toolroll 0.9.10 → 0.9.11

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.9.11 — 2026-10-02
+
+- **The Telegram bot always answers.** Replies and notifications go out from
+  the service itself, never from inside a build. If it can't answer, it says
+  why in plain words, and a session mix-up starts a fresh conversation instead
+  of refusing.
+
 ## 0.9.10 — 2026-10-02
 
 - **Chat reads like a teammate.** Short messages, outcome first, with real

package/dist/chat-channel.d.ts

@@ -12,18 +12,18 @@ export type ResolvedMate = {
     };
 } | {
     ok: false;
-    reason: "unpaired" | "unconfigured" | "direct-api" | "no-projects" | "session-mismatch" | "thread-mismatch";
+    reason: "unpaired" | "unconfigured" | "direct-api" | "no-projects" | "busy" | "no-session";
     said: string | null;
 };
 /**
  * The session and thread a paired phone speaks in: the approver's live
  * session when it is compatible (same generation, same membership
- * credential, same ceiling), else one minted under the very terms the
- * console and CLI state for membership chat (no dollar ceiling, this
- * ceiling digest) — and only when NO session is live, because minting
- * ends the previous one and an unrelated console conversation is not
- * this phone's to end. The same rule for the thread: reused when its
- * ceiling matches, never closed from here.
+ * credential, same ceiling), else a fresh one minted under the very terms
+ * the console and CLI state for membership chat (no dollar ceiling, this
+ * ceiling digest). An incompatible session or thread left open on the
+ * computer is replaced rather than refused, so a message from the phone
+ * always gets an answer — except while a turn is still running there,
+ * which is "busy": the message waits its turn instead of ending it.
  */
 export declare function resolveChannelMate(store: Store, binding: {
     approver: string;
@@ -34,6 +34,8 @@ export declare function resolveChannelMate(store: Store, binding: {
  * chat as well, so the task shows everything asked of it wherever it was
  * asked. Best effort: the phone conversation never depends on it. */
 export declare function mirrorToTaskChat(store: Store, who: VerifiedApprover, taskId: string, surface: string, message: string, reply: string, now: Date): void;
+/** The one short message a person gets when their question could not be answered. */
+export declare function couldNotAnswerText(reason: string): string;
 export declare function tooLongText(length: number): string;
 /** A reply to a message about several tasks is never guessed: it names them and says how to choose. */
 export declare function whichTaskText(titles: readonly string[]): string;

package/dist/chat-channel.js

@@ -25,12 +25,12 @@ export function channelRepos(store, approver, registry) {
 /**
  * The session and thread a paired phone speaks in: the approver's live
  * session when it is compatible (same generation, same membership
- * credential, same ceiling), else one minted under the very terms the
- * console and CLI state for membership chat (no dollar ceiling, this
- * ceiling digest) — and only when NO session is live, because minting
- * ends the previous one and an unrelated console conversation is not
- * this phone's to end. The same rule for the thread: reused when its
- * ceiling matches, never closed from here.
+ * credential, same ceiling), else a fresh one minted under the very terms
+ * the console and CLI state for membership chat (no dollar ceiling, this
+ * ceiling digest). An incompatible session or thread left open on the
+ * computer is replaced rather than refused, so a message from the phone
+ * always gets an answer — except while a turn is still running there,
+ * which is "busy": the message waits its turn instead of ending it.
  */
 export function resolveChannelMate(store, binding, repos, now) {
     const config = store.getChatConfig();
@@ -60,18 +60,17 @@ export function resolveChannelMate(store, binding, repos, now) {
         return { ok: false, reason: "unpaired", said: null };
     const who = verified.who;
     const credentialKey = subscriptionCredentialKey(config.provider);
-    const mismatch = "Your open chat session on the computer covers different projects or another provider. Finish or end it there, then message here again. Nothing was changed.";
     let session = store.activeMateSession(who.name);
-    if (session !== null &&
+    const liveThread = store.liveMateThreadFor(who.name);
+    const sessionMismatch = session !== null &&
         (session.approverGeneration !== who.generation ||
             session.credentialKey !== credentialKey ||
-            session.ceilingDigest !== who.ceilingDigest)) {
-        return { ok: false, reason: "session-mismatch", said: mismatch };
-    }
-    const liveThread = store.liveMateThreadFor(who.name);
-    if (liveThread !== null && liveThread.ceilingDigest !== who.ceilingDigest)
-        return { ok: false, reason: "thread-mismatch", said: mismatch };
-    if (session === null) {
+            session.ceilingDigest !== who.ceilingDigest);
+    const threadMismatch = liveThread !== null && liveThread.ceilingDigest !== who.ceilingDigest;
+    // Replacing either would end a turn still running on the computer.
+    if ((sessionMismatch || threadMismatch) && store.liveMateTurnFor(who.name) !== null)
+        return { ok: false, reason: "busy", said: null };
+    if (session === null || sessionMismatch) {
         const termsDigest = createHash("sha256")
             .update(`0\n${who.ceilingDigest}`)
             .digest("hex");
@@ -85,9 +84,12 @@ export function resolveChannelMate(store, binding, repos, now) {
         }, now);
         session = store.getMateSession(id);
         if (session === null)
-            return { ok: false, reason: "session-mismatch", said: mismatch };
+            return { ok: false, reason: "no-session", said: couldNotAnswerText("a new chat session couldn't be started") };
     }
-    const thread = liveThread ?? store.openMateThread(who.name, who.ceilingDigest, now).thread;
+    // openMateThread closes a thread kept under another ceiling.
+    const thread = threadMismatch || liveThread === null
+        ? store.openMateThread(who.name, who.ceilingDigest, now).thread
+        : liveThread;
     return {
         ok: true,
         who,
@@ -113,6 +115,10 @@ export function mirrorToTaskChat(store, who, taskId, surface, message, reply, no
         // The task chat is a copy; the phone's own conversation already has it.
     }
 }
+/** The one short message a person gets when their question could not be answered. */
+export function couldNotAnswerText(reason) {
+    return `I couldn't answer that just now: ${reason}. Ask again, or open the console.`;
+}
 export function tooLongText(length) {
     return `That message is ${length.toLocaleString("en-US")} characters; chat takes up to ${MATE_MESSAGE_MAX_CHARS.toLocaleString("en-US")}. Nothing was sent to the assistant. Send it in shorter parts, or say which part matters most.`;
 }

package/dist/chat-delivery.js

@@ -202,6 +202,10 @@ export async function processChatEvent(options) {
                 return true;
             }
             const resolved = resolveChannelMate(store, { approver: binding.approver, approverGeneration: binding.generation }, repos, now);
+            if (!resolved.ok && resolved.reason === "busy") {
+                state.defer(event.id, "Assistant is answering another message", new Date(now.getTime() + 5000));
+                return true;
+            }
             if (!resolved.ok) {
                 state.plan(event.id, [
                     {

package/dist/operate.d.ts

@@ -50,6 +50,8 @@ export type OperateOptions = {
     gitRunner?: CommandRunner;
     /** Injected by tests: the Telegram Bot API. Production dials the real one. */
     telegramTransport?: TelegramTransport;
+    /** Injected by tests: the environment checked for a fenced network before Telegram is reached (default: this process's, with the real transport). */
+    telegramEnv?: Record<string, string | undefined>;
     publishExec?: PublishExec;
     /** Injected by tests: the stop fence a watch would set. */
     shouldStop?: () => boolean;

