switchroom 0.14.70 → 0.14.72

package/dist/cli/switchroom.js

@@ -49601,8 +49601,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.70";
-var COMMIT_SHA = "fdaeb2c4";
+var VERSION = "0.14.72";
+var COMMIT_SHA = "0e840d59";
 
 // src/cli/agent.ts
 init_source();
@@ -52176,6 +52176,10 @@ function buildSettingsHooksBlock(p) {
 
 ` + 'Do NOT send a trailing confirmation after your answer \u2014 no "Done.", ' + '"Sent.", "Hope that helps." as a separate message once you have ' + "already replied. Your answer is the last thing the user should " + `see; a follow-up "Done." is dead-air clutter (and the user's ` + `device already pinged on the answer). Stop after the answer.
 
+` + "GROUND BEFORE YOU ASSERT. Any fact in your reply that can change " + "(a number, a status, a price, a date, who-uses-what, anything " + '"current" or "latest") must come from a source you actually checked ' + "THIS turn: your data tool, a file, the web. Memory and what you " + '"already know" are leads to verify, not sources. If you have not ' + "checked it this turn, do not state it as fact: go get it now, or tell " + "the user you will confirm and then do it. A confident wrong number is " + `worse than "let me check".
+
+` + "VOICE: write like a sharp colleague, not a chatbot. Lead with the " + "answer, plain words, plain punctuation (commas and periods, not " + `em-dashes). Skip the hollow openers ("You're absolutely right", ` + '"Great question", "Great catch", "Exactly!") and AI-tell filler ' + `("smoking gun", "delve", "it's worth noting", "a testament to", "in ` + `today's fast-paced..."). Genuine acknowledgement is fine when it is ` + 'real and adds something ("good catch, that was my bug"); what to ' + "avoid is the reflexive praise that opens every reply and means " + "nothing. When the user is wrong, say so directly; flattery is not " + `help.
+
 ` + 'CRITICAL: "answer" means a call to the reply tool ' + "(mcp__switchroom-telegram__reply, or stream_reply with done=true). " + "Your terminal/transcript text is NEVER delivered to Telegram \u2014 the " + "user sees only what you send through the reply tool. After a long " + "tool sequence (scheduling, multi-step research, sub-agent handback), " + "do not let your closing narration stand as the answer: end the turn " + "by passing that narration to the reply tool. No reply tool call = the " + "user got nothing, however much text you wrote. Call the reply tool as " + "your FIRST action when you have the answer \u2014 do not write it out as " + "transcript text first and call reply afterward: a framework backstop " + "flushes unsent text after a delay and then your real reply lands late " + "and out of order.</turn-pacing>";
   const switchroomUserPromptSubmit = [
     ...useHotReloadStable ? [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.70",
+  "version": "0.14.72",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -42543,6 +42543,22 @@ function enabled4() {
   const v = process.env.SWITCHROOM_DISABLE_VOICE_SCRUB;
   return !(v === "1" || v === "true");
 }
+function openerStripEnabled() {
+  const v = process.env.SWITCHROOM_VOICE_STRIP_OPENERS;
+  return v === "1" || v === "true";
+}
+var LEADING_AFFIRMATION_RE = /^(\s*)(you(?:['\u2019]| a)re absolutely right|you(?:['\u2019]| a)re so right|you(?:['\u2019]| a)re absolutely correct|absolutely right|exactly right|great catch|good catch|nice catch|spot on)\b(?:\s*$|\s*[!.,;:\u2014\u2013-][\s!.,;:\u2014\u2013-]*)/i;
+function stripLeadingAffirmation(text) {
+  const m = LEADING_AFFIRMATION_RE.exec(text);
+  if (!m)
+    return { out: text, count: 0 };
+  const leadingWs = m[1] ?? "";
+  const rest = text.slice(m[0].length);
+  if (rest.trim().length === 0)
+    return { out: text, count: 0 };
+  const recapped = rest.replace(/^(\s*)([a-z])/, (_m, ws, ch) => ws + ch.toUpperCase());
+  return { out: leadingWs + recapped, count: 1 };
+}
 function park(text) {
   const parts = [];
   let parked = text;
@@ -42605,14 +42621,16 @@ function replaceDashes(text) {
 }
 function scrubVoice(text) {
   if (!enabled4() || text.length === 0) {
-    return { scrubbed: text, replaced: 0 };
+    return { scrubbed: text, replaced: 0, openersStripped: 0 };
   }
   const { parked, parts } = park(text);
-  const { out, replaced } = replaceDashes(parked);
-  if (replaced === 0) {
-    return { scrubbed: text, replaced: 0 };
+  const opener = openerStripEnabled() ? stripLeadingAffirmation(parked) : { out: parked, count: 0 };
+  const { out, replaced } = replaceDashes(opener.out);
+  const total = replaced + opener.count;
+  if (total === 0) {
+    return { scrubbed: text, replaced: 0, openersStripped: 0 };
   }
-  return { scrubbed: restore(out, parts), replaced };
+  return { scrubbed: restore(out, parts), replaced: total, openersStripped: opener.count };
 }
 
