switchroom 0.20.7 → 0.20.8

package/telegram-plugin/gateway/gateway.ts

@@ -660,7 +660,7 @@ import { handleRequestMs365Approval } from './ms365-write-approval.js'
 import { buildDiffPreviewCard } from './diff-preview-card.js'
 import { createPendingInboundBuffer, redeliverBufferedInbound, idleDrainTick } from './pending-inbound-buffer.js'
 import { makeRepresentRedeliveryGuard, makeSessionBusyDrainDeferral } from './represent-delivery-guard.js'
-import { isCronIdentity, isCronInjectFire, deliverInjectWithFallback, replyCallerIsForeignSession } from './cron-session.js'
+import { isCronIdentity, isCronInjectFire, deliverInjectWithFallback, replyCallerIsForeignSession, drainCronBridgeOnRegister } from './cron-session.js'
 import {
   ObligationLedger,
   obligationEscalationText,
@@ -857,7 +857,7 @@ import {
   resolvePersonaName, shouldSkipDuplicateBootCard,
   type BootCardHandle, type RestartReason,
 } from './boot-card.js'
-import { determineRestartReason } from './boot-reason.js'
+import { determineRestartReason, determineBridgeReconnectReason } from './boot-reason.js'
 import { maybeRenderUpdateAnnouncement } from './update-announce.js'
 import { createIssuesCardHandle, type IssuesCardHandle } from '../issues-card.js'
 import { startIssuesWatcher, type IssuesWatcherHandle } from '../issues-watcher.js'
@@ -9163,6 +9163,8 @@ let activeBootCard: BootCardHandle | null = null
 // dedupe checks this so it can't race against the boot path's await.
 // See issue #489 (klanker msgId 4715 + 4716, 2026-05-01 10:13:15).
 let bootCardPending = false
+// Boot-determined restart reason — see determineBridgeReconnectReason (B2).
+let bootReasonAtStartup: RestartReason | null = null
 
 // Issues card (#428) — pinned per-agent surface listing current
 // unresolved entries from the issue sink (#425). Idempotent across
@@ -10366,17 +10368,13 @@ if (isGatewayMain) ipcServer = createIpcServer({
 
   onClientRegistered(client: IpcClient) {
     process.stderr.write(`telegram gateway: bridge registered — agent=${client.agentName}\n`)
-    // Cheap-cron (§2.4/§3.3): a `<agent>-cron` bridge is the Tier-1 cheap
-    // session. It is STATUS-SILENT — it must NOT drive the gateway's
-    // singleton machinery (shadow bridge-state, warmup, boot card, which all
-    // track the MAIN agent's liveness). Drain any buffered cron fire to it
-    // (so a fire that triggered a lazy spawn lands), then return early.
+    // Cheap-cron (§2.4/§3.3): a `<agent>-cron` bridge is the Tier-1 cheap,
+    // STATUS-SILENT session — it must NOT drive the gateway's singleton
+    // machinery. Drain any boot-window cron fire to it, then return early.
+    // #4348: the drain routes through `redeliverBufferedInbound` (the shared
+    // ack chokepoint) so a spooled fire is acked and never re-fires on restart.
     if (isCronIdentity(client.agentName)) {
-      client.send({ type: 'status', status: 'agent_connected' })
-      const pending = pendingInboundBuffer.drain(client.agentName ?? '')
-      for (const m of pending) {
-        try { client.send(m) } catch { /* cron fire drop — best-effort, like today's cron */ }
-      }
+      drainCronBridgeOnRegister(client, pendingInboundBuffer, inboundSpool ?? undefined, (l) => process.stderr.write(l))
       return
     }
     // Phase 2b shadow: ONLY emit bridgeUp for the REAL bridge sidecar
@@ -10450,15 +10448,12 @@ if (isGatewayMain) ipcServer = createIpcServer({
       })
     }
 
