switchroom 0.19.42 → 0.19.44

package/telegram-plugin/tests/tg-post-retry-attribution.test.ts

@@ -0,0 +1,196 @@
+/**
+ * A reply that was rate-limited and then DELIVERED on retry must not raise a
+ * fleet-health delivery-failure alert (#3931).
+ *
+ * ── The bug ──────────────────────────────────────────────────────────────
+ * `installTgPostLogger` is a grammy API transformer, so it runs INSIDE the
+ * function the retry policy calls — it observes one POST ATTEMPT, never the
+ * logical send's outcome. A 429 that `createRetryApiCall` slept and retried
+ * successfully therefore left a `tg-post method=sendRichMessage … status=err`
+ * line in the gateway log, and fleet-health's `reply-delivery-failure`
+ * signature (`src/fleet-health/detect.ts`) matches per LINE. Result: a
+ * severity-3 "the answer never reached the principal" escalation for an answer
+ * the operator had already read. Under flood pressure (the class of event that
+ * produces 429s in the first place) that is the alarm that fires most.
+ *
+ * ── The fix these tests pin ──────────────────────────────────────────────
+ * The retry policy publishes its attempt context; the transformer labels an
+ * attempt the policy is about to repeat `status=retry`. `status=err` now means
+ * the logical send is OVER and nothing landed. Nothing is suppressed — the
+ * retry lines are still written, they just no longer masquerade as outcomes.
+ *
+ * These tests drive a REAL grammy `Bot` (a mock-`api` harness sits above the
+ * transformer layer, so it would be a false guard) through the REAL retry
+ * policy, and feed the REAL emitted lines to the REAL detector.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { Bot } from 'grammy'
+import { installTgPostLogger } from '../shared/bot-runtime.js'
+import { createRetryApiCall, willRetryTelegramFailure } from '../retry-api-call.js'
+import { detectGatewayFindings, scanAgent } from '../../src/fleet-health/detect.js'
+
+/** A real Bot whose transport answers with `envelopes[i]` for the i-th call. */
+function makeBot(envelopes: Array<Record<string, unknown>>): Bot {
+  let i = 0
+  const fakeFetch = (async () => {
+    const envelope = envelopes[Math.min(i, envelopes.length - 1)]
+    i++
+    // A Bot API rejection is an HTTP 200 carrying `ok:false` — which is
+    // precisely why it RESOLVES the transformer chain (see #3927).
+    return { ok: true, status: 200, json: async () => envelope } as unknown as Response
+  }) as unknown as typeof fetch
+
+  const bot = new Bot('123456:TEST_TOKEN', {
+    botInfo: {
+      id: 123456,
+      is_bot: true,
+      first_name: 'Test',
+      username: 'test_bot',
+      can_join_groups: false,
+      can_read_all_group_messages: false,
+      supports_inline_queries: false,
+      can_connect_to_business: false,
+      has_main_web_app: false,
+    },
+    client: { fetch: fakeFetch },
+  })
+  installTgPostLogger(bot)
+  return bot
+}
+
+const OK_ENVELOPE = {
+  ok: true,
+  result: { message_id: 7, date: 0, chat: { id: 4242, type: 'private' } },
+}
+const FLOOD_429 = {
+  ok: false,
+  error_code: 429,
+  description: 'Too Many Requests: retry after 3',
+  parameters: { retry_after: 3 },
+}
+
+/**
+ * Send one user-facing reply through the production composition
+ * (retry policy → transformer → wire) and return the gateway log lines it
+ * produced, shaped exactly as `gateway-supervisor.log` carries them.
+ */
+async function gatewayLinesForReply(
+  envelopes: Array<Record<string, unknown>>,
+): Promise<{ lines: string[]; threw: boolean }> {
+  const written: string[] = []
+  const spy = vi.spyOn(process.stderr, 'write').mockImplementation(((chunk: unknown) => {
+    written.push(String(chunk))
+    return true
+  }) as unknown as typeof process.stderr.write)
+  let threw = false
+  try {
+    const bot = makeBot(envelopes)
+    // The real policy, with sleeping stubbed out so a 3s flood-wait doesn't
+    // cost the suite 3 seconds. Everything else is production behaviour.
+    const robustApiCall = createRetryApiCall({ sleep: async () => {} })
+    await robustApiCall(() =>
+      bot.api.sendRichMessage(4242, { markdown: 'the answer' }),
+    ).catch(() => {
+      threw = true
+    })
+  } finally {
+    spy.mockRestore()
+  }
+  const lines = written
+    .filter((l) => l.startsWith('tg-post '))
+    .map((l) => `2026-08-01T12:00:00Z gateway: ${l.trimEnd()}`)
+  return { lines, threw }
