@vellumai/assistant 0.11.8 → 0.11.9-staging.2

package/src/runtime/routes/inbound-message-handler.ts

@@ -46,6 +46,7 @@ import { classifyDiskPressureTurnPolicy } from "../../daemon/disk-pressure-polic
 import { processMessage } from "../../daemon/process-message.js";
 import type { TrustContext } from "../../daemon/trust-context-types.js";
 import { HeartbeatService } from "../../heartbeat/heartbeat-service.js";
+import type { ProviderMessageMetadata } from "../../messaging/provider-message-metadata.js";
 import type { Message as ProviderMessage } from "../../messaging/provider-types.js";
 import { editChannelMessage } from "../../messaging/providers/index.js";
 import {
@@ -68,7 +69,10 @@ import {
   type SlackMessageMetadata,
   writeSlackMetadata,
 } from "../../messaging/providers/slack/message-metadata.js";
-import { mergeProviderMessageMetadata } from "../../messaging/read-provider-metadata.js";
+import {
+  mergeProviderMessageMetadata,
+  readProviderMetadata,
+} from "../../messaging/read-provider-metadata.js";
 import { MESSAGE_PREVIEW_MAX_LENGTH } from "../../notifications/notification-utils.js";
 import {
   attachInlineAttachmentToMessage,
@@ -91,8 +95,11 @@ import {
 import { applyDeterministicTitleIfReplaceable } from "../../persistence/conversation-title-service.js";
 import {
   clearPayload,
+  DELETE_PROVIDER_MESSAGE_ID_MAX_SCAN,
+  findMessageByProviderMessageId,
   findMessageBySourceId,
   hasInboundEventForSource,
+  hasUnreconciledOutboundRow,
   recordInbound,
 } from "../../persistence/delivery-crud.js";
 import { markProcessed } from "../../persistence/delivery-status.js";
@@ -110,6 +117,7 @@ import {
 } from "../access-request-helper.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { deliverChannelReply } from "../gateway-client.js";
+import { publishConversationMessagesChanged } from "../sync/resource-sync-events.js";
 import { trustContextFromVerdict } from "../trust-verdict-consumer.js";
 import { BadRequestError } from "./errors.js";
 import { handleApprovalInterception } from "./guardian-approval-interception.js";
@@ -149,6 +157,13 @@ const DISK_PRESSURE_REMOTE_BLOCK_REPLY =
 // EDIT_LOOKUP_RETRIES / EDIT_LOOKUP_DELAY_MS constants.
 let deleteLookupRetries = 5;
 let deleteLookupDelayMs = 2000;
+/**
+ * Attempts during which a delete with no inbound event keeps retrying the
+ * envelope lane: an assistant post's provider id lands with the post-send
+ * reconciliation, one delivery round-trip behind the post itself, so a
+ * couple of backoff steps bridge an automated deletion that outruns it.
+ */
+const deleteOutboundReconcileRetries = 2;
 
 interface SlackActorTimezoneMetadata {
   timezone?: string;
@@ -434,13 +449,13 @@ export async function handleChannelInbound({
   // pipeline (ACL, admission floor, disk-pressure, conversation binding) so a
   // 👍 never triggers a verification handshake or an access-request
   // notification, and a stranger's reaction creates no conversation/binding.
-  // The interceptor drops strangers, records known contacts' reactions as
-  // transcript signals in the conversation of the reacted message, and routes
-  // a guardian's reaction on an approval card through the guardian decision
-  // pipeline. Reactions never mint a conversation and never drive an agent
-  // turn. A family member whose payload does not resolve (no emoji or no
-  // target message id) is dropped as noise here: the kind names the family,
-  // so it must never fall through and be read as a message.
+  // The interceptor drops strangers and records an admitted actor's reaction
+  // as a transcript signal in the conversation of the reacted message.
+  // Reactions never mint a conversation; the one that wakes a turn (a
+  // reaction on the assistant's own post) is the interceptor's call. A family member whose payload does not
+  // resolve (no emoji or no target message id) is dropped as noise here:
+  // the kind names the family, so it must never fall through and be read
+  // as a message.
   if (isReactionEvent(body)) {
     const reaction = resolveInboundReactionPayload(body);
     if (!reaction) {
@@ -462,7 +477,6 @@ export async function handleChannelInbound({
       actorUsername: body.actorUsername,
       replyCallbackUrl: body.replyCallbackUrl,
       sourceMetadata: body.sourceMetadata,
-      approvalConversationGenerator,
     });
   }
 
