switchroom 0.21.9 → 0.21.11

package/telegram-plugin/gateway/gateway.ts

@@ -737,7 +737,9 @@ import {
   type CardDrainGateCtx,
 } from './emission-authority.js'
 import { CurrentTurnMap } from './current-turn-map.js'
-import { resolveAnswerThreadId } from './answer-thread-resolve.js'
+import { resolveAnswerThreadId, isCrossChatAnchor } from './answer-thread-resolve.js'
+import { answerRouteOverrides } from './answer-route-overrides.js'
+import { formatReplyRouteLog } from './reply-route-log.js'
 import { latestTurnForChat } from './latest-turn-lookup.js'
 import { decideObligationTurnEnd } from './obligation-turn-end.js'
 import { maybeRotate, resolveAgentStateDir, resolveTurnsJsonlPath } from './turns-jsonl-rotate.js'
@@ -3909,25 +3911,22 @@ function resolveReplyOwnerTurn(
  * 2026-06-05 triage showed reply routing was the blind spot: `reply: invoked`
  * logged only chat + char count, so a late reply landing in the wrong topic was
  * invisible without hand-correlating raw tg-post threads against turn-lifecycle
- * timestamps. This wrapper logs, per reply: which precedence tier won (`via`),
- * the resolved thread, the origin turn + its thread, and whether the reply was
- * late (turn already ended). `via=recovered` marks a late reply this fix saved
- * from General; `via=quoted` marks an origin recovered from the framework-owned
- * quoted message_id (no model echo); `UNROUTED` flags a supergroup reply that
- * resolved to no topic with NO owner turn to attribute it to (genuinely lost).
- * `MISROUTE_RISK` flags the irreducible determinism residual: a no-echo,
- * no-quote reply that fell to the LIVE turn while a DIFFERENT topic recently had
- * a turn — the framework cannot tell which topic the bare reply answers, so the
- * routing MIGHT be wrong (HOLE a). It is observability only (the reply still
- * routes to the live turn) — it makes the one case that is genuinely
- * model-dependent visible instead of silently mis-routed. A General-topic turn
- * legitimately has no thread, so its replies are NOT UNROUTED-flagged.
+ * timestamps. The line itself — tier (`via`), resolved thread, owner turn, and
+ * the RECOVERED / QUOTED / UNROUTED / MISROUTE_RISK / CROSS_CHAT_ANCHOR_DROPPED
+ * / EXPLICIT_OVERRIDDEN markers — is built by the pure `formatReplyRouteLog`
+ * (`reply-route-log.ts`), which documents each marker. This wrapper binds the
+ * gateway's stateful lookups and owns the routing call.
  *
  * `originVia` distinguishes how the origin turn was resolved: 'echo' (model
  * echoed origin_turn_id), 'quoted' (framework recovered it from args.reply_to),
  * or null (no origin turn). It only affects the `via` label, never the routing.
+ *
+ * Exported ONLY as a test seam: the `answerRouteOverrides.note()` call below is
+ * a SIDE EFFECT no pure module carries, so nothing else can prove it still
+ * happens (`answer-route-side-effect.test.ts`). No production caller — the
+ * gateway still hands it to `sendReply` through the deps object.
  */
-function resolveAnswerThreadWithLog(
+export function resolveAnswerThreadWithLog(
   chatId: string,
   explicitThreadId: number | undefined,
   originTurn: CurrentTurn | null,
@@ -3935,17 +3934,25 @@ function resolveAnswerThreadWithLog(
   liveTurn: CurrentTurn | null,
   surface: 'reply' | 'stream_reply',
 ): number | undefined {
+  // Cross-chat anchor guard (2026-08-13, bug c in `answer-thread-resolve.ts`):
+  // an anchor turn owned by a DIFFERENT chat must not lend its topic id to this
+  // send. `resolveAnswerThreadId` drops it from the ROUTING (below); these
+  // locals apply the same predicate so the recovery tier and the telemetry
+  // agree with what routed.
+  const originAnchor = isCrossChatAnchor(chatId, originTurn?.sessionChatId) ? null : originTurn
+  const liveAnchor = isCrossChatAnchor(chatId, liveTurn?.sessionChatId) ? null : liveTurn
   // Recover ONLY for a genuinely LATE reply — no live turn at all. Gating on
   // `liveTurn?.sessionThreadId == null` (the original) also fired for a
   // threadless DM that still had a live turn, marking every DM reply
   // `via=recovered`/RECOVERED in the telemetry (routing result unchanged —
   // DM → undefined — but it drowned the real supergroup recoveries the marker
-  // exists to surface). `liveTurn == null` is the precise late-reply condition.
