switchroom 0.18.26 → 0.18.28

package/telegram-plugin/tests/worker-feed-migration-eviction.test.ts

@@ -0,0 +1,140 @@
+/**
+ * Regression guard for the feed-registry churn bug (FIX 2): a worker row whose
+ * `agentId` migrated feeds (a fresh `update()` under a different chat/thread)
+ * used to leave the OLD group's `workers` map holding an orphan row that the
+ * `agentIndex` no longer pointed at. `groupOfAgent(agentId)` could then never
+ * resolve it, so the heartbeat TTL sweep's `terminateWorker(agentId)` no-op'd
+ * and the row churned every tick forever — the self-contradictory
+ * `worker-feed: TTL reap … no update in 0s (>= 3000s); force-terminating
+ * leaked row` log, repeating ~every 6s.
+ *
+ * Two guarantees are asserted as OUTCOMES:
+ *   1. Migration eviction (root cause): after the same agentId updates a
+ *      different feed, the old group's row is gone immediately — total tracked
+ *      rows never double-count the migrated worker.
+ *   2. Sweep force-eviction is idempotent: once every worker has ended, the TTL
+ *      sweep drives `size` to 0 and it STAYS 0 across repeated heartbeat ticks
+ *      (no churning row that re-reaps forever).
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  createWorkerActivityFeed,
+  type BotApiForWorkerFeed,
+  type WorkerActivityView,
+} from '../worker-activity-feed.js'
+
+function view(desc: string, elapsedMs: number): WorkerActivityView {
+  return { description: desc, lastTool: null, toolCount: 1, latestSummary: 'step', elapsedMs, state: 'running' }
+}
+
+type IndexControl = { repointAgentIndex: (agentId: string, feedKey: string | null) => void }
+
+function makeFeed(nowRef: { t: number }) {
+  const pins: { messageId: number | null }[] = []
+  let seq = 900
+  let control: IndexControl | null = null
+  const bot: BotApiForWorkerFeed = {
+    sendMessage: async () => ({ message_id: seq++ }),
+    editMessageText: async () => true,
+  }
+  const feed = createWorkerActivityFeed({
+    bot,
+    now: () => nowRef.t,
+    minEditIntervalMs: 0,
+    heartbeatTickMs: 1000,
+    firstPaintMinMs: 0,
+    staleWorkerTtlMs: 3_000_000, // 3000s — matches the observed churn log
+    setInterval: () => 0,
+    clearInterval: () => {},
+    reconcilePin: ({ messageId }) => pins.push({ messageId }),
+    exposeTestControls: (c) => {
+      control = c
+    },
+  })
+  return { feed, pins, control: () => control as IndexControl }
+}
+
+async function drain(): Promise<void> {
+  for (let i = 0; i < 12; i++) await new Promise((r) => setImmediate(r))
+}
+
+describe('worker-feed migration eviction + churn-free sweep (FIX 2)', () => {
+  it('evicts the old-feed orphan when an agentId migrates feeds — no double-count', async () => {
+    const nowRef = { t: 1_000_000 }
+    const { feed } = makeFeed(nowRef)
+
+    // Worker registers in feed A (chat -100).
+    await feed.update('agent-1', '-100', view('task', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+
+    // SAME agentId now updates a DIFFERENT feed (chat -200) — a migration. The
+    // old feed-A row must be evicted, not orphaned. Total rows stay 1.
+    nowRef.t += 1000
+    await feed.update('agent-1', '-200', view('task', 1000))
+    await drain()
+    expect(feed.size).toBe(1)
+  })
+
+  it('TTL sweep drives size to 0 and stays 0 across repeated ticks (no churn)', async () => {
+    const nowRef = { t: 2_000_000 }
+    const { feed } = makeFeed(nowRef)
+
+    await feed.update('agent-1', '-100', view('task', 0))
+    await drain()
+    // Migrate to a second feed to exercise the exact desync path that leaked.
+    nowRef.t += 1000
+    await feed.update('agent-1', '-200', view('task', 1000))
+    await drain()
+    expect(feed.size).toBe(1)
+
+    // Advance past the silence TTL so the sweep force-terminates the last row.
+    nowRef.t += 3_000_001
+    feed.heartbeatTick()
+    await drain()
+    expect(feed.size).toBe(0)
+
+    // Idempotency: further ticks must not resurrect / re-reap a churning row.
+    for (let i = 0; i < 3; i++) {
+      nowRef.t += 3_000_001
+      feed.heartbeatTick()
+      await drain()
+    }
+    expect(feed.size).toBe(0)
+  })
+
+  it('TTL sweep FORCE-EVICTS a leaked row whose agentIndex has desynced from its group', async () => {
+    // Reproduce the exact desync the migration-eviction fix now prevents any
+    // public sequence from producing: a live row physically in group A while
+    // the agentIndex points somewhere else, so `groupOfAgent(agentId) !== g`.
+    // This drives the heartbeat sweep's FORCE-EVICT branch specifically — the
+    // one that removes the orphan directly from the group it lives in instead
+    // of no-op'ing through `terminateWorker` (which would churn forever).
+    const nowRef = { t: 3_000_000 }
+    const { feed, control } = makeFeed(nowRef)
+
+    await feed.update('agent-1', '-100', view('task', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+
+    // Corrupt the index so it no longer resolves to the group holding the row.
+    // `terminateWorker('agent-1')` would now look up a non-existent group and
+    // no-op — the leak the force-evict branch exists to catch.
+    control().repointAgentIndex('agent-1', 'bogus-feed-key')
+
+    // Past the silence TTL: the sweep must force-evict the row from its real
+    // group, NOT rely on terminateWorker.
+    nowRef.t += 3_000_001
+    feed.heartbeatTick()
+    await drain()
+    expect(feed.size).toBe(0)
+
+    // And it stays gone — no churning row re-reaped every tick.
+    for (let i = 0; i < 3; i++) {
+      nowRef.t += 3_000_001
+      feed.heartbeatTick()
+      await drain()
+    }
+    expect(feed.size).toBe(0)
+  })
+})