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
 import { fileAddTestsTask, followUpChecksOf, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
@@ -138,7 +139,7 @@ import { diagnoseTaskDispatch, diagnosisIsDispatchable, scopeApprovedForDispatch
 import { createDecisionServer } from "./serve.js";
 import { readTailnetNames } from "./tailnet.js";
 import { daemonLaunchCommand, daemonStatus, installReplacingLegacy, installedLegacyDaemon, planDaemon, uninstallDaemon, awaitFreshHeartbeat, } from "./daemon.js";
-import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
+import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, networkFence, networkFenceLine, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
 import { ask, askHidden, confirm, interactive, underAgent } from "./prompt.js";
@@ -820,6 +821,7 @@ export async function runOperate(command, argv, write, options = {}) {
             ...(options.agentRunner === undefined ? {} : { agentRunner: options.agentRunner }),
             ...(options.gitRunner === undefined ? {} : { gitRunner: options.gitRunner }),
             ...(options.telegramTransport === undefined ? {} : { telegramTransport: options.telegramTransport }),
+            ...(options.telegramEnv === undefined ? {} : { telegramEnv: options.telegramEnv }),
             ...(options.publishExec === undefined ? {} : { publishExec: options.publishExec }),
             ...(options.dispatchAdapter === undefined ? {} : { dispatchAdapter: options.dispatchAdapter }),
             ...(options.flowTriggerIo === undefined ? {} : { flowTriggerIo: options.flowTriggerIo }),
@@ -7288,6 +7290,50 @@ async function daemonCommand(positional, flags, context) {
 const WATCH_LEASE_MS = 90_000;
 const WATCH_HEARTBEAT_MS = 30_000;
 /** The start repair runs once per process, not once per project loop. */
+/**
+ * The Telegram follower: one actor on the wire that sends notifications and
+ * replies and reads what arrives, all over the same transport. Null when no
+ * bot token is saved, or when this process's network is fenced (it says so
+ * once instead of failing every send).
+ */
+function startTelegramFollower(args) {
+    const { context, progress, label } = args;
+    const source = loadBotToken(process.env, context.telegramTokenFile);
+    if (source === null)
+        return null;
+    const fence = networkFence(context.telegramEnv ?? (context.telegramTransport === undefined ? process.env : {}));
+    if (fence !== null) {
+        progress(networkFenceLine(fence));
+        return null;
+    }
+    const transport = context.telegramTransport ?? createTransport(source.token);
+    // v98: with a public hooks address (Tailscale Funnel covers /hooks), Telegram pushes updates to it instead.
+    const pushUrl = telegramPushUrl(readHooksBase(dirname(context.databaseFile)));
+    return followBridge(context.store, {
+        push: pushUrl === null ? null : { url: pushUrl, secret: telegramHookSecret(dirname(context.databaseFile), true) },
+        readProjects: telegramReadProjects(context),
+        canDeliver: telegramCanDeliver(context, source.token),
+        conversation: telegramConversation(context, args.publicUrl === undefined ? {} : { serverOrigin: args.publicUrl }),
+        botId: source.botId,
+        transport,
+        signal: args.signal,
+        ...(args.owner === undefined ? {} : { owner: args.owner }),
+        onCycle: cycle => {
+            // progress(), not write(): under --json this line went to stdout
+            // BESIDE the final envelope — the one stdout contamination in the
+            // watch (round-4 finding 12).
+            progress(`${label} sent ${cycle.sent}, answered ${cycle.answered}, paired ${cycle.paired}` +
+                ((cycle.statusReplies ?? 0) > 0 ? `, status replies ${cycle.statusReplies}` : "") +
+                ((cycle.chatQueued ?? 0) > 0 ? `, chat received ${cycle.chatQueued}` : "") +
+                ((cycle.chatAnswered ?? 0) > 0 ? `, chat replied ${cycle.chatAnswered}` : "") +
+                ((cycle.chatConfirmed ?? 0) > 0 ? `, chat confirmed ${cycle.chatConfirmed}` : "") +
+                (cycle.problems.length > 0 ? ` — ${cycle.problems.length} problem(s): ${cycle.problems[0].slice(0, 200)}` : ""));
+        },
+    }).catch(error => {
+        progress(`${args.died.prefix}the telegram follower died — ${describe(error)}; ${args.died.then}`);
+        return null;
+    });
+}
 let staleStatusesRepaired = false;
 async function runWatchLoop(args) {
     const { context, flags, runner, token, repo, progress } = args;
@@ -7366,38 +7412,13 @@ async function runWatchLoop(args) {
     // moment they arrive, and answering bumps the wake sequence, so the very
     // loop below wakes and resumes the freed task — phone to build, seconds.
     // The poll lease keeps this the only live poller; a cron `bridge
-    // telegram` overlapping it loses the lease race and reports busy.
-    let follower = null;
-    const followSource = loadBotToken(process.env, context.telegramTokenFile);
-    if (followSource !== null) {
-        const transport = context.telegramTransport ?? createTransport(followSource.token);
-        const publicUrl = text(flags, "public-url");
-        // v98: with a public hooks address (Tailscale Funnel covers /hooks), Telegram pushes updates to it instead.
-        const pushUrl = telegramPushUrl(readHooksBase(dirname(context.databaseFile)));
-        follower = followBridge(store, {
-            push: pushUrl === null ? null : { url: pushUrl, secret: telegramHookSecret(dirname(context.databaseFile), true) },
-            readProjects: telegramReadProjects(context),
-            canDeliver: telegramCanDeliver(context, followSource.token),
-            conversation: telegramConversation(context, publicUrl === undefined ? {} : { serverOrigin: publicUrl }),
-            botId: followSource.botId,
-            transport,
-            signal: followController.signal,
-            onCycle: cycle => {
-                // progress(), not write(): under --json this line went to stdout
-                // BESIDE the final envelope — the one stdout contamination in the
-                // watch (round-4 finding 12).
-                progress(`watch: bridge sent ${cycle.sent}, answered ${cycle.answered}, paired ${cycle.paired}` +
-                    ((cycle.statusReplies ?? 0) > 0 ? `, status replies ${cycle.statusReplies}` : "") +
-                    ((cycle.chatQueued ?? 0) > 0 ? `, chat received ${cycle.chatQueued}` : "") +
-                    ((cycle.chatAnswered ?? 0) > 0 ? `, chat replied ${cycle.chatAnswered}` : "") +
-                    ((cycle.chatConfirmed ?? 0) > 0 ? `, chat confirmed ${cycle.chatConfirmed}` : "") +
-                    (cycle.problems.length > 0 ? ` — ${cycle.problems.length} problem(s): ${cycle.problems[0].slice(0, 200)}` : ""));
-            },
-        }).catch(error => {
-            progress(`watch: the telegram follower died — ${describe(error)}; taps wait for the next watch`);
-            return null;
-        });
-    }
+    // telegram` overlapping it loses the lease race and reports busy. Under
+    // `up` the service runs the one follower itself and project loops leave
+    // Telegram to it.
+    const serviceBridge = args.serviceBridge === true;
+    const follower = serviceBridge
+        ? null
+        : startTelegramFollower({ context, publicUrl: text(flags, "public-url"), signal: followController.signal, progress, label: "watch: bridge", died: { prefix: "watch: ", then: "taps wait for the next watch" } });
