switchroom 0.15.10 → 0.15.12

package/telegram-plugin/history.ts

@@ -546,6 +546,63 @@ export function getRecentOutboundCount(
   return row?.cnt ?? 0
 }
 
+/**
+ * Returns true if at least one SUBSTANTIVE outbound (bot → user, role='assistant')
+ * message was delivered to `chatId` (and optionally `threadId`) AFTER `sinceMs`
+ * (wall-clock epoch milliseconds). Used by the obligation sweep to suppress a false
+ * "I may have missed this" escalation when the agent visibly answered: if a
+ * substantive outbound landed since the obligation was opened, the obligation is
+ * stale — close it silently rather than alarming the user.
+ *
+ * SUBSTANTIVE: we never suppress escalation on a bare ack ("on it", "give me a
+ * sec") — an agent that acks then ghosts must still escalate. The history schema
+ * does not store a done/substantive flag, so we approximate: a row counts only
+ * when LENGTH(text) >= 200 (the FINAL_ANSWER_MIN_CHARS constant from
+ * final-answer-detect.ts). This is false-negative-safe: a genuine substantive
+ * answer that happens to be < 200 chars will still fire an escalation, which is
+ * the conservative (safe) outcome. A schema column would be more precise but is
+ * disproportionate for this predicate; the reviewer accepted this approach.
+ *
+ * `threadId` semantics:
+ *   - undefined → any message in the chat regardless of thread (DMs + supergroups)
+ *   - explicit number → only that thread (precise for supergroups with topics)
+ *   - explicit null → only chat-root (non-thread) messages
+ *
+ * Falls back to false (safe: never suppresses escalation) if history is not yet
+ * initialised or the query fails.
+ */
+export function hasOutboundDeliveredSince(
+  chatId: string,
+  sinceMs: number,
+  threadId?: number | null,
+): boolean {
+  try {
+    const cutoffSec = Math.floor(sinceMs / 1000)
+    const params: unknown[] = [chatId, cutoffSec]
+    // LENGTH(text) >= 200 scopes to substantive replies only — never suppress
+    // escalation on a mere ack. Mirrors FINAL_ANSWER_MIN_CHARS (200) from
+    // final-answer-detect.ts; the `done` flag is not stored in the history
+    // schema, so length is the closest available proxy.
+    let sql =
+      "SELECT 1 FROM messages WHERE chat_id = ? AND role = 'assistant' AND ts >= ? AND LENGTH(text) >= 200"
+    if (threadId !== undefined) {
+      if (threadId === null) {
+        sql += ' AND thread_id IS NULL'
+      } else {
+        sql += ' AND thread_id = ?'
+        params.push(threadId)
+      }
+    }
+    sql += ' LIMIT 1'
+    const row = requireDb()
+      .prepare(sql)
+      .get(...(params as [unknown, ...unknown[]])) as Record<string, unknown> | undefined
+    return row != null
+  } catch {
+    return false
+  }
+}
+
 export function query(opts: QueryOptions): RecordedMessage[] {
   const limit = Math.min(MAX_LIMIT, Math.max(1, opts.limit ?? DEFAULT_LIMIT))
   const params: unknown[] = [opts.chat_id]

package/telegram-plugin/tests/gateway-request-secret.test.ts

@@ -29,7 +29,7 @@ describe('request_secret — gateway wiring', () => {
   })
 
   it('is allow-listed and dispatched', () => {
-    expect(gw).toMatch(/'request_secret',\n\]\)/)
+    expect(gw).toMatch(/'request_secret',\n/)
     expect(gw).toMatch(/case 'request_secret':\s*\n\s*return executeRequestSecret\(args\)/)
   })
 

package/telegram-plugin/tests/history.test.ts

@@ -10,6 +10,7 @@ import {
   query,
   getRecentOutboundCount,
   getLatestInboundMessageId,
+  hasOutboundDeliveredSince,
   _resetForTests,
 } from '../history.js'
 
@@ -363,6 +364,88 @@ describe('getRecentOutboundCount (backstop dedup helper)', () => {
   })
 })
 
