switchroom 0.19.40 → 0.19.42

package/telegram-plugin/gateway/gateway.ts

@@ -35,6 +35,7 @@ import {
   type AskUserOutcome,
 } from '../ask-user.js'
 import { redactAskUserFields, redactChecklistFields } from '../outbound-field-redact.js'
+import { createChecklistStore, checklistStoreKey, performSendChecklist, performUpdateChecklist, sendChecklistToolText, updateChecklistToolText } from './checklist-fallback.js'
 import { parseInterruptMarker } from '../interrupt-marker.js'
 import {
   ToolFlightTracker,
@@ -456,7 +457,7 @@ import {
   type SendReplyGatewayDeps,
   type DeliverCapturedProseDeps,
 } from './outbound-send-path.js'
-import { handleSessionEvent as handleSessionEventCore } from './stream-render.js'
+import { handleSessionEvent as handleSessionEventCore, drainParkedTurnStartsForChat } from './stream-render.js'
 import { createNarrativeLane } from './narrative-lane.js'
 import {
   parseAgentCallback,
@@ -1383,65 +1384,29 @@ let _rawEditMessageChecklist: unknown
 /** True when the connected Telegram Bot API supports native checklists. Set in initGatewayBot() (#2996 P0b). */
 let CHECKLIST_API_AVAILABLE = false
 
-/**
- * Send a native Telegram checklist message.
- * Wraps bot.api.raw.sendChecklist with string→number coercion (chat_id) and
- * a 30-task cap enforced before the API call.
- */
-async function rawSendChecklist(args: {
-  chat_id: string
-  title: string
-  tasks: Array<{ text: string; done?: boolean }>
-  message_thread_id?: number
-  reply_to_message_id?: number
-  protect_content?: boolean
-}): Promise<{ message_id: number }> {
-  if (!CHECKLIST_API_AVAILABLE) {
-    throw new Error('sendChecklist is not available in this grammY/Telegram Bot API version')
-  }
-  const MAX_TASKS = 30
-  if (args.tasks.length > MAX_TASKS) {
-    throw new Error(`checklist exceeds ${MAX_TASKS}-task limit (got ${args.tasks.length})`)
-  }
-  const result = await (_rawSendChecklist as (p: Record<string, unknown>) => Promise<{ message_id: number }>)({
-    chat_id: Number(args.chat_id),
-    title: args.title,
-    tasks: args.tasks.map(t => ({ text: t.text, ...(t.done != null ? { is_completed: t.done } : {}) })),
-    ...(args.message_thread_id != null ? { message_thread_id: args.message_thread_id } : {}),
-    ...(args.reply_to_message_id != null ? { reply_to_message_id: args.reply_to_message_id } : {}),
-    ...(args.protect_content === true ? { protect_content: true } : {}),
-  })
+/** bot.api.raw.sendChecklist with a payload pre-built by checklist-fallback.ts
+ *  (nested `checklist` object, per-task integer ids, business_connection_id —
+ *  the old flat shape got `400: parameter "checklist" is required`). */
+async function rawSendChecklist(payload: Record<string, unknown>): Promise<{ message_id: number }> {
+  if (!CHECKLIST_API_AVAILABLE) throw new Error('sendChecklist is not available in this grammY/Telegram Bot API version')
+  const result = await (_rawSendChecklist as (p: Record<string, unknown>) => Promise<{ message_id: number }>)(payload)
   return { message_id: result.message_id }
 }
 
