switchroom 0.18.31 → 0.18.33

package/telegram-plugin/tests/ask-callback-handler.test.ts

@@ -0,0 +1,118 @@
+/**
+ * Outcome pins for the ask_user option-callback family (`aq:<idx>:<askId>`,
+ * #574) extracted from the gateway's callback_query dispatcher
+ * (switchroom#2996 P6). Uses the REAL encode/decode from ask-user.ts and
+ * asserts: non-ask data falls through (returns false), the allowFrom gate,
+ * stale-tap and out-of-bounds acks, and the full resolve path (timer cleared,
+ * store entry deleted, promise resolved with the choice, message edited with
+ * the checkmark, toast acked).
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  handleAskCallback,
+  type AskCallbackDeps,
+  type PendingAskUserEntry,
+} from '../gateway/ask-callback-handler.js'
+import { encodeAskCallback } from '../ask-user.js'
+
+function makeCtx(over: Record<string, unknown> = {}) {
+  return {
+    from: { id: 42 },
+    callbackQuery: { message: { text: 'Pick one <a&b>' } },
+    answerCallbackQuery: vi.fn(async () => {}),
+    editMessageText: vi.fn(async () => {}),
+    ...over,
+  } as any
+}
+
+function makeDeps(entries: Record<string, PendingAskUserEntry> = {}) {
+  const store = new Map(Object.entries(entries))
+  const deps: AskCallbackDeps = {
+    loadAccess: () => ({ allowFrom: ['42'] }),
+    pendingAskUser: store,
+  }
+  return { deps, store }
+}
+
+function entryWith(options: string[]) {
+  let resolved: unknown = null
+  const entry: PendingAskUserEntry = {
+    options,
+    resolve: (o: unknown) => {
+      resolved = o
+    },
+    timer: setTimeout(() => {}, 60_000),
+  }
+  return { entry, getResolved: () => resolved }
+}
+
+describe('handleAskCallback — routing', () => {
+  it('returns false for non-ask callback data (dispatcher falls through)', async () => {
+    const { deps } = makeDeps()
+    const ctx = makeCtx()
+    expect(await handleAskCallback(ctx, 'apv:whatever', deps)).toBe(false)
+    expect(ctx.answerCallbackQuery).not.toHaveBeenCalled()
+  })
+
+  it('gates non-allowlisted senders with a Not authorized toast', async () => {
+    const { entry } = entryWith(['a'])
+    const { deps } = makeDeps({ aaaa1111: entry })
+    const ctx = makeCtx({ from: { id: 666 } })
+    expect(await handleAskCallback(ctx, encodeAskCallback('aaaa1111', 0), deps)).toBe(true)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: 'Not authorized.' })
+    clearTimeout(entry.timer)
+  })
+
+  it('acks a stale tap (entry gone) with the expired toast', async () => {
+    const { deps } = makeDeps()
+    const ctx = makeCtx()
+    expect(await handleAskCallback(ctx, encodeAskCallback('deadbeef', 0), deps)).toBe(true)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: 'This question expired.' })
+  })
+
+  it('rejects an out-of-bounds index (hostile callback) without resolving', async () => {
+    const { entry, getResolved } = entryWith(['only'])
+    const { deps, store } = makeDeps({ aaaa1111: entry })
+    const ctx = makeCtx()
+    await handleAskCallback(ctx, encodeAskCallback('aaaa1111', 3), deps)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: 'Invalid option.' })
+    expect(getResolved()).toBeNull()
+    expect(store.has('aaaa1111')).toBe(true)
+    clearTimeout(entry.timer)
+  })
+})
+
+describe('handleAskCallback — resolve path', () => {
+  it('resolves the deferred, deletes the entry, edits the message, acks the toast', async () => {
+    const { entry, getResolved } = entryWith(['yes', 'no'])
+    const { deps, store } = makeDeps({ aaaa1111: entry })
+    const ctx = makeCtx()
+    expect(await handleAskCallback(ctx, encodeAskCallback('aaaa1111', 1), deps)).toBe(true)
+    expect(getResolved()).toEqual({ kind: 'answered', choice: 'no', idx: 1 })
+    expect(store.has('aaaa1111')).toBe(false)
+    // Edited body: escaped source text + checkmarked choice.
