switchroom 0.14.68 → 0.14.70

package/telegram-plugin/gateway/gateway.ts

@@ -98,7 +98,7 @@ import * as pendingProgress from '../pending-work-progress.js'
 import { writeSilentEndState, clearSilentEndState, recordUndeliveredTurnEnd } from '../silent-end.js'
 import { isFinalAnswerReply, isSubstantiveFinalReply } from '../final-answer-detect.js'
 import { createAnswerStream, type AnswerStreamHandle } from '../answer-stream.js'
-import { parseVisibleAnswerStreamEnabled, parseDraftLaneRetiredEnabled } from '../answer-stream-flag.js'
+import { parseVisibleAnswerStreamEnabled, parseDraftLaneRetiredEnabled, resolveAnswerLaneConfig } from '../answer-stream-flag.js'
 import { type SessionEvent } from '../session-tail.js'
 import {
   shouldSuppressToolActivity,
@@ -1549,6 +1549,18 @@ const SERIALIZE_NOREPLY_DRAIN_MS =
 // behaviour (#1664: thread from the live currentTurn capture).
 const TURN_ORIGIN_ROUTING_ENABLED =
   process.env.SWITCHROOM_TURN_ORIGIN_ROUTING !== '0'
+// Framework-owned origin recovery (2026-06-05 determinism pass). The origin
+// signal that survives a currentTurn flip (tier 2) travels through the MODEL
+// (it echoes `origin_turn_id`). When the model OMITS it, routing falls to the
+// live turn — the wrong topic if currentTurn flipped (HOLE a). The model rarely
+// passes `reply_to` explicitly, but WHEN it quotes a specific earlier message
+// that message_id is a FRAMEWORK-owned anchor: reverse-index it to the turn
+// that owns it and recover the origin without the model echo. Strictly
+// additive — it only fires when the echo is absent AND a quote is present, and
+// resolves to the ACTUAL origin turn (never the live successor), so it cannot
+// mask a misroute. Kill switch off (=0) → echo-only origin (today's behaviour).
+const FRAMEWORK_ORIGIN_ROUTING_ENABLED =
+  process.env.SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'
 // Component 4 (per-turn topic framing). Add a one-line directive to the
 // channel meta + bridge instructions telling the model to answer ONLY the
 // current message's topic. Kill switch off (=0) → no framing field.
@@ -1858,14 +1870,57 @@ let currentTurn: CurrentTurn | null = null
 // a long-lived supergroup session.
 const RECENT_TURNS_MAX = 32
 const recentTurnsById = new Map<string, CurrentTurn>()
+// Framework-owned origin recovery: reverse-index from an inbound's source
+// message_id to the turnId that owns it, so a reply that QUOTES a specific
+// message (args.reply_to) resolves its origin turn deterministically — a
+// real message_id the framework stamped, never a model-asserted thread.
+// Evicted in lock-step with recentTurnsById so it can't outgrow it.
+const recentTurnIdBySourceMessageId = new Map<number, string>()
 function rememberRecentTurn(turn: CurrentTurn): void {
   recentTurnsById.set(turn.turnId, turn)
+  if (turn.sourceMessageId != null) {
+    recentTurnIdBySourceMessageId.set(turn.sourceMessageId, turn.turnId)
+  }
   while (recentTurnsById.size > RECENT_TURNS_MAX) {
     const oldest = recentTurnsById.keys().next().value
     if (oldest === undefined) break
+    const evicted = recentTurnsById.get(oldest)
     recentTurnsById.delete(oldest)
+    // Drop the reverse-index entry for the evicted turn (only when it still
+    // points at THIS turn — a newer turn may have reused the same message id).
+    if (evicted?.sourceMessageId != null &&
+        recentTurnIdBySourceMessageId.get(evicted.sourceMessageId) === oldest) {
+      recentTurnIdBySourceMessageId.delete(evicted.sourceMessageId)
+    }
   }
 }
+
+/**
+ * Framework-owned origin recovery (kill switch SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING).
+ * Resolve the turn that owns a reply from the message_id it QUOTES (args.reply_to),
+ * via the source-message reverse index. Returns null when disabled, when reply_to
+ * is absent/non-numeric, or when no turn owns that message id (evicted / unknown).
+ * Deterministic: a real framework-stamped message_id → its turn, with no model
+ * thread assertion and no dependence on the live currentTurn.
+ *
+ * SCOPED to `chatId`: Telegram numbers message ids PER CHAT, so the same numeric
+ * id exists in a DM and a supergroup. The reverse index is keyed by id alone, so
+ * the resolved turn MUST be confirmed to belong to this reply's chat — otherwise
+ * a reply quoting its own id could inherit another chat's thread (a cross-chat
+ * leak). On a chat mismatch we return null (decline to recover → fall through to
+ * the live-turn behaviour), never a wrong-chat thread.
