switchroom 0.18.24 → 0.18.25

package/telegram-plugin/tests/worker-feed-pin-persistence.test.ts

@@ -0,0 +1,306 @@
+import { describe, it, expect } from 'vitest'
+import {
+  createWorkerActivityFeed,
+  type WorkerActivityView,
+  type BotApiForWorkerFeed,
+} from '../worker-activity-feed.js'
+import { reconcilePin, type PinBotApi } from '../status-pin-driver.js'
+import type { PinState, DesiredPin } from '../status-pin.js'
+
+/**
+ * Outcome tests for the invisible-worker-cards fix (2026-07-15).
+ *
+ * Root cause: the worker feed reuses ONE shared group message per chat for the
+ * whole time workers overlap, but `syncPin` was called only at lifecycle edges
+ * (first-paint / terminal / GC) — NEVER on the steady-state edit path. So once
+ * the pin was lost out-of-band (its in-memory claim dropped), the reused message
+ * kept being edited live but was never re-pinned → scroll-buried / invisible.
+ *
+ * These tests wire the feed's `reconcilePin` hook into the REAL status-pin
+ * driver + a claim map exactly as the gateway does (`wk:group:<feedKey>` key,
+ * `void reconcileStatusPin`), and assert the PIN-CALL OUTCOMES:
+ *   1. a steady-state edit re-pins when the claim was lost — and does NOT re-pin
+ *      (no storm) when the claim is already correct.
+ *   2. routing an unpin through the reconciler CLEARS the claim, so a later edit
+ *      re-pins.
+ *   3. the group-message lifetime cap ROTATES to a fresh message id and re-
+ *      establishes the pin on the new message.
+ */
+
+function view(partial: Partial<WorkerActivityView> = {}): WorkerActivityView {
+  return {
+    description: 'background task',
+    lastTool: { name: 'Bash', sanitisedArg: 'grep -r x' },
+    toolCount: 1,
+    latestSummary: 'working',
+    elapsedMs: 10_000,
+    state: 'running',
+    ...partial,
+  }
+}
+
+interface FakeBot extends BotApiForWorkerFeed {
+  sent: Array<{ chatId: string; messageId: number; text: string }>
+  edits: Array<{ messageId: number; text: string }>
+}
+
+function makeFakeBot(): FakeBot {
+  let nextId = 1000
+  const fb: FakeBot = {
+    sent: [],
+    edits: [],
+    sendMessage: async (chatId, text) => {
+      const message_id = nextId++
+      fb.sent.push({ chatId, messageId: message_id, text })
+      return { message_id }
+    },
+    editMessageText: async (_chatId, messageId, text) => {
+      fb.edits.push({ messageId, text })
+      return {}
+    },
+  }
+  return fb
+}
+
+/**
+ * Mirror the gateway's status-pin reconcile: a `Map<key,PinState>` claim store
+ * driven through the real `reconcilePin` driver against a fake pin API that
+ * records every pin/unpin call. This is the seam that turns a `reconcilePin`
+ * hook call into an observable Telegram pin/unpin — proving OUTCOMES, not paths.
+ */
+function makePinHarness() {
+  const state = new Map<string, PinState>()
+  const pinCalls: number[] = []
+  const unpinCalls: number[] = []
+  let lastKey: string | null = null
+  const api: PinBotApi = {
+    pinChatMessage: async (_chat, message_id) => {
+      pinCalls.push(message_id)
+    },
+    unpinChatMessage: async (_chat, message_id) => {
+      unpinCalls.push(message_id)
+    },
+  }
+  async function reconcile(key: string, chatId: string, desired: DesiredPin): Promise<void> {
+    const prev = state.get(key) ?? null
+    const next = await reconcilePin({ api, chatId, prevState: prev, desired })
+    if (next == null) state.delete(key)
+    else state.set(key, next)
+  }
+  const reconcilePinFn = (args: {
+    feedKey: string
+    chatId: string
+    threadId?: number
+    messageId: number | null
+  }): void => {
+    const key = `wk:group:${args.feedKey}`
+    lastKey = key
