switchroom 0.21.7 → 0.21.8

package/dist/host-control/main.js

@@ -11763,7 +11763,7 @@ var init_schema = __esm(() => {
     repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
       url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
       branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
-    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated worktree for each " + "repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main, backed by a " + "shared bare clone at ~/.switchroom/repos/<slug>.git. The worktree path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
+    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated standing tree for " + "each repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main — an " + "independent clone (own refs/stash, hardlinked objects) seeded from a shared bare " + "clone at ~/.switchroom/repos/<slug>.git. The tree's path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
     experimental: exports_external.object({
       legacy_pty: exports_external.boolean().optional().describe("Opt out of the default tmux supervisor (#725) and run the agent " + "under the legacy PTY supervisor instead. Default: false."),
       legacy_autoaccept_expect: exports_external.boolean().optional().describe("Opt the autoaccept gateway back into the legacy expect-script " + "behaviour instead of the tmux send-keys path. Default: false.")
@@ -21565,7 +21565,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.21.7";
+var VERSION = "0.21.8";
 
 // src/setup/hindsight-recall-passthrough.ts
 var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
@@ -21649,7 +21649,7 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol", "local-time"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join3(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
   if (existsSync6(fragPath)) {
@@ -22357,6 +22357,7 @@ import { mkdir as mkdir2, chmod, chown, unlink, appendFile } from "node:fs/promi
 import {
   readdirSync as readdirSync6,
   existsSync as existsSync17,
+  statSync as statSync9,
   readFileSync as readFileSync13,
   writeFileSync as writeFileSync7,
   renameSync as renameSync6,
@@ -22497,13 +22498,14 @@ var AgentSmokeRequestSchema = exports_external.object({
     deep: exports_external.boolean().optional()
   })
 });
+var CANONICAL_CONFIG_PATH = "/state/config/switchroom.yaml";
 var ConfigProposeEditRequestSchema = exports_external.object({
   ...RequestEnvelope,
   op: exports_external.literal("config_propose_edit"),
   args: exports_external.object({
     unified_diff: exports_external.string().min(1).max(MAX_FRAME_BYTES2 - 1024),
     reason: exports_external.string().min(1).max(500),
-    target_path: exports_external.literal("/state/config/switchroom.yaml")
+    target_path: exports_external.literal(CANONICAL_CONFIG_PATH)
   })
 });
 var RequestSchema2 = exports_external.discriminatedUnion("op", [
@@ -30376,6 +30378,43 @@ function writeFileInPlacePreservingInode(targetPath, content) {
     throw new Error(`in-place write short: wrote ${buf.length} bytes but read back ${readBack.length}`);
   }
 }
+function verifyConfigWriteObserved(configPath, expected, snapshot, proposedChangedPaths) {
+  const expectedBuf = Buffer.from(expected, "utf-8");
+  let observed;
+  let size = null;
+  let mtimeMs = null;
+  try {
+    observed = readFileSync13(configPath);
+    const st = statSync9(configPath);
+    size = st.size;
+    mtimeMs = st.mtimeMs;
+  } catch (e) {
+    return {
+      ok: false,
+      reasons: [`post-write read-back of ${configPath} failed: ${e.message}`],
+      observed: null,
+      size: null,
+      mtimeMs: null
+    };
+  }
+  const reasons = [];
+  if (!observed.equals(expectedBuf)) {
+    let firstDiff = 0;
+    const min = Math.min(observed.length, expectedBuf.length);
+    while (firstDiff < min && observed[firstDiff] === expectedBuf[firstDiff]) {
+      firstDiff += 1;
+    }
