switchroom 0.18.30 → 0.18.32

package/telegram-plugin/tests/backstop-readback-probe.test.ts

@@ -0,0 +1,144 @@
+/**
+ * #3278 — read-back confirmation probe primitive (outbound-send-path.ts).
+ *
+ * `classifyReadBackError` maps a raw grammy `editMessageText` FAILURE into the
+ * confirmation tri-state, and `createBackstopReadBackProbe` combines a chunk's
+ * per-id probes into the chunk verdict `runBackstopDelivery` consumes. These
+ * assert OUTCOMES: which error shape means present vs absent vs ambiguous, and
+ * that a length-resplit chunk (>1 id) is confirmed only if EVERY id is present.
+ */
+import { describe, test, expect, vi } from 'vitest'
+import { GrammyError } from 'grammy'
+import {
+  classifyReadBackError,
+  createBackstopReadBackProbe,
+  createBackstopReadBack,
+} from '../gateway/outbound-send-path.js'
+import type { ReadBackResult } from '../gateway/backstop-delivery.js'
+
+// GrammyError's constructor takes (message, payload, method, parameters).
+function grammy(code: number, description: string): GrammyError {
+  return new GrammyError(
+    `Call to 'editMessageText' failed! (${code}: ${description})`,
+    { ok: false, error_code: code, description },
+    'editMessageText',
+    {},
+  )
+}
+
+describe('#3278 classifyReadBackError — raw edit-failure → confirmation tri-state', () => {
+  test('400 "message to edit not found" ⇒ absent (positive drop → safe re-send)', () => {
+    expect(classifyReadBackError(grammy(400, 'Bad Request: message to edit not found'))).toBe('absent')
+  })
+
+  test('400 "message is not modified" ⇒ exists (a no-op edit → message present)', () => {
+    expect(classifyReadBackError(grammy(400, 'Bad Request: message is not modified'))).toBe('exists')
+  })
+
+  test('429 flood ⇒ ambiguous (never re-send)', () => {
+    expect(classifyReadBackError(grammy(429, 'Too Many Requests: retry after 30'))).toBe('ambiguous')
+  })
+
+  test('5xx / non-grammy network error ⇒ ambiguous', () => {
+    expect(classifyReadBackError(grammy(500, 'Internal Server Error'))).toBe('ambiguous')
+    expect(classifyReadBackError(new Error('fetch failed: ECONNRESET'))).toBe('ambiguous')
+  })
+
+  test('an unrelated 400 (e.g. thread not found) is ambiguous, NOT absent', () => {
+    // A wrong-classification here would demote-and-re-send a message that may
+    // well exist — the never-demote-on-ambiguous rule guards against duplicates.
+    expect(classifyReadBackError(grammy(400, 'Bad Request: message thread not found'))).toBe('ambiguous')
+  })
+})
+
+describe('#3278 createBackstopReadBackProbe — per-chunk id combine', () => {
+  test('single id present ⇒ exists; probes the id with the SAME rich body', async () => {
+    const probeId = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const richMessage = vi.fn((s: string) => ({ rich: s }))
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage })
+    const verdict = await readBack(0, [111], 'answer')
+    expect(verdict).toBe('exists')
+    expect(richMessage).toHaveBeenCalledWith('answer')
+    expect(probeId).toHaveBeenCalledTimes(1)
+    expect(probeId).toHaveBeenCalledWith(111, { rich: 'answer' })
+  })
+
+  test('resplit chunk (2 ids): one absent ⇒ absent (whole chunk re-sent)', async () => {
+    const probeId = vi.fn(async (id: number): Promise<ReadBackResult> => (id === 12 ? 'absent' : 'exists'))
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage: (s) => s })