     const slackFollower = followSlack({ store, dir: dirname(context.databaseFile), signal: followController.signal,
         readProjects: telegramReadProjects(context), evidenceRoot: context.evidenceRoot,
         ...(context.mateSeams?.subscriptionRunner ? { subscriptionRunner: context.mateSeams.subscriptionRunner } : {}),
@@ -7690,7 +7711,7 @@ async function runWatchLoop(args) {
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
                 lastBridge = now;
-                const source = loadBotToken(process.env, context.telegramTokenFile);
+                const source = serviceBridge ? null : loadBotToken(process.env, context.telegramTokenFile);
                 const dir = dirname(context.databaseFile);
                 // Exactly ONE service carries the pages — the chosen primary, or
                 // the sensible implicit one. Telegram keeps draining taps and
@@ -8538,6 +8559,7 @@ async function upCommand(flags, context) {
             onFollowController: controller => followControllers.push(controller),
             containmentLines,
             passes: projectPasses,
+            serviceBridge: true,
             onReady: () => {
                 markReady();
                 if (bind)
@@ -8557,6 +8579,33 @@ async function upCommand(flags, context) {
         await ready;
     };
     await Promise.all(repos.map(repo => launchRepo(repo, false)));
+    // Telegram: one follower for the whole service, never one per project
+    // loop. Replies and notifications go out from it, over the same transport
+    // in the same cycle (Oct 2: a reply sent by a project loop's own follower
+    // failed "fetch failed" while notifications went out). A token saved
+    // while the service runs connects within seconds; a follower that dies
+    // is started again.
+    const telegramController = new AbortController();
+    followControllers.push(telegramController);
+    const telegramSupervisor = (async () => {
+        const pause = (ms) => new Promise(resolvePause => {
+            const timer = setTimeout(done, ms);
+            function done() { clearTimeout(timer); telegramController.signal.removeEventListener("abort", done); resolvePause(); }
+            telegramController.signal.addEventListener("abort", done, { once: true });
+        });
+        while (!stopping && !telegramController.signal.aborted) {
+            const follower = startTelegramFollower({
+                context, publicUrl: text(flags, "public-url"), signal: telegramController.signal, progress, label: "telegram:",
+                died: { prefix: "", then: "starting it again" }, owner: `service-${randomUUID()}`,
+            });
+            if (follower !== null)
+                await follower;
+            // Without a token (or on a fenced network) look again shortly; the fence line is said once.
+            if (follower === null && loadBotToken(process.env, context.telegramTokenFile) !== null)
+                break;
+            await pause(follower === null ? 2_000 : 5_000);
+        }
+    })();
     const dynamicCeiling = resolveCeiling(repos, projectRoots).ceiling;
     const rejected = new Set();
     const registrySupervisor = (async () => {
@@ -8691,6 +8740,7 @@ async function upCommand(flags, context) {
     await stopped;
     await registrySupervisor;
     await Promise.all([...loopResults.values()]);
+    await telegramSupervisor;
     clearInterval(runnerHeartbeat);
     if (runTimer !== undefined)
         clearTimeout(runTimer);
@@ -8738,6 +8788,7 @@ async function upCommand(flags, context) {
  *   bridge telegram token [<bot-token>|--clear]   set the credential file
  *   bridge telegram status
  *   bridge telegram digest [--every 30m|2h|24h | --off]   away mode: routine facts batch, decisions still page
+ *   bridge telegram retry                send unsent assistant replies again now
  *
  * The bot token comes from ${TOKEN_ENV} or the credential file this command
  * writes (0600, beside the database). Cron the pass right after tick; a
@@ -8754,7 +8805,14 @@ async function bridgeCommand(positional, flags, context) {
         return demoFence;
     const [channel, action] = positional;
     if (channel !== "telegram") {
-        return fail(write, json, "bridge", "usage", "`toolroll bridge telegram [pair|unpair|token|status|digest]`", EXIT.usage);
+        return fail(write, json, "bridge", "usage", "`toolroll bridge telegram [pair|unpair|token|status|digest|retry]`", EXIT.usage);
+    }
+    if (action === "retry") {
+        // Replies already written and fenced on the pairing like every send: this only moves their next attempt to now.
+        const retried = store.retryTelegramReplies(null, clock());
+        return succeed(write, json, "bridge retry", { retried }, () => [
+            retried === 0 ? "No unsent Telegram replies." : `Sending ${retried} Telegram ${retried === 1 ? "reply" : "replies"} again on the next bridge pass.`,
+        ]);
     }
     if (action === "token") {
         const value = positional[2];
@@ -8871,6 +8929,9 @@ async function bridgeCommand(positional, flags, context) {
     if (source === null) {
         return fail(write, json, "bridge", "no-token", `no bot token — set ${TOKEN_ENV}, run \`toolroll bridge telegram token <t>\`, or use the serve settings card`, EXIT.refused);
     }
+    const fenced = networkFence(context.telegramEnv ?? (context.telegramTransport === undefined ? process.env : {}));
+    if (fenced !== null)
+        return fail(write, json, "bridge", "network-fenced", networkFenceLine(fenced), EXIT.refused);
     const transport = context.telegramTransport ?? createTransport(source.token);
     // --follow: stay on the wire. One long-poll actor holds the poll lease;
     // an answer tapped on a phone lands in seconds instead of at the next
@@ -9588,7 +9649,18 @@ async function statusCommand(positional, flags, context) {
     const projects = projectBuildsStatus(context);
     const projectsLine = projects.length === 0 ? null
         : `Builds by project: ${projects.slice(0, 8).map(one => `${one.name} ${one.running} of ${one.limit}`).join(", ")}${projects.length > 8 ? ", …" : ""}`;
-    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting }, () => [...(waiting === null ? [] : [waiting.words]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+    // A Telegram reply written but still not sent after two minutes, with its Retry.
+    const unsent = context.store.unsentTelegramReplies(null, null, new Date(context.clock().getTime() - UNSENT_REPLY_MS));
+    const unsentLine = unsentRepliesLine(unsent);
+    const unsentReplies = unsent.length === 0 ? {} : { unsentReplies: unsent.map(one => ({ ...one, retry: "toolroll bridge telegram retry" })) };
+    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+}
+function unsentRepliesLine(unsent) {
+    if (unsent.length === 0)
+        return null;
+    const oldest = unsent[0];
+    const what = unsent.length === 1 ? "A Telegram reply hasn't" : `${unsent.length} Telegram replies haven't`;
+    return `${what} been sent since ${oldest.since.slice(11, 16)} UTC${oldest.error === null ? "" : ` (${oldest.error})`}. Retry: toolroll bridge telegram retry`;
 }
 /** Each known project's running builds against its limit: its own number, never past its workers' capacity. */
 function projectBuildsStatus(context) {