+// A substantive reply: 200+ chars (the FINAL_ANSWER_MIN_CHARS threshold).
+const SUBSTANTIVE = 'A'.repeat(200)
+// A non-substantive ack: short (<200 chars).
+const ACK = 'On it.'
+
+describe('hasOutboundDeliveredSince', () => {
+  beforeEach(() => initHistory(stateDir, 30))
+
+  it('returns true when a substantive outbound exists after openedAt', () => {
+    const openedAt = 1_000_000 * 1000 // ms
+    recordOutbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_ids: [10],
+      texts: [SUBSTANTIVE],
+      ts: 1_000_001, // sec — 1s after openedAt
+    })
+    expect(hasOutboundDeliveredSince('-100', openedAt)).toBe(true)
+  })
+
+  it('returns false when the only outbound is BEFORE openedAt', () => {
+    const openedAt = 1_000_002 * 1000 // ms — after the message
+    recordOutbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_ids: [10],
+      texts: [SUBSTANTIVE],
+      ts: 1_000_001, // sec — before openedAt
+    })
+    expect(hasOutboundDeliveredSince('-100', openedAt)).toBe(false)
+  })
+
+  it('returns false for a non-substantive ack after openedAt (blocker regression)', () => {
+    // An agent that sends a short ack ("on it") then ghosts must NOT have
+    // its escalation suppressed. The predicate must never match a bare ack.
+    const openedAt = 1_000_000 * 1000
+    recordOutbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_ids: [10],
+      texts: [ACK],          // < 200 chars — non-substantive
+      ts: 1_000_001,
+    })
+    expect(hasOutboundDeliveredSince('-100', openedAt)).toBe(false)
+  })
+
+  it('thread_id=undefined matches any thread (DM semantics)', () => {
+    const openedAt = 1_000_000 * 1000
+    recordOutbound({
+      chat_id: '-100',
+      thread_id: 5,
+      message_ids: [10],
+      texts: [SUBSTANTIVE],
+      ts: 1_000_001,
+    })
+    // No thread filter → should find it
+    expect(hasOutboundDeliveredSince('-100', openedAt, undefined)).toBe(true)
+  })
+
+  it('thread_id=number scopes to that thread only', () => {
+    const openedAt = 1_000_000 * 1000
+    recordOutbound({ chat_id: '-100', thread_id: 5, message_ids: [10], texts: [SUBSTANTIVE], ts: 1_000_001 })
+    expect(hasOutboundDeliveredSince('-100', openedAt, 5)).toBe(true)
+    expect(hasOutboundDeliveredSince('-100', openedAt, 6)).toBe(false)
+  })
+
+  it('thread_id=null matches only chat-root (non-thread) messages', () => {
+    const openedAt = 1_000_000 * 1000
+    recordOutbound({ chat_id: '-100', thread_id: null, message_ids: [10], texts: [SUBSTANTIVE], ts: 1_000_001 })
+    expect(hasOutboundDeliveredSince('-100', openedAt, null)).toBe(true)
+    // A thread-scoped message should NOT match the root filter
+    recordOutbound({ chat_id: '-100', thread_id: 3, message_ids: [11], texts: [SUBSTANTIVE], ts: 1_000_002 })
+    expect(hasOutboundDeliveredSince('-100', openedAt, null)).toBe(true) // root still there
+    expect(hasOutboundDeliveredSince('-100', openedAt, 3)).toBe(true)    // thread 3 also there
+    expect(hasOutboundDeliveredSince('-100', openedAt, 9)).toBe(false)   // thread 9 not there
+  })
+
+  it('returns false when no history is present for the chat', () => {
+    expect(hasOutboundDeliveredSince('-999', 0)).toBe(false)
+  })
+})
+
 describe('secret redaction at persistence (both directions)', () => {
   beforeEach(() => initHistory(stateDir, 30))
 

