switchroom 0.18.23 → 0.18.25

package/telegram-plugin/gateway/gateway.ts

@@ -88,7 +88,7 @@ import {
   type TelegraphAccount,
 } from '../telegraph.js'
 import { OutboundDedupCache } from '../recent-outbound-dedup.js'
-import { FlushedTurnSupersedeRegistry } from '../flushed-turn-supersede.js'
+import { FlushedTurnSupersedeRegistry, DEFAULT_SUPERSEDE_TTL_MS } from '../flushed-turn-supersede.js'
 import { createInboundCoalescer, inboundCoalesceKey } from './inbound-coalesce.js'
 import {
   splitCoalescedAttachments,
@@ -243,7 +243,11 @@ import { isFinalAnswerReply, isSubstantiveFinalReply, FINAL_ANSWER_MIN_CHARS } f
 import { deriveTurnRole, decideTerminalReason, parsePostAnswerLivenessMs, evaluatePostAnswerLiveness, type LoopRole } from '../turn-liveness-floor.js'
 import { createAnswerStream, type AnswerStreamHandle } from '../answer-stream.js'
 import { parseVisibleAnswerStreamEnabled, resolveAnswerLaneConfig } from '../answer-stream-flag.js'
-import { type SessionEvent } from '../session-tail.js'
+import {
+  type SessionEvent,
+  projectTrailingAnswerFromTranscript,
+  getProjectsDirForCwd,
+} from '../session-tail.js'
 import {
   shouldSuppressToolActivity,
 } from '../pty-tail.js'
@@ -303,6 +307,7 @@ import {
   checkpointWal as checkpointHistoryWal,
   pruneMessagesOlderThanDays,
   hasOutboundDeliveredSince,
+  hasOutboundWithText,
 } from '../history.js'
 import {
   runRegistryReaper,
@@ -352,6 +357,7 @@ const REPLY_TO_TEXT_MAX = 200
 // tests exercise the real string — see PR #2892.
 import { splitMarkdownChunks, repairEscapedWhitespace, normalizeParagraphBreaks, addParagraphSpacers, normalizePunctuation, stripExcessBold, escapeMarkdown, hardenCardBreaks, RICH_MESSAGE_MAX_CHARS } from '../format.js'
 import { richMessage } from '../rich-send.js'
+import { decideRedeliver, decideRedeliverCapture } from './redelivery-decision.js'
 import { scrubVoice } from '../text-voice-scrub.js'
 import {
   normalizeOutboundBody,
@@ -400,7 +406,12 @@ import {
 import {
   decideTurnFlush,
   isTurnFlushSafetyEnabled,
+  FLUSH_SUBSTANTIVE_MIN_CHARS,
 } from '../turn-flush-safety.js'
+import {
+  resolveReplyOwnerTurnId,
+  decideAnswerLatchSuppression,
+} from '../reply-owner-resolve.js'
 // PR A — deterministic answer-ready quiescence flush (late-delivery fix).
 import {
   AnswerReadyFlushController,
@@ -828,7 +839,10 @@ import {
   findRecentTurnsForChat,
   getTurnByKey,
   markTurnResumed,
+  markAnswerRedelivered,
+  stampTurnSessionId,
   reapStaleOpenTurns,
+  type Turn,
 } from '../registry/turns-schema.js'
 import {
   buildResumeInterruptedInbound,
@@ -1689,6 +1703,13 @@ let turnsDb: ReturnType<typeof openTurnsDb> | null = null
 // Stashed here; pushed to the spool once it's constructed below. The spool's
 // turn_key-keyed dedup makes a re-stash across multiple restarts a no-op.
 let bootResumeInbound: { agent: string; msg: InboundMessage } | null = null
+// Crash-survival redelivery candidate, captured during the boot-resume block
+// (module init, BEFORE the Telegram client connects) and consumed by
+// `maybeRedeliverUndeliveredAnswer` in the one-time-setup block AFTER
+// `bot.api.getMe()` succeeds — so the framed recovered-answer send is sequenced
+// after the client is ready, never fired mid module-init. `null` when there is
+// no interrupted turn to consider.
+let pendingRedelivery: { turn: Turn; maxAgeMs: number } | null = null
 // #3038 cross-boot damper: consecutive bridge-dead escalations by PRIOR
 // boots (the consumed marker's `count`; 0 when no fresh marker). Set in
 // the boot block below, consumed by the watchdog constructor further down.
@@ -1823,6 +1844,50 @@ try {
       maxAgeMs: RESUME_MAX_AGE_MS,
     })
 
+    // Crash-survival redelivery (deterministic, zero-token): capture THIS
+    // interrupted turn as a redelivery candidate. The actual re-project + framed
+    // send happens later, AFTER the Telegram client connects (see
+    // `maybeRedeliverUndeliveredAnswer`, fired from the one-time-setup block).
+    // Gated on the same `pending` as the resume synthetic but a SEPARATE concern:
+    // resume re-runs the model on unfinished work; redelivery just re-sends the
+    // finished answer the model already produced and the crash swallowed.
+    //
+    // MUTUAL EXCLUSION with resume (double-send guard): redelivery is captured
+    // ONLY when this turn will NOT be re-run by the resume path — i.e.
