switchroom 0.19.22 → 0.19.24

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -62,7 +62,12 @@ import {
   DEFAULT_SUPERSEDE_TTL_MS,
   type FlushedTurnSupersedeRegistry,
 } from '../flushed-turn-supersede.js'
-import { decideAnswerLatchSuppression, type ReplyOwnerTier } from '../reply-owner-resolve.js'
+import {
+  decideAnswerLatchSuppression,
+  decideContentGateBypass,
+  type ReplyOwnerTier,
+  type ReplyOwnerCandidates,
+} from '../reply-owner-resolve.js'
 import { deriveTelegraphTitle } from '../telegraph.js'
 import {
   mayInjectListenButton,
@@ -611,7 +616,14 @@ export function createBackstopReadBack(
     }
     try {
       const r = await w.gate(() => w.editMessageText(messageId, body, editApiOpts), gateOpts)
-      return w.isShed(r) ? 'ambiguous' : 'exists'
+      // A shed resolves the SEND_GATE_SHED sentinel; a gate no-op drop (the
+      // identical payload is already the last one sent for this message id) or
+      // an expired queue entry resolves `undefined`. In BOTH cases the edit
+      // never reached Telegram, so there is no evidence of existence —
+      // `ambiguous`, never a fabricated `exists`. Only a real API result
+      // (grammy resolves `true` or the edited Message) proves presence.
+      if (w.isShed(r) || r === undefined) return 'ambiguous'
+      return 'exists'
     } catch (err) {
       return classifyReadBackError(err)
     }
@@ -719,7 +731,13 @@ export interface SendReplyGatewayDeps {
   assertSendable(f: string): void
   statusKey(chatId: string, threadId?: number | null): string
   streamKey(chatId: string, threadId?: number | null): string
-  resolveReplyOwnerTurn(liveTurn: CurrentTurn | null, chatId: string, args: Record<string, unknown>): { turn: CurrentTurn | null; tier: ReplyOwnerTier }
+  /** Resolves the owner turn AND returns the CANDIDATE SET it was derived from.
+   *  The candidates are load-bearing, not diagnostics: `decideContentGateBypass`
+   *  corroborates a model-steerable `origin`/`quoted` attribution against the
+   *  framework-derived `latestEndedTurnId` inside them before allowing a
+   *  content-gate bypass — an anchor that is an ENDED turn within the supersede
+   *  TTL, never one still running (#3725). */
+  resolveReplyOwnerTurn(liveTurn: CurrentTurn | null, chatId: string, args: Record<string, unknown>): { turn: CurrentTurn | null; tier: ReplyOwnerTier; candidates: ReplyOwnerCandidates }
   findTurnByOriginId(originTurnId: string | null | undefined): CurrentTurn | null
   findTurnByQuotedMessageId(chatId: string, replyTo: unknown): CurrentTurn | null
   resolveAnswerThreadWithLog(
@@ -939,7 +957,11 @@ export async function sendReply(
     // double-send). The quoted / latest-ended recoveries are precisely what the
     // router already did for the same reply, so unifying here makes the two
     // resolvers agree and the late-reply supersede fires by identity.
-    const { turn: ownerTurn, tier: ownerTier } = resolveReplyOwnerTurn(turn, chat_id, args)
+    const {
+      turn: ownerTurn,
+      tier: ownerTier,
+      candidates: ownerCandidates,
+    } = resolveReplyOwnerTurn(turn, chat_id, args)
     const resolvedTurnId = ownerTurn?.turnId ?? null
     // #3429 — pass the (normalized) reply text so the registry CAN apply the
     // new-content gate: identity match + TTL alone also fits a background
@@ -991,7 +1013,7 @@ export async function sendReply(
     // owner turn resolved (no record to clobber on the collapse path).
     const gateThreadId = ownerTurn?.sessionThreadId ?? replyThreadId
     // MUST-FIX 2 (dup-audit / Fable) — the content-gate READ is CHAT-WIDE, not
-    // lane-specific: `findLatestEndedTurnForChat` resolves owners chat-wide, so a
+    // lane-specific: `findLatestTurnForChat` resolves owners chat-wide, so a
     // handback in topic A can supersede topic B's ended turn; a thread-keyed gate
     // read (the F2 regression) let a reply dodge that handback by carrying a
     // different `message_thread_id`. Chat-wide makes the gate un-steerable — any
@@ -1007,23 +1029,35 @@ export async function sendReply(
       ownerEndedAt != null &&
