switchroom 0.19.2 → 0.19.3

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -53,7 +53,11 @@ import { resolveChatIdFallback } from './chat-id-fallback.js'
 import { isFinalAnswerReply, isSubstantiveFinalReply } from '../final-answer-detect.js'
 import { decideOverPing, type OverPingDecision } from '../over-ping-safety-net.js'
 import { decideSilentReplyAnchor } from '../silent-reply-anchor.js'
-import { decideSupersedeCorrection, type FlushedTurnSupersedeRegistry } from '../flushed-turn-supersede.js'
+import {
+  decideSupersedeCorrection,
+  flushedAnswerMatchesReply,
+  type FlushedTurnSupersedeRegistry,
+} from '../flushed-turn-supersede.js'
 import { decideAnswerLatchSuppression } from '../reply-owner-resolve.js'
 import { deriveTelegraphTitle } from '../telegraph.js'
 import {
@@ -872,10 +876,16 @@ export async function sendReply(
     // resolvers agree and the late-reply supersede fires by identity.
     const ownerTurn = resolveReplyOwnerTurn(turn, chat_id, args)
     const resolvedTurnId = ownerTurn?.turnId ?? null
+    // #3429 — pass the (normalized) reply text so the registry can apply the
+    // new-content gate: identity match + TTL alone also fits an async handback
+    // that merely resolved this flush-delivered ENDED turn as its owner via
+    // the latest-ended tier. Editing the flushed message in place with that
+    // handback's text does not re-notify client-side (Telegram edits never
+    // push) — the observed silent non-surfacing of msgs 10482/10486.
     const decision = flushedTurnSupersede.take(
       chat_id,
       replyThreadId,
-      { liveTurnId: resolvedTurnId, now: Date.now() },
+      { liveTurnId: resolvedTurnId, replyText: text, now: Date.now() },
     )
     if (decision.supersede) {
       process.stderr.write(
@@ -899,20 +909,31 @@ export async function sendReply(
       // resolves the same ended owner turn, sees the latch, and is suppressed —
       // exactly one message ever ships. The latch is idempotent and the normal
       // (no-throw) path is unaffected: the correction below still ships B once.
-      if (ownerTurn != null) ownerTurn.answerDelivered = true
+      // Tagged 'flush' (#3426): a flush record existed for this turn (take()
+      // just consumed it), so the flushed message A is what the suppression
+      // protects against duplicating. #3429: stash the record's flushed text
+      // alongside, so the retry's latch check can discriminate by content —
+      // the retry of THIS superseding reply matches and stays suppressed, while
+      // a later genuinely-new handback does not and delivers.
+      if (ownerTurn != null) {
+        ownerTurn.answerDelivered = 'flush'
+        if (decision.recordText != null) ownerTurn.flushedAnswerText = decision.recordText
+      }
     } else {
       // 2026-07 double-reply-on-DM fix (Part 2) — answer-delivered race latch.
       // Supersede found no record. Either there was no flush (normal reply), or
       // the flush FIRED but has not yet recorded its message ids (the residual
       // pre-record race Part 1's supersede cannot reach). The flush sets
-      // `answerDelivered = true` synchronously at fire time (before its async
-      // send AND before `record`), and it persists on the ended turn — so when
-      // this LATE, substantive reply resolves its owner turn and sees the latch
-      // already set, the flush's message A is already on its way out and this
-      // reply would ship a duplicate. Suppress it. Scoped to the substantive
-      // ≥`FLUSH_SUBSTANTIVE_MIN_CHARS` floor and the late-reply case so an
-      // interim sub-floor ack, a chunked multi-part answer, or a legitimate
-      // second in-turn substantive reply (live `currentTurn`) is never
+      // `answerDelivered = 'flush'` synchronously at fire time (before its
+      // async send AND before `record`), and it persists on the ended turn — so
+      // when this LATE, substantive reply resolves its owner turn and sees the