+    // `bootResumeKind !== 'resume'`. When the kind IS 'resume', the model re-runs
+    // the interrupted work and emits a FRESH answer that supersedes the recovered
+    // draft; redelivering as well would send the same answer twice (once framed
+    // "Recovered from an interrupted turn:", once fresh). The other kinds do NOT
+    // auto-re-answer, so redelivery is the correct (and only) send there:
+    //   - 'report'          (watchdog-timeout): synthetic only ASKS retry — no auto re-answer
+    //   - 'defer-suppressed' (boot_resume: never): no synthetic re-run at all
+    //   - 'defer-loop'       (resume-of-a-resume guard): no re-run
+    //   - 'none'             (nothing queued): redelivery is the sole recovery
+    // This gate is deterministic in code, not prompt-dependent.
+    //
+    // Eligibility floor: only a turn with a durably-stamped `session_id` (pinned
+    // live via the session-event path) qualifies — without it we cannot resolve
+    // the EXACT transcript, and a most-recent-mtime heuristic could shadow a
+    // fresh boot session's file. The mutual-exclusion-with-resume rule and this
+    // floor live together in the pure `decideRedeliverCapture` predicate.
+    const redeliverCapture = decideRedeliverCapture({
+      willBeResumed: bootResumeKind === 'resume',
+      hasSessionId: Boolean(pending.session_id),
+    })
+    if (redeliverCapture.capture) {
+      pendingRedelivery = { turn: pending, maxAgeMs: RESUME_MAX_AGE_MS }
+    } else if (redeliverCapture.skipReason === 'will-be-resumed') {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery suppressed — interrupted turnKey=${pending.turn_key} will be ` +
+        `RESUMED (bootResumeKind=resume); the fresh re-answer supersedes the recovered draft (no double-send)\n`,
+      )
+    } else {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery skipped — interrupted turnKey=${pending.turn_key} has no ` +
+        `pinned session_id (pre-feature turn or no session event seen); cannot resolve exact transcript\n`,
+      )
+    }
+
     // Sub-agents that were still in flight (running / stalled — non-terminal)
     // when the turn was killed. Read HERE, at module top, BEFORE the
     // subagent-watcher's boot scan + reaper run: the watcher never deletes
@@ -2036,6 +2101,40 @@ const WORKER_FEED_FALLBACK_LOG_CAP = 256
  * slot, never a live-but-quiet worker. 5 min.
  */
 const WORKER_FEED_STALE_TTL_MARGIN_MS = 5 * 60_000
+/**
+ * Multiple of the watcher's in-flight terminal cap used to derive the worker-
+ * feed ABSOLUTE row-lifetime cap (`absoluteRowLifetimeCapMs`). Unlike the
+ * silence-keyed `staleWorkerTtlMs` backstop, the absolute cap is anchored to a
+ * row's immutable creation time, so it reaps an immortal card even when the row
+ * keeps receiving `update()` cues that reset `lastUpdateAt` every heartbeat
+ * (the Carrie 5h zombie-pin leak, re-edited 3000+ times, that the silence sweep
+ * could never match). At the 45-min default cap this yields a 3-hour absolute
+ * ceiling — comfortably above any legitimate single worker's lifetime, so it
+ * can only ever bite a genuine leak, while bounding a ghost card well UNDER the
+ * ~5h symptom Ken hit (the initial 8x/6h was too loose). Derived from the same
+ * base as `staleWorkerTtlMs` — the watcher's effective in-flight terminal cap
+ * (`resolveInflightTerminalCapMs()`: the `SWITCHROOM_SUBAGENT_INFLIGHT_TERMINAL_
+ * CAP_MS` env override, else the 45-min default) — never a bare magic number, so
+ * it tracks the env-level terminal-cap override in lockstep with the silence
+ * backstop. (Both this and `staleWorkerTtlMs` call `resolveInflightTerminalCapMs()`
+ * with NO arg, matching the watcher's OWN effective value here: the gateway does
+ * not pass a config-file `inflightTerminalCapMs` to `startSubagentWatcher`, so
+ * there is no config-file override to thread through — env + default is the
+ * complete override surface on this path.)
+ */
+const WORKER_FEED_ABSOLUTE_ROW_LIFETIME_CAP_MULTIPLE = 4
+/**
+ * ABSOLUTE reused-group-MESSAGE lifetime cap (invisible-worker-cards fix,
+ * 2026-07-15). Bounds how long the shared worker-feed message is reused before
+ * it is force-rotated to a fresh message, re-establishing the pin surface so a
+ * card whose pin was lost out-of-band (and whose in-memory claim went stale)
+ * cannot stay scroll-buried indefinitely. Conservative default 60 min; env
+ * `SWITCHROOM_WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS` overrides for tuning.
+ */
+const WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS = (() => {
+  const v = Number(process.env.SWITCHROOM_WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS)
+  return Number.isFinite(v) && v > 0 ? v : 60 * 60_000
+})()
 const workerFeedOwnerDmFallbackLogged = new Set<string>()
 
 /**
@@ -2950,6 +3049,10 @@ const PENDING_CMD_DRAIN_CAP_MS = 60_000
 // forwarded by the bridge on every session_event — we read occupancy from
 // exactly that file (never an independent findActiveSessionFile re-scan).
 let lastSessionActiveFile: string | null = null
+// Crash-survival redelivery (#session-id pin): the last turn_key whose
+// `session_id` we durably stamped, so the hot session-event path stamps once
+// per turn instead of issuing a guarded UPDATE on every event.