+    const edited = JSON.stringify(ctx.editMessageText.mock.calls[0][0])
+    expect(edited).toContain('✅')
+    expect(edited).toContain('no')
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: '✅ no' })
+  })
+
+  it('still resolves + acks when the source message has no text (no edit attempted)', async () => {
+    const { entry, getResolved } = entryWith(['ok'])
+    const { deps } = makeDeps({ aaaa1111: entry })
+    const ctx = makeCtx({ callbackQuery: { message: {} } })
+    await handleAskCallback(ctx, encodeAskCallback('aaaa1111', 0), deps)
+    expect(getResolved()).toEqual({ kind: 'answered', choice: 'ok', idx: 0 })
+    expect(ctx.editMessageText).not.toHaveBeenCalled()
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: '✅ ok' })
+  })
+
+  it('a failing editMessageText is swallowed — the ack toast still fires', async () => {
+    const { entry } = entryWith(['ok'])
+    const { deps } = makeDeps({ aaaa1111: entry })
+    const ctx = makeCtx({ editMessageText: vi.fn(async () => { throw new Error('too old') }) })
+    await handleAskCallback(ctx, encodeAskCallback('aaaa1111', 0), deps)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: '✅ ok' })
+  })
+})

package/telegram-plugin/tests/attachment-message-handlers.test.ts

@@ -0,0 +1,135 @@
+/**
+ * Outcome pins for the metadata-only attachment inbound handlers extracted
+ * from gateway.ts (switchroom#2996 P6 cluster C). Each handler is driven with
+ * a fake grammy ctx + a mock coalescing dispatch dep; the assertions pin the
+ * EXACT text envelope and AttachmentMeta slot forwarded to
+ * handleInboundCoalesced — the behaviour the gateway previously produced inline.
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  handleDocumentMessage,
+  handleAudioMessage,
+  handleVideoMessage,
+  handleVideoNoteMessage,
+  handleStickerMessage,
+  handleAnimationMessage,
+  type AttachmentHandlerDeps,
+} from '../gateway/attachment-message-handlers.js'
+
+function makeDeps() {
+  const handleInboundCoalesced = vi.fn(async () => {})
+  const deps: AttachmentHandlerDeps = { handleInboundCoalesced }
+  return { deps, handleInboundCoalesced }
+}
+
+// Build a fake ctx whose `message` carries the given content key (+ caption).
+function ctxWith(content: Record<string, unknown>): any {
+  return { message: content, chat: { id: 42 } }
+}
+
+describe('handleDocumentMessage', () => {
+  it('renders the document envelope with a sanitized name', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ document: { file_id: 'd1', file_name: 'a<b>.pdf', file_size: 10, mime_type: 'application/pdf' } })
+    await handleDocumentMessage(ctx, deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      ctx,
+      '(document: a_b_.pdf)',
+      undefined,
+      { kind: 'document', file_id: 'd1', size: 10, mime: 'application/pdf', name: 'a_b_.pdf' },
+    )
+  })
+  it('prefers the caption and falls back to "file" when unnamed', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ document: { file_id: 'd2' }, caption: 'see this' })
+    await handleDocumentMessage(ctx, deps)
+    const [, text, , meta] = (handleInboundCoalesced as any).mock.calls[0]
+    expect(text).toBe('see this')
+    expect(meta).toEqual({ kind: 'document', file_id: 'd2', size: undefined, mime: undefined, name: undefined })
+  })
+})
+
+describe('handleAudioMessage', () => {
+  it('renders title, then name, then "audio" fallback', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ audio: { file_id: 'a1', title: 'Song', file_name: 'x.mp3', file_size: 5, mime_type: 'audio/mpeg' } })