 // telegram-button-constraints.ts
@@ -52801,11 +52819,11 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.70";
-var COMMIT_SHA = "fdaeb2c4";
-var COMMIT_DATE = "2026-06-05T23:46:18+10:00";
-var LATEST_PR = null;
-var COMMITS_AHEAD_OF_TAG = 2;
+var VERSION = "0.14.72";
+var COMMIT_SHA = "0e840d59";
+var COMMIT_DATE = "2026-06-06T00:39:32Z";
+var LATEST_PR = 2183;
+var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {

package/telegram-plugin/runtime-metrics.ts

@@ -124,7 +124,7 @@ export type RuntimeMetricEvent =
    * losing ground; a per-agent spike is prompt drift on that agent.
    *
    *   chatKey   → `<chatId>:<threadIdOrEmpty>` (statusKey shape)
-   *   replaced  → count of dashes rewritten in this single message
+   *   replaced  → total voice changes in this message (dash rewrites + leading-affirmation strips)
    *   site      → which reply path saw the scrub (executeReply / edit / answer-stream)
    */
   | {

package/telegram-plugin/tests/text-voice-scrub.test.ts

@@ -172,3 +172,137 @@ describe('scrubVoice — em / en dash replacement', () => {
     })
   })
 })
+
+describe('scrubVoice — leading sycophancy openers (opt-in backstop)', () => {
+  // The opener strip is OFF by default (tone is the prompt's job); these
+  // tests opt it in to exercise the mechanism that remains available via
+  // SWITCHROOM_VOICE_STRIP_OPENERS=1.
+  beforeEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_VOICE_SCRUB
+    process.env.SWITCHROOM_VOICE_STRIP_OPENERS = '1'
+  })
+  afterEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_VOICE_SCRUB
+    delete process.env.SWITCHROOM_VOICE_STRIP_OPENERS
+  })
+
+  it('strips a leading "You\'re absolutely right" and recapitalizes', () => {
+    const r = scrubVoice("You're absolutely right, the build is broken.")
+    expect(r.scrubbed).toBe('The build is broken.')
+    expect(r.openersStripped).toBe(1)
+    expect(r.replaced).toBeGreaterThan(0) // total counts the opener
+  })
+
+  it('strips the affirmation even when only an opener changed (no dashes)', () => {
+    // Regression: the gateway gates on `replaced > 0`; an opener-only
+    // strip MUST still report replaced > 0 or the scrub is discarded.
+    const r = scrubVoice('Great catch! I fixed the off-by-one.')
+    expect(r.scrubbed).toBe('I fixed the off-by-one.')
+    expect(r.replaced).toBe(1)
+    expect(r.openersStripped).toBe(1)
+  })
+
+  it('consumes a trailing em-dash after the opener (no leftover dash)', () => {
+    const r = scrubVoice('Exactly right — the token had expired.')
+    expect(r.scrubbed).toBe('The token had expired.')
+    expect(r.openersStripped).toBe(1)
+  })
+
+  it('handles curly apostrophe and "you are" form', () => {
+    expect(scrubVoice('You’re absolutely right. Done.').scrubbed).toBe('Done.')
+    expect(scrubVoice('You are absolutely right, done.').scrubbed).toBe('Done.')
+  })
+
+  it('leaves a standalone affirmation ack intact (no content follows)', () => {
+    const r = scrubVoice("You're absolutely right!")
+    expect(r.scrubbed).toBe("You're absolutely right!")
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('does NOT strip bare "you\'re right" (often load-bearing)', () => {
+    const r = scrubVoice("You're right that the config drifted.")
+    expect(r.scrubbed).toBe("You're right that the config drifted.")
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('does NOT strip an affirmation mid-message', () => {
