diff --git a/backend/__tests__/unit/routes/slackOAuth.installables.test.js b/backend/__tests__/unit/routes/slackOAuth.installables.test.js
index 5151c2d2d7..6a3873e6b4 100644
--- a/backend/__tests__/unit/routes/slackOAuth.installables.test.js
+++ b/backend/__tests__/unit/routes/slackOAuth.installables.test.js
@@ -14,7 +14,7 @@ jest.mock('../../../middleware/integrationRateLimit', () => ({
 }));
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/Integration', () => ({
-  findOne: jest.fn(), findOneAndUpdate: jest.fn(), updateOne: jest.fn(),
+  findOne: jest.fn(), findOneAndUpdate: jest.fn(), findById: jest.fn(), updateOne: jest.fn(),
 }));
 jest.mock('../../../models/InstallableInstallation', () => ({ findOne: jest.fn() }));
 jest.mock('../../../utils/secret', () => ({ randomSecret: jest.fn(() => 'nonce-value') }));
@@ -22,9 +22,16 @@ jest.mock('../../../services/telegramConnectCode', () => ({
   mintConnectCode: jest.fn(() => ({ connectCode: 'r'.repeat(32), connectCodeExpiresAt: new Date(Date.now() + 60_000) })),
 }));
 jest.mock('../../../services/connectorSecrets', () => ({ get: jest.fn(), put: jest.fn(), revoke: jest.fn() }));
-jest.mock('../../../services/slackApi', () => jest.fn().mockImplementation(() => ({
-  openConversation: jest.fn(),
-})));
+// Same reason as slackBridgeService.test.js: the constructor is stubbed, the
+// escape is real — the connect marker's escaping is what this file asserts.
+jest.mock('../../../services/slackApi', () => {
+  const actual = jest.requireActual('../../../services/slackApi');
+  const mock = jest.fn().mockImplementation(() => ({
+    openConversation: jest.fn(),
+  }));
+  mock.escapeSlackMrkdwn = actual.escapeSlackMrkdwn;
+  return mock;
+});
 jest.mock('../../../services/slackOAuthService', () => {
   class SlackOAuthConfigurationError extends Error { constructor() { super('not configured'); this.code = 'slack_oauth_not_configured'; } }
   class SlackOAuthExchangeError extends Error { constructor() { super('exchange failed'); this.code = 'slack_oauth_exchange_failed'; } }
@@ -50,6 +57,7 @@ const InstallableInstallation = require('../../../models/InstallableInstallation
 const connectorSecrets = require('../../../services/connectorSecrets');
 const { mintConnectCode } = require('../../../services/telegramConnectCode');
 const SlackApi = require('../../../services/slackApi');
+const deliveryFailures = require('../../../services/connectorDeliveryFailureService');
 const slackOAuth = require('../../../services/slackOAuthService');
 const installableRoutes = require('../../../routes/installables');
 
@@ -230,7 +238,9 @@ describe('Slack installable OAuth routes', () => {
     Pod.findById
       .mockResolvedValueOnce({ createdBy: { toString: () => 'another' }, members: [ownerId] })
       .mockReturnValueOnce({
-        select: jest.fn().mockReturnValue({ lean: jest.fn().mockResolvedValue({ name: 'Launch' }) }),
+        // Purposefully hostile: this name is interpolated into the marker a
+        // human reads in Slack, and mrkdwn would draw `<...>` as markup.
+        select: jest.fn().mockReturnValue({ lean: jest.fn().mockResolvedValue({ name: '<Evil|pod>' }) }),
       });
     Integration.findOneAndUpdate.mockResolvedValue({
       ...integration,
@@ -252,7 +262,74 @@ describe('Slack installable OAuth routes', () => {
     );
     expect(JSON.stringify(response.body)).not.toContain('secret-ref');
     expect(JSON.stringify(response.body)).not.toContain('nonce-never-return');
-    expect(SlackApi.mock.results[0].value.postMessage).toHaveBeenCalledWith('D1', '[Launch] connected');
+    expect(SlackApi.mock.results[0].value.postMessage).toHaveBeenCalledWith('D1', '[&lt;Evil|pod&gt;] connected');
+  });
+
+  test('a reconnect clears the reason an earlier flip left on the row (wren 73838)', async () => {
+    const pending = {
+      teamId: 'T1', slackUserId: 'U1', chatId: 'D1', botTokenRef: 'secret-ref',
+      expiresAt: new Date(Date.now() + 60_000),
+    };
+    Integration.findOne.mockResolvedValue({ ...integration, config: { pendingBind: pending } });
+    Pod.findById
+      .mockResolvedValueOnce({ createdBy: { toString: () => 'another' }, members: [ownerId] })
+      .mockReturnValueOnce({ select: jest.fn().mockReturnValue({ lean: jest.fn().mockResolvedValue({ name: 'Pod' }) }) });
+    Integration.findOneAndUpdate.mockResolvedValue({ ...integration, status: 'connected', config: { ...pending, chatType: 'im' } });
+    connectorSecrets.get.mockResolvedValue('xoxb-secret');
+    SlackApi.mockImplementationOnce(() => ({ postMessage: jest.fn().mockResolvedValue({ ok: true, ts: '1.1' }) }));
+
+    const response = await request(app).post('/api/installables/slack/confirm');
+
+    expect(response.status).toBe(200);
+    expect(response.body.status).toBe('connected');
+    // A bind is the only thing that proves the connector works again, so it is
+    // the only thing that may clear what a flip wrote — otherwise a reconnect
+    // after any failure keeps naming a reason that is no longer true.
+    expect(Integration.findOneAndUpdate).toHaveBeenCalledWith(
+      expect.objectContaining({ _id: 'integration-1' }),
+      expect.objectContaining({ $set: expect.objectContaining({ errorMessage: null, errorMessageUserFacing: false }) }),
+      expect.anything(),
+    );
+  });
+
+  test('a permanent refusal on the confirmation marker flips the connector and names the reason (wren 73837)', async () => {
+    const pending = {
+      teamId: 'T1', slackUserId: 'U1', chatId: 'D1', botTokenRef: 'secret-ref',
+      expiresAt: new Date(Date.now() + 60_000),
+    };
+    // The marker goes to the chat this confirm just stored, so this is a
+    // bound-chat send — the twin of the Telegram bind confirmation.
+    Integration.findOne.mockResolvedValue({ ...integration, config: { pendingBind: pending } });
+    Pod.findById
+      .mockResolvedValueOnce({ createdBy: { toString: () => 'another' }, members: [ownerId] })
+      .mockReturnValueOnce({ select: jest.fn().mockReturnValue({ lean: jest.fn().mockResolvedValue({ name: 'Pod' }) }) });
+    Integration.findOneAndUpdate.mockResolvedValue({ ...integration, status: 'connected', config: { ...pending, chatType: 'im' } });
+    connectorSecrets.get.mockResolvedValue('xoxb-secret');
+    SlackApi.mockImplementationOnce(() => ({ postMessage: jest.fn().mockResolvedValue({ ok: false, error: 'channel_not_found' }) }));
+    // The route re-reads after a flip, so the response cannot keep saying
+    // "connected" while the row says the connector needs attention.
+    Integration.findById.mockResolvedValue({
+      ...integration, status: 'error', errorMessage: deliveryFailures.SLACK_CHANNEL_GONE_REASON, config: {},
+    });
+
+    const response = await request(app).post('/api/installables/slack/confirm');
+
+    expect(response.status).toBe(200);
+    expect(response.body.status).toBe('error');
+    expect(Integration.findOneAndUpdate).toHaveBeenCalledWith(
+      { _id: 'integration-1', 'config.chatId': 'D1' },
+      {
+        $set: {
+          status: 'error',
+          errorMessage: deliveryFailures.SLACK_CHANNEL_GONE_REASON,
+          // The page renders the message only when this flag is set, so the
+          // marker's own refusal has to write the pair, not just the string.
+          errorMessageUserFacing: true,
+        },
+        $unset: { 'config.chatId': '' },
+      },
+      { new: true },
+    );
   });
 
   test('rejects a pending Slack bind and revokes its secret reference', async () => {
diff --git a/backend/__tests__/unit/routes/telegram.webhook.connectCode.test.js b/backend/__tests__/unit/routes/telegram.webhook.connectCode.test.js
index cd890e66c1..f868e0cbb0 100644
--- a/backend/__tests__/unit/routes/telegram.webhook.connectCode.test.js
+++ b/backend/__tests__/unit/routes/telegram.webhook.connectCode.test.js
@@ -9,7 +9,12 @@ jest.mock('../../../models/Pod');
 jest.mock('../../../models/Summary', () => ({ findOne: jest.fn() }));
 jest.mock('../../../services/integrationSummaryService', () => ({ createSummary: jest.fn() }));
 jest.mock('../../../services/agentEventService', () => ({ enqueue: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
 jest.mock('../../../integrations', () => ({ get: jest.fn() }));
 jest.mock('../../../services/telegramBridgeService', () => ({ relayTelegramMessageToPod: jest.fn() }));
 jest.mock('../../../models/WebhookDelivery', () => ({
diff --git a/backend/__tests__/unit/routes/telegram.webhook.test.js b/backend/__tests__/unit/routes/telegram.webhook.test.js
index cd61a404b8..1079ba7d74 100644
--- a/backend/__tests__/unit/routes/telegram.webhook.test.js
+++ b/backend/__tests__/unit/routes/telegram.webhook.test.js
@@ -6,7 +6,13 @@ jest.mock('../../../models/Pod');
 jest.mock('../../../models/Summary', () => ({ findOne: jest.fn() }));
 jest.mock('../../../services/integrationSummaryService', () => ({ createSummary: jest.fn() }));
 jest.mock('../../../services/agentEventService', () => ({ enqueue: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
+// `sendMessage` is stubbed because it is the network; `escapeHtml` must stay
+// real, because escaping is behaviour this route is responsible for and a mock
+// that dropped it turned every escaped send into a 500 (vera 73812).
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
 jest.mock('../../../integrations', () => ({ get: jest.fn() }));
 jest.mock('../../../services/telegramBridgeService', () => ({
   relayTelegramMessageToPod: jest.fn(),
@@ -82,7 +88,16 @@ describe('Telegram webhook routes', () => {
           'config.chatId': '42',
           'config.chatType': 'group',
         }),
+        // The bind is the event that clears a named failure, and only a bind
+        // knows the connector works again (wren 73779). The flag is the pair's
+        // other half: it is what the page reads before rendering the message.
+        errorMessage: null,
+        errorMessageUserFacing: false,
       }),
+      // `new: true` is read back by the confirmation's classification: without
+      // it the doc in hand still carries the PRE-bind chat id, and a permanent
+      // failure of that confirmation could never undo the bind it just wrote.
+      { new: true },
     );
     expect(telegramService.sendMessage).toHaveBeenCalledWith(
       'bot-token',
@@ -91,6 +106,34 @@ describe('Telegram webhook routes', () => {
     );
   });
 
