switchroom 0.16.47 → 0.17.0

package/telegram-plugin/gateway/gateway.ts

@@ -114,7 +114,7 @@ import { renderVaultRequestAccessCard } from './vault-request-access-card.js'
 import { createPermissionCardStore } from './permission-card-store.js'
 import { pickRecoveredPermissionOrigin } from './permission-card-origin.js'
 import { isTelegramReplyTool, isTelegramSurfaceTool } from '../tool-names.js'
-import { appendActivityLabel, clipNarrative, renderActivityFeedWithNested, type SessionActivityHeader } from '../tool-activity-summary.js'
+import { appendActivityLabel, clipNarrative, renderActivityFeedWithNested, formatStepSuffix, type SessionActivityHeader } from '../tool-activity-summary.js'
 import { REPLY_TOOLS, isDraftOfReply } from '../narrative-dedup.js'
 import { toolLabel } from '../tool-labels.js'
 import { createTypingWrapper } from '../typing-wrap.js'
@@ -285,6 +285,7 @@ import {
 } from '../active-reactions.js'
 import { sweepActiveReactions } from '../active-reactions-sweep.js'
 import { flushOnAgentDisconnect } from './disconnect-flush.js'
+import { markBusyKeyLockstep, reapOrphanBusyKeys } from './busy-key-reaper.js'
 import { PreambleSuppressor } from './preamble-suppressor.js'
 import {
   fetchFolderPage,
@@ -383,6 +384,7 @@ import {
 import { loadObligations, persistObligations } from './obligation-store.js'
 import {
   loadStatusPins,
+  mutateStatusPinRow,
   pinnedMessageIsOurs,
   reconcileAndPersistStatusPin,
   runStatusPinBootCleanup,
@@ -392,6 +394,7 @@ import {
 } from './status-pin-store.js'
 import { driveEscalation } from './escalation-drive.js'
 import { shouldSuppressRepresent } from './represent-guard.js'
+import { shouldDeferEscalationForBridge } from './escalation-bridge-gate.js'
 import { createInboundSpool } from './inbound-spool.js'
 import { purgeStaleTurnsForChat } from './turn-state-purge.js'
 import { decideInboundDelivery } from './inbound-delivery-gate.js'
@@ -422,6 +425,7 @@ import {
   forgetDelivery,
   shouldTrackDelivery,
   isTrackableResumeSynthetic,
+  isRedeliverySuspended,
   type PendingDelivery,
 } from './inbound-delivery-confirm.js'
 import { createPendingPermissionBuffer } from './pending-permission-decisions.js'
@@ -434,6 +438,7 @@ import { chatKey, chatKeyWithSuffix, chatIdOfChatKey } from './chat-key.js'
 import { shadowEmit, isMachineInTurn, isDeliveryCutoverEnabled } from './inbound-delivery-machine-shadow.js'
 import type { ChatKey as _ChatKey } from './inbound-delivery-machine.js'
 import { dispatchEffects, isDispatchEnabled } from './inbound-delivery-machine-dispatch.js'
+import { probeGateParity } from './gate-parity-probe.js'
 import { maybeFireWarmup } from './prefix-warmup.js'
 import {
   buildVaultGrantApprovedInbound,
@@ -616,20 +621,26 @@ import {
   findLatestTurnIfInterrupted,
   findRecentTurnsForChat,
   getTurnByKey,
+  markTurnResumed,
 } from '../registry/turns-schema.js'
 import {
   buildResumeInterruptedInbound,
   buildResumeWatchdogReportInbound,
   selectResumeBuilder,
 } from './resume-inbound-builder.js'
-import { applySubagentsSchema, getSubagentByJsonlId } from '../registry/subagents-schema.js'
+import { applySubagentsSchema, getSubagentByJsonlId, resolveSubagentOriginTurnKey } from '../registry/subagents-schema.js'
 import { resolveWorkerFeedDispatch, type WorkerFeedDispatch } from './worker-feed-dispatch.js'
 import {
   resolveSubagentStatusSurface,
   isOrphanSubagentStatusEnabled,
 } from './subagent-status-surface.js'
 import { formatIdleFooter } from '../idle-footer.js'
-import { resolveCallingSubagent } from './resolve-calling-subagent.js'
+import {
+  deriveStatusQueryTelemetry,
+  formatStatusQueryLine,
+  formatStatusQueryUxFailureLine,
+  type StatusQuerySurfaces,
+} from '../status-query-telemetry.js'
 
 // ─── Stderr logging ───────────────────────────────────────────────────────
 // Install the line-stamper FIRST so it wraps closest to the original
@@ -1403,9 +1414,15 @@ function resolveSubagentOriginChat(
 ): { chatId: string; threadId?: number } | null {
   if (turnsDb == null) return null
   try {
-    const sub = getSubagentByJsonlId(turnsDb, agentId)
-    if (sub?.parent_turn_key == null) return null
-    const turn = getTurnByKey(turnsDb, sub.parent_turn_key)
+    // Transitive walk: a NESTED (depth-2+) worker's own parent_turn_key is
+    // NULL by construction (its dispatching context is another sub-agent,
+    // not a gateway turn) — resolveSubagentOriginTurnKey follows the
+    // parent_agent_id chain to the ancestor row that WAS stamped at
+    // main-turn dispatch time, so nested cards + handbacks route to the
+    // originating chat/topic instead of falling back to the owner DM.
+    const originKey = resolveSubagentOriginTurnKey(turnsDb, agentId)
+    if (originKey == null) return null
+    const turn = getTurnByKey(turnsDb, originKey)
     if (turn == null || turn.chat_id.length === 0) return null
     const threadNum =
       turn.thread_id != null && turn.thread_id.length > 0
@@ -1536,8 +1553,8 @@ const deferredDoneReactions = new DeferredDoneReactions<StatusReactionController
   purge: (key) => purgeReactionTracking(key),
 })
 
-// #546 — outbound content-dedup window. PR #599 introduced the four read
-// sites (`outboundDedup.check` / `.record` in executeReply, executeStreamReply,
+// #546 — outbound content-dedup window. PR #599 introduced the read
+// sites (`outboundDedup.check` / `.record` in executeReply and
 // turn-flush) but the declaration was lost in a merge somewhere — every reply
 // path threw `outboundDedup is not defined` at runtime, blocking ALL outbound
 // from the agent. Restore the module-level singleton here.
@@ -1577,6 +1594,18 @@ const activeTurnStartedAt = new Map<string, number>()
 // reading activeTurnStartedAt because they want the receipt timestamp.
 const claudeBusyKeys = new Set<string>()
 
+// #2787 Mechanism B — insertion timestamps for the busy keys above, so the
+// confirm sweep can reap an orphaned marker. `busy` is stamped EAGERLY at
+// delivery and cleared only at turn_end; a delivered-but-never-enqueued inbound
+// (e.g. a composer strand or an enqueue-ack mismatch) therefore leaves its key
+// stuck forever, wedging the legacy-regime idle-drain (turnInFlightForGate reads
+// claudeBusyKeys.size) for EVERY topic until the ~300s silence poke — the
+// 5-minute all-topics stall of #1922. The reaper (reapOrphanBusyKeys) uses these
+// timestamps to bound that dangle. The delivery-machine cutover regime is already
+// immune (it tracks one activeTurn + TTL tick, never a per-key set); this bounds
+// the legacy path it hasn't replaced yet.
+const claudeBusyKeySince = new Map<string, number>()
+
 /**
  * #2527 observability: count emoji transitions per status-reaction controller
  * so `turn_no_reply_warn` can report how many reaction changes happened while
@@ -1610,10 +1639,68 @@ function markClaudeBusyForInbound(m: {
     if (Number.isFinite(n)) tid = n
   }
   const key = chatKey(m.chatId, tid)
-  claudeBusyKeys.add(key)
+  // #2787: lockstep add + idle→busy timestamp. Keyed on set membership (see
+  // busy-key-reaper.ts) so a re-mark after a disconnect flush (which cleared
+  // claudeBusyKeys directly) always re-stamps a fresh Date.now() and the orphan
+  // TTL measures the CURRENT dangle, never a stale pre-disconnect timestamp.
+  markBusyKeyLockstep(claudeBusyKeys, claudeBusyKeySince, key, Date.now())
   return key
 }
 
+// #2787 Mechanism B — reap orphaned busy markers. Called from the confirm sweep
+// ONLY once `currentTurn == null` has been asserted: with no turn in flight, any
+// surviving claudeBusyKeys entry is definitionally an orphan (a real turn would
+// hold currentTurn non-null), so clearing a stale one can never clobber a live
+// turn. Also prunes timestamp entries whose key already left the set (e.g. a
+// disconnect flush cleared claudeBusyKeys directly) so the map can't grow
+// unbounded.
+//
+// SLOW-DELIVERY SAFETY (the #1922 hazard): `currentTurn == null` is NOT proof of
+// idle — busy is marked EAGERLY at delivery, and the gateway→claude enqueue-ack
+// lag can be up to ~5 MINUTES under load (#1922). During that eager-mark→enqueue
+// window `currentTurn` is null yet the turn is real-and-merely-slow, so a bare
+// time-grace reaper could reap a genuine delivery and re-open the idle-drain gate
+// while claude is about to process the very inbound whose key it just reaped
+// (duplicate / concurrent delivery on the CORE inbound path). A time grace alone
+// cannot distinguish "slow" from "orphaned".
+//
+// So the reap is PROOF-GATED, not just time-gated (option (b), the load-bearing
+// guarantee): a key is reaped ONLY when it has NO corresponding entry in the
+// delivery-confirm queue (`deliveryQueue.pending`). A slow-but-real inbound is
+// tracked there from delivery until claude's `enqueue` ack lands (or forever, via
+// the never-drop re-deliver loop), so any key still awaiting its turn is present
+// and skipped — no matter how slow. Only a key that is busy-marked yet has no
+// pending delivery is a TRUE orphan: either it was acked (its turn ran and should
+// have cleared busy at turn_end — a genuinely stuck marker) or it was a
+// steer/interrupt inbound that shouldTrackDelivery excludes (it amends a running
+// turn, so with currentTurn == null its marker is likewise stale). Reaping only
+// these can never clobber a slow delivery.
+//
+// The time grace is retained as defense-in-depth on top of the proof gate, raised
+// to a default well above the observed enqueue-ack lag and env-tunable via the
+// config cascade. This bounds the legacy-regime idle-drain wedge from ~300s
+// (silence poke) to the grace window without racing a slow delivery.
+//
+// Config cascade: SWITCHROOM_BUSY_ORPHAN_TTL_MS is an OVERRIDE-mode scalar
+// (defaults → profiles → agents; a lower layer's value replaces, not merges).
+// Default 360_000ms (6 min) — comfortably above the ~5-min #1922 tail so the
+// grace never trips on a merely-slow delivery even if the proof gate is bypassed.
+// Clamped to a positive finite value; a degenerate override falls back to default.
+const _busyOrphanTtlRaw = process.env.SWITCHROOM_BUSY_ORPHAN_TTL_MS
+const _busyOrphanTtlParsed =
+  _busyOrphanTtlRaw != null && _busyOrphanTtlRaw !== '' ? Number(_busyOrphanTtlRaw) : 360_000
+const CLAUDE_BUSY_ORPHAN_TTL_MS =
+  Number.isFinite(_busyOrphanTtlParsed) && _busyOrphanTtlParsed > 0 ? _busyOrphanTtlParsed : 360_000
+function reapOrphanBusyKeysNow(now: number): void {
+  reapOrphanBusyKeys(claudeBusyKeys, claudeBusyKeySince, now, {
+    ttlMs: CLAUDE_BUSY_ORPHAN_TTL_MS,
+    // Proof gate — a key still tracked in the delivery-confirm queue is a
+    // slow-but-real inbound awaiting its enqueue ack, never an orphan (#1922).
+    hasPendingDelivery: (key) => deliveryQueue.pending.has(key),
+    log: (msg) => process.stderr.write(`${msg}\n`),
+  })
+}
+
 // ─── Reliable inbound delivery: deliver-until-acked (the marko drop-wedge) ─
 // A delivered inbound is ACKED only by the `enqueue` session-event (claude
 // actually started the turn) — NOT by sendToAgent returning true. Until
@@ -1934,13 +2021,8 @@ const POST_ANSWER_LIVENESS_STALE_MS = parsePostAnswerLivenessMs(
   process.env.SWITCHROOM_POST_ANSWER_LIVENESS_STALE_MS,
 ) || 30_000
 
