switchroom 0.18.21 → 0.18.23

package/telegram-plugin/tests/worker-feed-coalesce.test.ts

@@ -443,6 +443,202 @@ describe('coalesced worker feed — GROUP-level pin lifecycle (#3207 review)', (
   })
 })
 
+// ─── #3207 leaked-finished-row fix ────────────────────────────────────────────
+//
+// Root cause of the "progress card never unpins; later workers append to a
+// stale pinned message" incident (a card observed pinned + edited for 2h12m):
+// a finished worker row whose terminal edit hit a 429/flood window was left in
+// `g.workers`, so the group never emptied → never deleted → never unpinned, and
+// a later worker inherited the stale message. These outcome tests pin the fix:
+// group emptiness / deletion / unpin are decoupled from terminal-edit success,
+// the finalize staging is per-agent (no single-slot overwrite), and a later
+// worker never reuses a terminated group's message.
+
+describe('coalesced worker feed — leaked finished-row fix (#3207)', () => {
+  interface PinCall {
+    feedKey: string
+    chatId: string
+    messageId: number | null
+  }
+  function leakHarness(opts: { failEdits?: () => unknown } = {}) {
+    const pins: PinCall[] = []
+    const sent: { chatId: string; text: string; messageId: number }[] = []
+    const edits: { messageId: number; text: string }[] = []
+    let seq = 700
+    let clock = 0
+    const bot: BotApiForWorkerFeed = {
+      sendMessage: async (chatId, text) => {
+        const messageId = seq++
+        sent.push({ chatId, text, messageId })
+        return { message_id: messageId }
+      },
+      editMessageText: async (_chatId, messageId, text) => {
+        const err = opts.failEdits?.()
+        if (err != null) throw err
+        edits.push({ messageId, text })
+        return true
+      },
+    }
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      minEditIntervalMs: 0,
+      firstPaintMinMs: 0,
+      heartbeatTickMs: 6000,
+      setInterval: () => 0,
+      clearInterval: () => {},
+      reconcilePin: ({ feedKey, chatId, messageId }) => pins.push({ feedKey, chatId, messageId }),
+    })
+    return { feed, pins, sent, edits, setClock: (t: number) => (clock = t) }
+  }
+  const done = (desc: string, elapsedMs: number): WorkerActivityView => ({
+    description: desc,
+    lastTool: null,
+    toolCount: 3,
+    latestSummary: `${desc} result`,
+    elapsedMs,
+    state: 'done',
+  })
+  const drain = () => new Promise((r) => setTimeout(r, 0))
+
+  it('drops the finished row + requests unpin even when the last terminal edit floods (429)', async () => {
+    let flooding = true
+    const { feed, pins, sent, edits, setClock } = leakHarness({
+      failEdits: () => (flooding ? { error_code: 429, parameters: { retry_after: 2 } } : null),
+    })
+    setClock(1000)
+    await feed.update('w1', 'chat', view('task 1', 'doing', 1000))
+    expect(sent).toHaveLength(1)
+    const feedKey = pins[pins.length - 1].feedKey
+
+    // The LAST worker finishes but the terminal recap edit 429s.
+    setClock(2000)
+    await feed.finish('w1', done('task 1', 2000))
+    await drain()
+
+    // Outcome: the finished row is gone and the pin is RELEASED immediately —
+    // neither is blocked by the failed terminal edit.
+    expect(feed.has('w1')).toBe(false)
+    expect(feed.size).toBe(0)
+    // Pin-reaper backstop: no running rows remain → the group is not "running".
+    expect(feed.hasRunningInFeed(feedKey)).toBe(false)
+    expect(pins[pins.length - 1].messageId).toBeNull()
+    // The terminal recap has NOT landed yet (still flooding) — proves the unpin
+    // did not wait on it.
+    expect(edits.some((e) => e.text.includes('_done ·'))).toBe(false)
+
+    // Flood clears; a heartbeat past the cooldown re-drives the staged recap.
+    flooding = false
+    setClock(5000)
+    feed.heartbeatTick()
+    await drain()
+    expect(edits.some((e) => e.text.includes('_done ·'))).toBe(true)
+
+    // The group is fully reaped: a later worker in the SAME chat paints a FRESH
+    // message — it does NOT reuse/edit the terminated group's message id.
+    setClock(6000)
+    await feed.update('w2', 'chat', view('task 2', 'doing2', 6000))
+    await drain()
+    expect(sent).toHaveLength(2)
+    expect(feed.messageIdOf('w2')).toBe(sent[1].messageId)
+    expect(feed.messageIdOf('w2')).not.toBe(sent[0].messageId)
+  })
+
+  it('TWO workers finishing in the same flood window are BOTH reaped (no single-slot overwrite)', async () => {
