switchroom 0.20.11 → 0.20.13

package/telegram-plugin/dist/server.js

@@ -24962,18 +24962,6 @@ var init_bridge = __esm(async () => {
         required: ["chat_id"]
       }
     },
-    {
-      name: "pin_message",
-      description: "Pin a message in a Telegram chat. Useful for important outputs the user wants to find later. Requires admin rights in groups.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          chat_id: { type: "string" },
-          message_id: { type: "string" }
-        },
-        required: ["chat_id", "message_id"]
-      }
-    },
     {
       name: "delete_message",
       description: "Delete a message the bot previously sent. Prefer edit_message if you just want to update text \u2014 delete_message is for true removal.",

package/telegram-plugin/gateway/captured-answer-resume.ts

@@ -68,7 +68,7 @@
  * `deliver` (via `deliverAnswer`), the durable oracle, and the obligation I/O.
  */
 
-import { hasOutboundWithText } from '../history.js'
+import { hasOutboundWithText as realHasOutboundWithText } from '../history.js'
 import type { BackstopDeliveryLedger } from './backstop-delivery.js'
 import type { CapturedDeliverySnapshot, Obligation } from './obligation-ledger.js'
 
@@ -168,6 +168,27 @@ export interface CapturedResumePorts {
   /** True when history is queryable (else the durable-text oracle reconcile that
    *  gives crash-idempotency — §2.3/A5 — is skipped). */
   historyEnabled: boolean
+  /**
+   * The durable outbound-text oracle. Defaults to the real `history.js`
+   * implementation; tests inject a fake here instead of module-mocking
+   * `../history.js`. A `vi.mock('../history.js', ...)` looks file-scoped
+   * under vitest but is NOT under bun's vitest-compat layer (`bun test`
+   * maps `vi.mock` onto the PROCESS-GLOBAL `mock.module`, which retroactively
+   * rebinds every other file's import of the same specifier in the same
+   * `bun-test-run` sweep — see check-bun-module-mock-scope.mjs). That leak
+   * was the actual root cause of #4488/#4491: a mocked `hasOutboundWithText`
+   * from this module's own test file silently answered
+   * `telegram-plugin/tests/history.test.ts`'s calls to the REAL function
+   * elsewhere in the same 651-file sweep, so a row `history.test.ts` had
+   * genuinely just written was reported as not found. Injecting via this
+   * port keeps the fake scoped to the dispatcher instance that receives it.
+   */
+  hasOutboundWithText?: (
+    chatId: string,
+    text: string,
+    threadId: number | null,
+    sinceMs?: number,
+  ) => boolean
   stderr?: (s: string) => void
 }
 
@@ -198,6 +219,7 @@ export interface CapturedResumeDispatcher {
  */
 export function createCapturedResumeDispatcher(ports: CapturedResumePorts): CapturedResumeDispatcher {
   const stderr = ports.stderr ?? (() => {})
+  const hasOutboundWithText = ports.hasOutboundWithText ?? realHasOutboundWithText
   const inFlight = new Set<string>()
 
   /** Re-deliver the UNSENT tail of `o`'s captured answer, byte-identical,

package/telegram-plugin/gateway/gateway.ts

@@ -8370,8 +8370,7 @@ const statusPinClaims = new Map<string, StatusPinClaim>()
 // Rights-aware negative cache (#3024): chats where an auto status-pin attempt
 // failed with the permanent "not enough rights to manage pinned messages" 400.
 // Per-process only — a restart clears it so a later-granted pin right re-enables
-// auto-pin. The explicit `pin_message` MCP tool deliberately does NOT consult
-// this cache (it always attempts and surfaces the error to the agent).
+// auto-pin.
 const statusPinRightsCache = new PinRightsCache()
 
 // Durable snapshot of the pin claim set on the persistent per-agent volume
@@ -8466,21 +8465,16 @@ const BANNER_PIN_KEY = 'banner:owner'
 // run → no-op). The boot-cleanup gate below is widened to cover this.
 const bannerPinPersistEnabled = !STATIC
 
