switchroom 0.18.31 → 0.18.32

package/telegram-plugin/tests/buffer-gate-broadened.test.ts

@@ -36,6 +36,13 @@ const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
 )
+// #2996 P2: executeReply's body moved verbatim to outbound-send-path.ts
+// (`sendReply`); the post-send block assertions read there. The
+// `releaseTurnBufferGate` helper itself stays in gateway.ts.
+const sendPathSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
+  'utf-8',
+)
 
 describe('buffer-gate release decoupled from final-answer classification', () => {
   // Extract the helper's docstring (everything between the matching
@@ -102,8 +109,8 @@ describe('buffer-gate release decoupled from final-answer classification', () =>
   it('executeReply calls releaseTurnBufferGate OUTSIDE the isFinalAnswerReply branch', () => {
     // Slice the executeReply post-send block (between the anchor
     // comments and the next exported function).
-    const post = gatewaySrc.split("fresh sendMessage from reply tool is a user-visible")[1] ?? ''
-    const slice = post.split('\nasync function ')[0] ?? ''
+    const post = sendPathSrc.split("fresh sendMessage from reply tool is a user-visible")[1] ?? ''
+    const slice = post.split('\nexport async function ')[0] ?? ''
     // The narrow `isFinalAnswerReply`-gated finalize MUST stay (it
     // emits the 👍 reaction on the final-answer happy path).
     expect(slice).toMatch(/isFinalAnswerReply\(/)
@@ -131,9 +138,12 @@ describe('buffer-gate release decoupled from final-answer classification', () =>
     // helper is narrow on purpose. If future code adds new
     // callsites that aren't turn-terminal, the steer-vs-queue
     // semantics could drift.
-    const callMatches = gatewaySrc.match(/releaseTurnBufferGate\(/g) ?? []
-    // Definition + 2 callsites = 3:
-    //   - executeReply's post-send block (reply-finalize, the original).
+    // #2996 P2: the reply-finalize callsite moved (verbatim) into
+    // outbound-send-path.ts `sendReply`; gateway.ts keeps the definition,
+    // the halt callsite, and the deps-injection reference.
+    const callMatches = (gatewaySrc + sendPathSrc).match(/releaseTurnBufferGate\(/g) ?? []
+    // Definition + deps-interface member + 2 callsites = 4:
+    //   - sendReply's post-send block (reply-finalize, the original).
     //   - executeHaltNow (#3020): an interrupt-cancelled turn never reaches
     //     reply-finalize (the C-c killed it and no replacement inbound
     //     follows), so the halt IS that turn's terminal — releasing there is
@@ -142,6 +152,6 @@ describe('buffer-gate release decoupled from final-answer classification', () =>
     //     with executeStreamReply.)
     // If this count grows the test catches it; reviewer must justify
     // any new callsite.
-    expect(callMatches.length).toBe(3)
+    expect(callMatches.length).toBe(4)
   })
 })

package/telegram-plugin/tests/button-tap-turn-gated.test.ts

@@ -115,9 +115,9 @@ describe("agent button taps use the turn-gate (mid-turn → buffer)", () => {
     });
 
     it("buffers + spools on bridge-offline (existing behaviour intact)", () => {
-      // The idle-branch send missed → the reservation is released in lockstep
-      // and the tap is spooled to the pending-inbound buffer for replay.
-      expect(body).toMatch(/claudeBusyKeys\.delete\(reservedBusyKey\)/);
+      // The idle-branch send missed → the tap is spooled to the
+      // pending-inbound buffer for replay. (#2996 P1: the legacy busy-key
+      // reservation/release pair was deleted with the claudeBusyKeys set.)
       expect(body).toMatch(/return 'buffered-bridge-offline'/);
       // The bridge-offline buffer push is the LAST push (after the send miss),
       // so it always spools before returning the offline outcome.