+      // FLUSH-armed latch, the flush's message A is already on its way out and
+      // this reply would ship a duplicate. Suppress it. Scoped to the
+      // substantive ≥`FLUSH_SUBSTANTIVE_MIN_CHARS` floor, the late-reply case,
+      // AND the 'flush' latch source (#3426) so an interim sub-floor ack, a
+      // chunked multi-part answer, a legitimate second in-turn substantive
+      // reply (live `currentTurn`), or an async sub-agent handback landing
+      // after a reply-delivered turn ended (latch = 'reply') is never
       // suppressed. `isSubstantiveFinalReply` reduces to the ≥200-char test on
       // the `reply` path (no `done`); pass the model's original notification
       // intent to mirror the #2533 decoupling call shape.
@@ -920,12 +941,33 @@ export async function sendReply(
         text: rawText,
         disableNotification: args.disable_notification === true,
       })
+      // #3429 — content evidence for the latch. `'new-content'` is the
+      // registry's POSITIVE determination that this reply differs from the
+      // flushed answer (record present, identity matched, text did not);
+      // otherwise compare against the owner turn's stashed `flushedAnswerText`
+      // (covers the post-fire pre-record race window, where no record exists
+      // yet but the fire site already stamped what it is delivering). Null —
+      // no flushed text to compare — keeps the conservative pre-#3429
+      // flush-armed suppression.
+      const replyMatchesFlushedAnswer: boolean | null =
+        decision.reason === 'new-content'
+          ? false
+          : ownerTurn?.flushedAnswerText != null
+            ? flushedAnswerMatchesReply(ownerTurn.flushedAnswerText, text)
+            : null
       const suppressByLatch = decideAnswerLatchSuppression({
         superseded: false,
         replySubstantive,
         isLateReply: turn == null,
         ownerAnswerDelivered: ownerTurn?.answerDelivered ?? false,
+        replyMatchesFlushedAnswer,
       })
+      if (decision.reason === 'new-content') {
+        process.stderr.write(
+          `telegram gateway: reply: flush supersede declined — new content (#3429) ` +
+          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)}; sending fresh\n`,
+        )
+      }
       if (suppressByLatch) {
         process.stderr.write(
           `telegram gateway: reply: suppressed by answer-delivered latch ` +
@@ -934,11 +976,22 @@ export async function sendReply(
         )
         return { content: [{ type: 'text', text: 'sent (deduped — answer already delivered via turn-flush)' }] }
       }
-      // A substantive answer is going out via this reply — set the latch on its
-      // owner turn so a later bridge-replayed / reworded duplicate of the same
-      // answer is caught by the branch above.
+      // A substantive answer is going out via this reply — record it on the
+      // owner turn, tagged 'reply' (#3426). The 'reply' tag does NOT trip the
+      // late-reply suppression above: a later reply attributed to this turn
+      // after it ends (the async sub-agent handback pattern — dispatch, interim
+      // ack, turn_end, handback with no live gateway turn) is genuinely new
+      // content and must deliver. Byte-identical replays of THIS answer are
+      // deduped by the content-keyed #546 cache at the top of this function.
+      // Honest bound: the dedup TTL (60 s) is anchored at reply RECORD time,
+      // while the latest-ended owner tier's 60 s is anchored at `endedAt` —
+      // later by the reply→turn_end gap. A byte-identical replay landing >60 s
+      // after record but ≤60 s after endedAt is evicted from dedup yet still
+      // resolves this ended turn, so it now DELIVERS as a duplicate message.
+      // Conscious trade: a rare duplicate beats the silent handback drop the
+      // boolean latch caused (#3426).
       if (replySubstantive && ownerTurn != null) {
-        ownerTurn.answerDelivered = true
+        ownerTurn.answerDelivered = 'reply'
       }
     }
   }

