sintbot 1.4.1 → 1.4.3

package/CHANGELOG.en.json

@@ -1,4 +1,46 @@
 [
+  {
+    "version": "1.4.3",
+    "date": "2026-11-09",
+    "name": "Progress on the reply card",
+    "items": [
+      {
+        "t": "A card appears even before any output",
+        "d": "If nothing has been produced after 25 seconds, a \"Received, working on it\" card appears and the answer later replaces it in place. A turn that ends without a reply recalls that card."
+      },
+      {
+        "t": "The card shows how far the task has got",
+        "d": "While running, one line updates every 15 seconds: how long it has run and what it is doing (reading, editing or writing which file, running a command, searching the web; file names only). After 10 minutes it updates once a minute, and notes when nothing has happened for more than 2 minutes. Delivered steps such as writing files, committing or pushing, and sending files to the group are listed with ▶ at the top of the card and fold into a \"Process\" section when the turn ends."
+      },
+      {
+        "t": "/status shows progress",
+        "d": "While running it shows how many steps have run, how long ago the last activity was, and what it is doing."
+      },
+      {
+        "t": "Fix: a streamed reply could fail the whole turn",
+        "d": "Text that arrived while the previous update was still being sent used to fail the turn; it now queues behind it and keeps updating the card."
+      }
+    ]
+  },
+  {
+    "version": "1.4.2",
+    "date": "2026-11-09",
+    "name": "Check and install new versions from the console",
+    "items": [
+      {
+        "t": "Version checks in the console",
+        "d": "Software updates in Settings checks for stable releases at startup and daily and shows release notes when a new version is available."
+      },
+      {
+        "t": "One-click upgrade for background runs",
+        "d": "When a launchd agent runs SintBot, Upgrade now waits until every group is idle and settled, installs the new version into its own folder and switches to it; if it does not connect every group within 90 seconds, the previous version is restored. New messages wait about a minute during the switch and are asked to be resent."
+      },
+      {
+        "t": "Steps for foreground runs",
+        "d": "A foreground run shows how to stop, reinstall and start. Upgrades are not announced in groups."
+      }
+    ]
+  },
   {
     "version": "1.4.1",
     "date": "2026-11-09",

package/CHANGELOG.json

@@ -1,4 +1,46 @@
 [
+  {
+    "version": "1.4.3",
+    "date": "2026-11-09",
+    "name": "回复卡片显示进度",
+    "items": [
+      {
+        "t": "一时没有输出也先回一张卡",
+        "d": "25 秒还没有任何输出时，先出一张「已收到，正在处理」卡片；回答出来后在同一张卡里替换。这一轮最后决定不回复时，撤回这张卡。"
+      },
+      {
+        "t": "卡片显示做到哪了",
+        "d": "运行中每 15 秒更新一行：已跑多久、最近在做什么（看、改、写哪个文件，跑命令，查网页等，只给文件名）；跑满 10 分钟后改为每分钟一次，超过 2 分钟没有新动静会注明。写改文件、提交推送、发文件到群这类交付动作以 ▶ 列在卡片上方，结束后收进「过程」折叠区。"
+      },
+      {
+        "t": "/status 显示进度",
+        "d": "运行中会显示已执行几步、最近一次动静在多久前，以及最近在做什么。"
+      },
+      {
+        "t": "修复：流式回复偶发整轮失败",
+        "d": "上一段内容还在发送时又来一段文字，原来会让这一轮失败；现在排在后面继续更新卡片。"
+      }
+    ]
+  },
+  {
+    "version": "1.4.2",
+    "date": "2026-11-09",
+    "name": "在控制台查看和安装新版本",
+    "items": [
+      {
+        "t": "控制台检查新版本",
+        "d": "设置页的软件更新启动时和每天各检查一次正式版，有新版本时提示并附发布说明。"
+      },
+      {
+        "t": "后台运行时一键升级",
+        "d": "由 launchd 后台任务运行时，点「现在升级」会等所有群空闲、记录结清后，把新版本装到单独的目录再切换；新版本 90 秒内没连上全部群会自动换回旧版。切换期间约一分钟不处理新消息，会提示稍后重发。"
+      },
+      {
+        "t": "前台运行给出升级步骤",
+        "d": "前台运行时卡片说明如何停止、重新安装并启动。升级不在群里播报。"
+      }
+    ]
+  },
   {
     "version": "1.4.1",
     "date": "2026-11-09",

