switchroom 0.18.24 → 0.18.26

package/telegram-plugin/dist/server.js

@@ -17357,6 +17357,13 @@ function projectAssistantTextBlocks(content, make) {
   });
   return out;
 }
+function sumUsageTokens(usage) {
+  if (usage == null || typeof usage !== "object")
+    return 0;
+  const u = usage;
+  const n = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+  return n(u.input_tokens) + n(u.output_tokens) + n(u.cache_creation_input_tokens);
+}
 function assistantLineCarriesAnswerSurface(content) {
   if (!Array.isArray(content))
     return false;
@@ -17412,6 +17419,15 @@ function projectTranscriptLine(line) {
     if (typeof mainModel === "string" && !isModelSentinel(mainModel)) {
       events.push({ kind: "model", model: mainModel });
     }
+    const mainUsageTotal = sumUsageTokens(message?.usage);
+    if (mainUsageTotal > 0) {
+      const mainMsgId = message?.id;
+      events.push({
+        kind: "usage",
+        messageId: typeof mainMsgId === "string" ? mainMsgId : null,
+        totalTokens: mainUsageTotal
+      });
+    }
     const textEvents = projectAssistantTextBlocks(content, (text, blockIndex, lastInMessage) => ({ kind: "text", text, blockIndex, lastInMessage }));
     content.forEach((c, i) => {
       const ct = c.type;
@@ -17518,6 +17534,16 @@ function projectSubagentLine(line, agentId, state) {
     if (typeof subModel === "string" && !isModelSentinel(subModel)) {
       events.push({ kind: "sub_agent_model", agentId, model: subModel });
     }
+    const subUsageTotal = sumUsageTokens(message?.usage);
+    if (subUsageTotal > 0) {
+      const subMsgId = message?.id;
+      events.push({
+        kind: "sub_agent_usage",
+        agentId,
+        messageId: typeof subMsgId === "string" ? subMsgId : null,
+        totalTokens: subUsageTotal
+      });
+    }
     const textEvents = projectAssistantTextBlocks(content, (text, blockIndex, lastInMessage) => ({
       kind: "sub_agent_text",
       agentId,

package/telegram-plugin/gateway/callback-query-handlers.ts

@@ -52,6 +52,7 @@ import {
 import {
   buildVaultGrantApprovedInbound,
   buildVaultGrantApprovedCardText,
+  normalizeGrantReason,
   buildVaultGrantDeniedInbound,
   buildVaultSaveCompletedInbound,
   buildVaultSaveFailedInbound,
@@ -786,6 +787,10 @@ async function performVaultAccessApproval(
   pendingCardStore.remove(stageId)
   if (pending.card_message_id != null) {
     const days = Math.round(pending.ttl_seconds / 86400)
+    // Normalize + cap the agent-supplied reason to a single line BEFORE
+    // escaping, so the value passed into the card builder is already
+    // safe to render inside the `_Reason: …_` italic clause.
+    const reasonNormalized = normalizeGrantReason(pending.reason)
     const footer =
       getVaultApprovalAuthMode() === 'telegram-id'
         ? `\n_Approver verified by Telegram identity — broker auto-unlocked at startup._`
@@ -801,6 +806,8 @@ async function performVaultAccessApproval(
             key: pending.key,
             days,
             grantId: id,
+            reasonEscaped:
+              reasonNormalized.length > 0 ? escapeHtmlForTg(reasonNormalized) : undefined,
             footer,
           }),
         ),

package/telegram-plugin/gateway/gateway.ts

@@ -243,7 +243,11 @@ import { isFinalAnswerReply, isSubstantiveFinalReply, FINAL_ANSWER_MIN_CHARS } f
 import { deriveTurnRole, decideTerminalReason, parsePostAnswerLivenessMs, evaluatePostAnswerLiveness, type LoopRole } from '../turn-liveness-floor.js'
 import { createAnswerStream, type AnswerStreamHandle } from '../answer-stream.js'
 import { parseVisibleAnswerStreamEnabled, resolveAnswerLaneConfig } from '../answer-stream-flag.js'
-import { type SessionEvent } from '../session-tail.js'
+import {
+  type SessionEvent,
+  projectTrailingAnswerFromTranscript,
+  getProjectsDirForCwd,
+} from '../session-tail.js'
 import {
   shouldSuppressToolActivity,
 } from '../pty-tail.js'
@@ -303,6 +307,7 @@ import {
   checkpointWal as checkpointHistoryWal,
   pruneMessagesOlderThanDays,
   hasOutboundDeliveredSince,
+  hasOutboundWithText,
 } from '../history.js'
 import {
   runRegistryReaper,
@@ -352,6 +357,7 @@ const REPLY_TO_TEXT_MAX = 200
 // tests exercise the real string — see PR #2892.
