@micha.bigler/ui-core-micha 2.17.0 → 2.19.0

package/src/messaging/MessagingProvider.jsx

@@ -127,7 +127,31 @@ export function applyFrame(state, frame, activeConversationId = null) {
     const message = { ...payload, conversation_id: conversationId };
     const requestId = clientRequestIdOf(message);
     const reconcilesOptimisticMessage = Boolean(requestId && Object.values(state.messages).some((item) => clientRequestIdOf(item) === requestId));
-    const messages = reconcileMessage(state.messages, message);
+    let messages = reconcileMessage(state.messages, message);
+    // reply_count/last_reply_at are viewer-independent facts (serialize_message
+    // always includes them, live-recomputed when not annotated) — bump the
+    // cached root unconditionally, regardless of who sent the reply. Spread
+    // the existing root first and only override these two fields, never
+    // rebuild the object from frame data, so thread_last_read_at (REST-only,
+    // never present on this frame) is never wiped — the merge-trap discipline
+    // MSG-3c's fixes established for exactly this failure shape.
+    //
+    // No self-send suppression here: a viewer never receives a "message"
+    // frame for their own reply in the first place — dcm's
+    // resolve_live_recipients(sender=actor) excludes the sender from the
+    // live WS fan-out (django_core_micha/messaging/services.py), so this
+    // branch structurally cannot fire for the viewer's own send. That is a
+    // dcm-side guarantee this code relies on, not something ucm re-derives —
+    // if dcm's recipient exclusion ever changes, this would need revisiting.
+    //
+    // reply_to_id only, never a client-shaped reply_to fallback — a live
+    // "message" frame is always server-shaped (serialize_message), so a
+    // reply_to fallback here would be dead-code-guessing at a payload shape
+    // no server ever sends, exactly the kind of unverified compatibility
+    // guess this workstream has twice shipped as a real bug.
+    const rootId = message.reply_to_id;
+    const root = rootId != null ? messages[rootId] : null;
+    if (root) messages = { ...messages, [rootId]: { ...root, reply_count: (root.reply_count || 0) + 1, last_reply_at: message.created_at || root.last_reply_at } };
     if (conversationId == null || String(conversationId) === String(activeConversationId) || reconcilesOptimisticMessage) return { ...state, messages };
     const unread = state.unread || EMPTY_CACHE.unread;
     const previousCount = unread.by_conversation?.[conversationId] || 0;
@@ -141,16 +165,46 @@ export function applyFrame(state, frame, activeConversationId = null) {
       },
     };
   }
-  if (frame.type === 'message_edited') return { ...state, messages: mergeById(state.messages, payload) };
+  if (frame.type === 'message_edited') {
+    // dcm's publish_messaging_event always attaches a full frame.message
+    // (serialize_message) for this event type, so `payload` already carries
+    // the message's own `.id` in practice. The explicit `id:` override below
+    // is defensive only — it keeps this branch correct even if a future
+    // producer ever omits `.message` and falls through to the raw frame,
+    // whose `conversation_id` would otherwise win idOf()'s fallback order.
+    const messageId = frame.message_id ?? payload.message_id;
+    return { ...state, messages: mergeById(state.messages, { ...payload, id: messageId }) };
+  }
   if (frame.type === 'reaction') {
     const messageId = frame.message_id ?? payload.message_id;
     const previous = state.messages[messageId] || { id: messageId };
-    return { ...state, messages: mergeById(state.messages, { ...previous, reactions: payload.reactions || frame.reactions || previous.reactions || [] }) };
+    // serialize_reactions (dcm) returns [{emoji, count}] only, never a
+    // per-viewer `reacted` flag, in any context — not REST, not frames, by
+    // design (aggregate-only). Wholesale-replacing `reactions` with the
+    // incoming server list would silently wipe every previously-known
+    // `reacted` flag on this message, not just whichever emoji changed.
+    // Merge by emoji instead: carry forward a previously-known `reacted`
+    // flag for any emoji still present in the incoming aggregate.
+    const incoming = payload.reactions || frame.reactions || previous.reactions || [];
+    const previousByEmoji = new Map((previous.reactions || []).map((reaction) => [reaction.emoji, reaction]));