+    if (args.messageId != null) void reconcile(key, args.chatId, { pinned: true, messageId: args.messageId })
+    else void reconcile(key, args.chatId, { pinned: false })
+  }
+  return {
+    state,
+    pinCalls,
+    unpinCalls,
+    reconcilePinFn,
+    key: (): string => {
+      if (lastKey == null) throw new Error('no reconcile happened yet')
+      return lastKey
+    },
+    /** Directly drop the claim to simulate a pin lost out-of-band. */
+    dropClaim(): void {
+      state.clear()
+    },
+  }
+}
+
+/** Flush the microtask queue so fire-and-forget `void reconcile(...)` settles. */
+async function flush(): Promise<void> {
+  for (let i = 0; i < 8; i++) await new Promise((r) => setImmediate(r))
+}
+
+describe('worker-feed pin persistence — steady-state re-pin (invisible-worker-cards)', () => {
+  it('re-pins on a steady-state edit when the claim was lost, and does NOT re-pin when already correct (no storm)', async () => {
+    const bot = makeFakeBot()
+    const pin = makePinHarness()
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    // First paint → message posted AND pinned once.
+    clock = 1000
+    await feed.update('w1', 'chat', view({ elapsedMs: 1000, toolCount: 1 }))
+    await flush()
+    expect(bot.sent).toHaveLength(1)
+    const msgId = bot.sent[0].messageId
+    expect(pin.pinCalls).toEqual([msgId])
+    expect(pin.state.get(pin.key())?.messageId).toBe(msgId)
+
+    // Steady-state edit while the pin is already correct → NO new pin (no storm).
+    clock = 2000
+    await feed.update('w1', 'chat', view({ elapsedMs: 2000, toolCount: 5 }))
+    await flush()
+    expect(bot.edits.length).toBeGreaterThanOrEqual(1)
+    expect(pin.pinCalls).toEqual([msgId]) // still exactly one pin — decidePinAction no-op'd
+
+    // Pin lost out-of-band (claim dropped) → next steady edit must re-pin.
+    pin.dropClaim()
+    clock = 3000
+    await feed.update('w1', 'chat', view({ elapsedMs: 3000, toolCount: 9 }))
+    await flush()
+    expect(pin.pinCalls).toEqual([msgId, msgId]) // re-pinned the SAME live message
+    expect(pin.state.get(pin.key())?.messageId).toBe(msgId)
+  })
+})
+
+describe('worker-feed pin persistence — unpin clears the claim', () => {
+  it('an unpin routed through the reconciler clears the claim so a later edit re-pins', async () => {
+    const bot = makeFakeBot()
+    const pin = makePinHarness()
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    clock = 1000
+    await feed.update('w1', 'chat', view({ elapsedMs: 1000, toolCount: 1 }))
+    await flush()
+    const msgId = bot.sent[0].messageId
+    const key = pin.key()
+    expect(pin.state.get(key)?.messageId).toBe(msgId)
+
+    // Route an unpin of the worker message through the reconciler (the sanctioned
+    // path): the claim is dropped AND the Telegram unpin is issued.
+    await (async () => {
+      const prev = pin.state.get(key) ?? null
+      const next = await reconcilePin({
+        api: {
+          pinChatMessage: async () => {},
+          unpinChatMessage: async (_c, id) => {
+            pin.unpinCalls.push(id)
+          },
+        },
+        chatId: 'chat',
+        prevState: prev,
+        desired: { pinned: false },
+      })
+      if (next == null) pin.state.delete(key)
+      else pin.state.set(key, next)
+    })()
+    expect(pin.state.has(key)).toBe(false) // claim cleared
+    expect(pin.unpinCalls).toContain(msgId)
+
+    // A later steady edit now re-pins (the claim being clear is what lets
+    // decidePinAction issue a fresh pin instead of a stale-id no-op).
+    clock = 2000
+    await feed.update('w1', 'chat', view({ elapsedMs: 2000, toolCount: 7 }))
