@vellumai/assistant 0.11.8 → 0.11.9-staging.1

package/src/monitoring/recovery/__tests__/stranded-delivery-events.test.ts

@@ -0,0 +1,208 @@
+import { rmSync } from "node:fs";
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { getDb, getSqliteFrom } from "../../../persistence/db-connection.js";
+import { initializeDb } from "../../../persistence/db-init.js";
+import {
+  getDaemonBootTimePath,
+  recordDaemonBootTime,
+} from "../../daemon-boot-time.js";
+import { recoverStrandedDeliveryEvents } from "../stranded-delivery-events.js";
+
+await initializeDb();
+
+/** Payload shape of an event whose turn ran and whose delivery is owed. */
+const DELIVERABLE_PAYLOAD = JSON.stringify({
+  content: "hello",
+  replyCallbackUrl: "https://gateway.local/deliver/slack?threadTs=1.2",
+  externalChatId: "C123",
+  replyMessageId: "assistant-row-1",
+});
+
+/** Payload shape of an intercept-settled event (no reply delivery owed). */
+const INTERCEPT_PAYLOAD = JSON.stringify({
+  content: "reaction",
+  replyCallbackUrl: "https://gateway.local/deliver/slack?threadTs=1.2",
+});
+
+// Seed rows via raw SQL rather than delivery-crud / conversation-crud helpers:
+// those modules are `mock.module`-replaced by other test files, and bun's mocks
+// are process-global, so depending on them here makes this file fail when
+// co-run with a mocking file. Raw SQL against the shared DB is isolation-proof.
+function seedEvent(
+  id: string,
+  opts: {
+    createdAt: number;
+    processingStatus: string;
+    deliveryStatus: string;
+    rawPayload: string | null;
+  },
+): string {
+  const db = getSqliteFrom(getDb());
+  const conversationId = `conv-${id}`;
+  db.query(
+    `INSERT INTO conversations (id, created_at, updated_at) VALUES (?, ?, ?)`,
+  ).run(conversationId, opts.createdAt, opts.createdAt);
+  db.query(
+    `INSERT INTO channel_inbound_events
+       (id, source_channel, external_chat_id, external_message_id,
+        conversation_id, delivery_status, processing_status, processing_attempts,
+        delivery_attempts, retry_after, raw_payload, delivered_segment_count,
+        created_at, updated_at)
+     VALUES (?, 'slack', ?, ?, ?, ?, ?, 0, 0, NULL, ?, 0, ?, ?)`,
+  ).run(
+    id,
+    `chat-${id}`,
+    `msg-${id}`,
+    conversationId,
+    opts.deliveryStatus,
+    opts.processingStatus,
+    opts.rawPayload,
+    opts.createdAt,
+    opts.createdAt,
+  );
+  return id;
+}
+
+function statusOf(eventId: string): {
+  delivery_status: string;
+  retry_after: number | null;
+} {
+  return getSqliteFrom(getDb())
+    .query(
+      `SELECT delivery_status, retry_after
+         FROM channel_inbound_events WHERE id = ?`,
+    )
+    .get(eventId) as { delivery_status: string; retry_after: number | null };
+}
+
+describe("recoverStrandedDeliveryEvents", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM channel_inbound_events");
+    db.run("DELETE FROM messages");
+    db.run("DELETE FROM conversation_keys");
+    db.run("DELETE FROM conversations");
+    rmSync(getDaemonBootTimePath(), { force: true });
+  });
+
+  test("promotes a pre-boot processed event whose delivery never finalized", () => {
+    const bootTime = Date.now();
+    recordDaemonBootTime(bootTime);
+
+    const eventId = seedEvent("stranded", {
+      createdAt: bootTime - 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "pending",
+      rawPayload: DELIVERABLE_PAYLOAD,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    const row = statusOf(eventId);
+    expect(row.delivery_status).toBe("failed"); // the delivery-retry arm selects it
+    expect(row.retry_after).not.toBeNull();
+  });
+
+  test("leaves a processed+pending event created after boot (a live delivery owns it)", () => {
+    const bootTime = Date.now();
+    recordDaemonBootTime(bootTime);
+
+    const eventId = seedEvent("live", {
+      createdAt: bootTime + 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "pending",
+      rawPayload: DELIVERABLE_PAYLOAD,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    expect(statusOf(eventId).delivery_status).toBe("pending");
+  });
+
+  test("leaves intercept-settled events whose payload names no reply (no delivery owed)", () => {
+    const bootTime = Date.now();
+    recordDaemonBootTime(bootTime);
+
+    const eventId = seedEvent("intercept", {
+      createdAt: bootTime - 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "pending",
+      rawPayload: INTERCEPT_PAYLOAD,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    expect(statusOf(eventId).delivery_status).toBe("pending");
+  });
+
+  test("leaves a stranded-looking event with no stored payload (cannot be redelivered)", () => {
+    const bootTime = Date.now();
+    recordDaemonBootTime(bootTime);
+
+    const eventId = seedEvent("no-payload", {
+      createdAt: bootTime - 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "pending",
+      rawPayload: null,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    expect(statusOf(eventId).delivery_status).toBe("pending");
+  });
+
+  test("never touches events with a terminal delivery state", () => {
+    const bootTime = Date.now();
+    recordDaemonBootTime(bootTime);
+
+    const delivered = seedEvent("delivered", {
+      createdAt: bootTime - 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "delivered",
+      rawPayload: DELIVERABLE_PAYLOAD,
+    });
+    const deadLetter = seedEvent("dead-letter", {
+      createdAt: bootTime - 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "dead_letter",
+      rawPayload: DELIVERABLE_PAYLOAD,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    expect(statusOf(delivered).delivery_status).toBe("delivered");
+    expect(statusOf(deadLetter).delivery_status).toBe("dead_letter");
+  });
+
+  test("leaves unprocessed events to the orphaned-channel-events step", () => {
+    const bootTime = Date.now();
+    recordDaemonBootTime(bootTime);
+
+    const eventId = seedEvent("still-pending", {
+      createdAt: bootTime - 5_000,
+      processingStatus: "pending",
+      deliveryStatus: "pending",
+      rawPayload: DELIVERABLE_PAYLOAD,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    expect(statusOf(eventId).delivery_status).toBe("pending");
+  });
+
+  test("skips recovery when the daemon boot time is unavailable", () => {
+    // No recordDaemonBootTime(): without the fence a live daemon's in-flight
+    // delivery is indistinguishable from a dead process's stranded row.
+    const eventId = seedEvent("no-fence", {
+      createdAt: Date.now() - 5_000,
+      processingStatus: "processed",
+      deliveryStatus: "pending",
+      rawPayload: DELIVERABLE_PAYLOAD,
+    });
+
+    recoverStrandedDeliveryEvents();
+
+    expect(statusOf(eventId).delivery_status).toBe("pending");
+  });
+});

