switchroom 0.20.7 → 0.20.9

package/telegram-plugin/dist/server.js

@@ -24317,11 +24317,14 @@ function createIpcClient(options) {
   function scheduleReconnect() {
     if (closed)
       return;
+    if (reconnectTimer)
+      return;
     log(`reconnecting in ${currentDelay}ms`);
     reconnectTimer = setTimeout(() => {
       reconnectTimer = null;
-      if (!closed)
-        doConnect();
+      if (!closed) {
+        doConnect().catch(() => {});
+      }
     }, currentDelay);
     currentDelay = Math.min(currentDelay * 2, maxReconnectDelayMs);
   }

package/telegram-plugin/gateway/auth-broker-client.ts

@@ -28,7 +28,7 @@ export function createAuthBrokerClient(): {
     listState: () => broker.listState(),
     setActive: (label: string) => broker.setActive(label),
     markExhausted: (until?: number) => broker.markExhausted(until),
-    markThrottled: (until: number) => broker.markThrottled(until),
+    markThrottled: (until: number, probeOnly?: boolean) => broker.markThrottled(until, probeOnly),
     rmAccount: (label: string) => broker.rmAccount(label),
     refreshAccount: (label: string) => broker.refreshAccount(label),
     setOverride: (agent: string, account: string | null) =>

package/telegram-plugin/gateway/auth-command.ts

@@ -334,10 +334,12 @@ export interface AuthBrokerClient {
    * per-account rate limit on the CALLER's own account — `throttled_until`
    * in the quota ledger — WITHOUT rolling the fleet and WITHOUT touching
    * eligibility. `escalated` is true when the broker's escalation guard
-   * (repeated hits corroborated by a live probe) converted it into the
+   * (a first-hit live probe corroborating a wall) converted it into the
    * standard mark-exhausted + roll; `rolledTo` names the roll target then.
+   * `probeOnly` (#failover-429-corroborate, generic-transient origin): run ONLY
+   * the escalation probe — a healthy probe records nothing (account stays inert).
    */
-  markThrottled(until: number): Promise<{
+  markThrottled(until: number, probeOnly?: boolean): Promise<{
     account: string
     throttled_until: number
     escalated: boolean

package/telegram-plugin/gateway/boot-reason.ts

@@ -83,3 +83,64 @@ export function determineRestartReason(opts: {
   if (sessionMarker != null) return 'crash'
   return 'fresh'
 }
+
+/**
+ * Boot-reason window during which a bridge re-register reuses the reason
+ * the boot path already determined. Matches the restart-marker and
+ * operator-marker freshness windows (5 min) — a bridge that survived a
+ * gateway restart reconnects within seconds of the new gateway's boot,
+ * comfortably inside it.
+ */
+export const BOOT_REASON_REUSE_WINDOW_MS = 5 * 60_000
+
+/**
+ * Determine the restart reason for a BRIDGE RE-REGISTER (gateway.ts
+ * `onClientRegistered`, the `bridge-reconnect` path) — as opposed to the
+ * gateway's own boot path.
+ *
+ * Why this exists (fleet-audit B2, kdogg 2026-08-02 06:27 trace): on a
+ * planned gateway restart (`cli: restart` SIGTERM), the bridge — living
+ * inside the separate claude process — survives and reconnects a few
+ * seconds after the new gateway boots. By then the boot path has already
+ * READ AND CLEARED the restart / clean-shutdown markers (the 2026-05-25
+ * GC, gateway.ts boot path), so re-deriving the reason from disk falls
+ * through to the sessionMarker branch and every such re-register logs —
+ * and, when a chat is resolvable, POSTS a boot card claiming —
+ * `reason=crash` for a perfectly graceful restart. Hundreds of these per
+ * agent fleet-wide (lawgpt 310, reggie 179, ziggy 175, kdogg 174).
+ *
+ * Decision:
+ *   1. Any on-disk marker still present → normal `determineRestartReason`
+ *      (in-gateway /restart flows where the gateway never went down write
+ *      a marker the boot path never consumed — keep honoring it).
+ *   2. No markers, but the gateway booted recently (<5 min) and recorded
+ *      the reason it determined at boot → reuse that reason. The bridge
+ *      is re-registering into the SAME restart episode the boot path
+ *      already classified.
+ *   3. Otherwise (gateway long-lived, markers absent) → fall through to
+ *      `determineRestartReason` — a marker-less bridge re-register hours
+ *      into a gateway's life still classifies conservatively as 'crash'
+ *      (the claude/bridge side genuinely died and came back).
+ */
+export function determineBridgeReconnectReason(opts: {
+  marker: { ts: number } | null
+  cleanMarker: CleanShutdownMarker | null
+  sessionMarker: SessionMarker | null
+  now: number
+  /** `GATEWAY_STARTED_AT_MS` of the running gateway process. */
+  gatewayStartedAtMs: number
+  /** Reason the gateway's own boot path determined (null if it never ran). */
+  bootReason: RestartReason | null
+  bootReasonReuseWindowMs?: number
+  cleanMaxAgeMs?: number
+  markerMaxAgeMs?: number
+  operatorMaxAgeMs?: number
+}): RestartReason {
+  const { gatewayStartedAtMs, bootReason, bootReasonReuseWindowMs = BOOT_REASON_REUSE_WINDOW_MS } = opts
+  if (opts.marker == null && opts.cleanMarker == null
+    && bootReason != null
+    && opts.now - gatewayStartedAtMs < bootReasonReuseWindowMs) {
+    return bootReason
+  }
+  return determineRestartReason(opts)
+}