-// `pin_message` MCP-tool pin registration (#3001). Tool pins ride the same
-// shared status-pins.json store under `tool:<chatId>:<messageId>` keys, but
-// with a TTL row (`expiresAt`): a tool pin is a deliberate agent action with
-// no "work finished" event, so a restart does NOT reset it — boot cleanup
-// keeps unexpired tool rows and only unpins them once the TTL lapses (the
-// backstop against agent-pinned messages accumulating forever). Independent
-// of PIN_STATUS_WHILE_WORKING (it gates the auto status pin, not the tool).
+// LEGACY `tool:` pin drain (#3001; the `pin_message` MCP tool was retired in
+// #4452). No new `tool:<chatId>:<messageId>` rows are ever written now that the
+// tool is gone, but rows an earlier build persisted may still sit in the shared
+// status-pins.json with a TTL (`expiresAt`). This flag keeps the boot cleanup /
+// stale-pin sweep aware of those legacy rows so they are still expired and
+// drained correctly on upgrade — an unexpired legacy row is preserved across
+// boots (never reaped as if it were a work-scoped card), then unpinned once its
+// TTL lapses, exactly as before. Independent of PIN_STATUS_WHILE_WORKING.
+// Self-clears within one TTL window since nothing writes new tool rows.
 const toolPinPersistEnabled = !STATIC
-// 7 days: generous — an agent-pinned message the operator still cares about
-// after a week has usually been re-pinned or acted on; anything older is the
-// stale-pin long tail this issue exists to clear. Override for tuning.
-const TOOL_PIN_TTL_MS = (() => {
-  const v = Number(process.env.SWITCHROOM_TOOL_PIN_TTL_MS)
-  return Number.isFinite(v) && v > 0 ? v : 7 * 24 * 60 * 60_000
-})()
 
 // Persist (or drop) the slot-banner's pin row into the shared store. Routes
 // through mutateStatusPinRow: a read-modify-write for ONLY the banner:owner key,
@@ -8950,8 +8944,7 @@ async function reconcileStatusPin(
   // "not enough rights to manage pinned messages" 400 in a supergroup took the
   // whole gateway down (marko, 2026-07-01). Auto status-pin is cosmetic; it
   // must NEVER be able to crash the gateway. Any throw here is logged and
-  // absorbed. (The `pin_message` MCP tool still surfaces failures to the agent
-  // as a normal tool-error — that path is `executePinMessage`, not this one.)
+  // absorbed.
   try {
     // Serialize per pinKey (F2): reconcileStatusPinInner reads `prev` from the
     // in-memory claim map at its top, so overlapping same-key reconciles must
@@ -9926,6 +9919,7 @@ async function deliverCapturedProse(args: {
   text: string
   /** Turn elapsed for the honest "(waited Ns)" apology clause; optional. */
   turnDurationMs?: number; replyToolThrewThisTurn?: boolean // #4141: label prose recovered from a turn whose reply tool threw (see outbound-send-path.ts)
+  reviewOriginated?: boolean // #4490: review-turn provenance, threaded through to the SAME card-gate / title-framing rules (see outbound-send-path.ts)
 }): Promise<void> {
   // #2996 P2: body moved VERBATIM to outbound-send-path.ts (single tested
   // send module). Injects the ONE `outboundDedup` instance (Amendment 1/9).
@@ -11808,7 +11802,7 @@ if (isGatewayMain && !STATIC) {
  *  bridge from calling arbitrary functions by name. */
 const ALLOWED_TOOLS = new Set([
   'reply', 'progress_update', 'react', 'download_attachment',
-  'edit_message', 'send_typing', 'pin_message', 'delete_message',
+  'edit_message', 'send_typing', 'delete_message',
   'forward_message', 'get_recent_messages',
   'send_checklist', 'update_checklist',
   'ask_user',
@@ -11844,8 +11838,6 @@ async function executeToolCall(
       return executeEditMessage(args)
     case 'send_typing':
       return executeSendTyping(args)
-    case 'pin_message':
-      return executePinMessage(args)
     case 'delete_message':
       return executeDeleteMessage(args)
     case 'forward_message':
@@ -13195,44 +13187,6 @@ async function executeSendTyping(args: Record<string, unknown>): Promise<unknown
   return { content: [{ type: 'text', text: `${action} indicator sent (auto-refreshes every 4s, stops after 30s or next reply)` }] }
 }
 
