switchroom 0.14.50 → 0.14.52

package/dist/cli/switchroom.js

@@ -49462,8 +49462,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.50";
-var COMMIT_SHA = "07e8b692";
+var VERSION = "0.14.52";
+var COMMIT_SHA = "98b4f7c3";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.50",
+  "version": "0.14.52",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/answer-stream-flag.ts

@@ -0,0 +1,18 @@
+/**
+ * Parse the `SWITCHROOM_VISIBLE_ANSWER_STREAM` env flag.
+ *
+ * Default **OFF** (flipped 2026-06-03, operator request) — see the rationale
+ * on the `ANSWER_STREAM_VISIBLE_ENABLED` gate in `gateway/gateway.ts`. When
+ * off, the answer lane streams to the invisible compose-box draft and the
+ * reply tool is the single canonical formatted message — no unformatted
+ * preliminary that flashes and gets deleted. Opt back IN per agent with
+ * `SWITCHROOM_VISIBLE_ANSWER_STREAM=1` (also accepts true/on/yes).
+ *
+ * Extracted as a pure function so the default + parsing are unit-testable
+ * (gateway.ts is not importable in isolation — top-level side effects).
+ */
+export function parseVisibleAnswerStreamEnabled(raw: string | undefined): boolean {
+  if (raw == null) return false
+  const v = raw.trim().toLowerCase()
+  return v === '1' || v === 'true' || v === 'on' || v === 'yes'
+}

package/telegram-plugin/dist/gateway/gateway.js

@@ -39700,6 +39700,14 @@ function createAnswerStream(config) {
   };
 }
 
+// answer-stream-flag.ts
+function parseVisibleAnswerStreamEnabled(raw) {
+  if (raw == null)
+    return false;
+  const v = raw.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "on" || v === "yes";
+}
+
 // pty-tail.ts
 var import_headless = __toESM(require_xterm_headless(), 1);
 var PTY_DEBUG = process.env.SWITCHROOM_PTY_DEBUG === "1";
@@ -52158,10 +52166,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.50";
-var COMMIT_SHA = "07e8b692";
-var COMMIT_DATE = "2026-06-03T10:08:18Z";
-var LATEST_PR = 2124;
+var VERSION = "0.14.52";
+var COMMIT_SHA = "98b4f7c3";
+var COMMIT_DATE = "2026-06-03T13:20:36Z";
+var LATEST_PR = 2129;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -52670,8 +52678,7 @@ function promptClause(turn) {
   const p = turn.user_prompt_preview?.trim();
   if (!p)
     return "";
-  const snippet = p.length > 160 ? p.slice(0, 160) + "\u2026" : p;
-  return ` The request was: "${snippet}".`;
+  return ` The start of the request was: "${p}".`;
 }
 function buildResumeInterruptedInbound(ctx) {
   const ts = ctx.nowMs ?? Date.now();
@@ -52696,7 +52703,7 @@ function buildResumeInterruptedInbound(ctx) {
     user: "switchroom",
     userId: 0,
     ts,
-    text: `You just restarted. Your previous turn was interrupted ${elapsed} ago, ` + `before it finished \u2014 it was cut off by a restart, not completed.` + promptClause(ctx.turn) + ` Pick that work back up now and continue it through to completion. ` + `In your first message, briefly let the user know you're resuming what ` + `was interrupted (mention roughly how long ago in plain language) so ` + `they're not left wondering \u2014 then carry on with the actual task. Do ` + `not ask whether to resume; just resume. If you genuinely can't tell ` + `what the work was, say so and ask.`,
+    text: `You just restarted. Your previous turn was interrupted ${elapsed} ago, ` + `before it finished \u2014 it was cut off by a restart, not completed.` + promptClause(ctx.turn) + ` That quoted text is only the first ~200 characters of the original ` + `request, and you've lost your in-memory context across the restart \u2014 so ` + `BEFORE you continue, call get_recent_messages for this chat to read your ` + `full original message and the surrounding conversation, so you resume the ` + `COMPLETE task (including any instructions in the tail of a long request), ` + `not just the truncated preview. Then pick that work back up and carry it ` + `through to completion. In your first message, briefly let the user know ` + `you're resuming what was interrupted (mention roughly how long ago in ` + `plain language) so they're not left wondering \u2014 then carry on with the ` + `actual task. Do not ask whether to resume; just resume. If even after ` + `reading the recent messages you genuinely can't tell what the work was, ` + `say so and ask.`,
     meta
   };
 }
@@ -54309,15 +54316,7 @@ var STREAM_THROTTLE_MS_OVERRIDE = (() => {
   return Number.isFinite(n) && n >= 0 ? n : undefined;
 })();
 var TURN_FLUSH_SAFETY_ENABLED = isTurnFlushSafetyEnabled();
-var ANSWER_STREAM_VISIBLE_ENABLED = (() => {
-  const raw = process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM;
-  if (raw == null)
-    return true;
-  const v = raw.trim().toLowerCase();
-  if (v === "0" || v === "false" || v === "off" || v === "no")
-    return false;
-  return true;
-})();
+var ANSWER_STREAM_VISIBLE_ENABLED = parseVisibleAnswerStreamEnabled(process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM);
 var progressDriver = null;
 var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
@@ -57087,7 +57086,7 @@ function handleSessionEvent(ev) {
             chatId: turn.sessionChatId,
             isPrivateChat: turn.isDm,
             threadId: turn.sessionThreadId,
-            ...ANSWER_STREAM_VISIBLE_ENABLED ? { minInitialChars: 1 } : { sendMessageDraft: sendMessageDraftFn },
+            ...ANSWER_STREAM_VISIBLE_ENABLED ? { minInitialChars: 1 } : { sendMessageDraft: sendMessageDraftFn, minInitialChars: Number.MAX_SAFE_INTEGER },
             sendMessage: async (chatId, text, params) => {
               const tid = params?.message_thread_id;
               const silent = params?.purpose !== "materialize";