package/telegram-plugin/gateway/checklist-fallback.ts

@@ -33,6 +33,8 @@
  * (same pattern as checklist-message-handler.ts).
  */
 
+import { parseSourceMessageId } from './source-message-id.js'
+
 export interface ChecklistTaskState {
   /** 1-based sequential id assigned at send time (mirrors the native API's
    *  required per-task integer id; doubles as the patch handle in text mode). */
@@ -130,6 +132,11 @@ export function buildNativeChecklistPayload(p: {
   replyToMessageId?: number
   protectContent?: boolean
 }): Record<string, unknown> {
+  // #4368 — defense at the payload boundary: a fabricated / out-of-int32
+  // reply anchor is dropped here so the native checklist sends UNANCHORED
+  // rather than Telegram 400ing on `reply_parameters.message_id`. Independent
+  // of any caller-side guard so this builder can never emit a bad anchor.
+  const replyAnchor = parseSourceMessageId(p.replyToMessageId)
   return {
     business_connection_id: p.businessConnectionId,
     chat_id: p.chatId,
@@ -137,7 +144,7 @@ export function buildNativeChecklistPayload(p: {
       title: p.title,
       tasks: p.tasks.map((t) => ({ id: t.id, text: t.text })),
     },
-    ...(p.replyToMessageId != null ? { reply_parameters: { message_id: p.replyToMessageId } } : {}),
+    ...(replyAnchor != null ? { reply_parameters: { message_id: replyAnchor } } : {}),
     ...(p.protectContent === true ? { protect_content: true } : {}),
   }
 }

package/telegram-plugin/gateway/cron-session.ts

@@ -17,6 +17,10 @@
  * target via `cronIdentity()`. Pure string fns — pinned in cron-session.test.ts.
  */
 
+import type { InboundMessage, GatewayToClient } from './ipc-protocol.js'
+import type { InboundSpool } from './inbound-spool.js'
+import { redeliverBufferedInbound, type PendingInboundBuffer } from './pending-inbound-buffer.js'
+
 /** Suffix that distinguishes a cron-session bridge from the main agent bridge. */
 export const CRON_IDENTITY_SUFFIX = "-cron";
 