package/telegram-plugin/tests/linear-agent-activity.test.ts

@@ -0,0 +1,124 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import {
+  emitLinearAgentActivity,
+  type LinearTokenResult,
+} from '../gateway/linear-activity.js'
+
+/**
+ * Tests for the `linear_agent_activity` MCP tool (#2298).
+ *
+ * Structural part: assert the tool is declared in bridge/bridge.ts and
+ * allow-listed + dispatched in gateway/gateway.ts (the gateway IIFE can't be
+ * imported in a test, so wiring is verified by reading the source — same
+ * constraint as gateway-request-secret.test.ts).
+ *
+ * Behavioural part: the activity-emit logic lives in gateway/linear-activity.ts
+ * with injectable token-resolver + fetch, so the happy path and the
+ * vault-denied path are exercised without a broker or the network.
+ */
+
+const okToken = (token: string) => async (): Promise<LinearTokenResult> => ({ ok: true, token })
+
+function fakeFetch(status: number, jsonBody: unknown): {
+  fetchImpl: typeof fetch
+  calls: Array<{ url: string; init?: RequestInit }>
+} {
+  const calls: Array<{ url: string; init?: RequestInit }> = []
+  const fetchImpl = (async (url: string, init?: RequestInit) => {
+    calls.push({ url, init })
+    return {
+      ok: status >= 200 && status < 300,
+      status,
+      json: async () => jsonBody,
+      text: async () => JSON.stringify(jsonBody),
+    } as unknown as Response
+  }) as unknown as typeof fetch
+  return { fetchImpl, calls }
+}
+
+describe('linear_agent_activity — gateway wiring (#2298)', () => {
+  const gw = readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8')
+  const bridge = readFileSync(new URL('../bridge/bridge.ts', import.meta.url), 'utf8')
+
+  it('declares the MCP tool with required {agent_session_id,type}', () => {
+    const idx = bridge.indexOf(`name: 'linear_agent_activity'`)
+    expect(idx).toBeGreaterThan(0)
+    const schema = bridge.slice(idx, idx + 2000)
+    expect(schema).toMatch(/required: \['agent_session_id', 'type'\]/)
+    expect(schema).toMatch(/thought/)
+    expect(schema).toMatch(/complete/)
+  })
+
+  it('is allow-listed and dispatched', () => {
+    expect(gw).toMatch(/'linear_agent_activity',\n\]\)/)
+    expect(gw).toMatch(/case 'linear_agent_activity':\s*\n\s*return executeLinearAgentActivity\(args\)/)
+  })
+})
+
+describe('emitLinearAgentActivity — behaviour (#2298)', () => {
+  it('POSTs an agentActivityCreate mutation on the happy path', async () => {
+    const { fetchImpl, calls } = fakeFetch(200, { data: { agentActivityCreate: { success: true } } })
+    const r = await emitLinearAgentActivity(
+      { agent_session_id: 'sess_1', type: 'thought', body: 'On it.' },
+      { agent: 'carrie', resolveToken: okToken('lin_tok'), fetchImpl, log: () => {} },
+    )
+    expect(r.content[0].text).toMatch(/emitted on session sess_1/)
+    expect(calls).toHaveLength(1)
+    expect(calls[0].url).toBe('https://api.linear.app/graphql')
+    const sent = JSON.parse(calls[0].init!.body as string)
+    expect(sent.query).toMatch(/agentActivityCreate/)
+    expect(sent.variables.input.agentSessionId).toBe('sess_1')
+    expect(sent.variables.input.content).toEqual({ type: 'thought', body: 'On it.' })
+    expect((calls[0].init!.headers as Record<string, string>).Authorization).toBe('lin_tok')
+  })
+
+  it('allows complete with no body', async () => {
+    const { fetchImpl } = fakeFetch(200, { data: { agentActivityCreate: { success: true } } })
+    const r = await emitLinearAgentActivity(
+      { agent_session_id: 'sess_2', type: 'complete' },
+      { agent: 'carrie', resolveToken: okToken('lin_tok'), fetchImpl, log: () => {} },
+    )
+    expect(r.content[0].text).toMatch(/complete emitted/)
+  })
+
+  it('requires body for thought/message/error', async () => {
+    await expect(
+      emitLinearAgentActivity(
+        { agent_session_id: 'sess_3', type: 'message' },
+        { resolveToken: okToken('t'), log: () => {} },
+      ),
+    ).rejects.toThrow(/body is required/)
+  })
+
+  it('rejects an unknown type', async () => {
+    await expect(
+      emitLinearAgentActivity(
+        { agent_session_id: 'sess_4', type: 'banana', body: 'x' },
+        { resolveToken: okToken('t'), log: () => {} },
+      ),
+    ).rejects.toThrow(/type must be one of/)
+  })
+
+  it('returns vault_request_access guidance when the token is denied', async () => {
+    const r = await emitLinearAgentActivity(
+      { agent_session_id: 'sess_5', type: 'thought', body: 'hi' },
+      {
+        agent: 'carrie',
+        resolveToken: async () => ({ ok: false, reason: 'denied' }),
+        log: () => {},
+      },
+    )
+    expect(r.content[0].text).toMatch(/vault_request_access/)
+    expect(r.content[0].text).toMatch(/linear\/carrie\/token/)
+  })
+
+  it('surfaces a Linear API error status', async () => {
+    const { fetchImpl } = fakeFetch(401, { error: 'bad token' })
+    const r = await emitLinearAgentActivity(
+      { agent_session_id: 'sess_6', type: 'thought', body: 'hi' },
+      { agent: 'carrie', resolveToken: okToken('lin_tok'), fetchImpl, log: () => {} },
+    )
+    expect(r.content[0].text).toMatch(/Linear API 401/)
+  })
+})