package/telegram-plugin/tests/captured-answer-resume.test.ts

@@ -0,0 +1,358 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+// The dispatcher's resume closure reaches for the durable outbound-text oracle
+// (history.hasOutboundWithText) to reconcile crash-idempotency. Mock it so these
+// stay pure vitest unit tests (no bun:sqlite / real DB) and we can control the
+// "did this chunk's text land durably?" answer per scenario.
+let mockOracle: (chatId: string, text: string, threadId: number | null, since: number) => boolean = () => false
+vi.mock('../history.js', () => ({
+  hasOutboundWithText: (chatId: string, text: string, threadId: number | null, since: number) =>
+    mockOracle(chatId, text, threadId, since),
+}))
+
+import {
+  BackstopDeliveryLedger,
+  runBackstopDelivery,
+  type ReadBackResult,
+} from '../gateway/backstop-delivery.js'
+import { ObligationLedger, type Obligation } from '../gateway/obligation-ledger.js'
+import {
+  buildCapturedDeliverySnapshot,
+  hydrateResumeLedger,
+  createCapturedResumeDispatcher,
+  type CapturedResumeArgs,
+} from '../gateway/captured-answer-resume.js'
+
+/**
+ * #3282 — a partial turn-flush backstop that left an obligation OPEN used to be
+ * re-presented as a FRESH model generation, re-posting chunks that already
+ * landed (the user saw the head of the answer twice). These assert the
+ * deterministic OUTCOME of the fix — the represent is now a byte-identical
+ * captured-answer RESUME of ONLY the non-`landed-confirmed` tail:
+ *   (a) 3-chunk answer, tail fails ⇒ resume sends EXACTLY the unlanded tail,
+ *       chunk 0 is NEVER re-sent, and the chat ends with each chunk once;
+ *   (b) a restart between landing and confirmation does NOT re-send a chunk the
+ *       durable oracle proves landed;
+ *   (c) a fully-landed answer's represent sends NOTHING.
+ * A test that would still pass if the resume re-sent a confirmed chunk is not a
+ * test — every scenario asserts the exact `sendChunk` index set.
+ */
+
+beforeEach(() => {
+  mockOracle = () => false
+})
+
+function obligation(over: Partial<Obligation> = {}): Obligation {
+  return {
+    originTurnId: '#t1',
+    chatId: '900',
+    threadId: undefined,
+    messageId: 42,
+    text: 'the question',
+    openedAt: 1000,
+    representCount: 0,
+    ...over,
+  }
+}
+
+/** Simulate the ORIGINAL partial backstop delivery into `ledger`, then snapshot
+ *  it — the exact input the represent resume consumes. `landPlan(i)` returns the
+ *  per-chunk behavior: 'ok' (lands + confirms), 'throw' (send fails → unsent),
+ *  or 'unconfirmed' (lands but read-back ambiguous → landed-unconfirmed). */
+async function seedPartial(
+  ledger: BackstopDeliveryLedger,
+  turnId: string,
+  chunks: string[],
+  landPlan: (i: number) => 'ok' | 'throw' | 'unconfirmed',
+): Promise<void> {
+  await runBackstopDelivery(
+    ledger,
+    turnId,
+    chunks,
+    null,
+    {
+      sendChunk: async (i: number) => {
+        if (landPlan(i) === 'throw') throw new Error('FLOOD_WAIT_ACTIVE')
+        return [5000 + i]
+      },
+      readBack: async (i: number): Promise<ReadBackResult> =>
+        landPlan(i) === 'unconfirmed' ? 'ambiguous' : 'exists',
+    },
+    1, // a single attempt → a genuine partial (no in-fire retry masking it)
+  )
+}
+
+/** A fake `deliverAnswer` that faithfully replicates the gateway's RESUME path:
+ *  run the injected `hydrate`, then `runBackstopDelivery` over the captured