-    // If the agent reconnected after a /restart (or any restart), post a boot
-    // card. The restart-marker carries the ack chat; if absent we fall back to
-    // resolveBootChatId so crash-recovery reconnects also get a card.
-    //
-    // Skip if the boot path already posted a card OR is currently in-flight
-    // on its sendMessage await (issue #489 — klanker msgId 4715+4716,
-    // 2026-05-01). The original dedupe (msgId 2245+2248, 2026-04-26) only
-    // covered the post-resolution case; bootCardPending closes the in-flight
-    // race window. See `shouldSkipDuplicateBootCard`.
+    // If the agent reconnected after a restart, post a boot card. The
+    // restart-marker carries the ack chat; else fall back to resolveBootChatId
+    // so crash-recovery reconnects also get a card. Skip if the boot path
+    // already posted a card OR its sendMessage is in-flight (issue #489,
+    // klanker 2026-05-01; earlier dedupe 2026-04-26 only covered the
+    // post-resolution case). See `shouldSkipDuplicateBootCard`.
     const dedupeDecision = shouldSkipDuplicateBootCard({ activeBootCard, bootCardPending }, 'bridge-reconnect')
     if (dedupeDecision.skip) {
       process.stderr.write(`telegram gateway: bridge-reconnect: skipping boot card (${dedupeDecision.reason})\n`)
@@ -10475,7 +10470,9 @@ if (isGatewayMain) ipcServer = createIpcServer({
         clearRestartMarker()
       }
 
-      const reason = determineRestartReason({ marker, cleanMarker, sessionMarker: storedSession, now: nowMs })
+      // B2: boot path cleared the markers — reuse its reason (boot-reason.ts).
+      const reason = determineBridgeReconnectReason({ marker, cleanMarker, sessionMarker: storedSession,
+        now: nowMs, gatewayStartedAtMs: GATEWAY_STARTED_AT_MS, bootReason: bootReasonAtStartup })
       const target = resolveBootChatId(marker, markerAgeMs)
 
       if (target) {
@@ -11760,7 +11757,9 @@ const IDLE_DRAIN_INTERVAL_MS = 5000
 // while the CLI is still producing the answer; draining a represent into that busy
 // session re-queues it BEHIND the real reply → a duplicate. Defer while busy,
 // bounded so a wedged session still drains (F1 then retracts it post-reply).
-const idleDrainBusyDefer = makeSessionBusyDrainDeferral(OBLIGATION_BACKGROUND_WORK_GRACE_MS)
+// staleGap = 3 poll intervals: a longer gap between busy consultations means the
+// buffer drained via a non-idle path so the next one is a NEW episode (#4341 f/u).
+const idleDrainBusyDefer = makeSessionBusyDrainDeferral(OBLIGATION_BACKGROUND_WORK_GRACE_MS, IDLE_DRAIN_INTERVAL_MS * 3)
 if (isGatewayMain && !STATIC) {
   setInterval(() => {
     const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? ''
@@ -23490,15 +23489,14 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
           } else {
             const markerAgeMs = marker ? nowMs - marker.ts : undefined
             const reason = determineRestartReason({ marker, cleanMarker, sessionMarker: storedSession, now: nowMs })
+            // Markers were cleared above — stash for bridge re-register (B2).
+            bootReasonAtStartup = reason
             const target = resolveBootChatId(marker, markerAgeMs)
 
-            // Issue #92: when reason='crash' AND no chat is resolvable,
-            // the gateway used to silently skip — the only signal a user
-            // got was their next message landing on a fresh process. Now
-            // we always surface unplanned crashes via the operator-events
-            // pipeline, which broadcasts to access.allowFrom (same path
-            // permission requests use). The pipeline's per-agent per-kind
-            // cooldown protects against crash loops spamming the chat.
+            // Issue #92: when reason='crash' AND no chat is resolvable, the
+            // gateway used to silently skip. Always surface unplanned crashes
+            // via the operator-events pipeline (broadcasts to access.allowFrom;
+            // its per-agent per-kind cooldown absorbs crash loops).
             if (reason === 'crash') {
               const cleanMarkerStale = cleanMarker
                 ? !shouldSuppressRecoveryBanner(cleanMarker, nowMs, CLEAN_SHUTDOWN_MAX_AGE_MS)