+    reasons.push(`written bytes are not observable at ${configPath} ` + `(expected ${expectedBuf.length} bytes, read back ${observed.length}, ` + `first difference at offset ${firstDiff})`);
+  }
+  const observedChangedPaths = classifyBlastRadius(snapshot, observed.toString("utf-8")).changedPaths;
+  const approvedSet = new Set(proposedChangedPaths);
+  const observedSet = new Set(observedChangedPaths);
+  const sameSet = approvedSet.size === observedSet.size && [...approvedSet].every((p) => observedSet.has(p));
+  if (!sameSet) {
+    reasons.push(`on-disk change set diverged from what was approved ` + `(approved: [${[...approvedSet].sort().join(", ")}]; ` + `observed on disk: [${[...observedSet].sort().join(", ")}])`);
+  }
+  return { ok: reasons.length === 0, reasons, observed, size, mtimeMs };
+}
 var STATUS_RETENTION_MS = 10 * 60 * 1000;
 var STATUS_MAX_ENTRIES = 256;
 var TAIL_BYTES = 4096;
@@ -30385,7 +30424,71 @@ function isAutoRolloutRequestId(requestId) {
   return requestId.startsWith(AUTO_ROLLOUT_REQUEST_PREFIX);
 }
 var AUTO_ROLLOUT_LATCH_FILENAME = "auto-rollout-latch.json";
-var HOSTD_FALLBACK_CONFIG_PATH = "/state/config/switchroom.yaml";
+var HOSTD_FALLBACK_CONFIG_PATH = CANONICAL_CONFIG_PATH;
+function statIdentity(path3) {
+  const st = statSync9(path3);
+  return { dev: st.dev, ino: st.ino };
+}
+function checkConfigPathProvenance(writePath, resolveFleetConfig = findConfigFile, identify = statIdentity) {
+  let resolvedPath;
+  try {
+    resolvedPath = resolveFleetConfig();
+  } catch (e) {
+    return {
+      ok: true,
+      writePath,
+      resolvedPath: null,
+      identityChecked: false,
+      detail: `fleet config resolver could not name a config file ` + `(${e.message}) — nothing to compare against ${writePath}`
+    };
+  }
+  if (resolvedPath === writePath) {
+    return {
+      ok: true,
+      writePath,
+      resolvedPath,
+      identityChecked: false,
+      detail: `write target and fleet config path are the same string (${writePath})`
+    };
+  }
+  let write;
+  let fleet;
+  try {
+    write = identify(writePath);
+    fleet = identify(resolvedPath);
+  } catch (e) {
+    return {
+      ok: false,
+      writePath,
+      resolvedPath,
+      identityChecked: false,
+      detail: `write target ${writePath} differs from the fleet config path ` + `${resolvedPath}, and file identity could not be established ` + `(${e.message}) — compared as strings, not inodes`
+    };
+  }
+  if (write.dev === fleet.dev && write.ino === fleet.ino) {
+    return {
+      ok: true,
+      writePath,
+      resolvedPath,
+      identityChecked: true,
+      detail: `write target ${writePath} and fleet config path ${resolvedPath} are ` + `two names for the SAME file (dev=${write.dev} ino=${write.ino})`
+    };
+  }
+  return {
+    ok: false,
+    writePath,
+    resolvedPath,
+    identityChecked: true,
+    detail: `write target ${writePath} (dev=${write.dev} ino=${write.ino}) is a ` + `DIFFERENT file from the config the fleet reads, ${resolvedPath} ` + `(dev=${fleet.dev} ino=${fleet.ino}) — a write here would be invisible ` + `to every other reader`
+  };
+}
+var CONFIG_PATH_PROVENANCE_TAG = "hostd-config-path-provenance";
+function configPathProvenanceWarning(resolveFleetConfig = findConfigFile, identify = statIdentity) {
+  const prov = checkConfigPathProvenance(CANONICAL_CONFIG_PATH, resolveFleetConfig, identify);
+  if (prov.ok)
+    return null;
+  return `${CONFIG_PATH_PROVENANCE_TAG}: ${prov.detail}. ` + `config_propose_edit will REFUSE with E_CONFIG_PATH_MISMATCH until this ` + `agrees — check the hostd bind mount over ${CANONICAL_CONFIG_PATH} and ` + `the SWITCHROOM_CONFIG it exports alongside it.`;
+}
 function resolveHostdConfigPath(explicit) {
   if (explicit)
     return explicit;
@@ -31572,6 +31675,12 @@ class HostdServer {
       return err("E_CONFIG_EDIT_DISABLED", "config_propose_edit is disabled").why("operator opt-in per RFC §3.3").fixFlipFlag("hostd.config_edit_enabled", true).docs("https://switchroom.dev/docs/config-edit#opt-in").op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
