switchroom 0.19.44 → 0.19.46

package/telegram-plugin/gateway/subagent-handback-marker.ts

@@ -18,9 +18,9 @@
  *     #1177/#1182/#1201 double-sent).
  *   - CASE B — a background handback attributed to that ended turn. A
  *     `subagent_handback` WAS enqueued after the turn ended and within the
- *     supersede TTL, so the late reply might BE it → keep the #3429 content gate
- *     and send fresh (two messages), never silently edit/delete the flushed
- *     answer.
+ *     handback recency window (`HANDBACK_RECENCY_WINDOW_MS` below, #4174), so
+ *     the late reply might BE it → keep the #3429 content gate and send fresh
+ *     (two messages), never silently edit/delete the flushed answer.
  *
  * ## Why thread-keyed (F2, dup-audit 2026-07-21)
  *
@@ -65,12 +65,30 @@
  *     reply with NO live gateway turn of its own (a background worker completion),
  *     so its reply resolves a DIFFERENT, already-ended turn via the latest-ended
  *     tier. It is the F1 vector.
- *   - Every OTHER synthesized source (cron, resume_*, reaction, vault_*, …) lands
- *     as its OWN live inbound turn, so its reply resolves the `live` tier for its
- *     own turnId and structurally cannot supersede a different ended turn's flush
- *     record (`decideSupersede` requires `record.turnId === liveTurnId`). Those
- *     must NOT stamp — stamping them would needlessly hold the content gate open
- *     for an unrelated own-reply in the window (a safe but avoidable visible dup).
+ *   - Every OTHER synthesized source that traverses THIS chokepoint (resume_*,
+ *     reaction, vault_*, Tier-2 cron, …) lands as its OWN live inbound turn, so
+ *     its reply resolves the `live` tier for its own turnId and structurally
+ *     cannot supersede a different ended turn's flush record (`decideSupersede`
+ *     requires `record.turnId === liveTurnId`). Those must NOT stamp — stamping
+ *     them would needlessly hold the content gate open for an unrelated
+ *     own-reply in the window (a safe but avoidable visible dup).
+ *
+ * ## What this chokepoint CANNOT see (#4172 — the caller-identity gate)
+ *
+ * The invariant above only covers sources delivered through
+ * `pendingInboundBuffer.push`. A Tier-1 CHEAP-CRON fire is delivered via
+ * `sendToAgent` to the derived `<agent>-cron` bridge and never traverses the
+ * buffer — AND its session events are dropped for the cron identity in
+ * `onSessionEvent`, so it never mints a live gateway turn either. Its `reply`
+ * therefore arrives decoupled (turn == null) with foreign content and NO
+ * marker — exactly the shape marker-absence was claimed to disprove. The same
+ * holds for any reply arriving on a connection that is not the main agent
+ * bridge. That class is closed at a DIFFERENT chokepoint: the reply send path
+ * (`outbound-send-path.ts`) refuses supersede/bypass/latch authority to any
+ * caller that is not the main agent bridge (`replyCallerIsForeignSession`,
+ *  cron-session.ts) — identity, not marker stamping, is the deterministic
+ * signal there. Setting `cron: { decoupledCompletion: true }` below would NOT
+ * work: a Tier-1 fire never reaches this registry's write site.
  *
  * This predicate is therefore the SINGLE point of extension: any future feature
  * that synthesizes an inbound which can land as a DECOUPLED late reply (no live
@@ -114,6 +132,12 @@ export const INBOUND_SOURCE_CLASSIFICATION: Record<string, { decoupledCompletion
   // Everything below lands as its OWN live inbound turn (live tier), so its reply
   // resolves the live tier for its own turnId and structurally cannot supersede a
   // different ended turn's record → not a decoupled-completion vector, must not stamp.
+  //
+  // cron: `false` covers the TIER-2 (main-bridge, `context:'agent'`) fire, which
+  // does land as its own live turn through this chokepoint. The TIER-1 cheap-cron
+  // fire never traverses this chokepoint AT ALL (see "What this chokepoint
+  // CANNOT see" above) — it is closed by the caller-identity gate in the reply
+  // send path (#4172), and flipping this to `true` would not reach it.
   cron: { decoupledCompletion: false },
   reaction: { decoupledCompletion: false },
   subagent_progress: { decoupledCompletion: false },
@@ -168,6 +192,22 @@ export function stampsHandbackMarker(source: string | null | undefined): boolean
   return known.decoupledCompletion
 }
 
