switchroom 0.20.4 → 0.20.6

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.20.4", COMMIT_SHA = "7f669382";
+var VERSION = "0.20.6", COMMIT_SHA = "4b1ad9b1";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -32408,7 +32408,9 @@ var init_scaffold = __esm(() => {
     "mcp__switchroom-telegram__forward_message",
     "mcp__switchroom-telegram__download_attachment",
     "mcp__switchroom-telegram__get_recent_messages",
-    "mcp__switchroom-telegram__progress_update"
+    "mcp__switchroom-telegram__progress_update",
+    "mcp__switchroom-telegram__send_checklist",
+    "mcp__switchroom-telegram__update_checklist"
   ];
   HINDSIGHT_MCP_TOOLS = [
     "mcp__hindsight__recall",
@@ -32464,6 +32466,7 @@ var init_scaffold = __esm(() => {
     "Task",
     "TodoWrite",
     "ExitPlanMode",
+    "Bash",
     "Skill"
   ];
   WEBKITE_FLEET_DENY_TOOLS = ["WebFetch", "WebSearch"];

package/dist/host-control/main.js

@@ -21432,7 +21432,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.20.4";
+var VERSION = "0.20.6";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.20.4",
+  "version": "0.20.6",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/skills/switchroom-release/SKILL.md

@@ -15,6 +15,7 @@ Cut a release of `switchroom/switchroom` and get it live on the fleet. This is a
 - Cutting the tag fires **two** workflows: `docker-images` (builds + pushes the 6 ghcr images) and `release` (the **orchestrator** — builds the four static binaries, attaches them, waits for `docker-images`, then calls `npm-publish`, then takes the GitHub Release out of draft).
 - **`npm-publish.yml` no longer has a tag trigger (#3654).** It is reachable only via `workflow_call` from `release.yml` and via `workflow_dispatch`. npm is the one leg that cannot be undone, so it runs last and only once everything else is green. It also re-proves both preconditions from inside its own run, so a hand dispatch cannot bypass the ordering either.
 - **The GitHub Release is created as a DRAFT and stays one until every leg is green.** `install.sh` resolves the version to install from `/releases/latest`, and that endpoint excludes drafts — so a half-finished release is invisible to `curl | sh` users and the previous complete release keeps serving them. This is not theoretical: v0.19.19 shipped published-with-zero-assets and broke the installer on every platform.
+- **A tag push is now SUFFICIENT: if no GitHub Release exists, `release.yml`'s `guard` job AUTO-CREATES it as a draft from the `## vX.Y.Z` section of `CHANGELOG.md` (#4331).** The manual `gh release create` in step 2b is therefore belt-and-suspenders — do it (it lets you pin an exact title/notes and shortens the guard's wait), but forgetting it no longer silently strands the release. This closed the v0.20.3/v0.20.4 hole: those tags shipped to the fleet with `gh release create` skipped, so `guard` failed, `npm` was skipped, and npm `latest` sat at 0.20.2 until it was recovered by hand. The one hard requirement is that `CHANGELOG.md` on the tagged commit HAS a section for the tag — if it doesn't, `guard` FAILS LOUDLY (it never invents an empty release).
 
 ## Before you start — pre-flight (verify, don't assume)
 
@@ -55,7 +56,7 @@ gh release create "vX.Y.Z" -R switchroom/switchroom \
 ```
 
 - **`--draft` is mandatory.** A published release with no assets immediately becomes `/releases/latest` and 404s every `curl | sh` install for the entire ~25-minute build window. `release.yml` will forcibly re-draft an incomplete published release within about a minute, but do not rely on the safety net — it exists for the case where this step was done wrong.
-- Creating the release object *before* the tag is what removes the race: `release.yml`'s `guard` job needs it to exist within ~150s of the tag push.
+- Creating the release object *before* the tag is what removes the race: `release.yml`'s `guard` job polls ~150s for it. **If you skip this step entirely, `guard` auto-creates the draft release from `CHANGELOG.md` (#4331)** — so a skipped `gh release create` is recoverable, not fatal, as long as the CHANGELOG section exists. Still create it here when you can: it is one fewer thing depending on the auto-heal, and it lets you author a title/notes that differ from the raw CHANGELOG section.
 - **Notes extraction gotcha (historical):** the naive `awk '/^## vX/,/^## v/' CHANGELOG` range collapses to a single line. Use a start-flag awk: `awk 'f{print} /^## vX\.Y\.Z/{print; f=1} f && /^## v/ && !/^## vX\.Y\.Z/{exit}'` — or extract the section to a temp file by line range.
 - **`gh release create` has been silently dropped in past runs.** Verify it exists and is a draft:
   ```bash
@@ -151,7 +152,7 @@ It re-runs every leg — including `finalize`, which is what actually takes the
 
 **But a re-dispatch cannot fix a defect that lives in the tag's own tree.** `workflow_dispatch` executes the workflow YAML **at the dispatched ref**, so `--ref vX.Y.Z` re-runs the same broken file and fails identically, every time. This is not theoretical — it is how v0.19.20 died (#3691). Before reaching for the re-dispatch, root-cause the failure in the workflow source **at that tag** (`git show vX.Y.Z:.github/workflows/release.yml`) and compare it to `main`. If the bug is in the tag's tree, the only path is a fix merged to `main` plus a **fresh tag**; abandon the old tag as a permanent draft (do not delete it, do not hand-publish it) and burn a patch version. Re-dispatch is for *transient* failures — a flaky runner, an npm 5xx, a `docker-images` run that has since gone green.
 
-- **`release` failed at `guard` ("no GitHub Release exists"):** step 2b was skipped or the tag name is misspelled. Create the draft release, then re-dispatch as above.
+- **`release` failed at `guard` ("cannot auto-create … no usable CHANGELOG.md section"):** the tag has no matching `## vX.Y.Z` section in `CHANGELOG.md` on the tagged commit, so `guard` could not auto-create the release from it (#4331). This is the fail-loud fallback, not the old "no release exists" failure — `guard` now auto-creates the DRAFT release from the CHANGELOG section whenever `gh release create` was skipped, so a missing release object no longer blocks the pipeline. The fix is a CHANGELOG defect in the tag's own tree: consolidate the notes under `## vX.Y.Z — <summary>` (step 1), merge to `main`, and cut a **fresh** tag — a re-dispatch on the same tag re-runs the same CHANGELOG-less tree and fails identically (see the "cannot fix a defect in the tag's tree" note above). If instead you simply want to override the auto-notes, `gh release create vX.Y.Z --draft --notes-file …` by hand before re-dispatching still works.
 - **`release` failed at `images-gate`:** `docker-images` was not green for this tag+commit. Fix it, `gh workflow run docker-images.yml --ref vX.Y.Z`, wait for green, then re-dispatch `release.yml`. Nothing was published to npm and the release is still a draft — nothing to undo.
 - **`release` failed at `npm` (e.g. a transient npm 5xx):** re-dispatch `release.yml` as above. `npm-publish` treats "already published" as success, so a re-run is safe and idempotent. Dispatching `npm-publish.yml --ref vX.Y.Z` directly also works and its own gates still apply, but it will NOT un-draft the release, so you would then have to re-dispatch `release.yml` anyway.
 - **Everything is green but the release is still a draft:** `finalize` did not run. Check `gh run view <run-id>` for a skipped job, then re-dispatch. Do not hand-publish — `finalize` re-verifies the asset set immediately before flipping the flag.

