switchroom 0.19.23 → 0.19.25

package/telegram-plugin/gateway/gateway.ts

@@ -489,7 +489,7 @@ import {
 import {
   resolveReplyOwnerTurnId,
   resolveReplyOwnerTier,
-  type ReplyOwnerTier,
+  type ReplyOwnerTier, type ReplyOwnerCandidates,
   type AnswerDeliveredLatch,
 } from '../reply-owner-resolve.js'
 import { SubagentHandbackMarker } from './subagent-handback-marker.js'
@@ -717,6 +717,7 @@ import {
 } from './emission-authority.js'
 import { CurrentTurnMap } from './current-turn-map.js'
 import { resolveAnswerThreadId } from './answer-thread-resolve.js'
+import { latestTurnForChat } from './latest-turn-lookup.js'
 import { decideObligationTurnEnd } from './obligation-turn-end.js'
 import { maybeRotate, resolveAgentStateDir, resolveTurnsJsonlPath } from './turns-jsonl-rotate.js'
 import {
@@ -3484,12 +3485,14 @@ export type CurrentTurn = {
   flushedAnswerText: string | null
   // 2026-07 double-reply-on-DM fix (F2 — recency bound). Wall-clock ms the turn
   // ENDED (stamped once by `endCurrentTurnAtomic`), or null while still live.
-  // The `findLatestEndedTurnForChat` supersede tier carries DESTRUCTIVE
-  // authority (it drives message deletion), so `resolveReplyOwnerTurn` only
-  // honours a latest-ended turn whose `endedAt` is within the supersede TTL —
+  // The `latest-ended` supersede tier carries DESTRUCTIVE authority (it drives
+  // message deletion), so `resolveReplyOwnerTurn` only honours a latest-ended
+  // turn whose `endedAt` is non-null (#3725 — the registry is populated at turn
+  // START, so the tail entry may still be RUNNING) AND within the supersede TTL —
   // otherwise a late reply belonging to an OLDER turn could resolve its owner to
-  // a NEWER turn sitting at the registry tail and delete that newer turn's legit
-  // answer. Unbounded routing use of `findLatestEndedTurnForChat` is unaffected.
+  // a NEWER turn at the registry tail and delete that turn's legit answer. The
+  // unbounded ROUTING use (`endedOnly: false`) is unaffected: it only picks a
+  // topic to deliver into and deletes nothing.
   endedAt: number | null
   // #1675 (over-ping safety net): wall-clock ms of the first reply
   // this turn that landed with `disable_notification: false` (a real
@@ -3999,21 +4002,18 @@ const LATE_REPLY_TOPIC_RECOVERY_ENABLED =
   process.env.SWITCHROOM_LATE_REPLY_TOPIC_RECOVERY !== '0'
 
 /**
- * The most-recently-started turn for a chat from the bounded recently-ended
- * registry — the deterministic fallback for a LATE answer reply when the model
- * echoed no `origin_turn_id` and `currentTurn` has already cleared. Iterates in
- * insertion order so the last match is the most recent turn for that chat.
- * Returns null when the chat has no remembered turn (so the caller keeps the
- * legacy result). NB: this is the chat's own most-recent TURN, not the
- * `chatThreadMap` last-seen-any-message heuristic that caused the wrong-topic
- * bug — a late reply almost always belongs to the turn that just ended.
+ * The most recent turn for a chat from the bounded recent-turn registry — the
+ * deterministic fallback for a LATE answer reply when the model echoed no
+ * `origin_turn_id` and `currentTurn` has already cleared. Returns null when the
+ * chat has no matching turn (so the caller keeps the legacy result). NB: this is
+ * the chat's own most-recent TURN, not the `chatThreadMap` last-seen-any-message
+ * heuristic that caused the wrong-topic bug. `endedOnly` selects the consumer's
+ * semantics — routing takes the tail entry even when that turn is still RUNNING;
+ * the destructive `latest-ended` owner tier takes only a genuinely ENDED turn,
+ * because the registry is populated at turn START (#3725; see the module).
  */
-function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
-  let latest: CurrentTurn | null = null
-  for (const t of recentTurnsById.values()) {
-    if (t.sessionChatId === chatId) latest = t
-  }
-  return latest
+function findLatestTurnForChat(chatId: string, opts: { endedOnly: boolean }): CurrentTurn | null {
+  return latestTurnForChat(recentTurnsById.values(), chatId, opts)
 }
 
