switchroom 0.20.10 → 0.20.12

package/telegram-plugin/gateway/gateway.ts

@@ -433,7 +433,8 @@ import {
 import { createThrottleTierRunner } from './throttle-tier-wiring.js'
 import { parseLitellmNoticeWindowMs } from '../litellm-local-notice.js'
 import { createLitellmLocalNoticeRunner, decideRateLimitedSurface } from './litellm-local-notice-wiring.js'
-import { runFleetAutoFallback, renderFallbackFailureNotice, evaluateFallbackFailureNotice, evaluateAllBlockedNotice, type FallbackFailureNoticeState, type FallbackAllBlockedNoticeState } from '../auto-fallback-fleet.js'
+import { runFleetAutoFallback, renderFallbackFailureNotice, evaluateFallbackFailureNotice, type FallbackFailureNoticeState } from '../auto-fallback-fleet.js'
+import { resetFleetFallbackNoticeCooldowns, shouldSendAllBlockedNotice, shouldSendStrictPinnedNotice } from './fleet-fallback-notice-cooldown.js'
 import { startRestartWatchdog } from './restart-watchdog.js'
 import { createAccessStore } from './access-store.js'
 
@@ -626,6 +627,13 @@ import { readTurnUsages } from '../../src/agents/perf.js'
 import { buildContextOccupancy, writeContextOccupancySnapshot } from './context-occupancy.js'
 import { decideProactiveCompact, initialCompactState, type CompactState } from './proactive-compact.js'
 import { IdleTracker, idleDurationToMs, DEFAULT_IDLE_CLEAR_MS } from './idle-clear.js'
+import {
+  openPrivateInterval,
+  closePrivateInterval,
+  PRIVATE_ON_REPLY,
+  PUBLIC_REPLY,
+} from './privacy-state.js'
+import { makePrivacyResetForNewSession, isContinueRestoreBoot } from './privacy-reset.js'
 import { nextCompactNotify, idleCompactNotifyState, type CompactNotifyState } from './compact-notify.js'
 import {
   tryHostdDispatch,
@@ -769,13 +777,9 @@ import type { ChatKey as _ChatKey } from './inbound-delivery-machine.js'
 import { dispatchEffects } from './inbound-delivery-machine-dispatch.js'
 import { maybeFireWarmup } from './prefix-warmup.js'
 import {
-  renderSkillProposalCard,
-  skillProposalKeyboard,
-} from './skill-proposal-card.js'
-import {
-  enqueueProposal as enqueueSkillProposal,
-  isSuppressed as isSkillProposalSuppressed,
-} from '../../src/self-improve/skill-proposals.js'
+  handlePostSkillProposal,
+  handlePostEvalCaseProposal,
+} from './self-improve-proposal-wiring.js'
 import { decideSubagentHandback } from './subagent-handback-inbound-builder.js'
 import {
   decideSubagentProgress,
@@ -803,6 +807,7 @@ import type {
   QueryPendingPermissionMessage,
   CheckPreApprovedMessage,
   PostSkillProposalMessage,
+  PostEvalCaseProposalMessage,
   PermissionEvent,
   RolloutStatusPostMessage,
   RolloutStatusEditMessage,
@@ -5097,6 +5102,10 @@ function maybeIdleClear(): void {
           `telegram gateway: idle /clear suppressed for ${agentName} ` +
             `(activity in check-to-send gap)\n`,
         );
+      } else {
+        // The idle /clear fired → new logical session; reset privacy to public.
+        const idleChat = loadAccess().allowFrom[0];
+        if (idleChat) resetPrivacyForNewSession(String(idleChat), undefined);
       }
     })
     .catch((err: unknown) => {
@@ -5600,6 +5609,11 @@ const swallowingApiCall = createSwallowingRetryApiCall(
   robustApiCall,
   (line) => process.stderr.write(line),
 )
+// Privacy (#private-mode): reset to public on a genuine new session (boot / /clear); loud only on a private→public transition. See privacy-reset.ts.
+const resetPrivacyForNewSession = makePrivacyResetForNewSession((chatId, threadId, text) =>
+  void swallowingApiCall(
+    () => lockedBot.api.sendMessage(chatId, text, threadId != null ? { message_thread_id: threadId, disable_notification: false } : { disable_notification: false }),
+    { chat_id: chatId, verb: 'privacy-reset-alert', priorityClass: 'critical' }))
 