package/telegram-plugin/gateway/narrative-lane.ts

@@ -56,6 +56,7 @@ import {
   appendActivityLabel, clipNarrative, formatStepSuffix, renderActivityFeedWithNested,
 } from '../tool-activity-summary.js'
 import { evaluatePostAnswerLiveness } from '../turn-liveness-floor.js'
+import { isSilentSentinelCardOutcome } from '../turn-flush-safety.js'
 import { clearActivityCardRecord, writeActivityCardRecord } from './activity-card-store.js'
 import { chatKeyWithSuffix } from './chat-key.js'
 import {
@@ -880,7 +881,26 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
       // before the delete. turn-end stays the idempotent backstop: it no-ops
       // once nothing is claimed for the key.
       await reconcileStatusPin(`fg:${statusKey(chat, thread)}`, chat, { pinned: false })
-      if (CLEAR_STATUS_ON_COMPLETION) {
+      // #4348 — silent-sentinel suppression. A turn whose entire user-facing
+      // outcome is a bare NO_REPLY / HEARTBEAT_OK (the sentinel-reply-guard
+      // dropped a sentinel-only reply, or the flush safety net classified the
+      // captured text as silent) said nothing to the user, so its activity/
+      // telemetry card is pure noise — most visibly on the forced-synthesis
+      // handback turns a background sub-agent injects. DELETE the card rather
+      // than finalizing a visible `done · … · ✓ NO_REPLY` record. Deterministic
+      // (reuses the shared `turn-flush-safety` silent predicates, no model
+      // behaviour) and normal-case-safe (`finalAnswerEverDelivered` keeps every
+      // card for a turn that actually delivered a substantive answer). The
+      // `finalHtmlOverride` finalize path is only taken by the foreground
+      // handoff-clear, which fires on a delivered final answer — so this gate
+      // never contends with it.
+      const silentSentinelTurn = isSilentSentinelCardOutcome({
+        replyCalled: turn.replyCalled,
+        lastReplyText: turn.lastReplyText,
+        capturedText: turn.capturedText,
+        finalAnswerEverDelivered: turn.finalAnswerEverDelivered,
+      })
+      if (CLEAR_STATUS_ON_COMPLETION || silentSentinelTurn) {
         try {
           await robustApiCall(
             () => bot.api.deleteMessage(chat, id),

package/telegram-plugin/gateway/represent-delivery-guard.ts

@@ -137,19 +137,50 @@ export function makeRepresentRedeliveryGuard(
  * ordinary busy turn (which ends well within the bound) defers cleanly and never
  * consumes the wedge budget.
  *
+ * Episode isolation (#4341 follow-up): `deferringSince` used to reset ONLY on a
+ * `busy=false` call, but the predicate is not consulted on every drain path. When
+ * a buffer is emptied by a bridge re-register (`onClientRegistered`) while the
+ * session is still busy, the idle-drain gate is never invoked with `busy=false`,
+ * so `deferringSince` stays pinned at the old t0. A later, UNRELATED deferral
+ * episode then computes `now - t0 >= boundMs` immediately and drains a represent
+ * into a mid-answer session — reopening the duplicate window this guard closes.
+ * Fix: a fresh deferral episode also starts the clock at `now` when the predicate
+ * has not been consulted within `staleGapMs`. The idle-drain gate polls on a
+ * fixed short interval while (and only while) the buffer is non-empty, so a gap
+ * between consecutive consultations longer than a few poll intervals means the
+ * prior episode's buffer drained via a non-idle path and this is a new episode.
+ *
  * `boundMs <= 0` disables the busy-defer entirely (kill switch / parity with the
- * background-work grace being disabled).
+ * background-work grace being disabled). `staleGapMs <= 0` disables the
+ * gap-based episode reset (leaving only the `busy=false` reset).
  */
+export const DEFAULT_DRAIN_DEFER_STALE_GAP_MS = 15_000
+
 export function makeSessionBusyDrainDeferral(
   boundMs: number,
+  staleGapMs: number = DEFAULT_DRAIN_DEFER_STALE_GAP_MS,
 ): (busy: boolean, now: number) => boolean {
   let deferringSince: number | null = null
+  let lastCallAt: number | null = null
   return (busy, now) => {
+    const gapSinceLastCall = lastCallAt == null ? null : now - lastCallAt
+    lastCallAt = now
     if (!busy || boundMs <= 0) {
       deferringSince = null
       return false
     }
-    if (deferringSince == null) deferringSince = now
+    // Start (or restart) the clock at the top of a NEW deferral episode:
+    //   - we were not deferring (deferringSince cleared by a busy=false call), OR
+    //   - the predicate has not been consulted within staleGapMs, which means the
+    //     prior episode's buffer drained via a path that never calls us with
+    //     busy=false (bridge re-register) and left deferringSince pinned at a
+    //     stale t0. Either way a fresh episode's bound must run from `now`.
+    if (
+      deferringSince == null ||
+      (staleGapMs > 0 && gapSinceLastCall != null && gapSinceLastCall > staleGapMs)
+    ) {
+      deferringSince = now
+    }
     // Bounded: stop deferring once we have been busy past the ceiling, so a
     // wedged/hung session still eventually drains the buffered represent.
     return now - deferringSince < boundMs