     }
     const configPath = this.opts.configPath ?? req.args.target_path;
+    if (this.opts.configPath === undefined) {
+      const provenance = checkConfigPathProvenance(configPath, this.opts.resolveFleetConfigPath ?? findConfigFile, this.opts.identifyForProvenance ?? statIdentity);
+      if (!provenance.ok) {
+        return this.configPathMismatch(provenance.detail, req, caller, started);
+      }
+    }
     const verdict = validateConfigEdit({
       configPath,
       targetPath: req.args.target_path,
@@ -31746,10 +31855,10 @@ class HostdServer {
         }
       }
       try {
-        writeFileInPlacePreservingInode(configPath, postApplyFresh);
+        this.writeLiveConfig(configPath, postApplyFresh);
       } catch (e) {
         try {
-          writeFileInPlacePreservingInode(configPath, snapshot);
+          this.writeLiveConfig(configPath, snapshot);
         } catch {}
         await approval.finalize({
           outcome: "reconcile_failed_rolled_back",
@@ -31757,8 +31866,31 @@ class HostdServer {
         });
         return this.reconcileFailedRolledBack(`write failed: ${e.message}`, req, caller, started);
       }
-      const runner = this.opts.runReconcile ?? (async () => this.runSwitchroom(caller.kind === "agent" ? ["apply", "--only", callerName, "--non-interactive"] : ["apply", "--non-interactive"]));
-      const recRes = await runner({ requestId: approvalId });
+      const observation = verifyConfigWriteObserved(configPath, postApplyFresh, snapshot, proposedChangedPaths);
+      if (!observation.ok) {
+        const why = `post-write verification failed: ${observation.reasons.join("; ")}`;
+        const snapshotBuf = Buffer.from(snapshot, "utf-8");
+        const alreadySnapshot = observation.observed !== null && observation.observed.equals(snapshotBuf);
+        let restoreDetail;
+        if (alreadySnapshot) {
+          restoreDetail = "live config already byte-identical to the pre-write snapshot; no restore needed";
+        } else {
+          try {
+            this.writeLiveConfig(configPath, snapshot);
+            restoreDetail = "rolled back to the pre-write snapshot";
+          } catch (e) {
+            restoreDetail = `SNAPSHOT RESTORE ALSO FAILED: ${e.message} — ` + `live config at ${configPath} is in an UNKNOWN state, inspect it by hand`;
+          }
+        }
+        await approval.finalize({
+          outcome: "reconcile_failed_rolled_back",
+          detail: `${why}; ${restoreDetail}`
+        });
+        return this.writeNotObserved(`${why}; ${restoreDetail}`, req, caller, started);
+      }
+      const reconcileEnv = { SWITCHROOM_CONFIG: configPath };
+      const runner = this.opts.runReconcile ?? (async () => this.runSwitchroom(caller.kind === "agent" ? ["apply", "--only", callerName, "--non-interactive"] : ["apply", "--non-interactive"], reconcileEnv));
+      const recRes = await runner({ requestId: approvalId, env: reconcileEnv });
       if (recRes.exit_code === 0) {
         const blast = classifyBlastRadius(snapshot, postApplyFresh);
         await approval.finalize({
@@ -31766,19 +31898,21 @@ class HostdServer {
           affectedAgents: blast.agents,
           fleetWide: blast.fleetWide
         });
+        const writeEvidence = `config write observed: path=${configPath} ` + `size=${observation.size} mtime_ms=${observation.mtimeMs}`;
         return {
           v: 1,
           request_id: req.request_id,
           result: "completed",
           exit_code: 0,
           duration_ms: Date.now() - started,
-          stdout_tail: tail(recRes.stdout),
+          stdout_tail: tail(`${recRes.stdout}
+--- ${writeEvidence} ---`),
           stderr_tail: tail(recRes.stderr)
         };
       }
       let rollbackDetail = "";
       try {
-        writeFileInPlacePreservingInode(configPath, snapshot);
