switchroom 0.14.68 → 0.14.69

package/dist/cli/switchroom.js

@@ -49601,8 +49601,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.68";
-var COMMIT_SHA = "4f371b79";
+var VERSION = "0.14.69";
+var COMMIT_SHA = "a3def2a8";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.68",
+  "version": "0.14.69",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -52776,10 +52776,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.68";
-var COMMIT_SHA = "4f371b79";
-var COMMIT_DATE = "2026-06-05T10:24:42Z";
-var LATEST_PR = 2174;
+var VERSION = "0.14.69";
+var COMMIT_SHA = "a3def2a8";
+var COMMIT_DATE = "2026-06-05T22:00:53+10:00";
+var LATEST_PR = null;
 var COMMITS_AHEAD_OF_TAG = 3;
 
 // gateway/boot-version.ts
@@ -54026,6 +54026,7 @@ var _noReplyDrainRaw = process.env.SWITCHROOM_SERIALIZE_NOREPLY_DRAIN_MS;
 var _noReplyDrainParsed = _noReplyDrainRaw != null && _noReplyDrainRaw !== "" ? Number(_noReplyDrainRaw) : 2500;
 var SERIALIZE_NOREPLY_DRAIN_MS = Number.isFinite(_noReplyDrainParsed) && _noReplyDrainParsed > 0 ? _noReplyDrainParsed : 2500;
 var TURN_ORIGIN_ROUTING_ENABLED = process.env.SWITCHROOM_TURN_ORIGIN_ROUTING !== "0";
+var FRAMEWORK_ORIGIN_ROUTING_ENABLED = process.env.SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== "0";
 var TOPIC_FRAMING_ENABLED = process.env.SWITCHROOM_TOPIC_FRAMING !== "0";
 var QUEUED_STATUS_UX_ENABLED = process.env.SWITCHROOM_QUEUED_STATUS_UX !== "0";
 var FEED_REOPEN_AFTER_ACK_ENABLED = process.env.SWITCHROOM_FEED_REOPEN_AFTER_ACK !== "0";
@@ -54058,15 +54059,39 @@ var progressUpdateTurnCount = new Map;
 var currentTurn = null;
 var RECENT_TURNS_MAX = 32;
 var recentTurnsById = new Map;
+var recentTurnIdBySourceMessageId = new Map;
 function rememberRecentTurn(turn) {
   recentTurnsById.set(turn.turnId, turn);
+  if (turn.sourceMessageId != null) {
+    recentTurnIdBySourceMessageId.set(turn.sourceMessageId, turn.turnId);
+  }
   while (recentTurnsById.size > RECENT_TURNS_MAX) {
     const oldest = recentTurnsById.keys().next().value;
     if (oldest === undefined)
       break;
+    const evicted = recentTurnsById.get(oldest);
     recentTurnsById.delete(oldest);
+    if (evicted?.sourceMessageId != null && recentTurnIdBySourceMessageId.get(evicted.sourceMessageId) === oldest) {
+      recentTurnIdBySourceMessageId.delete(evicted.sourceMessageId);
+    }
   }
 }
+function findTurnByQuotedMessageId(chatId, replyTo) {
+  if (!FRAMEWORK_ORIGIN_ROUTING_ENABLED)
+    return null;
+  if (replyTo == null)
+    return null;
+  const mid = Number(replyTo);
+  if (!Number.isFinite(mid))
+    return null;
+  const owner = recentTurnIdBySourceMessageId.get(mid);
+  if (owner == null)
+    return null;
+  const turn = recentTurnsById.get(owner) ?? null;
+  if (turn == null || turn.sessionChatId !== chatId)
+    return null;
+  return turn;
+}
 function deriveTurnId(chatId, threadId, messageId) {
   if (messageId == null || messageId === "" || String(messageId) === "0")
     return null;
@@ -54088,7 +54113,7 @@ function findLatestEndedTurnForChat(chatId) {
   }
   return latest;
 }
-function resolveAnswerThreadWithLog(chatId, explicitThreadId, originTurn, liveTurn, surface) {
+function resolveAnswerThreadWithLog(chatId, explicitThreadId, originTurn, originVia, liveTurn, surface) {
   const recovered = LATE_REPLY_TOPIC_RECOVERY_ENABLED && explicitThreadId == null && originTurn == null && liveTurn == null ? findLatestEndedTurnForChat(chatId) : null;
   const threadId = resolveAnswerThreadId({
     explicitThreadId,
@@ -54098,14 +54123,23 @@ function resolveAnswerThreadWithLog(chatId, explicitThreadId, originTurn, liveTu
     lastEndedResolvedForChat: recovered != null,
     lastEndedThreadIdForChat: recovered?.sessionThreadId
   });