+  // exists to surface). No live turn is the precise late-reply condition — and
+  // a cross-chat live turn is, for THIS chat, no live turn.
   const recovered =
     LATE_REPLY_TOPIC_RECOVERY_ENABLED &&
     explicitThreadId == null &&
-    originTurn == null &&
-    liveTurn == null
+    originAnchor == null &&
+    liveAnchor == null
       ? findLatestTurnForChat(chatId, { endedOnly: false })
       : null
   const threadId = resolveAnswerThreadId({
@@ -3957,58 +3964,44 @@ function resolveAnswerThreadWithLog(
     lastEndedResolvedForChat: recovered != null,
     lastEndedThreadIdForChat: recovered?.sessionThreadId,
     frameworkTopicAuthority: REPLY_TOPIC_AUTHORITY_ENABLED,
+    targetChatId: chatId,
+    originChatId: originTurn?.sessionChatId,
+    liveChatId: liveTurn?.sessionChatId,
+  })
+  // RECORD the explicit-thread override. `formatReplyRouteLog` re-derives the
+  // same predicate for its EXPLICIT_OVERRIDDEN marker, but that one is a pure
+  // string — this call is the SIDE EFFECT the marker used to carry, and it is
+  // load-bearing: obligation escalation reads this registry to tell "topic A's
+  // answer landed in B" from "something unrelated landed in B" (predicate +
+  // rationale: answer-route-overrides.ts). Deleting it would make the escalate
+  // branch nag on top of answers the user already got.
+  //
+  // `anchored` uses the CROSS-CHAT-FILTERED anchors, not the raw turns: an
+  // anchor owned by another chat is dropped from the routing (#4680), so it
+  // overrode nothing and must not be recorded as if it had. This keeps the
+  // record, the log marker, and what actually routed in agreement.
+  answerRouteOverrides.note({
+    chatId,
+    enabled: REPLY_TOPIC_AUTHORITY_ENABLED,
+    explicitThreadId,
+    anchored: originAnchor != null || liveAnchor != null,
+    routedThreadId: threadId,
+    nowMs: Date.now(),
   })
-  // `via` reflects the ACTIVE precedence so telemetry matches routing.
-  const via = REPLY_TOPIC_AUTHORITY_ENABLED
-    ? (originTurn != null ? (originVia === 'quoted' ? 'quoted' : 'origin')
-      : liveTurn != null ? 'live'
-      : explicitThreadId != null ? 'explicit'
-      : recovered != null ? 'recovered'
-      : 'none')
-    : (explicitThreadId != null ? 'explicit'
-      : originTurn != null ? (originVia === 'quoted' ? 'quoted' : 'origin')
-      : liveTurn?.sessionThreadId != null ? 'live'
-      : recovered != null ? 'recovered'
-      : 'none')
-  // Observability: the model passed an explicit topic but a framework anchor
-  // (origin/live) overrode it. This is the deterministic correction that fixes
-  // the General→CRM misroute; surface it so the model's topic-grabbing is
-  // visible rather than silent.
-  const explicitOverridden =
-    REPLY_TOPIC_AUTHORITY_ENABLED &&
-    explicitThreadId != null &&
-    (originTurn != null || liveTurn != null) &&
-    threadId !== explicitThreadId
-  const ownerTurn = originTurn ?? recovered ?? liveTurn
-  const isSupergroup = chatId.startsWith('-100')
-  // UNROUTED = a supergroup reply that resolved to NO topic with NO owner turn
-  // to attribute it to (genuinely lost). A General-topic turn legitimately has
-  // no thread, so a reply owned by it resolving to `-` is CORRECT, not lost —
-  // gate on `ownerTurn == null` so General replies don't false-alarm (found by
-  // the multi-topic UAT stress, 2026-06-05).
-  const unrouted = isSupergroup && threadId == null && ownerTurn == null
-  // MISROUTE_RISK = the irreducible determinism residual (HOLE a). A no-echo,
-  // no-quote reply fell to the LIVE turn (via=live), but a DIFFERENT topic
-  // recently had a turn for this chat — so this bare reply MIGHT belong to that
-  // other topic and we cannot tell without the model's echo. Observability only;
-  // routing is unchanged. This is the one case framework state cannot
-  // disambiguate, surfaced instead of silently mis-routed.