+    await flush()
+    expect(pin.pinCalls).toContain(msgId)
+    expect(pin.state.get(key)?.messageId).toBe(msgId)
+  })
+})
+
+describe('worker-feed pin persistence — group-message lifetime cap rotation', () => {
+  it('rotates to a fresh message past the cap and re-establishes the pin on the new id', async () => {
+    const bot = makeFakeBot()
+    const pin = makePinHarness()
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      heartbeatTickMs: 6000,
+      groupMessageLifetimeCapMs: 30_000,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    // First paint → message A posted + pinned.
+    clock = 1000
+    await feed.update('w1', 'chat', view({ elapsedMs: 1000, toolCount: 1 }))
+    await flush()
+    const msgA = bot.sent[0].messageId
+    expect(pin.pinCalls).toEqual([msgA])
+
+    // Worker keeps running; advance well past the 30s message cap, then tick.
+    clock = 40_000
+    await feed.update('w1', 'chat', view({ elapsedMs: 40_000, toolCount: 4 }))
+    await flush()
+    feed.heartbeatTick()
+    await flush()
+
+    // A SECOND message was posted (rotation) and it is a DIFFERENT id.
+    expect(bot.sent).toHaveLength(2)
+    const msgB = bot.sent[1].messageId
+    expect(msgB).not.toBe(msgA)
+    expect(feed.messageIdOf('w1')).toBe(msgB)
+
+    // The stale message was unpinned and the fresh one pinned → pin surface
+    // re-established on the new id (deterministic, no burst: one unpin + one pin).
+    expect(pin.unpinCalls).toContain(msgA)
+    expect(pin.pinCalls).toContain(msgB)
+    expect(pin.state.get(pin.key())?.messageId).toBe(msgB)
+
+    // FIX 1: the retired message was collapsed to the honest "moved" note with
+    // exactly ONE edit (not left frozen showing live rows, not re-edited per tick).
+    const supersedeEdits = bot.edits.filter(
+      (e) => e.messageId === msgA && e.text.includes('Live progress moved to a fresh card'),
+    )
+    expect(supersedeEdits).toHaveLength(1)
+  })
+
+  it('rotation preserves ALL live overlapping worker rows on the fresh message (none dropped/double-counted)', async () => {
+    const bot = makeFakeBot()
+    const pin = makePinHarness()
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      heartbeatTickMs: 6000,
+      groupMessageLifetimeCapMs: 30_000,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    // Two workers overlap in the SAME chat → one combined group message.
+    clock = 1000
+    await feed.update('w1', 'chat', view({ description: 'alpha task', elapsedMs: 1000 }))
+    await flush()
+    clock = 1100
+    await feed.update('w2', 'chat', view({ description: 'beta task', elapsedMs: 1100 }))
+    await flush()
+    const msgA = bot.sent[0].messageId
+    // Both workers share the one message.
+    expect(feed.messageIdOf('w1')).toBe(msgA)
+    expect(feed.messageIdOf('w2')).toBe(msgA)
+
+    // Advance past the cap with BOTH still live, then tick to rotate.
+    clock = 40_000
+    await feed.update('w1', 'chat', view({ description: 'alpha task', elapsedMs: 40_000, toolCount: 3 }))
+    await flush()
+    feed.heartbeatTick()
+    await flush()
+
+    // A fresh message was posted and BOTH live workers moved to it — no row
+    // dropped, no worker orphaned on the retired card.
+    expect(bot.sent).toHaveLength(2)
+    const fresh = bot.sent[1]
+    expect(fresh.messageId).not.toBe(msgA)
+    expect(feed.messageIdOf('w1')).toBe(fresh.messageId)
+    expect(feed.messageIdOf('w2')).toBe(fresh.messageId)
+    // The fresh combined body renders BOTH workers' rows.
+    expect(fresh.text).toContain('alpha task')
+    expect(fresh.text).toContain('beta task')
+    expect(feed.size).toBe(2)
+  })
+})