-  const via = explicitThreadId != null ? "explicit" : originTurn != null ? "origin" : liveTurn?.sessionThreadId != null ? "live" : recovered != null ? "recovered" : "none";
+  const via = explicitThreadId != null ? "explicit" : originTurn != null ? originVia === "quoted" ? "quoted" : "origin" : liveTurn?.sessionThreadId != null ? "live" : recovered != null ? "recovered" : "none";
   const ownerTurn = originTurn ?? recovered ?? liveTurn;
   const isSupergroup = chatId.startsWith("-100");
-  const unrouted = isSupergroup && threadId == null;
-  process.stderr.write(`telegram gateway: reply-route surface=${surface} chat=${chatId} resolved_thread=${threadId ?? "-"} via=${via} late=${liveTurn == null} originTurn=${ownerTurn?.turnId ?? "-"} origin_thread=${ownerTurn?.sessionThreadId ?? "-"}` + (via === "recovered" ? " RECOVERED" : "") + (unrouted ? " UNROUTED(supergroup\u2192no-topic)" : "") + `
+  const unrouted = isSupergroup && threadId == null && ownerTurn == null;
+  const misrouteRisk = isSupergroup && via === "live" && hasDifferentThreadedRecentTurn(chatId, liveTurn?.sessionThreadId);
+  process.stderr.write(`telegram gateway: reply-route surface=${surface} chat=${chatId} resolved_thread=${threadId ?? "-"} via=${via} late=${liveTurn == null} originTurn=${ownerTurn?.turnId ?? "-"} origin_thread=${ownerTurn?.sessionThreadId ?? "-"}` + (via === "recovered" ? " RECOVERED" : "") + (via === "quoted" ? " QUOTED(framework-origin)" : "") + (unrouted ? " UNROUTED(supergroup\u2192no-topic)" : "") + (misrouteRisk ? " MISROUTE_RISK(no-echo\u2192live-successor)" : "") + `
 `);
   return threadId;
 }
+function hasDifferentThreadedRecentTurn(chatId, liveThreadId) {
+  const live = liveThreadId ?? null;
+  for (const t of recentTurnsById.values()) {
+    if (t.sessionChatId === chatId && (t.sessionThreadId ?? null) !== live)
+      return true;
+  }
+  return false;
+}
 function closeObligationOnSubstantiveReply(args, liveTurn) {
   if (!OBLIGATION_LEDGER_ENABLED)
     return;
@@ -56339,8 +56373,10 @@ ${url}`;
   let threadId;
   if (TURN_ORIGIN_ROUTING_ENABLED) {
     const explicit = args.message_thread_id != null ? Number(args.message_thread_id) : undefined;
-    const originTurn = findTurnByOriginId(args.origin_turn_id);
-    threadId = resolveAnswerThreadWithLog(chat_id, Number.isFinite(explicit) ? explicit : undefined, originTurn, turn, "reply");
+    const echoedTurn = findTurnByOriginId(args.origin_turn_id);
+    const quotedTurn = echoedTurn == null ? findTurnByQuotedMessageId(chat_id, args.reply_to) : null;
+    const originTurn = echoedTurn ?? quotedTurn;
+    threadId = resolveAnswerThreadWithLog(chat_id, Number.isFinite(explicit) ? explicit : undefined, originTurn, originTurn == null ? null : echoedTurn != null ? "echo" : "quoted", turn, "reply");
   } else {
     threadId = resolveThreadId(chat_id, args.message_thread_id ?? (turn?.sessionThreadId != null ? turn.sessionThreadId : undefined));
   }
@@ -56699,8 +56735,10 @@ async function executeStreamReply(args) {
   if (args.message_thread_id == null) {
     let injected;
     if (TURN_ORIGIN_ROUTING_ENABLED) {
-      const originTurn = findTurnByOriginId(args.origin_turn_id);
-      injected = resolveAnswerThreadWithLog(String(args.chat_id), undefined, originTurn, turn, "stream_reply");
+      const echoedTurn = findTurnByOriginId(args.origin_turn_id);
+      const quotedTurn = echoedTurn == null ? findTurnByQuotedMessageId(String(args.chat_id), args.reply_to) : null;
+      const originTurn = echoedTurn ?? quotedTurn;
+      injected = resolveAnswerThreadWithLog(String(args.chat_id), undefined, originTurn, originTurn == null ? null : echoedTurn != null ? "echo" : "quoted", turn, "stream_reply");
     } else {
       injected = turn?.sessionThreadId;
     }