-  const misrouteRisk =
-    isSupergroup &&
-    via === 'live' &&
-    hasDifferentThreadedRecentTurn(chatId, liveTurn?.sessionThreadId)
   process.stderr.write(
-    `telegram gateway: reply-route surface=${surface} chat=${chatId} ` +
-      `resolved_thread=${threadId ?? '-'} via=${via} late=${liveTurn == null} ` +
-      `originTurn=${ownerTurn?.turnId ?? '-'} origin_thread=${ownerTurn?.sessionThreadId ?? '-'}` +
-      (via === 'recovered' ? ' RECOVERED' : '') +
-      (via === 'quoted' ? ' QUOTED(framework-origin)' : '') +
-      (unrouted ? ' UNROUTED(supergroup→no-topic)' : '') +
-      (misrouteRisk ? ' MISROUTE_RISK(no-echo→live-successor)' : '') +
-      (explicitOverridden
-        ? ` EXPLICIT_OVERRIDDEN(model→${explicitThreadId},routed→${threadId ?? '-'})`
-        : '') +
-      '\n',
+    formatReplyRouteLog({
+      surface,
+      chatId,
+      threadId,
+      explicitThreadId,
+      originTurn,
+      originVia,
+      liveTurn,
+      recovered,
+      frameworkTopicAuthority: REPLY_TOPIC_AUTHORITY_ENABLED,
+      hasDifferentThreadedRecentTurn: (liveThreadId) =>
+        hasDifferentThreadedRecentTurn(chatId, liveThreadId),
+    }),
   )
   return threadId
 }

package/telegram-plugin/gateway/obligation-wiring.ts

@@ -23,6 +23,13 @@ import { buildObligationRepresentInbound, type Obligation } from './obligation-l
 import { driveEscalation } from './escalation-drive.js'
 import { shouldSuppressRepresent } from './represent-guard.js'
 import { shouldDeferEscalationForBridge } from './escalation-bridge-gate.js'
+import {
+  answeredSinceOpen,
+  createEscalationSettleGate,
+  resolveEscalateSettleMs,
+  resolveRerouteMatchWindowMs,
+} from './escalation-staleness.js'
+import { answerRouteOverrides } from './answer-route-overrides.js'
 import { parkedTurnStartCount } from './stream-render.js'
 
 export function createObligationWiring(deps: ObligationWiringDeps) {
@@ -50,6 +57,16 @@ export function createObligationWiring(deps: ObligationWiringDeps) {
     sendEscalationNudge,
   } = deps
 
+  // Escalation settle gate (see escalation-staleness.ts). One instance per
+  // wiring — the sweep is the only caller, and the gate must remember the FIRST
+  // escalate decision for an obligation across sweep ticks.
+  const escalateSettleMs = resolveEscalateSettleMs()
+  const escalateSettleGate = createEscalationSettleGate(escalateSettleMs)
+  // How stale an EXPLICIT_OVERRIDDEN record may be and still license a look in
+  // the thread it names. Derived from the settle window, because the decision
+  // that consults it is the one AFTER the gate. See escalation-staleness.ts.
+  const rerouteMatchWindowMs = resolveRerouteMatchWindowMs(escalateSettleMs)
+
 /**
  * PR2 obligation-ledger CLOSE. Called when a SUBSTANTIVE final answer lands
  * (not a bare interim ack — using finalAnswerSubstantive, the #2141 signal): the
@@ -86,7 +103,12 @@ function closeObligationOnSubstantiveReply(
       ? routedOriginTurn.turnId
       : null
   const target = obligationLedger.resolveCloseTarget(echoed?.turnId, liveTurn?.turnId, routedOriginId)
-  if (target != null) obligationLedger.close(target)
+  if (target != null) {
+    obligationLedger.close(target)
+    // The settle gate must forget every terminal, not just the escalate-branch
+    // ones, or a closed obligation's entry lives on until FIFO eviction.
+    escalateSettleGate.clear(target)
+  }
 }
 
 /**
@@ -145,6 +167,7 @@ function cancelInterruptedObligation(): void {
   const turn = getCurrentTurn()
   if (turn == null) return
   if (obligationLedger.close(turn.turnId)) {
+    escalateSettleGate.clear(turn.turnId)
     process.stderr.write(
       `telegram gateway: obligation cancelled by interrupt origin=${turn.turnId}\n`,
     )
@@ -244,6 +267,7 @@ function obligationSweep(): void {
       process.stderr.write(
         `telegram gateway: obligation closed silently — reply delivered since last represent (no re-fire) origin=${o.originTurnId}\n`,
       )
+      escalateSettleGate.clear(o.originTurnId)
       obligationLedger.close(o.originTurnId)
       return
     }
@@ -304,13 +328,72 @@ function obligationSweep(): void {
     )
     return
   }
-  if (HISTORY_ENABLED && hasOutboundDeliveredSince(o.chatId, o.openedAt, o.threadId)) {
+  // SCOPE: the obligation's own topic, PLUS — only while the router's
+  // `EXPLICIT_OVERRIDDEN(model→N,routed→M)` record is still FRESH, and only
+  // across that record's own instant + the match window — the topic it names.