+    const r = scrubVoice('I checked the logs. Great catch on the typo.')
+    expect(r.scrubbed).toBe('I checked the logs. Great catch on the typo.')
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('does NOT over-strip when the phrase is a literal sentence start (no separator)', () => {
+    // The affirmation must be followed by a separator/end, not a bare
+    // space into more words — otherwise "Spot on the map..." loses "Spot
+    // on". These are real sentences, not detachable affirmations.
+    for (const s of [
+      'Spot on the map shows three sites.',
+      'Good catch basin overflow is the root cause.',
+      'Exactly right now, the count is 3.',
+      'Absolutely right turns are banned on that road.',
+    ]) {
+      const r = scrubVoice(s)
+      expect(r.scrubbed, s).toBe(s)
+      expect(r.openersStripped, s).toBe(0)
+    }
+  })
+
+  it('still strips when a separator follows (comma / period / dash)', () => {
+    expect(scrubVoice('Spot on, the value is 5.').scrubbed).toBe('The value is 5.')
+    expect(scrubVoice('Good catch. Fixed it.').scrubbed).toBe('Fixed it.')
+  })
+
+  it('does not touch an opener-like phrase inside code', () => {
+    const r = scrubVoice('`spot on` is the variable name. Here is the value.')
+    expect(r.scrubbed).toContain('`spot on`')
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('kill switch disables opener strip too', () => {
+    process.env.SWITCHROOM_DISABLE_VOICE_SCRUB = '1'
+    const r = scrubVoice("You're absolutely right, the build is broken.")
+    expect(r.scrubbed).toBe("You're absolutely right, the build is broken.")
+    expect(r.replaced).toBe(0)
+    expect(r.openersStripped).toBe(0)
+  })
+})
+
+describe('scrubVoice — opener strip is OFF by default (prompt carries tone)', () => {
+  // No SWITCHROOM_VOICE_STRIP_OPENERS set: the deterministic layer must
+  // NOT delete words. Em-dash normalization (punctuation, no content
+  // removed) still runs. Tone is the prompt VOICE directive's job.
+  beforeEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_VOICE_SCRUB
+    delete process.env.SWITCHROOM_VOICE_STRIP_OPENERS
+  })
+  afterEach(() => {
+    delete process.env.SWITCHROOM_VOICE_STRIP_OPENERS
+  })
+
+  it('does NOT strip a leading affirmation by default', () => {
+    const r = scrubVoice("You're absolutely right, the build is broken.")
+    expect(r.scrubbed).toBe("You're absolutely right, the build is broken.")
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('does NOT strip "Great catch" by default', () => {
+    const r = scrubVoice('Great catch! Fixed it.')
+    expect(r.scrubbed).toBe('Great catch! Fixed it.')
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('STILL normalizes em-dashes by default (punctuation, no content removed)', () => {
+    const r = scrubVoice('on it — checking the calendar')
+    expect(r.scrubbed).toBe('on it, checking the calendar')
+    expect(r.replaced).toBe(1)
+    expect(r.openersStripped).toBe(0)
+  })
+
+  it('an affirmation opener with an em-dash keeps the words, fixes only the dash', () => {
+    const r = scrubVoice('Exactly right — the token had expired.')
+    // Opener preserved; the em-dash after it becomes a comma.
+    expect(r.scrubbed).toBe('Exactly right, the token had expired.')
+    expect(r.openersStripped).toBe(0)
+    expect(r.replaced).toBe(1)
+  })
+})

