switchroom 0.17.10 → 0.18.6

package/telegram-plugin/tests/telegram-activity-visibility-integration.test.ts

@@ -40,7 +40,12 @@ import { describe, it, expect } from 'vitest'
 import * as realFs from 'fs'
 import { startSubagentWatcher } from '../subagent-watcher.js'
 import { mayOpenActivityCard } from '../gateway/feed-open-gate.js'
-import { clipNarrative, appendActivityLabel } from '../tool-activity-summary.js'
+import {
+  clipNarrative,
+  appendActivityLabel,
+  renderActivityFeedWithNested,
+  formatStepSuffix,
+} from '../tool-activity-summary.js'
 import { evaluatePostAnswerLiveness } from '../turn-liveness-floor.js'
 import {
   createWorkerActivityFeed,
@@ -249,6 +254,7 @@ describe('Fix 2: post-answer background-agent liveness (watcher → gate → liv
       finalAnswerDeliveredAt: currentTurn!.finalAnswerDeliveredAt,
       now: currentTime + 5, // a heartbeat tick moments after the stamp
       staleCapMs: 30_000,
+      stillDispatched: false,
     })
     expect(verdictInWindow).toBe('emit')
   })
@@ -262,6 +268,7 @@ describe('Fix 2: post-answer background-agent liveness (watcher → gate → liv
       finalAnswerDeliveredAt: 1000,
       now: 50_000,
       staleCapMs: 30_000,
+      stillDispatched: false,
     })
     expect(verdict).toBe('idle')
   })
@@ -273,6 +280,7 @@ describe('Fix 2: post-answer background-agent liveness (watcher → gate → liv
         finalAnswerDeliveredAt: 1000,
         now: 1500,
         staleCapMs: 30_000,
+        stillDispatched: false,
       }),
     ).toBe('idle')
   })
@@ -310,9 +318,14 @@ describe('Fix 2 / concern 2: currentTurn nulls at turn_end → heartbeat path in
 
   // The gateway's feedHeartbeatTick post-answer entry, reduced to its decision:
   // `if (turn == null) return` (no-turn), else the REAL evaluatePostAnswerLiveness.
+  // `stillDispatched` defaults to false (a purely-background worker, no
+  // foreground `turn.foregroundSubAgents` tracking) so these existing tests
+  // keep proving the ORIGINAL staleness-cap behaviour is preserved for that
+  // case; a dedicated Fix-3 describe block below covers `stillDispatched: true`.
   function heartbeatVerdict(
     currentTurn: { finalAnswerDelivered: boolean; finalAnswerDeliveredAt?: number; subagentActivityAt?: number } | null,
     now: number,
+    stillDispatched = false,
   ): 'no-turn' | 'pre-answer' | ReturnType<typeof evaluatePostAnswerLiveness> {
     const turn = currentTurn
     if (turn == null) return 'no-turn' // gateway: `if (turn == null) return`
@@ -322,6 +335,7 @@ describe('Fix 2 / concern 2: currentTurn nulls at turn_end → heartbeat path in
       finalAnswerDeliveredAt: turn.finalAnswerDeliveredAt,
       now,
       staleCapMs: 30_000,
+      stillDispatched,
     })
   }
 
@@ -377,6 +391,146 @@ describe('Fix 2 / concern 2: currentTurn nulls at turn_end → heartbeat path in
   })
 })
 