package/bin/sintbot-v2.js

@@ -112,6 +112,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
   let service
   let ui
   let configControl
+  let updater
   let liveTransport
   let onSigint, onSigterm
   try {
@@ -157,6 +158,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       if (finishing) return
       finishing = true
       ui?.close()
+      updater?.close()
       lock.release()
       process.stderr.write(`C2 multi-group · ${result.reason}; platform stopped=${result.platformStopped}; runner drained=${result.drained}\n`,
         () => process.exit(result.code))
@@ -255,8 +257,24 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     configControl = require('../src/c2configcontrol').createC2ConfigControl({
       installation, getBindings: () => service.bindings, getHeld: () => service.held,
       assertWriterLock, store,
-      activateRoute: route => service.addRoute(route),
+      activateRoute: route => service.addRoute(route), isFrozen: () => service.inMaintenance,
       log: message => process.stderr.write(`C2 multi-group · ${message}\n`) })
+    if (!preflightOnly) {
+      // Console software updates. Only a launchd job that starts this exact
+      // entry may upgrade, and only while every group is idle and settled.
+      const c2updates = require('../src/c2updater')
+      const pkg = require('../package.json')
+      const upgradeGate = c2updates.createC2UpgradeGate({ isRunning: () => running,
+        service: () => service, capacity, assertJournalScope })
+      updater = c2updates.createC2Updater({ currentVersion: pkg.version,
+        runMode: c2updates.detectRunMode({ privateBuild: pkg.private === true, entry: __filename }),
+        stateFile: path.join(stateDir, 'update.json'), dataDir: stateDir, configPath: cfg._path,
+        gate: upgradeGate, beginMaintenance: () => service.beginMaintenance(),
+        endMaintenance: () => service.endMaintenance(), expectedGroups: () => service.bindings.size,
+        registries: c2updates.registriesFromEnv(),
+        fetchImpl: require('../src/core/proxy').getProxyFetch() || globalThis.fetch,
+        autoCheck: uiEnabled, log: message => process.stderr.write(`C2 update · ${message}\n`) })
+    }
     const stop = reason => { void service.stop(reason, 0).then(finish) }
     onSigint = () => stop('SIGINT')
     onSigterm = () => stop('SIGTERM')
@@ -268,7 +286,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
         getConfig: () => cfg, getBindings: () => service.bindings,
         getHeld: () => service.held, getCapacity: () => capacity.snapshot(),
         getConnHealth: () => liveTransport?.platform.connHealth?.() || {},
-        assertWriterLock, ...configControl,
+        assertWriterLock, ...configControl, updater,
         log: message => process.stderr.write(`Console · ${message}\n`) })
       await new Promise((resolve, reject) => {
         ui.server.once('error', reject)
@@ -287,6 +305,10 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     for (const item of started.held || []) {
       process.stderr.write(`SintBot group ${item.chatId} is held: ${item.reason}\n`)
     }
+    // A console upgrade that switched to this version is done once every
+    // group is connected; then the daily version check starts.
+    if (!started.held?.length) updater?.confirmStarted()
+    void updater?.start()
   } catch (error) {
     ui?.close()
     const stopped = await service?.stop('startup-failed', 1)
@@ -297,6 +319,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     throw error
   } finally {
     if (!running) {
+      updater?.close()
       if (onSigint) process.off('SIGINT', onSigint)
       if (onSigterm) process.off('SIGTERM', onSigterm)
       capacity.close(); lock.release()
@@ -356,6 +379,14 @@ async function main(argv = process.argv.slice(2)) {
     process.stdout.write(HELP)
     return
   }
+  if (sub === 'upgrade-switch') {
+    // Internal: started detached by a console upgrade; never run it by hand.
+    const { values } = parseArgs({ args: rest, allowPositionals: false, options: { state: { type: 'string' } } })
+    if (!values.state || !path.isAbsolute(values.state)) throw new Error('upgrade-switch needs --state <absolute path>')
+    const outcome = await require('../src/c2upgradeswitch').runUpgradeSwitch({ stateFile: values.state })
+    process.exitCode = outcome === 'done' ? 0 : 1
+    return
+  }
   if (!['init', 'start', 'incident'].includes(sub)) {
     throw new Error(`${sub} is unavailable in this release; use sintbot help`)
   }

package/docs/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.1 with an AI assistant
+# Install SintBot 1.4.3 with an AI assistant
 
 English · [简体中文](./zh-CN/AI-ASSISTED-INSTALL.md)
 
@@ -15,5 +15,5 @@ Use the terminal on the Mac that will run SintBot. A cloud shell cannot install
 ## Copyable request
 
 ```text
-Install SintBot 1.4.1 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
+Install SintBot 1.4.3 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
 ```

package/docs/install.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.1
+# Install SintBot 1.4.3
 
 English · [简体中文](./zh-CN/install.md)
 
@@ -10,7 +10,7 @@ You need a Mac, Node.js 22 or newer, and projects stored on that Mac. Install an
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-The installer checks the environment, installs `sintbot@1.4.1` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.1`. No sudo is needed.
+The installer checks the environment, installs `sintbot@1.4.3` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.3`. No sudo is needed.
 
