switchroom 0.14.67 → 0.14.69

package/telegram-plugin/gateway/answer-thread-resolve.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { resolveAnswerThreadId } from './answer-thread-resolve.js'
+import { resolveAnswerThreadId, type AnswerThreadInput } from './answer-thread-resolve.js'
 
 describe('resolveAnswerThreadId — precedence', () => {
   it('(1) explicit model thread wins over everything', () => {
@@ -83,3 +83,137 @@ describe('resolveAnswerThreadId — precedence', () => {
     expect(resolveAnswerThreadId({ originResolved: false })).toBeUndefined()
   })
 })
+
+// ── TOTAL-ENUMERATION DETERMINISM PROOF ─────────────────────────────────────
+//
+// The operator standard (memory feedback_prove_finite_fsm_not_sample): a
+// passing sample is not a proof. `resolveAnswerThreadId` is a PURE decision
+// function over a FINITE input space — so we can prove its determinism by
+// CONSTRUCTION: enumerate every reachable input and assert totality,
+// determinism, no-fabrication, and the precedence the doc-comment promises.
+// Any future edit that perturbs the decision table on ANY of the 64 inputs
+// fails here — this block is the regression guard, the 9 examples above are
+// the human-readable map.
+//
+// Distinct symbolic thread ids so an output's provenance is unambiguous (no
+// two tiers share a value): explicit=70, origin=50, live=30, lastEnded=90.
+const T = 70 // explicit (tier 1)
+const O = 50 // origin   (tier 2)
+const L = 30 // live     (tier 3)
+const E = 90 // lastEnded(tier 4)
+
+function allInputs(): AnswerThreadInput[] {
+  const rows: AnswerThreadInput[] = []
+  for (const explicitThreadId of [undefined, T])
+    for (const originResolved of [false, true])
+      for (const originThreadId of [undefined, O])
+        for (const liveThreadId of [undefined, L])
+          for (const lastEndedResolvedForChat of [false, true])
+            for (const lastEndedThreadIdForChat of [undefined, E])
+              rows.push({
+                explicitThreadId,
+                originResolved,
+                originThreadId,
+                lastEndedResolvedForChat,
+                lastEndedThreadIdForChat,
+                liveThreadId,
+              })
+  return rows
+}
+
+// Independent reference encoding the documented precedence (the SPEC), kept
+// deliberately separate from the implementation so a regression in either
+// surfaces as a divergence rather than a silently-shared bug.
+function specExpected(i: AnswerThreadInput): number | undefined {
+  if (i.explicitThreadId != null) return i.explicitThreadId // tier 1
+  if (i.originResolved) return i.originThreadId // tier 2 (may be undefined: DM origin)
+  if (i.liveThreadId != null) return i.liveThreadId // tier 3
+  if (i.lastEndedResolvedForChat) return i.lastEndedThreadIdForChat // tier 4
+  return i.liveThreadId // catch-all (undefined here)
+}
+
+describe('resolveAnswerThreadId — total-enumeration determinism proof (all 64 inputs)', () => {
+  const ROWS = allInputs()
+
+  it('the input space is exactly 64 rows (2^6)', () => {
+    expect(ROWS.length).toBe(64)
+  })
+
+  it('TOTAL: every input returns without throwing', () => {
+    for (const i of ROWS) {
+      expect(() => resolveAnswerThreadId(i)).not.toThrow()
+    }
+  })
+
+  it('DETERMINISTIC: each input maps to exactly one output (idempotent across repeated calls)', () => {
+    for (const i of ROWS) {
+      const a = resolveAnswerThreadId(i)
+      const b = resolveAnswerThreadId({ ...i })
+      expect(b).toBe(a)
+    }
+  })
+
+  it('NO FABRICATION: every output is undefined or one of the four input thread fields', () => {
+    for (const i of ROWS) {
+      const out = resolveAnswerThreadId(i)
+      const provenance = new Set([
+        undefined,
+        i.explicitThreadId,
+        i.originThreadId,
+        i.liveThreadId,
+        i.lastEndedThreadIdForChat,
+      ])
+      expect(provenance.has(out)).toBe(true)
+    }
+  })
+
+  it('PRECEDENCE: matches the documented spec on all 64 inputs', () => {
+    for (const i of ROWS) {
+      expect(resolveAnswerThreadId(i)).toBe(specExpected(i))
+    }
+  })
+
+  // ── By-construction invariants: the output depends ONLY on the highest
+  //    RESOLVED tier, so no lower-tier input (notably a flipped live turn)
+  //    can perturb a higher tier's decision. These are the routing guarantees
+  //    the resolver exists to provide. ─────────────────────────────────────
+
+  it('INV-1 explicit DOMINANCE: explicit set ⇒ output === explicit, independent of all other fields', () => {
+    for (const i of ROWS) {
+      if (i.explicitThreadId != null) expect(resolveAnswerThreadId(i)).toBe(i.explicitThreadId)
+    }
+  })
+
+  it('INV-2 origin FLIP-IMMUNITY: no explicit + originResolved ⇒ output === originThreadId, for EVERY liveThreadId/lastEnded combo (the Brevo→Meta fix: a currentTurn flip cannot steal a resolved origin)', () => {
+    for (const i of ROWS) {
+      if (i.explicitThreadId == null && i.originResolved) {
+        expect(resolveAnswerThreadId(i)).toBe(i.originThreadId)
+      }
+    }
+  })
+
+  it('INV-3 recovery REACHABILITY: tier-4 (lastEnded) result occurs ONLY when no explicit, no origin, no live turn', () => {
+    for (const i of ROWS) {
+      const out = resolveAnswerThreadId(i)
+      // If the result came from the lastEnded field (and that field is the
+      // only one carrying that distinct value E), the three higher tiers must
+      // all be absent.
+      if (out === E) {
+        expect(i.explicitThreadId).toBeUndefined()
+        expect(i.originResolved).toBe(false)
+        expect(i.liveThreadId).toBeUndefined()
+        expect(i.lastEndedResolvedForChat).toBe(true)
+      }
+    }
+  })
+
+  it('INV-4 live-tier REACHABILITY: tier-3 (live) result occurs ONLY when no explicit and no resolved origin', () => {
+    for (const i of ROWS) {
+      const out = resolveAnswerThreadId(i)
+      if (out === L) {
+        expect(i.explicitThreadId).toBeUndefined()
+        expect(i.originResolved).toBe(false)
+      }
+    }
+  })
+})