+    expect(await readBack(1, [11, 12], 'B')).toBe('absent')
+    expect(probeId).toHaveBeenCalledTimes(2) // every id of the chunk is probed
+  })
+
+  test('resplit chunk (2 ids): all present ⇒ exists', async () => {
+    const probeId = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage: (s) => s })
+    expect(await readBack(0, [1, 2], 'A')).toBe('exists')
+  })
+
+  test('empty id set ⇒ ambiguous and NEVER probes (no confirm, no demote)', async () => {
+    const probeId = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage: (s) => s })
+    expect(await readBack(0, [], 'A')).toBe('ambiguous')
+    expect(probeId).not.toHaveBeenCalled()
+  })
+})
+
+const SHED = Symbol.for('switchroom.send-gate.shed')
+
+describe('#3278 createBackstopReadBack — full gate+edit+classify wiring', () => {
+  function wiring(overrides: Partial<Parameters<typeof createBackstopReadBack>[0]> = {}) {
+    return {
+      editMessageText: vi.fn(async () => true), // edit applied → exists
+      gate: vi.fn(async (fn: () => Promise<unknown>) => fn()), // passthrough gate
+      isShed: (r: unknown) => r === SHED,
+      richMessage: (s: string) => ({ rich: s }),
+      chatId: '1001',
+      threadId: undefined as number | undefined,
+      ...overrides,
+    }
+  }
+
+  test('edit RESOLVES ⇒ exists; edits to the identical rich body (no visible mutation)', async () => {
+    const w = wiring()
+    const readBack = createBackstopReadBack(w)
+    expect(await readBack(0, [55], 'answer')).toBe('exists')
+    // Probed the landed id with the SAME rich body the chunk was sent with.
+    expect(w.editMessageText).toHaveBeenCalledWith(55, { rich: 'answer' }, expect.anything())
+    // Routed through the send gate (pacing) rather than a raw call.
+    expect(w.gate).toHaveBeenCalledTimes(1)
+  })
+
+  test('400 message-not-found ⇒ absent (safe re-send)', async () => {
+    const editMessageText = vi.fn(async () => {
+      throw new GrammyError('boom', { ok: false, error_code: 400, description: 'Bad Request: message to edit not found' }, 'editMessageText', {})
+    })
+    const readBack = createBackstopReadBack(wiring({ editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('absent')
+  })
+
+  test('400 not-modified ⇒ exists (a no-op edit on a present message)', async () => {
+    const editMessageText = vi.fn(async () => {
+      throw new GrammyError('boom', { ok: false, error_code: 400, description: 'Bad Request: message is not modified' }, 'editMessageText', {})
+    })
+    const readBack = createBackstopReadBack(wiring({ editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('exists')
+  })
+
+  test('429 flood ⇒ ambiguous (never re-send)', async () => {
+    const editMessageText = vi.fn(async () => {
+      throw new GrammyError('boom', { ok: false, error_code: 429, description: 'Too Many Requests' }, 'editMessageText', {})
+    })
+    const readBack = createBackstopReadBack(wiring({ editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
+  })
+
+  test('gate SHED (SEND_GATE_SHED sentinel) ⇒ ambiguous, NOT a false exists', async () => {
+    // Under a flood window the cosmetic probe sheds — the gate resolves the
+    // sentinel, not the edit. Must be ambiguous so the chunk is never demoted.
+    const gate = vi.fn(async () => SHED)
+    const editMessageText = vi.fn(async () => true)
+    const readBack = createBackstopReadBack(wiring({ gate, editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
+  })
+})