-/** Compact mm/ss-ish elapsed for the live feed suffix: "18s", "1m05s". */
-function formatFeedElapsed(ms: number): string {
-  const s = Math.floor(ms / 1000)
-  if (s < 60) return `${s}s`
-  const m = Math.floor(s / 60)
-  return `${m}m${(s % 60).toString().padStart(2, '0')}s`
-}
+// Live-feed step suffixes render via `formatStepSuffix` (tool-activity-summary):
+// the CURRENT step's own elapsed, shown only past STEP_TIMER_MIN_MS (10 s).
 
 /**
  * Authoritative "is a turn in flight?" for every gate that previously
@@ -1957,7 +2039,14 @@ function formatFeedElapsed(ms: number): string {
  * message self-blocks. See the snapshot at the inbound handler.
  */
 function turnInFlightForGate(): boolean {
-  return isDeliveryCutoverEnabled() ? isMachineInTurn() : claudeBusyKeys.size > 0
+  if (!isDeliveryCutoverEnabled()) return claudeBusyKeys.size > 0
+  // Machine is authoritative. Run the log-only drift canary (#2794): the
+  // imperative `claudeBusyKeys` shadow is still live in parallel, so a
+  // dangerous over-hold divergence (machine holds the gate while the
+  // imperative view is idle) is surfaced without changing behaviour. The
+  // benign orphan-dangle direction — the wedge the machine self-heals — is
+  // NOT flagged. `probeGateParity` returns the machine value unchanged.
+  return probeGateParity(isMachineInTurn(), claudeBusyKeys.size)
 }
 
 /**
@@ -3263,6 +3352,7 @@ function purgeReactionTracking(key: string, endingTurn?: CurrentTurn): void {
   // the markClaudeBusyForInbound on the delivery path. Safe no-op
   // when the key was never marked (synthetic purge from a sweep).
   claudeBusyKeys.delete(key)
+  claudeBusyKeySince.delete(key) // #2787: keep the orphan-TTL map in lockstep
   // #2527: clear the per-key reaction-transition counter and first-reply
   // sentinel alongside the controller so we don't leak state across turns.
   reactionTransitionCounts.delete(key)
@@ -3448,6 +3538,7 @@ function releaseTurnBufferGate(key: string, endingTurn?: CurrentTurn): void {
   // PR3b: keep claudeBusyKeys in sync — same lifecycle as the
   // activeTurnStartedAt entry it's mirroring here.
   claudeBusyKeys.delete(key)
+  claudeBusyKeySince.delete(key) // #2787: keep the orphan-TTL map in lockstep
   // Shadow trace so the structural turn-end metric still records.
   // outboundEmitted=true is correct here — we only reach this from
   // executeReply AFTER an outbound landed.
@@ -4451,7 +4542,7 @@ const STATUS_QUERY_RE = /^\s*status\??\s*$/i
 
 // ─── Permission handling ──────────────────────────────────────────────────
 const PERMISSION_REPLY_RE = /^\s*(y|yes|n|no)\s+([a-km-z]{5})\s*$/i
-const pendingPermissions = new Map<string, { tool_name: string; description: string; input_preview: string; startedAt: number; card_text: string; cards: { chatId: string; messageId: number }[] }>()
+const pendingPermissions = new Map<string, { tool_name: string; description: string; input_preview: string; startedAt: number; card_text: string; cards: { chatId: string; messageId: number; threadId?: number | null }[] }>()
 // PERMISSION_TTL_MS / ttlForTool / the timed-out card builder now live in
 // ./permission-timeout.ts (pure + unit-testable). hostd gated verbs get a
 // 30-min window; everything else keeps the 10-min default.
@@ -5652,22 +5743,37 @@ const statusPinStoreFs = {
 }
 const statusPinPersistEnabled = !STATIC && PIN_STATUS_WHILE_WORKING
 
-// The full live claim set as persisted rows (confirmed pins), from the Maps.
-function snapshotStatusPins(): PersistedStatusPin[] {
-  const snapshot: PersistedStatusPin[] = []
-  for (const [pinKey, state] of statusPinState) {
-    const chatId = statusPinChatIds.get(pinKey)
-    if (chatId == null) continue
-    snapshot.push({ pinKey, chatId, messageId: state.messageId })
-  }
-  return snapshot
-}
-
-// The live claim set EXCLUDING one key — used by reconcileAndPersistStatusPin so
-// it can rewrite the whole set atomically while it flips that one key's record
-// between pending / confirmed / absent.
-function snapshotStatusPinsExcept(exceptKey: string): PersistedStatusPin[] {
-  return snapshotStatusPins().filter((p) => p.pinKey !== exceptKey)
+// Slot-banner pin persistence (#421 crash-recovery). The slot banner is pinned
+// in the owner chat when the agent is on a non-default OAuth slot. Rather than a
+// parallel store + second boot hook, its pin is persisted in the SAME
+// status-pins.json store under a distinct `banner:` pinKey, so the ONE existing
+// runStatusPinBootCleanup unpins an orphaned banner on boot for free. Every
+// write to the shared store is a per-key read-modify-write under the store's
+// per-path lock (mutateStatusPinRow / reconcileAndPersistStatusPin), so the two
+// pin kinds (map-backed status pins + this banner row) can never clobber each
+// other's rows — the "other" rows always come from the authoritative on-disk
+// file, never from a possibly-stale in-memory snapshot.
+const BANNER_PIN_KEY = 'banner:owner'
+// Banner persistence rides the same "store is usable" gate as status pins minus
+// the worker-pin feature flag: the banner is an independent feature, so it must
+// persist/recover whenever there's a real state volume (STATIC = no volume/dry
+// run → no-op). The boot-cleanup gate below is widened to cover this.
+const bannerPinPersistEnabled = !STATIC
+
+// Persist (or drop) the slot-banner's pin row into the shared store. Routes
+// through mutateStatusPinRow: a read-modify-write for ONLY the banner:owner key,
+// serialised on the store's per-path lock, so the live fg:/wk: status-pin rows
+// on disk are carried through unchanged and never clobbered. Best-effort +
+// gated: no-op when the store isn't usable (STATIC). Fire-and-forget — the
+// mutation never rejects (persist is fail-open, load is fail-open).
+function persistBannerRow(row: PersistedStatusPin | null): void {
+  if (!bannerPinPersistEnabled) return
+  void mutateStatusPinRow(
+    STATUS_PIN_STORE_PATH,
+    statusPinStoreFs,
+    BANNER_PIN_KEY,
+    row,
+  )
 }
 
