switchroom 0.18.15 → 0.18.18

package/telegram-plugin/tests/tier-downgrade-wiring.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Integration test for the tier-downgrade GLUE (`runTierDowngrade`,
+ * tier-downgrade-wiring.ts) — the gateway orchestration the pure
+ * `decideTierDowngrade` / `renderTierDowngradeNotice` tests do NOT cover.
+ *
+ * This is the test the @overlord review asked for (the MEDIUM "reverts to
+ * fable" misinform slipped through precisely because the glue that emits the
+ * BROADCAST notice text had no test — only the pure renderer did). It drives
+ * the real runner with injected seams and PINS the broadcast notice:
+ *   - asserts the resume-on-DEFAULT wording + the manual re-issue instruction;
+ *   - FAILS on any revert-to-premium phrasing (the exact regression).
+ * It also covers the resume-gate suppression path and the carrier-before-arm
+ * ordering invariant.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  runTierDowngrade,
+  type TierDowngradeRunnerDeps,
+  type TierDowngradeOutcome,
+} from '../gateway/tier-downgrade-wiring.js'
+
+interface Recorder {
+  carrier: Array<{ dir: string; toModel: string; cfg: string }>
+  arms: number
+  markers: Array<{ dir: string; premiumModel: string }>
+  notices: string[]
+  restarts: string[]
+  logs: string[]
+}
+
+function makeDeps(
+  over: Partial<TierDowngradeRunnerDeps> & {
+    sessionOverride?: string | null
+    configuredDefault?: string | null
+    gateVerdict?: 'resume' | 'skip-inflight' | 'skip-stale'
+    carrierThrows?: boolean
+    markerThrows?: boolean
+    agentDir?: string | null
+  } = {},
+): { deps: TierDowngradeRunnerDeps; rec: Recorder } {
+  const rec: Recorder = { carrier: [], arms: 0, markers: [], notices: [], restarts: [], logs: [] }
+  // A near-identity resolver like the real resolveMainModel: the unset/`default`
+  // sentinel maps to the switchroom default, everything else is itself.
+  const resolve = (t: string): string => (t === '' || t === 'default' ? 'claude-opus-4-8' : t)
+  const deps: TierDowngradeRunnerDeps = {
+    getAgentDir: () => (over.agentDir === undefined ? '/tmp/agent' : over.agentDir),
+    getConfiguredDefault: () => (over.configuredDefault === undefined ? 'opus' : over.configuredDefault),
+    getSessionOverride: () => (over.sessionOverride === undefined ? 'fable' : over.sessionOverride),
+    resolve,
+    peekResumeGate: () => over.gateVerdict ?? 'resume',
+    writeCarrier: (dir, toModel, cfg) => {
+      if (over.carrierThrows) throw new Error('disk full')
+      rec.carrier.push({ dir, toModel, cfg })
+    },
+    armResumeGate: () => {
+      rec.arms += 1
+    },
+    writeRecoveryMarker: (dir, premiumModel) => {
+      if (over.markerThrows) throw new Error('marker write failed')
+      rec.markers.push({ dir, premiumModel })
+    },
+    broadcastNotice: (md) => rec.notices.push(md),
+    selfRestart: (agent) => rec.restarts.push(agent),
+    selfAgent: (t) => `self-${t}`,
+    log: (msg) => rec.logs.push(msg),
+    ...over,
+  }
+  return { deps, rec }
+}
+
+describe('runTierDowngrade — broadcast notice honesty (the pinned regression)', () => {
+  it('downgrade path broadcasts EXACTLY ONE notice with resume-on-default wording', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: 'fable', configuredDefault: 'opus' })
+    const outcome: TierDowngradeOutcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('downgraded')
+    expect(rec.notices).toHaveLength(1)
+    const notice = rec.notices[0]
+    // Resume-on-DEFAULT + the manual re-issue instruction.