package/telegram-plugin/tests/buffer-gate-broadened.test.ts

@@ -36,6 +36,13 @@ const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
 )
+// #2996 P2: executeReply's body moved verbatim to outbound-send-path.ts
+// (`sendReply`); the post-send block assertions read there. The
+// `releaseTurnBufferGate` helper itself stays in gateway.ts.
+const sendPathSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
+  'utf-8',
+)
 
 describe('buffer-gate release decoupled from final-answer classification', () => {
   // Extract the helper's docstring (everything between the matching
@@ -102,8 +109,8 @@ describe('buffer-gate release decoupled from final-answer classification', () =>
   it('executeReply calls releaseTurnBufferGate OUTSIDE the isFinalAnswerReply branch', () => {
     // Slice the executeReply post-send block (between the anchor
     // comments and the next exported function).
-    const post = gatewaySrc.split("fresh sendMessage from reply tool is a user-visible")[1] ?? ''
-    const slice = post.split('\nasync function ')[0] ?? ''
+    const post = sendPathSrc.split("fresh sendMessage from reply tool is a user-visible")[1] ?? ''
+    const slice = post.split('\nexport async function ')[0] ?? ''
     // The narrow `isFinalAnswerReply`-gated finalize MUST stay (it
     // emits the 👍 reaction on the final-answer happy path).
     expect(slice).toMatch(/isFinalAnswerReply\(/)
@@ -131,9 +138,12 @@ describe('buffer-gate release decoupled from final-answer classification', () =>
     // helper is narrow on purpose. If future code adds new
     // callsites that aren't turn-terminal, the steer-vs-queue
     // semantics could drift.
-    const callMatches = gatewaySrc.match(/releaseTurnBufferGate\(/g) ?? []
-    // Definition + 2 callsites = 3:
-    //   - executeReply's post-send block (reply-finalize, the original).
+    // #2996 P2: the reply-finalize callsite moved (verbatim) into
+    // outbound-send-path.ts `sendReply`; gateway.ts keeps the definition,
+    // the halt callsite, and the deps-injection reference.
+    const callMatches = (gatewaySrc + sendPathSrc).match(/releaseTurnBufferGate\(/g) ?? []
+    // Definition + deps-interface member + 2 callsites = 4:
+    //   - sendReply's post-send block (reply-finalize, the original).
     //   - executeHaltNow (#3020): an interrupt-cancelled turn never reaches
     //     reply-finalize (the C-c killed it and no replacement inbound
     //     follows), so the halt IS that turn's terminal — releasing there is
@@ -142,6 +152,6 @@ describe('buffer-gate release decoupled from final-answer classification', () =>
     //     with executeStreamReply.)
     // If this count grows the test catches it; reviewer must justify
     // any new callsite.
-    expect(callMatches.length).toBe(3)
+    expect(callMatches.length).toBe(4)
   })
 })

package/telegram-plugin/tests/button-tap-turn-gated.test.ts

@@ -115,9 +115,9 @@ describe("agent button taps use the turn-gate (mid-turn → buffer)", () => {
     });
 
     it("buffers + spools on bridge-offline (existing behaviour intact)", () => {
-      // The idle-branch send missed → the reservation is released in lockstep
-      // and the tap is spooled to the pending-inbound buffer for replay.
-      expect(body).toMatch(/claudeBusyKeys\.delete\(reservedBusyKey\)/);
+      // The idle-branch send missed → the tap is spooled to the
+      // pending-inbound buffer for replay. (#2996 P1: the legacy busy-key
+      // reservation/release pair was deleted with the claudeBusyKeys set.)
       expect(body).toMatch(/return 'buffered-bridge-offline'/);
       // The bridge-offline buffer push is the LAST push (after the send miss),
       // so it always spools before returning the offline outcome.