       handbackAt > ownerEndedAt &&
       now - handbackAt <= DEFAULT_SUPERSEDE_TTL_MS
-    // MUST-FIX 1 (silent-data-loss, PROVEN by Fable 2026-07-21) — restrict the
-    // content-gate BYPASS to the tiers whose attribution is NOT model-steerable:
-    //   - `live`   — the framework-owned live `currentTurn` (not model-derived,
-    //                and `decideSupersede`'s same-turnId check bars it from an
-    //                ended turn's record). Bypasses even a handback window.
+    // MUST-FIX 1 (silent-data-loss, PROVEN by Fable 2026-07-21) + the 2026-07-27
+    // corroboration widening — decided by the pure `decideContentGateBypass` so
+    // the gateway runs the exact code the unit tests exercise. The rule, in
+    // brief (full rationale on that function):
+    //   - `live`   — framework-owned live `currentTurn`; bypasses unconditionally
+    //                (`decideSupersede`'s same-turnId check already bars it from
+    //                a DIFFERENT ended turn's record).
     //   - `latest-ended` — the ambiguous DM/late-reply fallback the marko fix
-    //                actually needs; bypass ONLY when no decoupled completion is
-    //                in the window (marker-absence ⇒ own answer).
-    // The `quoted` / `origin` tiers resolve from MODEL-SUPPLIED args
-    // (`args.reply_to` / `args.origin_turn_id`), so a reply can steer ITSELF onto
-    // a DIFFERENT ended turn's record — with marker-absence they used to bypass
-    // the content gate and silently edit-over that turn's delivered answer (the
-    // #3429 double-loss, executed by Fable). Those tiers therefore NEVER bypass:
-    // they always go through the content gate, so foreign content sends fresh and
-    // only a genuine same-answer reply collapses.
-    const replyIsOwnAnswer =
-      ownerTier === 'live' || (ownerTier === 'latest-ended' && !handbackCouldOwnReply)
+    //                needs; bypass ONLY when no decoupled completion is in the
+    //                window (marker-absence ⇒ own answer).
+    //   - `origin` / `quoted` — MODEL-SUPPLIED attributions, so they bypass ONLY
+    //                when CORROBORATED: the turn they resolve must be the same
+    //                turn the framework-derived, TTL-bounded `latestEndedTurnId`
+    //                resolves (#3725 — that anchor is a genuinely ENDED turn
+    //                within the TTL; a turn still RUNNING in this chat is not a
+    //                candidate and corroborates nothing), and no handback may be
+    //                in the window. A reply that
+    //                steers itself onto a DIFFERENT ended turn fails
+    //                corroboration and keeps the content gate, so the Fable
+    //                silent-edit-over stays closed; a reply that merely echoes
+    //                its OWN turn no longer loses the collapse it would have got
+    //                by omitting the echo entirely (the observed 2026-07-27
+    //                `via=origin` duplicate).
+    const replyIsOwnAnswer = decideContentGateBypass({
+      tier: ownerTier,
+      resolvedTurnId,
+      candidates: ownerCandidates,
+      handbackCouldOwnReply,
+    })
     const decision = flushedTurnSupersede.take(
       chat_id,
       gateThreadId,
@@ -1107,7 +1141,12 @@ export async function sendReply(
       if (decision.reason === 'new-content') {
         process.stderr.write(
           `telegram gateway: reply: flush supersede declined — new content (#3429) ` +
-          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)}; sending fresh\n`,
+          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)} ` +
+          // WHY the bypass didn't apply — without these two fields the
+          // 2026-07-27 duplicate looked like a pure text-matcher failure and
+          // took a log-archive dig to attribute to the tier restriction.
+          `tier=${ownerTier} latestEnded=${JSON.stringify(ownerCandidates.latestEndedTurnId)} ` +
+          `handbackInWindow=${handbackCouldOwnReply}; sending fresh\n`,
         )
       }
       if (suppressByLatch) {