+    await handleAudioMessage(ctx, deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      ctx,
+      '(audio: Song)',
+      undefined,
+      { kind: 'audio', file_id: 'a1', size: 5, mime: 'audio/mpeg', name: 'x.mp3' },
+    )
+  })
+})
+
+describe('handleVideoMessage', () => {
+  it('renders the video envelope, caption-or-fallback', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ video: { file_id: 'v1', file_size: 9, mime_type: 'video/mp4', file_name: 'clip.mp4' } })
+    await handleVideoMessage(ctx, deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      ctx,
+      '(video)',
+      undefined,
+      { kind: 'video', file_id: 'v1', size: 9, mime: 'video/mp4', name: 'clip.mp4' },
+    )
+  })
+})
+
+describe('handleVideoNoteMessage', () => {
+  it('renders the fixed video-note envelope', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ video_note: { file_id: 'vn1', file_size: 3 } })
+    await handleVideoNoteMessage(ctx, deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      ctx,
+      '(video note)',
+      undefined,
+      { kind: 'video_note', file_id: 'vn1', size: 3 },
+    )
+  })
+})
+
+describe('handleStickerMessage', () => {
+  it('includes emoji and set name when present', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ sticker: { file_id: 's1', emoji: '🎉', set_name: 'Party', file_size: 2 } })
+    await handleStickerMessage(ctx, deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      ctx,
+      '(sticker — 🎉 from "Party")',
+      undefined,
+      { kind: 'sticker', file_id: 's1', size: 2 },
+    )
+  })
+  it('falls back to bare "(sticker)" with no emoji/set', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ sticker: { file_id: 's2' } })
+    await handleStickerMessage(ctx, deps)
+    const [, text] = (handleInboundCoalesced as any).mock.calls[0]
+    expect(text).toBe('(sticker)')
+  })
+})
+
+describe('handleAnimationMessage', () => {
+  it('prefixes the caption to the gif envelope', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ animation: { file_id: 'g1', file_size: 7, mime_type: 'video/mp4', file_name: 'a.gif' }, caption: 'perfect' })
+    await handleAnimationMessage(ctx, deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      ctx,
+      '(gif) perfect',
+      undefined,
+      { kind: 'animation', file_id: 'g1', size: 7, mime: 'video/mp4', name: 'a.gif' },
+    )
+  })
+  it('renders bare "(gif)" when uncaptioned', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    const ctx = ctxWith({ animation: { file_id: 'g2' } })
+    await handleAnimationMessage(ctx, deps)
+    const [, text] = (handleInboundCoalesced as any).mock.calls[0]
+    expect(text).toBe('(gif)')
+  })
+})

package/telegram-plugin/tests/backstop-delivery.test.ts

@@ -5,6 +5,8 @@ import {
   backstopReceiptIds,
   backstopDelivered,
   runBackstopDelivery,
+  combineReadBackResults,
+  type ReadBackResult,
 } from '../gateway/backstop-delivery.js'
 import {
   backstopSendOutcomeGated,
@@ -248,3 +250,168 @@ describe('runBackstopDelivery — integration oracle over the delivery wiring',
     expect(recorded[0].ids).toHaveLength(recorded[0].texts.length)
   })
 })
+
+/**
+ * #3278 — read-back confirmation of an accepted-but-dropped send.
+ *
+ * A returned message_id proves Telegram ACCEPTED the send, not that the message
+ * is VISIBLE (a flood/anti-spam silent discard returns a fresh id yet the user
+ * sees nothing). These assert the deterministic OUTCOMES of the per-chunk state
+ * machine `unsent → pending → landed-unconfirmed → {landed-confirmed | unsent}`
+ * driven by a no-op editMessageText read-back — NOT code-path execution.