 /**
  * The ONE seam every `setMessageReaction` in this gateway goes through (#3155).
@@ -8356,8 +8370,7 @@ const statusPinClaims = new Map<string, StatusPinClaim>()
 // Rights-aware negative cache (#3024): chats where an auto status-pin attempt
 // failed with the permanent "not enough rights to manage pinned messages" 400.
 // Per-process only — a restart clears it so a later-granted pin right re-enables
-// auto-pin. The explicit `pin_message` MCP tool deliberately does NOT consult
-// this cache (it always attempts and surfaces the error to the agent).
+// auto-pin.
 const statusPinRightsCache = new PinRightsCache()
 
 // Durable snapshot of the pin claim set on the persistent per-agent volume
@@ -8452,21 +8465,16 @@ const BANNER_PIN_KEY = 'banner:owner'
 // run → no-op). The boot-cleanup gate below is widened to cover this.
 const bannerPinPersistEnabled = !STATIC
 
-// `pin_message` MCP-tool pin registration (#3001). Tool pins ride the same
-// shared status-pins.json store under `tool:<chatId>:<messageId>` keys, but
-// with a TTL row (`expiresAt`): a tool pin is a deliberate agent action with
-// no "work finished" event, so a restart does NOT reset it — boot cleanup
-// keeps unexpired tool rows and only unpins them once the TTL lapses (the
-// backstop against agent-pinned messages accumulating forever). Independent
-// of PIN_STATUS_WHILE_WORKING (it gates the auto status pin, not the tool).
+// LEGACY `tool:` pin drain (#3001; the `pin_message` MCP tool was retired in
+// #4452). No new `tool:<chatId>:<messageId>` rows are ever written now that the
+// tool is gone, but rows an earlier build persisted may still sit in the shared
+// status-pins.json with a TTL (`expiresAt`). This flag keeps the boot cleanup /
+// stale-pin sweep aware of those legacy rows so they are still expired and
+// drained correctly on upgrade — an unexpired legacy row is preserved across
+// boots (never reaped as if it were a work-scoped card), then unpinned once its
+// TTL lapses, exactly as before. Independent of PIN_STATUS_WHILE_WORKING.
+// Self-clears within one TTL window since nothing writes new tool rows.
 const toolPinPersistEnabled = !STATIC
-// 7 days: generous — an agent-pinned message the operator still cares about
-// after a week has usually been re-pinned or acted on; anything older is the
-// stale-pin long tail this issue exists to clear. Override for tuning.
-const TOOL_PIN_TTL_MS = (() => {
-  const v = Number(process.env.SWITCHROOM_TOOL_PIN_TTL_MS)
-  return Number.isFinite(v) && v > 0 ? v : 7 * 24 * 60 * 60_000
-})()
 