 // The Bot API surface the pin driver needs. `lockedBot` is defined later; wrap
@@ -5700,7 +5806,11 @@ function statusPinApi(): PinBotApi {
  * positives.
  */
 async function statusPinBootCleanup(): Promise<void> {
-  if (!statusPinPersistEnabled) return
+  // Runs when EITHER pin kind could have written the shared store: the
+  // map-backed status pins (statusPinPersistEnabled) or the slot banner
+  // (bannerPinPersistEnabled). A single cleanup drains ALL orphaned rows —
+  // status pins AND banner alike — since they share status-pins.json.
+  if (!statusPinPersistEnabled && !bannerPinPersistEnabled) return
   const api = statusPinApi()
   const { cleared, total } = await runStatusPinBootCleanup({
     path: STATUS_PIN_STORE_PATH,
@@ -5811,7 +5921,6 @@ async function reconcileStatusPinInner(
     pinKey,
     chatId,
     op,
-    snapshotOthers: () => snapshotStatusPinsExcept(pinKey),
     applyPin: runReconcile,
   })
   if (next == null) {
@@ -6624,19 +6733,56 @@ async function redeliverStrandedInbound(p: PendingDelivery<InboundMessage>): Pro
     forgetDelivery(deliveryQueue, p.key)
   }
 }
+// #2787 Mechanism A — which chats/topics currently hold a live permission or
+// ask_user card. A pending card is a live interaction for ITS OWN chat, so the
+// confirm sweep must not re-clear the composer + re-send there. But the OLD guard
+// (`pendingPermissions.size > 0 || pendingAskUser.size > 0 → return`) suspended
+// the sweep GLOBALLY: one card parked in a single topic (or in the operator DM,
+// a different chatId entirely) froze re-delivery of every stranded inbound across
+// EVERY topic until that one card resolved. This scopes the suspension to the
+// card's own target. Returns per-topic chatKeys where the topic is known and bare
+// chatIds where it isn't (a card fanned to operator DMs records chatId only, and
+// a whole-chat suspension is the safe conservative fallback there); the callsite
+// tests a delivery entry against both renderings.
+function sweepSuspendedTargets(): { keys: Set<string>; chats: Set<string> } {
+  const keys = new Set<string>()
+  const chats = new Set<string>()
+  for (const p of pendingPermissions.values()) {
+    for (const c of p.cards) {
+      if (c.threadId != null) keys.add(chatKey(c.chatId, c.threadId))
+      else chats.add(c.chatId)
+    }
+    // A permission whose card send hasn't resolved yet (cards still empty) has
+    // no recorded target — suspend nothing for it; the next sweep sees it once
+    // the send resolves, and the currentTurn guard already covers the in-turn
+    // window a fresh permission request lives in.
+  }
+  for (const a of pendingAskUser.values()) {
+    if (a.threadId != null) keys.add(chatKey(a.chatId, a.threadId))
+    else chats.add(a.chatId)
+  }
+  return { keys, chats }
+}
+
 const _deliveryConfirmSweep = setInterval(() => {
   if (!DELIVERY_CONFIRM_ENABLED) return
   // Re-deliver ONLY when claude is genuinely idle. `currentTurn` is set solely
   // by the enqueue session-event and nulled at turn-end, so `currentTurn != null`
   // means a real turn is in flight — re-clearing the composer + re-sending now
-  // would clobber it (the exact mid-turn wedge this queue exists to prevent). A
-  // pending permission / ask_user prompt is likewise a live interaction. Defer:
-  // leave the entry pending (it isn't acked) so the next idle sweep retries.
+  // would clobber it (the exact mid-turn wedge this queue exists to prevent).
   // NB: claudeBusyKeys (turnInFlightForGate) is set EAGERLY at delivery and
   // stays set through a strand, so it is NOT a usable "idle" signal here.
   if (currentTurn != null) return
-  if (pendingPermissions.size > 0 || pendingAskUser.size > 0) return
+  // #2787 Mechanism B: no turn in flight → reap any orphaned busy marker so a
+  // delivered-but-never-enqueued inbound can't wedge the idle-drain globally.
+  reapOrphanBusyKeysNow(Date.now())
+  // #2787 Mechanism A: a pending permission / ask_user card suspends re-delivery
+  // ONLY for its own chat/topic — never globally. Skip just the stranded entries
+  // whose target holds a live card; sweep the rest so unrelated topics keep
+  // getting re-delivered.
+  const suspended = sweepSuspendedTargets()
   for (const p of sweepDeliveryQueue(deliveryQueue, Date.now(), DELIVERY_CONFIRM_TIMEOUT_MS)) {
+    if (isRedeliverySuspended(p.key, suspended)) continue
     void redeliverStrandedInbound(p)
   }
 }, DELIVERY_CONFIRM_SWEEP_MS)
@@ -6709,8 +6855,61 @@ const inboundSpool = STATIC
         existsSync: (p) => existsSync(p),
         statSizeSync: (p) => statSync(p).size,
       },
+      // #2789 B: durability degradation must be visible, not silent. When
+      // spool appends start failing we're back to in-memory-only — a
+      // later crash loses those messages. Latched log so the operator /
+      // health surface sees the transition rather than a silent downgrade.
+      onDegraded: (info) => {
+        process.stderr.write(
+          `telegram gateway: inbound-spool durability ` +
+          `${info.degraded ? 'DEGRADED to in-memory-only' : 'RECOVERED'} ` +
+          `path=${info.path} consecutiveFailures=${info.consecutiveFailures}` +
+          `${info.error != null ? ` error=${info.error}` : ''}\n`,
+        )
+      },
     })
-const pendingInboundBuffer = createPendingInboundBuffer({ spool: inboundSpool })
+
+// #2789 A: the in-memory cap eviction used to silently drop the oldest
+// buffered inbound within a live session (the durable spool copy only
+// replays at boot / escalates after 15 min). Surface it as a coalesced,
+// per-chat "messages deferred" notice so the eviction is visible — the
+// evicted message still lives in the spool, so it is deferred, not lost.
+const EVICT_NOTICE_COOLDOWN_MS = 5 * 60 * 1000
+const evictNoticeByChat = new Map<string, number>()
+const pendingInboundBuffer = createPendingInboundBuffer({
+  spool: inboundSpool,
+  onEvict: (_agent, evicted) => {
+    const chat = evicted.chatId
+    const evThread =
+      typeof evicted.meta?.threadId === 'string' && evicted.meta.threadId
+        ? Number(evicted.meta.threadId)
+        : undefined
+    const key = `${chat}:${evThread ?? '-'}`
+    const last = evictNoticeByChat.get(key)
+    const nowMs = Date.now()
+    // Coalesce: at most one deferral notice per chat per cooldown so a
+    // sustained >32 burst posts one line, not one per evicted message.
+    if (last != null && nowMs - last < EVICT_NOTICE_COOLDOWN_MS) return
+    evictNoticeByChat.set(key, nowMs)
+    const threadOpts = evThread != null ? { message_thread_id: evThread } : {}
+    // Honesty: the evicted message is NOT re-pushed into the buffer
+    // in-session — its only in-session resolution is the escalation sweep
+    // (sweepEscalations, ~15 min), which either delivers it or posts the
+    // "couldn't deliver … please resend" retraction. So this notice must
+    // NOT promise a prompt pickup ("shortly"), or it would contradict a
+    // later escalation. Word it to match that reality: saved, handled when
+    // the current turn frees up, and prompted-to-resend if it can't be.
+    void swallowingApiCall(
+      () =>
+        bot.api.sendMessage(
+          chat,
+          "⏳ Messages are arriving faster than I can process them. Your messages are saved and will be handled once I finish the current turn — if any can't be picked up, I'll ask you to resend it.",
+          { ...threadOpts },
+        ),
+      { chat_id: chat, verb: 'inbound-buffer-eviction' },
+    )
+  },
+})
 
 // PR2 obligation-ledger idle sweep. Re-present an OPEN obligation only at a
 // CLEAN idle: no turn in flight AND the inbound buffer is empty — so the
@@ -6880,6 +7079,22 @@ function obligationSweep(): void {
   // normal close path) — close silently instead of alarming the user with a
   // false "I may have missed this". This is Fix 4: escalate only on knowledge,
   // not doubt. Fall back to false (safe: never suppresses) if history unavailable.
+  //
+  // #2788 Gap A — bridge-flap gate. The escalate branch DIRECT-SENDS (via
+  // bot.api.sendMessage below), bypassing the bridge. So while the bridge is
+  // down the represent branch is naturally stranded (bridge → buffer) but this
+  // branch would still fire a false "I may have missed this", even though the
+  // real reply is merely queued behind a transient outage. Defer: if the bridge
+  // is not alive, leave the obligation OPEN and re-drive on a later sweep once
+  // it recovers. Obligations survive bridge death (durable ledger, re-evaluated
+  // every sweep), so this deferral adds NO unbounded liveness dependency — the
+  // whole gateway already rests on the bridge eventually reconnecting.
+  if (shouldDeferEscalationForBridge({ bridgeAlive: ipcServer.getClient(agent)?.isAlive() === true })) {
+    process.stderr.write(
+      `telegram gateway: obligation escalation deferred — bridge down (nudge waits for reconnect) origin=${o.originTurnId}\n`,
+    )
+    return
+  }
   if (HISTORY_ENABLED && hasOutboundDeliveredSince(o.chatId, o.openedAt, o.threadId)) {
     process.stderr.write(
       `telegram gateway: obligation closed silently — outbound delivered since open origin=${o.originTurnId}\n`,
@@ -6938,6 +7153,25 @@ if (bootResumeInbound != null) {
   } else {
     pendingInboundBuffer.push(bootResumeInbound.agent, bootResumeInbound.msg)
   }
+  // At-most-once resume (#2793 part A): now that the resume inbound is
+  // DURABLY committed (spooled, or buffered in STATIC mode), stamp the
+  // turn's `resumed_at` so a later restart can't re-mint a fresh resume for
+  // the same turn and re-run side effects that already executed. This is
+  // synchronous and runs before any async delivery/ack can interleave, so
+  // the ledger is set before the spool entry can be consumed — closing the
+  // accept-vs-consume double-execution window. Stamping AFTER the durable
+  // put (never before) means a crash in between leaves the turn un-stamped
+  // and the resume is retried, not silently dropped.
+  const resumeTurnKey = bootResumeInbound.msg.meta?.resume_turn_key
+  if (turnsDb != null && typeof resumeTurnKey === 'string' && resumeTurnKey.length > 0) {
+    try {
+      markTurnResumed(turnsDb, resumeTurnKey)
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: markTurnResumed failed turnKey=${resumeTurnKey}: ${(err as Error).message}\n`,
+      )
+    }
+  }
 }
 // Boot-replay: re-queue every un-acked spooled inbound into the
 // in-memory buffer so the existing drain triggers (onClientRegistered
@@ -7272,6 +7506,7 @@ const ipcServer: IpcServer = createIpcServer({
       activeReactionMsgIds,
       activeTurnStartedAt,
       claudeBusyKeys,
+      claudeBusyKeySince,
       activeDraftStreams,
       clearActiveReactions: () => {
         const ad = resolveAgentDirFromEnv()
@@ -7328,11 +7563,10 @@ const ipcServer: IpcServer = createIpcServer({
     // compaction occupancy read (see maybeProactiveCompact).
     if (msg.activeFile) lastSessionActiveFile = msg.activeFile
     const ev = msg.event as unknown as SessionEvent
-    // Pass the envelope's chatId so non-enqueue events can route to the
-    // correct card even when the driver's currentChatId is stale.
-    const chatHint = msg.chatId || null
-    const threadHint = msg.threadId != null ? String(msg.threadId) : undefined
-    progressDriver?.ingest(ev, chatHint, threadHint)
+    // #1122/#1126: session events used to be ingested into the pinned progress
+    // card here (`progressDriver.ingest`). The card is retired and the driver
+    // is permanently null, so that call was a dead no-op — removed. Session
+    // events still drive the live surfaces via `handleSessionEvent`.
     handleSessionEvent(ev)
     // Problem B: keep the deferred-interrupt boundary tracker in lockstep with
     // the session stream (tool_use opens, tool_result/turn_end close). If a `!`
@@ -7498,7 +7732,7 @@ const ipcServer: IpcServer = createIpcServer({
       // found"), re-send thread-less into the main chat so the card still
       // ARRIVES rather than vanishing → 10-min TTL auto-deny → wedge.
       // allow-raw-bot-api: wrapped in retryWithThreadFallback (retry policy); topic-aware send
-      void retryWithThreadFallback<{ message_id: number }>(
+      void retryWithThreadFallback<{ message_id: number; message_thread_id?: number }>(
         robustApiCall,
         (tid) =>
           bot.api.sendRichMessage(chatId, richMessage(text), {
@@ -7514,7 +7748,19 @@ const ipcServer: IpcServer = createIpcServer({
         // guard the lookup.
         const pend = pendingPermissions.get(requestId)
         if (pend && sent && typeof sent.message_id === 'number') {
-          pend.cards.push({ chatId, messageId: sent.message_id })
+          // #2787: record where the card ACTUALLY LANDED so the confirm sweep
+          // scopes its re-delivery suspension to the real chat/topic. When
+          // retryWithThreadFallback hit THREAD_NOT_FOUND (stale/renumbered
+          // topic) it re-sent thread-less into the main chat — the returned
+          // Message then carries no message_thread_id, so we must record the
+          // landed topic (undefined → suspend by bare chatId), NOT the stale
+          // requested `threadId`. Keying suspension on the stale topic would
+          // leave the main-chat card unsuspended (a re-deliver could clobber
+          // the live card) while needlessly suspending a topic that holds
+          // nothing. `sent.message_thread_id` reflects reality in all three
+          // cases: topic success → tid, main-chat / fallback → undefined.
+          const landedThreadId = sent.message_thread_id ?? undefined
+          pend.cards.push({ chatId, messageId: sent.message_id, threadId: landedThreadId })
           permCardStore.add({
             requestId,
             chatId,
@@ -8374,7 +8620,7 @@ if (!STATIC) {
     // promise EXPLICITLY (honest failure) instead of letting it sit
     // forever. This is what makes the guarantee deterministic: every
     // queued message ends either delivered or visibly retracted.
-    inboundSpool?.sweepEscalations((e, { postNotice }) => {
+    inboundSpool?.sweepEscalations((e, { postNotice, droppedCount }) => {
       const chat = e.msg.chatId
       const escThread =
         typeof e.msg.meta?.threadId === 'string' && e.msg.meta.threadId
@@ -8393,13 +8639,17 @@ if (!STATIC) {
       // outage that re-ages a synthetic into the bound every 15 min posts ONE
       // notice, not one per cycle (the 2026-06-09 marko "please resend" spam).
       if (!postNotice) return
+      // #2789 C: report the REAL number of dropped messages for this chat
+      // in this sweep rather than under-counting a multi-message drop as a
+      // single one.
+      const n = droppedCount > 0 ? droppedCount : 1
+      const noticeText =
+        n === 1
+          ? "⚠️ I couldn't deliver an earlier message to the agent after repeated retries (it survived restarts but the agent never picked it up). Please resend it."
+          : `⚠️ I couldn't deliver ${n} earlier messages to the agent after repeated retries (they survived restarts but the agent never picked them up). Please resend them.`
       void swallowingApiCall(
         () =>
-          bot.api.sendMessage(
-            chat,
-            "⚠️ I couldn't deliver an earlier message to the agent after repeated retries (it survived restarts but the agent never picked it up). Please resend it.",
-            { ...threadOpts },
-          ),
+          bot.api.sendMessage(chat, noticeText, { ...threadOpts }),
         { chat_id: chat, verb: 'inbound-spool-escalation' },
       )
     })
@@ -8411,7 +8661,7 @@ if (!STATIC) {
 /** Allowlisted tool names that bridges may invoke via IPC. Prevents a rogue
  *  bridge from calling arbitrary functions by name. */
 const ALLOWED_TOOLS = new Set([
-  'reply', 'stream_reply', 'progress_update', 'react', 'download_attachment',
+  'reply', 'progress_update', 'react', 'download_attachment',
   'edit_message', 'send_typing', 'pin_message', 'delete_message',
   'forward_message', 'get_recent_messages',
   'send_checklist', 'update_checklist',
@@ -8432,8 +8682,6 @@ async function executeToolCall(tool: string, args: Record<string, unknown>): Pro
   switch (tool) {
     case 'reply':
       return executeReply(args)
-    case 'stream_reply':
-      return executeStreamReply(args)
     case 'progress_update':
       return executeProgressUpdate(args)
     case 'react':
@@ -9010,7 +9258,7 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   // delivery-channel decision must NOT pollute final-answer CLASSIFICATION: a
   // final answer the model intended to ping is STILL the final answer even when
   // the framework silences the actual ping. Classify on the model's original
-  // intent (what executeStreamReply already does), so an over-ping-silenced
+  // intent (what executeReply already does), so an over-ping-silenced
   // final answer sets finalAnswerDelivered=true — fixing both a spurious
   // silent-end re-prompt and a false 'undelivered' (😐) terminal reaction.
   const modelDisableNotification = args.disable_notification === true
@@ -10106,441 +10354,6 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   return { content: [{ type: 'text', text: result }] }
 }
 