 import { splitMarkdownChunks, repairEscapedWhitespace, normalizeParagraphBreaks, addParagraphSpacers, normalizePunctuation, stripExcessBold, escapeMarkdown, hardenCardBreaks, RICH_MESSAGE_MAX_CHARS } from '../format.js'
 import { richMessage } from '../rich-send.js'
+import { decideRedeliver, decideRedeliverCapture } from './redelivery-decision.js'
 import { scrubVoice } from '../text-voice-scrub.js'
 import {
   normalizeOutboundBody,
@@ -833,7 +839,10 @@ import {
   findRecentTurnsForChat,
   getTurnByKey,
   markTurnResumed,
+  markAnswerRedelivered,
+  stampTurnSessionId,
   reapStaleOpenTurns,
+  type Turn,
 } from '../registry/turns-schema.js'
 import {
   buildResumeInterruptedInbound,
@@ -1694,6 +1703,13 @@ let turnsDb: ReturnType<typeof openTurnsDb> | null = null
 // Stashed here; pushed to the spool once it's constructed below. The spool's
 // turn_key-keyed dedup makes a re-stash across multiple restarts a no-op.
 let bootResumeInbound: { agent: string; msg: InboundMessage } | null = null
+// Crash-survival redelivery candidate, captured during the boot-resume block
+// (module init, BEFORE the Telegram client connects) and consumed by
+// `maybeRedeliverUndeliveredAnswer` in the one-time-setup block AFTER
+// `bot.api.getMe()` succeeds — so the framed recovered-answer send is sequenced
+// after the client is ready, never fired mid module-init. `null` when there is
+// no interrupted turn to consider.
+let pendingRedelivery: { turn: Turn; maxAgeMs: number } | null = null
 // #3038 cross-boot damper: consecutive bridge-dead escalations by PRIOR
 // boots (the consumed marker's `count`; 0 when no fresh marker). Set in
 // the boot block below, consumed by the watchdog constructor further down.
@@ -1828,6 +1844,50 @@ try {
       maxAgeMs: RESUME_MAX_AGE_MS,
     })
 
+    // Crash-survival redelivery (deterministic, zero-token): capture THIS
+    // interrupted turn as a redelivery candidate. The actual re-project + framed
+    // send happens later, AFTER the Telegram client connects (see
+    // `maybeRedeliverUndeliveredAnswer`, fired from the one-time-setup block).
+    // Gated on the same `pending` as the resume synthetic but a SEPARATE concern:
+    // resume re-runs the model on unfinished work; redelivery just re-sends the
+    // finished answer the model already produced and the crash swallowed.
+    //
+    // MUTUAL EXCLUSION with resume (double-send guard): redelivery is captured
+    // ONLY when this turn will NOT be re-run by the resume path — i.e.
+    // `bootResumeKind !== 'resume'`. When the kind IS 'resume', the model re-runs
+    // the interrupted work and emits a FRESH answer that supersedes the recovered
+    // draft; redelivering as well would send the same answer twice (once framed
+    // "Recovered from an interrupted turn:", once fresh). The other kinds do NOT
+    // auto-re-answer, so redelivery is the correct (and only) send there:
+    //   - 'report'          (watchdog-timeout): synthetic only ASKS retry — no auto re-answer
+    //   - 'defer-suppressed' (boot_resume: never): no synthetic re-run at all
+    //   - 'defer-loop'       (resume-of-a-resume guard): no re-run
+    //   - 'none'             (nothing queued): redelivery is the sole recovery
+    // This gate is deterministic in code, not prompt-dependent.