package/telegram-plugin/gateway/session-model-source.ts

@@ -20,6 +20,28 @@
  * whichever was observed last. A fresh assistant line always reclaims the
  * transcript as the source; a confirmed switch always beats an older
  * transcript line. Pinned by tests/session-model-source.test.ts.
+ *
+ * Divergence tripwire (#3427 item 4): `--fallback-model` masks an invalid
+ * requested model id — claude silently serves the fallback while the override
+ * carries the requested token. The FIRST live transcript observation of the
+ * post-relaunch session is therefore the earliest deterministic verification
+ * point: when the injected comparator says the served id does NOT satisfy the
+ * requested token, the registered divergence handler fires (once per armed
+ * override) so the gateway can log + warn instead of self-healing silently.
+ *
+ * Two false-positive guards (#3437 review H1/H2 — "a false accusation must be
+ * impossible" is the contract, enforced HERE, not by caller discipline):
+ *   - H1: verification arms ONLY on an explicit `setOverride(model,
+ *     { verify: true })` — the boot-rehydration site, where the override IS
+ *     the launched token of the session now serving. A command-time
+ *     `setOverride(model)` (the pre-restart status-honesty record in
+ *     scheduleModelRelaunch) must NOT arm: an assistant line landing in the
+ *     pre-restart window is served by the OLD model and would false-mismatch
+ *     the NEW requested token.
+ *   - H2: observations flagged `replayed: true` (the session-tail's
+ *     first-attach replay of a prior session's in-flight turn — OLD-model
+ *     lines delivered AFTER boot) neither consume nor fire verification;
+ *     the tripwire waits for the first LIVE observation.
  */
 
 export interface SessionModelResolution {
@@ -30,14 +52,45 @@ export interface SessionModelResolution {
   source: 'transcript' | 'override'
 }
 
+/** The first live post-override assistant line served a different model (#3427). */
+export interface SessionModelDivergence {
+  /** The override token the operator requested (`/model <token>`). */
+  requested: string
+  /** The transcript's `message.model` — the model actually serving calls. */
+  served: string
+}
+
+export interface SessionModelSourceOptions {
+  /**
+   * Comparator for the divergence tripwire: does `served` (a resolved
+   * transcript id) satisfy `requested` (the override token)? Must be
+   * CONSERVATIVE — return true when the pair is not deterministically
+   * comparable (see servedModelMatchesRequested in model-command.ts).
+   * Absent → the tripwire never fires (verification is skipped).
+   */
+  servedMatchesRequested?: (requested: string, served: string) => boolean
+}
+
 export interface SessionModelSource {
-  /** Record a transcript observation (an assistant line's `message.model`,
-   *  already sentinel-filtered by the session-tail projection). */
-  noteTranscriptModel(model: string): void
-  /** Record an override set (a positively-confirmed /model switch), or clear
-   *  it with null. Setting stamps a fresh sequence, so the override wins over
-   *  every EARLIER transcript observation until a new assistant line lands. */
-  setOverride(model: string | null): void
+  /**
+   * Record a transcript observation (an assistant line's `message.model`,
+   * already sentinel-filtered by the session-tail projection). Pass
+   * `replayed: true` for lines delivered by the session-tail's first-attach
+   * replay (a PRIOR session's in-flight turn): they still update /status
+   * freshness exactly as before, but are excluded from divergence
+   * verification (H2 — they carry the pre-relaunch model).
+   */
+  noteTranscriptModel(model: string, opts?: { replayed?: boolean }): void
+  /**
+   * Record an override set (a positively-confirmed /model switch), or clear
+   * it with null. Setting stamps a fresh sequence, so the override wins over
+   * every EARLIER transcript observation until a new assistant line lands.
+   * `verify: true` additionally ARMS divergence verification for this
+   * override — pass it ONLY when the override is the launched token of the
+   * session currently serving (the boot-rehydration site). Default: not
+   * armed (H1 — command-time/rollback sets must never arm).
+   */
+  setOverride(model: string | null, opts?: { verify?: boolean }): void
   /** Current override value (the #2982 in-memory record), independent of
    *  freshness — for callers that need the override itself (e.g. the model
    *  menu's "session" marker), not the /status resolution. */
@@ -45,18 +98,42 @@ export interface SessionModelSource {
   /** The freshest observation across both sources, or null when neither has
    *  reported yet. */
   resolve(): SessionModelResolution | null
+  /** Register the handler fired when the first LIVE transcript observation
+   *  after an ARMED override fails the comparator (#3427 item 4). At most
+   *  once per armed override; null unregisters. Replaces any prior handler. */
+  setDivergenceHandler(handler: ((d: SessionModelDivergence) => void) | null): void
 }
 
