switchroom 0.20.8 → 0.20.10

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -73,6 +73,7 @@ import { getBuzzMirror } from './buzz-mirror.js'
 import { isFinalAnswerReply, isSubstantiveFinalReply, shouldJournalReplySiteDelivery } from '../final-answer-detect.js'
 import { decideOverPing, type OverPingDecision } from '../over-ping-safety-net.js'
 import { decideSilentReplyAnchor } from '../silent-reply-anchor.js'
+import { parseSourceMessageId } from './source-message-id.js'
 import {
   decideSupersedeCorrection,
   flushedAnswerMatchesReply,
@@ -1343,7 +1344,14 @@ export async function sendReply(
 
   const files = (args.files as string[] | undefined) ?? []
   const quoteOptIn = args.quote !== false
-  let reply_to = args.reply_to != null ? Number(args.reply_to) : undefined
+  // #4368 — the model's reply tool can quote a synthetic inbound (a boot-
+  // resume/handback/cron fabricated id at `Date.now()` scale). Route it through
+  // the canonical guard so an out-of-int32 anchor is DROPPED (send lands
+  // unanchored) rather than 400ing every chunk on `reply_parameters.message_id`.
+  // A later `reply_to = latest` (quote-opt-in default) is a Telegram-returned
+  // id and needs no re-check. Also closes the pre-existing NaN hole: a non-
+  // numeric `reply_to` used to coerce to NaN and still build the anchor.
+  let reply_to = parseSourceMessageId(args.reply_to as string | number | null | undefined) ?? undefined
   const protectContent = args.protect_content === true
   const quoteText = args.quote_text as string | undefined
   const access = loadAccess()

package/telegram-plugin/gateway/subagent-handback-inbound-builder.ts

@@ -183,6 +183,17 @@ export interface SubagentHandbackDecisionInput {
    *  the built inbound's `meta.subagent_jsonl_id`. See
    *  `SubagentHandbackContext.jsonlAgentId` for the dedup rationale. */
   jsonlAgentId?: string
+  /**
+   * Double-wake dedup (v0.20.8 candidate): true iff the session tail already
+   * observed a TERMINAL CLI `<task-notification>` for EXACTLY this sub-agent's
+   * task id within `TASK_NOTIFICATION_DEDUP_TTL_MS` — i.e. the CLI itself has
+   * already woken (or queued the wake of) the parent with this completion, so
+   * a second gateway-synthesized wake would duplicate it. The caller resolves
+   * this from `CliTaskNotificationLedger.seenRecently(agentId, now)`
+   * (subagent-handback-marker.ts). FAIL-OPEN: omitted/false → deliver; only a
+   * confirmed exact-id in-window hit suppresses.
+   */
+  cliTaskNotificationSeen?: boolean
   /** Deterministic clock for tests. */
   nowMs?: number
 }
@@ -192,6 +203,7 @@ export type SubagentHandbackSkipReason =
   | 'env-disabled'
   | 'outcome-not-terminal'
   | 'foreground'
+  | 'cli-task-notification'
   | 'no-chat'
 
 export type SubagentHandbackDecision =
@@ -208,7 +220,12 @@ export type SubagentHandbackDecision =
  *      stale historical-at-boot row, not a fresh completion.
  *   3. foreground — a foreground sub-agent already handed its result
  *      back as the Task tool result in the parent's own turn.
- *   4. no-chat — neither the fleet entry nor the owner chat resolved,
+ *   4. cli-task-notification — the claude CLI's OWN `<task-notification>`
+ *      for exactly this task id was already observed in-window, so the CLI
+ *      has already woken the parent with this completion; a second
+ *      gateway-synthesized wake would double it (the double-message bug).
+ *      Fail-open: only a confirmed exact-id hit skips.
+ *   5. no-chat — neither the fleet entry nor the owner chat resolved,
  *      so there is nowhere to deliver.
  */
 export function decideSubagentHandback(
@@ -223,6 +240,9 @@ export function decideSubagentHandback(
   if (!input.isBackground) {
     return { deliver: false, reason: 'foreground' }
   }
+  if (input.cliTaskNotificationSeen === true) {
+    return { deliver: false, reason: 'cli-task-notification' }
+  }
   const chatId = input.fleetChatId || input.ownerChatId
   if (!chatId) {
     return { deliver: false, reason: 'no-chat' }

package/telegram-plugin/gateway/subagent-handback-marker.ts

@@ -220,6 +220,100 @@ export function stampsHandbackMarker(source: string | null | undefined): boolean
  */
 export const HANDBACK_RECENCY_WINDOW_MS = 60_000
 
