switchroom 0.19.19 → 0.19.22

package/telegram-plugin/tests/vault-request-access-unlock-resume.test.ts

@@ -34,6 +34,19 @@ const gatewaySrc =
   // P7 PR-8 (#2996): vault pending-op intercept moved to inbound-interceptors.ts.
   readFileSync(resolve(__dirname, '..', 'gateway', 'inbound-interceptors.ts'), 'utf-8')
 
+/**
+ * #3627 extracted the prompt COPY into `buildAccessPassphrasePromptText` and
+ * the prompt SEND into `sendAccessPassphrasePrompt`, so both the first prompt
+ * and the wrong-passphrase re-prompt share one implementation. The pins below
+ * anchor on those two blocks instead of the inline text they replaced.
+ */
+const promptBuilder =
+  gatewaySrc
+    .split('export function buildAccessPassphrasePromptText')[1]
+    ?.split('export function createCallbackQueryHandlers')[0] ?? ''
+const promptSender =
+  gatewaySrc.split('async function sendAccessPassphrasePrompt')[1]?.split('\n/**')[0] ?? ''
+
 describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
   it('declares the passphrase-for-access-approve PendingVaultOp variant', () => {
     // fails when: the new PendingVaultOp kind is dropped. The
@@ -54,8 +67,11 @@ describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
     expect(approveBlock).toMatch(/pendingVaultOps\.set/)
     expect(approveBlock).toMatch(/passphrase-for-access-approve/)
     // Card text must invite a passphrase reply, not punt to a
-    // /vault unlock detour.
-    expect(approveBlock).toMatch(/Reply with your passphrase/i)
+    // /vault unlock detour. #3627 moved the body into the shared
+    // `buildAccessPassphrasePromptText` builder, so the copy pin lives
+    // there now; the approve block must still route into it.
+    expect(approveBlock).toMatch(/sendAccessPassphrasePrompt\(/)
+    expect(promptBuilder).toMatch(/Reply with your passphrase/i)
     // The "ask the agent to re-issue the request card" copy belonged
     // to the pre-fix path. Should be gone from the cache-miss branch.
     expect(approveBlock).not.toMatch(/ask the agent to re-issue the request card/)
@@ -67,12 +83,14 @@ describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
     // edit fires no notification and stays stapled to the card's old
     // position, so a busy topic buries it and the operator never sees
     // the passphrase ask (the reported v0.16.45 admin-key miss). The
-    // prompt must be a fresh `sendRichMessage` below.
-    const approveBlock =
-      gatewaySrc.split('if (action === \'approve\')')[1]?.split('await ctx.answerCallbackQuery({ text: \'Unknown action\'')[0] ?? ''
+    // prompt must be a fresh `sendRichMessage` (#3627: from the shared
+    // `sendAccessPassphrasePrompt` helper, used by BOTH the first
+    // prompt and the wrong-passphrase re-prompt).
     // A distinct passphrase-prompt send exists (verb-tagged).
-    expect(approveBlock).toMatch(/sendRichMessage\(pending\.chat_id, richMessage\(promptText\)/)
-    expect(approveBlock).toMatch(/vault_request_access\.passphrase_prompt/)
+    expect(promptSender).toMatch(/sendRichMessage\(target\.chat_id, richMessage\(promptText\)/)
+    expect(promptSender).toMatch(/vault_request_access\.passphrase_prompt/)
+    // And it is never an in-place edit of the original card.
+    expect(promptSender).not.toMatch(/editMessageText/)
   })
 
   it('passphrase prompt renders via richMessage — no raw literal-markdown edit', () => {
@@ -86,25 +104,26 @@ describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
     const approveBlock =
       gatewaySrc.split('if (action === \'approve\')')[1]?.split('await ctx.answerCallbackQuery({ text: \'Unknown action\'')[0] ?? ''
     // The prompt text is assembled once and wrapped in richMessage.
-    expect(approveBlock).toMatch(/const promptText =/)
+    expect(promptSender).toMatch(/const promptText = buildAccessPassphrasePromptText\(spec\)/)
     // Regression guard: the old raw-string admin-only edit copy is gone.
     expect(approveBlock).not.toMatch(/requires your vault passphrase to grant/)
     // Regression guard: no string-concatenated richMessage() object
-    // (the "[object Object]" bug) remains.
-    expect(approveBlock).not.toMatch(/\+\s*\n\s*richMessage\(/)
+    // (the "[object Object]" bug) remains — anywhere in the vault
+    // callback source, not just the approve block (#3627 fixed the
+    // last surviving instance, the standing-ACL resolution edit).
+    expect(gatewaySrc).not.toMatch(/\+\s*\n\s*richMessage\(/)
   })
 