-async function executePinMessage(args: Record<string, unknown>): Promise<unknown> {
-  if (!args.chat_id) throw new Error('pin_message: chat_id is required')
-  if (!args.message_id) throw new Error('pin_message: message_id is required')
-  const pinChatId = String(args.chat_id ?? '')
-  assertAllowedChat(pinChatId)
-  // #1075: wrap through robustApiCall so flood-wait / transient network
-  // errors are retried. THREAD_NOT_FOUND on a stale topic surfaces to the
-  // agent as a tool-error — pinning a vanished message is genuinely a
-  // failure the agent should see.
-  const pinMsgId = Number(args.message_id)
-  await robustApiCall(
-    () => lockedBot.api.pinChatMessage(pinChatId, pinMsgId), // allow-raw-pin: MCP `pin_message` tool — an explicit, agent-requested pin of an arbitrary message, not a progress surface with a claim.
-    { chat_id: pinChatId, verb: 'pin_message' },
-  )
-  // An explicit pin succeeded here, so the bot demonstrably HAS pin rights in
-  // this chat now — clear any auto-pin negative-cache entry (#3024) so the auto
-  // status-pin path resumes immediately rather than waiting for a restart. The
-  // explicit tool itself never consults the cache; a failure above still
-  // surfaces to the agent as a normal tool error (robustApiCall rethrows).
-  statusPinRightsCache.clear(pinChatId)
-  // #3001: register the tool pin in the shared status-pin store under a
-  // `tool:` key so it is no longer fire-and-forget. Unlike work-scoped
-  // fg:/wk: rows a tool pin has no "work finished" event, so a restart does
-  // NOT reset it — boot cleanup keeps the row until its TTL, then unpins the
-  // (likely long-forgotten) message. Best-effort fire-and-forget: a store
-  // failure must never fail the tool call the pin already landed for.
-  if (toolPinPersistEnabled) {
-    const toolPinKey = `tool:${pinChatId}:${pinMsgId}`
-    void mutateStatusPinRow(STATUS_PIN_STORE_PATH, statusPinStoreFs, toolPinKey, { // allow-raw-pin-store: records the TTL-scoped `tool:` row for the explicit pin above so the boot sweep can expire it.
-      pinKey: toolPinKey,
-      chatId: pinChatId,
-      messageId: pinMsgId,
-      expiresAt: Date.now() + TOOL_PIN_TTL_MS,
-    })
-  }
-  return { content: [{ type: 'text', text: `pinned message ${args.message_id}` }] }
-}
-
 async function executeDeleteMessage(args: Record<string, unknown>): Promise<unknown> {
   if (!args.chat_id) throw new Error('delete_message: chat_id is required')
   if (!args.message_id) throw new Error('delete_message: message_id is required')
@@ -23874,6 +23828,14 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
               const raw = Number(process.env.SWITCHROOM_TG_WORKER_FEED_MAX_ROWS)
               return Number.isInteger(raw) && raw > 0 ? raw : undefined
             })()
+            // First-paint hold for a prose-silent sub-agent card. Unset /
+            // non-positive → the feed's built-in default (4000ms). Operator
+            // override (SWITCHROOM_TG_WORKER_FEED_FIRST_PAINT_MS) lets first
+            // paint be retuned/reverted (e.g. back to 8000) without a redeploy.
+            const workerFeedFirstPaintMs = (() => {
+              const raw = Number(process.env.SWITCHROOM_TG_WORKER_FEED_FIRST_PAINT_MS)
+              return Number.isInteger(raw) && raw > 0 ? raw : undefined
+            })()
             // Model A — foreground sub-agent nesting in the parent's live
             // activity draft. ON by default; this edits the SAME activity-
             // summary message the tool_label feed already owns (not the
@@ -23947,6 +23909,10 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
               // channels.telegram.worker_feed.max_rows via the config cascade
               // (scaffold emits SWITCHROOM_TG_WORKER_FEED_MAX_ROWS); unset → 8.
               maxRows: workerFeedMaxRows,
+              // First-paint hold for a prose-silent worker's initial card.
+              // Unset → the feed's built-in default (4000ms); the operator
+              // override SWITCHROOM_TG_WORKER_FEED_FIRST_PAINT_MS retunes it.
+              firstPaintMinMs: workerFeedFirstPaintMs,
               // Backstop TTL for the feed's stale-row reaper, DERIVED in code
               // from the watcher's effective in-flight terminal cap (same env /
               // default the watcher itself resolves) plus a margin — NOT a