+// ───────────────────────────────────────────────────────────────────────────
+// CLI task-notification dedup ledger (double-wake fix, v0.20.8 candidate)
+// ───────────────────────────────────────────────────────────────────────────
+//
+// One background sub-agent completion used to produce TWO independent wakes of
+// the parent session:
+//   1. The claude CLI's OWN `<task-notification>` — the CLI proactively
+//      enqueues it into the parent session when a backgrounded task/agent
+//      completes (projected as a `task_notification` SessionEvent at the
+//      queue-operation enqueue line, session-tail.ts). The parent wakes,
+//      sees the notification + summary, and typically reports to the user.
+//   2. The gateway-synthesized `subagent_handback` inbound (subagent-watcher
+//      `onFinish` → pendingInboundBuffer.push) — switchroom's deliberate
+//      beat-4 wake, added because older CLIs surfaced a background result
+//      only on the parent's NEXT user turn.
+// Nothing linked them, so a single completion fanned out to two turns and two
+// user-visible replies. The CLI-native wake cannot be suppressed (it is the
+// CLI's internal queue); the ONE lever switchroom holds is the handback
+// enqueue. This ledger records every terminal `<task-notification>` the
+// session tail observes, keyed by its `<task-id>` — which is EXACTLY the
+// sub-agent watcher's `agentId` (both are the `agent-<id>.jsonl` stem;
+// verified against live transcripts: `<task-id>a204deeaedb27b580</task-id>`
+// ↔ `subagents/agent-a204deeaedb27b580.jsonl`). `decideSubagentHandback`
+// then skips the redundant handback ONLY on an exact-id hit inside a short
+// TTL.
+//
+// FAIL-OPEN by construction — every uncertain path DELIVERS the handback:
+//   - no notification seen for this exact id → deliver (a dropped real wake
+//     means a silent worker and a user waiting forever; an occasional double
+//     is strictly better);
+//   - notification older than the TTL → deliver (a resumed worker's second
+//     completion must not be swallowed by its first completion's entry);
+//   - non-terminal notification status → never recorded, so → deliver;
+//   - gateway restart (ledger is in-memory) → boot-replayed handbacks
+//     deliver;
+//   - the CLI notification landing AFTER the handback enqueue (lost race) →
+//     deliver (the residual occasional double, accepted).
+// The liveness consumer (background-shell-liveness.ts) is untouched: the same
+// `task_notification` event still drives noteBackgroundShellDead —
+// recording here is an independent, additive read of the event.
+
+/**
+ * How long a recorded terminal `<task-notification>` suppresses the matching
+ * `subagent_handback`. The real gap between the CLI's notification enqueue
+ * and the watcher's `onFinish` (its ~1s jsonl rescan) is a few seconds; 30s
+ * covers scheduler jitter with a wide margin while staying far below any
+ * plausible resume-and-complete-again cycle for the same agent id, so a
+ * resumed worker's second completion falls outside the window → fail-open.
+ */
+export const TASK_NOTIFICATION_DEDUP_TTL_MS = 30_000
+
+/** `<task-notification>` statuses that mean the task genuinely ended and the
+ *  CLI woke (or will wake) the parent with the completion. Mirrors the
+ *  liveness consumer's terminal set (background-shell-liveness.ts). */
+const NOTIF_TERMINAL_STATUSES = new Set(['completed', 'failed', 'killed'])
+
+/**
+ * In-memory seen-set of terminal CLI `<task-notification>` task ids.
+ * Deliberately process-local: absence after a restart fails open (deliver).
+ */
+export class CliTaskNotificationLedger {
+  private readonly seen = new Map<string, number>()
+
+  /** Record a parsed `task_notification` session event. Non-terminal
+   *  statuses and empty ids are ignored (they must never suppress). */
+  record(taskId: string, status: string, now: number): void {
+    if (taskId.length === 0 || !NOTIF_TERMINAL_STATUSES.has(status)) return
+    this.seen.set(taskId, now)
+    // Bounded: prune expired entries on write so the map tracks only the
+    // live window (a handful of ids), never the process lifetime.
+    for (const [id, ts] of this.seen) {
+      if (now - ts > TASK_NOTIFICATION_DEDUP_TTL_MS) this.seen.delete(id)
+    }
+  }
+
+  /** True iff a terminal notification for EXACTLY `taskId` was recorded
+   *  within the TTL. Anything else → false → the handback delivers. */
+  seenRecently(taskId: string, now: number): boolean {
+    const ts = this.seen.get(taskId)
+    return ts != null && now - ts <= TASK_NOTIFICATION_DEDUP_TTL_MS
+  }
+}
+
+/**
+ * The gateway's process-wide ledger instance (one gateway process per agent,
+ * one main session — a module singleton keeps the gateway.ts wiring to two
+ * lines under the anti-inflation ratchet, #2996). Written at the gateway's
+ * `onSessionEvent` (OUTSIDE the currentTurn guard — the CLI enqueues the
+ * notification while the parent is typically idle with no live gateway turn);
+ * read at the `onFinish` handback decide site. Tests construct their own
+ * `CliTaskNotificationLedger` instances.
+ */
+export const cliTaskNotifLedger = new CliTaskNotificationLedger()
+
 /** Sentinel thread key for the no-thread (DM / bare-chat) lane. */
 const MAIN_THREAD_KEY = '<main>'
 