+  it('escapes a pod name in the bind confirmation, which Telegram parses as HTML', async () => {
+    const integration = {
+      _id: 'integration-1',
+      podId: 'pod-1',
+      config: { connectCode: 'abc123', connectCodeExpiresAt: new Date(Date.now() + 60000) },
+    };
+    Integration.findOne = jest.fn().mockResolvedValueOnce(integration).mockResolvedValueOnce(null);
+    Integration.findByIdAndUpdate = jest.fn().mockResolvedValue({ config: { chatId: '42' } });
+    Pod.findById.mockReturnValue({
+      lean: jest.fn().mockResolvedValue({ name: 'R&D <b>ops</b>' }),
+    });
+
+    const res = await request(app)
+      .post('/api/webhooks/telegram')
+      .send({
+        message: {
+          text: '/commonly-enable abc123',
+          chat: { id: 42, title: 'Test Chat', type: 'group' },
+          from: { id: 7, first_name: 'Sam' },
+        },
+      });
+
+    expect(res.status).toBe(200);
+    const text = telegramService.sendMessage.mock.calls[0][2];
+    expect(text).toContain('Connected this chat to <b>R&amp;D &lt;b&gt;ops&lt;/b&gt;</b>');
+    expect(text).not.toContain('<b>ops</b>');
+  });
+
   it('posts integration summary on /summary', async () => {
     const integration = {
       _id: 'integration-1',
@@ -285,7 +328,7 @@ describe('bridge command surface (/mode /status /mute /help)', () => {
     expect(res.status).toBe(200);
     const [, update] = Integration.findByIdAndUpdate.mock.calls[0];
     const until = new Date(update.$set['config.relayMutedUntil']).getTime();
-    expect(until).toBeLessThanOrEqual(Date.now() + 24 * 60 * 60_000 + 5000);
+    expect(until).toBeLessThanOrEqual(Date.now() + 24 * 60 * 60000 + 5000);
     expect(until).toBeGreaterThan(Date.now());
   });
 
@@ -310,6 +353,52 @@ describe('bridge command surface (/mode /status /mute /help)', () => {
     );
   });
 
+  it('/status escapes the pod name and the lead agent handle it reports', async () => {
+    Integration.findOne = jest.fn().mockResolvedValue({
+      ...linked(),
+      config: {
+        ...linked().config,
+        leadAgentUsername: '<a href="https://evil.example">lead</a>',
+      },
+    });
+    Pod.findById.mockReturnValue({
+      lean: jest.fn().mockResolvedValue({ name: 'R&D <b>chat</b>' }),
+    });
+
+    const res = await post('/status');
+
+    expect(res.status).toBe(200);
+    const text = telegramService.sendMessage.mock.calls[0][2];
+    // Telegram HTML accepts <a href>, so an unescaped name renders a clickable
+    // link inside a message the user reads as the bot's own words.
+    expect(text).toContain('R&amp;D &lt;b&gt;chat&lt;/b&gt;');
+    expect(text).not.toContain('<b>chat</b>');
+    expect(text).toContain('&lt;a href="https://evil.example"&gt;lead&lt;/a&gt;');
+    expect(text).not.toContain('<a href');
+    // The formatting the route itself writes is untouched by the escaping.
+    expect(text).toContain('Pod: <b>');
+  });
+
+  it('/tldr escapes the summary title and body, which are generated from pod text', async () => {
+    Integration.findOne = jest.fn().mockResolvedValue(linked());
+    Summary.findOne.mockReturnValue({
+      sort: jest.fn().mockReturnValue({
+        lean: jest.fn().mockResolvedValue({
+          title: 'Sprint <script>alert(1)</script>',
+          content: 'Agent said <b>ship it</b> & left',
+        }),
+      }),
+    });
+
+    const res = await post('/tldr');
+
+    expect(res.status).toBe(200);
+    const text = telegramService.sendMessage.mock.calls[0][2];
+    expect(text).toContain('&lt;script&gt;alert(1)&lt;/script&gt;');
+    expect(text).not.toContain('<script>');
+    expect(text).toContain('Agent said &lt;b&gt;ship it&lt;/b&gt; &amp; left');
+  });
+
   it('commands never fall through to the live relay', async () => {
     const bridge = require('../../../services/telegramBridgeService');
     await post('/status');
diff --git a/backend/__tests__/unit/services/connectorDeliveryFailureService.test.js b/backend/__tests__/unit/services/connectorDeliveryFailureService.test.js
new file mode 100644
index 0000000000..64fcfe2358
--- /dev/null
+++ b/backend/__tests__/unit/services/connectorDeliveryFailureService.test.js
@@ -0,0 +1,259 @@
+/* eslint-disable global-require, import/no-unresolved, import/extensions --
+   the requires must follow jest.mock, and this corpus resolves TS through the TS parser */
+// Row D: a permanent delivery failure must name itself on the connector, and
+// only the connector that owns the chat may be flipped.
+//
+// The cases that matter are the ones where flipping would be WRONG: an inbound
+// chat's failure (vera 73761), a content 400 (wren 73778), a 401 from the shared
+// bot token, and a connector re-bound between the send and the classification.
+// Each is asserted against the STORED document as well as the return value,
+// because a service that returns false and writes anyway would satisfy the
+// return value alone.
+//
+// The flip also writes no Activity row: 73779 asked for one, 73792 withdrew it
+// because V2 renders none. The retirement is pinned by its own test below, with
+// a positive control so the zero cannot be an unplugged instrument.
+const { MongoMemoryServer } = require('mongodb-memory-server');
+const mongoose = require('mongoose');
+
+let mongod;
+let Integration;
+let Activity;
+let deliveryFailures;
+
+const POD = new mongoose.Types.ObjectId();
+
+const makeIntegration = (overrides = {}) => Integration.create({
+  name: 'Telegram',
+  type: 'telegram',
+  podId: POD,
+  createdBy: new mongoose.Types.ObjectId(),
+  status: 'connected',
+  config: { chatId: '55501' },
+  ...overrides,
+});
+
+const permanent403 = {
+  success: false,
+  errorCode: 403,
+  description: 'Forbidden: bot was blocked by the user',
+};
+
+const storedIntegration = async (id) => Integration.findById(id).lean();
+
+beforeAll(async () => {
+  mongod = await MongoMemoryServer.create();
+  await mongoose.connect(mongod.getUri());
+  Integration = require('../../../models/Integration');
+  Activity = require('../../../models/Activity');
+  deliveryFailures = require('../../../services/connectorDeliveryFailureService');
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongod.stop();
+});
+
+afterEach(async () => {
+  await Integration.deleteMany({});
+  await Activity.deleteMany({});
+});
+
+describe('classification', () => {
+  it('sorts Telegram-shaped and Slack-shaped results to their own classifier', () => {
+    expect(deliveryFailures.classifyDeliveryFailure({ success: false, errorCode: 403 }))
+      .toBe(deliveryFailures.TELEGRAM_BLOCKED_REASON);
+    expect(deliveryFailures.classifyDeliveryFailure({ ok: false, error: 'not_in_channel' }))
+      .toBe(deliveryFailures.SLACK_BOT_REMOVED_REASON);
+    expect(deliveryFailures.classifyDeliveryFailure(null)).toBeNull();
+  });
+  it('is permanent for a 403 and for a 400 whose description says the chat is gone', () => {
+    expect(deliveryFailures.classifyTelegramDeliveryFailure({ success: false, errorCode: 403 }))
+      .toBe(deliveryFailures.TELEGRAM_BLOCKED_REASON);
+    expect(deliveryFailures.classifyTelegramDeliveryFailure({
+      success: false,
+      errorCode: 400,
+      description: 'Bad Request: chat not found',
+    })).toBe(deliveryFailures.TELEGRAM_CHAT_GONE_REASON);
+    expect(deliveryFailures.classifyTelegramDeliveryFailure({
+      success: false,
+      errorCode: 400,
+      description: 'Chat Not Found',
+    })).toBe(deliveryFailures.TELEGRAM_CHAT_GONE_REASON);
+  });
+
+  it('is not permanent for content 400s, our own token, rate limits, or a success', () => {
+    [
+      // The regression that made the escape load-bearing: a pod named `A <b>`
+      // produces exactly this 400, and it must not undo a working connector.
+      { success: false, errorCode: 400, description: "Bad Request: can't parse entities: unsupported start tag" },
+      { success: false, errorCode: 400, description: 'Bad Request: message to reply not found' },
+      { success: false, errorCode: 401, description: 'Unauthorized' },
+      { success: false, errorCode: 429, description: 'Too Many Requests: retry after 3' },
+      { success: false, errorCode: 500, description: 'Internal Server Error' },
+      { success: true },
+      null,
+      undefined,
+    ].forEach((result) => {
+      expect(deliveryFailures.classifyTelegramDeliveryFailure(result)).toBeNull();
+    });
+  });
+});
+
+describe('Slack classification', () => {
+  it('is permanent for the three errors that mean the channel is unreachable', () => {
+    expect(deliveryFailures.classifySlackDeliveryFailure({ ok: false, error: 'channel_not_found' }))
+      .toBe(deliveryFailures.SLACK_CHANNEL_GONE_REASON);
+    expect(deliveryFailures.classifySlackDeliveryFailure({ ok: false, error: 'not_in_channel' }))
+      .toBe(deliveryFailures.SLACK_BOT_REMOVED_REASON);
+    expect(deliveryFailures.classifySlackDeliveryFailure({ ok: false, error: 'is_archived' }))
+      .toBe(deliveryFailures.SLACK_CHANNEL_ARCHIVED_REASON);
+  });
+
+  it('never flips for app-level auth, transient, or content errors', () => {
+    [
+      // The shared bot app, the analogue of Telegram's 401: one connector must
+      // not be marked broken because the app itself was revoked.
+      { ok: false, error: 'invalid_auth' },
+      { ok: false, error: 'token_revoked' },
+      { ok: false, error: 'account_inactive' },
+      { ok: false, error: 'ratelimited' },
+      { ok: false, error: 'msg_too_long' },
+      { ok: false, error: 'invalid_blocks' },
+      { ok: false, error: 'internal_error' },
+      { ok: false },
+      { ok: true, ts: '1.1' },
+      null,
+    ].forEach((result) => {
+      expect(deliveryFailures.classifySlackDeliveryFailure(result)).toBeNull();
+    });
+  });
+
+  it('flips through the shared entry point, which sorts the two providers by shape', async () => {
+    const integration = await makeIntegration({ type: 'slack', config: { chatId: 'C123' } });
+
+    const flipped = await deliveryFailures.noteBoundChatDeliveryFailure(integration, 'C123', { ok: false, error: 'is_archived' });
+
+    expect(flipped).toBe(true);
+    const stored = await storedIntegration(integration._id);
+    expect(stored.status).toBe('error');
+    expect(stored.errorMessage).toBe(deliveryFailures.SLACK_CHANNEL_ARCHIVED_REASON);
+    expect(stored.config.chatId).toBeUndefined();
+  });
+
+  it('refuses an inbound channel for Slack too — the guard is not per provider', async () => {
+    const integration = await makeIntegration({ type: 'slack', config: { chatId: 'C123' } });
+
+    const flipped = await deliveryFailures.noteBoundChatDeliveryFailure(integration, 'C999', { ok: false, error: 'channel_not_found' });
+
+    expect(flipped).toBe(false);
+    expect((await storedIntegration(integration._id)).config.chatId).toBe('C123');
+    expect(await Activity.countDocuments({})).toBe(0);
+  });
+});
+
+describe('which chat may flip', () => {
+  it('flips the connector when its own bound chat refuses delivery, and names the reason', async () => {
+    const integration = await makeIntegration();
+
+    const flipped = await deliveryFailures.noteBoundChatDeliveryFailure(integration, '55501', permanent403);
+    expect(flipped).toBe(true);
+
+    const stored = await storedIntegration(integration._id);
+    expect(stored.status).toBe('error');
+    expect(stored.errorMessage).toBe(deliveryFailures.TELEGRAM_BLOCKED_REASON);
+    // The flag the page reads before it renders the message: the field has a
+    // second writer that copies provider text into it, so the value alone is not
+    // permission to show it (vera 73848).
+    expect(stored.errorMessageUserFacing).toBe(true);
+    // Unset, which is what stops the relay and re-allows a connect code.
+    expect(stored.config.chatId).toBeUndefined();
+  });
+
+  it('writes no Activity row on a permanent failure (wren 73792 withdrew it: V2 renders none)', async () => {
+    const integration = await makeIntegration();
+
+    expect(await deliveryFailures.noteBoundChatDeliveryFailure(integration, '55501', permanent403)).toBe(true);
+    expect(await Activity.countDocuments({})).toBe(0);
+
+    // Positive control for the zero above: a row written directly is visible in
+    // this harness, so the absence is the service's choice, not the instrument's.
+    await Activity.create({
+      type: 'pod_event',
+      actor: {
+        id: null, name: 'Commonly', type: 'system', verified: true, 
+      },
+      action: 'control_row',
+      content: 'control',
+      podId: POD,
+      sourceType: 'event',
+    });
+    expect(await Activity.countDocuments({})).toBe(1);
+  });
+
+  it('refuses a chat the connector does not own — the inbound case — and writes nothing', async () => {
+    const integration = await makeIntegration();
+
+    const flipped = await deliveryFailures.noteBoundChatDeliveryFailure(integration, '99999', permanent403);
+    expect(flipped).toBe(false);
+
+    const stored = await storedIntegration(integration._id);
+    expect(stored.status).toBe('connected');
+    expect(stored.config.chatId).toBe('55501');
+    expect(await Activity.countDocuments({})).toBe(0);
+  });
+
+  // The reconciler's caller: a connector-level failure that is not a delivery
+  // error, but whose reason is still ours and still written for a person. It is
+  // the other writer of the pair, so it goes through the same `$set` — and its
+  // own guard is that a row the user has deactivated is not marked.
+  it('marks a connector the reconciler can no longer decrypt, for a person, and leaves an inactive row alone', async () => {
+    const live = await makeIntegration();
+    const gone = await makeIntegration({ isActive: false, name: 'Slack', type: 'slack', config: {} });
+
+    expect(await deliveryFailures.markConnectorUnavailable(live, 'Slack connector secret key is unavailable'))
+      .toBe(true);
+    expect(await deliveryFailures.markConnectorUnavailable(gone, 'Slack connector secret key is unavailable'))
+      .toBe(false);
+
+    const stored = await storedIntegration(live._id);
+    expect(stored.status).toBe('error');
+    expect(stored.errorMessage).toBe('Slack connector secret key is unavailable');
+    expect(stored.errorMessageUserFacing).toBe(true);
+    expect((await storedIntegration(gone._id)).status).toBe('connected');
+  });
+
+  it('leaves a transient failure alone, end to end', async () => {
+    const integration = await makeIntegration();
+
+    const flipped = await deliveryFailures.noteBoundChatDeliveryFailure(integration, '55501', {
+      success: false,
+      errorCode: 429,
+      description: 'Too Many Requests: retry after 3',
+    });
+    expect(flipped).toBe(false);
+
+    const stored = await storedIntegration(integration._id);
+    expect(stored.status).toBe('connected');
+    expect(stored.config.chatId).toBe('55501');
+    expect(stored.errorMessage == null).toBe(true);
+    expect(await Activity.countDocuments({})).toBe(0);
+  });
+
+  it('writes nothing when the connector was re-bound between the send and the classification', async () => {
+    const integration = await makeIntegration();
+    await Integration.updateOne({ _id: integration._id }, { $set: { 'config.chatId': '77777' } });
+
+    const flipped = await deliveryFailures.flipConnectorOnPermanentDeliveryFailure({
+      integrationId: integration._id,
+      failedChatId: '55501',
+      reason: deliveryFailures.TELEGRAM_BLOCKED_REASON,
+    });
+    expect(flipped).toBe(false);
+
+    const stored = await storedIntegration(integration._id);
+    expect(stored.status).toBe('connected');
+    expect(stored.config.chatId).toBe('77777');
+    expect(await Activity.countDocuments({})).toBe(0);
+  });
+});
diff --git a/backend/__tests__/unit/services/decisionCardReconcileService.test.js b/backend/__tests__/unit/services/decisionCardReconcileService.test.js
index ce5ad2e3f1..75eb27823c 100644
--- a/backend/__tests__/unit/services/decisionCardReconcileService.test.js
+++ b/backend/__tests__/unit/services/decisionCardReconcileService.test.js
@@ -1,6 +1,18 @@
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
-jest.mock('../../../services/slackApi', () => jest.fn());
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
+// The constructor is stubbed (the network); the escape is the real one, since the
+// reconcile service now shares the helper with the bridge.
+jest.mock('../../../services/slackApi', () => {
+  const actual = jest.requireActual('../../../services/slackApi');
+  const mock = jest.fn();
+  mock.escapeSlackMrkdwn = actual.escapeSlackMrkdwn;
+  return mock;
+});
 jest.mock('../../../services/connectorSecrets', () => ({ get: jest.fn(async () => 'slack-token') }));
 