package/telegram-plugin/tests/worker-pin-reaper.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import {
   decideWorkerPinReaps,
+  storeOnlyWorkerPinCandidates,
   workerAgentIdOfPinKey,
   WORKER_PIN_TTL_MS_DEFAULT,
   type WorkerPinCandidate,
@@ -130,3 +131,80 @@ describe("decideWorkerPinReaps (#3001 mid-session wk: sweep)", () => {
     expect(reaps).toHaveLength(0);
   });
 });
+
+describe("storeOnlyWorkerPinCandidates (#3001 durable group net)", () => {
+  const inMem = (keys: string[] = []) => new Set(keys);
+
+  it("promotes a wk: store row that has NO in-memory claim into a reap candidate (group chat)", () => {
+    // A GROUP chat id is negative; the reconciling sweep must recover a
+    // bot-tracked orphan there via a per-message unpin (never an unpin-all).
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [{ pinKey: "wk:group:-100:5", chatId: "-100", messageId: 42 }],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(1);
+    expect(cands[0].pinKey).toBe("wk:group:-100:5");
+    expect(cands[0].chatId).toBe("-100");
+    // messageId is carried so the gateway can per-message unpin (group-safe).
+    expect(cands[0].messageId).toBe(42);
+    // A terminal registry verdict reaps it now, however "young" (pinnedAt=now).
+    const reaps = decideWorkerPinReaps({
+      pins: cands,
+      statusOf: () => "terminal" as const,
+      ttlMs: TTL,
+      now: NOW,
+    });
+    expect(reaps.map((r) => r.pinKey)).toEqual(["wk:group:-100:5"]);
+  });
+
+  it("NEVER promotes an untracked/human pin — only wk: rows qualify (fg:/tool:/banner: excluded)", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [
+        { pinKey: "fg:-100:9", chatId: "-100", messageId: 1 },
+        { pinKey: "tool:-100:9", chatId: "-100", messageId: 2, expiresAt: NOW + 1 },
+        { pinKey: "banner:owner", chatId: "-100", messageId: 3 },
+      ],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(0);
+  });
+
+  it("skips rows the in-memory reaper already owns (dedup by pinKey)", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [{ pinKey: "wk:a", chatId: "-100", messageId: 7 }],
+      inMemoryPinKeys: inMem(["wk:a"]),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(0);
+  });
+
+  it("skips pending (pin API in-flight) and time-scoped tool rows and empty-chat rows", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [
+        { pinKey: "wk:pending", chatId: "-100", messageId: 1, pending: true },
+        { pinKey: "wk:tool", chatId: "-100", messageId: 2, expiresAt: NOW + 1000 },
+        { pinKey: "wk:nochat", chatId: "", messageId: 3 },
+      ],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    expect(cands).toHaveLength(0);
+  });
+
+  it("a store-orphan with a live 'running' worker is kept (never reaped mid-run)", () => {
+    const cands = storeOnlyWorkerPinCandidates({
+      rows: [{ pinKey: "wk:live", chatId: "-100", messageId: 5 }],
+      inMemoryPinKeys: inMem(),
+      now: NOW,
+    });
+    const reaps = decideWorkerPinReaps({
+      pins: cands,
+      statusOf: () => "running" as const,
+      ttlMs: TTL,
+      now: NOW,
+    });
+    expect(reaps).toHaveLength(0);
+  });
+});