package/telegram-plugin/tests/captured-answer-resume.test.ts

@@ -0,0 +1,358 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+// The dispatcher's resume closure reaches for the durable outbound-text oracle
+// (history.hasOutboundWithText) to reconcile crash-idempotency. Mock it so these
+// stay pure vitest unit tests (no bun:sqlite / real DB) and we can control the
+// "did this chunk's text land durably?" answer per scenario.
+let mockOracle: (chatId: string, text: string, threadId: number | null, since: number) => boolean = () => false
+vi.mock('../history.js', () => ({
+  hasOutboundWithText: (chatId: string, text: string, threadId: number | null, since: number) =>
+    mockOracle(chatId, text, threadId, since),
+}))
+
+import {
+  BackstopDeliveryLedger,
+  runBackstopDelivery,
+  type ReadBackResult,
+} from '../gateway/backstop-delivery.js'
+import { ObligationLedger, type Obligation } from '../gateway/obligation-ledger.js'
+import {
+  buildCapturedDeliverySnapshot,
+  hydrateResumeLedger,
+  createCapturedResumeDispatcher,
+  type CapturedResumeArgs,
+} from '../gateway/captured-answer-resume.js'
+
+/**
+ * #3282 — a partial turn-flush backstop that left an obligation OPEN used to be
+ * re-presented as a FRESH model generation, re-posting chunks that already
+ * landed (the user saw the head of the answer twice). These assert the
+ * deterministic OUTCOME of the fix — the represent is now a byte-identical
+ * captured-answer RESUME of ONLY the non-`landed-confirmed` tail:
+ *   (a) 3-chunk answer, tail fails ⇒ resume sends EXACTLY the unlanded tail,
+ *       chunk 0 is NEVER re-sent, and the chat ends with each chunk once;
+ *   (b) a restart between landing and confirmation does NOT re-send a chunk the
+ *       durable oracle proves landed;
+ *   (c) a fully-landed answer's represent sends NOTHING.
+ * A test that would still pass if the resume re-sent a confirmed chunk is not a
+ * test — every scenario asserts the exact `sendChunk` index set.
+ */
+
+beforeEach(() => {
+  mockOracle = () => false
+})
+
+function obligation(over: Partial<Obligation> = {}): Obligation {
+  return {
+    originTurnId: '#t1',
+    chatId: '900',
+    threadId: undefined,
+    messageId: 42,
+    text: 'the question',
+    openedAt: 1000,
+    representCount: 0,
+    ...over,
+  }
+}
+
+/** Simulate the ORIGINAL partial backstop delivery into `ledger`, then snapshot
+ *  it — the exact input the represent resume consumes. `landPlan(i)` returns the
+ *  per-chunk behavior: 'ok' (lands + confirms), 'throw' (send fails → unsent),
+ *  or 'unconfirmed' (lands but read-back ambiguous → landed-unconfirmed). */
+async function seedPartial(
+  ledger: BackstopDeliveryLedger,
+  turnId: string,
+  chunks: string[],
+  landPlan: (i: number) => 'ok' | 'throw' | 'unconfirmed',
+): Promise<void> {
+  await runBackstopDelivery(
+    ledger,
+    turnId,
+    chunks,
+    null,
+    {
+      sendChunk: async (i: number) => {
+        if (landPlan(i) === 'throw') throw new Error('FLOOD_WAIT_ACTIVE')
+        return [5000 + i]
+      },
+      readBack: async (i: number): Promise<ReadBackResult> =>
+        landPlan(i) === 'unconfirmed' ? 'ambiguous' : 'exists',
+    },
+    1, // a single attempt → a genuine partial (no in-fire retry masking it)
+  )
+}
+
+/** A fake `deliverAnswer` that faithfully replicates the gateway's RESUME path:
+ *  run the injected `hydrate`, then `runBackstopDelivery` over the captured
+ *  chunks with a `sendChunk` that records which indices are (re-)sent. */
+function makeResumeDeliverAnswer(ledger: BackstopDeliveryLedger, sentIdx: number[]) {
+  return async (a: CapturedResumeArgs): Promise<{ delivered: boolean; sentIds: number[] }> => {
+    a.resume.hydrate(ledger, a.turnId)
+    const res = await runBackstopDelivery(
+      ledger,
+      a.turnId,
+      a.resume.snapshot.chunks,
+      a.cardMessageId,
+      {
+        sendChunk: async (i: number) => {
+          sentIdx.push(i)
+          return [7000 + i]
+        },
+        readBack: async (): Promise<ReadBackResult> => 'exists',
+      },
+      3,
+    )
+    return { delivered: res.delivered, sentIds: res.sentIds }
+  }
+}
+
+async function flush(dispatcher: { inFlight: () => string[] }): Promise<void> {
+  for (let i = 0; i < 50 && dispatcher.inFlight().length > 0; i++) {
+    await new Promise((r) => setTimeout(r, 0))
+  }
+}
+
+describe('#3282 buildCapturedDeliverySnapshot — captures per-chunk landed state', () => {
