switchroom 0.17.6 → 0.18.3

package/telegram-plugin/tests/mental-model-propose-resolve.test.ts

@@ -0,0 +1,157 @@
+import { describe, it, expect, vi } from "vitest";
+import {
+  resolveMentalModelProposal,
+  type MentalModelPendingProposal,
+  type ResolveDeps,
+} from "../gateway/mental-model-propose-resolve.js";
+
+/**
+ * The approve/deny orchestration invariants (hindsight Phase 5):
+ *   - APPROVE appends config (dispatches the config edit) AND ensures.
+ *   - DENY writes NOTHING (no config read, diff, dispatch, or ensure).
+ *   - A duplicate proposal is rejected BEFORE any edit is dispatched.
+ * Self-approve is impossible by construction: this function is only reached
+ * after the gateway callback authorizes an allow-listed operator; there is no
+ * agent path to it (covered by the config-edit self-scope tests + the callback
+ * authorization gate).
+ */
+
+const CONFIG_NO_MODELS = `agents:
+  coach:
+    persona: fitness
+    memory:
+      collection: coach-bank
+`;
+const CONFIG_DUP = `agents:
+  coach:
+    persona: fitness
+    memory:
+      collection: coach-bank
+      mental_models:
+        - name: plan
+          source_query: existing
+`;
+
+function pending(overrides: Partial<MentalModelPendingProposal> = {}): MentalModelPendingProposal {
+  return {
+    agent: "coach",
+    chat_id: "123",
+    spec: { name: "plan", source_query: "What is the plan?" },
+    reason: "recurring lookup",
+    ...overrides,
+  };
+}
+
+function makeDeps(configText: string, overrides: Partial<ResolveDeps> = {}): {
+  deps: ResolveDeps;
+  spies: {
+    readConfigText: ReturnType<typeof vi.fn>;
+    registerPreApproval: ReturnType<typeof vi.fn>;
+    clearPreApproval: ReturnType<typeof vi.fn>;
+    dispatchConfigEdit: ReturnType<typeof vi.fn>;
+    ensureModel: ReturnType<typeof vi.fn>;
+    injectInbound: ReturnType<typeof vi.fn>;
+  };
+} {
+  const spies = {
+    readConfigText: vi.fn(() => configText),
+    registerPreApproval: vi.fn(),
+    clearPreApproval: vi.fn(),
+    dispatchConfigEdit: vi.fn(async () => ({ state: "applied" as const })),
+    ensureModel: vi.fn(async () => {}),
+    injectInbound: vi.fn(),
+  };
+  const deps: ResolveDeps = {
+    readConfigText: spies.readConfigText,
+    registerPreApproval: spies.registerPreApproval,
+    clearPreApproval: spies.clearPreApproval,
+    dispatchConfigEdit: spies.dispatchConfigEdit,
+    ensureModel: spies.ensureModel,
+    injectInbound: spies.injectInbound,
+    now: () => 1_700_000_000_000,
+    ...overrides,
+  };
+  return { deps, spies };
+}
+
+describe("resolveMentalModelProposal — APPROVE", () => {
+  it("appends config (dispatches the append edit) AND ensures, then wakes the agent", async () => {
+    const { deps, spies } = makeDeps(CONFIG_NO_MODELS);
+    const out = await resolveMentalModelProposal("approve", pending(), "stage1", "op-42", deps);
+
+    expect(out).toEqual({ outcome: "applied" });
+    // Config was read + an edit dispatched whose diff APPENDS the model.
+    expect(spies.readConfigText).toHaveBeenCalledTimes(1);
+    expect(spies.dispatchConfigEdit).toHaveBeenCalledTimes(1);
+    const editArg = spies.dispatchConfigEdit.mock.calls[0][0];
+    expect(editArg.agent).toBe("coach");
+    expect(editArg.diff).toContain("+++ b/switchroom.yaml");
+    expect(editArg.diff).toContain("plan");
+    // Single-tap correlation registered then cleared (single-shot).
+    expect(spies.registerPreApproval).toHaveBeenCalledWith("coach", editArg.diff);
+    expect(spies.clearPreApproval).toHaveBeenCalledWith("coach", editArg.diff);
+    // Ensured.