+/**
+ * #4174 — how long after a `subagent_handback` enqueue the content gate stays
+ * held for late replies attributed to an ended turn (`handbackCouldOwnReply`,
+ * outbound-send-path.ts). This deliberately does NOT follow the supersede
+ * window's bounds (#4173): the gate-hold is CHAT-WIDE (the latest-ended owner
+ * tier is chat-wide, so the read must be too — MUST-FIX 2 above), which means
+ * every in-window handback re-opens the reworded-own-answer visible-duplicate
+ * class for EVERY topic in the chat for the window's length. 60 s — the
+ * originally shipped bound — covers the enqueue→decoupled-reply gap the marker
+ * exists for, while keeping the chat-wide dup exposure per handback small. In
+ * a delegation-heavy agent, tying this to a minutes-long supersede bound would
+ * hold the gate almost continuously — re-opening the exact duplicate class the
+ * supersede machinery closes.
+ */
+export const HANDBACK_RECENCY_WINDOW_MS = 60_000
+
 /** Sentinel thread key for the no-thread (DM / bare-chat) lane. */
 const MAIN_THREAD_KEY = '<main>'
 

package/telegram-plugin/gateway/subagent-reply-authority.ts

@@ -0,0 +1,147 @@
+/**
+ * #4176 — sub-agent reply authority: the discriminator the "serial session"
+ * premise was missing.
+ *
+ * ## The premise that was false
+ *
+ * The turn-completion window (#4173, `flushed-turn-supersede.ts`) rests on this
+ * claim: a `reply` landing on the MAIN agent bridge between a flush's SYNTHETIC
+ * turn_end and the session's REAL turn_end is, by construction, that turn's own
+ * answer still being composed. The stated justification was that no other work
+ * can run on the serial claude session in that span.
+ *
+ * That is true of the session's OWN loop and false of its sub-agents. A
+ * background `Task` sub-agent runs CONCURRENTLY with the parent loop, and it
+ * calls MCP tools through the SAME plugin process and therefore the SAME IPC
+ * bridge — so `client.agentName` is the main agent and the #4172 caller-identity
+ * gate (`replyCallerIsForeignSession`) does not see it. In this fleet the
+ * `researcher` and `reviewer` sub-agent types hold the full tool set, `reply`
+ * included (`worker` holds only `progress_update`).
+ *
+ * The concrete loss that made this a MAJOR (review of #4167): the quiescence
+ * flush delivers the answer as message A and the window is OPEN; a background
+ * sub-agent calls `reply` into the same chat; owner resolution lands on the
+ * flush-ended turn (OPEN is accepted at ANY age up to the crash cap); no
+ * `subagent_handback` marker exists because a DIRECT tool call never traverses
+ * `pendingInboundBuffer.push`; `decideContentGateBypass` therefore grants
+ * `positiveAttribution`, and `decideSupersede` supersedes REGARDLESS of content
+ * — the sub-agent's message silently EDITS OVER the user's flushed answer
+ * (Telegram edits do not re-notify: both messages are lost client-side). The
+ * class pre-exists on `main` bounded by the old 60 s TTL; #4173 extends the tail
+ * to the OPEN-phase cap, which is why it is closed here rather than narrowed.
+ *
+ * ## The discriminator: gateway-observed sub-agent LIVENESS
+ *
+ * The gateway already receives the whole session-event stream, including every
+ * `sub_agent_*` kind, at `onSessionEvent` → `handleSessionEvent`. Those events
+ * are derived by the framework from the sidechain transcript
+ * (`projectSubagentLine`, session-tail.ts) — never from model discipline, never
+ * from anything a reply can steer.
+ *
+ * A sub-agent is tracked LIVE from any `sub_agent_*` event carrying its
+ * `agentId` until its `sub_agent_turn_end`. While ANY sub-agent is live, a
+ * decoupled reply on the main bridge MIGHT be that sub-agent's, so it is denied
+ * the #3429 content-gate bypass (`decideContentGateBypass`) — the reply must
+ * then BE the flushed answer to supersede it. A sub-agent's own (foreign)
+ * content therefore decides `'new-content'` and ships as a fresh, notifying
+ * message, with the flush record left intact for the turn's genuine replay.
+ *
+ * ### Why liveness and not per-reply correlation
+ *
+ * Correlating the landing MCP call with the `sub_agent_tool_use` event for that
+ * same `reply` would be exact, but the two arrive on independent transports (an
+ * MCP stdio round-trip vs. a JSONL tail), so the event can land AFTER the reply
+ * it describes — a race whose losing side is the silent edit-over. Liveness has