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('#3931 — a retried-and-delivered reply raises no delivery-failure alert', () => {
+  it('429-then-ok: fleet-health sees zero reply-delivery-failures and does not escalate', async () => {
+    const { lines, threw } = await gatewayLinesForReply([FLOOD_429, OK_ENVELOPE])
+
+    // Ground truth: the reply WAS delivered. If this ever fails, the fixture
+    // stopped modelling the scenario and the assertions below mean nothing.
+    expect(threw).toBe(false)
+    expect(lines).toHaveLength(2)
+    expect(lines[1]).toContain('status=ok')
+
+    // THE outcome: the detector raises nothing, and the agent is not escalated.
+    const { gw_hits, findings } = detectGatewayFindings('alpha', lines.join('\n'))
+    expect(gw_hits['reply-delivery-failure']).toBe(0)
+    expect(findings.filter((f) => f.signal === 'reply-delivery-failure')).toHaveLength(0)
+    expect(scanAgent('alpha', '', lines.join('\n')).escalate).toBe(false)
+
+    // The evidence is not hidden — the rate-limit attempt is still on the log,
+    // honestly labelled as an attempt rather than an outcome.
+    expect(lines[0]).toContain('status=retry')
+    expect(lines[0]).toContain('code=429')
+  })
+
+  it('an ok:true reply is untouched — no retry tier leaks onto the happy path', async () => {
+    const { lines, threw } = await gatewayLinesForReply([OK_ENVELOPE])
+    expect(threw).toBe(false)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('status=ok')
+    expect(lines[0]).toContain('err=- code=- desc=-')
+  })
+})
+
+describe('#3931 — a genuinely undelivered reply still escalates', () => {
+  it('a terminal 403 escalates', async () => {
+    const { lines, threw } = await gatewayLinesForReply([
+      { ok: false, error_code: 403, description: 'Forbidden: bot was blocked by the user' },
+    ])
+    expect(threw).toBe(true)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('status=err')
+
+    expect(detectGatewayFindings('alpha', lines.join('\n')).gw_hits['reply-delivery-failure']).toBe(1)
+    expect(scanAgent('alpha', '', lines.join('\n')).escalate).toBe(true)
+  })
+
+  it('a 429 on EVERY attempt (retries exhausted, nothing landed) escalates exactly once', async () => {
+    const { lines, threw } = await gatewayLinesForReply([FLOOD_429])
+    expect(threw).toBe(true)
+    // Three attempts: two survivable, the last one terminal.
+    expect(lines).toHaveLength(3)
+    expect(lines.filter((l) => l.includes('status=retry'))).toHaveLength(2)
+    expect(lines.filter((l) => l.includes('status=err'))).toHaveLength(1)
+
+    // One alert for one lost answer — not one per attempt.
+    expect(detectGatewayFindings('alpha', lines.join('\n')).gw_hits['reply-delivery-failure']).toBe(1)
+    expect(scanAgent('alpha', '', lines.join('\n')).escalate).toBe(true)
+  })
+})
+
+describe('willRetryTelegramFailure — the predicate mirrors the retry loop', () => {
+  const ctx = { attempt: 0, maxRetries: 3, maxFloodSleepMs: 120_000 }
+
+  it('is false with no enclosing retry policy (a raw bot.api.* call is its own outcome)', () => {
+    expect(willRetryTelegramFailure({ errorCode: 429, retryAfterSec: 3 }, undefined)).toBe(false)
+  })
+
+  it('is false on the last attempt — the loop falls through to give-up', () => {
+    expect(
+      willRetryTelegramFailure({ errorCode: 429, retryAfterSec: 3 }, { ...ctx, attempt: 2 }),
+    ).toBe(false)
+  })
+
+  it('is false for a 429 over the in-process sleep ceiling (FLOOD_WAIT_ACTIVE, not retried)', () => {
+    expect(willRetryTelegramFailure({ errorCode: 429, retryAfterSec: 15908 }, ctx)).toBe(false)
+  })
+
+  it('is true for a 429 under the ceiling and for a transient transport error', () => {
+    expect(willRetryTelegramFailure({ errorCode: 429, retryAfterSec: 3 }, ctx)).toBe(true)
+    expect(willRetryTelegramFailure({ message: 'ECONNRESET' }, ctx)).toBe(true)
+  })
+
+  it('is false for the error classes the loop rethrows immediately', () => {
+    expect(willRetryTelegramFailure({ errorCode: 400, message: 'Bad Request' }, ctx)).toBe(false)
+    expect(willRetryTelegramFailure({ errorCode: 403 }, ctx)).toBe(false)
+    // Local disk exhaustion must NOT look retryable — retrying it is what
+    // trips the flood ban in the first place (#2923).
+    expect(willRetryTelegramFailure({ message: 'ENOSPC: no space left on device' }, ctx)).toBe(false)
+  })
+})