   it('passphrase prompt is attention-grabbing and does NOT suppress notifications', () => {
     // fails when: the prompt loses its strong header or someone adds
     // disable_notification to it. The whole point of the fix is that
     // the operator gets PINGED — a silent prompt is the bug.
-    const approveBlock =
-      gatewaySrc.split('if (action === \'approve\')')[1]?.split('await ctx.answerCallbackQuery({ text: \'Unknown action\'')[0] ?? ''
-    expect(approveBlock).toMatch(/ACTION NEEDED: passphrase required/)
+    // #3627: 🚨 (not ⚠️) leads the header — this blocks an approval the
+    // operator already tapped, so it outranks a generic warning.
+    expect(promptBuilder).toMatch(/\*\*🚨🔐 ACTION NEEDED: passphrase required\*\*/)
+    expect(promptBuilder).not.toMatch(/⚠️🔐 ACTION NEEDED/)
     // The send options for the prompt must not carry disable_notification.
-    const promptSend =
-      approveBlock.split('const promptText =')[1]?.split('return')[0] ?? ''
-    expect(promptSend).not.toMatch(/disable_notification/)
+    expect(promptSender).not.toMatch(/disable_notification/)
   })
 
   it('passphrase intercept deletes the chat message and resumes mint', () => {
@@ -140,20 +159,22 @@ describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
     expect(handlerBlock).toMatch(/editMessageText/)
   })
 
-  it('mint failure (e.g. wrong passphrase) edits the card; does not silent-drop', () => {
+  it('mint failure (non-passphrase) edits the card; does not silent-drop', () => {
     // fails when: performVaultAccessApproval's error branch returns
-    // without editing the card. Without the edit, a wrong-passphrase
+    // without editing the card. Without the edit, a failed mint
     // attempt leaves the locked-vault prompt on screen forever and
     // the operator can't tell whether the system saw their reply.
     //
     // Anchor: performVaultAccessApproval's `result.kind === 'error'`
-    // branch.
+    // branch. #3627: a PASSPHRASE-MISMATCH error now returns early for
+    // the retry loop; everything else keeps the terminal edit + drop.
     const mintHelper =
       gatewaySrc.split('async function performVaultAccessApproval')[1]?.split('async function handleVaultRequestAccessCallback')[0] ?? ''
     expect(mintHelper).toMatch(/result\.kind === 'error'/)
     // After error: card edited AND pending entry dropped (no
-    // zombie staged request).
-    expect(mintHelper).toMatch(/editMessageText[\s\S]{0,400}mint_grant failed/)
+    // zombie staged request). The edit goes through `editResolvedCard`,
+    // which falls back to a fresh message when the edit itself fails.
+    expect(mintHelper).toMatch(/editResolvedCard[\s\S]{0,400}mint_grant failed/)
     expect(mintHelper).toMatch(/pendingVaultRequestAccesses\.delete/)
   })
 })

package/telegram-plugin/tests/worker-feed-coalesce.test.ts

@@ -1,11 +1,15 @@
 import { describe, expect, it } from 'vitest'
 import {
   createWorkerActivityFeed,
+  renderWorkerActivity,
   type BotApiForWorkerFeed,
   type WorkerActivityView,
 } from '../worker-activity-feed.js'
 import { renderCombinedWorkerFeed, combinedHistoryDepth } from '../tool-activity-summary.js'
-import { STATUS_CARD_CHAR_BUDGET } from '../status-no-truncate.js'
+import { STATUS_CARD_CHAR_BUDGET, WORKER_STEP_INDENT } from '../status-no-truncate.js'
+import { COLLAPSE_SAFE_SEPARATOR } from '../card-format.js'
+import { richMessage } from '../rich-send.js'
+import { parseRichEntities, validateRichMarkdown } from './rich-markdown-oracle.js'
 import { createSendGate, isSendGateShed, type Clock } from '../send-gate.js'
 