package/telegram-plugin/gateway/liveness-wiring.ts

@@ -21,6 +21,7 @@ import * as silencePoke from '../silence-poke.js'
 import * as signalTracker from '../turn-signal-tracker.js'
 import * as pendingProgress from '../pending-work-progress.js'
 import { emitRuntimeMetric } from '../runtime-metrics.js'
+import { computeTurnDurationMs } from './turn-record-status.js'
 import { logStreamingEvent } from '../streaming-metrics.js'
 import { clearSilentEndState } from '../silent-end.js'
 import { purgeStaleTurnsForChat } from './turn-state-purge.js'
@@ -377,7 +378,11 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
       turnMatchesFallback && wedgedTurn != null && turnLiveForItsTopic(wedgedTurn)
     const turnStartedAt = activeTurnStartedAt.get(fbKey)
     if (turnStartedAt != null) {
-      const turnDurationMs = Date.now() - turnStartedAt
+      // Guard shared with buildTurnRecord + the stream-render turn_ended paths:
+      // a 0 / bogus start must never emit `Date.now() - 0` (an absolute epoch
+      // value) as a duration. This path previously did a bare subtraction and
+      // poisoned the turn_ended dataset when `activeTurnStartedAt` held 0.
+      const turnDurationMs = computeTurnDurationMs(turnStartedAt, Date.now())
       const outboundMetrics = signalTracker.getOutboundMetrics(fbKey)
       emitRuntimeMetric({
         kind: 'turn_ended',