+let lastSessionStampedTurnKey: string | null = null
 // Anti-spam state machine lives in ./proactive-compact (pure, unit
 // tested). `compactDispatching` is a synchronous re-entrancy guard for
 // the async tmux send — purgeReactionTracking can run several times per
@@ -3104,6 +3207,27 @@ type CurrentTurn = {
   // false ONLY at turn start, mirroring `activityEverOpened`'s sticky-true
   // contract.
   finalAnswerEverDelivered: boolean
+  // 2026-07 double-reply-on-DM fix (Part 2 — race backstop). Set true
+  // SYNCHRONOUSLY at turn-flush FIRE time (before the ~500 ms async send and
+  // before `flushedTurnSupersede.record`) when the flush delivers a SUBSTANTIVE
+  // (≥`FLUSH_SUBSTANTIVE_MIN_CHARS`) terminal answer, and also set when a
+  // substantive `reply` sends. It persists on the ended turn in
+  // `recentTurnsById`, so a LATE reply landing in the flush's post-fire
+  // pre-record race window (where `flushedTurnSupersede` finds no record to
+  // delete yet) resolves this turn via the unified owner resolver, sees the
+  // latch already set, and suppresses itself — closing the residual window Part
+  // 1's supersede cannot reach. Scoped to the substantive floor so an interim
+  // sub-floor ack NEITHER sets nor trips it. Reset false at turn start.
+  answerDelivered: boolean
+  // 2026-07 double-reply-on-DM fix (F2 — recency bound). Wall-clock ms the turn
+  // ENDED (stamped once by `endCurrentTurnAtomic`), or null while still live.
+  // The `findLatestEndedTurnForChat` supersede tier carries DESTRUCTIVE
+  // authority (it drives message deletion), so `resolveReplyOwnerTurn` only
+  // honours a latest-ended turn whose `endedAt` is within the supersede TTL —
+  // otherwise a late reply belonging to an OLDER turn could resolve its owner to
+  // a NEWER turn sitting at the registry tail and delete that newer turn's legit
+  // answer. Unbounded routing use of `findLatestEndedTurnForChat` is unaffected.
+  endedAt: number | null
   // #1675 (over-ping safety net): wall-clock ms of the first reply
   // this turn that landed with `disable_notification: false` (a real
   // device ping). The conversational-pacing contract
@@ -3198,6 +3322,21 @@ type CurrentTurn = {
   // sync_retain are suppressed at the hook (computeLabel returns null) and
   // never arrive as tool_label events — excluded automatically.
   labeledToolCount: number
+  // Running total of the PARENT agent's OWN token usage this turn, summed from
+  // the main-tier session-tail `usage` events (input + output + cache_creation
+  // per assistant message, via sumUsageTokens; cache_read is excluded —
+  // replayed cached context, not new work). Rendered on the
+  // 🤖 turn-activity card's metrics line (`… · N tok · model`). This is the
+  // parent alone — sub-agent tokens are NOT folded in here (they report on
+  // their own worker-feed rows; summing them would double-count). 0 until the
+  // turn's first assistant line carries a usage block.
+  totalTokens: number
+  // Dedup guard for `totalTokens`: Claude Code persists one logical assistant
+  // message as MULTIPLE JSONL lines sharing one `message.id`, each stamped with
+  // the SAME `usage` block. We fold a given `message.id` exactly once (same
+  // idempotency as the sub-agent watcher's `seenUsageMessageIds`). A null/absent
+  // messageId is un-dedupable and always counted.
+  seenUsageMessageIds: Set<string>
   // Tool-activity summary — mirrors Claude Code's native chat-UI
   // rendering ("Ran 5 commands, read a file"). Counters are
   // incremented in `case 'tool_use'`; `activityMessageId` holds the
@@ -3608,6 +3747,55 @@ function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
   return latest
 }
 
+/**
+ * 2026-07 double-reply-on-DM fix (Part 1). Resolve the turn that OWNS a landing
+ * reply using the SAME full chain the thread-router uses, so the supersede
+ * resolver can never again diverge from routing (the exact bug: supersede
+ * omitted the quoted-message and latest-ended recoveries, so a DM late reply —
+ * no live turn, no `origin_turn_id` — resolved to a null owner and its flush
+ * message was never superseded → duplicate).
+ *
+ * Precedence (first non-null wins), delegated to the pure
+ * `resolveReplyOwnerTurnId` so the exact precedence is unit-tested:
+ *   1. the live `currentTurn` passed in (null once the flush nulled the atom);
+ *   2. `findTurnByOriginId(origin_turn_id)` — the model echo;
+ *   3. `findTurnByQuotedMessageId(chat_id, reply_to)` — framework-owned quote;
+ *   4. `findLatestEndedTurnForChat(chat_id)` — the chat's last-ended turn.
+ * Returns the CurrentTurn for the winning id (so callers can read its
+ * `answerDelivered` latch), or null when every lookup missed.
+ */
+function resolveReplyOwnerTurn(
+  liveTurn: CurrentTurn | null,
+  chatId: string,
+  args: Record<string, unknown>,
+): CurrentTurn | null {
+  const origin = findTurnByOriginId(args.origin_turn_id as string | undefined)
+  const quoted = findTurnByQuotedMessageId(chatId, args.reply_to)
+  const latestEnded = findLatestEndedTurnForChat(chatId)
+  const byId = new Map<string, CurrentTurn>()
+  // Populate lowest-precedence first so a higher tier's turn wins the id slot
+  // when two lookups resolve the same turn (they carry the same turnId anyway).
+  for (const t of [latestEnded, quoted, origin, liveTurn]) {
+    if (t != null) byId.set(t.turnId, t)
+  }
+  // F2 — bound the DESTRUCTIVE latest-ended tier to the supersede TTL so a stale
+  // latest-ended turn can't inherit deletion authority over a newer turn's flush
+  // record. `endedAt` is null only for a turn still resolvable but not yet ended
+  // (not a supersede risk); leave the age unset then (unbounded) rather than
+  // fabricate one.