-async function executeStreamReply(args: Record<string, unknown>): Promise<unknown> {
-  // #1664 — pin the turn at entry; see executeReply for the rationale.
-  const turn = currentTurn
-  if (!args.chat_id) throw new Error('stream_reply: chat_id is required')
-  if (args.text == null || args.text === '') throw new Error('stream_reply: text is required and cannot be empty')
-  // chat_id allowlist fallback — mirrors executeReply (~8725). stream_reply is
-  // the primary final-answer path, so a wrong/late chat_id (int/string mismatch,
-  // or the model echoing the wrong identifier after a silence poke flipped
-  // currentTurn to null) would otherwise fail assertAllowedChat in the stream
-  // controller → an invisible reply. Rewrite args.chat_id in place so every
-  // downstream consumer (origin resolution, dedup key, the send) sees the
-  // corrected value. Tier 1: live turn's sessionChatId. Tier 2: last-known
-  // turn's chat (survives silence poke — Bug D fix; currentTurn is null).
-  {
-    const _rawChatId = String(args.chat_id ?? '')
-    const resolved = resolveChatIdFallback(
-      _rawChatId,
-      loadAccess(),
-      turn?.sessionChatId,
-      lastActiveTurnChatId,
-      turn != null,
-    )
-    if (resolved.tier !== 'raw') {
-      process.stderr.write(
-        `telegram gateway: stream_reply: model passed chat_id "${_rawChatId}" (not allowlisted) — ` +
-          `routing to ${resolved.tier} turn chat "${resolved.chatId}"\n`,
-      )
-      args.chat_id = resolved.chatId
-    }
-  }
-  // Thread precedence (matches executeReply; component 3 — turn-origin
-  // routing): when the model passes no explicit message_thread_id, inject
-  // the ORIGIN turn's thread (matched by origin_turn_id) — authoritative
-  // even after currentTurn flips — falling back to the live turn's thread
-  // when no origin is resolvable (legacy #1664). Injecting into
-  // args.message_thread_id threads every downstream consumer consistently
-  // (dedup key, voice-scrub metric, draft transport, the send), so a
-  // streamed handback/synthetic-turn reply lands in the right supergroup
-  // topic and a late stream-reply can't be stolen by a successor turn. DM:
-  // every tier undefined → unchanged. Kill switch off → legacy live-turn
-  // injection only.
-  // Origin resolution is hoisted UNCONDITIONALLY (outside the
-  // message_thread_id==null guard below) so the obligation-close path has
-  // the correct routedOriginTurn even when the model explicitly passes
-  // message_thread_id (forum-topic streams). Without this hoist, Fix 1
-  // is a no-op for forum-topic streams — the origin is never resolved and
-  // closeObligationOnSubstantiveReply falls through to the live-turn
-  // fallback. Matches executeReply's unconditional resolution. Thread
-  // injection still stays scoped to the message_thread_id==null branch —
-  // only the obligation-close input changes.
-  let streamRoutedOriginTurn: CurrentTurn | null = null
-  // Track whether the origin was found via echo (for the routing log below).
-  let streamOriginVia: 'echo' | 'quoted' | null = null
-  if (TURN_ORIGIN_ROUTING_ENABLED) {
-    // Origin precedence: model echo first, then the framework-owned quoted
-    // message_id as a deterministic fallback (mirrors executeReply).
-    const echoedTurn = findTurnByOriginId(args.origin_turn_id as string | undefined)
-    const quotedTurn =
-      echoedTurn == null ? findTurnByQuotedMessageId(String(args.chat_id), args.reply_to) : null
-    const originTurn = echoedTurn ?? quotedTurn
-    streamRoutedOriginTurn = originTurn ?? null
-    streamOriginVia = originTurn == null ? null : echoedTurn != null ? 'echo' : 'quoted'
-  }
-  if (args.message_thread_id == null) {
-    let injected: number | undefined
-    if (TURN_ORIGIN_ROUTING_ENABLED) {
-      injected = resolveAnswerThreadWithLog(
-        String(args.chat_id),
-        undefined,
-        streamRoutedOriginTurn,
-        streamOriginVia,
-        turn,
-        'stream_reply',
-      )
-    } else {
-      injected = turn?.sessionThreadId
-    }
-    if (injected != null) args.message_thread_id = String(injected)
-  }
-
-  // Outbound secret scrub (#2044): mask before the dedup key, the draft
-  // stream sends, and the history record. stream_reply carries the FULL
-  // text-so-far on every call, so redacting each call keeps the answer-
-  // stream's incremental diffing comparing redacted-against-redacted.
-  args.text = redactOutboundText(args.text as string, 'stream_reply')
-
-  // Voice scrub (PR #1683 follow-up). Modern Claude on the fleet
-  // uses the answer-stream / draft-stream path for multi-paragraph
-  // replies — the model emits via stream_reply and the original
-  // PR #1683 scrub site (executeReply) never sees the text. klanker's
-  // 2026-05-24 log showed model output with em-dashes routed via
-  // stream_reply done=true, materializing as sendMessage with no
-  // scrub. Mirror the executeReply pattern here: scrub BEFORE the
-  // outbound-dedup check (so retries see the scrubbed key) and
-  // mutate args.text so all downstream consumers (the stream-
-  // controller, dedup record, history record) see the scrubbed
-  // version. Kill switch: SWITCHROOM_DISABLE_VOICE_SCRUB.
-  {
-    // Cross-path consistency (#2755): normalizePunctuation runs BEFORE
-    // scrubVoice here, matching the reply/edit paths, so a spaced em-dash
-    // gets the same comma treatment on every outbound path (scrubVoice
-    // would otherwise see the raw dash first on this path only and apply
-    // its period substitution). handleStreamReply's own deps run
-    // normalizePunctuation again downstream — it is idempotent, so the
-    // second pass is a no-op. Side effect: scrubVoice's dash telemetry
-    // (voice_scrub_applied) drops to ~zero on this path since the dashes
-    // are consumed here first — deliberate.
-    args.text = normalizePunctuation(args.text as string)
-    const scrub = scrubVoice(args.text as string)
-    if (scrub.replaced > 0) {
-      args.text = scrub.scrubbed
-      emitRuntimeMetric({
-        kind: 'voice_scrub_applied',
-        chatKey: statusKey(String(args.chat_id ?? ''), args.message_thread_id != null
-          ? Number(args.message_thread_id) : undefined),
-        replaced: scrub.replaced,
-        site: 'stream_reply',
-      })
-    }
-  }
-
-  // #546 dedup check: stream_reply done=true is the most-common
-  // retry shape — claude-code re-emits the final-text call when
-  // the previous bridge missed the ack. If turn-flush already sent
-  // the same content, swallow the retry and return success.
-  // Only check on done=true (the terminal call); intermediate
-  // streaming chunks are progress edits, not full sends.
-  if (args.done === true) {
-    const sChatId = String(args.chat_id ?? '')
-    const sThreadId = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    const sText = args.text as string
-    const dup = outboundDedup.check(sChatId, sThreadId, sText, Date.now(), currentTurn?.registryKey ?? null)
-    if (dup != null) {
-      process.stderr.write(
-        `telegram gateway: stream_reply: deduped (#546) chatId=${sChatId} ` +
-        `ageMs=${dup.ageMs} preview=${JSON.stringify(dup.preview)}\n`,
-      )
-      return { content: [{ type: 'text', text: 'sent (deduped — same content sent via earlier path)' }] }
-    }
-  }
-
-  const access = loadAccess()
-  // Detect chat type for throttle-default selection.
-  // Private (DM) chats have positive numeric IDs; groups/channels are negative.
-  const streamChatId = String(args.chat_id ?? '')
-  const streamIsPrivate = isDmChatId(streamChatId)
-  const streamIsForumTopic = args.message_thread_id != null && args.message_thread_id !== ''
-  // Pre-allocated draft handoff removed in #553 PR 5 — draft-stream
-  // now allocates a fresh draft id on its first send. The pre-alloc
-  // path has been retired along with the placeholder text it was
-  // designed to overwrite cleanly.
-
-  // #271: validate + namespace callback_data for stream_reply. Same
-  // wrapping as executeReply — URL buttons pass through, callback_data
-  // gets the `agent:` prefix so the dispatcher can route taps back to
-  // this agent. Only attached on done=true so buttons land on the
-  // final answer message, not on intermediate draft edits.
-  let streamReplyMarkup: { inline_keyboard: AnyButton[][] } | undefined
-  let streamButtonMeta: Map<string, AgentButtonMeta> | undefined
-  const rawStreamKeyboard = args.inline_keyboard as AnyButton[][] | undefined
-  if (rawStreamKeyboard != null && Boolean(args.done)) {
-    const validationErrors = validateInlineKeyboard(rawStreamKeyboard)
-    if (validationErrors.length > 0) {
-      const summary = validationErrors
-        .map((e) => `${e.path}.${e.field}: ${e.reason}`)
-        .join('; ')
-      throw new Error(`inline_keyboard validation failed: ${summary}`)
-    }
-    streamButtonMeta = extractAgentButtonMeta(rawStreamKeyboard)
-    streamReplyMarkup = { inline_keyboard: wrapAgentCallbacks(rawStreamKeyboard) }
-  }
-
-  // #1122 KPI: stream_reply's FIRST emit is a fresh user-visible outbound
-  // message (subsequent calls edit the same message — no device ping).
-  // Snapshot state BEFORE handleStreamReply to detect first-emit precisely.
-  {
-    const streamThreadId = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    const sKeyBefore = streamKey(streamChatId, streamThreadId)
-    if (!activeDraftStreams.has(sKeyBefore)) {
-      const sKey = statusKey(streamChatId, streamThreadId)
-      signalTracker.noteOutbound(sKey, Date.now())
-      silencePoke.noteOutbound(sKey, Date.now())
-      // PR3b-cutover: feed lastOutboundAt to the delivery machine (see
-      // executeReply) so its TTL tick suppresses an active-turn fallback.
-      shadowEmit({ kind: 'modelOutbound', key: sKey as _ChatKey, at: Date.now() })
-      // #2527: emit turn_reply_timing on the first stream_reply of the turn,
-      // mirroring the same gate in executeReply. Guards with firstTextReplyLogged
-      // so a turn that calls reply first and stream_reply second doesn't double-emit.
-      if (turn != null && !firstTextReplyLogged.has(sKey)) {
-        firstTextReplyLogged.add(sKey)
-        logStreamingEvent({
-          kind: 'turn_reply_timing',
-          chatId: streamChatId,
-          threadId: streamThreadId,
-          turnId: turn.turnId,
-          timeToFirstTextReplyMs: Date.now() - turn.gatewayReceiveAt,
-        })
-      }
-      // #1741 — see executeReply for the rationale: only a plausibly-
-      // final stream_reply clears the silent-end state. An interim
-      // ack via stream_reply must NOT clear; the Stop hook needs
-      // the state to persist if turn_end fails to land.
-      if (
-        isFinalAnswerReply({
-          text: (args.text as string | undefined) ?? '',
-          disableNotification: args.disable_notification === true,
-          done: args.done === true,
-        })
-      ) {
-        clearSilentEndState(sKey)
-      }
-    }
-  }
-
-  // Lever 2 (design §9 lever 2): finalize the activity card BEFORE the stream
-  // send so the card keeps its lower message_id and the reply is structurally
-  // last. ONLY for a *substantive* final (a stream_reply done=true or ≥200
-  // chars) — for a short pinging interim chunk do NOTHING (finalizing an ack