package/dist/serve.js

@@ -1674,7 +1674,7 @@ export function createDecisionServer(options) {
         // separately proves cookie, approver standing and password; instance bot
         // settings remain outside this exact allowlist.
         if ((request.method === "GET" && path === "/settings/telegram") ||
-            (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair"].includes(path)))
+            (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair", "/settings/telegram/retry"].includes(path)))
             return true;
         // Coding routes require an instance operator, then prove saved ownership and project access.
         if (path === "/code" || path.startsWith("/code/"))
@@ -4066,7 +4066,7 @@ export function createDecisionServer(options) {
             // The settings view holds no secret (a pairing code only appears in
             // the response to Pair, which stays script-free), so it joins the
             // workspace like every other settings page.
-            return sendScreen(response, 200, screen("Telegram", telegramSettingsHtml(store, botId, who.name, who.session.csrf), { chrome: chromeFor(project, "settings") }));
+            return sendScreen(response, 200, screen("Telegram", telegramSettingsHtml(store, botId, who.name, who.session.csrf, { now }), { chrome: chromeFor(project, "settings") }));
         }
         if (url.pathname === "/settings/teams") {
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
@@ -7885,6 +7885,13 @@ export function createDecisionServer(options) {
             }
             return redirect(response, "/settings/slack");
         }
+        if (url.pathname === "/settings/telegram/retry") {
+            // The signed-in person's own unsent replies only: already written and fenced on the pairing; this sends them again now.
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver can retry their own replies.", "/settings");
+            store.retryTelegramReplies(who.name, now);
+            return redirect(response, "/settings/telegram");
+        }
         if (url.pathname === "/settings/telegram/pair" || url.pathname === "/settings/telegram/unpair") {
             // The person's own pairing, under their password: a code minted for
             // them alone, or their own chats revoked. Teammates' pairings are

package/dist/store.d.ts

@@ -7294,7 +7294,7 @@ export declare class Store {
      * under a claim that lapsed (a crash mid-turn), and not deferred past now.
      * One at a time per bot — the mate runs one turn per approver anyway.
      */
-    claimTelegramConversation(botId: string, owner: string, ttlMs: number, now: Date): TelegramConversation | null;
+    claimTelegramConversation(botId: string, owner: string, ttlMs: number, now: Date, only?: "turns" | "replies"): TelegramConversation | null;
     /** Extend a held claim; false means it lapsed and somebody else may hold the row. */
     renewTelegramConversation(id: number, owner: string, ttlMs: number, now: Date): boolean;
     /**
@@ -7321,6 +7321,20 @@ export declare class Store {
         outcome: string;
         nextAttemptAt: string;
     }, now: Date): boolean;
+    /**
+     * Replies the assistant wrote that still have not reached the person
+     * `since` ago or longer (status and the console show them with a Retry):
+     * the message's row, whose it is, when the oldest unsent part was
+     * written, and the last send error.
+     */
+    unsentTelegramReplies(botId: string | null, approver: string | null, since: Date): {
+        conversation: number;
+        approver: string;
+        since: string;
+        error: string | null;
+    }[];
+    /** Send unsent replies on the next bridge pass instead of waiting out their backoff; returns how many. */
+    retryTelegramReplies(approver: string | null, now: Date): number;
     /**
      * Persist the whole outbound half of a turn — every reply part and every
      * card, with the cards' tokens already minted — in one transaction, BEFORE