@@ -527,10 +541,11 @@ export async function handleChannelInbound({
   // A delete names the original via `sourceMetadata.messageId` and
   // short-circuits the rest of the pipeline: no agent loop, no approval
   // routing. The stored row keeps its content for audit; rendering elides on
-  // the deletedAt marker. An attributed delete (the wire names the deleted
-  // message's author, as Slack's does) passed the ingress ACL above; an
-  // unattributed one bypassed it under the ACL's stated contract and applies
-  // only to a row this daemon ingested.
+  // the deletedAt marker. An attributed delete (the wire names a human
+  // author for the deleted message, as Slack's does for a member's post)
+  // passed the ingress ACL above; an unattributed one bypassed it under the
+  // ACL's stated contract and applies only to a row this daemon already
+  // holds for the chat.
   if (eventKind === "delete") {
     const deletedMessageTs =
       typeof sourceMetadata?.messageId === "string"
@@ -556,20 +571,38 @@ export async function handleChannelInbound({
     // that window is silently dropped and the deletion signal is lost.
     let original: { messageId: string; conversationId: string } | null = null;
     for (let attempt = 0; attempt <= deleteLookupRetries; attempt++) {
-      original = findMessageBySourceId(
-        sourceChannel,
-        conversationExternalId,
-        deletedMessageTs,
-      );
+      // Two resolution lanes, each with its own race. An inbound row's
+      // event is written before its message link lands (retried until
+      // `hasInboundEventForSource` says the source was never ingested). An
+      // assistant post opens no inbound event; its provider id is written
+      // by the post-send reconciliation, which an automated deletion can
+      // outrun, so the envelope lane retries within the same bounded
+      // window rather than giving up on the first miss.
+      original =
+        findMessageBySourceId(
+          sourceChannel,
+          conversationExternalId,
+          deletedMessageTs,
+        ) ??
+        findMessageByProviderMessageId(
+          sourceChannel,
+          conversationExternalId,
+          deletedMessageTs,
+        );
       if (original) {
         break;
       }
-      // The retry window exists for one race: the original's inbound-event
-      // row is written before its message link lands. A source with no row
-      // at all was never ingested, so nothing can appear by waiting, and
-      // waiting would hold this conversation's serialized lane through the
-      // full miss window for every unrelated delete a busy room produces.
+      // A source with no inbound row was either never ingested (nothing can
+      // appear by waiting) or is an assistant post racing its post-send id
+      // reconciliation. Only the second earns a wait, and it leaves
+      // evidence: a recent outbound row whose envelope names no id yet.
+      // Without that evidence the miss is final, so an unrelated delete in
+      // a busy room never holds the serialized lane through the window.
+      const raceStillPossible =
+        attempt < deleteOutboundReconcileRetries &&
+        hasUnreconciledOutboundRow(sourceChannel, conversationExternalId);
       if (
+        !raceStillPossible &&
         !hasInboundEventForSource(
           sourceChannel,
           conversationExternalId,
@@ -586,7 +619,7 @@ export async function handleChannelInbound({
             attempt: attempt + 1,
             maxAttempts: deleteLookupRetries,
           },
-          "Original message not linked yet, retrying delete lookup",
+          "Original message not resolved yet, retrying delete lookup",
         );
         await new Promise((resolve) =>
           setTimeout(resolve, deleteLookupDelayMs),
@@ -594,6 +627,17 @@ export async function handleChannelInbound({
       }
     }
 