-export function createSessionModelSource(): SessionModelSource {
+export function createSessionModelSource(
+  options: SessionModelSourceOptions = {},
+): SessionModelSource {
   let seq = 0
   let transcript: { model: string; seq: number } | null = null
   let override: { model: string; seq: number } | null = null
+  // True while an ARMED ({ verify: true }) non-null override awaits its first
+  // LIVE transcript observation. Consumed (set false) on that observation
+  // whether or not it diverges, so the handler fires at most once per armed
+  // override. Replayed observations neither consume nor fire (H2).
+  let overrideUnverified = false
+  let onDivergence: ((d: SessionModelDivergence) => void) | null = null
   return {
-    noteTranscriptModel(model: string): void {
+    noteTranscriptModel(model: string, opts?: { replayed?: boolean }): void {
       transcript = { model, seq: ++seq }
+      if (opts?.replayed === true) return // H2: pre-relaunch line — no verification
+      if (override != null && overrideUnverified) {
+        overrideUnverified = false
+        const matches = options.servedMatchesRequested
+        if (matches != null && !matches(override.model, model)) {
+          onDivergence?.({ requested: override.model, served: model })
+        }
+      }
     },
-    setOverride(model: string | null): void {
+    setOverride(model: string | null, opts?: { verify?: boolean }): void {
       override = model == null ? null : { model, seq: ++seq }
+      // H1: only an explicit verify-arm (the boot-rehydration site) starts
+      // verification; a plain set (command-time record, rollback restore)
+      // clears any pending arm — its token is NOT what is serving right now.
+      overrideUnverified = model != null && opts?.verify === true
     },
     getOverride(): string | null {
       return override?.model ?? null
@@ -69,5 +146,8 @@ export function createSessionModelSource(): SessionModelSource {
       }
       return { model: transcript.model, source: 'transcript' }
     },
+    setDivergenceHandler(handler: ((d: SessionModelDivergence) => void) | null): void {
+      onDivergence = handler
+    },
   }
 }

package/telegram-plugin/gateway/stream-render.ts

@@ -307,6 +307,9 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
           // 2026-07 double-reply-on-DM fix (Part 2) — answer-delivered race
           // latch, reset at turn start alongside the other answer flags.
           answerDelivered: false,
+          // #3429 — flushed-answer text for the content-vs-flush latch
+          // discrimination; stamped at flush arm, reset at turn start.
+          flushedAnswerText: null,
           // 2026-07 double-reply-on-DM fix (F2) — stamped at turn end.
           endedAt: null,
           firstPingAt: null,
@@ -535,7 +538,10 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
       if (turn != null) {
         turn.currentModel = ev.model
       }
-      sessionModelSource.noteTranscriptModel(ev.model)
+      // `replayed` (#3427 H2): a first-attach replay line carries the
+      // PRE-restart session's model — record it for freshness (unchanged
+      // behavior) but exclude it from divergence verification.
+      sessionModelSource.noteTranscriptModel(ev.model, { replayed: ev.replayed === true })
       return
     }
     case 'usage': {
@@ -1623,16 +1629,25 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
         // corrects it in place.
         //
         // TWO distinct arbiters set synchronously here, before any `await`:
-        //   (a) `turn.answerDelivered` — the backstop-vs-LATE-REPLY signal the
-        //       reply path already reads (`decideAnswerLatchSuppression` +
-        //       `flushedTurnSupersede`), exactly as on `main`.
+        //   (a) `turn.answerDelivered = 'flush'` — the backstop-vs-LATE-REPLY
+        //       signal the reply path already reads
+        //       (`decideAnswerLatchSuppression` + `flushedTurnSupersede`).
+        //       Source-tagged 'flush' (#3426): the late-reply suppression is
+        //       scoped to flush-armed latches, so a later async handback
+        //       attributed to a reply-delivered ended turn is never dropped.
         //   (b) `backstopDeliveryLedger.claim` — the backstop-vs-BACKSTOP
         //       double-fire latch: `claim` returning false means this turn
         //       already fired a backstop (answer-ready quiescence, then the
         //       turn-end backstop), so this fire is a no-op. It does NOT
         //       arbitrate the late reply (that is (a)); it is redundant-but-
         //       cheap with the `currentTurn == null` bail below.
-        turn.answerDelivered = true
+        turn.answerDelivered = 'flush'
+        // #3429 — stamp WHAT the flush is delivering alongside the arm, so the
+        // late-reply suppression can discriminate by content: a late reply
+        // carrying this same answer is the flush race (suppress/supersede); a
+        // late reply carrying DIFFERENT content is a genuinely new async
+        // handback attributed to this ended turn and must send fresh.
+        turn.flushedAnswerText = capturedText
         const backstopLatchClaimed = backstopDeliveryLedger.claim(turn.turnId)
 