package/src/monitoring/recovery/db.ts

@@ -12,6 +12,7 @@ import { Database } from "bun:sqlite";
 
 import { getLogger } from "../../util/logger.js";
 import { getDbPath } from "../../util/platform.js";
+import { readDaemonBootTime } from "../daemon-boot-time.js";
 
 const log = getLogger("recovery-db");
 
@@ -37,3 +38,37 @@ export function openRecoveryDb(): Database | null {
     return null;
   }
 }
+
+/**
+ * Run one recovery step against a boot-fenced database handle.
+ *
+ * Every step reconciles rows a dead process left behind, so every step needs
+ * the same two guards first: a daemon boot time to fence against (without it
+ * a live daemon's in-flight row is indistinguishable from a dead process's
+ * orphan) and an openable database. `run` is invoked only when both hold, and
+ * the handle is closed however it returns.
+ *
+ * Steps keep their own logger and their own result logging: this owns the
+ * preconditions and the handle's lifetime, not what a step does or says.
+ * A throw propagates to the orchestrator, which treats it as "schema not
+ * ready yet" and retries on the next monitor run.
+ */
+export function withBootFencedRecoveryDb(
+  step: string,
+  run: (db: Database, bootTime: number) => void,
+): void {
+  const bootTime = readDaemonBootTime();
+  if (bootTime == null) {
+    log.warn({ step }, "Skipping recovery step: daemon boot time unavailable");
+    return;
+  }
+  const db = openRecoveryDb();
+  if (db == null) {
+    return;
+  }
+  try {
+    run(db, bootTime);
+  } finally {
+    db.close();
+  }
+}