+    // Recency-capped misses above could still be an OLD assistant post:
+    // deletion can target one arbitrarily far back, so the last resort is a
+    // single deep scan. Once, after the retries: age and race are exclusive
+    // (a post old enough to be past the recent window reconciled long ago).
+    original ??= findMessageByProviderMessageId(
+      sourceChannel,
+      conversationExternalId,
+      deletedMessageTs,
+      { maxScan: DELETE_PROVIDER_MESSAGE_ID_MAX_SCAN },
+    );
+
     if (!original) {
       log.debug(
         { conversationExternalId, deletedMessageTs },
@@ -618,22 +662,50 @@ export async function handleChannelInbound({
         : null;
 
     if (!existingSlackMeta) {
-      const providerMeta = mergeProviderMessageMetadata(
-        row?.metadata ?? null,
-        {
-          source: sourceChannel,
-          conversationExternalId,
-          messageId: deletedMessageTs,
-          ...(sourceMetadata?.threadId
-            ? { threadId: sourceMetadata.threadId }
-            : {}),
-        },
-        { deletedAt: Date.now() },
-      );
+      // Deletion is tracked per provider post: a split reply's row names
+      // several posts, and deleting one must not read as the whole reply
+      // vanishing. The row-level `deletedAt` lands only when every post the
+      // row names is gone; a row whose envelope names no id (a legacy row
+      // synthesized from lookup facts) is single-post by construction and
+      // keeps the direct stamp.
+      const base = readProviderMetadata(row?.metadata ?? null, {
+        allowFlatLegacy: true,
+      });
+      let providerMeta: string;
+      if (base?.messageId) {
+        const rowPostIds = [
+          base.messageId,
+          ...(base.additionalMessageIds ?? []),
+        ];
+        const deletedIds = Array.from(
+          new Set([...(base.deletedMessageIds ?? []), deletedMessageTs]),
+        );
+        const fullyDeleted = rowPostIds.every((id) => deletedIds.includes(id));
+        providerMeta = JSON.stringify({
+          ...base,
+          deletedMessageIds: deletedIds,
+          ...(fullyDeleted ? { deletedAt: Date.now() } : {}),
+        });
+      } else {
+        providerMeta = mergeProviderMessageMetadata(
+          row?.metadata ?? null,
+          {
+            source: sourceChannel,
+            conversationExternalId,
+            messageId: deletedMessageTs,
+            ...(sourceMetadata?.threadId
+              ? { threadId: sourceMetadata.threadId }
+              : {}),
+          },
+          { deletedAt: Date.now() },
+        );
+      }
       updateMessageMetadata(original.messageId, { providerMeta });
-      // The stamp lands in the store only; stale-marking makes a resident
-      // conversation's next turn reload and see the row as deleted.
+      // The stamp lands in the store only: stale-marking makes a resident
+      // conversation's next turn reload and see the row as deleted, and the
+      // invalidation makes a client showing the conversation refetch it.
       findConversation(original.conversationId)?.markHistoryStale();
+      publishConversationMessagesChanged(original.conversationId);
       log.info(
         {
           conversationExternalId,
@@ -655,6 +727,7 @@ export async function handleChannelInbound({
     // is intentionally not updated.
     updateMessageMetadata(original.messageId, { slackMeta: updatedSlackMeta });
     findConversation(original.conversationId)?.markHistoryStale();
+    publishConversationMessagesChanged(original.conversationId);
 
     log.info(
       {
@@ -1417,6 +1490,30 @@ export async function handleChannelInbound({
             }
           : undefined;
 