package/telegram-plugin/worker-activity-feed.ts

@@ -238,6 +238,21 @@ export interface WorkerActivityFeedOpts {
    * `finish` edit bypass it.
    */
   minEditIntervalMs?: number
+  /**
+   * Coarse cadence (ms) for elapsed-ONLY refreshes. When the only thing that
+   * changed since the last edit is the volatile elapsed clock (no new step, no
+   * state/toolCount/token change), the card is NOT re-edited until this much
+   * time has passed — so a worker sitting in one long tool call advances its
+   * clock only every ~`elapsedRefreshMs`, not every jsonl tick. This is the
+   * primary defense against the sustained same-message edit stream that earns a
+   * Telegram flood ban (finn incident: 26,460 clock-only edits → ~88min 429).
+   * A SUBSTANTIVE change (new narrative step, done/failed, toolCount/token
+   * delta) still renders promptly under `minEditIntervalMs`. Default 15000ms.
+   * The terminal finish edit and forced edits bypass it. Liveness for a truly
+   * silent worker is already carried by the typing loop, so a slow clock is not
+   * a liveness regression.
+   */
+  elapsedRefreshMs?: number
   /**
    * A worker must have been running at least this long before its first
    * message is posted. Sub-second / trivial workers never surface a live
@@ -378,6 +393,21 @@ export interface WorkerActivityFeedOpts {
     threadId?: number
     messageId: number | null
   }) => void
+  /**
+   * TEST-ONLY (never set in production). Invoked once at construction with a
+   * narrow control that repoints the internal `agentId → feedKey` index WITHOUT
+   * moving the worker's row. Its sole purpose is to reproduce the
+   * `agentIndex`/`workers` DESYNC that the migration-eviction root-cause fix now
+   * prevents any public API sequence from producing — so the heartbeat sweep's
+   * force-evict backstop (the branch that removes a leaked row when
+   * `groupOfAgent(agentId)` no longer resolves to the group physically holding
+   * it) can be covered by a deterministic test. A no-op when unset.
+   */
+  exposeTestControls?: (controls: {
+    /** Set the internal index entry for `agentId` to `feedKey` (or delete it
+     *  when `feedKey` is null) without touching any group's `workers` map. */
+    repointAgentIndex: (agentId: string, feedKey: string | null) => void
+  }) => void
 }
 