+    let flooding = true
+    const { feed, pins, sent, edits, setClock } = leakHarness({
+      failEdits: () => (flooding ? { error_code: 429, parameters: { retry_after: 2 } } : null),
+    })
+    setClock(1000)
+    await feed.update('a', 'chat', view('task A', 'a-doing', 1000))
+    await feed.update('b', 'chat', view('task B', 'b-doing', 1000))
+    expect(feed.size).toBe(2)
+    const feedKey = pins[pins.length - 1].feedKey
+
+    // Both finish before either finalize chain drains, so both latch terminal in
+    // the SAME cooldown window. The old single `pendingFinalize` slot dropped all
+    // but one → the other row leaked forever. The per-agent map keeps both.
+    setClock(2000)
+    const f1 = feed.finish('a', done('task A', 2000))
+    const f2 = feed.finish('b', done('task B', 2000))
+    await Promise.all([f1, f2])
+    await drain()
+
+    // NEITHER finished row leaks — the group is empty and unpinned.
+    expect(feed.size).toBe(0)
+    expect(feed.hasRunningInFeed(feedKey)).toBe(false)
+    expect(pins[pins.length - 1].messageId).toBeNull()
+
+    // Flood clears; one heartbeat drains ALL staged recaps and reaps the group.
+    flooding = false
+    setClock(5000)
+    feed.heartbeatTick()
+    await drain()
+
+    // BOTH staged terminal recaps must actually repaint — not just one. This is
+    // the contract the per-agent `pendingFinalize` map exists to hold: a single-
+    // slot `pendingFinalize` would have let worker B's stage overwrite worker A's,
+    // so only ONE recap edit would land and this assertion would FAIL. The
+    // decoupled row-removal (fix 1) alone would pass size===0 + unpin above WITHOUT
+    // repainting either recap, so those assertions do not pin this contract — these
+    // do. Each recap carries its own worker's description ('task A' / 'task B').
+    const doneEdits = edits.filter((e) => e.text.includes('_done ·'))
+    expect(doneEdits.some((e) => e.text.includes('task A'))).toBe(true)
+    expect(doneEdits.some((e) => e.text.includes('task B'))).toBe(true)
+
+    // The group is gone: a later worker paints a FRESH message, never editing a
+    // terminated sibling's message.
+    setClock(6000)
+    await feed.update('c', 'chat', view('task C', 'c-doing', 6000))
+    await drain()
+    const firstMsgId = sent[0].messageId
+    expect(feed.messageIdOf('c')).toBe(sent[sent.length - 1].messageId)
+    expect(feed.messageIdOf('c')).not.toBe(firstMsgId)
+  })
+
+  it('a later worker after all prior workers finished does NOT reuse the prior message id', async () => {
+    const { feed, sent, setClock } = leakHarness()
+    setClock(1000)
+    await feed.update('w1', 'chat', view('task 1', 'doing', 1000))
+    setClock(2000)
+    await feed.finish('w1', done('task 1', 2000))
+    await drain()
+    expect(feed.size).toBe(0)
+
+    // A brand-new worker in the same chat gets its OWN fresh message.
+    setClock(3000)
+    await feed.update('w2', 'chat', view('task 2', 'doing2', 3000))
+    await drain()
+    expect(sent).toHaveLength(2)
+    expect(feed.messageIdOf('w2')).toBe(sent[1].messageId)
+    expect(feed.messageIdOf('w2')).not.toBe(sent[0].messageId)
+  })
+
+  it('hasRunningInFeed is false once only finished rows remain (pin-reaper backstop fires)', async () => {
+    // A sibling keeps the group running; when the LAST running worker finishes,
+    // no running row remains → hasRunningInFeed flips to false so the gateway's
+    // wk:group: reaper is free to unpin (finished rows never count as running).
+    const { feed, pins, setClock } = leakHarness()
+    setClock(1000)
+    await feed.update('a', 'chat', view('task A', 'a-doing', 1000))
+    await feed.update('b', 'chat', view('task B', 'b-doing', 1000))
+    const feedKey = pins[pins.length - 1].feedKey
+    expect(feed.hasRunningInFeed(feedKey)).toBe(true)
+
+    setClock(2000)
+    await feed.finish('a', done('task A', 2000))
+    await drain()
+    // One still runs → still counts.
+    expect(feed.hasRunningInFeed(feedKey)).toBe(true)
+
+    setClock(3000)
+    await feed.finish('b', done('task B', 3000))
+    await drain()
+    // Only finished work remains → NOT running.
+    expect(feed.hasRunningInFeed(feedKey)).toBe(false)
+  })
+})
+
 describe('renderCombinedWorkerFeed (pure)', () => {
   const row = (i: number, step: string) => ({
     description: `task number ${i}`,