+ * the ordering the correlation lacks: a sub-agent cannot call a tool before it
+ * exists, and `sub_agent_started` is projected from its FIRST transcript line,
+ * which precedes any tool call it makes by a full model round-trip. The gate is
+ * therefore armed by the time the reply can exist — a structural ordering
+ * argument, not a tuned delay.
+ *
+ * ### Failure directions (all fail SAFE)
+ *
+ *   - A sub-agent whose `sub_agent_turn_end` is never observed (capped, killed,
+ *     crashed tail) stays live: the content gate holds, so the worst case is a
+ *     REWORDED own-answer shipping as a visible duplicate. Never an edit-over.
+ *     `reset()` on bridge death bounds it — the sub-agents die with the session.
+ *   - A sub-agent steered after its `turn_end` (switchroom's `SendMessage`
+ *     pattern) re-arms on its next `sub_agent_*` event, which again precedes any
+ *     reply it makes by a model round-trip.
+ *   - No sub-agent live ⇒ the premise HOLDS and the #4166 collapse is untouched;
+ *     this gate costs nothing in the non-delegating case.
+ *
+ * ### Residual, stated honestly
+ *
+ * Denying the BYPASS (rather than supersede authority wholesale) is deliberate:
+ * with the gate on, a reply still supersedes when it IS the flushed answer
+ * (`flushedAnswerMatchesReply` — equality, or containment above
+ * `SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS`). Superseding on equality is
+ * content-preserving by definition. The residual is the containment arm: a
+ * sub-agent reply that is a ≥32-char verbatim substring of the flushed answer
+ * would still collapse into it. Denying supersede outright instead would, in a
+ * delegation-heavy agent where a background worker is nearly always live,
+ * re-open #4166 for every own-answer replay — a far larger, constant cost for a
+ * class that requires a sub-agent to emit a verbatim substring of the parent's
+ * answer.
+ *
+ * Pure: a set of ids, no clock reads, no I/O. The gateway wires the feed
+ * (`onSessionEvent`) and the read (the `sendReply` deps).
+ */
+
+/** The read surface the reply send path consumes (injected, so the golden
+ *  harness drives it without touching the singleton). */
+export interface SubagentReplyAuthorityView {
+  /** True when at least one sub-agent is live on this session and could
+   *  therefore be the author of a decoupled reply landing right now. */
+  subagentCouldOwnReply(): boolean
+}
+
+/** The minimal session-event shape this tracker reads. Structural so the module
+ *  never imports the session-tail union (no cycle, trivially fake-able). */
+export interface SubagentLifecycleEvent {
+  kind: string
+  agentId?: string
+}
+
+const SUB_AGENT_KIND_PREFIX = 'sub_agent_'
+
+export class SubagentReplyAuthority implements SubagentReplyAuthorityView {
+  private readonly live = new Set<string>()
+
+  /** Feed EVERY session event here. Non-`sub_agent_*` kinds are ignored, so the
+   *  call site needs no filtering (and cannot drift from this one). */
+  noteSessionEvent(ev: SubagentLifecycleEvent | null | undefined): void {
+    if (ev == null) return
+    const kind = ev.kind
+    if (typeof kind !== 'string' || !kind.startsWith(SUB_AGENT_KIND_PREFIX)) return
+    const agentId = ev.agentId
+    // An id-less sub-agent event cannot be attributed to a lifecycle; ignoring
+    // it is the safe direction for `turn_end` (liveness persists → gate holds)
+    // and merely a missed arm otherwise — every other kind for a real sub-agent
+    // carries the id.
+    if (typeof agentId !== 'string' || agentId === '') return
+    if (kind === `${SUB_AGENT_KIND_PREFIX}turn_end`) this.live.delete(agentId)
+    else this.live.add(agentId)
+  }
+
+  subagentCouldOwnReply(): boolean {
+    return this.live.size > 0
+  }
+
+  /** The bridge died: the claude session and every sub-agent under it are gone.
+   *  Bounds a leaked liveness entry (see "Failure directions"). */
+  reset(): void {
+    this.live.clear()
+  }
+
+  /** Test/diagnostics: how many sub-agents are currently tracked live. */
+  liveCount(): number {
+    return this.live.size
+  }
+}
+
+/** The ONE live instance (one CLI session per gateway process — the same
+ *  module-singleton shape as `flushCompletionTracker` in stream-render.ts).
+ *  Re-`new`ing this anywhere else splits the signal and silently re-opens the
+ *  edit-over hole. */
+export const subagentReplyAuthority = new SubagentReplyAuthority()

