switchroom 0.18.31 → 0.18.33

package/telegram-plugin/tests/per-topic-current-turn.test.ts

@@ -29,6 +29,17 @@ import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 
 const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
+// #2996 P4-A: the enqueue turn-ctor SET (`setCurrentTurn(next, statusKey(…))`)
+// and two of the three keyed-liveness comparison sites moved VERBATIM into
+// stream-render.ts with handleSessionEvent. In the extracted module the
+// flag-OFF liveness read routes through the injected accessor
+// (`getCurrentTurn() === turn`) rather than the `currentTurn` module global —
+// same invariant, accessor spelling. These wiring oracles span both files.
+const streamSrc = readFileSync(resolve(__dirname, '..', 'gateway', 'stream-render.ts'), 'utf-8')
+// #2996 P8 PR-C3: the silence-poke fallback body (keyed delete + purgeChatStale
+// self-heal) moved verbatim to liveness-wiring.ts — those oracles read there.
+const livenessSrc = readFileSync(resolve(__dirname, '..', 'gateway', 'liveness-wiring.ts'), 'utf-8')
+const gatewayAndStreamSrc = gatewaySrc + '\n' + streamSrc
 
 // ---------------------------------------------------------------------------
 // (a) SOURCE-READ STRUCTURAL ORACLE
@@ -51,19 +62,27 @@ describe('PR-4e source-read oracle — the wiring the per-topic map depends on',
     const rawAssigns = gatewaySrc.match(/^[^/\n]*\bcurrentTurn = (?!currentTurnMap\.get\(\)|null$)/gm) ?? []
     expect(rawAssigns, `unexpected raw currentTurn assignment(s): ${JSON.stringify(rawAssigns)}`).toEqual([])
 
-    // The turn ctor SET routes through setCurrentTurn with the statusKey.
-    expect(gatewaySrc).toMatch(/setCurrentTurn\(next, statusKey\(ev\.chatId, enqThreadIdNum\)\)/)
+    // The turn ctor SET routes through setCurrentTurn with the statusKey
+    // (now in stream-render.ts's `enqueue` branch — #2996 P4-A).
+    expect(gatewayAndStreamSrc).toMatch(/setCurrentTurn\(next, statusKey\(ev\.chatId, enqThreadIdNum\)\)/)
     // The disconnect-flush clears the WHOLE map (every entry is a ghost).
     expect(gatewaySrc).toMatch(/clearAllCurrentTurns\(\)/)
-    // The silence-poke fallback does a keyed delete for the wedged turn's key.
-    expect(gatewaySrc).toMatch(/endCurrentTurnForKey\(wedgedTurn, fbKey\)/)
+    // The silence-poke fallback does a keyed delete for the wedged turn's key
+    // (#2996 P8 PR-C3: the fallback body lives in liveness-wiring.ts).
+    expect(livenessSrc).toMatch(/endCurrentTurnForKey\(wedgedTurn, fbKey\)/)
   })
 