+    expect(spies.ensureModel).toHaveBeenCalledWith(pending().spec);
+    // Agent woken with the applied inbound.
+    expect(spies.injectInbound).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_applied",
+    );
+  });
+
+  it("a failed config edit yields a 'failed' inbound (honest — nothing landed)", async () => {
+    const { deps, spies } = makeDeps(CONFIG_NO_MODELS, {
+      dispatchConfigEdit: vi.fn(async () => ({ state: "error" as const, reason: "hostd down" })),
+    });
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    expect(out).toEqual({ outcome: "failed", reason: "hostd down" });
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_failed",
+    );
+  });
+
+  it("REJECTS a duplicate BEFORE dispatching any edit (no write, no correlation)", async () => {
+    const { deps, spies } = makeDeps(CONFIG_DUP);
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    expect(out.outcome).toBe("rejected");
+    expect(spies.dispatchConfigEdit).not.toHaveBeenCalled();
+    expect(spies.registerPreApproval).not.toHaveBeenCalled();
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_failed",
+    );
+  });
+
+  it("a successful declaration is NOT flipped to failure by an ensure error", async () => {
+    const { deps, spies } = makeDeps(CONFIG_NO_MODELS, {
+      ensureModel: vi.fn(async () => {
+        throw new Error("hindsight unreachable");
+      }),
+    });
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    // Model IS declared (reconcile will ensure regardless); still "applied".
+    expect(out).toEqual({ outcome: "applied" });
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_applied",
+    );
+  });
+});
+
+describe("resolveMentalModelProposal — DENY writes NOTHING", () => {
+  it("never reads config, builds a diff, dispatches an edit, or ensures", async () => {
+    const { deps, spies } = makeDeps(CONFIG_NO_MODELS);
+    const out = await resolveMentalModelProposal("deny", pending(), "stage1", "op-42", deps);
+
+    expect(out).toEqual({ outcome: "denied" });
+    expect(spies.readConfigText).not.toHaveBeenCalled();
+    expect(spies.dispatchConfigEdit).not.toHaveBeenCalled();
+    expect(spies.registerPreApproval).not.toHaveBeenCalled();
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    // Only side effect is waking the agent with the denied inbound.
+    expect(spies.injectInbound).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_denied",
+    );
+  });
+});

package/telegram-plugin/tests/missed-approvals-card.test.ts

@@ -0,0 +1,145 @@
+/**
+ * Unit tests for telegram-plugin/gateway/missed-approvals-card.ts (#2862).
+ *
+ * Pure builders — no gateway. Contract under test:
+ *   - parseMissedApprovalCallback round-trips the keyboard's callback_data;
+ *   - renderMissedApprovalsDigest lists entries, escapes HTML, and collapses
+ *     past the cap to "…and N more";
+ *   - buildMissedApprovalRetryInbound pins source='missed_approval_retry',
+ *     frames the retry as a QUESTION (never a verdict), and carries the
+ *     actions in the text.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  MISSED_APPROVAL_CALLBACK_PREFIX,
+  MISSED_APPROVAL_RENDER_CAP,
+  renderMissedApprovalsDigest,
+  missedApprovalsKeyboard,
+  parseMissedApprovalCallback,
+  buildMissedApprovalRetryInbound,
+} from '../gateway/missed-approvals-card.js'
+import type { MissedApproval } from '../gateway/missed-approvals-store.js'
+
+function miss(over: Partial<MissedApproval> = {}): MissedApproval {
+  return {
+    requestId: 'r',
+    toolName: 'mcp__brevo__post',
+    action: 'post to Brevo',
+    chatId: '-100123',
+    threadId: 7,
+    timedOutAt: Date.UTC(2026, 6, 4, 23, 2, 0),
+    ...over,
+  }
+}
+
+describe('missed-approvals callback shape', () => {
+  it('keyboard emits retry + dismiss callbacks that parse back', () => {
