switchroom 0.20.12 → 0.20.13

package/telegram-plugin/hooks/silent-end-interrupt-stop.mjs

@@ -72,6 +72,8 @@ import {
 import {
   decideCaptureAudience,
   resolveOpenObligation,
+  isReviewOriginatedSource,
+  isSelfImprovementCard,
   AUDIENCE_INTERNAL,
 } from './audience-classify.mjs'
 
@@ -129,6 +131,19 @@ function buildNextState(base, decision, retryCount) {
   } else {
     delete next.replyToolThrewThisTurn
   }
+  // #4490: same carry-through for review-turn provenance. The outbox capture
+  // path (`writeOutboxRecord` above) stamps `reviewOriginated` from the SAME
+  // envelope `source` tag; the ELECTED path ('trailing-text-after-reply') never
+  // writes an outbox record, so the captured-prose bridge (the delivering
+  // machine on this path) has no other way to learn it. Explicitly deleted
+  // when this turn's scan saw no review-source envelope, so a spread of a
+  // prior turn's file can never mislabel a normal turn's prose as a review
+  // turn's (or vice versa).
+  if (isReviewOriginatedSource(decision.source)) {
+    next.reviewOriginated = true
+  } else {
+    delete next.reviewOriginated
+  }
   return next
 }
 
@@ -181,7 +196,7 @@ function outboxAlreadyDelivered(outboxDir, nonce) {
  * `'unknown'` → the record delivers exactly as it does today.
  *
  * @param {string} stateDir
- * @param {{ chatId: string|null, originChatId?: string|null, replyToolThrewThisTurn?: boolean }} capture
+ * @param {{ chatId: string|null, originChatId?: string|null, replyToolThrewThisTurn?: boolean, source?: string|null }} capture
  * @returns {'user' | 'internal'}
  */
 function classifyCaptureAudience(stateDir, capture) {
@@ -212,6 +227,14 @@ function classifyCaptureAudience(stateDir, capture) {
     process.env.TELEGRAM_ACCESS_MODE !== 'static'
   return decideCaptureAudience({
     replyToolThrewThisTurn: capture.replyToolThrewThisTurn === true,
+    // A self-improvement review turn has exactly ONE sanctioned operator-facing
+    // output: a well-formed self-improvement CARD. Deterministic on the enqueue
+    // envelope's `source` tag (the same signal the rest of the self-improve
+    // machinery routes on) plus the EXACT card-shape of the captured text. A
+    // card delivers; any other trailing prose (the raw-reasoning leak) is
+    // suppressed. Independent of the reply-throw / obligation state below.
+    reviewOriginated: isReviewOriginatedSource(capture.source),
+    reviewTextIsCard: isSelfImprovementCard(capture.text),
     openInboundObligation: resolveOpenObligation({
       snapshotRaw,
       snapshotTrusted,
@@ -265,6 +288,13 @@ function writeOutboxRecord(stateDir, capture, audience) {
       // not catch (the foreground case). Stamped here because this is the last
       // point in the pipeline that can still see the transcript.
       replyToolThrewThisTurn: capture.replyToolThrewThisTurn === true,
+      // Ken 2026-08-07: did this turn originate from a self-improvement review
+      // inbound? `audience` already consumed it (with the card-shape signal) to
+      // deliver a well-formed card and suppress raw reasoning by default; the
+      // sweep consumes this raw flag again, on its own, to prepend the
+      // self-improvement TITLE to any review record delivered with the audience
+      // gate OFF, so review reasoning can never appear as raw, unlabelled prose.
+      reviewOriginated: isReviewOriginatedSource(capture.source),
     }
     const tmpPath = join(outboxDir, `.${capture.turnNonce}.${process.pid}.tmp`)
     writeFileSync(tmpPath, JSON.stringify(record), 'utf8')

