switchroom 0.21.18 → 0.21.20

package/telegram-plugin/dist/server.js

@@ -17278,6 +17278,34 @@ var init_operator_events = __esm(() => {
   ]);
 });
 
+// connection-drop.ts
+function isConnectionDropText(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const lower = text.toLowerCase();
+  return CONNECTION_DROP_SIGNALS.some((s) => lower.includes(s));
+}
+var CONNECTION_DROP_SIGNALS;
+var init_connection_drop = __esm(() => {
+  CONNECTION_DROP_SIGNALS = [
+    "socket hang up",
+    "econnreset",
+    "econnrefused",
+    "etimedout",
+    "epipe",
+    "fetch failed",
+    "network error",
+    "connection refused",
+    "connection reset",
+    "connection closed",
+    "connection lost",
+    "mid-response",
+    "premature close",
+    "stream disconnected",
+    "stream closed"
+  ];
+});
+
 // tool-label-sidecar.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync3 } from "node:fs";
 import { join as join3 } from "node:path";
@@ -17761,6 +17789,9 @@ function extractRetryState(obj) {
     maxRetries: typeof obj.maxRetries === "number" ? obj.maxRetries : null
   };
 }
+function isConnectionDrop(kind, scanText) {
+  return CONNECTION_DROP_ELIGIBLE_KINDS.has(kind) && isConnectionDropText(scanText);
+}
 function detectErrorInTranscriptLine(line) {
   if (!line || line.length > 2 * 1024 * 1024)
     return null;
@@ -17785,7 +17816,9 @@ ${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: e
       raw: obj,
       detail: text || errStr || "api error",
       transient: kind2 === "rate-limited",
-      terminal: true
+      terminal: true,
+      connectionDrop: isConnectionDrop(kind2, `${text}
+${errStr}`)
     };
   }
   const isErrorLine = type === "api_error" || type === "error";
@@ -17798,7 +17831,15 @@ ${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: e
   const transient = kind === "rate-limited" || kind === "transport-transient";
   const retry = extractRetryState(obj);
   const terminal = !transient ? true : retry.retryAttempt != null && retry.maxRetries != null ? retry.retryAttempt >= retry.maxRetries : isErrorLine;
-  return { kind, raw, detail, transient, terminal };
+  return {
+    kind,
+    raw,
+    detail,
+    transient,
+    terminal,
+    connectionDrop: isConnectionDrop(kind, `${detail}
+${String(type ?? "")}`)
+  };
 }
 function extractDetailMessage(obj) {
   if (!obj)
@@ -18234,13 +18275,15 @@ function startSessionTail(config2) {
     }
   };
 }
-var MAX_JSONL_LINE_BYTES, MAX_ERROR_TEXT_CHARS = 500;
+var MAX_JSONL_LINE_BYTES, MAX_ERROR_TEXT_CHARS = 500, CONNECTION_DROP_ELIGIBLE_KINDS;
 var init_session_tail = __esm(() => {
   init_operator_events();
   init_model_unavailable();
+  init_connection_drop();
   init_tool_label_sidecar();
   init_model_label();
   MAX_JSONL_LINE_BYTES = 2 * 1024 * 1024;
+  CONNECTION_DROP_ELIGIBLE_KINDS = new Set(["transport-transient", "unknown-5xx", "unknown-4xx"]);
 });
 
 // ../node_modules/.bun/@xterm+headless@6.0.0/node_modules/@xterm/headless/lib-headless/xterm-headless.js

package/telegram-plugin/llm-error-present.ts

@@ -41,6 +41,7 @@ import {
   type ProviderCreditEntry,
 } from './provider-credit.js'
 import { classifyClaudeError } from './operator-events.js'
+import { isConnectionDropText } from './connection-drop.js'
 import { stripRawErrorBytes, extractRequestId } from './raw-error-scrub.js'
 import { fmtLocalClock, tzAbbrev } from './shared/local-time.js'
 