         // #654 deterministic double-message fix. Hand off the pinned
@@ -1830,6 +1845,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               if (backstopCtrl) backstopCtrl.finalize('error')
               backstopDeliveryLedger.release(turn.turnId)
               turn.answerDelivered = false
+              turn.flushedAnswerText = null // #3429 — cleared with the latch
             } else if (backstopCtrl) {
               backstopCtrl.finalize('done')
             }
@@ -1854,6 +1870,7 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
             process.stderr.write(`telegram gateway: turn-flush post-delivery bookkeeping failed: ${(err as Error).message}\n`)
             if (!delivered) {
               turn.answerDelivered = false
+              turn.flushedAnswerText = null // #3429 — cleared with the latch
               backstopDeliveryLedger.release(turn.turnId)
               if (backstopCtrl) backstopCtrl.finalize('error')
             }

package/telegram-plugin/quota-bar-format.ts

@@ -147,18 +147,41 @@ export function buildBar(pct: number, elapsedFrac: number): string {
 
 // ── account status (title-line suffix) ───────────────────────────────
 
-export type QuotaBarAccountStatus = 'active' | 'exhausted' | 'idle';
+export type QuotaBarAccountStatus =
+  | 'active'
+  | 'org-disabled'
+  | 'retired'
+  | 'exhausted'
+  | 'idle';
+
+/** Title-line display word for each status (some differ from the enum key). */
+const STATUS_LABEL: Record<QuotaBarAccountStatus, string> = {
+  active: 'active',
+  'org-disabled': 'DISABLED (org)',
+  retired: 'retired',
+  exhausted: 'exhausted',
+  idle: 'idle',
+};
 