package/telegram-plugin/gateway/throttle-tier-wiring.ts

@@ -35,6 +35,18 @@
  * (`LastFleetRoll` docstring in src/auth/broker/server.ts), which also
  * covers PINNED (non-fleet-active) account rolls — then nudges the resume
  * immediately through the same turn-safety guards.
+ *
+ * Two entrypoints (#failover-429-corroborate):
+ *   - `fire` — the FULL path above, for an ACCOUNT-SCOPED 429 (wording that
+ *     names the account's own usage limit). Records `throttled_until`, notices,
+ *     nudges, escalates.
+ *   - `fireProbeOnly` — for a GENERIC-TRANSIENT 429 (bare `rate_limit_error`
+ *     wording that neither names the account nor is proxy-local). Runs ONLY the
+ *     broker's rate-bounded escalation probe: a corroborated wall escalates
+ *     exactly like `fire`, but a HEALTHY probe is account-inert — no notice, no
+ *     nudge, no `throttled_until`, no second card. The gateway's calm
+ *     rate-limited card stays the only user-visible output. The two share the
+ *     escalation announce/resume via `announceEscalation`.
  */
 
 import {
@@ -56,7 +68,7 @@ export const THROTTLE_RETRY_NUDGE_JITTER_MAX_MS = 30_000
 /** The narrow broker surface the runner needs (structurally satisfied by
  *  the gateway's AuthBrokerClient). */
 export interface ThrottleBrokerClient {
-  markThrottled(until: number): Promise<{
+  markThrottled(until: number, probeOnly?: boolean): Promise<{
     account: string
     throttled_until: number
     escalated: boolean
@@ -92,10 +104,21 @@ export interface ThrottleTierRunnerDeps {
 
 export interface ThrottleTierRunner {
   /**
-   * Run the throttle path for one terminal transient 429. Fire-and-forget
-   * from the caller's perspective — never throws.
+   * Run the FULL throttle path for one terminal account-scoped 429: record
+   * `throttled_until`, post one deduped notice, arm the retry nudge, and
+   * escalate to failover when the first-hit probe corroborates a wall.
+   * Fire-and-forget from the caller's perspective — never throws.
    */
   fire(triggerAgent: string, throttledUntilMs: number, resetParsed: boolean): Promise<void>
+  /**
+   * PROBE-ONLY path for a generic-transient 429 (#failover-429-corroborate).
+   * Runs ONLY the broker's rate-bounded escalation probe: a corroborated wall
+   * escalates (announce + resume nudge) exactly like `fire`; a HEALTHY probe is
+   * account-inert — NO notice, NO nudge, NO `throttled_until` soft-defer, NO
+   * second card. The calm rate-limited card the gateway already emitted stays
+   * the only user-visible output. Fire-and-forget; never throws.
+   */
+  fireProbeOnly(triggerAgent: string): Promise<void>
   /** Test/debug view of internal state. */
   inspect(): { noticeState: ThrottleNoticeState; nudgePending: boolean }
 }
@@ -180,6 +203,33 @@ export function createThrottleTierRunner(deps: ThrottleTierRunnerDeps): Throttle
     }
   }
 