 const mongoose = require('mongoose');
@@ -153,6 +165,103 @@ describe('decision card closure fan-out', () => {
     expect((await Integration.findById(sibling._id)).config.cards[0].closedAt).toEqual(expect.any(Date));
   });
 
+  test('a permanent Telegram failure on the closing line names the reason on the connector', async () => {
+    // The sibling of the Slack test below, and the reason it exists: the two
+    // branches' classification lines are textually identical, so a mutation
+    // aimed at one of them silently exercises the other unless each has its own
+    // witness.
+    const origin = await Integration.create({
+      podId, scope: 'user', type: 'telegram', createdBy: ownerId, isActive: true, status: 'connected',
+      config: {
+        liveRelay: true, linkedUserId: String(ownerId), chatType: 'private', chatId: 'origin-telegram',
+        gates: { [String(podId)]: { enabled: true, since: new Date() } },
+        cards: [{ podMessageId: cardId, tgMessageId: '1.1', sentAt: new Date() }],
+      },
+    });
+    const gone = await Integration.create({
+      podId, scope: 'user', type: 'telegram', createdBy: memberId, isActive: true, status: 'connected',
+      config: {
+        liveRelay: true, linkedUserId: String(memberId), chatType: 'private', chatId: 'gone-telegram',
+        gates: { [String(podId)]: { enabled: true, since: new Date() } },
+        cards: [{ podMessageId: cardId, tgMessageId: '2.2', sentAt: new Date() }],
+      },
+    });
+    telegramSend.sendMessage.mockResolvedValue({
+      success: false,
+      errorCode: 403,
+      description: 'Forbidden: bot was blocked by the user',
+    });
+
+    await fanoutDecisionClosure(
+      { _id: new mongoose.Types.ObjectId(), podId, messageId: cardId, ruling: { value: 'A', byUsername: 'Sam' } },
+      { via: 'workspace', integrationId: origin._id },
+    );
+
+    // Detached delivery again: poll rather than race the background write.
+    const deadline = Date.now() + 3000;
+    let stored = await Integration.findById(gone._id);
+    while (stored.status !== 'error' && Date.now() < deadline) {
+      /* eslint-disable no-await-in-loop -- polling a detached write, bounded below */
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      stored = await Integration.findById(gone._id);
+      /* eslint-enable no-await-in-loop */
+    }
+
+    expect(stored.status).toBe('error');
+    expect(stored.errorMessage).toBe('Telegram stopped delivering: the bot was blocked or removed from this chat.');
+    expect(stored.config.chatId).toBeUndefined();
+    expect((await Integration.findById(origin._id)).status).toBe('connected');
+  });
+
+  test('a permanent Slack delivery failure names the reason on the connector and unsets its channel', async () => {
+    const origin = await Integration.create({
+      podId, scope: 'user', type: 'slack', createdBy: ownerId, isActive: true, status: 'connected',
+      config: {
+        liveRelay: true, linkedUserId: String(ownerId), chatType: 'im', chatId: 'origin', teamId: 'T1',
+        botTokenRef: 'origin-ref', gates: { [String(podId)]: { enabled: true, since: new Date() } },
+        cards: [{ podMessageId: cardId, externalMessageId: '1.1', sentAt: new Date() }],
+      },
+    });
+    const gone = await Integration.create({
+      podId, scope: 'user', type: 'slack', createdBy: memberId, isActive: true, status: 'connected',
+      config: {
+        liveRelay: true, linkedUserId: String(memberId), chatType: 'im', chatId: 'gone', teamId: 'T1',
+        botTokenRef: 'gone-ref', gates: { [String(podId)]: { enabled: true, since: new Date() } },
+        cards: [{ podMessageId: cardId, externalMessageId: '4.4', sentAt: new Date() }],
+      },
+    });
+    // `channel_not_found` is permanent: the bot cannot reach this channel again
+    // until someone re-authorizes, which the unset below is what re-allows.
+    const goneSend = jest.fn(async () => ({ ok: false, error: 'channel_not_found' }));
+    SlackApi.mockImplementation(() => ({ postMessage: goneSend }));
+
+    await fanoutDecisionClosure(
+      { _id: new mongoose.Types.ObjectId(), podId, messageId: cardId, ruling: { value: 'A', byUsername: 'Sam' } },
+      { via: 'workspace', integrationId: origin._id },
+    );
+
+    // One send, so the flip below cannot be a row that was merely swept up. The
+    // closure id passed above is skipped by the fan-out, so `gone` is the only
+    // receipt holder that receives text.
+    expect(goneSend).toHaveBeenCalledTimes(1);
+
+    // Delivery is deliberately detached (`void Promise.allSettled`), so the flip
+    // lands after the call returns. Poll for it rather than assert into a race.
+    const deadline = Date.now() + 3000;
+    let stored = await Integration.findById(gone._id);
+    while (stored.status !== 'error' && Date.now() < deadline) {
+      /* eslint-disable no-await-in-loop -- polling a detached write, bounded below */
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      stored = await Integration.findById(gone._id);
+      /* eslint-enable no-await-in-loop */
+    }
+
+    expect(stored.status).toBe('error');
+    expect(stored.errorMessage).toBe('Slack stopped delivering: this channel no longer exists.');
+    expect(stored.config.chatId).toBeUndefined();
+    expect((await Integration.findById(origin._id)).status).toBe('connected');
+  });
+
   test('rechecks mute and gate at ruling time but still closes their receipts', async () => {
     const held = await Integration.create({
       podId, scope: 'user', type: 'telegram', createdBy: memberId, isActive: true, status: 'connected',
diff --git a/backend/__tests__/unit/services/decisionCardRelay.bridges.test.js b/backend/__tests__/unit/services/decisionCardRelay.bridges.test.js
index e55cbfebbc..bef94f5d09 100644
--- a/backend/__tests__/unit/services/decisionCardRelay.bridges.test.js
+++ b/backend/__tests__/unit/services/decisionCardRelay.bridges.test.js
@@ -3,9 +3,21 @@ jest.mock('../../../models/Integration', () => ({
   findByIdAndUpdate: jest.fn(),
 }));
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
 jest.mock('../../../services/connectorSecrets', () => ({ get: jest.fn() }));
-jest.mock('../../../services/slackApi', () => jest.fn());
+// Constructor stubbed (the network), the escape real: the renderer the bridges
+// share calls it, so a bare stub would leave it undefined.
+jest.mock('../../../services/slackApi', () => {
+  const actual = jest.requireActual('../../../services/slackApi');
+  const mock = jest.fn();
+  mock.escapeSlackMrkdwn = actual.escapeSlackMrkdwn;
+  return mock;
+});
 jest.mock('../../../services/connectorRelayPolicy', () => ({ shouldEscalate: jest.fn(() => false) }));
 jest.mock('../../../services/channelVerdictService', () => ({ record: jest.fn() }));
 