+// ─── Fix 3 — sub-agent-delegation freeze (operator-confirmed: card frozen on
+//     "Running a command" for 41s / 3m12s while a sub-agent ran underneath) ──
+
+describe('Fix 3: a still-tracked foreground sub-agent bypasses the staleness cap (no mid-delegation freeze)', () => {
+  /**
+   * Reproduces the EXACT scenario the operator's 3 screenshots showed: a
+   * foreground `Task`/`Agent` dispatch is still outstanding (one long silent
+   * step — no new watcher narrative tick), so `subagentActivityAt` stops
+   * advancing, yet the worker has NOT reported finished. Before Fix 3 the
+   * staleness cap could not tell this apart from genuine completion and froze
+   * the card after 30s regardless. `stillDispatched: true` — sourced from
+   * `turn.foregroundSubAgents.size > 0` at the real call site — is the
+   * positive signal that closes the gap.
+   */
+
+  // Local copy of the gateway's post-answer decision (same as the "Fix 2 /
+  // concern 2" describe block above — duplicated here rather than hoisted to
+  // module scope so each describe stays self-contained/readable).
+  function heartbeatVerdict(
+    currentTurn: { finalAnswerDelivered: boolean; finalAnswerDeliveredAt?: number; subagentActivityAt?: number } | null,
+    now: number,
+    stillDispatched = false,
+  ): 'no-turn' | 'pre-answer' | ReturnType<typeof evaluatePostAnswerLiveness> {
+    const turn = currentTurn
+    if (turn == null) return 'no-turn'
+    if (!turn.finalAnswerDelivered) return 'pre-answer'
+    return evaluatePostAnswerLiveness({
+      subagentActivityAt: turn.subagentActivityAt,
+      finalAnswerDeliveredAt: turn.finalAnswerDeliveredAt,
+      now,
+      staleCapMs: 30_000,
+      stillDispatched,
+    })
+  }
+
+  it('long silent single step (41s, no new narrative) — bypasses the cap while still dispatched', () => {
+    const turn = {
+      finalAnswerDelivered: true,
+      finalAnswerDeliveredAt: 1000,
+      subagentActivityAt: 2000 as number | undefined,
+    }
+    const currentTurn: typeof turn | null = turn
+    // 41s after the last (and only) narrative advance — well past the 30s cap.
+    // Legacy (stillDispatched: false) behaviour would already be 'stale' here
+    // (proven by the concern-3 test above); with a tracked foreground worker
+    // it must stay 'emit' so the card keeps climbing instead of freezing.
+    expect(heartbeatVerdict(currentTurn, 2000 + 41_000, /* stillDispatched */ true)).toBe('emit')
+  })
+
+  it('long silent single step (3m12s) — still bypasses the cap while still dispatched', () => {
+    const turn = {
+      finalAnswerDelivered: true,
+      finalAnswerDeliveredAt: 1000,
+      subagentActivityAt: 2000 as number | undefined,
+    }
+    const currentTurn: typeof turn | null = turn
+    const threeMinTwelveSecMs = 3 * 60_000 + 12_000
+    expect(heartbeatVerdict(currentTurn, 2000 + threeMinTwelveSecMs, true)).toBe('emit')
+  })
+
+  it('once the foreground sub-agent is no longer tracked (finished), the cap re-applies normally', () => {
+    // The gateway removes the agentId from `turn.foregroundSubAgents` when it
+    // finishes (gateway.ts ~27032/27037) — `stillDispatched` then reads false
+    // again and the ORIGINAL runaway-climb protection re-engages exactly as
+    // before Fix 3. This is the adversarial check that Fix 3 doesn't remove
+    // the cap's protection outright, only bypasses it while genuinely unknown.
+    const turn = {
+      finalAnswerDelivered: true,
+      finalAnswerDeliveredAt: 1000,
+      subagentActivityAt: 2000 as number | undefined,
+    }
+    const currentTurn: typeof turn | null = turn