package/telegram-plugin/gateway/gateway.ts

@@ -98,7 +98,7 @@ import * as pendingProgress from '../pending-work-progress.js'
 import { writeSilentEndState, clearSilentEndState, recordUndeliveredTurnEnd } from '../silent-end.js'
 import { isFinalAnswerReply, isSubstantiveFinalReply } from '../final-answer-detect.js'
 import { createAnswerStream, type AnswerStreamHandle } from '../answer-stream.js'
-import { parseVisibleAnswerStreamEnabled } from '../answer-stream-flag.js'
+import { parseVisibleAnswerStreamEnabled, parseDraftLaneRetiredEnabled } from '../answer-stream-flag.js'
 import { type SessionEvent } from '../session-tail.js'
 import {
   shouldSuppressToolActivity,
@@ -678,6 +678,14 @@ const AGENT_ADMIN = process.env.SWITCHROOM_AGENT_ADMIN === 'true'
 const bot = new Bot(TOKEN)
 installTgPostLogger(bot)
 
+// Draft-answer-lane retirement (2026-06-05): default RETIRED so the live answer
+// lane uses a real, mtcute-observable message instead of the invisible
+// compose-box draft. Declared HERE (above the boot-probe block) because
+// `sendMessageDraftFn` below reads it — keep it above its first use to avoid a
+// temporal-dead-zone ReferenceError at boot. Kill switch
+// SWITCHROOM_DRAFT_ANSWER_LANE=0 restores the legacy draft.
+const DRAFT_ANSWER_LANE_RETIRED = parseDraftLaneRetiredEnabled(process.env.SWITCHROOM_DRAFT_ANSWER_LANE)
+
 // ─── sendMessageDraft boot probe ──────────────────────────────────────────
 // grammY 1.x exposes all Telegram Bot API methods through bot.api.raw.
 // bot.api.sendMessageDraft (the typed wrapper) takes chat_id as number, but
@@ -695,7 +703,11 @@ const GRAMMY_VERSION: string = (() => {
 const sendMessageDraftFn: (
   (chatId: string, draftId: number, text: string, params?: { message_thread_id?: number; parse_mode?: 'HTML' }) => Promise<unknown>
 ) | undefined =
-  typeof _rawSendMessageDraft === 'function'
+  // When the draft lane is retired (default), force this undefined so BOTH
+  // consumers (the answer-stream config + the stream_reply handler) drop the
+  // draft transport and fall back to visible message transport — the single
+  // chokepoint for the retirement.
+  !DRAFT_ANSWER_LANE_RETIRED && typeof _rawSendMessageDraft === 'function'
     ? (chatId, draftId, text, params) =>
         (_rawSendMessageDraft as (args: Record<string, unknown>) => Promise<unknown>)({
           chat_id: Number(chatId),
@@ -1537,6 +1549,18 @@ const SERIALIZE_NOREPLY_DRAIN_MS =
 // behaviour (#1664: thread from the live currentTurn capture).
 const TURN_ORIGIN_ROUTING_ENABLED =
   process.env.SWITCHROOM_TURN_ORIGIN_ROUTING !== '0'
+// Framework-owned origin recovery (2026-06-05 determinism pass). The origin
+// signal that survives a currentTurn flip (tier 2) travels through the MODEL
+// (it echoes `origin_turn_id`). When the model OMITS it, routing falls to the
+// live turn — the wrong topic if currentTurn flipped (HOLE a). The model rarely
+// passes `reply_to` explicitly, but WHEN it quotes a specific earlier message
+// that message_id is a FRAMEWORK-owned anchor: reverse-index it to the turn
+// that owns it and recover the origin without the model echo. Strictly
+// additive — it only fires when the echo is absent AND a quote is present, and
+// resolves to the ACTUAL origin turn (never the live successor), so it cannot
+// mask a misroute. Kill switch off (=0) → echo-only origin (today's behaviour).
+const FRAMEWORK_ORIGIN_ROUTING_ENABLED =
+  process.env.SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'
 // Component 4 (per-turn topic framing). Add a one-line directive to the