package/telegram-plugin/gateway/stream-render.ts

@@ -1856,6 +1856,12 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
             sentIds = delivery.sentIds
             chunkCount = delivery.chunkCount
             delivered = delivery.delivered
+            // #3702 — how many landed ids the read-back never corroborated.
+            // Stamped on the turn so `emitTurnRecord` writes `landed_unconfirmed`
+            // (omitted when 0): the fleet-visible counter for deliveries we call
+            // `complete` on the Bot API's ack alone, because the probe is
+            // inconclusive. Observational only — it never changes the status.
+            turn.landedUnconfirmed = delivery.landedUnconfirmed
 
             // #546 dedup: record what turn-flush just sent so a late-arriving
             // reply / stream_reply with the same content gets suppressed.

package/telegram-plugin/gateway/subagent-handback-marker.ts

@@ -201,7 +201,7 @@ export class SubagentHandbackMarker {
    * Wall-clock ms of the most recent handback enqueue ANYWHERE in `chatId`
    * (across every topic lane), or null. This is what the content-gate read uses
    * (dup-audit MUST-FIX 2, Fable 2026-07-21): the owner-resolution latest-ended
-   * tier is CHAT-WIDE (`findLatestEndedTurnForChat` ignores thread), so a
+   * tier is CHAT-WIDE (`findLatestTurnForChat` ignores thread), so a
    * background handback in topic A can resolve — and supersede — topic B's
    * ended turn. A thread-SPECIFIC gate read (the F2 regression) let a reply
    * dodge that handback by carrying a different `message_thread_id`, silently

package/telegram-plugin/gateway/turn-end.ts

@@ -436,7 +436,7 @@ function endCurrentTurnAtomic(
   // live feed never opened because its sends failed (the resume-400 signature).
   const turnEndedAt = Date.now()
   // 2026-07 double-reply-on-DM fix (F2) — stamp the turn's end time so the
-  // `findLatestEndedTurnForChat` supersede tier can be recency-bounded to the
+  // `latest-ended` supersede tier can be recency-bounded to the
   // supersede TTL (a stale latest-ended turn must not inherit deletion
   // authority over a newer turn's flush record). Set once; idempotent on the
   // deferRecord flush path (which calls this synchronously before its send).

package/telegram-plugin/gateway/turn-record-status.ts

@@ -148,6 +148,20 @@ export interface TurnRecordRow {
   tools: number
   status: TurnStatus
   turn_id: string
+  /**
+   * How many landed message ids of this turn's backstop delivery the read-back
+   * probe never corroborated (`sentIds` minus the confirmed subset). OMITTED
+   * when zero, so an ordinary row is byte-identical to before.
+   *
+   * This is the measurable counterpart of the delivery verdict: since an
+   * inconclusive probe counts as delivered, a `complete` row carrying
+   * `landed_unconfirmed > 0` is a turn we called delivered on the Bot API's
+   * ack alone. Counting those is how the fleet can tell whether that optimism
+   * is ever wrong (a `landed_unconfirmed` turn followed by a "you never
+   * answered me" is the falsifying observation). It is NOT a failure signal and
+   * nothing escalates on it.
+   */
+  landed_unconfirmed?: number
 }
 