+    expect(heartbeatVerdict(currentTurn, 2000 + 41_000, false)).toBe('stale')
+  })
+
+  it('idle-gap suppression still wins over stillDispatched (no watcher activity ever ⇒ silent, reply-is-last preserved)', () => {
+    // Adversarial check: a turn that dispatched a foreground sub-agent but has
+    // had NO watcher tick at all since the answer (subagentActivityAt
+    // undefined) must stay 'idle', never 'emit', even if stillDispatched is
+    // true — a still-registered worker with zero ticks yet is not the same as
+    // one whose last tick went stale. This preserves the reply-is-last
+    // invariant for a turn that answered and dispatched but hasn't surfaced
+    // any post-answer step yet.
+    const turn = {
+      finalAnswerDelivered: true,
+      finalAnswerDeliveredAt: 1000,
+      subagentActivityAt: undefined as number | undefined,
+    }
+    const currentTurn: typeof turn | null = turn
+    expect(heartbeatVerdict(currentTurn, 50_000, true)).toBe('idle')
+  })
+
+  it('end-to-end: the RENDERED card text keeps changing across real heartbeat ticks while a foreground sub-agent is silently working (not just the verdict function)', () => {
+    // Full simulated turn: dispatch a foreground Task, one narrative tick
+    // lands, then NOTHING further for over three minutes (one long silent
+    // Bash inside the sub-agent) — the exact operator-reported shape. Drives
+    // the REAL `evaluatePostAnswerLiveness` verdict AND the REAL
+    // `renderActivityFeedWithNested`/`composeTurnActivity`-shaped render at
+    // each tick, asserting the VISIBLE text (not an internal label) actually
+    // climbs instead of freezing.
+    const turn = {
+      finalAnswerDelivered: true,
+      finalAnswerDeliveredAt: 1_000,
+      subagentActivityAt: 2_000 as number | undefined,
+      mirrorLines: ['Delegating to a sub-agent'],
+      foregroundSubAgents: new Map<string, string[]>([['agent-1', ['Running a command']]]),
+    }
+
+    function renderCardAt(now: number): string | null {
+      const verdict = evaluatePostAnswerLiveness({
+        subagentActivityAt: turn.subagentActivityAt,
+        finalAnswerDeliveredAt: turn.finalAnswerDeliveredAt,
+        now,
+        staleCapMs: 30_000,
+        stillDispatched: turn.foregroundSubAgents.size > 0,
+      })
+      if (verdict !== 'emit') return null // the pre-Fix-3 freeze point
+      const childLines = [...turn.foregroundSubAgents.values()].flat()
+      const header = { label: 'Agent', elapsedMs: now - 0, toolCount: 1, state: 'running' as const }
+      return renderActivityFeedWithNested(turn.mirrorLines, childLines, false, formatStepSuffix(now - turn.subagentActivityAt!), undefined, header)
+    }
+
+    const tick1 = renderCardAt(2_000 + 6_000) // 6s after the last tick
+    const tick2 = renderCardAt(2_000 + 41_000) // 41s — the first operator-reported freeze point
+    const tick3 = renderCardAt(2_000 + (3 * 60_000 + 12_000)) // 3m12s — the second
+
+    expect(tick1).not.toBeNull()
+    expect(tick2).not.toBeNull()
+    expect(tick3).not.toBeNull()
+    // The visible text must actually differ tick-over-tick (climbing elapsed),
+    // not be frozen at the same string for minutes.
+    expect(tick2).not.toBe(tick1)
+    expect(tick3).not.toBe(tick2)
+    // And it must contain the growing wall-clock evidence the operator was
+    // missing — a live elapsed suffix on the nested step.
+    expect(tick2).toContain('41s')
+    expect(tick3).toContain('3m12s')
+  })
+})
+
 // ─── Fix 2 — concern 2 resolution: the decoupled worker surfaces via the
 //     currentTurn-INDEPENDENT workerActivityFeed (and is bounded) ────────────
 