package/telegram-plugin/text-voice-scrub.ts

@@ -12,13 +12,27 @@
  * owns enforcement, soft instructions fail under load. Make the
  * framework do it.
  *
- * Scope. Em / en dashes only. The wider "AI-tell phrase denylist"
- * (smoking gun, by design, etc.) was scoped OUT after data showed
- * those phrases land in <0.5% of fleet messages and substituting
- * them risks semantic loss. Em-dash → comma/period is a pure
- * mechanical transform with no semantic loss when the surrounding
- * text is whitespace-separated prose, and a no-op when the dash
- * is inside code or a URL.
+ * Scope. By default ONE mechanical transform, the only one that removes
+ * no content:
+ *   1. Em / en dashes -> comma/period/hyphen. Pure punctuation
+ *      substitution, no semantic loss on whitespace-separated prose; a
+ *      no-op inside code or a URL. Kept deterministic because prompt-only
+ *      guidance was measured to fail at it (em-dashes in 73% of replies
+ *      despite the SOUL rule).
+ *
+ * OPT-IN, off by default:
+ *   2. Leading sycophancy openers ("You're absolutely right", "Great
+ *      catch") -> deleted + recapitalized. This one removes WORDS, and a
+ *      context-free hook can strip a sincere "good catch, that was my
+ *      bug" along with the hollow kind. Per operator steer (2026-06),
+ *      tone is carried by the prompt VOICE directive (where the model has
+ *      context to keep genuine acknowledgement and drop only the empty
+ *      reflexive praise), not by blind deletion here. Re-enable the
+ *      backstop with `SWITCHROOM_VOICE_STRIP_OPENERS=1`.
+ *
+ * Always scoped OUT: the wider mid-sentence "AI-tell phrase denylist"
+ * (smoking gun, delve, etc.). Substituting those mid-clause risks
+ * semantic loss, so they stay with the prompt-side voice guidance.
  *
  * Pipeline integration. Apply BEFORE markdownToHtml so the scrub
  * runs on the original model text, not on rendered HTML where
@@ -46,10 +60,17 @@ export interface VoiceScrubResult {
   /** The scrubbed text. Equal to input when no replacements made or
    *  when the kill switch is set. */
   scrubbed: string
-  /** Count of dash replacements made across the whole input. Surfaces
-   *  to the runtime-metrics fan-out so the cadence dashboard can track
-   *  fleet-wide voice-scrub rate over time. */
+  /** TOTAL voice changes across the whole input = dash replacements +
+   *  leading-affirmation strips. Callers gate on `replaced > 0` to decide
+   *  whether to apply `scrubbed`, so this MUST count every change (an
+   *  opener-only strip with zero dashes still needs `replaced > 0`).
+   *  Surfaces to the runtime-metrics fan-out as the fleet voice-scrub
+   *  rate. */
   replaced: number
+  /** Breakdown: leading sycophancy openers stripped (subset of
+   *  `replaced`). Lets the dashboard separate opener-strips from dash
+   *  fixes. */
+  openersStripped: number
 }
 
 const NULL = '\x00'
@@ -66,6 +87,63 @@ function enabled(): boolean {
   return !(v === '1' || v === 'true')
 }
 