+    //
+    // Eligibility floor: only a turn with a durably-stamped `session_id` (pinned
+    // live via the session-event path) qualifies — without it we cannot resolve
+    // the EXACT transcript, and a most-recent-mtime heuristic could shadow a
+    // fresh boot session's file. The mutual-exclusion-with-resume rule and this
+    // floor live together in the pure `decideRedeliverCapture` predicate.
+    const redeliverCapture = decideRedeliverCapture({
+      willBeResumed: bootResumeKind === 'resume',
+      hasSessionId: Boolean(pending.session_id),
+    })
+    if (redeliverCapture.capture) {
+      pendingRedelivery = { turn: pending, maxAgeMs: RESUME_MAX_AGE_MS }
+    } else if (redeliverCapture.skipReason === 'will-be-resumed') {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery suppressed — interrupted turnKey=${pending.turn_key} will be ` +
+        `RESUMED (bootResumeKind=resume); the fresh re-answer supersedes the recovered draft (no double-send)\n`,
+      )
+    } else {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery skipped — interrupted turnKey=${pending.turn_key} has no ` +
+        `pinned session_id (pre-feature turn or no session event seen); cannot resolve exact transcript\n`,
+      )
+    }
+
     // Sub-agents that were still in flight (running / stalled — non-terminal)
     // when the turn was killed. Read HERE, at module top, BEFORE the
     // subagent-watcher's boot scan + reaper run: the watcher never deletes
@@ -2063,6 +2123,18 @@ const WORKER_FEED_STALE_TTL_MARGIN_MS = 5 * 60_000
  * complete override surface on this path.)
  */
 const WORKER_FEED_ABSOLUTE_ROW_LIFETIME_CAP_MULTIPLE = 4
+/**
+ * ABSOLUTE reused-group-MESSAGE lifetime cap (invisible-worker-cards fix,
+ * 2026-07-15). Bounds how long the shared worker-feed message is reused before
+ * it is force-rotated to a fresh message, re-establishing the pin surface so a
+ * card whose pin was lost out-of-band (and whose in-memory claim went stale)
+ * cannot stay scroll-buried indefinitely. Conservative default 60 min; env
+ * `SWITCHROOM_WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS` overrides for tuning.
+ */
+const WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS = (() => {
+  const v = Number(process.env.SWITCHROOM_WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS)
+  return Number.isFinite(v) && v > 0 ? v : 60 * 60_000
+})()
 const workerFeedOwnerDmFallbackLogged = new Set<string>()
 
 /**
@@ -2977,6 +3049,10 @@ const PENDING_CMD_DRAIN_CAP_MS = 60_000
 // forwarded by the bridge on every session_event — we read occupancy from
 // exactly that file (never an independent findActiveSessionFile re-scan).
 let lastSessionActiveFile: string | null = null
+// Crash-survival redelivery (#session-id pin): the last turn_key whose
+// `session_id` we durably stamped, so the hot session-event path stamps once
+// per turn instead of issuing a guarded UPDATE on every event.
+let lastSessionStampedTurnKey: string | null = null
 // Anti-spam state machine lives in ./proactive-compact (pure, unit
 // tested). `compactDispatching` is a synchronous re-entrancy guard for
 // the async tmux send — purgeReactionTracking can run several times per
@@ -3246,6 +3322,21 @@ type CurrentTurn = {
   // sync_retain are suppressed at the hook (computeLabel returns null) and
   // never arrive as tool_label events — excluded automatically.
   labeledToolCount: number
+  // Running total of the PARENT agent's OWN token usage this turn, summed from
+  // the main-tier session-tail `usage` events (input + output + cache_creation
+  // per assistant message, via sumUsageTokens; cache_read is excluded —
+  // replayed cached context, not new work). Rendered on the
+  // 🤖 turn-activity card's metrics line (`… · N tok · model`). This is the
+  // parent alone — sub-agent tokens are NOT folded in here (they report on
+  // their own worker-feed rows; summing them would double-count). 0 until the
+  // turn's first assistant line carries a usage block.