 /**
@@ -1235,3 +1239,231 @@ describe('worker numbering — stable per-card ordinals end to end (#3298)', ()
     expect(h.edits.length).toBe(landed)
   })
 })
+
+// ── Per-worker step indent on the combined card ───────────────────────────────
+//
+// The multi-worker card put its `✓`/`→` step lines at the SAME left margin as
+// the numbered worker header lines, so where one worker ended and the next
+// began was invisible at a glance (operator report, 2026-07). Steps now nest
+// one level under their worker.
+//
+// The indent MUST be a U+2800 run. Card bodies go to Telegram as raw GFM
+// markdown (`richMessage` → `sendRichMessage` / `editMessageText({ markdown })`,
+// #2669) and are parsed server-side by a CommonMark/GFM-family parser that
+// LEFT-TRIMS a leading whitespace run — ASCII *and* Unicode. #3662 shipped three
+// U+00A0 and was inert: the bytes reached the Bot API intact and the card still
+// rendered flat, because U+00A0 is category Zs. U+2800 BRAILLE PATTERN BLANK is
+// category So — zero ink, non-zero width, not whitespace to any trimming rule —
+// and was live-verified on a phone on 2026-07-26.
+//
+// So these tests assert the indent's CHARACTER PROPERTY as well as its bytes: a
+// byte-only assertion is exactly what let #3662 ship green while broken.
+describe('combined worker card — steps indent under their worker (U+2800)', () => {
+  /** The indent glyph. */
+  const BLANK = '\u2800'
+  /** The #3666 pinned-bar collapse separator — TRAILING, structurally distinct. */
+  const NBSP = '\u00A0'
+  const rowsFor = (n: number) =>
+    Array.from({ length: n }, (_, i) => ({
+      description: `worker task ${i + 1}`,
+      elapsedMs: 60_000 * (i + 1),
+      toolCount: 3,
+      ordinal: i + 1,
+      currentStep: `w${i + 1} step b`,
+      historyLines: [`w${i + 1} step a`, `w${i + 1} step b`],
+    }))
+
+  /** Card lines as sent (the body is hard-break joined by stackCardLines). */
+  const linesOf = (body: string) => body.split('\n').map((l) => l.replace(/[ \t]+$/, ''))
+
+  it('every step line starts with the U+2800 indent; header and chrome lines do not', () => {
+    const body = renderCombinedWorkerFeed(rowsFor(3), { maxRows: 8 })!
+    const lines = linesOf(body)
+    const stepLines = lines.filter((l) => l.includes('✓ w') || l.includes('→ w'))
+    const headerLines = lines.filter((l) => /\*\*\d\. worker task/.test(l))
+
+    expect(stepLines.length).toBe(6) // 3 workers × 2 steps
+    expect(headerLines.length).toBe(3)
+    // Load-bearing: the exact indent bytes. `WORKER_STEP_INDENT` is U+2800 ×3;
+    // a plain-ASCII `'   '` indent fails this assertion, so does the U+00A0 run
+    // #3662 shipped, and so does flat output with no prefix at all.
+    for (const l of stepLines) {
+      expect(l.startsWith(WORKER_STEP_INDENT)).toBe(true)
+      expect(l.startsWith(BLANK)).toBe(true)
+      expect(l.startsWith(' ')).toBe(false)
+      expect(l.startsWith(NBSP)).toBe(false)
+    }
+    // Workers stay at the left margin so the nesting reads as nesting.
+    for (const l of headerLines) expect(l.startsWith(BLANK)).toBe(false)
+    expect(lines[0].startsWith('🛠')).toBe(true)
+  })
+
+  it('golden body — each worker header is immediately followed by ITS indented steps', () => {
+    // The assertions above are set-membership only: they count step lines and
+    // header lines and check prefixes independently, so a refactor that emitted
+    // all three headers and THEN all six steps — nesting completely destroyed —
+    // would still pass every one of them. This pins the full line ORDER, which
+    // is the actual thing the fix is for: a step must sit under its own worker.
+    const body = renderCombinedWorkerFeed(rowsFor(3), { maxRows: 8 })!
+    const I = WORKER_STEP_INDENT
+    // `S` is the pinned-bar collapse separator (#3666): every line that is
+    // followed by a hard break carries one trailing U+00A0 so the pinned-message
+    // bar (which drops the newline and substitutes nothing) does not mash the
+    // last glyph of a line into the first glyph of the next. It is TRAILING and
+    // exactly one char — structurally distinct from the LEADING three-char