+    expect(notice).toContain('`opus`')
+    expect(notice).toContain('/model fable')
+    expect(notice.toLowerCase()).toContain("won't switch back on its own")
+  })
+
+  it('the notice NEVER promises a revert to the premium model (the MEDIUM regression)', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: 'fable', configuredDefault: 'opus' })
+    runTierDowngrade('klanker', deps)
+    const notice = rec.notices[0].toLowerCase()
+    // The exact false phrasing from the pre-5d9bbf44 revision, and its kin.
+    expect(notice).not.toContain('reverts to `fable`')
+    expect(notice).not.toContain('revert to `fable`')
+    expect(notice).not.toMatch(/reverts? to fable/)
+    expect(notice).not.toMatch(/switch(es)? back.*on (the )?next restart/)
+    expect(notice).not.toMatch(/automatically.*(fable|premium)/)
+  })
+})
+
+describe('runTierDowngrade — side-effect ordering + outcomes', () => {
+  it('downgrade: carrier written BEFORE the arm, marker + notice + restart all fire', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: 'fable', configuredDefault: 'opus' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('downgraded')
+    expect(rec.carrier).toEqual([{ dir: '/tmp/agent', toModel: 'opus', cfg: 'opus' }])
+    expect(rec.arms).toBe(1)
+    expect(rec.markers).toEqual([{ dir: '/tmp/agent', premiumModel: 'fable' }])
+    expect(rec.restarts).toEqual(['self-klanker'])
+  })
+
+  it('carrier write THROWS → abort: NO arm, NO marker, NO notice, NO restart (skip)', () => {
+    const { deps, rec } = makeDeps({ carrierThrows: true })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.arms).toBe(0)
+    expect(rec.markers).toHaveLength(0)
+    expect(rec.notices).toHaveLength(0)
+    expect(rec.restarts).toHaveLength(0)
+  })
+
+  it('marker write THROWS → downgrade still completes (marker is best-effort)', () => {
+    const { deps, rec } = makeDeps({ markerThrows: true })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('downgraded')
+    expect(rec.arms).toBe(1)
+    expect(rec.notices).toHaveLength(1)
+    expect(rec.restarts).toEqual(['self-klanker'])
+    expect(rec.markers).toHaveLength(0)
+  })
+
+  it('resume-gate skip-inflight → restart-pending, NO notice, NO restart, NO carrier', () => {
+    const { deps, rec } = makeDeps({ gateVerdict: 'skip-inflight' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('restart-pending')
+    expect(rec.carrier).toHaveLength(0)
+    expect(rec.arms).toBe(0)
+    expect(rec.notices).toHaveLength(0)
+    expect(rec.restarts).toHaveLength(0)
+  })
+
+  it('resume-gate skip-stale → skip (give up), NO notice/restart', () => {
+    const { deps, rec } = makeDeps({ gateVerdict: 'skip-stale' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.notices).toHaveLength(0)
+    expect(rec.restarts).toHaveLength(0)
+  })
+
+  it('session on the configured default (override null) → skip, no downgrade', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: null })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.notices).toHaveLength(0)
+  })
+
+  it('unresolved configured default → skip (never downgrade blind)', () => {
+    const { deps, rec } = makeDeps({ configuredDefault: '' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.carrier).toHaveLength(0)
+  })
+
+  it('no agent dir → skip immediately', () => {
+    const { deps } = makeDeps({ agentDir: null })
+    expect(runTierDowngrade('klanker', deps)).toBe('skip')
+  })
+})

package/telegram-plugin/tests/tier-downgrade.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Unit tests for the MODEL-TIER downgrade failover (second recovery tier).
+ *
+ * The pure `decideTierDowngrade` owns the decision the gateway consults inside
+ * the `all-blocked` branch of doFireFleetAutoFallback — i.e. AFTER account-swap
+ * has been tried and found no account still serving the walled premium model.
+ * `planTierDowngrade` then routes that decision + the resume-gate verdict into
+ * what the gateway should DO (downgrade / suppress the give-up / fall through),
+ * and `renderTierDowngradeNotice` owns the exact user-facing wording. All three
+ * are pure so the decision, the concurrent-turn suppression (LOW-9a), and the
+ * honesty of the broadcast (no "revert to the premium model" promise) are pinned
+ * without a process restart.
