switchroom 0.19.1 → 0.19.3

package/telegram-plugin/gateway/status-pin-store.ts

@@ -313,6 +313,40 @@ export function withStoreLock<T>(
   return run
 }
 
+/**
+ * Per-pinKey async serial lock (F2, invisible-worker-cards review).
+ *
+ * The gateway's status-pin reconcile reads its `prev` claim from an in-memory
+ * map at the TOP of the reconcile, then awaits the persist+pin. Two overlapping
+ * reconciles for the SAME key could each capture a stale `prev`: a turn-end
+ * `{pinned:false}` reading prev=null no-ops and clears the durable row while a
+ * flood-delayed open-pin lands right after — a stuck pin with NO on-disk record.
+ *
+ * Chaining every reconcile for one pinKey through this tail map guarantees the
+ * NEXT reconcile reads `prev` only after the prior one for that key has fully
+ * settled (its in-memory Maps updated), so the pin decision always sees the true
+ * current claim. Different keys never contend. Same non-rejecting-tail contract
+ * as `withStoreLock`. Keyed by pinKey, held by the gateway around the WHOLE
+ * read-prev → decide → reconcileAndPersistStatusPin → update-Maps sequence.
+ */
+const pinReconcileTails = new Map<string, Promise<unknown>>()
+
+export function withPinReconcileLock<T>(
+  pinKey: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const prev = pinReconcileTails.get(pinKey) ?? Promise.resolve()
+  const run = prev.then(fn, fn)
+  pinReconcileTails.set(
+    pinKey,
+    run.then(
+      () => undefined,
+      () => undefined,
+    ),
+  )
+  return run
+}
+
 /**
  * READ-MODIFY-WRITE for exactly ONE pinKey's row, against the authoritative
  * on-disk file. Loads the current snapshot from disk, drops any row for
@@ -431,11 +465,37 @@ export function reconcileAndPersistStatusPin(args: {
       return next
     }
 
-    // clear: unpin (best-effort) THEN drop the record. Ordering is safe here —
-    // if we crash after the unpin but before the rewrite, the stale record just
-    // gets unpinned again next boot (idempotent), never a lingering pin.
+    // clear: unpin (best-effort) THEN reconcile the record with the OUTCOME.
+    //
+    // F1 (invisible-worker-cards review): a `clear` op covers BOTH a genuine
+    // unpin AND a `noop: already pinned` — the pin decision maps every non-`pin`
+    // action here (see decidePinAction → the gateway's op mapping). For a real
+    // unpin, applyPin drops the claim and returns null → we remove the row. But
+    // for a noop-already-pinned, reconcilePin returns the LIVE claim unchanged
+    // (non-null) and issues NO Telegram call — the pin is still up. The worker
+    // feed calls syncPin on EVERY steady-state edit, so a noop-clear fires
+    // constantly; unconditionally deleting the row there erased the durable
+    // status-pins.json entry for a still-live pin. A crash after that left a
+    // stuck pinned card boot cleanup could never see. So: only drop the row when
+    // the claim is actually gone (next == null); when applyPin returns a live
+    // claim, PRESERVE the row (rewritten confirmed) so the durable record keeps
+    // tracking the pin that is genuinely still up. No extra Telegram API call is
+    // added — applyPin already ran; this only changes the disk write's content.
+    // Ordering for the real-unpin case is safe: if we crash after the unpin but
+    // before the rewrite, the stale record just gets unpinned again next boot
+    // (idempotent), never a lingering pin.
     const next = await args.applyPin()
-    applyStatusPinRow(path, fs, pinKey, null, log)
+    if (next == null) {
+      applyStatusPinRow(path, fs, pinKey, null, log)
+    } else {
+      applyStatusPinRow(
+        path,
+        fs,
+        pinKey,
+        { pinKey, chatId, messageId: next.messageId },
+        log,
+      )
+    }
     return next
   })
 }