+  const latestEndedAgeMs =
+    latestEnded?.endedAt != null ? Date.now() - latestEnded.endedAt : null
+  const winnerId = resolveReplyOwnerTurnId({
+    liveTurnId: liveTurn?.turnId ?? null,
+    originTurnId: origin?.turnId ?? null,
+    quotedTurnId: quoted?.turnId ?? null,
+    latestEndedTurnId: latestEnded?.turnId ?? null,
+    latestEndedAgeMs,
+    latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
+  })
+  return winnerId != null ? (byId.get(winnerId) ?? null) : null
+}
+
 /**
  * Resolve the answer-reply thread AND emit `reply-route` telemetry. The
  * 2026-06-05 triage showed reply routing was the blind spot: `reply: invoked`
@@ -4842,6 +5030,12 @@ function endCurrentTurnAtomic(
   // the turn got), plus a DEGRADED warning when the turn did tool work but the
   // live feed never opened because its sends failed (the resume-400 signature).
   const turnEndedAt = Date.now()
+  // 2026-07 double-reply-on-DM fix (F2) — stamp the turn's end time so the
+  // `findLatestEndedTurnForChat` supersede tier can be recency-bounded to the
+  // supersede TTL (a stale latest-ended turn must not inherit deletion
+  // authority over a newer turn's flush record). Set once; idempotent on the
+  // deferRecord flush path (which calls this synchronously before its send).
+  turn.endedAt = turnEndedAt
   process.stderr.write(
     `telegram gateway: ${formatTurnLifecycle('clear', 'turn_end', turn, turnEndedAt)}\n`,
   )
@@ -8855,6 +9049,14 @@ async function reconcileStatusPinInner(
 ): Promise<void> {
   if (!PIN_STATUS_WHILE_WORKING) return
   if (chatId.length === 0) return
+  // NOTE (invisible-worker-cards review, intentionally left): this reconcile is
+  // NOT serialized per pinKey — it snapshots `prev` then awaits. Two edits that
+  // fire `syncPin` in the same microtask window after a dropped claim can both
+  // read `prev=null` and both issue a `pinChatMessage` for the SAME id. That is
+  // benign and self-healing: re-pinning an already-pinned id is idempotent on
+  // Telegram, and the first reconcile to set the claim makes every subsequent
+  // edit a no-op — it converges in one round, never a storm. A per-key mutex
+  // would remove the duplicate pin but adds lock complexity for zero UX gain.
   const prev = statusPinState.get(pinKey) ?? null
 
   const runReconcile = () =>
@@ -10355,6 +10557,150 @@ async function deliverCapturedProse(args: {
   }
 }
 
+/**
+ * Crash-survival redelivery — the LIVE boot send (deterministic, zero model
+ * tokens). Consumes the `pendingRedelivery` candidate captured during module
+ * init and, if the interrupted turn's finished answer never reached the user,
+ * re-projects it from the durable transcript and sends it FRAMED as a recovered
+ * draft.
+ *
+ * ── Ordering guarantee (why this is NOT called during module init) ───────────
+ * The Telegram raw send (`bot.api.sendRichMessage`) requires a CONNECTED client.
+ * The boot-resume block that computes `pendingRedelivery` runs at module top,
+ * BEFORE `bot.api.getMe()` and the grammy runner start — sending there would
+ * fire against an unconnected client (or block the connect). So the candidate is
+ * only STASHED at module init; this function is invoked exactly once from the
+ * `didOneTimeSetup` block AFTER `getMe()` resolves — i.e. after the client is
+ * connected and ready. This sequencing is a code-path guarantee, not prompt
+ * discipline: the call site is unreachable until the poll loop has authenticated.
+ *
+ * ── Invariants honored ──────────────────────────────────────────────────────
+ * - at-most-once per interruption: the durable text-identity oracle
+ *   (`hasOutboundWithText`, scoped to this turn's `started_at`) skips when the
+ *   answer already went out, and `markAnswerRedelivered` is stamped SYNCHRONOUSLY
+ *   after the send resolves (first-write-wins). The send also writes its own
+ *   `role='assistant'` history row, so a re-restart before the marker commits is
+ *   still caught by the oracle (residual send→row race documented on the marker).
+ * - RESUME_MAX_AGE_MS (3h) staleness, empty-text, trailing-not-text, and
+ *   already-delivered/already-redelivered are all enforced by `decideRedeliver`.
+ * - isApiErrorMessage lines are suppressed at the projector (never resurfaced).
+ * - only trailing TEXT after the last tool_use is redelivered (mid-tool preamble
+ *   is refused by `trailingIsText`).
+ */
+async function maybeRedeliverUndeliveredAnswer(): Promise<void> {
+  const candidate = pendingRedelivery
+  pendingRedelivery = null // consume once, regardless of outcome
+  if (candidate == null || turnsDb == null) return
+  const { turn, maxAgeMs } = candidate
+  const sessionId = turn.session_id
+  if (!sessionId) return
+
+  // Resolve the EXACT transcript from the pinned session id (never a
+  // most-recent-mtime scan, which a fresh boot session's file could shadow).