-/**
- * Edit (patch) an existing Telegram checklist message.
- * Supports updating title, adding/removing tasks, and marking tasks done/undone.
- * Task objects with an `id` field target existing tasks; those without are added.
- */
-async function rawEditMessageChecklist(args: {
-  chat_id: string
-  message_id: string
-  title?: string
-  tasks?: Array<{ id?: string; text?: string; done?: boolean }>
-}): Promise<void> {
-  if (!CHECKLIST_API_AVAILABLE) {
-    throw new Error('editMessageChecklist is not available in this grammY/Telegram Bot API version')
-  }
-  await (_rawEditMessageChecklist as (p: Record<string, unknown>) => Promise<unknown>)({
-    chat_id: Number(args.chat_id),
-    message_id: Number(args.message_id),
-    ...(args.title != null ? { title: args.title } : {}),
-    ...(args.tasks != null
-      ? {
-          tasks: args.tasks.map(t => ({
-            ...(t.id != null ? { id: Number(t.id) } : {}),
-            ...(t.text != null ? { text: t.text } : {}),
-            ...(t.done != null ? { is_completed: t.done } : {}),
-          })),
-        }
-      : {}),
-  })
+/** bot.api.raw.editMessageChecklist with a pre-built payload (the native edit REPLACES the whole checklist, so checklist-fallback.ts sends full state). */
+async function rawEditMessageChecklist(payload: Record<string, unknown>): Promise<void> {
+  if (!CHECKLIST_API_AVAILABLE) throw new Error('editMessageChecklist is not available in this grammY/Telegram Bot API version')
+  await (_rawEditMessageChecklist as (p: Record<string, unknown>) => Promise<unknown>)(payload)
+}
+
+/** Per-message checklist state — update_checklist re-renders from it (process-local; post-restart updates degrade gracefully). */
+const checklistStore = createChecklistStore()
+
+/** Native checklists are Telegram-Business-only (sendChecklist REQUIRES a business_connection_id).
+ *  No fleet config plumbing exists yet; this env var is the opt-in — unset (the normal case) means text fallback. */
+function resolveBusinessConnectionId(): string | undefined {
+  const v = process.env.SWITCHROOM_TELEGRAM_BUSINESS_CONNECTION_ID?.trim()
+  return v ? v : undefined
 }
 
 const chatLock = createChatLock()
@@ -5038,7 +5003,7 @@ function emitTurnRecord(turn: CurrentTurn, endedAt: number): void {
             startedAt: turn.startedAt,
             toolCallCount: turn.toolCallCount ?? 0,
             turnId: turn.turnId,
-            finalAnswerDelivered: turn.finalAnswerDelivered,
+            finalAnswerDelivered: turn.finalAnswerDelivered, replyCalled: turn.replyCalled, // replyCalled: honest delivery-route signal (turn-record-status.ts computeTurnRoute)
             deliveryOutcome: turn.deliveryOutcome, landedUnconfirmed: turn.landedUnconfirmed,
           },
           endedAt,
@@ -9704,14 +9669,14 @@ function gatewayLivenessWiringDeps() {
     turnLiveForItsTopic,
     endCurrentTurnForKey,
     // Getter, not an eager read: `pendingInboundBuffer` (const) is declared
-    // LATER in this module (~9863) than the module-load `startTimer` call that
-    // invokes this builder (isGatewayMain path). A by-value capture here is a
-    // temporal-dead-zone ReferenceError that crash-loops every gateway boot
-    // (#3392 regression). Deferring to a getter — matching getInboundSpool /
-    // getTurnsDb / ipcServer — means the binding is only read when the
-    // fallback actually fires, well after module eval.
+    // LATER than the module-load `startTimer` call that invokes this builder,
+    // so a by-value capture is a temporal-dead-zone ReferenceError that
+    // crash-loops boot (#3392). A getter (matching getInboundSpool / getTurnsDb
+    // / ipcServer) is read only when the fallback fires, well after module eval.
     getPendingInboundBuffer: () => pendingInboundBuffer,
     trackRedeliveredInbound,
+    // Two-state desync unwedge (#3927): drain the parked store the fallback else leaves latched — see liveness-wiring + stream-render drainParkedTurnStartsForChat.
+    drainParkedTurnStarts: (chatId: string, threadId: number | null): number => drainParkedTurnStartsForChat(gatewayStreamRenderDeps(), chatId, threadId != null ? String(threadId) : null).length,
     closeActivityLane,
     closeProgressLane,
     // Stage B: escalate a mid-tool + marker-stale fallback to a real restart.
@@ -12083,17 +12048,35 @@ async function executeSendChecklist(args: Record<string, unknown>): Promise<{ co
     (t) => redactOutboundText(t, 'send_checklist'),
   )
 