package/telegram-plugin/gateway/stream-render.ts

@@ -1138,8 +1138,17 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
       }
       if (QUEUED_CARD_ENABLED && !handbackOwnsSurface) {
         const cardChatId = ev.chatId
-        const replyToRaw = ev.messageId != null ? Number(ev.messageId) : null
-        const replyTo = replyToRaw != null && Number.isFinite(replyToRaw) ? replyToRaw : null
+        // Reply-anchor ONLY to a plausible real Telegram message id. Synthetic
+        // enqueues (subagent handback, boot resume, cron) fabricate `messageId`
+        // from `Date.now()` (~1.78e13) — finite, so a bare `Number.isFinite`
+        // guard passes it, but `reply_parameters.message_id` hard-rejects
+        // anything beyond signed int32 with 400 `field "message_id" must be a
+        // valid Number` (`allow_sending_without_reply` does NOT bypass the
+        // range check), killing the whole card send (overlord
+        // gateway-supervisor.log 2026-08-04, e.g. msg=1785846295635). Same bug
+        // class as the resume-dark-feed incident — reuse its guard, don't
+        // re-derive a weaker one. An unanchored card is fine; no card is not.
+        const replyTo = parseSourceMessageId(ev.messageId)
         void openQueuedCard(deps, cardChatId, enqThreadIdNum ?? null, replyTo).then((cardId) => {
           if (cardId == null) return
           // Still parked → adopt on the next dequeue. Otherwise the entry already

package/telegram-plugin/tests/boot-card-reason.test.ts

@@ -164,3 +164,91 @@ describe('determineRestartReason', () => {
     expect(result).toBe('crash')
   })
 })
+
+// ── determineBridgeReconnectReason (fleet-audit B2) ────────────────────────
+//
+// Live trace this pins (kdogg gateway-supervisor.log, 2026-08-02):
+//   06:27:43  shutdown.clean_marker_written reason="cli: restart"
+//   06:27:46  boot.clean_shutdown_detected → boot path logs reason=graceful
+//             …and CLEARS the clean-shutdown marker (2026-05-25 GC)
+//   06:27:55  surviving bridge re-registers → old code re-derived from the
+//             now-empty disk and logged reason=crash for a graceful restart.
+// Fleet-wide: lawgpt 310 / reggie 179 / ziggy 175 / kdogg 174 such lines.
+
+import { determineBridgeReconnectReason } from '../gateway/boot-reason.js'
+
+describe('determineBridgeReconnectReason', () => {
+  it('reuses the boot-determined reason when the boot path consumed the markers (kdogg 2026-08-02 trace)', () => {
+    const result = determineBridgeReconnectReason({
+      marker: null,               // cleared by the boot path
+      cleanMarker: null,          // cleared by the boot path
+      sessionMarker: sessionMarker(),
+      now: NOW,
+      gatewayStartedAtMs: NOW - 10_000, // bridge re-registered 10s after boot
+      bootReason: 'graceful',
+    })
+    // Old behavior (plain determineRestartReason on the empty disk state)
+    // returned 'crash' here — the B2 mislabel.
+    expect(result).toBe('graceful')
+  })
+
+  it('a still-present fresh restart marker wins over the cached boot reason', () => {
+    const result = determineBridgeReconnectReason({
+      marker: recentMarker(10_000),
+      cleanMarker: null,
+      sessionMarker: sessionMarker(),
+      now: NOW,
+      gatewayStartedAtMs: NOW - 10_000,
+      bootReason: 'graceful',
+    })
+    expect(result).toBe('planned')
+  })
+
+  it('a still-present fresh clean-shutdown marker wins over the cached boot reason', () => {
+    const result = determineBridgeReconnectReason({
+      marker: null,
+      cleanMarker: recentCleanMarker(5_000),
+      sessionMarker: sessionMarker(),
+      now: NOW,
+      gatewayStartedAtMs: NOW - 10_000,
+      bootReason: 'crash',
+    })
+    expect(result).toBe('graceful')
+  })
+
+  it('late re-register (gateway up past the reuse window) still classifies as crash', () => {
+    const result = determineBridgeReconnectReason({
+      marker: null,
+      cleanMarker: null,
+      sessionMarker: sessionMarker(),
+      now: NOW,
+      gatewayStartedAtMs: NOW - 6 * 60_000, // gateway alive 6 min — bridge side died
+      bootReason: 'graceful',
+    })
+    expect(result).toBe('crash')
+  })
+
+  it('no recorded boot reason falls back to the plain derivation', () => {
+    const result = determineBridgeReconnectReason({
+      marker: null,
+      cleanMarker: null,
+      sessionMarker: sessionMarker(),
+      now: NOW,
+      gatewayStartedAtMs: NOW - 10_000,
+      bootReason: null,
+    })
+    expect(result).toBe('crash')
+  })
+
+  it('fresh first boot (no session marker) reuses bootReason fresh', () => {
+    const result = determineBridgeReconnectReason({
+      marker: null,
+      cleanMarker: null,
+      sessionMarker: null,
+      now: NOW,
+      gatewayStartedAtMs: NOW - 3_000,
+      bootReason: 'fresh',
+    })
+    expect(result).toBe('fresh')
+  })
+})