 // Persist (or drop) the slot-banner's pin row into the shared store. Routes
 // through mutateStatusPinRow: a read-modify-write for ONLY the banner:owner key,
@@ -8936,8 +8944,7 @@ async function reconcileStatusPin(
   // "not enough rights to manage pinned messages" 400 in a supergroup took the
   // whole gateway down (marko, 2026-07-01). Auto status-pin is cosmetic; it
   // must NEVER be able to crash the gateway. Any throw here is logged and
-  // absorbed. (The `pin_message` MCP tool still surfaces failures to the agent
-  // as a normal tool-error — that path is `executePinMessage`, not this one.)
+  // absorbed.
   try {
     // Serialize per pinKey (F2): reconcileStatusPinInner reads `prev` from the
     // in-memory claim map at its top, so overlapping same-key reconciles must
@@ -9058,6 +9065,11 @@ const stalePinSweeper: StalePinSweeper = createGatewayStalePinSweeper({
       ? loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs)
       : [],
   eligible: () => stalePinSweepEligible,
+  // Share the live path's per-process pin-rights negative cache so the sweep
+  // and executePinLeg agree on rights-less chats (D3): the sweep skips a chat
+  // the live path already proved rights-less, and feeds its own reactive
+  // discoveries back so the live path skips too.
+  rightsCache: statusPinRightsCache,
   store: { path: STALE_PIN_SWEEP_STORE_PATH, fs: sweepStoreFs },
   // Per-deployment override only. UNSET (the normal case) means "take the
   // standing policy" — UNPIN_ALL_FORUM_TOPIC_ENABLED in stale-pin-sweep.ts,
@@ -11592,69 +11604,19 @@ if (isGatewayMain) ipcServer = createIpcServer({
   // onQuotaWallDetected so it doesn't fall inside the source slice that
   // send-outbound-wiring.test.ts takes between onSendOutbound and
   // onQuotaWallDetected.
+  // Thin delegate — body lives in self-improve-proposal-wiring.ts to keep the
+  // gateway line ratchet flat. Placed AFTER onQuotaWallDetected so it doesn't
+  // fall inside the source slice send-outbound-wiring.test.ts takes between
+  // onSendOutbound and onQuotaWallDetected.
   onPostSkillProposal(_client: IpcClient, msg: PostSkillProposalMessage) {
-    const self = process.env.SWITCHROOM_AGENT_NAME
-    if (self && msg.agentName !== self) {
-      process.stderr.write(
-        `telegram gateway: post_skill_proposal rejected — agent mismatch (${msg.agentName} != ${self})\n`,
-      )
-      return
-    }
-    try {
-      assertAllowedChat(msg.chatId)
-    } catch (err) {
-      process.stderr.write(
-        `telegram gateway: post_skill_proposal rejected — ${(err as Error).message}\n`,
-      )
-      return
-    }
-    const stateDir = process.env.TELEGRAM_STATE_DIR
-    if (stateDir == null || stateDir.length === 0) {
-      process.stderr.write(`telegram gateway: post_skill_proposal: TELEGRAM_STATE_DIR unset, skipping\n`)
-      return
-    }
-    // Dedup against still-live rejection fingerprints — never re-surface a
-    // proposal the operator already dismissed.
-    if (isSkillProposalSuppressed(stateDir, {
-      lesson: msg.lesson,
-      draft: msg.draft,
-      skill_slug: msg.skillSlug,
-    })) {
-      process.stderr.write(
-        `telegram gateway: post_skill_proposal suppressed (rejected before) slug=${msg.skillSlug}\n`,
-      )
-      return
-    }
-    const proposal = enqueueSkillProposal(stateDir, {
-      skill_slug: msg.skillSlug,
-      is_new: msg.isNew,
-      lesson: msg.lesson,
-      draft: msg.draft,
-      evidence: msg.evidence,
-      chat_id: Number(msg.chatId),
-    })
-    const cardText = renderSkillProposalCard({
-      id: proposal.id,
-      skill_slug: proposal.skill_slug,
-      is_new: proposal.is_new,
-      lesson: proposal.lesson,
-      evidence: proposal.evidence,
-      skill_md: proposal.draft['SKILL.md'],
-    })
-    const threadId = msg.threadId
-    void swallowingApiCall(
-      () =>
-        bot.api.sendMessage(msg.chatId, cardText, {
-          parse_mode: 'HTML',
-          reply_markup: skillProposalKeyboard(proposal.id),
-          ...(threadId != null && threadId !== 1 ? { message_thread_id: threadId } : {}),
-        }),
-      { chat_id: msg.chatId, verb: 'skill-proposal-card', ...(threadId != null ? { threadId } : {}) },
-    )
-    process.stderr.write(
-      `telegram gateway: post_skill_proposal agent=${msg.agentName} chat=${msg.chatId} ` +
-      `proposal=${proposal.id} slug=${proposal.skill_slug} new=${proposal.is_new}\n`,
-    )
+    handlePostSkillProposal(msg, { bot, assertAllowedChat, swallowingApiCall })
+  },
+
+  // RFC amendment §"corrections as eval cases" — thin delegate; the
+  // DETERMINISTIC applier runs on Approve in handleEvalCaseProposalCallback,
+  // NOT a model turn. Body in self-improve-proposal-wiring.ts.
+  onPostEvalCaseProposal(_client: IpcClient, msg: PostEvalCaseProposalMessage) {
+    handlePostEvalCaseProposal(msg, { bot, assertAllowedChat, swallowingApiCall })
   },
 
   // Buzz Phase 2b: the duplex peer's advisory publish outcome — no-op unless the hub mirror booted.
@@ -11839,7 +11801,7 @@ if (isGatewayMain && !STATIC) {
  *  bridge from calling arbitrary functions by name. */
 const ALLOWED_TOOLS = new Set([
   'reply', 'progress_update', 'react', 'download_attachment',
-  'edit_message', 'send_typing', 'pin_message', 'delete_message',
+  'edit_message', 'send_typing', 'delete_message',
   'forward_message', 'get_recent_messages',
   'send_checklist', 'update_checklist',
   'ask_user',
@@ -11875,8 +11837,6 @@ async function executeToolCall(
       return executeEditMessage(args)
     case 'send_typing':
       return executeSendTyping(args)
-    case 'pin_message':
-      return executePinMessage(args)
     case 'delete_message':
       return executeDeleteMessage(args)
     case 'forward_message':
@@ -13226,44 +13186,6 @@ async function executeSendTyping(args: Record<string, unknown>): Promise<unknown
   return { content: [{ type: 'text', text: `${action} indicator sent (auto-refreshes every 4s, stops after 30s or next reply)` }] }
 }
 