+  /**
+   * The escalated outcome, shared by `fire` and `fireProbeOnly`: the broker
+   * corroborated a genuine wall via a live probe and already ran mark-exhausted
+   * + roll (fleet active AND pinned accounts alike). The RAISING gateway
+   * announces — reactive-path doctrine — fleet-deduped so N gateways sharing
+   * the account produce one copy per chat, then nudges the resume.
+   */
+  async function announceEscalation(
+    client: ThrottleBrokerClient | null,
+    account: string | null,
+    rolledTo: string | null,
+    triggerAgent: string,
+    armedAtMs: number,
+  ): Promise<void> {
+    deps.log(
+      `[throttle-tier] escalated to wall account=${account ?? '?'} ` +
+        `rolledTo=${rolledTo ?? 'none (all blocked)'}`,
+    )
+    await broadcastDeduped(
+      client,
+      'throttle-escalation',
+      account,
+      renderThrottleEscalationNotice({ account, agent: triggerAgent, rolledTo }),
+    )
+    if (rolledTo) nudgeResume('throttle-escalation-resume', armedAtMs)
+  }
+
   async function fire(
     triggerAgent: string,
     throttledUntilMs: number,
@@ -209,21 +259,7 @@ export function createThrottleTierRunner(deps: ThrottleTierRunnerDeps): Throttle
     }
 
     if (escalated) {
-      // The broker corroborated a genuine wall via a live probe and already
-      // ran mark-exhausted + roll (fleet active AND pinned accounts alike).
-      // The RAISING gateway announces — reactive-path doctrine — fleet-
-      // deduped so N gateways sharing the account produce one copy per chat.
-      deps.log(
-        `[throttle-tier] escalated to wall account=${account ?? '?'} ` +
-          `rolledTo=${rolledTo ?? 'none (all blocked)'}`,
-      )
-      await broadcastDeduped(
-        client,
-        'throttle-escalation',
-        account,
-        renderThrottleEscalationNotice({ account, agent: triggerAgent, rolledTo }),
-      )
-      if (rolledTo) nudgeResume('throttle-escalation-resume', armedAtMs)
+      await announceEscalation(client, account, rolledTo, triggerAgent, armedAtMs)
       return
     }
 
@@ -261,8 +297,47 @@ export function createThrottleTierRunner(deps: ThrottleTierRunnerDeps): Throttle
     }, delayMs)
   }
 
+  async function fireProbeOnly(triggerAgent: string): Promise<void> {
+    const armedAtMs = now()
+    let client: ThrottleBrokerClient | null = null
+    let account: string | null = null
+    let escalated = false
+    let rolledTo: string | null = null
+    try {
+      client = await deps.getBrokerClient()
+      if (client) {
+        // `until` is ignored by the broker in probeOnly mode (nothing is
+        // recorded) but the protocol requires a positive int — pass a nominal.
+        const r = await client.markThrottled(now() + 1, true)
+        account = r.account
+        escalated = r.escalated
+        rolledTo = r.rolledTo ?? null
+      } else {
+        deps.log(
+          `[throttle-tier] broker unreachable — probe-only skipped agent=${triggerAgent}`,
+        )
+      }
+    } catch (err) {
+      deps.log(
+        `[throttle-tier] probe-only markThrottled failed agent=${triggerAgent}: ${(err as Error)?.message ?? err}`,
+      )
+    }
+
+    if (escalated) {
+      await announceEscalation(client, account, rolledTo, triggerAgent, armedAtMs)
+      return
+    }
+
+    // HEALTHY / rate-bounded / broker-down: account-inert. NOTHING else — no
+    // notice, no retry nudge, no throttled_until soft-defer. The calm
+    // rate-limited card the gateway already emitted is the only user-visible
+    // output, exactly as before the escalation probe was wired.
+    deps.log(`[throttle-tier] generic-transient probe-only inert (no wall) agent=${triggerAgent}`)
+  }
+
   return {
     fire,
+    fireProbeOnly,
     inspect: () => ({ noticeState, nudgePending: pendingNudge != null }),
   }
 }