@@ -94,6 +95,18 @@ export interface ParsedLlmError {
    */
   providerId?: string
   source: LlmErrorSource
+  /**
+   * True when this error is a mid-stream connection / SSE drop (a transport
+   * connection loss), per the canonical {@link isConnectionDropText} matcher.
+   * Set consistently on BOTH classification paths (here and
+   * `detectErrorInTranscriptLine`) so a later PR can gate auto-resume on ONE
+   * reliable discriminator. Only ever true for the `transient`/`unknown`
+   * families — never for a positively-identified auth/quota/overload/credit
+   * wall (guarded below), so it can never trigger a wrong auto-resume of a
+   * genuinely terminal error. Classification only in this PR; no consumer acts
+   * on it yet.
+   */
+  connectionDrop: boolean
   /** True when the harness is still retrying this error internally (mid-retry). */
   autoRetrying: boolean
   /** True when the failure is final (NOT an in-flight retry). */
@@ -169,6 +182,17 @@ export function parseLlmError(
     }
   }
 
+  // Connection-drop discriminator. Gated to the transient/unknown families so a
+  // positively-classified auth/quota/overload/credit wall is NEVER flagged as a
+  // drop, even if its raw text coincidentally carries a drop wording (e.g. a
+  // LiteLLM-wrapped 401 whose outer text says "fetch failed"). The gate mirrors
+  // Path B's inclusion set (`transport-transient`/`unknown-*`), keeping the two
+  // classifiers in agreement. `source==='network'` is not required: a drop
+  // wording that `detectModelUnavailable` does not recognise (e.g. `EPIPE`)
+  // lands on `unknown` here, and must still be identifiable as a drop.
+  const connectionDrop =
+    (kind === 'transient' || kind === 'unknown') && isConnectionDropText(text)
+
   return {
     kind,
     coreText: buildCoreText(kind, source),
@@ -178,6 +202,7 @@ export function parseLlmError(
     ...(requestId != null ? { requestId } : {}),
     ...(providerId != null ? { providerId } : {}),
     source,
+    connectionDrop,
     autoRetrying,
     terminal,
   }

package/telegram-plugin/session-tail.ts

@@ -42,6 +42,7 @@ function isMultiAgentEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
 }
 import { classifyClaudeError, type OperatorEventKind } from './operator-events.js'
 import { isLitellmProxyLocal429, isTransientUpstreamSignal } from './model-unavailable.js'
+import { isConnectionDropText } from './connection-drop.js'
 import { createToolLabelSidecar, type ToolLabelSidecar, type SidecarOptions } from './tool-label-sidecar.js'
 import { isModelSentinel } from './model-label.js'
 
@@ -960,6 +961,25 @@ function extractRetryState(obj: Record<string, unknown>): {
   }
 }
 
+/**
+ * The OperatorEventKinds on which a connection-drop wording may be flagged as a
+ * genuine transport drop. INCLUSION (not exclusion) by design: a positively
+ * classified auth/quota/credit/rate-limit/overload wall is NEVER in this set,
+ * so a wrapped terminal error whose outer text coincidentally carries a drop
+ * wording is never mislabelled a drop. `transport-transient` is the natural
+ * mid-stream-abort kind; `unknown-4xx`/`unknown-5xx` is where a drop-worded
+ * line lands when `classifyClaudeError` does not recognise its wording (the
+ * exact Path-B bug this closes). Mirrors Path A's `transient`/`unknown` gate in
+ * `parseLlmError`, keeping the two classifiers in agreement.
+ */
+const CONNECTION_DROP_ELIGIBLE_KINDS: ReadonlySet<OperatorEventKind> =
+  new Set<OperatorEventKind>(['transport-transient', 'unknown-5xx', 'unknown-4xx'])
+
+/** True when `kind` may carry the connection-drop flag AND the text is a drop wording. */
+function isConnectionDrop(kind: OperatorEventKind, scanText: string): boolean {
+  return CONNECTION_DROP_ELIGIBLE_KINDS.has(kind) && isConnectionDropText(scanText)
+}
+
 export function detectErrorInTranscriptLine(
   line: string,
 ): {
@@ -972,6 +992,15 @@ export function detectErrorInTranscriptLine(
    *  error mid-retry is `transient:true, terminal:false`; the caller
    *  suppresses it (no operator card until the failure is terminal). */
   terminal: boolean
+  /**
+   * True when this line is a mid-stream connection / SSE drop (a transport
+   * connection loss), per the canonical `isConnectionDropText` matcher, gated
+   * to the transport/unknown kinds. Set consistently with `parseLlmError`'s
+   * `ParsedLlmError.connectionDrop` so a later PR can gate auto-resume on ONE
+   * reliable discriminator across both classification paths. Classification
+   * only in this PR; no caller acts on it yet.
+   */
+  connectionDrop: boolean
 } | null {
   if (!line || line.length > 2 * 1024 * 1024) return null
   let obj: Record<string, unknown>
@@ -1042,6 +1071,7 @@ export function detectErrorInTranscriptLine(
       detail: text || errStr || 'api error',
       transient: kind === 'rate-limited',
       terminal: true,
+      connectionDrop: isConnectionDrop(kind, `${text}\n${errStr}`),
     }
   }
 
