switchroom 0.18.27 → 0.18.29

package/telegram-plugin/tests/turn-flush-safety.test.ts

@@ -629,6 +629,40 @@ describe('selectFlushDeliveryText — deliver the terminal answer, strip only na
     expect(selectFlushDeliveryText([])).toBe('')
   })
 
+  // #3276 guard 8 — the NARRATION_OPENER regex alone misses progress narration
+  // that does NOT open with "Let me…/I'll…" but trails off into an ellipsis or
+  // colon ("Checking now…"). Pre-fix, `isNarrationBlock` returned false for it,
+  // so the whole `narration\n\nanswer` blob was delivered. FAILS pre-fix.
+  it('strips a non-opener progress narration ("Checking now…") that precedes the answer', () => {
+    const out = selectFlushDeliveryText(['Checking now…', 'The build is green.'])
+    expect(out).toBe('The build is green.')
+    expect(out).not.toContain('Checking now')
+  })
+
+  it('strips a colon-terminated progress narration ("Pulling the numbers:")', () => {
+    const out = selectFlushDeliveryText(['Pulling the numbers:', 'Revenue was 4.2M.'])
+    expect(out).toBe('Revenue was 4.2M.')
+  })
+
+  it('still delivers a SHORT terminal answer after progress narration (no min-char re-gate)', () => {
+    // "yes, done" is well under FLUSH_SUBSTANTIVE_MIN_CHARS and MUST still deliver.
+    const out = selectFlushDeliveryText(['Looking into that...', 'yes, done'])
+    expect(out).toBe('yes, done')
+  })
+
+  // #3276 finding 7 — the narration heuristic only ever strips PRECEDING blocks;
+  // the terminal answer block is always preserved. A colon-terminated line that
+  // IS the whole answer (e.g. a lead-in the model never continued) must NOT be
+  // dropped, whether it stands alone or is the terminal block after narration.
+  it('never drops a colon-terminated line that IS the whole answer (single block)', () => {
+    expect(selectFlushDeliveryText(['Here are the results:'])).toBe('Here are the results:')
+  })
+
+  it('keeps a colon-terminated TERMINAL block (it is the answer, not narration)', () => {
+    const out = selectFlushDeliveryText(['Checking now…', 'Here are the results:'])
+    expect(out).toBe('Here are the results:')
+  })
+
   it('decideTurnFlush delivers the narrowed answer, not the whole blob', () => {
     const decision = decideTurnFlush({
       chatId: 'chat1',