+ */
+describe('#3278 read-back — the ledger confirmation state machine', () => {
+  it('confirmChunk transitions landed-unconfirmed → landed-confirmed', () => {
+    const l = new BackstopDeliveryLedger()
+    l.recordChunk('#t', 0, [900]) // landed-unconfirmed
+    expect(l.hasChunk('#t', 0)).toBe(true)
+    expect(l.hasConfirmedChunk('#t', 0)).toBe(false)
+    expect(l.landedUnconfirmedIndices('#t', 1)).toEqual([0])
+    l.confirmChunk('#t', 0)
+    expect(l.hasConfirmedChunk('#t', 0)).toBe(true)
+    expect(l.landedUnconfirmedIndices('#t', 1)).toEqual([])
+    expect(l.allConfirmed('#t', 1)).toBe(true)
+    expect(l.confirmedIds('#t')).toEqual([900])
+  })
+
+  it('demoteChunk resets a landed(-unconfirmed) chunk back to unsent (safe re-send)', () => {
+    const l = new BackstopDeliveryLedger()
+    l.recordChunk('#t', 0, [901])
+    l.confirmChunk('#t', 0)
+    l.demoteChunk('#t', 0) // positive-absence read-back
+    expect(l.hasChunk('#t', 0)).toBe(false)
+    expect(l.hasConfirmedChunk('#t', 0)).toBe(false)
+    expect(l.unsentIndices('#t', 1)).toEqual([0]) // resume set includes it again
+    expect(l.confirmedIds('#t')).toEqual([])
+  })
+
+  it('allConfirmed is false while any chunk is only landed-unconfirmed', () => {
+    const l = new BackstopDeliveryLedger()
+    l.recordChunk('#t', 0, [1]); l.confirmChunk('#t', 0)
+    l.recordChunk('#t', 1, [2]) // landed-unconfirmed
+    expect(l.allConfirmed('#t', 2)).toBe(false)
+    expect(l.landedUnconfirmedIndices('#t', 2)).toEqual([1])
+  })
+
+  it('confirmedIds returns ONLY confirmed chunk ids, in index order', () => {
+    const l = new BackstopDeliveryLedger()
+    l.recordChunk('#t', 0, [10]); l.confirmChunk('#t', 0)
+    l.recordChunk('#t', 1, [11]) // unconfirmed
+    l.recordChunk('#t', 2, [12, 13]); l.confirmChunk('#t', 2)
+    expect(l.confirmedIds('#t')).toEqual([10, 12, 13])
+  })
+})
+
+describe('#3278 combineReadBackResults — per-chunk id combine (guard A7)', () => {
+  it('ANY absent id ⇒ absent (re-send the whole chunk)', () => {
+    expect(combineReadBackResults(['exists', 'absent'])).toBe('absent')
+    expect(combineReadBackResults(['absent', 'ambiguous'])).toBe('absent')
+  })
+  it('ALL exist ⇒ exists', () => {
+    expect(combineReadBackResults(['exists', 'exists'])).toBe('exists')
+  })
+  it('some ambiguous, none absent ⇒ ambiguous (never re-send)', () => {
+    expect(combineReadBackResults(['exists', 'ambiguous'])).toBe('ambiguous')
+  })
+  it('empty id set ⇒ ambiguous (fabricate neither confirm nor demote)', () => {
+    expect(combineReadBackResults([])).toBe('ambiguous')
+  })
+})
+
+describe('#3278 runBackstopDelivery — read-back drives the delivery outcome', () => {
+  it('exists probe ⇒ landed-confirmed, delivered=true, ONE probe, no re-send', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const sendChunk = vi.fn(async () => [960])
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const res = await runBackstopDelivery(ledger, '#ok', ['the answer'], null, { sendChunk, readBack }, 3)
+    expect(res.delivered).toBe(true)
+    expect(res.exhausted).toBe(false)
+    expect(sendChunk).toHaveBeenCalledTimes(1) // never re-sent
+    expect(readBack).toHaveBeenCalledTimes(1) // exactly one probe per chunk
+    expect(ledger.hasConfirmedChunk('#ok', 0)).toBe(true)
+  })
+
+  it('400/absent probe ⇒ demote → RE-SENT EXACTLY ONCE, then confirmed', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    let sends = 0
+    const sendChunk = vi.fn(async () => { sends++; return [900 + sends] })
+    let probes = 0
+    // First probe: the send was silently dropped (absent). After the re-send the
+    // message is present (exists).