+ *
+ * Contract (post loop-guard reconciliation, option b — the ceremonial
+ * `.tier-downgrade-attempts` counter was REMOVED):
+ *   - overload + the session is NOT on a premium model (override null, or the
+ *     override resolves to the configured default) → NO downgrade ('skip'); the
+ *     account-swap path already handled it or there is no lower tier to fall to.
+ *     This is also the natural loop bound: after the downgrade boot the override
+ *     is gone, so a re-entry lands on 'on-default' and never re-downgrades.
+ *   - overload + a premium model walled across ALL accounts → 'downgrade' to the
+ *     configured default.
+ *   - a resume restart already armed in this process (gate 'skip-inflight') →
+ *     'suppress': no give-up card, no re-downgrade (the armed restart resumes).
+ *   - the downgrade broadcast states resume-on-default + manual re-issue and
+ *     carries NO promise of an automatic revert to the premium model.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  decideTierDowngrade,
+  planTierDowngrade,
+  renderTierDowngradeNotice,
+} from '../tier-downgrade.js'
+
+// The gateway passes resolveMainModel; here a near-identity resolver (maps the
+// unset/`default` sentinel to the switchroom default, exactly like the real one)
+// is enough to exercise the canonicalization guard.
+const resolve = (t: string): string =>
+  t === '' || t === 'default' ? 'claude-sonnet-5' : t
+
+describe('decideTierDowngrade — precedence + downgrade target', () => {
+  it('NO downgrade when the session is on the configured default (override null)', () => {
+    // Overload + account-swap all-blocked, but nothing premium is active — the
+    // account-swap path owns this and there is no lower tier. => skip.
+    const d = decideTierDowngrade({ sessionOverride: null, configuredDefault: 'opus', resolve })
+    expect(d).toEqual({ action: 'skip', reason: 'on-default' })
+  })
+
+  it('NO downgrade when the override resolves to the configured default (alias vs id)', () => {
+    // A premium-looking override that is actually the default in another spelling
+    // must never read as a premium tier (that would loop). Same resolver both
+    // sides → on-default.
+    const d = decideTierDowngrade({
+      sessionOverride: 'default',
+      configuredDefault: 'claude-sonnet-5',
+      resolve,
+    })
+    expect(d).toEqual({ action: 'skip', reason: 'on-default' })
+  })
+
+  it('NO downgrade (and no blind fall) when the configured default is unreadable', () => {
+    const d = decideTierDowngrade({ sessionOverride: 'fable', configuredDefault: null, resolve })
+    expect(d).toEqual({ action: 'skip', reason: 'unresolved' })
+  })
+
+  it('DOWNGRADES a walled premium model to the configured default', () => {
+    const d = decideTierDowngrade({ sessionOverride: 'fable', configuredDefault: 'opus', resolve })
+    expect(d).toEqual({ action: 'downgrade', toModel: 'opus', fromModel: 'fable' })
+  })
+
+  it('downgrade target is GENERAL — any premium model → the agent default (not hardcoded fable→opus)', () => {
+    const d = decideTierDowngrade({
+      sessionOverride: 'sr-x-ai/grok-4',
+      configuredDefault: 'claude-sonnet-5',
+      resolve,
+    })
+    expect(d).toEqual({ action: 'downgrade', toModel: 'claude-sonnet-5', fromModel: 'sr-x-ai/grok-4' })
+  })
+})
+
+describe('renderTierDowngradeNotice — HONEST wording (no revert-to-premium promise)', () => {
+  const notice = renderTierDowngradeNotice('fable', 'opus', 'klanker')
+
+  it('states the turn resumes on the DEFAULT to keep working', () => {
+    expect(notice).toContain('opus')
+    expect(notice.toLowerCase()).toContain('resuming on the default')
+  })
+
+  it('tells the user to RE-ISSUE the premium /model themselves', () => {
+    expect(notice).toContain('/model fable')
+    expect(notice.toLowerCase()).toContain("won't switch back on its own")
+  })
+
+  it("carries NO promise of an automatic revert to the premium/fable model", () => {
+    // The HIGH finding: the prior wording lied ("It reverts to `fable` on the
+    // next restart"). Assert none of those false promises can creep back.