-  // early would close → reopen → emit more, the #2141 ack-then-work feed, R3).
-  // `clearActivitySummary` edits in place + nulls activityMessageId; the sticky
-  // latch set here blocks any post-reply re-OPEN below the answer.
-  if (
-    turn != null
-    && isSubstantiveFinalReply({
-      text: (args.text as string | undefined) ?? '',
-      disableNotification: args.disable_notification === true,
-      done: args.done === true,
-    })
-  ) {
-    // PR-4a: routed through the emission-authority façade (no-op delegates —
-    // the latch-set and the finalize run exactly as before).
-    const ea = emissionAuthorityFor(turn)
-    ea.markSubstantiveFinalDelivered(() => {
-      turn.finalAnswerEverDelivered = true
-      if (turn.finalAnswerDeliveredAt == null) turn.finalAnswerDeliveredAt = Date.now()
-    })
-    ea.finalizeCard(() => {
-      clearActivitySummary(turn)
-    })
-  }
-
-  const result = await handleStreamReply(
-    {
-      chat_id: streamChatId,
-      text: args.text as string,
-      done: Boolean(args.done),
-      message_thread_id: args.message_thread_id as string | undefined,
-      format: args.format as string | undefined,
-      reply_to: args.reply_to as string | undefined,
-      quote: args.quote as boolean | undefined,
-      ...(args.protect_content === true ? { protect_content: true } : {}),
-      ...(args.quote_text != null ? { quote_text: args.quote_text as string } : {}),
-      ...(streamReplyMarkup != null ? { reply_markup: streamReplyMarkup } : {}),
-      ...(args.disable_notification === true ? { disable_notification: true } : {}),
-    },
-    { activeDraftStreams, suppressPtyPreview },
-    {
-      // grammy's Bot<Context, Api<RawApi>> has a wider api shape than the
-      // local StreamBotApi interface, but is structurally compatible at
-      // runtime (StreamBotApi is a subset). Cast through unknown to
-      // bypass the structural-typing strictness.
-      bot: lockedBot as unknown as { api: import('../stream-controller.js').StreamBotApi },
-      retry: robustApiCall,
-      repairEscapedWhitespace,
-      normalizeParagraphBreaks,
-      normalizePunctuation,
-      stripExcessBold,
-      addParagraphSpacers,
-      assertAllowedChat,
-      resolveThreadId,
-      disableLinkPreview: access.disableLinkPreview !== false,
-      defaultFormat: access.parseMode ?? 'html',
-      logStreamingEvent,
-      isPrivateChat: streamIsPrivate,
-      isForumTopic: streamIsForumTopic,
-      // Issue #310: deliver the outbound count bump BEFORE forceCompleteTurn
-      // so the terminal render sees outboundDeliveredCount > 0. The handler
-      // calls this dep in that order internally.
-      recordOutboundDelivered: (chatId, threadId) => {
-        progressDriver?.recordOutboundDelivered(
-          chatId,
-          threadId != null ? String(threadId) : undefined,
-        )
-      },
-      forceCompleteTurn: (chatId, threadId) => {
-        progressDriver?.forceCompleteTurn({
-          chatId,
-          threadId: threadId != null ? String(threadId) : undefined,
-        })
-      },
-      historyEnabled: HISTORY_ENABLED,
-      recordOutbound,
-      ...(HISTORY_ENABLED ? { getLatestInboundMessageId } : {}),
-      writeError: (line) => process.stderr.write(line),
-      // When the operator sets `channels.telegram.stream_throttle_ms` in yaml,
-      // the env override wins; otherwise draft-stream's DM/group defaults apply
-      // (400 ms for DMs, 1000 ms for groups). `throttleMs: undefined` passes
-      // through to draft-stream where the per-chat-type default applies.
-      ...(STREAM_THROTTLE_MS_OVERRIDE != null ? { throttleMs: STREAM_THROTTLE_MS_OVERRIDE } : {}),
-      progressCardActive: streamMode === 'checklist',
-    },
-  )
-  // Issue #137: bump the per-turn outbound counter on every successful
-  // stream_reply call (partial OR final). Even a single chunk landing
-  // proves the delivery path worked. messageId may be null when the
-  // call only updated the streaming draft and didn't sendMessage on
-  // this invocation — that case still counts as activity.
-  if (result.messageId != null) {
-    try {
-      progressDriver?.recordOutboundDelivered(
-        String(args.chat_id ?? ''),
-        args.message_thread_id as string | undefined,
-      )
-    } catch { /* best-effort signal */ }
-    // Issue #203: stream_reply is the agent's primary reply path. Without
-    // ticking the silent-gap tracker here, turn_signal_gap reports the
-    // entire turn duration as silent for any turn that uses stream_reply
-    // — which per CLAUDE.md guidance is most of them. The metric would be
-    // worse than no metric. Tick on every successful delivery (partial or
-    // final) so the gap measurement reflects real silent intervals.
-    try {
-      const threadIdNum = args.message_thread_id != null
-        ? Number(args.message_thread_id)
-        : undefined
-      signalTracker.noteSignal(
-        statusKey(String(args.chat_id ?? ''), threadIdNum),
-        Date.now(),
-      )
-    } catch { /* best-effort signal */ }
-  }
-  // #710: stash agent-button meta keyed by the final message id so the
-  // callback handler can honor ack_text / single_use on tap.
-  if (
-    args.done === true
-    && result.messageId != null
-    && streamButtonMeta != null
-    && streamButtonMeta.size > 0
-  ) {
-    rememberAgentButtonMeta(String(args.chat_id ?? ''), result.messageId, streamButtonMeta)
-  }
-  // #546 dedup record: capture the final stream_reply text on the
-  // terminal call so a subsequent retry (different bridge, same
-  // content) lands as a no-op instead of a second message.
-  if (args.done === true && result.messageId != null) {
-    const sChatId = String(args.chat_id ?? '')
-    const sThreadId = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    outboundDedup.record(sChatId, sThreadId, args.text as string, Date.now(), currentTurn?.registryKey ?? null)
-    // #1445 cross-turn pending-async ambient. The terminal stream_reply
-    // (done=true) is the user-visible anchor for any cross-turn wait
-    // that follows. Capture it so if this turn ends with a pending
-    // async dispatch, the framework edits THIS message in place at
-    // intervals.
-    //
-    // #2669 — capture whether the stream-reply-handler sent literally
-    // (format:'text') so the cross-turn edit tick re-edits with the same
-    // shape. The default rich-markdown path re-edits via the rich path.
-    const streamFormat = (args.format as string | undefined) ?? (access.parseMode ?? 'html')
-    const streamLiteralText = streamFormat === 'text'
-    // #1760 primary fix — clear any stale prior-turn ticker before
-    // re-anchoring on stream_reply done. See the matching comment at
-    // the executeReply finalize site.
-    pendingProgress.clearPending(statusKey(sChatId, sThreadId), 'reply_finalize')
-    pendingProgress.noteOutbound(statusKey(sChatId, sThreadId), {
-      messageId: result.messageId,
-      text: args.text as string,
-      literalText: streamLiteralText,
-    })
-  }
-  // #1664 — mark the turn's final answer as delivered. For stream_reply a
-  // call with done=true IS the final answer by definition (the model
-  // explicitly closed the stream). A non-terminal stream_reply chunk also
-  // counts when it carries the final-answer signals — notification-bearing
-  // OR substantive length — via the same `isFinalAnswerReply` predicate
-  // executeReply uses. See the CurrentTurn.finalAnswerDelivered doc-comment
-  // for why replyCalled is not a sufficient signal here.
-  if (
-    turn != null &&
-    isFinalAnswerReply({
-      text: (args.text as string | undefined) ?? '',
-      disableNotification: args.disable_notification === true,
-      done: args.done === true,
-    })
-  ) {
-    turn.finalAnswerDelivered = true
-    // Feed-reopen refinement: a stream_reply done=true (or a ≥200-char
-    // chunk) is substantive; a short pinging non-done chunk is an ack. Only
-    // the latter should re-open the feed on subsequent post-answer work.
-    turn.finalAnswerSubstantive = isSubstantiveFinalReply({
-      text: (args.text as string | undefined) ?? '',
-      disableNotification: args.disable_notification === true,
-      done: args.done === true,
-    })
-    // Sticky ordering latch (lever 1): set once a SUBSTANTIVE final lands;
-    // never cleared by reopen. The card OPEN gate keys on this sticky latch.
-    if (turn.finalAnswerSubstantive) turn.finalAnswerEverDelivered = true
-    if (turn.finalAnswerSubstantive && turn.finalAnswerDeliveredAt == null) turn.finalAnswerDeliveredAt = Date.now()
-    if (turn.finalAnswerSubstantive) closeObligationOnSubstantiveReply(args, turn, streamRoutedOriginTurn)
-    // #1744 follow-up — stream_reply edge case. The first-emit gate at
-    // L5178 only clears silent-end state on the FIRST emit of a stream.
-    // If a stream's first emit was ack-shaped (disable_notification:true,
-    // short text, no done) it correctly did NOT clear the state. But a
-    // LATER emit in the same stream may flip `done=true` or carry
-    // substantive text — that's the real final answer landing, and the
-    // state file must be cleared here too. clearSilentEndState is
-    // idempotent (no-op when the file is absent or the turnKey doesn't
-    // match), so calling it unconditionally on every final-answer-shaped
-    // emit is safe even if the first-emit path already cleared.
-    const streamThreadIdForClear = args.message_thread_id != null
-      ? Number(args.message_thread_id)
-      : undefined
-    clearSilentEndState(statusKey(streamChatId, streamThreadIdForClear))
-  }
-  // v0.13.30 follow-up — release the buffer gate on every successful
-  // stream_reply too. Same rationale as executeReply: short replies
-  // with `disable_notification: true` would otherwise wedge the gate
-  // forever. `result.status` is always 'updated' | 'finalized'
-  // (stream-reply-handler.ts:305) at this point — earlier failures
-  // throw or return before reaching here.
-  {
-    const sChat = String(args.chat_id ?? '')
-    const sThread = resolveThreadId(sChat, args.message_thread_id as string | undefined)
-    // Component 1: pass the turn (finalAnswerDelivered set above for a
-    // final stream emit). Interim stream chunks leave it false → no
-    // cross-topic drain until the done=true / substantive emit lands.
-    releaseTurnBufferGate(statusKey(sChat, sThread), turn ?? undefined)
-    // Component 5: reap the queued-status placeholder for THIS turn's
-    // topic once the final answer landed. Key on the turn's own session
-    // thread (where the placeholder lives), not the answer's resolved one.
-    if (turn?.finalAnswerDelivered === true) {
-      reapQueuedStatus(turn.sessionChatId, turn.sessionThreadId)
-    }
-  }
-  return { content: [{ type: 'text', text: `${result.status} (id: ${result.messageId ?? 'pending'})` }] }
-}
-
 async function executeProgressUpdate(args: Record<string, unknown>): Promise<unknown> {
   if (!args.chat_id) throw new Error('progress_update: chat_id is required')
   if (!args.text) throw new Error('progress_update: text is required')
@@ -10552,6 +10365,14 @@ async function executeProgressUpdate(args: Record<string, unknown>): Promise<unk
 