diff --git a/backend/__tests__/unit/services/decisionCardReply.bridges.test.js b/backend/__tests__/unit/services/decisionCardReply.bridges.test.js
index 6cf4ec6ab0..c86783881d 100644
--- a/backend/__tests__/unit/services/decisionCardReply.bridges.test.js
+++ b/backend/__tests__/unit/services/decisionCardReply.bridges.test.js
@@ -9,8 +9,20 @@ jest.mock('../../../services/agentMessageService', () => ({ postMessage: jest.fn
 jest.mock('../../../services/messageAgentDeliveryService', () => ({ deliverMessageToAgents: jest.fn(async () => ({})) }));
 jest.mock('../../../services/agentEventService', () => ({ enqueue: jest.fn(async () => ({})) }));
 jest.mock('../../../services/attentionItemService', () => ({ resolve: jest.fn(async () => {}), recordDecision: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
-jest.mock('../../../services/slackApi', () => jest.fn());
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
+// Constructor stubbed (the network), the escape real: the renderer the bridges
+// share calls it, so a bare stub would leave it undefined.
+jest.mock('../../../services/slackApi', () => {
+  const actual = jest.requireActual('../../../services/slackApi');
+  const mock = jest.fn();
+  mock.escapeSlackMrkdwn = actual.escapeSlackMrkdwn;
+  return mock;
+});
 jest.mock('../../../services/connectorSecrets', () => ({ get: jest.fn(async () => 'token') }));
 jest.mock('../../../config/socket', () => ({ getIO: jest.fn(() => null) }));
 jest.mock('../../../services/threadRootResolver', () => ({ resolveThreadRoot: jest.fn(async () => 600) }));
diff --git a/backend/__tests__/unit/services/slackApi.escapeSlackMrkdwn.test.js b/backend/__tests__/unit/services/slackApi.escapeSlackMrkdwn.test.js
new file mode 100644
index 0000000000..be752d7f42
--- /dev/null
+++ b/backend/__tests__/unit/services/slackApi.escapeSlackMrkdwn.test.js
@@ -0,0 +1,30 @@
+/* eslint-disable global-require, import/no-unresolved, import/extensions --
+   the requires must follow jest.mock, and this corpus resolves TS through the TS parser */
+// The Slack escape lives beside the one call that posts it (wren 73822), and its
+// signature is the thing that had to be reconciled rather than copied: the bridge
+// carried `(raw: string) => String(raw)` and the reconcile service
+// `(value: unknown) => String(value || '')` (vera 73824). Either copy taken as
+// the shared shape changes what a missing value renders as in a human's DM.
+const SlackApi = require('../../../services/slackApi');
+
+describe('SlackApi.escapeSlackMrkdwn', () => {
+  test('neutralises the markup mrkdwn would otherwise draw', () => {
+    expect(SlackApi.escapeSlackMrkdwn('<https://evil.example|click here>'))
+      .toBe('&lt;https://evil.example|click here&gt;');
+    expect(SlackApi.escapeSlackMrkdwn('<!channel> and <@U1>'))
+      .toBe('&lt;!channel&gt; and &lt;@U1&gt;');
+    expect(SlackApi.escapeSlackMrkdwn('a & b')).toBe('a &amp; b');
+  });
+
+  test('renders a missing value as nothing, never as the word undefined', () => {
+    // The bridge's copy would have produced the string "undefined" here, which is
+    // the regression that picking the wrong signature would have shipped.
+    expect(SlackApi.escapeSlackMrkdwn(undefined)).toBe('');
+    expect(SlackApi.escapeSlackMrkdwn(null)).toBe('');
+  });
+
+  test('keeps a legitimate 0 or false, which `||` would have swallowed', () => {
+    expect(SlackApi.escapeSlackMrkdwn(0)).toBe('0');
+    expect(SlackApi.escapeSlackMrkdwn(false)).toBe('false');
+  });
+});
diff --git a/backend/__tests__/unit/services/slackBridgeService.test.js b/backend/__tests__/unit/services/slackBridgeService.test.js
index dd8f7d5ec9..5fd4e406fd 100644
--- a/backend/__tests__/unit/services/slackBridgeService.test.js
+++ b/backend/__tests__/unit/services/slackBridgeService.test.js
@@ -2,13 +2,27 @@ jest.mock('../../../models/Integration', () => ({ findOne: jest.fn(), findByIdAn
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/User', () => ({ findById: jest.fn() }));
 jest.mock('../../../services/connectorSecrets', () => ({ get: jest.fn() }));
-jest.mock('../../../services/slackApi', () => jest.fn().mockImplementation(() => ({ postMessage: jest.fn() })));
+// The constructor is stubbed (the network); the escape is the real one, because
+// the escaping these tests assert is the behaviour we ship.
+jest.mock('../../../services/slackApi', () => {
+  const actual = jest.requireActual('../../../services/slackApi');
+  const mock = jest.fn().mockImplementation(() => ({ postMessage: jest.fn() }));
+  mock.escapeSlackMrkdwn = actual.escapeSlackMrkdwn;
+  return mock;
+});
+// The relay's classification is this service's own, tested against a real
+// database in connectorDeliveryFailureService.test.js. Here the mock exists to
+// witness the WIRING: which channel and which result reach it.
+jest.mock('../../../services/connectorDeliveryFailureService', () => ({
+  noteBoundChatDeliveryFailure: jest.fn().mockResolvedValue(false),
+}));
 
 const Integration = require('../../../models/Integration');
 const Pod = require('../../../models/Pod');
 const User = require('../../../models/User');
 const connectorSecrets = require('../../../services/connectorSecrets');
 const SlackApi = require('../../../services/slackApi');
+const deliveryFailures = require('../../../services/connectorDeliveryFailureService');
 const {
   relayAgentMessageToSlack,
   relaySlackMessageToPod,
@@ -37,6 +51,24 @@ describe('Slack installable bridge', () => {
     Integration.findByIdAndUpdate.mockResolvedValue(undefined);
   });
 
+  test('escapes the pod name, the author and the body of a relayed message', async () => {
+    // One ternary, two escape regimes (vera 73823): the card branch escapes every
+    // field it is handed through the renderer, and this fall-through interpolated
+    // three of them raw. mrkdwn reads `<url|label>` as a link, so a pod name an
+    // agent can choose becomes a link the bot appears to have posted.
+    Pod.findById.mockReturnValue({ select: jest.fn().mockReturnValue({ lean: jest.fn().mockResolvedValue({ name: '<Evil|pod>' }) }) });
+    await relayAgentMessageToSlack({
+      podId: 'pod-1', agentUsername: 'kai', displayName: 'Kai', content: '<https://evil.example|click> <!channel>',
+      podMessageId: 'message-1', integration,
+    });
+
+    const api = SlackApi.mock.results[0].value;
+    expect(api.postMessage).toHaveBeenCalledWith(
+      'D1',
+      '[&lt;Evil|pod&gt;] Kai: &lt;https://evil.example|click&gt; &lt;!channel&gt;',
+    );
+  });
+
   test('uses the selected Slack row, secret reference, and generic D11 map', async () => {
     await relayAgentMessageToSlack({
       podId: 'pod-1', agentUsername: 'kai', displayName: 'Kai', content: 'Hello from the pod',
@@ -56,6 +88,45 @@ describe('Slack installable bridge', () => {
     }));
   });
 
+  test('a permanent Slack failure is classified against the channel the relay targeted', async () => {
+    // `not_in_channel` is Slack's version of Telegram's 403: the bot was removed
+    // and every future relay to that channel fails the same way. The relay
+    // swallows its own errors (it warns rather than throwing), so the observable
+    // effects are the classification and the relay map that must not be written.
+    const api = { postMessage: jest.fn().mockResolvedValue({ ok: false, error: 'not_in_channel' }) };
+    SlackApi.mockImplementation(() => api);
+    const warned = jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    await relayAgentMessageToSlack({
+      podId: 'pod-1', agentUsername: 'kai', displayName: 'Kai', content: 'Hello from the pod',
+      podMessageId: 'message-1', integration,
+    });
+
+    expect(deliveryFailures.noteBoundChatDeliveryFailure).toHaveBeenCalledWith(
+      integration, 'D1', { ok: false, error: 'not_in_channel' },
+    );
+    expect(Integration.findByIdAndUpdate).not.toHaveBeenCalled();
+    expect(warned.mock.calls[0][0]).toContain('not_in_channel');
+  });
+
+  test('a missing ts on a successful send is not treated as a delivery failure', async () => {
+    // `!result.ts` warns in the same branch as `!result.ok`, but it says nothing
+    // about whether the channel is reachable — only `ok: false` may flip.
+    const api = { postMessage: jest.fn().mockResolvedValue({ ok: true }) };
+    SlackApi.mockImplementation(() => api);
+    jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    await relayAgentMessageToSlack({
+      podId: 'pod-1', agentUsername: 'kai', displayName: 'Kai', content: 'Hello from the pod',
+      podMessageId: 'message-1', integration,
+    });
+
+    expect(deliveryFailures.noteBoundChatDeliveryFailure).toHaveBeenCalledWith(
+      integration, 'D1', { ok: true },
+    );
+    expect(Integration.findByIdAndUpdate).not.toHaveBeenCalled();
+  });
+
   test('routes a Slack thread reply to the agent whose relayed message was quoted', () => {
     expect(routeSlackReplyContent({
       content: 'Can you clarify?',
diff --git a/backend/__tests__/unit/services/telegramBridgeService.attribution.test.js b/backend/__tests__/unit/services/telegramBridgeService.attribution.test.js
index 1507204ae5..ec6b4009b9 100644
--- a/backend/__tests__/unit/services/telegramBridgeService.attribution.test.js
+++ b/backend/__tests__/unit/services/telegramBridgeService.attribution.test.js
@@ -3,7 +3,12 @@
 // These pin the gate BEHAVIOURALLY: what reaches PGMessage.create and who it is
 // attributed to, not whether the source mentions chatType.
 jest.mock('../../../models/Integration', () => ({ findOne: jest.fn(), findByIdAndUpdate: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
 jest.mock('../../../models/User', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/pg/Message', () => ({ create: jest.fn(), findById: jest.fn() }));
diff --git a/backend/__tests__/unit/services/telegramBridgeService.inboundRetry.test.js b/backend/__tests__/unit/services/telegramBridgeService.inboundRetry.test.js
index 2204929df0..184cee04e0 100644
--- a/backend/__tests__/unit/services/telegramBridgeService.inboundRetry.test.js
+++ b/backend/__tests__/unit/services/telegramBridgeService.inboundRetry.test.js
@@ -1,7 +1,12 @@
 // Which side of the pod write a failure lands on decides whether Telegram's
 // redelivery is a repair or a duplicate. These pin that split.
 jest.mock('../../../models/Integration', () => ({ findOne: jest.fn(), findByIdAndUpdate: jest.fn() }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
 jest.mock('../../../models/User', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/pg/Message', () => ({ create: jest.fn(), findById: jest.fn() }));
diff --git a/backend/__tests__/unit/services/telegramBridgeService.test.js b/backend/__tests__/unit/services/telegramBridgeService.test.js
index f24751ab3c..09d7ac34c3 100644
--- a/backend/__tests__/unit/services/telegramBridgeService.test.js
+++ b/backend/__tests__/unit/services/telegramBridgeService.test.js
@@ -2,7 +2,12 @@ jest.mock('../../../models/Integration', () => ({
   findOne: jest.fn(),
   findByIdAndUpdate: jest.fn(),
 }));
-jest.mock('../../../services/telegramService', () => ({ sendMessage: jest.fn() }));
+// Stub the network, keep the behaviour: the bridge escapes through this module's
+// escapeHtml, so a bare stub leaves it undefined and the send is swallowed.
+jest.mock('../../../services/telegramService', () => ({
+  ...jest.requireActual('../../../services/telegramService'),
+  sendMessage: jest.fn(),
+}));
 