 /**
@@ -4029,7 +4029,7 @@ function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
  *   1. the live `currentTurn` passed in (null once the flush nulled the atom);
  *   2. `findTurnByOriginId(origin_turn_id)` — the model echo;
  *   3. `findTurnByQuotedMessageId(chat_id, reply_to)` — framework-owned quote;
- *   4. `findLatestEndedTurnForChat(chat_id)` — the chat's last-ended turn.
+ *   4. `findLatestTurnForChat(chat_id, {endedOnly:true})` — last ENDED turn.
  * Returns the CurrentTurn for the winning id (so callers can read its
  * `answerDelivered` latch), or null when every lookup missed.
  */
@@ -4037,10 +4037,10 @@ function resolveReplyOwnerTurn(
   liveTurn: CurrentTurn | null,
   chatId: string,
   args: Record<string, unknown>,
-): { turn: CurrentTurn | null; tier: ReplyOwnerTier } {
+): { turn: CurrentTurn | null; tier: ReplyOwnerTier; candidates: ReplyOwnerCandidates } {
   const origin = findTurnByOriginId(args.origin_turn_id as string | undefined)
   const quoted = findTurnByQuotedMessageId(chatId, args.reply_to)
-  const latestEnded = findLatestEndedTurnForChat(chatId)
+  const latestEnded = findLatestTurnForChat(chatId, { endedOnly: true })
   const byId = new Map<string, CurrentTurn>()
   // Populate lowest-precedence first so a higher tier's turn wins the id slot
   // when two lookups resolve the same turn (they carry the same turnId anyway).
@@ -4049,12 +4049,12 @@ function resolveReplyOwnerTurn(
   }
   // F2 — bound the DESTRUCTIVE latest-ended tier to the supersede TTL so a stale
   // latest-ended turn can't inherit deletion authority over a newer turn's flush
-  // record. `endedAt` is null only for a turn still resolvable but not yet ended
-  // (not a supersede risk); leave the age unset then (unbounded) rather than
-  // fabricate one.
+  // record. #3725: the lookup above is `endedOnly`, so `endedAt` is non-null here
+  // and the age is ALWAYS a real number — a not-yet-ended turn is no longer a
+  // candidate at all, and an explicit null age now fails CLOSED downstream.
   const latestEndedAgeMs =
     latestEnded?.endedAt != null ? Date.now() - latestEnded.endedAt : null
-  const candidates = {
+  const candidates: ReplyOwnerCandidates = {
     liveTurnId: liveTurn?.turnId ?? null,
     originTurnId: origin?.turnId ?? null,
     quotedTurnId: quoted?.turnId ?? null,
@@ -4062,15 +4062,14 @@ function resolveReplyOwnerTurn(
     latestEndedAgeMs,
     latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
   }
-  // #3429 — the WINNING tier travels with the turn. A positive tier
-  // (live/origin/quoted) means the reply is this turn's own answer and the
-  // supersede fires regardless of text; the ambiguous `latest-ended` fallback
-  // keeps the content gate (it cannot tell a late own-reply from an async
-  // sub-agent handback). Both derive from the SAME candidates, so the id and the
-  // tier can never disagree.
+  // #3429 — the winning tier AND the candidate set it came from travel with the
+  // turn. Tier alone no longer decides the content-gate bypass: the
+  // model-steerable `origin`/`quoted` tiers must be CORROBORATED against the
+  // framework-derived `latestEndedTurnId` (`decideContentGateBypass`). All three
+  // derive from these SAME candidates, so they can never disagree.
   const tier = resolveReplyOwnerTier(candidates)
   const winnerId = resolveReplyOwnerTurnId(candidates)
-  return { turn: winnerId != null ? (byId.get(winnerId) ?? null) : null, tier }
+  return { turn: winnerId != null ? (byId.get(winnerId) ?? null) : null, tier, candidates }
 }
 
 /**
@@ -4115,7 +4114,7 @@ function resolveAnswerThreadWithLog(
     explicitThreadId == null &&
     originTurn == null &&
     liveTurn == null
-      ? findLatestEndedTurnForChat(chatId)
+      ? findLatestTurnForChat(chatId, { endedOnly: false })
       : null
   const threadId = resolveAnswerThreadId({
     explicitThreadId,