package/telegram-plugin/gateway/answer-thread-resolve.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { resolveAnswerThreadId } from './answer-thread-resolve.js'
+import { resolveAnswerThreadId, type AnswerThreadInput } from './answer-thread-resolve.js'
 
 describe('resolveAnswerThreadId — precedence', () => {
   it('(1) explicit model thread wins over everything', () => {
@@ -83,3 +83,137 @@ describe('resolveAnswerThreadId — precedence', () => {
     expect(resolveAnswerThreadId({ originResolved: false })).toBeUndefined()
   })
 })
+
+// ── TOTAL-ENUMERATION DETERMINISM PROOF ─────────────────────────────────────
+//
+// The operator standard (memory feedback_prove_finite_fsm_not_sample): a
+// passing sample is not a proof. `resolveAnswerThreadId` is a PURE decision
+// function over a FINITE input space — so we can prove its determinism by
+// CONSTRUCTION: enumerate every reachable input and assert totality,
+// determinism, no-fabrication, and the precedence the doc-comment promises.
+// Any future edit that perturbs the decision table on ANY of the 64 inputs
+// fails here — this block is the regression guard, the 9 examples above are
+// the human-readable map.
+//
+// Distinct symbolic thread ids so an output's provenance is unambiguous (no
+// two tiers share a value): explicit=70, origin=50, live=30, lastEnded=90.
+const T = 70 // explicit (tier 1)
+const O = 50 // origin   (tier 2)
+const L = 30 // live     (tier 3)
+const E = 90 // lastEnded(tier 4)
+
+function allInputs(): AnswerThreadInput[] {
+  const rows: AnswerThreadInput[] = []
+  for (const explicitThreadId of [undefined, T])
+    for (const originResolved of [false, true])
+      for (const originThreadId of [undefined, O])
+        for (const liveThreadId of [undefined, L])
+          for (const lastEndedResolvedForChat of [false, true])
+            for (const lastEndedThreadIdForChat of [undefined, E])
+              rows.push({
+                explicitThreadId,
+                originResolved,
+                originThreadId,
+                lastEndedResolvedForChat,
+                lastEndedThreadIdForChat,
+                liveThreadId,
+              })
+  return rows
+}
+
+// Independent reference encoding the documented precedence (the SPEC), kept
+// deliberately separate from the implementation so a regression in either
+// surfaces as a divergence rather than a silently-shared bug.
+function specExpected(i: AnswerThreadInput): number | undefined {
+  if (i.explicitThreadId != null) return i.explicitThreadId // tier 1
+  if (i.originResolved) return i.originThreadId // tier 2 (may be undefined: DM origin)
+  if (i.liveThreadId != null) return i.liveThreadId // tier 3
+  if (i.lastEndedResolvedForChat) return i.lastEndedThreadIdForChat // tier 4
+  return i.liveThreadId // catch-all (undefined here)
+}
+
+describe('resolveAnswerThreadId — total-enumeration determinism proof (all 64 inputs)', () => {
+  const ROWS = allInputs()
+
+  it('the input space is exactly 64 rows (2^6)', () => {
+    expect(ROWS.length).toBe(64)
+  })
+
+  it('TOTAL: every input returns without throwing', () => {
+    for (const i of ROWS) {
+      expect(() => resolveAnswerThreadId(i)).not.toThrow()
+    }
+  })
+
+  it('DETERMINISTIC: each input maps to exactly one output (idempotent across repeated calls)', () => {
+    for (const i of ROWS) {
+      const a = resolveAnswerThreadId(i)
+      const b = resolveAnswerThreadId({ ...i })
+      expect(b).toBe(a)
+    }
+  })
+
+  it('NO FABRICATION: every output is undefined or one of the four input thread fields', () => {
+    for (const i of ROWS) {
+      const out = resolveAnswerThreadId(i)
+      const provenance = new Set([
+        undefined,
+        i.explicitThreadId,
+        i.originThreadId,
+        i.liveThreadId,
+        i.lastEndedThreadIdForChat,
+      ])
+      expect(provenance.has(out)).toBe(true)
+    }
+  })
+
+  it('PRECEDENCE: matches the documented spec on all 64 inputs', () => {
+    for (const i of ROWS) {
+      expect(resolveAnswerThreadId(i)).toBe(specExpected(i))
+    }
+  })
+
+  // ── By-construction invariants: the output depends ONLY on the highest
+  //    RESOLVED tier, so no lower-tier input (notably a flipped live turn)
+  //    can perturb a higher tier's decision. These are the routing guarantees
+  //    the resolver exists to provide. ─────────────────────────────────────
+
+  it('INV-1 explicit DOMINANCE: explicit set ⇒ output === explicit, independent of all other fields', () => {
+    for (const i of ROWS) {
+      if (i.explicitThreadId != null) expect(resolveAnswerThreadId(i)).toBe(i.explicitThreadId)
+    }
+  })
+
+  it('INV-2 origin FLIP-IMMUNITY: no explicit + originResolved ⇒ output === originThreadId, for EVERY liveThreadId/lastEnded combo (the Brevo→Meta fix: a currentTurn flip cannot steal a resolved origin)', () => {
+    for (const i of ROWS) {
+      if (i.explicitThreadId == null && i.originResolved) {
+        expect(resolveAnswerThreadId(i)).toBe(i.originThreadId)
+      }
+    }
+  })
+
+  it('INV-3 recovery REACHABILITY: tier-4 (lastEnded) result occurs ONLY when no explicit, no origin, no live turn', () => {
+    for (const i of ROWS) {
+      const out = resolveAnswerThreadId(i)
+      // If the result came from the lastEnded field (and that field is the
+      // only one carrying that distinct value E), the three higher tiers must
+      // all be absent.
+      if (out === E) {
+        expect(i.explicitThreadId).toBeUndefined()
+        expect(i.originResolved).toBe(false)
+        expect(i.liveThreadId).toBeUndefined()
+        expect(i.lastEndedResolvedForChat).toBe(true)
+      }
+    }
+  })
+
+  it('INV-4 live-tier REACHABILITY: tier-3 (live) result occurs ONLY when no explicit and no resolved origin', () => {
+    for (const i of ROWS) {
+      const out = resolveAnswerThreadId(i)
+      if (out === L) {
+        expect(i.explicitThreadId).toBeUndefined()
+        expect(i.originResolved).toBe(false)
+      }
+    }
+  })
+})