+ */
+function findTurnByQuotedMessageId(chatId: string, replyTo: unknown): CurrentTurn | null {
+  if (!FRAMEWORK_ORIGIN_ROUTING_ENABLED) return null
+  if (replyTo == null) return null
+  const mid = Number(replyTo)
+  if (!Number.isFinite(mid)) return null
+  const owner = recentTurnIdBySourceMessageId.get(mid)
+  if (owner == null) return null
+  const turn = recentTurnsById.get(owner) ?? null
+  if (turn == null || turn.sessionChatId !== chatId) return null
+  return turn
+}
 /**
  * Component 3 — derive the stable per-turn identity from the chat, thread,
  * and originating message id. Stamped into the inbound meta at build time
@@ -1932,13 +1987,26 @@ function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
  * timestamps. This wrapper logs, per reply: which precedence tier won (`via`),
  * the resolved thread, the origin turn + its thread, and whether the reply was
  * late (turn already ended). `via=recovered` marks a late reply this fix saved
- * from General; `UNROUTED` flags a supergroup reply that still resolved to no
- * topic (the residual gap to watch).
+ * from General; `via=quoted` marks an origin recovered from the framework-owned
+ * quoted message_id (no model echo); `UNROUTED` flags a supergroup reply that
+ * resolved to no topic with NO owner turn to attribute it to (genuinely lost).
+ * `MISROUTE_RISK` flags the irreducible determinism residual: a no-echo,
+ * no-quote reply that fell to the LIVE turn while a DIFFERENT topic recently had
+ * a turn — the framework cannot tell which topic the bare reply answers, so the
+ * routing MIGHT be wrong (HOLE a). It is observability only (the reply still
+ * routes to the live turn) — it makes the one case that is genuinely
+ * model-dependent visible instead of silently mis-routed. A General-topic turn
+ * legitimately has no thread, so its replies are NOT UNROUTED-flagged.
+ *
+ * `originVia` distinguishes how the origin turn was resolved: 'echo' (model
+ * echoed origin_turn_id), 'quoted' (framework recovered it from args.reply_to),
+ * or null (no origin turn). It only affects the `via` label, never the routing.
  */
 function resolveAnswerThreadWithLog(
   chatId: string,
   explicitThreadId: number | undefined,
   originTurn: CurrentTurn | null,
+  originVia: 'echo' | 'quoted' | null,
   liveTurn: CurrentTurn | null,
   surface: 'reply' | 'stream_reply',
 ): number | undefined {
@@ -1965,24 +2033,60 @@ function resolveAnswerThreadWithLog(
   })
   const via =
     explicitThreadId != null ? 'explicit'
-    : originTurn != null ? 'origin'
+    : originTurn != null ? (originVia === 'quoted' ? 'quoted' : 'origin')
     : liveTurn?.sessionThreadId != null ? 'live'
     : recovered != null ? 'recovered'
     : 'none'
   const ownerTurn = originTurn ?? recovered ?? liveTurn
   const isSupergroup = chatId.startsWith('-100')
-  const unrouted = isSupergroup && threadId == null
+  // UNROUTED = a supergroup reply that resolved to NO topic with NO owner turn
+  // to attribute it to (genuinely lost). A General-topic turn legitimately has
+  // no thread, so a reply owned by it resolving to `-` is CORRECT, not lost —
+  // gate on `ownerTurn == null` so General replies don't false-alarm (found by
+  // the multi-topic UAT stress, 2026-06-05).
+  const unrouted = isSupergroup && threadId == null && ownerTurn == null
+  // MISROUTE_RISK = the irreducible determinism residual (HOLE a). A no-echo,
+  // no-quote reply fell to the LIVE turn (via=live), but a DIFFERENT topic
+  // recently had a turn for this chat — so this bare reply MIGHT belong to that
+  // other topic and we cannot tell without the model's echo. Observability only;
+  // routing is unchanged. This is the one case framework state cannot
+  // disambiguate, surfaced instead of silently mis-routed.
+  const misrouteRisk =
+    isSupergroup &&
+    via === 'live' &&
+    hasDifferentThreadedRecentTurn(chatId, liveTurn?.sessionThreadId)
   process.stderr.write(
     `telegram gateway: reply-route surface=${surface} chat=${chatId} ` +
       `resolved_thread=${threadId ?? '-'} via=${via} late=${liveTurn == null} ` +
       `originTurn=${ownerTurn?.turnId ?? '-'} origin_thread=${ownerTurn?.sessionThreadId ?? '-'}` +
       (via === 'recovered' ? ' RECOVERED' : '') +
+      (via === 'quoted' ? ' QUOTED(framework-origin)' : '') +
       (unrouted ? ' UNROUTED(supergroup→no-topic)' : '') +
+      (misrouteRisk ? ' MISROUTE_RISK(no-echo→live-successor)' : '') +
       '\n',
   )
   return threadId
 }
 