+/**
+ * Leading-affirmation stripping is OPT-IN and OFF by default.
+ *
+ * Rationale (operator steer, 2026-06): tone should be carried by the
+ * prompt (the VOICE directive), where the model has context to keep a
+ * genuine acknowledgement and drop only the hollow reflexive kind.
+ * Deleting an opener in a context-free hook is bad UX: it can strip a
+ * sincere "good catch, that was my bug" along with the empty praise.
+ * So the deterministic layer no longer removes WORDS by default; it
+ * only normalizes em/en dashes (a punctuation substitution that removes
+ * no content, and that prompt-only guidance was measured to fail at).
+ * Set `SWITCHROOM_VOICE_STRIP_OPENERS=1` to re-enable the deterministic
+ * opener strip as a backstop.
+ */
+function openerStripEnabled(): boolean {
+  const v = process.env.SWITCHROOM_VOICE_STRIP_OPENERS
+  return v === '1' || v === 'true'
+}
+
+/**
+ * Leading sycophancy/affirmation openers. Matched ONLY at the very start
+ * of the message, ONLY this known pure-filler set, and the trailing
+ * punctuation/separators (incl. em/en dash) are consumed with it.
+ *
+ * Deliberately excludes bare "you're right" (often load-bearing, e.g.
+ * "you're right that X") and "great/good question" (overlaps the
+ * legitimate short-ack pattern). Kept to phrases whose only content is
+ * the affirmation itself. Apostrophe matches straight or curly.
+ *
+ * The affirmation must be followed by end-of-string OR a clause/sentence
+ * separator (punctuation, possibly with surrounding whitespace) — NOT a
+ * bare space into more words. This is what stops over-strips like
+ * "Spot on the map shows...", "Good catch basin overflow...", "Exactly
+ * right now, the count is 3" — there the phrase is a literal sentence
+ * start, not a detachable affirmation. "Spot on, the value is 5" (comma)
+ * still strips.
+ */
+const LEADING_AFFIRMATION_RE =
+  /^(\s*)(you(?:['’]| a)re absolutely right|you(?:['’]| a)re so right|you(?:['’]| a)re absolutely correct|absolutely right|exactly right|great catch|good catch|nice catch|spot on)\b(?:\s*$|\s*[!.,;:—–-][\s!.,;:—–-]*)/i
+
+/**
+ * Strip a single leading affirmation opener and recapitalize the next
+ * word. No-op (count 0) when there's no match, or when stripping would
+ * leave no substantive content (a standalone affirmation ack survives).
+ */
+function stripLeadingAffirmation(text: string): { out: string; count: number } {
+  const m = LEADING_AFFIRMATION_RE.exec(text)
+  if (!m) return { out: text, count: 0 }
+  const leadingWs = m[1] ?? ''
+  const rest = text.slice(m[0].length)
+  if (rest.trim().length === 0) return { out: text, count: 0 }
+  // Recapitalize the first alphabetic char of the remainder so the new
+  // opening word reads as a sentence start.
+  const recapped = rest.replace(/^(\s*)([a-z])/, (_m, ws: string, ch: string) => ws + ch.toUpperCase())
+  return { out: leadingWs + recapped, count: 1 }
+}
+
 /**
  * Park code-like regions behind placeholders so the dash-replacement
  * pass can't touch them. Returns the parked-string and the original
@@ -179,8 +257,13 @@ function replaceDashes(text: string): { out: string; replaced: number } {
 }
 