+    // `WORKER_STEP_INDENT`, which is what this golden is really pinning.
+    const S = COLLAPSE_SAFE_SEPARATOR
+    expect(linesOf(body)).toEqual([
+      `🛠 **Workers** · _3 running · oldest 3m00s · 9 tools_${S}`,
+      `**1. worker task 1** _· 1m00s · 3 tools_${S}`,
+      `${I}~~_✓ w1 step a_~~${S}`,
+      `${I}**→ w1 step b**${S}`,
+      `**2. worker task 2** _· 2m00s · 3 tools_${S}`,
+      `${I}~~_✓ w2 step a_~~${S}`,
+      `${I}**→ w2 step b**${S}`,
+      `**3. worker task 3** _· 3m00s · 3 tools_${S}`,
+      `${I}~~_✓ w3 step a_~~${S}`,
+      `${I}**→ w3 step b**`, // last line: nothing follows it to collide with
+    ])
+  })
+
+  // ── The assertion that would have caught #3662 ──────────────────────────
+  //
+  // Every OTHER test in this file (and in pinned-card-collapse.test.ts) asserts
+  // the string we hand the Bot API. #3662 shipped a U+00A0 indent that passed
+  // ALL of them and still rendered dead flat on a phone, because the stripping
+  // happens SERVER-SIDE: Telegram's CommonMark-family parser left-trims an
+  // inline whitespace run at the head of a content line, and U+00A0 is Unicode
+  // whitespace (category Zs). A byte assertion cannot observe that.
+  //
+  // So assert the PROPERTY that decides the outcome instead of the bytes: the
+  // indent must not be composed of characters that ANY whitespace-trimming rule
+  // — ASCII `/\s/`, Unicode `White_Space`, or category `Zs` — can classify as
+  // whitespace. U+2800 BRAILLE PATTERN BLANK qualifies: category So (Symbol,
+  // other), zero ink, non-zero width. Live-verified on a phone 2026-07-26.
+  const isTrimmableWhitespace = (ch: string) =>
+    /\s/u.test(ch) || /\p{White_Space}/u.test(ch) || /\p{Zs}/u.test(ch)
+
+  it('WORKER_STEP_INDENT is not Unicode whitespace — a Zs indent is trimmed server-side', () => {
+    const chars = [...WORKER_STEP_INDENT]
+    // Pin the WIDTH too: a single blank char reads as near-flat on a phone and
+    // would silently undo this fix while keeping the character class green.
+    expect(chars.length).toBe(3)
+    for (const ch of chars) {
+      const cp = `U+${ch.codePointAt(0)!.toString(16).toUpperCase().padStart(4, '0')}`
+      expect(
+        isTrimmableWhitespace(ch),
+        `WORKER_STEP_INDENT contains ${cp}, which is Unicode whitespace (\\s / White_Space / Zs). ` +
+          `Telegram parses card bodies server-side and LEFT-TRIMS a leading whitespace run, so this ` +
+          `indent renders FLAT on a phone — exactly the #3662 failure this test exists to catch ` +
+          `(#3662 shipped three U+00A0; the bytes reached the Bot API intact and the card was still ` +
+          `flat). The indent must be a zero-ink glyph that is NOT whitespace-categorised: use U+2800 ` +
+          `BRAILLE PATTERN BLANK (category So), live-verified on a real phone 2026-07-26.`,
+      ).toBe(false)
+    }
+  })
+
+  it('the whitespace predicate actually rejects every plausible wrong choice', () => {
+    // A property assertion is only worth having if the property discriminates.
+    // These are the characters a future edit would reach for as "a blank-looking
+    // indent"; every one is ASCII space/tab or category Zs, and every one is
+    // left-trimmed server-side.
+    const flatOnAPhone = [
+      ' ', // ASCII SPACE
+      '\t', // TAB
+      '\u00A0', // NO-BREAK SPACE — what #3662 shipped
+      '\u2002', // EN SPACE
+      '\u2003', // EM SPACE
+      '\u2007', // FIGURE SPACE
+      '\u200A', // HAIR SPACE
+      '\u3000', // IDEOGRAPHIC SPACE
+    ]
+    for (const bad of flatOnAPhone) expect(isTrimmableWhitespace(bad)).toBe(true)
+    // …and it accepts the one we ship.
+    expect(isTrimmableWhitespace('\u2800')).toBe(false)
+  })
+
+  it('WORKER_STEP_INDENT is exactly three U+2800 BRAILLE PATTERN BLANK', () => {
+    // Byte pin, the companion to the property test above: that one says "not
+    // whitespace", this one says "the specific glyph we live-tested".
+    expect(WORKER_STEP_INDENT).toBe('\u2800'.repeat(3))
+    expect(/^[\u2800]+$/.test(WORKER_STEP_INDENT)).toBe(true)