package/telegram-plugin/gateway/stream-render.ts

@@ -307,6 +307,9 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
           // 2026-07 double-reply-on-DM fix (Part 2) — answer-delivered race
           // latch, reset at turn start alongside the other answer flags.
           answerDelivered: false,
+          // #3429 — flushed-answer text for the content-vs-flush latch
+          // discrimination; stamped at flush arm, reset at turn start.
+          flushedAnswerText: null,
           // 2026-07 double-reply-on-DM fix (F2) — stamped at turn end.
           endedAt: null,
           firstPingAt: null,
@@ -535,7 +538,10 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
       if (turn != null) {
         turn.currentModel = ev.model
       }
-      sessionModelSource.noteTranscriptModel(ev.model)
+      // `replayed` (#3427 H2): a first-attach replay line carries the
+      // PRE-restart session's model — record it for freshness (unchanged
+      // behavior) but exclude it from divergence verification.
+      sessionModelSource.noteTranscriptModel(ev.model, { replayed: ev.replayed === true })
       return
     }
     case 'usage': {
@@ -1623,16 +1629,25 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
         // corrects it in place.
         //
         // TWO distinct arbiters set synchronously here, before any `await`:
-        //   (a) `turn.answerDelivered` — the backstop-vs-LATE-REPLY signal the
-        //       reply path already reads (`decideAnswerLatchSuppression` +
-        //       `flushedTurnSupersede`), exactly as on `main`.
+        //   (a) `turn.answerDelivered = 'flush'` — the backstop-vs-LATE-REPLY
+        //       signal the reply path already reads
+        //       (`decideAnswerLatchSuppression` + `flushedTurnSupersede`).
+        //       Source-tagged 'flush' (#3426): the late-reply suppression is
+        //       scoped to flush-armed latches, so a later async handback
+        //       attributed to a reply-delivered ended turn is never dropped.
         //   (b) `backstopDeliveryLedger.claim` — the backstop-vs-BACKSTOP
         //       double-fire latch: `claim` returning false means this turn
         //       already fired a backstop (answer-ready quiescence, then the
         //       turn-end backstop), so this fire is a no-op. It does NOT
         //       arbitrate the late reply (that is (a)); it is redundant-but-
         //       cheap with the `currentTurn == null` bail below.
-        turn.answerDelivered = true
+        turn.answerDelivered = 'flush'
+        // #3429 — stamp WHAT the flush is delivering alongside the arm, so the
+        // late-reply suppression can discriminate by content: a late reply
+        // carrying this same answer is the flush race (suppress/supersede); a
+        // late reply carrying DIFFERENT content is a genuinely new async
+        // handback attributed to this ended turn and must send fresh.
+        turn.flushedAnswerText = capturedText
         const backstopLatchClaimed = backstopDeliveryLedger.claim(turn.turnId)
 
         // #654 deterministic double-message fix. Hand off the pinned
@@ -1830,6 +1845,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               if (backstopCtrl) backstopCtrl.finalize('error')
               backstopDeliveryLedger.release(turn.turnId)
               turn.answerDelivered = false
+              turn.flushedAnswerText = null // #3429 — cleared with the latch
             } else if (backstopCtrl) {
               backstopCtrl.finalize('done')
             }
@@ -1854,6 +1870,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
             process.stderr.write(`telegram gateway: turn-flush post-delivery bookkeeping failed: ${(err as Error).message}\n`)
             if (!delivered) {
               turn.answerDelivered = false
+              turn.flushedAnswerText = null // #3429 — cleared with the latch
               backstopDeliveryLedger.release(turn.turnId)
               if (backstopCtrl) backstopCtrl.finalize('error')
             }

package/telegram-plugin/gateway/usage-mask.ts

@@ -0,0 +1,29 @@
+/**
+ * Adversarial-review F4 — account-label masking policy for the `/usage` card.
+ *
+ * A group configured with an EMPTY `allowFrom` authorizes every member
+ * (`isAuthorizedSender` returns true for any sender in that group). That is an
+ * intentional "whole-group" access mode, but it means `/usage` would expose
+ * per-account email labels + quota headroom to every member of a broadly
+ * shared group. This predicate decides whether to mask account labels for the
+ * quota-bearing card, reusing the existing demo-mask machinery:
+ *
+ *   - private (operator DM) chat  → never mask
+ *   - group / supergroup with a NON-empty pinned `allowFrom` → trusted,
+ *     operator-curated member list → don't mask
+ *   - group / supergroup with an EMPTY `allowFrom` (open membership) → mask
+ *   - any other chat type reaching a quota render → mask defensively
+ *
+ * This changes only what `/usage` REVEALS, not who may run it — general
+ * command authorization semantics are untouched.
+ */
+export function shouldMaskUsageLabels(
+  chatType: string | undefined,
+  groupAllowFrom: readonly string[] | undefined,
+): boolean {
+  if (chatType === 'private') return false
+  if (chatType === 'group' || chatType === 'supergroup') {
+    return (groupAllowFrom ?? []).length === 0
+  }
+  return true
+}