 /**
- * Title-line status word. `active` wins over `exhausted` (the fleet's
- * pinned account is reported as active even if the broker also flags it
- * exhausted — matches the locked example where the operator wants to know
- * WHICH account is live first, and its health second, from the two window
- * rows underneath). Otherwise: `exhausted` if the broker's own flag says
- * so, else `idle` (present, healthy, just not the current pick).
+ * Title-line status word. Precedence: `active` > `DISABLED (org)` > `retired` >
+ * `exhausted` > `idle`.
+ *   - `active` wins over everything (the fleet's pinned account is reported
+ *     active even if also flagged exhausted — the operator wants WHICH account
+ *     is live first, health second, from the window rows underneath).
+ *   - `org-disabled` (entitlement block, PR2) and `retired` (`in_service` false:
+ *     removed from every config list) are OUT OF SERVICE — never "idle", which
+ *     reads as an available-but-unused account.
+ *   - else `exhausted` if the broker flags it, else `idle`.
  */
-export function accountStatus(isActive: boolean, exhausted: boolean): QuotaBarAccountStatus {
+export function accountStatus(
+  isActive: boolean,
+  exhausted: boolean,
+  opts: { inService?: boolean; entitlementBlocked?: boolean } = {},
+): QuotaBarAccountStatus {
   if (isActive) return 'active';
+  if (opts.entitlementBlocked === true) return 'org-disabled';
+  if (opts.inService === false) return 'retired';
   if (exhausted) return 'exhausted';
   return 'idle';
 }
@@ -188,8 +211,9 @@ export function renderQuotaBarAccount(
   quota: QuotaUtilization | null,
   now: Date = new Date(),
   demo = false,
+  service: { inService?: boolean; entitlementBlocked?: boolean } = {},
 ): string[] {
-  const status = accountStatus(isActive, exhausted);
+  const status = accountStatus(isActive, exhausted, service);
   // Title line wraps `label` in GFM `**bold**`, NOT a code span — so this
   // needs `escapeMarkdown` (backslash-escapes *, _, [, ], etc.), not
   // `codeSpanSafe` (which only defuses backticks and is only correct
@@ -197,7 +221,18 @@ export function renderQuotaBarAccount(
   // was a bug: a label containing e.g. `**` or `[x](url)` would break the
   // bold run or inject a markdown link into the card.
   const displayLabel = demo ? maskEmail(label) : label;
-  const lines: string[] = [`- **${escapeMarkdown(displayLabel)}** (${status})`];
+  const lines: string[] = [`- **${escapeMarkdown(displayLabel)}** (${STATUS_LABEL[status]})`];
+  // Out-of-service accounts (retired / org-disabled) have no meaningful live
+  // windows — a 0%/0% bar would read as "available", the exact bug this fixes.
+  // Replace the two window rows with a single status note (shape stays a list).
+  if (status === 'retired' || status === 'org-disabled') {
+    const note =
+      status === 'org-disabled'
+        ? 'disabled by org — no fleet routing'
+        : 'retired — removed from fleet rotation';
+    lines.push(`- ⚫ \`${note}\``);
+    return lines;
+  }
   if (!quota || isProbeThin(quota)) {
     // Data-quality gap. A failed / thin probe carries NO real utilization
     // signal, so it must NOT render as a healthy 🟢 0% bar — that's
@@ -288,10 +323,21 @@ export function renderQuotaBarBlock(
   const now = opts.now ?? new Date();
   const demo = opts.demo ?? false;
   const lines: string[] = [];
-  for (const snap of snapshots) {
+  // Out-of-service accounts (retired / org-disabled) sort LAST — stable
+  // partition preserves the caller's active-first ordering among the rest.
+  const outOfService = (s: AccountSnapshot) =>
+    !s.isActive && (s.entitlementBlocked === true || s.inService === false);
+  const ordered = [
+    ...snapshots.filter((s) => !outOfService(s)),
+    ...snapshots.filter(outOfService),
+  ];
+  for (const snap of ordered) {
     const exhausted = exhaustedByLabel.get(snap.label) ?? false;
     lines.push(
-      ...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo),
+      ...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo, {
+        inService: snap.inService,
+        entitlementBlocked: snap.entitlementBlocked,
+      }),
     );
   }
   return lines.join('\n');
@@ -319,6 +365,8 @@ export function renderQuotaBarBlockFromListState(
     quotaError: acc.last_quota ? undefined : 'no cached quota (no probe since broker start)',
     expiresAtMs: acc.expiresAt,
     capturedAtMs: acc.last_quota?.capturedAt,
+    inService: acc.in_service,
+    entitlementBlocked: acc.entitlement_blocked,
   }));
   return renderQuotaBarBlock(snapshots, exhaustedByLabel, { now });
 }

