switchroom 0.18.6 → 0.18.7

package/telegram-plugin/gateway/pending-card-expiry.ts

@@ -0,0 +1,98 @@
+/**
+ * Pure, injectable core for expiring an agent-initiated approval card
+ * (vault_request_access / vault_request_save / request_secret /
+ * mental_model_propose) whose TTL elapsed with no operator tap.
+ *
+ * Extracted from gateway.ts so the ORDERING and FAULT-ISOLATION contract is
+ * unit-testable behaviorally (pending-card-expiry.test.ts), not just pinned by
+ * source-text regex:
+ *
+ *   1. remove() FIRST — the in-memory map entry + durable store record are
+ *      dropped before anything else, so the expiry is single-shot: a second
+ *      reaper tick (or a concurrent lazy sweep) can never double-fire the
+ *      synthetic wake for the same card.
+ *   2. editCard() — best-effort ⌛ card strip; a Telegram failure never blocks
+ *      the wake.
+ *   3. recordMiss() — the missed-approvals re-offer entry is written BEFORE
+ *      the deliver attempt, so a throwing IPC socket can't lose the re-offer:
+ *      even if the wake never lands, the operator's return re-surfaces it.
+ *   4. deliver() — the timeout synthetic, wrapped in try/catch. A half-dead
+ *      client socket that throws on write is contained here: the error is
+ *      logged, `delivered: false` is returned, and the caller's sweep loop
+ *      continues to the remaining entries/families.
+ *
+ * Every step is individually guarded — one failing dependency never skips the
+ * later steps or escapes to the caller (the reaper's setInterval callback,
+ * where an escaped throw would take the whole gateway down via
+ * uncaughtException).
+ */
+
+import type { InboundMessage } from './ipc-protocol.js'
+
+export interface ExpireCardDeps {
+  /** Drop the in-memory map entry AND the durable store record. Runs first. */
+  remove: () => void
+  /** Best-effort ⌛ card edit (strip keyboard). Failures are swallowed. */
+  editCard: () => void
+  /** Build the timeout synthetic inbound for this card's family. */
+  buildInbound: () => InboundMessage
+  /** Inject the synthetic (turn-safe gate). May throw on a dead socket. */
+  deliver: (inbound: InboundMessage) => boolean
+  /** Record the missed-approvals re-offer entry. Runs BEFORE deliver. */
+  recordMiss: () => void
+  /** Error sink (stderr in production). */
+  log: (msg: string) => void
+}
+
+export interface ExpireCardResult {
+  delivered: boolean
+}
+
+export function expirePendingCard(deps: ExpireCardDeps): ExpireCardResult {
+  // 1. Single-shot: entry gone before any fallible side effect.
+  deps.remove()
+  // 2. Card strip is cosmetic — never let it block the wake.
+  try {
+    deps.editCard()
+  } catch (err) {
+    deps.log(`card-expiry: card edit failed: ${(err as Error).message}`)
+  }
+  // 3. Re-offer entry BEFORE the deliver attempt so a throwing deliver can't
+  //    lose it (the operator's return still re-surfaces the missed card).
+  try {
+    deps.recordMiss()
+  } catch (err) {
+    deps.log(`card-expiry: missed-approval record failed: ${(err as Error).message}`)
+  }
+  // 4. The wake itself — contained so one dead socket doesn't skip the
+  //    remaining entries in the caller's sweep loop.
+  let delivered = false
+  try {
+    delivered = deps.deliver(deps.buildInbound())
+  } catch (err) {
+    deps.log(`card-expiry: timeout synthetic delivery failed: ${(err as Error).message}`)
+  }
+  return { delivered }
+}
+
+/**
+ * Sweep one pending-card map: expire every entry past its TTL via `expire`,
+ * guarding each entry so one throwing expiry can't skip the rest of the map
+ * (or, at the caller, the remaining families).
+ */
+export function sweepExpiredEntries<T>(
+  map: Map<string, T>,
+  isExpired: (value: T, now: number) => boolean,
+  expire: (stageId: string, value: T, now: number) => void,
+  now: number,
+  log: (msg: string) => void,
+): void {
+  for (const [k, v] of map) {
+    if (!isExpired(v, now)) continue
+    try {
+      expire(k, v, now)
+    } catch (err) {
+      log(`card-expiry: expire threw for stage=${k}: ${(err as Error).message}`)
+    }
+  }
+}