package/telegram-plugin/tests/worker-feed-migration-eviction.test.ts

@@ -0,0 +1,140 @@
+/**
+ * Regression guard for the feed-registry churn bug (FIX 2): a worker row whose
+ * `agentId` migrated feeds (a fresh `update()` under a different chat/thread)
+ * used to leave the OLD group's `workers` map holding an orphan row that the
+ * `agentIndex` no longer pointed at. `groupOfAgent(agentId)` could then never
+ * resolve it, so the heartbeat TTL sweep's `terminateWorker(agentId)` no-op'd
+ * and the row churned every tick forever — the self-contradictory
+ * `worker-feed: TTL reap … no update in 0s (>= 3000s); force-terminating
+ * leaked row` log, repeating ~every 6s.
+ *
+ * Two guarantees are asserted as OUTCOMES:
+ *   1. Migration eviction (root cause): after the same agentId updates a
+ *      different feed, the old group's row is gone immediately — total tracked
+ *      rows never double-count the migrated worker.
+ *   2. Sweep force-eviction is idempotent: once every worker has ended, the TTL
+ *      sweep drives `size` to 0 and it STAYS 0 across repeated heartbeat ticks
+ *      (no churning row that re-reaps forever).
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  createWorkerActivityFeed,
+  type BotApiForWorkerFeed,
+  type WorkerActivityView,
+} from '../worker-activity-feed.js'
+
+function view(desc: string, elapsedMs: number): WorkerActivityView {
+  return { description: desc, lastTool: null, toolCount: 1, latestSummary: 'step', elapsedMs, state: 'running' }
+}
+
+type IndexControl = { repointAgentIndex: (agentId: string, feedKey: string | null) => void }
+
+function makeFeed(nowRef: { t: number }) {
+  const pins: { messageId: number | null }[] = []
+  let seq = 900
+  let control: IndexControl | null = null
+  const bot: BotApiForWorkerFeed = {
+    sendMessage: async () => ({ message_id: seq++ }),
+    editMessageText: async () => true,
+  }
+  const feed = createWorkerActivityFeed({
+    bot,
+    now: () => nowRef.t,
+    minEditIntervalMs: 0,
+    heartbeatTickMs: 1000,
+    firstPaintMinMs: 0,
+    staleWorkerTtlMs: 3_000_000, // 3000s — matches the observed churn log
+    setInterval: () => 0,
+    clearInterval: () => {},
+    reconcilePin: ({ messageId }) => pins.push({ messageId }),
+    exposeTestControls: (c) => {
+      control = c
+    },
+  })
+  return { feed, pins, control: () => control as IndexControl }
+}
+
+async function drain(): Promise<void> {
+  for (let i = 0; i < 12; i++) await new Promise((r) => setImmediate(r))
+}
+
+describe('worker-feed migration eviction + churn-free sweep (FIX 2)', () => {
+  it('evicts the old-feed orphan when an agentId migrates feeds — no double-count', async () => {
+    const nowRef = { t: 1_000_000 }
+    const { feed } = makeFeed(nowRef)
+
+    // Worker registers in feed A (chat -100).
+    await feed.update('agent-1', '-100', view('task', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+
+    // SAME agentId now updates a DIFFERENT feed (chat -200) — a migration. The
+    // old feed-A row must be evicted, not orphaned. Total rows stay 1.
+    nowRef.t += 1000
+    await feed.update('agent-1', '-200', view('task', 1000))
+    await drain()
+    expect(feed.size).toBe(1)
+  })
+
+  it('TTL sweep drives size to 0 and stays 0 across repeated ticks (no churn)', async () => {
+    const nowRef = { t: 2_000_000 }
+    const { feed } = makeFeed(nowRef)
+
+    await feed.update('agent-1', '-100', view('task', 0))
+    await drain()
+    // Migrate to a second feed to exercise the exact desync path that leaked.
+    nowRef.t += 1000
+    await feed.update('agent-1', '-200', view('task', 1000))
+    await drain()
+    expect(feed.size).toBe(1)
+
+    // Advance past the silence TTL so the sweep force-terminates the last row.
+    nowRef.t += 3_000_001
+    feed.heartbeatTick()
+    await drain()
+    expect(feed.size).toBe(0)
+
+    // Idempotency: further ticks must not resurrect / re-reap a churning row.
+    for (let i = 0; i < 3; i++) {
+      nowRef.t += 3_000_001
+      feed.heartbeatTick()
+      await drain()
+    }
+    expect(feed.size).toBe(0)
+  })
+
+  it('TTL sweep FORCE-EVICTS a leaked row whose agentIndex has desynced from its group', async () => {
+    // Reproduce the exact desync the migration-eviction fix now prevents any
+    // public sequence from producing: a live row physically in group A while
+    // the agentIndex points somewhere else, so `groupOfAgent(agentId) !== g`.
+    // This drives the heartbeat sweep's FORCE-EVICT branch specifically — the
+    // one that removes the orphan directly from the group it lives in instead
+    // of no-op'ing through `terminateWorker` (which would churn forever).
+    const nowRef = { t: 3_000_000 }
+    const { feed, control } = makeFeed(nowRef)
+
+    await feed.update('agent-1', '-100', view('task', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+
+    // Corrupt the index so it no longer resolves to the group holding the row.
+    // `terminateWorker('agent-1')` would now look up a non-existent group and
+    // no-op — the leak the force-evict branch exists to catch.
+    control().repointAgentIndex('agent-1', 'bogus-feed-key')
+
+    // Past the silence TTL: the sweep must force-evict the row from its real
+    // group, NOT rely on terminateWorker.
+    nowRef.t += 3_000_001
+    feed.heartbeatTick()
+    await drain()
+    expect(feed.size).toBe(0)
+
+    // And it stays gone — no churning row re-reaped every tick.
+    for (let i = 0; i < 3; i++) {
+      nowRef.t += 3_000_001
+      feed.heartbeatTick()
+      await drain()
+    }
+    expect(feed.size).toBe(0)
+  })
+})