-async function executePinMessage(args: Record<string, unknown>): Promise<unknown> {
-  if (!args.chat_id) throw new Error('pin_message: chat_id is required')
-  if (!args.message_id) throw new Error('pin_message: message_id is required')
-  const pinChatId = String(args.chat_id ?? '')
-  assertAllowedChat(pinChatId)
-  // #1075: wrap through robustApiCall so flood-wait / transient network
-  // errors are retried. THREAD_NOT_FOUND on a stale topic surfaces to the
-  // agent as a tool-error — pinning a vanished message is genuinely a
-  // failure the agent should see.
-  const pinMsgId = Number(args.message_id)
-  await robustApiCall(
-    () => lockedBot.api.pinChatMessage(pinChatId, pinMsgId), // allow-raw-pin: MCP `pin_message` tool — an explicit, agent-requested pin of an arbitrary message, not a progress surface with a claim.
-    { chat_id: pinChatId, verb: 'pin_message' },
-  )
-  // An explicit pin succeeded here, so the bot demonstrably HAS pin rights in
-  // this chat now — clear any auto-pin negative-cache entry (#3024) so the auto
-  // status-pin path resumes immediately rather than waiting for a restart. The
-  // explicit tool itself never consults the cache; a failure above still
-  // surfaces to the agent as a normal tool error (robustApiCall rethrows).
-  statusPinRightsCache.clear(pinChatId)
-  // #3001: register the tool pin in the shared status-pin store under a
-  // `tool:` key so it is no longer fire-and-forget. Unlike work-scoped
-  // fg:/wk: rows a tool pin has no "work finished" event, so a restart does
-  // NOT reset it — boot cleanup keeps the row until its TTL, then unpins the
-  // (likely long-forgotten) message. Best-effort fire-and-forget: a store
-  // failure must never fail the tool call the pin already landed for.
-  if (toolPinPersistEnabled) {
-    const toolPinKey = `tool:${pinChatId}:${pinMsgId}`
-    void mutateStatusPinRow(STATUS_PIN_STORE_PATH, statusPinStoreFs, toolPinKey, { // allow-raw-pin-store: records the TTL-scoped `tool:` row for the explicit pin above so the boot sweep can expire it.
-      pinKey: toolPinKey,
-      chatId: pinChatId,
-      messageId: pinMsgId,
-      expiresAt: Date.now() + TOOL_PIN_TTL_MS,
-    })
-  }
-  return { content: [{ type: 'text', text: `pinned message ${args.message_id}` }] }
-}
-
 async function executeDeleteMessage(args: Record<string, unknown>): Promise<unknown> {
   if (!args.chat_id) throw new Error('delete_message: chat_id is required')
   if (!args.message_id) throw new Error('delete_message: message_id is required')
@@ -17683,6 +17605,10 @@ async function refreshPinnedBanner(reason: string): Promise<void> {
       onError: (phase, err) => {
         process.stderr.write(`telegram gateway: banner ${phase} failed (${reason}): ${err}\n`)
       },
+      // Share the one per-process pin-rights negative cache with the status-pin
+      // path and the stale-pin sweep (D5): the banner skips a chat already known
+      // rights-less and records/clears its own pin-verb discoveries there.
+      rightsCache: statusPinRightsCache,
       // Durable pin persistence into the SHARED status-pin store (distinct
       // `banner:` pinKey). persist-BEFORE-pin ordering: pending() lands before
       // the pinChatMessage call so a crash in that window is recoverable by the
@@ -17908,16 +17834,10 @@ const litellmLocalNoticeRunner = createLitellmLocalNoticeRunner({
  */
 let fallbackFailureNoticeState: FallbackFailureNoticeState = { lastSentAtMs: 0 }
 
-/**
- * Bug 2 — per-gateway cooldown for the "All accounts blocked" card. The
- * all-blocked outcome is a no-op swap (doFireFleetAutoFallback returns false),
- * so the fleetFallbackGate dedup window never arms for it, and the ~60s
- * quota_wall_detected re-trigger would otherwise re-broadcast the identical card
- * every minute for the life of the wall. This bounds it to one card per window.
- * Reset on a successful swap so a fresh all-blocked after a recovery (a real new
- * transition) is not stale-suppressed.
- */
-let fallbackAllBlockedNoticeState: FallbackAllBlockedNoticeState = { lastSentAtMs: 0 }
+// Per-gateway cooldown gates for the two NO-OP fleet-fallback outcomes
+// (all-blocked and strict-pinned) live in ./fleet-fallback-notice-cooldown.ts,
+// which owns their state and stderr suppress-logs (switchroom#4442, extracted to
+// keep the inline notice logic out of the line-ratchet-guarded gateway.ts).
 