+      // Neutral per-row envelope for every non-Slack channel, mirroring the
+      // Slack capture above field for field: it is persisted as the row's
+      // `providerMeta` so the row can say which external message it is, in
+      // which thread, from whom. Slack keeps its own `slackMeta` envelope
+      // (mapped to the neutral shape on read), so nothing is stored twice.
+      const inboundActorDisplayName =
+        body.actorDisplayName ?? body.actorUsername;
+      const channelInbound: ProviderMessageMetadata | undefined =
+        sourceChannel !== "slack"
+          ? {
+              source: sourceChannel,
+              conversationExternalId,
+              messageId: sourceMessageId ?? externalMessageId,
+              eventKind: "message",
+              ...(channelThreadId ? { threadId: channelThreadId } : {}),
+              ...(inboundActorDisplayName
+                ? { displayName: inboundActorDisplayName }
+                : {}),
+              ...(trustCtx.requesterExternalUserId
+                ? { actorExternalId: trustCtx.requesterExternalUserId }
+                : {}),
+            }
+          : undefined;
+
       // Account identifier threaded into backfill so `resolveConnection()`
       // can pick the right workspace in multi-account setups. Best-effort:
       // the gateway forwards `sourceMetadata.account` when it knows which
@@ -1524,6 +1621,7 @@ export async function handleChannelInbound({
         clientTimezone: inboundClientTimezone,
         slackBotMentioned,
         slackInbound,
+        channelInbound,
       });
     }
   }
@@ -1775,6 +1873,15 @@ async function persistBackfilledSlackMessage(params: {
   );
   const slackTranscriptTimestampTimezone =
     resolveSlackTranscriptTimestampTimezone();
+  const slackTimezoneFields = buildSlackTimezoneMetadata({
+    actorTimezone,
+    actorTimezoneLabel,
+    actorTimezoneOffsetSeconds: message.metadata?.actorTimezoneOffsetSeconds,
+    timestampTimezone: slackTranscriptTimestampTimezone?.timestampTimezone,
+    timestampTimezoneLabel:
+      slackTranscriptTimestampTimezone?.timestampTimezoneLabel,
+    speakerTimezoneLabel: isGuardian ? undefined : actorTimezoneLabel,
+  });
   const slackMeta: SlackMessageMetadata = {
     source: "slack",
     channelId: params.channelId,
@@ -1783,15 +1890,7 @@ async function persistBackfilledSlackMessage(params: {
     ...(message.threadId ? { threadTs: message.threadId } : {}),
     ...(message.sender?.name ? { displayName: message.sender.name } : {}),
     ...(actorExternalUserId ? { actorExternalUserId } : {}),
-    ...buildSlackTimezoneMetadata({
-      actorTimezone,
-      actorTimezoneLabel,
-      actorTimezoneOffsetSeconds: message.metadata?.actorTimezoneOffsetSeconds,
-      timestampTimezone: slackTranscriptTimestampTimezone?.timestampTimezone,
-      timestampTimezoneLabel:
-        slackTranscriptTimestampTimezone?.timestampTimezoneLabel,
-      speakerTimezoneLabel: isGuardian ? undefined : actorTimezoneLabel,
-    }),
+    ...slackTimezoneFields,
     ...(slackFiles.length > 0 ? { slackFiles } : {}),
   };
 
@@ -1813,9 +1912,32 @@ async function persistBackfilledSlackMessage(params: {
     ? message.timestamp
     : undefined;
 
+  // A row the daemon authors carries the neutral envelope, Slack's own fields
+  // riding its passthrough; a person's row keeps Slack's envelope for now.
+  const envelope =
+    role === "assistant"
+      ? {
+          providerMeta: JSON.stringify({
+            source: "slack",
+            conversationExternalId: params.channelId,
+            messageId: message.id,
+            eventKind: "message",
+            ...(message.threadId ? { threadId: message.threadId } : {}),
+            ...(message.sender?.name
+              ? { displayName: message.sender.name }
+              : {}),
+            ...(actorExternalUserId
+              ? { actorExternalId: actorExternalUserId }
+              : {}),
+            ...slackTimezoneFields,
+            ...(slackFiles.length > 0 ? { slackFiles } : {}),
+          } satisfies ProviderMessageMetadata),
+        }
+      : { slackMeta: writeSlackMetadata(slackMeta) };
+
   const persisted = await addMessage(params.conversationId, role, rawText, {
     metadata: {
-      slackMeta: writeSlackMetadata(slackMeta),
+      ...envelope,
       ...(sentAt !== undefined ? { sentAt } : {}),
       provenanceTrustClass: isGuardian ? "guardian" : "unknown",
       provenanceSourceChannel: "slack",