package/telegram-plugin/tests/cron-bridge-drain-spool-ack.test.ts

@@ -0,0 +1,150 @@
+/**
+ * #4348 — the Tier-1 cheap-cron bridge-register drain must route through the
+ * shared `redeliverBufferedInbound` chokepoint so a delivered cron fire is
+ * `spool.ack`'d exactly once and CANNOT re-fire after a restart.
+ *
+ * The bug: `onClientRegistered`'s `<agent>-cron` branch did a raw
+ * `pendingInboundBuffer.drain()` + `client.send()` loop and returned early,
+ * never reaching `spool.ack` (which lives only inside
+ * `redeliverBufferedInbound`). A due cron tick spooled during the boot window
+ * (before the cron bridge registered) stayed live in the durable spool, so
+ * boot-replay re-pushed it on the next restart and the SAME fire was delivered
+ * a second time — a duplicate cron delivery bounded only by the 15-min
+ * escalation sweep.
+ *
+ * These tests assert the OUTCOME on the real drain seam
+ * (`drainCronBridgeOnRegister`), against a REAL spool + buffer:
+ *   1. the boot-window fire is delivered to the cron bridge, AND
+ *   2. its durable spool entry is acked (liveCount → 0), AND
+ *   3. a simulated restart's boot-replay finds nothing to re-push, so the fire
+ *      does NOT re-fire.
+ *
+ * RED-before-GREEN: with the pre-#4348 raw-drain body the fire is delivered but
+ * the spool entry stays live, so assertions (2)+(3) fail. With the fix routing
+ * through `redeliverBufferedInbound` they pass.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  createInboundSpool,
+  type InboundSpoolFsSeam,
+  type InboundSpool,
+} from '../gateway/inbound-spool.js'
+import { createPendingInboundBuffer } from '../gateway/pending-inbound-buffer.js'
+import { drainCronBridgeOnRegister, cronIdentity } from '../gateway/cron-session.js'
+import type { InboundMessage } from '../gateway/ipc-protocol.js'
+
+const SPOOL_PATH = '/state/agent/telegram/inbound-spool.jsonl'
+
+/** In-memory fake fs for the spool — models append + atomic-rename compaction.
+ *  Shared across "restarts" so the durable JSONL survives, exactly like the
+ *  persistent per-agent volume. */
+function fakeFs(): InboundSpoolFsSeam {
+  const files = new Map<string, string>()
+  return {
+    appendFileSync: (p, d) => files.set(p, (files.get(p) ?? '') + d),
+    readFileSync: (p) => files.get(p) ?? '',
+    writeFileSync: (p, d) => files.set(p, d),
+    renameSync: (from, to) => {
+      files.set(to, files.get(from) ?? '')
+      files.delete(from)
+    },
+    existsSync: (p) => files.has(p),
+    statSizeSync: (p) => Buffer.byteLength(files.get(p) ?? ''),
+    fsyncFileSync: () => {},
+    fsyncDirSync: () => {},
+  }
+}
+
+function cronFire(over: Partial<InboundMessage> = {}): InboundMessage {
+  return {
+    type: 'inbound',
+    chatId: 'c1',
+    messageId: 0, // synthetic — cron fires carry no Telegram messageId
+    user: 'system',
+    userId: 0,
+    ts: 1000,
+    text: 'Time for the daily digest',
+    meta: { source: 'cron', session: 'cron' },
+    ...over,
+  } as InboundMessage
+}
+
+/** A capturing stand-in for the just-registered cron IPC client. */
+function fakeClient(agentName: string): {
+  agentName: string
+  send: (msg: unknown) => void
+  sent: unknown[]
+} {
+  const sent: unknown[] = []