+        this.writeLiveConfig(configPath, snapshot);
       } catch (e) {
         rollbackDetail = `snapshot restore failed: ${e.message}`;
         await approval.finalize({
@@ -31787,7 +31921,7 @@ class HostdServer {
         });
         return this.reconcileFailedRolledBack(rollbackDetail, req, caller, started);
       }
-      const recRes2 = await runner({ requestId: approvalId });
+      const recRes2 = await runner({ requestId: approvalId, env: reconcileEnv });
       const recoveryNote = recRes2.exit_code === 0 ? "rolled back successfully" : `rolled back but recovery reconcile also failed (exit ${recRes2.exit_code})`;
       await approval.finalize({
         outcome: "reconcile_failed_rolled_back",
@@ -31803,6 +31937,27 @@ class HostdServer {
     const built = err("E_CONFIG_CHANGED", "config changed since the proposal was validated; re-propose against the current config").why(why).fixBadInput("unified_diff").op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
     return { ...built, error: legacy };
   }
+  writeLiveConfig(path3, content) {
+    (this.opts.writeConfigFile ?? writeFileInPlacePreservingInode)(path3, content);
+  }
+  writeNotObserved(detail, req, caller, started) {
+    const legacy = `E_WRITE_NOT_OBSERVED: ${detail}`;
+    const built = err("E_WRITE_NOT_OBSERVED", "config write could not be observed on the target file; apply aborted before reconcile").why(detail).fixOperatorAction("infra", [
+      "confirm hostd reads and writes the SAME switchroom.yaml the fleet reads (check the hostd bind mount over /state/config/switchroom.yaml)",
+      "check for a competing writer to the config (operator hand-edit or editor daemon) during the apply window",
+      "inspect the live config by hand before re-proposing — the diff was valid, the write path was not"
+    ]).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
+    return { ...built, error: legacy };
+  }
+  configPathMismatch(detail, req, caller, started) {
+    const legacy = `E_CONFIG_PATH_MISMATCH: ${detail}`;
+    const built = err("E_CONFIG_PATH_MISMATCH", "hostd would write a different switchroom.yaml than the fleet reads; apply refused before any write").why(detail).fixOperatorAction("infra", [
+      `confirm the hostd container bind-mounts the live switchroom.yaml onto ${CANONICAL_CONFIG_PATH}`,
+      "confirm SWITCHROOM_CONFIG inside the hostd container points at that same path (hostd install exports it alongside the mount)",
+      "re-propose once the two agree — the diff was never applied, nothing was written"
+    ]).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
+    return { ...built, error: legacy };
+  }
   reconcileFailedRolledBack(detail, req, caller, started, output) {
     const legacy = `E_RECONCILE_FAILED_ROLLED_BACK: ${detail}`;
     const built = err("E_RECONCILE_FAILED_ROLLED_BACK", "config write or reconcile failed; live file rolled back to snapshot").why(detail).fixOperatorAction("infra", [
@@ -31878,7 +32033,11 @@ ${output.recovery.stderr}` : "";
         name: "bot_token",
         cmd: "test -f /state/agent/telegram/.env && grep -qE '^TELEGRAM_BOT_TOKEN=[0-9]+:' /state/agent/telegram/.env"
       },
-      { name: "state", cmd: "test -w /state/agent" }
+      { name: "state", cmd: "test -w /state/agent" },
+      {
+        name: "tzdata",
+        cmd: "test ! -L /etc/localtime && python3 -c 'import sys;" + "from datetime import datetime;" + "from zoneinfo import ZoneInfo;" + 'sys.exit(0 if datetime.now(ZoneInfo("Etc/UTC")).utcoffset()' + ".total_seconds()==0 else 1)'"
+      }
     ];
     if (req.args.deep) {
       PROBES.push({
@@ -34146,6 +34305,11 @@ async function main() {
 `);
     process.exit(2);
   }
+  const provenanceWarning = configPathProvenanceWarning();
+  if (provenanceWarning !== null) {
+    process.stderr.write(`hostd: ${provenanceWarning}
+`);
+  }
   const agentUids = {};
   for (const name of Object.keys(config.agents)) {
     agentUids[name] = allocateAgentUid(name);