 // channel meta + bridge instructions telling the model to answer ONLY the
 // current message's topic. Kill switch off (=0) → no framing field.
@@ -1846,14 +1870,57 @@ let currentTurn: CurrentTurn | null = null
 // a long-lived supergroup session.
 const RECENT_TURNS_MAX = 32
 const recentTurnsById = new Map<string, CurrentTurn>()
+// Framework-owned origin recovery: reverse-index from an inbound's source
+// message_id to the turnId that owns it, so a reply that QUOTES a specific
+// message (args.reply_to) resolves its origin turn deterministically — a
+// real message_id the framework stamped, never a model-asserted thread.
+// Evicted in lock-step with recentTurnsById so it can't outgrow it.
+const recentTurnIdBySourceMessageId = new Map<number, string>()
 function rememberRecentTurn(turn: CurrentTurn): void {
   recentTurnsById.set(turn.turnId, turn)
+  if (turn.sourceMessageId != null) {
+    recentTurnIdBySourceMessageId.set(turn.sourceMessageId, turn.turnId)
+  }
   while (recentTurnsById.size > RECENT_TURNS_MAX) {
     const oldest = recentTurnsById.keys().next().value
     if (oldest === undefined) break
+    const evicted = recentTurnsById.get(oldest)
     recentTurnsById.delete(oldest)
+    // Drop the reverse-index entry for the evicted turn (only when it still
+    // points at THIS turn — a newer turn may have reused the same message id).
+    if (evicted?.sourceMessageId != null &&
+        recentTurnIdBySourceMessageId.get(evicted.sourceMessageId) === oldest) {
+      recentTurnIdBySourceMessageId.delete(evicted.sourceMessageId)
+    }
   }
 }
+
+/**
+ * Framework-owned origin recovery (kill switch SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING).
+ * Resolve the turn that owns a reply from the message_id it QUOTES (args.reply_to),
+ * via the source-message reverse index. Returns null when disabled, when reply_to
+ * is absent/non-numeric, or when no turn owns that message id (evicted / unknown).
+ * Deterministic: a real framework-stamped message_id → its turn, with no model
+ * thread assertion and no dependence on the live currentTurn.
+ *
+ * SCOPED to `chatId`: Telegram numbers message ids PER CHAT, so the same numeric
+ * id exists in a DM and a supergroup. The reverse index is keyed by id alone, so
+ * the resolved turn MUST be confirmed to belong to this reply's chat — otherwise
+ * a reply quoting its own id could inherit another chat's thread (a cross-chat
+ * leak). On a chat mismatch we return null (decline to recover → fall through to
+ * the live-turn behaviour), never a wrong-chat thread.
+ */
+function findTurnByQuotedMessageId(chatId: string, replyTo: unknown): CurrentTurn | null {
+  if (!FRAMEWORK_ORIGIN_ROUTING_ENABLED) return null
+  if (replyTo == null) return null
+  const mid = Number(replyTo)
+  if (!Number.isFinite(mid)) return null
+  const owner = recentTurnIdBySourceMessageId.get(mid)
+  if (owner == null) return null
+  const turn = recentTurnsById.get(owner) ?? null
+  if (turn == null || turn.sessionChatId !== chatId) return null
+  return turn
+}
 /**
  * Component 3 — derive the stable per-turn identity from the chat, thread,
  * and originating message id. Stamped into the inbound meta at build time
@@ -1920,13 +1987,26 @@ function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
  * timestamps. This wrapper logs, per reply: which precedence tier won (`via`),
  * the resolved thread, the origin turn + its thread, and whether the reply was
  * late (turn already ended). `via=recovered` marks a late reply this fix saved
