switchroom 0.19.23 → 0.19.24

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -62,7 +62,12 @@ import {
   DEFAULT_SUPERSEDE_TTL_MS,
   type FlushedTurnSupersedeRegistry,
 } from '../flushed-turn-supersede.js'
-import { decideAnswerLatchSuppression, type ReplyOwnerTier } from '../reply-owner-resolve.js'
+import {
+  decideAnswerLatchSuppression,
+  decideContentGateBypass,
+  type ReplyOwnerTier,
+  type ReplyOwnerCandidates,
+} from '../reply-owner-resolve.js'
 import { deriveTelegraphTitle } from '../telegraph.js'
 import {
   mayInjectListenButton,
@@ -726,7 +731,13 @@ export interface SendReplyGatewayDeps {
   assertSendable(f: string): void
   statusKey(chatId: string, threadId?: number | null): string
   streamKey(chatId: string, threadId?: number | null): string
-  resolveReplyOwnerTurn(liveTurn: CurrentTurn | null, chatId: string, args: Record<string, unknown>): { turn: CurrentTurn | null; tier: ReplyOwnerTier }
+  /** Resolves the owner turn AND returns the CANDIDATE SET it was derived from.
+   *  The candidates are load-bearing, not diagnostics: `decideContentGateBypass`
+   *  corroborates a model-steerable `origin`/`quoted` attribution against the
+   *  framework-derived `latestEndedTurnId` inside them before allowing a
+   *  content-gate bypass — an anchor that is an ENDED turn within the supersede
+   *  TTL, never one still running (#3725). */
+  resolveReplyOwnerTurn(liveTurn: CurrentTurn | null, chatId: string, args: Record<string, unknown>): { turn: CurrentTurn | null; tier: ReplyOwnerTier; candidates: ReplyOwnerCandidates }
   findTurnByOriginId(originTurnId: string | null | undefined): CurrentTurn | null
   findTurnByQuotedMessageId(chatId: string, replyTo: unknown): CurrentTurn | null
   resolveAnswerThreadWithLog(
@@ -946,7 +957,11 @@ export async function sendReply(
     // double-send). The quoted / latest-ended recoveries are precisely what the
     // router already did for the same reply, so unifying here makes the two
     // resolvers agree and the late-reply supersede fires by identity.
-    const { turn: ownerTurn, tier: ownerTier } = resolveReplyOwnerTurn(turn, chat_id, args)
+    const {
+      turn: ownerTurn,
+      tier: ownerTier,
+      candidates: ownerCandidates,
+    } = resolveReplyOwnerTurn(turn, chat_id, args)
     const resolvedTurnId = ownerTurn?.turnId ?? null
     // #3429 — pass the (normalized) reply text so the registry CAN apply the
     // new-content gate: identity match + TTL alone also fits a background
@@ -998,7 +1013,7 @@ export async function sendReply(
     // owner turn resolved (no record to clobber on the collapse path).
     const gateThreadId = ownerTurn?.sessionThreadId ?? replyThreadId
     // MUST-FIX 2 (dup-audit / Fable) — the content-gate READ is CHAT-WIDE, not
-    // lane-specific: `findLatestEndedTurnForChat` resolves owners chat-wide, so a
+    // lane-specific: `findLatestTurnForChat` resolves owners chat-wide, so a
     // handback in topic A can supersede topic B's ended turn; a thread-keyed gate
     // read (the F2 regression) let a reply dodge that handback by carrying a
     // different `message_thread_id`. Chat-wide makes the gate un-steerable — any
@@ -1014,23 +1029,35 @@ export async function sendReply(
       ownerEndedAt != null &&
       handbackAt > ownerEndedAt &&
       now - handbackAt <= DEFAULT_SUPERSEDE_TTL_MS
-    // MUST-FIX 1 (silent-data-loss, PROVEN by Fable 2026-07-21) — restrict the
-    // content-gate BYPASS to the tiers whose attribution is NOT model-steerable:
-    //   - `live`   — the framework-owned live `currentTurn` (not model-derived,
-    //                and `decideSupersede`'s same-turnId check bars it from an