   assertAllowedChat(chat_id)
 
+  // Outbound secret scrub (#2044). progress_update was the ONLY send site not
+  // calling redactOutboundText, so a secret the agent echoed into a progress
+  // line reached Telegram unmasked (reply/stream_reply/edit_message/turn_flush
+  // all redact). Mask BEFORE the 300-char truncation below: a secret straddling
+  // the 300-char cut would otherwise be sliced apart and evade the detector, so
+  // redaction has to run on the full untruncated text first.
+  text = redactOutboundText(text, 'progress_update')
+
   // Truncate to 300 chars
   if (text.length > 300) {
     text = text.slice(0, 299) + '…'
@@ -10592,44 +10413,14 @@ async function executeProgressUpdate(args: Record<string, unknown>): Promise<unk
     progressUpdateTurnCount.set(key, currentCount + 1)
   }
 
-  // Issue #305 Option A — try the card-injection path first.
-  // If the call originates from a sub-agent and the parent has an active
-  // pinned card, narrative lands as the sub-agent's row body. Falls through
-  // to the message-send path on miss (parent-agent calls, no active card,
-  // race with watcher backfill, etc).
-  const agentIdHint = (typeof args.agent_id === 'string' && args.agent_id) || null
-  const toolUseIdHint = (typeof args.tool_use_id === 'string' && args.tool_use_id) || null
-  const subAgent = resolveCallingSubagent({
-    db: turnsDb,
-    chatId: chat_id,
-    threadId,
-    agentIdHint,
-    toolUseIdHint,
-  })
-  if (subAgent != null && progressDriver != null) {
-    const cardText = text.length > 200 ? text.slice(0, 199) + '…' : text
-    const result = progressDriver.recordSubAgentNarrative({
-      chatId: chat_id,
-      threadId: threadId != null ? String(threadId) : undefined,
-      agentId: subAgent.agentId,
-      text: cardText,
-    })
-    if (result.ok) {
-      progressUpdateLastSent.set(key, now)
-      try {
-        signalTracker.noteSignal(key, Date.now())
-      } catch { /* best-effort signal */ }
-      return {
-        content: [
-          {
-            type: 'text',
-            text: JSON.stringify({ ok: true, mode: 'card', agent_id: subAgent.agentId }),
-          },
-        ],
-      }
-    }
-    // Otherwise fall through to message-send below.
-  }
+  // Issue #305 Option A — the card-injection path (route a sub-agent's
+  // `progress_update` narrative into its row on the parent's pinned card)
+  // was retired with the progress card in #1122/#1126: `progressDriver` is
+  // permanently null, so `recordSubAgentNarrative` could never fire and the
+  // whole `resolveCallingSubagent` → card-inject block was a dead no-op that
+  // always fell through here. Removed. Sub-agent progress now surfaces via
+  // the `🛠 Worker` activity feed + the model's own in-voice handback, and a
+  // `progress_update` call always takes the plain message-send path below.
 
   // Send plain message (no quote-reply). Single rich-markdown path (#2669):
   // `parseMode:'text'` config opts into a literal plain send; everything
@@ -11798,7 +11589,11 @@ function resetOrphanedReplyTimeout(): void {
     currentSessionChatId: turn.sessionChatId,
     capturedTextCount: turn.capturedText.length,
     replyCalled: turn.replyCalled,
-    progressCardActive: progressDriver != null,
+    // #1122/#1126: the pinned card is retired and `progressDriver` is
+    // permanently null, so this suppression signal is always false. Kept as a
+    // literal (the shouldArm* predicate still accepts the flag) rather than
+    // reading the dead driver.
+    progressCardActive: false,
   })) {
     turn.orphanedReplyTimeoutId = setTimeout(() => {
       // The timer fires asynchronously; re-read currentTurn so we
@@ -11812,7 +11607,8 @@ function resetOrphanedReplyTimeout(): void {
         currentSessionChatId: t.sessionChatId,
         capturedTextCount: t.capturedText.length,
         replyCalled: t.replyCalled,
-        progressCardActive: progressDriver != null,
+        // #1122/#1126: retired card / null driver — always false (see above).
+        progressCardActive: false,
       })) {
         // Feed-survival guard: re-arm the fuse while the turn is
         // legitimately working — an in-flight tool, a detached background
@@ -12192,7 +11988,10 @@ function openLivenessFeedIfDue(turn: CurrentTurn): void {
   const livenessHeader: SessionActivityHeader = {
     label: 'Agent', elapsedMs: age, toolCount: turn.labeledToolCount, state: 'running',
   }
-  const rendered = renderActivityFeedWithNested(lines, [], false, ` · ${formatFeedElapsed(age)}`, undefined, livenessHeader)
+  // Liveness card is a single "step" whose start is the turn start, so `age`
+  // IS the step's own elapsed. formatStepSuffix keeps the `→` line timer-free
+  // until the step has run ≥ STEP_TIMER_MIN_MS (header total still shows).
+  const rendered = renderActivityFeedWithNested(lines, [], false, formatStepSuffix(age), undefined, livenessHeader)
   if (rendered == null) return
   turn.activityPendingRender = rendered
   const ea = emissionAuthorityFor(turn)
@@ -12312,8 +12111,10 @@ function feedHeartbeatTick(): void {
       label: 'Agent', elapsedMs: age, toolCount: turn.labeledToolCount, state: 'running',
     }
     const lines = turn.mirrorLines.length > 0 ? turn.mirrorLines : ['Working in background…']
+    // `subagentAt` is the worker's last ADVANCE — the current step's start —
+    // so this suffix is already per-step. formatStepSuffix adds the 10 s gate.
     const elapsed = Date.now() - subagentAt
-    const rendered = renderActivityFeedWithNested(lines, [], false, ` · ${formatFeedElapsed(elapsed)}`, undefined, livenessHeader)
+    const rendered = renderActivityFeedWithNested(lines, [], false, formatStepSuffix(elapsed), undefined, livenessHeader)
     if (rendered == null) return
     turn.activityPendingRender = rendered
     const ea = emissionAuthorityFor(turn)
@@ -12354,7 +12155,10 @@ function feedHeartbeatTick(): void {
   if (turn.lastToolLabelAt == null) return // feed not driven by a labelled step
   const elapsed = Date.now() - turn.lastToolLabelAt
   if (elapsed < FEED_HEARTBEAT_MIN_STALE_MS) return // step is fresh; feed advancing normally
-  const rendered = composeTurnActivity(turn, false, ` · ${formatFeedElapsed(elapsed)}`)
+  // `lastToolLabelAt` resets on every new tool label, so `elapsed` is the
+  // CURRENT step's own run time. formatStepSuffix holds the timer back until
+  // the step passes STEP_TIMER_MIN_MS (10 s) — header total is unaffected.
+  const rendered = composeTurnActivity(turn, false, formatStepSuffix(elapsed))
   if (rendered == null) return
   turn.activityPendingRender = rendered
   const ea = emissionAuthorityFor(turn)
@@ -12614,6 +12418,13 @@ function handleSessionEvent(ev: SessionEvent): void {
             deliveryQueue,
             chatKey(ev.chatId, ev.threadId != null ? Number(ev.threadId) : null),
             ev.messageId,
+            // #2786 — pass the raw enqueue envelope so the ack survives the
+            // composer merging/reordering inbound wrappers (the single
+            // re-parsed `ev.messageId` can then belong to a sibling, not our
+            // tracked message). The tolerant match scans all ids in this
+            // content; a synthetic-source turn still lacks the user id, so the
+            // cross-source false-ack guard holds.
+            ev.rawContent,
           )
         }
         // PR3b-cutover: feed the authoritative turn-start to the delivery
@@ -13562,6 +13373,18 @@ function handleSessionEvent(ev: SessionEvent): void {
 