package/telegram-plugin/tests/tool-activity-summary.test.ts

@@ -14,7 +14,13 @@ import {
   STEP_TIMER_MIN_MS,
   type SessionActivityHeader,
 } from "../tool-activity-summary.js";
-import { STATUS_ROLLING_LINES, STATUS_LINE_MAX } from "../status-no-truncate.js";
+import { STATUS_ROLLING_LINES, STATUS_LINE_MAX, NESTED_PREFIX } from "../status-no-truncate.js";
+
+// The nested (foreground sub-agent) child-block indent. Asserted through the
+// constant, never as a literal: #3668 replaced its ASCII spaces with U+2800
+// (Telegram left-trims a leading ASCII/Zs run off a content line), and a test
+// that hardcodes the bytes pins the defect instead of the behaviour.
+const NP = NESTED_PREFIX;
 import { COLLAPSE_SAFE_SEPARATOR } from "../card-format.js";
 
 /** The pinned-card collapse separator (#3666) every status-card line now
@@ -352,29 +358,29 @@ describe("renderActivityFeedWithNested — foreground sub-agent nesting (Model A
     expect(out).toContain("~~_✓ Delegating: review the migration_~~");
     expect(out).not.toContain("**→ Delegating");
     // The live → step is the newest nested child line; earlier child = italic.
-    expect(out).toContain("   ↳ ~~_Reading schema.ts_~~");
-    expect(out).toContain("   ↳ **→ Looking for foreign keys**");
+    expect(out).toContain(NP + "~~_Reading schema.ts_~~");
+    expect(out).toContain(NP + "**→ Looking for foreign keys**");
   });
 
   it("windows the nested block to STATUS_ROLLING_LINES with a '↳ +N earlier…' header", () => {
     const total = STATUS_ROLLING_LINES + 3;
     const child = Array.from({ length: total }, (_, i) => `step ${i + 1}`);
     const out = renderActivityFeedWithNested(["Delegating: x"], child)!;
-    expect(out).toContain(`   ↳ _+${total - STATUS_ROLLING_LINES} earlier…_`);
+    expect(out).toContain(`${NP}_+${total - STATUS_ROLLING_LINES} earlier…_`);
     // newest nested line is the live → step
-    expect(out).toContain(`   ↳ **→ step ${total}**`);
+    expect(out).toContain(`${NP}**→ step ${total}**`);
     // the oldest (collapsed) lines are not rendered verbatim
     expect(out).not.toContain("step 1<");
   });
 
   it("renders the child block even when the parent feed is empty", () => {
     const out = renderActivityFeedWithNested([], ["Reading a.ts"]);
-    expect(out).toBe("   ↳ **→ Reading a.ts**");
+    expect(out).toBe(NP + "**→ Reading a.ts**");
   });
 
   it("markdown-escapes nested child text (emphasis specials only)", () => {
     const out = renderActivityFeedWithNested(["Delegating: x"], ["touch a_b & 2 * 3"])!;
-    expect(out).toContain("   ↳ **→ touch a\\_b & 2 \\* 3**");
+    expect(out).toContain(NP + "**→ touch a\\_b & 2 \\* 3**");
   });
 
   it("final=true: the nested newest step renders done (✓), not in-progress (→)", () => {
@@ -383,7 +389,7 @@ describe("renderActivityFeedWithNested — foreground sub-agent nesting (Model A
       ["Reading schema.ts", "Looking for foreign keys"],
       true,
     )!;
-    expect(out).toContain("   ↳ ~~_Looking for foreign keys_~~"); // newest now struck italic done
+    expect(out).toContain(NP + "~~_Looking for foreign keys_~~"); // newest now struck italic done
     expect(out).not.toContain("→"); // no in-progress arrow in the finalized feed
   });
 
@@ -400,7 +406,7 @@ describe("renderActivityFeedWithNested — foreground sub-agent nesting (Model A
       false,
       " · 22s",
     )!;
-    expect(out).toContain("   ↳ **→ Looking for foreign keys · 22s**");
+    expect(out).toContain(NP + "**→ Looking for foreign keys · 22s**");
     expect(out).not.toContain("Reading schema.ts · "); // only the newest line ticks
   });
 