package/dist/store.js

@@ -21621,14 +21621,18 @@ export class Store {
      * under a claim that lapsed (a crash mid-turn), and not deferred past now.
      * One at a time per bot — the mate runs one turn per approver anyway.
      */
-    claimTelegramConversation(botId, owner, ttlMs, now) {
+    claimTelegramConversation(botId, owner, ttlMs, now, only) {
         return this.transact(() => {
             const stamp = now.toISOString();
+            // "turns": still needs the assistant; "replies": the reply is planned and only sending remains.
+            const planned = "EXISTS (SELECT 1 FROM telegram_conversation_part p WHERE p.conversation = telegram_conversation.id)";
+            const which = only === "turns" ? `AND NOT ${planned}` : only === "replies" ? `AND ${planned}` : "";
             const row = this.db
                 .prepare(`SELECT * FROM telegram_conversation
             WHERE bot_id = ? AND state IN ('queued','running')
               AND (claim_expires_at IS NULL OR claim_expires_at <= ?)
               AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+              ${which}
             ORDER BY id LIMIT 1`)
                 .get(botId, stamp, stamp);
             if (row === undefined)
@@ -21686,6 +21690,31 @@ export class Store {
                 .run(result.state, result.outcome, result.replyMessageId ?? null, stamp, id, owner, stamp);
         return Number(changes) === 1;
     }
+    /**
+     * Replies the assistant wrote that still have not reached the person
+     * `since` ago or longer (status and the console show them with a Retry):
+     * the message's row, whose it is, when the oldest unsent part was
+     * written, and the last send error.
+     */
+    unsentTelegramReplies(botId, approver, since) {
+        return this.db
+            .prepare(`SELECT c.id, c.approver, MIN(p.created_at) AS since,
+           (SELECT q.last_error FROM telegram_conversation_part q WHERE q.conversation = c.id AND q.state = 'pending' ORDER BY q.ordinal LIMIT 1) AS error
+          FROM telegram_conversation c JOIN telegram_conversation_part p ON p.conversation = c.id AND p.state = 'pending'
+         WHERE c.state IN ('queued','running') AND (? IS NULL OR c.bot_id = ?) AND (? IS NULL OR c.approver = ?)
+         GROUP BY c.id HAVING MIN(p.created_at) <= ? ORDER BY c.id`)
+            .all(botId, botId, approver, approver, since.toISOString())
+            .map(row => ({ conversation: Number(row["id"]), approver: String(row["approver"]), since: String(row["since"]), error: row["error"] === null ? null : String(row["error"]) }));
+    }
+    /** Send unsent replies on the next bridge pass instead of waiting out their backoff; returns how many. */
+    retryTelegramReplies(approver, now) {
+        const { changes } = this.db
+            .prepare(`UPDATE telegram_conversation SET next_attempt_at = ?
+          WHERE state = 'queued' AND (? IS NULL OR approver = ?)
+            AND EXISTS (SELECT 1 FROM telegram_conversation_part p WHERE p.conversation = telegram_conversation.id AND p.state = 'pending')`)
+            .run(now.toISOString(), approver, approver);
+        return Number(changes);
+    }
     // ---- the outbound parts (v63) ------------------------------------------------
     /**
      * Persist the whole outbound half of a turn — every reply part and every

package/dist/telegram-mate.d.ts

@@ -122,6 +122,12 @@ export declare function splitParts(text: string): string[];
  * outside any SQLite transaction. The caller holds the poll lease and
  * renews it; the row's own claim is renewed here. Bounded per call so a
  * flood cannot pin one pass forever.
+ *
+ * `only` splits the work for the follower: "turns" runs the model and
+ * persists the reply but leaves the sending to the bridge's own cycle,
+ * which calls back with "replies" — so a reply goes out from the same
+ * place, in the same order and over the same connection as notifications,
+ * never beside a long poll. Absent, a row is answered and sent in one go.
  */
 export declare function processTelegramConversations(args: {
     store: Store;
@@ -134,4 +140,5 @@ export declare function processTelegramConversations(args: {
     report: ConversationReport;
     signal?: AbortSignal;
     limit?: number;
+    only?: "turns" | "replies";
 }): Promise<void>;