package/telegram-plugin/hooks/silent-end-scan.mjs

@@ -259,6 +259,13 @@ function buildTurnId(chatId, threadId, messageId) {
  */
 function buildBlockResult(envelope, reason, pendingText, hasTrailingProse, replyToolThrewThisTurn) {
   const block = { decided: 'block', reason }
+  // #4490: the enqueue envelope's RAW `source` tag, carried through exactly
+  // like `replyToolThrewThisTurn` above — the single-writer election needs it
+  // to derive `reviewOriginated` for the captured-prose bridge (the ELECTED
+  // path's deliverer, which never writes an outbox record and so has no other
+  // way to learn a review turn's provenance). Omitted when the envelope carried
+  // none, so a spread of a prior state file is never read as positive evidence.
+  if (envelope.source != null) block.source = envelope.source
   if (replyToolThrewThisTurn === true) block.replyToolThrewThisTurn = true
   // Single-writer election input (#duplicate-message fix): does ANY
   // non-empty, non-silent trailing text block exist after the last
@@ -360,7 +367,7 @@ function buildBlockResult(envelope, reason, pendingText, hasTrailingProse, reply
  * false-positive that burned retry budget on healthy turns.
  *
  * @param {string} jsonl
- * @returns {{ decided: 'allow' | 'block' | 'unknown', reason: string, turnKey?: string, turnId?: string, chatId?: string, threadId?: number | null, pendingText?: string }}
+ * @returns {{ decided: 'allow' | 'block' | 'unknown', reason: string, turnKey?: string, turnId?: string, chatId?: string, threadId?: number | null, pendingText?: string, source?: string, replyToolThrewThisTurn?: boolean }}
  */
 export function scanTurnForFinalReply(jsonl) {
   const lines = jsonl.split('\n')

package/telegram-plugin/outbox.ts

@@ -75,6 +75,9 @@ import type { Audience } from './hooks/audience-classify.mjs'
 import {
   applyReplyThrowFraming,
   shouldFrameReplyThrow,
+  applySelfImprovementFraming,
+  shouldFrameSelfImprovement,
+  isSelfImprovementCard,
 } from './hooks/audience-classify.mjs'
 
 export type { Audience }
@@ -162,6 +165,25 @@ export interface OutboxRecord {
    * exact boolean `true` changes anything — see `shouldFrameReplyThrow`.
    */
   replyToolThrewThisTurn?: boolean
+  /**
+   * Ken 2026-08-07: did the turn that produced this record originate from a
+   * self-improvement review inbound (`source="self_improve_review"`)? Stamped at
+   * capture by `hooks/silent-end-interrupt-stop.mjs` from the enqueue envelope's
+   * source tag.
+   *
+   * `audience` already consumed it once — a review turn classifies `'internal'`
+   * (`decideCaptureAudience`), so by default it is SUPPRESSED at the sweep's
+   * entry gate and never delivered. The sweep consumes this raw flag again, on
+   * its own, only for the residual: a review record that IS delivered (the
+   * audience gate turned off, or a legacy/`user` route) must carry the
+   * self-improvement TITLE so it can never appear as raw, unlabelled agent
+   * reasoning — the leak this closes.
+   *
+   * OPTIONAL: absent on every pre-change record and on non-review turns, which
+   * deliver unframed. Only an exact boolean `true` changes anything — see
+   * `shouldFrameSelfImprovement`.
+   */
+  reviewOriginated?: boolean
 }
 