   it('endCurrentTurnAtomic closes the leak AT ORIGIN — keyed liveness guard + keyed delete', () => {
     // Anchor on the `function ` prefix only — the signature is multi-line
     // (gained an `opts?` param + `number | null` return in the send-honesty
     // work), and `function ` disambiguates the definition from its call sites.
-    const body = gatewaySrc
+    // #2996 P8 PR-B: the funnel body moved verbatim to turn-end.ts (gateway
+    // keeps a thin delegating wrapper) — read the body there.
+    const turnEndSrc = readFileSync(
+      resolve(__dirname, '..', 'gateway', 'turn-end.ts'),
+      'utf-8',
+    )
+    const body = turnEndSrc
       .split('function endCurrentTurnAtomic(')[1]
       ?.split('\n}')[0] ?? ''
     expect(body.length).toBeGreaterThan(50)
@@ -88,8 +107,12 @@ describe('PR-4e source-read oracle — the wiring the per-topic map depends on',
     // the flag, resolve THIS turn by ITS OWN topic key. We assert the keyed
     // form appears the expected number of times AND the literal flag-OFF form is
     // retained (the silence-liveness-wiring oracle requires `currentTurn === turn`).
-    const keyedLiveness = gatewaySrc.match(
-      /EMISSION_AUTHORITY_ENABLED \? turnLiveForItsTopic\(turn\) : currentTurn === turn/g,
+    // #2996 P4-A: two of the three sites moved to stream-render.ts, where the
+    // flag-OFF read is spelled `getCurrentTurn() === turn` (injected accessor);
+    // the one remaining in gateway.ts keeps `currentTurn === turn`. Match either
+    // spelling across both files — the population is still exactly 3.
+    const keyedLiveness = gatewayAndStreamSrc.match(
+      /EMISSION_AUTHORITY_ENABLED \? turnLiveForItsTopic\(turn\) : (?:currentTurn|getCurrentTurn\(\)) === turn/g,
     ) ?? []
     expect(keyedLiveness.length).toBe(3)
   })
@@ -105,7 +128,8 @@ describe('PR-4e source-read oracle — the wiring the per-topic map depends on',
   })
 
   it('the self-heal backstop drops per-topic entries for the swept chat (purgeChatStale)', () => {
-    expect(gatewaySrc).toMatch(/currentTurnMap\.purgeChatStale\(fbChatId,/)
+    // #2996 P8 PR-C3: the self-heal lives in the extracted fallback body.
+    expect(livenessSrc).toMatch(/currentTurnMap\.purgeChatStale\(fbChatId,/)
   })
 })
 

package/telegram-plugin/tests/permission-no-repeat-wiring.test.ts

@@ -101,14 +101,17 @@ describe('inbound gate holds while approval card is outstanding (#2841)', () =>
     expect(fn).toMatch(/hasPendingApproval\s*=\s*pendingPermissions\.size\s*>\s*0/)
   })
 
-  it('turnInFlightMachineOnly carries BOTH busy paths (legacy claudeBusyKeys + machine)', () => {
+  it('turnInFlightMachineOnly reads the delivery machine (sole gate, #2996 P1)', () => {
     // #3262: the machine-in-turn signal moved here (read by the /model & /effort
-    // resolver without the approval hold). Both the legacy claudeBusyKeys path
-    // and the machine-authoritative probeGateParity path must be present — a
-    // dropped branch would silently change the busy read.
+    // resolver without the approval hold). #2996 P1 deleted the legacy
+    // claudeBusyKeys branch and the gate-parity probe — the machine read is
+    // the ONLY busy source now; a reintroduced legacy branch would silently
+    // fork the busy read again.
     const fn = slice(GATEWAY, 'function turnInFlightMachineOnly()', 1400)
-    expect(fn).toMatch(/claudeBusyKeys\.size\s*>\s*0/)
-    expect(fn).toContain('probeGateParity(')
+    expect(fn).toContain('return isMachineInTurn()')
+    // Code-shape pins (comments may still narrate the deleted legacy design):
+    expect(fn).not.toMatch(/claudeBusyKeys\.size/)
+    expect(fn).not.toMatch(/probeGateParity\(/)
     // NOT gated by the approval hold — that stays in turnInFlightForGate.
     expect(fn).not.toContain('hasPendingApproval')
   })