package/telegram-plugin/gateway/turn-end.ts

@@ -437,10 +437,18 @@ function endCurrentTurnAtomic(
   const turnEndedAt = Date.now()
   // 2026-07 double-reply-on-DM fix (F2) — stamp the turn's end time so the
   // `latest-ended` supersede tier can be recency-bounded to the
-  // supersede TTL (a stale latest-ended turn must not inherit deletion
+  // turn-completion window (a stale latest-ended turn must not inherit deletion
   // authority over a newer turn's flush record). Set once; idempotent on the
   // deferRecord flush path (which calls this synchronously before its send).
   turn.endedAt = turnEndedAt
+  // #4173 — default completion stamp: for every ordinary turn-end path, the
+  // turn ending IS the session's real stop, so the completion window is born
+  // closed (the latest-ended tier keeps its tight ~60 s replay grace). The ONE
+  // path where that is false — the answer-ready quiescence flush, which ends
+  // the turn synthetically while the session is still composing — re-opens the
+  // window right after this call (`flushCompletionTracker.open`, stream-render
+  // turn-flush branch) and holds it until the REAL turn_end is observed.
+  turn.realEndObservedAt = turnEndedAt
   process.stderr.write(
     `telegram gateway: ${formatTurnLifecycle('clear', 'turn_end', turn, turnEndedAt)}\n`,
   )

package/telegram-plugin/reply-owner-resolve.ts

@@ -41,6 +41,11 @@
  * feeds their resolved turnIds here; the precedence lives in one place.
  */
 
+// The one cross-module import this pure module takes — a sibling PURE module's
+// constant, so the two consumers of the turn-completion window (#4173) can
+// never disagree on the default replay grace.
+import { SUPERSEDE_COMPLETED_GRACE_MS } from './flushed-turn-supersede.js'
+
 /**
  * The four owner-turn candidate ids, in the gateway's resolution precedence.
  * Each is the `turnId` of the turn a given lookup resolved, or null when that
@@ -63,38 +68,75 @@ export interface ReplyOwnerCandidates {
   latestEndedTurnId: string | null
   /** Age (ms) of the latest-ended turn — `now - turn.endedAt`. The latest-ended
    *  tier carries DESTRUCTIVE authority (it drives supersede deletion), so it is
-   *  honoured ONLY when the turn ended within `latestEndedTtlMs` (the supersede
-   *  TTL). Without the bound, a late reply belonging to an OLDER turn could
-   *  resolve its owner to a NEWER turn now sitting at the registry tail and
-   *  delete THAT turn's legit answer.
+   *  honoured ONLY within the turn-completion window (#4173 — see
+   *  `latestEndedRealEndAgeMs`). Without a bound, a late reply belonging to an
+   *  OLDER turn could resolve its owner to a NEWER turn now sitting at the
+   *  registry tail and delete THAT turn's legit answer.
    *
    *  Two distinct absences (#3725):
-   *    - `undefined` (property omitted) ⇒ unbounded, the pre-F2 back-compat
-   *      escape for callers that don't supply an age at all;
+   *    - `undefined` (property omitted) ⇒ no age supplied at all — fails
+   *      CLOSED since #4175 (the pre-F2 "unbounded" escape granted unbounded
+   *      destructive authority exactly when the wiring was DROPPED, the
+   *      dangerous direction);
    *    - explicit `null` ⇒ the caller COMPUTED no age, i.e. its candidate turn
-   *      has no `endedAt` and has NOT ended. That cannot be TTL-bounded, so it
+   *      has no `endedAt` and has NOT ended. That cannot be bounded, so it
    *      fails CLOSED (not accepted) rather than granting unbounded authority
    *      to a turn that is still running. */
   latestEndedAgeMs?: number | null
-  /** The supersede TTL bound applied to `latestEndedAgeMs`. Undefined ⇒
-   *  unbounded. */
+  /** Bound applied to `latestEndedAgeMs` while the turn's completion window is
+   *  OPEN (#4173): for a flush-ended turn whose REAL turn_end has not been
+   *  observed yet, this is the crash-backstop cap
+   *  (`SUPERSEDE_OPEN_WINDOW_CAP_MS`). Undefined ⇒ fails closed (#4175). */
   latestEndedTtlMs?: number
+  /** #4173 — the turn-completion signal, ms since the candidate turn's REAL
+   *  turn_end was observed (`turn.realEndObservedAt`):
+   *    - `null` ⇒ the real turn_end has NOT been observed (a flush ended this
+   *      turn synthetically and the session is still composing) — the OPEN
+   *      phase; acceptance falls to `latestEndedAgeMs <= latestEndedTtlMs`
+   *      (the crash backstop), so a 20-minute compaction still resolves.
+   *    - a number ⇒ the session stopped that long ago — the COMPLETED phase;
+   *      accepted only within `latestEndedCompletedGraceMs` (the bounded
+   *      tool-call-replay window). For a normally-ended turn the real end IS
+   *      `endedAt`, so this equals `latestEndedAgeMs` and the tier keeps its
+   *      original tight ~60 s bound.
+   *    - `undefined` ⇒ legacy caller shape (no completion signal wired):
+   *      falls back to the plain `age <= ttl` rule. */
+  latestEndedRealEndAgeMs?: number | null
+  /** COMPLETED-phase bound for `latestEndedRealEndAgeMs`. Undefined ⇒ the
+   *  module default (`SUPERSEDE_COMPLETED_GRACE_MS`). */
+  latestEndedCompletedGraceMs?: number
 }
 