package/telegram-plugin/gateway/latest-turn-lookup.ts

@@ -0,0 +1,60 @@
+/**
+ * The recently-seen-turn registry scan, extracted from `gateway.ts` as a pure
+ * function so its ENDED-ness contract is unit-testable (#3725; gateway.ts is not
+ * importable in tests — the repo's `decideTurnFlush` / `resolveReplyOwnerTurnId`
+ * pattern).
+ *
+ * ## Why `endedOnly` exists (#3725)
+ *
+ * `recentTurnsById` is populated at turn **start** (`rememberRecentTurn` fires
+ * from the `enqueue` lifecycle event in `stream-render.ts`), and the atom is
+ * built with `endedAt: null`; `endedAt` is stamped later, in `turn-end.ts`. So
+ * the registry's tail entry for a chat is the most-recently-STARTED turn, which
+ * may still be RUNNING. The registry is also chat-wide and thread-agnostic, so
+ * on a forum a turn running in ANOTHER topic sits at the tail.
+ *
+ * That distinction is load-bearing because the two consumers want different
+ * things:
+ *
+ *   - **Routing** (`resolveAnswerThreadWithLog`) wants the chat's most recent
+ *     turn whether or not it has ended — it only picks a topic to deliver into,
+ *     and a still-running turn's topic is a perfectly good (indeed better)
+ *     answer than falling back to General. `endedOnly: false`.
+ *   - **Owner resolution** (`resolveReplyOwnerTurn` → the `latest-ended`
+ *     supersede tier) wants a genuinely ENDED turn: that tier carries
+ *     DESTRUCTIVE authority (it drives message deletion) and is bounded by the
+ *     supersede TTL measured from `endedAt`. A turn with `endedAt == null` has
+ *     no age, so it could not be TTL-bounded at all — it was an unbounded
+ *     anchor for the corroborated content-gate bypass (#3725). A still-running
+ *     turn must be resolved by the `live` tier, never by this fallback.
+ *     `endedOnly: true`.
+ */
+
+/** The registry-atom shape this scan needs (structural — `CurrentTurn` in the
+ *  gateway satisfies it without importing the gateway's type). */
+export interface LatestTurnLookupAtom {
+  /** The chat the turn belongs to. */
+  sessionChatId: string
+  /** Wall-clock ms the turn ENDED, or null while it is still running. */
+  endedAt: number | null
+}
+
+/**
+ * The last turn for `chatId` in registry insertion order — i.e. the most recent
+ * one. With `endedOnly: true` the scan skips turns that have not ended yet, so
+ * the result is the most-recently-ended turn (which may NOT be the tail entry).
+ * Returns null when the chat has no matching turn.
+ */
+export function latestTurnForChat<T extends LatestTurnLookupAtom>(
+  turns: Iterable<T>,
+  chatId: string,
+  opts: { endedOnly: boolean },
+): T | null {
+  let latest: T | null = null
+  for (const t of turns) {
+    if (t.sessionChatId !== chatId) continue
+    if (opts.endedOnly && t.endedAt == null) continue
+    latest = t
+  }
+  return latest
+}