@@ -140,3 +144,65 @@ export function deliverInjectWithFallback(
   }
   return { target, delivered: false, fellBackToMain: false };
 }
+
+/** Minimal view of the IPC client the cron-bridge register handler needs.
+ *  A structural subset of `IpcClient` so this stays unit-testable without the
+ *  gateway's module-load side effects. */
+export interface CronBridgeRegisterClient {
+  agentName: string | null | undefined;
+  send: (msg: GatewayToClient) => void;
+}
+
+/**
+ * Drain a cheap-cron (`<agent>-cron`) bridge's buffered fires when it
+ * registers — the Tier-1 §2.4/§3.3 status-silent path (#4348).
+ *
+ * The cron bridge is STATUS-SILENT: it must NOT drive the gateway's singleton
+ * machinery (shadow bridge-state, warmup, boot card). But it MUST still flush
+ * any cron fire buffered+spooled during the boot window — a due tick that
+ * arrived before the cron bridge registered.
+ *
+ * THE BUG (#4348): the pre-fix path did a raw `pendingInboundBuffer.drain()` +
+ * `client.send()` loop and returned early WITHOUT ever reaching `spool.ack`.
+ * `spool.ack` lives ONLY inside `redeliverBufferedInbound` — the one chokepoint
+ * every other drain path (bridgeUp, idle-drain, silence-poke, turn-end) routes
+ * through. So the durable spool entry stayed live, boot-replay re-pushed it on
+ * the next restart, and the SAME cron fire re-fired: a duplicate delivery
+ * bounded only by the 15-min escalation sweep. This was the ONLY drain that
+ * bypassed the chokepoint.
+ *
+ * THE FIX: route the drain through `redeliverBufferedInbound` too, so each
+ * delivered fire is spool-acked exactly once and cannot re-fire after a
+ * restart. `beforeRedeliver` (the represent-veto) rides along by construction;
+ * it self-gates and is a no-op for cron-sourced fires. A `send` throw now
+ * re-buffers the fire (lossless) instead of dropping it — strictly safer than
+ * the pre-fix best-effort drop and identical to every sibling drain path.
+ *
+ * Returns the `redeliverBufferedInbound` counts for observability.
+ */
+export function drainCronBridgeOnRegister(
+  client: CronBridgeRegisterClient,
+  buffer: PendingInboundBuffer,
+  spool?: InboundSpool,
+  log?: (line: string) => void,
+): { drained: number; redelivered: number; rebuffered: number; retracted: number } {
+  // Status-silent handshake ack (unchanged from the pre-fix path).
+  client.send({ type: "status", status: "agent_connected" });
+  const send = (msg: InboundMessage): boolean => {
+    try {
+      client.send(msg);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const result = redeliverBufferedInbound(buffer, client.agentName ?? "", send, spool);
+  if (result.drained > 0 && log != null) {
+    log(
+      `telegram gateway: cron-bridge drain agent=${client.agentName} ` +
+        `drained=${result.drained} redelivered=${result.redelivered} ` +
+        `rebuffered=${result.rebuffered}\n`,
+    );
+  }
+  return result;
+}

package/telegram-plugin/gateway/gateway.ts

@@ -427,6 +427,7 @@ import {
   build429ClassifiedMetric,
   classify429Detail,
   decideThrottleTier,
+  routeRateLimit429,
   throttleRetryInPlaceMaxMs,
 } from '../throttle-tier.js'
 import { createThrottleTierRunner } from './throttle-tier-wiring.js'
@@ -497,7 +498,7 @@ import {
   type ReplyOwnerTier, type ReplyOwnerCandidates,
   type AnswerDeliveredLatch,
 } from '../reply-owner-resolve.js'
-import { SubagentHandbackMarker } from './subagent-handback-marker.js'
+import { SubagentHandbackMarker, cliTaskNotifLedger } from './subagent-handback-marker.js'
 // PR A — deterministic answer-ready quiescence flush (late-delivery fix).
 import { AnswerReadyFlushController, resolveAnswerReadyFlushMs, resolveAnswerStageMs } from '../answer-ready-flush.js'
 // #1667 — pure decision core for the turn_end answer-delivery gate (#1664).
@@ -660,7 +661,7 @@ import { handleRequestMs365Approval } from './ms365-write-approval.js'
 import { buildDiffPreviewCard } from './diff-preview-card.js'
 import { createPendingInboundBuffer, redeliverBufferedInbound, idleDrainTick } from './pending-inbound-buffer.js'
 import { makeRepresentRedeliveryGuard, makeSessionBusyDrainDeferral } from './represent-delivery-guard.js'
-import { isCronIdentity, isCronInjectFire, deliverInjectWithFallback, replyCallerIsForeignSession } from './cron-session.js'
+import { isCronIdentity, isCronInjectFire, deliverInjectWithFallback, replyCallerIsForeignSession, drainCronBridgeOnRegister } from './cron-session.js'
 import {
   ObligationLedger,
   obligationEscalationText,
@@ -857,7 +858,7 @@ import {
   resolvePersonaName, shouldSkipDuplicateBootCard,
   type BootCardHandle, type RestartReason,
 } from './boot-card.js'
-import { determineRestartReason } from './boot-reason.js'
+import { determineRestartReason, determineBridgeReconnectReason } from './boot-reason.js'
 import { maybeRenderUpdateAnnouncement } from './update-announce.js'
 import { createIssuesCardHandle, type IssuesCardHandle } from '../issues-card.js'
 import { startIssuesWatcher, type IssuesWatcherHandle } from '../issues-watcher.js'
@@ -7827,6 +7828,7 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
       agent,
       shouldEmitCard: (a) => shouldEmitOperatorEvent(a, 'rate-limited'),
     })
+    routeRateLimit429(rateLimit429Classification, throttleTierRunner, agent) // #failover-429-corroborate probe-only seam; boolean return is for test observability (throttle-tier-route-429.test.ts), intentionally discarded here — see docstring
     if (surface === 'litellm-local-notice') {
       process.stderr.write(
         `telegram gateway: 429 classified litellm-proxy-local agent=${agent} — ` +
@@ -9163,6 +9165,8 @@ let activeBootCard: BootCardHandle | null = null
 // dedupe checks this so it can't race against the boot path's await.
 // See issue #489 (klanker msgId 4715 + 4716, 2026-05-01 10:13:15).
 let bootCardPending = false
+// Boot-determined restart reason — see determineBridgeReconnectReason (B2).
+let bootReasonAtStartup: RestartReason | null = null
 