package/telegram-plugin/tool-activity-summary.ts

@@ -115,6 +115,11 @@ export interface SessionActivityHeader {
    * `formatModelLabel` (model-label.ts).
    */
   model?: string
+  /** Running total tokens for THIS turn (the parent agent's OWN per-message
+   *  usage, summed + deduped upstream) — rendered as `· {N} tok` on the metrics
+   *  line via `tokenSegment`. Omitted (0/undefined) → no token segment, same
+   *  clean-omit behavior as the worker feed. */
+  totalTokens?: number
 }
 
 /**
@@ -185,21 +190,57 @@ export function renderActivityHeader(
   toolCount: number,
   state: 'running' | 'done' | 'failed' | 'incomplete',
   model?: string,
+  totalTokens?: number,
 ): [string, string] {
   const toolWord = toolCount === 1 ? 'tool' : 'tools'
   const elapsed = formatFeedElapsed(elapsedMs)
   const descPart = description.length > 0 ? ` · _${escapeMarkdown(description)}_` : ''
   const line1 = `${emoji} **${escapeMarkdown(label)}**${descPart}`
+  // Running total tokens: joins the dot-separated metrics between the tool
+  // count and the model tag. Omitted (empty) when the total is 0/unknown.
+  const tokPart = tokenSegment(totalTokens)
   // Subtle live-model tag: joins the existing dot-separated metrics (never a new
   // line). formatModelLabel returns null for absent/sentinel values → no suffix.
   const modelLabel = formatModelLabel(model)
   const modelPart = modelLabel != null ? ` · ${escapeMarkdown(modelLabel)}` : ''
   const line2 = state === 'running'
-    ? `_${elapsed} · ${toolCount} ${toolWord}${modelPart}_`
-    : `_${state} · ${toolCount} ${toolWord} · ${elapsed}${modelPart}_`
+    ? `_${elapsed} · ${toolCount} ${toolWord}${tokPart}${modelPart}_`
+    : `_${state} · ${toolCount} ${toolWord}${tokPart} · ${elapsed}${modelPart}_`
   return [line1, line2]
 }
 
+/**
+ * Compact token-count formatter for the activity card's metrics line:
+ *   <1000        → raw          ("940")
+ *   ≥1000, <1e6  → one-decimal k ("12.4k", "1.0k")
+ *   ≥1e6         → one-decimal M ("1.2M")
+ * Negative / non-finite inputs clamp to "0". The caller appends " tok".
+ */
+export function formatTokenCount(n: number): string {
+  if (!Number.isFinite(n) || n <= 0) return '0'
+  if (n < 1000) return String(Math.floor(n))
+  if (n < 1_000_000) {
+    // Round to the displayed 1-decimal k FIRST: inputs in [999_950, 999_999]
+    // round to "1000.0k", which must promote into the M branch rather than
+    // render a nonsense "1000.0k". Fall through when the rounded k reaches 1000.
+    const k = Number((n / 1000).toFixed(1))
+    if (k < 1000) return `${k.toFixed(1)}k`
+  }
+  return `${(n / 1_000_000).toFixed(1)}M`
+}
+
+/**
+ * The ` · {N} tok` metrics segment, or '' when there are no tokens to show.
+ * A 0 / undefined total (a worker that emitted no usage — e.g. a non-Claude
+ * transcript) OMITS the segment entirely so the line stays clean; the same
+ * predicate is used by BOTH render variants (single-worker header + combined
+ * row) so they never diverge.
+ */
+function tokenSegment(totalTokens: number | undefined): string {
+  if (totalTokens == null || totalTokens <= 0) return ''
+  return ` · ${formatTokenCount(totalTokens)} tok`
+}
+
 /** Format elapsed milliseconds for display in the activity header (e.g. "12s", "2m05s"). */
 export function formatFeedElapsed(ms: number): string {
   const s = Math.floor(ms / 1000)
@@ -289,6 +330,9 @@ export interface StatusCardHeader {
   /** Live model id (raw, e.g. `claude-opus-4-8`) — rendered as a short friendly
    *  tag on the metrics line via `formatModelLabel`. Omitted when unknown. */
   model?: string
+  /** Running total tokens for the worker/turn — rendered as `· {N} tok` on the
+   *  metrics line. Omitted (0/undefined) → no token segment. */
+  totalTokens?: number
 }
 
 /** Inputs to the unified status-card renderer. */
@@ -341,6 +385,7 @@ export function renderStatusCard(opts: StatusCardOpts): string | null {
         // 'failed', so only the worker card is affected.
         header.state,
         header.model,
+        header.totalTokens,
       )
     : []
 