- * from General; `UNROUTED` flags a supergroup reply that still resolved to no
- * topic (the residual gap to watch).
+ * from General; `via=quoted` marks an origin recovered from the framework-owned
+ * quoted message_id (no model echo); `UNROUTED` flags a supergroup reply that
+ * resolved to no topic with NO owner turn to attribute it to (genuinely lost).
+ * `MISROUTE_RISK` flags the irreducible determinism residual: a no-echo,
+ * no-quote reply that fell to the LIVE turn while a DIFFERENT topic recently had
+ * a turn — the framework cannot tell which topic the bare reply answers, so the
+ * routing MIGHT be wrong (HOLE a). It is observability only (the reply still
+ * routes to the live turn) — it makes the one case that is genuinely
+ * model-dependent visible instead of silently mis-routed. A General-topic turn
+ * legitimately has no thread, so its replies are NOT UNROUTED-flagged.
+ *
+ * `originVia` distinguishes how the origin turn was resolved: 'echo' (model
+ * echoed origin_turn_id), 'quoted' (framework recovered it from args.reply_to),
+ * or null (no origin turn). It only affects the `via` label, never the routing.
  */
 function resolveAnswerThreadWithLog(
   chatId: string,
   explicitThreadId: number | undefined,
   originTurn: CurrentTurn | null,
+  originVia: 'echo' | 'quoted' | null,
   liveTurn: CurrentTurn | null,
   surface: 'reply' | 'stream_reply',
 ): number | undefined {
@@ -1953,24 +2033,60 @@ function resolveAnswerThreadWithLog(
   })
   const via =
     explicitThreadId != null ? 'explicit'
-    : originTurn != null ? 'origin'
+    : originTurn != null ? (originVia === 'quoted' ? 'quoted' : 'origin')
     : liveTurn?.sessionThreadId != null ? 'live'
     : recovered != null ? 'recovered'
     : 'none'
   const ownerTurn = originTurn ?? recovered ?? liveTurn
   const isSupergroup = chatId.startsWith('-100')
-  const unrouted = isSupergroup && threadId == null
+  // UNROUTED = a supergroup reply that resolved to NO topic with NO owner turn
+  // to attribute it to (genuinely lost). A General-topic turn legitimately has
+  // no thread, so a reply owned by it resolving to `-` is CORRECT, not lost —
+  // gate on `ownerTurn == null` so General replies don't false-alarm (found by
+  // the multi-topic UAT stress, 2026-06-05).
+  const unrouted = isSupergroup && threadId == null && ownerTurn == null
+  // MISROUTE_RISK = the irreducible determinism residual (HOLE a). A no-echo,
+  // no-quote reply fell to the LIVE turn (via=live), but a DIFFERENT topic
+  // recently had a turn for this chat — so this bare reply MIGHT belong to that
+  // other topic and we cannot tell without the model's echo. Observability only;
+  // routing is unchanged. This is the one case framework state cannot
+  // disambiguate, surfaced instead of silently mis-routed.
+  const misrouteRisk =
+    isSupergroup &&
+    via === 'live' &&
+    hasDifferentThreadedRecentTurn(chatId, liveTurn?.sessionThreadId)
   process.stderr.write(
     `telegram gateway: reply-route surface=${surface} chat=${chatId} ` +
       `resolved_thread=${threadId ?? '-'} via=${via} late=${liveTurn == null} ` +
       `originTurn=${ownerTurn?.turnId ?? '-'} origin_thread=${ownerTurn?.sessionThreadId ?? '-'}` +
       (via === 'recovered' ? ' RECOVERED' : '') +
+      (via === 'quoted' ? ' QUOTED(framework-origin)' : '') +
       (unrouted ? ' UNROUTED(supergroup→no-topic)' : '') +
+      (misrouteRisk ? ' MISROUTE_RISK(no-echo→live-successor)' : '') +
       '\n',
   )
   return threadId
 }
 