+    const reactions = incoming.map((reaction) => ({ ...reaction, reacted: reaction.reacted ?? previousByEmoji.get(reaction.emoji)?.reacted ?? false }));
+    return { ...state, messages: mergeById(state.messages, { ...previous, reactions }) };
   }
   if (frame.type === 'poll_updated') {
     const messageId = frame.message_id ?? payload.message_id;
     const previous = state.messages[messageId] || { id: messageId };
-    const poll = payload.poll || frame.poll || payload;
+    const incomingPoll = payload.poll || frame.poll || payload;
+    // dcm's poll_updated frame is a viewer-independent projection
+    // (serialize_poll) — it never carries voted_option_ids, which dcm only
+    // ever adds to this viewer's own vote/create/close REST response. A
+    // frame arriving after a REST-derived vote is known must not wipe that
+    // locally-known selection; carry it forward when the frame is silent
+    // about it, never invert it from frame data that structurally can't
+    // contain it.
+    const previousVotedOptionIds = previous.poll?.voted_option_ids;
+    const poll = incomingPoll.voted_option_ids === undefined && previousVotedOptionIds
+      ? { ...incomingPoll, voted_option_ids: previousVotedOptionIds }
+      : incomingPoll;
     return { ...state, messages: mergeById(state.messages, { ...previous, poll }), polls: mergeById(state.polls, poll) };
   }
   if (frame.type === 'message_deleted') {
@@ -229,7 +283,6 @@ export function MessagingProvider({ children, filters = {}, activeConversationId
     dispatch({ type: 'conversationRead', conversationId });
     return result;
   }, [api]);
-  const markReplyThreadRead = useCallback((rootId, readAt) => api.markThreadRead(rootId, readAt), [api]);
   const openGroupConversation = useCallback(async (payload) => {
     const conversation = await api.createGroupConversation(payload);
     return updateConversation(conversation);
@@ -288,6 +341,16 @@ export function MessagingProvider({ children, filters = {}, activeConversationId
     }
   }, [api, user]);
   const patchMessage = useCallback((message) => dispatch({ type: 'messagePatched', message }), []);
+  const markReplyThreadRead = useCallback(async (rootId, readAt) => {
+    const result = await api.markThreadRead(rootId, readAt);
+    // The mark-read response's `last_read_at` maps onto the cached root
+    // message's `thread_last_read_at` field — different key names, same
+    // value; this is the only place the client ever learns this viewer's own
+    // thread receipt, since it's REST-only and never rides a realtime frame.
+    const previous = cache.messages[rootId];
+    if (previous && result?.last_read_at !== undefined) patchMessage({ ...previous, thread_last_read_at: result.last_read_at });
+    return result;
+  }, [api, cache.messages, patchMessage]);
   // Keep this API-backed action deliberately distinct from the cache-merge
   // helper above. The server remains the authority for author/moderator rights.
   const editMessage = useCallback(async (messageId, patch) => {
@@ -324,7 +387,14 @@ export function MessagingProvider({ children, filters = {}, activeConversationId
     patchMessage({ ...message, reactions: nextReactions });
     try {
       const result = active ? await api.removeReaction(messageId, emoji) : await api.addReaction(messageId, emoji);
-      patchMessage({ ...message, ...(result?.message || result), reactions: result?.reactions || result?.message?.reactions || nextReactions });
+      // Same aggregate-only shape as the realtime `reaction` frame (serialize_reactions
+      // never returns a per-viewer `reacted` flag) — merge the server's confirmed
+      // counts with the reacted flags nextReactions already computed correctly,
+      // rather than letting the reacted-less server array wipe them.
+      const confirmedCounts = result?.reactions || result?.message?.reactions;
+      const nextByEmoji = new Map(nextReactions.map((reaction) => [reaction.emoji, reaction]));
+      const reactions = confirmedCounts ? confirmedCounts.map((reaction) => ({ ...reaction, reacted: reaction.reacted ?? nextByEmoji.get(reaction.emoji)?.reacted ?? false })) : nextReactions;
+      patchMessage({ ...message, ...(result?.message || result), reactions });
       return result;
     } catch (error) { patchMessage(message); throw error; }
   }, [api, cache.messages, patchMessage]);