+    // And not a GFM block-structure lead-in: a leading `·` was also tried live
+    // and Telegram promoted it to a real list bullet, which breaks the
+    // `stackCardLines` precondition that card lines are never block-structure
+    // lines (card-format.ts) — the next worker header gets absorbed as a lazy
+    // continuation.
+    expect(/^[-*+>|#·]/.test(WORKER_STEP_INDENT)).toBe(false)
+  })
+
+  it('the `starting…` placeholder line is indented too', () => {
+    const body = renderCombinedWorkerFeed(
+      [
+        { description: 'fresh worker', elapsedMs: 1000, toolCount: 0, ordinal: 1, currentStep: '' },
+        ...rowsFor(1),
+      ],
+      { maxRows: 8 },
+    )!
+    const starting = linesOf(body).find((l) => l.includes('starting…'))!
+    expect(starting).toBeDefined()
+    expect(starting.startsWith(WORKER_STEP_INDENT)).toBe(true)
+    expect(starting.startsWith(BLANK)).toBe(true)
+  })
+
+  it('the indent survives the real outbound guard chain byte-for-byte and stays parseable', () => {
+    const body = renderCombinedWorkerFeed(rowsFor(3), { maxRows: 8 })!
+    // `richMessage` is the ONE adapter every `{ markdown }` wire send funnels
+    // through (rich-send.ts) — it must not escape, strip, or rewrite the indent.
+    const wire = richMessage(body).markdown
+    expect(wire).toBe(body)
+    expect(wire.includes(`${WORKER_STEP_INDENT}**→ w1 step b**`)).toBe(true)
+    expect(wire.includes(`${BLANK}**→ w1 step b**`)).toBe(true)
+    // Adding the indent introduced no fence/emphasis corruption.
+    //
+    // Scope, deliberately understated: `validateRichMarkdown` checks fence
+    // balance, unterminated inline code/links, and emphasis pairing ONLY (see
+    // tests/rich-markdown-oracle.ts). It models NEITHER leading-whitespace
+    // stripping NOR indented code blocks, so a regression to four ASCII spaces
+    // would ALSO return `[]` here. This is NOT rendering evidence and must not
+    // be read as proof that the indent survives Telegram's parser — that
+    // question is server-side and unobservable from this repo (see the honest
+    // limit note on WORKER_STEP_INDENT in status-no-truncate.ts). The byte
+    // assertions above are what discriminate an ASCII indent.
+    expect(validateRichMarkdown(wire)).toEqual([])
+    // …and the indent stays OUTSIDE the markdown spans — it must not land
+    // inside an emphasis run (which would style the blanks). Note this checks
+    // OUR OWN capture regexes in the oracle, not Telegram's real entity
+    // offsets; it pins where we place the indent relative to the `**`/`~~`
+    // delimiters, which is the part this repo actually controls.
+    const ents = parseRichEntities(wire)
+    expect(ents.some((e) => e.type === 'bold' && e.text === '→ w1 step b')).toBe(true)
+    expect(ents.some((e) => e.type === 'strikethrough' && e.text === '_✓ w1 step a_')).toBe(true)
+    expect(ents.every((e) => !e.text.includes(BLANK))).toBe(true)
+    expect(ents.every((e) => !e.text.includes(NBSP))).toBe(true)
+  })
+
+  it('the SINGLE-worker 🛠 card is untouched (no indent on its step lines)', () => {
+    const single = renderWorkerActivity({
+      workerId: 'w1',
+      description: 'lone worker',
+      latestSummary: 'step b',
+      narrativeLines: ['step a', 'step b'],
+      elapsedMs: 60_000,
+      toolCount: 3,
+      state: 'running',
+    })
+    expect(single).toContain('~~_✓ step a_~~')
+    expect(single).toContain('**→ step b**')
+    // No LEADING indent: the single-worker card has nothing to nest under, so
+    // its step lines must sit flush at the left margin. Asserted per line on the
+    // leading edge rather than as "no U+00A0 anywhere in the card", because
+    // #3666 puts one TRAILING U+00A0 on every hard-broken line of every pinned
+    // card (this one included) as the collapse separator. A regression that
+    // leaked WORKER_STEP_INDENT onto these lines still fails here.
+    for (const l of single.split('\n')) {
+      expect(l.startsWith(BLANK)).toBe(false)
+      expect(l.startsWith(NBSP)).toBe(false)
+      expect(l.startsWith(WORKER_STEP_INDENT)).toBe(false)
+    }
+  })
+})