-    //                ended turn's record). Bypasses even a handback window.
+    // MUST-FIX 1 (silent-data-loss, PROVEN by Fable 2026-07-21) + the 2026-07-27
+    // corroboration widening — decided by the pure `decideContentGateBypass` so
+    // the gateway runs the exact code the unit tests exercise. The rule, in
+    // brief (full rationale on that function):
+    //   - `live`   — framework-owned live `currentTurn`; bypasses unconditionally
+    //                (`decideSupersede`'s same-turnId check already bars it from
+    //                a DIFFERENT ended turn's record).
     //   - `latest-ended` — the ambiguous DM/late-reply fallback the marko fix
-    //                actually needs; bypass ONLY when no decoupled completion is
-    //                in the window (marker-absence ⇒ own answer).
-    // The `quoted` / `origin` tiers resolve from MODEL-SUPPLIED args
-    // (`args.reply_to` / `args.origin_turn_id`), so a reply can steer ITSELF onto
-    // a DIFFERENT ended turn's record — with marker-absence they used to bypass
-    // the content gate and silently edit-over that turn's delivered answer (the
-    // #3429 double-loss, executed by Fable). Those tiers therefore NEVER bypass:
-    // they always go through the content gate, so foreign content sends fresh and
-    // only a genuine same-answer reply collapses.
-    const replyIsOwnAnswer =
-      ownerTier === 'live' || (ownerTier === 'latest-ended' && !handbackCouldOwnReply)
+    //                needs; bypass ONLY when no decoupled completion is in the
+    //                window (marker-absence ⇒ own answer).
+    //   - `origin` / `quoted` — MODEL-SUPPLIED attributions, so they bypass ONLY
+    //                when CORROBORATED: the turn they resolve must be the same
+    //                turn the framework-derived, TTL-bounded `latestEndedTurnId`
+    //                resolves (#3725 — that anchor is a genuinely ENDED turn
+    //                within the TTL; a turn still RUNNING in this chat is not a
+    //                candidate and corroborates nothing), and no handback may be
+    //                in the window. A reply that
+    //                steers itself onto a DIFFERENT ended turn fails
+    //                corroboration and keeps the content gate, so the Fable
+    //                silent-edit-over stays closed; a reply that merely echoes
+    //                its OWN turn no longer loses the collapse it would have got
+    //                by omitting the echo entirely (the observed 2026-07-27
+    //                `via=origin` duplicate).
+    const replyIsOwnAnswer = decideContentGateBypass({
+      tier: ownerTier,
+      resolvedTurnId,
+      candidates: ownerCandidates,
+      handbackCouldOwnReply,
+    })
     const decision = flushedTurnSupersede.take(
       chat_id,
       gateThreadId,
@@ -1114,7 +1141,12 @@ export async function sendReply(
       if (decision.reason === 'new-content') {
         process.stderr.write(
           `telegram gateway: reply: flush supersede declined — new content (#3429) ` +
-          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)}; sending fresh\n`,
+          `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)} ` +
+          // WHY the bypass didn't apply — without these two fields the
+          // 2026-07-27 duplicate looked like a pure text-matcher failure and
+          // took a log-archive dig to attribute to the tier restriction.
+          `tier=${ownerTier} latestEnded=${JSON.stringify(ownerCandidates.latestEndedTurnId)} ` +
+          `handbackInWindow=${handbackCouldOwnReply}; sending fresh\n`,
         )
       }
       if (suppressByLatch) {