 /**
  * Whether the latest-ended candidate is fresh enough to carry supersede
- * (deletion) authority. An OMITTED age or TTL means unbounded (the pre-F2
- * back-compat escape); an EXPLICIT null age fails closed (#3725 — the caller
- * computed no age because its candidate turn has not ended, and an un-ended turn
- * must be resolved by the `live` tier, never by this destructive fallback).
+ * (deletion) authority — the turn-completion-window rule (#4173, three phases
+ * documented on `latestEndedRealEndAgeMs` above).
+ *
+ * An EXPLICIT null age fails closed (#3725 — the caller computed no age
+ * because its candidate turn has not ended, and an un-ended turn must be
+ * resolved by the `live` tier, never by this destructive fallback). An OMITTED
+ * age or TTL also fails closed (#4175): the old "omitted ⇒ unbounded"
+ * back-compat escape meant DROPPING the gateway's bound wiring silently
+ * granted unbounded destructive authority — failing toward silent edit-over.
+ * Now dropped wiring degrades to "tier never accepted" — a visible duplicate,
+ * the safe direction.
  */
 function latestEndedAccepted(candidates: ReplyOwnerCandidates): boolean {
   if (candidates.latestEndedTurnId == null) return false
   const age = candidates.latestEndedAgeMs
   const ttl = candidates.latestEndedTtlMs
-  if (age === null) return false
-  if (age === undefined || ttl == null) return true
-  return age <= ttl
+  if (age == null || ttl == null) return false
+  const realEndAge = candidates.latestEndedRealEndAgeMs
+  if (realEndAge === undefined || realEndAge === null) {
+    // Legacy caller (no completion signal) or OPEN window (real turn_end not
+    // yet observed): the plain age-vs-cap rule. For an open window `ttl` is
+    // the generous crash backstop, so a long compaction still resolves.
+    return age <= ttl
+  }
+  // COMPLETED: the session stopped `realEndAge` ago — only the bounded
+  // tool-call-replay grace remains.
+  const grace = candidates.latestEndedCompletedGraceMs ?? SUPERSEDE_COMPLETED_GRACE_MS
+  return realEndAge <= grace
 }
 