package/telegram-plugin/turn-flush-safety.ts

@@ -128,6 +128,75 @@ export function endsWithSilentMarker(text: string | undefined): boolean {
   return isSilentFlushMarker(lines[lines.length - 1])
 }
 
+/**
+ * Substantive-answer floor (chars, trimmed). Mirrors
+ * `final-answer-detect.ts` `FINAL_ANSWER_MIN_CHARS` and
+ * `hooks/silent-end-scan.mjs` — the same bar the codebase uses everywhere to
+ * recognise "this text block is a real answer, not a short narration/closer".
+ */
+export const FLUSH_SUBSTANTIVE_MIN_CHARS = 200
+
+/**
+ * Pick the text a turn-flush should actually DELIVER from the captured
+ * assistant blocks.
+ *
+ * The duplicate-reply bug (2026-07) had the answer-ready flush fire while the
+ * model was still composing its `reply` tool call: `capturedText` at that
+ * moment holds intent-narration blocks ("Let me check X", "I'll now …") FOLLOWED
+ * by the composed answer block. Flushing `capturedText.join('\n\n')` dumped the
+ * whole narration+answer blob into chat — which then never matched the clean
+ * answer-only `reply` on the outbound dedup (containment, not equality), so the
+ * user got a narration-laden duplicate.
+ *
+ * The answer is the TERMINAL block — the last thing the model wrote is what it
+ * settled on, REGARDLESS of length. A real dropped answer is often short
+ * (a one-line confirmation, a two-sentence reply), so gating delivery on the
+ * 200-char substantive floor was wrong: with blocks
+ * `[verboseNarration(250), realAnswer(150)]` a reversed length scan returns the
+ * 250-char narration and DROPS the 150-char real answer. Instead we take the
+ * last non-empty block as the answer and strip only the EARLIER blocks — and
+ * only when they look like intent-narration (short, or the classic "Let me…" /
+ * "I'll…" openers). If the earlier blocks are themselves substantial (a genuine
+ * multi-paragraph answer written as several blocks) we keep the whole thing
+ * joined, so we never truncate a real long answer down to its last paragraph.
+ *
+ * `blocks` are already trimmed/non-empty candidates (silent markers removed by
+ * the caller's guards). Returns the chosen delivery text.
+ */
+export function selectFlushDeliveryText(blocks: string[]): string {
+  const candidates = blocks
+    .map(b => b.trim())
+    .filter(b => b.length > 0)
+  if (candidates.length === 0) return ''
+  if (candidates.length === 1) return candidates[0]
+  const answer = candidates[candidates.length - 1]
+  const preceding = candidates.slice(0, -1)
+  // Deliver only the terminal answer when every earlier block is
+  // intent-narration (a short block, or a "Let me…/I'll…/I'm going to…" opener).
+  // Otherwise the earlier blocks carry real content — keep the full joined text
+  // so a legitimate multi-block answer is never truncated to its last paragraph.
+  const allNarration = preceding.every(isNarrationBlock)
+  return allNarration ? answer : candidates.join('\n\n')
+}
+
+/**
+ * Narration heuristic: a block that opens with a first-person "about to do X"
+ * phrase the model emits BEFORE composing its real answer ("Let me check…",
+ * "I'll look it up…", "Now let me…"). Deliberately NOT length-based — the
+ * narration that shadowed the real answer in the observed bug was a LONG