+  let transcriptText: string
+  try {
+    const projectsDir = getProjectsDirForCwd()
+    const path = join(projectsDir, `${sessionId}.jsonl`)
+    if (!existsSync(path)) {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery — transcript not found for turnKey=${turn.turn_key} ` +
+        `session=${sessionId} (${path}); skipping\n`,
+      )
+      return
+    }
+    transcriptText = readFileSync(path, 'utf8')
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: crash-redelivery — transcript read failed turnKey=${turn.turn_key}: ${(err as Error).message}\n`,
+    )
+    return
+  }
+
+  const projected = projectTrailingAnswerFromTranscript(transcriptText)
+  const threadIdNum =
+    turn.thread_id != null && turn.thread_id !== '' ? Number(turn.thread_id) : undefined
+  const threadIdForOracle: number | null = threadIdNum != null && Number.isFinite(threadIdNum) ? threadIdNum : null
+
+  const decision = decideRedeliver({
+    capturedText: projected.text,
+    trailingIsText: projected.trailingIsText,
+    // Durable text-identity oracle, scoped to THIS turn's window (`started_at`)
+    // so an unrelated earlier turn's message can never false-positive-suppress.
+    hasDeliveredText: HISTORY_ENABLED
+      ? hasOutboundWithText(turn.chat_id, projected.text, threadIdForOracle, turn.started_at)
+      : false,
+    alreadyRedelivered: turn.answer_redelivered_at != null,
+    ageMs: Math.max(0, Date.now() - turn.started_at),
+    maxAgeMs,
+  })
+
+  if (!decision.redeliver || decision.framedText == null) {
+    process.stderr.write(
+      `telegram gateway: crash-redelivery skipped turnKey=${turn.turn_key} reason=${decision.skipReason ?? 'unknown'}\n`,
+    )
+    return
+  }
+
+  const chatId = turn.chat_id
+  const out = redactOutboundText(decision.framedText, 'crash_redelivery')
+  const chunks = splitMarkdownChunks(out, RICH_MESSAGE_MAX_CHARS)
+  const sentIds: number[] = []
+  try {
+    let liveThreadId: number | undefined = threadIdNum != null && Number.isFinite(threadIdNum) ? threadIdNum : undefined
+    for (const c of chunks) {
+      const sent = await retryWithThreadFallback(
+        robustApiCall,
+        (tid) => {
+          // Built as a variable (not an inline literal) so excess-property
+          // checks don't reject `link_preview_options` on sendRichMessage's
+          // narrow Other<> type — mirrors the captured-prose / turn-flush sites.
+          const opts = {
+            link_preview_options: { is_disabled: true },
+            ...(tid != null ? { message_thread_id: tid } : {}),
+          }
+          return bot.api.sendRichMessage(chatId, richMessage(c), opts)
+        },
+        { threadId: liveThreadId, chat_id: chatId, verb: 'crash-redelivery.sendMessage' },
+      )
+      if (liveThreadId != null && (sent as { message_thread_id?: number }).message_thread_id == null) {
+        liveThreadId = undefined
+      }
+      sentIds.push(sent.message_id)
+    }
+    // Record the send as a real assistant delivery so the durable oracle catches
+    // a duplicate if we crash before the marker commits (self-idempotent).
+    if (HISTORY_ENABLED && sentIds.length > 0) {
+      try {
+        recordOutbound({
+          chat_id: chatId,
+          thread_id: threadIdForOracle,
+          message_ids: sentIds,
+          texts: chunks,
+        })
+      } catch {}
+    }
+    // Stamp the at-most-once marker SYNCHRONOUSLY after the send resolves.
+    try {
+      markAnswerRedelivered(turnsDb, turn.turn_key)
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery markAnswerRedelivered failed turnKey=${turn.turn_key}: ${(err as Error).message}\n`,
+      )
+    }
+    process.stderr.write(
+      `telegram gateway: crash-redelivery — delivered recovered answer (${out.length} chars, ` +
+      `${chunks.length} chunk(s)) for turnKey=${turn.turn_key} chat=${chatId}\n`,
+    )
+  } catch (err) {
+    // Send failed — leave the marker UNSTAMPED so a later restart retries rather
+    // than silently dropping the recovered answer.
+    process.stderr.write(
+      `telegram gateway: crash-redelivery send failed turnKey=${turn.turn_key}: ${(err as Error).message} ` +
+      `— left un-stamped for a later retry\n`,
+    )
+  }
+}
+
 function obligationSweep(): void {
   if (!OBLIGATION_LEDGER_ENABLED) return
   if (!obligationLedger.hasOpen()) return
@@ -11108,6 +11454,29 @@ const ipcServer: IpcServer = createIpcServer({
     // Track the session-tail's attached file for the proactive-
     // compaction occupancy read (see maybeProactiveCompact).
     if (msg.activeFile) lastSessionActiveFile = msg.activeFile
+    // Crash-survival redelivery: durably pin the claude session id onto the
+    // current turn's row the first time we see a session event for it, WHILE
+    // the turn is live (so a later crash preserves it). Boot redelivery then
+    // resolves the EXACT `<sessionId>.jsonl` for the interrupted turn rather
+    // than a most-recent-mtime heuristic that a fresh boot session shadows.
+    // First-write-wins in SQL (`session_id IS NULL`); the in-memory guard just
+    // avoids a redundant UPDATE on every event of the same turn.