package/dist/telegram-mate.js

@@ -1,5 +1,5 @@
 import { CHAT_ACTIONS, sharedActionAllowsChallenge, sharedActionPayload } from "./chat-actions.js";
-import { taskInCeiling, mirrorToTaskChat, channelRepos as telegramConversationRepos, resolveChannelMate as resolveTelegramMate, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
+import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelMate as resolveTelegramMate, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
 export { channelRepos as telegramConversationRepos, resolveChannelMate as resolveTelegramMate, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
 /**
  * The paired phone as one more way to use the same assistant.
@@ -299,11 +299,17 @@ export function splitParts(text) {
  * outside any SQLite transaction. The caller holds the poll lease and
  * renews it; the row's own claim is renewed here. Bounded per call so a
  * flood cannot pin one pass forever.
+ *
+ * `only` splits the work for the follower: "turns" runs the model and
+ * persists the reply but leaves the sending to the bridge's own cycle,
+ * which calls back with "replies" — so a reply goes out from the same
+ * place, in the same order and over the same connection as notifications,
+ * never beside a long poll. Absent, a row is answered and sent in one go.
  */
 export async function processTelegramConversations(args) {
     const limit = args.limit ?? 20;
     for (let count = 0; count < limit && args.signal?.aborted !== true; count++) {
-        const row = args.store.claimTelegramConversation(args.botId, args.owner, CONVERSATION_CLAIM_MS, args.clock());
+        const row = args.store.claimTelegramConversation(args.botId, args.owner, CONVERSATION_CLAIM_MS, args.clock(), args.only);
         if (row === null)
             return;
         try {
@@ -318,6 +324,8 @@ export async function processTelegramConversations(args) {
 }
 class PlanRefused extends Error {
 }
+/** The outcome a planned reply waits under until the bridge's cycle sends it. */
+const ANSWERED_SENDING = "answered:sending";
 /**
  * One claimed message, in order of what is already known about it:
  *
@@ -334,12 +342,13 @@ class PlanRefused extends Error {
  * the ceiling the turn opened under; only a confirmed message id counts.
  */
 async function runTelegramConversation(row, args) {
-    const { store, botId, transport, owner, clock, readProjects, options, report } = args;
+    const { store, botId, transport, owner, clock, readProjects, options, report, only } = args;
     const finish = (result) => store.finishTelegramConversation(row.id, owner, result, clock());
     const held = () => store.renewTelegramConversation(row.id, owner, CONVERSATION_CLAIM_MS, clock());
     const ageMs = clock().getTime() - Date.parse(row.createdAt);
-    const requeue = (outcome) => {
+    const requeue = async (outcome) => {
         if (ageMs > CONVERSATION_MAX_AGE_MS) {
+            await notify(couldNotAnswerText(outcome === "registry-unavailable" ? "your projects couldn't be read" : "the assistant stayed busy with another message"));
             finish({ state: "failed", outcome: `${outcome}:gave-up` });
             report.refused++;
             return;
@@ -384,6 +393,7 @@ async function runTelegramConversation(row, args) {
         const bound = store.getTelegramConversation(row.id)?.session ?? null;
         const session = bound === null ? null : store.getMateSession(bound);
         if (session === null) {
+            await notify(couldNotAnswerText("the chat session for this reply is gone"));
             finish({ state: "failed", outcome: "unsent:no-session" });
             report.refused++;
             return;
@@ -407,6 +417,7 @@ async function runTelegramConversation(row, args) {
             }
             if (now.getTime() - Date.parse(row.createdAt) > DELIVERY_MAX_AGE_MS) {
                 report.problems.push(`telegram chat reply for update ${row.updateId} was not sent within a day: ${part.lastError ?? "unsent"}`);
+                await notify(couldNotAnswerText("my reply couldn't be sent for a day"));
                 finish({ state: "failed", outcome: `unsent:gave-up:${part.lastError ?? "unsent"}` });
                 report.refused++;
                 return;
@@ -512,15 +523,24 @@ async function runTelegramConversation(row, args) {
                     ...(keyboard === undefined ? {} : { reply_markup: { inline_keyboard: keyboard } }),
                 });
             }
+            // The first time the answer itself fails to go out, the person hears so once,
+            // in plain words; the reply itself keeps being retried and shows as
+            // unsent in status and the console after two minutes.
+            const firstFailure = part.kind === "reply" && store.listTelegramConversationParts(row.id).every(one => one.attempts <= (one.state === "sent" ? 1 : 0));
+            const failed = async (until, error, uncertain) => {
+                if (!store.settleTelegramConversationPart(row.id, part.ordinal, owner, { ok: false, error, uncertain, retryAt: until.toISOString() }, clock()))
+                    return;
+                if (firstFailure)
+                    await notify(couldNotAnswerText(uncertain ? "my reply may not have reached Telegram" : "Telegram didn't accept my reply"));
+                defer(until, error);
+            };
             let answer;
             try {
                 answer = await send();
             }
             catch {
                 // The answer was lost: Telegram may or may not have the message. Said so, retried, counted.
-                const error = "Telegram transport failed; delivery may be uncertain";
-                if (store.settleTelegramConversationPart(row.id, part.ordinal, owner, { ok: false, error, uncertain: true, retryAt: backoff.toISOString() }, clock()))
-                    defer(backoff, error);
+                await failed(backoff, "Telegram transport failed; delivery may be uncertain", true);
                 return;
             }
             if (!answer.ok) {
@@ -535,15 +555,12 @@ async function runTelegramConversation(row, args) {
                     if (paused > until)
                         until = paused;
                 }
-                if (store.settleTelegramConversationPart(row.id, part.ordinal, owner, { ok: false, error, uncertain, retryAt: until.toISOString() }, clock()))
-                    defer(until, error);
+                await failed(until, error, uncertain);
                 return;
             }
             const id = answer.result?.message_id;
             if (!Number.isSafeInteger(id) || id <= 0) {
-                const error = "Telegram returned no confirmed message identity";
-                if (store.settleTelegramConversationPart(row.id, part.ordinal, owner, { ok: false, error, uncertain: true, retryAt: backoff.toISOString() }, clock()))
-                    defer(backoff, error);
+                await failed(backoff, "Telegram returned no confirmed message identity", true);
                 return;
             }
             const messageId = String(id);
@@ -596,11 +613,11 @@ async function runTelegramConversation(row, args) {
         }
         store.bindTelegramConversationTurn(row.id, owner, session, turnId);
         if (turn.state === "queued" || turn.state === "running") {
-            requeue("replayed:running");
+            await requeue("replayed:running");
             return;
         }
         if (turn.state !== "answered") {
-            await notify(`Your earlier message was received, but the assistant's reply did not complete (${phoneText(turn.failureReason ?? "unknown", 40)}). Nothing was changed. Send it again if you still want it.`);
+            await notify(couldNotAnswerText(`the assistant's reply did not complete (${phoneText(turn.failureReason ?? "unknown", 40)})`));
             finish({ state: "failed", outcome: `replayed:${turn.failureReason ?? "failed"}` });
             report.refused++;
             return;
@@ -609,11 +626,19 @@ async function runTelegramConversation(row, args) {
         const proposals = store.listMateProposals(turn.thread, ["pending"]).filter(one => one.turn === turn.id);
         if (!plan(session, turnId, reply, proposals, repos) && store.listTelegramConversationParts(row.id).length === 0)
             return;
-        await deliver("replayed");
+        await sendOrHandOff("replayed");
+    };
+    /** Send now, or — for the follower's turn worker — leave it to the bridge's cycle, which sends it next. */
+    const sendOrHandOff = async (outcomeWord) => {
+        if (only !== "turns") {
+            await deliver(outcomeWord);
+            return;
+        }
+        finish({ state: "queued", outcome: outcomeWord === "answered" ? ANSWERED_SENDING : "delivering", nextAttemptAt: clock().toISOString() });
     };
     // 2. Parts already planned: the turn answered; only the sending remains.
     if (store.listTelegramConversationParts(row.id).length > 0) {
-        await deliver("replayed");
+        await deliver(row.outcome === ANSWERED_SENDING ? "answered" : "replayed");
         return;
     }
     // 3. The ceiling, reloaded now.
@@ -623,7 +648,7 @@ async function runTelegramConversation(row, args) {
     }
     catch {
         report.problems.push("telegram chat could not read the current project records");
-        requeue("registry-unavailable");
+        await requeue("registry-unavailable");
         return;
     }
     const repos = telegramConversationRepos(store, binding.approver, registry);
@@ -638,6 +663,10 @@ async function runTelegramConversation(row, args) {
     }
     // 5. The session and thread — shared with the console and the CLI.
     const resolved = resolveTelegramMate(store, binding, repos, clock());
+    if (!resolved.ok && resolved.reason === "busy") {
+        await requeue("busy");
+        return;
+    }
     if (!resolved.ok) {
         if (resolved.said !== null)
             await notify(resolved.said);
@@ -676,10 +705,10 @@ async function runTelegramConversation(row, args) {
         store.bindTelegramConversationTurn(row.id, owner, session.id, receipt.turn);
     if (!outcome.ok && "refused" in outcome) {
         if (outcome.refused === "concurrent") {
-            requeue("busy");
+            await requeue("busy");
             return;
         }
-        await notify(`${outcome.message.charAt(0).toUpperCase()}${outcome.message.slice(1)}. Nothing was changed.`);
+        await notify(phoneText(couldNotAnswerText(outcome.message), 1_000));
         finish({ state: "failed", outcome: `refused:${outcome.refused}` });
         report.refused++;
         return;
@@ -687,7 +716,7 @@ async function runTelegramConversation(row, args) {
     if (!outcome.ok) {
         // Truthful: what failed, that nothing was kept, and that a new message
         // is a new turn. A failed turn's drafts are already gone.
-        const words = outcome.failed === "revoked" ? `${outcome.message.charAt(0).toUpperCase()}${outcome.message.slice(1)}.` : `The assistant's reply did not complete: ${outcome.message}. Nothing it proposed was kept. Send your message again if you still want it.`;
+        const words = outcome.failed === "revoked" ? `${outcome.message.charAt(0).toUpperCase()}${outcome.message.slice(1)}.` : couldNotAnswerText(`the assistant's reply did not complete (${outcome.message})`);
         await notify(phoneText(words, 1_000));
         finish({ state: "failed", outcome: `failed:${outcome.failed}` });
         report.refused++;
@@ -703,5 +732,5 @@ async function runTelegramConversation(row, args) {
     const proposals = store.listMateProposals(thread.id, ["pending"]).filter(one => one.turn === outcome.turn);
     if (!plan(session.id, outcome.turn, outcome.reply, proposals, who.repos) && store.listTelegramConversationParts(row.id).length === 0)
         return;
-    await deliver("answered");
+    await sendOrHandOff("answered");
 }