@@ -1089,7 +1119,14 @@ export function detectErrorInTranscriptLine(
       ? retry.retryAttempt >= retry.maxRetries
       : isErrorLine
 
-  return { kind, raw, detail, transient, terminal }
+  return {
+    kind,
+    raw,
+    detail,
+    transient,
+    terminal,
+    connectionDrop: isConnectionDrop(kind, `${detail}\n${String(type ?? '')}`),
+  }
 }
 
 function extractDetailMessage(obj: Record<string, unknown> | null): string | null {

package/telegram-plugin/tests/llm-error-present.test.ts

@@ -27,6 +27,7 @@ import {
 } from '../llm-error-present.js'
 import { truncateDetailPreservingRequestId } from '../raw-error-scrub.js'
 import { projectTranscriptLine, detectErrorInTranscriptLine } from '../session-tail.js'
+import { isConnectionDropText } from '../connection-drop.js'
 import { renderOperatorEvent, type OperatorEvent } from '../operator-events.js'
 import { redact } from '../secret-detect/redact.js'
 
@@ -137,6 +138,188 @@ describe('parseLlmError — classification table', () => {
   })
 })
 
+// ─── Connection-drop classification (PR 0: unify drop classification) ─────────
+//
+// The two classifiers historically disagreed about a mid-stream connection /
+// SSE drop: Path A (`parseLlmError`) mapped it to a transient/network error,
+// while Path B (`detectErrorInTranscriptLine`) let a drop-worded line whose
+// wording `classifyClaudeError` did not recognise fall through to a generic
+// `unknown-*` terminal. These blocks assert the SAME line is now identifiable
+// as a connection drop on BOTH paths — and, critically, that auth / quota /
+// overload / provider-credit walls are NEVER flagged as drops on either path
+// (the greedy-matcher failure mode that would later cause a wrong auto-resume).
+
+const OPENROUTER_402_CREDIT =
+  'litellm.APIError: OpenrouterException - {"error":{"code":402,"message":"Your account or API key has insufficient credits. Add more credits and retry the request.","metadata":{"provider_name":"openrouter"}}}'
+
+/** Build the v2.1.x `isApiErrorMessage` synthetic-assistant transcript line. */
+function apiErrorLine(text: string, opts: { error?: string; status?: number } = {}): string {
+  return JSON.stringify({
+    type: 'assistant',
+    message: { role: 'assistant', model: '<synthetic>', content: [{ type: 'text', text }] },
+    isApiErrorMessage: true,
+    ...(opts.error != null ? { error: opts.error } : { error: '' }),
+    ...(opts.status != null ? { apiErrorStatus: opts.status } : {}),
+  })
+}
+
+describe('connection-drop — identifiable on BOTH classification paths', () => {
+  // The canonical mid-stream abort shape: isApiErrorMessage + error:"server_error",
+  // NO status. Path A sees the worded string; Path B sees the transcript line.
+  it('a "Connection closed mid-response" line is a connection-drop on Path A AND Path B', () => {
+    const wording = 'API Error: Connection closed mid-response'
+
+    // Path A
+    const a = parseLlmError(wording)
+    expect(a.connectionDrop).toBe(true)
+    expect(a.kind).toBe('transient')
+    expect(a.source).toBe('network')
+
+    // Path B
+    const b = detectErrorInTranscriptLine(apiErrorLine(wording, { error: 'server_error' }))
+    expect(b).not.toBeNull()
+    expect(b!.connectionDrop).toBe(true)
+    expect(b!.kind).toBe('transport-transient')
+  })
+
+  // The exact Path-B bug: a drop-worded line whose wording `classifyClaudeError`
+  // does NOT recognise (no server_error type, no status) fell through to
+  // unknown-5xx. It must STILL be flagged a connection-drop.
+  it('a "socket hang up" line unknown to classifyClaudeError is still a connection-drop on both paths', () => {
+    const wording = 'API Error: socket hang up'
+
+    const a = parseLlmError(wording)
+    expect(a.connectionDrop).toBe(true)
+
+    const b = detectErrorInTranscriptLine(apiErrorLine(wording))
+    expect(b).not.toBeNull()
+    expect(b!.kind).toBe('unknown-5xx') // classifyClaudeError does not recognise the wording…
+    expect(b!.connectionDrop).toBe(true) // …yet the drop is identified anyway.
+  })
+
+  // The wrapper-error line shape (`type:"error"`, nested error object).
+  it('a server_error wrapper line carrying a drop wording is a connection-drop on Path B', () => {
+    const line = JSON.stringify({
+      type: 'error',
+      error: { type: 'server_error', message: 'Connection closed mid-response' },
+    })
+    const b = detectErrorInTranscriptLine(line)
+    expect(b).not.toBeNull()