 function broadcastFleetFallbackFailure(triggerAgent: string, reason: string): void {
   if (process.env.SWITCHROOM_FLEET_FALLBACK_FAILURE_NOTICE === '0') return
@@ -18167,7 +18087,11 @@ async function doFireFleetAutoFallback(
         // weekly-capped account is never re-probed (and re-wedged) within the
         // broker's ~5h default.
         const r = await client.markExhausted(untilMs)
-        return { rolledTo: r.rolledTo ?? null, rolled: r.rolled }
+        return {
+          rolledTo: r.rolledTo ?? null,
+          rolled: r.rolled,
+          callerPinnedStrict: r.caller_pinned_strict ?? false,
+        }
       },
       triggerAgent,
       tz,
@@ -18193,7 +18117,11 @@ async function doFireFleetAutoFallback(
     // cooldown; a successful swap resets the window so a later (genuinely new)
     // all-blocked still emits promptly.
     if (outcome.kind === 'switched') {
-      fallbackAllBlockedNoticeState = { lastSentAtMs: 0 }
+      resetFleetFallbackNoticeCooldowns()
+    } else if (outcome.kind === 'strict-pinned') {
+      // Same cooldown pattern as all-blocked (below): a no-op outcome the
+      // ~60s wall re-trigger would otherwise re-broadcast every minute.
+      if (!shouldSendStrictPinnedNotice(triggerAgent)) return false
     } else if (outcome.kind === 'all-blocked') {
       // ── Second recovery tier: MODEL-TIER downgrade (precedence A) ──────────
       // Account-swap just came back all-blocked (no account still serves the
@@ -18210,14 +18138,7 @@ async function doFireFleetAutoFallback(
         // card — a restart is coming that replays the interrupted turn.
         return false
       }
-      const verdict = evaluateAllBlockedNotice(fallbackAllBlockedNoticeState, Date.now())
-      if (!verdict.send) {
-        process.stderr.write(
-          `telegram gateway: [fleet-fallback] all-blocked card suppressed (cooldown) agent=${triggerAgent}\n`,
-        )
-        return false
-      }
-      fallbackAllBlockedNoticeState = verdict.next
+      if (!shouldSendAllBlockedNotice(triggerAgent)) return false
     }
     // Post the announcement to every authorized chat. Mirrors the
     // operator-event broadcast pattern (line ~2290) — DM-only opts
@@ -19849,6 +19770,22 @@ bot.command('compact', async ctx => {
 })
 bot.command('clear', async ctx => {
   await handleInjectCommand(ctx, buildInjectDeps({ open: true, fixedVerb: '/clear' }))
+  // A /clear starts a new logical session → reset privacy to public.
+  const clearChatId = String(ctx.chat!.id)
+  resetPrivacyForNewSession(clearChatId, resolveThreadId(clearChatId, ctx.message?.message_thread_id))
+})
+// Per-operator session privacy controls. NOT admin verbs (deliberately kept
+// out of ADMIN_COMMAND_NAMES) — they gate memory writing for THIS session, so
+// they share the plain per-command isAuthorizedSender gate like inject/clear.
+bot.command('private', async ctx => {
+  if (!isAuthorizedSender(ctx)) return
+  openPrivateInterval()
+  await switchroomReply(ctx, PRIVATE_ON_REPLY)
+})
+bot.command('public', async ctx => {
+  if (!isAuthorizedSender(ctx)) return
+  closePrivateInterval()
+  await switchroomReply(ctx, PUBLIC_REPLY)
 })
 // /model and /effort extracted to bot-commands-model-effort.ts
 // (switchroom#2996 P6 bot.command drain). Helper registration keeps grammy
@@ -21749,6 +21686,15 @@ bot.on('callback_query:data', async ctx => {
     return
   }
 