 // Issues card (#428) — pinned per-agent surface listing current
 // unresolved entries from the issue sink (#425). Idempotent across
@@ -10366,17 +10370,13 @@ if (isGatewayMain) ipcServer = createIpcServer({
 
   onClientRegistered(client: IpcClient) {
     process.stderr.write(`telegram gateway: bridge registered — agent=${client.agentName}\n`)
-    // Cheap-cron (§2.4/§3.3): a `<agent>-cron` bridge is the Tier-1 cheap
-    // session. It is STATUS-SILENT — it must NOT drive the gateway's
-    // singleton machinery (shadow bridge-state, warmup, boot card, which all
-    // track the MAIN agent's liveness). Drain any buffered cron fire to it
-    // (so a fire that triggered a lazy spawn lands), then return early.
+    // Cheap-cron (§2.4/§3.3): a `<agent>-cron` bridge is the Tier-1 cheap,
+    // STATUS-SILENT session — it must NOT drive the gateway's singleton
+    // machinery. Drain any boot-window cron fire to it, then return early.
+    // #4348: the drain routes through `redeliverBufferedInbound` (the shared
+    // ack chokepoint) so a spooled fire is acked and never re-fires on restart.
     if (isCronIdentity(client.agentName)) {
-      client.send({ type: 'status', status: 'agent_connected' })
-      const pending = pendingInboundBuffer.drain(client.agentName ?? '')
-      for (const m of pending) {
-        try { client.send(m) } catch { /* cron fire drop — best-effort, like today's cron */ }
-      }
+      drainCronBridgeOnRegister(client, pendingInboundBuffer, inboundSpool ?? undefined, (l) => process.stderr.write(l))
       return
     }
     // Phase 2b shadow: ONLY emit bridgeUp for the REAL bridge sidecar
@@ -10450,15 +10450,12 @@ if (isGatewayMain) ipcServer = createIpcServer({
       })
     }
 