-  const sent = await rawSendChecklist({
-    chat_id,
-    title: redactedTitle!,
-    tasks: redactedTasks!,
+  // Graceful degradation: native sendChecklist is Business-account-only, so
+  // ordinary chats (the fleet norm) get a formatted text render instead of a
+  // raw Telegram 400 (rationale + orchestration in checklist-fallback.ts).
+  const literal = (loadAccess().parseMode ?? 'html') === 'text'
+  const sendOpts = {
     ...(threadId != null ? { message_thread_id: threadId } : {}),
-    ...(replyTo != null ? { reply_to_message_id: replyTo } : {}),
+    ...(replyTo != null ? { reply_parameters: { message_id: replyTo } } : {}),
     ...(protectContent ? { protect_content: true } : {}),
-  })
+  }
+  const result = await performSendChecklist({
+    businessConnectionId: resolveBusinessConnectionId(),
+    nativeAvailable: CHECKLIST_API_AVAILABLE,
+    sendNative: rawSendChecklist,
+    sendText: (text) => robustApiCall(
+      (): Promise<{ message_id: number }> =>
+        literal
+          // allow-raw-bot-api: literal checklist text-fallback send routed through robustApiCall
+          ? lockedBot.api.sendMessage(chat_id, text, sendOpts as never)
+          // allow-raw-bot-api: checklist text-fallback send routed through robustApiCall
+          : lockedBot.api.sendRichMessage(chat_id, richMessage(text), sendOpts as never),
+      { verb: 'sendMessage', chat_id, threadId },
+    ),
+    literalText: literal,
+    log: (l) => process.stderr.write(`telegram gateway: ${l}`),
+  }, { title: redactedTitle!, tasks: redactedTasks!, chatId: Number(chat_id), replyToMessageId: replyTo, protectContent })
 
-  process.stderr.write(`telegram gateway: send_checklist: sent chatId=${chat_id} messageId=${sent.message_id} tasks=${tasks.length}\n`)
-  return { content: [{ type: 'text', text: `checklist sent (id: ${sent.message_id})` }] }
+  checklistStore.set(checklistStoreKey(chat_id, result.message_id), result.state)
+  process.stderr.write(`telegram gateway: send_checklist: sent chatId=${chat_id} messageId=${result.message_id} tasks=${tasks.length} mode=${result.mode}\n`)
+  return { content: [{ type: 'text', text: sendChecklistToolText(result) }] }
 }
 
 /**
@@ -12180,10 +12163,27 @@ async function executeUpdateChecklist(args: Record<string, unknown>): Promise<{
     (t) => redactOutboundText(t, 'update_checklist'),
   )
 
-  await rawEditMessageChecklist({ chat_id, message_id, title: redactedTitle, tasks: redactedTasks })
-
-  process.stderr.write(`telegram gateway: update_checklist: updated chatId=${chat_id} messageId=${message_id}\n`)
-  return { content: [{ type: 'text', text: `checklist updated (id: ${message_id})` }] }
+  // Graceful degradation (checklist-fallback.ts): the patch is applied to the
+  // stored per-message state and the message re-rendered in the mode it was
+  // sent in. Failures come back structured, never as a raw Telegram 400.
+  const literal = (loadAccess().parseMode ?? 'html') === 'text'
+  const key = checklistStoreKey(chat_id, message_id)
+  const result = await performUpdateChecklist({
+    state: checklistStore.get(key),
+    businessConnectionId: resolveBusinessConnectionId(),
+    nativeAvailable: CHECKLIST_API_AVAILABLE,
+    editNative: rawEditMessageChecklist,
+    // allow-raw-bot-api: checklist text-fallback edit routed through robustApiCall
+    editText: async (text) => { await robustApiCall(() => lockedBot.api.editMessageText(chat_id, Number(message_id), literal ? text : richMessage(text))) },
+    literalText: literal,
+    log: (l) => process.stderr.write(`telegram gateway: ${l}`),
+    chatId: Number(chat_id),
+    messageId: Number(message_id),
+  }, { title: redactedTitle, tasks: redactedTasks })
+
+  if (result.ok) checklistStore.set(key, result.state)
+  process.stderr.write(`telegram gateway: update_checklist: ${result.ok ? `updated mode=${result.mode}` : `failed reason=${result.reason}`} chatId=${chat_id} messageId=${message_id}\n`)
+  return { content: [{ type: 'text', text: updateChecklistToolText(result, Number(message_id)) }] }
 }
 