+  // Deliberately neither chat-wide, nor cut at `openedAt`, nor open-ended
+  // forward: all three close a genuinely unanswered obligation in silence. Field
+  // evidence for each in escalation-staleness.ts.
+  //
+  // FRESHNESS ANCHOR: the settle gate's `firstAt` for this obligation when a
+  // window is already open, else this decision's `now`. NOT the re-check
+  // instant — every gate above (`turnInFlightForGate`, the background-work /
+  // session-busy defer, the escalate and represent graces) can SKIP sweep ticks
+  // outright, so the decision that consults the record may run minutes after the
+  // one that deferred, and a record that was fresh when the question was first
+  // asked would read as stale purely because the sweep was starved. That same
+  // starvation is why the DELIVERY needs its own upper bound: the anchor makes
+  // the override read fresh at a re-check minutes later, and without a forward
+  // bound it would then reach the whole of that gap. See `#4681` / form (iii).
+  const answered = answeredSinceOpen(o, {
+    historyEnabled: HISTORY_ENABLED,
+    hasOutboundDeliveredSince,
+    // The reroute fallback's query, bounded at BOTH ends. `minChars` stays at
+    // the history default (200 — the escalate branch's substantive floor); only
+    // the upper time bound is added.
+    hasOutboundDeliveredBetween: (chatId, sinceMs, untilMs, threadId) =>
+      hasOutboundDeliveredSince(chatId, sinceMs, threadId, undefined, untilMs),
+    routeOverrides: answerRouteOverrides,
+    anchorMs: escalateSettleGate.firstAt(o.originTurnId, o.openedAt) ?? now,
+    rerouteMatchWindowMs: rerouteMatchWindowMs,
+  })
+  if (answered.answered) {
+    // The two scopes log DISTINGUISHABLY: a `via=reroute` close is the widened
+    // path, so its blast radius is measurable in production without a rebuild.
+    const scope =
+      answered.via === 'reroute'
+        ? `via=reroute routed_thread=${answered.routedThreadId ?? '-'}`
+        : 'via=thread'
     process.stderr.write(
-      `telegram gateway: obligation closed silently — outbound delivered since open origin=${o.originTurnId}\n`,
+      `telegram gateway: obligation closed silently — outbound delivered since open ${scope} origin=${o.originTurnId}\n`,
     )
+    escalateSettleGate.clear(o.originTurnId)
     obligationLedger.close(o.originTurnId)
     return
   }
+  if (answered.staleOverrideAgeMs != null) {
+    // NEGATIVE-PATH telemetry for the freshness bound. A reroute WAS on record
+    // for this obligation and the bound threw it away — indistinguishable from
+    // "no reroute at all" without this line, which makes the bound (the whole
+    // correctness argument for the fallback) unmeasurable in production. A near
+    // miss here is the signal that the window is mis-tuned.
+    process.stderr.write(
+      `telegram gateway: obligation reroute record rejected age=${answered.staleOverrideAgeMs}ms ` +
+        `window=${rerouteMatchWindowMs}ms origin=${o.originTurnId}\n`,
+    )
+  }
+  // SETTLE. The check above is a point-in-time read, and the answer is often
+  // still IN FLIGHT at this instant (reply tool invoked, history row not yet
+  // written) — confirmed lags of 1.23s and 2.81s between this decision and the
+  // answer landing. Defer the first decision and re-check on a later sweep, so
+  // the nudge only goes out when "unanswered" held across the settle window.
+  // Bounded: a genuinely unanswered obligation escalates one window later.
+  if (escalateSettleGate.shouldDefer(o.originTurnId, now, o.openedAt)) {
+    process.stderr.write(
+      `telegram gateway: obligation escalation deferred — settling (re-checking for an in-flight answer) origin=${o.originTurnId}\n`,
+    )
+    return
+  }
   // Proceed with escalation: send ONE operator-visible nudge and close the
   // obligation ONLY AFTER it actually lands. This inverts the old
   // close-before-send (which silently dropped the terminal whenever the send
@@ -337,6 +420,11 @@ function obligationSweep(): void {
     maxAttempts: OBLIGATION_ESCALATE_MAX,
     deadlineMs: OBLIGATION_ESCALATE_SEND_DEADLINE_MS,
   })
+  // Terminal for this settle episode. A send that FAILS leaves the obligation
+  // open and re-drives on a later sweep; that retry then opens its own fresh
+  // settle window, which is the same "re-check before nagging" guarantee, not a
+  // regression. Keeps the gate map from retaining closed obligations.