+    if (turnsDb != null && msg.activeFile != null) {
+      const stampKey = currentTurn?.registryKey ?? null
+      if (stampKey != null && stampKey !== lastSessionStampedTurnKey) {
+        const sessionId = basename(msg.activeFile).replace(/\.jsonl$/, '')
+        if (sessionId) {
+          try {
+            stampTurnSessionId(turnsDb, stampKey, sessionId)
+            lastSessionStampedTurnKey = stampKey
+          } catch (err) {
+            process.stderr.write(
+              `telegram gateway: stampTurnSessionId failed turnKey=${stampKey}: ${(err as Error).message}\n`,
+            )
+          }
+        }
+      }
+    }
     const ev = msg.event as unknown as SessionEvent
     // #1122/#1126: session events used to be ingested into the pinned progress
     // card here (`progressDriver.ingest`). The card is retired and the driver
@@ -12925,17 +13294,21 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   // so a fresh turn's answer is never clobbered.
   {
     const replyThreadId = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-    // Resolve the turnId this reply belongs to by IDENTITY, not just the live
-    // `currentTurn`. A late reply lands with `currentTurn == null` (silence poke
-    // cleared it — Bug D) or with a transiently-cleared currentTurn while its own
-    // turn is really still the owner (LOW-1); in both cases the turn is still
-    // resolvable from the `origin_turn_id` nonce the model echoes back (Tier 2 —
-    // the same last-known-turn resolver the chat-routing / obligation code uses).
-    // Passing this resolved turnId means supersede matches the flushed record by
-    // identity instead of falling back to a null-liveTurnId branch that would
-    // otherwise be free to delete a DIFFERENT turn's legitimate message.
-    const resolvedTurnId =
-      turn?.turnId ?? findTurnByOriginId(args.origin_turn_id as string | undefined)?.turnId ?? null
+    // 2026-07 double-reply-on-DM fix (Part 1) — resolve the turn this reply
+    // belongs to by IDENTITY, via the SAME full chain the thread-router uses
+    // (`resolveReplyOwnerTurn`): live `currentTurn`, then the model-echoed
+    // `origin_turn_id`, then the framework-owned quoted message id, then the
+    // chat's most-recently-ended turn. The prior chain stopped at
+    // `currentTurn ?? findTurnByOriginId`, so a DM late reply — `currentTurn`
+    // nulled by the flush's synthetic turn_end AND no `origin_turn_id` (a
+    // supergroup-only field) — resolved to a null owner. `decideSupersede`
+    // deliberately never lets a null live turn supersede a turnId-bearing flush
+    // record, so message A survived AND the reply shipped message B (the exact
+    // double-send). The quoted / latest-ended recoveries are precisely what the
+    // router already did for the same reply, so unifying here makes the two
+    // resolvers agree and the late-reply supersede fires by identity.
+    const ownerTurn = resolveReplyOwnerTurn(turn, chat_id, args)
+    const resolvedTurnId = ownerTurn?.turnId ?? null
     const decision = flushedTurnSupersede.take(
       chat_id,
       replyThreadId,
@@ -12952,6 +13325,46 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
           { chat_id, verb: 'reply.supersedeFlushed' },
         )
       }
+    } else {
+      // 2026-07 double-reply-on-DM fix (Part 2) — answer-delivered race latch.
+      // Supersede found no record. Either there was no flush (normal reply), or
+      // the flush FIRED but has not yet recorded its message ids (the residual
+      // pre-record race Part 1's supersede cannot reach). The flush sets
+      // `answerDelivered = true` synchronously at fire time (before its async
+      // send AND before `record`), and it persists on the ended turn — so when
+      // this LATE, substantive reply resolves its owner turn and sees the latch
+      // already set, the flush's message A is already on its way out and this
+      // reply would ship a duplicate. Suppress it. Scoped to the substantive
+      // ≥`FLUSH_SUBSTANTIVE_MIN_CHARS` floor and the late-reply case so an
+      // interim sub-floor ack, a chunked multi-part answer, or a legitimate
+      // second in-turn substantive reply (live `currentTurn`) is never
+      // suppressed. `isSubstantiveFinalReply` reduces to the ≥200-char test on
+      // the `reply` path (no `done`); pass the model's original notification
+      // intent to mirror the #2533 decoupling call shape.
+      const replySubstantive = isSubstantiveFinalReply({
+        text: rawText,
+        disableNotification: args.disable_notification === true,
+      })
+      const suppressByLatch = decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive,
+        isLateReply: turn == null,
+        ownerAnswerDelivered: ownerTurn?.answerDelivered ?? false,
+      })
+      if (suppressByLatch) {
+        process.stderr.write(
+          `telegram gateway: reply: suppressed by answer-delivered latch ` +
+          `(flush already delivered this turn's answer) chatId=${chat_id} ` +
+          `ownerTurnId=${JSON.stringify(resolvedTurnId)}\n`,
+        )
+        return { content: [{ type: 'text', text: 'sent (deduped — answer already delivered via turn-flush)' }] }
+      }
+      // A substantive answer is going out via this reply — set the latch on its
+      // owner turn so a later bridge-replayed / reworded duplicate of the same
+      // answer is caught by the branch above.
+      if (replySubstantive && ownerTurn != null) {
+        ownerTurn.answerDelivered = true
+      }
     }
   }
 
@@ -15848,6 +16261,9 @@ function composeTurnActivity(turn: CurrentTurn, final = false, liveSuffix = ''):
     toolCount: turn.labeledToolCount,
     state: final ? 'done' : 'running',
     model: turn.currentModel,
+    // The parent's OWN running token total → `· N tok` on the metrics line.
+    // 0 → tokenSegment omits it (clean, same as the worker feed).