package/telegram-plugin/gateway/gateway.ts

@@ -96,6 +96,7 @@ import * as pendingProgress from '../pending-work-progress.js'
 import { writeSilentEndState, clearSilentEndState, recordUndeliveredTurnEnd } from '../silent-end.js'
 import { isFinalAnswerReply } from '../final-answer-detect.js'
 import { createAnswerStream, type AnswerStreamHandle } from '../answer-stream.js'
+import { parseVisibleAnswerStreamEnabled } from '../answer-stream-flag.js'
 import { type SessionEvent } from '../session-tail.js'
 import {
   shouldSuppressToolActivity,
@@ -3738,23 +3739,33 @@ const TURN_FLUSH_SAFETY_ENABLED = isTurnFlushSafetyEnabled()
 // the cross-turn pending-progress system (#1445/#1669) is the
 // canonical surface and DOES ping at the appropriate boundaries.
 //
-// 2026-05-25: default flipped ON after fleet-log audit showed
-// framework-fallback rate at ~19% of inbounds (target per
-// `reference/conversational-pacing.md`: <0.5%). Streaming the
-// model's text events live into the chat closes the
-// catastrophic-UX failure mode at the lane-of-first-defense level.
-// Aligned with the "chat IS the artifact" sub-principle (the user
-// sees a normal chat message that grows — no chrome, no parallel
-// widget). Override with SWITCHROOM_VISIBLE_ANSWER_STREAM=0 to
-// disable, e.g. for an agent that needs the legacy draft-only
-// behaviour during debugging.
-const ANSWER_STREAM_VISIBLE_ENABLED = (() => {
-  const raw = process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM
-  if (raw == null) return true
-  const v = raw.trim().toLowerCase()
-  if (v === '0' || v === 'false' || v === 'off' || v === 'no') return false
-  return true
-})()
+// 2026-05-25: default flipped ON after a fleet-log audit showed a ~19%
+// framework-fallback ("still working…") rate — the visible stream gave an
+// immediate in-timeline signal that suppressed the silence-poke.
+//
+// 2026-06-03: default flipped back OFF (operator request). In practice the
+// visible stream delivered ~none of its intended benefit while imposing a
+// jarring cost:
+//   - Telegram rate-limits editMessageText to roughly once/second, so real
+//     "watch it type" streaming is impossible; and the model emits almost no
+//     interstitial assistant.text (it thinks → tool → reply), so the
+//     preliminary was a near-empty bubble (observed: 5–13 byte edits).
+//   - On every turn where the model calls the reply tool (≈always), the reply
+//     posts a SEPARATE canonical message and the stream RETRACTS (deletes) its
+//     preliminary — the user sees a raw bubble appear then vanish, replaced by
+//     the formatted reply. In supergroup topics it also mis-routed (preliminary
+//     → General, reply → topic). Net: an unformatted flash + a delete, no
+//     streaming value.
+// The anti-silence role the visible stream once filled is now covered by the
+// live ACTIVITY FEED (tool-use streaming, below), the "…typing" chat-action
+// loop, and `thinking_effort: low` (fast tool-less turns) — so off-by-default
+// no longer regresses the framework-fallback rate. With the flag off the lane
+// uses the invisible compose-box draft (the original default, #1664-compatible)
+// and the reply tool is the single canonical, formatted message.
+// Opt back IN per agent with SWITCHROOM_VISIBLE_ANSWER_STREAM=1.
+const ANSWER_STREAM_VISIBLE_ENABLED = parseVisibleAnswerStreamEnabled(
+  process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM,
+)
 