+  escalateSettleGate.clear(o.originTurnId)
 }
 
   return {

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -43,6 +43,7 @@ import {
   isQuoteRejectionError,
   sendOptsHaveQuote,
 } from '../reply-quote.js'
+import { captureSpeechText } from './speech-capture.js'
 
 // ── send-orchestration façade imports (#2996 P2) ──
 // Pure/deterministic helpers are imported; stateful or side-effecting gateway
@@ -84,6 +85,15 @@ import {
   formatInternalSuppression,
   AUDIENCE_INTERNAL,
 } from '../hooks/audience-classify.mjs'
+// Bug (c) cross-chat anchor guard. Pure module, no cycle — the SAME predicate
+// the routing (`resolveAnswerThreadId`), the gateway's recovery tier and the
+// `reply-route` telemetry use, so the kill-switch branch below cannot drift
+// from them.
+import { isCrossChatAnchor } from './answer-thread-resolve.js'
+// The ONE `reply-route` line builder — shared with `resolveAnswerThreadWithLog`
+// in gateway.ts so the flag-on and kill-switch branches can never emit two
+// different spellings of the same drop.
+import { formatReplyRouteLog } from './reply-route-log.js'
 import { queueFloodBlockedReply } from './flood-reply-queue.js'
 import { resolveChatIdFallback } from './chat-id-fallback.js'
 import { getBuzzMirror } from './buzz-mirror.js'
@@ -1376,6 +1386,12 @@ export async function sendReply(
   // plain-text TTS input); synthesis happens just before the send so a
   // voice-only reply can suppress the text chunk loop on success. Voice is
   // fully best-effort — every failure below falls back to the text reply.
+  // Raw-corpus capture (TTS redesign PR-0, flag-gated, off by default): `text`
+  // here IS Stage A's future input — capture it byte-for-byte BEFORE the
+  // resolve call, ahead of any TTS normalisation, so the redesign's property
+  // tests can validate against real markdown instead of synthetic fixtures
+  // only. See telegram-plugin/gateway/speech-capture.ts.
+  captureSpeechText(text)
   const voiceOutPlan = resolveVoiceOutPlan(access.voice_out, text)
   const configParseMode = access.parseMode ?? 'html'
   const format = (args.format as string | undefined) ?? configParseMode
@@ -1587,11 +1603,56 @@ export async function sendReply(
       'reply',
     )
   } else {
+    // Cross-chat anchor guard (bug c, `answer-thread-resolve.ts`). This legacy
+    // branch does NOT go through `resolveAnswerThreadWithLog`, so the drop that
+    // `resolveAnswerThreadId` performs above never runs here — without this the
+    // pinned turn's thread is passed through even when the turn belongs to a
+    // DIFFERENT chat, handing chat B's topic id to a send into chat A and
+    // earning a `400 Bad Request: message thread not found`. The kill switch
+    // restores the legacy PRECEDENCE, not the wrong-chat topic id: that is an
+    // API error, not a routing policy a kill switch should be able to
+    // reinstate. Uses the SAME exported predicate as the routing, the recovery
+    // tier and the telemetry, so no second copy of the rule can drift.
+    const anchorCrossChat = isCrossChatAnchor(chat_id, turn?.sessionChatId)
+    const anchorThreadId = anchorCrossChat ? undefined : turn?.sessionThreadId
     threadId = resolveThreadId(
       chat_id,
       (args.message_thread_id as string | undefined) ??
-        (turn?.sessionThreadId != null ? turn.sessionThreadId : undefined),
+        (anchorThreadId != null ? anchorThreadId : undefined),
     )
+    if (anchorCrossChat) {
+      // Telemetry parity with the flag-ON branch, which emits this marker via
+      // `resolveAnswerThreadWithLog`. Without it a `TURN_ORIGIN_ROUTING=0`
+      // deployment still performs the drop but records nothing — losing the
+      // audit trail the rest of the cross-chat fix is built on, on exactly the
+      // branch most likely to be running when something is already suspected
+      // wrong. Reuses the ONE authoritative formatter (`reply-route-log.ts`)
+      // rather than a second, driftable spelling of the same line.
+      const explicitRaw =
+        args.message_thread_id != null ? Number(args.message_thread_id) : undefined
+      process.stderr.write(
+        formatReplyRouteLog({
+          surface: 'reply',
+          chatId: chat_id,
+          threadId,
+          explicitThreadId: Number.isFinite(explicitRaw as number)
+            ? (explicitRaw as number)
+            : undefined,
+          // The legacy branch resolves no origin turn at all — the pinned live
+          // turn IS the anchor that was dropped.