package/telegram-plugin/tests/photo-message-handler.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Outcome pins for the photo inbound handler extracted from gateway.ts
+ * (switchroom#2996 P6 cluster D). Unlike the metadata-only attachment handlers,
+ * photo downloads the largest size from the Telegram CDN into the inbox and
+ * returns the on-disk path as the coalesced image. The download closure is
+ * driven here against a fake grammy ctx + fetch, pinning: caption-or-fallback
+ * envelope, largest-size selection, inbox write, and token redaction on error.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, readFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { handlePhotoMessage, type PhotoHandlerDeps } from '../gateway/photo-message-handler.js'
+
+const TOKEN = '123:SECRET-TOKEN'
+let inboxDir: string
+
+function makeDeps(overrides: Partial<PhotoHandlerDeps> = {}) {
+  const logs: string[] = []
+  // capture the download closure passed to handleInboundCoalesced so the test
+  // can invoke it and assert the returned path.
+  let captured: { text: string; download?: () => Promise<string | undefined> } | undefined
+  const handleInboundCoalesced = vi.fn(async (_ctx: any, text: string, download: any) => {
+    captured = { text, download }
+  })
+  const deps: PhotoHandlerDeps = {
+    handleInboundCoalesced,
+    getToken: () => TOKEN,
+    inboxDir,
+    log: line => logs.push(line),
+    ...overrides,
+  }
+  return { deps, handleInboundCoalesced, logs, getCaptured: () => captured }
+}
+
+function ctxWith(photo: unknown[], caption?: string, getFile?: any): any {
+  return {
+    message: { photo, caption },
+    api: { getFile: getFile ?? vi.fn() },
+    chat: { id: 42 },
+  }
+}
+
+beforeEach(() => {
+  inboxDir = mkdtempSync(join(tmpdir(), 'photo-inbox-'))
+})
+afterEach(() => {
+  rmSync(inboxDir, { recursive: true, force: true })
+  vi.restoreAllMocks()
+})
+
+describe('handlePhotoMessage', () => {
+  it('uses the caption as the envelope, falling back to (photo)', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    await handlePhotoMessage(ctxWith([{ file_id: 'p1', file_unique_id: 'u1' }]), deps)
+    expect(handleInboundCoalesced.mock.calls[0][1]).toBe('(photo)')
+
+    const { deps: deps2, handleInboundCoalesced: h2 } = makeDeps()
+    await handlePhotoMessage(ctxWith([{ file_id: 'p1', file_unique_id: 'u1' }], 'look'), deps2)
+    expect(h2.mock.calls[0][1]).toBe('look')
+  })
+
+  it('downloads the largest size and writes it into the inbox', async () => {
+    const getFile = vi.fn(async () => ({ file_path: 'photos/big.jpg' }))
+    const ctx = ctxWith(
+      [{ file_id: 'small', file_unique_id: 'us' }, { file_id: 'big', file_unique_id: 'ub' }],
+      undefined,
+      getFile,
+    )
+    const { deps, getCaptured } = makeDeps()
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(new Uint8Array([1, 2, 3]), { status: 200 }),
+    )
+    await handlePhotoMessage(ctx, deps)
+    const dlPath = await getCaptured()!.download!()
+    // Largest (last) size selected.
+    expect(getFile).toHaveBeenCalledWith('big')
+    // Token embedded in the CDN URL.
+    expect(fetchSpy.mock.calls[0][0]).toContain(`/bot${TOKEN}/photos/big.jpg`)
+    expect(dlPath).toBeDefined()
+    expect(existsSync(dlPath!)).toBe(true)
+    expect(Array.from(readFileSync(dlPath!))).toEqual([1, 2, 3])
+  })
+
+  it('returns undefined and logs HTTP status on a failed download', async () => {
+    const getFile = vi.fn(async () => ({ file_path: 'photos/x.jpg' }))
+    const { deps, getCaptured, logs } = makeDeps()
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 502 }))
+    await handlePhotoMessage(ctxWith([{ file_id: 'p', file_unique_id: 'u' }], undefined, getFile), deps)
+    const dlPath = await getCaptured()!.download!()
+    expect(dlPath).toBeUndefined()
+    expect(logs.some(l => l.includes('HTTP 502'))).toBe(true)
+  })
+
+  it('redacts the bot token from a thrown error message', async () => {
+    const getFile = vi.fn(async () => ({ file_path: 'photos/x.jpg' }))
+    const { deps, getCaptured, logs } = makeDeps()
+    vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error(`connect failed to bot${TOKEN}/x`))
+    await handlePhotoMessage(ctxWith([{ file_id: 'p', file_unique_id: 'u' }], undefined, getFile), deps)
+    const dlPath = await getCaptured()!.download!()
+    expect(dlPath).toBeUndefined()
+    const line = logs.find(l => l.startsWith('telegram gateway: photo download failed:'))!
+    expect(line).toContain('<REDACTED>')
+    expect(line).not.toContain(TOKEN)
+  })
+
+  it('returns undefined when the file has no path', async () => {
+    const getFile = vi.fn(async () => ({}))
+    const { deps, getCaptured } = makeDeps()
+    await handlePhotoMessage(ctxWith([{ file_id: 'p', file_unique_id: 'u' }], undefined, getFile), deps)
+    expect(await getCaptured()!.download!()).toBeUndefined()
+  })
+})