+  // RFC amendment §"corrections as eval cases": one-tap eval-case card.
+  //   evcase:approve:<id> — run the DETERMINISTIC apply-eval-case applier
+  //                         (byte-exact write; NOT a model turn)
+  //   evcase:deny:<id>    — dismiss + mark the proposal rejected
+  if (data.startsWith('evcase:')) {
+    await callbackQueryHandlers.handleEvalCaseProposalCallback(ctx, data)
+    return
+  }
+
   // #2862: missed-approvals re-offer digest.
   //   missre:retry:<id>   — inject a synthetic inbound asking the agent to
   //                         re-attempt (re-raises a fresh approval card)
@@ -23527,6 +23473,8 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
             // Only when we KNOW it was a /model switch (reason) AND we will send the
             // confirmation (marker chat captured); otherwise the boot card fires
             // normally. Version/quota remain available via /status.
+            // Privacy: genuine FRESH boot (cold/crash/planned/model-switch) → reset to public, reusing boot-card's chat. Suppressed on a --continue/auto transcript-restore (state must persist) and never wired to bridge-reconnect.
+            if (target && !isContinueRestoreBoot(resolveAgentDirFromEnv())) resetPrivacyForNewSession(target.chatId, target.threadId)
             const suppressBootCardForModelSwitch =
               modelSwitchReason != null && modelSwitchMarkerChat != null
             if (target && suppressBootCardForModelSwitch) {
@@ -23879,6 +23827,14 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
               const raw = Number(process.env.SWITCHROOM_TG_WORKER_FEED_MAX_ROWS)
               return Number.isInteger(raw) && raw > 0 ? raw : undefined
             })()
+            // First-paint hold for a prose-silent sub-agent card. Unset /
+            // non-positive → the feed's built-in default (4000ms). Operator
+            // override (SWITCHROOM_TG_WORKER_FEED_FIRST_PAINT_MS) lets first
+            // paint be retuned/reverted (e.g. back to 8000) without a redeploy.
+            const workerFeedFirstPaintMs = (() => {
+              const raw = Number(process.env.SWITCHROOM_TG_WORKER_FEED_FIRST_PAINT_MS)
+              return Number.isInteger(raw) && raw > 0 ? raw : undefined
+            })()
             // Model A — foreground sub-agent nesting in the parent's live
             // activity draft. ON by default; this edits the SAME activity-
             // summary message the tool_label feed already owns (not the
@@ -23952,6 +23908,10 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
               // channels.telegram.worker_feed.max_rows via the config cascade
               // (scaffold emits SWITCHROOM_TG_WORKER_FEED_MAX_ROWS); unset → 8.
               maxRows: workerFeedMaxRows,
+              // First-paint hold for a prose-silent worker's initial card.
+              // Unset → the feed's built-in default (4000ms); the operator
+              // override SWITCHROOM_TG_WORKER_FEED_FIRST_PAINT_MS retunes it.
+              firstPaintMinMs: workerFeedFirstPaintMs,
               // Backstop TTL for the feed's stale-row reaper, DERIVED in code
               // from the watcher's effective in-flight terminal cap (same env /
               // default the watcher itself resolves) plus a margin — NOT a

package/telegram-plugin/gateway/ipc-protocol.ts

@@ -573,6 +573,48 @@ export interface PostSkillProposalMessage {
   evidence: string;
   /** Full drafted skill bundle (SKILL.md + optional files). */
   draft: Record<string, string>;
+  /**
+   * Provenance of the proposal — `"skill-synthesis"` (the weekly cron) or
+   * `"failure-synthesis"` (a skill drafted from an observed failure). Absent
+   * ⇒ the store defaults it to `"skill-synthesis"` (back-compat). Provenance
+   * is orthogonal to tier routing.
+   */
+  origin?: "skill-synthesis" | "failure-synthesis";
+}
+
+/**
+ * `switchroom self-improve add-eval-case` asks the caller agent's gateway to
+ * persist an eval-case proposal and post a one-tap Approve/Dismiss card (RFC
+ * amendment §"corrections as eval cases"). Unlike a skill proposal, the
+ * Approve tap does NOT inject a model turn — the gateway runs the
+ * DETERMINISTIC `apply-eval-case` applier so the case lands byte-exact.
+ *
+ * Trust model identical to post_skill_proposal: per-agent socket, agentName
+ * validated, chat fenced to the agent's own chat.
+ */
+export interface PostEvalCaseProposalMessage {
+  type: "post_eval_case_proposal";
+  agentName: string;
+  /** Agent's own chat id (fenced server-side). */
+  chatId: string;
+  threadId?: number;
+  /** Target skill slug. */
+  skillSlug: string;
+  /** Absolute path to the owned skill bundle dir (resolved by the CLI). */
+  skillDir: string;
+  /** The eval case to append (prompt + optional expected/expectations/etc). */
+  case: {
+    prompt: string;
+    expected_output?: string;
+    files?: string[];
+    expectations?: string[];
+    source?: string;
+    id?: string;
+  };
+  /** Prompt fingerprint (dedup + provenance). */
+  fingerprint: string;
+  /** Route the case to the held-out sink instead of evals.json. */
+  heldOut: boolean;
 }
 