+/**
+ * Determinism-residual detector (HOLE a observability). True when a DIFFERENT
+ * forum topic recently had a turn for this chat than the live turn's thread —
+ * i.e. a currentTurn flip plausibly happened, so a no-echo / no-quote reply
+ * routed to the live turn MIGHT belong to the other topic. Scans the bounded
+ * recently-ended registry; cheap (≤32 entries). Used only to ALARM, never to
+ * route.
+ */
+function hasDifferentThreadedRecentTurn(
+  chatId: string,
+  liveThreadId: number | undefined,
+): boolean {
+  const live = liveThreadId ?? null
+  for (const t of recentTurnsById.values()) {
+    if (t.sessionChatId === chatId && (t.sessionThreadId ?? null) !== live) return true
+  }
+  return false
+}
+
 /**
  * PR2 obligation-ledger CLOSE. Called when a SUBSTANTIVE final answer lands
  * (not a bare interim ack — using finalAnswerSubstantive, the #2141 signal): the
@@ -4485,6 +4589,16 @@ const TURN_FLUSH_SAFETY_ENABLED = isTurnFlushSafetyEnabled()
 const ANSWER_STREAM_VISIBLE_ENABLED = parseVisibleAnswerStreamEnabled(
   process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM,
 )
+// Single source of truth for the answer-lane behaviour (flash-decouple,
+// 2026-06-05). The visible preview gates on the visible flag ALONE; the draft
+// flag controls only the transport. Resolved here once and consulted at the
+// createAnswerStream config, the materialize-as-answer guard, and the boot log,
+// so all three can never drift back into the `visible || retired` conflation
+// that re-opened the flash. Total-enumerated in answer-stream-flag.test.ts.
+const ANSWER_LANE = resolveAnswerLaneConfig({
+  visibleEnabled: ANSWER_STREAM_VISIBLE_ENABLED,
+  draftFnAvailable: sendMessageDraftFn != null,
+})
 