package/dist/vault/approvals/kernel-server.js

@@ -5203,7 +5203,7 @@ var init_schema = __esm(() => {
     repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
       url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
       branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
-    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated worktree for each " + "repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main, backed by a " + "shared bare clone at ~/.switchroom/repos/<slug>.git. The worktree path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
+    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated standing tree for " + "each repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main — an " + "independent clone (own refs/stash, hardlinked objects) seeded from a shared bare " + "clone at ~/.switchroom/repos/<slug>.git. The tree's path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
     experimental: exports_external.object({
       legacy_pty: exports_external.boolean().optional().describe("Opt out of the default tmux supervisor (#725) and run the agent " + "under the legacy PTY supervisor instead. Default: false."),
       legacy_autoaccept_expect: exports_external.boolean().optional().describe("Opt the autoaccept gateway back into the legacy expect-script " + "behaviour instead of the tmux send-keys path. Default: false.")
@@ -19544,7 +19544,7 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol", "local-time"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
   if (existsSync5(fragPath)) {

package/dist/vault/broker/server.js

@@ -4799,7 +4799,7 @@ var init_schema = __esm(() => {
     repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
       url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
       branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
-    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated worktree for each " + "repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main, backed by a " + "shared bare clone at ~/.switchroom/repos/<slug>.git. The worktree path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
+    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated standing tree for " + "each repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main — an " + "independent clone (own refs/stash, hardlinked objects) seeded from a shared bare " + "clone at ~/.switchroom/repos/<slug>.git. The tree's path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
     experimental: exports_external.object({
       legacy_pty: exports_external.boolean().optional().describe("Opt out of the default tmux supervisor (#725) and run the agent " + "under the legacy PTY supervisor instead. Default: false."),
       legacy_autoaccept_expect: exports_external.boolean().optional().describe("Opt the autoaccept gateway back into the legacy expect-script " + "behaviour instead of the tmux send-keys path. Default: false.")
@@ -19957,7 +19957,7 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol", "local-time"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
   if (existsSync5(fragPath)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.21.7",
+  "version": "0.21.8",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -24,11 +24,11 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/hindsight-bank-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/boot-briefing-builder.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-buzz-dedup.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/rollout-narration-edit-socket.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/progress-fallback-cap.test.ts telegram-plugin/tests/progress-cap.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/worker-origin-gap-dispatch.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/hermes-messages-paging.test.ts telegram-plugin/tests/hermes-session-search.test.ts telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/hindsight-bank-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/boot-briefing-builder.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-buzz-dedup.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/rollout-narration-edit-socket.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/progress-fallback-cap.test.ts telegram-plugin/tests/progress-cap.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/worker-origin-gap-dispatch.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/hindsight-bank-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-scope-persist.test.ts src/vault/broker/server-tokenless-scope.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/self-approval-bypass.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/boot-briefing-builder.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-buzz-dedup.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/rollout-narration-edit-socket.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/progress-fallback-cap.test.ts telegram-plugin/tests/progress-cap.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/worker-origin-gap-dispatch.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test:bun": "bun test telegram-plugin/tests/hermes-messages-paging.test.ts telegram-plugin/tests/hermes-session-search.test.ts telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/hindsight-bank-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-scope-persist.test.ts src/vault/broker/server-tokenless-scope.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/self-approval-bypass.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/boot-briefing-builder.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-buzz-dedup.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/rollout-narration-edit-socket.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/progress-fallback-cap.test.ts telegram-plugin/tests/progress-cap.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/worker-origin-gap-dispatch.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
-    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-bench-baseline-anonymised.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-hindsight-bank-hermeticity.mjs && node scripts/check-parked-turn-start-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-ctx-send-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-foreign-db-readonly.mjs && node scripts/check-changelog-entry.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && bun scripts/check-secret-pattern-parity.ts && bun scripts/check-hostd-template-guard.ts",
+    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-bench-baseline-anonymised.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-hindsight-bank-hermeticity.mjs && node scripts/check-parked-turn-start-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-ctx-send-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-foreign-db-readonly.mjs && node scripts/check-claude-cli-lockstep.mjs && node scripts/check-changelog-entry.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && bun scripts/check-secret-pattern-parity.ts && bun scripts/check-hostd-template-guard.ts",
     "lint:tsc": "tsc --noEmit",
     "lint:hindsight-write-redaction": "node scripts/check-hindsight-write-redaction.mjs",
     "lint:secret-pattern-parity": "bun scripts/check-secret-pattern-parity.ts",
@@ -53,6 +53,7 @@
     "lint:litellm-config-guard": "node scripts/check-litellm-config-guard.mjs",
     "lint:release-asset-contract": "node scripts/check-release-asset-names.mjs",
     "lint:foreign-db-readonly": "node scripts/check-foreign-db-readonly.mjs",
+    "lint:claude-cli-lockstep": "node scripts/check-claude-cli-lockstep.mjs",
     "lint:changelog-entry": "node scripts/check-changelog-entry.mjs",
     "changelog:generate": "node scripts/gen-changelog-entry.mjs",
     "lint:agent-attribution-trailers": "node scripts/check-agent-attribution-trailers.mjs",