package/src/messaging/PollCard.jsx

@@ -12,10 +12,18 @@ export function PollCard({ message, canClose: canCloseProp }) {
   const [selected, setSelected] = useState([]);
   const [error, setError] = useState(null);
   const [busy, setBusy] = useState(false);
-  useEffect(() => setSelected((poll?.options || []).filter((option) => option.selected || option.voted).map((option) => option.id)), [poll]);
+  // voted_option_ids is a view-level enrichment dcm adds ONLY to the
+  // create/vote/close poll REST responses (serialize_poll itself, every
+  // message-list/thread load, and every poll_updated realtime frame never
+  // carry it) — so it's only ever present right after this viewer's own
+  // vote/create/close action. When it's absent (a freshly loaded or
+  // frame-updated poll), there's no way to know this viewer's vote from the
+  // payload alone; default to no selection rather than guessing or carrying
+  // over stale local state.
+  useEffect(() => setSelected(poll?.voted_option_ids ? [...poll.voted_option_ids] : []), [poll]);
   if (!poll) return null;
   const closed = Boolean(poll.closed_at);
-  const creatorId = poll.created_by?.id ?? poll.created_by;
+  const creatorId = poll.created_by_id ?? poll.created_by?.id ?? poll.created_by;
   const canClose = canCloseProp ?? poll.can_close ?? message?.can_close ?? message?.permissions?.can_close ?? (creatorId != null && creatorId === currentUser?.id);
   const changeSelection = (id) => setSelected((current) => poll.allow_multiple ? (current.includes(id) ? current.filter((value) => value !== id) : [...current, id]) : (current.includes(id) ? [] : [id]));
   const vote = async () => {
@@ -29,7 +37,15 @@ export function PollCard({ message, canClose: canCloseProp }) {
   };
   return <Paper variant="outlined" sx={{ p: 1 }} aria-label={t('MessagingPoll.LABEL')}><Stack spacing={0.5}>
     <Typography variant="subtitle2">{poll.question}</Typography>
-    {(poll.options || []).map((option) => <FormControlLabel key={option.id} disabled={closed || busy} control={<Checkbox checked={selected.includes(option.id)} onChange={() => changeSelection(option.id)} />} label={`${option.text || option.label} (${option.vote_count ?? option.votes_count ?? 0})`} />)}
+    {(poll.options || []).map((option) => {
+      // dcm's poll projection gives voter user ids only, never names — there
+      // is no user-directory endpoint (same structural limit already
+      // established for the DM candidate list). A count is always correct;
+      // marking the viewer's own vote is derivable from voted_option_ids.
+      const votedByMe = Boolean(poll.voted_option_ids?.includes(option.id));
+      const voterCount = option.voters?.length ?? option.vote_count ?? option.votes_count ?? 0;
+      return <FormControlLabel key={option.id} disabled={closed || busy} control={<Checkbox checked={selected.includes(option.id)} onChange={() => changeSelection(option.id)} />} label={`${option.text || option.label} (${option.vote_count ?? voterCount ?? 0})${votedByMe ? ` — ${t('MessagingPoll.YOU_VOTED')}` : ''}`} />;
+    })}
     {error && <Alert severity="error" role="alert">{error}</Alert>}
     <Stack direction="row" spacing={1}><Button size="small" onClick={vote} disabled={closed || busy}>{t('MessagingPoll.VOTE')}</Button>{canClose && !closed && <Button size="small" color="warning" onClick={close} disabled={busy}>{t('MessagingPoll.CLOSE')}</Button>}{closed && <Typography variant="caption">{t('MessagingPoll.CLOSED')}</Typography>}</Stack>
   </Stack></Paper>;

package/src/messaging/Thread.jsx

@@ -1,4 +1,4 @@
-import { Alert, Box, Button, CircularProgress, Divider, Stack, Typography } from '@mui/material';
+import { Alert, Badge, Box, Button, CircularProgress, Divider, Stack, Typography } from '@mui/material';
 import { useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
@@ -9,6 +9,15 @@ import { ReadTicks } from './ReadTicks';
 
 function chronological(messages) { return [...messages].sort((left, right) => new Date(left.created_at || 0) - new Date(right.created_at || 0)); }
 function replyToId(message) { return message.reply_to_id ?? message.reply_to; }
+// last_reply_at/reply_count are viewer-independent (always on serialize_message);
+// thread_last_read_at is viewer-specific and REST-only (never on a frame — see
+// MessagingProvider.jsx's applyFrame merge-trap handling). A null receipt with
+// at least one reply counts as unread; no replies means no marker at all.
+function hasUnreadReplies(message) {
+  if (!message.reply_count) return false;
+  if (message.thread_last_read_at == null) return true;
+  return Boolean(message.last_reply_at) && new Date(message.last_reply_at) > new Date(message.thread_last_read_at);
+}
 // A still-pending optimistic row (chunk 4) has a fake `local-<requestId>` id
 // and no durable server row yet — mounting ReadTicks against it would fire a
 // getMessageReadStatus REST call for an id the server has never heard of.
@@ -92,7 +101,15 @@ export function Thread({ conversationId, onReplyTargetChange, canModerateMessage
         <Stack spacing={1}>{roots.map((message) => {
           const replies = chronological(Object.values(cache.messages).filter((item) => String(replyToId(item)) === String(message.id)));
           return <Stack key={message.id} spacing={0.75}><MessageBubble message={message} conversation={conversation} onReply={reply} onJumpToMessage={jumpToMessage} onAnnouncementLink={onAnnouncementLink} canModerateMessages={canModerateMessages}>{canShowReadTicks(message, user) && <ReadTicks messageId={message.id} conversation={conversation} />}</MessageBubble>
-            {(message.reply_count || replies.length) > 0 && <Button size="small" onClick={() => toggleReplies(message)}>{openThreads[message.id] ? t('MessagingThread.HIDE_REPLIES') : t('MessagingThread.SHOW_REPLIES', { count: message.reply_count || replies.length })}</Button>}
+            {(message.reply_count || replies.length) > 0 && (() => {
+              const unread = hasUnreadReplies(message);
+              const label = openThreads[message.id] ? t('MessagingThread.HIDE_REPLIES') : t('MessagingThread.SHOW_REPLIES', { count: message.reply_count || replies.length });
+              // MUI's Badge spreads unrecognized props (incl. aria-label) onto
+              // its own non-interactive wrapping span, not the inner control —
+              // a screen reader focuses the Button, so the accessible name
+              // must live there, not on the purely-visual dot.
+              return <Badge color="error" variant="dot" invisible={!unread}><Button size="small" aria-label={unread ? `${label} — ${t('MessagingThread.UNREAD_REPLIES')}` : undefined} onClick={() => toggleReplies(message)}>{label}</Button></Badge>;
+            })()}
             {openThreads[message.id] && <Stack spacing={0.75} sx={{ pl: 3, borderLeft: 2, borderColor: 'divider' }}>{replies.map((item) => <MessageBubble key={item.id} message={item} replyTo={message} conversation={conversation} onReply={reply} onJumpToMessage={jumpToMessage} onAnnouncementLink={onAnnouncementLink} canModerateMessages={canModerateMessages}>{canShowReadTicks(item, user) && <ReadTicks messageId={item.id} conversation={conversation} />}</MessageBubble>)}</Stack>}
             <Divider /></Stack>;
         })}</Stack>