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -62,7 +62,12 @@ import {
   DEFAULT_SUPERSEDE_TTL_MS,
   type FlushedTurnSupersedeRegistry,
 } from '../flushed-turn-supersede.js'
-import { decideAnswerLatchSuppression, type ReplyOwnerTier } from '../reply-owner-resolve.js'
+import {
+  decideAnswerLatchSuppression,
+  decideContentGateBypass,
+  type ReplyOwnerTier,
+  type ReplyOwnerCandidates,
+} from '../reply-owner-resolve.js'
 import { deriveTelegraphTitle } from '../telegraph.js'
 import {
   mayInjectListenButton,
@@ -726,7 +731,13 @@ export interface SendReplyGatewayDeps {
   assertSendable(f: string): void
   statusKey(chatId: string, threadId?: number | null): string
   streamKey(chatId: string, threadId?: number | null): string
-  resolveReplyOwnerTurn(liveTurn: CurrentTurn | null, chatId: string, args: Record<string, unknown>): { turn: CurrentTurn | null; tier: ReplyOwnerTier }
+  /** Resolves the owner turn AND returns the CANDIDATE SET it was derived from.
+   *  The candidates are load-bearing, not diagnostics: `decideContentGateBypass`
+   *  corroborates a model-steerable `origin`/`quoted` attribution against the
+   *  framework-derived `latestEndedTurnId` inside them before allowing a
+   *  content-gate bypass — an anchor that is an ENDED turn within the supersede
+   *  TTL, never one still running (#3725). */
+  resolveReplyOwnerTurn(liveTurn: CurrentTurn | null, chatId: string, args: Record<string, unknown>): { turn: CurrentTurn | null; tier: ReplyOwnerTier; candidates: ReplyOwnerCandidates }
   findTurnByOriginId(originTurnId: string | null | undefined): CurrentTurn | null
   findTurnByQuotedMessageId(chatId: string, replyTo: unknown): CurrentTurn | null
   resolveAnswerThreadWithLog(
@@ -946,7 +957,11 @@ export async function sendReply(
     // double-send). The quoted / latest-ended recoveries are precisely what the
     // router already did for the same reply, so unifying here makes the two
     // resolvers agree and the late-reply supersede fires by identity.
-    const { turn: ownerTurn, tier: ownerTier } = resolveReplyOwnerTurn(turn, chat_id, args)
+    const {
+      turn: ownerTurn,
+      tier: ownerTier,
+      candidates: ownerCandidates,
+    } = resolveReplyOwnerTurn(turn, chat_id, args)
     const resolvedTurnId = ownerTurn?.turnId ?? null
     // #3429 — pass the (normalized) reply text so the registry CAN apply the
     // new-content gate: identity match + TTL alone also fits a background
@@ -998,7 +1013,7 @@ export async function sendReply(
     // owner turn resolved (no record to clobber on the collapse path).
     const gateThreadId = ownerTurn?.sessionThreadId ?? replyThreadId
     // MUST-FIX 2 (dup-audit / Fable) — the content-gate READ is CHAT-WIDE, not
-    // lane-specific: `findLatestEndedTurnForChat` resolves owners chat-wide, so a
+    // lane-specific: `findLatestTurnForChat` resolves owners chat-wide, so a
     // handback in topic A can supersede topic B's ended turn; a thread-keyed gate
     // read (the F2 regression) let a reply dodge that handback by carrying a
     // different `message_thread_id`. Chat-wide makes the gate un-steerable — any
@@ -1014,23 +1029,35 @@ export async function sendReply(
       ownerEndedAt != null &&
       handbackAt > ownerEndedAt &&
       now - handbackAt <= DEFAULT_SUPERSEDE_TTL_MS
-    // MUST-FIX 1 (silent-data-loss, PROVEN by Fable 2026-07-21) — restrict the
-    // content-gate BYPASS to the tiers whose attribution is NOT model-steerable:
-    //   - `live`   — the framework-owned live `currentTurn` (not model-derived,
-    //                and `decideSupersede`'s same-turnId check bars it from an
-    //                ended turn's record). Bypasses even a handback window.
+    // MUST-FIX 1 (silent-data-loss, PROVEN by Fable 2026-07-21) + the 2026-07-27
+    // corroboration widening — decided by the pure `decideContentGateBypass` so
+    // the gateway runs the exact code the unit tests exercise. The rule, in
+    // brief (full rationale on that function):
+    //   - `live`   — framework-owned live `currentTurn`; bypasses unconditionally
+    //                (`decideSupersede`'s same-turnId check already bars it from
+    //                a DIFFERENT ended turn's record).
     //   - `latest-ended` — the ambiguous DM/late-reply fallback the marko fix
-    //                actually needs; bypass ONLY when no decoupled completion is
-    //                in the window (marker-absence ⇒ own answer).
-    // The `quoted` / `origin` tiers resolve from MODEL-SUPPLIED args
-    // (`args.reply_to` / `args.origin_turn_id`), so a reply can steer ITSELF onto
-    // a DIFFERENT ended turn's record — with marker-absence they used to bypass
-    // the content gate and silently edit-over that turn's delivered answer (the
-    // #3429 double-loss, executed by Fable). Those tiers therefore NEVER bypass:
-    // they always go through the content gate, so foreign content sends fresh and
-    // only a genuine same-answer reply collapses.
-    const replyIsOwnAnswer =
-      ownerTier === 'live' || (ownerTier === 'latest-ended' && !handbackCouldOwnReply)
+    //                needs; bypass ONLY when no decoupled completion is in the
+    //                window (marker-absence ⇒ own answer).
+    //   - `origin` / `quoted` — MODEL-SUPPLIED attributions, so they bypass ONLY
+    //                when CORROBORATED: the turn they resolve must be the same
+    //                turn the framework-derived, TTL-bounded `latestEndedTurnId`
+    //                resolves (#3725 — that anchor is a genuinely ENDED turn
+    //                within the TTL; a turn still RUNNING in this chat is not a
+    //                candidate and corroborates nothing), and no handback may be
+    //                in the window. A reply that
+    //                steers itself onto a DIFFERENT ended turn fails
+    //                corroboration and keeps the content gate, so the Fable
+    //                silent-edit-over stays closed; a reply that merely echoes
+    //                its OWN turn no longer loses the collapse it would have got
+    //                by omitting the echo entirely (the observed 2026-07-27
+    //                `via=origin` duplicate).
+    const replyIsOwnAnswer = decideContentGateBypass({
+      tier: ownerTier,
+      resolvedTurnId,
+      candidates: ownerCandidates,
+      handbackCouldOwnReply,
+    })
     const decision = flushedTurnSupersede.take(
       chat_id,
       gateThreadId,
@@ -1114,7 +1141,12 @@ export async function sendReply(
       if (decision.reason === 'new-content') {
         process.stderr.write(
           `telegram gateway: reply: flush supersede declined — new content (#3429) ` +
-          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)}; sending fresh\n`,
+          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)} ` +
+          // WHY the bypass didn't apply — without these two fields the
+          // 2026-07-27 duplicate looked like a pure text-matcher failure and
+          // took a log-archive dig to attribute to the tier restriction.
+          `tier=${ownerTier} latestEnded=${JSON.stringify(ownerCandidates.latestEndedTurnId)} ` +
+          `handbackInWindow=${handbackCouldOwnReply}; sending fresh\n`,
         )
       }
       if (suppressByLatch) {