+    const lower = notice.toLowerCase()
+    expect(lower).not.toMatch(/reverts? to `?fable/)
+    expect(lower).not.toContain('reverts to `fable`')
+    expect(lower).not.toContain('on the next restart')
+    expect(lower).not.toMatch(/revert(s|ing)? to the premium/)
+    expect(lower).not.toMatch(/back to `?fable`? (on|at|after)/)
+  })
+})
+
+describe('planTierDowngrade — routing (downgrade / suppress / skip)', () => {
+  const skipDecision = { action: 'skip', reason: 'on-default' } as const
+  const downgradeDecision = { action: 'downgrade', toModel: 'opus', fromModel: 'fable' } as const
+
+  it("a 'skip' decision routes to 'skip' regardless of the gate verdict", () => {
+    expect(planTierDowngrade(skipDecision, 'resume', 'ag').kind).toBe('skip')
+    expect(planTierDowngrade(skipDecision, 'skip-inflight', 'ag').kind).toBe('skip')
+    expect(planTierDowngrade(skipDecision, 'skip-stale', 'ag').kind).toBe('skip')
+  })
+
+  it("downgrade + gate 'resume' → 'downgrade' with the honest notice", () => {
+    const plan = planTierDowngrade(downgradeDecision, 'resume', 'klanker')
+    expect(plan.kind).toBe('downgrade')
+    if (plan.kind === 'downgrade') {
+      expect(plan.toModel).toBe('opus')
+      expect(plan.fromModel).toBe('fable')
+      // The plan carries EXACTLY the honest renderer output — no revert promise.
+      expect(plan.notice).toBe(renderTierDowngradeNotice('fable', 'opus', 'klanker'))
+      expect(plan.notice.toLowerCase()).not.toContain('on the next restart')
+    }
+  })
+
+  it("LOW-9a: downgrade + gate 'skip-inflight' → 'suppress' (a resume restart is already armed, no give-up card)", () => {
+    // Two turns hit all-blocked in the same pre-restart process. Turn 1 armed a
+    // downgrade (or account-swap) restart. Turn 2 must NOT broadcast a "could
+    // not be recovered" give-up — the armed restart resumes the interrupted turn.
+    const plan = planTierDowngrade(downgradeDecision, 'skip-inflight', 'klanker')
+    expect(plan.kind).toBe('suppress')
+  })
+
+  it("downgrade + gate 'skip-stale' → 'skip' (turn too old to resume; fall through to the all-blocked card)", () => {
+    const plan = planTierDowngrade(downgradeDecision, 'skip-stale', 'klanker')
+    expect(plan.kind).toBe('skip')
+  })
+})

package/telegram-plugin/tests/unhandled-rejection-policy.test.ts

@@ -11,7 +11,7 @@
 import { describe, it, expect } from 'bun:test'
 import { GrammyError } from 'grammy'
 import { classifyRejection } from '../gateway/unhandled-rejection-policy.js'
-import { FLOOD_WAIT_ACTIVE } from '../retry-api-call.js'
+import { FLOOD_WAIT_ACTIVE, LOCAL_RESOURCE_EXHAUSTED } from '../retry-api-call.js'
 
 // ── Real GrammyError fixtures ──────────────────────────────────────────────
 
@@ -241,3 +241,29 @@ describe('classifyRejection — FLOOD_WAIT_ACTIVE marker (#3084)', () => {
     expect(classifyRejection(new Error('FLOOD_WAIT_ACTIVE-ish but not it'))).toBe('shutdown')
   })
 })
+
+describe('classifyRejection — LOCAL_RESOURCE_EXHAUSTED marker (#3099)', () => {
+  // retry-api-call throws this plain Error marker (retry-api-call.ts:344) when a
+  // send fails on LOCAL disk/memory exhaustion (ENOSPC/EDQUOT/EIO/ENOMEM) rather
+  // than retrying it (#2923). Like its sibling FLOOD_WAIT_ACTIVE it is a plain
+  // Error, not a GrammyError, so without an explicit entry it fell into the
+  // `!isGrammy → shutdown` branch — crashing the gateway when the box is ALREADY
+  // out of disk, which drives a fresh round of boot-time sends/staging writes at
+  // an exhausted resource (the amplification the #2923 marker exists to avoid).