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -62,10 +62,27 @@ import { journalExternalDelivery } from './outbox-sweep.js'
 import { sha256Hex } from '../outbox.js'
 // #4141: the ONE shared framing implementation, also used by the outbox sweep
 // and (for the classifier half) the unbundled Stop hooks.
+//
+// #4490: previously this import only pulled the reply-throw half. The
+// captured-prose bridge below is the ELECTED path's deliverer — it never
+// writes an outbox record, so without the audience gate / self-improvement
+// framing wired in here too, a review-turn's raw, unlabelled reasoning could
+// reach the operator whenever the single-writer election (in
+// `silent-end-interrupt-stop.mjs`) routes a 'trailing-text-after-reply' case
+// here instead of to the outbox sweep. Wiring the SAME shared predicates in
+// both places (rather than re-deriving a third, parallel implementation)
+// restores the #4141-style symmetry #4485 left one-sided.
 import {
   applyReplyThrowFraming,
   formatReplyThrowFraming,
   shouldFrameReplyThrow,
+  decideCaptureAudience,
+  isSelfImprovementCard,
+  shouldFrameSelfImprovement,
+  applySelfImprovementFraming,
+  formatSelfImprovementFraming,
+  formatInternalSuppression,
+  AUDIENCE_INTERNAL,
 } from '../hooks/audience-classify.mjs'
 import { queueFloodBlockedReply } from './flood-reply-queue.js'
 import { resolveChatIdFallback } from './chat-id-fallback.js'
@@ -2737,6 +2754,17 @@ export async function deliverCapturedProse(
    * record, so the sweep's framing can never reach the message.
    */
   replyToolThrewThisTurn?: boolean
+  /**
+   * #4490 — this turn originated from a self-improvement review inbound
+   * (`source="self_improve_review"`). Stamped by the Stop hook's
+   * single-writer election onto the `SilentEndState` file (the ONLY way this
+   * path — which never writes an outbox record — can learn a review turn's
+   * provenance) and threaded through `decideCapturedProseDelivery`. Gates the
+   * SAME audience-suppression / title-framing rules the outbox sweep applies
+   * to a review record, restoring the #4141-style symmetry #4485 left
+   * one-sided (card gate + title framing applied at the sweep only).
+   */
+  reviewOriginated?: boolean
   },
 ): Promise<void> {
   const {
@@ -2758,14 +2786,69 @@ export async function deliverCapturedProse(
     { replyToolThrewThisTurn: args.replyToolThrewThisTurn },
     { frameEnabled: process.env.SWITCHROOM_TG_OUTBOX_PROVENANCE_FRAMING !== '0' },
   )
-  // #3228 Finding 1 — the three settlement points (sent / skipped-dedup /
-  // failed) all funnel through the pure `settleCapturedProseDelivery` core so
-  // the failure posture is deterministic and unit-tested. `outcome` is set on
-  // each branch and applied ONCE at the bottom.
+  // #4490 — CARD GATE, primary: same two-layer design the outbox sweep uses
+  // (`audience-classify.mjs`'s module doc). `decideCaptureAudience` checks
+  // `reviewOriginated` independent of the reply-throw path above: a review
+  // turn's prose classifies `internal` UNLESS the text itself is the one
+  // sanctioned card (`isSelfImprovementCard`), in which case it's `user` and
+  // delivered normally. A non-review turn's `reviewOriginated` is `false`/
+  // `undefined`, which never enters this branch — so this can only ever
+  // ADD suppression to a review turn, never touch a normal answer.
+  const audienceGateEnabled = process.env.SWITCHROOM_TG_OUTBOX_AUDIENCE_GATE !== '0'
+  const audience = decideCaptureAudience({
+    reviewOriginated: args.reviewOriginated === true,
+    reviewTextIsCard: isSelfImprovementCard(text),
+  })
+  const suppressed = audienceGateEnabled && audience === AUDIENCE_INTERNAL
+  // #4490 — TITLE FRAMING, residual belt-and-braces: applied OUTERMOST, after
+  // the reply-throw banner, exactly mirroring `decideOutboxSweep`'s ordering
+  // (`outbox.ts`). Only reachable when the card gate is disabled (or a
+  // legacy/`user`-audience route) — a review record that IS delivered here
+  // must still carry the title so it can never appear as raw, unlabelled
+  // agent reasoning even in a degraded config. `!isSelfImprovementCard(text)`
+  // keeps this idempotent against a text that already opens with the title
+  // (#4489's fix, same discipline).
+  const selfImproveFramed =
+    !suppressed &&
+    shouldFrameSelfImprovement(
+      { reviewOriginated: args.reviewOriginated },
+      { frameEnabled: process.env.SWITCHROOM_TG_OUTBOX_SELF_IMPROVE_FRAMING !== '0' },
+    ) &&
+    !isSelfImprovementCard(text)
+  // #3228 Finding 1 — the settlement points (sent / skipped-dedup / failed /
+  // suppressed-internal) all funnel through the pure
+  // `settleCapturedProseDelivery` core so the failure posture is
+  // deterministic and unit-tested. `outcome` is set on each branch and
+  // applied ONCE at the bottom.
   let outcome: CapturedProseSendOutcome
+  if (suppressed) {
+    // #4490 — the gap this closes: previously this path had NO audience gate
+    // at all, so a non-card review turn's raw reasoning would be sent below
+    // exactly like any other captured prose. Suppress before the dedup check
+    // and before any send attempt — nothing is delivered, so there is nothing
+    // to dedup against.
+    journalExternalDelivery({
+      turnNonce: originTurnId,
+      text,
+      replyAlreadyDeliveredThisTurn: false,
+      audience,
+      suppressedAudience: AUDIENCE_INTERNAL,
+    })
+    process.stderr.write(
+      formatInternalSuppression({
+        turnNonce: originTurnId,
+        turnId: originTurnId,
+        chatId,
+        textSha256: sha256Hex(text),
+        source: 'captured-prose-bridge',
+      }),
+    )
+    outcome = 'suppressed-internal'
+  } else {
   const already = outboundDedup.check(chatId, threadId, text, now, registryKey)
   if (already == null) {
     let out = normalizeParagraphBreaks(repairEscapedWhitespace(framed ? applyReplyThrowFraming(text) : text))
+    out = selfImproveFramed ? applySelfImprovementFraming(out) : out
     out = redactOutboundText(out, 'captured_prose')
     const chunks = splitMarkdownChunks(out, RICH_MESSAGE_MAX_CHARS)
     const sentIds: number[] = []
@@ -2821,6 +2904,14 @@ export async function deliverCapturedProse(
         // `DeliveredEntry.framedProvenance`, so "was this labelled?" is
         // answerable from the journal alone, hours later.
         ...(framed ? { framedProvenance: 'reply-throw' as const } : {}),
+        // #4490 durable terminal stamp — parity with the sweep's
+        // `DeliveredEntry.framedSelfImprovement`.
+        ...(selfImproveFramed ? { framedSelfImprovement: 'self-improve' as const } : {}),
+        // #4490 — stamp the audience decision on every journal line from this
+        // site, not only the suppressed one, so "what audience did this
+        // classify as" is answerable from the journal alone even for a
+        // successful send (parity with the outbox sweep's journal rows).
+        audience,
       })
       process.stderr.write(
         `telegram gateway: captured-prose delivery — sent ${out.length} chars recovered from ` +
@@ -2837,6 +2928,17 @@ export async function deliverCapturedProse(
           }),
         )
       }
+      if (selfImproveFramed) {
+        process.stderr.write(
+          formatSelfImprovementFraming({
+            turnNonce: originTurnId,
+            turnId: originTurnId,
+            chatId,
+            textSha256: sha256Hex(text),
+            source: 'captured-prose-bridge',
+          }),
+        )
+      }
       outcome = 'sent'
     } catch (err) {
       // #3228 Finding 1 — the send threw, so the answer did NOT reach the user.
@@ -2861,9 +2963,12 @@ export async function deliverCapturedProse(
     )
     outcome = 'skipped-dedup'
   }
+  }
   // Apply the settlement bookkeeping through the pure core (#3228 Finding 1):
-  //   sent / skipped-dedup → close obligation + clear state (answer is with the
-  //                          user, so represent + exhausted fallback must not fire)
+  //   sent / skipped-dedup / suppressed-internal → close obligation + clear
+  //                          state (either the answer is with the user, or it
+  //                          was never meant to reach them — either way the
+  //                          represent + exhausted fallback must not fire).
   //   failed               → arm the Stop-hook re-prompt net (recordUndelivered),
   //                          do NOT close/clear.
   const settlement = settleCapturedProseDelivery(outcome, {