 /**
@@ -165,6 +179,7 @@ export function buildTurnRecord(
     turnId: string
     finalAnswerDelivered: boolean
     deliveryOutcome?: DeliveryOutcome
+    landedUnconfirmed?: number
   },
   endedAt: number,
 ): TurnRecordRow {
@@ -175,5 +190,9 @@ export function buildTurnRecord(
     tools: turn.toolCallCount ?? 0,
     status: computeTurnStatus(turn),
     turn_id: turn.turnId,
+    // Emitted ONLY when non-zero (see `TurnRecordRow.landed_unconfirmed`).
+    ...(turn.landedUnconfirmed != null && turn.landedUnconfirmed > 0
+      ? { landed_unconfirmed: turn.landedUnconfirmed }
+      : {}),
   }
 }

package/telegram-plugin/gateway/turns-jsonl-rotate.ts

@@ -13,6 +13,71 @@
  */
 export const TURNS_JSONL_MAX_BYTES = 5 * 1024 * 1024 // 5 MiB
 
+/** The agent state dir inside a switchroom agent container (bind-mounted to
+ *  `~/.switchroom/agents/<name>/` on the host). */
+export const DEFAULT_AGENT_STATE_DIR = '/state/agent'
+
+/**
+ * Resolve the agent state dir from the environment — the ONE reader for
+ * `SWITCHROOM_AGENT_STATE_DIR` that every writer into that dir must use.
+ *
+ * Normalisation is the point. The gateway had two writers into this dir a few
+ * lines apart (the context-occupancy snapshot and the turn record) reading the
+ * env var with two different expressions: a bare
+ * `process.env.SWITCHROOM_AGENT_STATE_DIR ?? '/state/agent'` and this one. For
+ * a value like `"/x/ "` or `"/x/"` those resolve to DIFFERENT directories, so
+ * the two artifacts of the same turn would land in two places — exactly the
+ * kind of split-brain state that made the turn-record leak hard to see. Both
+ * call sites now share this function.
+ *
+ * Blank/whitespace-only is treated as unset (a compose file that renders an
+ * empty value must not send state to `/turns.jsonl` at the filesystem root),
+ * and a trailing slash is stripped so joins never double it.
+ */
+export function resolveAgentStateDir(
+  env: Record<string, string | undefined> = process.env,
+): string {
+  const dir = env.SWITCHROOM_AGENT_STATE_DIR?.trim()
+  return dir != null && dir !== '' ? dir.replace(/\/+$/, '') : DEFAULT_AGENT_STATE_DIR
+}
+
+/**
+ * Resolve the turn-record path from the environment.
+ *
+ * `emitTurnRecord` used to hard-code `/state/agent/turns.jsonl`, ignoring
+ * `SWITCHROOM_AGENT_STATE_DIR` — which the sibling context-occupancy writer a
+ * few lines above it in `gateway.ts` already honours. Inside an agent container
+ * that path is the bind-mounted PRODUCTION `~/.switchroom/agents/<name>/
+ * turns.jsonl`, so any test that drove the real turn-end funnel while running
+ * in an agent container appended its synthetic rows straight into that agent's
+ * production turn record — even when the test had pointed every state-dir env
+ * var at a tmpdir. Those rows are then read back by the fleet-health L0 sensor
+ * (`src/fleet-health/scan.ts`) as that agent's real production turns.
+ *
+ * Honouring the env var is the root-cause fix: production containers do not set
+ * it (default unchanged), and a test that isolates its state dir now isolates
+ * its turn records with it.
+ *
+ * ── Operator coupling: setting this var RELOCATES the fleet-health input ──
+ *
+ * `agent.env` in `switchroom.yaml` is propagated verbatim into the container
+ * (`src/agents/compose.ts` `userEnv`), so an operator CAN set
+ * `SWITCHROOM_AGENT_STATE_DIR` on an agent. If they point it anywhere other
+ * than the bind-mounted `/state/agent`, this file moves with it — but the
+ * fleet-health L0 sensor reads `~/.switchroom/agents/<name>/turns.jsonl` at a
+ * FIXED host path (`src/fleet-health/scan.ts`). That agent then presents no
+ * turns artifact, lands in the scan's `skipped[]`, and goes quiet on the health
+ * board: no findings, no ledger entries, indistinguishable from a healthy
+ * agent. Do not set this var in production `agent.env`; it exists so tests (and
+ * the vitest `agent-state-dir-guard` setup file) can isolate agent state into a
+ * tmpdir.
+ */
+export function resolveTurnsJsonlPath(
+  env: Record<string, string | undefined> = process.env,
+): string {
+  return `${resolveAgentStateDir(env)}/turns.jsonl`
+}
+
 export interface RotateFs {
   statSize: (path: string) => number | undefined // undefined ⇒ file absent
   rename: (from: string, to: string) => void