package/telegram-plugin/hooks/subagent-tracker-pretool.mjs

@@ -360,6 +360,22 @@ function main() {
   }
 
   const input = event.tool_input ?? {}
+  // F3 (progress-card fork model): a FORK dispatch (`subagent_type === 'fork'`)
+  // inherits the PARENT session's model and IGNORES any `tool_input.model`
+  // override. Seeding the row's first-paint model from that ignored override
+  // makes the worker card show a WRONG model (e.g. "sonnet" while the fork
+  // actually runs Opus) until the watcher overwrites it from the fork's own
+  // transcript. Suppress the dispatch-time seed for forks — leave model NULL so
+  // the card omits the model rather than showing a value the fork won't honor;
+  // the transcript-sourced model then paints as soon as the first assistant
+  // line lands (transcript wins, exactly as for non-fork workers). Fixing it at
+  // the seed source (not downstream in worker-feed-dispatch) keeps the
+  // transcript-confirmed model flowing to the terminal card unchanged.
+  const isFork = input.subagent_type === 'fork'
+  const dispatchModel =
+    !isFork && typeof input.model === 'string' && input.model.length > 0
+      ? input.model
+      : null
   // Resolve parent_turn_key from the live turn-active marker (the turn whose
   // tool call is dispatching this sub-agent). Claude Code's PreToolUse payload
   // carries only its own session id, never the gateway-minted Telegram turn_key
@@ -384,8 +400,9 @@ function main() {
       // BEFORE the sub-agent writes its first assistant line. Persisted so the
       // card can render the model from dispatch; the watcher later overwrites it
       // from the worker's own transcript (transcript wins). Only a non-empty
-      // string is stored — never guess from config.
-      model: typeof input.model === 'string' && input.model.length > 0 ? input.model : null,
+      // string is stored — never guess from config. NULL for a fork dispatch,
+      // which ignores the model override (see dispatchModel above, F3).
+      model: dispatchModel,
       now: Date.now(),
     },
     (err) => {

package/telegram-plugin/quota-bar-format.ts

@@ -42,6 +42,7 @@ import type { AccountState, ListStateData } from '../src/auth/broker/client.js';
 import { reviveLastQuota, recommendation, type AccountSnapshot } from './auth-snapshot-format.js';
 import { escapeMarkdown } from './card-format.js';
 import { maskEmail } from './demo-mask.js';
+import { formatExternalSpendBlock } from './external-spend.js';
 
 // ── dot thresholds ───────────────────────────────────────────────────
 
@@ -146,18 +147,41 @@ export function buildBar(pct: number, elapsedFrac: number): string {
 
 // ── account status (title-line suffix) ───────────────────────────────
 
-export type QuotaBarAccountStatus = 'active' | 'exhausted' | 'idle';
+export type QuotaBarAccountStatus =
+  | 'active'
+  | 'org-disabled'
+  | 'retired'
+  | 'exhausted'
+  | 'idle';
+
+/** Title-line display word for each status (some differ from the enum key). */
+const STATUS_LABEL: Record<QuotaBarAccountStatus, string> = {
+  active: 'active',
+  'org-disabled': 'DISABLED (org)',
+  retired: 'retired',
+  exhausted: 'exhausted',
+  idle: 'idle',
+};
 