@@ -497,6 +542,7 @@ export function renderActivityFeed(
           toolCount: header.toolCount,
           state: header.state,
           model: header.model,
+          totalTokens: header.totalTokens,
         }
       : undefined,
     steps: lines,
@@ -549,6 +595,7 @@ export function renderActivityFeedWithNested(
           toolCount: header.toolCount,
           state: header.state,
           model: header.model,
+          totalTokens: header.totalTokens,
         }
       : undefined,
     steps: lines,
@@ -596,6 +643,9 @@ export interface CombinedWorkerRow {
   historyLines?: string[]
   /** Live model id (raw, e.g. `claude-opus-4-8`); omitted when unknown. */
   model?: string
+  /** Running total tokens for this worker — rendered as `· {N} tok` on the row
+   *  header. Omitted (0/undefined) → no token segment. */
+  totalTokens?: number
 }
 
 export interface CombinedWorkerFeedOpts {
@@ -671,9 +721,10 @@ export function renderCombinedWorkerFeed(
       truncate(stripMarkdown(r.description).replace(/\s+/g, ' ').trim() || 'background task', COMBINED_ROW_DESC_MAX),
     )
     const toolWord = r.toolCount === 1 ? 'tool' : 'tools'
+    const tokPart = tokenSegment(r.totalTokens)
     const modelLabel = formatModelLabel(r.model)
     const modelPart = modelLabel != null ? ` · ${escapeMarkdown(modelLabel)}` : ''
-    return `**${desc}** _· ${formatFeedElapsed(r.elapsedMs)} · ${r.toolCount} ${toolWord}${modelPart}_`
+    return `**${desc}** _· ${formatFeedElapsed(r.elapsedMs)} · ${r.toolCount} ${toolWord}${tokPart}${modelPart}_`
   }
 
   // Raw (unescaped) history for a worker, oldest→newest, empty lines stripped.

package/telegram-plugin/worker-activity-feed.ts

@@ -92,6 +92,14 @@ export interface WorkerActivityView {
   lastTool: { name: string; sanitisedArg: string } | null
   /** Number of tool calls observed so far. */
   toolCount: number
+  /**
+   * Running TOTAL tokens across the worker's assistant messages so far
+   * (input + output + cache_creation, deduped by message.id in the watcher;
+   * cache_read is excluded — replayed cached context, not new work). Rendered
+   * as `· {N} tok` on the card's metrics line. Omitted /
+   * 0 → no token segment (a worker that emitted no usage).
+   */
+  totalTokens?: number
   /** The worker's latest narrative line, if any (already capped upstream). */
   latestSummary: string
   /**
@@ -178,6 +186,7 @@ export function renderWorkerActivity(v: WorkerActivityView, liveSuffix = ''): st
     toolCount: v.toolCount,
     state: v.state,
     model: v.model,
+    totalTokens: v.totalTokens,
   }
 