package/telegram-plugin/tests/model-command.test.ts

@@ -113,6 +113,46 @@ describe("isValidModelArg", () => {
   });
 });
 
+// Regression for the 2026-06-13 fleet outage: defaults.model was pinned to
+// the full codename `claude-fable-5`, which Anthropic retired server-side →
+// every agent 4xx'd. The fix is to select models by ALIAS (durable) instead
+// of pinned ids. This locks in that `fable` (and the other aliases) stay
+// selectable, and documents the alias-vs-codename distinction.
+describe("model selection: aliases stay selectable (incl. fable)", () => {
+  it("lists fable as a first-class alias", () => {
+    // `fable` is the latest flagship (Fable 5) and must remain pickable.
+    expect(MODEL_ALIASES).toContain("fable");
+    // The standard set is intact alongside it.
+    for (const a of ["opus", "sonnet", "haiku", "default"]) {
+      expect(MODEL_ALIASES, a).toContain(a);
+    }
+  });
+
+  it("each alias is a valid model arg and parses as a set", () => {
+    for (const alias of MODEL_ALIASES) {
+      expect(isValidModelArg(alias), alias).toBe(true);
+      expect(parseModelCommand(`/model ${alias}`)).toEqual({ kind: "set", model: alias });
+    }
+  });
+
+  it("the help text surfaces the fable alias", async () => {
+    const reply = await handleModelCommand({ kind: "help" }, makeDeps());
+    expect(reply.text).toContain("fable");
+  });
+
+  it("passthrough: a full id (incl. the retired claude-fable-5 codename) is shape-accepted, not allowlisted", () => {
+    // switchroom does NOT allowlist models — the SHAPE gate passes any
+    // well-formed id through to claude, which is the sole validator. So the
+    // retired `claude-fable-5` codename still parses here (it just 4xx's at
+    // claude); selection flexibility (any current/future model) is preserved.
+    expect(parseModelCommand("/model claude-fable-5")).toEqual({
+      kind: "set",
+      model: "claude-fable-5",
+    });
+    expect(isValidModelArg("claude-fable-5")).toBe(true);
+  });
+});
+
 describe("handleModelCommand — show / help never inject (picker-wedge guard)", () => {
   it("show renders configured model + switch options without injecting", async () => {
     const { deps, calls } = makeDeps();

package/telegram-plugin/tests/obligation-ledger.test.ts

@@ -105,14 +105,26 @@ describe("ObligationLedger", () => {
       expect(L.resolveCloseTarget(undefined, "c:3#715")).toBe("c:3#715");
     });
 