package/tests/ConversationList.test.jsx

@@ -17,7 +17,7 @@ describe('ConversationList', () => {
   let api;
   beforeEach(() => {
     api = {
-      listConversations: vi.fn().mockResolvedValue({ results: [{ id: 1, title: 'First', unread_count: 2, last_message: { body: 'Hello' } }], next_cursor: 'opaque-cursor' }),
+      listConversations: vi.fn().mockResolvedValue({ results: [{ id: 1, title: 'First', unread_count: 2, last_message: { excerpt: 'Hello' } }], next_cursor: 'opaque-cursor' }),
       getUnreadCount: vi.fn().mockResolvedValue({ unread_count: 2, by_conversation: { 1: 2 } }),
       listMessages: vi.fn().mockResolvedValue({ results: [] }),
       archiveConversation: vi.fn().mockResolvedValue({ id: 1, archived: true }),

package/tests/messagingContractConformance.test.js

@@ -21,6 +21,33 @@ const FRAME_EXEMPTIONS = {
   thread_read_state: 'Receipt synchronisation is outside MSG-3b.',
 };
 
+const BLOCKED_LINE = /\*\*BLOCKED\*\*/;
+const VERSION_PIN = /dcm \d+\.\d+\.\d+/;
+
+// A BLOCKED row without a version pin is exactly how MSG-3b's seven blocked
+// rows went stale unnoticed: dcm shipped what they needed mid-flight and the
+// WO-end review had no cheap way to tell. This check can't know whether dcm
+// has since shipped — it only guarantees the pin exists, which is what turns
+// the re-check into a two-minute job instead of an archaeology exercise.
+function unpinnedBlockedLines(markdown) {
+  return markdown.split('\n').filter((line) => BLOCKED_LINE.test(line) && !VERSION_PIN.test(line));
+}
+
+describe('messaging deviation-doc BLOCKED entries carry a dependency version pin', () => {
+  it('every BLOCKED line in docs/messaging-deviations.md names the dcm version it was blocked at', () => {
+    const markdown = fs.readFileSync(path.join(root, 'docs', 'messaging-deviations.md'), 'utf8');
+    expect(unpinnedBlockedLines(markdown)).toEqual([]);
+  });
+
+  // Required negative case (the WO is explicit: prove the check can fail,
+  // not only that the real file happens to pass).
+  it('flags a BLOCKED line that omits the version pin', () => {
+    const unpinned = '99. **BLOCKED** — some capability with no dependency version named.';
+    const pinned = '100. **BLOCKED** (blocked as of dcm 2.37.0) — some other capability.';
+    expect(unpinnedBlockedLines(`${unpinned}\n${pinned}`)).toEqual([unpinned]);
+  });
+});
+
 describe('messaging adapter and realtime contract conformance', () => {
   it('has a caller for every API export unless it has an explicit rationale', () => {
     const apiSource = fs.readFileSync(path.join(messagingRoot, 'api.js'), 'utf8');

package/tests/messagingInteractions.test.jsx

@@ -19,7 +19,9 @@ afterEach(cleanup);
 
 describe('messaging reactions and polls', () => {
   it('round-trips add and remove reactions through the cache-backed API', async () => {
-    const api = baseApi(); api.addReaction.mockResolvedValue({ reactions: [{ emoji: '👍', count: 1, reacted: true }] }); api.removeReaction.mockResolvedValue({ reactions: [] });
+    // serialize_reactions (dcm) never returns a per-viewer `reacted` flag —
+    // {emoji, count} only, in every context.
+    const api = baseApi(); api.addReaction.mockResolvedValue({ reactions: [{ emoji: '👍', count: 1 }] }); api.removeReaction.mockResolvedValue({ reactions: [] });
     const { rerender } = render(<MessagingProvider api={api} active={false}><ReactionBar message={{ id: 7, reactions: [{ emoji: '👍', count: 1, reacted: false }] }} /></MessagingProvider>);
     fireEvent.click(screen.getByRole('button', { name: 'MessagingReactions.TOGGLE' })); await waitFor(() => expect(api.addReaction).toHaveBeenCalledWith(7, '👍'));
     rerender(<MessagingProvider api={api} active={false}><ReactionBar message={{ id: 7, reactions: [{ emoji: '👍', count: 1, reacted: true }] }} /></MessagingProvider>);