 // Activity feed. The gateway streams a live "what it's doing" tool-activity
 // feed for every turn. The PreToolUse sidecar emits a `tool_label` per tool
@@ -8426,9 +8437,19 @@ function handleSessionEvent(ev: SessionEvent): void {
             // tool_use stream (case 'tool_use' above) where the real
             // signal lives. assistant.text keeps its visible-message
             // home; the reply tool stays the canonical answer.
+            // Flag OFF (default): use the compose-box draft for DMs, and set
+            // minInitialChars effectively-infinite so the lane NEVER opens a
+            // visible chat message. This matters in supergroup TOPICS, where
+            // draft transport is unsupported (gateway.ts:6422) so the lane
+            // would otherwise fall to message transport and post a visible
+            // preview once interstitial text passed the default 50-char gate
+            // — which retract() then deletes (the unformatted flash, marko
+            // General). With the gate unreachable the only posted message is
+            // the canonical reply. (The gate is bypassed for DM draft
+            // transport, so DM draft streaming is unaffected.)
             ...(ANSWER_STREAM_VISIBLE_ENABLED
               ? { minInitialChars: 1 }
-              : { sendMessageDraft: sendMessageDraftFn }),
+              : { sendMessageDraft: sendMessageDraftFn, minInitialChars: Number.MAX_SAFE_INTEGER }),
             // #1075: route through robustApiCall so flood-wait,
             // benign-400, and THREAD_NOT_FOUND are handled uniformly
             // instead of crashing the answer-stream loop on a deleted

package/telegram-plugin/gateway/resume-inbound-builder.ts

@@ -66,9 +66,12 @@ function threadIdNum(turn: Turn): number | undefined {
 function promptClause(turn: Turn): string {
   const p = turn.user_prompt_preview?.trim()
   if (!p) return ''
-  // Quote-trim so a long preview doesn't bloat the channel body.
-  const snippet = p.length > 160 ? p.slice(0, 160) + '…' : p
-  return ` The request was: "${snippet}".`
+  // The stored preview is already capped at the first ~200 chars of the user
+  // message (TURN_PREVIEW_MAX). Include it verbatim as a hint — do NOT
+  // re-truncate (the old 160-char slice dropped instructions that lived in the
+  // tail of a longer request). The FULL original is recovered via
+  // get_recent_messages; the resume body tells the model to do that.
+  return ` The start of the request was: "${p}".`
 }
 
 /**
@@ -117,12 +120,18 @@ export function buildResumeInterruptedInbound(ctx: ResumeInboundContext): Inboun
       `You just restarted. Your previous turn was interrupted ${elapsed} ago, ` +
       `before it finished — it was cut off by a restart, not completed.` +
       promptClause(ctx.turn) +
-      ` Pick that work back up now and continue it through to completion. ` +
-      `In your first message, briefly let the user know you're resuming what ` +
-      `was interrupted (mention roughly how long ago in plain language) so ` +
-      `they're not left wondering — then carry on with the actual task. Do ` +
-      `not ask whether to resume; just resume. If you genuinely can't tell ` +
-      `what the work was, say so and ask.`,
+      ` That quoted text is only the first ~200 characters of the original ` +
+      `request, and you've lost your in-memory context across the restart — so ` +
+      `BEFORE you continue, call get_recent_messages for this chat to read your ` +
+      `full original message and the surrounding conversation, so you resume the ` +
+      `COMPLETE task (including any instructions in the tail of a long request), ` +
+      `not just the truncated preview. Then pick that work back up and carry it ` +
+      `through to completion. In your first message, briefly let the user know ` +
+      `you're resuming what was interrupted (mention roughly how long ago in ` +
+      `plain language) so they're not left wondering — then carry on with the ` +
+      `actual task. Do not ask whether to resume; just resume. If even after ` +
+      `reading the recent messages you genuinely can't tell what the work was, ` +
+      `say so and ask.`,
     meta,
   }
 }

