 1
     ) {
@@ -51,6 +62,7 @@ const { call, readSecret, socketPathFor } = require('../lib/ipc/client');
       bot,
       accepted: true,
       old_pid: result.old_pid,
+      restart_request_id: requestId,
     }));
     return;
   }