+ *  chunks with a `sendChunk` that records which indices are (re-)sent. */
+function makeResumeDeliverAnswer(ledger: BackstopDeliveryLedger, sentIdx: number[]) {
+  return async (a: CapturedResumeArgs): Promise<{ delivered: boolean; sentIds: number[] }> => {
+    a.resume.hydrate(ledger, a.turnId)
+    const res = await runBackstopDelivery(
+      ledger,
+      a.turnId,
+      a.resume.snapshot.chunks,
+      a.cardMessageId,
+      {
+        sendChunk: async (i: number) => {
+          sentIdx.push(i)
+          return [7000 + i]
+        },
+        readBack: async (): Promise<ReadBackResult> => 'exists',
+      },
+      3,
+    )
+    return { delivered: res.delivered, sentIds: res.sentIds }
+  }
+}
+
+async function flush(dispatcher: { inFlight: () => string[] }): Promise<void> {
+  for (let i = 0; i < 50 && dispatcher.inFlight().length > 0; i++) {
+    await new Promise((r) => setTimeout(r, 0))
+  }
+}
+
+describe('#3282 buildCapturedDeliverySnapshot — captures per-chunk landed state', () => {
+  it('captures landed chunks (ids + confirmed flag); an unsent chunk is absent', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const chunks = ['c0', 'c1', 'c2']
+    // chunk 0 confirmed, chunk 1 landed-unconfirmed, chunk 2 never sent.
+    await seedPartial(ledger, '#s', chunks, (i) => (i === 0 ? 'ok' : i === 1 ? 'unconfirmed' : 'throw'))
+    const snap = buildCapturedDeliverySnapshot(ledger, '#s', chunks)
+    expect(snap.chunks).toEqual(chunks)
+    const byIndex = Object.fromEntries(snap.chunkStates.map((s) => [s.index, s]))
+    expect(byIndex[0]).toMatchObject({ index: 0, confirmed: true })
+    expect(byIndex[0].messageIds.length).toBeGreaterThan(0)
+    expect(byIndex[1]).toMatchObject({ index: 1, confirmed: false })
+    expect(byIndex[2]).toBeUndefined() // never landed → not in the snapshot
+  })
+})
+
+describe('#3282 hydrateResumeLedger — rebuilds ledger + oracle reconcile', () => {
+  it('confirmed chunk ⇒ excluded from the resume send set; unsent chunk ⇒ included', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = {
+      chunks: ['c0', 'c1', 'c2'],
+      chunkStates: [{ index: 0, messageIds: [10], confirmed: true }],
+    }
+    hydrateResumeLedger(l, '#h', snap, () => false)
+    expect(l.hasConfirmedChunk('#h', 0)).toBe(true)
+    // chunk 0 confirmed → not resent; chunks 1,2 unsent → the resume tail.
+    expect(l.unsentIndices('#h', 3)).toEqual([1, 2])
+  })
+
+  it('landed-unconfirmed chunk ⇒ re-PROBED (landedUnconfirmed), not re-sent', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = {
+      chunks: ['c0', 'c1'],
+      chunkStates: [{ index: 0, messageIds: [10], confirmed: false }],
+    }
+    hydrateResumeLedger(l, '#h', snap, () => false)
+    expect(l.landedUnconfirmedIndices('#h', 2)).toEqual([0]) // will be re-probed
+    expect(l.unsentIndices('#h', 2)).toEqual([1]) // only chunk 1 is unsent
+  })
+
+  it('oracle proves a landed-unconfirmed chunk landed ⇒ CONFIRMED (crash-idempotency A5)', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = {
+      chunks: ['c0', 'c1'],
+      chunkStates: [{ index: 0, messageIds: [10], confirmed: false }],
+    }
+    // The durable outbound row for c0 exists → confirm without re-probe/re-send.
+    hydrateResumeLedger(l, '#h', snap, (txt) => txt === 'c0')
+    expect(l.hasConfirmedChunk('#h', 0)).toBe(true)
+    expect(l.landedUnconfirmedIndices('#h', 2)).toEqual([])
+    expect(l.unsentIndices('#h', 2)).toEqual([1])
+  })
+
+  it('a chunkState with no message ids is left unsent (never fabricates a landing)', () => {