package/telegram-plugin/gateway/pending-card-store.ts

@@ -0,0 +1,173 @@
+/**
+ * Persistence store for in-flight AGENT-INITIATED approval cards that park
+ * the requesting agent until the operator taps: `vault_request_access`,
+ * `vault_request_save`, `request_secret`, and `mental_model_propose`.
+ *
+ * Problem (mirror of the permission-card `permission-card-store.ts` bug): the
+ * gateway holds each staged request in an in-memory Map only
+ * (`pendingVaultRequestAccesses`, `pendingVaultRequestSaves`,
+ * `pendingSecretRequests`, `pendingMentalModelProposes`). When the gateway
+ * restarts (crash OR container restart), every entry is lost. The card in
+ * Telegram keeps its live inline keyboard, so when the operator taps it later
+ * they hit the "Card expired — ask the agent to re-request" tombstone: no
+ * grant, no injected inbound, and the agent that ended its turn to WAIT on the
+ * card stays parked forever.
+ *
+ * Fix: persist the METADATA for every posted card to a JSON file in STATE_DIR.
+ * On each resolution (tap / TTL-expire) remove the entry. On gateway boot,
+ * restore surviving entries into the in-memory maps so a post-restart tap on a
+ * still-valid (unexpired) card works exactly like a pre-restart tap.
+ *
+ * SECRETS HYGIENE — LOAD-BEARING: this file is written to disk unencrypted.
+ * It MUST NOT carry any secret VALUE. `vault_request_save` stages a secret
+ * value in gateway memory; only its key/metadata is persisted here (never the
+ * value), so a restored save card is re-associated with a tap but cannot
+ * complete the write — the caller degrades gracefully (tells the agent the
+ * value was lost to a restart). `request_secret` never holds a value at
+ * staging time (the value arrives after the tap), so its metadata is safe to
+ * persist. The "no value field" invariant is enforced by the record types
+ * below (PersistedVaultSaveCard has no `value` member, so a callsite can't
+ * compile one in) and pinned by the on-disk sentinel test in
+ * pending-card-store.test.ts.
+ *
+ * File format: JSON array of PersistedApprovalCard objects. Written
+ * synchronously (mode 0o600) to avoid interleaving on concurrent card posts;
+ * production rate is a handful of cards, so the file stays tiny.
+ */
+
+import { readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** The four agent-initiated approval-card families we persist. */
+export type ApprovalCardFamily =
+  | 'vault_request_access'
+  | 'vault_request_save'
+  | 'request_secret'
+  | 'mental_model_propose'
+
+interface BasePersistedCard {
+  family: ApprovalCardFamily
+  /** The staging id embedded in the card's callback_data (dedup + re-associate). */
+  stageId: string
+  /** Agent that requested (process.env.SWITCHROOM_AGENT_NAME). */
+  agent: string
+  /** Chat the card was rendered into; edited on tap / expiry. */
+  chatId: string
+  /** Card message id (filled after the card is sent). */
+  cardMessageId?: number
+  /** Forum topic the agent was working in, if any. */
+  threadId?: number
+  /** Unix-ms staging timestamp — the TTL clock. Preserved across restart. */