package/telegram-plugin/tests/photo-reroute-wiring.test.ts

@@ -21,12 +21,15 @@ import { describe, it, expect } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 
+// #2996 P2: executeReply's body (incl. the file-send + result + history
+// block this suite pins) moved VERBATIM to outbound-send-path.ts
+// (`sendReply`); the slice reads there now. Assertions unchanged.
 const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
   'utf-8',
 )
 
-// Slice executeReply's file-send + result + history block: from the
+// Slice sendReply's file-send + result + history block: from the
 // photo-precheck anchor to the recordOutbound call for replies.
 const sliceStart = gatewaySrc.indexOf('const photoPrecheck = new Map')
 const sliceEnd = gatewaySrc.indexOf('history recordOutbound (reply) failed')

package/telegram-plugin/tests/pinned-message-handler.test.ts

@@ -0,0 +1,108 @@
+/**
+ * Outcome pins for the `message:pinned_message` service-message cleanup handler
+ * extracted from gateway.ts (switchroom#2996 P6 cluster F). Asserts the
+ * chat-scoped ownership guard (only OUR pins get their service message
+ * deleted), the reconcile-store race retry, and best-effort logging on a
+ * delete failure — against injected pin-state maps + a mock deleteServiceMessage.
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  handlePinnedMessage,
+  type PinnedMessageHandlerDeps,
+} from '../gateway/pinned-message-handler.js'
+
+function makeDeps(over: Partial<PinnedMessageHandlerDeps> = {}) {
+  const deleteServiceMessage = vi.fn(async () => {})
+  const log = vi.fn()
+  const deps: PinnedMessageHandlerDeps = {
+    statusPinState: new Map(),
+    statusPinChatIds: new Map(),
+    deleteServiceMessage,
+    log,
+    ...over,
+  }
+  return { deps, deleteServiceMessage, log }
+}
+
+function ctxWith(chatId: number, pinnedMessageId: number | undefined, serviceMsgId = 999): any {
+  return {
+    msg: {
+      message_id: serviceMsgId,
+      pinned_message: pinnedMessageId == null ? undefined : { message_id: pinnedMessageId },
+    },
+    chat: { id: chatId },
+  }
+}
+
+describe('handlePinnedMessage — ownership guard', () => {
+  it('deletes the service message when the pin is ours in this chat', async () => {
+    const { deps, deleteServiceMessage } = makeDeps({
+      statusPinState: new Map([['fg:a', { messageId: 555 }]]),
+      statusPinChatIds: new Map([['fg:a', '42']]),
+    })
+    await handlePinnedMessage(ctxWith(42, 555, 999), deps)
+    expect(deleteServiceMessage).toHaveBeenCalledWith('42', 999)
+  })
+
+  it('does NOT delete when the pinned id matches but the tracked chat differs', async () => {
+    const { deps, deleteServiceMessage } = makeDeps({
+      statusPinState: new Map([['fg:a', { messageId: 555 }]]),
+      statusPinChatIds: new Map([['fg:a', '99']]), // tracked in a DIFFERENT chat
+    })
+    await handlePinnedMessage(ctxWith(42, 555, 999), deps)
+    expect(deleteServiceMessage).not.toHaveBeenCalled()
+  })
+
+  it('does nothing when there is no pinned_message id', async () => {
+    const { deps, deleteServiceMessage } = makeDeps()
+    await handlePinnedMessage(ctxWith(42, undefined), deps)
+    expect(deleteServiceMessage).not.toHaveBeenCalled()
+  })
+
+  it('does not delete an untracked (operator-manual) pin', async () => {
+    const { deps, deleteServiceMessage } = makeDeps()
+    await handlePinnedMessage(ctxWith(42, 555, 999), deps)
+    expect(deleteServiceMessage).not.toHaveBeenCalled()
+  })
+})
+
+describe('handlePinnedMessage — reconcile-store race', () => {
+  it('re-checks ownership once after the store catches up', async () => {
+    // REAL timers on purpose: this suite also runs under `bun test`, whose
+    // vitest shim does not support vi.useFakeTimers — fake timers here left
+    // the global clock mocked and hung the NEXT test file in CI (the exact
+    // #3354 bun-test failure). The handler waits 250ms before its single
+    // re-check; populate the store inside that window and await the real
+    // delay.
+    const state = new Map<string, { messageId: number }>()
+    const chatIds = new Map<string, string>()
+    const { deps, deleteServiceMessage } = makeDeps({
+      statusPinState: state,
+      statusPinChatIds: chatIds,
+    })
+    const p = handlePinnedMessage(ctxWith(42, 555, 999), deps)
+    // Store catches up during the 250ms race window.
+    state.set('fg:a', { messageId: 555 })
+    chatIds.set('fg:a', '42')
+    await p
+    expect(deleteServiceMessage).toHaveBeenCalledWith('42', 999)
+  })
+})
+
+describe('handlePinnedMessage — best-effort delete failure', () => {
+  it('logs a concise reason when the delete throws', async () => {
+    const { deps, log } = makeDeps({
+      statusPinState: new Map([['fg:a', { messageId: 555 }]]),
+      statusPinChatIds: new Map([['fg:a', '42']]),
+      deleteServiceMessage: vi.fn(async () => {
+        throw new Error('not enough rights')
+      }),
+    })
+    await handlePinnedMessage(ctxWith(42, 555, 999), deps)
+    expect(log).toHaveBeenCalledTimes(1)
+    const line = log.mock.calls[0][0] as string
+    expect(line).toContain('could not delete pin service message')
+    expect(line).toContain('not enough rights')
+  })
+})