+/**
+ * Determinism-residual detector (HOLE a observability). True when a DIFFERENT
+ * forum topic recently had a turn for this chat than the live turn's thread —
+ * i.e. a currentTurn flip plausibly happened, so a no-echo / no-quote reply
+ * routed to the live turn MIGHT belong to the other topic. Scans the bounded
+ * recently-ended registry; cheap (≤32 entries). Used only to ALARM, never to
+ * route.
+ */
+function hasDifferentThreadedRecentTurn(
+  chatId: string,
+  liveThreadId: number | undefined,
+): boolean {
+  const live = liveThreadId ?? null
+  for (const t of recentTurnsById.values()) {
+    if (t.sessionChatId === chatId && (t.sessionThreadId ?? null) !== live) return true
+  }
+  return false
+}
+
 /**
  * PR2 obligation-ledger CLOSE. Called when a SUBSTANTIVE final answer lands
  * (not a bare interim ack — using finalAnswerSubstantive, the #2141 signal): the
@@ -6619,11 +6735,17 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   let threadId: number | undefined
   if (TURN_ORIGIN_ROUTING_ENABLED) {
     const explicit = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    const originTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+    // Origin precedence: model echo first (authoritative), then the
+    // framework-owned quoted message_id (deterministic, no model thread
+    // assertion) as a fallback when the model omitted the echo.
+    const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+    const quotedTurn = echoedTurn == null ? findTurnByQuotedMessageId(chat_id, args.reply_to) : null
+    const originTurn = echoedTurn ?? quotedTurn
     threadId = resolveAnswerThreadWithLog(
       chat_id,
       Number.isFinite(explicit as number) ? (explicit as number) : undefined,
       originTurn,
+      originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted',
       turn,
       'reply',
     )
@@ -7276,11 +7398,17 @@ async function executeStreamReply(args: Record<string, unknown>): Promise<unknow
   if (args.message_thread_id == null) {
     let injected: number | undefined
     if (TURN_ORIGIN_ROUTING_ENABLED) {
-      const originTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+      // Origin precedence: model echo first, then the framework-owned quoted
+      // message_id as a deterministic fallback (mirrors executeReply).
+      const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+      const quotedTurn =
+        echoedTurn == null ? findTurnByQuotedMessageId(String(args.chat_id), args.reply_to) : null
+      const originTurn = echoedTurn ?? quotedTurn
       injected = resolveAnswerThreadWithLog(
         String(args.chat_id),
         undefined,
         originTurn,
+        originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted',
         turn,
         'stream_reply',
       )
@@ -9545,7 +9673,13 @@ function handleSessionEvent(ev: SessionEvent): void {
             // General). With the gate unreachable the only posted message is
             // the canonical reply. (The gate is bypassed for DM draft
             // transport, so DM draft streaming is unaffected.)
-            ...(ANSWER_STREAM_VISIBLE_ENABLED
+            // Draft retired (default) OR visible explicitly on → a real
+            // edit-in-place message (minInitialChars:1, no draft): observable by
+            // the UAT and the onMetric silence-liveness reset fires on visible
+            // sends in DMs AND supergroups. Legacy draft only when the kill
+            // switch re-enables it (DRAFT_ANSWER_LANE_RETIRED=false), which also
+            // restores sendMessageDraftFn above.
+            ...(ANSWER_STREAM_VISIBLE_ENABLED || DRAFT_ANSWER_LANE_RETIRED
               ? { minInitialChars: 1 }
               : { sendMessageDraft: sendMessageDraftFn, minInitialChars: Number.MAX_SAFE_INTEGER }),
             // #1075: route through robustApiCall so flood-wait,
@@ -9835,7 +9969,13 @@ function handleSessionEvent(ev: SessionEvent): void {
         const streamedMsgId = stream.messageId()
         const streamedFinalText = turn.capturedText.join('').trim()
         if (
-          ANSWER_STREAM_VISIBLE_ENABLED
+          // Broadened for draft retirement: a text-only no-reply turn that
+          // streamed a VISIBLE preview must materialize a pinged final answer +
+          // delete the preview. Without this, the retired-default path would
+          // fall into the else-branch retract() and delete the user's only copy
+          // of the answer (a lost-answer bug). The reply-tool branch still hits
+          // retract() → single canonical formatted reply, no flash.
+          (ANSWER_STREAM_VISIBLE_ENABLED || DRAFT_ANSWER_LANE_RETIRED)
           && !turn.replyCalled
           && streamedMsgId != null
           && streamedFinalText.length > 0
@@ -20565,7 +20705,7 @@ void (async () => {
         }
       }
 