package/dist/telegram-settings.d.ts

@@ -3,7 +3,10 @@
  * the settings page; this card only mints or revokes the signed-in person's
  * pairing, never anyone else's. */
 import type { Store } from "./store.js";
+/** How long a written reply may wait to be sent before it shows here with a Retry. */
+export declare const UNSENT_REPLY_MS: number;
 export declare function telegramSettingsHtml(store: Store, botId: string | null, who: string, csrf: string, options?: {
     code?: string;
     problem?: string;
+    now?: Date;
 }): string;

package/dist/telegram-settings.js

@@ -1,3 +1,5 @@
+/** How long a written reply may wait to be sent before it shows here with a Retry. */
+export const UNSENT_REPLY_MS = 2 * 60_000;
 const escape = (text) => text
     .replaceAll("&", "&")
     .replaceAll("<", "&lt;")
@@ -17,6 +19,15 @@ export function telegramSettingsHtml(store, botId, who, csrf, options = {}) {
         const mine = bindings.filter(binding => binding.approver === who);
         const others = bindings.length - mine.length;
         content = `<p><strong>${mine.length > 0 ? "Your phone is paired." : "Your phone is not paired."}</strong> ${others === 0 ? "No teammates are paired yet." : `${others} teammate${others === 1 ? " is" : "s are"} paired.`}</p>`;
+        // A reply the assistant wrote that has not reached this person's phone for two minutes.
+        const unsent = store.unsentTelegramReplies(botId, who, new Date((options.now ?? new Date()).getTime() - UNSENT_REPLY_MS));
+        if (unsent.length > 0) {
+            const oldest = unsent[0];
+            content +=
+                `<div class="card" role="status" data-unsent-replies><p><strong>${unsent.length === 1 ? "A reply hasn't reached your phone" : `${unsent.length} replies haven't reached your phone`}</strong></p>` +
+                    `<p class="meta">Trying since ${escape(oldest.since.slice(11, 16))} UTC${oldest.error === null ? "" : `: ${escape(oldest.error)}`}</p>` +
+                    `<form method="post" action="/settings/telegram/retry">${hidden}<button type="submit">Retry</button></form></div>`;
+        }
         if (options.code !== undefined) {
             content +=
                 "<h2>Pair your phone</h2><p>Send this to the bot in a private Telegram chat within 10 minutes:</p>" +

package/dist/telegram.d.ts

@@ -98,6 +98,20 @@ export type TelegramUpload = {
     bytes: Buffer;
 };
 export declare function createTransport(token: string, timeoutMs?: number): TelegramTransport;
+/**
+ * Why this process can't reach Telegram the way the service does, or null.
+ * A coding agent's sandbox fences the network: Codex says so in its own
+ * variables, and Claude Code's sandbox routes traffic through a proxy on
+ * this computer, which curl uses and Node's fetch does not — so sends fail
+ * "fetch failed" while curl works (Oct 2). Builds, checks and agents also
+ * get a database of their own, so none of them can hold the live bridge;
+ * this keeps an agent-launched `watch` or `bridge` from holding it either.
+ */
+export declare function networkFence(env: Record<string, string | undefined>): string | null;
+/** The plain line a fenced process says instead of polling or sending. */
+export declare function networkFenceLine(reason: string): string;
+/** fetch's own message ("fetch failed") with the reason under it, e.g. "fetch failed (EMFILE: too many open files)". */
+export declare function transportError(error: unknown): string;
 /** The multipart body: every param a field (objects as JSON), the file last. Exported for the adapter's own test only. */
 export declare function multipartOf(params: Record<string, unknown>, upload: TelegramUpload): FormData;
 export declare function hashPairingCode(code: string): string;