 /**
@@ -467,6 +497,14 @@ interface FeedGroup {
    */
   messageCreatedAtMs: number
   lastBody: string | null
+  /**
+   * Substance signature of the last EDITED body — every rendered field EXCEPT
+   * the volatile elapsed clock (and heartbeat live suffix). Used to distinguish
+   * an elapsed-only change (paced to `elapsedRefreshMs`) from a real update
+   * (new step / state / toolCount / tokens, rendered promptly). Null until the
+   * group's first paint. See {@link groupSubstanceKey}.
+   */
+  lastSubstanceKey: string | null
   lastEditAt: number
   cooldownUntil: number
   /** Single serialization chain for the shared message — ticks can't interleave sends. */
@@ -647,6 +685,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   const nowFn = opts.now ?? Date.now
   const floodWaitRemainingMs = opts.floodWaitRemainingMs ?? (() => 0)
   const minEditInterval = opts.minEditIntervalMs ?? 2500
+  const elapsedRefreshMs = Math.max(minEditInterval, Math.floor(opts.elapsedRefreshMs ?? 15000))
   const firstPaintMin = opts.firstPaintMinMs ?? 8000
   const heartbeatTickMs = opts.heartbeatTickMs ?? 6000
   const maxRows = Math.max(1, Math.floor(opts.maxRows ?? 8))
@@ -820,6 +859,52 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     return renderCombinedWorkerFeed(rows, { maxRows })
   }
 
+  /**
+   * Substance signature of a group's render at `now` — a stable string of every
+   * field that renders EXCEPT the volatile elapsed clock (and the heartbeat
+   * live suffix, which is elapsed-derived). Two renders with the same substance
+   * key differ only in their clock; an edit between them advances nothing the
+   * user cares about and is exactly the churn that accumulates into a flood ban.
+   *
+   * Built from the group data (not by string-stripping the rendered body) so it
+   * is deterministic and robust to render-format changes: description, state,
+   * toolCount, totalTokens, and the full narrative trail per running row (or the
+   * terminal recap's state/result/narrative when finalizing).
+   */
+  function groupSubstanceKey(g: FeedGroup, terminalRecap: WorkerActivityView | null): string {
+    // Unambiguous delimiters so adjacent fields can never blur into a boundary
+    // collision (e.g. toolCount `1`+desc `"23"` vs toolCount `12`+desc `"3"`).
+    // FS separates fields within a row; RS separates rows in the combined body.
+    const FS = '\x00'
+    const RS = '\x1e'
+    if (terminalRecap != null) {
+      return [
+        'T',
+        terminalRecap.state,
+        terminalRecap.description,
+        terminalRecap.toolCount,
+        terminalRecap.totalTokens ?? '',
+        terminalRecap.latestSummary,
+        ...(terminalRecap.narrativeLines ?? []),
+      ].join(FS)
+    }
+    const running = runningRows(g)
+    if (running.length === 0) return 'EMPTY'
+    return running
+      .map((r) => {
+        const v = r.lastView as WorkerActivityView
+        return [
+          r.agentId,
+          v.state,
+          v.description,
+          v.toolCount,
+          v.totalTokens ?? '',
+          ...r.narrative,
+        ].join(FS)
+      })
+      .join(RS)
+  }
+
   /** Remove a worker's row + index entry; delete the group if it is now empty. */
   function removeWorker(g: FeedGroup, agentId: string): void {
     g.workers.delete(agentId)
@@ -827,6 +912,20 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     maybeDeleteGroup(g)
   }
 
+  /**
+   * Force-evict a LEAKED row from the specific group it lives in, used when the
+   * agentIndex has desynced (points at a different feed, or none) so the normal
+   * `removeWorker`/`terminateWorker` path — which resolves the group via the
+   * index — can't reach it. Deletes the index entry ONLY if it still points at
+   * THIS group, so a live row for the same agentId in another feed keeps its
+   * mapping intact.
+   */
+  function evictRowFromGroup(g: FeedGroup, agentId: string): void {
+    g.workers.delete(agentId)
+    if (agentIndex.get(agentId) === g.feedKey) agentIndex.delete(agentId)
+    maybeDeleteGroup(g)
+  }
+
   /**
    * Delete an empty group. A group is gone only when it has NO tracked workers
    * AND no staged terminal repaints pending — the latter keeps the group object
@@ -926,6 +1025,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     }
 