package/src/monitoring/recovery/orphaned-channel-events.ts

@@ -25,30 +25,13 @@
  */
 
 import { getLogger } from "../../util/logger.js";
-import { readDaemonBootTime } from "../daemon-boot-time.js";
-import { openRecoveryDb } from "./db.js";
+import { withBootFencedRecoveryDb } from "./db.js";
 
 const log = getLogger("recovery-orphaned-channel-events");
 
 export function recoverOrphanedChannelEvents(): void {
-  const bootTime = readDaemonBootTime();
-  if (bootTime == null) {
-    // Without the fence we cannot tell a dead process's orphan from a live
-    // daemon's just-arrived pending row, so skip; the next restart reconciles.
-    log.warn(
-      "Skipping orphaned-channel-event recovery — daemon boot time unavailable",
-    );
-    return;
-  }
-
-  const db = openRecoveryDb();
-  if (db == null) {
-    return;
-  }
-  try {
+  withBootFencedRecoveryDb("orphaned-channel-events", (db, bootTime) => {
     const now = Date.now();
-    // Throws here (missing column) propagate to the orchestrator as "schema not
-    // ready yet" and retry on the next monitor run.
     const result = db
       .query(
         `UPDATE channel_inbound_events
@@ -66,7 +49,5 @@ export function recoverOrphanedChannelEvents(): void {
         "Promoted orphaned pending channel events onto the retry sweep",
       );
     }
-  } finally {
-    db.close();
-  }
+  });
 }

package/src/monitoring/recovery/run-recovery.ts

@@ -5,9 +5,11 @@
  * path runs here instead, in the resource-monitor process, off the daemon's
  * event loop. It lists a set of recovery steps and runs each ONCE, shortly
  * after the monitor starts — this is crash recovery, not a periodic sweep.
- * Each step owns the database file it needs and its own logging; the
+ * Each step owns its own reconciliation query and its own logging; the
  * orchestrator only sequences them and isolates one step's failure from the
- * next.
+ * next. The preconditions every step shares, a daemon boot time to fence
+ * against and an openable handle to close afterwards, live in
+ * `withBootFencedRecoveryDb`.
  *
  * Steps run in order; new reconciliations plug in by adding a
  * {@link RecoveryStep} to `RECOVERY_STEPS`. `clear-stale-processing` runs
@@ -19,6 +21,7 @@ import { getLogger } from "../../util/logger.js";
 import { recoverInflightContent } from "./inflight-content.js";
 import { recoverOrphanedChannelEvents } from "./orphaned-channel-events.js";
 import { clearStaleProcessing } from "./stale-processing.js";
+import { recoverStrandedDeliveryEvents } from "./stranded-delivery-events.js";
 
 const log = getLogger("recovery");
 
@@ -38,6 +41,7 @@ const RECOVERY_STEPS: RecoveryStep[] = [
   { name: "clear-stale-processing", run: clearStaleProcessing },
   { name: "inflight-content", run: recoverInflightContent },
   { name: "orphaned-channel-events", run: recoverOrphanedChannelEvents },
+  { name: "stranded-delivery-events", run: recoverStrandedDeliveryEvents },
 ];
 
 /**

package/src/monitoring/recovery/stale-processing.ts

@@ -24,27 +24,12 @@
  */
 
 import { getLogger } from "../../util/logger.js";
-import { readDaemonBootTime } from "../daemon-boot-time.js";
-import { openRecoveryDb } from "./db.js";
+import { withBootFencedRecoveryDb } from "./db.js";
 
 const log = getLogger("recovery-stale-processing");
 