 /** One line of the delivered-keys journal (`outbox/delivered.jsonl`). */
@@ -204,6 +226,16 @@ export interface DeliveredEntry {
    * framed delivery is a delivery.
    */
   framedProvenance?: 'reply-throw'
+  /**
+   * Ken 2026-08-07: this delivery carried the self-improvement TITLE header
+   * (`SELF_IMPROVEMENT_TITLE`) in front of a review-originated record's prose.
+   * Durable and terminal, for the same reason `framedProvenance` is: framing
+   * changes what a human sees, so the outcome is recorded as an explicit named
+   * state on the journal line rather than being inferable only from a log line
+   * that may have rotated away. `tgMessageId` IS present on these lines — a
+   * framed delivery is a delivery.
+   */
+  framedSelfImprovement?: 'self-improve'
 }
 
 export function sha256Hex(s: string): string {
@@ -519,6 +551,13 @@ export interface OutboxSweepDecision {
    * the rule.
    */
   framedProvenance?: 'reply-throw'
+  /**
+   * Ken 2026-08-07: `text` carries the self-improvement title header. Surfaced
+   * on the decision (rather than left implicit in a string compare) so the
+   * caller can journal the outcome and emit telemetry without re-deriving the
+   * rule — same shape as `framedProvenance`.
+   */
+  framedSelfImprovement?: 'self-improve'
 }
 
 /**
@@ -538,7 +577,7 @@ export interface OutboxSweepDecision {
 export function decideOutboxSweep(input: {
   record: Pick<
     OutboxRecord,
-    'turnNonce' | 'text' | 'createdAt' | 'replyToolThrewThisTurn'
+    'turnNonce' | 'text' | 'createdAt' | 'replyToolThrewThisTurn' | 'reviewOriginated'
   >
   now: number
   deliveredNonces: Set<string>
@@ -566,6 +605,13 @@ export function decideOutboxSweep(input: {
    * revert-check can flip it in-process.
    */
   provenanceFraming?: boolean
+  /**
+   * Ken 2026-08-07 kill switch for the self-improvement TITLE header. `false`
+   * restores the pre-change body byte-for-byte; the default is ON. Passed in
+   * rather than read from env here so this core stays pure and a revert-check
+   * can flip it in-process.
+   */
+  selfImprovementFraming?: boolean
 }): OutboxSweepDecision {
   const {
     record,
@@ -578,6 +624,7 @@ export function decideOutboxSweep(input: {
     maxAgeMs = OUTBOX_MAX_AGE_MS,
     shownLedgerHit = false,
     provenanceFraming = true,
+    selfImprovementFraming = true,
   } = input
   if (deliveredNonces.has(record.turnNonce)) return { action: 'skip-journaled' }
   if (shownLedgerHit) return { action: 'skip-ephemeral-shown' }
@@ -592,11 +639,30 @@ export function decideOutboxSweep(input: {
   // the banner describes the TEXT. It is additive only: it can never turn a
   // send into a skip, so this branch cannot manufacture silence.
   const framed = shouldFrameReplyThrow(record, { frameEnabled: provenanceFraming })
-  const body = framed ? applyReplyThrowFraming(record.text) : record.text
+  const provenanceBody = framed ? applyReplyThrowFraming(record.text) : record.text
+  // Ken 2026-08-07: the self-improvement title is the OUTERMOST content line, so
+  // it is applied AFTER the reply-throw banner — a review record that somehow
+  // also threw reads "🔧 Self-improvement" first, then the provenance note, then
+  // the prose. Additive only: it can never turn a send into a skip.
+  //
+  // #4489: idempotency is gated on the RAW `record.text`, NOT on `provenanceBody`.
+  // A real card's `record.text` opens with the title; the reply-throw banner
+  // above is PREPENDED in front of it, so `provenanceBody` no longer opens with
+  // the title even though the underlying card does. `applySelfImprovementFraming`
+  // alone can't see that — its idempotency check only looks at what it was
+  // handed — so gating the whole decision on the raw text is what keeps a real
+  // card from acquiring a second, duplicated title when both framings compose.
+  const selfImproveFramed =
+    shouldFrameSelfImprovement(record, { frameEnabled: selfImprovementFraming }) &&
+    !isSelfImprovementCard(record.text)
+  const body = selfImproveFramed ? applySelfImprovementFraming(provenanceBody) : provenanceBody
   return {
     action: delayed ? 'send-delayed' : 'send',
     text: prefix + body,
-    ...(framed && body !== record.text ? { framedProvenance: 'reply-throw' as const } : {}),
+    ...(framed && provenanceBody !== record.text ? { framedProvenance: 'reply-throw' as const } : {}),
+    ...(selfImproveFramed && body !== provenanceBody
+      ? { framedSelfImprovement: 'self-improve' as const }
+      : {}),
   }
 }
 