+  it('returns "log_only" for a leaked LOCAL_RESOURCE_EXHAUSTED marker', () => {
+    // Mirror the real throw shape from retry-api-call.ts:344 —
+    // `Object.assign(new Error(LOCAL_RESOURCE_EXHAUSTED), { original: err })`.
+    const err = Object.assign(new Error(LOCAL_RESOURCE_EXHAUSTED), {
+      original: Object.assign(new Error('ENOSPC: no space left on device'), {
+        code: 'ENOSPC',
+      }),
+    })
+    expect(classifyRejection(err)).toBe('log_only')
+  })
+
+  it('still returns "shutdown" for an unrelated plain Error', () => {
+    expect(
+      classifyRejection(new Error('LOCAL_RESOURCE_EXHAUSTED-ish but not it')),
+    ).toBe('shutdown')
+  })
+})

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -7,6 +7,7 @@ import {
   type BotApiForWorkerFeed,
 } from '../worker-activity-feed.js'
 import { STATUS_ROLLING_LINES, STATUS_LINE_MAX } from '../status-no-truncate.js'
+import { SEND_GATE_SHED } from '../send-gate.js'
 
 describe('isWorkerActivityFeedEnabled (default ON)', () => {
   it('defaults to true when the env var is unset', () => {
@@ -532,17 +533,20 @@ describe('createWorkerActivityFeed — log sink', () => {
     const edit = logs.find((l) => l.startsWith('worker-feed: edit'))
     const finish = logs.find((l) => l.startsWith('worker-feed: finish'))
 
+    // The feed message is per-(chat,thread) now (workers coalesce), so the
+    // paint/edit lines are feed-scoped; the terminal `finish` line still names
+    // the finishing worker + its state.
     expect(paint).toBeDefined()
-    expect(paint).toContain('agent=w-research')
     expect(paint).toContain('chat=chat-9')
     expect(paint).toContain('thread=7')
     expect(paint).toMatch(/msgId=\d+/)
     expect(paint).toMatch(/bytes=\d+/)
 
     expect(edit).toBeDefined()
-    expect(edit).toContain('agent=w-research')
+    expect(edit).toContain('chat=chat-9')
 
     expect(finish).toBeDefined()
+    expect(finish).toContain('agent=w-research')
     expect(finish).toContain('state=done')
   })
 
@@ -1336,3 +1340,209 @@ describe('narrative dedup — non-adjacent repeats collapse (A,B,A)', () => {
     expect(last.text).toContain('step-repeat')
   })
 })
+
+// ─── send-gate shed contract (#3174) ────────────────────────────────────────
+//
+// The feed's send/edit adapters transit the deterministic send gate
+// (telegram-plugin/send-gate.ts, #3084), wired at the robustApiCall layer. The
+// gate SHEDS a call — resolves `undefined` WITHOUT hitting the API — when a
+// flood window is open (or a `useful` send exceeds its queue TTL, or a cosmetic
+// edit finds no free token). Before this fix the first-paint path dereferenced
+// `sent.message_id` on that `undefined`, throwing every heartbeat tick (~6s) for
+// the whole ban — 578 `undefined is not an object (evaluating 'sent.message_id')`
+// crashes in one 6h flood ban on 2026-07-12. These tests pin the shed contract:
+// (a) an open flood window parks the handle and makes ZERO api calls; (b) an
+// undefined send is treated as NOT-delivered (no crash, no phantom message id);
+// (c)/(d) an undefined edit is not recorded as on-screen (shed honesty, mirroring
+// PR #3173) so the update re-sends once the gate clears.