package/telegram-plugin/tool-activity-summary.ts

@@ -89,6 +89,7 @@ import {
   WORKER_HISTORY_MAX,
   STATUS_LINE_MAX,
   NESTED_PREFIX,
+  WORKER_STEP_INDENT,
 } from './status-no-truncate.js'
 import { escapeMarkdown, stripMarkdown, truncate, stackCardLines } from './card-format.js'
 import { isTelegramSurfaceTool } from './tool-names.js'
@@ -297,6 +298,11 @@ function escapeStepLine(raw: string): string {
  * `allDone`    — when true ALL steps render done (✓ struck italic); when false the
  *                newest renders in-progress (→ bold)
  * `liveSuffix` — appended INSIDE the newest in-progress line (heartbeat tick)
+ * `indent`     — literal prefix put on EVERY emitted line (incl. the
+ *                `+N earlier…` header), OUTSIDE the markdown spans so it never
+ *                lands inside an emphasis run. Default `''` — byte-identical
+ *                output for callers that don't indent. The combined worker card
+ *                passes `WORKER_STEP_INDENT` to nest steps under their worker.
  */
 export function renderStepFeed(
   out: string[],
@@ -304,14 +310,19 @@ export function renderStepFeed(
   allDone: boolean,
   liveSuffix = '',
   window: number = STATUS_ROLLING_LINES,
+  indent = '',
 ): void {
   if (steps.length === 0) return
   const shown = steps.slice(-Math.max(1, window))
   const hidden = steps.length - shown.length
-  if (hidden > 0) out.push(`_✓ +${hidden} earlier…_`)
+  if (hidden > 0) out.push(`${indent}_✓ +${hidden} earlier…_`)
   const lastIdx = shown.length - 1
   shown.forEach((s, i) => {
-    out.push(!allDone && i === lastIdx ? `**→ ${s}${liveSuffix}**` : `~~_✓ ${s}_~~`)
+    out.push(
+      !allDone && i === lastIdx
+        ? `${indent}**→ ${s}${liveSuffix}**`
+        : `${indent}~~_✓ ${s}_~~`,
+    )
   })
 }
 
@@ -439,7 +450,10 @@ export function renderStatusCard(opts: StatusCardOpts): string | null {
   // Stack lines with GFM hard breaks (`  \n`) so the card's styled prose lines
   // don't collapse onto one visual line in the rich-message renderer — see
   // stackCardLines. This is what makes a card render identically to a reply.
-  const joined = stackCardLines(out)
+  // collapseSafe (#3666): the agent status card and the single-worker card are
+  // both PINNED, and Telegram's pinned bar shows them collapsed to one line
+  // with the newlines dropped — the separator keeps that preview legible.
+  const joined = stackCardLines(out, { collapseSafe: true })
   if (joined.length <= STATUS_CARD_CHAR_BUDGET) return joined
   return fitCardToBudget(opts, headerLines)
 }
@@ -492,7 +506,8 @@ function fitCardToBudget(opts: StatusCardOpts, headerLines: string[]): string {
     const lastIdx = shown.length - 1
     shown.forEach((esc, i) => lines.push(buildBullet(esc, i === lastIdx)))
     lines.push(...footerLines)
-    const candidate = stackCardLines(lines)
+    // collapseSafe: same pinned surface as renderStatusCard (#3666).
+    const candidate = stackCardLines(lines, { collapseSafe: true })
     if (candidate.length <= STATUS_CARD_CHAR_BUDGET) return candidate
   }
 