-      process.stderr.write(`telegram gateway: answer-stream draft transport=${sendMessageDraftFn != null ? 'available' : 'unavailable'} grammy=${GRAMMY_VERSION}\n`)
+      process.stderr.write(`telegram gateway: answer-stream lane=${DRAFT_ANSWER_LANE_RETIRED ? 'visible(draft-retired)' : (ANSWER_STREAM_VISIBLE_ENABLED ? 'visible' : 'draft')} draftFn=${sendMessageDraftFn != null ? 'available' : 'off'} grammy=${GRAMMY_VERSION}\n`)
       process.stderr.write(`telegram gateway: starting bot polling pid=${process.pid} agent=${process.env.SWITCHROOM_AGENT_NAME ?? '-'} stateDir=${STATE_DIR} historyEnabled=${HISTORY_ENABLED} streamMode=${process.env.SWITCHROOM_TG_STREAM_MODE ?? 'checklist'}\n`)
       runnerHandle = run(bot, {
         runner: {

package/telegram-plugin/tests/answer-stream-flag.test.ts

@@ -6,7 +6,7 @@
  */
 
 import { describe, it, expect } from 'vitest'
-import { parseVisibleAnswerStreamEnabled } from '../answer-stream-flag.js'
+import { parseVisibleAnswerStreamEnabled, parseDraftLaneRetiredEnabled } from '../answer-stream-flag.js'
 
 describe('parseVisibleAnswerStreamEnabled — default OFF, opt-in', () => {
   it('defaults OFF when unset', () => {
@@ -25,3 +25,21 @@ describe('parseVisibleAnswerStreamEnabled — default OFF, opt-in', () => {
     }
   })
 })
+
+describe('parseDraftLaneRetiredEnabled — default RETIRED (2026-06-05), kill-switch off', () => {
+  it('defaults to RETIRED (true) when unset — the draft lane is gone by default', () => {
+    expect(parseDraftLaneRetiredEnabled(undefined)).toBe(true)
+  })
+
+  it('stays RETIRED for any non-disable value (including unrecognized)', () => {
+    for (const v of ['1', 'true', 'on', 'yes', '', '   ', 'whatever', 'retired']) {
+      expect(parseDraftLaneRetiredEnabled(v)).toBe(true)
+    }
+  })
+
+  it('restores the legacy draft (false) ONLY on an explicit disable (case/space-insensitive)', () => {
+    for (const v of ['0', 'false', 'off', 'no', ' FALSE ', 'Off', 'NO']) {
+      expect(parseDraftLaneRetiredEnabled(v)).toBe(false)
+    }
+  })
+})

package/telegram-plugin/tests/draft-retirement-wiring.test.ts

@@ -0,0 +1,52 @@
+/**
+ * Draft-answer-lane retirement — gateway wiring guards (2026-06-05).
+ *
+ * The retirement switches the live answer lane from the invisible compose-box
+ * draft to a real, mtcute-observable edit-in-place message, default-on. The
+ * design review flagged two ways this silently breaks (gateway IIFE can't be
+ * instantiated in-process, so these are source-level assertions, same pattern as
+ * silence-liveness-wiring.test):
+ *
+ *  PRIMARY: drop sendMessageDraftFn but FORGET to flip minInitialChars to 1 →
+ *  the lane becomes a total no-op (the MAX gate never opens it), losing ALL
+ *  answer-lane status AND the #2169 onMetric silence-liveness reset.
+ *  SECONDARY: flip the lane to visible but FORGET to broaden the
+ *  materialize-as-answer guard → a text-only no-reply turn falls into retract()
+ *  and deletes the user's only copy of the answer (a lost-answer bug).
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
+
+describe('draft-retirement wiring', () => {
+  it('sendMessageDraftFn is gated on the retirement (the single chokepoint)', () => {
+    expect(gatewaySrc).toMatch(/!DRAFT_ANSWER_LANE_RETIRED && typeof _rawSendMessageDraft === 'function'/)
+  })
+
+  it('DRAFT_ANSWER_LANE_RETIRED is declared before its first use (no TDZ at boot)', () => {
+    const declIdx = gatewaySrc.indexOf('const DRAFT_ANSWER_LANE_RETIRED =')
+    const firstUseIdx = gatewaySrc.indexOf('!DRAFT_ANSWER_LANE_RETIRED && typeof _rawSendMessageDraft')
+    expect(declIdx).toBeGreaterThan(0)
+    expect(firstUseIdx).toBeGreaterThan(declIdx)
+  })
+
+  it('PRIMARY GUARD: retired lane uses minInitialChars:1 (visible), never the MAX no-op gate', () => {
+    // The config must pick the {minInitialChars:1} branch when retired, so the
+    // lane actually opens a real message. The MAX branch is draft-only (legacy).
+    expect(gatewaySrc).toMatch(/ANSWER_STREAM_VISIBLE_ENABLED \|\| DRAFT_ANSWER_LANE_RETIRED\s*\n?\s*\?\s*\{ minInitialChars: 1 \}/)
+  })
+
+  it('SECONDARY GUARD: the materialize-as-answer guard is broadened in lockstep', () => {
+    // A text-only no-reply turn must materialize (ping + delete preview), not
+    // retract() the answer away.
+    expect(gatewaySrc).toMatch(/\(ANSWER_STREAM_VISIBLE_ENABLED \|\| DRAFT_ANSWER_LANE_RETIRED\)\s*\n?\s*&& !turn\.replyCalled/)
+  })
+
+  it('the #2169 onMetric silence-liveness reset is preserved (fires on visible sends now)', () => {
+    const onMetric = (gatewaySrc.split('onMetric: (metricEv) => {')[1] ?? '').split('\n            },')[0]
+    expect(onMetric).toMatch(/silencePoke\.noteProduction/)
+    expect(onMetric).toMatch(/currentTurn === turn/)
+  })
+})

package/telegram-plugin/tests/multitopic-routing-wiring.test.ts

@@ -67,6 +67,51 @@ describe('component 3 — turn-origin reply routing', () => {
   })
 })
 