 const telegramSend = require('../../../services/telegramService');
 const {
diff --git a/backend/__tests__/unit/services/telegramService.deliveryFailureFields.test.js b/backend/__tests__/unit/services/telegramService.deliveryFailureFields.test.js
new file mode 100644
index 0000000000..96bd7f6e66
--- /dev/null
+++ b/backend/__tests__/unit/services/telegramService.deliveryFailureFields.test.js
@@ -0,0 +1,68 @@
+// Row D rests on `sendMessage` handing Telegram's own error_code and description
+// to its caller. Until this change they were read only to be logged, and every
+// failure arrived as axios's "Request failed with status code 400" — so a
+// classifier would have had nothing to classify and a permanent 403 would have
+// looked exactly like a transient one. This is the test that keeps the feature
+// from silently becoming a no-op.
+const axios = require('axios');
+
+jest.mock('axios', () => ({ post: jest.fn() }));
+
+const telegramService = require('../../../services/telegramService');
+
+let consoleError;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  consoleError = jest.spyOn(console, 'error').mockImplementation(() => {});
+});
+
+afterEach(() => {
+  consoleError.mockRestore();
+});
+
+describe('sendMessage passes the failure detail through', () => {
+  it('returns error_code and description so a call site can classify', async () => {
+    axios.post.mockRejectedValueOnce({
+      response: { data: { ok: false, error_code: 400, description: 'Bad Request: chat not found' } },
+      message: 'Request failed with status code 400',
+    });
+
+    const result = await telegramService.sendMessage('token', '55501', 'hi');
+
+    expect(result.success).toBe(false);
+    expect(result.errorCode).toBe(400);
+    expect(result.description).toBe('Bad Request: chat not found');
+    // The old field stays: existing callers read it and nothing here decides.
+    expect(result.error).toBe('Request failed with status code 400');
+  });
+
+  it('returns neither field when the failure carried no Telegram body', async () => {
+    axios.post.mockRejectedValueOnce({ message: 'socket hang up' });
+
+    const result = await telegramService.sendMessage('token', '55501', 'hi');
+
+    expect(result.success).toBe(false);
+    expect(result.errorCode).toBeUndefined();
+    expect(result.description).toBeUndefined();
+  });
+});
+
+describe('escapeHtml', () => {
+  it('escapes the characters that would otherwise 400 an HTML send', () => {
+    // The bind confirmation names the pod inside parse_mode HTML, so a pod
+    // called `A <b>` used to fail the whole send with "can't parse entities".
+    expect(telegramService.escapeHtml('A <b> & "c"')).toBe('A &lt;b&gt; &amp; "c"');
+    expect(telegramService.escapeHtml('plain')).toBe('plain');
+  });
+
+  it('renders an absent value as nothing, not as the literal "null" or "undefined"', () => {
+    // The pair Slack's escaper already keeps: `String(undefined)` is a truthy
+    // two-character string that would print in place of the name. Unreachable
+    // today — every call site pre-guards — which is exactly why the assertion is
+    // about the function rather than about a send (vera 73849).
+    expect(telegramService.escapeHtml(undefined)).toBe('');
+    expect(telegramService.escapeHtml(null)).toBe('');
+    expect(telegramService.escapeHtml(0)).toBe('0');
+  });
+});
diff --git a/backend/models/Integration.ts b/backend/models/Integration.ts
index 5774a7f7d9..e106b584ce 100644
--- a/backend/models/Integration.ts
+++ b/backend/models/Integration.ts
@@ -163,6 +163,14 @@ export interface IIntegration extends Document {
   lastSync?: Date | null;
   createdBy: Types.ObjectId;
   errorMessage?: string | null;
+  /**
+   * True when `errorMessage` was written by Commonly for the person reading the
+   * Connectors page, rather than copied out of a provider response. The page
+   * renders the message only when this is set, so the two writers of this field
+   * — our own classifier, and externalFeedService copying a provider's error
+   * text or a raw `err.message` — cannot be told apart by the reader's eye alone.
+   */
+  errorMessageUserFacing?: boolean;
   isActive: boolean;
   createdAt: Date;
   updatedAt: Date;
@@ -328,6 +336,9 @@ const IntegrationSchema = new Schema<IIntegration>(
     lastSync: { type: Date, default: null },
     createdBy: { type: Schema.Types.ObjectId, ref: 'User', required: true },
     errorMessage: { type: String, default: null },
+    // Set by connectorDeliveryFailureService, the only writer that puts text on
+    // the Connectors page for a person to read (see the model interface).
+    errorMessageUserFacing: { type: Boolean, default: false },
     isActive: { type: Boolean, default: true },
   },
   { timestamps: true, collection: 'integrations' },
diff --git a/backend/routes/installables.ts b/backend/routes/installables.ts
index 98a93a6a51..81c59357a1 100644
--- a/backend/routes/installables.ts
+++ b/backend/routes/installables.ts
@@ -18,6 +18,8 @@ const { mintConnectCode } = require('../services/telegramConnectCode');
 // eslint-disable-next-line global-require
 const connectorSecrets = require('../services/connectorSecrets');
 // eslint-disable-next-line global-require
+const connectorDeliveryFailures = require('../services/connectorDeliveryFailureService');
+// eslint-disable-next-line global-require
 const {
   catalogFor,
   providerReadiness,
@@ -414,6 +416,12 @@ router.post('/slack/confirm', writeIntegrationsRateLimit, auth, async (req: Auth
     {
       $set: {
         status: 'connected',
+        // A reconnect is the only thing that proves this connector works again,
+        // so it is the only thing that clears the reason an earlier flip left on
+        // the row — the same shape as the Telegram bind (wren 73838). The flag
+        // goes with the message: it is what the page reads before rendering it.
+        errorMessage: null,
+        errorMessageUserFacing: false,
         'config.teamId': pending.teamId,
         'config.teamName': pending.teamName,
         'config.slackUserId': pending.slackUserId,
@@ -433,10 +441,25 @@ router.post('/slack/confirm', writeIntegrationsRateLimit, auth, async (req: Auth
   try {
     const token = await connectorSecrets.get(pending.botTokenRef);
     const livePod = await Pod.findById(confirmed.podId).select('name').lean();
-    await new SlackApi(token).postMessage(
+    const sent = await new SlackApi(token).postMessage(
       pending.chatId,
-      `[${String(livePod?.name || 'Commonly')}] connected`,
+      // Same escape the relay uses, and for the same reason: the pod name is
+      // owner-authored text landing in mrkdwn.
+      `[${SlackApi.escapeSlackMrkdwn(livePod?.name || 'Commonly')}] connected`,
     );
+    // The marker goes to the chat this confirm just stored, so by 73777's own
+    // test this is a bound-chat send — the twin of the Telegram bind
+    // confirmation. A permanent refusal means the connector is bound to a DM
+    // the bot cannot post in, which is exactly the state the page has to name
+    // (wren 73837). It still cannot cost a good bind: only channel_not_found,
+    // not_in_channel and is_archived classify as permanent.
+    if (await connectorDeliveryFailures.noteBoundChatDeliveryFailure(confirmed, pending.chatId, sent)) {
+      const flipped = await Integration.findById(confirmed._id);
+      return res.json({
+        status: flipped?.status ?? 'error',
+        integration: publicIntegration(flipped || confirmed),
+      });
+    }
   } catch (error) {
     console.warn('[slack-oauth] connected marker could not be sent:', (error as Error).message);
   }
diff --git a/backend/routes/webhooks/telegram.ts b/backend/routes/webhooks/telegram.ts
index bb5ba4817e..12a592606b 100644
--- a/backend/routes/webhooks/telegram.ts
+++ b/backend/routes/webhooks/telegram.ts
@@ -8,6 +8,8 @@ const registry = require('../../integrations');
 const IntegrationSummaryService = require('../../services/integrationSummaryService');
 const AgentEventService = require('../../services/agentEventService');
 const telegramService = require('../../services/telegramService');
+const { escapeHtml } = telegramService;
+const deliveryFailures = require('../../services/connectorDeliveryFailureService');
 const { isConnectCodeExpired, registerEnableAttempt } = require('../../services/telegramConnectCode');
 const {
   claimDelivery: claimWebhookDelivery,
@@ -159,8 +161,16 @@ const handleEnableCommand = async (chat: any, code: any) => {
     return;
   }
 
-  await Integration.findByIdAndUpdate(integration._id, {
+  // `errorMessage: null` because the working bind is the other state of the
+  // field the failure writes, and only a bind knows the connector works again
+  // (wren 73779). `new: true` is what the confirmation below classifies against:
+  // the chat id it compares is the one this update just stored.
+  const bound = await Integration.findByIdAndUpdate(integration._id, {
     status: 'connected',
+    errorMessage: null,
+    // The flag goes with the message it describes: a bind clears the reason, so
+    // it clears the claim that the reason was written for a person.
+    errorMessageUserFacing: false,
     $set: {
       'config.chatId': chatId,
       'config.chatTitle': chatTitle,
@@ -171,18 +181,25 @@ const handleEnableCommand = async (chat: any, code: any) => {
       'config.connectCode': '',
       'config.connectCodeExpiresAt': '',
     },
-  });
+  }, { new: true });
 
   const pod = await Pod.findById(integration.podId).lean();
   const podName = pod?.name || 'your pod';
 
-  await telegramService.sendMessage(
+  // Escaped because parse_mode is HTML: a pod named `A <b>` made Telegram reject
+  // this send with 400 "can't parse entities", which is a content failure and
+  // must never undo a bind (wren 73778).
+  const confirmation = await telegramService.sendMessage(
     botToken,
     chatId,
-    `✅ Connected this chat to <b>${podName}</b> in Commonly.\n`
+    `✅ Connected this chat to <b>${escapeHtml(podName)}</b> in Commonly.\n`
     + 'Agent messages from the pod will appear here. Too chatty? Send '
     + '/mode attention to only get what needs you. /help lists the rest.',
   );
+  // The one receive-side send that may flip: it targets the chat that was just
+  // bound, so a permanent failure means this bind is unusable. Undoing it clears
+  // the chat id, which is what lets the user mint a fresh code and reconnect.
+  await deliveryFailures.noteBoundChatDeliveryFailure(bound, chatId, confirmation);
 };
 
 const handleSummaryCommand = async (chat: any, integration: any) => {
@@ -295,10 +312,12 @@ const handlePodSummaryCommand = async (chat: any, integration: any) => {
   }
 
   const title = latestSummary.title || 'Pod Summary';
+  // Summary text is generated from pod messages, so it is untrusted here for
+  // the same reason a pod name is: parse_mode is HTML (vera 73812).
   await telegramService.sendMessage(
     botToken,
     chatId,
-    `${title}\n\n${latestSummary.content}`,
+    `${escapeHtml(title)}\n\n${escapeHtml(latestSummary.content)}`,
   );
 };
 