 // Whether to DELETE the activity/status feed when the final answer lands.
 // Default OFF (2026-06-04, operator request): the status message stays in the
@@ -6631,11 +6745,17 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   let threadId: number | undefined
   if (TURN_ORIGIN_ROUTING_ENABLED) {
     const explicit = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    const originTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+    // Origin precedence: model echo first (authoritative), then the
+    // framework-owned quoted message_id (deterministic, no model thread
+    // assertion) as a fallback when the model omitted the echo.
+    const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+    const quotedTurn = echoedTurn == null ? findTurnByQuotedMessageId(chat_id, args.reply_to) : null
+    const originTurn = echoedTurn ?? quotedTurn
     threadId = resolveAnswerThreadWithLog(
       chat_id,
       Number.isFinite(explicit as number) ? (explicit as number) : undefined,
       originTurn,
+      originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted',
       turn,
       'reply',
     )
@@ -7288,11 +7408,17 @@ async function executeStreamReply(args: Record<string, unknown>): Promise<unknow
   if (args.message_thread_id == null) {
     let injected: number | undefined
     if (TURN_ORIGIN_ROUTING_ENABLED) {
-      const originTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+      // Origin precedence: model echo first, then the framework-owned quoted
+      // message_id as a deterministic fallback (mirrors executeReply).
+      const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
+      const quotedTurn =
+        echoedTurn == null ? findTurnByQuotedMessageId(String(args.chat_id), args.reply_to) : null
+      const originTurn = echoedTurn ?? quotedTurn
       injected = resolveAnswerThreadWithLog(
         String(args.chat_id),
         undefined,
         originTurn,
+        originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted',
         turn,
         'stream_reply',
       )
@@ -9557,15 +9683,29 @@ function handleSessionEvent(ev: SessionEvent): void {
             // General). With the gate unreachable the only posted message is
             // the canonical reply. (The gate is bypassed for DM draft
             // transport, so DM draft streaming is unaffected.)
-            // Draft retired (default) OR visible explicitly on → a real
-            // edit-in-place message (minInitialChars:1, no draft): observable by
-            // the UAT and the onMetric silence-liveness reset fires on visible
-            // sends in DMs AND supergroups. Legacy draft only when the kill
-            // switch re-enables it (DRAFT_ANSWER_LANE_RETIRED=false), which also
-            // restores sendMessageDraftFn above.
-            ...(ANSWER_STREAM_VISIBLE_ENABLED || DRAFT_ANSWER_LANE_RETIRED
-              ? { minInitialChars: 1 }
-              : { sendMessageDraft: sendMessageDraftFn, minInitialChars: Number.MAX_SAFE_INTEGER }),
+            // VISIBLE preview gating decoupled from the draft-transport flag
+            // (2026-06-05 flash regression fix). The visible flag ALONE decides
+            // whether a user-visible preview opens; DRAFT_ANSWER_LANE_RETIRED
+            // controls only the TRANSPORT (whether sendMessageDraftFn exists).
+            // The earlier `|| DRAFT_ANSWER_LANE_RETIRED` here meant retiring the
+            // draft (the default since v0.14.68) silently forced minInitialChars:1
+            // → a visible preliminary opened on every streaming turn and was then
+            // retracted (deleted) when the reply tool fired — the exact "raw bubble
+            // appears, formatted reply lands, raw bubble vanishes" flash that
+            // turning the visible stream OFF (v0.14.52) was meant to remove. So
+            // v0.14.68 silently undid v0.14.52 fleet-wide. Now:
+            //   - VISIBLE on (opt-in) → minInitialChars:1, a real edit-in-place
+            //     preview (observable by UAT, silence-liveness reset on its sends).
+            //   - VISIBLE off (default) → minInitialChars:MAX so NO visible preview
+            //     ever opens; the reply tool is the single canonical formatted
+            //     message (no flash). With the draft retired (default) there is no
+            //     transport either, so the lane stays dormant; with the kill switch
+            //     DRAFT_ANSWER_LANE=0 the legacy compose-box draft transport is
+            //     restored (sendMessageDraftFn defined above, gate bypassed for DM
+            //     draft so #1664 DM draft streaming is unaffected).
+            ...(ANSWER_LANE.usesDraftTransport
+              ? { sendMessageDraft: sendMessageDraftFn, minInitialChars: ANSWER_LANE.minInitialChars }
+              : { minInitialChars: ANSWER_LANE.minInitialChars }),
             // #1075: route through robustApiCall so flood-wait,
             // benign-400, and THREAD_NOT_FOUND are handled uniformly
             // instead of crashing the answer-stream loop on a deleted
@@ -9853,13 +9993,18 @@ function handleSessionEvent(ev: SessionEvent): void {
         const streamedMsgId = stream.messageId()
         const streamedFinalText = turn.capturedText.join('').trim()
         if (
-          // Broadened for draft retirement: a text-only no-reply turn that
-          // streamed a VISIBLE preview must materialize a pinged final answer +
-          // delete the preview. Without this, the retired-default path would
-          // fall into the else-branch retract() and delete the user's only copy
-          // of the answer (a lost-answer bug). The reply-tool branch still hits
-          // retract() → single canonical formatted reply, no flash.
-          (ANSWER_STREAM_VISIBLE_ENABLED || DRAFT_ANSWER_LANE_RETIRED)
+          // Only when a VISIBLE preview actually opened (visible flag on): a
+          // text-only no-reply turn that streamed a visible preview must
+          // materialize a pinged final answer + delete the preview, NOT fall into
+          // the else-branch retract() which would delete the user's only copy of
+          // the answer (a lost-answer bug). Gated on the visible flag alone (the
+          // flash-regression decoupling): with the visible stream OFF (default)
+          // no preview opens (minInitialChars:MAX), so streamedMsgId is null and
+          // this branch is unreachable — the no-reply answer is delivered by the
+          // turn-flush backstop below instead, the pre-v0.14.68 path. The
+          // reply-tool branch hits retract() on a non-opened lane (a no-op), so
+          // there is no preliminary to flash.
+          ANSWER_LANE.opensVisiblePreview
           && !turn.replyCalled
           && streamedMsgId != null
           && streamedFinalText.length > 0
@@ -20589,7 +20734,13 @@ void (async () => {
         }
       }
 