package/telegram-plugin/reply-owner-resolve.ts

@@ -25,8 +25,8 @@
  *
  * The DECISIVE divergence: the gateway's *thread-routing* path DID recover the
  * owner turn for the same late reply — via `findTurnByQuotedMessageId` (the
- * framework-owned default quote target) and `findLatestEndedTurnForChat` (the
- * chat's most-recently-ended turn). The supersede resolver chain omitted BOTH
+ * framework-owned default quote target) and `findLatestTurnForChat` (the
+ * chat's most recent turn). The supersede resolver chain omitted BOTH
  * recoveries, so the two resolvers disagreed on who owned the reply. This module
  * unifies them onto ONE precedence so they can never diverge again.
  *
@@ -37,7 +37,7 @@
  * `decideCapturedProseDelivery` — is to extract the decision core into a pure,
  * unit-testable function and have the gateway run the EXACT code the regression
  * tests exercise. The gateway performs the four turn lookups (currentTurn,
- * findTurnByOriginId, findTurnByQuotedMessageId, findLatestEndedTurnForChat) and
+ * findTurnByOriginId, findTurnByQuotedMessageId, findLatestTurnForChat) and
  * feeds their resolved turnIds here; the precedence lives in one place.
  */
 
@@ -56,16 +56,25 @@ export interface ReplyOwnerCandidates {
   /** `findTurnByQuotedMessageId(chat_id, reply_to)` — the framework-owned
    *  quoted message id, resolved with NO model thread assertion. */
   quotedTurnId: string | null
-  /** `findLatestEndedTurnForChat(chat_id)` — the chat's most-recently-ended
-   *  turn. The deterministic late-reply fallback (the DM path's recovery). */
+  /** `findLatestTurnForChat(chat_id, {endedOnly:true})` — the chat's
+   *  most-recently-ENDED turn. The deterministic late-reply fallback (the DM
+   *  path's recovery). #3725: the gateway lookup skips turns that have not
+   *  ended, so this is never a still-running turn. */
   latestEndedTurnId: string | null
   /** Age (ms) of the latest-ended turn — `now - turn.endedAt`. The latest-ended
    *  tier carries DESTRUCTIVE authority (it drives supersede deletion), so it is
    *  honoured ONLY when the turn ended within `latestEndedTtlMs` (the supersede
    *  TTL). Without the bound, a late reply belonging to an OLDER turn could
    *  resolve its owner to a NEWER turn now sitting at the registry tail and
-   *  delete THAT turn's legit answer. Undefined/null ⇒ unbounded (back-compat:
-   *  callers that don't supply an age keep the pre-F2 behaviour). */
+   *  delete THAT turn's legit answer.
+   *
+   *  Two distinct absences (#3725):
+   *    - `undefined` (property omitted) ⇒ unbounded, the pre-F2 back-compat
+   *      escape for callers that don't supply an age at all;
+   *    - explicit `null` ⇒ the caller COMPUTED no age, i.e. its candidate turn
+   *      has no `endedAt` and has NOT ended. That cannot be TTL-bounded, so it
+   *      fails CLOSED (not accepted) rather than granting unbounded authority
+   *      to a turn that is still running. */
   latestEndedAgeMs?: number | null
   /** The supersede TTL bound applied to `latestEndedAgeMs`. Undefined ⇒
    *  unbounded. */
@@ -74,13 +83,17 @@ export interface ReplyOwnerCandidates {
 