+    expect(b!.kind).toBe('transport-transient')
+    expect(b!.connectionDrop).toBe(true)
+  })
+
+  // EPIPE is a genuine drop wording that `detectModelUnavailable` does not
+  // classify as network — Path A lands it on `unknown`, but it must still be a
+  // connection-drop (proving the discriminator is NOT tied to source:'network').
+  it('EPIPE is a connection-drop on Path A even though its kind stays unknown', () => {
+    const a = parseLlmError('write EPIPE: half-dead socket')
+    expect(a.kind).toBe('unknown')
+    expect(a.connectionDrop).toBe(true)
+  })
+})
+
+describe('connection-drop — negatives (auth / quota / overload / provider-credit are NEVER drops)', () => {
+  it('auth is not a connection-drop on either path', () => {
+    const a = parseLlmError('authentication_error: OAuth token expired, please refresh')
+    expect(a.kind).toBe('auth')
+    expect(a.connectionDrop).toBe(false)
+
+    const b = detectErrorInTranscriptLine(
+      apiErrorLine('authentication_error: OAuth token expired', { error: 'authentication_error', status: 401 }),
+    )
+    expect(b).not.toBeNull()
+    expect(b!.connectionDrop).toBe(false)
+  })
+
+  it('quota_wall is not a connection-drop on either path', () => {
+    const a = parseLlmError("You've hit your limit · resets 5pm")
+    expect(a.kind).toBe('quota_wall')
+    expect(a.connectionDrop).toBe(false)
+
+    const b = detectErrorInTranscriptLine(
+      apiErrorLine("You've hit your limit · resets 5pm", { error: 'rate_limit_error', status: 429 }),
+    )
+    expect(b).not.toBeNull()
+    expect(b!.kind).toBe('quota-exhausted')
+    expect(b!.connectionDrop).toBe(false)
+  })
+
+  it('overload_529 is not a connection-drop on either path', () => {
+    const a = parseLlmError('Overloaded (overloaded_error) — HTTP 529')
+    expect(a.kind).toBe('overload_529')
+    expect(a.connectionDrop).toBe(false)
+
+    const b = detectErrorInTranscriptLine(apiErrorLine('Overloaded', { error: 'overloaded_error' }))
+    expect(b).not.toBeNull()
+    expect(b!.connectionDrop).toBe(false)
+  })
+
+  it('provider_credit is not a connection-drop on either path', () => {
+    const a = parseLlmError(OPENROUTER_402_CREDIT)
+    expect(a.kind).toBe('provider_credit')
+    expect(a.connectionDrop).toBe(false)
+
+    const b = detectErrorInTranscriptLine(apiErrorLine(OPENROUTER_402_CREDIT, { status: 402 }))
+    expect(b).not.toBeNull()
+    expect(b!.kind).toBe('provider-credit-exhausted')
+    expect(b!.connectionDrop).toBe(false)
+  })
+
+  // The single highest-risk case: a wrapped auth/quota wall whose OUTER text
+  // coincidentally carries a drop wording ("fetch failed") must NOT be flagged a
+  // drop — the classification wins over the wording, on both paths.
+  it('a wrapped auth error whose outer text says "fetch failed" is NOT a connection-drop', () => {
+    const a = parseLlmError('authentication_error: invalid api key (underlying: fetch failed)')
+    expect(a.kind).toBe('auth')
+    expect(a.connectionDrop).toBe(false)
+
+    const b = detectErrorInTranscriptLine(
+      JSON.stringify({
+        type: 'error',
+        error: { type: 'authentication_error', message: 'invalid api key; underlying: fetch failed' },
+      }),
+    )
+    expect(b).not.toBeNull()
+    expect(b!.kind).toBe('credentials-invalid')
+    expect(b!.connectionDrop).toBe(false)
+  })
+})
+
+describe('isConnectionDropText — the canonical matcher is conservative', () => {
+  it('matches the canonical drop wordings', () => {
+    for (const s of [
+      'socket hang up',
+      'read ECONNRESET',
+      'connect ECONNREFUSED 1.2.3.4:443',
+      'write EPIPE',
+      'fetch failed',
+      'network error',
+      'Connection closed mid-response',
+      'connection lost',
+      'Premature close',
+      'the stream disconnected unexpectedly',
+    ]) {
+      expect(isConnectionDropText(s)).toBe(true)
+    }
+  })
+
+  it('does NOT over-match "upstream"/"downstream"/"terminated" or auth/quota wording', () => {
+    for (const s of [
+      'the upstream provider returned a result',
+      'downstream consumer finished',
+      'the worker terminated cleanly',
+      'authentication_error: invalid api key',
+      "You've hit your usage limit",
+      'overloaded_error',
+      'insufficient credits',
+      '',
+    ]) {
+      expect(isConnectionDropText(s)).toBe(false)
+    }
+  })
+})
+
 // ─── local-time render ───────────────────────────────────────────────────────
 