package/telegram-plugin/tests/unhandled-rejection-policy.test.ts

@@ -96,6 +96,25 @@ describe('classifyRejection — benign Telegram 400s', () => {
     )
     expect(classifyRejection(err)).toBe('log_only')
   })
+  it('returns "log_only" for "group chat was upgraded to a supergroup chat" (marko 2026-07-09, recurring 2026-06-07/2026-06-09)', () => {
+    // A send targeted a basic-group chat_id that Telegram had since
+    // migrated to a supergroup (new -100xxxxxxxxxx id). This crashed the
+    // ENTIRE gateway process (every agent/chat) over a single stale
+    // cached chat_id — the same root cause recurred three times across a
+    // month because the crash-on-leak behavior masked the underlying
+    // stale-id bug instead of just logging it. A migrated/invalid
+    // destination chat must never take down the whole gateway.
+    const err = grammyError(
+      400,
+      'Bad Request: group chat was upgraded to a supergroup chat',
+    )
+    expect(classifyRejection(err)).toBe('log_only')
+  })
+
+  it('returns "log_only" for "group chat was deactivated"', () => {
+    const err = grammyError(400, 'Bad Request: group chat was deactivated')
+    expect(classifyRejection(err)).toBe('log_only')
+  })
 })
 
 describe('classifyRejection — genuine errors still crash', () => {

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -945,6 +945,103 @@ describe('createWorkerActivityFeed — heartbeat', () => {
   })
 })
 
+// ─── Resurrection guard + deferred finalize (review findings #2 & #3) ─────────
+// #3: a late watcher onProgress tick arriving after `finish()` queued its
+//    chain must NOT resurrect the handle and paint a fresh running message.
+// #2: a terminal edit that hit a 429 cooldown stages on `pendingFinish` and
+//    is re-driven by the heartbeat after cooldown — the card can't get stuck
+//    on its last running render. "not modified" / message-gone are success/drop.
+describe('createWorkerActivityFeed — resurrection guard + deferred finalize', () => {
+  const drain = () => new Promise((r) => setTimeout(r, 0))
+
+  it('#3: a late update tick after finish does not resurrect a running card', async () => {
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
+    await feed.update('w1', 'chat', view({ toolCount: 1, latestSummary: 'step one' }))
+    expect(bot.sent).toHaveLength(1)
+
+    await feed.finish('w1', view({ state: 'done', toolCount: 1, latestSummary: 'done result' }))
+    // finish landed a terminal edit and dropped the handle.
+    expect(bot.edits.some((e) => e.text.includes('_done ·'))).toBe(true)
+    expect(feed.has('w1')).toBe(false)
+
+    // Late watcher tick arrives AFTER finish. Pre-fix this would create a
+    // fresh handle and paint a new running message on a finalized worker.
+    clock = 12_000
+    await feed.update('w1', 'chat', view({ toolCount: 2, latestSummary: 'step two' }))
+    expect(bot.sent).toHaveLength(1) // no new running message
+    expect(feed.has('w1')).toBe(false)
+    expect(feed.size).toBe(0)
+  })
+
+  it('#2: a 429 on the finish edit stages pendingFinish; the heartbeat re-drives it after cooldown', async () => {
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      minEditIntervalMs: 0,
+      heartbeatTickMs: 6000,
+      setInterval: () => 1,
+      clearInterval: () => {},
+    })
+    await feed.update('w1', 'chat', view({ toolCount: 1, latestSummary: 'running step' }))
+    expect(bot.sent).toHaveLength(1)
+
+    // The terminal edit hits a 429 with a 2s retry_after.
+    bot.failNextEditWith = { error_code: 429, parameters: { retry_after: 2 } }
+    await feed.finish('w1', view({ state: 'done', toolCount: 1, latestSummary: 'final result' }))
+    await drain()
+    // No terminal edit landed yet — the last edit is still the running render.
+    expect(bot.edits.some((e) => e.text.includes('_done ·'))).toBe(false)
+
+    // Inside the cooldown — a heartbeat tick must NOT retry (would re-429).
+    clock = 11_000
+    feed.heartbeatTick()
+    await drain()
+    expect(bot.edits.some((e) => e.text.includes('_done ·'))).toBe(false)
+
+    // Past the cooldown (10_000 + 2000 + 500 jitter = 12_500) — the heartbeat
+    // re-drives the deferred finalize and the terminal edit lands.
+    clock = 13_000
+    feed.heartbeatTick()
+    await drain()
+    expect(bot.edits.some((e) => e.text.includes('_done ·'))).toBe(true)
+    expect(feed.has('w1')).toBe(false) // handle dropped after the terminal edit landed
+  })
+
+  it('#2: "message is not modified" on finish is treated as success (card already correct)', async () => {
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
+    await feed.update('w1', 'chat', view({ toolCount: 1, latestSummary: 'x' }))
+    expect(bot.sent).toHaveLength(1)
+
+    bot.failNextEditWith = new Error('Bad Request: message is not modified')
+    await feed.finish('w1', view({ state: 'done', toolCount: 1, latestSummary: 'x' }))
+    await drain()
+    // The handle is dropped — the not-modified outcome is success, no retry.
+    expect(feed.has('w1')).toBe(false)
+  })
+
+  it('#2: a gone message on finish drops the handle silently (no card to finalize)', async () => {
+    const bot = makeFakeBot()
+    const logs: string[] = []
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0, log: (m) => logs.push(m) })
+    await feed.update('w1', 'chat', view({ toolCount: 1, latestSummary: 'x' }))
+    expect(bot.sent).toHaveLength(1)
+
+    bot.failNextEditWith = new Error('Bad Request: message to edit not found')
+    await feed.finish('w1', view({ state: 'done', toolCount: 1, latestSummary: 'done' }))
+    await drain()
+    expect(feed.has('w1')).toBe(false)
+    // No scary "finish edit failed" warning for a transport-gone outcome.
+    expect(logs.some((l) => l.includes('finish edit failed'))).toBe(false)
+  })
+})
+
 // ─── Extreme-edge: single oversized narrative line (no-truncate ON) ──────────
 // Reproduces the bug where accumulateNarrative's char-budget splice would push
 // the oversized line then immediately splice it out, making the narrative empty