package/telegram-plugin/gateway/gateway.ts

@@ -1549,6 +1549,18 @@ const SERIALIZE_NOREPLY_DRAIN_MS =
 // behaviour (#1664: thread from the live currentTurn capture).
 const TURN_ORIGIN_ROUTING_ENABLED =
   process.env.SWITCHROOM_TURN_ORIGIN_ROUTING !== '0'
+// Framework-owned origin recovery (2026-06-05 determinism pass). The origin
+// signal that survives a currentTurn flip (tier 2) travels through the MODEL
+// (it echoes `origin_turn_id`). When the model OMITS it, routing falls to the
+// live turn — the wrong topic if currentTurn flipped (HOLE a). The model rarely
+// passes `reply_to` explicitly, but WHEN it quotes a specific earlier message
+// that message_id is a FRAMEWORK-owned anchor: reverse-index it to the turn
+// that owns it and recover the origin without the model echo. Strictly
+// additive — it only fires when the echo is absent AND a quote is present, and
+// resolves to the ACTUAL origin turn (never the live successor), so it cannot
+// mask a misroute. Kill switch off (=0) → echo-only origin (today's behaviour).
+const FRAMEWORK_ORIGIN_ROUTING_ENABLED =
+  process.env.SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'
 // Component 4 (per-turn topic framing). Add a one-line directive to the
 // channel meta + bridge instructions telling the model to answer ONLY the
 // current message's topic. Kill switch off (=0) → no framing field.
@@ -1858,14 +1870,57 @@ let currentTurn: CurrentTurn | null = null
 // a long-lived supergroup session.
 const RECENT_TURNS_MAX = 32
 const recentTurnsById = new Map<string, CurrentTurn>()
+// Framework-owned origin recovery: reverse-index from an inbound's source
+// message_id to the turnId that owns it, so a reply that QUOTES a specific
+// message (args.reply_to) resolves its origin turn deterministically — a
+// real message_id the framework stamped, never a model-asserted thread.
+// Evicted in lock-step with recentTurnsById so it can't outgrow it.
+const recentTurnIdBySourceMessageId = new Map<number, string>()
 function rememberRecentTurn(turn: CurrentTurn): void {
   recentTurnsById.set(turn.turnId, turn)
+  if (turn.sourceMessageId != null) {
+    recentTurnIdBySourceMessageId.set(turn.sourceMessageId, turn.turnId)
+  }
   while (recentTurnsById.size > RECENT_TURNS_MAX) {
     const oldest = recentTurnsById.keys().next().value
     if (oldest === undefined) break
+    const evicted = recentTurnsById.get(oldest)
     recentTurnsById.delete(oldest)
+    // Drop the reverse-index entry for the evicted turn (only when it still
+    // points at THIS turn — a newer turn may have reused the same message id).
+    if (evicted?.sourceMessageId != null &&
+        recentTurnIdBySourceMessageId.get(evicted.sourceMessageId) === oldest) {
+      recentTurnIdBySourceMessageId.delete(evicted.sourceMessageId)
+    }
   }
 }
+
+/**
+ * Framework-owned origin recovery (kill switch SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING).
+ * Resolve the turn that owns a reply from the message_id it QUOTES (args.reply_to),
+ * via the source-message reverse index. Returns null when disabled, when reply_to
+ * is absent/non-numeric, or when no turn owns that message id (evicted / unknown).
+ * Deterministic: a real framework-stamped message_id → its turn, with no model
+ * thread assertion and no dependence on the live currentTurn.
+ *
+ * SCOPED to `chatId`: Telegram numbers message ids PER CHAT, so the same numeric
+ * id exists in a DM and a supergroup. The reverse index is keyed by id alone, so
+ * the resolved turn MUST be confirmed to belong to this reply's chat — otherwise
+ * a reply quoting its own id could inherit another chat's thread (a cross-chat
+ * leak). On a chat mismatch we return null (decline to recover → fall through to
+ * the live-turn behaviour), never a wrong-chat thread.
+ */
+function findTurnByQuotedMessageId(chatId: string, replyTo: unknown): CurrentTurn | null {
+  if (!FRAMEWORK_ORIGIN_ROUTING_ENABLED) return null
+  if (replyTo == null) return null
+  const mid = Number(replyTo)
+  if (!Number.isFinite(mid)) return null
+  const owner = recentTurnIdBySourceMessageId.get(mid)
+  if (owner == null) return null
+  const turn = recentTurnsById.get(owner) ?? null
+  if (turn == null || turn.sessionChatId !== chatId) return null
+  return turn
+}
 /**
  * Component 3 — derive the stable per-turn identity from the chat, thread,
  * and originating message id. Stamped into the inbound meta at build time
@@ -1932,13 +1987,26 @@ function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
  * timestamps. This wrapper logs, per reply: which precedence tier won (`via`),
  * the resolved thread, the origin turn + its thread, and whether the reply was
  * late (turn already ended). `via=recovered` marks a late reply this fix saved
- * from General; `UNROUTED` flags a supergroup reply that still resolved to no
- * topic (the residual gap to watch).
+ * from General; `via=quoted` marks an origin recovered from the framework-owned
+ * quoted message_id (no model echo); `UNROUTED` flags a supergroup reply that
+ * resolved to no topic with NO owner turn to attribute it to (genuinely lost).
+ * `MISROUTE_RISK` flags the irreducible determinism residual: a no-echo,
+ * no-quote reply that fell to the LIVE turn while a DIFFERENT topic recently had
+ * a turn — the framework cannot tell which topic the bare reply answers, so the
+ * routing MIGHT be wrong (HOLE a). It is observability only (the reply still
+ * routes to the live turn) — it makes the one case that is genuinely
+ * model-dependent visible instead of silently mis-routed. A General-topic turn
+ * legitimately has no thread, so its replies are NOT UNROUTED-flagged.
+ *
+ * `originVia` distinguishes how the origin turn was resolved: 'echo' (model
+ * echoed origin_turn_id), 'quoted' (framework recovered it from args.reply_to),
+ * or null (no origin turn). It only affects the `via` label, never the routing.
  */
 function resolveAnswerThreadWithLog(
   chatId: string,
   explicitThreadId: number | undefined,
   originTurn: CurrentTurn | null,
+  originVia: 'echo' | 'quoted' | null,
   liveTurn: CurrentTurn | null,
   surface: 'reply' | 'stream_reply',
 ): number | undefined {
@@ -1965,24 +2033,60 @@ function resolveAnswerThreadWithLog(
   })
   const via =
     explicitThreadId != null ? 'explicit'
-    : originTurn != null ? 'origin'
+    : originTurn != null ? (originVia === 'quoted' ? 'quoted' : 'origin')
     : liveTurn?.sessionThreadId != null ? 'live'
     : recovered != null ? 'recovered'
     : 'none'
   const ownerTurn = originTurn ?? recovered ?? liveTurn
   const isSupergroup = chatId.startsWith('-100')
-  const unrouted = isSupergroup && threadId == null
+  // UNROUTED = a supergroup reply that resolved to NO topic with NO owner turn
+  // to attribute it to (genuinely lost). A General-topic turn legitimately has
+  // no thread, so a reply owned by it resolving to `-` is CORRECT, not lost —
+  // gate on `ownerTurn == null` so General replies don't false-alarm (found by
+  // the multi-topic UAT stress, 2026-06-05).
+  const unrouted = isSupergroup && threadId == null && ownerTurn == null
+  // MISROUTE_RISK = the irreducible determinism residual (HOLE a). A no-echo,
+  // no-quote reply fell to the LIVE turn (via=live), but a DIFFERENT topic
+  // recently had a turn for this chat — so this bare reply MIGHT belong to that
+  // other topic and we cannot tell without the model's echo. Observability only;
+  // routing is unchanged. This is the one case framework state cannot
+  // disambiguate, surfaced instead of silently mis-routed.
+  const misrouteRisk =
+    isSupergroup &&
+    via === 'live' &&
+    hasDifferentThreadedRecentTurn(chatId, liveTurn?.sessionThreadId)
   process.stderr.write(
     `telegram gateway: reply-route surface=${surface} chat=${chatId} ` +
       `resolved_thread=${threadId ?? '-'} via=${via} late=${liveTurn == null} ` +
       `originTurn=${ownerTurn?.turnId ?? '-'} origin_thread=${ownerTurn?.sessionThreadId ?? '-'}` +
       (via === 'recovered' ? ' RECOVERED' : '') +
+      (via === 'quoted' ? ' QUOTED(framework-origin)' : '') +
       (unrouted ? ' UNROUTED(supergroup→no-topic)' : '') +
+      (misrouteRisk ? ' MISROUTE_RISK(no-echo→live-successor)' : '') +
       '\n',
   )
   return threadId
 }
 