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => {
+      probes++
+      return probes === 1 ? 'absent' : 'exists'
+    })
+    const res = await runBackstopDelivery(ledger, '#drop', ['answer'], null, { sendChunk, readBack }, 3)
+    expect(sendChunk).toHaveBeenCalledTimes(2) // initial + exactly one re-send
+    expect(res.delivered).toBe(true)
+    expect(ledger.hasConfirmedChunk('#drop', 0)).toBe(true)
+  })
+
+  it('429/ambiguous probe ⇒ NOT re-sent, stays landed-unconfirmed, delivered=false', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const sendChunk = vi.fn(async () => [950])
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#amb', ['answer'], null, { sendChunk, readBack }, 3)
+    expect(sendChunk).toHaveBeenCalledTimes(1) // never re-sent on ambiguous
+    expect(res.delivered).toBe(false)
+    expect(res.exhausted).toBe(true)
+    expect(ledger.hasConfirmedChunk('#amb', 0)).toBe(false)
+    expect(ledger.landedUnconfirmedIndices('#amb', 1)).toEqual([0]) // still landed-unconfirmed
+  })
+
+  it('a read-back adapter THAT THROWS is treated as ambiguous — never re-sent', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const sendChunk = vi.fn(async () => [951])
+    const readBack = vi.fn(async () => { throw new Error('boom') })
+    const res = await runBackstopDelivery(ledger, '#throw', ['answer'], null, { sendChunk, readBack }, 3)
+    expect(sendChunk).toHaveBeenCalledTimes(1)
+    expect(res.delivered).toBe(false)
+  })
+
+  it('#3278 CORE: API-ack fresh id but read-back ABSENT ⇒ send_failed, NOT complete', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 500
+    // The Bot API returns a fresh non-card id (an accept) every time...
+    const sendChunk = vi.fn(async () => [970])
+    // ...but the read-back proves the message is not actually in the chat
+    // (flood/anti-spam silent discard). It never confirms.
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'absent')
+    const res = await runBackstopDelivery(ledger, '#ghost', ['answer'], cardId, { sendChunk, readBack }, 3)
+    expect(res.delivered).toBe(false) // pre-#3278 this was true → false `complete`
+    expect(res.exhausted).toBe(true)
+    // The exact input the gateway feeds the turn record: delivered=false ⇒ the
+    // status is send_failed and the obligation is left OPEN — the answer is NOT
+    // silently marked complete.
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: cardId,
+    })
+    expect(computeTurnStatus(turn)).toBe('send_failed')
+  })
+
+  it('scope guard: NO readBack dep ⇒ ZERO probes, legacy confirm-on-landing preserved', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const readBack = vi.fn()
+    const sendChunk = vi.fn(async () => [980])
+    // deliberately omit `readBack` — the hot path / opt-out shape.