 /**
- * Title-line status word. `active` wins over `exhausted` (the fleet's
- * pinned account is reported as active even if the broker also flags it
- * exhausted — matches the locked example where the operator wants to know
- * WHICH account is live first, and its health second, from the two window
- * rows underneath). Otherwise: `exhausted` if the broker's own flag says
- * so, else `idle` (present, healthy, just not the current pick).
+ * Title-line status word. Precedence: `active` > `DISABLED (org)` > `retired` >
+ * `exhausted` > `idle`.
+ *   - `active` wins over everything (the fleet's pinned account is reported
+ *     active even if also flagged exhausted — the operator wants WHICH account
+ *     is live first, health second, from the window rows underneath).
+ *   - `org-disabled` (entitlement block, PR2) and `retired` (`in_service` false:
+ *     removed from every config list) are OUT OF SERVICE — never "idle", which
+ *     reads as an available-but-unused account.
+ *   - else `exhausted` if the broker flags it, else `idle`.
  */
-export function accountStatus(isActive: boolean, exhausted: boolean): QuotaBarAccountStatus {
+export function accountStatus(
+  isActive: boolean,
+  exhausted: boolean,
+  opts: { inService?: boolean; entitlementBlocked?: boolean } = {},
+): QuotaBarAccountStatus {
   if (isActive) return 'active';
+  if (opts.entitlementBlocked === true) return 'org-disabled';
+  if (opts.inService === false) return 'retired';
   if (exhausted) return 'exhausted';
   return 'idle';
 }
@@ -187,8 +211,9 @@ export function renderQuotaBarAccount(
   quota: QuotaUtilization | null,
   now: Date = new Date(),
   demo = false,
+  service: { inService?: boolean; entitlementBlocked?: boolean } = {},
 ): string[] {
-  const status = accountStatus(isActive, exhausted);
+  const status = accountStatus(isActive, exhausted, service);
   // Title line wraps `label` in GFM `**bold**`, NOT a code span — so this
   // needs `escapeMarkdown` (backslash-escapes *, _, [, ], etc.), not
   // `codeSpanSafe` (which only defuses backticks and is only correct
@@ -196,7 +221,18 @@ export function renderQuotaBarAccount(
   // was a bug: a label containing e.g. `**` or `[x](url)` would break the
   // bold run or inject a markdown link into the card.
   const displayLabel = demo ? maskEmail(label) : label;
-  const lines: string[] = [`- **${escapeMarkdown(displayLabel)}** (${status})`];
+  const lines: string[] = [`- **${escapeMarkdown(displayLabel)}** (${STATUS_LABEL[status]})`];
+  // Out-of-service accounts (retired / org-disabled) have no meaningful live
+  // windows — a 0%/0% bar would read as "available", the exact bug this fixes.
+  // Replace the two window rows with a single status note (shape stays a list).
+  if (status === 'retired' || status === 'org-disabled') {
+    const note =
+      status === 'org-disabled'
+        ? 'disabled by org — no fleet routing'
+        : 'retired — removed from fleet rotation';
+    lines.push(`- ⚫ \`${note}\``);
+    return lines;
+  }
   if (!quota || isProbeThin(quota)) {
     // Data-quality gap. A failed / thin probe carries NO real utilization
     // signal, so it must NOT render as a healthy 🟢 0% bar — that's
@@ -257,6 +293,17 @@ export interface UsageCardRenderOpts extends QuotaBarRenderOpts {
    * because in that case there IS real data, just stale.
    */
   probeFailed?: boolean;
+  /**
+   * Optional External (OpenRouter / non-Claude cash) spend block — layout B
+   * (operator-locked 2026-07-19). When null/undefined the block is omitted
+   * entirely (no error rows). When present (including $0.00), bullets land
+   * after the recommendation and before the freshness footer.
+   */
+  externalSpend?: {
+    day24hUsd: number;
+    day7dUsd: number;
+    top: Array<{ label: string; usd: number }>;
+  } | null;
 }
 