+  totalTokens: number
+  // Dedup guard for `totalTokens`: Claude Code persists one logical assistant
+  // message as MULTIPLE JSONL lines sharing one `message.id`, each stamped with
+  // the SAME `usage` block. We fold a given `message.id` exactly once (same
+  // idempotency as the sub-agent watcher's `seenUsageMessageIds`). A null/absent
+  // messageId is un-dedupable and always counted.
+  seenUsageMessageIds: Set<string>
   // Tool-activity summary — mirrors Claude Code's native chat-UI
   // rendering ("Ran 5 commands, read a file"). Counters are
   // incremented in `case 'tool_use'`; `activityMessageId` holds the
@@ -8958,6 +9049,14 @@ async function reconcileStatusPinInner(
 ): Promise<void> {
   if (!PIN_STATUS_WHILE_WORKING) return
   if (chatId.length === 0) return
+  // NOTE (invisible-worker-cards review, intentionally left): this reconcile is
+  // NOT serialized per pinKey — it snapshots `prev` then awaits. Two edits that
+  // fire `syncPin` in the same microtask window after a dropped claim can both
+  // read `prev=null` and both issue a `pinChatMessage` for the SAME id. That is
+  // benign and self-healing: re-pinning an already-pinned id is idempotent on
+  // Telegram, and the first reconcile to set the claim makes every subsequent
+  // edit a no-op — it converges in one round, never a storm. A per-key mutex
+  // would remove the duplicate pin but adds lock complexity for zero UX gain.
   const prev = statusPinState.get(pinKey) ?? null
 
   const runReconcile = () =>
@@ -10458,6 +10557,150 @@ async function deliverCapturedProse(args: {
   }
 }
 
+/**
+ * Crash-survival redelivery — the LIVE boot send (deterministic, zero model
+ * tokens). Consumes the `pendingRedelivery` candidate captured during module
+ * init and, if the interrupted turn's finished answer never reached the user,
+ * re-projects it from the durable transcript and sends it FRAMED as a recovered
+ * draft.
+ *
+ * ── Ordering guarantee (why this is NOT called during module init) ───────────
+ * The Telegram raw send (`bot.api.sendRichMessage`) requires a CONNECTED client.
+ * The boot-resume block that computes `pendingRedelivery` runs at module top,
+ * BEFORE `bot.api.getMe()` and the grammy runner start — sending there would
+ * fire against an unconnected client (or block the connect). So the candidate is
+ * only STASHED at module init; this function is invoked exactly once from the
+ * `didOneTimeSetup` block AFTER `getMe()` resolves — i.e. after the client is
+ * connected and ready. This sequencing is a code-path guarantee, not prompt
+ * discipline: the call site is unreachable until the poll loop has authenticated.
+ *
+ * ── Invariants honored ──────────────────────────────────────────────────────
+ * - at-most-once per interruption: the durable text-identity oracle
+ *   (`hasOutboundWithText`, scoped to this turn's `started_at`) skips when the
+ *   answer already went out, and `markAnswerRedelivered` is stamped SYNCHRONOUSLY
+ *   after the send resolves (first-write-wins). The send also writes its own
+ *   `role='assistant'` history row, so a re-restart before the marker commits is
+ *   still caught by the oracle (residual send→row race documented on the marker).
+ * - RESUME_MAX_AGE_MS (3h) staleness, empty-text, trailing-not-text, and
+ *   already-delivered/already-redelivered are all enforced by `decideRedeliver`.
+ * - isApiErrorMessage lines are suppressed at the projector (never resurfaced).
+ * - only trailing TEXT after the last tool_use is redelivered (mid-tool preamble
+ *   is refused by `trailingIsText`).
+ */
+async function maybeRedeliverUndeliveredAnswer(): Promise<void> {
+  const candidate = pendingRedelivery
+  pendingRedelivery = null // consume once, regardless of outcome
+  if (candidate == null || turnsDb == null) return
+  const { turn, maxAgeMs } = candidate
+  const sessionId = turn.session_id
+  if (!sessionId) return
+
+  // Resolve the EXACT transcript from the pinned session id (never a
+  // most-recent-mtime scan, which a fresh boot session's file could shadow).