-    it("no echo + MULTIPLE open → close NOTHING (never wrong-close/drop)", () => {
+    it("no echo + MULTIPLE open + live turn IS open → close the live turn's OWN obligation (Fix 2)", () => {
       const L = new ObligationLedger();
       L.openIfAbsent(input("c:635#713", 1000));
       L.openIfAbsent(input("c:3#715", 1100));
-      // the marko race: 713's un-echoed reply lands while currentTurn=715.
-      // Closing 715 would silently drop it → resolveCloseTarget refuses.
-      expect(L.resolveCloseTarget(undefined, "c:3#715")).toBeNull();
-      expect(L.isOpen("c:3#715")).toBe(true); // 715 stays open → re-presented
+      // A substantive reply delivered during currentTurn=715 (no model echo, no
+      // routed origin) closes 715's own obligation. 713 stays open and is
+      // re-presented. The 713/715 invariant holds: this does NOT close 713.
+      expect(L.resolveCloseTarget(undefined, "c:3#715")).toBe("c:3#715");
+      expect(L.isOpen("c:635#713")).toBe(true); // 713 stays open
+    });
+
+    it("no echo + MULTIPLE open + live turn NOT one of them → close nothing (713/715 invariant preserved)", () => {
+      const L = new ObligationLedger();
+      L.openIfAbsent(input("c:635#713", 1000));
+      L.openIfAbsent(input("c:3#715", 1100));
+      // currentTurn=999 is NOT an open obligation. We can't identify the right
+      // target → refuse to close anything (a re-present is safer than a wrong close).
+      expect(L.resolveCloseTarget(undefined, "c:9#999")).toBeNull();
+      expect(L.isOpen("c:635#713")).toBe(true);
+      expect(L.isOpen("c:3#715")).toBe(true);
     });
 
     it("no echo + live turn not an open obligation → null", () => {
@@ -120,6 +132,35 @@ describe("ObligationLedger", () => {
       L.openIfAbsent(input("c:3#715", 1100));
       expect(L.resolveCloseTarget(undefined, "c:9#999")).toBeNull();
     });
+
+    it("routedOriginId (Fix 1) closes the routed target even with multiple open + no model echo", () => {
+      // Simulate the clerk incident: two obligations open, agent answers #14057
+      // via a quoted reply (via=quoted), no model echo. The gateway resolves
+      // routedOriginId=#14057 from the quote. That obligation closes; #14059 stays.
+      const L = new ObligationLedger();
+      L.openIfAbsent(input("c:0#14057", 1000));
+      L.openIfAbsent(input("c:0#14059", 1100));
+      expect(L.resolveCloseTarget(undefined, "c:0#14059", "c:0#14057")).toBe("c:0#14057");
+      // Close it to confirm only #14057 closes
+      L.close("c:0#14057");
+      expect(L.isOpen("c:0#14057")).toBe(false);
+      expect(L.isOpen("c:0#14059")).toBe(true);
+    });
+
+    it("echoedTurnId wins over routedOriginId when both present (echoed is authoritative)", () => {
+      const L = new ObligationLedger();
+      L.openIfAbsent(input("c:635#713", 1000));
+      L.openIfAbsent(input("c:3#715", 1100));
+      // Model explicitly echoed 713 AND router resolved 715 as routed origin.
+      // The echo is authoritative — close 713.
+      expect(L.resolveCloseTarget("c:635#713", "c:3#715", "c:3#715")).toBe("c:635#713");
+    });
+
+    it("routedOriginId=null falls through to live-turn fallback", () => {
+      const L = new ObligationLedger();
+      L.openIfAbsent(input("c:3#715", 1100));
+      expect(L.resolveCloseTarget(undefined, "c:3#715", null)).toBe("c:3#715");
+    });
   });
 });
 