+/**
+ * Determinism-residual detector (HOLE a observability). True when a DIFFERENT
+ * forum topic recently had a turn for this chat than the live turn's thread —
+ * i.e. a currentTurn flip plausibly happened, so a no-echo / no-quote reply
+ * routed to the live turn MIGHT belong to the other topic. Scans the bounded
+ * recently-ended registry; cheap (≤32 entries). Used only to ALARM, never to
+ * route.
+ */
+function hasDifferentThreadedRecentTurn(
+  chatId: string,
+  liveThreadId: number | undefined,
+): boolean {
+  const live = liveThreadId ?? null
+  for (const t of recentTurnsById.values()) {
+    if (t.sessionChatId === chatId && (t.sessionThreadId ?? null) !== live) return true
+  }
+  return false
+}
+
 /**
  * PR2 obligation-ledger CLOSE. Called when a SUBSTANTIVE final answer lands
  * (not a bare interim ack — using finalAnswerSubstantive, the #2141 signal): the
@@ -6631,11 +6735,17 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   let threadId: number | undefined
   if (TURN_ORIGIN_ROUTING_ENABLED) {
     const explicit = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    const originTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+    // Origin precedence: model echo first (authoritative), then the
+    // framework-owned quoted message_id (deterministic, no model thread
+    // assertion) as a fallback when the model omitted the echo.
+    const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+    const quotedTurn = echoedTurn == null ? findTurnByQuotedMessageId(chat_id, args.reply_to) : null
+    const originTurn = echoedTurn ?? quotedTurn
     threadId = resolveAnswerThreadWithLog(
       chat_id,
       Number.isFinite(explicit as number) ? (explicit as number) : undefined,
       originTurn,
+      originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted',
       turn,
       'reply',
     )
@@ -7288,11 +7398,17 @@ async function executeStreamReply(args: Record<string, unknown>): Promise<unknow
   if (args.message_thread_id == null) {
     let injected: number | undefined
     if (TURN_ORIGIN_ROUTING_ENABLED) {
-      const originTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+      // Origin precedence: model echo first, then the framework-owned quoted
+      // message_id as a deterministic fallback (mirrors executeReply).
+      const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+      const quotedTurn =
+        echoedTurn == null ? findTurnByQuotedMessageId(String(args.chat_id), args.reply_to) : null
+      const originTurn = echoedTurn ?? quotedTurn
       injected = resolveAnswerThreadWithLog(
         String(args.chat_id),
         undefined,
         originTurn,
+        originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted',
         turn,
         'stream_reply',
       )

package/telegram-plugin/tests/multitopic-routing-wiring.test.ts

@@ -67,6 +67,51 @@ describe('component 3 — turn-origin reply routing', () => {
   })
 })
 