+    const kb = missedApprovalsKeyboard('abc123')
+    const [[retry, dismiss]] = kb.inline_keyboard
+    expect(retry.callback_data).toBe(`${MISSED_APPROVAL_CALLBACK_PREFIX}retry:abc123`)
+    expect(dismiss.callback_data).toBe(`${MISSED_APPROVAL_CALLBACK_PREFIX}dismiss:abc123`)
+    expect(parseMissedApprovalCallback(retry.callback_data)).toEqual({ action: 'retry', digestId: 'abc123' })
+    expect(parseMissedApprovalCallback(dismiss.callback_data)).toEqual({ action: 'dismiss', digestId: 'abc123' })
+  })
+
+  it('callback_data stays within Telegram 64-byte limit', () => {
+    const kb = missedApprovalsKeyboard('deadbeef')
+    for (const row of kb.inline_keyboard) {
+      for (const btn of row) {
+        expect(Buffer.byteLength(btn.callback_data, 'utf8')).toBeLessThanOrEqual(64)
+      }
+    }
+  })
+
+  it('rejects foreign / malformed callbacks', () => {
+    expect(parseMissedApprovalCallback('skprop:approve:x')).toBeNull()
+    expect(parseMissedApprovalCallback('missre:bogus:x')).toBeNull()
+    expect(parseMissedApprovalCallback('missre:retry:')).toBeNull()
+    expect(parseMissedApprovalCallback('missre:retry')).toBeNull()
+  })
+})
+
+describe('renderMissedApprovalsDigest', () => {
+  it('lists each entry with its natural action', () => {
+    const text = renderMissedApprovalsDigest([
+      miss({ action: 'post to Brevo' }),
+      miss({ action: 'send an email' }),
+    ])
+    expect(text).toContain('Missed approvals while you were away')
+    expect(text).toContain('post to Brevo')
+    expect(text).toContain('send an email')
+    expect(text).not.toContain('…and')
+  })
+
+  it('collapses past the cap to "…and N more"', () => {
+    const entries = Array.from({ length: MISSED_APPROVAL_RENDER_CAP + 3 }, (_, i) =>
+      miss({ requestId: `r${i}`, action: `action ${i}` }),
+    )
+    const text = renderMissedApprovalsDigest(entries)
+    expect(text).toContain('action 0')
+    expect(text).toContain(`action ${MISSED_APPROVAL_RENDER_CAP - 1}`)
+    // Entry at index == cap must NOT be listed individually.
+    expect(text).not.toContain(`action ${MISSED_APPROVAL_RENDER_CAP}`)
+    expect(text).toContain('…and 3 more')
+  })
+
+  it('escapes HTML in the action text', () => {
+    const text = renderMissedApprovalsDigest([miss({ action: 'run: rm <a> & <b>' })])
+    expect(text).toContain('rm &lt;a&gt; &amp; &lt;b&gt;')
+    expect(text).not.toContain('<a>')
+  })
+
+  it('names the agent when provided', () => {
+    const text = renderMissedApprovalsDigest([miss()], { agentName: 'marko' })
+    expect(text).toContain('marko')
+  })
+})
+
+describe('buildMissedApprovalRetryInbound', () => {
+  it('pins source + origin surface + operator id (single action)', () => {
+    const inbound = buildMissedApprovalRetryInbound({
+      ctx: { agent: 'marko', chat_id: '-100123', threadId: 7 },
+      actions: ['post to Brevo'],
+      operatorId: '8201250670',
+      nowMs: 123,
+    })
+    expect(inbound.type).toBe('inbound')
+    expect(inbound.chatId).toBe('-100123')
+    expect(inbound.threadId).toBe(7)
+    expect(inbound.meta.source).toBe('missed_approval_retry')
+    expect(inbound.meta.agent).toBe('marko')
+    expect(inbound.meta.operator_id).toBe('8201250670')
+    expect(inbound.meta.action_count).toBe('1')
+    expect(inbound.meta.message_thread_id).toBe('7')
+    expect(inbound.text).toContain('post to Brevo')
+  })
+
+  it('frames the retry as a QUESTION, never a verdict (no-self-escalation)', () => {
+    const inbound = buildMissedApprovalRetryInbound({
+      ctx: { agent: 'marko', chat_id: '-100123' },
+      actions: ['post to Brevo'],
+      operatorId: 'x',
+    })
+    // It asks the agent to re-attempt; it must NOT approve/deny on the
+    // operator's behalf.