-      process.stderr.write(`telegram gateway: answer-stream lane=${DRAFT_ANSWER_LANE_RETIRED ? 'visible(draft-retired)' : (ANSWER_STREAM_VISIBLE_ENABLED ? 'visible' : 'draft')} draftFn=${sendMessageDraftFn != null ? 'available' : 'off'} grammy=${GRAMMY_VERSION}\n`)
+      // Lane state (post flash-decouple): VISIBLE only when the visible flag is
+      // Lane state from the single-source-of-truth resolver: 'visible' (preview
+      // on), 'draft' (compose-box transport), or 'dormant' (the default: no
+      // preview, no draft — reply tool is the only message). The old label
+      // wrongly reported 'visible(draft-retired)' for the dormant default, which
+      // masked the flash regression.
+      process.stderr.write(`telegram gateway: answer-stream lane=${ANSWER_LANE.state} draftFn=${sendMessageDraftFn != null ? 'available' : 'off'} visible=${ANSWER_STREAM_VISIBLE_ENABLED} draftRetired=${DRAFT_ANSWER_LANE_RETIRED} grammy=${GRAMMY_VERSION}\n`)
       process.stderr.write(`telegram gateway: starting bot polling pid=${process.pid} agent=${process.env.SWITCHROOM_AGENT_NAME ?? '-'} stateDir=${STATE_DIR} historyEnabled=${HISTORY_ENABLED} streamMode=${process.env.SWITCHROOM_TG_STREAM_MODE ?? 'checklist'}\n`)
       runnerHandle = run(bot, {
         runner: {

package/telegram-plugin/tests/answer-stream-flag.test.ts

@@ -6,7 +6,7 @@
  */
 
 import { describe, it, expect } from 'vitest'
-import { parseVisibleAnswerStreamEnabled, parseDraftLaneRetiredEnabled } from '../answer-stream-flag.js'
+import { parseVisibleAnswerStreamEnabled, parseDraftLaneRetiredEnabled, resolveAnswerLaneConfig } from '../answer-stream-flag.js'
 
 describe('parseVisibleAnswerStreamEnabled — default OFF, opt-in', () => {
   it('defaults OFF when unset', () => {
@@ -43,3 +43,75 @@ describe('parseDraftLaneRetiredEnabled — default RETIRED (2026-06-05), kill-sw
     }
   })
 })
+
+// ── resolveAnswerLaneConfig — TOTAL-ENUMERATION REGRESSION PROOF ─────────────
+//
+// This is the behavioural guard for the flash regression (the gateway IIFE is
+// not importable, so the decision lives in this pure function and the gateway
+// delegates to it). The input space is finite — visibleEnabled × draftFnAvailable
+// = 4 — so we enumerate ALL of it and assert the full decision table plus the
+// load-bearing INVARIANT: opensVisiblePreview === visibleEnabled, ALWAYS. That
+// invariant is exactly what v0.14.68 broke (it made the preview depend on the
+// draft flag), so a future change that re-conflates them fails here, not in prod.
+describe('resolveAnswerLaneConfig — total enumeration (flash-regression proof)', () => {
+  const MAX = Number.MAX_SAFE_INTEGER
+  const ALL = [
+    { visibleEnabled: false, draftFnAvailable: false }, // the DEFAULT (visible off, draft retired)
+    { visibleEnabled: false, draftFnAvailable: true }, // draft kill switch on
+    { visibleEnabled: true, draftFnAvailable: false }, // opt-in visible
+    { visibleEnabled: true, draftFnAvailable: true }, // visible wins over draft
+  ]
+
+  it('the input space is exactly 4 rows (2×2)', () => {
+    expect(ALL.length).toBe(4)
+  })
+
+  it('INVARIANT (the regression guard): opensVisiblePreview === visibleEnabled for EVERY draftFnAvailable', () => {
+    for (const input of ALL) {
+      expect(resolveAnswerLaneConfig(input).opensVisiblePreview).toBe(input.visibleEnabled)
+    }
+  })
+
+  it('TOTAL: every input returns a defined config and never throws', () => {
+    for (const input of ALL) {
+      expect(() => resolveAnswerLaneConfig(input)).not.toThrow()
+      expect(resolveAnswerLaneConfig(input).state).toBeDefined()
+    }
+  })
+
+  it('DEFAULT (visible off, draft retired) → DORMANT: no preview, no draft, MAX gate (no flash)', () => {
+    expect(resolveAnswerLaneConfig({ visibleEnabled: false, draftFnAvailable: false })).toEqual({
+      minInitialChars: MAX,
+      usesDraftTransport: false,
+      opensVisiblePreview: false,
+      state: 'dormant',
+    })
+  })
+
+  it('visible off + draft transport available → DRAFT: no visible preview, draft renders', () => {
+    expect(resolveAnswerLaneConfig({ visibleEnabled: false, draftFnAvailable: true })).toEqual({
+      minInitialChars: MAX,
+      usesDraftTransport: true,
+      opensVisiblePreview: false,
+      state: 'draft',
+    })
+  })
+
+  it('visible on → VISIBLE: preview opens on the first chunk (minChars 1), no draft', () => {
+    for (const draftFnAvailable of [false, true]) {
+      expect(resolveAnswerLaneConfig({ visibleEnabled: true, draftFnAvailable })).toEqual({
+        minInitialChars: 1,
+        usesDraftTransport: false,
+        opensVisiblePreview: true,
+        state: 'visible',
+      })
+    }
+  })
+
+  it('a visible preview NEVER opens unless explicitly enabled (no draftFnAvailable forces it on)', () => {
+    // The exact v0.14.68 failure shape: retiring the draft (draftFnAvailable=false)
+    // must NOT open a visible preview.
+    expect(resolveAnswerLaneConfig({ visibleEnabled: false, draftFnAvailable: false }).opensVisiblePreview).toBe(false)
+    expect(resolveAnswerLaneConfig({ visibleEnabled: false, draftFnAvailable: false }).minInitialChars).toBe(MAX)
+  })
+})