+describe('framework-owned origin recovery (determinism residual, 2026-06-05)', () => {
+  it('a source-message reverse index is populated at enqueue and EVICTED in parity with recentTurnsById', () => {
+    expect(gatewaySrc).toMatch(/const recentTurnIdBySourceMessageId = new Map<number, string>\(\)/)
+    // Populated inside rememberRecentTurn from the turn's sourceMessageId.
+    const fn = gatewaySrc.split('function rememberRecentTurn')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.set\(turn\.sourceMessageId, turn\.turnId\)/)
+    // Eviction parity: the reverse entry is dropped when its turn is evicted —
+    // so the index cannot outgrow the bounded RECENT_TURNS_MAX registry.
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.delete\(evicted\.sourceMessageId\)/)
+  })
+
+  it('both reply paths recover origin from the quoted message_id when the model omits the echo', () => {
+    for (const name of ['executeReply', 'executeStreamReply']) {
+      const fn = gatewaySrc.split(new RegExp(`async function ${name}`))[1]?.split('\nasync function ')[0] ?? ''
+      // Echo first (authoritative), quoted message_id as the framework fallback.
+      expect(fn).toMatch(/const echoedTurn = findTurnByOriginId\(args\.origin_turn_id/)
+      // Quoted lookup is CHAT-SCOPED (cross-chat message-id collision guard).
+      expect(fn).toMatch(/findTurnByQuotedMessageId\([^,]+, args\.reply_to\)/)
+      expect(fn).toMatch(/echoedTurn \?\? quotedTurn/)
+    }
+  })
+
+  it('findTurnByQuotedMessageId is gated on the kill switch and resolves a real turn (never the live successor)', () => {
+    const fn = gatewaySrc.split('function findTurnByQuotedMessageId')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/FRAMEWORK_ORIGIN_ROUTING_ENABLED/)
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.get\(mid\)/)
+    expect(fn).toMatch(/recentTurnsById\.get\(owner\)/)
+    // Cross-chat collision guard: the resolved turn must belong to this chat.
+    expect(fn).toMatch(/turn\.sessionChatId !== chatId/)
+  })
+
+  it('the irreducible no-echo residual is ALARMED (MISROUTE_RISK), never silently mis-routed', () => {
+    expect(gatewaySrc).toMatch(/MISROUTE_RISK\(no-echo→live-successor\)/)
+    expect(gatewaySrc).toMatch(/function hasDifferentThreadedRecentTurn/)
+    // The alarm is observability-only: it fires on via=live with a different
+    // recent topic, and does NOT change the resolved thread.
+    expect(gatewaySrc).toMatch(/const misrouteRisk =/)
+    expect(gatewaySrc).toMatch(/via === 'quoted' \? ' QUOTED\(framework-origin\)' : ''/)
+  })
+
+  it('the kill switch defaults ON and is independent of TURN_ORIGIN_ROUTING', () => {
+    expect(gatewaySrc).toMatch(/SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'/)
+  })
+})
+
 describe('component 4 — per-turn topic framing', () => {
   it('the gateway stamps a topic_scope directive for forum-topic inbounds (kill-switched)', () => {
     expect(gatewaySrc).toMatch(/TOPIC_FRAMING_ENABLED/)

package/telegram-plugin/uat/scenarios/fuzz-cross-surface-ordering-channel.test.ts

@@ -0,0 +1,100 @@
+/**
+ * Cross-surface ordering stress — a DM question and a supergroup question
+ * back-to-back, assert each answer lands in ITS OWN surface (DM answer in the
+ * DM, channel answer in the channel) with no cross-contamination.
+ *
+ * One Claude CLI serves both the DM and the supergroup through a singleton
+ * currentTurn; a late or mis-attributed reply can leak across surfaces (a DM
+ * answer posted into the channel, or vice versa) — the cross-surface twin of
+ * the multi-topic bleed. This is the "handling messages in multiple channels"
+ * concern at the DM-vs-channel axis. Self-skips green without a resolvable
+ * SWITCHROOM_UAT_CHAT_ID supergroup (uat/** is non-gating).
+ */
+import { describe, it, expect, beforeAll } from "vitest";
+import { spinUp, type Scenario } from "../harness.js";
+import { isWorkerFeedMessage, isActivityFeedMessage } from "../assertions.js";
+import type { ObservedMessage } from "../driver.js";
+
+const SUPERGROUP_ID = Number.parseInt(process.env.SWITCHROOM_UAT_CHAT_ID ?? "", 10);
+
+interface Hit { chatId: number; text: string; messageId: number; }
+
+function isAnswer(m: ObservedMessage, driverUserId: number): boolean {
+  return m.senderUserId !== driverUserId && !m.edited
+    && !isWorkerFeedMessage(m) && !isActivityFeedMessage(m) && m.text.trim().length > 0;
+}
+
+describe("uat: cross-surface ordering — DM Q + channel Q, no surface bleed", () => {
+  let sc: Scenario | null = null;
+  let postable = false;
+
+  beforeAll(async () => {
+    if (!Number.isFinite(SUPERGROUP_ID)) {
+      console.warn("[uat] SWITCHROOM_UAT_CHAT_ID unset — skipping cross-surface ordering");
+      return;
+    }
+    sc = await spinUp({ agent: "test-harness" });
+    await sc.driver.primeDialogs();
+    postable = await sc.driver.canResolve(SUPERGROUP_ID);
+    if (!postable) console.warn(`[uat] supergroup ${SUPERGROUP_ID} not resolvable — skipping`);
+  });
+
+  it("DM answer stays in the DM and channel answer stays in the channel (no leak)", async () => {
+    if (sc == null || !postable) return; // self-skip green
+    const { driver, driverUserId, botUserId } = sc;
+    await driver.primeDialogs();
+
+    const dmIter = driver.observeMessages(botUserId)[Symbol.asyncIterator]();
+    const sgIter = driver.observeMessages(SUPERGROUP_ID)[Symbol.asyncIterator]();
+
+    // Distinct answers per surface: DM → 14, channel → 42.
+    await driver.sendText(botUserId, "Reply with only the number and nothing else: what is 7 + 7?");
+    await driver.sendText(SUPERGROUP_ID, "Reply with only the number and nothing else: what is 40 + 2?");
+
+    let dmHit: Hit | undefined;
+    let sgHit: Hit | undefined;
+    const strays: Hit[] = []; // an expected-answer token observed in the WRONG surface
+
+    const deadline = Date.now() + 120_000;
+    const pump = async (iter: AsyncIterator<ObservedMessage>, chatId: number) => {
+      while (Date.now() < deadline && !(dmHit && sgHit)) {
+        const next = await Promise.race([
+          iter.next(),
+          new Promise<{ done: true; value: undefined }>((r) =>
+            setTimeout(() => r({ done: true, value: undefined }), Math.max(0, deadline - Date.now())),
+          ),
+        ]);
+        if (next.done || next.value == null) break;
+        const m = next.value as ObservedMessage;
+        if (!isAnswer(m, driverUserId)) continue;
+        const hit: Hit = { chatId: m.chatId, text: m.text, messageId: m.messageId };
+        const has14 = /(^|\D)14(\D|$)/.test(m.text);
+        const has42 = /(^|\D)42(\D|$)/.test(m.text);
+        if (chatId === botUserId) {
+          if (has14 && dmHit == null) dmHit = hit;
+          if (has42) strays.push(hit); // channel answer leaked into the DM
+        } else {
+          if (has42 && sgHit == null) sgHit = hit;
+          if (has14) strays.push(hit); // DM answer leaked into the channel
+        }
+      }
+    };
+    await Promise.all([pump(dmIter, botUserId), pump(sgIter, SUPERGROUP_ID)]);
+    void dmIter.return?.();
+    void sgIter.return?.();
+
+    console.log(
+      `[cross-surface] dm(7+7=14)=${dmHit ? `msg=${dmHit.messageId}` : "MISSING"} ` +
+        `channel(40+2=42)=${sgHit ? `msg=${sgHit.messageId}` : "MISSING"} strays=${strays.length}`,
+    );
+
+    // Invariant 1: both answered.
+    expect(dmHit, "DM question (7+7=14) was never answered in the DM").toBeDefined();
+    expect(sgHit, "channel question (40+2=42) was never answered in the channel").toBeDefined();
+    // Invariant 2: no answer leaked to the wrong surface.
+    expect(strays, `an answer leaked across surfaces: ${JSON.stringify(strays)}`).toHaveLength(0);
+    // Invariant 3 (belt+braces): the right answer is in the right chat.
+    expect(dmHit!.chatId).toBe(botUserId);
+    expect(sgHit!.chatId).toBe(SUPERGROUP_ID);
+  }, 150_000);
+});