+ * (≥200-char) "Let me pull the numbers…" block, and short blocks are frequently
+ * legitimate multi-paragraph answer content — so gating on length either drops a
+ * short real answer or keeps a long narration. When earlier blocks don't match
+ * this opener we keep the full joined text (never drop content we can't
+ * confidently attribute to narration).
+ */
+const NARRATION_OPENER =
+  /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i
+
+function isNarrationBlock(block: string): boolean {
+  return NARRATION_OPENER.test(block.trimStart())
+}
+
 export type FlushDecision =
   | { kind: 'flush'; text: string }
   | { kind: 'skip'; reason: FlushSkipReason }
@@ -219,7 +288,11 @@ export function decideTurnFlush(input: FlushDecisionInput): FlushDecision {
   // sentinel — treat the whole turn as intentionally silent rather than
   // flush the prose with the sentinel glued on.
   if (endsWithSilentMarker(joined)) return { kind: 'skip', reason: 'silent-marker' }
-  return { kind: 'flush', text: joined }
+  // Deliver only the substantive answer block, never the whole narration+answer
+  // blob (see `selectFlushDeliveryText`). The silent-marker / empty guards above
+  // still run on the full `joined` string so a partly-silent turn is classified
+  // correctly; only the DELIVERED text is narrowed to the answer.
+  return { kind: 'flush', text: selectFlushDeliveryText(input.capturedText) }
 }
 
 /**

package/telegram-plugin/worker-activity-feed.ts

@@ -390,12 +390,29 @@ interface FeedGroup {
   /** Live workers in this group, keyed by agentId (insertion ≈ dispatch order). */
   workers: Map<string, WorkerRow>
   /**
-   * A terminal render (the last worker's recap) staged because a 429 cooldown /
-   * flood window blocked the edit. The heartbeat re-drives it once the cooldown
-   * expires so a finished feed can't get stuck on its last running render.
-   * Null when no finalize is pending.
+   * Terminal renders (per finishing worker's recap) staged because a 429
+   * cooldown / flood window blocked the edit. Keyed by agentId so a SECOND
+   * worker finishing in the same window can't overwrite the first's staged
+   * recap (the single-slot bug: two near-simultaneous last-worker finishes
+   * leaked the earlier finished row forever). The heartbeat drains EVERY entry
+   * once the cooldown expires so a finished feed can't get stuck on its last
+   * running render. Empty when no finalize is pending.
+   *
+   * Note: the finishing row is dropped from `workers` immediately at finalize
+   * time (decoupled from edit success — #3207 leaked-finished-row fix), so a
+   * staged entry here is purely the best-effort terminal REPAINT; group
+   * emptiness / deletion / unpin never wait on it.
+   */
+  pendingFinalize: Map<string, WorkerActivityView>
+  /**
+   * True once this group's shared message last rendered a TERMINAL recap (a
+   * finished worker's done/failed/incomplete card), and no live worker has
+   * repainted since. A later worker joining the group must NOT edit that
+   * terminal message — it forces a fresh first-paint (new message) instead, so
+   * a new dispatch never appends to a stale "done" card. Reset to false on any
+   * fresh first-paint.
    */
-  pendingFinalize: WorkerActivityView | null
+  terminalPainted: boolean
 }
 