 describe('renderLlmError / formatResetLocal — local-time rendering', () => {

package/vendor/hindsight-memory/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "hindsight-memory",
   "description": "Automatic long-term memory for Claude Code via Hindsight. Recalls relevant memories before each prompt and retains conversation transcripts after each response.",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "author": {"name": "Hindsight Team", "url": "https://vectorize.io/hindsight"},
   "license": "MIT",
   "keywords": ["memory", "hindsight", "recall", "retain"]

package/vendor/hindsight-memory/CHANGELOG.md

@@ -1,7 +1,27 @@
 # Changelog
 
+> **Versioning scheme (switchroom, #4779).** The manifest `version` in
+> `.claude-plugin/plugin.json` MUST be bumped on every substantive change to
+> this vendored tree — new/removed `scripts/`, changed hook wiring, or any
+> behaviour an agent would observe. It sat frozen at `0.4.0` across the entire
+> M4/M5 async-recall-prefetch rewrite, so a version-string check could not tell
+> a June pre-M4 tree from the shipped build and `test-harness` silently ran the
+> stale one. The version is only a COARSE signal, though — the authoritative
+> drift guard is the `scripts/`-tree hash in
+> `detectHindsightPluginTreeDrift` (`src/agents/drift.ts`), surfaced by
+> `switchroom doctor` and the gateway boot-card. Bump the version AND rely on
+> the hash; never the version alone.
+
 ## [Unreleased]
 