package/telegram-plugin/tests/answer-stream-flag.test.ts

@@ -0,0 +1,27 @@
+/**
+ * Pin the SWITCHROOM_VISIBLE_ANSWER_STREAM contract: default OFF (2026-06-03),
+ * opt-in only on a truthy value. Guards against an accidental flip back to
+ * default-on (which would reintroduce the unformatted-preliminary flash +
+ * delete-on-every-reply — see the gateway gate comment).
+ */
+
+import { describe, it, expect } from 'vitest'
+import { parseVisibleAnswerStreamEnabled } from '../answer-stream-flag.js'
+
+describe('parseVisibleAnswerStreamEnabled — default OFF, opt-in', () => {
+  it('defaults OFF when unset', () => {
+    expect(parseVisibleAnswerStreamEnabled(undefined)).toBe(false)
+  })
+
+  it('stays OFF for empty / falsey / unrecognized values', () => {
+    for (const v of ['', '   ', '0', 'false', 'off', 'no', 'nope', 'enabled', 'x']) {
+      expect(parseVisibleAnswerStreamEnabled(v)).toBe(false)
+    }
+  })
+
+  it('opts IN only on explicit truthy values (case/space-insensitive)', () => {
+    for (const v of ['1', 'true', 'on', 'yes', ' TRUE ', 'On', 'YES']) {
+      expect(parseVisibleAnswerStreamEnabled(v)).toBe(true)
+    }
+  })
+})

package/telegram-plugin/tests/gateway-no-reply-single-emit.test.ts

@@ -68,6 +68,41 @@ describe('#656 — answer-stream retract() at turn_end emits nothing', () => {
     expect(deleteMessage).not.toHaveBeenCalled()
   })
 
+  // Visible-answer-stream OFF (default since 2026-06-03): the gateway passes
+  // minInitialChars=MAX_SAFE_INTEGER so a SUPERGROUP turn (message transport —
+  // draft is unsupported in forum topics) NEVER opens a visible preview, no
+  // matter how much interstitial assistant.text streams. This is the full fix
+  // for the marko-General unformatted-flash (the DM path is already covered by
+  // draft transport). Without it, message transport opens at the 50-char gate
+  // and retract() then deletes it.
+  it('flag-off supergroup: huge minInitialChars never opens a message even past the 50-char gate', async () => {
+    const sendMessage = vi.fn(async () => ({ message_id: nextMessageId++ }))
+    const editMessageText = vi.fn(async () => {})
+    const deleteMessage = vi.fn(async () => {})
+
+    const stream = createAnswerStream({
+      chatId: 'supergroup-topic',
+      isPrivateChat: false, // supergroup → message transport (no draft)
+      threadId: 4,
+      minInitialChars: Number.MAX_SAFE_INTEGER,
+      throttleMs: 250,
+      sendMessage: sendMessage as never,
+      editMessageText: editMessageText as never,
+      deleteMessage: deleteMessage as never,
+    })
+
+    // Feed 200 chars — well past the default 50-char open gate.
+    stream.update('x'.repeat(200))
+    vi.advanceTimersByTime(1000)
+    await flushMicrotasks()
+    expect(sendMessage).not.toHaveBeenCalled() // never opened a preview
+    expect(editMessageText).not.toHaveBeenCalled()
+
+    await stream.retract()
+    expect(sendMessage).not.toHaveBeenCalled()
+    expect(deleteMessage).not.toHaveBeenCalled() // nothing to delete → no flash
+  })
+
   it('retract after a preliminary send: deletes the prelim, no fresh sendMessage', async () => {
     const THROTTLE = 1000
     const sendMessage = vi.fn(async () => ({ message_id: nextMessageId++ }))

package/telegram-plugin/tests/resume-inbound-builder.test.ts

@@ -106,12 +106,22 @@ describe('buildResumeInterruptedInbound', () => {
     expect(msg.meta.original_prompt).toBe('refactor the auth module')
   })
 