 const COOLDOWN_JITTER_MS = 500
@@ -693,7 +710,24 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   function removeWorker(g: FeedGroup, agentId: string): void {
     g.workers.delete(agentId)
     agentIndex.delete(agentId)
-    if (g.workers.size === 0) groups.delete(g.feedKey)
+    maybeDeleteGroup(g)
+  }
+
+  /**
+   * Delete an empty group. A group is gone only when it has NO tracked workers
+   * AND no staged terminal repaints pending — the latter keeps the group object
+   * reachable for the heartbeat re-drive after a flood/429 deferred the recap,
+   * without keeping it "alive" for the pin (syncPin / hasRunningInFeed count
+   * only live workers, so an emptied-but-pending group is already unpinned).
+   */
+  function maybeDeleteGroup(g: FeedGroup): void {
+    if (g.workers.size === 0 && g.pendingFinalize.size === 0) groups.delete(g.feedKey)
+  }
+
+  /** Live (not-yet-finished) workers still tracked in a group. */
+  function hasLiveWorker(g: FeedGroup): boolean {
+    for (const w of g.workers.values()) if (!w.finished) return true
+    return false
   }
 
   /**
@@ -704,7 +738,10 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
    * still needs — the survivors keep the pin until the LAST worker is done.
    */
   function syncPin(g: FeedGroup): void {
-    const messageId = g.messageId != null && g.workers.size > 0 ? g.messageId : null
+    // Pin follows LIVE membership, not row count: a finished-but-not-yet-swept
+    // row (or a staged terminal repaint) must NOT keep the pin. Unpin the
+    // instant the last running worker is gone.
+    const messageId = g.messageId != null && hasLiveWorker(g) ? g.messageId : null
     reconcilePinFn({ feedKey: g.feedKey, chatId: g.chatId, threadId: g.threadId, messageId })
   }
 