+  let transcriptText: string
+  try {
+    const projectsDir = getProjectsDirForCwd()
+    const path = join(projectsDir, `${sessionId}.jsonl`)
+    if (!existsSync(path)) {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery — transcript not found for turnKey=${turn.turn_key} ` +
+        `session=${sessionId} (${path}); skipping\n`,
+      )
+      return
+    }
+    transcriptText = readFileSync(path, 'utf8')
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: crash-redelivery — transcript read failed turnKey=${turn.turn_key}: ${(err as Error).message}\n`,
+    )
+    return
+  }
+
+  const projected = projectTrailingAnswerFromTranscript(transcriptText)
+  const threadIdNum =
+    turn.thread_id != null && turn.thread_id !== '' ? Number(turn.thread_id) : undefined
+  const threadIdForOracle: number | null = threadIdNum != null && Number.isFinite(threadIdNum) ? threadIdNum : null
+
+  const decision = decideRedeliver({
+    capturedText: projected.text,
+    trailingIsText: projected.trailingIsText,
+    // Durable text-identity oracle, scoped to THIS turn's window (`started_at`)
+    // so an unrelated earlier turn's message can never false-positive-suppress.
+    hasDeliveredText: HISTORY_ENABLED
+      ? hasOutboundWithText(turn.chat_id, projected.text, threadIdForOracle, turn.started_at)
+      : false,
+    alreadyRedelivered: turn.answer_redelivered_at != null,
+    ageMs: Math.max(0, Date.now() - turn.started_at),
+    maxAgeMs,
+  })
+
+  if (!decision.redeliver || decision.framedText == null) {
+    process.stderr.write(
+      `telegram gateway: crash-redelivery skipped turnKey=${turn.turn_key} reason=${decision.skipReason ?? 'unknown'}\n`,
+    )
+    return
+  }
+
+  const chatId = turn.chat_id
+  const out = redactOutboundText(decision.framedText, 'crash_redelivery')
+  const chunks = splitMarkdownChunks(out, RICH_MESSAGE_MAX_CHARS)
+  const sentIds: number[] = []
+  try {
+    let liveThreadId: number | undefined = threadIdNum != null && Number.isFinite(threadIdNum) ? threadIdNum : undefined
+    for (const c of chunks) {
+      const sent = await retryWithThreadFallback(
+        robustApiCall,
+        (tid) => {
+          // Built as a variable (not an inline literal) so excess-property
+          // checks don't reject `link_preview_options` on sendRichMessage's
+          // narrow Other<> type — mirrors the captured-prose / turn-flush sites.
+          const opts = {
+            link_preview_options: { is_disabled: true },
+            ...(tid != null ? { message_thread_id: tid } : {}),
+          }
+          return bot.api.sendRichMessage(chatId, richMessage(c), opts)
+        },
+        { threadId: liveThreadId, chat_id: chatId, verb: 'crash-redelivery.sendMessage' },
+      )
+      if (liveThreadId != null && (sent as { message_thread_id?: number }).message_thread_id == null) {
+        liveThreadId = undefined
+      }
+      sentIds.push(sent.message_id)
+    }
+    // Record the send as a real assistant delivery so the durable oracle catches
+    // a duplicate if we crash before the marker commits (self-idempotent).
+    if (HISTORY_ENABLED && sentIds.length > 0) {
+      try {
+        recordOutbound({
+          chat_id: chatId,
+          thread_id: threadIdForOracle,
+          message_ids: sentIds,
+          texts: chunks,
+        })
+      } catch {}
+    }
+    // Stamp the at-most-once marker SYNCHRONOUSLY after the send resolves.
+    try {
+      markAnswerRedelivered(turnsDb, turn.turn_key)
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: crash-redelivery markAnswerRedelivered failed turnKey=${turn.turn_key}: ${(err as Error).message}\n`,
+      )
+    }
+    process.stderr.write(
+      `telegram gateway: crash-redelivery — delivered recovered answer (${out.length} chars, ` +
+      `${chunks.length} chunk(s)) for turnKey=${turn.turn_key} chat=${chatId}\n`,
+    )
+  } catch (err) {
+    // Send failed — leave the marker UNSTAMPED so a later restart retries rather
+    // than silently dropping the recovered answer.