package/profiles/_base/start.sh.hbs

@@ -33,6 +33,31 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # same path the rest of start.sh + the MCP sidecar expects.
   export TELEGRAM_STATE_DIR="{{agentDir}}/telegram"
 
+  # --- Boot-resume generation token: OPEN it (switchroom#4641) -------------
+  #
+  # The gateway's boot-resume block (orphan-turn reaper, `resume_interrupted`
+  # synthetic, bridge-dead marker, `.pending-turn.env`) is a ONCE-PER-CONTAINER-
+  # BOOT action. But the gateway is a SUPERVISED SIDECAR: when it crashes the
+  # supervisor respawns it and its boot block runs again — against a claude
+  # session that never stopped. That is #4641: it stamped the still-executing
+  # turn `ended_via='restart'` and told the live session it had been killed.
+  #
+  # THIS line is the whole generation mechanism. Deleting the token here — in
+  # the outer pass, exactly once per container boot, BEFORE the gateway is
+  # forked below and where the supervisor can never re-run it — is what makes
+  # "the token exists" mean "a gateway in this same container generation
+  # already completed its boot resume". The gateway writes the token at the
+  # END of that block (agent-process-liveness.ts `markBootResumeComplete`) and
+  # skips the block entirely when it finds one. No timing, no clock
+  # comparison: a gateway that dies mid-boot leaves no token, so its
+  # replacement redoes the work and a genuinely interrupted turn is never lost.
+  #
+  # `agent-process.json` (written by the inner pass just before it `exec`s the
+  # agent) goes too: it names a pid from the PREVIOUS generation, and the
+  # pid namespace is reset by a container restart, so leaving it risks a
+  # (pid, starttime) collision against an unrelated live process.
+  rm -f "$TELEGRAM_STATE_DIR/.boot-resume-done" "$TELEGRAM_STATE_DIR/agent-process.json" 2>/dev/null || true
+
   # SWITCHROOM_AGENT_NAME is the canonical "which agent am I" identity. It is
   # normally supplied by the container env (compose.ts) so it is already
   # present here, but the authoritative inner-pass export lives at line ~387,
@@ -538,6 +563,32 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
       bun /opt/switchroom/agent-scheduler/index.js &
   fi
 