 /**

package/telegram-plugin/gateway/liveness-wiring.ts

@@ -62,6 +62,7 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
     endCurrentTurnForKey,
     getPendingInboundBuffer,
     trackRedeliveredInbound,
+    drainParkedTurnStarts,
     closeActivityLane,
     closeProgressLane,
     hangRestart,
@@ -593,6 +594,16 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
       getInboundSpool(),
       trackRedeliveredInbound,
     )
+    // Two-state desync unwedge. `pendingInboundBuffer` (above) is NOT where a
+    // wedge-behind-a-dead-lock message sits: an already-`enqueue`d message lives
+    // in stream-render's `parkedTurnStarts`, and the busy park gate stays latched
+    // while that store is non-empty. A hung REPL never emits the `dequeue`/
+    // `remove` that drain it, so drain it HERE, scoped to the wedged chat/thread,
+    // routing each envelope back through the real `dequeue` turn-start path. The
+    // count joins the `drained_buffered` field below so the log stops reading a
+    // misleading `0/0` while real user messages were stranded. Guarded getter:
+    // absent (older deps) → 0, so the fallback degrades to its prior behaviour.
+    const fbDrainedParked = drainParkedTurnStarts?.(fbChatId, fbThreadId ?? null) ?? 0
     process.stderr.write(
       `telegram gateway: silence-poke framework-fallback ended wedged turn ` +
       `chat=${fbChatId} thread=${ctx.threadId ?? '-'} silence_ms=${ctx.silenceMs} ` +
@@ -601,6 +612,7 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
       // keyed liveness check skipped the teardown, so the field lied.
       `currentTurn_nulled=${tearsDownLiveTurn} ` +
       `drained_buffered=${fbRedeliver.redelivered}/${fbRedeliver.drained}` +
+      `${fbDrainedParked > 0 ? ` drained_parked=${fbDrainedParked}` : ''}` +
       `${fbRedeliver.rebuffered > 0 ? ` rebuffered=${fbRedeliver.rebuffered}` : ''}` +
       `${fbExtraPurge.purged.length > 0 ? ` extra_keys_purged=${fbExtraPurge.purged.length}` : ''}\n`,
     )

package/telegram-plugin/gateway/model-command.ts

@@ -34,6 +34,27 @@ import {
   type ModelPickerOption,
 } from '../../src/agents/model-picker.js'
 import { assessThinkingEffortRisk } from '../../src/config/thinking-effort-risk.js'
+// The model-alias tables + expansion helpers live in the shared
+// `src/agents/model-aliases.ts` module so the gateway `/model` path and
+// scaffold-time config-default resolution expand from ONE table (#3998).
+// Imported for this module's internal use and re-exported below to preserve the
+// existing `model-command.js` public API (every importer keeps its entrypoint).
+import {
+  CLAUDE_MODEL_ALIASES,
+  SR_MODEL_ALIASES,
+  expandClaudeAlias,
+  expandSrAlias,
+  canonicalModelToken,
+  expandModelAlias,
+} from '../../src/agents/model-aliases.js'
+export {
+  CLAUDE_MODEL_ALIASES,
+  SR_MODEL_ALIASES,
+  expandClaudeAlias,
+  expandSrAlias,
+  canonicalModelToken,
+  expandModelAlias,
+}
 