package/telegram-plugin/tests/worktree-watch-cwds.test.ts

@@ -9,14 +9,17 @@
  * Run with:
  *   bun test telegram-plugin/tests/worktree-watch-cwds.test.ts
  */
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, beforeEach } from "vitest";
 import {
   ownedWorktreeCwds,
+  __resetIdentityEscalationForTests,
   type WorktreeOwnershipRecord,
 } from "../worktree-watch-cwds.js";
 
 const idPath = (p: string) => p; // identity realpath for deterministic tests
 
+beforeEach(() => __resetIdentityEscalationForTests());
+
 describe("ownedWorktreeCwds", () => {
   const records: WorktreeOwnershipRecord[] = [
     { path: "/wt/mine-1", ownerAgent: "klanker" },
@@ -25,18 +28,110 @@ describe("ownedWorktreeCwds", () => {
     { path: "/wt/ownerless" }, // ownerAgent undefined
   ];
 
-  it("returns NOTHING when the agent identity is unset (fail-closed, no #1116 leak)", () => {
+  it("returns NOTHING when the agent identity is unset and no durable fallback given (fail-closed, no #1116 leak)", () => {
     expect(
       ownedWorktreeCwds({ self: undefined, listRecords: () => records, realpath: idPath }),
     ).toEqual([]);
   });
 
-  it("returns NOTHING when the agent identity is empty string", () => {
+  it("returns NOTHING when the agent identity is empty string and no durable fallback given", () => {
     expect(
       ownedWorktreeCwds({ self: "", listRecords: () => records, realpath: idPath }),
     ).toEqual([]);
   });
 