package/telegram-plugin/render/emphasis-guard.ts

@@ -34,19 +34,38 @@
 // `__x__` double runs are excluded for free: the inner neighbour of each `*`
 // in `a**b` is another `*` (not alphanumeric), so neither half matches.
 //
+// A SECOND, always-safe arm (added for issue #3464 alongside the line-start
+// glued-`#` guard) escapes a `*` that is flanked by WHITESPACE OR A STRING
+// BOUNDARY on BOTH immediate sides (`a * b`, ` * `, a bare `*`, a trailing
+// `rm *`). Under GFM flanking rules such a `*` is neither left- nor right-
+// flanking, so it can NEVER open OR close emphasis; escaping it therefore
+// cannot break an intended `*italic*` / `**bold**` (whose delimiters are
+// word-adjacent on their INNER side, so never whitespace-flanked on both
+// sides). Because this `*` can never pair, the arm fires on a single
+// occurrence — it needs no 2+ threshold. Live Telegram UAT for #3464 confirmed
+// the non-spec Bot API parser can still surface a stray lone `*` in this
+// position, so neutralising it deterministically is the durable fix.
+//
+// The ONE boundary-flanked position this arm must NOT touch is a line-leading
+// `* ` — that is an unordered-list BULLET (`* item`), not an inert operator.
+// Escaping it would break `*`-bullets on every outbound message AND (because
+// this arm runs before `guardAccidentalHeading`) disarm the glued-`#` fix for
+// `* #4382`. See `isLineLeadingBullet`. A lone `*` on its own line has no
+// trailing space, is not a bullet, and is still escaped.
+//
 // What we DELIBERATELY LEAVE ALONE (conservative false-negatives, per the
 // "when in doubt, leave it" doctrine inherited from the dollar guard):
-//   - Space-flanked operators (`3 * 4`): a whitespace-flanked `*`/`_` is
-//     neither left- nor right-flanking under GFM, so it can never open or
-//     close emphasis — there is no bug to fix, and escaping it would be pure
-//     churn.
-//   - Boundary-flanked delimiters (`rm *`, `*.ts`, leading-`_` `_private`):
-//     these are INDISTINGUISHABLE from an intended `*glob*` / `_italic_`
-//     opener (`*.ts is a glob*` is a legitimate italic). Escaping them would
-//     risk breaking intended emphasis — the one thing this guard must never
-//     do — so a glob/leading-underscore that pairs into an accidental span is
-//     accepted as a rare false-negative rather than risked as a false-positive.
-//     (A future arm could target these behind live Telegram UAT; see below.)
+//   - Boundary-flanked delimiters with a NON-whitespace neighbour on the other
+//     side (`*.ts`, leading-`_` `_private`): these are INDISTINGUISHABLE from
+//     an intended `*glob*` / `_italic_` opener (`*.ts is a glob*` is a
+//     legitimate italic). Escaping them would risk breaking intended emphasis —
+//     the one thing this guard must never do — so a glob/leading-underscore
+//     that pairs into an accidental span is accepted as a rare false-negative
+//     rather than risked as a false-positive. (The whitespace-on-BOTH-sides
+//     form `rm *` is NOT in this class — a `*` with whitespace/boundary on both
+//     sides is provably inert, so the new arm above escapes it safely.)
+//     `_` in this position is likewise left alone; the boundary-flanked arm is
+//     `*`-only.
 //
 // Idempotent: the escape is expressed as an intra-word match, so an
 // already-escaped `\_`/`\*` has a backslash (not an alphanumeric) immediately
@@ -91,6 +110,47 @@ const INTRA_WORD_UNDERSCORE = /(?<=[A-Za-z0-9])_(?=[A-Za-z0-9])/g;
  *  neighbour is `*` (not alnum). Idempotent for the same reason as above. */
 const INTRA_WORD_ASTERISK = /(?<=[A-Za-z0-9])\*(?=[A-Za-z0-9])/g;
 