   // Terminal: latestSummary carries the worker's final result text (gateway
@@ -328,6 +337,29 @@ export interface WorkerActivityFeedOpts {
    * Tests inject a small value.
    */
   absoluteRowLifetimeCapMs?: number
+  /**
+   * ABSOLUTE reused-group-MESSAGE lifetime cap (ms), measured from the moment
+   * the shared message was posted (`messageCreatedAtMs`), NOT from a worker
+   * row's age. When workers overlap continuously the group is NEVER reset to a
+   * fresh message (the only messageId reset is the group-reuse-after-terminal
+   * branch, gated on `!hasLiveWorker`), so ONE message can live for hours. If
+   * that message loses its pin out-of-band (a raw unpin somewhere else, or
+   * Telegram pin-stacking burying it), the steady-state edit path re-pins via
+   * `syncPin`; but a STALE in-memory pin claim (the claim still names this id, so
+   * `decidePinAction` no-ops on equal id) can only be cleared by rotating to a
+   * NEW message id. This cap force-rotates the shared message past an absolute
+   * age WHILE live workers remain, so the pin surface is periodically re-
+   * established through the first-paint `syncPin` path — the deterministic
+   * defense-in-depth that bounds how long a buried card can stay invisible
+   * (invisible-worker-cards incident, 2026-07-15; mirrors the immutable-anchor
+   * absolute-cap pattern of `absoluteRowLifetimeCapMs` / #3239's row cap).
+   *
+   * Conservative by design: set well above a normal edit cadence so a healthy
+   * pinned card is not needlessly churned. Rotation costs ONE unpin (old claim)
+   * + ONE pin (fresh message) per cap interval — never a burst. Fallback default
+   * (this module) 60 min; tests inject a small value.
+   */
+  groupMessageLifetimeCapMs?: number
   /**
    * Group-level status-pin reconcile hook (#3207 review). Because workers now
    * COALESCE into one shared message, the pin MUST follow the GROUP lifecycle,
@@ -425,6 +457,15 @@ interface FeedGroup {
   chatId: string
   threadId?: number
   messageId: number | null
+  /**
+   * Wall-clock ms the CURRENT shared message was posted (first paint / re-paint).
+   * IMMUTABLE for the lifetime of a given `messageId`: stamped when a message id
+   * is assigned and NEVER re-stamped by later edits, so the group-message
+   * lifetime cap (`groupMessageLifetimeCapMs`) measures the reused message's true
+   * absolute age and cannot be reset by a continuous edit stream. Reset to 0
+   * whenever `messageId` goes null (rotation / stale-message drop).
+   */
+  messageCreatedAtMs: number
   lastBody: string | null
   lastEditAt: number
   cooldownUntil: number
@@ -460,6 +501,17 @@ interface FeedGroup {
 
 const COOLDOWN_JITTER_MS = 500
 
+/**
+ * Static body the retired shared message is finalized to when the group-message
+ * lifetime cap rotates to a fresh card (invisible-worker-cards review, FIX 1).
+ * Without this the abandoned message stays frozen showing live-styled worker
+ * rows and reads like a stuck worker. A single best-effort edit collapses it to
+ * an honest "moved" note — issued once per rotation (≥ cap interval), never per
+ * tick, so it adds no edit churn / pin storm. Plain voice, no em dash.
+ */
+const WORKER_CARD_SUPERSEDED_BODY =
+  '🛠 **Worker** · _continued_\n\n_Live progress moved to a fresh card to stay pinned._'
+
 function extractRetryAfterSecs(err: unknown): number | null {
   if (err == null || typeof err !== 'object') return null
   const e = err as { error_code?: unknown; parameters?: { retry_after?: unknown } }
@@ -600,6 +652,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   const maxRows = Math.max(1, Math.floor(opts.maxRows ?? 8))
   const staleWorkerTtlMs = Math.max(1, Math.floor(opts.staleWorkerTtlMs ?? 50 * 60_000))
   const absoluteRowLifetimeCapMs = Math.max(1, Math.floor(opts.absoluteRowLifetimeCapMs ?? 6 * 60 * 60_000))
+  const groupMessageLifetimeCapMs = Math.max(1, Math.floor(opts.groupMessageLifetimeCapMs ?? 60 * 60_000))
   const reconcilePinFn = opts.reconcilePin ?? (() => {})
   const setIntervalFn =
     opts.setInterval ??
@@ -754,6 +807,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         description: v.description,
         elapsedMs: elapsedFor(r),
         toolCount: v.toolCount,
+        totalTokens: v.totalTokens,
         currentStep,
         // Full per-worker rolling history (oldest→newest) so the combined feed
         // can paint an adaptive-depth ✓/→ trail, not just the latest line. The
@@ -903,6 +957,9 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           return
         }
         g.messageId = sent.message_id
+        // Stamp the reused-message birth time (immutable for this id) so the
+        // group-message lifetime cap measures the message's true absolute age.
+        g.messageCreatedAtMs = now
         g.lastBody = body
         g.lastEditAt = now
         // A fresh message is a live running paint, never a terminal recap.
@@ -951,6 +1008,16 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           `worker-feed: edit feed=${g.feedKey} chat=${g.chatId} ` +
             `thread=${g.threadId ?? '-'} msgId=${g.messageId} workers=${g.workers.size} bytes=${body.length}`,
         )
+        // Re-assert the group pin on the steady-state edit path (invisible-
+        // worker-cards fix). `syncPin` was previously called ONLY at lifecycle
+        // edges (first-paint / terminal / GC), so once a long-lived reused
+        // message lost its pin out-of-band it was edited live forever but never
+        // re-pinned → scroll-buried. This closes that gap deterministically. It
+        // is a NO-OP when the pin is already correct: `decidePinAction` returns
+        // `noop` on equal claim id (status-pin.ts), so this makes ZERO Telegram
+        // calls on the common path and cannot create a pin storm — when the
+        // claim was dropped (variant 1) it re-pins the current message.
+        syncPin(g)
       }
       if (isTerminal) clearStaged()
     } catch (err) {
@@ -971,6 +1038,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         // stale message id; a fresh first-paint re-establishes one if workers
         // are still live. On a terminal finalize, clear the staged repaint.
         g.messageId = null
+        g.messageCreatedAtMs = 0
         g.lastBody = null
         // The pinned message no longer exists → release the group pin claim
         // (clearStaged already re-syncs on the terminal path).
@@ -1054,6 +1122,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       description: lv?.description ?? 'background task',
       lastTool: null,
       toolCount: lv?.toolCount ?? 0,
+      totalTokens: lv?.totalTokens,
       // No fabricated result paragraph — an authoritative sweep can't know what
       // the worker returned; the terminal card shows the header struck-through
       // as `incomplete`, and the handback (if it ran) carries the actual result.
@@ -1152,6 +1221,39 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       const running = runningRows(g)
       if (running.length === 0) continue
 