@@ -567,7 +573,7 @@ describe("rolling window + +N earlier — renderActivityFeedWithNested", () => {
       expect(out).not.toContain(`Parent ${i}`);
     }
     expect(out).toContain(`_✓ +${totalParent - STATUS_ROLLING_LINES} earlier…_`);
-    expect(out).toContain("   ↳ **→ Child step B**");
+    expect(out).toContain(NP + "**→ Child step B**");
   });
 
   it("many child lines → only the last STATUS_ROLLING_LINES child lines render with a ↳ +N earlier header", () => {
@@ -582,8 +588,8 @@ describe("rolling window + +N earlier — renderActivityFeedWithNested", () => {
     for (let i = 1; i < firstVisible; i++) {
       expect(out).not.toContain(`Child ${i}`);
     }
-    expect(out).toContain(`   ↳ _+${totalChild - STATUS_ROLLING_LINES} earlier…_`);
-    expect(out).toContain(`   ↳ **→ Child ${totalChild}**`);
+    expect(out).toContain(`${NP}_+${totalChild - STATUS_ROLLING_LINES} earlier…_`);
+    expect(out).toContain(`${NP}**→ Child ${totalChild}**`);
   });
 
   it("STATUS_LINE_MAX=200: a 250-char child line is clipped to 200 (both surfaces)", () => {
@@ -600,7 +606,7 @@ describe("rolling window + +N earlier — renderActivityFeedWithNested", () => {
     const child = Array.from({ length: STATUS_ROLLING_LINES }, () => bigLine);
     const out = renderActivityFeedWithNested(parent, child)!;
     expect(out.length).toBeLessThanOrEqual(4096);
-    expect(out).toContain("   ↳ ");
+    expect(out).toContain(NP);
   });
 });
 
@@ -678,11 +684,11 @@ describe("extreme-edge: single oversized line with markdown specials & && _ *",
     expect(out.length).toBeLessThanOrEqual(4000);
     expect(isValidMarkdown(out)).toBe(true);
     // Must contain the nested prefix.
-    expect(out).toContain("   ↳ ");
+    expect(out).toContain(NP);
     // Regression guard: an operator-precedence bug made wrapperOverhead a string
     // (NESTED_PREFIX + n) → NaN budget → slice(0, NaN) === "" → the child content
-    // was silently discarded, leaving only "   ↳ **→ **". The empty-wrapper
-    // output still satisfies the toContain("   ↳ ") check above, so assert that
+    // was silently discarded, leaving only `${NESTED_PREFIX}**→ **`. The empty-wrapper
+    // output still satisfies the toContain(NP) check above, so assert that
     // real child content actually survives.
     expect(out).toContain("Child step");
     expect(out.length).toBeGreaterThan(100);
@@ -1025,7 +1031,7 @@ describe("renderActivityFeed — header param (main-session card fix)", () => {
     // Parent step is done-styled (child is the live step).
     expect(out).toContain("~~_✓ Delegating: review_~~");
     // Child step is the in-progress step.
-    expect(out).toContain("   ↳ **→ Reading schema.ts**");
+    expect(out).toContain(NP + "**→ Reading schema.ts**");
   });
 });
 

package/telegram-plugin/tool-activity-summary.ts

@@ -389,13 +389,14 @@ export function renderStatusCard(opts: StatusCardOpts): string | null {
    *                          an already-escaped markdown escape is never sliced.
    */
   const deepest = Math.max(1, escapedBody.length)
+  /** The collapsed parent trail, kept at every shrink level below level 0. */
+  const markerSection: CardSection = {
+    steps: [],
+    window: 1,
+    placeholder: parentMarker ?? undefined,
+  }
   return fitCardToBudget((level) => {
     if (level === 0) return { spec: fullSpec() }
-    const markerSection: CardSection = {
-      steps: [],
-      window: 1,
-      placeholder: parentMarker ?? undefined,
-    }
     if (level < escapedBody.length) {
       return {
         spec: {
@@ -427,39 +428,66 @@ export function renderStatusCard(opts: StatusCardOpts): string | null {
     }
   }, deepest)
 