+  stagedAt: number
+}
+
+export interface PersistedVaultAccessCard extends BasePersistedCard {
+  family: 'vault_request_access'
+  key: string
+  scope: 'read' | 'write'
+  reason?: string
+  ttlSeconds: number
+}
+
+export interface PersistedVaultSaveCard extends BasePersistedCard {
+  family: 'vault_request_save'
+  key: string
+  kind: 'string' | 'binary'
+  why?: string
+  // NOTE: NO `value` — the staged secret never touches disk.
+}
+
+export interface PersistedSecretRequestCard extends BasePersistedCard {
+  family: 'request_secret'
+  key: string
+  reason?: string
+}
+
+export interface PersistedMentalModelCard extends BasePersistedCard {
+  family: 'mental_model_propose'
+  spec: {
+    name: string
+    source_query: string
+    refresh_after_consolidation?: boolean
+    max_tokens?: number
+  }
+  reason?: string
+}
+
+export type PersistedApprovalCard =
+  | PersistedVaultAccessCard
+  | PersistedVaultSaveCard
+  | PersistedSecretRequestCard
+  | PersistedMentalModelCard
+
+export interface PendingCardStore {
+  /** Record a newly-posted card. Idempotent on stageId (replaces in place). */
+  add(entry: PersistedApprovalCard): void
+  /** Remove the entry for this stageId (resolved — tap or TTL). */
+  remove(stageId: string): void
+  /** All persisted entries (for boot-time restore). */
+  loadAll(): PersistedApprovalCard[]
+  /** Delete the backing file entirely. */
+  clear(): void
+}
+
+export function createPendingCardStore(stateDir: string): PendingCardStore {
+  const filePath = join(stateDir, 'pending-approval-cards.json')
+
+  function read(): PersistedApprovalCard[] {
+    try {
+      const raw = readFileSync(filePath, 'utf-8')
+      const parsed = JSON.parse(raw)
+      return Array.isArray(parsed) ? (parsed as PersistedApprovalCard[]) : []
+    } catch {
+      return []
+    }
+  }
+
+  function write(entries: PersistedApprovalCard[]): void {
+    try {
+      writeFileSync(filePath, JSON.stringify(entries), { encoding: 'utf-8', mode: 0o600 })
+      // `mode` only applies when writeFileSync CREATES the file; an existing
+      // file keeps its prior perms. Re-assert 0600 on every write so the file
+      // can never stay laxer than intended.
+      chmodSync(filePath, 0o600)
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: pending-card-store write failed: ${(err as Error).message}\n`,
+      )
+    }
+  }
+
+  return {
+    add(entry) {
+      const entries = read()
+      const idx = entries.findIndex(e => e.stageId === entry.stageId)
+      if (idx >= 0) {
+        entries[idx] = entry
+      } else {
+        entries.push(entry)
+      }
+      write(entries)
+    },
+
+    remove(stageId) {
+      const entries = read()
+      const filtered = entries.filter(e => e.stageId !== stageId)
+      if (filtered.length !== entries.length) {
+        write(filtered)
+      }
+    },
+
+    loadAll() {
+      return read()
+    },
+
+    clear() {
+      try {
+        unlinkSync(filePath)
+      } catch {
+        // File may not exist — that's fine.
+      }
+    },
+  }
+}