package/telegram-plugin/gateway/subagent-handback-marker.ts

@@ -201,7 +201,7 @@ export class SubagentHandbackMarker {
    * Wall-clock ms of the most recent handback enqueue ANYWHERE in `chatId`
    * (across every topic lane), or null. This is what the content-gate read uses
    * (dup-audit MUST-FIX 2, Fable 2026-07-21): the owner-resolution latest-ended
-   * tier is CHAT-WIDE (`findLatestEndedTurnForChat` ignores thread), so a
+   * tier is CHAT-WIDE (`findLatestTurnForChat` ignores thread), so a
    * background handback in topic A can resolve — and supersede — topic B's
    * ended turn. A thread-SPECIFIC gate read (the F2 regression) let a reply
    * dodge that handback by carrying a different `message_thread_id`, silently

package/telegram-plugin/gateway/turn-end.ts

@@ -436,7 +436,7 @@ function endCurrentTurnAtomic(
   // live feed never opened because its sends failed (the resume-400 signature).
   const turnEndedAt = Date.now()
   // 2026-07 double-reply-on-DM fix (F2) — stamp the turn's end time so the
-  // `findLatestEndedTurnForChat` supersede tier can be recency-bounded to the
+  // `latest-ended` supersede tier can be recency-bounded to the
   // supersede TTL (a stale latest-ended turn must not inherit deletion
   // authority over a newer turn's flush record). Set once; idempotent on the
   // deferRecord flush path (which calls this synchronously before its send).

package/telegram-plugin/quota-bar-format.ts

@@ -39,6 +39,7 @@
 import type { QuotaUtilization } from './quota-check.js';
 import { refillNormalizedUtils, isProbeThin } from '../src/auth/quota.js';
 import type { AccountState, ListStateData } from '../src/auth/broker/client.js';
+import { effectiveServingLabel } from '../src/auth/broker/client.js';
 import { reviveLastQuota, recommendation, type AccountSnapshot } from './auth-snapshot-format.js';
 import { escapeMarkdown } from './card-format.js';
 import { maskEmail } from './demo-mask.js';
@@ -358,9 +359,11 @@ export function renderQuotaBarBlockFromListState(
   const exhaustedByLabel = new Map<string, boolean>(
     state.accounts.map((a: AccountState) => [a.label, a.exhausted]),
   );
+  // SERVING, not pinned — see effectiveServingLabel.
+  const serving = effectiveServingLabel(state);
   const snapshots: AccountSnapshot[] = state.accounts.map((acc: AccountState) => ({
     label: acc.label,
-    isActive: acc.label === state.active,
+    isActive: acc.label === serving,
     quota: reviveLastQuota(acc.last_quota ?? null),
     quotaError: acc.last_quota ? undefined : 'no cached quota (no probe since broker start)',
     expiresAtMs: acc.expiresAt,

package/telegram-plugin/reply-owner-resolve.ts

@@ -25,8 +25,8 @@
  *
  * The DECISIVE divergence: the gateway's *thread-routing* path DID recover the
  * owner turn for the same late reply — via `findTurnByQuotedMessageId` (the
- * framework-owned default quote target) and `findLatestEndedTurnForChat` (the
- * chat's most-recently-ended turn). The supersede resolver chain omitted BOTH
+ * framework-owned default quote target) and `findLatestTurnForChat` (the
+ * chat's most recent turn). The supersede resolver chain omitted BOTH
  * recoveries, so the two resolvers disagreed on who owned the reply. This module
  * unifies them onto ONE precedence so they can never diverge again.
  *
@@ -37,7 +37,7 @@
  * `decideCapturedProseDelivery` — is to extract the decision core into a pure,
  * unit-testable function and have the gateway run the EXACT code the regression
  * tests exercise. The gateway performs the four turn lookups (currentTurn,
- * findTurnByOriginId, findTurnByQuotedMessageId, findLatestEndedTurnForChat) and
+ * findTurnByOriginId, findTurnByQuotedMessageId, findLatestTurnForChat) and
  * feeds their resolved turnIds here; the precedence lives in one place.
  */
 