+  /** The deepest shrink level's spec, for a given already-wrapped body line. */
+  function deepestSpec(bodyLine: string): CardSpec {
+    return {
+      chrome,
+      sections: [markerSection, { steps: [], window: 1, placeholder: bodyLine }],
+      footer,
+    }
+  }
+
+  /** Wrap an ALREADY-ESCAPED newest step in its bullet chrome. */
+  function wrapNewest(escaped: string): string {
+    return final
+      ? `${bodyIndent}_✓ ${escaped}_`
+      : `${bodyIndent}**→ ${escaped}${liveSuffix}**`
+  }
+
   /**
-   * The deepest shrink level's single bullet. Charges the fixed header/footer
-   * (and the parent marker) against `STATUS_CARD_CHAR_BUDGET`, then clips the
-   * RAW newest text to what is left, re-checking after escaping because
-   * escaping can expand the string (`&` → `&amp;`).
+   * The deepest shrink level's single bullet: clip the RAW newest text to
+   * whatever the fixed chrome/footer leaves of `STATUS_CARD_CHAR_BUDGET`,
+   * escape, then re-measure — escaping can expand the string (`&` → `&amp;`).
+   *
+   * Everything is measured by RENDERING the level's real spec (#3833). The
+   * previous arithmetic estimate charged `[...chrome, ...footer].join('\n')`,
+   * but the renderer is `stackCard`, which emits a collapse separator plus a
+   * two-space GFM hard break at every line boundary — 4 chars, not 1 — and it
+   * also charges the marker line and the section boundaries the estimate only
+   * partly counted. That under-count let a card render OVER the wire budget.
+   * Measuring with the renderer cannot drift from it by construction.
    */
   function truncatedNewestLine(): string {
-    const fixedCost = [...chrome, ...footer].join('\n').length
     const rawNewest = rawBody.length > 0 ? cleanStepLine(rawBody[rawBody.length - 1]) : ''
-    const wrapperOverhead = final
-      ? (bodyIndent + '_✓ _').length
-      : (bodyIndent + '**→ **').length + liveSuffix.length
-    const headerFooterCost =
-      fixedCost +
-      (fixedCost > 0 ? 1 : 0) +
-      (parentMarker != null ? parentMarker.length + 1 : 0)
-    const budget = STATUS_CARD_CHAR_BUDGET - headerFooterCost - wrapperOverhead
-    let raw = rawNewest.slice(0, Math.max(0, budget))
-    let newest = escapeMarkdown(raw)
-    while (
-      raw.length > 0 &&
-      wrapperOverhead + headerFooterCost + newest.length > STATUS_CARD_CHAR_BUDGET
-    ) {
-      const excess = wrapperOverhead + headerFooterCost + newest.length - STATUS_CARD_CHAR_BUDGET
-      raw = raw.slice(0, Math.max(0, raw.length - excess - 1))
-      newest = escapeMarkdown(raw)
+    const empty = wrapNewest('')
+    const fixedCost = renderCardSpec(deepestSpec(empty)).length
+    const budget = STATUS_CARD_CHAR_BUDGET - fixedCost
+    // Chrome alone is over budget (a 40k-char worker description, #3682). No
+    // amount of body clipping helps; `fitCardToBudget`'s hard-truncate backstop
+    // is what keeps the card under the wire limit in that case.
+    if (budget <= 0) return empty
+    let raw = clipRaw(rawNewest, budget)
+    let line = wrapNewest(escapeMarkdown(raw))
+    for (;;) {
+      const excess = renderCardSpec(deepestSpec(line)).length - STATUS_CARD_CHAR_BUDGET
+      if (excess <= 0 || raw.length === 0) return line
+      // Dropping k RAW chars drops at least k escaped chars (escaping never
+      // shrinks), so this strictly converges.
+      raw = clipRaw(raw, Math.max(0, raw.length - excess))
+      line = wrapNewest(escapeMarkdown(raw))
     }
-    return final
-      ? `${bodyIndent}_✓ ${newest}_`
-      : `${bodyIndent}**→ ${newest}${liveSuffix}**`
   }
 }
 
+/**
+ * Slice raw (pre-escape) text to `n` chars without leaving a dangling lone
+ * high surrogate — an unpaired surrogate is invalid UTF-16 on the wire.
+ */
+function clipRaw(text: string, n: number): string {
+  const out = text.slice(0, Math.max(0, n))
+  return /[\uD800-\uDBFF]$/.test(out) ? out.slice(0, -1) : out
+}
+
 /** Subtle horizontal rule between the running feed and the finished result. */
 const WORKER_RESULT_RULE = '─────'
 /** Hard cap on the terminal result paragraph. */

package/telegram-plugin/uat/scenarios/jtbd-foreground-subagent-activity-dm.test.ts

@@ -51,8 +51,9 @@ const FG_DISPATCH_PROMPT =
   `one-line summary." Wait for the foreground sub-agent to finish, then send ` +
   `me a brief reply telling me it's done.`;
 