package/telegram-plugin/tests/worker-pin-reaper.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import {
   decideWorkerPinReaps,
+  storeOnlyWorkerPinCandidates,
   workerAgentIdOfPinKey,
   WORKER_PIN_TTL_MS_DEFAULT,
   type WorkerPinCandidate,
@@ -130,3 +131,80 @@ describe("decideWorkerPinReaps (#3001 mid-session wk: sweep)", () => {
     expect(reaps).toHaveLength(0);
   });
 });
+
+describe("storeOnlyWorkerPinCandidates (#3001 durable group net)", () => {
+  const inMem = (keys: string[] = []) => new Set(keys);
+
+  it("promotes a wk: store row that has NO in-memory claim into a reap candidate (group chat)", () => {
+    // A GROUP chat id is negative; the reconciling sweep must recover a
+    // bot-tracked orphan there via a per-message unpin (never an unpin-all).
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [{ pinKey: "wk:group:-100:5", chatId: "-100", messageId: 42 }],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(1);
+    expect(cands[0].pinKey).toBe("wk:group:-100:5");
+    expect(cands[0].chatId).toBe("-100");
+    // messageId is carried so the gateway can per-message unpin (group-safe).
+    expect(cands[0].messageId).toBe(42);
+    // A terminal registry verdict reaps it now, however "young" (pinnedAt=now).
+    const reaps = decideWorkerPinReaps({
+      pins: cands,
+      statusOf: () => "terminal" as const,
+      ttlMs: TTL,
+      now: NOW,
+    });
+    expect(reaps.map((r) => r.pinKey)).toEqual(["wk:group:-100:5"]);
+  });
+
+  it("NEVER promotes an untracked/human pin — only wk: rows qualify (fg:/tool:/banner: excluded)", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [
+        { pinKey: "fg:-100:9", chatId: "-100", messageId: 1 },
+        { pinKey: "tool:-100:9", chatId: "-100", messageId: 2, expiresAt: NOW + 1 },
+        { pinKey: "banner:owner", chatId: "-100", messageId: 3 },
+      ],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(0);
+  });
+
+  it("skips rows the in-memory reaper already owns (dedup by pinKey)", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [{ pinKey: "wk:a", chatId: "-100", messageId: 7 }],
+      inMemoryPinKeys: inMem(["wk:a"]),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(0);
+  });
+
+  it("skips pending (pin API in-flight) and time-scoped tool rows and empty-chat rows", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [
+        { pinKey: "wk:pending", chatId: "-100", messageId: 1, pending: true },
+        { pinKey: "wk:tool", chatId: "-100", messageId: 2, expiresAt: NOW + 1000 },
+        { pinKey: "wk:nochat", chatId: "", messageId: 3 },
+      ],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(0);
+  });
+
+  it("a store-orphan with a live 'running' worker is kept (never reaped mid-run)", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [{ pinKey: "wk:live", chatId: "-100", messageId: 5 }],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    const reaps = decideWorkerPinReaps({
+      pins: cands,
+      statusOf: () => "running" as const,
+      ttlMs: TTL,
+      now: NOW,
+    });
+    expect(reaps).toHaveLength(0);
+  });
+});