 /**
@@ -766,6 +808,7 @@ export type ClientToGateway =
   | QuotaWallDetectedMessage
   | SendOutboundMessage
   | PostSkillProposalMessage
+  | PostEvalCaseProposalMessage
   | RolloutStatusPostMessage
   | RolloutStatusEditMessage
   | QueryPendingPermissionMessage

package/telegram-plugin/gateway/ipc-server.ts

@@ -9,6 +9,7 @@ import type {
   QueryPendingPermissionMessage,
   CheckPreApprovedMessage,
   PostSkillProposalMessage,
+  PostEvalCaseProposalMessage,
   OperatorEventForward,
   PermissionRequestForward,
   PtyPartialForward,
@@ -101,6 +102,12 @@ export interface IpcServerOptions {
    * chat. Optional; gateways that don't surface proposals ignore it.
    */
   onPostSkillProposal?: (client: IpcClient, msg: PostSkillProposalMessage) => void;
+  /**
+   * RFC amendment §"corrections as eval cases" — `add-eval-case` asks the
+   * gateway to persist an eval-case proposal and post its one-tap card.
+   * Optional; gateways that don't surface proposals ignore it.
+   */
+  onPostEvalCaseProposal?: (client: IpcClient, msg: PostEvalCaseProposalMessage) => void;
   /**
    * RFC E §4.2 Cut 2 — Drive-write PreToolUse hook asks the gateway
    * to register a kernel approval request + post a diff-preview
@@ -379,6 +386,23 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
         && (typeof m.threadId !== "number" || !Number.isInteger(m.threadId as number))) return false;
       return true;
     }
+    case "post_eval_case_proposal": {
+      // RFC amendment §"corrections as eval cases" — validate the wire shape;
+      // the gateway handler fences chatId to the agent's own chat.
+      if (typeof m.agentName !== "string"
+        || !AGENT_NAME_RE.test(m.agentName as string)) return false;
+      if (typeof m.chatId !== "string" || (m.chatId as string).length === 0) return false;
+      if (typeof m.skillSlug !== "string" || (m.skillSlug as string).length === 0) return false;
+      if (typeof m.skillDir !== "string" || (m.skillDir as string).length === 0) return false;
+      if (typeof m.fingerprint !== "string" || (m.fingerprint as string).length === 0) return false;
+      if (typeof m.heldOut !== "boolean") return false;
+      if (typeof m.case !== "object" || m.case === null || Array.isArray(m.case)) return false;
+      if (typeof (m.case as Record<string, unknown>).prompt !== "string"
+        || ((m.case as Record<string, unknown>).prompt as string).length === 0) return false;
+      if (m.threadId !== undefined
+        && (typeof m.threadId !== "number" || !Number.isInteger(m.threadId as number))) return false;
+      return true;
+    }
     case "quota_wall_detected": {
       // wedge-watchdog detected the /rate-limit-options weekly-quota menu.
       if (typeof m.agentName !== "string"
@@ -565,6 +589,7 @@ export function createIpcServer(options: IpcServerOptions): IpcServer {
     onQueryPendingPermission,
     onCheckPreApproved,
     onPostSkillProposal,
+    onPostEvalCaseProposal,
     onRequestDriveApproval,
     onRequestMs365Approval,
     onRequestConfigApproval,
@@ -733,6 +758,9 @@ export function createIpcServer(options: IpcServerOptions): IpcServer {
       case "post_skill_proposal":
         if (onPostSkillProposal) onPostSkillProposal(client, msg as PostSkillProposalMessage);
         break;
+      case "post_eval_case_proposal":
+        if (onPostEvalCaseProposal) onPostEvalCaseProposal(client, msg as PostEvalCaseProposalMessage);
+        break;
       case "quota_wall_detected":
         if (onQuotaWallDetected) onQuotaWallDetected(client, msg as QuotaWallDetectedMessage);
         break;