+    expect(inbound.text.toLowerCase()).toContain('re-attempt')
+    expect(inbound.text.toLowerCase()).toContain('approve again')
+    expect(inbound.text.toLowerCase()).not.toMatch(/\b(approved|allow(ed)? this|permission granted)\b/)
+    // No thread → no thread fields.
+    expect(inbound.threadId).toBeUndefined()
+    expect(inbound.meta.message_thread_id).toBeUndefined()
+  })
+
+  it('lists every action for a multi-miss retry', () => {
+    const inbound = buildMissedApprovalRetryInbound({
+      ctx: { agent: 'marko', chat_id: '-100123' },
+      actions: ['post to Brevo', 'send an email', 'update the CRM'],
+      operatorId: 'x',
+    })
+    expect(inbound.meta.action_count).toBe('3')
+    expect(inbound.text).toContain('post to Brevo')
+    expect(inbound.text).toContain('send an email')
+    expect(inbound.text).toContain('update the CRM')
+  })
+})

package/telegram-plugin/tests/missed-approvals-store.test.ts

@@ -0,0 +1,147 @@
+/**
+ * Unit tests for telegram-plugin/gateway/missed-approvals-store.ts (#2862).
+ *
+ * Persisted list of approvals that TTL-expired while the operator was away.
+ * Contract under test:
+ *   - append at auto-deny; dedup on requestId; survive reload (new instance);
+ *   - cap pending (drop oldest) so the file stays bounded;
+ *   - promoteToDigest moves pending → delivered (so a second read sees empty
+ *     pending → "posts once");
+ *   - getDigest / removeDigest for the retry/dismiss taps.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import {
+  createMissedApprovalsStore,
+  MAX_PENDING,
+  type MissedApproval,
+} from '../gateway/missed-approvals-store.js'
+
+function makeTmpDir() {
+  return mkdtempSync(join(tmpdir(), 'missed-approvals-store-test-'))
+}
+
+function entry(over: Partial<MissedApproval> = {}): MissedApproval {
+  return {
+    requestId: 'fztws',
+    toolName: 'mcp__brevo__post',
+    action: 'post to Brevo',
+    chatId: '-100123',
+    threadId: 7,
+    timedOutAt: 1_700_000_000_000,
+    ...over,
+  }
+}
+
+describe('createMissedApprovalsStore', () => {
+  let dir: string
+  beforeEach(() => { dir = makeTmpDir() })
+  afterEach(() => { rmSync(dir, { recursive: true, force: true }) })
+
+  it('starts empty', () => {
+    const store = createMissedApprovalsStore(dir)
+    expect(store.listPending()).toEqual([])
+    expect(store.pendingCount()).toBe(0)
+  })
+
+  it('append + listPending returns the entry', () => {
+    const store = createMissedApprovalsStore(dir)
+    store.add(entry())
+    expect(store.listPending()).toHaveLength(1)
+    expect(store.listPending()[0].action).toBe('post to Brevo')
+  })
+
+  it('dedups on requestId (replace, not duplicate)', () => {
+    const store = createMissedApprovalsStore(dir)
+    store.add(entry({ requestId: 'aaa', action: 'first' }))
+    store.add(entry({ requestId: 'aaa', action: 'second' }))
+    expect(store.listPending()).toHaveLength(1)
+    expect(store.listPending()[0].action).toBe('second')
+  })
+
+  it('survives reload (a fresh instance sees persisted entries)', () => {
+    const s1 = createMissedApprovalsStore(dir)
+    s1.add(entry({ requestId: 'a' }))
+    s1.add(entry({ requestId: 'b' }))
+    const s2 = createMissedApprovalsStore(dir)
+    expect(s2.pendingCount()).toBe(2)
+  })
+
+  it('caps pending at MAX_PENDING, dropping the oldest', () => {
+    const store = createMissedApprovalsStore(dir)
+    for (let i = 0; i < MAX_PENDING + 5; i++) {
+      store.add(entry({ requestId: `r${i}`, timedOutAt: 1_700_000_000_000 + i }))
+    }
+    const pending = store.listPending()
+    expect(pending).toHaveLength(MAX_PENDING)
+    // Oldest (r0..r4) dropped; newest (r<MAX+4>) retained.