 /**
@@ -207,6 +249,21 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
  * `live` keeps its unconditional bypass: `currentTurn` is framework-owned, and
  * `decideSupersede`'s same-turnId requirement already bars it from reaching a
  * DIFFERENT ended turn's record. `none` never bypasses (nothing to attribute).
+ *
+ * ## The second ambiguity: a live sub-agent (#4176)
+ *
+ * `handbackCouldOwnReply` covers the sub-agent completion that the gateway
+ * SYNTHESIZED as an inbound. It does not cover a background sub-agent calling
+ * `reply` DIRECTLY, mid-run: that call rides the same main bridge as the parent
+ * loop (so the #4172 caller-identity gate cannot see it) and never traverses
+ * `pendingInboundBuffer.push` (so no marker is stamped). Marker-absence is only
+ * evidence of "the turn's own answer" if nothing else on the session could have
+ * emitted this reply — which is exactly what `subagentCouldOwnReply` reports,
+ * from gateway-observed `sub_agent_*` liveness. When it is true the content gate
+ * is KEPT on every non-`live` tier: a reply that IS the flushed answer still
+ * collapses, a sub-agent's foreign content sends fresh. See
+ * `gateway/subagent-reply-authority.ts` for the ordering argument and the
+ * failure directions.
  */
 export function decideContentGateBypass(input: {
   /** The winning owner tier (`resolveReplyOwnerTier`). */
@@ -216,18 +273,36 @@ export function decideContentGateBypass(input: {
   /** The SAME candidate set both of the above were derived from — supplies the
    *  framework-derived `latestEndedTurnId` plus its freshness bound, so the
    *  corroboration reuses the EXACT rule `resolveReplyOwnerTier` applies
-   *  (`latestEndedAccepted`) instead of duplicating it: within the TTL, and —
-   *  since #3725 — not a turn that is still running. */
+   *  (`latestEndedAccepted`) instead of duplicating it: within the
+   *  turn-completion window (#4173), and — since #3725 — not a turn that is
+   *  still running. */
   candidates: ReplyOwnerCandidates
   /** True when a decoupled-completion inbound (`subagent_handback`) was enqueued
-   *  in this chat AFTER the owner turn ended and within the supersede TTL — the
-   *  ambiguous window where the late reply might BE that handback rather than
-   *  the turn's own answer. Keeps the content gate on every non-`live` tier. */
+   *  in this chat AFTER the owner turn ended and within the handback recency
+   *  window (`HANDBACK_RECENCY_WINDOW_MS`, #4174) — the ambiguous window where
+   *  the late reply might BE that handback rather than the turn's own answer.
+   *  Keeps the content gate on every non-`live` tier. */
   handbackCouldOwnReply: boolean
+  /** #4176 — true when a sub-agent is LIVE on this session
+   *  (`subagentReplyAuthority`, gateway/subagent-reply-authority.ts). A
+   *  background `Task` sub-agent calls `reply` over the SAME main bridge as the
+   *  parent loop, so the #4172 caller-identity gate cannot see it and — because
+   *  a DIRECT tool call never traverses `pendingInboundBuffer.push` — it stamps
+   *  no handback marker either. Marker-absence therefore does NOT prove "the
+   *  turn's own answer" while a sub-agent is live: the reply might be the
+   *  sub-agent's, and bypassing the content gate would silently EDIT OVER the
+   *  flushed answer. Typed REQUIRED and evaluated FAIL-CLOSED (anything but an
+   *  explicit `false` keeps the gate): `telegram-plugin/` is not covered by
+   *  `tsc --noEmit`, so the type alone cannot stop a caller from dropping the
+   *  wiring — and the #4175 precedent is that a dropped bound fails closed,
+   *  never open. */
+  subagentCouldOwnReply: boolean
 }): boolean {
   if (input.tier === 'live') return true
   if (input.tier === 'none') return false
   if (input.handbackCouldOwnReply) return false
+  // Fail-CLOSED on an omitted flag (see the field doc): `!== false`, not truthiness.
+  if (input.subagentCouldOwnReply !== false) return false
   // Total over degenerate input (#3726). TypeScript makes `candidates` mandatory
   // and the one production caller (`resolveReplyOwnerTurn`) always builds it, so
   // this cannot fire today — but this module is exported precisely so the
@@ -260,16 +335,17 @@ export function decideContentGateBypass(input: {
  * handback pattern (#3426): the parent turn's interim ack (a substantive
  * `reply`) armed the latch, the turn ended, and the sub-agent completion
  * handback — a genuinely NEW answer arriving with no live gateway turn —
- * resolved the ended turn as owner (latest-ended tier, inside the 60 s
- * supersede TTL), saw the stale latch, and was silently dropped with a false
+ * resolved the ended turn as owner (latest-ended tier, inside the — then 60 s —
+ * supersede window), saw the stale latch, and was silently dropped with a false
  * "deduped" success. Tagging the source lets the suppression fire ONLY for the
  * flush races it exists for; byte-identical replays of a reply-delivered
  * answer remain covered by the content-keyed outbound dedup (#546).
  *
  * Honest bound on that dedup cover: the #546 TTL (60 s) is anchored at reply
- * RECORD time, while the latest-ended owner tier's 60 s is anchored at the
- * turn's `endedAt` — later by the reply→turn_end gap. A byte-identical replay
- * landing >60 s after record but ≤60 s after endedAt is evicted from dedup yet
+ * RECORD time, while the latest-ended owner tier's bound is the turn-completion
+ * window (#4173) anchored at the turn's OBSERVED real end — later by the
+ * reply→turn_end gap. A byte-identical replay landing >60 s after record but
+ * still inside the completion window is evicted from dedup yet
  * still resolves the ended turn, so it DELIVERS as a duplicate message. That
  * is a conscious trade: this fix also drops the weak "reworded/bridge-replayed
  * duplicate" suppression the reply-armed boolean latch used to provide —