+
+interface GateBot extends BotApiForWorkerFeed {
+  /** Times sendMessage was INVOKED (attempts), delivered or shed. */
+  sendCalls: number
+  /** Times editMessageText was INVOKED (attempts), delivered or shed. */
+  editCalls: number
+  /** DELIVERED sends (gate admitted). */
+  sent: Array<{ text: string }>
+  /** DELIVERED edits (gate admitted). */
+  edits: Array<{ messageId: number; text: string }>
+  /**
+   * One-shot: shed the next send even with the window closed. Faithful to the
+   * gate: a worker-feed SEND is `useful` (never `cosmetic`), so a gate that
+   * can't admit it resolves `undefined` (queue-TTL `expired`) — NEVER the
+   * cosmetic-only SEND_GATE_SHED sentinel. The feed's send-shed detection is
+   * structural (`typeof sent.message_id !== 'number'`), catching either.
+   */
+  shedNextSend: boolean
+  /**
+   * One-shot: shed the next EDIT even with the window closed. Faithful to the
+   * gate: worker-feed edits are `cosmetic`, so a gate shed resolves the
+   * distinguishable SEND_GATE_SHED sentinel (#3110 F1) — NOT `undefined` (which
+   * the gate reserves for a benign no-op drop whose payload IS on screen).
+   */
+  shedNextEdit: boolean
+}
+
+/**
+ * A bot adapter that models the send gate: it SHEDS (without recording a
+ * delivery) whenever the injected flood probe reports an open window, or a
+ * one-shot `shedNext*` flag is set (the race where the window opens between the
+ * feed's probe read and the send). Faithful to the post-#3110 contract: a shed
+ * EDIT resolves the SEND_GATE_SHED sentinel (cosmetic shed), a shed SEND
+ * resolves `undefined` (`useful` queue-TTL expiry). A DELIVERED edit resolves a
+ * non-shed value (`{}` — grammy returns `true`/`Message`).
+ */
+function makeGateBot(floodRemaining: () => number): GateBot {
+  let nextId = 1000
+  const gb: GateBot = {
+    sendCalls: 0,
+    editCalls: 0,
+    sent: [],
+    edits: [],
+    shedNextSend: false,
+    shedNextEdit: false,
+    sendMessage: async (_chatId, text) => {
+      gb.sendCalls++
+      if (floodRemaining() > 0 || gb.shedNextSend) {
+        gb.shedNextSend = false
+        return undefined as unknown as { message_id: number }
+      }
+      gb.sent.push({ text })
+      return { message_id: nextId++ }
+    },
+    editMessageText: async (_chatId, messageId, text) => {
+      gb.editCalls++
+      if (floodRemaining() > 0 || gb.shedNextEdit) {
+        gb.shedNextEdit = false
+        return SEND_GATE_SHED as unknown as undefined
+      }
+      gb.edits.push({ messageId, text })
+      return {}
+    },
+  }
+  return gb
+}
+
+describe('worker-feed send-gate shed contract', () => {
+  it('makes ZERO api calls while a flood window is open, then paints full state after it closes', async () => {
+    let clock = 0
+    const untilTs = 6 * 60 * 60 * 1000 // a 6h ban, as observed 2026-07-12
+    const probe = () => Math.max(0, untilTs - clock)
+    const bot = makeGateBot(probe)
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      floodWaitRemainingMs: probe,
+    })
+
+    // Drive the heartbeat cadence hammering the feed for the whole ban.
+    for (let i = 0; i < 30; i++) {
+      clock += 6000
+      await feed.update('w1', 'chat', view({ elapsedMs: clock }))
+    }
+    // Parked on the window — never even called the API (the whole point).
+    expect(bot.sendCalls).toBe(0)
+    expect(bot.sent).toHaveLength(0)
+    expect(feed.has('w1')).toBe(false)
+
+    // Window closes: the next tick paints full state exactly once.