package/telegram-plugin/tests/answer-stream.test.ts

@@ -6,6 +6,7 @@ import {
   DRAFT_METHOD_UNAVAILABLE_RE,
   DRAFT_CHAT_UNSUPPORTED_RE,
 } from '../answer-stream.js'
+import { resolveAnswerLaneConfig, ANSWER_LANE_NEVER_OPENS } from '../answer-stream-flag.js'
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -96,6 +97,35 @@ describe('answer-stream — minInitialChars threshold', () => {
     expect(editMessageText).not.toHaveBeenCalled()
   })
 
+  it('FLASH REGRESSION: the DORMANT config (visible off, draft retired) sends NOTHING, even for a full answer', async () => {
+    // End-to-end proof that the resolved default config produces no visible
+    // preview → nothing to retract → no flash. Wires the ACTUAL resolver output
+    // (not a hand-picked threshold) into the stream.
+    const lane = resolveAnswerLaneConfig({ visibleEnabled: false, draftFnAvailable: false })
+    expect(lane.state).toBe('dormant')
+    expect(lane.minInitialChars).toBe(ANSWER_LANE_NEVER_OPENS)
+
+    const sendMessage = makeSendMessage()
+    const editMessageText = makeEditMessageText()
+    const stream = createAnswerStream({
+      chatId: 'chat1',
+      isPrivateChat: false,
+      minInitialChars: lane.minInitialChars,
+      throttleMs: 250,
+      sendMessage,
+      editMessageText,
+      // no sendMessageDraft — dormant lane has no transport
+    })
+
+    // A realistic full answer — 2000 chars, far above any normal threshold.
+    stream.update('The answer is '.repeat(150))
+    vi.advanceTimersByTime(5000)
+    await flushMicrotasks()
+
+    expect(sendMessage).not.toHaveBeenCalled()
+    expect(editMessageText).not.toHaveBeenCalled()
+  })
+
   it('calls transport exactly once when text meets minInitialChars', async () => {
     const sendMessage = makeSendMessage()
     const editMessageText = makeEditMessageText()

package/telegram-plugin/tests/draft-retirement-wiring.test.ts

@@ -1,18 +1,24 @@
 /**
- * Draft-answer-lane retirement — gateway wiring guards (2026-06-05).
+ * Answer-lane wiring guards — draft retirement + flash decoupling.
  *
- * The retirement switches the live answer lane from the invisible compose-box
- * draft to a real, mtcute-observable edit-in-place message, default-on. The
- * design review flagged two ways this silently breaks (gateway IIFE can't be
- * instantiated in-process, so these are source-level assertions, same pattern as
- * silence-liveness-wiring.test):
+ * History:
+ *  - v0.14.52 turned the VISIBLE answer-stream OFF by default to remove the
+ *    "raw preview appears, formatted reply lands, raw preview deleted" flash.
+ *  - v0.14.68 retired the invisible compose-box DRAFT transport. The original
+ *    wiring (and the first version of this test) conflated the two flags —
+ *    `ANSWER_STREAM_VISIBLE_ENABLED || DRAFT_ANSWER_LANE_RETIRED` — so retiring
+ *    the draft (default) silently forced a VISIBLE preview (minInitialChars:1)
+ *    even with the visible flag off, re-introducing the flash FLEET-WIDE
+ *    (v0.14.68 undid v0.14.52). The first revision of this file pinned that
+ *    conflation as a "guard" — i.e. it asserted the bug.
+ *  - 2026-06-05 flash-decouple: the VISIBLE preview now gates on the visible
+ *    flag ALONE; DRAFT_ANSWER_LANE_RETIRED controls only the TRANSPORT. With
+ *    defaults (visible off, draft retired) the lane is DORMANT — no preview, the
+ *    reply tool is the single formatted message, no flash. The no-reply text-only
+ *    answer is delivered by the turn-flush backstop (the pre-v0.14.68 path).
  *
- *  PRIMARY: drop sendMessageDraftFn but FORGET to flip minInitialChars to 1 →
- *  the lane becomes a total no-op (the MAX gate never opens it), losing ALL
- *  answer-lane status AND the #2169 onMetric silence-liveness reset.
- *  SECONDARY: flip the lane to visible but FORGET to broaden the
- *  materialize-as-answer guard → a text-only no-reply turn falls into retract()
- *  and deletes the user's only copy of the answer (a lost-answer bug).
+ * gateway IIFE can't be instantiated in-process, so these are source-level
+ * assertions (same pattern as silence-liveness-wiring.test).
  */
 import { describe, it, expect } from 'vitest'
 import { readFileSync } from 'node:fs'
@@ -20,8 +26,8 @@ import { resolve } from 'node:path'
 