-    // If the agent reconnected after a /restart (or any restart), post a boot
-    // card. The restart-marker carries the ack chat; if absent we fall back to
-    // resolveBootChatId so crash-recovery reconnects also get a card.
-    //
-    // Skip if the boot path already posted a card OR is currently in-flight
-    // on its sendMessage await (issue #489 — klanker msgId 4715+4716,
-    // 2026-05-01). The original dedupe (msgId 2245+2248, 2026-04-26) only
-    // covered the post-resolution case; bootCardPending closes the in-flight
-    // race window. See `shouldSkipDuplicateBootCard`.
+    // If the agent reconnected after a restart, post a boot card. The
+    // restart-marker carries the ack chat; else fall back to resolveBootChatId
+    // so crash-recovery reconnects also get a card. Skip if the boot path
+    // already posted a card OR its sendMessage is in-flight (issue #489,
+    // klanker 2026-05-01; earlier dedupe 2026-04-26 only covered the
+    // post-resolution case). See `shouldSkipDuplicateBootCard`.
     const dedupeDecision = shouldSkipDuplicateBootCard({ activeBootCard, bootCardPending }, 'bridge-reconnect')
     if (dedupeDecision.skip) {
       process.stderr.write(`telegram gateway: bridge-reconnect: skipping boot card (${dedupeDecision.reason})\n`)
@@ -10475,7 +10472,9 @@ if (isGatewayMain) ipcServer = createIpcServer({
         clearRestartMarker()
       }
 
-      const reason = determineRestartReason({ marker, cleanMarker, sessionMarker: storedSession, now: nowMs })
+      // B2: boot path cleared the markers — reuse its reason (boot-reason.ts).
+      const reason = determineBridgeReconnectReason({ marker, cleanMarker, sessionMarker: storedSession,
+        now: nowMs, gatewayStartedAtMs: GATEWAY_STARTED_AT_MS, bootReason: bootReasonAtStartup })
       const target = resolveBootChatId(marker, markerAgeMs)
 
       if (target) {
@@ -10693,6 +10692,7 @@ if (isGatewayMain) ipcServer = createIpcServer({
       }
     }
     const ev = msg.event as unknown as SessionEvent
+    if (ev.kind === 'task_notification') cliTaskNotifLedger.record(ev.taskId, ev.status, Date.now()) // double-wake dedup — ledger doc in subagent-handback-marker.ts
     // #1122/#1126: session events used to be ingested into the pinned progress
     // card here (`progressDriver.ingest`). The card is retired and the driver
     // is permanently null, so that call was a dead no-op — removed. Session
@@ -11760,7 +11760,9 @@ const IDLE_DRAIN_INTERVAL_MS = 5000
 // while the CLI is still producing the answer; draining a represent into that busy
 // session re-queues it BEHIND the real reply → a duplicate. Defer while busy,
 // bounded so a wedged session still drains (F1 then retracts it post-reply).
-const idleDrainBusyDefer = makeSessionBusyDrainDeferral(OBLIGATION_BACKGROUND_WORK_GRACE_MS)
+// staleGap = 3 poll intervals: a longer gap between busy consultations means the
+// buffer drained via a non-idle path so the next one is a NEW episode (#4341 f/u).
+const idleDrainBusyDefer = makeSessionBusyDrainDeferral(OBLIGATION_BACKGROUND_WORK_GRACE_MS, IDLE_DRAIN_INTERVAL_MS * 3)
 if (isGatewayMain && !STATIC) {
   setInterval(() => {
     const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? ''
@@ -11918,7 +11920,7 @@ async function executeSendChecklist(args: Record<string, unknown>): Promise<{ co
   const tasks = args.tasks as Array<{ text: string; done?: boolean }> | undefined
   if (!Array.isArray(tasks) || tasks.length === 0) throw new Error('send_checklist: tasks must be a non-empty array')
   const threadId = args.message_thread_id != null ? Number(args.message_thread_id) : undefined
-  const replyTo = args.reply_to != null ? Number(args.reply_to) : undefined
+  const replyTo = parseSourceMessageId(args.reply_to as string | number | null | undefined) ?? undefined // #4368: drop a fabricated/out-of-int32 anchor so the send lands unanchored, not 400
   const protectContent = args.protect_content === true
 
   assertAllowedChat(chat_id)
@@ -23490,15 +23492,14 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
           } else {
             const markerAgeMs = marker ? nowMs - marker.ts : undefined
             const reason = determineRestartReason({ marker, cleanMarker, sessionMarker: storedSession, now: nowMs })
+            // Markers were cleared above — stash for bridge re-register (B2).
+            bootReasonAtStartup = reason
             const target = resolveBootChatId(marker, markerAgeMs)
 