+  // ---- Layer 2: durable, non-env identity fallback (#1116 / #2893) ----
+
+  it("(a) env SET → ownership resolves exactly as before (fast path unchanged)", () => {
+    expect(
+      ownedWorktreeCwds({
+        self: "klanker",
+        agentDir: "/home/x/.switchroom/agents/SHOULD_BE_IGNORED",
+        listRecords: () => records,
+        realpath: idPath,
+      }),
+    ).toEqual(["/wt/mine-1", "/wt/mine-2"]);
+  });
+
+  it("(b) env UNSET but agentDir present → identity derived from dir basename, ownership resolves", () => {
+    const out = ownedWorktreeCwds({
+      self: undefined,
+      agentDir: "/home/x/.switchroom/agents/klanker",
+      listRecords: () => records,
+      realpath: idPath,
+    });
+    expect(out).toEqual(["/wt/mine-1", "/wt/mine-2"]);
+  });
+
+  it("(b) env EMPTY but agentDir present → same durable derivation", () => {
+    const out = ownedWorktreeCwds({
+      self: "",
+      agentDir: "/home/x/.switchroom/agents/klanker",
+      listRecords: () => records,
+      realpath: idPath,
+    });
+    expect(out).toEqual(["/wt/mine-1", "/wt/mine-2"]);
+  });
+
+  it("(b) durable fallback NEVER mis-attributes: a dir for a different agent matches only THAT agent's records, never klanker's", () => {
+    // agentDir names 'reggie' → resolves reggie's worktrees, never klanker's
+    // or the ownerless ones. A wrong basename fails-closed to [], it can never
+    // attribute to the WRONG owner.
+    const out = ownedWorktreeCwds({
+      self: undefined,
+      agentDir: "/home/x/.switchroom/agents/reggie",
+      listRecords: () => records,
+      realpath: idPath,
+    });
+    expect(out).toEqual(["/wt/theirs"]);
+    expect(out).not.toContain("/wt/ownerless");
+  });
+
+  it("(c) BOTH env and agentDir unavailable → returns [] AND emits an escalated ERROR (no throw, no mis-attribution)", () => {
+    const logs: string[] = [];
+    const out = ownedWorktreeCwds({
+      self: undefined,
+      agentDir: undefined,
+      listRecords: () => records,
+      realpath: idPath,
+      log: (m) => logs.push(m),
+    });
+    expect(out).toEqual([]);
+    expect(logs).toHaveLength(1);
+    expect(logs[0]).toContain("ERROR");
+    expect(logs[0]).toContain("identity resolution FAILED");
+  });
+
+  it("(c) blank agentDir (whitespace) is treated as unavailable → [] + escalated error", () => {
+    const logs: string[] = [];
+    const out = ownedWorktreeCwds({
+      self: "",
+      agentDir: "   ",
+      listRecords: () => records,
+      realpath: idPath,
+      log: (m) => logs.push(m),
+    });
+    expect(out).toEqual([]);
+    expect(logs).toHaveLength(1);
+    expect(logs[0]).toContain("identity resolution FAILED");
+  });
+
+  it("(c) the escalated error is one-shot per process (not re-logged every rescan tick)", () => {
+    const logs: string[] = [];
+    const call = () =>
+      ownedWorktreeCwds({
+        self: undefined,
+        agentDir: undefined,
+        listRecords: () => records,
+        realpath: idPath,
+        log: (m) => logs.push(m),
+      });
+    call();
+    call();
+    call();
+    expect(logs).toHaveLength(1);
+  });
+
   it("does NOT match ownerless records even when identity is set", () => {
     const out = ownedWorktreeCwds({ self: "klanker", listRecords: () => records, realpath: idPath });
     expect(out).not.toContain("/wt/ownerless");

package/telegram-plugin/turn-liveness-floor.ts

@@ -227,13 +227,47 @@ export interface PostAnswerLivenessInput {
   now: number
   /** Staleness cap in ms; `<= 0` disables the cap. */
   staleCapMs: number
+  /**
+   * A POSITIVE, independent signal that a sub-agent dispatch is still known to
+   * be outstanding (e.g. `turn.foregroundSubAgents.size > 0` — a foreground
+   * `Task`/`Agent` this turn dispatched and has not yet reported finished).
+   *
+   * ## The gap this closes
+   *
+   * The staleness cap above was built to stop the card climbing FOREVER once
+   * a worker's `onFinish` froze `subagentActivityAt` and nothing further would
+   * ever arrive — but the ONLY signal it read (`now - subagentActivityAt`) is
+   * identical whether the worker (a) actually finished, or (b) is still
+   * genuinely running a SINGLE long silent step (one long Bash call, a slow
+   * fetch) that simply hasn't produced a NEW distinguishable watcher tick.
+   * Case (b) is exactly the scenario `feed-heartbeat-climb.ts`'s 0-label climb
+   * and `worker-activity-feed.ts`'s own heartbeat both exist to handle
+   * deterministically elsewhere — this post-answer branch alone lacked that
+   * fallback, so it froze the card mid-delegation (the confirmed operator
+   * symptom: "Running a command" stuck for 41s / 3m12s while a sub-agent ran
+   * underneath).
+   *
+   * When `stillDispatched` is `true` we have POSITIVE evidence the worker has
+   * not reported completion, so the staleness cap is bypassed entirely and the
+   * verdict stays `'emit'` — the caller keeps climbing the card deterministically
+   * off wall-clock elapsed exactly like the sibling 0-label/worker-feed paths.
+   * When `false` (no such tracking available — e.g. a purely-background worker
+   * with no foreground registration), the ORIGINAL cap behaviour is preserved
+   * unchanged, so the runaway-climb-after-completion protection this cap was
+   * built for still applies wherever we have no better signal.
+   */
+  stillDispatched: boolean
 }
 