package/telegram-plugin/tier-downgrade.ts

@@ -20,9 +20,10 @@
  * account-swap, never by a downgrade.
  *
  * There is NO automatic return to the premium model. The `/model` override is
- * SESSION-SCOPED and in-memory only (`recordTypedModelSwitch` writes NO carrier
- * — reference/rfcs/session-model-stickiness.md §0.1 rev 4), so it dies on the
- * downgrade SIGTERM. The downgrade writes a consume-once `.session-model`
+ * SESSION-SCOPED: rev 5 (reference/rfcs/session-model-stickiness.md §0.05) makes
+ * every switch a consume-once `.session-model` carrier relaunch, so the override
+ * dies on the downgrade SIGTERM (the carrier was consumed on its own apply-boot).
+ * The downgrade writes a consume-once `.session-model`
  * carrier for the CONFIGURED DEFAULT: start.sh applies+deletes it on the resume
  * boot, and every subsequent restart boots the configured default too. The
  * premium model is never restored on its own — the user must re-issue

package/telegram-plugin/turn-flush-safety.ts

@@ -193,8 +193,32 @@ export function selectFlushDeliveryText(blocks: string[]): string {
 const NARRATION_OPENER =
   /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i
 
+/**
+ * #3276 guard 8 — the `NARRATION_OPENER` regex alone misses common progress
+ * narration that opens with a gerund/present-continuous verb and trails off
+ * into an ellipsis or colon: "Checking now…", "Pulling the numbers:",
+ * "Looking into that…". Relying on the opener regex leaked those blocks into
+ * the delivered answer. This recognises a NON-terminal narration line
+ * deterministically, WITHOUT re-gating on a min-char floor (a short real
+ * answer like "Yes, done." must still deliver): a single short line that ends
+ * with an ellipsis or a colon is progress narration, not the terminal answer.
+ *
+ * Kept conservative on purpose — only a SINGLE-line block (no internal
+ * paragraph) under the substantive floor, ending in `…` / `...` / `:`, so a
+ * genuine multi-paragraph answer that happens to end a paragraph with a colon
+ * is never mistaken for narration.
+ */
+const NARRATION_TRAILER = /(?:\.{3}|…|:)\s*$/
+
+function isTrailingNarrationLine(block: string): boolean {
+  const t = block.trim()
+  if (t.length === 0 || t.length >= FLUSH_SUBSTANTIVE_MIN_CHARS) return false
+  if (t.includes('\n')) return false
+  return NARRATION_TRAILER.test(t)
+}
+
 function isNarrationBlock(block: string): boolean {
-  return NARRATION_OPENER.test(block.trimStart())
+  return NARRATION_OPENER.test(block.trimStart()) || isTrailingNarrationLine(block)
 }
 
 export type FlushDecision =

package/telegram-plugin/worker-activity-feed.ts

@@ -393,6 +393,21 @@ export interface WorkerActivityFeedOpts {
     threadId?: number
     messageId: number | null
   }) => void
+  /**
+   * TEST-ONLY (never set in production). Invoked once at construction with a
+   * narrow control that repoints the internal `agentId → feedKey` index WITHOUT
+   * moving the worker's row. Its sole purpose is to reproduce the
+   * `agentIndex`/`workers` DESYNC that the migration-eviction root-cause fix now
+   * prevents any public API sequence from producing — so the heartbeat sweep's
+   * force-evict backstop (the branch that removes a leaked row when
+   * `groupOfAgent(agentId)` no longer resolves to the group physically holding
+   * it) can be covered by a deterministic test. A no-op when unset.
+   */
+  exposeTestControls?: (controls: {
+    /** Set the internal index entry for `agentId` to `feedKey` (or delete it
+     *  when `feedKey` is null) without touching any group's `workers` map. */
+    repointAgentIndex: (agentId: string, feedKey: string | null) => void
+  }) => void
 }
 
 /**
@@ -897,6 +912,20 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     maybeDeleteGroup(g)
   }
 