 /**
@@ -276,10 +323,21 @@ export function renderQuotaBarBlock(
   const now = opts.now ?? new Date();
   const demo = opts.demo ?? false;
   const lines: string[] = [];
-  for (const snap of snapshots) {
+  // Out-of-service accounts (retired / org-disabled) sort LAST — stable
+  // partition preserves the caller's active-first ordering among the rest.
+  const outOfService = (s: AccountSnapshot) =>
+    !s.isActive && (s.entitlementBlocked === true || s.inService === false);
+  const ordered = [
+    ...snapshots.filter((s) => !outOfService(s)),
+    ...snapshots.filter(outOfService),
+  ];
+  for (const snap of ordered) {
     const exhausted = exhaustedByLabel.get(snap.label) ?? false;
     lines.push(
-      ...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo),
+      ...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo, {
+        inService: snap.inService,
+        entitlementBlocked: snap.entitlementBlocked,
+      }),
     );
   }
   return lines.join('\n');
@@ -307,6 +365,8 @@ export function renderQuotaBarBlockFromListState(
     quotaError: acc.last_quota ? undefined : 'no cached quota (no probe since broker start)',
     expiresAtMs: acc.expiresAt,
     capturedAtMs: acc.last_quota?.capturedAt,
+    inService: acc.in_service,
+    entitlementBlocked: acc.entitlement_blocked,
   }));
   return renderQuotaBarBlock(snapshots, exhaustedByLabel, { now });
 }
@@ -342,6 +402,12 @@ export function renderUsageCard(
   const lines = [bar];
   // Actionable cross-account verdict — restored from renderAuthSnapshotFormat2.
   lines.push(`_${recommendation(snapshots, now, demo)}_`);
+  // External cash spend (OpenRouter / non-Claude) — layout B. Omitted when
+  // the caller could not fetch a summary (null/undefined: no admin key,
+  // timeout, error). Present summary including $0.00 still renders.
+  if (opts.externalSpend != null) {
+    lines.push(...formatExternalSpendBlock(opts.externalSpend));
+  }
   // Freshness signal: stale-cache warning takes precedence over a live stamp,
   // which takes precedence over an explicit probe-failed marker (no live data
   // AND no cache — the card is showing "⚠️ no data" rows, so "Live" would be

package/telegram-plugin/quota-check.ts

@@ -252,11 +252,26 @@ export function formatQuotaBlock(q: QuotaUtilization, now: Date = new Date()): s
   const lines: string[] = [];
   lines.push("**Claude plan quota**");
   lines.push("");
+  // #2494 Bug C / adversarial-review F3 — a window whose utilization header
+  // was absent (a thin probe) has a numeric field that coalesced to 0, so a
+  // naive `${pct}%` renders a confident `0%` indistinguishable from a genuine
+  // fresh-account 0%. The modern bar card (quota-bar-format.ts ~200) already
+  // renders these as "no data"; backport that honesty here. The presence
+  // markers are optional — `undefined` means a legacy/real probe (render the
+  // percent); only an explicit `false` suppresses the number.
+  const fiveHour =
+    q.fiveHourUtilPresent === false
+      ? "no data"
+      : `\`${Math.round(q.fiveHourUtilizationPct)}%\``;
+  const sevenDay =
+    q.sevenDayUtilPresent === false
+      ? "no data"
+      : `\`${Math.round(q.sevenDayUtilizationPct)}%\``;
   lines.push(
-    `**5h window**  \`${Math.round(q.fiveHourUtilizationPct)}%\` · \`${formatResetRelative(q.fiveHourResetAt, now)}\``,
+    `**5h window**  ${fiveHour} · \`${formatResetRelative(q.fiveHourResetAt, now)}\``,
   );
   lines.push(
-    `**7d window**  \`${Math.round(q.sevenDayUtilizationPct)}%\` · \`${formatResetRelative(q.sevenDayResetAt, now)}\``,
+    `**7d window**  ${sevenDay} · \`${formatResetRelative(q.sevenDayResetAt, now)}\``,
   );
   if (q.representativeClaim) {
     lines.push("");