+  # 3a) switchroom-tmp-reaper — bounded janitor for the /tmp tmpfs.
+  #
+  #     /tmp is a RAM-backed tmpfs sized by `resources.tmp_size`
+  #     (DEFAULT_TMP_SIZE = 2g) and mounted noexec by Docker's tmpfs
+  #     defaults. Nothing ages out of a tmpfs, so a long-running container
+  #     accumulates every scratch dir any tool forgot to remove until writes
+  #     start failing ENOSPC — and the failure surfaces in the victim (npm
+  #     ci, git, the CLI's own staging), never at the cause. Observed live:
+  #     4,462 top-level entries and 490 MiB used, 204 MiB of it two orphaned
+  #     compile artifacts from one test run.
+  #
+  #     Deliberately NOT "raise tmp_size": a bigger tmpfs converts a fast,
+  #     loud failure into a slow leak against host RAM. The safety contract
+  #     (age floor, open-file check, /tmp-only scope) lives in the script's
+  #     header and is pinned by tests/tmp-reaper.test.ts.
+  #
+  #     Kill switch: SWITCHROOM_TMP_REAPER=0 in the container env. Supervised
+  #     like the other sidecars so a crash self-heals and its log rotates;
+  #     NOT --oneshot-ok, because a clean exit from an endless loop is
+  #     abnormal and must restart.
+  if [ "$SWITCHROOM_TMP_REAPER" != "0" ] \
+     && [ -x /opt/switchroom/bin/tmp-reaper.sh ]; then
+    _switchroom_supervise tmp-reaper /var/log/switchroom/tmp-reaper.log \
+      bash /opt/switchroom/bin/tmp-reaper.sh &
+  fi
+
   # 3b) Buzz co-channel inbound sidecar (Phase 1, channels.buzz).
   #     A supervised sibling that opens a WebSocket Nostr subscription to a
   #     closed Buzz relay, NIP-42-authenticates, and injects allowlisted
@@ -2475,6 +2526,70 @@ fi
 rm -f "$_session_model_resolved_tmp"
 unset _session_model_resolved_tmp
 
+# --- Agent-process identity record (switchroom#4641) ---
+#
+# The gateway and the agent are SEPARATE processes: the gateway runs as a
+# supervised sidecar (see `_switchroom_supervise gateway` above) while THIS
+# shell becomes the agent via `exec claude` below. A gateway crash respawns
+# only the gateway — this process, its conversation, its in-flight turn and
+# its sub-agents all keep running. The gateway used to read its own boot as
+# "the agent restarted" and fire a false `resume_interrupted` into the live
+# session ("your previous turn was interrupted", "your sub-agents were killed")
+# while everything it named was demonstrably still alive.
+#
+# What DECIDES that is the per-container-boot generation token cleared in the
+# outer pass above (`.boot-resume-done`). This record is the SAFETY VETO on top
+# of it: if the token says "already done" but the recorded agent process is
+# provably gone, the gateway runs the boot resume anyway. It can only ever
+# re-enable a resume, never suppress a legitimate one — which is why nothing
+# here depends on when the gateway was forked relative to this shell.
+#
+# So publish this process's identity for the gateway to probe:
+#   pid       — `$$`, and because the `exec` below REPLACES this shell rather
+#               than forking, that pid IS the claude process's pid.
+#   starttime — `/proc/<pid>/stat` field 22, clock ticks since host boot.
+#               Assigned at fork and NOT reset by `exec`, so the value read
+#               here is exactly what claude will carry. PIDs are reused (and a
+#               container restart resets the pid namespace), so identity is the
+#               PAIR — the gateway rejects a pid whose starttime disagrees.
+#
+# Deliberately NOT recorded: `comm`. It is "bash" here and becomes claude's
+# after the exec, so recording it would guarantee a mismatch. (An earlier
+# review suggested recording it and requiring the live process to look
+# claude-ish, to close a fresh-boot race cheaply — the generation token closes
+# that race outright, so the extra guard would only add a way to fail.)
+#
+# Written LAST, immediately before the exec: a record must never name a
+# process that does not exist yet. Best-effort throughout — a missing or torn
+# record makes the gateway fail open to its pre-#4641 behaviour.
+_sr_agent_stat=$(cat "/proc/$$/stat" 2>/dev/null || true)
+if [ -n "$_sr_agent_stat" ]; then
+  # comm is parenthesised and may contain spaces/`)`, so split on the LAST ") ".
+  _sr_agent_rest=${_sr_agent_stat##*') '}
+  # Field 22 (starttime) is the 20th field after comm. Subshell + `set -f` so
+  # the word split neither globs nor clobbers this script's positional params.
+  _sr_agent_start=$( set -f; set -- $_sr_agent_rest; printf '%s' "${20}" )
+  case "$_sr_agent_start" in
+    ''|*[!0-9]*) _sr_agent_start="" ;;
+  esac
+  if [ -n "$_sr_agent_start" ]; then
+    _sr_agent_dir="${TELEGRAM_STATE_DIR:-{{agentDir}}/telegram}"
+    mkdir -p "$_sr_agent_dir" 2>/dev/null || true
+    _sr_agent_tmp="$_sr_agent_dir/agent-process.json.tmp.$$"
+    if printf '{"pid":%s,"starttime":"%s","boot_at":%s}\n' \
+         "$$" "$_sr_agent_start" "$(( $(date +%s) * 1000 ))" > "$_sr_agent_tmp" 2>/dev/null; then
+      mv -f "$_sr_agent_tmp" "$_sr_agent_dir/agent-process.json" 2>/dev/null || true
+    fi
+    rm -f "$_sr_agent_tmp" 2>/dev/null || true
+    # Passive context for the agent process itself (diagnostics only — the
+    # gateway reads the FILE; it was already running when this env was set).
+    export SWITCHROOM_AGENT_PID="$$"
+    export SWITCHROOM_AGENT_STARTTIME="$_sr_agent_start"
+    unset _sr_agent_dir _sr_agent_tmp
+  fi
+fi
+unset _sr_agent_stat _sr_agent_rest _sr_agent_start
+
 {{#if useSwitchroomPlugin}}
 if [ -n "$APPEND_PROMPT" ]; then
   exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL" $_EFFORT_ARG{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}