package/telegram-plugin/dist/gateway/gateway.js

@@ -71555,6 +71555,7 @@ __export(exports_silence_poke, {
   noteThinking: () => noteThinking,
   noteProduction: () => noteProduction,
   noteOutbound: () => noteOutbound2,
+  noteCardRender: () => noteCardRender,
   noteBackgroundShellDead: () => noteBackgroundShellDead,
   noteBackgroundShellAlive: () => noteBackgroundShellAlive,
   longestInFlightTool: () => longestInFlightTool,
@@ -71567,7 +71568,8 @@ __export(exports_silence_poke, {
   __getStateForTests: () => __getStateForTests,
   __bgMarkerParserConfirmedForTests: () => __bgMarkerParserConfirmedForTests,
   DEFAULT_THRESHOLDS: () => DEFAULT_THRESHOLDS,
-  DEFAULT_POLL_INTERVAL_MS: () => DEFAULT_POLL_INTERVAL_MS
+  DEFAULT_POLL_INTERVAL_MS: () => DEFAULT_POLL_INTERVAL_MS,
+  CARD_RENDER_FRESH_MS: () => CARD_RENDER_FRESH_MS
 });
 
 // turn-liveness-floor.ts
@@ -71633,6 +71635,7 @@ var DEFAULT_THRESHOLDS = {
   fallback: 300000
 };
 var DEFAULT_POLL_INTERVAL_MS = 5000;
+var CARD_RENDER_FRESH_MS = 30000;
 var state2 = new Map;
 var timer = null;
 var activeDeps = null;
@@ -71651,6 +71654,7 @@ function startTurn(key, now) {
     fallbackFired: false,
     floorFired: false,
     inFlightTools: new Map,
+    lastCardRenderAt: null,
     sawBashThisTurn: false,
     aliveShells: new Set
   });
@@ -71682,6 +71686,12 @@ function noteProduction(key, now) {
   s.lastOutboundAt = now;
   s.fallbackFired = false;
 }
+function noteCardRender(key, now) {
+  const s = state2.get(key);
+  if (s == null)
+    return;
+  s.lastCardRenderAt = now;
+}
 function noteThinking(key, now) {
   const s = state2.get(key);
   if (s == null)
@@ -71828,6 +71838,8 @@ function tick(now) {
       if (underCeiling) {
         if (activeDeps.isCompactionInFlight?.(key) === true)
           continue;
+        if (s.lastCardRenderAt != null && now - s.lastCardRenderAt < CARD_RENDER_FRESH_MS)
+          continue;
         const forceDisable = process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS === "0";
         if (!forceDisable && activeDeps.isLegitimatelyWorking != null) {
           if (activeDeps.isLegitimatelyWorking(key))
@@ -82138,6 +82150,12 @@ function noteProduction2(key, now) {
   s.lastOutboundAt = now;
   s.fallbackFired = false;
 }
+function noteCardRender2(key, now) {
+  const s = state5.get(key);
+  if (s == null)
+    return;
+  s.lastCardRenderAt = now;
+}
 function endTurn2(key) {
   state5.delete(key);
 }
@@ -83706,6 +83724,7 @@ function createNarrativeLane(deps) {
             if (isSendGateShed(editRes))
               break;
           }
+          noteCardRender2(statusKey(chat, thread), Date.now());
           turn.activityLastSentRender = target;
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
@@ -89472,6 +89491,7 @@ async function runBootPinSweepSteps(deps) {
   await step("status-pin-cleanup", deps.statusPinCleanup, log);
   await step("activity-card-reaper", deps.activityCardReaper, log);
   await step("queued-card-reaper", deps.queuedCardReaper, log);
+  await step("seed-prune-sweep-cursors", async () => deps.seedPruneSweepCursors(), log);
   await step("enable-sweep", async () => deps.enableSweep(), log);
   for (const t of targets) {
     await step(`stale-pin-sweep:${sweepTargetKey(t.chatId, t.threadId)}`, () => deps.sweepTarget(t), log);
@@ -90284,6 +90304,56 @@ function createGatewayStalePinSweeper(w) {
   });
 }
 
+// gateway/stale-pin-sweep-store.ts
+var SWEEP_ENVELOPE_VERSION2 = 1;
+function isCursorRow2(x) {
+  if (x == null || typeof x !== "object")
+    return false;
+  const o = x;
+  return typeof o.chatId === "string" && o.chatId.length > 0 && (o.threadId === undefined || typeof o.threadId === "number") && (o.kind === "dm" || o.kind === "forum-topic" || o.kind === "supergroup") && typeof o.popped === "number" && typeof o.done === "boolean" && typeof o.attempts === "number" && (o.doneIds === undefined || Array.isArray(o.doneIds) && o.doneIds.every((n) => typeof n === "number")) && (o.lastStatus === undefined || typeof o.lastStatus === "string") && typeof o.updatedAt === "number";
+}
+function loadSweepCursors2(path2, fs2) {
+  if (!fs2.existsSync(path2))
+    return [];
+  let raw = "";
+  try {
+    raw = fs2.readFileSync(path2);
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (parsed == null || typeof parsed !== "object")
+    return [];
+  const env = parsed;
+  if (!Number.isInteger(env.v) || env.v < 1 || !Array.isArray(env.cursors)) {
+    return [];
+  }
+  return env.cursors.filter(isCursorRow2);
+}
+function persistSweepCursors2(path2, fs2, cursors, log = (l) => process.stderr.write(l)) {
+  const env = { v: SWEEP_ENVELOPE_VERSION2, cursors: [...cursors] };
+  try {
+    fs2.writeFileSync(path2, JSON.stringify(env));
+  } catch (err) {
+    log(`stale-pin-sweep-store: persist FAILED path=${path2}: ${err.message} \u2014 ` + `durability degraded; a restart mid-sweep will re-seed instead of resume
+`);
+  }
+}
+function pruneSweepCursors(cursors) {
+  return cursors.filter((c) => !c.done);
+}
+function reseedSweepLedger(path2, fs2, log = (l) => process.stderr.write(l)) {
+  const rows = loadSweepCursors2(path2, fs2);
+  const pruned = pruneSweepCursors(rows);
+  if (pruned.length !== rows.length)
+    persistSweepCursors2(path2, fs2, pruned, log);
+}
+
 // gateway/webhook-ingest-server.ts
 import net4 from "node:net";
 import { chmodSync as chmodSync10, existsSync as existsSync39, unlinkSync as unlinkSync18 } from "node:fs";
@@ -102409,10 +102479,10 @@ function startOutboxSweep(deps) {
 }
 