package/telegram-plugin/gateway/pending-inbound-buffer.ts

@@ -150,9 +150,19 @@ export function redeliverBufferedInbound(
  *  approvals, subagent handbacks, warmup, reaction triggers) all tag a
  *  `meta.source`; the user-message inbound built in gateway.ts sets none.
  *  Restricting to source-less inbounds keeps merge-on-drain away from the
- *  #1150 wake-up class entirely. */
+ *  #1150 wake-up class entirely.
+ *
+ *  Button taps (#271, `meta.button_callback`) are ALSO excluded even though
+ *  they carry no `meta.source`: `mergeRun` keeps only the anchor (last)
+ *  message's meta, so a tap merged with an adjacent buffered user text would
+ *  silently drop its `button_callback_data`/`button_text` whenever the text
+ *  is last — the agent would see the `[user tapped button: …]` line without
+ *  the machine-readable payload. Taps deliver individually. */
 function isMergeableUserInbound(msg: InboundMessage): boolean {
-  return msg.type === 'inbound' && (msg.meta == null || msg.meta.source == null)
+  return (
+    msg.type === 'inbound' &&
+    (msg.meta == null || (msg.meta.source == null && msg.meta.button_callback == null))
+  )
 }
 
 function inboundHasMedia(msg: InboundMessage): boolean {

package/telegram-plugin/gateway/resume-inbound-builder.ts

@@ -49,12 +49,127 @@ export function humanizeElapsed(ms: number): string {
   return `~${days} day${days === 1 ? '' : 's'}`
 }
 
+/**
+ * A sub-agent that was still in flight when the turn was interrupted. The
+ * gateway derives these from the registry (`listNonTerminalSubagentsForTurn`)
+ * — every non-terminal (`running` / `stalled`) worker of the interrupted turn.
+ * Kept to just the display fields so the builder stays pure (no SQLite import).
+ */
+export interface InterruptedSubagent {
+  /** Agent type / label (e.g. 'worker', 'researcher'). */
+  agentType?: string | null
+  /** Human-readable dispatch prompt / task description. */
+  description?: string | null
+  /** Current registry status ('running' | 'stalled'). Informational only. */
+  status?: string | null
+}
+
+/** Max chars of each sub-agent's dispatch prompt included in the inbound. */
+const SUBAGENT_PROMPT_MAX = 200
+/** Max number of sub-agents listed (the rest are summarised as a count). */
+const SUBAGENT_LIST_CAP = 10
+
+function truncatePrompt(s: string, max: number): string {
+  const t = s.trim()
+  if (t.length <= max) return t
+  // Codepoint-safe truncation: slice by code POINTS, not UTF-16 code units —
+  // a naive `.slice()` can split a surrogate pair (emoji, astral-plane CJK)
+  // and leave a lone surrogate that renders as U+FFFD in the inbound.
+  const points = Array.from(t)
+  if (points.length <= max) return t
+  return points.slice(0, max - 1).join('').trimEnd() + '…'
+}
+
+/**
+ * Render the compact "these workers died with the restart" block appended to
+ * an interrupted-turn inbound. Empty string when there were no in-flight
+ * sub-agents (so the inbound is unchanged in the common case). Bounded: at
+ * most `SUBAGENT_LIST_CAP` entries, each prompt truncated to
+ * `SUBAGENT_PROMPT_MAX` chars, with an overflow count for the remainder.
+ *
+ * The closing instruction is mode-aware, mirroring the two builders'
+ * contracts:
+ *   - `assertive: true` (the `resume_interrupted` path, whose inbound already
+ *     says "just resume") → imperative: re-dispatch the ones still needed
+ *     before declaring the task done.
+ *   - `assertive: false` (the `resume_watchdog_timeout` path — an ask-first