@@ -411,3 +452,170 @@ describe("ObligationLedger — background-work grace (extended-autonomous fix, g
     ).toBe("represent");
   });
 });
+
+describe("ObligationLedger — per-represent grace (Fix 3: clerk 2026-06-13 incident)", () => {
+  function input(id: string, openedAt: number) {
+    return { originTurnId: id, chatId: "-100123", threadId: 3, messageId: Number(id.split("#").pop() ?? 0), text: "x", openedAt };
+  }
+
+  const REPR_GRACE = 120_000; // 2 min, mirroring the default
+
+  it("a freshly re-presented obligation is ineligible until representGraceMs elapses", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    // Re-present fires at t=5000; markRepresented stamps lastRepresentedAt.
+    L.markRepresented("c:3#1", 5000);
+    // 10s later — still within 120s represent grace → ineligible → none.
+    expect(
+      L.decideAtIdle({ now: 15000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("none");
+    // 120s + 1ms after re-present → grace expired → act.
+    expect(
+      L.decideAtIdle({ now: 5000 + REPR_GRACE + 1, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("represent");
+  });
+
+  it("markRepresented stamps lastRepresentedAt and persists", () => {
+    const snapshots: Obligation[][] = [];
+    const L = new ObligationLedger(2, { onChange: (s) => snapshots.push(s) });
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.markRepresented("c:3#1", 9000);
+    const snap = L.list()[0];
+    expect(snap.lastRepresentedAt).toBe(9000);
+    expect(snap.representCount).toBe(1);
+    // Persisted: onChange fired for open + markRepresented = 2 snapshots
+    expect(snapshots.length).toBe(2);
+    expect(snapshots[1][0].lastRepresentedAt).toBe(9000);
+  });
+
+  it("representGraceMs=0 (kill switch) → no per-represent grace, acts immediately", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.markRepresented("c:3#1", 5000);
+    // Kill switch: representGraceMs=0 → the freshly-represented obligation is still eligible.
+    expect(
+      L.decideAtIdle({ now: 5001, graceMs: 45000, representGraceMs: 0 }).action,
+    ).toBe("represent");
+  });
+
+  it("an obligation that was NEVER re-presented has no per-represent grace (no lastRepresentedAt)", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    // No markRepresented call → no lastRepresentedAt → always eligible on this axis.
+    expect(
+      L.decideAtIdle({ now: 2000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("represent");
+  });
+
+  it("per-represent grace survives hydration (durable snapshot)", () => {
+    const L = new ObligationLedger(2);
+    const now = 10_000;
+    L.hydrate([
+      {
+        originTurnId: "c:3#1",
+        chatId: "-100123",
+        threadId: 3,
+        messageId: 1,
+        text: "x",
+        openedAt: 1000,
+        representCount: 1,
+        lastRepresentedAt: now - 5000, // represented 5s ago
+      },
+    ]);
+    // 5s after re-present, grace=120s → still within grace → none.
+    expect(
+      L.decideAtIdle({ now, graceMs: 0, representGraceMs: REPR_GRACE }).action,
+    ).toBe("none");
+    // 120s + 1ms after re-present → grace expired → escalate (count=1 < max=2 → represent).
+    expect(
+      L.decideAtIdle({ now: now - 5000 + REPR_GRACE + 1, graceMs: 0, representGraceMs: REPR_GRACE }).action,
+    ).toBe("represent");
+  });
+
+  it("per-represent grace composes with trailing-answer grace: both must clear", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.noteTurnEnded("c:3#1", 5000);
+    L.markRepresented("c:3#1", 5000);
+    // Both graces active; trailing: turn ended 5s ago (grace=45s → in grace);
+    // per-represent: re-presented 5s ago (grace=120s → in grace) → none.
+    expect(
+      L.decideAtIdle({ now: 10000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("none");
+    // Trailing grace cleared (50s after turn-end), per-represent NOT yet (only 45s after re-present).
+    expect(
+      L.decideAtIdle({ now: 5000 + 50000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("none");
+    // Both cleared (125s after re-present at t=5000 → t=130000).
+    expect(
+      L.decideAtIdle({ now: 5000 + REPR_GRACE + 5000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("represent");
+  });
+
+  it("the clerk incident: two messages arrive, re-present fires at T; the sweep ticks again at T+5s → grace prevents premature escalation", () => {
+    // This is the exact sequence from clerk 2026-06-13: obligation re-presented
+    // at T, sweep fires at T+5s before the re-present turn has even landed, would
+    // immediately fire AGAIN (burning representCount to 2 → escalate in 5 more
+    // seconds). With per-represent grace, the T+5s tick is a no-op.
+    const L = new ObligationLedger(2);
+    const T = 1_000_000;
+    L.openIfAbsent(input("c:0#14057", T));
+    // First represent at T
+    L.markRepresented("c:0#14057", T);
+    expect(L.list()[0].representCount).toBe(1);
+    // Sweep at T+5s: MUST be "none" (within per-represent grace)
+    expect(
+      L.decideAtIdle({ now: T + 5000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("none");
+    // Sweep at T+10s: still within grace
+    expect(
+      L.decideAtIdle({ now: T + 10000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("none");
+    // Sweep after grace: eligible for second represent (not escalate — count=1 < max=2)
+    expect(
+      L.decideAtIdle({ now: T + REPR_GRACE + 1000, graceMs: 45000, representGraceMs: REPR_GRACE }).action,
+    ).toBe("represent");
+    expect(L.list()[0].representCount).toBe(1); // still 1 — decideAtIdle is pure
+  });
+});
+
+describe("ObligationLedger — escalation suppression predicate (Fix 4)", () => {
+  // Fix 4 is implemented in the gateway (obligationSweep checks
+  // hasOutboundDeliveredSince before calling driveEscalation). We test the
+  // predicate seam via the pattern the sweep uses: if an outbound was delivered
+  // since openedAt, the obligation should be closed silently, not escalated.
+  // This suite tests the ledger behaviour that enables that path: after a
+  // silent close the ledger is empty and the next sweep sees 'none'.
+  function input(id: string, openedAt: number) {
+    return { originTurnId: id, chatId: "-100123", threadId: 3, messageId: Number(id.split("#").pop() ?? 0), text: "x", openedAt };
+  }
+
+  it("a silently-closed obligation (gateway closed on outbound-delivered check) leaves ledger empty", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    // Gateway's Fix 4 path: outbound delivered since openedAt → close silently
+    expect(L.close("c:3#1")).toBe(true);
+    expect(L.hasOpen()).toBe(false);
+    expect(L.decideAtIdle().action).toBe("none");
+  });
+
+  it("an escalation that reaches maxRepresents WITHOUT any known outbound still proceeds (escalate action)", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.markRepresented("c:3#1");
+    L.markRepresented("c:3#1");
+    // hasOutboundDeliveredSince returns false (no outbound recorded) → escalate
+    const d = L.decideAtIdle({ now: 9_999_999, graceMs: 0, representGraceMs: 0 });
+    expect(d.action).toBe("escalate");
+    expect(d.obligation?.originTurnId).toBe("c:3#1");
+  });
+
+  it("silent close fires onChange (persists the empty set)", () => {
+    const snapshots: Obligation[][] = [];
+    const L = new ObligationLedger(2, { onChange: (s) => snapshots.push(s) });
+    L.openIfAbsent(input("c:3#1", 1000)); // snapshot[0]
+    L.close("c:3#1"); // snapshot[1] = []
+    expect(snapshots.length).toBe(2);
+    expect(snapshots[1]).toEqual([]);
+  });
+});