package/telegram-plugin/reply-owner-resolve.ts

@@ -107,6 +107,42 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
   )
 }
 
+/**
+ * The answer-delivered latch value — SOURCE-TAGGED (#3426).
+ *
+ * `false`   — no answer delivered this turn (latch unarmed).
+ * `'flush'` — the TURN-FLUSH backstop delivered (or is mid-delivering) this
+ *             turn's answer as its own message A. Set synchronously at
+ *             flush-fire time, and at supersede-record consumption (the
+ *             resurrection window — a flush record existed for this turn).
+ * `'reply'` — a normally-delivered `reply` tool call carried this turn's
+ *             answer (no flush involved).
+ *
+ * Why the tag exists: the late-reply suppression below is a race backstop for
+ * FLUSH duplicates only. A boolean latch also suppressed the async sub-agent
+ * handback pattern (#3426): the parent turn's interim ack (a substantive
+ * `reply`) armed the latch, the turn ended, and the sub-agent completion
+ * handback — a genuinely NEW answer arriving with no live gateway turn —
+ * resolved the ended turn as owner (latest-ended tier, inside the 60 s
+ * supersede TTL), saw the stale latch, and was silently dropped with a false
+ * "deduped" success. Tagging the source lets the suppression fire ONLY for the
+ * flush races it exists for; byte-identical replays of a reply-delivered
+ * answer remain covered by the content-keyed outbound dedup (#546).
+ *
+ * Honest bound on that dedup cover: the #546 TTL (60 s) is anchored at reply
+ * RECORD time, while the latest-ended owner tier's 60 s is anchored at the
+ * turn's `endedAt` — later by the reply→turn_end gap. A byte-identical replay
+ * landing >60 s after record but ≤60 s after endedAt is evicted from dedup yet
+ * still resolves the ended turn, so it DELIVERS as a duplicate message. That
+ * is a conscious trade: this fix also drops the weak "reworded/bridge-replayed
+ * duplicate" suppression the reply-armed boolean latch used to provide —
+ * replays of an un-acked tool_call are byte-identical (content dedup's case),
+ * and a model-REGENERATED paraphrase is indistinguishable from a genuinely new
+ * handback, so delivering it is the correct default. A rare duplicate message
+ * beats the silent handback drop.
+ */
+export type AnswerDeliveredLatch = false | 'flush' | 'reply'
+
 /**
  * The answer-delivered latch inputs (Part 2 — the race backstop).
  *
@@ -118,11 +154,11 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
  * There `flushed-turn-supersede` finds no record (nothing to delete yet) and the
  * reply would ship message B as a duplicate of the flush's message A.
  *
- * The latch closes that window: the gateway sets `answerDelivered = true` on the
- * turn atom SYNCHRONOUSLY at flush-fire time — before the ~500 ms async send and
- * before the record — and the flag persists on the ended turn (readable via the
- * unified resolver after `currentTurn` is null). A reply landing in the race
- * window then sees the latch already set and suppresses itself.
+ * The latch closes that window: the gateway sets `answerDelivered = 'flush'` on
+ * the turn atom SYNCHRONOUSLY at flush-fire time — before the ~500 ms async send
+ * and before the record — and the flag persists on the ended turn (readable via
+ * the unified resolver after `currentTurn` is null). A reply landing in the race
+ * window then sees the flush latch already set and suppresses itself.
  */
 export interface AnswerLatchSuppressInput {
   /** True when Part 1's supersede already fired for THIS reply (message A was
@@ -140,21 +176,50 @@ export interface AnswerLatchSuppressInput {
    *  legitimate second in-turn substantive reply (a genuine multi-message
    *  answer, live currentTurn) untouched. */
   isLateReply: boolean
-  /** The resolved owner turn's `answerDelivered` latch. */
-  ownerAnswerDelivered: boolean
+  /** The resolved owner turn's source-tagged `answerDelivered` latch. */
+  ownerAnswerDelivered: AnswerDeliveredLatch
+  /** #3429 — content evidence: does the landing reply carry the SAME answer
+   *  the flush delivered (`flushedAnswerMatchesReply` against the supersede
+   *  record's text or the owner turn's stashed `flushedAnswerText`)?
+   *    - `false`  → POSITIVE evidence of genuinely new content (an async
+   *                 handback attributed to the flush-delivered ended turn).
+   *                 Suppressing it would silently drop the user's answer —
+   *                 never suppress.
+   *    - `true`   → the reply is the flushed answer landing again — suppress
+   *                 (the flush race the latch exists for).
+   *    - `null` / omitted → no flushed text available to compare (legacy atom,
+   *                 pre-#3429 caller). Conservative: keep the pre-#3429
+   *                 flush-armed suppression. */
+  replyMatchesFlushedAnswer?: boolean | null
 }
 
 /**
  * Decide whether the answer-delivered latch suppresses a landing reply.
  *
  * Suppress IFF: Part 1 did NOT already supersede, the reply is a substantive
- * final answer, it is a late reply (no live turn), AND the owner turn's latch is
- * already set (the flush delivered the same substantive answer as message A in
- * the pre-record race window). Otherwise the reply sends.
+ * final answer, it is a late reply (no live turn), AND the owner turn's latch
+ * was armed by the TURN-FLUSH path (`'flush'` — the flush delivered the same
+ * substantive answer as message A in the pre-record race window, or the
+ * supersede-consumed resurrection window). Otherwise the reply sends.
+ *
+ * A `'reply'`-armed latch deliberately does NOT suppress (#3426): the prior
+ * answer went out via a normal, completed `reply`, so a later late-landing
+ * reply attributed to that ended turn is NOT a flush duplicate — it is
+ * (typically) an async sub-agent handback carrying genuinely new content, and
+ * suppressing it silently drops the user's answer. Byte-identical replays of
+ * the delivered reply are still deduped by the content-keyed #546 cache.
+ *
+ * #3429 refinement: even a FLUSH-armed latch does not suppress when there is
+ * POSITIVE content evidence (`replyMatchesFlushedAnswer === false`) that the
+ * landing reply is NOT the flushed answer — an async handback attributed to a
+ * flush-delivered ended turn must send fresh, not vanish. Absent evidence
+ * (`null`/omitted) the flush-armed suppression holds, preserving the #2996
+ * Part 2 race backstop.
  */
 export function decideAnswerLatchSuppression(input: AnswerLatchSuppressInput): boolean {
   if (input.superseded) return false
   if (!input.replySubstantive) return false
   if (!input.isLateReply) return false
-  return input.ownerAnswerDelivered
+  if (input.replyMatchesFlushedAnswer === false) return false
+  return input.ownerAnswerDelivered === 'flush'
 }