package/telegram-plugin/gateway/outbox-sweep.ts

@@ -47,8 +47,10 @@ import {
   AUDIENCE_INTERNAL,
   formatInternalSuppression,
   formatReplyThrowFraming,
+  formatSelfImprovementFraming,
   resolveRecordAudience,
   shouldSuppressForAudience,
+  type Audience,
 } from '../hooks/audience-classify.mjs'
 import { isShownBlock } from '../shown-ledger.js'
 import { richMessage, isParseEntitiesError } from '../rich-send.js'
@@ -162,6 +164,19 @@ export interface OutboxSweepDeps {
    * Defaults to `log`.
    */
   logProvenanceFraming?: (line: string) => void
+  /**
+   * Ken 2026-08-07 kill switch for the self-improvement title header. Defaults
+   * to `SWITCHROOM_TG_OUTBOX_SELF_IMPROVE_FRAMING !== '0'` (ON). Same
+   * injected-seam reasoning as {@link provenanceFramingEnabled}: a module-scope
+   * env read would be captured at import and a revert-check could not run.
+   */
+  selfImprovementFramingEnabled?: () => boolean
+  /**
+   * Ken 2026-08-07 telemetry sink for a self-improvement-framed delivery.
+   * Separate from {@link logProvenanceFraming} so the two framings are greppable
+   * apart. Defaults to `log`.
+   */
+  logSelfImprovementFraming?: (line: string) => void
 }
 
 export interface OutboxSweepSummary {
@@ -190,6 +205,12 @@ export interface OutboxSweepSummary {
    * delivery, not a skip.
    */
   provenanceFramed?: number
+  /**
+   * Ken 2026-08-07: deliveries this sweep that carried the self-improvement
+   * title header. These ARE counted in `delivered` — framing is a delivery, not
+   * a skip.
+   */
+  selfImprovementFramed?: number
 }
 
 /**
@@ -246,6 +267,9 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
   const provenanceFramingEnabled = deps.provenanceFramingEnabled?.() ??
     process.env.SWITCHROOM_TG_OUTBOX_PROVENANCE_FRAMING !== '0'
   const logProvenanceFraming = deps.logProvenanceFraming ?? log
+  const selfImprovementFramingEnabled = deps.selfImprovementFramingEnabled?.() ??
+    process.env.SWITCHROOM_TG_OUTBOX_SELF_IMPROVE_FRAMING !== '0'
+  const logSelfImprovementFraming = deps.logSelfImprovementFraming ?? log
 
   for (const record of records) {
     summary.scanned++
@@ -341,6 +365,11 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
       // exists to prevent. So we state the provenance instead, and the human
       // (who can tell the difference, unlike any classifier here) decides.
       provenanceFraming: provenanceFramingEnabled,
+      // Ken 2026-08-07: label any review-originated record that reaches delivery
+      // (the audience gate's default suppression already withheld it above; this
+      // covers the gate-off / `user`-route residual) with the self-improvement
+      // title, so review reasoning can never appear as raw, unlabelled prose.
+      selfImprovementFraming: selfImprovementFramingEnabled,
     })
 