package/telegram-plugin/tests/obligation-store.test.ts

@@ -101,6 +101,23 @@ describe("obligation-store", () => {
     expect(loaded.map((o) => o.originTurnId)).toEqual(["c:3#715", "c:5#900"]);
   });
 
+  it("round-trips lastRepresentedAt through parse → isObligationRow filter → hydrate", () => {
+    // Regression: isObligationRow only checks required fields; optional fields
+    // (lastRepresentedAt, lastTurnEndedAt, escalateAttempts) must survive the
+    // filter without being stripped. A missing check would silently drop the field
+    // and break the per-represent grace window across restarts.
+    const { fs } = memFs();
+    const snap: Obligation[] = [
+      ob("c:3#715", { representCount: 1, lastRepresentedAt: 1_700_000_000_000, lastTurnEndedAt: 1_700_000_001_000 }),
+    ];
+    persistObligations(PATH, fs, snap);
+    const loaded = loadObligations(PATH, fs);
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]!.lastRepresentedAt).toBe(1_700_000_000_000);
+    expect(loaded[0]!.lastTurnEndedAt).toBe(1_700_000_001_000);
+    expect(loaded[0]!.representCount).toBe(1);
+  });
+
   it("never throws on a write failure — degrades to in-memory (logs)", () => {
     const logs: string[] = [];
     const fs: ObligationStoreFsSeam = {