+    const l = new BackstopDeliveryLedger()
+    const snap = { chunks: ['c0'], chunkStates: [{ index: 0, messageIds: [], confirmed: false }] }
+    hydrateResumeLedger(l, '#h', snap, () => false)
+    expect(l.unsentIndices('#h', 1)).toEqual([0])
+  })
+})
+
+describe('#3282 createCapturedResumeDispatcher — the represent RESUME outcome', () => {
+  it('(a) partial [0 confirmed, 1+2 unsent] ⇒ resume sends EXACTLY [1,2]; chunk 0 never re-sent; each chunk once', async () => {
+    const chunks = ['c0', 'c1', 'c2']
+    // Original delivery: chunk 0 lands+confirms, chunks 1,2 fail (unsent).
+    const orig = new BackstopDeliveryLedger()
+    await seedPartial(orig, '#t1', chunks, (i) => (i === 0 ? 'ok' : 'throw'))
+    const snapshot = buildCapturedDeliverySnapshot(orig, '#t1', chunks)
+    orig.clear('#t1') // the turn-flush GCs the in-memory ledger (state is durable)
+
+    // The represent runs on a FRESH ledger (as after a sweep / restart).
+    const resumeLedger = new BackstopDeliveryLedger()
+    const sentIdx: number[] = []
+    const oblLedger = new ObligationLedger(2)
+    const supersedes: Array<{ ids: number[] }> = []
+    const o = obligation({ capturedDelivery: snapshot })
+    oblLedger.openIfAbsent(o)
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: (_c, _t, rec) => supersedes.push({ ids: rec.messageIds }) },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    // The core anti-regression assertion: ONLY the unlanded tail is (re-)sent.
+    expect(sentIdx.sort()).toEqual([1, 2])
+    expect(sentIdx).not.toContain(0) // chunk 0 (already landed) NEVER re-posted
+    expect(oblLedger.isOpen('#t1')).toBe(false) // fully delivered ⇒ closed
+    // §4 — the supersede record covers the WHOLE delivered set (original landed
+    // chunk 0's id 5000 + the resumed tail's ids), keyed by turn so a late reply
+    // corrects the complete answer in place.
+    expect(supersedes.at(-1)?.ids).toEqual([5000, 7001, 7002])
+  })
+
+  it('(b) restart between landing and confirmation ⇒ oracle-confirmed chunk NOT re-sent', async () => {
+    const chunks = ['c0', 'c1']
+    // Snapshot has chunk 0 landed-unconfirmed (crashed before read-back), chunk 1 unsent.
+    const snapshot = {
+      chunks,
+      chunkStates: [{ index: 0, messageIds: [5000], confirmed: false }],
+    }
+    const resumeLedger = new BackstopDeliveryLedger()
+    const sentIdx: number[] = []
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    // The durable oracle proves chunk 0's text landed → confirm, don't re-send.
+    mockOracle = (_c, txt) => txt === 'c0'
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: true,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    expect(sentIdx).toEqual([1]) // chunk 0 reconciled-confirmed, only chunk 1 sent
+    expect(sentIdx).not.toContain(0)
+    expect(oblLedger.isOpen('#t1')).toBe(false)
+  })
+
+  it('(c) fully-landed answer ⇒ resume sends NOTHING and closes the obligation', async () => {
+    const chunks = ['c0', 'c1']
+    const snapshot = {
+      chunks,
+      chunkStates: [
+        { index: 0, messageIds: [5000], confirmed: true },
+        { index: 1, messageIds: [5001], confirmed: true },
+      ],
+    }
+    const resumeLedger = new BackstopDeliveryLedger()
+    const sentIdx: number[] = []
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: makeResumeDeliverAnswer(resumeLedger, sentIdx),
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    expect(sentIdx).toEqual([]) // nothing re-posted