 // ../src/build-info.ts
-var VERSION2 = "0.20.4";
-var COMMIT_SHA = "7f669382";
-var COMMIT_DATE = "2026-08-04T01:43:38Z";
-var LATEST_PR = 4331;
+var VERSION2 = "0.20.6";
+var COMMIT_SHA = "4b1ad9b1";
+var COMMIT_DATE = "2026-08-04T07:34:19Z";
+var LATEST_PR = 4340;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -108121,19 +108191,17 @@ async function unpinAllStatusPins() {
 }
 var stalePinSweepEligible = false;
 var STALE_PIN_SWEEP_STORE_PATH = join71(STATE_DIR, "stale-pin-sweep.json");
+var sweepStoreFs = {
+  readFileSync: (p) => readFileSync64(p, "utf-8"),
+  writeFileSync: (p, data) => atomicWriteFileSync(p, data, 384),
+  existsSync: (p) => existsSync61(p)
+};
 var stalePinSweeper = createGatewayStalePinSweeper({
   telegram: { handle: () => lockedBot, call: robustApiCall },
   claims: () => statusPinClaims.values(),
   loadPinRows: () => statusPinPersistEnabled || bannerPinPersistEnabled || toolPinPersistEnabled ? loadStatusPins2(STATUS_PIN_STORE_PATH, statusPinStoreFs) : [],
   eligible: () => stalePinSweepEligible,
-  store: {
-    path: STALE_PIN_SWEEP_STORE_PATH,
-    fs: {
-      readFileSync: (p) => readFileSync64(p, "utf-8"),
-      writeFileSync: (p, data) => atomicWriteFileSync(p, data, 384),
-      existsSync: (p) => existsSync61(p)
-    }
-  },
+  store: { path: STALE_PIN_SWEEP_STORE_PATH, fs: sweepStoreFs },
   allowUnpinAllForumTopic: process.env.SWITCHROOM_PIN_SWEEP_UNPIN_ALL_TOPIC == null ? undefined : process.env.SWITCHROOM_PIN_SWEEP_UNPIN_ALL_TOPIC === "1"
 });
 function runBootPinCleanupAndStalePinSweep() {
@@ -108149,6 +108217,7 @@ function runBootPinCleanupAndStalePinSweep() {
     enableSweep: () => {
       stalePinSweepEligible = true;
     },
+    seedPruneSweepCursors: () => reseedSweepLedger(STALE_PIN_SWEEP_STORE_PATH, sweepStoreFs),
     sweepTarget: (t) => stalePinSweeper.sweepTarget(t),
     log: (line) => process.stderr.write(line)
   });
@@ -109926,6 +109995,9 @@ async function executeProgressUpdate(args) {
   try {
     noteSignal(key, Date.now());
   } catch {}
+  try {
+    noteOutbound2(key, Date.now());
+  } catch {}
   return {
     content: [
       {

package/telegram-plugin/gateway/boot-sweep-gate.ts

@@ -103,6 +103,21 @@ export interface BootPinSweepSteps {
   /** Flips the flag authorising the stale-pin drain — for this sweep AND for
    *  later lazy first-inbound sweeps. */
   enableSweep: () => void
+  /**
+   * BOOT-SEED PRUNE (#3953 regression fix). Drops discharged (`done: true`)
+   * cursor rows from the sweep ledger so a `(chat, thread)` that drained in a
+   * PRIOR session is re-evaluated live this boot, instead of short-circuiting
+   * forever on a stale `done`. Kind-agnostic — clears DM, forum-topic and
+   * supergroup rows alike. Forfeited rows (`attempts >= SWEEP_MAX_ATTEMPTS`)
+   * are RETAINED by the underlying `pruneSweepCursors`, so a chat the bot
+   * cannot pin does not re-burn its attempt budget every boot.
+   *
+   * MUST stay BOOT-scoped. The lazy first-inbound sweep fires on EVERY message;
+   * pruning there would re-arm a full re-drain per message = a Telegram flood.
+   * Runs once here, before the `sweepTarget` loop, so the loop re-evaluates the
+   * freshly-reseeded ledger.
+   */
+  seedPruneSweepCursors: () => void
   sweepTarget: (target: SweepTarget) => Promise<unknown>
   log?: (line: string) => void
 }
@@ -161,6 +176,15 @@ export async function runBootPinSweepSteps(deps: BootPinSweepSteps): Promise<voi
   await step('activity-card-reaper', deps.activityCardReaper, log)
   await step('queued-card-reaper', deps.queuedCardReaper, log)
 
+  // Boot-seed prune (#3953): reseed the cursor ledger so a chat that drained in
+  // a prior session is re-evaluated live below, rather than short-circuiting on
+  // a stale `done`. Boot-scoped ONLY — never on the per-inbound path. Runs
+  // BEFORE enableSweep so eligibility (which also gates the lazy first-inbound
+  // sweep) is granted only once the ledger is reseeded — no window where an
+  // inbound observes a stale `done`. Isolated: a throw here must not strand the
+  // drain, and enableSweep below still runs regardless.
+  await step('seed-prune-sweep-cursors', async () => deps.seedPruneSweepCursors(), log)
+
   // Unconditional: reached even when every step above threw. See the docblock.
   await step('enable-sweep', async () => deps.enableSweep(), log)
   for (const t of targets) {

package/telegram-plugin/gateway/gateway.ts

@@ -648,6 +648,7 @@ import { withDeadline } from './with-deadline.js'
 import { createStatusPinApi, type PinCapableBot, type RobustApiSeam } from './status-pin-api.js'
 import { collectSweepTargets, type StalePinSweeper, type SweepTarget } from './stale-pin-sweep.js'
 import { createGatewayStalePinSweeper } from './stale-pin-sweep-wiring.js'
+import { reseedSweepLedger } from './stale-pin-sweep-store.js'
 import { atomicWriteFileSync } from '../../src/util/atomic.js'
 import { startWebhookIngestServer } from './webhook-ingest-server.js'
 import { recordWebhookEvent } from '../../src/web/webhook-gateway-record.js'
@@ -9041,6 +9042,11 @@ let stalePinSweepEligible = false
 // the previous complete ledger or the new one — never a truncated file that
 // forgets an in-flight drain.
 const STALE_PIN_SWEEP_STORE_PATH = join(STATE_DIR, 'stale-pin-sweep.json')
+const sweepStoreFs = {
+  readFileSync: (p: string) => readFileSync(p, 'utf-8'),
+  writeFileSync: (p: string, data: string) => atomicWriteFileSync(p, data, 0o600),
+  existsSync: (p: string) => existsSync(p),
+}
 const stalePinSweeper: StalePinSweeper = createGatewayStalePinSweeper({
   telegram: { handle: () => lockedBot, call: robustApiCall },
   claims: () => statusPinClaims.values(),
@@ -9049,14 +9055,7 @@ const stalePinSweeper: StalePinSweeper = createGatewayStalePinSweeper({
       ? loadStatusPins(STATUS_PIN_STORE_PATH, statusPinStoreFs)
       : [],
   eligible: () => stalePinSweepEligible,
-  store: {
-    path: STALE_PIN_SWEEP_STORE_PATH,
-    fs: {
-      readFileSync: (p) => readFileSync(p, 'utf-8'),
-      writeFileSync: (p, data) => atomicWriteFileSync(p, data, 0o600),
-      existsSync: (p) => existsSync(p),
-    },
-  },
+  store: { path: STALE_PIN_SWEEP_STORE_PATH, fs: sweepStoreFs },
   // Per-deployment override only. UNSET (the normal case) means "take the
   // standing policy" — UNPIN_ALL_FORUM_TOPIC_ENABLED in stale-pin-sweep.ts,
   // i.e. the WHOLESALE topic drain stays off because it also removes pins this
@@ -9099,6 +9098,7 @@ function runBootPinCleanupAndStalePinSweep(): Promise<void> {
     enableSweep: () => {
       stalePinSweepEligible = true
     },
+    seedPruneSweepCursors: () => reseedSweepLedger(STALE_PIN_SWEEP_STORE_PATH, sweepStoreFs),
     sweepTarget: (t: SweepTarget) => stalePinSweeper.sweepTarget(t),
     log: (line) => process.stderr.write(line),
   })
@@ -12573,6 +12573,8 @@ async function executeProgressUpdate(args: Record<string, unknown>): Promise<unk
   try {
     signalTracker.noteSignal(key, Date.now())
   } catch { /* best-effort signal */ }
+  // #4330: model-driven user-visible outbound — reset the silence clock like a reply send.
+  try { silencePoke.noteOutbound(key, Date.now()) } catch { /* best-effort */ }
 