 export function evaluatePostAnswerLiveness(input: PostAnswerLivenessInput): PostAnswerLivenessVerdict {
-  const { subagentActivityAt, finalAnswerDeliveredAt, now, staleCapMs } = input
+  const { subagentActivityAt, finalAnswerDeliveredAt, now, staleCapMs, stillDispatched } = input
   const answeredAt = finalAnswerDeliveredAt ?? 0
   // idle-gap: nothing surfaced after the answer → silent (reply-is-last preserved).
   if (subagentActivityAt == null || subagentActivityAt <= answeredAt) return 'idle'
+  // A positive "still dispatched" signal overrides the staleness cap — we KNOW
+  // the worker hasn't reported done, so a quiet stretch is a long silent step,
+  // not completion. Never freeze the card while that's true.
+  if (stillDispatched) return 'emit'
   // staleness cap: the worker's last advance is older than the cap → stop emitting.
   if (staleCapMs > 0 && now - subagentActivityAt >= staleCapMs) return 'stale'
   return 'emit'

package/telegram-plugin/uat/scenarios/jtbd-rich-formatting-render-dm.test.ts

@@ -56,9 +56,20 @@
 import { describe, it, expect } from "vitest";
 import { spinUp } from "../harness.js";
 import type { ObservedMessage } from "../driver.js";
+import { richRenderEnabled } from "../../render/rich-render.js";
 
 const AGENT = "test-harness";
 