+ *     contract: "Do NOT silently resume … ask whether to retry") → deferred:
+ *     IF the user asks to retry, the workers will need re-dispatching. An
+ *     unconditional re-dispatch imperative here would contradict that
+ *     hang-safety gate.
+ */
+export function renderInterruptedSubagentsBlock(
+  subs: InterruptedSubagent[] | undefined,
+  opts: { assertive: boolean } = { assertive: true },
+): string {
+  if (!subs || subs.length === 0) return ''
+  const shown = subs.slice(0, SUBAGENT_LIST_CAP)
+  const lines = shown.map((s, i) => {
+    const type = s.agentType?.trim() ? s.agentType.trim() : 'sub-agent'
+    const desc = s.description?.trim()
+      ? truncatePrompt(s.description, SUBAGENT_PROMPT_MAX)
+      : '(no task description recorded)'
+    return `  ${i + 1}. [${type}] ${desc}`
+  })
+  const overflow =
+    subs.length > SUBAGENT_LIST_CAP
+      ? `\n  …and ${subs.length - SUBAGENT_LIST_CAP} more.`
+      : ''
+  const count = subs.length
+  const closing = opts.assertive
+    ? `\nRe-dispatch the ones still needed before declaring the task done — ` +
+      `don't assume their work landed.`
+    : `\nIf the user asks you to retry, they'll need re-dispatching — ` +
+      `don't assume their work landed.`
+  return (
+    `\n\nWhen the restart hit, ${count} sub-agent${count === 1 ? ' was' : 's were'} still ` +
+    `in flight. These sub-agents were killed by the restart and did NOT complete:\n` +
+    lines.join('\n') +
+    overflow +
+    closing
+  )
+}
+
 export interface ResumeInboundContext {
   /** The interrupted turn, straight from the registry. */
   turn: Turn
   /** Wall-clock ms. Drives `ts`, `messageId`, and the elapsed framing.
    *  Defaults to Date.now(). */
   nowMs?: number
+  /** Sub-agents that were still non-terminal when the turn was interrupted.
+   *  Rendered into the inbound so the resumed session knows what to
+   *  re-dispatch. Omitted / empty → the inbound is unchanged. */
+  subagents?: InterruptedSubagent[]
+}
+
+/**
+ * Machine-stable leading token shared by EVERY synthetic boot inbound this
+ * module mints (resume, watchdog-report, deferred-report). It is the anchor
+ * the loop-guard keys on: a turn whose `user_prompt_preview` starts with
+ * this string was itself started by a synthetic boot inbound, so building
+ * ANOTHER resume for it would replay already-resumed work and could chain
+ * unboundedly across repeated restarts.
+ *
+ * `extractUserPromptPreview` strips the `<channel …>` wrapper before storing
+ * the preview, so the stored text begins with this prose prefix (not the
+ * `meta.source` attribute, which the preview drops). Every builder below
+ * MUST keep this as the first characters of its `text`; `resume-inbound-
+ * builder.test.ts` pins that contract so a prose edit can't silently break
+ * the loop-guard.
+ */
+export const RESUME_SYNTHETIC_PROMPT_PREFIX = 'You just restarted.'
+
+/**
+ * Loop-guard predicate: was this interrupted turn ITSELF started by one of
+ * this module's synthetic boot inbounds? Detected via the stored
+ * `user_prompt_preview` prefix. Used at boot to cap the auto-resume chain at
+ * depth 1 — a resume turn that is itself interrupted is NOT re-resumed
+ * (which would double-execute the resumed side effects and could loop
+ * forever); the caller downgrades to a passive deferred-report instead.
+ */
+export function isResumeSyntheticTurn(turn: Turn): boolean {
+  const p = turn.user_prompt_preview
+  return typeof p === 'string' && p.startsWith(RESUME_SYNTHETIC_PROMPT_PREFIX)
 }
 