+    const res = await runBackstopDelivery(ledger, '#noprobe', ['answer'], null, { sendChunk })
+    expect(readBack).not.toHaveBeenCalled()
+    expect(res.delivered).toBe(true) // confirmed on landing (receipt-gated)
+    expect(ledger.hasConfirmedChunk('#noprobe', 0)).toBe(true)
+  })
+
+  it('partial: chunk 0 confirmed, chunk 1 ambiguous ⇒ delivered=false, chunk 0 not re-sent', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const calls: number[] = []
+    const sendChunk = vi.fn(async (i: number) => { calls.push(i); return [700 + i] })
+    const readBack = vi.fn(async (i: number): Promise<ReadBackResult> => (i === 0 ? 'exists' : 'ambiguous'))
+    const res = await runBackstopDelivery(ledger, '#part', ['c0', 'c1'], null, { sendChunk, readBack }, 3)
+    expect(res.delivered).toBe(false)
+    expect(calls.filter(i => i === 0)).toHaveLength(1) // confirmed chunk never re-sent
+    expect(ledger.hasConfirmedChunk('#part', 0)).toBe(true)
+    expect(ledger.hasConfirmedChunk('#part', 1)).toBe(false)
+  })
+})

package/telegram-plugin/tests/backstop-readback-probe.test.ts

@@ -0,0 +1,144 @@
+/**
+ * #3278 — read-back confirmation probe primitive (outbound-send-path.ts).
+ *
+ * `classifyReadBackError` maps a raw grammy `editMessageText` FAILURE into the
+ * confirmation tri-state, and `createBackstopReadBackProbe` combines a chunk's
+ * per-id probes into the chunk verdict `runBackstopDelivery` consumes. These
+ * assert OUTCOMES: which error shape means present vs absent vs ambiguous, and
+ * that a length-resplit chunk (>1 id) is confirmed only if EVERY id is present.
+ */
+import { describe, test, expect, vi } from 'vitest'
+import { GrammyError } from 'grammy'
+import {
+  classifyReadBackError,
+  createBackstopReadBackProbe,
+  createBackstopReadBack,
+} from '../gateway/outbound-send-path.js'
+import type { ReadBackResult } from '../gateway/backstop-delivery.js'
+
+// GrammyError's constructor takes (message, payload, method, parameters).
+function grammy(code: number, description: string): GrammyError {
+  return new GrammyError(
+    `Call to 'editMessageText' failed! (${code}: ${description})`,
+    { ok: false, error_code: code, description },
+    'editMessageText',
+    {},
+  )
+}
+
+describe('#3278 classifyReadBackError — raw edit-failure → confirmation tri-state', () => {
+  test('400 "message to edit not found" ⇒ absent (positive drop → safe re-send)', () => {
+    expect(classifyReadBackError(grammy(400, 'Bad Request: message to edit not found'))).toBe('absent')
+  })
+
+  test('400 "message is not modified" ⇒ exists (a no-op edit → message present)', () => {
+    expect(classifyReadBackError(grammy(400, 'Bad Request: message is not modified'))).toBe('exists')
+  })
+
+  test('429 flood ⇒ ambiguous (never re-send)', () => {
+    expect(classifyReadBackError(grammy(429, 'Too Many Requests: retry after 30'))).toBe('ambiguous')
+  })
+
+  test('5xx / non-grammy network error ⇒ ambiguous', () => {
+    expect(classifyReadBackError(grammy(500, 'Internal Server Error'))).toBe('ambiguous')
+    expect(classifyReadBackError(new Error('fetch failed: ECONNRESET'))).toBe('ambiguous')
+  })
+
+  test('an unrelated 400 (e.g. thread not found) is ambiguous, NOT absent', () => {
+    // A wrong-classification here would demote-and-re-send a message that may
+    // well exist — the never-demote-on-ambiguous rule guards against duplicates.