package/telegram-plugin/tests/render/render.test.ts

@@ -143,6 +143,48 @@ describe("render: inline palette", () => {
   });
 });
 
+describe("render: line-leading issue refs are not headings (#3304 regression)", () => {
+  it("multi-line message whose first line starts with #3304 stays a paragraph", () => {
+    const md = "#3304 is merged. The regression suite is green.\n\nNext up: the follow-up PR.";
+    const doc = parse(md);
+    // Spec-correct parse: `#` without a following space is NOT an ATX heading.
+    expect(doc.blocks.map((b) => b.type)).toEqual(["paragraph", "paragraph"]);
+
+    const out = render(doc);
+    // The line-leading `#` must be escaped so Telegram's non-spec rich parser
+    // cannot promote the line to a heading...
+    expect(out.startsWith("\\#3304 is merged.")).toBe(true);
+    expect(out).not.toMatch(/^#{1,6} /m);
+    // ...and the escape resolves back to the literal "#3304" on re-parse
+    // (what the reader sees), with no heading node anywhere.
+    const reparsed = parse(out);
+    expect(reparsed.blocks.map((b) => b.type)).toEqual(["paragraph", "paragraph"]);
+    expect((reparsed.blocks[0] as any).children[0].text).toContain("#3304 is merged.");
+  });
+
+  it("issue ref at line start mid-message is escaped too", () => {
+    const md = "Shipped today:\n#123 closes the loop on retries.";
+    const out = render(parse(md));
+    expect(out).toContain("\n\\#123 closes the loop");
+    const reparsed = parse(out);
+    expect(reparsed.blocks.every((b) => b.type !== "heading")).toBe(true);
+  });
+
+  it("a genuine `# Heading` still renders as a heading", () => {
+    const md = "# Release notes\n\n#456 fixed the flake.";
+    const out = render(parse(md));
+    expect(out.startsWith("# Release notes")).toBe(true);
+    expect(out).toContain("\\#456 fixed the flake.");
+    const reparsed = parse(out);
+    expect(reparsed.blocks[0].type).toBe("heading");
+  });
+
+  it("mid-line `#` is left alone", () => {
+    const md = "merged in PR #789 yesterday";
+    expect(render(parse(md))).toBe(md);
+  });
+});
+
 describe("render: block palette", () => {
   it("heading levels 1-6", () => {
     for (let level = 1; level <= 6; level++) {