+      // ABSOLUTE group-message lifetime cap (invisible-worker-cards fix, defense
+      // in depth). While workers overlap continuously the shared message is
+      // never reset, so one message can live for hours; if its pin was lost
+      // out-of-band and the in-memory claim went STALE (claim still names this
+      // id → `decidePinAction` no-ops on equal id), `syncPin` alone can never
+      // re-pin it. Force-rotate to a fresh message past an absolute age WHILE
+      // live workers remain: drop the id (unpinning the stale claim via
+      // `syncPin`, which clears it to null), then fall through to the first-
+      // paint path, whose `syncPin` re-pins the NEW message from a null claim.
+      // Costs exactly one unpin + one pin per cap interval — never a burst.
+      if (g.messageId != null && now - g.messageCreatedAtMs >= groupMessageLifetimeCapMs) {
+        const age = Math.floor((now - g.messageCreatedAtMs) / 1000)
+        const retiredId = g.messageId
+        log(
+          `worker-feed: group-message lifetime cap rotate feed=${g.feedKey} ` +
+            `msgId=${retiredId} — age ${age}s (>= ${Math.floor(groupMessageLifetimeCapMs / 1000)}s); ` +
+            `rotating to a fresh message to re-establish the pin surface`,
+        )
+        g.messageId = null
+        g.messageCreatedAtMs = 0
+        g.lastBody = null
+        // Clear the (possibly stale) pin claim for the retired message; the
+        // fresh first-paint below re-pins the new one from a null claim.
+        syncPin(g)
+        // FIX 1: collapse the retired message to an honest "moved" note so it
+        // doesn't sit frozen showing live-styled rows (mistakable for a stuck
+        // worker). ONE best-effort edit per rotation (≥ cap interval), fired
+        // off-chain and swallowing errors — never per-tick, never a burst.
+        void opts.bot
+          .editMessageText(g.chatId, retiredId, WORKER_CARD_SUPERSEDED_BODY, sendOptsFor(g))
+          .catch(() => {})
+      }
+
       // First-paint path: no message yet and some worker has now crossed
       // firstPaintMin (a prose-silent worker's single early tick was held).
       if (g.messageId == null) {
@@ -1218,6 +1320,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           chatId,
           threadId,
           messageId: null,
+          messageCreatedAtMs: 0,
           lastBody: null,
           lastEditAt: 0,
           cooldownUntil: 0,
@@ -1237,6 +1340,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       // live worker remains AND the group last went terminal.
       if (!g.workers.has(agentId) && g.terminalPainted && !hasLiveWorker(g)) {
         g.messageId = null
+        g.messageCreatedAtMs = 0
         g.lastBody = null
         g.pendingFinalize.clear()
         g.terminalPainted = false