 /**
  * Whether the latest-ended candidate is fresh enough to carry supersede
- * (deletion) authority. A missing age or TTL means unbounded (back-compat).
+ * (deletion) authority. An OMITTED age or TTL means unbounded (the pre-F2
+ * back-compat escape); an EXPLICIT null age fails closed (#3725 — the caller
+ * computed no age because its candidate turn has not ended, and an un-ended turn
+ * must be resolved by the `live` tier, never by this destructive fallback).
  */
 function latestEndedAccepted(candidates: ReplyOwnerCandidates): boolean {
   if (candidates.latestEndedTurnId == null) return false
   const age = candidates.latestEndedAgeMs
   const ttl = candidates.latestEndedTtlMs
-  if (age == null || ttl == null) return true
+  if (age === null) return false
+  if (age === undefined || ttl == null) return true
   return age <= ttl
 }
 
@@ -143,6 +156,94 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
   }
 }
 
+/**
+ * Whether the supersede path may BYPASS the #3429 content gate — i.e. treat the
+ * landing reply as this flushed turn's OWN answer and collapse the provisional
+ * flush REGARDLESS of the model having reworded it.
+ *
+ * ## Why this is not simply "the tier is positive"
+ *
+ * The pre-existing rule was `tier === 'live' || (tier === 'latest-ended' &&
+ * !handbackCouldOwnReply)`. `origin` and `quoted` were excluded WHOLESALE
+ * because both derive from MODEL-SUPPLIED args (`args.origin_turn_id` /
+ * `args.reply_to`): a reply can STEER its own attribution onto a DIFFERENT
+ * ended turn and, with the gate bypassed, silently edit over that turn's
+ * delivered answer (the #3429 double-loss, executed by Fable 2026-07-21).
+ *
+ * That wholesale exclusion over-fires. Observed 2026-07-27 on a DM agent (two
+ * answers delivered twice): the answer-ready quiescence flush posted the turn's
+ * composed prose as message A, the model then fired `reply` with a REWORDED
+ * version of the SAME answer, and — because it had echoed `origin_turn_id` back
+ * pointing at its OWN turn — the tier resolved `origin` rather than
+ * `latest-ended`, so no bypass applied and the content gate declined on the
+ * rewording (`reply: flush supersede declined — new content (#3429)`). Message B
+ * shipped as a visible duplicate. Had the model simply OMITTED the echo, the
+ * identical reply would have resolved `latest-ended` and collapsed to ONE
+ * message. The exclusion punished the model for supplying MORE information.
+ *
+ * ## The rule: corroborate the steerable tier, don't blanket-ban it
+ *
+ * A model-supplied attribution is dangerous only when it points somewhere the
+ * FRAMEWORK would not have gone on its own. So `origin`/`quoted` bypass the
+ * content gate IFF the turn they resolve is the SAME turn the framework-derived,
+ * TTL-bounded `latest-ended` candidate resolves — a candidate computed from
+ * `findLatestTurnForChat(chat_id, {endedOnly:true})` with no model input at all.
+ * "TTL-bounded" is enforced, not assumed (#3725): `latestEndedAccepted` demands
+ * an age within `latestEndedTtlMs`, and an anchor turn that has NOT ended (age
+ * explicitly null) is rejected outright rather than treated as unbounded — so a
+ * turn still running in another topic of the same chat can corroborate nothing.
+ *
+ * This grants ZERO new capability, which is the safety argument: any reply that
+ * reaches the bypass via a corroborated `origin`/`quoted` attribution could
+ * already have reached it by omitting `origin_turn_id`/`reply_to` entirely and