package/telegram-plugin/tests/reply-terminal-reaction.test.ts

@@ -43,8 +43,10 @@ describe('#1713 + #1728 — reply tool reaction contract', () => {
     const fs = require('node:fs') as typeof import('node:fs')
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const path = require('node:path') as typeof import('node:path')
+    // #2996 P2: executeReply's body moved verbatim to outbound-send-path.ts
+    // (`sendReply`); the post-send block anchors live there now.
     const src = fs.readFileSync(
-      path.resolve(__dirname, '../gateway/gateway.ts'),
+      path.resolve(__dirname, '../gateway/outbound-send-path.ts'),
       'utf8',
     )
     // Find the executeReply post-send block — anchored on the
@@ -75,8 +77,10 @@ describe('#1713 + #1728 — reply tool reaction contract', () => {
     const fs = require('node:fs') as typeof import('node:fs')
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const path = require('node:path') as typeof import('node:path')
+    // #2996 P2: executeReply's body moved verbatim to outbound-send-path.ts
+    // (`sendReply`); the post-send block anchors live there now.
     const src = fs.readFileSync(
-      path.resolve(__dirname, '../gateway/gateway.ts'),
+      path.resolve(__dirname, '../gateway/outbound-send-path.ts'),
       'utf8',
     )
     const anchor = src.indexOf("fresh sendMessage from reply tool is a user-visible")

package/telegram-plugin/tests/secret-detect-delete-must-surface-failures.test.ts

@@ -31,10 +31,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  // P7 PR-9 (#2996): the secret-detect pipeline intercept moved verbatim into
+  // gateway/inbound-interceptors.ts (interceptSecretDetectPipeline); the
+  // FAIL-CLOSED block anchor now resolves there. deleteSensitiveMessage is
+  // injected via deps but every branch still routes through it.
+  readFileSync(resolve(__dirname, "..", "gateway", "inbound-interceptors.ts"), "utf-8");
 
 /** Slice the gateway source between two anchor strings. */
 function sliceBetween(src: string, from: string, to: string): string {

package/telegram-plugin/tests/secret-detect-fail-closed.test.ts

@@ -19,10 +19,20 @@ import { readFileSync } from 'node:fs'
  * bytes directly.
  */
 describe('secret-detect pipeline fail-closed contract (gateway)', () => {
-  const src = readFileSync(
+  // P7 PR-9 (#2996): the pipeline intercept (incl. the fail-closed catch)
+  // moved verbatim into gateway/inbound-interceptors.ts
+  // (interceptSecretDetectPipeline). The catch now returns `{ handled: true }`
+  // and the gateway call site early-returns on `handled` BEFORE the sinks —
+  // the contract is unchanged, split across the seam.
+  const gatewaySrc = readFileSync(
     new URL('../gateway/gateway.ts', import.meta.url),
     'utf8',
   )
+  const interceptorsSrc = readFileSync(
+    new URL('../gateway/inbound-interceptors.ts', import.meta.url),
+    'utf8',
+  )
+  const src = gatewaySrc + '\n' + interceptorsSrc
 
   it('has exactly one [secret-detect] pipeline error catch marker', () => {
     const matches = src.match(/\[secret-detect\] pipeline error/g) ?? []
@@ -30,25 +40,23 @@ describe('secret-detect pipeline fail-closed contract (gateway)', () => {
   })
 