package/profiles/_shared/local-time.md.hbs

@@ -0,0 +1,6 @@
+## Local time — never show a human a UTC timestamp
+
+Convert to the agent's zone (`SWITCHROOM_TIMEZONE`, else `TZ`; the container clock is already local).
+
+- **Never hardcode an offset or a zone abbreviation** (`+10:00`, `AEST`) — both move with DST; derive from the zone.
+- **Attach a naive timestamp's true zone before converting** (`.replace(tzinfo=ZoneInfo("UTC"))`) — `.astimezone()` on a naive value assumes the process clock.

package/profiles/default/CLAUDE.md.hbs

@@ -16,9 +16,7 @@ You are operating in the **{{topicName}}** {{#if topicEmoji}}{{topicEmoji}} {{/i
 {{/if}}
 
 ## Core Behavior
-- Respond helpfully, concisely, and conversationally.
 - Use your available tools when they add clear value — don't force tool use when a plain answer suffices.
-- Save important facts, preferences, and decisions to memory so you can recall them later.
 - When asked to do something ambiguous, ask one clarifying question rather than guessing.
 - If a task has multiple steps, outline your plan before executing.
 
@@ -58,7 +56,6 @@ Hard rules the agent must follow during reflect — guardrails that are always a
 
 Retain proactively when:
 - The user shares a preference or fact about themselves
-- The user gives you a correction or rule (these go to directives, not retain)
 - A significant decision was made and the rationale matters for next time
 - You did real work and the result + the path you took would be useful next session
 
@@ -68,8 +65,6 @@ Don't retain:
 - Sensitive content the user explicitly asked you to not remember
 - Things already in a mental model — they'll be re-derived from underlying memories
 
-Auto-retain (see above) covers routine capture; use manual `retain` for high-signal observations you want immediately searchable.
-
 ### When to synthesize — concrete triggers
 
 Auto-recall and auto-retain feed the bank but never *synthesize* — that's on you, only if you act on these triggers. Each has a backstop:
@@ -134,13 +129,6 @@ Discipline (you read peers' attacker-influenced output, nothing taps your shell)
 Your transcript is this power's audit trail; keep your actions legible.
 {{/if}}
 
-## Tools
-{{#if tools}}
-Use the tools available to you to accomplish tasks effectively. Prefer the simplest tool that gets the job done.
-{{else}}
-Use your available tools when appropriate. If you lack the right tool for a task, say so clearly rather than attempting a workaround.
-{{/if}}
-
 {{#if schedule}}
 ## Scheduled Tasks
 You have scheduled tasks configured. At fire time an in-container scheduler sidecar injects a synthesized inbound turn into **your running session** — a scheduled task arrives as an ordinary turn tagged `<channel source="cron">`, using your normal session, context, and model, and it shows up in your transcript and Hindsight memory like any other turn (it is *not* an isolated one-shot `claude -p` process). They survive reboots via the container restart policy plus an at-least-once boot replay.