+// The rich-render wiring (parse -> IR -> renderSafe -> sendRichMessage) is
+// gated behind `SWITCHROOM_RICH_RENDER` (default OFF). The expandable /
+// collapsible round-trip proof below only runs when BOTH the driver creds AND
+// the flag are present — the flag must be set in the gateway process under
+// test for the renderer to actually shape the outbound message, so gating the
+// scenario on the same flag keeps it honest (no false green when the wiring
+// isn't live). When the flag is off, this scenario self-skips green exactly
+// like the credential-less case.
+const RICH_RENDER_ON = richRenderEnabled();
+
 // The driver session is the load-bearing credential. Absent it, spinUp()
 // throws in resolveConfig — so guard at describe level and self-skip green.
 const HAS_DRIVER_CREDS =
@@ -105,13 +116,18 @@ const SAMPLE_LINES = [
  * trip on the uat-host (PR #2745 first live run: present set was
  * `bold, italic, code, strikethrough, text_link, blockquote, pre`).
  *
- * `spoiler` is deliberately NOT hard-asserted: on the live wire the `||…||`
- * span did NOT surface as a `spoiler`/`textMarked` entity (the model either
- * dropped the syntax or Telegram's chat-message GFM parser doesn't map it the
- * way the IV table-of-contents `textMarked` node does). Rather than red the
- * whole render gate on a construct the round trip doesn't reliably produce, we
- * observe spoiler softly (logged below). The decoder's `textMarked → spoiler`
- * mapping is still pinned deterministically by the hosted unit suite.
+ * `spoiler` is soft-observed HERE only because of THIS harness's decode path:
+ * the `||…||` span did NOT reliably surface as a `spoiler`/`textMarked` entity
+ * through the MTProto send→IV→decode round trip the UAT driver uses. This is a
+ * harness-decoder limitation, NOT a wire failure: a 2026-07 direct probe of the
+ * Bot API `sendRichMessage` endpoint (the actual production send path) confirmed
+ * `||spoiler||` DOES parse to a `spoiler` entity and `==highlight==` to `marked`
+ * on the live wire — see `reference/rfcs/telegram-native-formatting.md` §6a.
+ * Spoiler ships default-on; it stays soft here purely so this MTProto-decode
+ * gate doesn't red on its own decode gap. (Underline `__…__`, by contrast, is a
+ * genuine wire exclusion — it parses as bold; see §6a.) The decoder's
+ * `textMarked → spoiler` mapping is still pinned deterministically by the
+ * hosted unit suite.
  *
  * Lists and dividers carry no first-class Bot API entity (they render as
  * bulleted/numbered/rule TEXT), so they are asserted on `reply.text` below.
@@ -252,3 +268,79 @@ function kindsPresent(msg: ObservedMessage): Set<string> {
     );
   },
 );
+
+// ---------------------------------------------------------------------------
+// Rich-render wiring proof — expandable / collapsible content round-trip.
+//
+// This is the piece the unit suite CANNOT prove: that a REAL markdown reply
+// carrying the Bot API 10.1 expandable-blockquote marker (`**> `) flows
+// through the live send path — parse.ts (marker -> IR `expandable: true`) ->
+// render.ts (IR -> `**> ` markdown) -> renderSafe -> sendRichMessage — and
+// that Telegram actually parses it back to a blockquote entity on the wire.
+//
+// Runs ONLY when the rich-render flag is on in this process (see
+// RICH_RENDER_ON) AND the driver creds are present; self-skips green
+// otherwise, so default CI (flag off) never reds on it.
+// ---------------------------------------------------------------------------
+
+const EXP_MARKER = "COLLAPSE9";
+const EXPANDABLE_SAMPLE = [
+  `Reply with EXACTLY this and NOTHING else, keeping ${EXP_MARKER} verbatim:`,
+  "",
+  `${EXP_MARKER}: here is a collapsible section.`,
+  "",
+  "**> first hidden line of the expandable quote",
+  "> second hidden line",
+  "> third hidden line",
+].join("\n");
+
+(HAS_DRIVER_CREDS && RICH_RENDER_ON ? describe : describe.skip)(
+  "uat: expandable/collapsible content round-trips through the live renderer",
+  () => {
+    it(
+      "a `**>` reply parses -> renders -> sends -> decodes as a blockquote entity",
+      async () => {
+        const sc = await spinUp({ agent: AGENT });
+        try {
+          await sc.sendDM(EXPANDABLE_SAMPLE);
+
+          const reply = await sc.expectMessage(
+            (m: ObservedMessage) =>
+              m.text.includes(EXP_MARKER) || m.text === "\x01",
+            { from: "bot", timeout: 90_000 },
+          );
+
+          // Decode regression gate (same as the primary scenario).
+          expect(
+            reply.text,
+            "expandable reply decoded as the \\x01 unsupported-media sentinel",
+          ).not.toBe("\x01");
+          expect(reply.text).toContain(EXP_MARKER);
+
+          // The collapsible construct must survive as a real blockquote entity
+          // on the wire — proof the parse->render->send path produced valid
+          // Bot API 10.1 markdown, not stray `**>` literal text.
+          const present = kindsPresent(reply);
+          expect(
+            [...present],
+            `expandable quote did not decode as a blockquote entity ` +
+              `(present kinds: ${[...present].join(", ")})`,
+          ).toContain("blockquote");
+
+          // The quoted body text must round-trip (content never lost).
+          expect(reply.text).toContain("first hidden line");
+
+          console.info(
+            "[uat] expandable round-trip entity structure: " +
+              JSON.stringify(
+                reply.entities.map((e) => ({ kind: e.kind, text: e.text })),
+              ),
+          );
+        } finally {
+          await sc.tearDown();
+        }
+      },
+      120_000,
+    );
+  },
+);