@@ -355,9 +374,9 @@ const handleStatusCommand = async (chat: any, integration: any) => {
     : 'not muted';
   const lead = integration.config?.leadAgentUsername;
   return sendToChat(chatId, [
-    `Pod: <b>${pod?.name || 'unknown'}</b>`,
+    `Pod: <b>${escapeHtml(pod?.name || 'unknown')}</b>`,
     `Mode: <b>${mode}</b> · Relay: ${integration.config?.liveRelay ? 'on' : 'off'} · ${muted}`,
-    lead ? `Lead agent: ${lead}` : null,
+    lead ? `Lead agent: ${escapeHtml(lead)}` : null,
   ].filter(Boolean).join('\n'));
 };
 
diff --git a/backend/services/connectorDeliveryFailureService.ts b/backend/services/connectorDeliveryFailureService.ts
new file mode 100644
index 0000000000..60e5db09ec
--- /dev/null
+++ b/backend/services/connectorDeliveryFailureService.ts
@@ -0,0 +1,215 @@
+import Integration from '../models/Integration';
+
+// Row D: a permanent delivery failure used to change nothing at all — the
+// integration stayed `connected`, `errorMessage` stayed null and the relay kept
+// running, so replies vanished while the page said the connector was fine. The
+// fix is to classify the failure at the call site that sent it and flip the
+// connector only for the chats it owns.
+//
+// Classification lives at the call site, not inside sendMessage (wren 73777):
+// a Telegram chat id has two provenances — the connector's own bound chat, and
+// the chat an inbound update came from. A 400/403 on the second says nothing
+// about the first: a stranger who holds a connect code, binds, then blocks the
+// bot would otherwise mark someone's working connector as needing attention
+// (vera 73761). `noteBoundChatDeliveryFailure` can only ever act on the bound
+// chat, so that wiring mistake is refused rather than merely discouraged.
+
+// The page shows a cause, not a number: "the bot was blocked" is actionable,
+// "403" is not.
+const TELEGRAM_BLOCKED_REASON = 'Telegram stopped delivering: the bot was blocked or removed from this chat.';
+const TELEGRAM_CHAT_GONE_REASON = 'Telegram stopped delivering: this chat no longer exists.';
+
+// Slack reports the same three situations in its own vocabulary (wren 73779).
+const SLACK_CHANNEL_GONE_REASON = 'Slack stopped delivering: this channel no longer exists.';
+const SLACK_BOT_REMOVED_REASON = 'Slack stopped delivering: the bot is not in this channel.';
+const SLACK_CHANNEL_ARCHIVED_REASON = 'Slack stopped delivering: this channel was archived.';
+
+/**
+ * Slack's permanent errors. `invalid_auth`, `token_revoked` and `account_inactive`
+ * are deliberately absent: they are the shared bot app, the analogue of
+ * Telegram's 401, and they must never mark one connector as needing attention.
+ * Everything else (`ratelimited`, `msg_too_long`, `invalid_blocks`,
+ * `internal_error`) is transient or content.
+ */
+const PERMANENT_SLACK_ERRORS: { [error: string]: string } = {
+  channel_not_found: SLACK_CHANNEL_GONE_REASON,
+  not_in_channel: SLACK_BOT_REMOVED_REASON,
+  is_archived: SLACK_CHANNEL_ARCHIVED_REASON,
+};
+
+interface DeliveryResult {
+  success?: boolean;
+  errorCode?: number;
+  description?: string;
+}
+
+interface SlackDeliveryResult {
+  ok?: boolean;
+  error?: string;
+}
+
+/**
+ * Slack's own `error` string → a named reason, or null when the failure says
+ * nothing about this connector. See PERMANENT_SLACK_ERRORS for what is excluded
+ * and why.
+ */
+const classifySlackDeliveryFailure = (result?: SlackDeliveryResult | null): string | null => {
+  if (!result || result.ok !== false) return null;
+  return PERMANENT_SLACK_ERRORS[String(result.error || '').toLowerCase()] || null;
+};
+
+/**
+ * Telegram's own error_code/description → a named reason, or null when the
+ * failure says nothing about this connector.
+ *
+ *  403  blocked, kicked, or the bot was stopped        → permanent
+ *  400  description "chat not found"                   → permanent (the chat is gone)
+ *  401  our shared bot token, not this connector       → never
+ *  400  anything else — an unescaped entity, a bad offset, a bad offset in the
+ *       reply target. Content, not reachability: a pod named `A <b>` used to 400
+ *       every confirmation, and that must not undo a working bind (wren 73778).
+ *  429/5xx, and anything we did not classify            → never
+ *
+ * `errorCode`/`description` are read off the axios throw, so a Telegram reply
+ * that arrives as HTTP 200 with `ok: false` reaches here as a plain success and
+ * classifies as null. That is the direction this must fail in: a missed flip is
+ * a connector that keeps relaying until the next failure names it, a wrong flip
+ * is someone's working connector marked broken (vera 73849).
+ */
+const classifyTelegramDeliveryFailure = (result?: DeliveryResult | null): string | null => {
+  if (!result || result.success === true) return null;
+  if (result.errorCode === 403) return TELEGRAM_BLOCKED_REASON;
+  if (result.errorCode === 400 && /chat not found/i.test(String(result.description || ''))) {
+    return TELEGRAM_CHAT_GONE_REASON;
+  }
+  return null;
+};
+
+interface FlipInput {
+  integrationId: unknown;
+  failedChatId: unknown;
+  reason: string;
+}
+
+/**
+ * One matched update and nothing else. The Activity row that 73779 attached to
+ * this was withdrawn in 73792 — V2 renders none: the frontend never calls
+ * /api/activity/feed, the recap keeps agent actors, and needs-you reads only
+ * AttentionItem, so the row would have been written and never read.
+ *
+ * The match on `config.chatId` is the race guard: if the connector was
+ * re-bound between the send and this call, the update matches nothing and no
+ * row is written — we would be reporting a failure for a chat it no longer
+ * owns. Unsetting the chat id is what allows a reconnect (the connect-code
+ * route 409s while a chat id is present), and it is what stops the Telegram
+ * relay — that predicate reads the chat id and the pause flag, never `status`.
+ * The Slack relay filters `status: { $ne: 'error' }` as well
+ * (slackBridgeService.findLiveIntegration), so there the flip stops it twice.
+ *
+ * `errorMessage` on its own cannot say the reason is fit to read: this field has
+ * a second, older writer — externalFeedService copies a provider's error text or
+ * a raw `err.message` (`connect ECONNREFUSED <addr>:443`) into it for `x` and
+ * `instagram` rows — and the page renders every `status: 'error'` row through
+ * one branch. So "the field has a value" is not the same fact as "the value was
+ * written for a person". `errorMessageUserFacing` is that fact, this module is
+ * its only writer, and the page renders the message only when it is set; a
+ * writer that does not set it falls back to the generic sentence instead of
+ * printing our stack text in a connector row (vera 73848).
+ */
+const userFacingError = (reason: string) => ({
+  status: 'error',
+  errorMessage: reason,
+  errorMessageUserFacing: true,
+});
+
+/**
+ * The flip's update payload, and the reconciler's — one home for the pair, so a
+ * second user-facing writer cannot forget half of it.
+ */
+const flipConnectorOnPermanentDeliveryFailure = async ({
+  integrationId,
+  failedChatId,
+  reason,
+}: FlipInput): Promise<boolean> => {
+  const matched = await Integration.findOneAndUpdate(
+    { _id: integrationId, 'config.chatId': String(failedChatId) },
+    {
+      $set: userFacingError(reason),
+      $unset: { 'config.chatId': '' },
+    },
+    { new: true },
+  );
+  if (!matched) return false;
+  return true;
+};
+
+/**
+ * The two providers report failure in their own shapes — `{success: false,
+ * errorCode}` and `{ok: false, error}` — and the call sites hand over whatever
+ * their provider returned, so the entry point sorts them by shape rather than
+ * making every caller name its provider.
+ */
+const classifyDeliveryFailure = (result?: (DeliveryResult & SlackDeliveryResult) | null): string | null => (
+  result && result.ok === false ? classifySlackDeliveryFailure(result) : classifyTelegramDeliveryFailure(result)
+);
+
+/**
+ * Call this only from a send that targeted the connector's own bound chat — for
+ * either provider, since both store it in `config.chatId`.
+ *
+ * `sentToChatId` is compared against the stored one on purpose: the sites that
+ * may flip all send to `integration.config.chatId`, and the receive-side replies
+ * in the Telegram webhook send to the chat the update came from. Passing an
+ * inbound chat here is the griefing lever, and it returns false instead of
+ * flipping someone else's working connector.
+ */
+const noteBoundChatDeliveryFailure = async (
+  integration: { _id?: unknown; config?: { chatId?: unknown } } | null | undefined,
+  sentToChatId: unknown,
+  result?: (DeliveryResult & SlackDeliveryResult) | null,
+): Promise<boolean> => {
+  const boundChatId = integration?.config?.chatId;
+  if (!boundChatId || !sentToChatId || String(boundChatId) !== String(sentToChatId)) return false;
+
+  const reason = classifyDeliveryFailure(result);
+  if (!reason) return false;
+
+  return flipConnectorOnPermanentDeliveryFailure({
+    integrationId: integration?._id,
+    failedChatId: boundChatId,
+    reason,
+  });
+};
+
+/**
+ * A connector-level failure that is not a delivery error but whose reason is
+ * still ours and still written for the person reading the page: the reconciler
+ * found that this row's connector secret can no longer be decrypted. Same
+ * `$set` as the flip; the filter stays the caller's own guard, and a row the
+ * user has already deactivated must not be marked.
+ */
+const markConnectorUnavailable = async (
+  integration: { _id?: unknown } | null | undefined,
+  reason: string,
+): Promise<boolean> => {
+  if (!integration?._id) return false;
+  const result = await Integration.updateOne(
+    { _id: integration._id, isActive: true },
+    { $set: userFacingError(reason) },
+  );
+  return (result.matchedCount || 0) > 0;
+};
+
+export {
+  classifyDeliveryFailure,
+  classifySlackDeliveryFailure,
+  classifyTelegramDeliveryFailure,
+  flipConnectorOnPermanentDeliveryFailure,
+  markConnectorUnavailable,
+  noteBoundChatDeliveryFailure,
+  TELEGRAM_BLOCKED_REASON,
+  TELEGRAM_CHAT_GONE_REASON,
+  SLACK_BOT_REMOVED_REASON,
+  SLACK_CHANNEL_ARCHIVED_REASON,
+  SLACK_CHANNEL_GONE_REASON,
+};
diff --git a/backend/services/decisionCardReconcileService.ts b/backend/services/decisionCardReconcileService.ts
index c9b3377dfd..b9f59608ae 100644
--- a/backend/services/decisionCardReconcileService.ts
+++ b/backend/services/decisionCardReconcileService.ts
@@ -10,6 +10,7 @@ const Pod = require('../models/Pod');
 const isPodMember = require('../utils/isPodMember');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const telegramSend = require('./telegramService');
+const deliveryFailures = require('./connectorDeliveryFailureService');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const SlackApi = require('./slackApi');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
@@ -60,10 +61,11 @@ interface IntegrationDoc {
   };
 }
 