+### Changed (switchroom divergence)
+
+- **Manifest version bumped `0.4.0` → `0.5.0`** to reflect the M4/M5
+  async-recall-prefetch tree (adds `scripts/prefetch.py`,
+  `scripts/lib/recall_buffer.py`, `scripts/orientation.py`, and the
+  `memoryPrefetch*` settings). Per the scheme note above this is the first
+  bump of the discipline that stops build drift from going invisible (#4779).
+
 ### Added (switchroom divergence)
 
 - **Per-row `observation_scopes` on every retain.** Hindsight accepts and

package/vendor/hindsight-memory/scripts/lib/recall_buffer.py

@@ -93,13 +93,27 @@ def _sentinel_path(session_id: str) -> str:
     return os.path.join(buffer_dir(), f"{_safe_session(session_id)}.buffer.done")
 
 
-def write_buffer(session_id: str, context: str, telemetry: Optional[dict] = None) -> None:
+def write_buffer(
+    session_id: str,
+    context: str,
+    telemetry: Optional[dict] = None,
+    query: Optional[str] = None,
+) -> None:
     """Write the prefetched recall payload for ``session_id``.
 
     Atomic (temp file + ``os.replace`` within the same directory). Does NOT
     write the sentinel — the caller MUST call ``write_sentinel`` after this,
     and only once the payload write has returned, to preserve the
     read-after-write ordering guarantee.
+
+    ``query`` (#4778) is the speculative query the producer used to build this
+    buffer. It is stored verbatim so the consumer can gate the join on topical
+    similarity between it and turn N+1's ACTUAL prompt — the buffer is keyed by
+    ``session_id`` alone and, without this, a fresh buffer built for the prior
+    turn is served on a topic pivot regardless of relevance. A ``None``/absent
+    query is stored as ``""``, which the consumer treats as "cannot establish a
+    topic match" and falls through to synchronous recall (fail-safe; also the
+    backward-compat behaviour for buffers written before this field existed).
     """
     d = _ensure_dir()
     final = _buffer_path(session_id)
@@ -108,6 +122,7 @@ def write_buffer(session_id: str, context: str, telemetry: Optional[dict] = None
         "schema": SCHEMA,
         "session_id": session_id,
         "context": context,
+        "query": query or "",
         "telemetry": telemetry or {},
         "written_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
     }
@@ -187,7 +202,11 @@ def sentinel_exists(session_id: str) -> bool:
 def read_if_fresh(session_id: str, last_consumed_token: Optional[int]) -> tuple:
     """Return ``(payload_dict | None, current_token)``.
 
-    ``payload_dict`` (when present) is ``{"context": str, "telemetry": dict}``.
+    ``payload_dict`` (when present) is
+    ``{"context": str, "query": str, "telemetry": dict}``. ``query`` (#4778) is
+    the speculative query the buffer was built for — the consumer uses it to
+    gate the join on topical similarity to turn N+1's prompt. It is ``""`` for a
+    legacy buffer written before the field existed.
 
     Returns ``(None, token_or_last_consumed)`` when:
       * no sentinel exists yet (nothing has been produced this session), or
@@ -207,7 +226,11 @@ def read_if_fresh(session_id: str, last_consumed_token: Optional[int]) -> tuple:
         # Torn write: sentinel landed but payload didn't (or is corrupt).
         # Fail-closed — never serve this as fresh.
         return None, token
-    return {"context": payload.get("context", ""), "telemetry": payload.get("telemetry", {})}, token
+    return {
+        "context": payload.get("context", ""),
+        "query": payload.get("query", ""),
+        "telemetry": payload.get("telemetry", {}),
+    }, token
 
 
 def invalidate(session_id: str) -> None:

package/vendor/hindsight-memory/scripts/prefetch.py

@@ -75,8 +75,18 @@ def run_prefetch(hook_input: dict, config: dict) -> bool:
     that could take the Stop hook (and thus the turn) down with it."""
     session_id = hook_input.get("session_id") or "unknown"
 