-            // Issue #92: when reason='crash' AND no chat is resolvable,
-            // the gateway used to silently skip — the only signal a user
-            // got was their next message landing on a fresh process. Now
-            // we always surface unplanned crashes via the operator-events
-            // pipeline, which broadcasts to access.allowFrom (same path
-            // permission requests use). The pipeline's per-agent per-kind
-            // cooldown protects against crash loops spamming the chat.
+            // Issue #92: when reason='crash' AND no chat is resolvable, the
+            // gateway used to silently skip. Always surface unplanned crashes
+            // via the operator-events pipeline (broadcasts to access.allowFrom;
+            // its per-agent per-kind cooldown absorbs crash loops).
             if (reason === 'crash') {
               const cleanMarkerStale = cleanMarker
                 ? !shouldSuppressRecoveryBanner(cleanMarker, nowMs, CLEAN_SHUTDOWN_MAX_AGE_MS)
@@ -24372,11 +24373,12 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
                   // deterministic dedup key — closes the #1719
                   // re-fire-on-restart class.
                   jsonlAgentId: agentId,
+                  cliTaskNotificationSeen: cliTaskNotifLedger.seenRecently(agentId, Date.now()), // double-wake dedup, fail-open — ledger doc in subagent-handback-marker.ts
                 })
                 if (!decision.deliver) {
-                  if (decision.reason === 'no-chat') {
+                  if (decision.reason === 'no-chat' || decision.reason === 'cli-task-notification') {
                     process.stderr.write(
-                      `telegram gateway: subagent-handback ${agentId} — no chat to deliver to; skipped\n`,
+                      `telegram gateway: subagent-handback ${agentId} skipped — ${decision.reason === 'no-chat' ? 'no chat to deliver to' : 'CLI task-notification already woke the parent for this completion (double-wake dedup)'}\n`,
                     )
                   }
                   return

package/telegram-plugin/gateway/narrative-lane.ts

@@ -56,6 +56,7 @@ import {
   appendActivityLabel, clipNarrative, formatStepSuffix, renderActivityFeedWithNested,
 } from '../tool-activity-summary.js'
 import { evaluatePostAnswerLiveness } from '../turn-liveness-floor.js'
+import { isSilentSentinelCardOutcome } from '../turn-flush-safety.js'
 import { clearActivityCardRecord, writeActivityCardRecord } from './activity-card-store.js'
 import { chatKeyWithSuffix } from './chat-key.js'
 import {
@@ -880,7 +881,26 @@ export function createNarrativeLane(deps: NarrativeLaneDeps) {
       // before the delete. turn-end stays the idempotent backstop: it no-ops
       // once nothing is claimed for the key.
       await reconcileStatusPin(`fg:${statusKey(chat, thread)}`, chat, { pinned: false })
-      if (CLEAR_STATUS_ON_COMPLETION) {
+      // #4348 — silent-sentinel suppression. A turn whose entire user-facing
+      // outcome is a bare NO_REPLY / HEARTBEAT_OK (the sentinel-reply-guard
+      // dropped a sentinel-only reply, or the flush safety net classified the
+      // captured text as silent) said nothing to the user, so its activity/
+      // telemetry card is pure noise — most visibly on the forced-synthesis
+      // handback turns a background sub-agent injects. DELETE the card rather
+      // than finalizing a visible `done · … · ✓ NO_REPLY` record. Deterministic
+      // (reuses the shared `turn-flush-safety` silent predicates, no model
+      // behaviour) and normal-case-safe (`finalAnswerEverDelivered` keeps every
+      // card for a turn that actually delivered a substantive answer). The
+      // `finalHtmlOverride` finalize path is only taken by the foreground
+      // handoff-clear, which fires on a delivered final answer — so this gate
+      // never contends with it.
+      const silentSentinelTurn = isSilentSentinelCardOutcome({
+        replyCalled: turn.replyCalled,
+        lastReplyText: turn.lastReplyText,
+        capturedText: turn.capturedText,
+        finalAnswerEverDelivered: turn.finalAnswerEverDelivered,
+      })
+      if (CLEAR_STATUS_ON_COMPLETION || silentSentinelTurn) {
         try {
           await robustApiCall(
             () => bot.api.deleteMessage(chat, id),