+ * landing on `latest-ended` with the same turn and the same outcome. Steering to
+ * a DIFFERENT ended turn breaks corroboration (`origin` id ≠ latest-ended id),
+ * so the gate holds and the #3429/Fable silent-edit-over defence is untouched.
+ *
+ * `latest-ended` corroborates itself trivially (its resolved id IS the
+ * latest-ended candidate), so the rule below SUBSUMES the previous behaviour on
+ * that tier rather than changing it.
+ *
+ * `live` keeps its unconditional bypass: `currentTurn` is framework-owned, and
+ * `decideSupersede`'s same-turnId requirement already bars it from reaching a
+ * DIFFERENT ended turn's record. `none` never bypasses (nothing to attribute).
+ */
+export function decideContentGateBypass(input: {
+  /** The winning owner tier (`resolveReplyOwnerTier`). */
+  tier: ReplyOwnerTier
+  /** The owner turnId the supersede will act on (`resolveReplyOwnerTurnId`). */
+  resolvedTurnId: string | null
+  /** The SAME candidate set both of the above were derived from — supplies the
+   *  framework-derived `latestEndedTurnId` plus its freshness bound, so the
+   *  corroboration reuses the EXACT rule `resolveReplyOwnerTier` applies
+   *  (`latestEndedAccepted`) instead of duplicating it: within the TTL, and —
+   *  since #3725 — not a turn that is still running. */
+  candidates: ReplyOwnerCandidates
+  /** True when a decoupled-completion inbound (`subagent_handback`) was enqueued
+   *  in this chat AFTER the owner turn ended and within the supersede TTL — the
+   *  ambiguous window where the late reply might BE that handback rather than
+   *  the turn's own answer. Keeps the content gate on every non-`live` tier. */
+  handbackCouldOwnReply: boolean
+}): boolean {
+  if (input.tier === 'live') return true
+  if (input.tier === 'none') return false
+  if (input.handbackCouldOwnReply) return false
+  // Total over degenerate input (#3726). TypeScript makes `candidates` mandatory
+  // and the one production caller (`resolveReplyOwnerTurn`) always builds it, so
+  // this cannot fire today — but this module is exported precisely so the
+  // decision can be exercised OUTSIDE the gateway's construction discipline.
+  // Every other defensive branch here fails CLOSED (keep the #3429 content
+  // gate); without this guard the missing-input case instead fails by THROWING
+  // out of the supersede path — a fail-open-by-crash. Matches the module's own
+  // precedent: `latestEndedAccepted` is total over null age/ttl/turnId.
+  if (input.candidates == null) return false
+  if (!latestEndedAccepted(input.candidates)) return false
+  return (
+    input.resolvedTurnId != null &&
+    input.resolvedTurnId === input.candidates.latestEndedTurnId
+  )
+}
+
 /**
  * The answer-delivered latch value — SOURCE-TAGGED (#3426).
  *

package/telegram-plugin/send-gate-degraded.test.ts

@@ -113,7 +113,7 @@ describe('send-gate PR2: cosmetic shedding', () => {
     expect(gate.stats().global.sent).toBe(1)
   })
 
-  it('sheds a cosmetic EDIT while the message-edit window is open', async () => {
+  it('COALESCES a cosmetic EDIT through an open message-edit window instead of shedding it (#3716)', async () => {
     const clock = new FakeClock()
     const { calls, fn } = recorder(clock)
     const gate = createSendGate({
@@ -122,17 +122,35 @@ describe('send-gate PR2: cosmetic shedding', () => {
       // H1: msg-edit scope is keyed `${chat_id}:${messageId}`.
       initialWindows: [{ scopeKey: 'msg-edit:5:42', untilTs: HOUR }],
     })
+    const opts = { chat_id: '5', messageId: 42, priorityClass: 'cosmetic' as const }
 