package/telegram-plugin/tests/auth-loopback-relay.test.ts

@@ -22,6 +22,7 @@ import { describe, it, expect } from 'vitest'
 import { EventEmitter } from 'node:events'
 
 import {
+  buildRelayArgs,
   parseLoopbackRedirect,
   extractConsentUrl,
   parseConsentUrl,
@@ -492,6 +493,7 @@ describe('parseAuthCommand — provider verbs (#2582)', () => {
       email: 'user@example.com',
       replace: false,
       write: false,
+      calendar: false,
       orgMode: false,
     })
   })
@@ -501,6 +503,26 @@ describe('parseAuthCommand — provider verbs (#2582)', () => {
     expect(p).toMatchObject({ kind: 'provider-add', replace: true, write: true })
   })
 
+  it('parses google --calendar, and it does not imply --write', () => {
+    const p = parseAuthCommand('/auth google add user@example.com --replace --calendar')
+    expect(p).toMatchObject({
+      kind: 'provider-add',
+      replace: true,
+      calendar: true,
+      write: false,
+    })
+  })
+
+  it('parses --write and --calendar together', () => {
+    const p = parseAuthCommand('/auth google add user@example.com --write --calendar')
+    expect(p).toMatchObject({ kind: 'provider-add', write: true, calendar: true })
+  })
+
+  it('--calendar is google-only — microsoft rejects it as an unknown flag', () => {
+    const p = parseAuthCommand('/auth microsoft add user@corp.com --calendar')
+    expect(p).toMatchObject({ kind: 'help' })
+  })
+
   it('parses /auth microsoft add with --org-mode', () => {
     const p = parseAuthCommand('/auth microsoft add user@corp.com --org-mode')
     expect(p).toMatchObject({
@@ -531,3 +553,39 @@ describe('parseAuthCommand — provider verbs (#2582)', () => {
     expect(p).toMatchObject({ kind: 'help' })
   })
 })
+
+
+describe('buildRelayArgs — chat flags actually reach the CLI', () => {
+  it('bare google add: no opt-in flags', () => {
+    expect(buildRelayArgs('google', 'a@b.com', {})).toEqual([
+      'auth', 'google', 'account', 'add', 'a@b.com',
+    ])
+  })
+
+  it('forwards --calendar', () => {
+    expect(buildRelayArgs('google', 'a@b.com', { calendar: true })).toEqual([
+      'auth', 'google', 'account', 'add', 'a@b.com', '--calendar',
+    ])
+  })
+
+  it('forwards --replace --write --calendar together, in order', () => {
+    expect(
+      buildRelayArgs('google', 'a@b.com', {
+        replace: true,
+        write: true,
+        calendar: true,
+      }),
+    ).toEqual([
+      'auth', 'google', 'account', 'add', 'a@b.com',
+      '--replace', '--write', '--calendar',
+    ])
+  })
+
+  it('--calendar never leaks into the microsoft argv', () => {
+    expect(
+      buildRelayArgs('microsoft', 'a@corp.com', { calendar: true, orgMode: true }),
+    ).toEqual([
+      'auth', 'microsoft', 'account', 'add', 'a@corp.com', '--org-mode',
+    ])
+  })
+})