@@ -518,7 +533,7 @@ function fitCardToBudget(opts: StatusCardOpts, headerLines: string[]): string {
   if (parentMarker != null) lines.push(parentMarker)
   lines.push(newestLine)
   lines.push(...footerLines)
-  return stackCardLines(lines)
+  return stackCardLines(lines, { collapseSafe: true })
 }
 
 /**
@@ -729,18 +744,54 @@ export function combinedHistoryDepth(w: number): number {
 /** Alias for readability at the single-worker call site — same curve. */
 export const workerHistoryDepth = combinedHistoryDepth
 
+/**
+ * The combined card's first line: a SELF-CONTAINED glance at the whole swarm
+ * (#3666) — `🛠 Workers · 3 running · oldest 38m16s · 196 tools · 1.2M tok`.
+ *
+ * Two jobs, both load-bearing:
+ *
+ *   1. In the feed it answers "what is my fleet doing" without reading the
+ *      rows — the aggregate the per-row lines never showed.
+ *   2. In Telegram's pinned bar, where the card collapses to ONE line, it is
+ *      the part most likely to survive truncation, so the preview leads with
+ *      real information instead of a four-word chrome stub that ran into
+ *      row 1's ordinal (`… 3 running1. Fix issue …`).
+ *
+ * It always ends in a UNIT WORD (`running` / `oldest <elapsed>` / `tools` /
+ * `tok`), never a bare number, so the first collapse seam reads as
+ * `… · 196 tools 1. Fix issue …` — a list starting after a unit — rather than
+ * two numbers colliding. Aggregates cover ALL rows (including any spilled to
+ * `+M more working…`), matching the `N running` count beside them.
+ */
+function glanceLine(rows: CombinedWorkerRow[]): string {
+  const oldestMs = rows.reduce((m, r) => Math.max(m, r.elapsedMs), 0)
+  const tools = rows.reduce((n, r) => n + r.toolCount, 0)
+  const tok = rows.reduce((n, r) => n + (r.totalTokens ?? 0), 0)
+  const toolWord = tools === 1 ? 'tool' : 'tools'
+  return (
+    `🛠 **Workers** · _${rows.length} running · oldest ${formatFeedElapsed(oldestMs)}` +
+    ` · ${tools} ${toolWord}${tokenSegment(tok)}_`
+  )
+}
+
 /**
  * Render N≥1 live workers into ONE combined feed body (ready Telegram
  * markdown; callers send verbatim — do NOT re-escape). Layout:
  *
- *   🛠 **Workers** · _N running_
+ *   🛠 **Workers** · _N running · oldest {elapsed} · {n} tools · {t} tok_
  *   **1. {desc1}** _· {elapsed} · {n} tools_
- *   ~~_✓ {earlier step}_~~
- *   **→ {newest step}**
+ *      ~~_✓ {earlier step}_~~
+ *      **→ {newest step}**
  *   **2. {desc2}** _· {elapsed} · {n} tools_
- *   **→ {newest step}**
+ *      **→ {newest step}**
  *   _+M more working…_
  *
+ * INDENT: every step line carries a leading `WORKER_STEP_INDENT` (a U+2800 run
+ * — neither ASCII spaces nor U+00A0; Telegram left-trims BOTH, see the
+ * constant's doc comment) so the steps nest under their worker header and the
+ * per-worker blocks are scannable. Header and chrome lines stay at the left
+ * margin.
+ *
  * NUMBERING (#3298): when the card tracks 2+ rows AND a row carries `ordinal`,
  * its header gets a stable `{ordinal}. ` prefix. Ordinals are assigned by the
  * caller at dispatch and kept for the card's life — after an earlier worker
@@ -755,6 +806,15 @@ export const workerHistoryDepth = combinedHistoryDepth
  * card staying bounded regardless of fan-out. When a worker has no history yet
  * it falls back to a single `→ starting…`/currentStep line.
  *
+ * PINNED-BAR READABILITY (#3666): line 1 is a self-contained glance
+ * (`glanceLine`) and the stack is joined with `collapseSafe`, because this card
+ * is pinned and Telegram's pinned bar renders it collapsed onto ONE line with
+ * the newlines dropped and NOTHING substituted. Both halves are needed: the
+ * glance so the preview leads with information, the per-line separator so every
+ * later seam (`opus 5` → `✓ …` → `→ …`) degrades to a word gap instead of a