package/telegram-plugin/uat/scenarios/fuzz-multitopic-routing-channel.test.ts

@@ -0,0 +1,184 @@
+/**
+ * Multi-topic routing stress (channel) — two questions in TWO forum topics
+ * back-to-back, assert each answer lands in ITS OWN topic with no cross-bleed.
+ *
+ * This exercises live the failure class behind #2137 ("two questions in two
+ * forum topics → both answers in one topic, the other unanswered") and the
+ * #2166 late-reply topic recovery — the exact "handling messages in multiple
+ * channels" concern. One Claude CLI owns every topic via a singleton
+ * currentTurn, so a late/misrouted reply can land in the wrong topic.
+ *
+ * The test supergroup has General (message_thread_id omitted → observed
+ * threadId undefined) plus a real topic (thread=5). mtcute sends into a topic
+ * via messageThreadId→replyTo and reads each observed message's threadId, so we
+ * can prove WHICH topic each answer landed in. Self-skips green without
+ * SWITCHROOM_UAT_CHAT_ID or an unresolvable supergroup (uat/** is non-gating).
+ *
+ * mtcute caveat: it can't enumerate topics, so the topic id is pinned (5, the
+ * active non-General topic in the test supergroup). If that topic is ever
+ * deleted the send 400s and the test skips with a clear message.
+ */
+import { describe, it, expect, beforeAll } from "vitest";
+import { spinUp, type Scenario } from "../harness.js";
+import { isWorkerFeedMessage, isActivityFeedMessage } from "../assertions.js";
+import type { ObservedMessage } from "../driver.js";
+
+const SUPERGROUP_ID = Number.parseInt(process.env.SWITCHROOM_UAT_CHAT_ID ?? "", 10);
+const TOPIC_THREAD = 5; // a real non-General topic in the test supergroup
+
+interface Hit {
+  text: string;
+  threadId: number | undefined;
+  messageId: number;
+  at: number;
+}
+
+describe("uat: multi-topic routing — two topics back-to-back, no answer bleed", () => {
+  let sc: Scenario | null = null;
+  let postable = false;
+
+  beforeAll(async () => {
+    if (!Number.isFinite(SUPERGROUP_ID)) {
+      console.warn("[uat] SWITCHROOM_UAT_CHAT_ID unset — skipping multi-topic routing");
+      return;
+    }
+    sc = await spinUp({ agent: "test-harness" });
+    await sc.driver.primeDialogs();
+    postable = await sc.driver.canResolve(SUPERGROUP_ID);
+    if (!postable) console.warn(`[uat] supergroup ${SUPERGROUP_ID} not resolvable — skipping`);
+  });
+
+  it("topic-5 Q and General Q are each answered IN THEIR OWN topic (no swap, no drop)", async () => {
+    if (sc == null || !postable) return; // self-skip green
+    const driver = sc.driver;
+    const driverUserId = sc.driverUserId;
+    await driver.primeDialogs();
+
+    // Distinct, unambiguous answers so we can tell the two replies apart by
+    // content and check the topic each landed in. 7+7=14 (topic 5), 40+2=42
+    // (General) — no digit overlap, no accidental substring match.
+    const iter = driver.observeMessages(SUPERGROUP_ID)[Symbol.asyncIterator]();
+    let topic5: Hit | undefined;
+    let general: Hit | undefined;
+
+    try {
+      await driver.sendText(
+        SUPERGROUP_ID,
+        "Reply with only the number and nothing else: what is 7 + 7?",
+        { messageThreadId: TOPIC_THREAD },
+      );
+    } catch (err) {
+      console.warn(`[uat] could not post to topic ${TOPIC_THREAD} (${(err as Error).message}) — skipping`);
+      return;
+    }
+    // Back-to-back (the #2137 bleed trigger): General question immediately after.
+    await driver.sendText(
+      SUPERGROUP_ID,
+      "Reply with only the number and nothing else: what is 40 + 2?",
+    );
+
+    const deadline = Date.now() + 120_000;
+    while (Date.now() < deadline && !(topic5 && general)) {
+      const next = await Promise.race([
+        iter.next(),
+        new Promise<{ done: true; value: undefined }>((r) =>
+          setTimeout(() => r({ done: true, value: undefined }), Math.max(0, deadline - Date.now())),
+        ),
+      ]);
+      if (next.done || next.value == null) break;
+      const m = next.value as ObservedMessage;
+      if (m.senderUserId === driverUserId) continue; // our own sends
+      if (isWorkerFeedMessage(m) || isActivityFeedMessage(m)) continue; // status surfaces, not answers
+      const hit: Hit = { text: m.text, threadId: m.threadId, messageId: m.messageId, at: Date.now() };
+      if (topic5 == null && /(^|\D)14(\D|$)/.test(m.text)) topic5 = hit;
+      if (general == null && /(^|\D)42(\D|$)/.test(m.text)) general = hit;
+    }
+    void iter.return?.();
+
+    console.log(
+      `[multitopic] topic5(7+7=14)=${topic5 ? `thread=${topic5.threadId ?? "-"} msg=${topic5.messageId}` : "MISSING"} ` +