package/telegram-plugin/silent-end.ts

@@ -82,6 +82,26 @@ export interface SilentEndState {
    * throw", which delivers exactly as before. It never suppresses.
    */
   replyToolThrewThisTurn?: boolean
+  /**
+   * #4490 — did the turn that produced `pendingText` originate from a
+   * self-improvement review inbound (`source="self_improve_review"`)?
+   *
+   * Stamped by the Stop hook's single-writer election
+   * (`silent-end-interrupt-stop.mjs` → `buildNextState`) from the SAME
+   * enqueue-envelope `source` tag `writeOutboxRecord` reads for the outbox
+   * capture path; the gateway's own `writeSilentEndState` never sets it.
+   * Consumed by `deliverCapturedProse` (`gateway/outbound-send-path.ts`),
+   * which is the ELECTED path's deliverer — it never writes an outbox record,
+   * so the sweep's audience gate / self-improvement framing can never reach
+   * this message, and this is the only way that machine can learn the
+   * provenance. Restores the #4141-style symmetry #4485 left one-sided (card
+   * gate + title framing applied at the sweep only).
+   *
+   * Optional and only ever `true`: absent means "no positive evidence of a
+   * review-origin turn", which delivers exactly as before. It never widens
+   * suppression on a normal user turn.
+   */
+  reviewOriginated?: boolean
 }
 
 export interface SilentEndDeps {
@@ -346,6 +366,15 @@ export interface CapturedProseDecision {
    * `true` only on positive evidence; never affects `deliver`.
    */
   replyToolThrewThisTurn?: boolean
+  /**
+   * #4490 — the persisted record says this turn originated from a
+   * self-improvement review inbound. Surfaced (not acted on) so
+   * `deliverCapturedProse` can apply the SAME card-gate / title-framing rules
+   * the outbox sweep applies. `true` only on positive evidence; never affects
+   * `deliver` here — the audience decision is made downstream, exactly as
+   * `replyToolThrewThisTurn`'s banner decision is.
+   */
+  reviewOriginated?: boolean
   /** Machine-readable reason (for logs / tests). */
   reason:
     | 'captured-prose'
@@ -426,17 +455,31 @@ export function decideCapturedProseDelivery(
     // AFTER every `deliver:false` gate above — the banner is a labelling
     // concern, and must never become an input to whether we deliver at all.
     ...(state.replyToolThrewThisTurn === true ? { replyToolThrewThisTurn: true } : {}),
+    // #4490: same discipline for the review-origin signal — placed after every
+    // `deliver:false` gate so it can never become an input to whether the
+    // (structurally different) "should we deliver at all" decision above
+    // fires. The caller decides suppression/framing from this raw flag.
+    ...(state.reviewOriginated === true ? { reviewOriginated: true } : {}),
   }
 }
 