+  return { agentName, send: (m) => void sent.push(m), sent }
+}
+
+/** Simulate the gateway's boot-replay: re-push every live (un-acked) spool
+ *  entry into a fresh in-memory buffer, exactly as gateway.ts does at boot. */
+function bootReplayInto(spool: InboundSpool): ReturnType<typeof createPendingInboundBuffer> {
+  const buffer = createPendingInboundBuffer({ log: () => {}, spool })
+  for (const { agent, msg } of spool.liveEntries()) buffer.push(agent, msg)
+  return buffer
+}
+
+describe('#4348 cron-bridge drain routes through the spool-ack chokepoint', () => {
+  it('acks the boot-window cron fire and does not re-fire after restart', () => {
+    const fs = fakeFs()
+    const spool = createInboundSpool({ path: SPOOL_PATH, fs, log: () => {} })
+    const cronAgent = cronIdentity('overlord') // "overlord-cron"
+
+    // Boot window: a due cron tick arrives BEFORE the cron bridge registers.
+    // It is buffered (in-memory) AND durably spooled by the same push.
+    const buffer = createPendingInboundBuffer({ log: () => {}, spool })
+    buffer.push(cronAgent, cronFire())
+    expect(spool.liveCount()).toBe(1) // durably recorded, not yet delivered
+
+    // The cron bridge registers → the drain seam under test runs.
+    const client = fakeClient(cronAgent)
+    const result = drainCronBridgeOnRegister(client, buffer, spool)
+
+    // (1) The fire was delivered to the cron bridge.
+    expect(result.drained).toBe(1)
+    expect(result.redelivered).toBe(1)
+    const deliveredFires = client.sent.filter(
+      (m): m is InboundMessage => (m as InboundMessage).type === 'inbound',
+    )
+    expect(deliveredFires).toHaveLength(1)
+    expect(deliveredFires[0]!.text).toBe('Time for the daily digest')
+
+    // (2) The durable spool entry is tombstoned — the whole point of #4348.
+    expect(spool.liveCount()).toBe(0)
+    expect(spool.liveEntries()).toHaveLength(0)
+
+    // (3) Simulated restart: boot-replay finds nothing to re-push, so the SAME
+    //     fire does NOT re-fire. (Pre-fix this replayed the un-acked entry.)
+    const afterRestart = bootReplayInto(spool)
+    expect(afterRestart.drain(cronAgent)).toHaveLength(0)
+  })
+
+  it('a send failure re-buffers the fire and leaves the spool entry live (lossless)', () => {
+    const fs = fakeFs()
+    const spool = createInboundSpool({ path: SPOOL_PATH, fs, log: () => {} })
+    const cronAgent = cronIdentity('overlord')
+
+    const buffer = createPendingInboundBuffer({ log: () => {}, spool })
+    buffer.push(cronAgent, cronFire())
+
+    // Client whose send throws for inbound fires (bridge wedged mid-drain).
+    const throwing = {
+      agentName: cronAgent,
+      send: (m: unknown) => {
+        if ((m as InboundMessage).type === 'inbound') throw new Error('socket gone')
+      },
+    }
+    const result = drainCronBridgeOnRegister(throwing, buffer, spool)
+
+    // Not delivered → re-buffered, and the spool entry stays LIVE so the next
+    // register (or boot-replay) retries it. Nothing is dropped, nothing acked.
+    expect(result.redelivered).toBe(0)
+    expect(result.rebuffered).toBe(1)
+    expect(spool.liveCount()).toBe(1)
+    expect(buffer.drain(cronAgent)).toHaveLength(1)
+  })
+})