+          originTurn: null,
+          originVia: null,
+          liveTurn: turn,
+          recovered: null,
+          frameworkTopicAuthority: false,
+          // MISROUTE_RISK requires `via === 'live'`, and the formatter nulls a
+          // cross-chat live anchor before computing `via` — so on this arm
+          // (reached only when the anchor IS cross-chat) the predicate is
+          // unreachable and the constant cannot change the emitted line.
+          hasDifferentThreadedRecentTurn: () => false,
+        }),
+      )
+    }
   }
 
   // #4301: track whether `reply_to` came from the quote-opt-in DEFAULT (the

package/telegram-plugin/gateway/reply-route-log.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, expect } from 'vitest'
+import { formatReplyRouteLog, type ReplyRouteLogInput } from './reply-route-log.js'
+
+const CHAT_A = '12345678' // DM — the reply target
+const CHAT_B = '-1001234567890' // forum supergroup — where the anchor lives
+
+function line(over: Partial<ReplyRouteLogInput> = {}): string {
+  return formatReplyRouteLog({
+    surface: 'reply',
+    chatId: CHAT_A,
+    threadId: undefined,
+    explicitThreadId: undefined,
+    originTurn: null,
+    originVia: null,
+    liveTurn: null,
+    recovered: null,
+    frameworkTopicAuthority: true,
+    hasDifferentThreadedRecentTurn: () => false,
+    ...over,
+  })
+}
+
+describe('formatReplyRouteLog', () => {
+  it('CROSS_CHAT_ANCHOR_DROPPED names BOTH chat ids and the topic that was dropped', () => {
+    const out = line({
+      liveTurn: { turnId: `${CHAT_B}:635#5388`, sessionChatId: CHAT_B, sessionThreadId: 635 },
+    })
+    expect(out).toContain('CROSS_CHAT_ANCHOR_DROPPED(')
+    expect(out).toContain(`target=${CHAT_A}`)
+    expect(out).toContain(`live_chat=${CHAT_B},live_thread=635`)
+    expect(out).toContain('routed→-')
+  })
+
+  it('a dropped cross-chat anchor is NOT counted as the routing tier (via=none, not via=live)', () => {
+    const out = line({
+      chatId: CHAT_B,
+      liveTurn: { turnId: 'x', sessionChatId: '999', sessionThreadId: 7 },
+    })
+    expect(out).toContain('via=none')
+    expect(out).toContain('late=true')
+  })
+
+  it('a dropped cross-chat anchor does NOT raise the UNROUTED alarm (it is a cross-chat send, not a lost reply)', () => {
+    const out = line({
+      chatId: CHAT_B, // supergroup target, resolved to no topic
+      liveTurn: { turnId: 'x', sessionChatId: CHAT_A, sessionThreadId: undefined },
+    })
+    expect(out).not.toContain('UNROUTED')
+    expect(out).toContain('CROSS_CHAT_ANCHOR_DROPPED(')
+  })
+
+  it('a SAME-chat live anchor is untouched: via=live, no cross-chat marker', () => {
+    const out = line({
+      chatId: CHAT_B,
+      threadId: 4,
+      liveTurn: { turnId: `${CHAT_B}:4#1`, sessionChatId: CHAT_B, sessionThreadId: 4 },
+    })
+    expect(out).toContain('via=live')
+    expect(out).toContain('resolved_thread=4')
+    expect(out).not.toContain('CROSS_CHAT_ANCHOR_DROPPED')
+  })
+
+  it('an origin anchor from another chat is dropped and reported with its own chat id', () => {
+    const out = line({
+      originTurn: { turnId: `${CHAT_B}:2#9`, sessionChatId: CHAT_B, sessionThreadId: 2 },
+      originVia: 'echo',
+      explicitThreadId: 11,
+      threadId: 11, // explicit is the only remaining signal
+    })
+    expect(out).toContain(`origin_chat=${CHAT_B},origin_thread=2`)
+    expect(out).toContain('via=explicit')
+    expect(out).not.toContain('EXPLICIT_OVERRIDDEN')
+  })
+
+  it('UNROUTED still fires for a genuine no-owner supergroup reply (guard did not weaken it)', () => {
+    expect(line({ chatId: CHAT_B })).toContain('UNROUTED(supergroup→no-topic)')
+  })
+
+  it('EXPLICIT_OVERRIDDEN still fires when a SAME-chat anchor beats the model explicit', () => {
+    const out = line({
+      chatId: CHAT_B,
+      explicitThreadId: 99,
+      threadId: 4,
+      originTurn: { turnId: `${CHAT_B}:4#1`, sessionChatId: CHAT_B, sessionThreadId: 4 },
+      originVia: 'echo',
+    })
+    expect(out).toContain('EXPLICIT_OVERRIDDEN(model→99,routed→4)')
+    expect(out).toContain('via=origin')
+  })
+
+  // The two `explicitOverridden` clauses the escalation drift matrix
+  // (`tests/escalation-staleness.test.ts`) cannot pin, because it drives the
+  // REAL router: with authority off the router returns the explicit topic, and a
+  // dropped cross-chat anchor falls back to it too — so `threadId !== explicit`
+  // is never true on either arm there. Both combinations are reachable only by
+  // calling this pure formatter directly, and without these two cases both
+  // mutants (drop the authority clause; read the RAW turns instead of the
+  // cross-chat-filtered anchors) survive all 64 matrix cases.