   return {
     content: [

package/telegram-plugin/gateway/narrative-lane.ts

@@ -47,6 +47,7 @@
 // ─────────────────────────────────────────────────────────────────────────
 
 import { runSilentTurnHeartbeatTick } from '../feed-heartbeat-climb.js'
+import * as silencePoke from '../silence-poke.js'
 import { NarrativeFlushController, PENDING_NARRATIVE_FLUSH_MS } from '../narrative-flush.js'
 import { richMessage } from '../rich-send.js'
 import { isSendGateShed } from '../send-gate.js'
@@ -496,6 +497,20 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
             // payload IS on screen, so it advances normally below.
             if (isSendGateShed(editRes)) break
           }
+          // #4330 — a card render LANDED (fresh open above, or a non-shed
+          // edit): the pinned "→ Working…" status card the user watches just
+          // visibly moved. Stamp silence-poke's card-render clock so the 300s
+          // terminal fallback is DEFERRED (bounded by the hard ceiling) while
+          // the card keeps updating — a visibly-live card must not be torn
+          // down as "silence". This is the single transport chokepoint for
+          // every card producer (tool label, narrative SHOW, liveness open,
+          // heartbeat climb), and it is a DEFER-stamp only — it never touches
+          // `lastOutboundAt`, so the silence CLOCK still resets only at the
+          // model-driven production sites (stream-render tool-label / draft,
+          // foreground sub-agent render). That keeps the #1556 heartbeat-
+          // safety guard intact: a hung turn's climbing card defers the
+          // teardown at most to `fallbackHardCeiling`, never forever.
+          silencePoke.noteCardRender(statusKey(chat, thread), Date.now())
           turn.activityLastSentRender = target
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err)

package/telegram-plugin/gateway/stale-pin-sweep-store.ts

@@ -221,7 +221,44 @@ export function pendingSweepCursors(cursors: readonly SweepCursor[]): SweepCurso
   return cursors.filter((c) => !c.done && c.attempts < SWEEP_MAX_ATTEMPTS)
 }
 
-/** Drop discharged and forfeited rows — called once the ledger is reseeded. */
+/**
+ * Boot seed pass: drop DISCHARGED (`done: true`) rows ONLY, so a chat that
+ * drained in a prior session is re-evaluated LIVE on the next sweep instead of
+ * short-circuiting forever on a stale `done` (#3953 regression — the seed pass
+ * was never wired, so `done` was effectively permanent).
+ *
+ * FORFEITED rows (`attempts >= SWEEP_MAX_ATTEMPTS`, still `!done`) are
+ * deliberately RETAINED. Their whole purpose is to remember that a chat's
+ * attempt budget is spent (bot kicked, pin rights revoked, a chat that
+ * flood-waits forever). Pruning one would let the next boot re-seed it from the
+ * pin stores and re-burn the full 8-attempt budget on every boot for the rest
+ * of time — precisely the Telegram flood the attempt cap exists to prevent. So
+ * this filters on `done` ALONE; it must NOT also gate on `attempts`.
+ */
 export function pruneSweepCursors(cursors: readonly SweepCursor[]): SweepCursor[] {
-  return cursors.filter((c) => !c.done && c.attempts < SWEEP_MAX_ATTEMPTS)
+  return cursors.filter((c) => !c.done)
+}
+
+/**
+ * BOOT-SEED reseed of the durable ledger (#3953): drop discharged (`done:true`)
+ * rows so a `(chat, thread)` that drained in a prior session is re-evaluated
+ * LIVE on the next sweep instead of short-circuiting forever on a stale `done`.
+ * Forfeited rows are retained (see {@link pruneSweepCursors}).
+ *
+ * Writes ONLY when the prune changed the ledger, so a no-op boot never churns
+ * the durable file. Never throws — a reseed failure degrades to the pre-fix
+ * behaviour (the stale `done` survives one more boot), it must not break boot.
+ *
+ * BOOT-SCOPED BY CONTRACT: the caller must invoke this once at boot, never on
+ * the per-inbound path (which fires on every message — re-arming a full re-drain
+ * per message is a Telegram flood).
+ */
+export function reseedSweepLedger(
+  path: string,
+  fs: SweepStoreFsSeam,
+  log: (line: string) => void = (l) => process.stderr.write(l),
+): void {
+  const rows = loadSweepCursors(path, fs)
+  const pruned = pruneSweepCursors(rows)
+  if (pruned.length !== rows.length) persistSweepCursors(path, fs, pruned, log)
 }