+ * mashed glyph. There is no Bot API for a separate pin-bar preview — the client
+ * derives it from the message text — so the text is the only lever.
+ *
  * Pure. Rows are rendered in the order supplied (the manager passes them
  * dispatch-order, oldest first). `maxRows` caps the visible rows; the hidden
  * remainder collapses to a single `+M more working…` line. A total-budget
@@ -802,13 +862,13 @@ export function renderCombinedWorkerFeed(
     // Per-worker depth follows Ken's deterministic curve max(3, 7−w) (#3349):
     // the curve drives DEPTH; the total-line budget below drives ROW COUNT.
     const depth = combinedHistoryDepth(shown.length)
-    const chrome: string[] = [`🛠 **Workers** · _${rows.length} running_`]
+    const chrome: string[] = [glanceLine(rows)]
     const bodyOut: string[] = []
     for (const r of shown) {
       bodyOut.push(rowHeader(r))
       const hist = rowHistory(r)
       if (hist.length === 0) {
-        bodyOut.push('→ _starting…_')
+        bodyOut.push(`${WORKER_STEP_INDENT}→ _starting…_`)
         continue
       }
       // Paint the last-K history lines with the SAME `✓`/`→` idiom as the
@@ -816,12 +876,24 @@ export function renderCombinedWorkerFeed(
       // pipeline (escapeStepLine), then renderStepFeed strikes the prior steps
       // and bolds the newest in-progress step. The window equals the depth so a
       // per-worker `+N earlier…` marker never appears inside the combined feed.
+      //
+      // WORKER_STEP_INDENT nests every step line one level under its worker
+      // header, so the boundary between two workers is visible at a glance on a
+      // phone (the header lines stay at the left margin, their steps sit in).
+      // It is a U+2800 run. NOT ASCII spaces and NOT U+00A0: Telegram's
+      // server-side parser left-trims a leading Unicode-whitespace run, so both
+      // render flat (#3662 shipped U+00A0 and was inert). U+2800 is category So,
+      // not Zs. See the constant's doc comment for the live evidence.
       const esc = hist.slice(-depth).map(escapeStepLine)
-      renderStepFeed(bodyOut, esc, false, '', depth)
+      renderStepFeed(bodyOut, esc, false, '', depth, WORKER_STEP_INDENT)
     }
     const out = [...chrome, ...bodyOut]
     if (hidden > 0) out.push(`_+${hidden} more working…_`)
-    return { body: stackCardLines(out), bodyLines: bodyOut.length }
+    // collapseSafe (#3666): this card is PINNED, and Telegram's pinned bar
+    // renders it collapsed to one line with the newlines dropped and nothing
+    // substituted. Without the separator the glance line runs straight into
+    // row 1's ordinal and every step glyph mashes into the previous line.
+    return { body: stackCardLines(out, { collapseSafe: true }), bodyLines: bodyOut.length }
   }
 
   // Cap to maxRows first, then shrink the visible set while EITHER the total

package/telegram-plugin/worker-activity-feed.ts

@@ -53,6 +53,7 @@ import {
   cleanWorkerResultParagraph,
   stripMarkdown,
   truncate,
+  COLLAPSE_SAFE_SEPARATOR,
 } from './card-format.js'
 import { WORKER_HISTORY_MAX } from './status-no-truncate.js'
 import {
@@ -245,7 +246,10 @@ export function renderWorkerActivity(v: WorkerActivityView, liveSuffix = ''): st
     // Header-only running render → append the starting placeholder with a GFM
     // hard break (`  \n`) so it stacks under the header instead of collapsing
     // onto the header line in the rich-message renderer (matches stackCardLines).
-    return `${card}  \n_starting…_`
+    // The collapse separator is carried here too (#3666) — this card is pinned,
+    // and a hand-rolled seam would be the one boundary that still mashed in
+    // Telegram's pinned bar.
+    return `${card}${COLLAPSE_SAFE_SEPARATOR}  \n_starting…_`
   }
   return card
 }