+describe('framework-owned origin recovery (determinism residual, 2026-06-05)', () => {
+  it('a source-message reverse index is populated at enqueue and EVICTED in parity with recentTurnsById', () => {
+    expect(gatewaySrc).toMatch(/const recentTurnIdBySourceMessageId = new Map<number, string>\(\)/)
+    // Populated inside rememberRecentTurn from the turn's sourceMessageId.
+    const fn = gatewaySrc.split('function rememberRecentTurn')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.set\(turn\.sourceMessageId, turn\.turnId\)/)
+    // Eviction parity: the reverse entry is dropped when its turn is evicted —
+    // so the index cannot outgrow the bounded RECENT_TURNS_MAX registry.
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.delete\(evicted\.sourceMessageId\)/)
+  })
+
+  it('both reply paths recover origin from the quoted message_id when the model omits the echo', () => {
+    for (const name of ['executeReply', 'executeStreamReply']) {
+      const fn = gatewaySrc.split(new RegExp(`async function ${name}`))[1]?.split('\nasync function ')[0] ?? ''
+      // Echo first (authoritative), quoted message_id as the framework fallback.
+      expect(fn).toMatch(/const echoedTurn = findTurnByOriginId\(args\.origin_turn_id/)
+      // Quoted lookup is CHAT-SCOPED (cross-chat message-id collision guard).
+      expect(fn).toMatch(/findTurnByQuotedMessageId\([^,]+, args\.reply_to\)/)
+      expect(fn).toMatch(/echoedTurn \?\? quotedTurn/)
+    }
+  })
+
+  it('findTurnByQuotedMessageId is gated on the kill switch and resolves a real turn (never the live successor)', () => {
+    const fn = gatewaySrc.split('function findTurnByQuotedMessageId')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/FRAMEWORK_ORIGIN_ROUTING_ENABLED/)
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.get\(mid\)/)
+    expect(fn).toMatch(/recentTurnsById\.get\(owner\)/)
+    // Cross-chat collision guard: the resolved turn must belong to this chat.
+    expect(fn).toMatch(/turn\.sessionChatId !== chatId/)
+  })
+
+  it('the irreducible no-echo residual is ALARMED (MISROUTE_RISK), never silently mis-routed', () => {
+    expect(gatewaySrc).toMatch(/MISROUTE_RISK\(no-echo→live-successor\)/)
+    expect(gatewaySrc).toMatch(/function hasDifferentThreadedRecentTurn/)
+    // The alarm is observability-only: it fires on via=live with a different
+    // recent topic, and does NOT change the resolved thread.
+    expect(gatewaySrc).toMatch(/const misrouteRisk =/)
+    expect(gatewaySrc).toMatch(/via === 'quoted' \? ' QUOTED\(framework-origin\)' : ''/)
+  })
+
+  it('the kill switch defaults ON and is independent of TURN_ORIGIN_ROUTING', () => {
+    expect(gatewaySrc).toMatch(/SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'/)
+  })
+})
+
 describe('component 4 — per-turn topic framing', () => {
   it('the gateway stamps a topic_scope directive for forum-topic inbounds (kill-switched)', () => {
     expect(gatewaySrc).toMatch(/TOPIC_FRAMING_ENABLED/)

package/telegram-plugin/uat/scenarios/fuzz-cross-surface-ordering-channel.test.ts