package/telegram-plugin/gateway/stale-pin-sweep.test.ts

@@ -32,6 +32,8 @@ import {
 import {
   SWEEP_MAX_ATTEMPTS,
   loadSweepCursors,
+  pruneSweepCursors,
+  reseedSweepLedger,
   upsertSweepCursor,
   type SweepCursor,
   type SweepStoreFsSeam,
@@ -907,3 +909,163 @@ describe('stale-pin sweep — classification and seeding', () => {
     expect(isNothingToUnpinError(new Error('something else'))).toBe(false)
   })
 })
+
+// ─── #3953: the boot-seed prune reseeds a discharged obligation ───────────────
+//
+// Regression #3953 replaced the per-boot DM self-heal with a cursor-gated stack
+// drain, but the boot "seed pass" that clears discharged cursors was never
+// wired — so `done:true` was effectively PERMANENT and every later boot /
+// first-inbound sweep short-circuited on `already-drained`, orphaning any pin
+// that leaked AFTER the first drain. These tests pin the reseed contract:
+//   1. `pruneSweepCursors` drops `done` rows ONLY and RETAINS forfeited
+//      (attempts-exhausted) rows — a store-level test that FAILS on the pre-fix
+//      filter (which also dropped forfeited rows, re-burning the attempt budget
+//      every boot = flood risk).
+//   2. Running that prune between two fresh-process sweeps re-arms the drain, so
+//      a pin leaked after a prior discharge is reaped — for a DM AND a
+//      supergroup (channel-class) target alike.
+
+/** The boot-seed reseed exactly as the gateway wires it (`gateway.ts`
+ *  `seedPruneSweepCursors` → `reseedSweepLedger`). */
+function bootSeedPrune(fs: SweepStoreFsSeam, path: string): void {
+  reseedSweepLedger(path, fs, () => {})
+}
+
+/** A sweeper over a SHARED durable store — a distinct instance models a fresh
+ *  process (reboot), so the only state carried across is the on-disk ledger. */
+function sweeperOver(
+  fs: SweepStoreFsSeam,
+  path: string,
+  fake: ReturnType<typeof fakeChat>,
+  opts: { recordedPinIds?: number[] } = {},
+) {
+  let clock = 1_000_000
+  const deps: StalePinSweepDeps = {
+    getTopPinnedMessageId: fake.getTopPinnedMessageId,
+    pinSilent: fake.pinSilent,
+    unpin: fake.unpin,
+    unpinAllForumTopicMessages: fake.unpinAllForumTopicMessages,
+    canPinInChat: fake.canPinInChat,
+    protectedMessageIds: () => [],
+    recordedPinIds: () => opts.recordedPinIds ?? [],
+    eligible: () => true,
+    sleep: async (ms) => {
+      clock += ms
+    },
+    now: () => clock,
+    store: { path, fs },
+    log: () => {},
+  }
+  return createStalePinSweeper(deps)
+}
+
+describe('pruneSweepCursors — boot-seed reseed (#3953)', () => {
+  const now = 1_000_000
+
+  it('drops discharged rows but RETAINS forfeited (attempts-exhausted) rows', () => {
+    const discharged: SweepCursor = {
+      chatId: DM,
+      kind: 'dm',
+      popped: 3,
+      done: true,
+      attempts: 1,
+      updatedAt: now,
+    }
+    // A no-rights group that spent its whole attempt budget: `done` is false,
+    // but re-seeding it would re-burn all 8 attempts on the NEXT boot, and every
+    // boot after — the exact Telegram flood the attempt cap exists to stop.
+    const forfeited: SweepCursor = {
+      chatId: GROUP,
+      kind: 'supergroup',
+      popped: 0,
+      done: false,
+      attempts: SWEEP_MAX_ATTEMPTS,
+      lastStatus: 'skipped-no-rights',
+      updatedAt: now,
+    }
+    const stillOwed: SweepCursor = {
+      chatId: '900000002',
+      kind: 'dm',
+      popped: 0,
+      done: false,
+      attempts: 2,
+      updatedAt: now,
+    }
+
+    const keys = pruneSweepCursors([discharged, forfeited, stillOwed]).map((c) => c.chatId)
+
+    expect(keys).not.toContain(DM) // discharged → reseeded (dropped)
+    expect(keys).toContain(GROUP) // forfeited no-rights → RETAINED (no re-burn)
+    expect(keys).toContain('900000002') // still owed → retained untouched
+  })
+
+  it('clears discharged rows for EVERY surface — dm, forum-topic, supergroup', () => {
+    // The prune must be kind-agnostic: a stuck `done` on a topic or a channel is
+    // the same regression as on a DM, so none may be left short-circuiting.
+    const rows: SweepCursor[] = [
+      { chatId: '1', kind: 'dm', popped: 1, done: true, attempts: 1, updatedAt: now },
+      { chatId: '2', kind: 'forum-topic', threadId: 5, popped: 1, done: true, attempts: 1, updatedAt: now },
+      { chatId: '3', kind: 'supergroup', popped: 1, done: true, attempts: 1, updatedAt: now },
+    ]
+    expect(pruneSweepCursors(rows)).toEqual([])
+  })
+})
+
+describe('stale-pin sweep — re-drain after the boot-seed prune (#3953)', () => {
+  it('re-drains a DM whose obligation was discharged in a prior session', async () => {
+    const fs = memFs()
+    const path = '/state/stale-pin-sweep.json'
+
+    // Session 1: an orphan bot pin is drained and the obligation discharged.
+    const s1 = await sweeperOver(fs, path, fakeChat({ stack: [11] })).sweepTarget({ chatId: DM })
+    expect(s1.status).toBe('drained')
+    expect(loadSweepCursors(path, fs).find((c) => c.chatId === DM)?.done).toBe(true)
+
+    // A NEW orphan pin leaks in after that drain.
+    // Fresh process, no prune: the sweep short-circuits on the stale `done` —
+    // the #3953 regression, verbatim. The orphan is left pinned.
+    const stuckChat = fakeChat({ stack: [99] })
+    const stuck = await sweeperOver(fs, path, stuckChat).sweepTarget({ chatId: DM })
+    expect(stuck.status).toBe('already-drained')
+    expect(stuck.popped).toBe(0)
+    expect(stuckChat.stack).toEqual([99])
+
+    // Reboot WITH the boot-seed prune: the discharged row is reseeded, so the
+    // next sweep re-evaluates the chat LIVE and reaps the orphan.
+    bootSeedPrune(fs, path)
+    const rebootChat = fakeChat({ stack: [99] })
+    const redrain = await sweeperOver(fs, path, rebootChat).sweepTarget({ chatId: DM })
+    expect(redrain.status).toBe('drained')
+    expect(redrain.popped).toBe(1)
+    expect(rebootChat.stack).toEqual([])
+  })
+
+  it('re-drains a supergroup (channel-class) discharged in a prior session', async () => {
+    const fs = memFs()
+    const path = '/state/stale-pin-sweep.json'
+
+    // Session 1: the one recorded orphan is reaped, obligation discharged.
+    const s1 = await sweeperOver(fs, path, fakeChat({ stack: [77], canPin: true }), {
+      recordedPinIds: [77],
+    }).sweepTarget({ chatId: GROUP })
+    expect(s1.status).toBe('drained')
+    expect(loadSweepCursors(path, fs).find((c) => c.chatId === GROUP)?.done).toBe(true)
+
+    // A fresh recorded orphan leaks in; a fresh process short-circuits on `done`.
+    const stuckChat = fakeChat({ stack: [88], canPin: true })
+    const stuck = await sweeperOver(fs, path, stuckChat, { recordedPinIds: [88] }).sweepTarget({
+      chatId: GROUP,
+    })
+    expect(stuck.status).toBe('already-drained')
+    expect(stuckChat.stack).toEqual([88])
+
+    // Reboot + prune: the supergroup row is reseeded and re-swept.
+    bootSeedPrune(fs, path)
+    const rebootChat = fakeChat({ stack: [88], canPin: true })
+    const redrain = await sweeperOver(fs, path, rebootChat, { recordedPinIds: [88] }).sweepTarget({
+      chatId: GROUP,
+    })
+    expect(redrain.status).toBe('drained')
+    expect(rebootChat.stack).toEqual([])
+  })
+})

package/telegram-plugin/silence-poke.ts

@@ -28,6 +28,14 @@
  * is visibly running; nulling `currentTurn` there would darken the very feed the
  * user is watching. A turn with no in-flight tool is unaffected.
  *
+ * #4330 caveat: an activity-card render that LANDED on Telegram within
+ * `CARD_RENDER_FRESH_MS` (stamped via `noteCardRender` from the card-drain
+ * transport) likewise DEFERS the terminal unwedge, bounded by the same hard
+ * ceiling — a visibly-updating pinned "→ Working…" card is user-visible
+ * activity, and killing the turn under it is a false positive. It never
+ * resets the clock: the framework heartbeat climbs the card on pure wall
+ * clock even on a hung turn, so a reset would pin a dead turn forever.
+ *
  * Terminal action, once per turn:
  *
  *   t=0       startTurn() — silence clock starts at turnStartedAt
@@ -110,6 +118,21 @@ export interface SilencePokeState {
    * silence clock — a real reply / feed edit still does that; this only
    * gates the terminal teardown. */
   sawBashThisTurn: boolean
+  /**
+   * #4330: wall-clock ms of the last activity-card render (open or in-place
+   * edit) that actually LANDED on Telegram for this turn — the pinned
+   * "→ Working… · Nm · N tools" status card the user is watching. Stamped by
+   * `noteCardRender` from the card-drain transport site
+   * (`gateway/narrative-lane.ts` drainActivitySummary), which covers every
+   * producer: tool labels, narrative SHOWs, the liveness open, and the
+   * framework heartbeat climb. Deliberately NOT a clock reset — the heartbeat
+   * climb re-renders on pure wall clock, so a hung turn's card keeps
+   * "updating" and an unbounded reset would pin a dead turn forever (the
+   * #1556 class). Instead the tick() DEFERS the terminal fallback while the
+   * card moved within `CARD_RENDER_FRESH_MS`, bounded by
+   * `fallbackHardCeiling` exactly like the in-flight-tool / compaction
+   * defers. null until the first card render of the turn. */
+  lastCardRenderAt: number | null
   /**
    * #3519 sharpen: claude-CLI background shells PROVEN alive right now. A
    * shell is added on its launch marker (structured `backgroundTaskId`, via
@@ -153,6 +176,16 @@ export const DEFAULT_THRESHOLDS: ThresholdsMs = {
 