 function threadIdNum(turn: Turn): number | undefined {
@@ -131,7 +246,8 @@ export function buildResumeInterruptedInbound(ctx: ResumeInboundContext): Inboun
       `plain language) so they're not left wondering — then carry on with the ` +
       `actual task. Do not ask whether to resume; just resume. If even after ` +
       `reading the recent messages you genuinely can't tell what the work was, ` +
-      `say so and ask.`,
+      `say so and ask.` +
+      renderInterruptedSubagentsBlock(ctx.subagents),
     meta,
   }
 }
@@ -190,7 +306,129 @@ export function buildResumeWatchdogReportInbound(
       `after ${idle} of no progress, and roughly what it was doing. Then ask ` +
       `whether they want you to retry it or take a different angle. Report ` +
       `only the honest cause — no observable progress for that long — don't ` +
-      `speculate about a deeper root cause you can't see.`,
+      `speculate about a deeper root cause you can't see.` +
+      // Deferred (non-assertive) form: this is the ask-first path — the killed
+      // workers are listed as facts, but re-dispatch waits on the user's call.
+      renderInterruptedSubagentsBlock(ctx.subagents, { assertive: false }),
+    meta,
+  }
+}
+
+/** Why an auto-resume was declined in favour of a passive notice. */
+export type ResumeDeferReason = 'clean-restart-suppressed' | 'loop-guard'
+
+/**
+ * The inbound the boot-resume block should mint for an interrupted turn:
+ *   - 'resume'           → active resume (buildResumeInterruptedInbound)
+ *   - 'report'           → watchdog report (buildResumeWatchdogReportInbound)
+ *   - 'defer-loop'       → loop-guard passive notice (deferred-report)
+ *   - 'defer-suppressed' → boot_resume:never passive notice (deferred-report)
+ *   - null               → nothing (turn finished cleanly)
+ */
+export type BootResumeKind = 'resume' | 'report' | 'defer-loop' | 'defer-suppressed' | null
+
+/**
+ * Pure boot-resume decision, extracted from the gateway so the precedence
+ * (esp. the bounded resume-chain loop-guard) is unit-testable without
+ * booting a gateway. Precedence, highest first:
+ *
+ *   1. loop-guard — the interrupted turn was ITSELF a synthetic resume/report
+ *      turn (`isResumeSyntheticTurn`). NEVER mint another resume for it: that
+ *      would replay already-partly-executed work and could chain
+ *      restart→resume→restart forever. The at-most-once `resumed_at` ledger
+ *      bounds each individual turn, but each resume spawns a NEW turn, so
+ *      without this the CHAIN is unbounded. Cap it at one auto-resume by
+ *      downgrading to a passive deferred-report ('defer-loop').
+ *   2. suppressed — `boot_resume: never` on a fresh clean restart. Downgrade
+ *      to a passive deferred-report ('defer-suppressed') — a notice, never
+ *      silence.
+ *   3. otherwise — the normal age/ended_via policy (`selectResumeBuilder`).
+ */
+export function decideBootResumeKind(args: {
+  pending: Turn
+  suppressed: boolean
+  ageMs: number
+  maxAgeMs: number
+}): BootResumeKind {
+  if (isResumeSyntheticTurn(args.pending)) return 'defer-loop'
+  if (args.suppressed) return 'defer-suppressed'
+  return selectResumeBuilder(args.pending.ended_via, {
+    ageMs: args.ageMs,
+    maxAgeMs: args.maxAgeMs,
+  })
+}
+
+/**
+ * Build the `resume_deferred` inbound — a passive notice delivered when the
+ * framework declines to AUTO-resume interrupted work but must NOT stay
+ * silent (silence when work was in flight is never acceptable). Two reasons:
+ *