package/telegram-plugin/tests/ipc-client-reconnect-rejection.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Regression test for fleet-audit B2 — the bridge's background reconnect
+ * loop must never surface a failed connect attempt as a process-level
+ * unhandledRejection.
+ *
+ * Live evidence (kdogg, 2026-07-17):
+ *   bridge-crash.log: `unhandledRejection … Error: Failed to connect
+ *     | at doConnect (dist/server.js:24188) …`
+ *
+ * Mechanism: `scheduleReconnect()`'s timer invoked `doConnect()` without a
+ * rejection handler. `doConnect` returns a promise that REJECTS whenever
+ * the `Bun.connect` attempt fails (gateway restarting out from under a
+ * long-lived bridge — the exact window every planned `docker restart`
+ * opens). The initial-connect call sites attach a `.catch`; the retry
+ * timer did not, so every failed background retry escaped as an
+ * unhandledRejection. Pre-#3033 that killed the bridge process outright
+ * (Claude Code never respawns a dead MCP server → mute agent); post-#3033
+ * it still spams `bridge-crash.log` with pseudo-crash breadcrumbs and
+ * leans on a global process handler for survival.
+ *
+ * Outcome asserted: with nothing listening on the socket path, the client
+ * runs through its initial attempt AND several background retries without
+ * a single unhandledRejection reaching the process. RED without the
+ * `.catch` in scheduleReconnect's timer, GREEN with it.
+ *
+ * Run with: bun test telegram-plugin/tests/ipc-client-reconnect-rejection.test.ts
+ */
+import { describe, it, expect } from "bun:test";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createIpcClient } from "../bridge/ipc-client.js";
+
+describe("ipc-client background reconnect", () => {
+  it("a failed reconnect attempt never escapes as a process-level unhandledRejection", async () => {
+    const captured: unknown[] = [];
+    const onUnhandled = (err: unknown) => {
+      captured.push(err);
+    };
+    process.on("unhandledRejection", onUnhandled);
+
+    // Nothing listens here — every connect attempt fails, exercising both
+    // the (already-handled) initial attempt and the retry-timer path.
+    const socketPath = join(tmpdir(), `ipc-b2-${crypto.randomUUID()}.sock`);
+
+    const handle = await createIpcClient({
+      socketPath,
+      agentName: "b2-test",
+      onInbound: () => {},
+      onPermission: () => {},
+      onStatus: () => {},
+      log: () => {},
+      reconnectDelayMs: 15,
+      maxReconnectDelayMs: 30,
+    });
+
+    try {
+      // Long enough for several background retries (15ms, 30ms, 30ms, …)
+      // plus the macrotask on which unhandledRejection is delivered.
+      await new Promise((resolve) => setTimeout(resolve, 300));
+    } finally {
+      handle.close();
+      // Give any in-flight rejection its delivery tick before detaching.
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      process.off("unhandledRejection", onUnhandled);
+    }
+
+    expect(handle.isConnected()).toBe(false);
+    expect(captured).toEqual([]);
+  });
+});

package/telegram-plugin/tests/narrative-lane-golden.test.ts

@@ -282,6 +282,92 @@ describe('narrative-lane golden — clearActivitySummary finalize', () => {
   })
 })
 