@@ -721,45 +758,78 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   ): Promise<void> {
     const now = nowFn()
     const isTerminal = opts2.terminalRecap != null
-    // Terminal edit RESOLVED (landed / not-modified / gone): clear the staged
-    // re-drive unconditionally so a heartbeat re-drive can never loop, and drop
-    // the finished row when its id is known (the last-worker finalize path).
-    const settleTerminal = (): void => {
-      g.pendingFinalize = null
-      if (opts2.finishingAgentId != null) removeWorker(g, opts2.finishingAgentId)
-      // Group-level pin follows membership: unpin once this drops the last
-      // worker; a NOOP-pin (siblings remain) keeps the shared message pinned.
+    const finishingAgentId = opts2.finishingAgentId
+
+    // Stage the terminal recap for the heartbeat re-drive, keyed by the
+    // FINISHING agent so a second worker finishing in the same cooldown/flood
+    // window can't overwrite an earlier staged recap (#3207: the single-slot
+    // overwrite that orphaned finished rows). Best-effort repaint only — the
+    // row is dropped and the pin released independently, below.
+    const stageRecap = (): void => {
+      if (isTerminal && finishingAgentId != null && opts2.terminalRecap != null) {
+        g.pendingFinalize.set(finishingAgentId, opts2.terminalRecap)
+      }
+    }
+    // Terminal repaint no longer pending (landed / not-modified / gone / never
+    // had a message): stop re-driving it and reap the group if now fully empty.
+    const clearStaged = (): void => {
+      if (finishingAgentId != null) g.pendingFinalize.delete(finishingAgentId)
+      maybeDeleteGroup(g)
+      syncPin(g)
+    }
+
+    // #3207 leaked-finished-row fix — decouple row removal + unpin from the
+    // terminal edit's SUCCESS. The instant a worker finalizes we drop its row
+    // and release the group pin; a 429 / flood / transport failure on the
+    // cosmetic recap edit must NEVER keep the group, its message, or its pin
+    // alive. The recap is staged (above) purely as a best-effort repaint.
+    if (isTerminal) {
+      stageRecap()
+      if (finishingAgentId != null && g.workers.has(finishingAgentId)) {
+        removeWorker(g, finishingAgentId)
+      }
+      // Only latch terminalPainted when NO live worker remains at paint time.
+      // Race: this finalize was the last live worker when the chain latched, but
+      // a fresh worker B may have called update() and joined g.workers before
+      // this body runs — in which case renderGroupBody paints B's RUNNING card,
+      // not a terminal recap. Setting the flag true unconditionally would
+      // mislabel that running paint as terminal (a spurious group-reuse fresh-
+      // paint on B's next update). Reflect reality: the group only went terminal
+      // if it's actually empty of live workers.
+      g.terminalPainted = !hasLiveWorker(g)
       syncPin(g)
     }
+
     if (now < g.cooldownUntil) {
-      if (isTerminal && opts2.terminalRecap != null) g.pendingFinalize = opts2.terminalRecap
+      // Row already dropped + unpinned above; the recap stays staged so the
+      // heartbeat re-drives the repaint once the cooldown expires.
       return
     }
     // A flood window is open: the gate would SHED every call. Park in cooldown
     // and make ZERO api calls until it closes; the heartbeat re-drives.
     if (parkIfFloodWindowOpen(g)) {
-      if (isTerminal && opts2.terminalRecap != null) g.pendingFinalize = opts2.terminalRecap
       return
     }
 
     const body = renderGroupBody(g, now, opts2.terminalRecap ?? null, opts2.heartbeat ?? false)
     if (body == null) {
-      // Nothing to show. On a terminal finalize with no message ever posted,
-      // just drop the finished row (the handback carries the result).
-      if (isTerminal) settleTerminal()
+      // Nothing to show. On a terminal finalize the row is already dropped;
+      // clear the staged repaint (the handback carries the result).
+      if (isTerminal) clearStaged()
       return
     }
 
     // First paint: hold until some worker in the group has run long enough.
     if (g.messageId == null) {
-      const maxElapsed = Math.max(0, ...runningRows(g).map((r) => liveElapsed(r, now)))
       // A terminal recap for a group that never painted → nothing to finalize;
       // never first-paint a terminal card (trivial workers stay silent, the
       // handback carries the result — matches the pre-coalesce doFinish guard).
+      // The finished row is already dropped; just clear the staged repaint.
       if (isTerminal) {
-        settleTerminal()
+        clearStaged()
         return
       }
+      const maxElapsed = Math.max(0, ...runningRows(g).map((r) => liveElapsed(r, now)))
       if (maxElapsed < firstPaintMin) return
       try {
         const sent = await opts.bot.sendMessage(g.chatId, body, sendOptsFor(g))
@@ -775,6 +845,8 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         g.messageId = sent.message_id
         g.lastBody = body
         g.lastEditAt = now
+        // A fresh message is a live running paint, never a terminal recap.
+        g.terminalPainted = false
         // Group's first (or re-established) message is up → pin it for the group.
         syncPin(g)
         log(
@@ -790,7 +862,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
 