 export function clearStaleProcessing(): void {
-  const bootTime = readDaemonBootTime();
-  if (bootTime == null) {
-    // Without the boot-time fence we can't distinguish a dead process's flag
-    // from a live turn's, so skip; the next daemon restart reconciles.
-    log.warn("Skipping stale-processing clear — daemon boot time unavailable");
-    return;
-  }
-
-  const db = openRecoveryDb();
-  if (db == null) {
-    return;
-  }
-  try {
-    // Throws here (missing `processing_started_at` column) propagate to the
-    // orchestrator as "schema not ready yet" and retry on the next monitor run.
+  withBootFencedRecoveryDb("stale-processing", (db, bootTime) => {
     const result = db
       .query(
         `UPDATE conversations
@@ -59,7 +44,5 @@ export function clearStaleProcessing(): void {
         "Cleared stale conversation processing flags from a previous process",
       );
     }
-  } finally {
-    db.close();
-  }
+  });
 }

package/src/monitoring/recovery/stranded-delivery-events.ts

@@ -0,0 +1,68 @@
+/**
+ * Recovery step: promote channel inbound events stranded between processing
+ * and delivery onto the delivery-retry sweep after a crash.
+ *
+ * A channel turn is marked `processing_status = 'processed'` the moment its
+ * agent turn persists (`markProcessed` in `inbound-stages/background-dispatch.ts`),
+ * but its reply delivery finalizes afterwards, in memory, ending in
+ * `markDeliveryDelivered` / `recordDeliveryFailure`. A daemon that dies inside
+ * that window leaves the row `processed` + `delivery_status = 'pending'`, and
+ * nothing recovers it: the delivery-retry sweep selects only
+ * `delivery_status = 'failed'`, and `recoverOrphanedChannelEvents` only
+ * promotes `processing_status = 'pending'` rows. The user-visible symptom is
+ * either a reply that never reaches the channel (durable delivery had not run
+ * yet) or, when the reply had already streamed live into Slack, a delivered
+ * message whose assistant row never gains its sent-message id
+ * (`slackMeta.channelTs` / `providerMeta.messageId`), which drops the row out
+ * of every projection keyed on that id.
+ *
+ * This step, run once from the monitor process at startup, promotes those
+ * orphans to `delivery_status = 'failed'` with an immediate `retry_after` so
+ * the existing delivery-retry arm of the sweep re-delivers from the stored
+ * payload. That arm is idempotent against a reply that already streamed: the
+ * `slackStreamMessageTs` breadcrumb makes it edit the visible message in
+ * place, and the sent-message-id reconciliation stamps the row. Guards:
+ *
+ *   - **Boot-time fence.** Only rows created BEFORE this daemon booted are
+ *     touched. A newer row belongs to a live turn on the running daemon;
+ *     promoting it would let the sweep race the in-flight delivery. Mirrors
+ *     `recoverOrphanedChannelEvents`.
+ *   - **Delivery must actually be owed.** `processed` + `pending` is the
+ *     normal terminal state for events the inbound intercepts settle without
+ *     a reply delivery (reactions, edits, deletes, admission denials), so the
+ *     promotion requires the payload keys only the turn-and-deliver path
+ *     writes: `replyCallbackUrl` (stored at ingress for deliverable turns)
+ *     AND `replyMessageId` (stored by `storeReplyMessageId` right after the
+ *     turn persists its reply row).
+ */
+
+import { getLogger } from "../../util/logger.js";
+import { withBootFencedRecoveryDb } from "./db.js";
+
+const log = getLogger("recovery-stranded-delivery-events");
+
+export function recoverStrandedDeliveryEvents(): void {
+  withBootFencedRecoveryDb("stranded-delivery-events", (db, bootTime) => {
+    const now = Date.now();
+    const result = db
+      .query(
+        `UPDATE channel_inbound_events
+            SET delivery_status = 'failed',
+                retry_after = ?,
+                updated_at = ?
+          WHERE processing_status = 'processed'
+            AND delivery_status = 'pending'
+            AND raw_payload IS NOT NULL
+            AND json_extract(raw_payload, '$.replyCallbackUrl') IS NOT NULL
+            AND json_extract(raw_payload, '$.replyMessageId') IS NOT NULL
+            AND created_at < ?`,
+      )
+      .run(now, now, bootTime);
+    if (result.changes > 0) {
+      log.info(
+        { promoted: result.changes, bootTime },
+        "Promoted stranded processed channel events onto the delivery-retry sweep",
+      );
+    }
+  });
+}

package/src/notifications/AGENTS.md

@@ -2,11 +2,11 @@
 
 All notification producers **MUST** go through `emitNotificationSignal()` in `notifications/emit-signal.ts`. Do not bypass the pipeline by broadcasting events directly -- the pipeline handles event persistence, deduplication, decision routing, and delivery audit.
 