+    process.stderr.write(
+      `telegram gateway: crash-redelivery send failed turnKey=${turn.turn_key}: ${(err as Error).message} ` +
+      `— left un-stamped for a later retry\n`,
+    )
+  }
+}
+
 function obligationSweep(): void {
   if (!OBLIGATION_LEDGER_ENABLED) return
   if (!obligationLedger.hasOpen()) return
@@ -11211,6 +11454,29 @@ const ipcServer: IpcServer = createIpcServer({
     // Track the session-tail's attached file for the proactive-
     // compaction occupancy read (see maybeProactiveCompact).
     if (msg.activeFile) lastSessionActiveFile = msg.activeFile
+    // Crash-survival redelivery: durably pin the claude session id onto the
+    // current turn's row the first time we see a session event for it, WHILE
+    // the turn is live (so a later crash preserves it). Boot redelivery then
+    // resolves the EXACT `<sessionId>.jsonl` for the interrupted turn rather
+    // than a most-recent-mtime heuristic that a fresh boot session shadows.
+    // First-write-wins in SQL (`session_id IS NULL`); the in-memory guard just
+    // avoids a redundant UPDATE on every event of the same turn.
+    if (turnsDb != null && msg.activeFile != null) {
+      const stampKey = currentTurn?.registryKey ?? null
+      if (stampKey != null && stampKey !== lastSessionStampedTurnKey) {
+        const sessionId = basename(msg.activeFile).replace(/\.jsonl$/, '')
+        if (sessionId) {
+          try {
+            stampTurnSessionId(turnsDb, stampKey, sessionId)
+            lastSessionStampedTurnKey = stampKey
+          } catch (err) {
+            process.stderr.write(
+              `telegram gateway: stampTurnSessionId failed turnKey=${stampKey}: ${(err as Error).message}\n`,
+            )
+          }
+        }
+      }
+    }
     const ev = msg.event as unknown as SessionEvent
     // #1122/#1126: session events used to be ingested into the pinned progress
     // card here (`progressDriver.ingest`). The card is retired and the driver
@@ -15995,6 +16261,9 @@ function composeTurnActivity(turn: CurrentTurn, final = false, liveSuffix = ''):
     toolCount: turn.labeledToolCount,
     state: final ? 'done' : 'running',
     model: turn.currentModel,
+    // The parent's OWN running token total → `· N tok` on the metrics line.
+    // 0 → tokenSegment omits it (clean, same as the worker feed).
+    totalTokens: turn.totalTokens,
   }
   return renderActivityFeedWithNested(turn.mirrorLines, childLines, final, liveSuffix, stepCount, header)
 }
@@ -17052,6 +17321,8 @@ function handleSessionEvent(ev: SessionEvent): void {
           lastAssistantDone: false,
           toolCallCount: 0,
           labeledToolCount: 0,
+          totalTokens: 0,
+          seenUsageMessageIds: new Set<string>(),
           activityMessageId: null,
           activityInFlight: null,
           activityPendingRender: null,
@@ -17233,6 +17504,22 @@ function handleSessionEvent(ev: SessionEvent): void {
       sessionModelSource.noteTranscriptModel(ev.model)
       return
     }
+    case 'usage': {
+      // Fold the parent agent's OWN per-message token usage into the turn's
+      // running total, deduped by message.id (one logical assistant message can
+      // land as several JSONL lines sharing one id + usage block). Rendered on
+      // the 🤖 turn-activity card's metrics line. Sub-agent tokens are NOT
+      // folded here — they surface on their own worker-feed rows; summing them
+      // would double-count. A null messageId is un-dedupable → always counted.
+      const turn = currentTurn
+      if (turn == null) return
+      if (ev.messageId != null) {
+        if (turn.seenUsageMessageIds.has(ev.messageId)) return
+        turn.seenUsageMessageIds.add(ev.messageId)
+      }
+      turn.totalTokens += ev.totalTokens
+      return
+    }
     case 'thinking': {
       // #1067: snapshot the turn atom at handler entry. Even though this
       // handler is sync, the principle is uniform across all event arms
@@ -29841,6 +30128,19 @@ void (async () => {
           )
         }
 
+        // Crash-survival redelivery — LIVE boot send. Now that `bot.api.getMe()`
+        // has resolved (the Telegram client is connected and authenticated), it
+        // is safe to fire the framed recovered-answer send for an interrupted
+        // turn whose finished answer the crash swallowed. Fire-and-forget: it is
+        // self-contained, must not block the rest of one-time setup, and is a
+        // no-op when there is no eligible candidate. See
+        // `maybeRedeliverUndeliveredAnswer` for the ordering guarantee + invariants.