package/telegram-plugin/reply-owner-resolve.ts

@@ -107,6 +107,42 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
   )
 }
 
+/**
+ * The answer-delivered latch value — SOURCE-TAGGED (#3426).
+ *
+ * `false`   — no answer delivered this turn (latch unarmed).
+ * `'flush'` — the TURN-FLUSH backstop delivered (or is mid-delivering) this
+ *             turn's answer as its own message A. Set synchronously at
+ *             flush-fire time, and at supersede-record consumption (the
+ *             resurrection window — a flush record existed for this turn).
+ * `'reply'` — a normally-delivered `reply` tool call carried this turn's
+ *             answer (no flush involved).
+ *
+ * Why the tag exists: the late-reply suppression below is a race backstop for
+ * FLUSH duplicates only. A boolean latch also suppressed the async sub-agent
+ * handback pattern (#3426): the parent turn's interim ack (a substantive
+ * `reply`) armed the latch, the turn ended, and the sub-agent completion
+ * handback — a genuinely NEW answer arriving with no live gateway turn —
+ * resolved the ended turn as owner (latest-ended tier, inside the 60 s
+ * supersede TTL), saw the stale latch, and was silently dropped with a false
+ * "deduped" success. Tagging the source lets the suppression fire ONLY for the
+ * flush races it exists for; byte-identical replays of a reply-delivered
+ * answer remain covered by the content-keyed outbound dedup (#546).
+ *
+ * Honest bound on that dedup cover: the #546 TTL (60 s) is anchored at reply
+ * RECORD time, while the latest-ended owner tier's 60 s is anchored at the
+ * turn's `endedAt` — later by the reply→turn_end gap. A byte-identical replay
+ * landing >60 s after record but ≤60 s after endedAt is evicted from dedup yet
+ * still resolves the ended turn, so it DELIVERS as a duplicate message. That
+ * is a conscious trade: this fix also drops the weak "reworded/bridge-replayed
+ * duplicate" suppression the reply-armed boolean latch used to provide —
+ * replays of an un-acked tool_call are byte-identical (content dedup's case),
+ * and a model-REGENERATED paraphrase is indistinguishable from a genuinely new
+ * handback, so delivering it is the correct default. A rare duplicate message
+ * beats the silent handback drop.
+ */
+export type AnswerDeliveredLatch = false | 'flush' | 'reply'
+
 /**
  * The answer-delivered latch inputs (Part 2 — the race backstop).
  *
@@ -118,11 +154,11 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
  * There `flushed-turn-supersede` finds no record (nothing to delete yet) and the
  * reply would ship message B as a duplicate of the flush's message A.
  *
- * The latch closes that window: the gateway sets `answerDelivered = true` on the
- * turn atom SYNCHRONOUSLY at flush-fire time — before the ~500 ms async send and
- * before the record — and the flag persists on the ended turn (readable via the
- * unified resolver after `currentTurn` is null). A reply landing in the race
- * window then sees the latch already set and suppresses itself.
+ * The latch closes that window: the gateway sets `answerDelivered = 'flush'` on
+ * the turn atom SYNCHRONOUSLY at flush-fire time — before the ~500 ms async send
+ * and before the record — and the flag persists on the ended turn (readable via
+ * the unified resolver after `currentTurn` is null). A reply landing in the race
+ * window then sees the flush latch already set and suppresses itself.
  */
 export interface AnswerLatchSuppressInput {
   /** True when Part 1's supersede already fired for THIS reply (message A was
@@ -140,21 +176,50 @@ export interface AnswerLatchSuppressInput {
    *  legitimate second in-turn substantive reply (a genuine multi-message
    *  answer, live currentTurn) untouched. */
   isLateReply: boolean
-  /** The resolved owner turn's `answerDelivered` latch. */
-  ownerAnswerDelivered: boolean
+  /** The resolved owner turn's source-tagged `answerDelivered` latch. */
+  ownerAnswerDelivered: AnswerDeliveredLatch
+  /** #3429 — content evidence: does the landing reply carry the SAME answer
+   *  the flush delivered (`flushedAnswerMatchesReply` against the supersede
+   *  record's text or the owner turn's stashed `flushedAnswerText`)?
+   *    - `false`  → POSITIVE evidence of genuinely new content (an async
+   *                 handback attributed to the flush-delivered ended turn).
+   *                 Suppressing it would silently drop the user's answer —
+   *                 never suppress.
+   *    - `true`   → the reply is the flushed answer landing again — suppress
+   *                 (the flush race the latch exists for).
+   *    - `null` / omitted → no flushed text available to compare (legacy atom,
+   *                 pre-#3429 caller). Conservative: keep the pre-#3429
+   *                 flush-armed suppression. */
+  replyMatchesFlushedAnswer?: boolean | null
 }
 