+  it('authority DISABLED never claims the framework overrode the model, even when ' +
+    'the routed thread differs from the explicit one', () => {
+    const out = line({
+      chatId: CHAT_B,
+      frameworkTopicAuthority: false,
+      explicitThreadId: 99,
+      threadId: 4,
+      originTurn: { turnId: `${CHAT_B}:4#1`, sessionChatId: CHAT_B, sessionThreadId: 4 },
+      originVia: 'echo',
+    })
+    expect(out).not.toContain('EXPLICIT_OVERRIDDEN')
+  })
+
+  it('EXPLICIT_OVERRIDDEN reads the FILTERED anchors — a cross-chat origin overrode ' +
+    'nothing, so it must not be reported as if it had', () => {
+    const out = line({
+      chatId: CHAT_B,
+      explicitThreadId: 99,
+      // The target chat's own last-seen topic, not the dropped anchor's.
+      threadId: 4,
+      originTurn: { turnId: 'x', sessionChatId: CHAT_A, sessionThreadId: 635 },
+      originVia: 'echo',
+    })
+    expect(out).toContain('CROSS_CHAT_ANCHOR_DROPPED(')
+    expect(out).not.toContain('EXPLICIT_OVERRIDDEN')
+  })
+
+  it('MISROUTE_RISK reads the FILTERED live anchor — a cross-chat live turn cannot raise it', () => {
+    const out = line({
+      chatId: CHAT_B,
+      liveTurn: { turnId: 'x', sessionChatId: CHAT_A, sessionThreadId: 3 },
+      hasDifferentThreadedRecentTurn: () => true,
+    })
+    expect(out).not.toContain('MISROUTE_RISK')
+  })
+})

package/telegram-plugin/gateway/reply-route-log.ts

@@ -0,0 +1,118 @@
+/**
+ * `reply-route` telemetry line — the pure formatter behind the gateway's
+ * `resolveAnswerThreadWithLog`.
+ *
+ * The 2026-06-05 triage showed reply routing was the blind spot: `reply:
+ * invoked` logged only chat + char count, so a late reply landing in the wrong
+ * topic was invisible without hand-correlating raw tg-post threads against
+ * turn-lifecycle timestamps. This module builds, per reply: which precedence
+ * tier won (`via`), the resolved thread, the owner turn + its thread, whether
+ * the reply was late (turn already ended), and the alarm markers.
+ *
+ * Extracted out of `gateway.ts` (#2996 anti-inflation ratchet) so the string
+ * building — which is pure — is unit-testable and the gateway keeps only the
+ * stateful wiring.
+ *
+ * Markers:
+ *   - `RECOVERED`                 — a late reply this fix saved from General.
+ *   - `QUOTED(framework-origin)`  — origin recovered from the framework-owned
+ *     quoted message_id (no model echo).
+ *   - `UNROUTED`                  — a supergroup reply that resolved to NO topic
+ *     with NO owner turn to attribute it to (genuinely lost). A General-topic
+ *     turn legitimately has no thread, so a reply owned by it resolving to `-`
+ *     is CORRECT, not lost — hence the `ownerTurn == null` gate (found by the
+ *     multi-topic UAT stress, 2026-06-05).
+ *   - `MISROUTE_RISK`             — the irreducible determinism residual (HOLE
+ *     a): a no-echo, no-quote reply that fell to the LIVE turn while a DIFFERENT
+ *     topic recently had a turn. Observability only; routing is unchanged.
+ *   - `CROSS_CHAT_ANCHOR_DROPPED` — an anchor turn belonging to another chat was
+ *     ignored (see `answer-thread-resolve.ts` bug c). Carries BOTH chat ids so
+ *     cross-chat replies stay auditable.
+ *   - `EXPLICIT_OVERRIDDEN`       — the model passed an explicit topic and a
+ *     framework anchor overrode it (the General→CRM correction).