+    expect(pending.some(e => e.requestId === 'r0')).toBe(false)
+    expect(pending.some(e => e.requestId === `r${MAX_PENDING + 4}`)).toBe(true)
+  })
+
+  it('promoteToDigest moves entries out of pending into a delivered record', () => {
+    const store = createMissedApprovalsStore(dir)
+    store.add(entry({ requestId: 'a', action: 'post to Brevo' }))
+    store.add(entry({ requestId: 'b', action: 'send email' }))
+    const entries = store.listPending()
+    store.promoteToDigest({
+      digestId: 'deadbeef',
+      chatId: '-100123',
+      threadId: 7,
+      entries,
+      deliveredAt: Date.now(),
+    })
+    // Pending is now empty — a second operator-activity event posts nothing.
+    expect(store.listPending()).toEqual([])
+    const digest = store.getDigest('deadbeef')
+    expect(digest?.entries).toHaveLength(2)
+    expect(digest?.entries.map(e => e.action)).toEqual(['post to Brevo', 'send email'])
+  })
+
+  it('removeDigest drops the delivered record (dismiss / retry consumed it)', () => {
+    const store = createMissedApprovalsStore(dir)
+    store.add(entry({ requestId: 'a' }))
+    store.promoteToDigest({
+      digestId: 'cafef00d',
+      chatId: '-100123',
+      threadId: 7,
+      entries: store.listPending(),
+      deliveredAt: Date.now(),
+    })
+    expect(store.getDigest('cafef00d')).toBeDefined()
+    store.removeDigest('cafef00d')
+    expect(store.getDigest('cafef00d')).toBeUndefined()
+  })
+
+  it('promote + remove survive reload', () => {
+    const s1 = createMissedApprovalsStore(dir)
+    s1.add(entry({ requestId: 'a' }))
+    s1.promoteToDigest({
+      digestId: 'd1',
+      chatId: '-100123',
+      threadId: null,
+      entries: s1.listPending(),
+      deliveredAt: Date.now(),
+    })
+    const s2 = createMissedApprovalsStore(dir)
+    expect(s2.getDigest('d1')?.entries).toHaveLength(1)
+    expect(s2.listPending()).toEqual([])
+  })
+
+  it('clear() wipes the backing file', () => {
+    const store = createMissedApprovalsStore(dir)
+    store.add(entry())
+    store.clear()
+    expect(store.listPending()).toEqual([])
+  })
+
+  it('tolerates a corrupt backing file (returns empty)', () => {
+    const store = createMissedApprovalsStore(dir)
+    // Write garbage directly, then ensure reads don't throw.
+    writeFileSync(join(dir, 'missed-approvals.json'), 'not json')
+    expect(store.listPending()).toEqual([])
+  })
+})

package/telegram-plugin/tests/missed-approvals-wiring.test.ts

@@ -0,0 +1,89 @@
+/**
+ * Source-text pins for the missed-approvals re-offer wiring (#2862).