+    totalTokens: turn.totalTokens,
   }
   return renderActivityFeedWithNested(turn.mirrorLines, childLines, final, liveSuffix, stepCount, header)
 }
@@ -16880,6 +17296,11 @@ function handleSessionEvent(ev: SessionEvent): void {
           finalAnswerSubstantive: false,
           // Sticky latch — reset ONLY here (turn start), never by reopen.
           finalAnswerEverDelivered: false,
+          // 2026-07 double-reply-on-DM fix (Part 2) — answer-delivered race
+          // latch, reset at turn start alongside the other answer flags.
+          answerDelivered: false,
+          // 2026-07 double-reply-on-DM fix (F2) — stamped at turn end.
+          endedAt: null,
           firstPingAt: null,
           // Notification ownership (R8 / PR-2): no slot claimed yet, so the
           // "claimer was substantive" flag starts false. Set atomically with
@@ -16900,6 +17321,8 @@ function handleSessionEvent(ev: SessionEvent): void {
           lastAssistantDone: false,
           toolCallCount: 0,
           labeledToolCount: 0,
+          totalTokens: 0,
+          seenUsageMessageIds: new Set<string>(),
           activityMessageId: null,
           activityInFlight: null,
           activityPendingRender: null,
@@ -17081,6 +17504,22 @@ function handleSessionEvent(ev: SessionEvent): void {
       sessionModelSource.noteTranscriptModel(ev.model)
       return
     }
+    case 'usage': {
+      // Fold the parent agent's OWN per-message token usage into the turn's
+      // running total, deduped by message.id (one logical assistant message can
+      // land as several JSONL lines sharing one id + usage block). Rendered on
+      // the 🤖 turn-activity card's metrics line. Sub-agent tokens are NOT
+      // folded here — they surface on their own worker-feed rows; summing them
+      // would double-count. A null messageId is un-dedupable → always counted.
+      const turn = currentTurn
+      if (turn == null) return
+      if (ev.messageId != null) {
+        if (turn.seenUsageMessageIds.has(ev.messageId)) return
+        turn.seenUsageMessageIds.add(ev.messageId)
+      }
+      turn.totalTokens += ev.totalTokens
+      return
+    }
     case 'thinking': {
       // #1067: snapshot the turn atom at handler entry. Even though this
       // handler is sync, the principle is uniform across all event arms
@@ -18113,6 +18552,20 @@ function handleSessionEvent(ev: SessionEvent): void {
         // the silent-end re-prompt. (Belt-and-braces, like the set above —
         // this branch returns before any further tool_label can arrive.)
         turn.finalAnswerSubstantive = true
+        // 2026-07 double-reply-on-DM fix (Part 2) — arm the answer-delivered
+        // race latch NOW, synchronously, BEFORE the ~500 ms async send below and
+        // BEFORE `flushedTurnSupersede.record`. A late reply that lands in the
+        // post-fire pre-record window resolves this turn (via the unified owner
+        // resolver, reading the atom preserved in `recentTurnsById`) and
+        // suppresses itself against this latch — closing the residual race Part
+        // 1's supersede cannot reach. Scoped to a SUBSTANTIVE terminal answer
+        // (the same ≥`FLUSH_SUBSTANTIVE_MIN_CHARS` floor the codebase uses to
+        // recognise a real answer) so a short flush never latches against a
+        // legitimate substantive reply. `capturedText` here is the selected,
+        // normalized flush delivery text.
+        if (capturedText.trim().length >= FLUSH_SUBSTANTIVE_MIN_CHARS) {
+          turn.answerDelivered = true
+        }
 
         // #654 deterministic double-message fix. Hand off the pinned
         // progress card BEFORE state reset so the driver doesn't keep
@@ -18352,6 +18805,22 @@ function handleSessionEvent(ev: SessionEvent): void {
           } catch (err) {
             sendThrew = true
             process.stderr.write(`telegram gateway: turn-flush send failed: ${(err as Error).message}\n`)
+            // 2026-07 double-reply-on-DM fix (F1) — the flush armed
+            // `answerDelivered` synchronously at FIRE time, but the send just
+            // FAILED. When nothing was delivered the supersede record was NOT
+            // written (gated on `sentIds.length > 0` above), so Part 1 can never
+            // fire for this turn — leaving the latch armed would make a genuine
+            // late reply suppress itself and the user would get ZERO messages
+            // (silent answer loss; on main that path still delivers the reply).
+            // Reset the latch so the late reply is NOT suppressed. On a PARTIAL
+            // send (sentIds > 0) the record WAS written, so Part 1's supersede
+            // deletes the partial message A and the reply delivers cleanly —
+            // resetting here is harmless in that case too.
+            // FOLLOW-UP (coordinator to file an issue): a reply suppressed
+            // synchronously DURING the in-flight send that then fails is not
+            // fully closable with a boolean latch — a residual micro-window the
+            // supersede+latch pair cannot eliminate. Not addressed in this PR.
+            turn.answerDelivered = false
             // #1713: backstop send failed — finalize as error so the
             // turn ends cleanly with 😱 rather than leaving it open.
             if (backstopCtrl) backstopCtrl.finalize('error')
@@ -29659,6 +30128,19 @@ void (async () => {
           )
         }
 
+        // Crash-survival redelivery — LIVE boot send. Now that `bot.api.getMe()`
+        // has resolved (the Telegram client is connected and authenticated), it
+        // is safe to fire the framed recovered-answer send for an interrupted
+        // turn whose finished answer the crash swallowed. Fire-and-forget: it is
+        // self-contained, must not block the rest of one-time setup, and is a
+        // no-op when there is no eligible candidate. See
+        // `maybeRedeliverUndeliveredAnswer` for the ordering guarantee + invariants.