 /**
  * Aliases the claude CLI resolves natively (`claude --help`: "an alias for
@@ -51,34 +72,6 @@ import { assessThinkingEffortRisk } from '../../src/config/thinking-effort-risk.
  */
 export const MODEL_ALIASES = ['opus', 'sonnet', 'haiku', 'fable', 'default'] as const
 
-/**
- * Short SWITCHROOM-side spellings for pinned **Anthropic** model ids. These are
- * expanded to the full `claude-*` id on the `/model` path BEFORE any
- * Claude-vs-external classification runs, so what reaches the `.session-model`
- * carrier (and therefore `claude --model`) is always the canonical id — the CLI
- * never sees the short spelling.
- *
- * Deliberately NOT `SR_MODEL_ALIASES`: that map means "external / OpenRouter /
- * the Anthropic OAuth header is NOT forwarded". These targets are Anthropic
- * OAuth-passthrough models, so putting them there would flip the
- * header-forwarding + external-billing classification and surface them under the
- * "🌐 External models" keyboard page with an `srFriendlyLabel`.
- *
- * Also NOT `MODEL_ALIASES`: that list is the aliases the claude CLI resolves
- * *itself*, and its members double as FAMILY tokens in `modelFamilyToken` /
- * `canonicalClaudeToken` / `servedModelMatchesRequested`. A pinned-id shortcut
- * is neither.
- *
- * NB the repo prefers family aliases over pinned ids (an alias tracks the
- * current flagship, a pinned id goes stale) — these exist because an operator
- * sometimes wants a specific pinned Opus, and typing `claude-opus-4-8` on a
- * phone is hostile. Keys are matched case-insensitively.
- */
-export const CLAUDE_MODEL_ALIASES: Record<string, string> = {
-  opus48: 'claude-opus-4-8',
-  'opus-4-8': 'claude-opus-4-8',
-}
-
 /**
  * Shape gate for the model argument. This string is typed literally
  * into the agent's tmux pane, so the gate is strict by construction:
@@ -1166,35 +1159,6 @@ export const SR_MODEL_LABELS: Record<string, string> = {
   'sr-gpt-5.6-luna': 'GPT-5.6 Luna',
 }
 
-/**
- * Short text-command aliases for sr-* models. These let the operator type
- * `/model flash`, `/model codex`, etc. instead of the full `sr-*` id.
- * Expanded in handleModelCommand before injection; the full sr-* id is what
- * reaches the agent session and LiteLLM.
- */
-export const SR_MODEL_ALIASES: Record<string, string> = {
-  flash: 'sr-gemini-2.5-flash',
-  gemini: 'sr-gemini-2.5-pro',
-  deepseek: 'sr-deepseek-v3',
-  r1: 'sr-deepseek-r1',
-  glm: 'sr-glm-5',
-  codex: 'sr-codex-5.5',
-  // Flagship keyboard buttons for the three providers added 2026-07-19. Each
-  // points at that provider's top tier; the cheaper tiers (grok-4.3,
-  // kimi-k2.7-code, gpt-5.6-terra/luna) stay typeable via `/model sr-<id>` and
-  // keep a friendly label above, matching the "labels are a superset of buttons"
-  // design (SR_MODEL_LABELS doc comment).
-  grok: 'sr-grok-4.5',
-  kimi: 'sr-kimi-k3',
-  gpt: 'sr-gpt-5.6-sol',
-  // Per-tier buttons for the GPT-5.6 line so each is a one-word shortcut
-  // (`gpt` stays the flagship-Sol default). Added 2026-07-19.
-  sol: 'sr-gpt-5.6-sol',
-  terra: 'sr-gpt-5.6-terra',
-  luna: 'sr-gpt-5.6-luna',
-}
-
-/** Expand a short alias (case-insensitive) to its full sr-* id, or return the original. */
 /**
  * #3042 review blocker 2a: can `token` be trusted for a boot-applied
  * `.session-model` carrier persist WITHOUT a live confirmation from claude?
@@ -1230,58 +1194,6 @@ export function isOfflineTrustedModelToken(token: string): boolean {
   return Object.values(CLAUDE_MODEL_ALIASES).includes(lower)
 }
 