 To preview, append `-s -- --dry-run`. To choose another location, set `SINTBOT_INSTALL_DIR` and adjust the executable paths below.
 
@@ -86,12 +86,12 @@ In a group, send "Read the first line of the project README and reply with only
 
 ## 5. Use it in a group
 
-Any text message is a task. Replies arrive in a card that appears once the model starts answering and refreshes as it works.
+Any text message is a task. Replies arrive in a card that appears once the model starts answering, or after 25 seconds if it is still working without output. While the task runs, the card shows how long it has run, what it is doing and the steps already delivered; at the end those steps fold into a Process section.
 
 | Command | Effect |
 | --- | --- |
 | `/help` | List commands |
-| `/status` | Group status: model, project, busy or idle, queue |
+| `/status` | Group status: model, project, busy or idle (steps and current work while busy), queue |
 | `/model` | List models; `/model name` switches (only while the group is idle; starts a new conversation) |
 | `/new` | Start a new conversation (only while the group is idle) |
 | `/stop` | Stop the current task and cancel queued ones |
@@ -104,6 +104,8 @@ Messages sent while a task runs are added to that task in Codex groups (`codexSt
 
 With `--ui`, open `http://127.0.0.1:4600` on this Mac. The console shows each group (a paused group shows Needs attention), stops tasks, binds new groups, and switches the model or project folder of an idle group. For LAN access, set a console password in its settings first, then enable LAN access.
 
+Settings → Software updates checks for new releases. In the foreground setup above it shows the upgrade steps: press Ctrl-C and wait for exit, rerun the one-line installer, then start again with the same command. If your own launchd agent starts SintBot, Upgrade now waits until every group is idle and settled, installs the new version into `~/.local/share/sintbot/releases/<version>` and switches the agent to it; if the new version does not connect every group within 90 seconds, the previous one is restored. Upgrades are not announced in groups.
+
 You can also add a group without the console: add it to the configuration, stop the service and run `start` again; the new group is registered automatically. Bound groups cannot be removed or renamed by editing the configuration.
 
 ## Stop and restart

package/docs/zh-CN/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# 用 AI 助手安装 SintBot 1.4.1
+# 用 AI 助手安装 SintBot 1.4.3
 
 [English](../AI-ASSISTED-INSTALL.md) · 简体中文
 
@@ -15,5 +15,5 @@
 ## 可复制的请求
 
 ```text
-按一行安装指南，在这台 Mac 安装 SintBot 1.4.1。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
+按一行安装指南，在这台 Mac 安装 SintBot 1.4.3。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
 ```

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.1
+# 安装 SintBot 1.4.3
 
 [English](../install.md) · 简体中文
 
@@ -10,7 +10,7 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.1` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.1` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.3` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.3` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 
@@ -86,12 +86,12 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 
 ## 5. 在群里使用
 
-直接发文字就是给它派任务。回复以卡片呈现，模型开始输出后就会出现并随进度刷新。
+直接发文字就是给它派任务。回复以卡片呈现：模型开始输出时出现；25 秒还没有输出也会先出现。运行中卡片显示已跑多久、正在做什么和已完成的步骤，结束后这些步骤收进「过程」折叠区。
 
 | 命令 | 作用 |
 | --- | --- |
 | `/help` | 查看可用命令 |
-| `/status` | 本群状态：模型、项目、是否在忙、排队数 |
+| `/status` | 本群状态：模型、项目、是否在忙（在忙时含步数和正在做什么）、排队数 |
 | `/model` | 查看可选模型；`/model 名字` 切换（只在本群空闲时生效，切换后开始新的一段对话） |
 | `/new` | 开始新的一段对话（只在本群空闲时生效） |
 | `/stop` | 停止当前任务，连同排队的一起取消 |
@@ -104,6 +104,8 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 
 带 `--ui` 启动后，在本机浏览器打开 `http://127.0.0.1:4600`。控制台可以查看各群状态（暂停的群显示「需要处理」）、停止任务、绑定新群、给空闲的群切换模型或项目目录。要从局域网访问，先在控制台的设置里设访问密码，再开启局域网访问。
 