@@ -0,0 +1,100 @@
+/**
+ * Cross-surface ordering stress — a DM question and a supergroup question
+ * back-to-back, assert each answer lands in ITS OWN surface (DM answer in the
+ * DM, channel answer in the channel) with no cross-contamination.
+ *
+ * One Claude CLI serves both the DM and the supergroup through a singleton
+ * currentTurn; a late or mis-attributed reply can leak across surfaces (a DM
+ * answer posted into the channel, or vice versa) — the cross-surface twin of
+ * the multi-topic bleed. This is the "handling messages in multiple channels"
+ * concern at the DM-vs-channel axis. Self-skips green without a resolvable
+ * SWITCHROOM_UAT_CHAT_ID supergroup (uat/** is non-gating).
+ */
+import { describe, it, expect, beforeAll } from "vitest";
+import { spinUp, type Scenario } from "../harness.js";
+import { isWorkerFeedMessage, isActivityFeedMessage } from "../assertions.js";
+import type { ObservedMessage } from "../driver.js";
+
+const SUPERGROUP_ID = Number.parseInt(process.env.SWITCHROOM_UAT_CHAT_ID ?? "", 10);
+
+interface Hit { chatId: number; text: string; messageId: number; }
+
+function isAnswer(m: ObservedMessage, driverUserId: number): boolean {
+  return m.senderUserId !== driverUserId && !m.edited
+    && !isWorkerFeedMessage(m) && !isActivityFeedMessage(m) && m.text.trim().length > 0;
+}
+
+describe("uat: cross-surface ordering — DM Q + channel Q, no surface bleed", () => {
+  let sc: Scenario | null = null;
+  let postable = false;
+
+  beforeAll(async () => {
+    if (!Number.isFinite(SUPERGROUP_ID)) {
+      console.warn("[uat] SWITCHROOM_UAT_CHAT_ID unset — skipping cross-surface ordering");
+      return;
+    }
+    sc = await spinUp({ agent: "test-harness" });
+    await sc.driver.primeDialogs();
+    postable = await sc.driver.canResolve(SUPERGROUP_ID);
+    if (!postable) console.warn(`[uat] supergroup ${SUPERGROUP_ID} not resolvable — skipping`);
+  });
+
+  it("DM answer stays in the DM and channel answer stays in the channel (no leak)", async () => {
+    if (sc == null || !postable) return; // self-skip green
+    const { driver, driverUserId, botUserId } = sc;
+    await driver.primeDialogs();
+
+    const dmIter = driver.observeMessages(botUserId)[Symbol.asyncIterator]();
+    const sgIter = driver.observeMessages(SUPERGROUP_ID)[Symbol.asyncIterator]();
+
+    // Distinct answers per surface: DM → 14, channel → 42.
+    await driver.sendText(botUserId, "Reply with only the number and nothing else: what is 7 + 7?");
+    await driver.sendText(SUPERGROUP_ID, "Reply with only the number and nothing else: what is 40 + 2?");
+
+    let dmHit: Hit | undefined;
+    let sgHit: Hit | undefined;
+    const strays: Hit[] = []; // an expected-answer token observed in the WRONG surface
+
+    const deadline = Date.now() + 120_000;
+    const pump = async (iter: AsyncIterator<ObservedMessage>, chatId: number) => {
+      while (Date.now() < deadline && !(dmHit && sgHit)) {
+        const next = await Promise.race([
+          iter.next(),
+          new Promise<{ done: true; value: undefined }>((r) =>
+            setTimeout(() => r({ done: true, value: undefined }), Math.max(0, deadline - Date.now())),
+          ),
+        ]);
+        if (next.done || next.value == null) break;
+        const m = next.value as ObservedMessage;
+        if (!isAnswer(m, driverUserId)) continue;
+        const hit: Hit = { chatId: m.chatId, text: m.text, messageId: m.messageId };
+        const has14 = /(^|\D)14(\D|$)/.test(m.text);
+        const has42 = /(^|\D)42(\D|$)/.test(m.text);
+        if (chatId === botUserId) {
+          if (has14 && dmHit == null) dmHit = hit;
+          if (has42) strays.push(hit); // channel answer leaked into the DM
+        } else {
+          if (has42 && sgHit == null) sgHit = hit;
+          if (has14) strays.push(hit); // DM answer leaked into the channel
+        }
+      }
+    };
+    await Promise.all([pump(dmIter, botUserId), pump(sgIter, SUPERGROUP_ID)]);
+    void dmIter.return?.();
+    void sgIter.return?.();
+
+    console.log(
+      `[cross-surface] dm(7+7=14)=${dmHit ? `msg=${dmHit.messageId}` : "MISSING"} ` +
+        `channel(40+2=42)=${sgHit ? `msg=${sgHit.messageId}` : "MISSING"} strays=${strays.length}`,
+    );
+
+    // Invariant 1: both answered.
+    expect(dmHit, "DM question (7+7=14) was never answered in the DM").toBeDefined();
+    expect(sgHit, "channel question (40+2=42) was never answered in the channel").toBeDefined();
+    // Invariant 2: no answer leaked to the wrong surface.
+    expect(strays, `an answer leaked across surfaces: ${JSON.stringify(strays)}`).toHaveLength(0);
+    // Invariant 3 (belt+braces): the right answer is in the right chat.
+    expect(dmHit!.chatId).toBe(botUserId);
+    expect(sgHit!.chatId).toBe(SUPERGROUP_ID);
+  }, 150_000);
+});