+  it('captures landed chunks (ids + confirmed flag); an unsent chunk is absent', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const chunks = ['c0', 'c1', 'c2']
+    // chunk 0 confirmed, chunk 1 landed-unconfirmed, chunk 2 never sent.
+    await seedPartial(ledger, '#s', chunks, (i) => (i === 0 ? 'ok' : i === 1 ? 'unconfirmed' : 'throw'))
+    const snap = buildCapturedDeliverySnapshot(ledger, '#s', chunks)
+    expect(snap.chunks).toEqual(chunks)
+    const byIndex = Object.fromEntries(snap.chunkStates.map((s) => [s.index, s]))
+    expect(byIndex[0]).toMatchObject({ index: 0, confirmed: true })
+    expect(byIndex[0].messageIds.length).toBeGreaterThan(0)
+    expect(byIndex[1]).toMatchObject({ index: 1, confirmed: false })
+    expect(byIndex[2]).toBeUndefined() // never landed → not in the snapshot
+  })
+})
+
+describe('#3282 hydrateResumeLedger — rebuilds ledger + oracle reconcile', () => {
+  it('confirmed chunk ⇒ excluded from the resume send set; unsent chunk ⇒ included', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = {
+      chunks: ['c0', 'c1', 'c2'],
+      chunkStates: [{ index: 0, messageIds: [10], confirmed: true }],
+    }
+    hydrateResumeLedger(l, '#h', snap, () => false)
+    expect(l.hasConfirmedChunk('#h', 0)).toBe(true)
+    // chunk 0 confirmed → not resent; chunks 1,2 unsent → the resume tail.
+    expect(l.unsentIndices('#h', 3)).toEqual([1, 2])
+  })
+
+  it('landed-unconfirmed chunk ⇒ re-PROBED (landedUnconfirmed), not re-sent', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = {
+      chunks: ['c0', 'c1'],
+      chunkStates: [{ index: 0, messageIds: [10], confirmed: false }],
+    }
+    hydrateResumeLedger(l, '#h', snap, () => false)
+    expect(l.landedUnconfirmedIndices('#h', 2)).toEqual([0]) // will be re-probed
+    expect(l.unsentIndices('#h', 2)).toEqual([1]) // only chunk 1 is unsent
+  })
+
+  it('oracle proves a landed-unconfirmed chunk landed ⇒ CONFIRMED (crash-idempotency A5)', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = {
+      chunks: ['c0', 'c1'],
+      chunkStates: [{ index: 0, messageIds: [10], confirmed: false }],
+    }
+    // The durable outbound row for c0 exists → confirm without re-probe/re-send.
+    hydrateResumeLedger(l, '#h', snap, (txt) => txt === 'c0')
+    expect(l.hasConfirmedChunk('#h', 0)).toBe(true)
+    expect(l.landedUnconfirmedIndices('#h', 2)).toEqual([])
+    expect(l.unsentIndices('#h', 2)).toEqual([1])
+  })
+
+  it('a chunkState with no message ids is left unsent (never fabricates a landing)', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = { chunks: ['c0'], chunkStates: [{ index: 0, messageIds: [], confirmed: false }] }
+    hydrateResumeLedger(l, '#h', snap, () => false)
+    expect(l.unsentIndices('#h', 1)).toEqual([0])
+  })
+})
+
+describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome', () => {
+  it('(a) partial [0 confirmed, 1+2 unsent] ⇒ resume sends EXACTLY [1,2]; chunk 0 never re-sent; each chunk once', async () => {
+    const chunks = ['c0', 'c1', 'c2']
+    // Original delivery: chunk 0 lands+confirms, chunks 1,2 fail (unsent).
+    const orig = new BackstopDeliveryLedger()
+    await seedPartial(orig, '#t1', chunks, (i) => (i === 0 ? 'ok' : 'throw'))
+    const snapshot = buildCapturedDeliverySnapshot(orig, '#t1', chunks)
+    orig.clear('#t1') // the turn-flush GCs the in-memory ledger (state is durable)
+
+    // The represent runs on a FRESH ledger (as after a sweep / restart).
+    const resumeLedger = new BackstopDeliveryLedger()
+    const sentIdx: number[] = []
+    const oblLedger = new ObligationLedger(2)
+    const supersedes: Array<{ ids: number[] }> = []
+    const o = obligation({ capturedDelivery: snapshot })
+    oblLedger.openIfAbsent(o)
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: (_c, _t, rec) => supersedes.push({ ids: rec.messageIds }) },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    // The core anti-regression assertion: ONLY the unlanded tail is (re-)sent.
+    expect(sentIdx.sort()).toEqual([1, 2])
+    expect(sentIdx).not.toContain(0) // chunk 0 (already landed) NEVER re-posted
+    expect(oblLedger.isOpen('#t1')).toBe(false) // fully delivered ⇒ closed
+    // §4 — the supersede record covers the WHOLE delivered set (original landed
+    // chunk 0's id 5000 + the resumed tail's ids), keyed by turn so a late reply
+    // corrects the complete answer in place.
+    expect(supersedes.at(-1)?.ids).toEqual([5000, 7001, 7002])
+  })