+ *
+ * gateway.ts has top-level side effects and isn't unit-importable; the store
+ * and card logic are unit-tested in missed-approvals-store.test.ts /
+ * missed-approvals-card.test.ts. These pins lock the gateway wiring so it can't
+ * silently regress:
+ *   - the store is constructed + kill switch defined;
+ *   - the TTL auto-deny appends the miss (anchored to the card origin);
+ *   - all three operator-activity paths trigger the digest;
+ *   - the digest posts ONE card per surface then promotes (clears pending);
+ *   - the callback dispatcher routes `missre:`;
+ *   - retry rides deliverResumeSyntheticOrBuffer; dismiss removes + edits.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const read = (p: string) => readFileSync(resolve(__dirname, '..', p), 'utf8')
+const GATEWAY = read('gateway/gateway.ts')
+
+function slice(src: string, header: string, span = 2000): string {
+  const start = src.indexOf(header)
+  expect(start, `expected to find ${header}`).toBeGreaterThan(-1)
+  return src.slice(start, start + span)
+}
+
+describe('missed-approvals re-offer wiring (#2862)', () => {
+  it('constructs the persisted store and defines the kill switch', () => {
+    expect(GATEWAY).toContain('createMissedApprovalsStore(STATE_DIR)')
+    expect(GATEWAY).toContain('SWITCHROOM_MISSED_APPROVAL_REOFFER')
+    expect(GATEWAY).toMatch(/MISSED_APPROVAL_REOFFER_ENABLED\s*=\s*\n?\s*process\.env\.SWITCHROOM_MISSED_APPROVAL_REOFFER !== '0'/)
+  })
+
+  it('appends the miss at TTL auto-deny, anchored to the card origin, gated by the kill switch', () => {
+    // Within the pending-permission TTL sweep block.
+    const sweep = slice(GATEWAY, 'for (const [k, v] of pendingPermissions)', 3600)
+    expect(sweep).toContain('if (MISSED_APPROVAL_REOFFER_ENABLED) {')
+    expect(sweep).toContain('missedApprovalsStore.add({')
+    expect(sweep).toContain('const origin = v.cards[0]')
+    expect(sweep).toContain('action: naturalAction(v.tool_name, v.input_preview)')
+  })
+
+  it('all three operator-activity paths trigger the digest', () => {
+    const calls = GATEWAY.match(/maybePostMissedApprovalDigest\(/g) ?? []
+    // 1 definition + 3 activity callsites.
+    expect(calls.length).toBeGreaterThanOrEqual(4)
+    expect(GATEWAY).toContain("maybePostMissedApprovalDigest('operator inbound')")
+    expect(GATEWAY).toContain("maybePostMissedApprovalDigest('operator answered via /approve|/deny')")
+    expect(GATEWAY).toContain("maybePostMissedApprovalDigest('operator answered a permission card')")
+  })
+
+  it('the digest posts one card per surface, then promotes (clears pending → posts once)', () => {
+    const fn = slice(GATEWAY, 'function maybePostMissedApprovalDigest(', 2400)
+    expect(fn).toContain('if (!MISSED_APPROVAL_REOFFER_ENABLED) return')
+    expect(fn).toContain('missedApprovalsStore.listPending()')
+    // Groups by origin surface.
+    expect(fn).toMatch(/const groups = new Map/)
+    expect(fn).toContain('missedApprovalsKeyboard(digestId)')
+    expect(fn).toContain('missedApprovalsStore.promoteToDigest({')
+  })
+
+  it('routes the missre: callback family', () => {
+    expect(GATEWAY).toContain("data.startsWith('missre:')")
+    expect(GATEWAY).toContain('handleMissedApprovalCallback(ctx, data)')
+  })
+
+  it('retry injects a synthetic inbound via the shared resume-or-buffer path', () => {
+    const fn = slice(GATEWAY, 'async function handleMissedApprovalCallback(', 2600)
+    // authorization gate first.
+    expect(fn).toContain('access.allowFrom.includes(senderId)')
+    // retry synthesizes + delivers via the cron/synthetic inbound primitive.
+    expect(fn).toContain('buildMissedApprovalRetryInbound({')
+    expect(fn).toContain('deliverResumeSyntheticOrBuffer(agent, synthetic)')
+    // dismiss clears the record + edits the card closed.
+    expect(fn).toContain('missedApprovalsStore.removeDigest(parsed.digestId)')
+    expect(fn).toContain('Dismissed')
+  })
+
+  it('never synthesizes a verdict on retry (no-self-escalation)', () => {
+    const fn = slice(GATEWAY, 'async function handleMissedApprovalCallback(', 2600)
+    // The handler must not dispatch a permission verdict — retry is a question.
+    expect(fn).not.toContain('dispatchPermissionVerdict')
+    expect(fn).not.toContain("behavior: 'allow'")
+  })
+})