package/tests/messagingLastMessagePreview.test.jsx

@@ -0,0 +1,93 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, render, screen, waitFor } from '@testing-library/react';
+
+vi.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key) => key }) }));
+
+const realtimeSubscribers = new Map();
+vi.mock('../src/notifications/realtime', () => ({
+  useRealtime: () => ({
+    subscribe: (envelope, handler) => { realtimeSubscribers.set(envelope, handler); return () => realtimeSubscribers.delete(envelope); },
+    onReconnect: () => () => {},
+  }),
+}));
+function dispatchMessagingFrame(frame) { realtimeSubscribers.get('messaging')?.(frame); }
+
+import { ConversationList } from '../src/messaging/ConversationList';
+import { applyFrame, MessagingProvider, useMessaging } from '../src/messaging/MessagingProvider';
+
+function cache() { return { conversations: {}, messages: {}, threads: {}, polls: {}, reactions: {}, receipts: {}, unread: { unread_count: 0, by_conversation: {} }, cursors: { conversations: null, messages: {}, threads: {} } }; }
+
+afterEach(() => { cleanup(); realtimeSubscribers.clear(); });
+
+describe('last-message preview and conversation reorder', () => {
+  it('moves a conversation to the top and updates its preview from a server-shaped conversation_upsert frame', async () => {
+    const api = {
+      listConversations: vi.fn().mockResolvedValue({
+        results: [
+          { id: 1, title: 'Older', last_message_at: '2026-07-31T09:00:00Z', last_message: { excerpt: 'Old preview' } },
+          { id: 2, title: 'Newer', last_message_at: '2026-07-31T10:00:00Z', last_message: { excerpt: 'Newer preview' } },
+        ],
+        next_cursor: null,
+      }),
+      getUnreadCount: vi.fn().mockResolvedValue({ unread_count: 0, by_conversation: {} }),
+      listMessages: vi.fn().mockResolvedValue({ results: [] }),
+    };
+    render(<MessagingProvider api={api}><ConversationList /></MessagingProvider>);
+    await screen.findByText('Newer preview');
+    // Server-shaped conversation_upsert payload: serialize_conversation_core's
+    // real keys (id, last_message_at, last_message: {excerpt}), not a
+    // client-invented shape.
+    dispatchMessagingFrame({
+      envelope: 'messaging', type: 'conversation_upsert', event_id: 'evt-1', conversation_id: 1,
+      id: '1', last_message_at: '2026-07-31T12:00:00Z', last_message: { excerpt: 'Fresh reply' },
+    });
+    await screen.findByText('Fresh reply');
+    const rows = screen.getAllByRole('button').map((el) => el.textContent);
+    const olderIndex = rows.findIndex((text) => text.includes('Older'));
+    const newerIndex = rows.findIndex((text) => text.includes('Newer'));
+    expect(olderIndex).toBeGreaterThanOrEqual(0);
+    expect(olderIndex).toBeLessThan(newerIndex);
+  });
+
+  it('reflects an edited or deleted last message through a REST refresh', async () => {
+    const api = {
+      listConversations: vi.fn()
+        .mockResolvedValueOnce({ results: [{ id: 1, title: 'Chat', last_message: { excerpt: 'Original text' } }], next_cursor: null })
+        .mockResolvedValueOnce({ results: [{ id: 1, title: 'Chat', last_message: { excerpt: '' } }], next_cursor: null }),
+      getUnreadCount: vi.fn().mockResolvedValue({ unread_count: 0, by_conversation: {} }),
+      listMessages: vi.fn().mockResolvedValue({ results: [] }),
+    };
+    function Refresher() {
+      const { refreshConversations } = useMessaging();
+      return <button onClick={() => refreshConversations()}>refresh</button>;
+    }
+    render(<MessagingProvider api={api}><ConversationList /><Refresher /></MessagingProvider>);
+    await screen.findByText('Original text');
+    screen.getByText('refresh').click();
+    await waitFor(() => expect(screen.queryByText('Original text')).toBeNull());
+    await screen.findByText('MessagingList.NO_MESSAGES');
+  });
+
+  it('applies a real message_edited frame (dcm always attaches frame.message) and updates the edited body', () => {
+    const state = { ...cache(), messages: { 'msg-1': { id: 'msg-1', conversation_id: 'conv-1', body: 'Before' } } };
+    // dcm's publish_messaging_event (realtime.py) always attaches a full
+    // frame.message = serialize_message(message) for message_edited, never
+    // just {message_id} alone — verified against django_core_micha's actual
+    // realtime.py. This is the real wire shape, not a client-invented one.
+    const next = applyFrame(state, {
+      envelope: 'messaging', type: 'message_edited', event_id: 'evt-2', conversation_id: 'conv-1', message_id: 'msg-1',
+      message: { id: 'msg-1', conversation_id: 'conv-1', body: 'After edit', edited_at: '2026-07-31T12:00:00Z' },
+    }, null);
+    expect(next.messages['msg-1'].body).toBe('After edit');
+    expect(next.messages['msg-1'].edited_at).toBe('2026-07-31T12:00:00Z');
+  });
+
+  it('keys a message_edited frame by message_id defensively, even if a producer ever omitted frame.message', () => {
+    const state = { ...cache(), messages: { 'msg-1': { id: 'msg-1', conversation_id: 'conv-1', body: 'Before' } } };
+    const next = applyFrame(state, { envelope: 'messaging', type: 'message_edited', event_id: 'evt-3', conversation_id: 'conv-1', message_id: 'msg-1' }, null);
+    expect(next.messages['msg-1']).toBeTruthy();
+    expect(next.messages['conv-1']).toBeUndefined();
+  });
+});