+        `general(40+2=42)=${general ? `thread=${general.threadId ?? "-"} msg=${general.messageId}` : "MISSING"}`,
+    );
+
+    // Invariant 1: BOTH questions were answered (no drop — the #2137 "other
+    // topic unanswered" half).
+    expect(topic5, "topic-5 question (7+7=14) was never answered").toBeDefined();
+    expect(general, "General question (40+2=42) was never answered").toBeDefined();
+
+    // Invariant 2: each answer landed in ITS OWN topic (no bleed/swap). The
+    // topic-5 answer carries threadId=5; the General answer omits the thread.
+    expect(topic5!.threadId).toBe(TOPIC_THREAD);
+    expect(general!.threadId).toBeUndefined();
+  }, 150_000);
+
+  it("a SLOW topic-5 turn whose answer lands LATE (after a fast General turn) still routes to topic-5", async () => {
+    if (sc == null || !postable) return; // self-skip green
+    const { driver, driverUserId } = sc;
+    await driver.primeDialogs();
+
+    // The #2137 trigger: topic-5 turn is still working when General's turn
+    // arrives, so the singleton currentTurn flips to General. The slow topic-5
+    // answer then lands AFTER General's — it must STILL route to topic-5 (via
+    // origin_turn_id / the #2166 late-reply recovery), not bleed into General.
+    const iter = driver.observeMessages(SUPERGROUP_ID)[Symbol.asyncIterator]();
+    let slowHit: Hit | undefined; // topic-5, distinctive token
+    let fastHit: Hit | undefined; // General, the number 42
+
+    try {
+      await driver.sendText(
+        SUPERGROUP_ID,
+        "Do this slowly, ONE step at a time with a brief note on each (I want to see you work): run uname -a, then nproc, " +
+          "then lscpu, then cat /proc/cpuinfo | grep -c processor, then free -h, then df -h. After all six, tell me how many " +
+          "CPU cores this machine has and end your reply with the exact token CORESDONE on its own line.",
+        { messageThreadId: TOPIC_THREAD },
+      );
+    } catch (err) {
+      console.warn(`[uat] could not post to topic ${TOPIC_THREAD} (${(err as Error).message}) — skipping`);
+      return;
+    }
+    // Let the slow turn get underway, then fire the fast General question while
+    // it's still working. Use an unusual WORD token (not a number) so the slow
+    // turn's tool output (which prints numbers like "42Gi") can't false-match.
+    await new Promise((r) => setTimeout(r, 3000));
+    await driver.sendText(SUPERGROUP_ID, "Reply with only this exact word and nothing else: ZUCCHINI.");
+
+    const deadline = Date.now() + 130_000;
+    while (Date.now() < deadline && !(slowHit && fastHit)) {
+      const next = await Promise.race([
+        iter.next(),
+        new Promise<{ done: true; value: undefined }>((r) =>
+          setTimeout(() => r({ done: true, value: undefined }), Math.max(0, deadline - Date.now())),
+        ),
+      ]);
+      if (next.done || next.value == null) break;
+      const m = next.value as ObservedMessage;
+      if (m.senderUserId === driverUserId) continue;
+      if (isWorkerFeedMessage(m) || isActivityFeedMessage(m)) continue;
+      const hit: Hit = { text: m.text, threadId: m.threadId, messageId: m.messageId, at: Date.now() };
+      if (slowHit == null && /CORESDONE/i.test(m.text)) slowHit = hit;
+      if (fastHit == null && /ZUCCHINI/i.test(m.text)) fastHit = hit;
+    }
+    void iter.return?.();
+
+    console.log(
+      `[multitopic-late] slow(CORESDONE)=${slowHit ? `thread=${slowHit.threadId ?? "-"} msg=${slowHit.messageId}` : "MISSING"} ` +
+        `fast(ZUCCHINI)=${fastHit ? `thread=${fastHit.threadId ?? "-"} msg=${fastHit.messageId}` : "MISSING"} ` +
+        `slowArrivedAfterFast=${slowHit && fastHit ? slowHit.at > fastHit.at : "n/a"}`,
+    );
+
+    expect(slowHit, "slow topic-5 answer (CORESDONE) never arrived").toBeDefined();
+    expect(fastHit, "fast General answer (42) never arrived").toBeDefined();
+    // Honest about whether the LATE-after-flip stress was actually exercised:
+    // it only is if the slow topic-5 answer landed AFTER the fast General one.
+    if (slowHit!.at <= fastHit!.at) {
+      console.warn(
+        "[multitopic-late] topic-5 answered BEFORE General — the late-after-flip case " +
+          "was not exercised this run (routing still asserted below).",
+      );
+    }
+    // The crux: the slow answer routed to topic-5, NOT bled into General — and
+    // this holds whether or not it arrived late (the stronger claim is when late).
+    expect(slowHit!.threadId).toBe(TOPIC_THREAD);
+    expect(fastHit!.threadId).toBeUndefined();
+  }, 160_000);
+});