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -73,6 +73,7 @@ import { getBuzzMirror } from './buzz-mirror.js'
 import { isFinalAnswerReply, isSubstantiveFinalReply, shouldJournalReplySiteDelivery } from '../final-answer-detect.js'
 import { decideOverPing, type OverPingDecision } from '../over-ping-safety-net.js'
 import { decideSilentReplyAnchor } from '../silent-reply-anchor.js'
+import { parseSourceMessageId } from './source-message-id.js'
 import {
   decideSupersedeCorrection,
   flushedAnswerMatchesReply,
@@ -1343,7 +1344,14 @@ export async function sendReply(
 
   const files = (args.files as string[] | undefined) ?? []
   const quoteOptIn = args.quote !== false
-  let reply_to = args.reply_to != null ? Number(args.reply_to) : undefined
+  // #4368 — the model's reply tool can quote a synthetic inbound (a boot-
+  // resume/handback/cron fabricated id at `Date.now()` scale). Route it through
+  // the canonical guard so an out-of-int32 anchor is DROPPED (send lands
+  // unanchored) rather than 400ing every chunk on `reply_parameters.message_id`.
+  // A later `reply_to = latest` (quote-opt-in default) is a Telegram-returned
+  // id and needs no re-check. Also closes the pre-existing NaN hole: a non-
+  // numeric `reply_to` used to coerce to NaN and still build the anchor.
+  let reply_to = parseSourceMessageId(args.reply_to as string | number | null | undefined) ?? undefined
   const protectContent = args.protect_content === true
   const quoteText = args.quote_text as string | undefined
   const access = loadAccess()

package/telegram-plugin/gateway/represent-delivery-guard.ts

@@ -137,19 +137,50 @@ export function makeRepresentRedeliveryGuard(
  * ordinary busy turn (which ends well within the bound) defers cleanly and never
  * consumes the wedge budget.
  *
+ * Episode isolation (#4341 follow-up): `deferringSince` used to reset ONLY on a
+ * `busy=false` call, but the predicate is not consulted on every drain path. When
+ * a buffer is emptied by a bridge re-register (`onClientRegistered`) while the
+ * session is still busy, the idle-drain gate is never invoked with `busy=false`,
+ * so `deferringSince` stays pinned at the old t0. A later, UNRELATED deferral
+ * episode then computes `now - t0 >= boundMs` immediately and drains a represent
+ * into a mid-answer session — reopening the duplicate window this guard closes.
+ * Fix: a fresh deferral episode also starts the clock at `now` when the predicate
+ * has not been consulted within `staleGapMs`. The idle-drain gate polls on a
+ * fixed short interval while (and only while) the buffer is non-empty, so a gap
+ * between consecutive consultations longer than a few poll intervals means the
+ * prior episode's buffer drained via a non-idle path and this is a new episode.
+ *
  * `boundMs <= 0` disables the busy-defer entirely (kill switch / parity with the
- * background-work grace being disabled).
+ * background-work grace being disabled). `staleGapMs <= 0` disables the
+ * gap-based episode reset (leaving only the `busy=false` reset).
  */
+export const DEFAULT_DRAIN_DEFER_STALE_GAP_MS = 15_000
+
 export function makeSessionBusyDrainDeferral(
   boundMs: number,
+  staleGapMs: number = DEFAULT_DRAIN_DEFER_STALE_GAP_MS,
 ): (busy: boolean, now: number) => boolean {
   let deferringSince: number | null = null
+  let lastCallAt: number | null = null
   return (busy, now) => {
+    const gapSinceLastCall = lastCallAt == null ? null : now - lastCallAt
+    lastCallAt = now
     if (!busy || boundMs <= 0) {
       deferringSince = null
       return false
     }
-    if (deferringSince == null) deferringSince = now
+    // Start (or restart) the clock at the top of a NEW deferral episode:
+    //   - we were not deferring (deferringSince cleared by a busy=false call), OR
+    //   - the predicate has not been consulted within staleGapMs, which means the
+    //     prior episode's buffer drained via a path that never calls us with
+    //     busy=false (bridge re-register) and left deferringSince pinned at a
+    //     stale t0. Either way a fresh episode's bound must run from `now`.
+    if (
+      deferringSince == null ||
+      (staleGapMs > 0 && gapSinceLastCall != null && gapSinceLastCall > staleGapMs)
+    ) {
+      deferringSince = now
+    }
     // Bounded: stop deferring once we have been busy past the ceiling, so a
     // wedged/hung session still eventually drains the buffered represent.
     return now - deferringSince < boundMs