+
+  it('(b) restart between landing and confirmation ⇒ oracle-confirmed chunk NOT re-sent', async () => {
+    const chunks = ['c0', 'c1']
+    // Snapshot has chunk 0 landed-unconfirmed (crashed before read-back), chunk 1 unsent.
+    const snapshot = {
+      chunks,
+      chunkStates: [{ index: 0, messageIds: [5000], confirmed: false }],
+    }
+    const resumeLedger = new BackstopDeliveryLedger()
+    const sentIdx: number[] = []
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    // The durable oracle proves chunk 0's text landed → confirm, don't re-send.
+    mockOracle = (_c, txt) => txt === 'c0'
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: true,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    expect(sentIdx).toEqual([1]) // chunk 0 reconciled-confirmed, only chunk 1 sent
+    expect(sentIdx).not.toContain(0)
+    expect(oblLedger.isOpen('#t1')).toBe(false)
+  })
+
+  it('(c) fully-landed answer ⇒ resume sends NOTHING and closes the obligation', async () => {
+    const chunks = ['c0', 'c1']
+    const snapshot = {
+      chunks,
+      chunkStates: [
+        { index: 0, messageIds: [5000], confirmed: true },
+        { index: 1, messageIds: [5001], confirmed: true },
+      ],
+    }
+    const resumeLedger = new BackstopDeliveryLedger()
+    const sentIdx: number[] = []
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    expect(sentIdx).toEqual([]) // nothing re-posted
+    expect(oblLedger.isOpen('#t1')).toBe(false)
+  })
+
+  it('a partial RESUME (tail still fails) leaves the obligation OPEN + consumes represent budget', async () => {
+    const chunks = ['c0', 'c1']
+    const snapshot = {
+      chunks,
+      chunkStates: [{ index: 0, messageIds: [5000], confirmed: true }],
+    }
+    const resumeLedger = new BackstopDeliveryLedger()
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    // A resume whose tail send keeps throwing ⇒ not delivered ⇒ obligation stays OPEN.
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: async (a) => {
+        a.resume.hydrate(resumeLedger, a.turnId)
+        const res = await runBackstopDelivery(
+          resumeLedger, a.turnId, a.resume.snapshot.chunks, a.cardMessageId,
+          { sendChunk: async () => { throw new Error('FLOOD_WAIT_ACTIVE') }, readBack: async () => 'exists' as ReadBackResult },
+          2,
+        )
+        return { delivered: res.delivered, sentIds: res.sentIds }
+      },
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    expect(oblLedger.isOpen('#t1')).toBe(true) // left OPEN for the next paced sweep
+    expect(oblLedger.list()[0].representCount).toBe(1) // budget consumed → bounded ladder
+  })
+
+  it('de-dupes concurrent dispatches for the same origin (only one resume runs)', async () => {
+    const chunks = ['c0', 'c1']
+    const orig = new BackstopDeliveryLedger()
+    await seedPartial(orig, '#t1', chunks, (i) => (i === 0 ? 'ok' : 'throw'))
+    const snapshot = buildCapturedDeliverySnapshot(orig, '#t1', chunks)
+    orig.clear('#t1')
+
+    const resumeLedger = new BackstopDeliveryLedger()
+    let deliverCalls = 0
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: async (a) => {
+        deliverCalls++
+        a.resume.hydrate(resumeLedger, a.turnId)
+        const res = await runBackstopDelivery(
+          resumeLedger, a.turnId, a.resume.snapshot.chunks, a.cardMessageId,
+          { sendChunk: async (i: number) => [7000 + i], readBack: async () => 'exists' as ReadBackResult },
+          3,
+        )
+        return { delivered: res.delivered, sentIds: res.sentIds }
+      },
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    const o = oblLedger.list()[0]
+    dispatcher.dispatch(o)
+    dispatcher.dispatch(o) // second, concurrent — must be a no-op
+    await flush(dispatcher)
+    expect(deliverCalls).toBe(1)
+  })
+
+  it('no captured snapshot ⇒ dispatch is a no-op (caller falls through to fresh generation)', async () => {
+    let delivered = false
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: async () => { delivered = true; return { delivered: true, sentIds: [] } },
+      obligationLedger: new ObligationLedger(2),
+      backstopDeliveryLedger: new BackstopDeliveryLedger(),
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(obligation()) // no capturedDelivery
+    dispatcher.dispatch(obligation({ capturedDelivery: { chunks: [], chunkStates: [] } })) // empty
+    await flush(dispatcher)
+    expect(delivered).toBe(false)
+  })
+})