-  it('truncates a long prompt preview in the body', () => {
-    const long = 'x'.repeat(300)
-    const turn = makeTurn({ user_prompt_preview: long })
-    const msg = buildResumeInterruptedInbound({ turn })
-    expect(msg.text).toContain('…')
-    expect(msg.text).not.toContain('x'.repeat(200))
+  it('includes the FULL stored preview in the body (no double-truncation below the 200-char storage cap)', () => {
+    // The turns table already caps the preview at ~200 chars (TURN_PREVIEW_MAX);
+    // the builder must NOT slice it shorter (the old 160-char cut dropped detail
+    // from the tail of a longer request). A 180-char preview must appear in full.
+    const preview = "step 1 do X; step 2 do Y; step 3 do Z; " + "d".repeat(141) // 180 chars
+    expect(preview.length).toBe(180)
+    const msg = buildResumeInterruptedInbound({ turn: makeTurn({ user_prompt_preview: preview }) })
+    expect(msg.text).toContain(preview) // verbatim, not sliced to 160
+    expect(msg.meta.original_prompt).toBe(preview)
+  })
+
+  it('tells the resumed turn to recover the FULL original via get_recent_messages', () => {
+    const msg = buildResumeInterruptedInbound({ turn: makeTurn({ user_prompt_preview: 'short task' }) })
+    expect(msg.text).toContain('get_recent_messages')
+    // Frames the quoted preview as partial so the model knows to fetch the rest.
+    expect(msg.text).toMatch(/first ~200 characters|start of the request/i)
   })
 
   it('routes to the forum thread when thread_id is numeric', () => {

package/telegram-plugin/uat/scenarios/jtbd-interrupted-turn-resumes-dm.test.ts

@@ -0,0 +1,90 @@
+/**
+ * JTBD — always-on: a turn interrupted by a restart is RESUMED without
+ * re-prompting, and the resume turn runs to completion (it is not silently
+ * dropped into a not-ready session). Regression gate for v0.14.50 / #2122.
+ *
+ * Flow: send a long-running task, let it get in-flight, then restart the agent
+ * (--force, NOT --wait, so it interrupts rather than draining). On boot the
+ * gateway finds the orphaned turn and injects the `resume_interrupted`
+ * synthetic. With #2122 that synthetic carries meta.chat_id + message_id, so the
+ * resumed turn (a) builds a currentTurn (progress card + silence-poke), (b)
+ * routes its reply to the originating chat, and (c) re-enrols in
+ * deliver-until-acked so a drop into a still-booting session is rescued rather
+ * than lost.
+ *
+ * Assertion: a reply arrives after the interrupting restart whose FRAMING shows
+ * the agent is resuming ("picking this back up" / "interrupted" / "cut off by a
+ * restart"). We deliberately do NOT assert an end-token: the resume synthetic
+ * only carries the first ~160 chars of the original prompt (promptClause
+ * truncation), so instructions in the prompt's tail are not guaranteed to
+ * survive — the resume FRAMING is the stable, builder-guaranteed signal.
+ *
+ * Self-skips green without NOPASSWD sudo.
+ */
+
+import { describe, it, expect } from "vitest";
+import { execSync, spawn } from "node:child_process";
+import { spinUp } from "../harness.js";
+
+const AGENT = "test-harness";
+const MID_TURN_MS = 10_000;        // let the turn enqueue (become a recorded interrupted turn)
+const RESUME_BUDGET_MS = 180_000;  // boot + resume + reply
+
+// The resume builder tells the model to "briefly let the user know you're
+// resuming what was interrupted" — so the reply always opens with this framing.
+const RESUME_FRAMING = /resum|picking .*back|interrupted|cut off|just restarted/i;
+
+function canShellSudo(): boolean {
+  try {
+    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function kickRestartDetached(name: string): void {
+  // --force WITHOUT --wait → recreate now, interrupting the in-flight turn.
+  const child = spawn(
+    "sudo",
+    ["-n", "env", `PATH=${process.env.PATH}`, `HOME=${process.env.HOME}`,
+      "switchroom", "agent", "restart", name, "--force"],
+    { detached: true, stdio: "ignore" },
+  );
+  child.unref();
+}
+
+const sudoOk = canShellSudo();
+
+(sudoOk ? describe : describe.skip)("uat: interrupted turn resumes after restart (DM)", () => {
+  it(
+    "a turn interrupted by a restart is resumed and the resume turn completes",
+    async () => {
+      const sc = await spinUp({ agent: AGENT, settleMs: 0 });
+      try {
+        // A task long enough that it's still in-flight at MID_TURN_MS.
+        await sc.sendDM(
+          `Please write a thorough, detailed ~300-word explanation of how a ` +
+          `mechanical typewriter's typebar mechanism works, step by step. Take ` +
+          `your time and be complete.`,
+        );
+
+        await new Promise((r) => setTimeout(r, MID_TURN_MS));
+        kickRestartDetached(AGENT);
+
+        // After boot, the resume synthetic should make the agent pick the work
+        // back up and say so. (The newest interrupted turn — this one — is the
+        // one findLatestTurnIfInterrupted resumes.)
+        const reply = await sc.expectMessage((m) => RESUME_FRAMING.test(m.text), {
+          from: "bot",
+          timeout: RESUME_BUDGET_MS,
+        });
+        expect(reply.text).toMatch(RESUME_FRAMING);
+        expect(reply.text.length).toBeGreaterThan(40); // a substantive resumed reply, not a stub
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    RESUME_BUDGET_MS + 60_000,
+  );
+});