package/telegram-plugin/gateway/liveness-wiring.ts

@@ -21,6 +21,7 @@ import * as silencePoke from '../silence-poke.js'
 import * as signalTracker from '../turn-signal-tracker.js'
 import * as pendingProgress from '../pending-work-progress.js'
 import { emitRuntimeMetric } from '../runtime-metrics.js'
+import { computeTurnDurationMs } from './turn-record-status.js'
 import { logStreamingEvent } from '../streaming-metrics.js'
 import { clearSilentEndState } from '../silent-end.js'
 import { purgeStaleTurnsForChat } from './turn-state-purge.js'
@@ -377,7 +378,11 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
       turnMatchesFallback && wedgedTurn != null && turnLiveForItsTopic(wedgedTurn)
     const turnStartedAt = activeTurnStartedAt.get(fbKey)
     if (turnStartedAt != null) {
-      const turnDurationMs = Date.now() - turnStartedAt
+      // Guard shared with buildTurnRecord + the stream-render turn_ended paths:
+      // a 0 / bogus start must never emit `Date.now() - 0` (an absolute epoch
+      // value) as a duration. This path previously did a bare subtraction and
+      // poisoned the turn_ended dataset when `activeTurnStartedAt` held 0.
+      const turnDurationMs = computeTurnDurationMs(turnStartedAt, Date.now())
       const outboundMetrics = signalTracker.getOutboundMetrics(fbKey)
       emitRuntimeMetric({
         kind: 'turn_ended',

package/telegram-plugin/gateway/narrative-lane.ts

@@ -56,7 +56,7 @@ import {
   appendActivityLabel, clipNarrative, formatStepSuffix, renderActivityFeedWithNested,
 } from '../tool-activity-summary.js'
 import { evaluatePostAnswerLiveness } from '../turn-liveness-floor.js'
-import { isSilentSentinelCardOutcome } from '../turn-flush-safety.js'
+import { isHollowGhostCardOutcome, isSilentSentinelCardOutcome } from '../turn-flush-safety.js'
 import { clearActivityCardRecord, writeActivityCardRecord } from './activity-card-store.js'
 import { chatKeyWithSuffix } from './chat-key.js'
 import {
@@ -455,10 +455,18 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
             // stays in view when the feed scrolls past. Keyed to the same
             // status-key the canonical turn-end (purgeReactionTracking) unpins.
             // Fire-and-forget; the single-owner reconcile keeps state consistent.
+            // Pass `thread` as the 4th arg so the persisted row keeps the forum
+            // topic (D4): without it a forum-topic foreground card orphaned by a
+            // crash lands a threadId-less row, and the sweep cannot aim
+            // `unpinAllForumTopicMessages` at the right topic. Mirrors the worker
+            // feed's `reconcilePin` (gateway.ts). It does NOT change the pinKey —
+            // `statusKey(chat, thread)` already folds the topic into the key; the
+            // 4th arg only threads the topic into the claim + durable row.
             void reconcileStatusPin(
               `fg:${statusKey(chat, thread)}`,
               chat,
               { pinned: true, messageId: sent.message_id },
+              thread,
             )
           } else {
             const id = turn.activityMessageId
@@ -900,7 +908,30 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
         capturedText: turn.capturedText,
         finalAnswerEverDelivered: turn.finalAnswerEverDelivered,
       })
-      if (CLEAR_STATUS_ON_COMPLETION || silentSentinelTurn) {
+      // #45 — hollow-ghost suppression. The sibling to the #4348 sentinel gate:
+      // a turn that ended having done ZERO surfaced tool work, never called
+      // reply, delivered no final answer, surfaced NO narration, and emitted no
+      // captured/reply text adopted an activity card at turn start that never
+      // got any content — the contentless `🤖 Agent · done · 0 tools · Ns`
+      // record Ken reported (a card opened by the liveness timer that stayed
+      // empty). The sentinel gate can't catch it (there is no NO_REPLY/
+      // HEARTBEAT_OK text to match; the flush classifies it `empty-text`, not
+      // `silent-marker`), so DELETE the empty card here instead of finalizing
+      // it. Deterministic (pure predicate over already-tracked turn fields) and
+      // normal-case-safe: any surfaced tool step, any rendered narrative line
+      // (`mirrorLines` — content the user actually saw), any reply, any captured
+      // text, or a delivered answer keeps the card. The `finalHtmlOverride`
+      // finalize path is only taken by the foreground handoff-clear (which fires
+      // on a delivered final answer), so this gate never contends with it.
+      const hollowGhostTurn = isHollowGhostCardOutcome({
+        replyCalled: turn.replyCalled,
+        labeledToolCount: turn.labeledToolCount,
+        mirrorLines: turn.mirrorLines,
+        capturedText: turn.capturedText,
+        lastReplyText: turn.lastReplyText,
+        finalAnswerEverDelivered: turn.finalAnswerEverDelivered,
+      })
+      if (CLEAR_STATUS_ON_COMPLETION || silentSentinelTurn || hollowGhostTurn) {
         try {
           await robustApiCall(
             () => bot.api.deleteMessage(chat, id),