+ *   - 'clean-restart-suppressed' — `session_continuity.boot_resume: never`
+ *     is set and the prior shutdown was a fresh, deliberate restart. Per
+ *     that opt-in posture we don't replay the work unprompted, but we still
+ *     tell the user what was in flight so they can ask us to continue.
+ *
+ *   - 'loop-guard' — the interrupted turn was ITSELF a synthetic resume/
+ *     report turn (see `isResumeSyntheticTurn`). Auto-resuming a resume that
+ *     was interrupted again risks an unbounded restart→resume→restart chain
+ *     and double-executed side effects, so we cap the chain: report instead
+ *     of resuming, and let the user decide whether to keep going.
+ *
+ * Like the watchdog report, this is a REPORT (source `resume_deferred`), not
+ * a resume: the agent must not silently pick the work back up. The text
+ * starts with RESUME_SYNTHETIC_PROMPT_PREFIX so a further restart during
+ * THIS turn is itself detected as a synthetic turn and stays capped.
+ */
+export function buildResumeDeferredReportInbound(
+  ctx: ResumeInboundContext & { reason: ResumeDeferReason },
+): InboundMessage {
+  const ts = ctx.nowMs ?? Date.now()
+  const elapsed = humanizeElapsed(ts - ctx.turn.started_at)
+  const threadId = threadIdNum(ctx.turn)
+  const meta: Record<string, string> = {
+    source: 'resume_deferred',
+    // Origin chat/topic as channel attributes so the report turn gets a
+    // currentTurn (progress card + silence-poke) and the notice lands in the
+    // topic the work lived in. Same rationale as the other builders.
+    chat_id: ctx.turn.chat_id,
+    ...(threadId != null ? { message_thread_id: String(threadId) } : {}),
+    resume_turn_key: ctx.turn.turn_key,
+    interrupted_via: ctx.turn.ended_via ?? 'restart',
+    defer_reason: ctx.reason,
+    started_at: String(ctx.turn.started_at),
+  }
+  if (ctx.turn.user_prompt_preview) meta.original_prompt = ctx.turn.user_prompt_preview
+  const cause =
+    ctx.reason === 'loop-guard'
+      ? `Your previous turn was ALREADY a resume of earlier interrupted work, ` +
+        `and it was interrupted again by another restart ${elapsed} ago. To ` +
+        `avoid an endless restart→resume loop (and re-running work that may ` +
+        `have already partly executed), the framework has stopped ` +
+        `auto-resuming this chain.`
+      : `Your previous turn was interrupted ${elapsed} ago by a deliberate ` +
+        `restart, before it finished. This agent is configured NOT to ` +
+        `auto-resume work across deliberate restarts (boot_resume: never), so ` +
+        `it was not replayed automatically.`
+  return {
+    type: 'inbound',
+    chatId: ctx.turn.chat_id,
+    ...(threadId != null ? { threadId } : {}),
+    messageId: ts,
+    user: 'switchroom',
+    userId: 0,
+    ts,
+    text:
+      `${RESUME_SYNTHETIC_PROMPT_PREFIX} ${cause}` +
+      promptClause(ctx.turn) +
+      ` Do NOT silently resume it. Instead, briefly tell the user what was in ` +
+      `flight (call get_recent_messages for this chat if you need the full ` +
+      `original request — the quoted preview is only the first ~200 ` +
+      `characters), then ask whether they want you to pick it back up or drop ` +
+      `it. If you genuinely can't tell what the work was, say so and ask.` +
+      // Deferred (non-assertive) form, same as the watchdog path: this is an
+      // ask-first inbound — killed workers are named as facts, but
+      // re-dispatch waits on the user's call.
+      renderInterruptedSubagentsBlock(ctx.subagents, { assertive: false }),
     meta,
   }
 }