 const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
 
-describe('draft-retirement wiring', () => {
-  it('sendMessageDraftFn is gated on the retirement (the single chokepoint)', () => {
+describe('answer-lane wiring (draft retirement + flash decoupling)', () => {
+  it('sendMessageDraftFn is gated on the retirement (the single transport chokepoint)', () => {
     expect(gatewaySrc).toMatch(/!DRAFT_ANSWER_LANE_RETIRED && typeof _rawSendMessageDraft === 'function'/)
   })
 
@@ -32,19 +38,43 @@ describe('draft-retirement wiring', () => {
     expect(firstUseIdx).toBeGreaterThan(declIdx)
   })
 
-  it('PRIMARY GUARD: retired lane uses minInitialChars:1 (visible), never the MAX no-op gate', () => {
-    // The config must pick the {minInitialChars:1} branch when retired, so the
-    // lane actually opens a real message. The MAX branch is draft-only (legacy).
-    expect(gatewaySrc).toMatch(/ANSWER_STREAM_VISIBLE_ENABLED \|\| DRAFT_ANSWER_LANE_RETIRED\s*\n?\s*\?\s*\{ minInitialChars: 1 \}/)
+  it('the lane behaviour is resolved by the single-source-of-truth pure function', () => {
+    // The flag→config decision lives in resolveAnswerLaneConfig (total-enumerated
+    // in answer-stream-flag.test.ts); the gateway delegates so the three use-sites
+    // can never drift apart.
+    expect(gatewaySrc).toMatch(/const ANSWER_LANE = resolveAnswerLaneConfig\(\{/)
+    expect(gatewaySrc).toMatch(/visibleEnabled: ANSWER_STREAM_VISIBLE_ENABLED/)
+    expect(gatewaySrc).toMatch(/draftFnAvailable: sendMessageDraftFn != null/)
   })
 
-  it('SECONDARY GUARD: the materialize-as-answer guard is broadened in lockstep', () => {
-    // A text-only no-reply turn must materialize (ping + delete preview), not
-    // retract() the answer away.
-    expect(gatewaySrc).toMatch(/\(ANSWER_STREAM_VISIBLE_ENABLED \|\| DRAFT_ANSWER_LANE_RETIRED\)\s*\n?\s*&& !turn\.replyCalled/)
+  it('FLASH GUARD: the createAnswerStream config is driven by ANSWER_LANE (preview gated on the visible flag alone)', () => {
+    // The minInitialChars / draft-transport choice comes from the resolved lane,
+    // never from a `visible || retired` inline conflation.
+    expect(gatewaySrc).toMatch(/\.\.\.\(ANSWER_LANE\.usesDraftTransport/)
+    expect(gatewaySrc).toMatch(/minInitialChars: ANSWER_LANE\.minInitialChars/)
   })
 