-Guardian-request cards (approvals, questions) ride this pipeline end to end -- the full lifecycle map is [docs/guardian-request-flow.md](../../docs/guardian-request-flow.md). Card actions (`actions[]`) are built **once, centrally** in the broadcaster's context resolvers (`resolveApprovalContext` / `resolveQuestionOptionsContext`); channel adapters render only. Adding buttons for a new request kind = a broadcaster context branch, never adapter parsing.
+Guardian-request cards (approvals, questions) ride this pipeline end to end -- the full lifecycle map is [docs/guardian-request-flow.md](../../docs/guardian-request-flow.md). Card actions (`actions[]`) are built **once, centrally** in the broadcaster's context resolvers (`resolveApprovalContext` / `resolveQuestionContext`); channel adapters render only. Adding buttons for a new request kind = a broadcaster context branch, never adapter parsing.
 
 When a notification flow creates a server-side conversation (e.g. guardian question conversations, task run conversations), the conversation and initial message **MUST** be persisted before the conversation-created event is emitted. This ensures the macOS/iOS client can immediately fetch the conversation contents when it receives the event.
 
-Guardian-request producers (access requests, tool approvals, tool-grant escalations, voice questions, trusted-contact confirmations) **MUST** record approval-card deliveries through `recordApprovalCardDelivery` / `recordGuardianRequestDeliveries` in `guardian-delivery-recorder.ts` -- never by calling the gateway client's `createGuardianRequestDelivery` directly. That sink is the single place the card-to-request addressing convention lives (conversation id for the in-app card; chat + channel-native `ts` for channel cards), so the path that writes a delivery row cannot drift from the paths that read it back to withdraw a card or resolve an emoji reaction -- the drift that previously fanned this logic into four divergent copies. (Tests may seed delivery rows directly for fixtures.)
+Guardian-request producers (access requests, tool approvals, tool-grant escalations, voice questions, trusted-contact confirmations) **MUST** record approval-card deliveries through `recordApprovalCardDelivery` / `recordGuardianRequestDeliveries` in `guardian-delivery-recorder.ts` -- never by calling the gateway client's `createGuardianRequestDelivery` directly. That sink is the single place the card-to-request addressing convention lives (conversation id for the in-app card; chat + channel-native `ts` for channel cards), so the path that writes a delivery row cannot drift from the paths that read it back to withdraw a card -- the drift that previously fanned this logic into four divergent copies. (Tests may seed delivery rows directly for fixtures.)
 
 Approval-card **source references** (the link back to the channel message that triggered a request) resolve only through `resolveApprovalSourceReference()` in `runtime/approval-source-link.ts` -- producers spread the result into the `guardian.question` context payload and never hand-build links. Channel-format knowledge (id shapes, permalinks, mrkdwn) lives only in `messaging/providers/<channel>/` and `notifications/adapters/<channel>`; the four-layer ownership map is documented at the top of `approval-source-link.ts`. Exception: access-request cards predate the registry and still derive their Slack permalink from payload `messageTs` in `access-request-copy.ts` -- converge them onto the registry rather than adding a third resolution path.
 

package/src/notifications/README.md

@@ -57,8 +57,8 @@ Hard invariants that the LLM cannot override:
 