 export const DEFAULT_POLL_INTERVAL_MS = 5_000
 
+/**
+ * #4330 — how recent the last landed activity-card render must be for the
+ * card to count as "actively updating in front of the user". The framework
+ * heartbeat edits the card every ~6s (FEED_HEARTBEAT_MIN_STALE_MS); 30s
+ * tolerates several shed/coalesced cosmetic edits under flood-control
+ * backoff while still lapsing quickly once the card genuinely stops moving
+ * (turn ended → card cleared, or the drain wedged).
+ */
+export const CARD_RENDER_FRESH_MS = 30_000
+
 export interface FrameworkFallbackContext {
   key: string
   chatId: string
@@ -326,6 +359,7 @@ export function startTurn(key: string, now: number): void {
     fallbackFired: false,
     floorFired: false,
     inFlightTools: new Map(),
+    lastCardRenderAt: null,
     sawBashThisTurn: false,
     aliveShells: new Set(),
   })
@@ -397,6 +431,36 @@ export function noteProduction(key: string, now: number): void {
   s.fallbackFired = false
 }
 
+/**
+ * #4330: record an activity-card render (open or in-place edit) that actually
+ * LANDED on Telegram for `key` — the pinned "→ Working…" status card visibly
+ * moved. Called from the card-drain transport site
+ * (`gateway/narrative-lane.ts` drainActivitySummary) after a successful
+ * sendRichMessage / non-shed editMessageText, so it covers every card
+ * producer — tool labels, narrative SHOWs, the liveness open, AND the
+ * framework heartbeat climb (`feedHeartbeatTick`), which is exactly the path
+ * that has no `noteProduction` site.
+ *
+ * Deliberately does NOT reset the silence clock (`lastOutboundAt` untouched,
+ * `fallbackFired` untouched): the heartbeat climb renders on pure wall clock
+ * (`now - turn.startedAt`), so a genuinely hung turn's card keeps climbing
+ * forever — counting that as production would keep a dead turn alive
+ * indefinitely (the #1556 dangling-turn class the stream-render tool-label
+ * comment warns about). Instead, tick() DEFERS the terminal fallback while
+ * `now - lastCardRenderAt < CARD_RENDER_FRESH_MS`, bounded by
+ * `fallbackHardCeiling` — same semantics as the #1292/#3519/#4058 defers.
+ * Model-driven card progress (a NEW tool label, a foreground sub-agent nested
+ * render, a draft update) additionally resets the clock via the existing
+ * `noteProduction` sites; this stamp is the floor beneath them.
+ *
+ * No-op when the kill switch is on or the key has no live turn.
+ */
+export function noteCardRender(key: string, now: number): void {
+  const s = state.get(key)
+  if (s == null) return
+  s.lastCardRenderAt = now
+}
+
 /**
  * Record a `thinking` session event. Used to pick "still thinking…" vs
  * "still working…" wording for the 300s framework fallback.
@@ -801,6 +865,22 @@ function tick(now: number): void {
         // gated by SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS=0 — that flag
         // scopes the TOOL defers; compaction has no tool in flight.
         if (activeDeps.isCompactionInFlight?.(key) === true) continue
+        // #4330 — the pinned activity card is visibly updating. A card render
+        // (open or edit) landed on Telegram within CARD_RENDER_FRESH_MS, so
+        // the user is watching a live "→ Working… · Nm · N tools" surface —
+        // the "silent to the user" premise does not hold, and tearing the
+        // turn down would kill the very card they are watching, then re-ask
+        // their message under it. DEFER (clock untouched, fallbackFired
+        // unset, re-checked next tick), bounded by the enclosing
+        // `underCeiling` guard: the heartbeat climb keeps a hung turn's card
+        // moving on pure wall clock, so a truly wedged turn still unwedges at
+        // the hard ceiling. Like the #4058 compaction defer, deliberately NOT
+        // gated by SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS=0 — that flag
+        // scopes the TOOL defers; a card render is not a tool signal.
+        if (
+          s.lastCardRenderAt != null &&
+          now - s.lastCardRenderAt < CARD_RENDER_FRESH_MS
+        ) continue
         const forceDisable = process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS === '0'
         if (!forceDisable && activeDeps.isLegitimatelyWorking != null) {
           if (activeDeps.isLegitimatelyWorking(key)) continue

package/telegram-plugin/tests/boot-sweep-gate.test.ts

@@ -161,6 +161,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
         order.push('queued-cards')
       },
       enableSweep: () => order.push('enable-sweep'),
+      seedPruneSweepCursors: () => order.push('seed-prune'),
       sweepTarget: async (t) => {
         order.push(`sweep:${t.chatId}:${t.threadId ?? '-'}`)
       },
@@ -177,6 +178,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       'status-pins',
       'activity-cards',
       'queued-cards',
+      'seed-prune',
       'enable-sweep',
       'sweep:900000001:-',
     ])
@@ -194,6 +196,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       'scan',
       'status-pins',
       'queued-cards',
+      'seed-prune',
       'enable-sweep',
       'sweep:900000001:-',
     ])
@@ -210,7 +213,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       queuedCardReaper: boom,
     })
     await runBootPinSweepSteps(d.deps)
-    expect(d.order).toEqual(['scan', 'enable-sweep', 'sweep:900000001:-'])
+    expect(d.order).toEqual(['scan', 'seed-prune', 'enable-sweep', 'sweep:900000001:-'])
   })
 
   it('a failing store scan still lets the reapers and the DM enable run', async () => {
@@ -221,7 +224,13 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
     })
     await runBootPinSweepSteps(d.deps)
     // No targets to sweep, but nothing behind the scan is stranded.
-    expect(d.order).toEqual(['status-pins', 'activity-cards', 'queued-cards', 'enable-sweep'])
+    expect(d.order).toEqual([
+      'status-pins',
+      'activity-cards',
+      'queued-cards',
+      'seed-prune',
+      'enable-sweep',
+    ])
     expect(d.logs.join('')).toContain("step 'sweep-target-scan' failed: ENOENT")
   })
 