+    expect(oblLedger.isOpen('#t1')).toBe(false)
+  })
+
+  it('a partial RESUME (tail still fails) leaves the obligation OPEN + consumes represent budget', async () => {
+    const chunks = ['c0', 'c1']
+    const snapshot = {
+      chunks,
+      chunkStates: [{ index: 0, messageIds: [5000], confirmed: true }],
+    }
+    const resumeLedger = new BackstopDeliveryLedger()
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    // A resume whose tail send keeps throwing ⇒ not delivered ⇒ obligation stays OPEN.
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: async (a) => {
+        a.resume.hydrate(resumeLedger, a.turnId)
+        const res = await runBackstopDelivery(
+          resumeLedger, a.turnId, a.resume.snapshot.chunks, a.cardMessageId,
+          { sendChunk: async () => { throw new Error('FLOOD_WAIT_ACTIVE') }, readBack: async () => 'exists' as ReadBackResult },
+          2,
+        )
+        return { delivered: res.delivered, sentIds: res.sentIds }
+      },
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(oblLedger.list()[0])
+    await flush(dispatcher)
+
+    expect(oblLedger.isOpen('#t1')).toBe(true) // left OPEN for the next paced sweep
+    expect(oblLedger.list()[0].representCount).toBe(1) // budget consumed → bounded ladder
+  })
+
+  it('de-dupes concurrent dispatches for the same origin (only one resume runs)', async () => {
+    const chunks = ['c0', 'c1']
+    const orig = new BackstopDeliveryLedger()
+    await seedPartial(orig, '#t1', chunks, (i) => (i === 0 ? 'ok' : 'throw'))
+    const snapshot = buildCapturedDeliverySnapshot(orig, '#t1', chunks)
+    orig.clear('#t1')
+
+    const resumeLedger = new BackstopDeliveryLedger()
+    let deliverCalls = 0
+    const oblLedger = new ObligationLedger(2)
+    oblLedger.openIfAbsent(obligation({ capturedDelivery: snapshot }))
+    oblLedger.noteCapturedDelivery('#t1', snapshot)
+
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: async (a) => {
+        deliverCalls++
+        a.resume.hydrate(resumeLedger, a.turnId)
+        const res = await runBackstopDelivery(
+          resumeLedger, a.turnId, a.resume.snapshot.chunks, a.cardMessageId,
+          { sendChunk: async (i: number) => [7000 + i], readBack: async () => 'exists' as ReadBackResult },
+          3,
+        )
+        return { delivered: res.delivered, sentIds: res.sentIds }
+      },
+      obligationLedger: oblLedger,
+      backstopDeliveryLedger: resumeLedger,
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    const o = oblLedger.list()[0]
+    dispatcher.dispatch(o)
+    dispatcher.dispatch(o) // second, concurrent — must be a no-op
+    await flush(dispatcher)
+    expect(deliverCalls).toBe(1)
+  })
+
+  it('no captured snapshot ⇒ dispatch is a no-op (caller falls through to fresh generation)', async () => {
+    let delivered = false
+    const dispatcher = createCapturedResumeDispatcher({
+      deliverAnswer: async () => { delivered = true; return { delivered: true, sentIds: [] } },
+      obligationLedger: new ObligationLedger(2),
+      backstopDeliveryLedger: new BackstopDeliveryLedger(),
+      flushedTurnSupersede: { record: () => {} },
+      historyEnabled: false,
+    })
+    dispatcher.dispatch(obligation()) // no capturedDelivery
+    dispatcher.dispatch(obligation({ capturedDelivery: { chunks: [], chunkStates: [] } })) // empty
+    await flush(dispatcher)
+    expect(delivered).toBe(false)
+  })
+})