+/** A `*` flanked by WHITESPACE OR A STRING BOUNDARY on BOTH immediate sides
+ *  (`a * b`, ` * `, a bare `*`, `rm *`). Neither left- nor right-flanking under
+ *  GFM, so it can never open or close emphasis — escaping it is always safe and
+ *  can never touch an intended `*italic*` / `**bold**` (word-adjacent on the
+ *  inner side). Idempotent: after escaping, the `*` is preceded by `\` (neither
+ *  whitespace nor `^`), so the lookbehind no longer matches. `\n` is whitespace,
+ *  so a `*` alone on its own line is covered without a multiline flag.
+ *
+ *  CRITICAL EXCLUSION — a line-leading `* ` is an unordered-LIST BULLET, not an
+ *  inert operator, and MUST NOT be escaped (`isLineLeadingBullet` below). Two
+ *  reasons: (a) `*`-bullets are extremely common in replies and escaping the
+ *  marker would break the list on EVERY outbound message (an asymmetric
+ *  regression — `-`/`+` bullets are untouched); (b) this guard runs BEFORE
+ *  `guardAccidentalHeading` in the `guardAccidentalFormatting` pipeline
+ *  (rich-send.ts), and the heading guard's `ACCIDENTAL_HEADING_AFTER_MARKER`
+ *  needs the LITERAL `*` marker to fire — escaping the marker here would silently
+ *  disarm the glued-`#` fix for the `* #4382` case (#3464). A lone `*` on its own
+ *  line (`\n*\n`) is NOT a bullet — no trailing space — so it is still escaped. */
+const BOUNDARY_FLANKED_ASTERISK = /(?<=^|\s)\*(?=\s|$)/g;
+
+/** True iff the `*` at `starIndex` is a line-leading unordered-list bullet: a
+ *  line start (string start or after `\n`) + up to 3 spaces/tabs of indent, then
+ *  the `*`, then a space/tab. This is the ONE boundary-flanked position we leave
+ *  alone (see BOUNDARY_FLANKED_ASTERISK). Note: a segment that begins mid-line
+ *  (right after an inline code span) has its start treated as a line start here,
+ *  which errs toward PRESERVING an ambiguous leading `*` — the safe direction,
+ *  since wrongly escaping a bullet is the failure this exclusion exists to stop. */
+function isLineLeadingBullet(text: string, starIndex: number): boolean {
+  // A bullet requires a space/tab immediately after the marker.
+  const next = text[starIndex + 1];
+  if (next !== " " && next !== "\t") return false;
+  // Walk left over up to 3 indent spaces/tabs; the run must reach a line start.
+  let i = starIndex - 1;
+  let indent = 0;
+  while (i >= 0 && (text[i] === " " || text[i] === "\t")) {
+    if (++indent > 3) return false;
+    i--;
+  }
+  return i < 0 || text[i] === "\n";
+}
+
 /** Every unescaped `_` / `*` in prose (the pair-threshold input). An emphasis
  *  span needs a MATCHING pair of the same delimiter, so a delimiter can only
  *  mis-render when 2+ of it exist. The `(?<!\\)` keeps the count idempotent. */
@@ -129,22 +189,37 @@ export function guardAccidentalEmphasis(text: string): string {
   // 2+ of that delimiter exist (so a pair — hence a mis-render — is possible).
   let hasIntraUnderscore = false;
   let hasIntraAsterisk = false;
+  let hasBoundaryAsterisk = false;
   let underscoreCount = 0;
   let asteriskCount = 0;
   for (const seg of segments) {
     if (seg.code) continue;
     if (INTRA_WORD_UNDERSCORE.test(seg.text)) hasIntraUnderscore = true;
     if (INTRA_WORD_ASTERISK.test(seg.text)) hasIntraAsterisk = true;
+    // Arm only on a boundary-flanked `*` that is NOT a line-leading bullet, so a
+    // segment whose only such `*` is a bullet keeps the guard a strict no-op.
+    if (!hasBoundaryAsterisk) {
+      for (const m of seg.text.matchAll(BOUNDARY_FLANKED_ASTERISK)) {
+        if (!isLineLeadingBullet(seg.text, m.index ?? 0)) {
+          hasBoundaryAsterisk = true;
+          break;
+        }
+      }
+    }
     underscoreCount += seg.text.match(ANY_UNDERSCORE)?.length ?? 0;
     asteriskCount += seg.text.match(ANY_ASTERISK)?.length ?? 0;
   }
   // Reset lastIndex — the /g regexes above are stateful across .test() calls.
   INTRA_WORD_UNDERSCORE.lastIndex = 0;
   INTRA_WORD_ASTERISK.lastIndex = 0;
+  BOUNDARY_FLANKED_ASTERISK.lastIndex = 0;
 
   const armUnderscore = hasIntraUnderscore && underscoreCount >= 2;
   const armAsterisk = hasIntraAsterisk && asteriskCount >= 2;
-  if (!armUnderscore && !armAsterisk) return text;
+  // The boundary-flanked `*` can NEVER pair (neither flanking), so no 2+
+  // threshold: a single occurrence is escaped on its own.
+  const armBoundaryAsterisk = hasBoundaryAsterisk;
+  if (!armUnderscore && !armAsterisk && !armBoundaryAsterisk) return text;
 