+「设置 → 软件更新」会检查新版本。按上面前台方式运行时，卡片给出升级步骤：按 Ctrl-C 等待退出，重新运行一行安装命令，再用原来的命令启动。如果用你自己的 launchd 后台任务启动 SintBot，「现在升级」会等所有群空闲、记录结清后，把新版本装到 `~/.local/share/sintbot/releases/<版本>` 并切换过去；新版本 90 秒内没连上全部群会自动换回旧版。升级不在群里播报。
+
 不用控制台也能加群：在配置里加上新群，停止后重新 `start` 即可，新群会自动登记。已绑定的群不能通过改配置删除或改名。
 
 ## 停止与重启

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.1
+  version=1.4.3
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {
@@ -63,6 +63,8 @@
     "src/c2migration.js",
     "src/c2multigroupcapacity.js",
     "src/c2multigroupservice.js",
+    "src/c2updater.js",
+    "src/c2upgradeswitch.js",
     "src/cdp.js",
     "src/config.js",
     "src/core/c2cardeffectbridge.js",
@@ -101,6 +103,7 @@
     "src/core/redact.js",
     "src/core/store.js",
     "src/core/time.js",
+    "src/core/turnprogress.js",
     "src/core/v2engine.js",
     "src/core/verify.js",
     "src/design.js",
@@ -129,6 +132,7 @@
     "src/ui/serverbase.js",
     "src/ui/sessions.js",
     "src/ui/takeover.js",
+    "src/updater.js",
     "src/usage.js"
   ],
   "scripts": {

package/src/c2configcontrol.js

@@ -19,9 +19,9 @@ const RESET_KEYS = ['provider', 'model', 'workdir', 'codexApp']
 // It never moves a journal, settles a receipt or reconnects the platform.
 function createC2ConfigControl({ installation, getBindings, getHeld = () => new Map(),
   assertWriterLock, store = null, activateRoute = null, probeRunner = assertRunnerExecutable,
-  log = () => {} } = {}) {
+  isFrozen = () => false, log = () => {} } = {}) {
   if (!installation?.cfg?._path || typeof getBindings !== 'function' ||
-      typeof getHeld !== 'function' ||
+      typeof getHeld !== 'function' || typeof isFrozen !== 'function' ||
       typeof assertWriterLock !== 'function' ||
       store !== null && typeof store.resetGroupSession !== 'function' ||
       activateRoute !== null && typeof activateRoute !== 'function' ||
@@ -47,6 +47,7 @@ function createC2ConfigControl({ installation, getBindings, getHeld = () => new
   function validateConfig(raw) {
     prepared = null
     held()
+    if (isFrozen()) throw new Error('SintBot is upgrading; settings cannot change until it restarts')
     const next = loadInstallationFromRaw(raw, cfg._path, { dataDir: stateDir,
       allowAddedGroups: !!activateRoute && !!store })
     const bindings = getBindings()

package/src/c2console.js

@@ -17,7 +17,10 @@ const WRITE_PATHS = ['/api/login', '/api/logout', '/api/logout/all',
   '/api/groups/order', '/api/groups/policy', '/api/groups/redact',
   '/api/groups/codex-steer', '/api/groups/pause', '/api/groups/stop',
   '/api/agent', '/api/provider-settings', '/api/codex/verify', '/api/usage/refresh',
-  '/api/inbox/dismiss', '/api/issues/status']
+  '/api/inbox/dismiss', '/api/issues/status',
+  // Software updates: check and ignore anywhere; install only when launchd
+  // manages this exact entry (the updater refuses every other run mode).
+  '/api/update/check', '/api/update/start', '/api/update/ignore']
 const SUPPORTED_RUNNERS = ['claude', 'codex']
 