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -131,9 +131,10 @@ export interface AclEnforcementParams {
    * The platform named no actor for this event (the id is a channel's
    * synthetic system identity). There is no identity claim to enforce, so
    * the ACL neither resolves a member nor denies: the family stage that
-   * consumes such an event applies it only to rows whose author cleared
-   * this ACL when the original message arrived. Callers set this ONLY for
-   * event kinds that cannot start an agent turn.
+   * consumes such an event applies it only to a row the daemon already
+   * holds for that chat, one ingested from an author who cleared this ACL
+   * on arrival or one the assistant posted itself. Callers set this ONLY
+   * for event kinds that cannot start an agent turn.
    */
   actorUnattributed?: boolean;
 }

package/src/runtime/routes/inbound-stages/background-dispatch.test.ts

@@ -44,6 +44,7 @@ mock.module("../../../persistence/delivery-channels.js", () => ({
 mock.module("../../../persistence/delivery-crud.js", () => ({
   linkMessage: () => {},
   storeReplyMessageId: (eventId: string, replyMessageId: string) => {
+    operationOrder.push("store-reply-id");
     storedReplyMessageIds.push({ eventId, replyMessageId });
   },
   storeStreamedReplyTs: (eventId: string, messageTs: string) => {
@@ -58,6 +59,7 @@ mock.module("../../../persistence/delivery-status.js", () => ({
     deliveredEvents.push(eventId);
   },
   markProcessed: (eventId: string) => {
+    operationOrder.push("mark-processed");
     markedProcessedEvents.push(eventId);
   },
   recordDeliveryFailure: (eventId: string) => {
@@ -111,12 +113,35 @@ mock.module("../../../messaging/providers/index.js", () => ({
     sentActivity.push(target);
     return setChannelActivityImpl(target);
   },
+  // Slack declares it can stream by implementing the method; whether a given
+  // conversation can is Slack's own answer to `start`, which is why the stub
+  // below models the refusal rather than gating before the call.
+  getTransportForCallback: () => ({
+    streamReply: () => undefined,
+    streamPersists: true,
+  }),
   sendChannelStreamOp: async (
-    _callbackUrl: string,
+    callbackUrl: string,
     _chatId: string,
     op: Record<string, unknown>,
   ) => {
     sentStreamOps.push(op);
+    // `chat.startStream` streams into a thread, and names the reader when the
+    // room has more than one, so a start lacking either is refused. Modelled
+    // here so these tests exercise the fallback the refusal produces.
+    // `chat.startStream` streams into a thread, and a room with more than one
+    // reader must name the reader, so a start lacking either is refused. Slack
+    // ids say which room this is: `D` a DM, `C` a channel. Modelled here so
+    // these tests exercise the fallback a refusal produces, rather than a gate
+    // that no longer exists above the transport.
+    if (op.action === "start") {
+      if (!callbackUrl.includes("threadTs=")) {
+        return { ok: false };
+      }
+      if (/channel=C/.test(callbackUrl) && op.audience === undefined) {
+        return { ok: false };
+      }
+    }
     return sendChannelStreamOpImpl(op);
   },
 }));
@@ -322,6 +347,37 @@ describe("processChannelMessageInBackground — reply delivery", () => {
     expect(deliveredEvents).toEqual(["evt-fast-path"]);
   });
 