   return segments
     .map((seg) => {
@@ -152,6 +227,11 @@ export function guardAccidentalEmphasis(text: string): string {
       let out = seg.text;
       if (armUnderscore) out = out.replace(INTRA_WORD_UNDERSCORE, "\\_");
       if (armAsterisk) out = out.replace(INTRA_WORD_ASTERISK, "\\*");
+      if (armBoundaryAsterisk) {
+        out = out.replace(BOUNDARY_FLANKED_ASTERISK, (m, offset: number, str: string) =>
+          isLineLeadingBullet(str, offset) ? m : "\\*",
+        );
+      }
       return out;
     })
     .join("");

package/telegram-plugin/render/line-start-guard.ts

@@ -187,13 +187,38 @@ export function guardAccidentalBlockConstructs(text: string): string {
  *  `#{1,6}` no longer sits at the (post-indent) line start. */
 const ACCIDENTAL_HEADING = /^([ \t]{0,3})(#{1,6})(?=[^\s#])/;
 
+/** Same accidental-heading run, but sitting AFTER one or more line-start LIST or
+ *  BLOCKQUOTE markers on the SAME line (`- #4382`, `* #4382`, `+ #4382`,
+ *  `1. #4382`, `> #4382`, and nested combinations like `- > #4382`) — issue
+ *  #3464. `guardAccidentalHeading`'s original `^`-anchored pattern only sees a
+ *  `#` at the true (post-indent) line start, so a `#` glued after a marker slips
+ *  through and Telegram's non-spec Bot API parser promotes it to a heading just
+ *  as it does at a bare line start (confirmed by live UAT for #3464). The prefix
+ *  is `([ \t]{0,3}<marker>+)`: up to 3 leading spaces, then one-or-more markers,
+ *  each an unordered bullet (`-`/`*`/`+`) or short ordered marker (`1.`/`1)`,
+ *  1–3 digits) followed by ≥1 space/tab, or a blockquote `>` with optional
+ *  spaces. Group 1 captures the WHOLE prefix so the replacement re-emits it
+ *  verbatim and escapes ONLY the first `#` of group 2. The same `(?=[^\s#])`
+ *  lookahead keeps a real nested heading (`- # Heading`, space AFTER the `#`)
+ *  and a bare `#`/`##` untouched. Idempotent: after escaping, the `#` sits
+ *  behind a `\` (`- \#4382`), so the `(#{1,6})` no longer follows the prefix. */
+const ACCIDENTAL_HEADING_AFTER_MARKER =
+  /^([ \t]{0,3}(?:(?:[-*+]|\d{1,3}[.)])[ \t]+|>[ \t]*)+)(#{1,6})(?=[^\s#])/;
+
 /**
  * Escape the accidental heading trigger at the start of ONE line (the string
  * must NOT contain a newline; the caller guarantees a true line start). A no-op
- * unless the line begins with a `#{1,6}` run glued to a non-space, non-`#` char.
+ * unless the line begins with a `#{1,6}` run glued to a non-space, non-`#` char
+ * — either at the true line start (`#4382`) or immediately after one or more
+ * line-start list/blockquote markers (`- #4382`, `> #4382`, `1. #4382`, #3464).
+ * The two patterns are mutually exclusive on any given line (the bare one needs
+ * a `#` right after the indent; the marker one needs a marker first), so running
+ * both replaces can never double-escape.
  */
 function escapeAccidentalHeadingLine(line: string): string {
-  return line.replace(ACCIDENTAL_HEADING, "$1\\$2");
+  return line
+    .replace(ACCIDENTAL_HEADING, "$1\\$2")
+    .replace(ACCIDENTAL_HEADING_AFTER_MARKER, "$1\\$2");
 }
 