-const escapeSlack = (value: unknown): string => String(value || '')
-  .replace(/&/g, '&amp;')
-  .replace(/</g, '&lt;')
-  .replace(/>/g, '&gt;');
+// One implementation, in slackApi.ts beside the call that posts it. The local
+// name stays so the call site below reads as it did; the behaviour is the shared
+// helper's, `??` rather than `||`, so a missing value renders as nothing while a
+// legitimate 0 or false still renders as itself.
+const escapeSlack = SlackApi.escapeSlackMrkdwn;
 
 const memberIdFor = (integration: IntegrationDoc): string | null => {
   const linked = integration.config?.linkedUserId;
@@ -104,7 +106,12 @@ const sendClosingLine = async (
       text,
       { replyToMessageId: card.tgMessageId, plainText: true },
     );
-    if (!sent?.success) throw new Error('Telegram ruling confirmation was not sent');
+    if (!sent?.success) {
+      // Bound chat: the closing line goes to the connector's own chat, so a
+      // permanent failure is the connector's, not an inbound sender's.
+      await deliveryFailures.noteBoundChatDeliveryFailure(integration, integration.config?.chatId, sent);
+      throw new Error('Telegram ruling confirmation was not sent');
+    }
     return;
   }
   const token = await connectorSecrets.get(String(integration.config?.botTokenRef));
@@ -114,7 +121,13 @@ const sendClosingLine = async (
     undefined,
     card.externalMessageId,
   );
-  if (!sent?.ok) throw new Error(`Slack ruling confirmation was not sent: ${String(sent?.error || 'unknown error')}`);
+  if (!sent?.ok) {
+    // Same split as the Telegram half above: bound channel, so a permanent
+    // failure (removed, archived, gone) is this connector's, not an inbound
+    // sender's.
+    await deliveryFailures.noteBoundChatDeliveryFailure(integration, integration.config?.chatId, sent);
+    throw new Error(`Slack ruling confirmation was not sent: ${String(sent?.error || 'unknown error')}`);
+  }
 };
 
 /**
diff --git a/backend/services/externalFeedService.ts b/backend/services/externalFeedService.ts
index 8f88622502..cfff6c7b02 100644
--- a/backend/services/externalFeedService.ts
+++ b/backend/services/externalFeedService.ts
@@ -434,6 +434,11 @@ async function syncExternalFeeds(): Promise<FeedSyncResult[]> {
           await Integration.findByIdAndUpdate(integration._id, {
             $set: {
               status: 'error',
+              // Diagnostic, not copy. This is a provider's error text or a raw
+              // exception message, so `errorMessageUserFacing` stays unset and
+              // the Connectors page shows its generic sentence for these rows —
+              // the detail is kept here for whoever debugs the feed instead of
+              // being printed in someone's connector list (vera 73848).
               errorMessage: detail,
               lastSync: new Date(),
             },
diff --git a/backend/services/installable/installableReconciler.ts b/backend/services/installable/installableReconciler.ts
index 98a5268baf..e454b2b643 100644
--- a/backend/services/installable/installableReconciler.ts
+++ b/backend/services/installable/installableReconciler.ts
@@ -11,6 +11,12 @@ const Pod = require('../../models/Pod');
 const ConnectorSecret = require('../../models/ConnectorSecret');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const connectorSecrets = require('../connectorSecrets');
+// The user-facing half of the error state: this module marks a row it cannot
+// decrypt, and the reason is written for the person reading the Connectors page
+// — the same flag the delivery-failure flip sets, so it comes from that service
+// rather than a second `$set` here.
+// eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
+const connectorDeliveryFailures = require('../connectorDeliveryFailureService');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const isPodMember = require('../../utils/isPodMember');
 
@@ -208,16 +214,6 @@ const sweepStaleUninstalls = async (now: Date): Promise<number> => {
   return completed;
 };
 
-const markSlackIntegrationUnavailable = async (
-  integration: { _id: unknown },
-  message: string,
-): Promise<void> => {
-  await Integration.updateOne(
-    { _id: integration._id, isActive: true },
-    { $set: { status: 'error', errorMessage: message } },
-  );
-};
-
 const sweepExpiredSlackBinds = async (now: Date): Promise<number> => {
   const rows = await Integration.find({
     type: 'slack',
@@ -292,7 +288,12 @@ const sweepUnavailableSlackSecretKeys = async (): Promise<number> => {
   for (const secret of unavailable) {
     const integration = await Integration.findById(secret.integrationId)
       .select('installationId').lean() as { _id: unknown; installationId?: string } | null;
-    if (integration) await markSlackIntegrationUnavailable(integration, 'Slack connector secret key is unavailable');
+    if (integration) {
+      await connectorDeliveryFailures.markConnectorUnavailable(
+        integration,
+        'Slack connector secret key is unavailable',
+      );
+    }
   }
   return unavailable.length;
 };
diff --git a/backend/services/slackApi.ts b/backend/services/slackApi.ts
index 6ee05d3fc9..b951a102fb 100644
--- a/backend/services/slackApi.ts
+++ b/backend/services/slackApi.ts
@@ -40,6 +40,25 @@ class SlackApi {
     });
   }
 
+  /**
+   * Slack mrkdwn treats `&`, `<` and `>` as markup: `<https://x|label>` renders
+   * as a link and `<!channel>` as a mention, so a pod name or a message body
+   * that reaches a human's DM unescaped can be made to say what the bot never
+   * said. It lives here, one step above the single call that posts, so an
+   * escaped call site cannot sit beside an unescaped one in the same file —
+   * which is how this recurred in two of them (wren 73822, vera 73824).
+   *
+   * `??` rather than `||`: a missing value must render as nothing, while a
+   * legitimate `0` or `false` still renders as itself. `String(undefined)` is
+   * the string "undefined", which a human reads as a bug.
+   */
+  static escapeSlackMrkdwn(value: unknown): string {
+    return String(value ?? '')
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;');
+  }
+
   async postMessage(channel: string, text: string, blocks?: unknown, threadTs?: string): Promise<PostMessageResponse> {
     const res = await this.client.post<PostMessageResponse>('/chat.postMessage', {
       channel,
diff --git a/backend/services/slackBridgeService.ts b/backend/services/slackBridgeService.ts
index df38e2461f..c69786af8b 100644
--- a/backend/services/slackBridgeService.ts
+++ b/backend/services/slackBridgeService.ts
@@ -8,6 +8,7 @@ const Pod = require('../models/Pod');
 const isPodMember = require('../utils/isPodMember');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const connectorSecrets = require('./connectorSecrets');
+const deliveryFailures = require('./connectorDeliveryFailureService');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const { shouldEscalate } = require('./connectorRelayPolicy');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
@@ -17,6 +18,11 @@ import { resolveDecisionCardReply } from './decisionCardReply';
 import type { ChannelCardEntry } from './decisionCardReply';
 
 const RELAY_MAP_CAP = 100;
+
+// One implementation, in slackApi.ts one step above the call that posts it. This
+// file and decisionCardReconcileService each carried their own copy, which is how
+// an escaped call site came to sit beside an unescaped one in the same ternary.
+const escapeSlackMrkdwn = SlackApi.escapeSlackMrkdwn;
 const OUTBOUND_TEXT_CAP = 900;
 const CARD_OUTBOUND_TEXT_CAP = 1_900;
 
@@ -73,13 +79,9 @@ const truncateWithEllipsis = (value: string, limit: number): string => {
   return `${value.slice(0, limit - 1)}…`;
 };
 
-// Slack mrkdwn treats these as control characters: escaping keeps agent-authored
-// card fields from creating links, mentions, or other markup in a human's DM.
-const escapeSlackMrkdwn = (raw: string): string => String(raw)
-  .replace(/&/g, '&amp;')
-  .replace(/</g, '&lt;')
-  .replace(/>/g, '&gt;');
-
+// Every field this renderer is handed goes through the shared escape: mrkdwn
+// reads &, < and > as markup, so an agent-authored card could otherwise create
+// links and mentions in a human's DM.
 export const renderSlackDecisionCard = (opts: {
   card: DecisionRelayCard;
   displayName: string;
@@ -136,7 +138,9 @@ const replyNoActivePod = async (integration: SlackIntegrationDoc): Promise<void>
   if (!chatId || !botTokenRef) return;
   try {
     const token = await connectorSecrets.get(String(botTokenRef));
-    await new SlackApi(token).postMessage(String(chatId), NO_ACTIVE_POD_REPLY);
+    // Bound channel, so this is one of the sends that may flip the connector.
+    const sent = await new SlackApi(token).postMessage(String(chatId), NO_ACTIVE_POD_REPLY);
+    await deliveryFailures.noteBoundChatDeliveryFailure(integration, chatId, sent);
   } catch (error) {
     console.warn('[slack-bridge] could not send no-active-pod reply:', (error as Error).message);
   }
@@ -224,9 +228,16 @@ export const relayAgentMessageToSlack = async (opts: {
       : `${base}/v2/pods/${podId}`;
     const text = opts.card
       ? renderSlackDecisionCard({ card: opts.card, displayName, agentUsername, link })
-      : `[${podName}] ${displayName || agentUsername}: ${String(content).slice(0, OUTBOUND_TEXT_CAP)}`;
+      // One ternary, two escape regimes: the card renderer escapes every field it
+      // is handed, this fall-through used to interpolate three of them raw. Slice
+      // before escaping — the other order can cut a `&amp;` in half.
+      : `[${escapeSlackMrkdwn(podName)}] ${escapeSlackMrkdwn(displayName || agentUsername)}: `
+        + escapeSlackMrkdwn(String(content).slice(0, OUTBOUND_TEXT_CAP));
     const result = await new SlackApi(token).postMessage(String(integration.config!.chatId), text);
     if (!result.ok || !result.ts) {
+      // Bound channel. Only an `ok: false` classifies — a missing `ts` on an
+      // otherwise successful send says nothing about reachability.
+      await deliveryFailures.noteBoundChatDeliveryFailure(integration, integration.config?.chatId, result);
       throw new Error(`chat.postMessage failed: ${String(result.error || 'unknown error')}`);
     }
     await Integration.findByIdAndUpdate(integration._id, {
@@ -336,7 +347,10 @@ export const relaySlackMessageToPod = async (opts: {
       const sent = await new SlackApi(token).postMessage(
         String(config.chatId), escapeSlackMrkdwn(cardReply.confirmation), undefined, cardReply.externalMessageId,
       );
-      if (!sent.ok) console.warn('[slack-bridge] card confirmation was not sent');
+      if (!sent.ok) {
+        console.warn('[slack-bridge] card confirmation was not sent');
+        await deliveryFailures.noteBoundChatDeliveryFailure(integration, config.chatId, sent);
+      }
     } catch (error) {
       console.warn('[slack-bridge] card confirmation failed:', (error as Error).message);
     }
diff --git a/backend/services/telegramBridgeService.ts b/backend/services/telegramBridgeService.ts
index 40bd412f67..5af9b46f14 100644
--- a/backend/services/telegramBridgeService.ts
+++ b/backend/services/telegramBridgeService.ts
@@ -24,6 +24,7 @@ const IntegrationModel = require('../models/Integration');
 const isPodMember = require('../utils/isPodMember');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const telegramSend = require('./telegramService');
+const deliveryFailures = require('./connectorDeliveryFailureService');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
 const { shouldEscalate } = require('./connectorRelayPolicy');
 // eslint-disable-next-line @typescript-eslint/no-require-imports, global-require
@@ -63,10 +64,10 @@ interface TelegramIntegrationDoc {
   };
 }
 