 /**
- * Public entry: scrub em / en dashes from outbound text while
- * preserving dashes inside code and URLs.
+ * Public entry: strip a leading sycophancy opener and scrub em/en dashes
+ * from outbound text, preserving anything inside code and URLs.
+ *
+ * Order: park code/URLs -> strip leading affirmation -> replace dashes ->
+ * restore. The opener strip runs on parked text so it can never touch a
+ * code region, and before the dash pass so a dash trailing the opener is
+ * consumed by the strip rather than converted.
  *
  * Pure: no IO, no module-scope state, deterministic. Kill switch is
  * checked per call so an operator can flip it via env var without a
@@ -188,12 +271,20 @@ function replaceDashes(text: string): { out: string; replaced: number } {
  */
 export function scrubVoice(text: string): VoiceScrubResult {
   if (!enabled() || text.length === 0) {
-    return { scrubbed: text, replaced: 0 }
+    return { scrubbed: text, replaced: 0, openersStripped: 0 }
   }
   const { parked, parts } = park(text)
-  const { out, replaced } = replaceDashes(parked)
-  if (replaced === 0) {
-    return { scrubbed: text, replaced: 0 }
+  // Opener strip is opt-in (default off) — see openerStripEnabled(). By
+  // default the deterministic layer removes no words; only em/en dashes
+  // are normalized below, and tone is left to the prompt's VOICE
+  // directive where the model can judge genuine vs hollow.
+  const opener = openerStripEnabled()
+    ? stripLeadingAffirmation(parked)
+    : { out: parked, count: 0 }
+  const { out, replaced } = replaceDashes(opener.out)
+  const total = replaced + opener.count
+  if (total === 0) {
+    return { scrubbed: text, replaced: 0, openersStripped: 0 }
   }
-  return { scrubbed: restore(out, parts), replaced }
+  return { scrubbed: restore(out, parts), replaced: total, openersStripped: opener.count }
 }