+  test("stores the reply id before marking the event processed", async () => {
+    // `processed` is the point stranded-delivery recovery starts considering
+    // an event, and that step reads the reply id from the stored payload. If
+    // the event became eligible first, a crash in between would leave a row
+    // that recovery skips, so its reply would never be delivered.
+    const processMessage: MessageProcessor = async () => ({
+      messageId: "user-msg-order",
+      assistantMessageId: "assistant-msg-order",
+    });
+
+    processChannelMessageInBackground({
+      processMessage,
+      conversationId: "conv-order",
+      eventId: "evt-order",
+      content: "hello",
+      sourceChannel: "slack",
+      sourceInterface: "slack",
+      externalChatId: "C-ORDER",
+      trustCtx,
+      metadataHints: [],
+      replyCallbackUrl: "https://example.test/deliver/slack?channel=C-ORDER",
+    });
+
+    await flush();
+
+    expect(operationOrder.indexOf("store-reply-id")).toBeGreaterThanOrEqual(0);
+    expect(operationOrder.indexOf("store-reply-id")).toBeLessThan(
+      operationOrder.indexOf("mark-processed"),
+    );
+  });
+
   test("suppresses reply delivery when a deduplicated redelivery's prior attempt already delivered", async () => {
     const conversationId = "conv-dedup-delivered";
     const channelId = "C-DEDUP-DELIVERED";
@@ -351,12 +407,15 @@ describe("processChannelMessageInBackground — reply delivery", () => {
 
     await flush();
 
-    // The redelivery is recorded as processed, but the original reply is not
-    // re-delivered — no durable delivery, no terminal delivery transition.
+    // The redelivery is recorded as processed and nothing is re-posted. It
+    // still settles its OWN delivery state: the sibling owns delivery, so a
+    // row left `pending` would read as still owing one and the
+    // stranded-delivery recovery step would re-post the sibling's reply
+    // after a restart.
     expect(markedProcessedEvents).toEqual(["evt-dedup-delivered"]);
     expect(replyDeliveryCalls).toEqual([]);
-    expect(deliveredEvents).toEqual([]);
     expect(deliveredChannelReplies).toEqual([]);
+    expect(deliveredEvents).toEqual(["evt-dedup-delivered"]);
   });
 
   test("skips reply delivery when a deduplicated redelivery's prior attempt failed (sweep owns recovery)", async () => {
@@ -386,10 +445,13 @@ describe("processChannelMessageInBackground — reply delivery", () => {
 
     await flush();
 
+    // Same settlement as the delivered-sibling case. Marking THIS row
+    // delivered does not touch the sibling's `failed` status, so the sweep
+    // still owns and retries the real delivery.
     expect(markedProcessedEvents).toEqual(["evt-dedup-failed"]);
     expect(replyDeliveryCalls).toEqual([]);
-    expect(deliveredEvents).toEqual([]);
     expect(deliveredChannelReplies).toEqual([]);
+    expect(deliveredEvents).toEqual(["evt-dedup-failed"]);
   });
 
   test("recovers the reply when a deduplicated redelivery's prior attempt is stuck pending (crash window)", async () => {
@@ -510,7 +572,8 @@ describe("processChannelMessageInBackground — reply delivery", () => {
 
     await flush();
 