-export function expandSrAlias(arg: string): string {
-  return SR_MODEL_ALIASES[arg.toLowerCase()] ?? arg
-}
-
-/**
- * The ONE canonical form of a model token — what `claude --model` is handed and
- * what every downstream gate compares against.
- *
- * Two normalizations, both narrow:
- *   - **trim** — unconditional. `unvalidatedIdCaveat` already trimmed while
- *     expansion did not, so the two disagreed on a padded token.
- *   - **lowercase, `claude-*` ONLY.** Every real Anthropic model id is lowercase
- *     and a phone autocapitalizes, so `/model Claude-Opus-4-8` used to be launched
- *     VERBATIM as an unvalidated id while the caveat exemption (which lowercases)
- *     suppressed the warning — a clean green ack for a token the caveat was
- *     written for. Non-`claude-` tokens are left alone: `sr-*` ids are matched
- *     case-insensitively by their own maps, and rewriting an arbitrary external
- *     id's case is not ours to do.
- *
- * Applied by `expandModelAlias`, so canonicalization happens on every `/model`
- * path (typed apply, mid-turn queue, menu tap, queued-across-restart persist)
- * whether or not the token hit a shortcut map — one canonical form flows to
- * `claude --model`, and `unvalidatedIdCaveat` sees exactly that form.
- */
-export function canonicalModelToken(arg: string): string {
-  const trimmed = arg.trim()
-  const lower = trimmed.toLowerCase()
-  return lower.startsWith('claude-') ? lower : trimmed
-}
-
-/** Expand a short pinned-Claude spelling (case-insensitive) to its full `claude-*` id. */
-export function expandClaudeAlias(arg: string): string {
-  return CLAUDE_MODEL_ALIASES[arg.trim().toLowerCase()] ?? arg
-}
-
-/**
- * The ONE expansion every `/model` argument goes through, on every path that
- * consumes a user-supplied token (typed apply, mid-turn queue, menu tap,
- * queued-across-restart persist). Claude shortcuts resolve first, then sr-*
- * shortcuts; the two key sets are disjoint by construction (a Claude shortcut
- * never expands to an `sr-*` id and vice versa), so order only documents intent.
- * The result is `canonicalModelToken`-normalized, so a miss can no longer emit a
- * verbatim mixed-case `claude-*` id that the caveat exemption then mis-matches.
- *
- * Expanding HERE — before `isClaudeModel` / `isSrModel` / `externalModelNames`
- * ever see the token — is what keeps a pinned-Claude shortcut on the Anthropic
- * OAuth passthrough instead of being misread as an external route.
- */
-export function expandModelAlias(arg: string): string {
-  return canonicalModelToken(expandSrAlias(expandClaudeAlias(arg)))
-}
-
 export function srFriendlyLabel(srName: string): string {
   return SR_MODEL_LABELS[srName] ?? srName.replace(/^sr-/, '').replace(/-/g, ' ')
 }

package/telegram-plugin/gateway/stream-render.ts

@@ -232,6 +232,63 @@ export function __parkedTurnStartCountForTest(): number {
   return parkedTurnStarts.length
 }
 