+  /**
+   * Force-evict a LEAKED row from the specific group it lives in, used when the
+   * agentIndex has desynced (points at a different feed, or none) so the normal
+   * `removeWorker`/`terminateWorker` path — which resolves the group via the
+   * index — can't reach it. Deletes the index entry ONLY if it still points at
+   * THIS group, so a live row for the same agentId in another feed keeps its
+   * mapping intact.
+   */
+  function evictRowFromGroup(g: FeedGroup, agentId: string): void {
+    g.workers.delete(agentId)
+    if (agentIndex.get(agentId) === g.feedKey) agentIndex.delete(agentId)
+    maybeDeleteGroup(g)
+  }
+
   /**
    * Delete an empty group. A group is gone only when it has NO tracked workers
    * AND no staged terminal repaints pending — the latter keeps the group object
@@ -1243,7 +1272,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     //      that keeps getting `update()` cues every heartbeat resets
     //      `lastUpdateAt` forever, so only an age anchor immune to that reset can
     //      reap it (Carrie 5h zombie pin, re-edited 3000+ times).
-    const staleAgentIds: Array<{ agentId: string; reason: 'silence' | 'absolute' }> = []
+    const staleAgentIds: Array<{ g: FeedGroup; agentId: string; reason: 'silence' | 'absolute' }> = []
     const staleFinished: Array<{ g: FeedGroup; agentId: string; reason: 'silence' | 'absolute' }> = []
     for (const g of groups.values()) {
       for (const row of g.workers.values()) {
@@ -1253,8 +1282,12 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         // Attribute the reap to the absolute cap only when silence alone would
         // NOT have fired — so the log names the trigger that actually caught it.
         const reason: 'silence' | 'absolute' = silent ? 'silence' : 'absolute'
+        // Carry the group the row was ACTUALLY found in (not `groupOfAgent`,
+        // which resolves via the agentIndex — that index can desync from a
+        // group's `workers` map when an agentId migrated feeds, orphaning the
+        // old row. Using `g` guarantees the reap evicts the row that exists.)
         if (row.finished) staleFinished.push({ g, agentId: row.agentId, reason })
-        else staleAgentIds.push({ agentId: row.agentId, reason })
+        else staleAgentIds.push({ g, agentId: row.agentId, reason })
       }
     }
     // GC any FINISHED row still lingering past the TTL (#3207: finished rows
@@ -1274,15 +1307,32 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       removeWorker(g, agentId)
       syncPin(g)
     }
-    for (const { agentId, reason } of staleAgentIds) {
-      const row = groupOfAgent(agentId)?.workers.get(agentId)
+    for (const { g, agentId, reason } of staleAgentIds) {
+      // Read the row from the group it was FOUND in, so the log reports the
+      // real age even when the agentIndex has desynced (the old bug printed
+      // "no update in 0s" because it read `groupOfAgent(agentId)`, which
+      // resolved to a different/absent group and fell back to `now`).
+      const row = g.workers.get(agentId)
       if (reason === 'absolute') {
         const age = Math.floor((now - (row?.createdAtMs ?? now)) / 1000)
         log(`worker-feed: ABSOLUTE cap reap agent=${agentId} — row age ${age}s (>= ${Math.floor(absoluteRowLifetimeCapMs / 1000)}s); force-terminating immortal row (survives lastUpdateAt reset)`)
       } else {
         log(`worker-feed: TTL reap agent=${agentId} — no update in ${Math.floor((now - (row?.lastUpdateAt ?? now)) / 1000)}s (>= ${Math.floor(staleWorkerTtlMs / 1000)}s); force-terminating leaked row`)
       }
-      void terminateWorker(agentId)
+      // Normal honest finalize when the agentIndex still points at THIS group
+      // (renders the terminal recap + releases the pin through the chain). But
+      // when the index has desynced — it resolves to a different group or none
+      // — `terminateWorker` would look up the wrong/no row and no-op, leaving
+      // this row to churn every heartbeat forever. Detect that and force-evict
+      // the leaked row directly from the group it actually lives in.
+      if (groupOfAgent(agentId) === g) {
+        void terminateWorker(agentId)
+      } else {
+        log(`worker-feed: force-evicting leaked row agent=${agentId} feed=${g.feedKey} — agentIndex desynced (points elsewhere); removing directly`)
+        markFinalized(agentId)
+        evictRowFromGroup(g, agentId)
+        syncPin(g)
+      }
     }
     for (const g of [...groups.values()]) {
       // Deferred-finalize re-drive: a terminal edit that hit a cooldown/flood
@@ -1369,6 +1419,15 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
 