@@ -272,6 +281,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
           order.push('queued-cards')
         },
         enableSweep: () => order.push('enable-sweep'),
+        seedPruneSweepCursors: () => {},
         sweepTarget: async () => {},
         log: () => {
           throw new Error('EPIPE')
@@ -296,6 +306,9 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
         enableSweep: () => {
           throw new Error('boom')
         },
+        seedPruneSweepCursors: () => {
+          throw new Error('boom')
+        },
         sweepTarget: boom,
         log: () => {},
       }),

package/telegram-plugin/tests/silence-poke-card-render.test.ts

@@ -0,0 +1,300 @@
+/**
+ * #4330 — a visibly-updating pinned activity card must not be treated as
+ * silence by the 300s terminal fallback.
+ *
+ * The bug (user-reported, with screenshot): the framework fired the terminal
+ * unwedge — "⚠️ no output for 5 min — the framework ended that stalled turn"
+ * — on a HEALTHY turn whose pinned "→ Working… · Nm · N tools" status card
+ * WAS actively updating the whole time. The card edits are driven by
+ * `feedHeartbeatTick` (the 0-label climb / labelled-step elapsed re-render)
+ * through `drainActivitySummary`'s editMessageText, and that transport path
+ * had NO `noteProduction`/`noteOutbound` site — deliberately, because the
+ * heartbeat climbs on pure wall clock and an unbounded clock RESET would keep
+ * a genuinely hung turn alive forever (the #1556 class). So when every defer
+ * signal (in-flight tool, pending async dispatch, alive shells, compaction)
+ * read false at the 300s tick, the fallback tore down the very card the user
+ * was watching and re-asked their message.
+ *
+ * The fix: `drainActivitySummary` stamps `silencePoke.noteCardRender` on
+ * every card render that actually lands (open or non-shed edit); tick()
+ * DEFERS the terminal fallback while the last landed render is younger than
+ * `CARD_RENDER_FRESH_MS`, bounded by `fallbackHardCeiling` exactly like the
+ * #1292/#3519/#4058 defers. These tests drive the REAL tick loop (and, for
+ * the wiring case, the REAL narrative-lane transport) and assert outcomes:
+ *   - card renders arriving faster than the fresh window → NO fire past 300s;
+ *   - renders that keep coming forever → STILL fires at the hard ceiling
+ *     (a hung turn's heartbeat keeps climbing, so the net must stay bounded);
+ *   - a genuinely silent turn (no renders, no tool, no reply) → STILL fires
+ *     at 300s (the safety net is not disabled);
+ *   - renders that STOP → the fallback fires once silence ≥ threshold and
+ *     the last render has aged out (no unearned extension);
+ *   - wiring: a card edit through the REAL `createNarrativeLane` drain
+ *     defers the fallback for its status key.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { tmpdir } from 'node:os'
+import { createNarrativeLane } from '../gateway/narrative-lane.js'
+import type { CurrentTurn, NarrativeLaneDeps } from '../gateway/gateway.js'
+import * as silencePoke from '../silence-poke.js'
+import {
+  startTurn,
+  noteCardRender,
+  __tickForTests,
+  __setDepsForTests,
+  __getStateForTests,
+  __resetAllForTests,
+  DEFAULT_THRESHOLDS,
+  CARD_RENDER_FRESH_MS,
+  type SilencePokeMetric,
+  type FrameworkFallbackContext,
+  type ThresholdsMs,
+} from '../silence-poke.js'
+
+const HARD_CEILING = 900_000 // SILENCE_FALLBACK_HARD_MS default
+
+interface TestFixtures {
+  emitted: SilencePokeMetric[]
+  fallbacks: FrameworkFallbackContext[]
+}
+
+function setupDeps(opts?: { thresholdsMs?: ThresholdsMs }): TestFixtures {
+  const fixtures: TestFixtures = { emitted: [], fallbacks: [] }
+  __setDepsForTests({
+    emitMetric: (e) => fixtures.emitted.push(e),
+    onFrameworkFallback: (ctx) => { fixtures.fallbacks.push(ctx) },
+    thresholdsMs: opts?.thresholdsMs
+      ?? { ...DEFAULT_THRESHOLDS, fallbackHardCeiling: HARD_CEILING },
+    // Mirror production wiring: the callback path is active (liveness-wiring
+    // always wires isLegitimatelyWorking), returning false = "no tool work".
+    isLegitimatelyWorking: () => false,
+  })
+  return fixtures
+}
+
+beforeEach(() => {
+  __resetAllForTests()
+  delete process.env.SWITCHROOM_DISABLE_SILENCE_POKE
+  delete process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS
+})
+
+afterEach(() => {
+  __resetAllForTests()
+})
+
+describe('silence-poke — #4330 card-render defer (outcome)', () => {
+  it('a turn whose ONLY output is card renders faster than the fresh window is NOT torn down past 300s', () => {
+    const fx = setupDeps()
+    startTurn('chat:1', 0)
+    // The heartbeat edits the card every ~6s; simulate a card that keeps
+    // visibly updating for 10 minutes with no reply, no tool, no draft.
+    for (let t = 6_000; t <= 600_000; t += 6_000) {
+      noteCardRender('chat:1', t)
+      __tickForTests(t)
+    }
+    // Pre-fix this fired at the first tick with silence >= 300_000 — the
+    // exact "framework ended that stalled turn" false positive.
+    expect(fx.fallbacks).toHaveLength(0)
+    expect(fx.emitted).toHaveLength(0)
+  })
+
+  it('card renders that keep coming forever STILL fire the fallback at the hard ceiling (bounded defer)', () => {
+    const fx = setupDeps()
+    startTurn('chat:2', 0)
+    // A hung turn: the framework heartbeat keeps climbing the card on pure
+    // wall clock even though the model is dead. The defer must stay bounded.
+    let fired: number | null = null
+    for (let t = 6_000; t <= 1_200_000; t += 6_000) {
+      noteCardRender('chat:2', t)
+      __tickForTests(t)
+      if (fx.fallbacks.length > 0 && fired == null) fired = t
+    }
+    expect(fx.fallbacks).toHaveLength(1)
+    expect(fired).not.toBeNull()
+    expect(fired!).toBeGreaterThanOrEqual(HARD_CEILING)
+    // Fires promptly AT the ceiling, not some window after it.
+    expect(fired!).toBeLessThanOrEqual(HARD_CEILING + 6_000)
+  })
+
+  it('a genuinely silent turn (no card renders, no tool, no reply) STILL fires at 300s — the net is intact', () => {
+    const fx = setupDeps()
+    startTurn('chat:3', 0)
+    __tickForTests(299_000)
+    expect(fx.fallbacks).toHaveLength(0)
+    __tickForTests(300_000)
+    expect(fx.fallbacks).toHaveLength(1)
+    expect(fx.emitted.at(-1)).toMatchObject({ kind: 'silence_fallback_sent' })
+  })
+
+  it('card renders that STOP do not extend the window — fallback fires once the last render ages out', () => {
+    const fx = setupDeps()
+    startTurn('chat:4', 0)
+    // Card updated until t=100s (turn wedged after; heartbeat drain stuck /
+    // card torn down), then nothing.
+    for (let t = 6_000; t <= 100_000; t += 6_000) {
+      noteCardRender('chat:4', t)
+      __tickForTests(t)
+    }
+    // At 305s: silence (never reset by noteCardRender) is 305s >= 300s and