package/telegram-plugin/gateway/subagent-handback-marker.ts

@@ -201,7 +201,7 @@ export class SubagentHandbackMarker {
    * Wall-clock ms of the most recent handback enqueue ANYWHERE in `chatId`
    * (across every topic lane), or null. This is what the content-gate read uses
    * (dup-audit MUST-FIX 2, Fable 2026-07-21): the owner-resolution latest-ended
-   * tier is CHAT-WIDE (`findLatestEndedTurnForChat` ignores thread), so a
+   * tier is CHAT-WIDE (`findLatestTurnForChat` ignores thread), so a
    * background handback in topic A can resolve — and supersede — topic B's
    * ended turn. A thread-SPECIFIC gate read (the F2 regression) let a reply
    * dodge that handback by carrying a different `message_thread_id`, silently

package/telegram-plugin/gateway/turn-end.ts

@@ -436,7 +436,7 @@ function endCurrentTurnAtomic(
   // live feed never opened because its sends failed (the resume-400 signature).
   const turnEndedAt = Date.now()
   // 2026-07 double-reply-on-DM fix (F2) — stamp the turn's end time so the
-  // `findLatestEndedTurnForChat` supersede tier can be recency-bounded to the
+  // `latest-ended` supersede tier can be recency-bounded to the
   // supersede TTL (a stale latest-ended turn must not inherit deletion
   // authority over a newer turn's flush record). Set once; idempotent on the
   // deferRecord flush path (which calls this synchronously before its send).

package/telegram-plugin/reply-owner-resolve.ts

@@ -25,8 +25,8 @@
  *
  * The DECISIVE divergence: the gateway's *thread-routing* path DID recover the
  * owner turn for the same late reply — via `findTurnByQuotedMessageId` (the
- * framework-owned default quote target) and `findLatestEndedTurnForChat` (the
- * chat's most-recently-ended turn). The supersede resolver chain omitted BOTH
+ * framework-owned default quote target) and `findLatestTurnForChat` (the
+ * chat's most recent turn). The supersede resolver chain omitted BOTH
  * recoveries, so the two resolvers disagreed on who owned the reply. This module
  * unifies them onto ONE precedence so they can never diverge again.
  *
@@ -37,7 +37,7 @@
  * `decideCapturedProseDelivery` — is to extract the decision core into a pure,
  * unit-testable function and have the gateway run the EXACT code the regression
  * tests exercise. The gateway performs the four turn lookups (currentTurn,
- * findTurnByOriginId, findTurnByQuotedMessageId, findLatestEndedTurnForChat) and
+ * findTurnByOriginId, findTurnByQuotedMessageId, findLatestTurnForChat) and
  * feeds their resolved turnIds here; the precedence lives in one place.
  */
 
@@ -56,16 +56,25 @@ export interface ReplyOwnerCandidates {
   /** `findTurnByQuotedMessageId(chat_id, reply_to)` — the framework-owned
    *  quoted message id, resolved with NO model thread assertion. */
   quotedTurnId: string | null
-  /** `findLatestEndedTurnForChat(chat_id)` — the chat's most-recently-ended
-   *  turn. The deterministic late-reply fallback (the DM path's recovery). */
+  /** `findLatestTurnForChat(chat_id, {endedOnly:true})` — the chat's
+   *  most-recently-ENDED turn. The deterministic late-reply fallback (the DM
+   *  path's recovery). #3725: the gateway lookup skips turns that have not
+   *  ended, so this is never a still-running turn. */
   latestEndedTurnId: string | null
   /** Age (ms) of the latest-ended turn — `now - turn.endedAt`. The latest-ended
    *  tier carries DESTRUCTIVE authority (it drives supersede deletion), so it is
    *  honoured ONLY when the turn ended within `latestEndedTtlMs` (the supersede
    *  TTL). Without the bound, a late reply belonging to an OLDER turn could
    *  resolve its owner to a NEWER turn now sitting at the registry tail and
-   *  delete THAT turn's legit answer. Undefined/null ⇒ unbounded (back-compat:
-   *  callers that don't supply an age keep the pre-F2 behaviour). */
+   *  delete THAT turn's legit answer.
+   *
+   *  Two distinct absences (#3725):
+   *    - `undefined` (property omitted) ⇒ unbounded, the pre-F2 back-compat
+   *      escape for callers that don't supply an age at all;
+   *    - explicit `null` ⇒ the caller COMPUTED no age, i.e. its candidate turn
+   *      has no `endedAt` and has NOT ended. That cannot be TTL-bounded, so it
+   *      fails CLOSED (not accepted) rather than granting unbounded authority
+   *      to a turn that is still running. */
   latestEndedAgeMs?: number | null
   /** The supersede TTL bound applied to `latestEndedAgeMs`. Undefined ⇒
    *  unbounded. */
@@ -74,13 +83,17 @@ export interface ReplyOwnerCandidates {
 