+        void maybeRedeliverUndeliveredAnswer().catch((err) => {
+          process.stderr.write(
+            `telegram gateway: crash-redelivery boot send errored: ${(err as Error).message}\n`,
+          )
+        })
+
         // Boot-time pin sweep
         try {
           const bootAccess = loadAccess()
@@ -30364,6 +30664,12 @@ void (async () => {
               // Derived from the same terminal cap so it tracks operator
               // overrides; 4× → ~3h at the 45-min default.
               absoluteRowLifetimeCapMs: resolveInflightTerminalCapMs() * WORKER_FEED_ABSOLUTE_ROW_LIFETIME_CAP_MULTIPLE,
+              // ABSOLUTE reused-group-MESSAGE lifetime cap (invisible-worker-
+              // cards fix): force-rotate the shared message past this age while
+              // workers overlap continuously, so a card that lost its pin
+              // out-of-band re-establishes the pin surface via the first-paint
+              // path instead of living buried on one immortal message.
+              groupMessageLifetimeCapMs: WORKER_FEED_GROUP_MESSAGE_LIFETIME_CAP_MS,
               // #3207 review: GROUP-level status pin. Workers now coalesce into
               // ONE shared message, so the pin must follow the GROUP lifecycle,
               // not a single worker's — otherwise a sibling's finish unpins a
@@ -30546,7 +30852,7 @@ void (async () => {
                   )
                 }
               },
-              onFinish: ({ agentId, outcome, description, resultText, toolCount, durationMs, background: entryBackground }) => {
+              onFinish: ({ agentId, outcome, description, resultText, toolCount, totalTokens, durationMs, background: entryBackground }) => {
                 // Reaction promotion: if the parent turn already ended
                 // with this (or another) worker still running, its 👍 was
                 // deferred (held on ✍️/⚡). Now that a worker finished,
@@ -30616,6 +30922,7 @@ void (async () => {
                       description: dispatch.feedDescription,
                       lastTool: null,
                       toolCount,
+                      totalTokens,
                       latestSummary: resultText,
                       elapsedMs: durationMs,
                       state: outcome === 'failed' ? 'failed' : 'done',
@@ -30697,6 +31004,7 @@ void (async () => {
                       description: dispatch.feedDescription,
                       lastTool: null,
                       toolCount,
+                      totalTokens,
                       latestSummary: resultText,
                       elapsedMs: durationMs,
                       state: outcome === 'failed' ? 'failed' : 'done',
@@ -30718,6 +31026,7 @@ void (async () => {
                     description: dispatch.feedDescription,
                     lastTool: null,
                     toolCount,
+                    totalTokens,
                     latestSummary: resultText,
                     elapsedMs: durationMs,
                     state: outcome === 'failed' ? 'failed' : 'done',
@@ -30808,7 +31117,7 @@ void (async () => {
               // suppresses stale-after-restart delivery (a 4-h-old
               // "still working (5m)" would be a lie). Sweep on handback
               // lives in the `onFinish` block just above.
-              onProgress: ({ agentId, description, latestSummary, elapsedMs, prevBucketIdx, setBucketIdx, lastTool, toolCount, progressLine, model, skeleton }) => {
+              onProgress: ({ agentId, description, latestSummary, elapsedMs, prevBucketIdx, setBucketIdx, lastTool, toolCount, totalTokens, progressLine, model, skeleton }) => {
                 let fleetChatId = ''
                 try {
                   const fleets = progressDriver?.peekAllFleets() ?? []
@@ -30889,6 +31198,7 @@ void (async () => {
                         elapsedMs,
                         state: 'running',
                         model: feedModel,
+                        totalTokens,
                       },
                       wk.threadId,
                     )
@@ -31043,6 +31353,7 @@ void (async () => {
                       elapsedMs,
                       state: 'running',
                       model: feedModel,
+                      totalTokens,
                     },
                     wk.threadId,
                   )