package/telegram-plugin/uat/scenarios/jtbd-message-during-restart-channel.test.ts

@@ -0,0 +1,95 @@
+/**
+ * JTBD — always-on in a supergroup: a message sent into a forum topic WHILE the
+ * agent is restarting must still be answered IN the group (the channel twin of
+ * jtbd-message-during-restart-dm). Regression gate for v0.14.48 / #2117, proving
+ * the restart-redeliver rescue is keyed per (chat, thread) so DM and supergroup
+ * topics recover identically.
+ *
+ * Self-skips green when SWITCHROOM_UAT_CHAT_ID is unset or the chat isn't a
+ * resolvable forum supergroup the driver is in (uat/** is excluded from gating
+ * CI). mtcute caveat: no forum-topic create API, so this uses the supergroup's
+ * General topic — it proves DM-vs-channel routing, not "correct topic among
+ * many" (pinned by the gateway unit thread-assertions).
+ */
+
+import { describe, it, expect } from "vitest";
+import { execSync, spawn } from "node:child_process";
+import { spinUp } from "../harness.js";
+import { expectMessage } from "../assertions.js";
+
+const AGENT = "test-harness";
+const SUPERGROUP_ID = Number.parseInt(process.env.SWITCHROOM_UAT_CHAT_ID ?? "", 10);
+const BOOT_SEND_DELAY_MS = Number.parseInt(
+  process.env.SWITCHROOM_UAT_BOOT_SEND_DELAY_MS ?? "12000",
+  10,
+);
+const REPLY_BUDGET_MS = 180_000;
+
+function canShellSudo(): boolean {
+  try {
+    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function kickRestartDetached(name: string): void {
+  const child = spawn(
+    "sudo",
+    ["-n", "env", `PATH=${process.env.PATH}`, `HOME=${process.env.HOME}`,
+      "switchroom", "agent", "restart", name, "--force"],
+    { detached: true, stdio: "ignore" },
+  );
+  child.unref();
+}
+
+const sudoOk = canShellSudo();
+
+(sudoOk ? describe : describe.skip)("uat: message sent during a restart (supergroup)", () => {
+  it(
+    "a supergroup-topic message sent DURING the restart boot window is still answered in the group",
+    async () => {
+      if (!Number.isFinite(SUPERGROUP_ID)) {
+        console.warn("[during-restart-channel] SWITCHROOM_UAT_CHAT_ID unset — skipping");
+        return;
+      }
+      const sc = await spinUp({ agent: AGENT, settleMs: 0 });
+      try {
+        await sc.driver.primeDialogs();
+        if (!(await sc.driver.canResolve(SUPERGROUP_ID))) {
+          console.warn(
+            `[during-restart-channel] supergroup ${SUPERGROUP_ID} not resolvable — skipping ` +
+              `(ensure forum supergroup with Topics + driver is a member)`,
+          );
+          return;
+        }
+
+        const nonce = `bootsg-${Date.now().toString(36)}`;
+        kickRestartDetached(AGENT);
+        await new Promise((r) => setTimeout(r, BOOT_SEND_DELAY_MS));
+
+        const sendStart = Date.now();
+        await sc.driver.sendText(
+          SUPERGROUP_ID,
+          `You are being restart-tested in this group. Reply in this group with exactly this token and nothing else: ${nonce}`,
+        );
+
+        const reply = await expectMessage(
+          sc.driver,
+          SUPERGROUP_ID,
+          (m) => m.text.includes(nonce),
+          { timeout: REPLY_BUDGET_MS, senderFilter: { notUserId: sc.driverUserId } },
+        );
+        const ttfo = Date.now() - sendStart;
+        console.warn(`[during-restart-channel] answered in ${ttfo}ms (nonce ${nonce})`);
+        expect(reply.chatId).toBe(SUPERGROUP_ID);
+        expect(reply.fromBot).toBe(true);
+        expect(reply.text).toContain(nonce);
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    REPLY_BUDGET_MS + 60_000,
+  );
+});