 /**
  * Whether the latest-ended candidate is fresh enough to carry supersede
- * (deletion) authority. A missing age or TTL means unbounded (back-compat).
+ * (deletion) authority. An OMITTED age or TTL means unbounded (the pre-F2
+ * back-compat escape); an EXPLICIT null age fails closed (#3725 — the caller
+ * computed no age because its candidate turn has not ended, and an un-ended turn
+ * must be resolved by the `live` tier, never by this destructive fallback).
  */
 function latestEndedAccepted(candidates: ReplyOwnerCandidates): boolean {
   if (candidates.latestEndedTurnId == null) return false
   const age = candidates.latestEndedAgeMs
   const ttl = candidates.latestEndedTtlMs
-  if (age == null || ttl == null) return true
+  if (age === null) return false
+  if (age === undefined || ttl == null) return true
   return age <= ttl
 }
 
@@ -143,6 +156,94 @@ export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): strin
   }
 }
 
+/**
+ * Whether the supersede path may BYPASS the #3429 content gate — i.e. treat the
+ * landing reply as this flushed turn's OWN answer and collapse the provisional
+ * flush REGARDLESS of the model having reworded it.
+ *
+ * ## Why this is not simply "the tier is positive"
+ *
+ * The pre-existing rule was `tier === 'live' || (tier === 'latest-ended' &&
+ * !handbackCouldOwnReply)`. `origin` and `quoted` were excluded WHOLESALE
+ * because both derive from MODEL-SUPPLIED args (`args.origin_turn_id` /
+ * `args.reply_to`): a reply can STEER its own attribution onto a DIFFERENT
+ * ended turn and, with the gate bypassed, silently edit over that turn's
+ * delivered answer (the #3429 double-loss, executed by Fable 2026-07-21).
+ *
+ * That wholesale exclusion over-fires. Observed 2026-07-27 on a DM agent (two
+ * answers delivered twice): the answer-ready quiescence flush posted the turn's
+ * composed prose as message A, the model then fired `reply` with a REWORDED
+ * version of the SAME answer, and — because it had echoed `origin_turn_id` back
+ * pointing at its OWN turn — the tier resolved `origin` rather than
+ * `latest-ended`, so no bypass applied and the content gate declined on the
+ * rewording (`reply: flush supersede declined — new content (#3429)`). Message B
+ * shipped as a visible duplicate. Had the model simply OMITTED the echo, the
+ * identical reply would have resolved `latest-ended` and collapsed to ONE
+ * message. The exclusion punished the model for supplying MORE information.
+ *
+ * ## The rule: corroborate the steerable tier, don't blanket-ban it
+ *
+ * A model-supplied attribution is dangerous only when it points somewhere the
+ * FRAMEWORK would not have gone on its own. So `origin`/`quoted` bypass the
+ * content gate IFF the turn they resolve is the SAME turn the framework-derived,
+ * TTL-bounded `latest-ended` candidate resolves — a candidate computed from
+ * `findLatestTurnForChat(chat_id, {endedOnly:true})` with no model input at all.
+ * "TTL-bounded" is enforced, not assumed (#3725): `latestEndedAccepted` demands
+ * an age within `latestEndedTtlMs`, and an anchor turn that has NOT ended (age
+ * explicitly null) is rejected outright rather than treated as unbounded — so a
+ * turn still running in another topic of the same chat can corroborate nothing.
+ *
+ * This grants ZERO new capability, which is the safety argument: any reply that
+ * reaches the bypass via a corroborated `origin`/`quoted` attribution could
+ * already have reached it by omitting `origin_turn_id`/`reply_to` entirely and