     if (decision.action !== 'send' && decision.action !== 'send-delayed') {
@@ -423,6 +452,11 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
           ...(decision.framedProvenance != null
             ? { framedProvenance: decision.framedProvenance }
             : {}),
+          // Ken 2026-08-07: durable terminal stamp for a self-improvement-framed
+          // delivery — same reasoning as `framedProvenance`.
+          ...(decision.framedSelfImprovement != null
+            ? { framedSelfImprovement: decision.framedSelfImprovement }
+            : {}),
         },
         deps.stateDir,
       )
@@ -438,6 +472,18 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
           }),
         )
       }
+      if (decision.framedSelfImprovement != null) {
+        summary.selfImprovementFramed = (summary.selfImprovementFramed ?? 0) + 1
+        logSelfImprovementFraming(
+          formatSelfImprovementFraming({
+            turnNonce: record.turnNonce,
+            turnId: turnIdFromNonce(record.turnNonce),
+            chatId: resolvedChat.chatId,
+            textSha256: record.textSha256,
+            source: record.source,
+          }),
+        )
+      }
       // Persist parity (mirrors outbound-send-path.ts + backstop-delivery.ts):
       // record the delivered chunk ids + texts to history so a net-delivered
       // answer is not silently absent from history.db. Best-effort — a missing
@@ -980,6 +1026,26 @@ export function journalExternalDelivery(
      * bridge), hours later.
      */
     framedProvenance?: 'reply-throw'
+    /**
+     * #4490: the record's audience, carried onto the journal line — parity
+     * with the sweep's own `DeliveredEntry.audience`. Lets the captured-prose
+     * bridge (`outbound-send-path.ts`), the OTHER delivery machine, journal
+     * through this ONE shared function instead of a second, hand-rolled
+     * `appendDelivered` call.
+     */
+    audience?: Audience
+    /**
+     * #4490: this journal line is a TERMINAL SUPPRESSION (the audience gate
+     * withheld an `'internal'` record), not a delivery — mirrors
+     * `DeliveredEntry.suppressedAudience`.
+     */
+    suppressedAudience?: Audience
+    /**
+     * #4490: this delivery carried the self-improvement title framing —
+     * mirrors `DeliveredEntry.framedSelfImprovement`, applied on either
+     * delivery path.
+     */
+    framedSelfImprovement?: 'self-improve'
   },
   stateDir?: string,
   now: number = Date.now(),
@@ -1000,6 +1066,9 @@ export function journalExternalDelivery(
         ? {}
         : { replyAlreadyDeliveredThisTurn: args.replyAlreadyDeliveredThisTurn }),
       ...(args.framedProvenance == null ? {} : { framedProvenance: args.framedProvenance }),
+      ...(args.audience == null ? {} : { audience: args.audience }),
+      ...(args.suppressedAudience == null ? {} : { suppressedAudience: args.suppressedAudience }),
+      ...(args.framedSelfImprovement == null ? {} : { framedSelfImprovement: args.framedSelfImprovement }),
     },
     stateDir,
   )

package/telegram-plugin/gateway/stale-pin-sweep.ts

@@ -352,9 +352,10 @@ export function collectSweepTargets(input: {
 
 /**
  * The messageIds in `chatId` that must SURVIVE a drain because they belong to
- * deliberately-retained store rows: unexpired time-scoped `tool:` pins (the
- * `pin_message` MCP tool, #3001), which `runStatusPinBootCleanup` intentionally
- * KEEPS across restarts. Work-scoped rows (no `expiresAt`) are stale by
+ * deliberately-retained store rows: unexpired time-scoped `tool:` pins (legacy
+ * rows from the retired `pin_message` MCP tool, #3001 / #4452 — no new ones are
+ * written), which `runStatusPinBootCleanup` intentionally KEEPS across restarts
+ * until they expire. Work-scoped rows (no `expiresAt`) are stale by
  * definition after a restart and are NOT re-pin candidates; expired
  * time-scoped rows are due for sweeping.
  */