-    const res = await gate.gate(fn('edit'), {
-      chat_id: '5',
-      messageId: 42,
-      editPayload: 'v1',
-      priorityClass: 'cosmetic',
-    })
+    // A burst of cosmetic edits arrives while the window is wide open. The old
+    // behaviour dropped every one of them (SEND_GATE_SHED), which stranded the
+    // card on whatever body happened to be on screen when the window opened.
+    const p1 = gate.gate(fn('v1'), { ...opts, editPayload: 'v1' })
+    await flush()
+    const p2 = gate.gate(fn('v2'), { ...opts, editPayload: 'v2' })
+    await flush()
+    const p3 = gate.gate(fn('v3'), { ...opts, editPayload: 'v3' })
+    await flush()
 
-    expect(res).toBe(SEND_GATE_SHED)
+    // Nothing has hit the API yet — the window still suppresses the send, which
+    // is the flood protection doing its job.
     expect(calls).toHaveLength(0)
-    expect(gate.stats().global.shed).toBe(1)
+    // ...but nothing was DISCARDED either.
+    expect(gate.stats().global.shed).toBe(0)
+
+    // Walk past the window. Exactly ONE send lands, carrying the NEWEST payload:
+    // the burst was aggregated, not dropped, and not replayed edit-by-edit.
+    await clock.advance(HOUR + 1000)
+    await flush()
+    await Promise.allSettled([p1, p2, p3])
+
+    expect(calls.map((c) => c.label)).toEqual(['v3'])
+    expect(gate.stats().global.sent).toBe(1)
+    expect(gate.stats().global.shed).toBe(0)
+    // v1 and v2 were superseded in the pending slot (last-write-wins).
+    expect(gate.stats().global.coalesced).toBeGreaterThan(0)
   })
 })
 
@@ -343,7 +361,7 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
     expect(calls.every((c) => c.at === 0)).toBe(true)
   })
 
-  it('a 429 on chat A message 100 does NOT shed chat B message 100 cosmetic edits', async () => {
+  it('a 429 on chat A message 100 does NOT delay chat B message 100 cosmetic edits', async () => {
     const clock = new FakeClock()
     const { calls, fn } = recorder(clock)
     const gate = createSendGate({
@@ -353,14 +371,17 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
       initialWindows: [{ scopeKey: 'msg-edit:A:100', untilTs: HOUR }],
     })
 
-    // Chat A cosmetic edit → shed (its scope window is open).
-    const rA = await gate.gate(fn('A-edit'), {
+    // Chat A cosmetic edit → deferred, its scope window is open (#3716: deferred,
+    // NOT shed — the edit is held and lands with its state once the window ends).
+    const pA = gate.gate(fn('A-edit'), {
       chat_id: 'A',
       messageId: 100,
       editPayload: 'A-edit',
       priorityClass: 'cosmetic',
     })
-    // Chat B cosmetic edit to the SAME message_id → must NOT shed (different scope).
+    await flush()
+    // Chat B cosmetic edit to the SAME message_id → must be unaffected (different
+    // scope). This is the H1 isolation the test exists to guard.
     const rB = await gate.gate(fn('B-edit'), {
       chat_id: 'B',
       messageId: 100,
@@ -368,10 +389,18 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
       priorityClass: 'cosmetic',
     })
 
-    expect(rA).toBe(SEND_GATE_SHED) // A shed
-    expect(rB).toBe('B-edit') // B sent
+    expect(rB).toBe('B-edit') // B sent immediately, unblocked by A's window
     expect(calls.map((c) => c.label)).toEqual(['B-edit'])
-    expect(gate.stats().global.shed).toBe(1)
+    // A is still pending, not discarded.
+    expect(gate.stats().global.shed).toBe(0)
+
+    // Once A's window closes, A's edit lands too — nothing was lost.
+    await clock.advance(HOUR + 1000)
+    await flush()
+    await Promise.allSettled([pA])
+
+    expect(calls.map((c) => c.label).sort()).toEqual(['A-edit', 'B-edit'])
+    expect(gate.stats().global.shed).toBe(0)
   })
 })