package/tests/messagingPollRendering.test.jsx

@@ -0,0 +1,115 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+
+vi.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key, options) => options?.message ? `${key}:${options.message}` : key }) }));
+
+const realtimeSubscribers = new Map();
+vi.mock('../src/notifications/realtime', () => ({
+  useRealtime: () => ({
+    subscribe: (envelope, handler) => { realtimeSubscribers.set(envelope, handler); return () => realtimeSubscribers.delete(envelope); },
+    onReconnect: () => () => {},
+  }),
+}));
+function dispatchMessagingFrame(frame) { realtimeSubscribers.get('messaging')?.(frame); }
+
+import { AuthContext } from '../src/auth/AuthContext';
+import { PollCard } from '../src/messaging/PollCard';
+import { MessagingProvider, useMessaging } from '../src/messaging/MessagingProvider';
+
+function baseApi(overrides = {}) {
+  return {
+    listConversations: vi.fn().mockResolvedValue({ results: [] }), listMessages: vi.fn().mockResolvedValue({ results: [] }),
+    getUnreadCount: vi.fn().mockResolvedValue({ unread_count: 0, by_conversation: {} }),
+    votePoll: vi.fn(), closePoll: vi.fn(),
+    ...overrides,
+  };
+}
+
+// A genuinely server-shaped serialize_poll payload (django_core_micha
+// serializers.py:52-64): id/question/allow_multiple/closed_at/created_by_id,
+// options carry {id,text,order,vote_count,voters} — never selected/voted
+// flags, never created_by as an object. voted_option_ids is added ONLY on
+// the vote/create/close REST responses (views.py _poll_response), never here.
+function serverPoll(overrides = {}) {
+  return {
+    id: 'poll-1', question: 'Where should we meet?', allow_multiple: false, closed_at: null, created_by_id: 'user-9',
+    options: [
+      { id: 'opt-a', text: 'Library', order: 0, vote_count: 2, voters: ['user-1', 'user-2'] },
+      { id: 'opt-b', text: 'Cafe', order: 1, vote_count: 1, voters: ['user-3'] },
+    ],
+    ...overrides,
+  };
+}
+function State() { const { cache } = useMessaging(); return <output data-testid="cache">{JSON.stringify(cache)}</output>; }
+// PollCard is a "dumb" prop-driven component (matches Thread.jsx's usage,
+// which passes down cache.messages[id] directly) — it does not subscribe to
+// the cache itself. A live-frame test must read the message back out of the
+// cache, not hold a static prop, or it can never observe a frame update.
+function ConnectedPollCard({ messageId }) {
+  const { cache } = useMessaging();
+  return <PollCard message={cache.messages[messageId]} />;
+}
+
+afterEach(() => { cleanup(); realtimeSubscribers.clear(); });
+
+describe('poll rendering against the real server contract', () => {
+  it('renders question, options, vote counts and per-option voters from a server-shaped payload', () => {
+    render(<MessagingProvider api={baseApi()} active={false}><PollCard message={{ id: 'msg-1', poll: serverPoll() }} /></MessagingProvider>);
+    expect(screen.getByText('Where should we meet?')).toBeTruthy();
+    expect(screen.getByText(/Library \(2\)/)).toBeTruthy();
+    expect(screen.getByText(/Cafe \(1\)/)).toBeTruthy();
+  });
+
+  it('derives selection from voted_option_ids (REST-only) and marks the viewer\'s own vote', () => {
+    const poll = serverPoll({ voted_option_ids: ['opt-a'] });
+    render(<MessagingProvider api={baseApi()} active={false}><PollCard message={{ id: 'msg-1', poll }} /></MessagingProvider>);
+    const checkboxes = screen.getAllByRole('checkbox');
+    expect(checkboxes[0].checked).toBe(true);
+    expect(checkboxes[1].checked).toBe(false);