@@ -56,16 +56,25 @@ export interface ReplyOwnerCandidates {
   /** `findTurnByQuotedMessageId(chat_id, reply_to)` — the framework-owned
    *  quoted message id, resolved with NO model thread assertion. */
   quotedTurnId: string | null
-  /** `findLatestEndedTurnForChat(chat_id)` — the chat's most-recently-ended
-   *  turn. The deterministic late-reply fallback (the DM path's recovery). */
+  /** `findLatestTurnForChat(chat_id, {endedOnly:true})` — the chat's
+   *  most-recently-ENDED turn. The deterministic late-reply fallback (the DM
+   *  path's recovery). #3725: the gateway lookup skips turns that have not
+   *  ended, so this is never a still-running turn. */
   latestEndedTurnId: string | null
   /** Age (ms) of the latest-ended turn — `now - turn.endedAt`. The latest-ended
    *  tier carries DESTRUCTIVE authority (it drives supersede deletion), so it is
    *  honoured ONLY when the turn ended within `latestEndedTtlMs` (the supersede
    *  TTL). Without the bound, a late reply belonging to an OLDER turn could
    *  resolve its owner to a NEWER turn now sitting at the registry tail and
-   *  delete THAT turn's legit answer. Undefined/null ⇒ unbounded (back-compat:
-   *  callers that don't supply an age keep the pre-F2 behaviour). */
+   *  delete THAT turn's legit answer.
+   *
+   *  Two distinct absences (#3725):
+   *    - `undefined` (property omitted) ⇒ unbounded, the pre-F2 back-compat
+   *      escape for callers that don't supply an age at all;
+   *    - explicit `null` ⇒ the caller COMPUTED no age, i.e. its candidate turn
+   *      has no `endedAt` and has NOT ended. That cannot be TTL-bounded, so it
+   *      fails CLOSED (not accepted) rather than granting unbounded authority
+   *      to a turn that is still running. */
   latestEndedAgeMs?: number | null
   /** The supersede TTL bound applied to `latestEndedAgeMs`. Undefined ⇒
    *  unbounded. */
@@ -74,13 +83,17 @@ export interface ReplyOwnerCandidates {
 
 /**
  * Whether the latest-ended candidate is fresh enough to carry supersede
- * (deletion) authority. A missing age or TTL means unbounded (back-compat).
+ * (deletion) authority. An OMITTED age or TTL means unbounded (the pre-F2
+ * back-compat escape); an EXPLICIT null age fails closed (#3725 — the caller
+ * computed no age because its candidate turn has not ended, and an un-ended turn
+ * must be resolved by the `live` tier, never by this destructive fallback).
  */
 function latestEndedAccepted(candidates: ReplyOwnerCandidates): boolean {
   if (candidates.latestEndedTurnId == null) return false
   const age = candidates.latestEndedAgeMs
   const ttl = candidates.latestEndedTtlMs
-  if (age == null || ttl == null) return true
+  if (age === null) return false
+  if (age === undefined || ttl == null) return true
   return age <= ttl
 }
 