package/telegram-plugin/uat/scenarios/jtbd-message-during-restart-dm.test.ts

@@ -0,0 +1,95 @@
+/**
+ * JTBD — always-on: a message sent WHILE the agent is restarting must still be
+ * answered (DM). Regression gate for the v0.14.48 / #2117 lost-message incident
+ * (clerk/KenGPT, 2026-06-03).
+ *
+ * The wedge this guards: an inbound that arrives during a restart is buffered +
+ * spool-persisted, then redelivered on bridge-up — but `bridge registered` is
+ * not the same as `claude` session-ready. If claude is slow to boot (e.g. a
+ * Hindsight MCP timeout) the redelivered inject hit a still-booting session and
+ * was silently dropped; the 300s silence-poke then ended a phantom turn
+ * (`drained_buffered=0/0`) and the message was gone. The fix re-enrols the
+ * redelivered inbound in the deliver-until-acked queue so it re-delivers every
+ * 5s until claude actually consumes it.
+ *
+ * Unlike `jtbd-always-on-after-restart-dm` (which sends ~5s AFTER the restart
+ * returns, exercising the live path), this sends DURING the boot window so the
+ * message goes through the restart-redeliver path the fix patches. The mtcute
+ * driver sends straight to Telegram — independent of the agent's bridge — so the
+ * message queues server-side and is delivered the moment the new gateway
+ * reconnects.
+ *
+ * Self-skips green without NOPASSWD sudo (can't restart the agent).
+ */
+
+import { describe, it, expect } from "vitest";
+import { execSync, spawn } from "node:child_process";
+import { spinUp } from "../harness.js";
+
+const AGENT = "test-harness";
+
+// After kicking the restart, wait this long before sending — long enough that
+// the reconcile + docker recreate have dropped the bridge, so the message
+// buffers and is drained on bridge-up (the restart-redeliver path). Override
+// for forensics (e.g. 6000 to land it deeper in the not-ready window so the
+// strand-rescue sweep fires).
+const BOOT_SEND_DELAY_MS = Number.parseInt(
+  process.env.SWITCHROOM_UAT_BOOT_SEND_DELAY_MS ?? "12000",
+  10,
+);
+
+// Generous: the fix re-delivers every 5s until claude is ready. The wedge
+// symptom is ≥300s (silence-poke floor) or never — both fail this.
+const REPLY_BUDGET_MS = 180_000;
+
+function canShellSudo(): boolean {
+  try {
+    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Kick a marker-safe restart and return immediately (detached). */
+function kickRestartDetached(name: string): void {
+  const child = spawn(
+    "sudo",
+    ["-n", "env", `PATH=${process.env.PATH}`, `HOME=${process.env.HOME}`,
+      "switchroom", "agent", "restart", name, "--force"],
+    { detached: true, stdio: "ignore" },
+  );
+  child.unref();
+}
+
+const sudoOk = canShellSudo();
+
+(sudoOk ? describe : describe.skip)("uat: message sent during a restart (DM)", () => {
+  it(
+    "a DM sent DURING the restart boot window is still answered (not lost)",
+    async () => {
+      const sc = await spinUp({ agent: AGENT, settleMs: 0 });
+      try {
+        const nonce = `bootdm-${Date.now().toString(36)}`;
+        kickRestartDetached(AGENT);
+        await new Promise((r) => setTimeout(r, BOOT_SEND_DELAY_MS));
+
+        const sendStart = Date.now();
+        await sc.sendDM(
+          `You are being restart-tested. Reply with exactly this token and nothing else: ${nonce}`,
+        );
+
+        const reply = await sc.expectMessage((m) => m.text.includes(nonce), {
+          from: "bot",
+          timeout: REPLY_BUDGET_MS,
+        });
+        const ttfo = Date.now() - sendStart;
+        console.warn(`[during-restart-dm] answered in ${ttfo}ms (nonce ${nonce})`);
+        expect(reply.text).toContain(nonce);
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    REPLY_BUDGET_MS + 60_000,
+  );
+});