+    expect(screen.getByText(/Library.*MessagingPoll\.YOU_VOTED/)).toBeTruthy();
+  });
+
+  it('does not clear or invert the viewer\'s own vote when a poll_updated frame carries no voted_option_ids', async () => {
+    const api = baseApi();
+    const votedPoll = serverPoll({ voted_option_ids: ['opt-a'] });
+    render(<MessagingProvider api={api} active={false}><ConnectedPollCard messageId="msg-1" /><State /></MessagingProvider>);
+    // Seed the cache the way a real poll message arrives: a `message` frame
+    // (kind: 'poll') carrying the just-voted poll, exactly as this viewer's
+    // own castPollVote reconciliation would leave it — not a static prop the
+    // component can never observe a later frame update against.
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'message', event_id: 'seed', conversation_id: 'conv-1', message: { id: 'msg-1', conversation_id: 'conv-1', kind: 'poll', poll: votedPoll } });
+    await waitFor(() => expect(screen.getAllByRole('checkbox')[0].checked).toBe(true));
+    // The real poll_updated frame shape: payload.poll is a bare serialize_poll
+    // result (verified against services.py's _poll_updated_payload) — never
+    // carries voted_option_ids. A vote_count bump from another viewer must
+    // not touch this viewer's own selection.
+    dispatchMessagingFrame({
+      envelope: 'messaging', type: 'poll_updated', event_id: 'evt-1', conversation_id: 'conv-1', message_id: 'msg-1', poll_id: 'poll-1',
+      poll: { ...serverPoll(), options: [{ id: 'opt-a', text: 'Library', order: 0, vote_count: 3, voters: ['user-1', 'user-2', 'user-4'] }, { id: 'opt-b', text: 'Cafe', order: 1, vote_count: 1, voters: ['user-3'] }] },
+    });
+    await waitFor(() => expect(screen.getByText(/Library \(3\)/)).toBeTruthy());
+    // The frame carries no voted_option_ids at all — the viewer's REST-known
+    // vote must be carried forward, not wiped, by this update.
+    expect(screen.getAllByRole('checkbox')[0].checked).toBe(true);
+  });
+
+  it('grants close only to the poll creator (created_by_id) or a host override, never a guess from an object shape', () => {
+    const poll = serverPoll({ created_by_id: 'user-9' });
+    const { rerender } = render(<AuthContext.Provider value={{ user: { id: 'user-9' } }}><MessagingProvider api={baseApi()} active={false}><PollCard message={{ id: 'msg-1', poll }} /></MessagingProvider></AuthContext.Provider>);
+    expect(screen.getByRole('button', { name: 'MessagingPoll.CLOSE' })).toBeTruthy();
+    rerender(<AuthContext.Provider value={{ user: { id: 'user-2' } }}><MessagingProvider api={baseApi()} active={false}><PollCard message={{ id: 'msg-1', poll }} /></MessagingProvider></AuthContext.Provider>);
+    expect(screen.queryByRole('button', { name: 'MessagingPoll.CLOSE' })).toBeNull();
+    rerender(<AuthContext.Provider value={{ user: { id: 'user-2' } }}><MessagingProvider api={baseApi()} active={false}><PollCard canClose message={{ id: 'msg-1', poll }} /></MessagingProvider></AuthContext.Provider>);
+    expect(screen.getByRole('button', { name: 'MessagingPoll.CLOSE' })).toBeTruthy();
+  });
+
+  it('disables voting once the poll is closed', () => {
+    const poll = serverPoll({ closed_at: '2026-07-31T10:00:00Z' });
+    render(<MessagingProvider api={baseApi()} active={false}><PollCard message={{ id: 'msg-1', poll }} /></MessagingProvider>);
+    screen.getAllByRole('checkbox').forEach((checkbox) => expect(checkbox.disabled).toBe(true));
+    expect(screen.getByRole('button', { name: 'MessagingPoll.VOTE' }).disabled).toBe(true);
+    expect(screen.getByText('MessagingPoll.CLOSED')).toBeTruthy();
+  });
+});