 /**
  * Outcome of a captured-prose send attempt (Option A transcript-prose bridge).
- *   - `sent`         — the answer was delivered fresh this call.
- *   - `skipped-dedup`— the exact answer already went out (dedup hit); nothing
- *                      new was sent, but the answer IS with the user.
- *   - `failed`       — the send threw; the answer did NOT reach the user.
+ *   - `sent`               — the answer was delivered fresh this call.
+ *   - `skipped-dedup`      — the exact answer already went out (dedup hit);
+ *                            nothing new was sent, but the answer IS with the
+ *                            user.
+ *   - `failed`             — the send threw; the answer did NOT reach the
+ *                            user.
+ *   - `suppressed-internal`— #4490: the audience gate classified this prose
+ *                            as internal (a non-card self-improvement review
+ *                            turn) and it was never sent. Falls through the
+ *                            SAME close-obligation + clear-state bookkeeping
+ *                            as `sent` / `skipped-dedup` below — no operator
+ *                            is waiting on a message that was never meant to
+ *                            reach them, so there is nothing to recover.
  */
-export type CapturedProseSendOutcome = 'sent' | 'skipped-dedup' | 'failed'
+export type CapturedProseSendOutcome = 'sent' | 'skipped-dedup' | 'failed' | 'suppressed-internal'
 
 /**
  * The bookkeeping effects the gateway applies after a captured-prose send

package/telegram-plugin/tests/captured-answer-resume.test.ts

@@ -1,14 +1,4 @@
-import { describe, expect, it, vi, beforeEach } from 'vitest'
-
-// The dispatcher's resume closure reaches for the durable outbound-text oracle
-// (history.hasOutboundWithText) to reconcile crash-idempotency. Mock it so these
-// stay pure vitest unit tests (no bun:sqlite / real DB) and we can control the
-// "did this chunk's text land durably?" answer per scenario.
-let mockOracle: (chatId: string, text: string, threadId: number | null, since: number) => boolean = () => false
-vi.mock('../history.js', () => ({
-  hasOutboundWithText: (chatId: string, text: string, threadId: number | null, since: number) =>
-    mockOracle(chatId, text, threadId, since),
-}))
+import { describe, expect, it, beforeEach } from 'vitest'
 
 import {
   BackstopDeliveryLedger,
@@ -36,7 +26,24 @@ import {
  *   (c) a fully-landed answer's represent sends NOTHING.
  * A test that would still pass if the resume re-sent a confirmed chunk is not a
  * test — every scenario asserts the exact `sendChunk` index set.
+ *
+ * The dispatcher's resume closure reaches for the durable outbound-text oracle
+ * (history.hasOutboundWithText) to reconcile crash-idempotency. `mockOracle`
+ * below is injected per-scenario via `createCapturedResumeDispatcher`'s
+ * `hasOutboundWithText` port (see `gateway/captured-answer-resume.ts`) — NOT
+ * via `vi.mock('../history.js', ...)`. That used to module-mock `history.js`,
+ * which looks file-scoped under vitest but under bun's vitest-compat layer
+ * `vi.mock` maps onto the process-global `mock.module`: `bun test` runs the
+ * whole `telegram-plugin/` surface in one process
+ * (`telegram-plugin/scripts/bun-test-ci.sh`), so the mock retroactively
+ * rebound `hasOutboundWithText` for every OTHER file in the same sweep —
+ * including `tests/history.test.ts`'s calls to the REAL implementation. That
+ * was the actual root cause of #4488/#4491: a row `history.test.ts` had
+ * genuinely just written to its own real bun:sqlite DB was reported "not
+ * found" because its `hasOutboundWithText` import had been silently rebound
+ * to this file's `() => false` default. See check-bun-module-mock-scope.mjs.
  */
+let mockOracle: (chatId: string, text: string, threadId: number | null, since: number) => boolean = () => false
 
 beforeEach(() => {
   mockOracle = () => false
@@ -192,6 +199,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
     oblLedger.noteCapturedDelivery('#t1', snapshot)
 
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
       obligationLedger: oblLedger,
       backstopDeliveryLedger: resumeLedger,
@@ -228,6 +236,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
     mockOracle = (_c, txt) => txt === 'c0'
 
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
       obligationLedger: oblLedger,
       backstopDeliveryLedger: resumeLedger,
@@ -258,6 +267,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
     oblLedger.noteCapturedDelivery('#t1', snapshot)
 