     // Dedup + proactive throttle (finish/terminal edits force through).
     if (body === g.lastBody) {
-      if (isTerminal) settleTerminal()
+      if (isTerminal) clearStaged()
       return
     }
     if (!opts2.force && now - g.lastEditAt < minEditInterval) return
@@ -803,7 +875,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       // The shed payload is NOT on screen, so do not record it as `lastBody`.
       if (isSendGateShed(res)) {
         parkIfFloodWindowOpen(g)
-        if (isTerminal && opts2.terminalRecap != null) g.pendingFinalize = opts2.terminalRecap
+        // Recap stays staged (above); row already dropped + unpinned.
         return
       }
       g.lastBody = body
@@ -811,7 +883,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       if (isTerminal) {
         log(
           `worker-feed: finish feed=${g.feedKey} chat=${g.chatId} thread=${g.threadId ?? '-'} ` +
-            `msgId=${g.messageId} agent=${opts2.finishingAgentId ?? '-'} ` +
+            `msgId=${g.messageId} agent=${finishingAgentId ?? '-'} ` +
             `state=${opts2.terminalRecap?.state ?? 'done'} bytes=${body.length}`,
         )
       } else {
@@ -820,34 +892,34 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
             `thread=${g.threadId ?? '-'} msgId=${g.messageId} workers=${g.workers.size} bytes=${body.length}`,
         )
       }
-      if (isTerminal) settleTerminal()
+      if (isTerminal) clearStaged()
     } catch (err) {
       const outcome = classifyEditError(err)
       if (outcome === 'rate_limited') {
         noteRateLimited(g, err, isTerminal ? 'finish' : 'edit')
-        if (isTerminal && opts2.terminalRecap != null) g.pendingFinalize = opts2.terminalRecap
+        // Recap stays staged; the heartbeat re-drives after the cooldown.
         return
       }
       if (outcome === 'not_modified') {
         g.lastBody = body
         g.lastEditAt = now
-        if (isTerminal) settleTerminal()
+        if (isTerminal) clearStaged()
         return
       }
       if (outcome === 'gone') {
         // Message/chat gone or edit window closed — no card to update. Drop the
         // stale message id; a fresh first-paint re-establishes one if workers
-        // are still live. On a terminal finalize, also drop the finished row.
+        // are still live. On a terminal finalize, clear the staged repaint.
         g.messageId = null
         g.lastBody = null
         // The pinned message no longer exists → release the group pin claim
-        // (settleTerminal already re-syncs on the terminal path).
-        if (isTerminal) settleTerminal()
+        // (clearStaged already re-syncs on the terminal path).
+        if (isTerminal) clearStaged()
         else syncPin(g)
         return
       }
       // 'transient' — leave the message intact; the heartbeat re-attempts.
-      if (isTerminal && opts2.terminalRecap != null) g.pendingFinalize = opts2.terminalRecap
+      // Recap stays staged for the terminal path.
       log(`worker-feed: edit transient error feed=${g.feedKey}: ${(err as Error).message}`)
     }
   }
@@ -945,13 +1017,27 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     // mutates the group's worker map), then terminate each through its chain so
     // the render/unpin happens under the normal cooldown/flood guards.
     const staleAgentIds: string[] = []
+    const staleFinished: Array<{ g: FeedGroup; agentId: string }> = []
     for (const g of groups.values()) {
       for (const row of g.workers.values()) {
-        if (!row.finished && now - row.lastUpdateAt >= staleWorkerTtlMs) {
-          staleAgentIds.push(row.agentId)
+        if (now - row.lastUpdateAt >= staleWorkerTtlMs) {
+          if (row.finished) staleFinished.push({ g, agentId: row.agentId })
+          else staleAgentIds.push(row.agentId)
         }
       }
     }
+    // GC any FINISHED row still lingering past the TTL (#3207: finished rows
+    // were exempt from the sweep — `if (!row.finished …)` — so a stuck finished
+    // row could keep a group, its message, and its pin alive forever). The
+    // normal finalize path drops the row immediately now, but reap directly
+    // here as a durable backstop: `terminate()` no-ops on a finished row, so
+    // remove it and release the pin without routing through it.
+    for (const { g, agentId } of staleFinished) {
+      log(`worker-feed: TTL GC finished row agent=${agentId} feed=${g.feedKey} — reaping leaked finished row`)
+      g.pendingFinalize.delete(agentId)
+      removeWorker(g, agentId)
+      syncPin(g)
+    }
     for (const agentId of staleAgentIds) {
       log(`worker-feed: TTL reap agent=${agentId} — no update in ${Math.floor((now - (groupOfAgent(agentId)?.workers.get(agentId)?.lastUpdateAt ?? now)) / 1000)}s (>= ${Math.floor(staleWorkerTtlMs / 1000)}s); force-terminating leaked row`)
       void terminateWorker(agentId)
@@ -960,15 +1046,19 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       // Deferred-finalize re-drive: a terminal edit that hit a cooldown/flood
       // window was staged on `pendingFinalize`. Re-drive it once the cooldown
       // expires so a finished feed can't get stuck on its last running render.
-      if (g.pendingFinalize != null && now >= g.cooldownUntil) {
-        const recap = g.pendingFinalize
-        // The finishing agent is whatever finished row remains (state terminal).
-        const finishingAgentId = [...g.workers.values()].find((w) => w.finished)?.agentId
-        g.chain = g.chain
-          .then(() => doRender(g, { force: true, terminalRecap: recap, finishingAgentId }))
-          .catch((err) => {
-            log(`worker-feed: heartbeat finalize re-drive error feed=${g.feedKey}: ${(err as Error).message}`)
-          })
+      if (g.pendingFinalize.size > 0 && now >= g.cooldownUntil) {
+        // Drain EVERY staged terminal recap, keyed by its finishing agent
+        // (#3207: the single `pendingFinalize` slot dropped all but one when
+        // multiple workers finished inside the same cooldown/flood window, so
+        // the earlier finished rows leaked). Each re-drive removes its own
+        // staged entry on success and reaps the group once fully empty.
+        for (const [agentId, recap] of [...g.pendingFinalize]) {
+          g.chain = g.chain
+            .then(() => doRender(g, { force: true, terminalRecap: recap, finishingAgentId: agentId }))
+            .catch((err) => {
+              log(`worker-feed: heartbeat finalize re-drive error feed=${g.feedKey}: ${(err as Error).message}`)
+            })
+        }
         continue
       }
 