package/telegram-plugin/tests/emission-authority-facade.test.ts

@@ -48,6 +48,19 @@ const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
 )
+// #2996 P2: executeReply's body (the over-ping block + the lever-2 finalize)
+// moved VERBATIM to outbound-send-path.ts `sendReply()`. The façade call-site
+// assertions that used to grep the executeReply window grep the sendReply
+// window there instead — the wiring contract they pin is unchanged.
+const sendPathSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
+  'utf-8',
+)
+/** The sendReply window: from the function decl to the next export. */
+function sendReplyWindow(): string {
+  const after = sendPathSrc.split('export async function sendReply(')[1] ?? ''
+  return after.split('\nexport ')[0] ?? after
+}
 
 /** Source of a named gateway function up to the next top-level definition. */
 function fnSrc(name: string): string {
@@ -243,15 +256,15 @@ describe('claimOrDowngradePing — PR-4c over-ping decision moves into the faça
     // The relocation must NOT split the #2562 pair across the façade boundary:
     // the façade decides; the call-site thunk sets firstPingAt AND
     // firstPingWasSubstantive on two adjacent lines, no await between.
-    expect(gatewaySrc).toMatch(
+    expect(sendPathSrc).toMatch(
       /turn\.firstPingAt = now\s*\n\s*turn\.firstPingWasSubstantive = replySubstantive/,
     )
     // No await anywhere in the executeReply over-ping block (the decide→apply→
     // pair-set synchronous chain). Bound to the block, BEFORE the Telegraph
     // block below (which legitimately awaits).
-    const blockStart = gatewaySrc.indexOf('const applyOverPingDecision')
-    const telegraphIdx = gatewaySrc.indexOf('// Telegraph publish (#579)', blockStart)
-    const block = gatewaySrc.slice(blockStart, telegraphIdx)
+    const blockStart = sendPathSrc.indexOf('const applyOverPingDecision')
+    const telegraphIdx = sendPathSrc.indexOf('// Telegraph publish (#579)', blockStart)
+    const block = sendPathSrc.slice(blockStart, telegraphIdx)
     const blockCode = block
       .split('\n')
       .filter((l) => {
@@ -267,17 +280,14 @@ describe('claimOrDowngradePing — PR-4c over-ping decision moves into the faça
     // The over-ping net exists ONLY in executeReply. The retired stream_reply
     // tool (executeStreamReply) had no decideOverPing / firstPingAt /
     // wasOverPingSuppressed and never called claimOrDowngradePing.
-    const calls = [...gatewaySrc.matchAll(/\.claimOrDowngradePing\(/g)]
+    // #2996 P2: the single call now lives in the extracted sendReply body;
+    // gateway.ts must have ZERO (the wrapper delegates).
+    const gwCalls = [...gatewaySrc.matchAll(/\.claimOrDowngradePing\(/g)]
+    expect(gwCalls).toHaveLength(0)
+    const calls = [...sendPathSrc.matchAll(/\.claimOrDowngradePing\(/g)]
     expect(calls).toHaveLength(1)
-    const callIdx = gatewaySrc.indexOf('.claimOrDowngradePing(')
-    const execReplyIdx = gatewaySrc.indexOf('async function executeReply(')
-    // Upper bound: the next top-level function after executeReply.
-    const nextFnIdx = gatewaySrc.indexOf('\nasync function ', execReplyIdx + 1)
-    expect(execReplyIdx).toBeGreaterThan(-1)
-    expect(nextFnIdx).toBeGreaterThan(execReplyIdx)
-    // The single call is inside executeReply.
-    expect(callIdx).toBeGreaterThan(execReplyIdx)
-    expect(callIdx).toBeLessThan(nextFnIdx)
+    // The single call is inside the sendReply window.
+    expect(sendReplyWindow()).toMatch(/\.claimOrDowngradePing\(/)
   })
 })
 