 /**
  * Decide whether the answer-delivered latch suppresses a landing reply.
  *
  * Suppress IFF: Part 1 did NOT already supersede, the reply is a substantive
- * final answer, it is a late reply (no live turn), AND the owner turn's latch is
- * already set (the flush delivered the same substantive answer as message A in
- * the pre-record race window). Otherwise the reply sends.
+ * final answer, it is a late reply (no live turn), AND the owner turn's latch
+ * was armed by the TURN-FLUSH path (`'flush'` — the flush delivered the same
+ * substantive answer as message A in the pre-record race window, or the
+ * supersede-consumed resurrection window). Otherwise the reply sends.
+ *
+ * A `'reply'`-armed latch deliberately does NOT suppress (#3426): the prior
+ * answer went out via a normal, completed `reply`, so a later late-landing
+ * reply attributed to that ended turn is NOT a flush duplicate — it is
+ * (typically) an async sub-agent handback carrying genuinely new content, and
+ * suppressing it silently drops the user's answer. Byte-identical replays of
+ * the delivered reply are still deduped by the content-keyed #546 cache.
+ *
+ * #3429 refinement: even a FLUSH-armed latch does not suppress when there is
+ * POSITIVE content evidence (`replyMatchesFlushedAnswer === false`) that the
+ * landing reply is NOT the flushed answer — an async handback attributed to a
+ * flush-delivered ended turn must send fresh, not vanish. Absent evidence
+ * (`null`/omitted) the flush-armed suppression holds, preserving the #2996
+ * Part 2 race backstop.
  */
 export function decideAnswerLatchSuppression(input: AnswerLatchSuppressInput): boolean {
   if (input.superseded) return false
   if (!input.replySubstantive) return false
   if (!input.isLateReply) return false
-  return input.ownerAnswerDelivered
+  if (input.replyMatchesFlushedAnswer === false) return false
+  return input.ownerAnswerDelivered === 'flush'
 }

package/telegram-plugin/session-tail.ts

@@ -100,7 +100,12 @@ export type SessionEvent =
   // same batch already reflects the current model. Sentinels (`<synthetic>` on
   // compaction lines, fixture junk) are filtered at projection — see
   // isModelSentinel — so this only ever carries a real resolved model id.
-  | { kind: 'model'; model: string }
+  // `replayed: true` marks a model observation delivered by the FIRST-ATTACH
+  // replay of a prior session's in-flight turn (computeFirstAttachCursor) —
+  // it reflects the PRE-restart session's model, not the live one. Consumers
+  // that verify the live model (#3427 divergence tripwire, H2) must skip
+  // replayed observations; freshness consumers may still record them.
+  | { kind: 'model'; model: string; replayed?: boolean }
   | { kind: 'tool_use'; toolName: string; toolUseId?: string | null; input?: Record<string, unknown>; precomputedLabel?: string }
   // Real-time tool label from the PreToolUse-hook sidecar — fires when the
   // hook writes the label (synchronous at tool-call time), independent of
@@ -1217,6 +1222,17 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
   // re-attach.
   const fileCursors = new Map<string, { cursor: number; pendingPartial: string }>()
 
+  // First-attach REPLAY window per file (#3427 H2): when attachToFile replays
+  // a prior session's in-flight turn (computeFirstAttachCursor returned an
+  // offset below the size-at-attach), every byte below that size is HISTORY
+  // written by the pre-restart session. Model observations projected from it
+  // must be marked `replayed` so the divergence tripwire ignores them.
+  // Granularity is the read CHUNK (a batch whose read started inside the
+  // window is marked wholesale) — deliberately conservative: over-marking a
+  // boundary batch can only delay verification to the next live line, never
+  // false-accuse.
+  const replayUntilByFile = new Map<string, number>()
+
   function readNew(): void {
     if (stopped || !currentFile) return
     try {
@@ -1226,9 +1242,14 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
         // stored per-file state for this path.
         cursor = 0
         pendingPartial = ''
-        if (currentFile != null) fileCursors.delete(currentFile)
+        if (currentFile != null) {
+          fileCursors.delete(currentFile)
+          replayUntilByFile.delete(currentFile)
+        }
       }
       if (stat.size === cursor) return
+      const chunkStart = cursor
+      const isReplayChunk = chunkStart < (replayUntilByFile.get(currentFile) ?? 0)
       const buf = Buffer.alloc(stat.size - cursor)
       const fd = openSync(currentFile, 'r')
       try {
@@ -1247,7 +1268,7 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
         const sid = sessionIdForFile(currentFile)
         for (const ev of events) {
           try {
-            onEvent(decorate(ev, sid))
+            onEvent(decorate(isReplayChunk && ev.kind === 'model' ? { ...ev, replayed: true } : ev, sid))
           } catch (err) {
             log?.(`session-tail: onEvent threw: ${(err as Error).message}`)
           }
@@ -1322,6 +1343,9 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
         const size = statSync(file).size
         cursor = computeFirstAttachCursor(file, size)
         if (cursor < size) {
+          // #3427 H2: everything below size-at-attach is pre-restart history;
+          // model events projected from it are marked `replayed` in readNew.
+          replayUntilByFile.set(file, size)
           log?.(`session-tail: attached to ${file} (cursor=${cursor}, replaying in-flight turn from offset; size=${size})`)
         } else {
           log?.(`session-tail: attached to ${file} (cursor=${cursor})`)