+    // the last render is 200s+ old — well past CARD_RENDER_FRESH_MS. Fires.
+    __tickForTests(305_000)
+    expect(fx.fallbacks).toHaveLength(1)
+    expect(fx.fallbacks[0]!.silenceMs).toBe(305_000)
+  })
+
+  it('noteCardRender never resets the silence clock or re-arms a fired fallback', () => {
+    setupDeps()
+    startTurn('chat:5', 0)
+    noteCardRender('chat:5', 250_000)
+    const s = __getStateForTests('chat:5')!
+    expect(s.lastOutboundAt).toBeNull() // clock untouched — defer only
+    expect(s.lastCardRenderAt).toBe(250_000)
+    expect(s.fallbackFired).toBe(false)
+  })
+})
+
+// ── wiring proof: the REAL narrative-lane card drain stamps the defer ─────
+
+const CHAT = '1001'
+
+function makeLane() {
+  const noop = () => {}
+  let nextId = 3000
+  const calls: Array<{ method: string }> = []
+  const api = {
+    sendRichMessage: async () => {
+      calls.push({ method: 'sendRichMessage' })
+      return { message_id: ++nextId }
+    },
+    editMessageText: async () => {
+      calls.push({ method: 'editMessageText' })
+      return {}
+    },
+    deleteMessage: async () => true,
+  }
+  const fakeEA = {
+    mayDrain: () => true,
+    openOrEditCard: (_p: string, fn: () => void) => fn(),
+    finalizeCard: (fn: () => void) => fn(),
+    markSubstantiveFinalDelivered: (fn: () => void) => fn(),
+  }
+  const deps = {
+    ACTIVITY_CARD_STORE_PATH: `${tmpdir()}/silence-card-render-activity-cards.json`,
+    CLEAR_STATUS_ON_COMPLETION: false,
+    FEED_HEARTBEAT_ENABLED: false,
+    FEED_HEARTBEAT_MIN_STALE_MS: 6000,
+    FEED_LIVENESS_OPEN_ENABLED: false,
+    FEED_LIVENESS_OPEN_MS: 5000,
+    PIN_STATUS_WHILE_WORKING: false,
+    POST_ANSWER_LIVENESS_STALE_MS: 90000,
+    STATIC: false,
+    activeDraftStreams: new Map(),
+    activityCardPersistEnabled: false,
+    activityCardStoreFs: { readFileSync: () => '', writeFileSync: noop, mkdirSync: noop, renameSync: noop, unlinkSync: noop },
+    bot: { api },
+    cardDrainGate: (_t: unknown, _ea: unknown, run: () => void) => run(),
+    currentTurnMap: { get: () => null, byKey: new Map() },
+    earlyLivenessOpenTimers: new Map(),
+    emissionAuthorityFor: () => fakeEA,
+    feedOpenGateDeps: () => ({ hasOutboundDeliveredSince: () => false, historyEnabled: false, finalAnswerMinChars: 200 }),
+    getCurrentTurn: () => null,
+    reconcileStatusPin: noop,
+    robustApiCall: (fn: () => Promise<unknown>) => fn(),
+    // Same key shape silence-poke is driven with below.
+    statusKey: (c: string, t?: number | null) => `${c}:${t ?? ''}`,
+  } as unknown as NarrativeLaneDeps
+  const lane = createNarrativeLane(deps)
+  return { lane, calls }
+}
+
+function makeLaneTurn(lane: ReturnType<typeof createNarrativeLane>): CurrentTurn {
+  const turn = {
+    turnId: 'turn-card-render-1',
+    sessionChatId: CHAT,
+    sessionThreadId: undefined,
+    sourceMessageId: null,
+    registryKey: null,
+    startedAt: Date.now() - 3000,
+    currentModel: null,
+    totalTokens: 0,
+    labeledToolCount: 0,
+    mirrorLines: [] as string[],
+    foregroundSubAgents: new Map<string, string[]>(),
+    activityPendingRender: null as string | null,
+    activityLastSentRender: null as string | null,
+    activityMessageId: null as number | null,
+    activityInFlight: null as Promise<void> | null,
+    activityEverOpened: false,
+    activityDrainFailures: 0,
+    finalAnswerEverDelivered: false,
+    finalAnswerDelivered: false,
+    replyCalled: false,
+    capturedText: [] as string[],
+    lastReplyText: '',
+    answerStream: null,
+    liveness: { recentlyStreaming: () => false, onStreamEvent: () => {}, note: () => {} },
+  } as unknown as CurrentTurn
+  ;(turn as { narrativeGate?: unknown }).narrativeGate = lane.makeNarrativeGate(turn)
+  return turn
+}
+
+describe('silence-poke — #4330 wiring: the REAL card drain defers the fallback', () => {
+  it('a card render landed through drainActivitySummary defers a due fallback; without it the fallback fires', async () => {
+    const key = `${CHAT}:`
+    const now = Date.now()
+    // Real wall clock end-to-end: tiny fallback threshold, real
+    // CARD_RENDER_FRESH_MS (the lane stamps Date.now()).
+    const fx = setupDeps({
+      thresholdsMs: { fallback: 1_000, fallbackHardCeiling: HARD_CEILING },
+    })
+
+    // Control first: a turn past the threshold with NO card render fires.
+    startTurn(key, now - 5_000)
+    __tickForTests(now)
+    expect(fx.fallbacks).toHaveLength(1)
+
+    // Now the same shape, but a card render lands through the REAL lane
+    // transport before the tick — the fallback must be deferred.
+    __resetAllForTests()
+    const fx2 = setupDeps({
+      thresholdsMs: { fallback: 1_000, fallbackHardCeiling: HARD_CEILING },
+    })
+    startTurn(key, Date.now() - 5_000)
+    const { lane, calls } = makeLane()
+    const turn = makeLaneTurn(lane)
+    lane.showNarrativeStep(turn, 'Compiling the release notes')
+    await turn.activityInFlight
+    expect(calls.filter((c) => c.method === 'sendRichMessage')).toHaveLength(1)
+    const st = __getStateForTests(key)!
+    expect(st.lastCardRenderAt).not.toBeNull() // the drain stamped it
+    __tickForTests(Date.now())
+    expect(fx2.fallbacks).toHaveLength(0) // deferred: the card just moved
+
+    // And the defer stays bounded: past the hard ceiling it fires anyway,
+    // even with a render landed inside the fresh window at fire time.
+    const tFinal = Date.now() + HARD_CEILING + CARD_RENDER_FRESH_MS
+    noteCardRender(key, tFinal - 1_000) // card still "moving" at the ceiling
+    __tickForTests(tFinal)
+    expect(fx2.fallbacks).toHaveLength(1)
+  })
+})
+
+// ── structural: progress_update (a model-driven user-visible send inside the
+//    gateway IIFE, not instantiable in-process — same pattern as
+//    silence-liveness-wiring.test.ts) must reset the silence clock ──────────
+
+describe('silence-poke — #4330 progress_update liveness wiring (structural)', () => {
+  it('the progress_update handler calls silencePoke.noteOutbound after the send lands', () => {
+    const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
+    const start = "if (!args.chat_id) throw new Error('progress_update: chat_id is required')"
+    const end = '`ask_user` MCP tool'
+    const block = (gatewaySrc.split(start)[1] ?? '').split(end)[0] ?? ''
+    expect(block.length).toBeGreaterThan(100) // sanity: slice found the handler
+    // A progress_update is a fresh user-visible outbound the model authored —
+    // it must reset the 300s silence clock exactly like a reply send does
+    // (outbound-send-path.ts). Pre-#4330 only signalTracker was ticked, so a
+    // turn narrating solely via progress_update was torn down as "silent".
+    expect(block).toMatch(/silencePoke\.noteOutbound\(key, Date\.now\(\)\)/)
+  })
+})