     const body = renderGroupBody(g, now, opts2.terminalRecap ?? null, opts2.heartbeat ?? false)
+    const substanceKey = groupSubstanceKey(g, opts2.terminalRecap ?? null)
     if (body == null) {
       // Nothing to show. On a terminal finalize the row is already dropped;
       // clear the staged repaint (the handback carries the result).
@@ -961,6 +1061,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         // group-message lifetime cap measures the message's true absolute age.
         g.messageCreatedAtMs = now
         g.lastBody = body
+        g.lastSubstanceKey = substanceKey
         g.lastEditAt = now
         // A fresh message is a live running paint, never a terminal recap.
         g.terminalPainted = false
@@ -982,7 +1083,19 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       if (isTerminal) clearStaged()
       return
     }
-    if (!opts2.force && now - g.lastEditAt < minEditInterval) return
+    if (!opts2.force && !isTerminal) {
+      // Spacing floor: never edit the same message faster than the 429 floor.
+      if (now - g.lastEditAt < minEditInterval) return
+      // Elapsed-only pacing (flood-ban defense): if the SUBSTANCE is unchanged
+      // since the last edit — the body differs only because the clock advanced —
+      // hold the edit until the coarse `elapsedRefreshMs` cadence. A real change
+      // (new step / state / toolCount / tokens) shifts `substanceKey` and falls
+      // through immediately (subject only to the spacing floor above). This is
+      // what collapses the sustained ~0.33/s clock-only edit stream that
+      // accumulates into Telegram's per-message flood counter.
+      const substanceChanged = substanceKey !== g.lastSubstanceKey
+      if (!substanceChanged && now - g.lastEditAt < elapsedRefreshMs) return
+    }
 
     try {
       const res = await opts.bot.editMessageText(g.chatId, g.messageId, body, sendOptsFor(g))
@@ -996,6 +1109,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         return
       }
       g.lastBody = body
+      g.lastSubstanceKey = substanceKey
       g.lastEditAt = now
       if (isTerminal) {
         log(
@@ -1029,6 +1143,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       }
       if (outcome === 'not_modified') {
         g.lastBody = body
+        g.lastSubstanceKey = substanceKey
         g.lastEditAt = now
         if (isTerminal) clearStaged()
         return
@@ -1040,6 +1155,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         g.messageId = null
         g.messageCreatedAtMs = 0
         g.lastBody = null
+        g.lastSubstanceKey = null
         // The pinned message no longer exists → release the group pin claim
         // (clearStaged already re-syncs on the terminal path).
         if (isTerminal) clearStaged()
@@ -1156,7 +1272,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     //      that keeps getting `update()` cues every heartbeat resets
     //      `lastUpdateAt` forever, so only an age anchor immune to that reset can
     //      reap it (Carrie 5h zombie pin, re-edited 3000+ times).
-    const staleAgentIds: Array<{ agentId: string; reason: 'silence' | 'absolute' }> = []
+    const staleAgentIds: Array<{ g: FeedGroup; agentId: string; reason: 'silence' | 'absolute' }> = []
     const staleFinished: Array<{ g: FeedGroup; agentId: string; reason: 'silence' | 'absolute' }> = []
     for (const g of groups.values()) {
       for (const row of g.workers.values()) {
@@ -1166,8 +1282,12 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         // Attribute the reap to the absolute cap only when silence alone would
         // NOT have fired — so the log names the trigger that actually caught it.
         const reason: 'silence' | 'absolute' = silent ? 'silence' : 'absolute'
+        // Carry the group the row was ACTUALLY found in (not `groupOfAgent`,
+        // which resolves via the agentIndex — that index can desync from a
+        // group's `workers` map when an agentId migrated feeds, orphaning the
+        // old row. Using `g` guarantees the reap evicts the row that exists.)
         if (row.finished) staleFinished.push({ g, agentId: row.agentId, reason })
-        else staleAgentIds.push({ agentId: row.agentId, reason })
+        else staleAgentIds.push({ g, agentId: row.agentId, reason })
       }
     }
     // GC any FINISHED row still lingering past the TTL (#3207: finished rows
@@ -1187,15 +1307,32 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       removeWorker(g, agentId)
       syncPin(g)
     }
-    for (const { agentId, reason } of staleAgentIds) {
-      const row = groupOfAgent(agentId)?.workers.get(agentId)
+    for (const { g, agentId, reason } of staleAgentIds) {
+      // Read the row from the group it was FOUND in, so the log reports the
+      // real age even when the agentIndex has desynced (the old bug printed
+      // "no update in 0s" because it read `groupOfAgent(agentId)`, which
+      // resolved to a different/absent group and fell back to `now`).
+      const row = g.workers.get(agentId)
       if (reason === 'absolute') {
         const age = Math.floor((now - (row?.createdAtMs ?? now)) / 1000)
         log(`worker-feed: ABSOLUTE cap reap agent=${agentId} — row age ${age}s (>= ${Math.floor(absoluteRowLifetimeCapMs / 1000)}s); force-terminating immortal row (survives lastUpdateAt reset)`)
       } else {
         log(`worker-feed: TTL reap agent=${agentId} — no update in ${Math.floor((now - (row?.lastUpdateAt ?? now)) / 1000)}s (>= ${Math.floor(staleWorkerTtlMs / 1000)}s); force-terminating leaked row`)
       }
-      void terminateWorker(agentId)
+      // Normal honest finalize when the agentIndex still points at THIS group
+      // (renders the terminal recap + releases the pin through the chain). But
+      // when the index has desynced — it resolves to a different group or none
+      // — `terminateWorker` would look up the wrong/no row and no-op, leaving
+      // this row to churn every heartbeat forever. Detect that and force-evict
+      // the leaked row directly from the group it actually lives in.
+      if (groupOfAgent(agentId) === g) {
+        void terminateWorker(agentId)
+      } else {
+        log(`worker-feed: force-evicting leaked row agent=${agentId} feed=${g.feedKey} — agentIndex desynced (points elsewhere); removing directly`)
+        markFinalized(agentId)
+        evictRowFromGroup(g, agentId)
+        syncPin(g)
+      }
     }
     for (const g of [...groups.values()]) {
       // Deferred-finalize re-drive: a terminal edit that hit a cooldown/flood
@@ -1242,6 +1379,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         g.messageId = null
         g.messageCreatedAtMs = 0
         g.lastBody = null
+        g.lastSubstanceKey = null
         // Clear the (possibly stale) pin claim for the retired message; the
         // fresh first-paint below re-pins the new one from a null claim.
         syncPin(g)
@@ -1281,6 +1419,15 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
 