 function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld = () => new Map(),
@@ -32,7 +35,7 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld =
   const startedAt = now()
   const capabilities = Object.freeze({ mode: 'durable-v2',
     reason: '此操作尚未接入当前版本的持久处理流程，未执行。',
-    summary: '实时状态、认证管理、停止任务、绑定新群，以及空闲群的模型切换（Codex / Claude Code）和项目目录修改已接入；该群有任务或未结记录时不能修改。开新会话、解除绑定、控制台插话、定时任务、画布和升级暂不可用。',
+    summary: '实时状态、认证管理、停止任务、绑定新群、空闲群的模型切换（Codex / Claude Code）和项目目录修改，以及后台运行时的软件升级已接入；该群有任务或未结记录时不能修改。开新会话、解除绑定、控制台插话、定时任务和画布暂不可用。',
     allowed: { GET: READ_PATHS, POST: WRITE_PATHS } })
   function held() {
     if (assertWriterLock() !== true) throw new Error('服务写入权限已失效，操作未执行')
@@ -133,7 +136,7 @@ function createC2Console(options = {}) {
     throw new TypeError('C2 console requires explicit installation paths')
   }
   const facade = createC2ConsoleFacade(options)
-  const ui = createUiServer({ configPath, host, log, getConnHealth,
+  const ui = createUiServer({ configPath, host, log, getConnHealth, updater: options.updater || null,
     onHostChange: options.onHostChange,
     getLiveState: facade.getLiveState, control: facade.control, runtimePolicy: facade,
     issuesPath: path.join(stateDir, 'issues.jsonl'),

package/src/c2multigroupservice.js

@@ -5,6 +5,7 @@ const { coordinateC2GlobalFault } = require('./core/c2globalfault')
 
 const RECOVERING_NOTICE = '上一个任务出错，正在收尾，这条消息没有处理，请稍后重发。'
 const HELD_NOTICE = '本群上一个任务结果不明，已暂停处理，等待人工确认；其他群不受影响。'
+const UPGRADING_NOTICE = 'SintBot 正在升级，这条消息没有处理，请一分钟后重发。'
 const reasonOf = error => String(error?.message || error || 'unknown').slice(0, 300)
 
 // Turns a group binding still holds: a running turn, a non-idle handoff or a
@@ -58,6 +59,8 @@ function createC2MultiGroupService({ routes, assertWriterLock,
   const bindings = new Map()
   // chatId -> { reason, source: 'startup' | 'runtime', since, binding }
   const suspended = new Map()
+  // Set while a console upgrade switches the service: no message is admitted.
+  let maintenance = false
   let transport = null
   let started = false
   let starting = false
@@ -227,7 +230,7 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     if (bindings.has(route.chatId)) return Promise.resolve(bindings.get(route.chatId))
     if (activating.has(route.chatId)) return activating.get(route.chatId)
     const opening = (async () => {
-      if (!started || starting || stopPromise) throw new Error('C2 service is not serving')
+      if (!started || starting || stopPromise || maintenance) throw new Error('C2 service is not serving')
       held()
       const binding = await createBinding({ route, transport })
       if (!started || stopPromise || !writerHeld() || suspended.has(route.chatId) ||
@@ -255,6 +258,10 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     // Foreign/paused group events are not faults and never get a receipt.
     if (!allowed(msg?.chatId)) return { ignored: true, reason: 'unconfigured-or-paused' }
     if (quarantine?.rejects(msg)) return { quarantined: true }
+    if (maintenance && started && !stopPromise) {
+      return answerC2InputRejection({ error: rejectC2Input('C2 service upgrading',
+        { reason: 'upgrading', notice: UPGRADING_NOTICE }), msg, platform: sourceAdapter, log })
+    }
     if (recovering.has(msg.chatId) && started && !stopPromise) {
       // The group's failed turn is being closed; nothing is admitted meanwhile.
       return answerC2InputRejection({ error: rejectC2Input('C2 group recovering',
@@ -319,6 +326,7 @@ function createC2MultiGroupService({ routes, assertWriterLock,
   }
   function recall(event) {
     if (suspended.has(event?.chatId)) return { ignored: true, reason: 'group-held' }
+    if (maintenance) return { ignored: true, reason: 'upgrading' }
     if (!allowed(event?.chatId)) return { ignored: true }
     let binding
     try {
@@ -409,7 +417,16 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     return [...suspended].map(([chatId, entry]) => Object.freeze({ chatId,
       reason: entry.reason, source: entry.source, since: entry.since }))
   }
-  return { start, stop, routeMessage, addRoute, heldGroups,
+  function beginMaintenance() {
+    if (!maintenance) log('upgrade: admission closed for the service switch')
+    maintenance = true
+  }
+  function endMaintenance() {
+    if (maintenance) log('upgrade: admission reopened')
+    maintenance = false
+  }
+  return { start, stop, routeMessage, addRoute, heldGroups, beginMaintenance, endMaintenance,
+    get inMaintenance() { return maintenance },
     get bindings() { return new Map(bindings) },
     get held() { return new Map([...suspended].map(([chatId, entry]) =>
       [chatId, { reason: entry.reason, source: entry.source, since: entry.since }])) } }