-// The nested foreground block renders each child line prefixed with "↳"
-// (NESTED_PREFIX = "   ↳ "), newest as a bold "→ …" current step. Telegram
+// The nested foreground block renders each child line prefixed with a three
+// U+2800 indent then "↳" (NESTED_PREFIX; #3668 replaced the old ASCII spaces,
+// which Telegram left-trims), newest as a bold "→ …" current step. Telegram
 // strips the bold but keeps the literal ↳ / → glyphs in message text.
 const NESTED_RE = /↳/;
 

package/vendor/hindsight-memory/scripts/lib/config.py

@@ -25,9 +25,24 @@ OBSERVATION_SCOPE_STRATEGIES = ("curated", "shared", "combined", "off")
 #: value that, if left in scope, defeats cross-session dedup on the dominant
 #: (sidechain) observation path. A tag matching ANY of these is dropped from the
 #: consolidation scope but LEFT on the source fact.
+#:
+#: ``^source:`` (switchroom provenance tagging) is in the list for a different
+#: reason than the other two, and the name of the constant undersells it: what
+#: this list really means is "tags excluded from the CONSOLIDATION SCOPE, kept
+#: on the source fact". ``source:transcript`` is the opposite of volatile — it
+#: is stamped identically on every auto-retain, forever. That is exactly why it
+#: must not reach the scope: a stable tag flips ``curated`` from the bank-wide
+#: ``"shared"`` scope to an explicit ``[["source:transcript"]]`` partition, so
+#: every observation consolidated after the tag ships would be isolated from
+#: every observation consolidated before it. The tag is a RECALL-side filter
+#: handle (``metadata`` is not filterable, tags are), not a consolidation
+#: partition, so scope computation must stay byte-identical to before it
+#: existed. Pinned against ``RETAIN_PROVENANCE_TAG_SCOPE_PATTERN`` in
+#: ``src/memory/hindsight-retain-provenance.ts``.
 DEFAULT_VOLATILE_SCOPE_PATTERNS = (
     r"^parent_session:",
     r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(-sub-.+)?$",
+    r"^source:",
 )
 
 DEFAULTS = {

package/vendor/hindsight-memory/scripts/tests/test_retain_provenance_tag.py

@@ -0,0 +1,135 @@
+"""Provenance on auto-retained transcript content (switchroom fix/retain-provenance).
+
+The defect: the Stop-hook auto-retain posts the recent transcript window to
+Hindsight, which extracts facts from it — including from the ASSISTANT's own
+synthesis. Those fabrications land as ordinary memory units and recall back next
+session as though a human had asserted them. Nothing on the stored unit said
+"this came out of a transcript": ``tags`` held only the raw session UUID and the
+only other signal, ``session_id``, lived in ``metadata`` — which Hindsight's
+best-practices page states is NOT filterable, while tags ARE.
+
+The fix stamps a stable, semantic ``source:transcript`` tag via switchroom's
+``retainTags`` default, so recall/reflect can address it (tag filters, tag
+weights). This module asserts the two OUTCOMES that matter at the retain seam:
+
+  1. The tag actually reaches the wire payload, alongside the session tag and
+     any detected lesson tags (i.e. it composes, it does not clobber).
+  2. It does NOT change the observation consolidation scope. This is the
+     non-obvious half: ``observationScopeStrategy: "curated"`` builds the scope
+     from a retain's STABLE tags, so a permanently-stamped tag would flip every
+     bank from the bank-wide ``"shared"`` scope to a ``[["source:transcript"]]``
+     partition, isolating every new observation from every observation
+     consolidated before the tag shipped. ``^source:`` is therefore excluded
+     from the scope in ``DEFAULT_VOLATILE_SCOPE_PATTERNS`` — the tag is a
+     recall-side filter handle, not a consolidation partition.
+
+Stdlib-only; runs under ``python3 -m unittest discover tests/``.
+"""
+
+import os
+import sys
+import unittest
+