+ */
+
+import { isCrossChatAnchor } from './answer-thread-resolve.js'
+
+/** The structural slice of a turn this formatter reads (`CurrentTurn`). */
+export interface RouteLogTurn {
+  turnId?: string
+  sessionChatId: string
+  sessionThreadId: number | undefined
+}
+
+export interface ReplyRouteLogInput {
+  surface: 'reply' | 'stream_reply'
+  /** Chat the reply is being SENT to. */
+  chatId: string
+  /** What `resolveAnswerThreadId` actually resolved. */
+  threadId: number | undefined
+  explicitThreadId: number | undefined
+  /** RAW anchors as looked up — the cross-chat filter is applied here, with the
+   *  same predicate the resolver used, so `via` can never disagree with it. */
+  originTurn: RouteLogTurn | null
+  originVia: 'echo' | 'quoted' | null
+  liveTurn: RouteLogTurn | null
+  recovered: RouteLogTurn | null
+  frameworkTopicAuthority: boolean
+  /** Lazy: only consulted for the MISROUTE_RISK arm, which is the sole caller
+   *  that needs the bounded recent-turn scan. */
+  hasDifferentThreadedRecentTurn: (liveThreadId: number | undefined) => boolean
+}
+
+export function formatReplyRouteLog(i: ReplyRouteLogInput): string {
+  const originCrossChat = isCrossChatAnchor(i.chatId, i.originTurn?.sessionChatId)
+  const liveCrossChat = isCrossChatAnchor(i.chatId, i.liveTurn?.sessionChatId)
+  const crossChatDropped = originCrossChat || liveCrossChat
+  const originAnchor = originCrossChat ? null : i.originTurn
+  const liveAnchor = liveCrossChat ? null : i.liveTurn
+  const explicit = i.explicitThreadId
+  // `via` reflects the ACTIVE precedence so telemetry matches routing.
+  const via = i.frameworkTopicAuthority
+    ? (originAnchor != null ? (i.originVia === 'quoted' ? 'quoted' : 'origin')
+      : liveAnchor != null ? 'live'
+      : explicit != null ? 'explicit'
+      : i.recovered != null ? 'recovered'
+      : 'none')
+    : (explicit != null ? 'explicit'
+      : originAnchor != null ? (i.originVia === 'quoted' ? 'quoted' : 'origin')
+      : liveAnchor?.sessionThreadId != null ? 'live'
+      : i.recovered != null ? 'recovered'
+      : 'none')
+  const explicitOverridden =
+    i.frameworkTopicAuthority &&
+    explicit != null &&
+    (originAnchor != null || liveAnchor != null) &&
+    i.threadId !== explicit
+  const ownerTurn = originAnchor ?? i.recovered ?? liveAnchor
+  const isSupergroup = i.chatId.startsWith('-100')
+  // A dropped cross-chat anchor is NOT a lost reply — the send is a cross-chat
+  // one and the main chat is where it belongs — so it does not raise UNROUTED;
+  // CROSS_CHAT_ANCHOR_DROPPED already explains the line.
+  const unrouted = isSupergroup && i.threadId == null && ownerTurn == null && !crossChatDropped
+  const misrouteRisk =
+    isSupergroup && via === 'live' && i.hasDifferentThreadedRecentTurn(liveAnchor?.sessionThreadId)
+  return (
+    `telegram gateway: reply-route surface=${i.surface} chat=${i.chatId} ` +
+    `resolved_thread=${i.threadId ?? '-'} via=${via} late=${liveAnchor == null} ` +
+    `originTurn=${ownerTurn?.turnId ?? '-'} origin_thread=${ownerTurn?.sessionThreadId ?? '-'}` +
+    (via === 'recovered' ? ' RECOVERED' : '') +
+    (via === 'quoted' ? ' QUOTED(framework-origin)' : '') +
+    (unrouted ? ' UNROUTED(supergroup→no-topic)' : '') +
+    (misrouteRisk ? ' MISROUTE_RISK(no-echo→live-successor)' : '') +
+    (crossChatDropped
+      ? ` CROSS_CHAT_ANCHOR_DROPPED(target=${i.chatId}` +
+        (originCrossChat
+          ? `,origin_chat=${i.originTurn?.sessionChatId},origin_thread=${i.originTurn?.sessionThreadId ?? '-'}`
+          : '') +
+        (liveCrossChat
+          ? `,live_chat=${i.liveTurn?.sessionChatId},live_thread=${i.liveTurn?.sessionThreadId ?? '-'}`
+          : '') +
+        `,routed→${i.threadId ?? '-'})`
+      : '') +
+    (explicitOverridden
+      ? ` EXPLICIT_OVERRIDDEN(model→${explicit},routed→${i.threadId ?? '-'})`
+      : '') +
+    '\n'
+  )
+}