+/**
+ * Silence-fallback unwedge for the parked store (the two-state desync fix).
+ *
+ * The park gate in `case 'enqueue'` treats the session as busy while EITHER a
+ * live `currentTurn` exists OR `parkedTurnStarts` is non-empty. The 300 s
+ * framework-fallback (`liveness-wiring.ts` onFrameworkFallback) that recovers a
+ * hung turn nulls `currentTurn` and redelivers `pendingInboundBuffer` — but
+ * before this it NEVER touched `parkedTurnStarts`. When the claude REPL hangs
+ * mid-turn the CLI's own `dequeue` / `remove` events (the only real drains of
+ * this store) never arrive, so a leftover parked envelope latches the busy gate
+ * permanently and every later inbound parks unseen until a manual container
+ * restart (gymbro parked msgs 4502→4504 behind a dead lock until SIGTERM). The
+ * `drained_buffered=0/0` fallback log was honest-but-misleading: it counted the
+ * empty `pendingInboundBuffer`, not this store, where the real messages sat.
+ *
+ * This drains the parked envelopes for ONE chat/thread — scoped, never global,
+ * so a fallback fired for chat A cannot release chat B's queued messages — and
+ * hands each back into turn processing through the EXACT `beginTurn` path a real
+ * `dequeue` uses. Envelopes are re-begun in arrival order (oldest first) so the
+ * NEWEST, the message the user is actually waiting on, ends up the live turn and
+ * the older ones are cleanly superseded (never silently dropped). The store is
+ * kept module-encapsulated: callers get a function, not the array. Returns the
+ * drained envelopes so the caller can log an honest count. Idempotent w.r.t. a
+ * late CLI event: once drained, a subsequent `dequeue` finds an empty store and
+ * `takeParkedTurnStart` returns null, so a message can never be double-started.
+ */
+export function drainParkedTurnStartsForChat(
+  deps: StreamRenderDeps,
+  chatId: string | null,
+  threadId: string | null,
+): TurnStartEnvelope[] {
+  const wantThread = envThreadIdNum(threadId)
+  const drained: ParkedTurnStart[] = []
+  // Splice out the matching entries, preserving arrival order (oldest first).
+  for (let i = 0; i < parkedTurnStarts.length; ) {
+    const entry = parkedTurnStarts[i]!
+    if (entry.chatId === chatId && envThreadIdNum(entry.threadId) === wantThread) {
+      drained.push(entry)
+      parkedTurnStarts.splice(i, 1)
+    } else {
+      i++
+    }
+  }
+  for (const env of drained) {
+    process.stderr.write(
+      `telegram gateway: parked-turn-start drained on silence-fallback ` +
+        `chat=${env.chatId ?? '-'} thread=${envThreadIdNum(env.threadId) ?? '-'} ` +
+        `msg=${env.messageId ?? '-'}\n`,
+    )
+    // Reuse the dequeue turn-start path verbatim — beginTurn adopts the parked
+    // envelope's queued card (Part B) so the frozen "⏳ Queued" surface becomes
+    // the live progress card rather than lingering.
+    beginTurn(deps, env)
+  }
+  return drained
+}
+
 // ─── Queued-turn card send / finalize (Part B) ───────────────────────────────
 // These use the ALREADY-injected `bot` + `robustApiCall` deps, so the whole
 // feature lives in stream-render.ts with zero new wiring in gateway.ts. No

package/telegram-plugin/gateway/turn-record-status.ts

@@ -27,6 +27,38 @@ export type DeliveryOutcome = 'delivered' | 'failed' | 'suppressed'
 /** The status strings written to turns.jsonl. `send_failed` is new in PR B. */
 export type TurnStatus = 'complete' | 'no_reply' | 'send_failed'
 
+/**
+ * How this turn's answer actually reached (or failed to reach) the user — the
+ * honest delivery route, recorded alongside `status` so the fleet-health
+ * detector can tell a flush-recovered turn apart from a genuine silent no-op.
+ *
+ * - `reply`  — the reply tool delivered the answer (the normal path), OR the
+ *              flush short-circuited because reply had already delivered.
+ * - `stream` — the answer landed via the streaming/draft path without a reply
+ *              tool call (final answer delivered, `replyCalled` false).
+ * - `flush`  — a turn-flush / outbox-sweep backstop delivered the answer after
+ *              the reply tool was bypassed (terminal prose, `tools:0`). This is
+ *              the case that used to masquerade as a silent no-op.
+ * - `none`   — nothing reached the user (send failed, or a genuine no-reply).
+ */
+export type TurnRoute = 'reply' | 'stream' | 'flush' | 'none'
+
+/**
+ * Epoch of when the honest `route` field shipped on turns.jsonl rows — a FIXED
+ * literal cutoff the fleet-health detector uses to age out the pre-route legacy
+ * backlog (rows written before this field existed carry no `route`, so the
+ * detector cannot classify them and must not escalate them as silent no-ops).
+ *
+ * UNIX SECONDS, not milliseconds: turns.jsonl `ts` is written as
+ * `Math.floor(endedAt / 1000)` (see `buildTurnRecord`), and the detector
+ * compares this constant against that seconds-valued `ts`. It intentionally
+ * mirrors the units of `SILENT_NOOP_FLOOR_TS` in `src/fleet-health/detect.ts`.
+ *
+ * Value = 2026-07-31T00:00:00Z (`date -u -d @1785456000`). Fixed, not rolling:
+ * a rolling window would hide a genuine ongoing regression that drops the field.
+ */
+export const ROUTE_FIELD_SHIP_TS = 1_785_456_000
+
 /**
  * Derive the recorded turn status from the turn's flags.
  *
@@ -58,6 +90,41 @@ export function computeTurnStatus(turn: {
   }
 }
 