 /**

package/telegram-plugin/sticker-aliases.ts

@@ -18,6 +18,8 @@
  * surface uses: trust-by-explicit-listing.
  */
 
+import { parseSourceMessageId } from './gateway/source-message-id.js'
+
 export interface StickerAliasMap {
   /** alias name → Telegram file_id. Both validated on read. */
   [alias: string]: string
@@ -132,13 +134,12 @@ export function resolveStickerSendArgs(
       throw new Error('send_sticker: message_thread_id must be a positive integer string')
     }
   }
-  let replyTo: number | undefined
-  if (raw.reply_to != null) {
-    replyTo = Number(raw.reply_to)
-    if (!Number.isFinite(replyTo) || replyTo <= 0) {
-      throw new Error('send_sticker: reply_to must be a positive integer string')
-    }
-  }
+  // #4368 — route the agent-supplied reply anchor through the canonical
+  // guard. A fabricated (synthetic / out-of-int32) message id — e.g. an agent
+  // echoing a boot-resume/handback inbound's `Date.now()`-scale id — yields
+  // null, so the sticker sends UNANCHORED rather than 400ing the whole send on
+  // `reply_parameters.message_id` (which Telegram hard-rejects out of range).
+  const replyTo = parseSourceMessageId(raw.reply_to) ?? undefined
 
   return {
     chatId: raw.chat_id,
@@ -230,13 +231,10 @@ export function resolveGifSendArgs(raw: GifSendArgs): ValidatedGifSendArgs {
       throw new Error('send_gif: message_thread_id must be a positive integer string')
     }
   }
-  let replyTo: number | undefined
-  if (raw.reply_to != null) {
-    replyTo = Number(raw.reply_to)
-    if (!Number.isFinite(replyTo) || replyTo <= 0) {
-      throw new Error('send_gif: reply_to must be a positive integer string')
-    }
-  }
+  // #4368 — route the agent-supplied reply anchor through the canonical guard
+  // (see resolveStickerSendArgs). A fabricated / out-of-int32 id sends the GIF
+  // UNANCHORED instead of 400ing on `reply_parameters.message_id`.
+  const replyTo = parseSourceMessageId(raw.reply_to) ?? undefined
 
   return {
     chatId: raw.chat_id,

package/telegram-plugin/tests/ask-user.test.ts

@@ -106,6 +106,21 @@ describe('validateAskUserArgs — optional fields', () => {
     const r = validateAskUserArgs({ chat_id: '1', question: 'q', options: ['a', 'b'], reply_to: '99' })
     expect(r.replyTo).toBe(99)
   })
+
+  // #4368 — a fabricated reply anchor (a synthetic boot-resume/handback/cron
+  // inbound id at `Date.now()` scale) is out of the signed-int32 range Telegram
+  // accepts for `reply_parameters.message_id`. It must be DROPPED so the
+  // ask_user prompt still sends (unanchored) rather than 400ing the whole send.
+  // Before the fix `Number(args.reply_to)` let a 13-digit id through unchanged.
+  it('drops an out-of-int32 reply_to so the prompt sends unanchored (#4368)', () => {
+    const r = validateAskUserArgs({
+      chat_id: '1',
+      question: 'q',
+      options: ['a', 'b'],
+      reply_to: String(1_785_000_000_000),
+    })
+    expect(r.replyTo).toBeUndefined()
+  })
 })
 
 describe('validateAskUserArgs — timeout clamping', () => {

package/telegram-plugin/tests/checklist-fallback.test.ts

@@ -146,6 +146,27 @@ describe('native payloads — correct Bot API 9.1 shape', () => {
     expect(JSON.stringify(payload)).not.toContain('is_completed')
   })
 
+  // #4368 — a fabricated reply anchor (a synthetic boot-resume/handback/cron
+  // inbound id at `Date.now()` scale) is out of the signed-int32 range Telegram
+  // accepts for `reply_parameters.message_id`. The builder must DROP it so the
+  // native checklist sends UNANCHORED rather than 400ing the whole send. Before
+  // the fix the builder emitted `reply_parameters.message_id` verbatim.
+  it('drops an out-of-int32 replyToMessageId — no reply_parameters (#4368)', () => {
+    const payload = buildNativeChecklistPayload({
+      businessConnectionId: 'bc1',
+      chatId: 42,
+      title: 'T',
+      tasks: buildChecklistTasks([{ text: 'a' }]),
+      replyToMessageId: 1_785_000_000_000,
+    })
+    expect(payload.reply_parameters).toBeUndefined()
+    expect(payload).toEqual({
+      business_connection_id: 'bc1',
+      chat_id: 42,
+      checklist: { title: 'T', tasks: [{ id: 1, text: 'a' }] },
+    })
+  })
+
   it('editMessageChecklist sends the FULL checklist (native edits replace it)', () => {
     const payload = buildNativeEditChecklistPayload({
       businessConnectionId: 'bc1',