   heartbeatTimer = setIntervalFn(heartbeatTick, heartbeatTickMs)
 
+  // TEST-ONLY: hand out the narrow index-repoint control (see opts doc). Never
+  // provided in production wiring, so this is a no-op there.
+  opts.exposeTestControls?.({
+    repointAgentIndex: (agentId, feedKey) => {
+      if (feedKey == null) agentIndex.delete(agentId)
+      else agentIndex.set(agentId, feedKey)
+    },
+  })
+
   return {
     has(agentId) {
       const g = groupOfAgent(agentId)
@@ -1313,6 +1460,20 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       if (existingRow?.finished === true) return Promise.resolve()
 
       const feedKey = feedKeyOf(chatId, threadId)
+      // Feed-migration cleanup (root-cause of the "no update in 0s" churn): if
+      // this agentId is already indexed to a DIFFERENT feed, its prior row is
+      // about to be orphaned (we re-index below to the new feed, but the old
+      // group's `workers` map still holds the stale row — invisible to
+      // `groupOfAgent` forever after, so the TTL sweep can never evict it and
+      // it churns every heartbeat). Evict the stale row from its old group now.
+      const priorFeedKey = agentIndex.get(agentId)
+      if (priorFeedKey != null && priorFeedKey !== feedKey) {
+        const priorGroup = groups.get(priorFeedKey)
+        if (priorGroup != null) {
+          evictRowFromGroup(priorGroup, agentId)
+          syncPin(priorGroup)
+        }
+      }
       let g = groups.get(feedKey)
       if (g == null) {
         g = {
@@ -1322,6 +1483,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           messageId: null,
           messageCreatedAtMs: 0,
           lastBody: null,
+          lastSubstanceKey: null,
           lastEditAt: 0,
           cooldownUntil: 0,
           chain: Promise.resolve(),
@@ -1342,6 +1504,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
         g.messageId = null
         g.messageCreatedAtMs = 0
         g.lastBody = null
+        g.lastSubstanceKey = null
         g.pendingFinalize.clear()
         g.terminalPainted = false
         // The stale terminal message is no longer this group's pinned surface.