package/telegram-plugin/uat/scenarios/fuzz-voice-scrub-dm.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Voice-scrub fuzz — end-to-end check of the voice layers.
+ *
+ * Two layers with different strengths:
+ *   - Em/en dashes are DETERMINISTIC: the gateway's `scrubVoice`
+ *     normalizes every dash on every outbound reply, so "no em-dash
+ *     reaches the user" is a hard, observable guarantee (asserted).
+ *   - Sycophancy openers are PROBABILISTIC: the deterministic opener
+ *     strip is off by default (operator steer 2026-06: context-free word
+ *     deletion is bad UX), and tone is carried by the prompt VOICE
+ *     directive where the model can keep genuine acknowledgement. So an
+ *     opener is a soft signal (warn), not a gate failure.
+ *
+ * This fuzz file drives REAL Telegram inbounds engineered to bait both
+ * (statements the agent will want to affirm; prose asks where models
+ * reach for em-dashes). mtcute's view of the sent message is ground
+ * truth for the deterministic dash check.
+ *
+ * Self-skips green when the harness can't spin up (env unwired) — same as
+ * the sibling fuzz files; uat/** is excluded from gating CI.
+ */
+
+import { describe, it, expect } from "vitest";
+import { spinUp } from "../harness.js";
+
+interface VoiceCase {
+  name: string;
+  prompt: string;
+  timeout: number;
+}
+
+// Prompts engineered to bait the two AI-tells the gate removes.
+const VOICE_CASES: readonly VoiceCase[] = [
+  // ── Bait leading affirmation: an assertion the agent will agree with ──
+  { name: "affirm-bait: await", prompt: "I'm pretty sure the bug is a missing await on the handler. Am I right?", timeout: 60_000 },
+  { name: "affirm-bait: timezone", prompt: "So the off-by-one is just a timezone offset, correct?", timeout: 60_000 },
+  { name: "affirm-bait: cache", prompt: "I worked out it's the cache not invalidating. Good call on my part, no?", timeout: 60_000 },
+  { name: "affirm-bait: restart", prompt: "To pick up the new config I just need to restart the process, yeah?", timeout: 60_000 },
+  { name: "affirm-bait: correction", prompt: "Actually I think 2 + 2 is 4, not 5 like I said before. Right?", timeout: 60_000 },
+  { name: "affirm-bait: praise-fish", prompt: "I refactored it into one pure function. Pretty clean solution, right?", timeout: 60_000 },
+
+  // ── Bait em-dashes: prose explanations / tradeoff asks ──
+  { name: "dash-bait: tradeoff", prompt: "In a sentence or two, what's the tradeoff between threads and async?", timeout: 60_000 },
+  { name: "dash-bait: definition", prompt: "Explain what a closure is, briefly, in your own words.", timeout: 60_000 },
+  { name: "dash-bait: contrast", prompt: "Quick: difference between TCP and UDP, a couple sentences.", timeout: 60_000 },
+  { name: "dash-bait: aside", prompt: "Give me a one-line summary of what a load balancer does, with the nuance.", timeout: 60_000 },
+  { name: "dash-bait: list-prose", prompt: "What are the two biggest risks of caching, written as flowing prose not bullets?", timeout: 60_000 },
+
+  // ── Combined: agree AND explain (both tells in one reply) ──
+  { name: "combo: agree+explain", prompt: "I think REST is simpler than GraphQL for small apps. Agree? Explain why in a couple sentences.", timeout: 60_000 },
+];
+
+const TYPO_DASH_RE = /[—–]/; // em-dash, en-dash
+
+// Mirrors the gateway scrubber's exact strip condition (affirmation +
+// separator/end). Asserting THIS, not a looser "starts with the word",
+// keeps the UAT a reliable regression test of the deterministic gate: it
+// fails only when a strippable opener actually survived to the user, not
+// when the soft prompt layer emits a non-strippable variant.
+const LEADING_AFFIRMATION_RE =
+  /^(you(?:['’]| a)re absolutely right|you(?:['’]| a)re so right|you(?:['’]| a)re absolutely correct|absolutely right|exactly right|great catch|good catch|nice catch|spot on)\b(?:\s*$|\s*[!.,;:—–-])/i;
+
+describe("uat: voice-scrub fuzz — no em-dashes, no sycophancy openers reach the user", () => {
+  for (const vc of VOICE_CASES) {
+    it(
+      `[voice] ${vc.name} — reply is dash-free (affirmation now prompt-tier)`,
+      async () => {
+        const sc = await spinUp({ agent: "test-harness" });
+        try {
+          await sc.sendDM(vc.prompt);
+          const reply = await sc.expectMessage(/\S/, {
+            from: "bot",
+            timeout: vc.timeout,
+          });
+          const text = reply.text ?? "";
+
+          // Invariant 1: non-empty reply (user not ghosted).
+          expect(text.trim().length).toBeGreaterThan(0);
+
+          // Invariant 2: no typographic em/en dash reached the user.
+          // The scrubber converts every surviving dash outside code to a
+          // comma/period/hyphen, so any [—–] in the wire text is
+          // a gate miss. (Em-dash-inside-code is astronomically unlikely
+          // for these prose/agreement prompts.)
+          if (TYPO_DASH_RE.test(text)) {
+            throw new Error(
+              `[voice] ${vc.name}: em/en dash reached the user (scrub miss). `
+              + `Reply: ${JSON.stringify(text.slice(0, 400))}`,
+            );
+          }
+
+          // Invariant 3 (SOFT): reply ideally does not OPEN with a hollow
+          // affirmation. This is now PROBABILISTIC, not deterministic: the
+          // opener strip is off by default and tone is the prompt VOICE
+          // directive's job, so an occasional opener is a soft signal (the
+          // model judged it genuine), not a hard gate failure. Warn, don't
+          // fail — a hard assert here would flake on a prompt-driven lever.
+          if (LEADING_AFFIRMATION_RE.test(text.trim())) {
+            console.warn(
+              `[voice] ${vc.name}: reply opened with an affirmation (prompt-tier, not enforced). `
+              + `Reply: ${JSON.stringify(text.slice(0, 200))}`,
+            );
+          }
+        } finally {
+          await sc.tearDown();
+        }
+      },
+      vc.timeout + 30_000,
+    );
+  }
+});