+    clock = untilTs + 1000
+    await feed.update('w1', 'chat', view({ elapsedMs: clock }))
+    expect(bot.sendCalls).toBe(1)
+    expect(bot.sent).toHaveLength(1)
+    expect(bot.sent[0].text).toContain('🛠 **Worker**')
+    expect(feed.has('w1')).toBe(true)
+  })
+
+  it('treats an undefined send result as not-delivered — no crash, no phantom message id', async () => {
+    let clock = 10_000
+    const logs: string[] = []
+    const bot = makeGateBot(() => 0) // probe reads clear …
+    bot.shedNextSend = true // … but the gate sheds this send (race)
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      floodWaitRemainingMs: () => 0,
+      log: (m) => logs.push(m),
+    })
+
+    await feed.update('w1', 'chat', view())
+    expect(bot.sendCalls).toBe(1) // it attempted the send
+    expect(bot.sent).toHaveLength(0) // but nothing was delivered
+    expect(feed.messageIdOf('w1')).toBeNull() // and no phantom message id recorded
+    expect(feed.has('w1')).toBe(false)
+    // Regression pin: the old code dereferenced `undefined.message_id` and logged
+    // it as a hard "send failed"; the shed is now a recognized, clean skip.
+    expect(logs.some((l) => l.startsWith('worker-feed: send failed'))).toBe(false)
+    expect(logs.some((l) => l.includes('shed by send gate'))).toBe(true)
+
+    // The next paint (gate no longer shedding) lands cleanly.
+    clock = 20_000
+    await feed.update('w1', 'chat', view())
+    expect(bot.sent).toHaveLength(1)
+    expect(feed.has('w1')).toBe(true)
+  })
+
+  it('does not record a shed cosmetic edit as on-screen — the update re-sends after the gate clears', async () => {
+    let clock = 10_000
+    const bot = makeGateBot(() => 0)
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      floodWaitRemainingMs: () => 0,
+    })
+
+    await feed.update('w1', 'chat', view({ toolCount: 1 }))
+    expect(bot.sent).toHaveLength(1)
+
+    // Gate sheds the edit (undefined) — it is NOT on screen.
+    clock = 20_000
+    bot.shedNextEdit = true
+    await feed.update('w1', 'chat', view({ toolCount: 2 }))
+    expect(bot.editCalls).toBe(1)
+    expect(bot.edits).toHaveLength(0)
+
+    // Shed honesty: the SAME update re-sends once the gate clears — the shed
+    // payload was never recorded as `lastBody`, so it is not dropped as a dup.
+    clock = 30_000
+    await feed.update('w1', 'chat', view({ toolCount: 2 }))
+    expect(bot.edits).toHaveLength(1)
+    expect(bot.edits[0].text).toContain('2 tools')
+  })
+
+  it('does not falsely finalize on a shed terminal edit — re-drives the finalize once the gate clears', async () => {
+    let clock = 10_000
+    const bot = makeGateBot(() => 0)
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      floodWaitRemainingMs: () => 0,
+    })
+
+    await feed.update('w1', 'chat', view({ toolCount: 1 }))
+    expect(bot.sent).toHaveLength(1)
+
+    // Gate sheds the terminal edit (undefined).
+    clock = 20_000
+    bot.shedNextEdit = true
+    await feed.finish('w1', view({ state: 'done', toolCount: 5 }))
+    expect(bot.editCalls).toBe(1)
+    expect(bot.edits).toHaveLength(0)
+    // NOT finalized: the handle survives (pendingFinish staged) rather than
+    // being torn down with the card frozen on its last running render.
+    expect(feed.has('w1')).toBe(true)
+
+    // Re-drive with the gate clear: the terminal recap lands and the handle
+    // finalizes.
+    clock = 30_000
+    await feed.finish('w1', view({ state: 'done', toolCount: 5 }))
+    expect(bot.edits).toHaveLength(1)
+    expect(bot.edits[0].text).toContain('_done · 5 tools')
+    expect(feed.has('w1')).toBe(false)
+  })
+})