+        void maybeRedeliverUndeliveredAnswer().catch((err) => {
+          process.stderr.write(
+            `telegram gateway: crash-redelivery boot send errored: ${(err as Error).message}\n`,
+          )
+        })
+
         // Boot-time pin sweep
         try {
           const bootAccess = loadAccess()
@@ -30102,7 +30584,16 @@ void (async () => {
             // or the turn ended while it kept running — extended autonomous
             // work) is surfaced via the worker feed instead of vanishing.
             const orphanStatusEnabled = isOrphanSubagentStatusEnabled(process.env.SWITCHROOM_ORPHAN_SUBAGENT_STATUS)
-            workerActivityFeed?.stop()
+            // Boot/reconnect purge (Ken, PR #3239 review): every row in the
+            // OUTGOING feed is a dead child sub-agent, and its `wk:group:` pins
+            // would otherwise be orphaned — the replacement feed is empty and
+            // never knew those groups, so it can never unpin them, and no full-
+            // boot pin sweep runs on a bare bridge reconnect. Reconcile the old
+            // feed to empty and release all its group pins BEFORE stopping it.
+            if (workerActivityFeed != null) {
+              workerActivityFeed.purgeAllOnBoot()
+              workerActivityFeed.stop()
+            }
             workerActivityFeed = createWorkerActivityFeed({
               // #2669: worker-feed body is raw GFM markdown — send via rich.
               bot: {
@@ -30167,6 +30658,18 @@ void (async () => {
               // force-collapsing a row the terminal signals somehow never
               // removed.
               staleWorkerTtlMs: resolveInflightTerminalCapMs() + WORKER_FEED_STALE_TTL_MARGIN_MS,
+              // ABSOLUTE row-lifetime cap — anchored to a row's creation, immune
+              // to the `lastUpdateAt` reset that lets an immortal-but-updating
+              // row dodge `staleWorkerTtlMs` forever (Carrie 5h zombie pin).
+              // Derived from the same terminal cap so it tracks operator
+              // overrides; 4× → ~3h at the 45-min default.
+              absoluteRowLifetimeCapMs: resolveInflightTerminalCapMs() * WORKER_FEED_ABSOLUTE_ROW_LIFETIME_CAP_MULTIPLE,
+              // ABSOLUTE reused-group-MESSAGE lifetime cap (invisible-worker-
+              // cards fix): force-rotate the shared message past this age while
+              // workers overlap continuously, so a card that lost its pin
+              // out-of-band re-establishes the pin surface via the first-paint
+              // path instead of living buried on one immortal message.
+              groupMessageLifetimeCapMs: WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS,
               // #3207 review: GROUP-level status pin. Workers now coalesce into
               // ONE shared message, so the pin must follow the GROUP lifecycle,
               // not a single worker's — otherwise a sibling's finish unpins a
@@ -30349,7 +30852,7 @@ void (async () => {
                   )
                 }
               },
-              onFinish: ({ agentId, outcome, description, resultText, toolCount, durationMs, background: entryBackground }) => {
+              onFinish: ({ agentId, outcome, description, resultText, toolCount, totalTokens, durationMs, background: entryBackground }) => {
                 // Reaction promotion: if the parent turn already ended
                 // with this (or another) worker still running, its 👍 was
                 // deferred (held on ✍️/⚡). Now that a worker finished,
@@ -30419,6 +30922,7 @@ void (async () => {
                       description: dispatch.feedDescription,
                       lastTool: null,
                       toolCount,
+                      totalTokens,
                       latestSummary: resultText,
                       elapsedMs: durationMs,
                       state: outcome === 'failed' ? 'failed' : 'done',
@@ -30500,6 +31004,7 @@ void (async () => {
                       description: dispatch.feedDescription,
                       lastTool: null,
                       toolCount,
+                      totalTokens,
                       latestSummary: resultText,
                       elapsedMs: durationMs,
                       state: outcome === 'failed' ? 'failed' : 'done',
@@ -30521,6 +31026,7 @@ void (async () => {
                     description: dispatch.feedDescription,
                     lastTool: null,
                     toolCount,
+                    totalTokens,
                     latestSummary: resultText,
                     elapsedMs: durationMs,
                     state: outcome === 'failed' ? 'failed' : 'done',
@@ -30611,7 +31117,7 @@ void (async () => {
               // suppresses stale-after-restart delivery (a 4-h-old
               // "still working (5m)" would be a lie). Sweep on handback
               // lives in the `onFinish` block just above.
-              onProgress: ({ agentId, description, latestSummary, elapsedMs, prevBucketIdx, setBucketIdx, lastTool, toolCount, progressLine, model, skeleton }) => {
+              onProgress: ({ agentId, description, latestSummary, elapsedMs, prevBucketIdx, setBucketIdx, lastTool, toolCount, totalTokens, progressLine, model, skeleton }) => {
                 let fleetChatId = ''
                 try {
                   const fleets = progressDriver?.peekAllFleets() ?? []
@@ -30692,6 +31198,7 @@ void (async () => {
                         elapsedMs,
                         state: 'running',
                         model: feedModel,
+                        totalTokens,
                       },
                       wk.threadId,
                     )
@@ -30846,6 +31353,7 @@ void (async () => {
                       elapsedMs,
                       state: 'running',
                       model: feedModel,
+                      totalTokens,
                     },
                     wk.threadId,
                   )