package/telegram-plugin/gateway/stream-render.ts

@@ -1138,8 +1138,17 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
       }
       if (QUEUED_CARD_ENABLED && !handbackOwnsSurface) {
         const cardChatId = ev.chatId
-        const replyToRaw = ev.messageId != null ? Number(ev.messageId) : null
-        const replyTo = replyToRaw != null && Number.isFinite(replyToRaw) ? replyToRaw : null
+        // Reply-anchor ONLY to a plausible real Telegram message id. Synthetic
+        // enqueues (subagent handback, boot resume, cron) fabricate `messageId`
+        // from `Date.now()` (~1.78e13) — finite, so a bare `Number.isFinite`
+        // guard passes it, but `reply_parameters.message_id` hard-rejects
+        // anything beyond signed int32 with 400 `field "message_id" must be a
+        // valid Number` (`allow_sending_without_reply` does NOT bypass the
+        // range check), killing the whole card send (overlord
+        // gateway-supervisor.log 2026-08-04, e.g. msg=1785846295635). Same bug
+        // class as the resume-dark-feed incident — reuse its guard, don't
+        // re-derive a weaker one. An unanchored card is fine; no card is not.
+        const replyTo = parseSourceMessageId(ev.messageId)
         void openQueuedCard(deps, cardChatId, enqThreadIdNum ?? null, replyTo).then((cardId) => {
           if (cardId == null) return
           // Still parked → adopt on the next dequeue. Otherwise the entry already

package/telegram-plugin/gateway/subagent-handback-inbound-builder.ts

@@ -183,6 +183,17 @@ export interface SubagentHandbackDecisionInput {
    *  the built inbound's `meta.subagent_jsonl_id`. See
    *  `SubagentHandbackContext.jsonlAgentId` for the dedup rationale. */
   jsonlAgentId?: string
+  /**
+   * Double-wake dedup (v0.20.8 candidate): true iff the session tail already
+   * observed a TERMINAL CLI `<task-notification>` for EXACTLY this sub-agent's
+   * task id within `TASK_NOTIFICATION_DEDUP_TTL_MS` — i.e. the CLI itself has
+   * already woken (or queued the wake of) the parent with this completion, so
+   * a second gateway-synthesized wake would duplicate it. The caller resolves
+   * this from `CliTaskNotificationLedger.seenRecently(agentId, now)`
+   * (subagent-handback-marker.ts). FAIL-OPEN: omitted/false → deliver; only a
+   * confirmed exact-id in-window hit suppresses.
+   */
+  cliTaskNotificationSeen?: boolean
   /** Deterministic clock for tests. */
   nowMs?: number
 }
@@ -192,6 +203,7 @@ export type SubagentHandbackSkipReason =
   | 'env-disabled'
   | 'outcome-not-terminal'
   | 'foreground'
+  | 'cli-task-notification'
   | 'no-chat'
 
 export type SubagentHandbackDecision =
@@ -208,7 +220,12 @@ export type SubagentHandbackDecision =
  *      stale historical-at-boot row, not a fresh completion.
  *   3. foreground — a foreground sub-agent already handed its result
  *      back as the Task tool result in the parent's own turn.
- *   4. no-chat — neither the fleet entry nor the owner chat resolved,
+ *   4. cli-task-notification — the claude CLI's OWN `<task-notification>`
+ *      for exactly this task id was already observed in-window, so the CLI
+ *      has already woken the parent with this completion; a second
+ *      gateway-synthesized wake would double it (the double-message bug).
+ *      Fail-open: only a confirmed exact-id hit skips.
+ *   5. no-chat — neither the fleet entry nor the owner chat resolved,
  *      so there is nowhere to deliver.
  */
 export function decideSubagentHandback(
@@ -223,6 +240,9 @@ export function decideSubagentHandback(
   if (!input.isBackground) {
     return { deliver: false, reason: 'foreground' }
   }
+  if (input.cliTaskNotificationSeen === true) {
+    return { deliver: false, reason: 'cli-task-notification' }
+  }
   const chatId = input.fleetChatId || input.ownerChatId
   if (!chatId) {
     return { deliver: false, reason: 'no-chat' }