-  it('the #2169 onMetric silence-liveness reset is preserved (fires on visible sends now)', () => {
+  it('FLASH GUARD: the visible-OR-retired conflation is GONE everywhere (it pinned the flash)', () => {
+    // No answer-lane path may re-introduce `VISIBLE || RETIRED` — that is the
+    // exact regression this fix removes.
+    expect(gatewaySrc).not.toMatch(/ANSWER_STREAM_VISIBLE_ENABLED \|\| DRAFT_ANSWER_LANE_RETIRED/)
+  })
+
+  it('LOST-ANSWER GUARD: materialize-as-answer gates on ANSWER_LANE.opensVisiblePreview (only fires when a preview actually opened)', () => {
+    // A text-only no-reply turn materializes (ping + keep) ONLY when a visible
+    // preview opened. With visible off the lane is dormant (minInitialChars:MAX),
+    // so this branch is unreachable and the answer is delivered by turn-flush
+    // instead — never retracted away.
+    expect(gatewaySrc).toMatch(/\n\s*ANSWER_LANE\.opensVisiblePreview\s*\n\s*&& !turn\.replyCalled/)
+  })
+
+  it('LOST-ANSWER GUARD: turn-flush is skipped ONLY when the stream finalized as the answer (so dormant-lane no-reply turns still flush)', () => {
+    // flushDecision skips only on streamFinalizedAsAnswer; with the lane dormant
+    // that stays false, so decideTurnFlush runs and delivers the no-reply answer.
+    expect(gatewaySrc).toMatch(/const flushDecision = streamFinalizedAsAnswer\s*\n?\s*\?/)
+  })
+
+  it('the #2169 onMetric silence-liveness reset is still wired (fires on visible sends when opted in)', () => {
     const onMetric = (gatewaySrc.split('onMetric: (metricEv) => {')[1] ?? '').split('\n            },')[0]
     expect(onMetric).toMatch(/silencePoke\.noteProduction/)
     expect(onMetric).toMatch(/currentTurn === turn/)

package/telegram-plugin/tests/multitopic-routing-wiring.test.ts

@@ -67,6 +67,51 @@ describe('component 3 — turn-origin reply routing', () => {
   })
 })
 
+describe('framework-owned origin recovery (determinism residual, 2026-06-05)', () => {
+  it('a source-message reverse index is populated at enqueue and EVICTED in parity with recentTurnsById', () => {
+    expect(gatewaySrc).toMatch(/const recentTurnIdBySourceMessageId = new Map<number, string>\(\)/)
+    // Populated inside rememberRecentTurn from the turn's sourceMessageId.
+    const fn = gatewaySrc.split('function rememberRecentTurn')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.set\(turn\.sourceMessageId, turn\.turnId\)/)
+    // Eviction parity: the reverse entry is dropped when its turn is evicted —
+    // so the index cannot outgrow the bounded RECENT_TURNS_MAX registry.
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.delete\(evicted\.sourceMessageId\)/)
+  })
+
+  it('both reply paths recover origin from the quoted message_id when the model omits the echo', () => {
+    for (const name of ['executeReply', 'executeStreamReply']) {
+      const fn = gatewaySrc.split(new RegExp(`async function ${name}`))[1]?.split('\nasync function ')[0] ?? ''
+      // Echo first (authoritative), quoted message_id as the framework fallback.
+      expect(fn).toMatch(/const echoedTurn = findTurnByOriginId\(args\.origin_turn_id/)
+      // Quoted lookup is CHAT-SCOPED (cross-chat message-id collision guard).
+      expect(fn).toMatch(/findTurnByQuotedMessageId\([^,]+, args\.reply_to\)/)
+      expect(fn).toMatch(/echoedTurn \?\? quotedTurn/)
+    }
+  })
+
+  it('findTurnByQuotedMessageId is gated on the kill switch and resolves a real turn (never the live successor)', () => {
+    const fn = gatewaySrc.split('function findTurnByQuotedMessageId')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/FRAMEWORK_ORIGIN_ROUTING_ENABLED/)
+    expect(fn).toMatch(/recentTurnIdBySourceMessageId\.get\(mid\)/)
+    expect(fn).toMatch(/recentTurnsById\.get\(owner\)/)
+    // Cross-chat collision guard: the resolved turn must belong to this chat.
+    expect(fn).toMatch(/turn\.sessionChatId !== chatId/)
+  })
+
+  it('the irreducible no-echo residual is ALARMED (MISROUTE_RISK), never silently mis-routed', () => {
+    expect(gatewaySrc).toMatch(/MISROUTE_RISK\(no-echo→live-successor\)/)
+    expect(gatewaySrc).toMatch(/function hasDifferentThreadedRecentTurn/)
+    // The alarm is observability-only: it fires on via=live with a different
+    // recent topic, and does NOT change the resolved thread.
+    expect(gatewaySrc).toMatch(/const misrouteRisk =/)
+    expect(gatewaySrc).toMatch(/via === 'quoted' \? ' QUOTED\(framework-origin\)' : ''/)
+  })
+
+  it('the kill switch defaults ON and is independent of TURN_ORIGIN_ROUTING', () => {
+    expect(gatewaySrc).toMatch(/SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'/)
+  })
+})
+
 describe('component 4 — per-turn topic framing', () => {
   it('the gateway stamps a topic_scope directive for forum-topic inbounds (kill-switched)', () => {
     expect(gatewaySrc).toMatch(/TOPIC_FRAMING_ENABLED/)