package/telegram-plugin/gateway/session-model-source.ts

@@ -0,0 +1,73 @@
+/**
+ * Freshness-aware source of truth for the /status session model.
+ *
+ * Two independent signals report what model the live session is running:
+ *
+ *   - the TRANSCRIPT: `message.model` on each assistant line (session-tail's
+ *     `model` event) — ground truth for the model that served the LAST API
+ *     call, but only advances when a new assistant line lands;
+ *   - the OVERRIDE: the in-memory `/model` switch record (#2982) — set the
+ *     moment a switch is positively confirmed, ahead of any assistant line.
+ *
+ * Neither is unconditionally right. Preferring the transcript regresses the
+ * idle-after-switch window (#2982's core fix): a native `/model` inject while
+ * idle sets the override to the NEW model, but the transcript still holds the
+ * OLD one until the next assistant line — /status would lie. Preferring the
+ * override goes stale the other way (a relaunch carrier that never applied).
+ *
+ * The invariant is "prefer the NEWER observation": every write from either
+ * source is stamped with a shared monotonic sequence, and `resolve()` returns
+ * whichever was observed last. A fresh assistant line always reclaims the
+ * transcript as the source; a confirmed switch always beats an older
+ * transcript line. Pinned by tests/session-model-source.test.ts.
+ */
+
+export interface SessionModelResolution {
+  /** The raw value from the winning source. Transcript entries are resolved
+   *  model ids (`claude-opus-4-8`); override entries may be friendly labels
+   *  ("Opus 4.8") or sr-* ids depending on the /model path that set them. */
+  model: string
+  source: 'transcript' | 'override'
+}
+
+export interface SessionModelSource {
+  /** Record a transcript observation (an assistant line's `message.model`,
+   *  already sentinel-filtered by the session-tail projection). */
+  noteTranscriptModel(model: string): void
+  /** Record an override set (a positively-confirmed /model switch), or clear
+   *  it with null. Setting stamps a fresh sequence, so the override wins over
+   *  every EARLIER transcript observation until a new assistant line lands. */
+  setOverride(model: string | null): void
+  /** Current override value (the #2982 in-memory record), independent of
+   *  freshness — for callers that need the override itself (e.g. the model
+   *  menu's "session" marker), not the /status resolution. */
+  getOverride(): string | null
+  /** The freshest observation across both sources, or null when neither has
+   *  reported yet. */
+  resolve(): SessionModelResolution | null
+}
+
+export function createSessionModelSource(): SessionModelSource {
+  let seq = 0
+  let transcript: { model: string; seq: number } | null = null
+  let override: { model: string; seq: number } | null = null
+  return {
+    noteTranscriptModel(model: string): void {
+      transcript = { model, seq: ++seq }
+    },
+    setOverride(model: string | null): void {
+      override = model == null ? null : { model, seq: ++seq }
+    },
+    getOverride(): string | null {
+      return override?.model ?? null
+    },
+    resolve(): SessionModelResolution | null {
+      if (transcript == null && override == null) return null
+      if (override == null) return { model: transcript!.model, source: 'transcript' }
+      if (transcript == null || transcript.seq < override.seq) {
+        return { model: override.model, source: 'override' }
+      }
+      return { model: transcript.model, source: 'transcript' }
+    },
+  }
+}

package/telegram-plugin/gateway/worker-feed-dispatch.ts

@@ -25,6 +25,15 @@ export interface WorkerFeedDispatch {
    * result returns to its dispatching worker as the Task tool result).
    */
   isNested: boolean
+  /**
+   * Dispatch-time / last-persisted model for the worker, from the registry
+   * row's `model` column (seeded by the pretool hook from `tool_input.model`,
+   * later updated by the watcher from the worker's transcript). The FIRST-PAINT
+   * fallback the worker card renders before the live watcher entry has observed
+   * a transcript model. Null when the row is missing or never carried a model —
+   * the card then omits the model rather than guessing from config.
+   */
+  feedModel: string | null
 }
 
 /**
@@ -43,14 +52,28 @@ export interface WorkerFeedDispatch {
  * decision again: a regression here silently reverts the feed header to
  * "· sub-agent".
  */
+/**
+ * `entryBackground` (fix #1(+#2)): the in-memory watcher entry's own cached
+ * `background` flag (`WorkerEntry.background`), passed by the gateway as a
+ * graceful-degradation fallback for when the registry row (`sub`) is
+ * missing — most often because `jsonl_agent_id` never linked (unreadable
+ * meta.json, or an ambiguous fuzzy backfill — see fix #3). Without this, a
+ * missing row hard-defaults `isBackground` to `false`, silently dropping a
+ * completed background worker's handback (the gateway's `onFinish` treats
+ * `false` as "nothing to deliver — it returns inline"). Ignored entirely
+ * when `sub` resolves — the registry row is always the authoritative
+ * source once it links.
+ */
 export function resolveWorkerFeedDispatch(
   sub: Subagent | null,
   watcherDescription: string,
+  entryBackground?: boolean,
 ): WorkerFeedDispatch {
   return {
-    isBackground: sub?.background ?? false,
+    isBackground: sub?.background ?? entryBackground ?? false,
     feedDescription: (sub?.description ?? '') || watcherDescription,
     hasRow: sub != null,
     isNested: sub?.parent_agent_id != null,
+    feedModel: sub?.model ?? null,
   }
 }