+/**
+ * Derive the honest delivery `route` from the SAME resolved delivery state
+ * `computeTurnStatus` reads — never speculative. `deliveryOutcome` (when
+ * present) is authoritative; when absent we fall back to the legacy
+ * `finalAnswerDelivered` / `replyCalled` reading, exactly as `computeTurnStatus`
+ * does for `status`.
+ *
+ *   failed              → none    (nothing reached the user)
+ *   delivered           → flush   (a backstop send delivered the answer)
+ *   suppressed          → reply   (flush short-circuited; reply already delivered)
+ *   undefined (legacy)  → finalAnswerDelivered
+ *                            ? (replyCalled ? reply : stream)
+ *                            : none
+ */
+export function computeTurnRoute(turn: {
+  finalAnswerDelivered: boolean
+  replyCalled: boolean
+  deliveryOutcome?: DeliveryOutcome
+}): TurnRoute {
+  switch (turn.deliveryOutcome) {
+    case 'failed':
+      return 'none'
+    case 'delivered':
+      return 'flush'
+    case 'suppressed':
+      return 'reply'
+    default:
+      return turn.finalAnswerDelivered
+        ? turn.replyCalled
+          ? 'reply'
+          : 'stream'
+        : 'none'
+  }
+}
+
 /**
  * Resolve a backstop send's outcome from what actually happened on the wire.
  * A throw is a failure; a no-throw send that delivered fewer chunks than it
@@ -148,6 +215,13 @@ export interface TurnRecordRow {
   tools: number
   status: TurnStatus
   turn_id: string
+  /**
+   * The honest delivery route for this turn (see `TurnRoute`). Recorded on every
+   * row so the fleet-health detector can distinguish a flush-recovered turn
+   * (`route: 'flush'`, answer delivered by a backstop after the reply tool was
+   * bypassed) from a genuine silent no-op (`route: 'none'`). Always emitted.
+   */
+  route: TurnRoute
   /**
    * How many landed message ids of this turn's backstop delivery the read-back
    * probe never corroborated (`sentIds` minus the confirmed subset). OMITTED
@@ -178,6 +252,7 @@ export function buildTurnRecord(
     toolCallCount: number
     turnId: string
     finalAnswerDelivered: boolean
+    replyCalled?: boolean
     deliveryOutcome?: DeliveryOutcome
     landedUnconfirmed?: number
   },
@@ -190,6 +265,11 @@ export function buildTurnRecord(
     tools: turn.toolCallCount ?? 0,
     status: computeTurnStatus(turn),
     turn_id: turn.turnId,
+    route: computeTurnRoute({
+      finalAnswerDelivered: turn.finalAnswerDelivered,
+      replyCalled: turn.replyCalled ?? false,
+      deliveryOutcome: turn.deliveryOutcome,
+    }),
     // Emitted ONLY when non-zero (see `TurnRecordRow.landed_unconfirmed`).
     ...(turn.landedUnconfirmed != null && turn.landedUnconfirmed > 0
       ? { landed_unconfirmed: turn.landedUnconfirmed }