-    prompt = (hook_input.get("prompt") or hook_input.get("user_prompt") or "").strip()
-    if prompt.startswith("<task-notification"):
+    # F6 — junk gate derived from the TRANSCRIPT's last human turn, not from a
+    # `hook_input["prompt"]` field. A Stop hook's input carries only
+    # session_id/transcript_path/stop_hook_active — never `prompt`/`user_prompt`
+    # — so the old `hook_input.get("prompt")` gate was permanently empty and
+    # NEVER fired, meaning prefetch would run on `<task-notification>` turns once
+    # lit. `_last_human_prompt` reads the same last-human turn the speculative
+    # query is derived from, so the gate now fires on exactly the synthetic
+    # follow-up turns `recall.py`'s synchronous gate skips (honouring the same
+    # `recallSkipTaskNotification` switch).
+    transcript_path = hook_input.get("transcript_path") or ""
+    query = _last_human_prompt(transcript_path)
+    if config.get("recallSkipTaskNotification", True) and query.startswith("<task-notification"):
         debug_log(config, "Prefetch: task-notification turn, skipping")
         return False
 
@@ -97,9 +107,8 @@ def run_prefetch(hook_input: dict, config: dict) -> bool:
     except Exception as exc:  # pragma: no cover - defensive
         debug_log(config, f"Prefetch: delta retain failed, continuing without it: {exc}")
 
-    # Step 2 — speculative recall.
-    transcript_path = hook_input.get("transcript_path") or ""
-    query = _last_human_prompt(transcript_path)
+    # Step 2 — speculative recall (query derived above from the transcript's
+    # last human turn).
     if not query:
         debug_log(config, "Prefetch: no usable query, nothing to prefetch")
         return False
@@ -123,6 +132,25 @@ def run_prefetch(hook_input: dict, config: dict) -> bool:
         debug_log(config, "Prefetch: no candidates, nothing to buffer")
         return False
 
+    # F5 — CURATE before buffering, through the SAME pipeline the synchronous
+    # recall path enforces (demote-drop, relevance sort, score floor, and the
+    # `recallMaxMemories` cap). Calling recall's shared helper — rather than
+    # `format_memories(results)` on the raw set — is what stops a demoted or
+    # uncapped memory from reaching the buffer and bypassing curation the sync
+    # path applies (carve §6.1 sharing requirement). Imported lazily so the
+    # flag-off no-op in `main()` never pays recall.py's import cost.
+    try:
+        import recall  # noqa: PLC0415 - lazy, kept off the flag-off no-op path
+
+        results = recall.curate_recall_results(results, config, bank_id)
+    except Exception as exc:  # pragma: no cover - defensive
+        debug_log(config, f"Prefetch: curation failed, skipping buffer: {exc}")
+        return False
+
+    if not results:
+        debug_log(config, "Prefetch: all candidates filtered by curation, nothing to buffer")
+        return False
+
     from lib.content import format_memories
 
     memories_block = format_memories(results)
@@ -131,7 +159,13 @@ def run_prefetch(hook_input: dict, config: dict) -> bool:
 
     # Step 3 — write payload THEN sentinel, strictly in that order.
     try:
-        recall_buffer.write_buffer(session_id, memories_block, {"result_count": len(results)})
+        # #4778 — persist the speculative `query` alongside the buffer so the
+        # consumer can gate the turn-N+1 join on topical similarity, not just
+        # session freshness. Without it a fresh buffer built for THIS turn's
+        # prompt is served on next turn's prompt even after a topic pivot.
+        recall_buffer.write_buffer(
+            session_id, memories_block, {"result_count": len(results)}, query=query
+        )
         recall_buffer.write_sentinel(session_id)
     except Exception as exc:  # pragma: no cover - defensive
         debug_log(config, f"Prefetch: buffer write failed: {exc}")