package/dist/telegram.js

@@ -194,7 +194,7 @@ export function createTransport(token, timeoutMs = 30_000) {
         catch (error) {
             return {
                 ok: false,
-                description: scrub(error instanceof Error ? error.message : String(error), token),
+                description: scrub(transportError(error), token),
                 uncertain: true,
             };
         }
@@ -204,6 +204,48 @@ export function createTransport(token, timeoutMs = 30_000) {
         }
     };
 }
+/**
+ * Why this process can't reach Telegram the way the service does, or null.
+ * A coding agent's sandbox fences the network: Codex says so in its own
+ * variables, and Claude Code's sandbox routes traffic through a proxy on
+ * this computer, which curl uses and Node's fetch does not — so sends fail
+ * "fetch failed" while curl works (Oct 2). Builds, checks and agents also
+ * get a database of their own, so none of them can hold the live bridge;
+ * this keeps an agent-launched `watch` or `bridge` from holding it either.
+ */
+export function networkFence(env) {
+    const set = (name) => (env[name] ?? "") !== "";
+    if (set("CODEX_SANDBOX_NETWORK_DISABLED") || set("CODEX_SANDBOX"))
+        return "a Codex sandbox";
+    const agent = ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"].some(set);
+    const loopbackProxy = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy"].some(name => {
+        const value = env[name] ?? "";
+        if (value === "")
+            return false;
+        try {
+            return /^(?:localhost|127\.\d+\.\d+\.\d+|\[::1\])$/i.test(new URL(value.includes("://") ? value : `http://${value}`).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
+    return agent && loopbackProxy ? "a Claude Code sandbox" : null;
+}
+/** The plain line a fenced process says instead of polling or sending. */
+export function networkFenceLine(reason) {
+    return `Telegram: not connecting from here — this process runs inside ${reason}, which blocks its network. Replies and notifications go out from the Toolroll service.`;
+}
+/** fetch's own message ("fetch failed") with the reason under it, e.g. "fetch failed (EMFILE: too many open files)". */
+export function transportError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const cause = error instanceof Error ? error.cause : undefined;
+    if (cause === undefined || cause === null)
+        return message;
+    const code = typeof cause.code === "string" ? cause.code : null;
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    const why = code !== null && !detail.includes(code) ? `${code}: ${detail}` : detail;
+    return why === "" || why === message ? message : `${message} (${why.slice(0, 160)})`;
+}
 /** The multipart body: every param a field (objects as JSON), the file last. Exported for the adapter's own test only. */
 export function multipartOf(params, upload) {
     const form = new FormData();
@@ -332,12 +374,16 @@ export async function followBridge(store, options) {
     // turn must not stall the long poll, and each cycle's lease re-acquire is
     // the renewal that keeps this the only live poller meanwhile. One
     // processor at a time; its counts land on the totals when it finishes.
+    // It only persists the reply: the cycle sends it, in the same slot as
+    // notifications, so a reply never needs a connection of its own beside
+    // the long poll (Oct 2: replies failed "fetch failed" for minutes while
+    // notifications from the same process went out).
     let inFlight = null;
     const kick = () => {
         if (inFlight !== null || options.conversation === undefined || options.readProjects === undefined)
             return;
         const report = { sent: 0, answered: 0, paired: 0, ignored: 0, backlog: false, problems: [] };
-        inFlight = processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, signal)
+        inFlight = processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, signal, "turns")
             .catch(error => { report.problems.push(`telegram chat: ${error instanceof Error ? error.message : String(error)}`); })
             .finally(() => {
             inFlight = null;
@@ -449,13 +495,18 @@ export async function followBridge(store, options) {
                 await deliverOutbox(store, botId, transport, owner, clock, report, options.readProjects, options.canDeliver, options.conversation?.phoneOrigin, options.conversation?.evidenceRoot);
                 await deliverTeam(store, botId, transport, clock, report, options.readProjects, options.canDeliver, options.conversation?.phoneOrigin);
             }
+            // Replies the turn worker has planned go out here, like notifications.
+            if (options.conversation !== undefined && options.readProjects !== undefined) {
+                await processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, signal, "replies");
+            }
             // Pushed updates first (some may wait from before a fall back), then — only while
             // Telegram isn't pushing — ask for more.
             const pushed = await drainInbox({ store, botId, transport, clock, report, readProjects: options.readProjects, conversation: options.conversation, projects: null }, owner, lease.generation);
             if (pushed > 0)
                 report.pushed = pushed;
             if (!pushing()) {
-                await drainUpdates(store, botId, transport, owner, lease.generation, lease.cursor, clock, report, pollSeconds, signal, options.readProjects, options.conversation);
+                // While a turn is running, poll briefly so its reply is sent within a second or two of being written.
+                await drainUpdates(store, botId, transport, owner, lease.generation, lease.cursor, clock, report, inFlight === null ? pollSeconds : 1, signal, options.readProjects, options.conversation);
                 // A push address nobody here wants any more (the public address was removed): take it down, so asking works again.
                 if (report.webhookActive === true && push === null)
                     await transport("deleteWebhook", { drop_pending_updates: false }, signal);
@@ -474,11 +525,13 @@ export async function followBridge(store, options) {
                 total.chatRefused = (total.chatRefused ?? 0) + report.chatRefused;
             if (report.chatConfirmed !== undefined)
                 total.chatConfirmed = (total.chatConfirmed ?? 0) + report.chatConfirmed;
+            if (report.chatAnswered !== undefined)
+                total.chatAnswered = (total.chatAnswered ?? 0) + report.chatAnswered;
             total.problems.push(...report.problems);
-            if (report.sent > 0 || report.answered > 0 || report.paired > 0 || (report.statusReplies ?? 0) > 0 || (report.chatQueued ?? 0) > 0 || (report.chatRefused ?? 0) > 0 || (report.chatConfirmed ?? 0) > 0 || report.problems.length > 0) {
+            if (report.sent > 0 || report.answered > 0 || report.paired > 0 || (report.statusReplies ?? 0) > 0 || (report.chatQueued ?? 0) > 0 || (report.chatAnswered ?? 0) > 0 || (report.chatRefused ?? 0) > 0 || (report.chatConfirmed ?? 0) > 0 || report.problems.length > 0) {
                 options.onCycle?.(report);
             }
-            if (report.problems.length > 0 && report.sent === 0 && report.answered === 0) {
+            if (report.problems.length > 0 && report.sent === 0 && report.answered === 0 && (report.chatAnswered ?? 0) === 0) {
                 // The wire is down. Back off; the counter resets on the first clean cycle.
                 if (!signal.aborted) {
                     await wait(FOLLOW_BACKOFF_MS[Math.min(failures, FOLLOW_BACKOFF_MS.length - 1)]);
@@ -493,7 +546,7 @@ export async function followBridge(store, options) {
             const took = Date.now() - startedAt;
             // While Telegram pushes (v98) there is no long poll to wait on: a pushed update waits at most this long.
             const floor = pushing() ? PUSH_IDLE_MS : FOLLOW_IDLE_FLOOR_MS;
-            if (!signal.aborted && report.sent === 0 && report.answered === 0 && took < floor) {
+            if (!signal.aborted && report.sent === 0 && report.answered === 0 && (report.chatAnswered ?? 0) === 0 && took < floor) {
                 await wait(floor - took);
             }
         }
@@ -501,16 +554,25 @@ export async function followBridge(store, options) {
     finally {
         // A turn in flight finishes on its own bounds (the engine's wall clock);
         // its reply is fenced on the claim and the channel like every other part.
-        if (inFlight !== null)
+        if (inFlight !== null) {
             await inFlight;
+            // Its reply was written for the cycle that will not come: send it now, while the lease is still ours.
+            if (options.conversation !== undefined && options.readProjects !== undefined) {
+                const report = { sent: 0, answered: 0, paired: 0, ignored: 0, backlog: false, problems: [] };
+                await processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, undefined, "replies").catch(() => { });
+                if (report.chatAnswered !== undefined)
+                    total.chatAnswered = (total.chatAnswered ?? 0) + report.chatAnswered;
+                total.problems.push(...report.problems);
+            }
+        }
         store.releaseBridgeLease(botId, owner, clock());
     }
     return total;
 }
 /** The queued turns for one bot, counted onto the pass's report. */
-async function processConversations(store, botId, transport, owner, clock, report, readProjects, conversation, signal) {
+async function processConversations(store, botId, transport, owner, clock, report, readProjects, conversation, signal, only) {
     const chat = { answered: 0, refused: 0, problems: [] };
-    await processTelegramConversations({ store, botId, transport, owner, clock, readProjects, options: conversation, report: chat, ...(signal === undefined ? {} : { signal }) });
+    await processTelegramConversations({ store, botId, transport, owner, clock, readProjects, options: conversation, report: chat, ...(signal === undefined ? {} : { signal }), ...(only === undefined ? {} : { only }) });
     if (chat.answered > 0)
         report.chatAnswered = (report.chatAnswered ?? 0) + chat.answered;
     if (chat.refused > 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.10",
+  "version": "0.9.11",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"