       if (flushDecision.kind === 'flush') {
         let capturedText = flushDecision.text
+        // #2798 — turn-flush delivers the model's terminal prose when it
+        // skipped reply/stream_reply, but historically bypassed the reply
+        // path's markdown normalization entirely. Mirror executeReply's front
+        // of pipeline here so the backstop renders identically: repair LLM
+        // JSON-escape bungles (literal `\n`), then promote lone prose paragraph
+        // breaks into GFM hard breaks so the Bot API 10.1 rich path doesn't
+        // collapse them (lists/tables/code left untouched). Runs BEFORE the
+        // redact/scrub below, exactly as reply orders it (repair → normalize →
+        // redact → scrub), so masking sees the repaired text. The matching
+        // addParagraphSpacers pass runs on the send side just before
+        // splitMarkdownChunks (see below).
+        capturedText = normalizeParagraphBreaks(repairEscapedWhitespace(capturedText))
         // Component 3 — origin-thread backstop. `chatId`/`threadId` are
         // captured from the turn atom (turn.sessionChatId/sessionThreadId)
         // at the top of this turn_end handler, NOT from the live
@@ -13581,6 +13404,15 @@ function handleSessionEvent(ev: SessionEvent): void {
         // the preview, and recordOutbound.
         capturedText = redactOutboundText(capturedText, 'turn_flush')
 
+        // #2798 reply-parity — normalize dashes/bullets and trip the over-bold
+        // guard deterministically, on code-masked text. This is the SAME chain
+        // the reply path applies (`stripExcessBold(normalizePunctuation(text))`)
+        // in the SAME order: after redact, before scrubVoice. Without it the
+        // turn-flush backstop rendered punctuation/bold differently from an
+        // identical reply. Kept inline to mirror reply exactly — a shared helper
+        // is a deliberate future refactor, not this change.
+        capturedText = stripExcessBold(normalizePunctuation(capturedText))
+
         // Voice scrub (PR #1683 follow-up). Turn-flush is the path
         // that fires when the model emits raw transcript text WITHOUT
         // calling reply / stream_reply. That captured text bypasses
@@ -13692,7 +13524,14 @@ function handleSessionEvent(ev: SessionEvent): void {
             link_preview_options: { is_disabled: true },
           }
           const limit = RICH_MESSAGE_MAX_CHARS
-          const htmlChunks = splitMarkdownChunks(capturedText, limit)
+          // #2798 / #2692 — inject visible blank-line spacers into prose `\n\n`
+          // gaps before splitting, exactly as executeReply does. The rich GFM
+          // renderer collapses a bare `\n\n` gap TIGHT, so without this the
+          // paragraph boundaries from the '\n\n' block join (turn-flush-safety
+          // .ts) would still render jammed together. Mirrors reply's
+          // `addParagraphSpacers(text)` on the non-literal path.
+          const renderedText = addParagraphSpacers(capturedText)
+          const htmlChunks = splitMarkdownChunks(renderedText, limit)
           const sentIds: number[] = []
           try {
             // #654 deterministic double-message fix. If the progress
@@ -13969,12 +13808,13 @@ function handleSessionEvent(ev: SessionEvent): void {
       }
       // #550: symmetric cleanup with the writeTurnActiveMarker call at
       // the enqueue arm (line ~2810). Pre-fix, removal was single-pathed
-      // through progressDriver.onTurnComplete, which silently no-ops
-      // when forceCompleteTurn finds no active card — leaking the
-      // marker across restarts and triggering watchdog false-positive
-      // restarts. The onTurnComplete callback is retained as defence-
-      // in-depth (both paths are idempotent — unlinkSync swallows
-      // ENOENT).
+      // through the (now-retired, #1122/#1126) progressDriver.onTurnComplete
+      // callback, which silently no-op'd when forceCompleteTurn found no
+      // active card — leaking the marker across restarts and triggering
+      // watchdog false-positive restarts. That driver callback no longer
+      // exists (progressDriver is permanently null); this explicit
+      // removeTurnActiveMarker is now the sole cleanup path (idempotent —
+      // unlinkSync swallows ENOENT).
       removeTurnActiveMarker(STATE_DIR)
       // #1067: null the atom in one assignment, replacing the seven
       // field clears the pre-refactor version did. Any late-arriving
@@ -14651,36 +14491,56 @@ async function handleInbound(
   }
 
   // Issue #109: when the user has to ask "status?" mid-turn, the live progress
-  // surface (pinned card + status reactions) has failed its job. Log the
-  // event with a snapshot of the card state so we can count + analyze
-  // frequency. We don't intercept the message — it still flows through to
-  // the agent, since the agent may have a useful answer the card hasn't
-  // surfaced yet.
+  // surface (status reactions + the edit-in-place `🛠 Worker` feed) may have
+  // failed its job. Log the event with a snapshot of what is ACTUALLY in
+  // flight so we can count + analyze frequency. We don't intercept the
+  // message — it still flows through to the agent, since the agent may have a
+  // useful answer the surfaces haven't communicated yet.
+  //
+  // Truthful telemetry (was a lying diagnostic): the pinned progress card was
+  // retired in #1122/#1126 and `progressDriver` is now permanently null, so
+  // the old `progressDriver.peek(...)` snapshot ALWAYS reported idle/zero
+  // regardless of live work — actively misleading debugging. We now read the
+  // LIVE surfaces instead: the running-background-worker DB count
+  // (`countRunningWorkers`), the `🛠 Worker` activity-feed size, the
+  // cross-turn pending-async-dispatch flag (`pending-work-progress.ts`), and
+  // whether a turn is active (`activeTurnStartedAt`). A live background worker
+  // ⇒ non-idle. A `ux-failure` is emitted ONLY when all of those are genuinely
+  // zero AND no turn is active — i.e. the user asked "status?" and there really
+  // was nothing in flight for the surfaces to have shown.
   //
-  // Log shape (grep anchor: "ux-failure: status-query"):
-  //   ux-failure: status-query agent=<n> chat_id=<n> thread=<n|none>
-  //                            card_stage=<stage> card_turn_age_s=<int>
-  //                            card_items=<n> card_subagents=<n>
+  // Log shape (grep anchor: "status-query"):
+  //   status-query agent=<n> chat_id=<n> thread=<n|none> stage=<stage>
+  //                turn_age_s=<int> running_workers=<n> worker_feed=<n>
+  //                pending_async=<0|1>
+  // When idle, a second line carries the grep anchor "ux-failure: status-query".
   //
-  // `card_turn_age_s` is always a non-negative integer; `-1` is the
-  // sentinel for "no active turn / driver idle" so structured-log parsers
-  // (Loki, Datadog, awk) can treat the field as numeric without
-  // string-comparison branches.
+  // `turn_age_s` is always a non-negative integer; `-1` is the sentinel for
+  // "no active turn" so structured-log parsers (Loki, Datadog, awk) can treat
+  // the field as numeric without string-comparison branches.
   if (STATUS_QUERY_RE.test(text)) {
     try {
-      const threadKey = messageThreadId != null ? String(messageThreadId) : undefined
-      const cardState = progressDriver?.peek(chat_id, threadKey)
-      const turnAgeS = cardState?.turnStartedAt
-        ? Math.max(0, Math.floor((Date.now() - cardState.turnStartedAt) / 1000))
-        : -1
-      const stage = cardState?.stage ?? 'idle'
-      const itemCount = cardState?.items.length ?? 0
-      const subAgentCount = cardState?.subAgents.size ?? 0
+      const thread = messageThreadId != null ? String(messageThreadId) : 'none'
+      const key = statusKey(chat_id, messageThreadId)
+      const turnStartedAt = activeTurnStartedAt.get(key)
+      const turnActive = turnStartedAt != null
+      const surfaces: StatusQuerySurfaces = {
+        turnActive,
+        turnAgeS: turnActive
+          ? Math.max(0, Math.floor((Date.now() - turnStartedAt) / 1000))
+          : -1,
+        runningWorkers: countRunningWorkers(),
+        workerFeedSize: workerActivityFeed?.size ?? 0,
+        pendingAsync: pendingProgress.hasPendingAsyncDispatch(key) ? 1 : 0,
+      }
+      const telemetry = deriveStatusQueryTelemetry(surfaces)
       const agentName = process.env.SWITCHROOM_AGENT_NAME ?? '-'
       process.stderr.write(
-        `telegram gateway: ux-failure: status-query agent=${agentName} chat_id=${chat_id} thread=${threadKey ?? 'none'} ` +
-        `card_stage=${stage} card_turn_age_s=${turnAgeS} card_items=${itemCount} card_subagents=${subAgentCount}\n`,
+        formatStatusQueryLine(agentName, String(chat_id), thread, surfaces, telemetry),
       )
+      if (telemetry.idle) {
+        process.stderr.write(formatStatusQueryUxFailureLine(agentName, String(chat_id), thread))
+      }
     } catch (err) {
       process.stderr.write(`telegram gateway: status-query telemetry failed: ${(err as Error).message}\n`)
     }
@@ -18294,6 +18154,17 @@ async function refreshPinnedBanner(reason: string): Promise<void> {
       onError: (phase, err) => {
         process.stderr.write(`telegram gateway: banner ${phase} failed (${reason}): ${err}\n`)
       },
+      // Durable pin persistence into the SHARED status-pin store (distinct
+      // `banner:` pinKey). persist-BEFORE-pin ordering: pending() lands before
+      // the pinChatMessage call so a crash in that window is recoverable by the
+      // one runStatusPinBootCleanup on next boot. Best-effort / gated no-op.
+      persist: {
+        pending: (chatId, messageId) =>
+          persistBannerRow({ pinKey: BANNER_PIN_KEY, chatId, messageId, pending: true }),
+        confirm: (chatId, messageId) =>
+          persistBannerRow({ pinKey: BANNER_PIN_KEY, chatId, messageId }),
+        clear: () => persistBannerRow(null),
+      },
     })
   } catch (err) {
     process.stderr.write(`telegram gateway: banner refresh error (${reason}): ${err}\n`)
@@ -24679,10 +24550,22 @@ process.on('SIGINT', () => void shutdown('SIGINT'))
 // pacing + the silence-poke safety net. The module-level helper vars
 // (`unpinProgressCardForChat`, `getPinnedProgressCardMessageId`,
 // `completeProgressCardTurn`, `flushProgressCardsForShutdown`,
-// `progressDriver`) stay declared and `null`, so the dozens of
+// `progressDriver`) stay declared and `null`, so the remaining
 // optional-chained call sites scattered through this file remain
-// valid TypeScript and no-op at runtime. Those dead sites are
-// scheduled for a follow-up cleanup PR.
+// valid TypeScript and no-op at runtime.
+//
+// Cleanup pass (truthful-telemetry PR): the actively-misleading dead sites
+// have been purged — the `status-query` telemetry now reads the live surfaces
+// instead of the null-driver `peek()`; the sub-agent `onStall`/`onUnstall`/
+// `onStallTerminal` gateway wirings (which falsely implied a stall renders a
+// visual badge) are removed; the dead sub-agent card-injection block in
+// `progress_update` is gone; and `progressCardActive` reads the literal false
+// instead of `progressDriver != null`. The remaining `progressDriver?.X` /
+// `unpinProgressCardForChat?.(...)` / `completeProgressCardTurn?.(...)` sites
+// are interface-bound no-ops (deps handed to stream-reply-handler /
+// disconnect-flush, or constant-folding guards inside the turn-flush backstop
+// hot path); removing them means changing those modules' public shapes and is
+// deferred so this PR stays scoped to truthful telemetry + comment fixes.
 