@@ -299,7 +309,8 @@ describe('façade delegates to the existing emission primitives (call-site liter
   it('finalizeCard wraps clearActivitySummary at the call sites (not CALLED inside the façade)', () => {
     expect(facadeSrc).not.toMatch(/import .*clearActivitySummary/)
     expect(facadeCode).not.toMatch(/clearActivitySummary\(/)
-    expect(gatewaySrc).toMatch(/finalizeCard\(\(\) => \{\s*\n\s*clearActivitySummary\(/)
+    // #2996 P2: the lever-2 call site moved (verbatim) into sendReply.
+    expect(sendPathSrc).toMatch(/finalizeCard\(\(\) => \{\s*\n\s*clearActivitySummary\(/)
   })
 
   it('claimOrDowngradePing — the call-site disabled thunk STILL contains a literal decideOverPing( (disabled-path proof)', () => {
@@ -308,9 +319,9 @@ describe('façade delegates to the existing emission primitives (call-site liter
     // its OWN literal `decideOverPing(` call inside the call-site thunk, VERBATIM
     // from PR-4b-base — so the disabled path is provably byte-identical (never
     // depends on the façade for the decision).
-    const pingIdx = gatewaySrc.indexOf('claimOrDowngradePing(')
+    const pingIdx = sendPathSrc.indexOf('claimOrDowngradePing(')
     expect(pingIdx).toBeGreaterThan(-1)
-    const window = gatewaySrc.slice(pingIdx, pingIdx + 1600)
+    const window = sendPathSrc.slice(pingIdx, pingIdx + 1600)
     expect(window).toMatch(/decideOverPing\(/)
   })
 })
@@ -385,8 +396,7 @@ describe('the drain sites route through the façade with producers preserved ver
 
 describe('the lever-2 finalize block routes through the façade', () => {
   it('executeReply finalize routes via markSubstantiveFinalDelivered + finalizeCard (latch + clear preserved)', () => {
-    const after = gatewaySrc.split('async function executeReply(')[1] ?? ''
-    const body = after.split('\nasync function ')[0]?.split('\nfunction ')[0] ?? after
+    const body = sendReplyWindow()
     expect(body).toMatch(/markSubstantiveFinalDelivered\(\(\) => \{\s*\n\s*finalizeTurn\.finalAnswerEverDelivered = true/)
     expect(body).toMatch(/finalizeCard\(\(\) => \{\s*\n\s*clearActivitySummary\(finalizeTurn\)/)
   })