+// ── #4348 — silent-sentinel activity card is SUPPRESSED (deleted, not finalized) ─
+// A turn whose entire user-facing outcome is a bare NO_REPLY / HEARTBEAT_OK
+// (the sentinel-reply-guard dropped the sentinel-only reply, or the flush net
+// classified the captured text as silent) must leave NO visible telemetry card
+// in the chat — most visibly on the forced-synthesis handback turns a
+// background sub-agent injects. A real reply's card must still finalize.
+describe('narrative-lane golden — silent-sentinel card suppression (#4348)', () => {
+  // Open the feed card on a fresh (working) turn FIRST — the card-open gate
+  // (mayOpenActivityCard) won't open one once the answer is already delivered —
+  // then stamp the turn's terminal outcome, exactly as the real turn does:
+  // the card opens mid-work, and lastReplyText / finalAnswerEverDelivered are
+  // only known at turn end.
+  async function openThenClear(over: Partial<CurrentTurn>) {
+    const { lane, calls } = makeLane()
+    const turn = makeLaneTurn(lane)
+    lane.showNarrativeStep(turn, 'Doing the work now')
+    await turn.activityInFlight
+    const cardId = turn.activityMessageId
+    expect(cardId).not.toBeNull()
+    Object.assign(turn, over)
+    lane.clearActivitySummary(turn)
+    await settle()
+    return { calls, cardId, turn }
+  }
+
+  it('reply("NO_REPLY") turn: DELETES the card, never edits a done record', async () => {
+    // The guard drops the sentinel-only reply before chat, but the blocked
+    // tool_use still stamps lastReplyText — the exact `✓ NO_REPLY` noise card.
+    const { calls, cardId, turn } = await openThenClear({
+      replyCalled: true,
+      lastReplyText: 'NO_REPLY',
+      finalAnswerEverDelivered: false,
+    })
+    expect(calls.filter((c) => c.method === 'deleteMessage' && c.message_id === cardId)).toHaveLength(1)
+    expect(calls.filter((c) => c.method === 'editMessageText' && c.message_id === cardId)).toHaveLength(0)
+    expect(turn.activityMessageId).toBeNull()
+  })
+
+  it('HEARTBEAT_OK. (trailing punctuation, case-insensitive) is also suppressed', async () => {
+    const { calls, cardId } = await openThenClear({
+      replyCalled: true,
+      lastReplyText: 'heartbeat_ok.',
+      finalAnswerEverDelivered: false,
+    })
+    expect(calls.filter((c) => c.method === 'deleteMessage' && c.message_id === cardId)).toHaveLength(1)
+    expect(calls.filter((c) => c.method === 'editMessageText' && c.message_id === cardId)).toHaveLength(0)
+  })
+
+  it('flush path (no reply): prose + trailing NO_REPLY (H6/#2053) is suppressed', async () => {
+    const { calls, cardId } = await openThenClear({
+      replyCalled: false,
+      lastReplyText: '',
+      capturedText: ["Nothing actionable in today's digest.", 'NO_REPLY'],
+      finalAnswerEverDelivered: false,
+    })
+    expect(calls.filter((c) => c.method === 'deleteMessage' && c.message_id === cardId)).toHaveLength(1)
+    expect(calls.filter((c) => c.method === 'editMessageText' && c.message_id === cardId)).toHaveLength(0)
+  })
+
+  it('normal reply turn: still FINALIZES the card (edit, no delete)', async () => {
+    // The guarantee the fix must not break: a real answer keeps its record.
+    const { calls, cardId, turn } = await openThenClear({
+      replyCalled: true,
+      lastReplyText: 'The fix is deployed and the tests are green.',
+      finalAnswerEverDelivered: true,
+    })
+    expect(calls.filter((c) => c.method === 'editMessageText' && c.message_id === cardId).length)
+      .toBeGreaterThanOrEqual(1)
+    expect(calls.filter((c) => c.method === 'deleteMessage')).toHaveLength(0)
+    expect(turn.activityMessageId).toBeNull()
+  })
+
+  it('reply "prose\\nNO_REPLY" that WAS delivered (finalAnswerEverDelivered) keeps its card', async () => {
+    // The guard does NOT drop a reply with non-marker content, so its prose
+    // reached chat — endsWithSilentMarker must NOT suppress a delivered reply.
+    const { calls, cardId } = await openThenClear({
+      replyCalled: true,
+      lastReplyText: 'Here is the full answer to your question.\nNO_REPLY',
+      finalAnswerEverDelivered: true,
+    })
+    expect(calls.filter((c) => c.method === 'editMessageText' && c.message_id === cardId).length)
+      .toBeGreaterThanOrEqual(1)
+    expect(calls.filter((c) => c.method === 'deleteMessage')).toHaveLength(0)
+  })
+})
+
 // ── THREE-MODULE cross-surface dedup (Amendment 1) ────────────────────────
 // The REAL P4-A handleSessionEvent turn-flush, with the REAL P4-B lane wired
 // into its deps, records the delivered answer into ONE OutboundDedupCache;