   heartbeatTimer = setIntervalFn(heartbeatTick, heartbeatTickMs)
 
+  // TEST-ONLY: hand out the narrow index-repoint control (see opts doc). Never
+  // provided in production wiring, so this is a no-op there.
+  opts.exposeTestControls?.({
+    repointAgentIndex: (agentId, feedKey) => {
+      if (feedKey == null) agentIndex.delete(agentId)
+      else agentIndex.set(agentId, feedKey)
+    },
+  })
+
   return {
     has(agentId) {
       const g = groupOfAgent(agentId)
@@ -1401,6 +1460,20 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       if (existingRow?.finished === true) return Promise.resolve()
 
       const feedKey = feedKeyOf(chatId, threadId)
+      // Feed-migration cleanup (root-cause of the "no update in 0s" churn): if
+      // this agentId is already indexed to a DIFFERENT feed, its prior row is
+      // about to be orphaned (we re-index below to the new feed, but the old
+      // group's `workers` map still holds the stale row — invisible to
+      // `groupOfAgent` forever after, so the TTL sweep can never evict it and
+      // it churns every heartbeat). Evict the stale row from its old group now.
+      const priorFeedKey = agentIndex.get(agentId)
+      if (priorFeedKey != null && priorFeedKey !== feedKey) {
+        const priorGroup = groups.get(priorFeedKey)
+        if (priorGroup != null) {
+          evictRowFromGroup(priorGroup, agentId)
+          syncPin(priorGroup)
+        }
+      }
       let g = groups.get(feedKey)
       if (g == null) {
         g = {

package/vendor/hindsight-memory/scripts/lib/content.py

@@ -8,8 +8,14 @@ truncateRecallQuery, sliceLastTurnsByUserBoundary, prepareRetentionTranscript,
 formatMemories.
 """
 
+import os
 import re
-from datetime import datetime, timezone
+from datetime import datetime
+
+try:  # Python 3.9+; present in every switchroom agent image.
+    from zoneinfo import ZoneInfo
+except ImportError:  # pragma: no cover - defensive only
+    ZoneInfo = None  # type: ignore[assignment,misc]
 
 # ---------------------------------------------------------------------------
 # Memory tag stripping (anti-feedback-loop)
@@ -254,16 +260,44 @@ def format_memories(results: list) -> str:
     return "\n\n".join(lines)
 
 
+def _resolve_agent_timezone() -> str:
+    """Resolve the agent's configured IANA timezone.
+
+    Mirrors the switchroom cascade used by ``bin/timezone-hook.sh`` and
+    ``src/config/timezone.ts``: ``SWITCHROOM_TIMEZONE`` → ``TZ`` → ``UTC``.
+    This recall hook runs as a plugin subprocess INSIDE the agent container,
+    so it inherits both env vars (compose.ts bakes them onto the container).
+    """
+    return os.environ.get("SWITCHROOM_TIMEZONE") or os.environ.get("TZ") or "UTC"
+
+
 def format_current_time() -> str:
-    """Format current UTC time for recall context.
+    """Format the current time in the agent's LOCAL timezone for recall context.
 