package/telegram-plugin/session-tail.ts

@@ -100,7 +100,12 @@ export type SessionEvent =
   // same batch already reflects the current model. Sentinels (`<synthetic>` on
   // compaction lines, fixture junk) are filtered at projection — see
   // isModelSentinel — so this only ever carries a real resolved model id.
-  | { kind: 'model'; model: string }
+  // `replayed: true` marks a model observation delivered by the FIRST-ATTACH
+  // replay of a prior session's in-flight turn (computeFirstAttachCursor) —
+  // it reflects the PRE-restart session's model, not the live one. Consumers
+  // that verify the live model (#3427 divergence tripwire, H2) must skip
+  // replayed observations; freshness consumers may still record them.
+  | { kind: 'model'; model: string; replayed?: boolean }
   | { kind: 'tool_use'; toolName: string; toolUseId?: string | null; input?: Record<string, unknown>; precomputedLabel?: string }
   // Real-time tool label from the PreToolUse-hook sidecar — fires when the
   // hook writes the label (synchronous at tool-call time), independent of
@@ -1217,6 +1222,17 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
   // re-attach.
   const fileCursors = new Map<string, { cursor: number; pendingPartial: string }>()
 
+  // First-attach REPLAY window per file (#3427 H2): when attachToFile replays
+  // a prior session's in-flight turn (computeFirstAttachCursor returned an
+  // offset below the size-at-attach), every byte below that size is HISTORY
+  // written by the pre-restart session. Model observations projected from it
+  // must be marked `replayed` so the divergence tripwire ignores them.
+  // Granularity is the read CHUNK (a batch whose read started inside the
+  // window is marked wholesale) — deliberately conservative: over-marking a
+  // boundary batch can only delay verification to the next live line, never
+  // false-accuse.
+  const replayUntilByFile = new Map<string, number>()
+
   function readNew(): void {
     if (stopped || !currentFile) return
     try {
@@ -1226,9 +1242,14 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
         // stored per-file state for this path.
         cursor = 0
         pendingPartial = ''
-        if (currentFile != null) fileCursors.delete(currentFile)
+        if (currentFile != null) {
+          fileCursors.delete(currentFile)
+          replayUntilByFile.delete(currentFile)
+        }
       }
       if (stat.size === cursor) return
+      const chunkStart = cursor
+      const isReplayChunk = chunkStart < (replayUntilByFile.get(currentFile) ?? 0)
       const buf = Buffer.alloc(stat.size - cursor)
       const fd = openSync(currentFile, 'r')
       try {
@@ -1247,7 +1268,7 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
         const sid = sessionIdForFile(currentFile)
         for (const ev of events) {
           try {
-            onEvent(decorate(ev, sid))
+            onEvent(decorate(isReplayChunk && ev.kind === 'model' ? { ...ev, replayed: true } : ev, sid))
           } catch (err) {
             log?.(`session-tail: onEvent threw: ${(err as Error).message}`)
           }
@@ -1322,6 +1343,9 @@ export function startSessionTail(config: SessionTailConfig): SessionTailHandle {
         const size = statSync(file).size
         cursor = computeFirstAttachCursor(file, size)
         if (cursor < size) {
+          // #3427 H2: everything below size-at-attach is pre-restart history;
+          // model events projected from it are marked `replayed` in readNew.
+          replayUntilByFile.set(file, size)
           log?.(`session-tail: attached to ${file} (cursor=${cursor}, replaying in-flight turn from offset; size=${size})`)
         } else {
           log?.(`session-tail: attached to ${file} (cursor=${cursor})`)