package/telegram-plugin/gateway/status-pin-store.ts

@@ -17,7 +17,8 @@
  * — the turn it represented is over or crashed), dropping rows only after a
  * successful unpin (failed ones are retained with an attempt counter for a
  * next-boot retry — see runStatusPinBootCleanup). Time-scoped `tool:` rows
- * (the `pin_message` MCP tool, #3001) survive boots until their `expiresAt`.
+ * (legacy pins from the retired `pin_message` MCP tool, #3001 / #4452 — no new
+ * ones are written) survive boots until their `expiresAt`.
  * It does NOT re-adopt or re-pin — it only cleans up.
  *
  * Shape choice — SNAPSHOT, not append-log, mirroring obligation-store.ts. The
@@ -78,10 +79,10 @@ export interface PersistedStatusPin {
   /** Wall-clock ms after which this pin is stale and boot cleanup unpins it.
    *  Rows WITHOUT this field are work-scoped (fg:/wk:/banner:) — stale the
    *  moment their owning session dies, so boot cleanup unpins them
-   *  unconditionally. Rows WITH it (the `tool:` pins written by the
-   *  `pin_message` MCP tool, #3001) represent deliberate agent pins that have
-   *  no "work finished" event: they SURVIVE restarts and are only swept once
-   *  expired. */
+   *  unconditionally. Rows WITH it (legacy `tool:` pins from the retired
+   *  `pin_message` MCP tool, #3001 / #4452 — no new ones are written)
+   *  represented deliberate agent pins with no "work finished" event: they
+   *  SURVIVE restarts and are only swept once expired. */
   expiresAt?: number
   /** Boot-cleanup unpin retry counter (#3001). Incremented each boot the
    *  unpin fails (flood-wait exhausted / transient 5xx); the row is retained
@@ -282,10 +283,10 @@ export function pinnedMessageIsOurs(
  * record whose pin MAY have landed in Telegram, so we must treat it exactly
  * like a confirmed one and unpin it.
  *
- * TIME-SCOPED rows (`tool:` pins from the `pin_message` MCP tool, carrying
- * `expiresAt`) have no "work finished" event, so a restart does NOT reset
- * them: an unexpired row is RETAINED untouched across boots and only unpinned
- * once `now >= expiresAt`.
+ * TIME-SCOPED rows (legacy `tool:` pins from the retired `pin_message` MCP
+ * tool, #4452, carrying `expiresAt`) have no "work finished" event, so a
+ * restart does NOT reset them: an unexpired row is RETAINED untouched across
+ * boots and only unpinned once `now >= expiresAt`.
  *
  * RETRY-SAFETY (#3001): a row is dropped only AFTER its unpin resolves. A
  * failing unpin (flood-wait exhausted / transient 5xx) retains the row with an

package/telegram-plugin/gateway/stream-render.ts

@@ -90,7 +90,7 @@ import { formatTurnLifecycle } from './status-surface-log.js'
 import { removeTurnActiveMarker, touchTurnActiveMarker, writeTurnActiveMarker } from './turn-active-marker.js'
 import { withTurnEndGateBackstop } from './turn-end-gate-backstop.js'
 import { decideTurnEndGate } from './turn-end-gate.js'
-import { finalizeBackstopSendGated } from './turn-record-status.js'
+import { finalizeBackstopSendGated, computeTurnDurationMs } from './turn-record-status.js'
 import type { SilentEndDeps } from '../silent-end.js'
 import type { ChatKey as _ChatKey } from './inbound-delivery-machine.js'
 import type { SessionEvent } from '../session-tail.js'
@@ -2174,7 +2174,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
             chatId,
             threadId,
             turnId: turn.turnId,
-            turnDurationMs: turn.startedAt > 0 ? Date.now() - turn.startedAt : 0,
+            turnDurationMs: computeTurnDurationMs(turn.startedAt, Date.now()),
             reactionCount: reactionTransitionCounts.get(tKey) ?? 0,
           })
         }
@@ -2214,7 +2214,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
         // still appear in turn-duration graphs.
         {
           const sKey = streamKey(chatId, threadId)
-          const turnDurationMs = turn.startedAt > 0 ? Date.now() - turn.startedAt : 0
+          const turnDurationMs = computeTurnDurationMs(turn.startedAt, Date.now())
           logStreamingEvent({
             kind: 'turn_end',
             chatId,
@@ -2799,7 +2799,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
       finalizeStatusReaction(chatId, threadId, terminalReason)
       {
         const sKey = streamKey(chatId, threadId)
-        const turnDurationMs = turn.startedAt > 0 ? Date.now() - turn.startedAt : 0
+        const turnDurationMs = computeTurnDurationMs(turn.startedAt, Date.now())
         logStreamingEvent({
           kind: 'turn_end',
           chatId,
@@ -2941,6 +2941,10 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               // not what it chose to send. Pass the raw signal through so the
               // send states that provenance. It never gates delivery.
               replyToolThrewThisTurn: proseDecision.replyToolThrewThisTurn === true,
+              // #4490 — same pass-through for the review-origin signal, so the
+              // send path can apply the SAME card-gate / title-framing rules the
+              // outbox sweep applies to a review turn's prose.
+              reviewOriginated: proseDecision.reviewOriginated === true,
               // For the honest "(waited Ns)" clause if the exhaustion-boundary
               // apology fallback fires (#3228).
               turnDurationMs,