 **Post-generation enforcement** (`decision-engine.ts`):
 
-- **Guardian question request-code enforcement** — `enforceGuardianRequestCode()` ensures request-code instructions (approve/reject or free-text answer) appear in all `guardian.question` notification copy, even when the LLM omits them. Exception: for approval-mode questions the Slack adapter renders an interactive card with Approve/Reject buttons, so Slack copy is instead **stripped** of request-code instructions and bare code mentions (`stripGuardianRequestCodeInstructions()`).
-- **Access-request instruction enforcement** — `enforceAccessRequestInstructions()` validates that `ingress.access_request` copy contains: (1) the request-code approve/reject directive, (2) the exact "open invite flow" phrase. If any required element is missing, the full deterministic contract text is appended. This prevents model-generated copy from dropping security-critical action directives.
+- **Guardian question reply mechanics**: `enforceGuardianRequestCode()` applies one per-channel rule, `guardianCopyCarriesReplyMechanics()` in `guardian-question-mode.ts`, to every channel's `guardian.question` copy. A channel the guardian answers by typing (Telegram, Discord, Slack answer-mode questions) gets the request-code instruction (approve/reject or free-text answer) **enforced in**, even when the LLM omitted it. A channel that acts through the request card gets it **stripped**, bare code mentions included: the vellum copy (read by the bell detail, the OS banner, and the delivery audit row), the platform push, and Slack approval-mode cards with Approve/Reject buttons. The template composer applies the same rule, so copy reaches the same shape on the fallback path.
+- **Access-request copy**: `enforceAccessRequestCopy()` strips a model's echo of the request-code directive (`Reply "X trust"`, `Reply "X verify"`, and the rest) from every channel's `ingress.access_request` copy, as whole sentences, so the directive lives only in the card's `plainTextFallback` (`buildAccessRequestReplyMechanics`), appended by a transport when it sends text without buttons. The invite-flow directive is context, not mechanics: no surface has a button for it, so it stays in `buildAccessRequestContextText` and is ensured into model-composed copy that leaves it out.
 
 **Pre-send gate checks** (`deterministic-checks.ts`) — these all depend on the decision, so they run here, after it:
 

package/src/notifications/__tests__/assistant-reply-producer.test.ts

@@ -609,20 +609,22 @@ describe("emitAssistantReplyNotification", () => {
   });
 
   // Control characters would otherwise ride into the APNs payload verbatim.
-  test("strips control characters and newlines out of the preview", async () => {
+  // Newlines stay: iOS (and other lock screens) render them as line breaks.
+  test("strips control characters and keeps line breaks in the preview", async () => {
     assistantRow = makeAssistantRow([
       { type: "text", text: "Hello\n\tthere" },
     ] as ContentBlock[]);
 
     await run();
 
-    expect(emitCalls[0].contextPayload.requestedMessage).toBe("Hello there");
+    expect(emitCalls[0].contextPayload.requestedMessage).toBe("Hello\nthere");
   });
 
-  // Blank lines and list indentation would otherwise spend the preview's
-  // length budget on whitespace. The bullets go with them: a lock screen
-  // renders the marker as literal punctuation, not as a list.
-  test("collapses whitespace runs in the preview", async () => {
+  // List indentation and extra blank lines would otherwise spend the preview's
+  // length budget on whitespace. Markdown list markers are already gone after
+  // flattening; the remaining line breaks are the structure a lock screen can
+  // render.
+  test("keeps paragraph breaks after collapsing horizontal whitespace", async () => {
     assistantRow = makeAssistantRow([
       { type: "text", text: "  Here:\n\n  - item\n  - other  " },
     ] as ContentBlock[]);
@@ -630,7 +632,7 @@ describe("emitAssistantReplyNotification", () => {
     await run();
 
     expect(emitCalls[0].contextPayload.requestedMessage).toBe(
-      "Here: item other",
+      "Here:\n\nitem\nother",
     );
   });
 
@@ -684,7 +686,7 @@ describe("emitAssistantReplyNotification", () => {
       await run();
 
       expect(emitCalls[0].contextPayload.requestedMessage).toBe(
-        "Fixed it: const a = 1;",
+        "Fixed it:\n\nconst a = 1;",
       );
     });
 
@@ -699,7 +701,7 @@ describe("emitAssistantReplyNotification", () => {
       await run();
 
       expect(emitCalls[0].contextPayload.requestedMessage).toBe(
-        "Keys Env Key dev 4Y4L",
+        "Keys\n\nEnv Key\ndev 4Y4L",
       );
     });
 

package/src/notifications/__tests__/broadcaster.test.ts

@@ -718,7 +718,7 @@ describe("NotificationBroadcaster question option actions", () => {
     expect(approval?.plainTextFallback).toContain("your answer");
   });
 