package/telegram-plugin/tests/emission-authority-facade.test.ts

@@ -48,6 +48,19 @@ const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
 )
+// #2996 P2: executeReply's body (the over-ping block + the lever-2 finalize)
+// moved VERBATIM to outbound-send-path.ts `sendReply()`. The façade call-site
+// assertions that used to grep the executeReply window grep the sendReply
+// window there instead — the wiring contract they pin is unchanged.
+const sendPathSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
+  'utf-8',
+)
+/** The sendReply window: from the function decl to the next export. */
+function sendReplyWindow(): string {
+  const after = sendPathSrc.split('export async function sendReply(')[1] ?? ''
+  return after.split('\nexport ')[0] ?? after
+}
 
 /** Source of a named gateway function up to the next top-level definition. */
 function fnSrc(name: string): string {
@@ -243,15 +256,15 @@ describe('claimOrDowngradePing — PR-4c over-ping decision moves into the faça
     // The relocation must NOT split the #2562 pair across the façade boundary:
     // the façade decides; the call-site thunk sets firstPingAt AND
     // firstPingWasSubstantive on two adjacent lines, no await between.
-    expect(gatewaySrc).toMatch(
+    expect(sendPathSrc).toMatch(
       /turn\.firstPingAt = now\s*\n\s*turn\.firstPingWasSubstantive = replySubstantive/,
     )
     // No await anywhere in the executeReply over-ping block (the decide→apply→
     // pair-set synchronous chain). Bound to the block, BEFORE the Telegraph
     // block below (which legitimately awaits).
-    const blockStart = gatewaySrc.indexOf('const applyOverPingDecision')
-    const telegraphIdx = gatewaySrc.indexOf('// Telegraph publish (#579)', blockStart)
-    const block = gatewaySrc.slice(blockStart, telegraphIdx)
+    const blockStart = sendPathSrc.indexOf('const applyOverPingDecision')
+    const telegraphIdx = sendPathSrc.indexOf('// Telegraph publish (#579)', blockStart)
+    const block = sendPathSrc.slice(blockStart, telegraphIdx)
     const blockCode = block
       .split('\n')
       .filter((l) => {
@@ -267,17 +280,14 @@ describe('claimOrDowngradePing — PR-4c over-ping decision moves into the faça
     // The over-ping net exists ONLY in executeReply. The retired stream_reply
     // tool (executeStreamReply) had no decideOverPing / firstPingAt /
     // wasOverPingSuppressed and never called claimOrDowngradePing.
-    const calls = [...gatewaySrc.matchAll(/\.claimOrDowngradePing\(/g)]
+    // #2996 P2: the single call now lives in the extracted sendReply body;
+    // gateway.ts must have ZERO (the wrapper delegates).
+    const gwCalls = [...gatewaySrc.matchAll(/\.claimOrDowngradePing\(/g)]
+    expect(gwCalls).toHaveLength(0)
+    const calls = [...sendPathSrc.matchAll(/\.claimOrDowngradePing\(/g)]
     expect(calls).toHaveLength(1)
-    const callIdx = gatewaySrc.indexOf('.claimOrDowngradePing(')
-    const execReplyIdx = gatewaySrc.indexOf('async function executeReply(')
-    // Upper bound: the next top-level function after executeReply.
-    const nextFnIdx = gatewaySrc.indexOf('\nasync function ', execReplyIdx + 1)
-    expect(execReplyIdx).toBeGreaterThan(-1)
-    expect(nextFnIdx).toBeGreaterThan(execReplyIdx)
-    // The single call is inside executeReply.
-    expect(callIdx).toBeGreaterThan(execReplyIdx)
-    expect(callIdx).toBeLessThan(nextFnIdx)
+    // The single call is inside the sendReply window.
+    expect(sendReplyWindow()).toMatch(/\.claimOrDowngradePing\(/)
   })
 })
 
@@ -299,7 +309,8 @@ describe('façade delegates to the existing emission primitives (call-site liter
   it('finalizeCard wraps clearActivitySummary at the call sites (not CALLED inside the façade)', () => {
     expect(facadeSrc).not.toMatch(/import .*clearActivitySummary/)
     expect(facadeCode).not.toMatch(/clearActivitySummary\(/)
-    expect(gatewaySrc).toMatch(/finalizeCard\(\(\) => \{\s*\n\s*clearActivitySummary\(/)
+    // #2996 P2: the lever-2 call site moved (verbatim) into sendReply.
+    expect(sendPathSrc).toMatch(/finalizeCard\(\(\) => \{\s*\n\s*clearActivitySummary\(/)
   })
 
   it('claimOrDowngradePing — the call-site disabled thunk STILL contains a literal decideOverPing( (disabled-path proof)', () => {
@@ -308,9 +319,9 @@ describe('façade delegates to the existing emission primitives (call-site liter
     // its OWN literal `decideOverPing(` call inside the call-site thunk, VERBATIM
     // from PR-4b-base — so the disabled path is provably byte-identical (never
     // depends on the façade for the decision).
-    const pingIdx = gatewaySrc.indexOf('claimOrDowngradePing(')
+    const pingIdx = sendPathSrc.indexOf('claimOrDowngradePing(')
     expect(pingIdx).toBeGreaterThan(-1)
-    const window = gatewaySrc.slice(pingIdx, pingIdx + 1600)
+    const window = sendPathSrc.slice(pingIdx, pingIdx + 1600)
     expect(window).toMatch(/decideOverPing\(/)
   })
 })
@@ -385,8 +396,7 @@ describe('the drain sites route through the façade with producers preserved ver
 
 describe('the lever-2 finalize block routes through the façade', () => {
   it('executeReply finalize routes via markSubstantiveFinalDelivered + finalizeCard (latch + clear preserved)', () => {
-    const after = gatewaySrc.split('async function executeReply(')[1] ?? ''
-    const body = after.split('\nasync function ')[0]?.split('\nfunction ')[0] ?? after
+    const body = sendReplyWindow()
     expect(body).toMatch(/markSubstantiveFinalDelivered\(\(\) => \{\s*\n\s*finalizeTurn\.finalAnswerEverDelivered = true/)
     expect(body).toMatch(/finalizeCard\(\(\) => \{\s*\n\s*clearActivitySummary\(finalizeTurn\)/)
   })

