refactor: harden plugin install flow and main DM route pinning

src/channels/session.test.ts

@@ -103,4 +103,32 @@ describe("recordInboundSession", () => {
       }),
     );
   });
+
+  it("skips last-route updates when main DM owner pin mismatches sender", async () => {
+    const { recordInboundSession } = await import("./session.js");
+    const onSkip = vi.fn();
+
+    await recordInboundSession({
+      storePath: "/tmp/openclaw-session-store.json",
+      sessionKey: "agent:main:telegram:1234:thread:42",
+      ctx,
+      updateLastRoute: {
+        sessionKey: "agent:main:main",
+        channel: "telegram",
+        to: "telegram:1234",
+        mainDmOwnerPin: {
+          ownerRecipient: "1234",
+          senderRecipient: "9999",
+          onSkip,
+        },
+      },
+      onRecordError: vi.fn(),
+    });
+
+    expect(updateLastRouteMock).not.toHaveBeenCalled();
+    expect(onSkip).toHaveBeenCalledWith({
+      ownerRecipient: "1234",
+      senderRecipient: "9999",
+    });
+  });
 });