   it('the catch block around runPipeline returns (does not fall through to recordInbound / broadcast)', () => {
-    const idx = src.indexOf('[secret-detect] pipeline error')
+    // Interceptor side: after the error marker, the catch must return
+    // `{ handled: true }` (drop) — never fall out of the catch body.
+    const idx = interceptorsSrc.indexOf('[secret-detect] pipeline error')
     expect(idx).toBeGreaterThan(0)
-
-    // The fail-closed `return` must appear BEFORE the next recordInbound()
-    // and ipcServer.broadcast() calls. We scan forward from the error-log
-    // marker for the first top-level `return` statement (indented by 4
-    // spaces, matching the handleInbound body style).
-    const tail = src.slice(idx)
-    const returnMatch = tail.match(/\n {4}return\b/)
-    expect(returnMatch).not.toBeNull()
-    const returnOffset = returnMatch!.index!
-    const recordOffset = tail.indexOf('recordInbound(')
-    const broadcastOffset = tail.indexOf('ipcServer.broadcast(inboundMsg)')
-    // Both sinks are further down the function body; the fail-closed
-    // return must come first.
-    expect(recordOffset).toBeGreaterThan(0)
-    expect(broadcastOffset).toBeGreaterThan(0)
-    expect(returnOffset).toBeLessThan(recordOffset)
-    expect(returnOffset).toBeLessThan(broadcastOffset)
+    const tail = interceptorsSrc.slice(idx, idx + 2000)
+    expect(tail).toMatch(/\n\s*return \{ handled: true \}/)
+    // Gateway side: the delegation early-returns on `handled` BEFORE both
+    // sinks, so a dropped message can never reach them.
+    const callIdx = gatewaySrc.indexOf('await interceptSecretDetectPipeline(')
+    expect(callIdx).toBeGreaterThan(0)
+    const afterCall = gatewaySrc.slice(callIdx)
+    const handledReturn = afterCall.indexOf('if (secretOutcome.handled) return')
+    const recordOffset = afterCall.indexOf('recordInbound(')
+    const broadcastOffset = afterCall.indexOf('ipcServer.broadcast(inboundMsg)')
+    expect(handledReturn).toBeGreaterThan(0)
+    expect(recordOffset).toBeGreaterThan(handledReturn)
+    expect(broadcastOffset).toBeGreaterThan(handledReturn)
   })
 
   it('catch body warns the user that the message was dropped', () => {
@@ -58,15 +66,17 @@ describe('secret-detect pipeline fail-closed contract (gateway)', () => {
   })
 
   it('no path exists where recordInbound or broadcast is called with the raw effectiveText after a pipeline throw', () => {
-    // Structural guarantee: between the catch marker and the next sink
-    // there must be a `return` — otherwise a thrown pipeline error could
-    // flow through.
-    const catchIdx = src.indexOf('[secret-detect] pipeline error')
-    const afterCatch = src.slice(catchIdx)
-    const recordIdx = afterCatch.indexOf('recordInbound(')
-    expect(recordIdx).toBeGreaterThan(0)
-    const gap = afterCatch.slice(0, recordIdx)
-    expect(gap).toMatch(/\n\s*return\b/)
+    // Structural guarantee across the seam: the interceptor catch returns
+    // handled:true, and the gateway adopts the scrubbed effectiveText only
+    // on the handled:false path — there is no branch that reaches the sinks
+    // after a throw. Pin: the catch body ends in `return { handled: true }`
+    // with no intervening effectiveText pass-through.
+    const catchIdx = interceptorsSrc.indexOf('[secret-detect] pipeline error')
+    expect(catchIdx).toBeGreaterThan(0)
+    const catchTail = interceptorsSrc.slice(catchIdx, catchIdx + 2000)
+    const returnIdx = catchTail.search(/\n\s*return \{ handled: true \}/)
+    expect(returnIdx).toBeGreaterThan(0)
+    expect(catchTail.slice(0, returnIdx)).not.toMatch(/handled: false/)
   })
 
   it('server.ts no longer contains the secret-detect intercept', () => {