package/telegram-plugin/tests/emission-authority-ping-gate.test.ts

@@ -354,8 +354,11 @@ describe('claimOrDowngradePing — no await in the synchronous decide→apply→
     resolve(__dirname, '..', 'gateway', 'emission-authority.ts'),
     'utf-8',
   )
+  // #2996 P2: the over-ping call site moved VERBATIM (with executeReply's
+  // body) into outbound-send-path.ts `sendReply()`; the await-free window
+  // assertion reads there. Contract unchanged.
   const gatewaySrc = readFileSync(
-    resolve(__dirname, '..', 'gateway', 'gateway.ts'),
+    resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
     'utf-8',
   )
 

package/telegram-plugin/tests/emission-determinism-wiring.test.ts

@@ -17,6 +17,13 @@ const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
 )
+// #2996 P2: executeReply's body (incl. the lever-2 finalize + the latch sets)
+// moved VERBATIM to outbound-send-path.ts `sendReply()`; the assertions that
+// pinned that body now read it there. The wiring contract is unchanged.
+const sendPathSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
+  'utf-8',
+)
 
 /** Source of `drainActivitySummary` up to the next top-level function. */
 function drainSrc(): string {
@@ -51,20 +58,23 @@ describe('sticky finalAnswerEverDelivered latch (lever 1 precondition / R0)', ()
   it('every site that sets the sticky latch true gates on finalAnswerSubstantive', () => {
     // The latch is set true only at the points that set finalAnswerDelivered=true,
     // and only when the reply was substantive — so an ack never latches it.
-    const setTrue = [...gatewaySrc.matchAll(/finalAnswerEverDelivered\s*=\s*true/g)]
-    // executeReply, silent-anchor merge, + the lever-2 finalize block
+    // #2996 P2: all three latch-set sites live in the extracted sendReply body.
+    const setTrue = [...sendPathSrc.matchAll(/finalAnswerEverDelivered\s*=\s*true/g)]
+    // sendReply post-send, silent-anchor merge, + the lever-2 finalize block
     // (which is itself substantive-gated).
     expect(setTrue.length).toBeGreaterThanOrEqual(3)
+    // And gateway.ts has none left (the wrapper delegates).
+    expect(gatewaySrc).not.toMatch(/finalAnswerEverDelivered\s*=\s*true/)
     // Each `finalAnswerEverDelivered = true` must sit in a substantive context:
     // either guarded by `if (turn.finalAnswerSubstantive)` or inside an
     // `isSubstantiveFinalReply(...)` branch. Assert the substantive-gating
     // token co-occurs (no bare unconditional latch set).
     const bareUnconditional = [
-      ...gatewaySrc.matchAll(/\n\s*(?:turn|finalizeTurn)\.finalAnswerEverDelivered\s*=\s*true/g),
+      ...sendPathSrc.matchAll(/\n\s*(?:turn|finalizeTurn)\.finalAnswerEverDelivered\s*=\s*true/g),
     ]
     for (const m of bareUnconditional) {
       const idx = m.index ?? 0
-      const window = gatewaySrc.slice(Math.max(0, idx - 600), idx)
+      const window = sendPathSrc.slice(Math.max(0, idx - 600), idx)
       expect(
         /finalAnswerSubstantive/.test(window) || /isSubstantiveFinalReply/.test(window),
       ).toBe(true)
@@ -125,10 +135,11 @@ describe('drain producers — narrative may not OPEN, liveness + tool may', () =
 })
 
 describe('lever 2 — finalize the card BEFORE a substantive reply send', () => {
-  /** executeReply body up to the next top-level function. */
+  /** The extracted reply-orchestration body (#2996 P2): the sendReply window
+   *  in outbound-send-path.ts, up to the next export. */
   function executeReplySrc(): string {
-    const after = gatewaySrc.split('async function executeReply(')[1] ?? ''
-    return after.split('\nasync function ')[0]?.split('\nfunction ')[0] ?? after
+    const after = sendPathSrc.split('export async function sendReply(')[1] ?? ''
+    return after.split('\nexport ')[0] ?? after
   }
 
   // #2996 step 1: the chunk send loop was relocated verbatim from executeReply