 
 // ─── Startup ──────────────────────────────────────────────────────────────
@@ -25402,55 +25285,21 @@ void (async () => {
               // the model's own beat-4 handback reply; the watcher's
               // role here is registry liveness + the `onFinish` cue.
               log: (msg) => process.stderr.write(`telegram gateway: ${msg}\n`),
-              // Option C (#393): route stall detections into the progress-card
-              // driver so the pinned card re-renders with a ⚠️ indicator even
-              // when the bridge has disconnected and events have stopped flowing.
-              onStall: (agentId, idleMs, description) => {
-                progressDriver?.onSubAgentStall(agentId, idleMs, description)
-              },
-              // Symmetric to onStall: clear the ⚠ Stalled badge as soon
-              // as the watcher sees JSONL activity return, instead of
-              // waiting on the next render tick to recompute idle ms.
-              onUnstall: (agentId, description) => {
-                progressDriver?.onSubAgentUnstall?.(agentId, description)
-              },
-              // RFC §Bug 6: background `Agent` dispatches in some
-              // Claude Code versions don't write a terminal
-              // `system + turn_duration` line to the sub-agent JSONL.
-              // The watcher detects the silent-stall window and
-              // synthesises terminal here; we mirror it into the
-              // progress driver as a real `sub_agent_turn_end`
-              // SessionEvent so the deferred-completion gate
-              // releases and the pinned card flips from 🌀 to ✅.
+              // #1122/#1126 cleanup: the `onStall` / `onUnstall` /
+              // `onStallTerminal` callbacks used to route into
+              // `progressDriver.onSubAgentStall` / `onSubAgentUnstall` /
+              // `ingest(sub_agent_turn_end)` so the pinned card could render a
+              // ⚠️ badge and release its deferred-completion gate. That card
+              // was deleted and `progressDriver` is permanently null, so those
+              // wirings were dead no-ops that falsely implied a stall renders a
+              // visual badge (it doesn't). They are removed here.
               //
-              // Find the parent turnKey + chatId by peeking the
-              // driver's fleet (same idiom onFinish uses just below).
-              onStallTerminal: (agentId) => {
-                try {
-                  const fleets = progressDriver?.peekAllFleets() ?? []
-                  for (const f of fleets) {
-                    if (f.fleet.has(agentId)) {
-                      progressDriver?.ingest(
-                        { kind: 'sub_agent_turn_end', agentId },
-                        f.chatId ?? null,
-                        undefined,
-                      )
-                      return
-                    }
-                  }
-                  // No fleet entry — the driver-side state was lost
-                  // (cs.dispose ran or peek timing missed). Drop a
-                  // log line and fall through to onFinish's audit
-                  // surface; the card may already be cleaned up.
-                  process.stderr.write(
-                    `telegram gateway: subagent-watcher: onStallTerminal ${agentId} — no fleet entry to retarget; synthetic sub_agent_turn_end skipped\n`,
-                  )
-                } catch (err) {
-                  process.stderr.write(
-                    `telegram gateway: subagent-watcher: onStallTerminal ${agentId} ingest error: ${(err as Error).message}\n`,
-                  )
-                }
-              },
+              // The load-bearing completion path is NOT here: subagent-watcher's
+              // silent-stall terminal synthesis writes the terminal registry-DB
+              // row itself (`recordSubagentEnd`) and fires `maybySendStateTransition`
+              // → `onFinish` (the handback) independently of `onStallTerminal`.
+              // Re-painting a live background worker on stall/unstall is PR 2's
+              // job (via the `🛠 Worker` activity feed, not a retired card).
               // conversational-pacing beat 4 — the handback. A foreground
               // sub-agent hands its result straight back as the Task tool
               // result, inside the parent's own turn; the model sees it
@@ -25504,6 +25353,27 @@ void (async () => {
                   } catch { /* best-effort */ }
                 }
                 const isBackground = dispatch.isBackground
+                // NESTED (depth-2+) worker terminal: its live status surfaced
+                // via the worker feed (see onProgress), so finalize that card
+                // cleanly — never leave it frozen mid-"→ step". But NO user
+                // handback: its result returns to its DISPATCHING WORKER as
+                // the Task tool result (the depth-1 worker folds it into its
+                // own handback); injecting a second gateway handback would
+                // double-report the same work.
+                if (dispatch.isNested) {
+                  if (workerFeedEnabled) {
+                    void workerActivityFeed?.finish(agentId, {
+                      description: dispatch.feedDescription,
+                      lastTool: null,
+                      toolCount,
+                      latestSummary: resultText,
+                      elapsedMs: durationMs,
+                      state: outcome === 'failed' ? 'failed' : 'done',
+                    })
+                    reconcileWorkerPin(agentId, null, false)
+                  }
+                  return
+                }
                 if (!isBackground) {
                   // Model A — a foreground sub-agent finished. Collapse its
                   // nested child block from the parent's activity draft; the
@@ -25703,7 +25573,18 @@ void (async () => {
                     dispatch = resolveWorkerFeedDispatch(getSubagentByJsonlId(turnsDb, agentId), description)
                   } catch { /* best-effort */ }
                 }
-                const isBackground = dispatch.isBackground
+                // A NESTED (depth-2+) worker surfaces via the worker feed
+                // regardless of its own background flag: its "parent" is a
+                // worker, not the gateway's live turn, so nesting it into
+                // `currentTurn` would attribute it to an unrelated turn.
+                const isBackground = dispatch.isBackground || dispatch.isNested
+                // The live step line for THIS tick: the friendly tool label on
+                // tool ticks, else the narrative. Previously the worker feed
+                // was fed ONLY `latestSummary` (prose), so a tools-only worker
+                // — the common case — had a card that heartbeat-edited but
+                // never grew past "starting…" (the frozen-card symptom). The
+                // foreground nest path below already used this precedence.
+                const stepLine = (progressLine != null && progressLine.length > 0) ? progressLine : latestSummary
                 if (!isBackground) {
                   // Model A — a foreground sub-agent runs inside the parent's
                   // turn, so its live narrative nests under the parent's
@@ -25719,7 +25600,14 @@ void (async () => {
                   // the worker feed (owner-DM fallback), not into the void.
                   const surface = resolveSubagentStatusSurface({
                     isBackground: false,
-                    liveTurnPresent: currentTurn != null,
+                    // A ROW-LESS worker must not nest into the live turn: with
+                    // no registry row we cannot know it belongs to this turn
+                    // (it is most often a nested dispatch whose row hasn't
+                    // linked yet), and polluting the parent's card misroutes
+                    // it. Route it via the orphan worker-feed path instead —
+                    // once the row links (watcher retry, ≤ a poll tick) the
+                    // classification self-corrects.
+                    liveTurnPresent: currentTurn != null && dispatch.hasRow,
                     workerFeedEnabled,
                     orphanStatusEnabled,
                   })
@@ -25733,7 +25621,7 @@ void (async () => {
                         description: dispatch.feedDescription,
                         lastTool,
                         toolCount,
-                        latestSummary,
+                        latestSummary: stepLine,
                         elapsedMs,
                         state: 'running',
                       },
@@ -25774,9 +25662,12 @@ void (async () => {
                     narrative = []
                     turn.foregroundSubAgents.set(agentId, narrative)
                   }
-                  // Dedup against the immediately-preceding line — the watcher
-                  // re-emits the same narrative across ticks while a tool runs.
-                  if (narrative[narrative.length - 1] !== child) {
+                  // Dedup within the whole rolling window (mirrors the worker
+                  // feed's accumulateNarrative): the watcher re-emits the same
+                  // narrative across ticks, and a preamble + its tool label can
+                  // repeat non-adjacently (A,B,A) — both must collapse to one
+                  // ordered step.
+                  if (!narrative.includes(child)) {
                     narrative.push(child)
                     if (narrative.length > FOREGROUND_SUBAGENT_ACCUM_MAX) {
                       narrative.splice(0, narrative.length - FOREGROUND_SUBAGENT_ACCUM_MAX)
@@ -25868,7 +25759,10 @@ void (async () => {
                       description: dispatch.feedDescription,
                       lastTool,
                       toolCount,
-                      latestSummary,
+                      // The tick's step line (tool label on tool ticks, prose
+                      // on text ticks) — NOT bare latestSummary, which starved
+                      // tools-only workers of steps (frozen "starting…").
+                      latestSummary: stepLine,
                       elapsedMs,
                       state: 'running',
                     },