package/tests/messagingReactionMerge.test.jsx

@@ -0,0 +1,79 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+
+vi.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key, options) => options?.emoji ? `${key}:${options.emoji}:${options.count}` : key }) }));
+
+const realtimeSubscribers = new Map();
+vi.mock('../src/notifications/realtime', () => ({
+  useRealtime: () => ({
+    subscribe: (envelope, handler) => { realtimeSubscribers.set(envelope, handler); return () => realtimeSubscribers.delete(envelope); },
+    onReconnect: () => () => {},
+  }),
+}));
+function dispatchMessagingFrame(frame) { realtimeSubscribers.get('messaging')?.(frame); }
+
+import { ReactionBar } from '../src/messaging/ReactionBar';
+import { MessagingProvider, useMessaging } from '../src/messaging/MessagingProvider';
+
+function baseApi(overrides = {}) {
+  return {
+    listConversations: vi.fn().mockResolvedValue({ results: [] }), listMessages: vi.fn().mockResolvedValue({ results: [] }),
+    getUnreadCount: vi.fn().mockResolvedValue({ unread_count: 0, by_conversation: {} }),
+    addReaction: vi.fn(), removeReaction: vi.fn(),
+    ...overrides,
+  };
+}
+// ReactionBar is prop-driven (matches every other messaging leaf component) —
+// a live-frame test must read the message back out of the cache.
+function ConnectedReactionBar({ messageId }) {
+  const { cache } = useMessaging();
+  return <ReactionBar message={cache.messages[messageId]} />;
+}
+
+afterEach(() => { cleanup(); realtimeSubscribers.clear(); });
+
+describe('reaction frame/REST merge against the real aggregate-only contract', () => {
+  it('an unrelated reaction frame updates its own emoji without touching the viewer\'s known reacted state on other emoji', async () => {
+    const api = baseApi();
+    render(<MessagingProvider api={api} active={false}><ConnectedReactionBar messageId="msg-1" /></MessagingProvider>);
+    // Seed: the viewer has already reacted with 👍 (locally known — e.g. from
+    // an earlier REST confirmation), the server aggregate never carries that.
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'message', event_id: 'seed', conversation_id: 'conv-1', message: { id: 'msg-1', conversation_id: 'conv-1', body: 'Hi', reactions: [{ emoji: '👍', count: 1, reacted: true }] } });
+    await waitFor(() => expect(screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:👍:1' })).toBeTruthy());
+    // A different viewer reacts with 🎉 — dcm's real reaction frame shape
+    // (serialize_reactions): {emoji, count} only, never reacted, for the
+    // WHOLE aggregate list including 👍.
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'reaction', event_id: 'evt-1', conversation_id: 'conv-1', message_id: 'msg-1', reactions: [{ emoji: '👍', count: 1 }, { emoji: '🎉', count: 1 }] });
+    await waitFor(() => expect(screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:🎉:1' })).toBeTruthy());
+    const thumbsUp = screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:👍:1' });
+    expect(thumbsUp.className.includes('MuiChip-colorPrimary')).toBe(true); // still marked as the viewer's own reaction
+  });
+
+  it('the viewer\'s own optimistic reacted flag survives its own REST confirmation, which returns an aggregate-only shape', async () => {
+    const api = baseApi({ addReaction: vi.fn().mockResolvedValue({ reactions: [{ emoji: '👍', count: 1 }] }) });
+    render(<MessagingProvider api={api} active={false}><ConnectedReactionBar messageId="msg-1" /></MessagingProvider>);
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'message', event_id: 'seed', conversation_id: 'conv-1', message: { id: 'msg-1', conversation_id: 'conv-1', body: 'Hi', reactions: [] } });
+    await waitFor(() => screen.getByLabelText('MessagingReactions.ADD'));
+    fireEvent.click(screen.getByLabelText('MessagingReactions.ADD'));
+    fireEvent.click(screen.getByText('👍'));
+    await waitFor(() => expect(api.addReaction).toHaveBeenCalledWith('msg-1', '👍'));
+    await waitFor(() => {
+      const chip = screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:👍:1' });
+      expect(chip.className.includes('MuiChip-colorPrimary')).toBe(true);
+    });
+  });
+
+  it('a duplicate event_id changes nothing', async () => {
+    const api = baseApi();
+    render(<MessagingProvider api={api} active={false}><ConnectedReactionBar messageId="msg-1" /></MessagingProvider>);
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'message', event_id: 'seed', conversation_id: 'conv-1', message: { id: 'msg-1', conversation_id: 'conv-1', body: 'Hi', reactions: [{ emoji: '👍', count: 1 }] } });
+    await waitFor(() => screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:👍:1' }));
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'reaction', event_id: 'dup-1', conversation_id: 'conv-1', message_id: 'msg-1', reactions: [{ emoji: '👍', count: 2 }] });
+    await waitFor(() => expect(screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:👍:2' })).toBeTruthy());
+    dispatchMessagingFrame({ envelope: 'messaging', type: 'reaction', event_id: 'dup-1', conversation_id: 'conv-1', message_id: 'msg-1', reactions: [{ emoji: '👍', count: 99 }] });
+    expect(screen.queryByRole('button', { name: 'MessagingReactions.TOGGLE:👍:99' })).toBeNull();
+    expect(screen.getByRole('button', { name: 'MessagingReactions.TOGGLE:👍:2' })).toBeTruthy();
+  });
+});