-  test("an option-less pending_question (voice) carries no card actions", async () => {
+  test("an option-less pending_question (voice) carries the typed-reply instruction and no actions", async () => {
     const { adapter, sends } = makeCapturingAdapter("platform");
     const broadcaster = new NotificationBroadcaster([adapter]);
 
@@ -735,9 +735,40 @@ describe("NotificationBroadcaster question option actions", () => {
     );
 
     expect(sends.length).toBe(1);
-    // Answer-mode without options renders as plain text with request-code
-    // instructions — no approve/reject pair is ever attached to a question.
-    expect(sends[0]?.payload.approvalContext).toBeUndefined();
+    // No buttons to draw, so the transports send text and append the
+    // instruction; an approve/reject pair is never attached to a question.
+    const approval = sends[0]?.payload.approvalContext;
+    expect(approval?.requestId).toBe("req-v1");
+    expect(approval?.actions).toEqual([]);
+    expect(approval?.intent).toBe("question");
+    expect(approval?.plainTextFallback).toBe(
+      'Reference code: DEF456. Reply "DEF456 <your answer>".',
+    );
+  });
+
+  test("a coded question that fails strict parsing still carries its typed-reply instruction", async () => {
+    const { adapter, sends } = makeCapturingAdapter("platform");
+    const broadcaster = new NotificationBroadcaster([adapter]);
+
+    await broadcaster.broadcastDecision(
+      questionSignal({
+        requestKind: "pending_question",
+        requestId: "req-lenient-1",
+        requestCode: "abc999",
+        // A null requester id fails the strict schema (string | undefined).
+        requesterExternalUserId: null,
+        questionText: "What time works?",
+      }),
+      decisionForPlatform(),
+    );
+
+    expect(sends.length).toBe(1);
+    const approval = sends[0]?.payload.approvalContext;
+    expect(approval?.requestId).toBe("req-lenient-1");
+    expect(approval?.actions).toEqual([]);
+    expect(approval?.plainTextFallback).toBe(
+      'Reference code: ABC999. Reply "ABC999 <your answer>".',
+    );
   });
 
   test("tool_approval payloads keep the approve/reject action pair", async () => {

package/src/notifications/__tests__/notification-utils.test.ts

@@ -1,8 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  collapseHorizontalWhitespace,
   describeMedia,
   mediaEmbeds,
+  sanitizeMultilineMessagePreview,
   stripMarkdownForPreview,
 } from "../notification-utils.js";
 
@@ -230,6 +232,35 @@ describe("mediaEmbeds", () => {
   });
 });
 
+describe("collapseHorizontalWhitespace", () => {
+  test("keeps paragraph breaks and trims line padding", () => {
+    expect(collapseHorizontalWhitespace("  Here:\n\n  item  \n  other  ")).toBe(
+      "Here:\n\nitem\nother",
+    );
+  });
+
+  test("collapses three or more newlines to one blank line", () => {
+    expect(collapseHorizontalWhitespace("a\n\n\n\nb")).toBe("a\n\nb");
+  });
+});
+
+describe("sanitizeMultilineMessagePreview", () => {
+  test("keeps newlines and strips other control characters", () => {
+    expect(sanitizeMultilineMessagePreview("Hello\n\tWorld")).toBe(
+      "Hello\nWorld",
+    );
+    expect(sanitizeMultilineMessagePreview("Test\r\nMessage")).toBe(
+      "Test\nMessage",
+    );
+  });
+
+  test("clamps to the shared preview budget", () => {
+    const result = sanitizeMultilineMessagePreview("A".repeat(250));
+    expect(result).toHaveLength(200);
+    expect(result.endsWith("…")).toBe(true);
+  });
+});
+
 describe("describeMedia", () => {
   test("names a single label", () => {
     expect(describeMedia(["cut.mp4"])).toBe("Sent cut.mp4");