+SCRIPTS_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+if SCRIPTS_DIR not in sys.path:
+    sys.path.insert(0, SCRIPTS_DIR)
+
+from lib.config import (  # noqa: E402
+    DEFAULTS,
+    DEFAULT_VOLATILE_SCOPE_PATTERNS,
+    compute_observation_scopes,
+)
+from retain import build_retain_payload  # noqa: E402
+
+#: What switchroom's ``renderHindsightSettingsOverrides`` stamps into every
+#: agent's deployed settings.json (src/memory/hindsight-retain-provenance.ts).
+PROVENANCE_TAG = "source:transcript"
+SESSION_ID = "4c386b32-ddfd-40d1-b557-da8135b294af"
+
+
+def _cfg(**over):
+    c = {
+        "retainRoles": ["user", "assistant"],
+        "retainToolCalls": True,
+        "retainContext": "claude-code",
+        "retainMetadata": {},
+        "retainTags": ["{session_id}", PROVENANCE_TAG],
+        "lessonTagging": DEFAULTS["lessonTagging"],
+        "lessonTagMarkers": DEFAULTS["lessonTagMarkers"],
+        "observationScopeStrategy": "curated",
+    }
+    c.update(over)
+    return c
+
+
+def _build(transcript_text="Edited the login handler and ran tests.", **cfg_over):
+    msgs = [
+        {"role": "user", "content": "what did we change?", "uuid": "u1"},
+        {"role": "assistant", "content": transcript_text, "uuid": "a1"},
+    ]
+    built = build_retain_payload(
+        _cfg(**cfg_over),
+        SESSION_ID,
+        msgs,
+        msgs,
+        bank_id="bank",
+        api_url="http://x",
+        api_token=None,
+    )
+    assert built is not None
+    return built["payload"]
+
+
+class ProvenanceTagReachesTheWire(unittest.TestCase):
+    def test_tag_is_on_the_retain_payload(self):
+        self.assertIn(PROVENANCE_TAG, _build()["tags"])
+
+    def test_session_tag_still_templated_and_kept(self):
+        tags = _build()["tags"]
+        self.assertIn(SESSION_ID, tags)
+        self.assertNotIn("{session_id}", tags)
+
+    def test_composes_with_detected_lesson_tags(self):
+        tags = _build("anti-pattern: narrate without executing")["tags"]
+        self.assertIn(PROVENANCE_TAG, tags)
+        self.assertIn("anti-pattern", tags)
+        self.assertIn(SESSION_ID, tags)
+
+    def test_absent_when_retain_tags_config_omits_it(self):
+        # The tag is data, not hardcoded behaviour: retain.py has no knowledge
+        # of it beyond honouring the configured retainTags. That keeps the
+        # vendored plugin generic and the switchroom stamp the single source.
+        tags = _build(retainTags=["{session_id}"])["tags"]
+        self.assertNotIn(PROVENANCE_TAG, tags)
+
+
+class ProvenanceTagIsScopeNeutral(unittest.TestCase):
+    """The tag must not silently re-partition observation consolidation."""
+
+    def test_curated_scope_stays_shared_with_the_provenance_tag(self):
+        payload = _build()
+        self.assertEqual(payload["observation_scopes"], "shared")
+
+    def test_scope_is_byte_identical_to_a_bank_without_the_tag(self):
+        with_tag = _build()["observation_scopes"]
+        without = _build(retainTags=["{session_id}"])["observation_scopes"]
+        self.assertEqual(with_tag, without)
+
+    def test_a_stable_tag_that_is_not_excluded_would_have_changed_the_scope(self):
+        # Guards the guard: proves the "shared" result above is caused by the
+        # exclusion pattern and not by curated ignoring stable tags generally.
+        scope, err = compute_observation_scopes(
+            [SESSION_ID, "project:switchroom"], _cfg()
+        )
+        self.assertIsNone(err)
+        self.assertEqual(scope, [["project:switchroom"]])
+
+    def test_exclusion_pattern_is_present_and_matches_the_tag(self):
+        self.assertIn(r"^source:", DEFAULT_VOLATILE_SCOPE_PATTERNS)
+        scope, err = compute_observation_scopes([SESSION_ID, PROVENANCE_TAG], _cfg())
+        self.assertIsNone(err)
+        self.assertEqual(scope, "shared")
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()