-    The "UTC" suffix is explicit so client LLMs do not misread the
-    value as local time when reasoning about wall-clock context.
+    Switchroom #tz-fix: previously this emitted ``"%Y-%m-%d %H:%M UTC"``, the
+    STRONGEST of several competing UTC "current time" strings the model saw
+    each turn — it fought the single correct local-time hint and made agents
+    intermittently report UTC / wrong-offset times. We now render the agent's
+    LOCAL wall clock in am/pm form (e.g. ``2026-07-16 04:09 PM AEST``) so the
+    recall block never injects a UTC "now". Deterministic — the timezone comes
+    from the container env, not model discipline.
 
     Port of: formatCurrentTimeForRecall() in index.js
     """
-    now = datetime.now(timezone.utc)
-    return now.strftime("%Y-%m-%d %H:%M UTC")
+    tz_name = _resolve_agent_timezone()
+    now = None
+    if ZoneInfo is not None:
+        try:
+            now = datetime.now(ZoneInfo(tz_name))
+        except Exception:  # unknown/invalid zone — degrade, don't crash recall.
+            now = None
+    if now is None:
+        # No zoneinfo or bad zone: fall back to the process-local clock, which
+        # already honours the container's TZ env via libc. am/pm form, no "UTC".
+        now = datetime.now().astimezone()
+    # "%Y-%m-%d %I:%M %p %Z" → e.g. "2026-07-16 04:09 PM AEST" (mirrors the
+    # %I:%M %p %Z tail of bin/timezone-hook.sh's format).
+    return now.strftime("%Y-%m-%d %I:%M %p %Z")
 
 
 # ---------------------------------------------------------------------------

package/vendor/hindsight-memory/tests/test_content.py

@@ -585,10 +585,31 @@ class TestPrepareRetentionTranscript:
 
 
 class TestFormatCurrentTime:
-    def test_includes_utc_suffix(self):
-        # The "UTC" suffix prevents client LLMs from misreading the
-        # timestamp as local time.
-        assert format_current_time().endswith(" UTC")
-
-    def test_format_shape(self):
-        assert re.fullmatch(r"\d{4}-\d{2}-\d{2} \d{2}:\d{2} UTC", format_current_time())
+    # switchroom #tz-fix: recall's "Current time - …" line now renders the
+    # agent's LOCAL wall clock in am/pm, NOT UTC — it was the strongest of
+    # several competing UTC "now" strings the model saw each turn.
+    def test_local_am_pm_shape(self, monkeypatch):
+        # A real IANA zone → am/pm form with the zone abbreviation, no "UTC".
+        monkeypatch.setenv("SWITCHROOM_TIMEZONE", "Australia/Melbourne")
+        monkeypatch.delenv("TZ", raising=False)
+        out = format_current_time()
+        # e.g. "2026-07-16 04:09 PM AEST" / "… AEDT" (DST) — abbrev is 3-5 alpha.
+        assert re.fullmatch(
+            r"\d{4}-\d{2}-\d{2} \d{2}:\d{2} (?:AM|PM) [A-Za-z]{2,5}", out
+        ), out
+
+    def test_never_emits_utc_current_time(self, monkeypatch):
+        # The whole point of the fix: no UTC "current time" for a real zone.
+        monkeypatch.setenv("SWITCHROOM_TIMEZONE", "Australia/Melbourne")
+        monkeypatch.delenv("TZ", raising=False)
+        out = format_current_time()
+        assert "UTC" not in out
+        assert not out.endswith("Z")
+
+    def test_am_pm_when_no_zone_configured(self, monkeypatch):
+        # No SWITCHROOM_TIMEZONE / TZ → still am/pm shape (process-local clock),
+        # never the old "%Y-%m-%d %H:%M UTC" 24h form.
+        monkeypatch.delenv("SWITCHROOM_TIMEZONE", raising=False)
+        monkeypatch.delenv("TZ", raising=False)
+        out = format_current_time()
+        assert re.match(r"\d{4}-\d{2}-\d{2} \d{2}:\d{2} (?:AM|PM)", out), out