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
       obligationLedger: oblLedger,
       backstopDeliveryLedger: resumeLedger,
@@ -302,6 +312,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
 
     const lines: string[] = []
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: async (a) => {
         a.resume.hydrate(resumeLedger, a.turnId)
         const res = await runBackstopDelivery(
@@ -351,6 +362,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
 
     let probes = 0
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: async (a) => {
         a.resume.hydrate(resumeLedger, a.turnId)
         const res = await runBackstopDelivery(
@@ -388,6 +400,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
 
     // A resume whose tail send keeps throwing ⇒ not delivered ⇒ obligation stays OPEN.
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: async (a) => {
         a.resume.hydrate(resumeLedger, a.turnId)
         const res = await runBackstopDelivery(
@@ -423,6 +436,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
     oblLedger.noteCapturedDelivery('#t1', snapshot)
 
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: async (a) => {
         deliverCalls++
         a.resume.hydrate(resumeLedger, a.turnId)
@@ -448,6 +462,7 @@ describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome'
   it('no captured snapshot ⇒ dispatch is a no-op (caller falls through to fresh generation)', async () => {
     let delivered = false
     const dispatcher = createCapturedResumeDispatcher({
+      hasOutboundWithText: mockOracle,
       deliverAnswer: async () => { delivered = true; return { delivered: true, sentIds: [] } },
       obligationLedger: new ObligationLedger(2),
       backstopDeliveryLedger: new BackstopDeliveryLedger(),

package/telegram-plugin/tests/hindsight-bank-preload.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  HINDSIGHT_BANK_GUARD_MARKER,
+  hindsightBankGuardTrips,
+  resetHindsightBankGuardTrips,
+} from '../../tests/vitest-setup/hindsight-bank-guard-core.mjs'
+
+/**
+ * Runtime alarm for the BUN half of the Hindsight bank hermeticity guard.
+ *
+ * vitest loads `tests/vitest-setup/hindsight-bank-guard.mjs` via
+ * `test.setupFiles`; `bun test` loads the same file via `[test] preload` in
+ * bunfig.toml (repo root) and telegram-plugin/bunfig.toml (CI's bun-test-run
+ * has `working-directory: telegram-plugin`, and bun reads the bunfig in its CWD
+ * only). Without the bun half, every bun-run test file can still reach the
+ * FLEET's Hindsight — which auto-creates a bank on miss, so one stray request
+ * mints a bank in the live instance. That is how eleven throwaway banks
+ * appeared there on 2026-07-30, one of them named `clerk`, colliding with a
+ * live agent and erasing the annotation that documented where that agent's
+ * memory actually lives.
+ *
+ * `npm run lint:hindsight-bank-hermeticity` pins the WIRING statically; this
+ * pins the EFFECT, so a bunfig that is present but no longer loading the guard
+ * (wrong relative path, bun config-discovery change) fails a test rather than
+ * silently un-protecting the runner.
+ *
+ * Imports the CORE, never the setup file — importing the setup file would
+ * INSTALL the guard and let this alarm heal itself. The replay target is
+ * 192.0.2.1 (TEST-NET-1, RFC 5737): unroutable, so an unwired run fails on the
+ * assertion rather than doing the thing the guard exists to prevent.
+ */
+describe('bun test runs with the fleet Hindsight blocked', () => {
+  it('rejects a bank request to a fleet Hindsight origin', async () => {
+    resetHindsightBankGuardTrips()
+    let err: unknown
+    try {
+      await fetch('http://192.0.2.1:18888/v1/default/banks/clerk/config', {
+        signal: AbortSignal.timeout(250),
+      })
+    } catch (e) {
+      err = e
+    }
+    expect(
+      String((err as Error | undefined)?.message ?? ''),
+      'bunfig.toml `[test] preload` did not install the Hindsight bank guard',
+    ).toContain(HINDSIGHT_BANK_GUARD_MARKER)
+    expect(hindsightBankGuardTrips()).toBe(1)
+  })
+})