-const escapeHtml = (raw: string): string => String(raw)
-  .replace(/&/g, '&amp;')
-  .replace(/</g, '&lt;')
-  .replace(/>/g, '&gt;');
+// This escape moved into telegramService, beside the `parse_mode: 'HTML'` it
+// exists for, and is imported back: one Telegram escape for the whole backend
+// rather than a copy per module (wren 73790).
+const { escapeHtml } = telegramSend;
 
 export { shouldEscalate };
 
@@ -201,7 +202,9 @@ const replyNoActivePod = async (integration: TelegramIntegrationDoc): Promise<vo
   const chatId = integration.config?.chatId;
   if (!botToken || !chatId) return;
   try {
-    await telegramSend.sendMessage(botToken, chatId, NO_ACTIVE_POD_REPLY);
+    // Bound chat, so this is one of the four sends that may flip the connector.
+    const sent = await telegramSend.sendMessage(botToken, chatId, NO_ACTIVE_POD_REPLY);
+    await deliveryFailures.noteBoundChatDeliveryFailure(integration, chatId, sent);
   } catch (error) {
     console.warn('[tg-bridge] could not send no-active-pod reply:', (error as Error).message);
   }
@@ -284,7 +287,12 @@ export const relayAgentMessageToTelegram = async (opts: {
 
     const result = await telegramSend.sendMessage(botToken, chatId, text);
     const tgMessageId = result && result.messageId != null ? String(result.messageId) : null;
-    if (!tgMessageId) return;
+    if (!tgMessageId) {
+      // The silent half of row D: this used to return with no trace at all, so a
+      // blocked bot left the connector looking healthy while replies vanished.
+      await deliveryFailures.noteBoundChatDeliveryFailure(integration, chatId, result);
+      return;
+    }
 
     await IntegrationModel.findByIdAndUpdate(integration._id, {
       $push: {
@@ -407,7 +415,10 @@ export const relayTelegramMessageToPod = async (opts: {
         process.env.TELEGRAM_BOT_TOKEN, integration.config?.chatId, cardReply.confirmation,
         { replyToMessageId: cardReply.externalMessageId, plainText: true },
       );
-      if (!sent?.success) console.warn('[tg-bridge] card confirmation was not sent');
+      if (!sent?.success) {
+        console.warn('[tg-bridge] card confirmation was not sent');
+        await deliveryFailures.noteBoundChatDeliveryFailure(integration, integration.config?.chatId, sent);
+      }
     } catch (error) {
       console.warn('[tg-bridge] card confirmation failed:', (error as Error).message);
     }
diff --git a/backend/services/telegramService.ts b/backend/services/telegramService.ts
index a186cf9be6..dc35d4f2dc 100644
--- a/backend/services/telegramService.ts
+++ b/backend/services/telegramService.ts
@@ -3,12 +3,32 @@ import axios from 'axios';
 interface SendResult {
   success: boolean;
   error?: string;
+  // Telegram's own error_code and description, passed through unchanged for
+  // callers that classify delivery failures. This service decides nothing: a
+  // 400 "chat not found" and a 400 "can't parse entities" look identical here
+  // and mean opposite things to a caller, so the meaning stays at the call site
+  // (wren 73777) — which chat a send targets is a property of the call site, not
+  // of the message text.
+  errorCode?: number;
+  description?: string;
   // Telegram's message_id for the sent message — the bridge stores it to
   // route quote-replies back to the agent whose line was quoted. Absent on
   // failure; existing callers that only read `success` are unaffected.
   messageId?: number;
 }
 
+// Every text interpolated into `parse_mode: 'HTML'` below must be escaped: a pod
+// named `A <b>` makes Telegram reject the whole send with 400 "can't parse
+// entities", and the bind confirmation that carries the pod name must never be
+// lost that way (wren 73778). Lives beside the parse_mode it exists for so the
+// route and the bridge share one implementation instead of a fourth copy.
+// `?? ''` and not `||`: the pair with Slack's escaper, so an absent value
+// renders as nothing rather than as the literal `null`/`undefined` (vera 73849).
+const escapeHtml = (raw: string): string => String(raw ?? '')
+  .replace(/&/g, '&amp;')
+  .replace(/</g, '&lt;')
+  .replace(/>/g, '&gt;');
+
 async function sendMessage(botToken: string, chatId: string | number, text: string, options?: {
   replyToMessageId?: string;
   plainText?: boolean;
@@ -34,13 +54,21 @@ async function sendMessage(botToken: string, chatId: string | number, text: stri
       messageId: response.data?.result?.message_id,
     };
   } catch (error) {
-    const err = error as { response?: { data: unknown }; message: string };
+    const err = error as {
+      response?: { data?: { error_code?: number; description?: string } };
+      message: string;
+    };
     console.error(
       'Error sending Telegram message:',
       err.response?.data || err.message,
     );
-    return { success: false, error: err.message };
+    return {
+      success: false,
+      error: err.message,
+      errorCode: err.response?.data?.error_code,
+      description: err.response?.data?.description,
+    };
   }
 }
 
-export { sendMessage };
+export { sendMessage, escapeHtml };
diff --git a/docs/design/evidence/row-d-connector-error-reason-1200-after.png b/docs/design/evidence/row-d-connector-error-reason-1200-after.png
new file mode 100644
index 0000000000..5a2e3b07ab
Binary files /dev/null and b/docs/design/evidence/row-d-connector-error-reason-1200-after.png differ
diff --git a/docs/design/evidence/row-d-connector-error-reason-1200-before.png b/docs/design/evidence/row-d-connector-error-reason-1200-before.png
new file mode 100644
index 0000000000..4b96464984
Binary files /dev/null and b/docs/design/evidence/row-d-connector-error-reason-1200-before.png differ
diff --git a/docs/design/evidence/row-d-connector-error-reason-390-after.png b/docs/design/evidence/row-d-connector-error-reason-390-after.png
new file mode 100644
index 0000000000..20a2d4cc19
Binary files /dev/null and b/docs/design/evidence/row-d-connector-error-reason-390-after.png differ
diff --git a/docs/design/evidence/row-d-connector-error-reason-390-before.png b/docs/design/evidence/row-d-connector-error-reason-390-before.png
new file mode 100644
index 0000000000..bdda355227
Binary files /dev/null and b/docs/design/evidence/row-d-connector-error-reason-390-before.png differ
diff --git a/frontend/src/v2/__tests__/V2ConnectorsPage.test.tsx b/frontend/src/v2/__tests__/V2ConnectorsPage.test.tsx
index 10f597ee7c..8b4203ac34 100644
--- a/frontend/src/v2/__tests__/V2ConnectorsPage.test.tsx
+++ b/frontend/src/v2/__tests__/V2ConnectorsPage.test.tsx
@@ -449,6 +449,43 @@ describe('V2ConnectorsPage', () => {
     expect(screen.getByRole('button', { name: /Really remove/ })).toBeInTheDocument();
   });
 
+  it('names the reason a connector needs attention when the server sent one', async () => {
+    // The row's line is the only place a person sees why relaying stopped. A
+    // classified permanent failure writes `errorMessage`; the generic sentence
+    // is the fallback for everything else, not a replacement for it.
+    const reason = 'Telegram stopped delivering: the bot was blocked or removed from this chat.';
+    mockGets([{
+      _id: 'i-tg-error', installationId: 'install-tg-u1', type: 'telegram', status: 'error', errorMessage: reason,
+      // The flag is what makes the message readable to a person: it is set by
+      // connectorDeliveryFailureService, the writer that owns the pair.
+      errorMessageUserFacing: true,
+      config: { chatTitle: 'Ops chat', liveRelay: true },
+      podId: { _id: 'p1', name: 'Rewire Live Demo' },
+    }]);
+    renderPage();
+
+    expect((await screen.findAllByText(reason)).length).toBeGreaterThan(0);
+    expect(screen.queryByText('The connection dropped.')).toBeNull();
+  });
+
+  it('does not print a provider error text in a connector row, only a message written for a person (vera 73848)', async () => {
+    // `Integration.errorMessage` has an older writer: externalFeedService copies
+    // a provider's response, or a raw exception message, into it for the `x` and
+    // `instagram` rows. Those rows reach this same error branch, so a value in
+    // the field is not permission to render it — `errorMessageUserFacing` is,
+    // and it is absent here. The row still shows the generic sentence.
+    const raw = 'connect ECONNREFUSED 10.4.4.7:443';
+    mockGets([{
+      _id: 'i-x-error', installationId: 'install-x-u1', type: 'x', status: 'error', errorMessage: raw,
+      config: { chatTitle: 'Feed' },
+      podId: { _id: 'p1', name: 'Rewire Live Demo' },
+    }]);
+    renderPage();
+
+    expect((await screen.findAllByText('The connection dropped.')).length).toBeGreaterThan(0);
+    expect(screen.queryByText(raw)).toBeNull();
+  });
+
   it('derives the installable lifecycle target from the connector row type', () => {
     expect(installableLifecyclePath('slack')).toBe('/api/installables/slack/install');
   });
diff --git a/frontend/src/v2/components/V2ConnectorsPage.tsx b/frontend/src/v2/components/V2ConnectorsPage.tsx
index 85120a2b35..bc9683dfb1 100644
--- a/frontend/src/v2/components/V2ConnectorsPage.tsx
+++ b/frontend/src/v2/components/V2ConnectorsPage.tsx
@@ -43,6 +43,13 @@ interface Connector {
   installationId?: string;
   type: string;
   status: string;
+  // A reason this connector needs attention. Two writers share the field: our
+  // own classifier, and externalFeedService, which copies a provider's error
+  // text or a raw `err.message` in here. `errorMessageUserFacing` is what tells
+  // them apart, and only a message written for a person is rendered — the field
+  // holding a value is not permission to show it (vera 73848).
+  errorMessage?: string | null;
+  errorMessageUserFacing?: boolean;
   scope?: 'user' | 'pod';
   isActive?: boolean;
   createdAt?: string;
@@ -613,7 +620,9 @@ const V2ConnectorsPage: React.FC = () => {
         actionLabel: isTelegram ? t('connectors.newCode', { defaultValue: 'New code' }) : t('connectors.slackAuthorize', { defaultValue: 'Authorize in Slack' }),
         detail: t('connectors.errorReconnect', { defaultValue: 'reconnect to resume' }),
         dot: 'empty',
-        line: t('connectors.errorLine', { defaultValue: 'The connection dropped.' }),
+        line: connector.errorMessageUserFacing && connector.errorMessage
+          ? connector.errorMessage
+          : t('connectors.errorLine', { defaultValue: 'The connection dropped.' }),
         pulse: false,
         when: ageLine('since', connector.updatedAt || connector.createdAt),
       };