+ * landing on `latest-ended` with the same turn and the same outcome. Steering to
+ * a DIFFERENT ended turn breaks corroboration (`origin` id ≠ latest-ended id),
+ * so the gate holds and the #3429/Fable silent-edit-over defence is untouched.
+ *
+ * `latest-ended` corroborates itself trivially (its resolved id IS the
+ * latest-ended candidate), so the rule below SUBSUMES the previous behaviour on
+ * that tier rather than changing it.
+ *
+ * `live` keeps its unconditional bypass: `currentTurn` is framework-owned, and
+ * `decideSupersede`'s same-turnId requirement already bars it from reaching a
+ * DIFFERENT ended turn's record. `none` never bypasses (nothing to attribute).
+ */
+export function decideContentGateBypass(input: {
+  /** The winning owner tier (`resolveReplyOwnerTier`). */
+  tier: ReplyOwnerTier
+  /** The owner turnId the supersede will act on (`resolveReplyOwnerTurnId`). */
+  resolvedTurnId: string | null
+  /** The SAME candidate set both of the above were derived from — supplies the
+   *  framework-derived `latestEndedTurnId` plus its freshness bound, so the
+   *  corroboration reuses the EXACT rule `resolveReplyOwnerTier` applies
+   *  (`latestEndedAccepted`) instead of duplicating it: within the TTL, and —
+   *  since #3725 — not a turn that is still running. */
+  candidates: ReplyOwnerCandidates
+  /** True when a decoupled-completion inbound (`subagent_handback`) was enqueued
+   *  in this chat AFTER the owner turn ended and within the supersede TTL — the
+   *  ambiguous window where the late reply might BE that handback rather than
+   *  the turn's own answer. Keeps the content gate on every non-`live` tier. */
+  handbackCouldOwnReply: boolean
+}): boolean {
+  if (input.tier === 'live') return true
+  if (input.tier === 'none') return false
+  if (input.handbackCouldOwnReply) return false
+  // Total over degenerate input (#3726). TypeScript makes `candidates` mandatory
+  // and the one production caller (`resolveReplyOwnerTurn`) always builds it, so
+  // this cannot fire today — but this module is exported precisely so the
+  // decision can be exercised OUTSIDE the gateway's construction discipline.
+  // Every other defensive branch here fails CLOSED (keep the #3429 content
+  // gate); without this guard the missing-input case instead fails by THROWING
+  // out of the supersede path — a fail-open-by-crash. Matches the module's own
+  // precedent: `latestEndedAccepted` is total over null age/ttl/turnId.
+  if (input.candidates == null) return false
+  if (!latestEndedAccepted(input.candidates)) return false
+  return (
+    input.resolvedTurnId != null &&
+    input.resolvedTurnId === input.candidates.latestEndedTurnId
+  )
+}
+
 /**
  * The answer-delivered latch value — SOURCE-TAGGED (#3426).
  *

package/telegram-plugin/send-gate-degraded.test.ts

@@ -113,7 +113,7 @@ describe('send-gate PR2: cosmetic shedding', () => {
     expect(gate.stats().global.sent).toBe(1)
   })
 
-  it('sheds a cosmetic EDIT while the message-edit window is open', async () => {
+  it('COALESCES a cosmetic EDIT through an open message-edit window instead of shedding it (#3716)', async () => {
     const clock = new FakeClock()
     const { calls, fn } = recorder(clock)
     const gate = createSendGate({
@@ -122,17 +122,35 @@ describe('send-gate PR2: cosmetic shedding', () => {
       // H1: msg-edit scope is keyed `${chat_id}:${messageId}`.
       initialWindows: [{ scopeKey: 'msg-edit:5:42', untilTs: HOUR }],
     })
+    const opts = { chat_id: '5', messageId: 42, priorityClass: 'cosmetic' as const }
 