@@ -143,6 +156,94 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
   }
 }
 
+/**
+ * Whether the supersede path may BYPASS the #3429 content gate — i.e. treat the
+ * landing reply as this flushed turn's OWN answer and collapse the provisional
+ * flush REGARDLESS of the model having reworded it.
+ *
+ * ## Why this is not simply "the tier is positive"
+ *
+ * The pre-existing rule was `tier === 'live' || (tier === 'latest-ended' &&
+ * !handbackCouldOwnReply)`. `origin` and `quoted` were excluded WHOLESALE
+ * because both derive from MODEL-SUPPLIED args (`args.origin_turn_id` /
+ * `args.reply_to`): a reply can STEER its own attribution onto a DIFFERENT
+ * ended turn and, with the gate bypassed, silently edit over that turn's
+ * delivered answer (the #3429 double-loss, executed by Fable 2026-07-21).
+ *
+ * That wholesale exclusion over-fires. Observed 2026-07-27 on a DM agent (two
+ * answers delivered twice): the answer-ready quiescence flush posted the turn's
+ * composed prose as message A, the model then fired `reply` with a REWORDED
+ * version of the SAME answer, and — because it had echoed `origin_turn_id` back
+ * pointing at its OWN turn — the tier resolved `origin` rather than
+ * `latest-ended`, so no bypass applied and the content gate declined on the
+ * rewording (`reply: flush supersede declined — new content (#3429)`). Message B
+ * shipped as a visible duplicate. Had the model simply OMITTED the echo, the
+ * identical reply would have resolved `latest-ended` and collapsed to ONE
+ * message. The exclusion punished the model for supplying MORE information.
+ *
+ * ## The rule: corroborate the steerable tier, don't blanket-ban it
+ *
+ * A model-supplied attribution is dangerous only when it points somewhere the
+ * FRAMEWORK would not have gone on its own. So `origin`/`quoted` bypass the
+ * content gate IFF the turn they resolve is the SAME turn the framework-derived,
+ * TTL-bounded `latest-ended` candidate resolves — a candidate computed from
+ * `findLatestTurnForChat(chat_id, {endedOnly:true})` with no model input at all.
+ * "TTL-bounded" is enforced, not assumed (#3725): `latestEndedAccepted` demands
+ * an age within `latestEndedTtlMs`, and an anchor turn that has NOT ended (age
+ * explicitly null) is rejected outright rather than treated as unbounded — so a
+ * turn still running in another topic of the same chat can corroborate nothing.
+ *
+ * This grants ZERO new capability, which is the safety argument: any reply that
+ * reaches the bypass via a corroborated `origin`/`quoted` attribution could
+ * already have reached it by omitting `origin_turn_id`/`reply_to` entirely and
+ * landing on `latest-ended` with the same turn and the same outcome. Steering to
+ * a DIFFERENT ended turn breaks corroboration (`origin` id ≠ latest-ended id),
+ * so the gate holds and the #3429/Fable silent-edit-over defence is untouched.
+ *
+ * `latest-ended` corroborates itself trivially (its resolved id IS the
+ * latest-ended candidate), so the rule below SUBSUMES the previous behaviour on
+ * that tier rather than changing it.
+ *
+ * `live` keeps its unconditional bypass: `currentTurn` is framework-owned, and
+ * `decideSupersede`'s same-turnId requirement already bars it from reaching a
+ * DIFFERENT ended turn's record. `none` never bypasses (nothing to attribute).
+ */
+export function decideContentGateBypass(input: {
+  /** The winning owner tier (`resolveReplyOwnerTier`). */
+  tier: ReplyOwnerTier
+  /** The owner turnId the supersede will act on (`resolveReplyOwnerTurnId`). */
+  resolvedTurnId: string | null
+  /** The SAME candidate set both of the above were derived from — supplies the
+   *  framework-derived `latestEndedTurnId` plus its freshness bound, so the
+   *  corroboration reuses the EXACT rule `resolveReplyOwnerTier` applies
+   *  (`latestEndedAccepted`) instead of duplicating it: within the TTL, and —
+   *  since #3725 — not a turn that is still running. */
+  candidates: ReplyOwnerCandidates
+  /** True when a decoupled-completion inbound (`subagent_handback`) was enqueued
+   *  in this chat AFTER the owner turn ended and within the supersede TTL — the
+   *  ambiguous window where the late reply might BE that handback rather than
+   *  the turn's own answer. Keeps the content gate on every non-`live` tier. */
+  handbackCouldOwnReply: boolean
+}): boolean {
+  if (input.tier === 'live') return true
+  if (input.tier === 'none') return false
+  if (input.handbackCouldOwnReply) return false
+  // Total over degenerate input (#3726). TypeScript makes `candidates` mandatory
+  // and the one production caller (`resolveReplyOwnerTurn`) always builds it, so
+  // this cannot fire today — but this module is exported precisely so the
+  // decision can be exercised OUTSIDE the gateway's construction discipline.
+  // Every other defensive branch here fails CLOSED (keep the #3429 content
+  // gate); without this guard the missing-input case instead fails by THROWING
+  // out of the supersede path — a fail-open-by-crash. Matches the module's own
+  // precedent: `latestEndedAccepted` is total over null age/ttl/turnId.
+  if (input.candidates == null) return false
+  if (!latestEndedAccepted(input.candidates)) return false
+  return (
+    input.resolvedTurnId != null &&
+    input.resolvedTurnId === input.candidates.latestEndedTurnId
+  )
+}
+
 /**
  * The answer-delivered latch value — SOURCE-TAGGED (#3426).
  *

package/telegram-plugin/send-gate-degraded.test.ts

@@ -113,7 +113,7 @@ describe('send-gate PR2: cosmetic shedding', () => {
     expect(gate.stats().global.sent).toBe(1)
   })
 