-    expect(slackStreamOps()).toEqual([]);
+    // A start is attempted and refused, so nothing advances past it.
+    expect(slackStreamOps().map((op) => op.action)).toEqual(["start"]);
     expect(
       deliveredChannelReplies
         .map((entry) => entry.payload.text)
@@ -566,7 +629,6 @@ describe("processChannelMessageInBackground — reply delivery", () => {
     expect(slackStreamOps()).toEqual([
       {
         action: "start",
-        anchorMessageId: threadTs,
         text: "Streamed DM reply.",
         appended: "Streamed DM reply.",
       },
@@ -648,7 +710,8 @@ describe("processChannelMessageInBackground — reply delivery", () => {
         .map((entry) => entry.payload.text)
         .filter(Boolean),
     ).toEqual([]);
-    expect(slackStreamOps()).toEqual([]);
+    // A start is attempted and refused, so nothing advances past it.
+    expect(slackStreamOps().map((op) => op.action)).toEqual(["start"]);
     expect(replyDeliveryCalls).toEqual([
       { messageId: "assistant-msg-channel-final", startFromSegment: 0 },
     ]);
@@ -889,6 +952,104 @@ describe("processChannelMessageInBackground — admission (queue if busy)", () =
     expect(markedProcessedEvents).toEqual([]);
     expect(deliveredEvents).toEqual([]);
   });
+
+  test("a busy loss with a caller fallback degrades there, never to the sweep", async () => {
+    const processMessage: MessageProcessor = async () => {
+      throw new Error(CONVERSATION_BUSY_MESSAGE);
+    };
+
+    let fellBack = 0;
+    processChannelMessageInBackground({
+      processMessage,
+      conversationId: "conv-wake-busy",
+      eventId: "evt-wake-busy",
+      content: "Alice reacted with :tada: to your message",
+      sourceChannel: "discord",
+      sourceInterface: "discord",
+      externalChatId: "999000111222333444",
+      trustCtx,
+      metadataHints: [],
+      replyCallbackUrl: "https://example.test/deliver/discord",
+      onTurnLostToBusy: async () => {
+        fellBack++;
+      },
+    });
+
+    await flush();
+
+    // The caller's event stores nothing the sweep could rebuild a turn
+    // from, so its processing lane must never see it: the degradation is
+    // the fallback alone.
+    expect(fellBack).toBe(1);
+    expect(deferredRetryEvents).toEqual([]);
+    expect(retryableFailureEvents).toEqual([]);
+    expect(processingFailureEvents).toEqual([]);
+  });
+
+  test("a non-busy failure with a caller fallback records nothing for the sweep", async () => {
+    const processMessage: MessageProcessor = async () => {
+      throw new Error("provider exploded");
+    };
+
+    let fellBack = 0;
+    processChannelMessageInBackground({
+      processMessage,
+      conversationId: "conv-wake-error",
+      eventId: "evt-wake-error",
+      content: "Alice reacted with :tada: to your message",
+      sourceChannel: "discord",
+      sourceInterface: "discord",
+      externalChatId: "999000111222333444",
+      trustCtx,
+      metadataHints: [],
+      replyCallbackUrl: "https://example.test/deliver/discord",
+      onTurnLostToBusy: async () => {
+        fellBack++;
+      },
+    });
+
+    await flush();
+
+    // Best-effort turn lost; a failure record would only feed the sweep an
+    // event it cannot rebuild. The fallback is busy-specific and stays uncalled.
+    expect(fellBack).toBe(0);
+    expect(processingFailureEvents).toEqual([]);
+    expect(deferredRetryEvents).toEqual([]);
+  });
+
+  test("ingress row extensions reach processMessage", async () => {
+    let seenOptions: Record<string, unknown> | undefined;
+    const processMessage: MessageProcessor = async (
+      _conversationId,
+      _content,
+      options,
+    ) => {
+      seenOptions = options as unknown as Record<string, unknown>;
+      return { messageId: "user-row-1" };
+    };
+
+    processChannelMessageInBackground({
+      processMessage,
+      conversationId: "conv-wake-meta",
+      eventId: "evt-wake-meta",
+      content: "Alice reacted with :tada: to your message",
+      sourceChannel: "discord",
+      sourceInterface: "discord",
+      externalChatId: "999000111222333444",
+      trustCtx,
+      metadataHints: [],
+      replyCallbackUrl: "https://example.test/deliver/discord",
+      slackReactionRowMeta: '{"eventKind":"reaction"}',
+      clientMessageId: "reaction:evt-wake-meta",
+      skipUserMessageIndexing: true,
+    });
+
+    await flush();
+
+    expect(seenOptions?.slackReactionRowMeta).toBe('{"eventKind":"reaction"}');
+    expect(seenOptions?.clientMessageId).toBe("reaction:evt-wake-meta");
+    expect(seenOptions?.skipUserMessageIndexing).toBe(true);
+  });
 });
 
 describe("channel activity timing", () => {