package/telegram-plugin/tests/activity-card-wiring.test.ts

@@ -58,6 +58,53 @@ describe('activity-card durability wiring', () => {
     expect(recordCode).not.toMatch(/pinned: true/)
   })
 
+  // F6 (persist-intent-first ordering): the durable record must be written in
+  // the SAME synchronous block as the send, BEFORE the status-pin reconcile and
+  // with NO `await` between the send resolving and the persist — otherwise the
+  // crash window in which a sent card has no reapable record reopens. Structural
+  // lock (the gateway IIFE can't be instantiated in-process); complements the
+  // behavioural store/reaper tests in activity-card-store.test.ts.
+  it('(F6) persists the record BEFORE the status-pin reconcile, with no await between send and persist', () => {
+    const openBranch = between(
+      laneSrc,
+      'if (turn.activityMessageId == null) {',
+      'turn.activityLastSentRender = target',
+    )
+    const persistIdx = openBranch.indexOf('writeActivityCardRecord(')
+    const pinIdx = openBranch.indexOf('void reconcileStatusPin(')
+    expect(persistIdx).toBeGreaterThanOrEqual(0)
+    expect(pinIdx).toBeGreaterThanOrEqual(0)
+    // Persist-intent-first: the record write precedes the pin reconcile.
+    expect(persistIdx).toBeLessThan(pinIdx)
+    // No `await` sits between the send returning and the persist — the whole
+    // window from `const sent =` to writeActivityCardRecord( is synchronous.
+    const sendToPersist = between(openBranch, 'const sent = await robustApiCall', 'writeActivityCardRecord(')
+    const codeOnly = sendToPersist
+      .split('\n')
+      .filter((l) => !l.trim().startsWith('//') && !l.trim().startsWith('*'))
+      .join('\n')
+    expect(codeOnly).not.toMatch(/\bawait\b/)
+  })
+
+  // F5 (persist-intent honesty): the persisted `pinned` mirrors the ACTUAL pin
+  // decision (PIN_STATUS_WHILE_WORKING), never a bare `pinned: true`. This is
+  // also asserted in the OPEN test above; kept as a named F5 lock so a rename or
+  // refactor that reintroduces an unconditional `pinned: true` is caught here too.
+  it('(F5) the persisted record mirrors the real pin decision, not an unconditional pinned:true', () => {
+    const openBranch = between(
+      laneSrc,
+      'if (turn.activityMessageId == null) {',
+      'turn.activityLastSentRender = target',
+    )
+    const recordBlock = between(openBranch, 'writeActivityCardRecord(', 'void reconcileStatusPin(')
+    const recordCode = recordBlock
+      .split('\n')
+      .filter((l) => !l.trim().startsWith('//'))
+      .join('\n')
+    expect(recordCode).toMatch(/pinned: PIN_STATUS_WHILE_WORKING/)
+    expect(recordCode).not.toMatch(/pinned: true/)
+  })
+
   it('the normal-CLOSE path clears the durable handle, id-scoped (reap-race guard)', () => {
     const closeBody = between(
       laneSrc,