-  it('sheds a cosmetic EDIT while the message-edit window is open', async () => {
+  it('COALESCES a cosmetic EDIT through an open message-edit window instead of shedding it (#3716)', async () => {
     const clock = new FakeClock()
     const { calls, fn } = recorder(clock)
     const gate = createSendGate({
@@ -122,17 +122,35 @@ describe('send-gate PR2: cosmetic shedding', () => {
       // H1: msg-edit scope is keyed `${chat_id}:${messageId}`.
       initialWindows: [{ scopeKey: 'msg-edit:5:42', untilTs: HOUR }],
     })
+    const opts = { chat_id: '5', messageId: 42, priorityClass: 'cosmetic' as const }
 
-    const res = await gate.gate(fn('edit'), {
-      chat_id: '5',
-      messageId: 42,
-      editPayload: 'v1',
-      priorityClass: 'cosmetic',
-    })
+    // A burst of cosmetic edits arrives while the window is wide open. The old
+    // behaviour dropped every one of them (SEND_GATE_SHED), which stranded the
+    // card on whatever body happened to be on screen when the window opened.
+    const p1 = gate.gate(fn('v1'), { ...opts, editPayload: 'v1' })
+    await flush()
+    const p2 = gate.gate(fn('v2'), { ...opts, editPayload: 'v2' })
+    await flush()
+    const p3 = gate.gate(fn('v3'), { ...opts, editPayload: 'v3' })
+    await flush()
 
-    expect(res).toBe(SEND_GATE_SHED)
+    // Nothing has hit the API yet — the window still suppresses the send, which
+    // is the flood protection doing its job.
     expect(calls).toHaveLength(0)
-    expect(gate.stats().global.shed).toBe(1)
+    // ...but nothing was DISCARDED either.
+    expect(gate.stats().global.shed).toBe(0)
+
+    // Walk past the window. Exactly ONE send lands, carrying the NEWEST payload:
+    // the burst was aggregated, not dropped, and not replayed edit-by-edit.
+    await clock.advance(HOUR + 1000)
+    await flush()
+    await Promise.allSettled([p1, p2, p3])
+
+    expect(calls.map((c) => c.label)).toEqual(['v3'])
+    expect(gate.stats().global.sent).toBe(1)
+    expect(gate.stats().global.shed).toBe(0)
+    // v1 and v2 were superseded in the pending slot (last-write-wins).
+    expect(gate.stats().global.coalesced).toBeGreaterThan(0)
   })
 })
 
@@ -343,7 +361,7 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
     expect(calls.every((c) => c.at === 0)).toBe(true)
   })
 
-  it('a 429 on chat A message 100 does NOT shed chat B message 100 cosmetic edits', async () => {
+  it('a 429 on chat A message 100 does NOT delay chat B message 100 cosmetic edits', async () => {
     const clock = new FakeClock()
     const { calls, fn } = recorder(clock)
     const gate = createSendGate({
@@ -353,14 +371,17 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
       initialWindows: [{ scopeKey: 'msg-edit:A:100', untilTs: HOUR }],
     })
 
-    // Chat A cosmetic edit → shed (its scope window is open).
-    const rA = await gate.gate(fn('A-edit'), {
+    // Chat A cosmetic edit → deferred, its scope window is open (#3716: deferred,
+    // NOT shed — the edit is held and lands with its state once the window ends).
+    const pA = gate.gate(fn('A-edit'), {
       chat_id: 'A',
       messageId: 100,
       editPayload: 'A-edit',
       priorityClass: 'cosmetic',
     })
-    // Chat B cosmetic edit to the SAME message_id → must NOT shed (different scope).
+    await flush()
+    // Chat B cosmetic edit to the SAME message_id → must be unaffected (different
+    // scope). This is the H1 isolation the test exists to guard.
     const rB = await gate.gate(fn('B-edit'), {
       chat_id: 'B',
       messageId: 100,
@@ -368,10 +389,18 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
       priorityClass: 'cosmetic',
     })
 
-    expect(rA).toBe(SEND_GATE_SHED) // A shed
-    expect(rB).toBe('B-edit') // B sent
+    expect(rB).toBe('B-edit') // B sent immediately, unblocked by A's window
     expect(calls.map((c) => c.label)).toEqual(['B-edit'])
-    expect(gate.stats().global.shed).toBe(1)
+    // A is still pending, not discarded.
+    expect(gate.stats().global.shed).toBe(0)
+
+    // Once A's window closes, A's edit lands too — nothing was lost.
+    await clock.advance(HOUR + 1000)
+    await flush()
+    await Promise.allSettled([pA])
+
+    expect(calls.map((c) => c.label).sort()).toEqual(['A-edit', 'B-edit'])
+    expect(gate.stats().global.shed).toBe(0)
   })
 })