@@ -1013,7 +1103,11 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     },
     hasRunningInFeed(feedKey) {
       const g = groups.get(feedKey)
-      return g != null && g.workers.size > 0
+      // Count only RUNNING (not-yet-finished) rows (#3207): a finished row
+      // lingering pre-sweep — or a group kept alive solely for a staged
+      // terminal repaint — is NOT running, so the gateway's `wk:group:` pin
+      // reaper must be free to unpin it.
+      return g != null && hasLiveWorker(g)
     },
     get size() {
       let n = 0
@@ -1043,10 +1137,26 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           cooldownUntil: 0,
           chain: Promise.resolve(),
           workers: new Map(),
-          pendingFinalize: null,
+          pendingFinalize: new Map(),
+          terminalPainted: false,
         }
         groups.set(feedKey, g)
       }
+      // Group-reuse-after-terminal (#3207): a later worker landing in a group
+      // whose shared message last rendered a TERMINAL recap (its prior workers
+      // all finished, but the group lingered — e.g. a staged repaint, or a
+      // finished row not yet swept) must NOT inherit that message id and edit
+      // the "done" card. Force a fresh first-paint (new message) so the new
+      // dispatch never appends to a stale terminal card. Only triggers when no
+      // live worker remains AND the group last went terminal.
+      if (!g.workers.has(agentId) && g.terminalPainted && !hasLiveWorker(g)) {
+        g.messageId = null
+        g.lastBody = null
+        g.pendingFinalize.clear()
+        g.terminalPainted = false
+        // The stale terminal message is no longer this group's pinned surface.
+        syncPin(g)
+      }
       let row = g.workers.get(agentId)
       if (row == null) {
         row = {