-    const res = await gate.gate(fn('edit'), {
-      chat_id: '5',
-      messageId: 42,
-      editPayload: 'v1',
-      priorityClass: 'cosmetic',
-    })
+    // A burst of cosmetic edits arrives while the window is wide open. The old
+    // behaviour dropped every one of them (SEND_GATE_SHED), which stranded the
+    // card on whatever body happened to be on screen when the window opened.
+    const p1 = gate.gate(fn('v1'), { ...opts, editPayload: 'v1' })
+    await flush()
+    const p2 = gate.gate(fn('v2'), { ...opts, editPayload: 'v2' })
+    await flush()
+    const p3 = gate.gate(fn('v3'), { ...opts, editPayload: 'v3' })
+    await flush()
 
-    expect(res).toBe(SEND_GATE_SHED)
+    // Nothing has hit the API yet — the window still suppresses the send, which
+    // is the flood protection doing its job.
     expect(calls).toHaveLength(0)
-    expect(gate.stats().global.shed).toBe(1)
+    // ...but nothing was DISCARDED either.
+    expect(gate.stats().global.shed).toBe(0)
+
+    // Walk past the window. Exactly ONE send lands, carrying the NEWEST payload:
+    // the burst was aggregated, not dropped, and not replayed edit-by-edit.
+    await clock.advance(HOUR + 1000)
+    await flush()
+    await Promise.allSettled([p1, p2, p3])
+
+    expect(calls.map((c) => c.label)).toEqual(['v3'])
+    expect(gate.stats().global.sent).toBe(1)
+    expect(gate.stats().global.shed).toBe(0)
+    // v1 and v2 were superseded in the pending slot (last-write-wins).
+    expect(gate.stats().global.coalesced).toBeGreaterThan(0)
   })
 })
 
@@ -343,7 +361,7 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
     expect(calls.every((c) => c.at === 0)).toBe(true)
   })
 
-  it('a 429 on chat A message 100 does NOT shed chat B message 100 cosmetic edits', async () => {
+  it('a 429 on chat A message 100 does NOT delay chat B message 100 cosmetic edits', async () => {
     const clock = new FakeClock()
     const { calls, fn } = recorder(clock)
     const gate = createSendGate({
@@ -353,14 +371,17 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
       initialWindows: [{ scopeKey: 'msg-edit:A:100', untilTs: HOUR }],
     })
 
-    // Chat A cosmetic edit → shed (its scope window is open).
-    const rA = await gate.gate(fn('A-edit'), {
+    // Chat A cosmetic edit → deferred, its scope window is open (#3716: deferred,
+    // NOT shed — the edit is held and lands with its state once the window ends).
+    const pA = gate.gate(fn('A-edit'), {
       chat_id: 'A',
       messageId: 100,
       editPayload: 'A-edit',
       priorityClass: 'cosmetic',
     })
-    // Chat B cosmetic edit to the SAME message_id → must NOT shed (different scope).
+    await flush()
+    // Chat B cosmetic edit to the SAME message_id → must be unaffected (different
+    // scope). This is the H1 isolation the test exists to guard.
     const rB = await gate.gate(fn('B-edit'), {
       chat_id: 'B',
       messageId: 100,
@@ -368,10 +389,18 @@ describe('send-gate PR2: H1 cross-chat message_id isolation', () => {
       priorityClass: 'cosmetic',
     })
 
-    expect(rA).toBe(SEND_GATE_SHED) // A shed
-    expect(rB).toBe('B-edit') // B sent
+    expect(rB).toBe('B-edit') // B sent immediately, unblocked by A's window
     expect(calls.map((c) => c.label)).toEqual(['B-edit'])
-    expect(gate.stats().global.shed).toBe(1)
+    // A is still pending, not discarded.
+    expect(gate.stats().global.shed).toBe(0)
+
+    // Once A's window closes, A's edit lands too — nothing was lost.
+    await clock.advance(HOUR + 1000)
+    await flush()
+    await Promise.allSettled([pA])
+
+    expect(calls.map((c) => c.label).sort()).toEqual(['A-edit', 'B-edit'])
+    expect(gate.stats().global.shed).toBe(0)
   })
 })