+    expect(classifyReadBackError(grammy(400, 'Bad Request: message thread not found'))).toBe('ambiguous')
+  })
+})
+
+describe('#3278 createBackstopReadBackProbe — per-chunk id combine', () => {
+  test('single id present ⇒ exists; probes the id with the SAME rich body', async () => {
+    const probeId = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const richMessage = vi.fn((s: string) => ({ rich: s }))
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage })
+    const verdict = await readBack(0, [111], 'answer')
+    expect(verdict).toBe('exists')
+    expect(richMessage).toHaveBeenCalledWith('answer')
+    expect(probeId).toHaveBeenCalledTimes(1)
+    expect(probeId).toHaveBeenCalledWith(111, { rich: 'answer' })
+  })
+
+  test('resplit chunk (2 ids): one absent ⇒ absent (whole chunk re-sent)', async () => {
+    const probeId = vi.fn(async (id: number): Promise<ReadBackResult> => (id === 12 ? 'absent' : 'exists'))
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage: (s) => s })
+    expect(await readBack(1, [11, 12], 'B')).toBe('absent')
+    expect(probeId).toHaveBeenCalledTimes(2) // every id of the chunk is probed
+  })
+
+  test('resplit chunk (2 ids): all present ⇒ exists', async () => {
+    const probeId = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage: (s) => s })
+    expect(await readBack(0, [1, 2], 'A')).toBe('exists')
+  })
+
+  test('empty id set ⇒ ambiguous and NEVER probes (no confirm, no demote)', async () => {
+    const probeId = vi.fn(async (): Promise<ReadBackResult> => 'exists')
+    const readBack = createBackstopReadBackProbe({ probeId, richMessage: (s) => s })
+    expect(await readBack(0, [], 'A')).toBe('ambiguous')
+    expect(probeId).not.toHaveBeenCalled()
+  })
+})
+
+const SHED = Symbol.for('switchroom.send-gate.shed')
+
+describe('#3278 createBackstopReadBack — full gate+edit+classify wiring', () => {
+  function wiring(overrides: Partial<Parameters<typeof createBackstopReadBack>[0]> = {}) {
+    return {
+      editMessageText: vi.fn(async () => true), // edit applied → exists
+      gate: vi.fn(async (fn: () => Promise<unknown>) => fn()), // passthrough gate
+      isShed: (r: unknown) => r === SHED,
+      richMessage: (s: string) => ({ rich: s }),
+      chatId: '1001',
+      threadId: undefined as number | undefined,
+      ...overrides,
+    }
+  }
+
+  test('edit RESOLVES ⇒ exists; edits to the identical rich body (no visible mutation)', async () => {
+    const w = wiring()
+    const readBack = createBackstopReadBack(w)
+    expect(await readBack(0, [55], 'answer')).toBe('exists')
+    // Probed the landed id with the SAME rich body the chunk was sent with.
+    expect(w.editMessageText).toHaveBeenCalledWith(55, { rich: 'answer' }, expect.anything())
+    // Routed through the send gate (pacing) rather than a raw call.
+    expect(w.gate).toHaveBeenCalledTimes(1)
+  })
+
+  test('400 message-not-found ⇒ absent (safe re-send)', async () => {
+    const editMessageText = vi.fn(async () => {
+      throw new GrammyError('boom', { ok: false, error_code: 400, description: 'Bad Request: message to edit not found' }, 'editMessageText', {})
+    })
+    const readBack = createBackstopReadBack(wiring({ editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('absent')
+  })
+
+  test('400 not-modified ⇒ exists (a no-op edit on a present message)', async () => {
+    const editMessageText = vi.fn(async () => {
+      throw new GrammyError('boom', { ok: false, error_code: 400, description: 'Bad Request: message is not modified' }, 'editMessageText', {})
+    })
+    const readBack = createBackstopReadBack(wiring({ editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('exists')
+  })
+
+  test('429 flood ⇒ ambiguous (never re-send)', async () => {
+    const editMessageText = vi.fn(async () => {
+      throw new GrammyError('boom', { ok: false, error_code: 429, description: 'Too Many Requests' }, 'editMessageText', {})
+    })
+    const readBack = createBackstopReadBack(wiring({ editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
+  })
+
+  test('gate SHED (SEND_GATE_SHED sentinel) ⇒ ambiguous, NOT a false exists', async () => {
+    // Under a flood window the cosmetic probe sheds — the gate resolves the
+    // sentinel, not the edit. Must be ambiguous so the chunk is never demoted.
+    const gate = vi.fn(async () => SHED)
+    const editMessageText = vi.fn(async () => true)
+    const readBack = createBackstopReadBack(wiring({ gate, editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
+  })
+})