package/vendor/hindsight-memory/settings.json

@@ -2,7 +2,7 @@
   "hindsightApiUrl": "",
   "bankId": "claude_code",
   "bankMission": "You are a Claude Code AI assistant. Focus on technical discussions, decisions, and context relevant to the user's projects.",
-  "retainMission": "Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.\n\nDURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:\n- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.\n- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.\n- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.\n- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.\n- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.\nIf a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.\n\nA preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.\n\nA TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this\ncandidate a file path, a command/process/agent/session id, a temp directory, or\nthe location where some output was written? If yes, drop it — it is transcript\nexhaust, not memory.\n\nNEVER extract:\n- Tool results verbatim or paraphrased. Concretely, never produce a fact whose\n  text resembles any of these: \"File created successfully at /path/to/file\",\n  \"A background command with ID bctz4yskm is running, and its output will be\n  written to /tmp/...\", \"Async agent a745598ba84e71df1 was launched successfully\n  and is running in the background\", \"User executed a Bash command to sleep for\n  200 seconds\", \"The assistant used grep to locate 'truncateSync' in src/foo.ts\".\n- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.\n- Agent tool-use traces or narration of what the assistant did (e.g. \"the\n  assistant used X to query Y\", \"ran a search\", \"sent the message\").\n- The act of delegating, dispatching, spawning, launching, steering or merging\n  work — including when it succeeded. \"X was dispatched and completed\" is the\n  session describing itself. Record only what the work LEARNED or CHANGED.\n- In-flight workflow/process narration (a sub-task started, paused, or is still\n  running) — retain the outcome only once the task completes or a decision is made.\n- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.\n- Slash commands the user typed and their effects (e.g. \"User issued /clear to\n  reset assistant state\").\n- Hindsight's own errors, retries, backlogs, or internal state — the memory\n  system's self-reports are not memories.\n- Restatements of the user's current request or the task in progress.\n- Volatile state written as a timeless assertion. A version, count, size,\n  backlog, status, or any \"X is running Y\" / \"X is at Y\" / \"X is currently Y\"\n  claim is true only at the instant it was said. Concretely, never produce a\n  fact whose text resembles any of these: \"Switchroom fleet is running image\n  version v0.18.19\", \"The switchroom repo is at /path/to/fleet, version\n  v0.19.5\", \"Bank overlord has 43155 pending consolidations\", \"The build is\n  currently green\". If the claim is worth keeping, put the date INSIDE the\n  fact text (\"As of 2026-07-19 the fleet was running v0.18.19\"); if you\n  cannot date it, drop it. An undated one is recalled forever as though it\n  were still true, which is worse than not remembering it at all.\n- Transient state (unread counts, build status, what is running right now) unless\n  the fact is explicitly dated, in which case record it as a dated observation.\n- Greetings, acknowledgements, and routine operational chatter.\n\nWrite each fact so it stands alone: name the thing, the number, and the date. A\nsentence that only makes sense while reading this transcript is not durable.\n\nIf a candidate fact matches an exclusion, drop it rather than rewording it. If\nnothing durable remains, return an empty facts list.\n",
+  "retainMission": "Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.\n\nDURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:\n- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.\n- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.\n- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.\n- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.\n- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.\nIf a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.\n\nA preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.\n\nA TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this\ncandidate a file path, a command/process/agent/session id, a temp directory, or\nthe location where some output was written? If yes, drop it — it is transcript\nexhaust, not memory.\n\nNEVER extract:\n- Tool results verbatim or paraphrased. Concretely, never produce a fact whose\n  text resembles any of these: \"File created successfully at /path/to/file\",\n  \"A background command with ID bctz4yskm is running, and its output will be\n  written to /tmp/...\", \"Async agent a745598ba84e71df1 was launched successfully\n  and is running in the background\", \"User executed a Bash command to sleep for\n  200 seconds\", \"The assistant used grep to locate 'truncateSync' in src/foo.ts\".\n- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.\n- Agent tool-use traces or narration of what the assistant did (e.g. \"the\n  assistant used X to query Y\", \"ran a search\", \"sent the message\").\n- The act of delegating, dispatching, spawning, launching, steering or merging\n  work — including when it succeeded. \"X was dispatched and completed\" is the\n  session describing itself. Record only what the work LEARNED or CHANGED.\n- In-flight workflow/process narration (a sub-task started, paused, or is still\n  running) — retain the outcome only once the task completes or a decision is made.\n- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.\n- Slash commands the user typed and their effects (e.g. \"User issued /clear to\n  reset assistant state\").\n- Hindsight's own errors, retries, backlogs, or internal state — the memory\n  system's self-reports are not memories.\n- Restatements of the user's current request or the task in progress.\n- The assistant's own answers, summaries, recaps, or reflect output. Before\n  extracting, ask: does anything in this transcript support this claim OTHER\n  than the assistant having asserted it? If not, drop it — a model's own\n  synthesis re-extracted as a fact is how a guess becomes permanent.\n  Concretely, never produce a fact whose only support is the assistant\n  stating a date, a version, an attribution, a total, or a decision that the\n  user never confirmed and no tool output shows. An unverified claim recalls\n  later as though it had been established, which is worse than not\n  remembering it at all.\n- Volatile state written as a timeless assertion. A version, count, size,\n  backlog, status, or any \"X is running Y\" / \"X is at Y\" / \"X is currently Y\"\n  claim is true only at the instant it was said. Concretely, never produce a\n  fact whose text resembles any of these: \"Switchroom fleet is running image\n  version v0.18.19\", \"The switchroom repo is at /path/to/fleet, version\n  v0.19.5\", \"Bank overlord has 43155 pending consolidations\", \"The build is\n  currently green\". If the claim is worth keeping, put the date INSIDE the\n  fact text (\"As of 2026-07-19 the fleet was running v0.18.19\"); if you\n  cannot date it, drop it. An undated one is recalled forever as though it\n  were still true, which is worse than not remembering it at all.\n- Transient state (unread counts, build status, what is running right now) unless\n  the fact is explicitly dated, in which case record it as a dated observation.\n- Greetings, acknowledgements, and routine operational chatter.\n\nWrite each fact so it stands alone: name the thing, the number, and the date. A\nsentence that only makes sense while reading this transcript is not durable.\n\nIf a candidate fact matches an exclusion, drop it rather than rewording it. If\nnothing durable remains, return an empty facts list.\n",
   "autoRecall": true,
   "autoRetain": true,
   "retainMode": "full-session",