switchroom 0.19.25 → 0.19.27

package/telegram-plugin/tests/worker-feed-pin-persistence.test.ts

@@ -4,13 +4,22 @@ import {
   type WorkerActivityView,
   type BotApiForWorkerFeed,
 } from '../worker-activity-feed.js'
-import { reconcilePin, type PinBotApi } from '../status-pin-driver.js'
-import { decidePinAction, type PinState, type DesiredPin } from '../status-pin.js'
+import { executePinLeg, type PinBotApi } from '../status-pin-driver.js'
+import type { PinState, DesiredPin } from '../status-pin.js'
 import {
-  reconcileAndPersistStatusPin,
   loadStatusPins,
+  type PersistedStatusPin,
   type StatusPinStoreFsSeam,
 } from '../gateway/status-pin-store.js'
+import {
+  runStatusPinReconcile,
+  type StatusPinClaim,
+} from '../gateway/status-pin-retarget.js'
+
+/** Drop the #3810 claim-age stamp so a row's identity can be compared literally. */
+function idOnly(rows: PersistedStatusPin[]): Omit<PersistedStatusPin, 'pinnedAt'>[] {
+  return rows.map(({ pinnedAt: _age, ...rest }) => rest)
+}
 
 /**
  * Outcome tests for the invisible-worker-cards fix (2026-07-15).
@@ -21,9 +30,10 @@ import {
  * the pin was lost out-of-band (its in-memory claim dropped), the reused message
  * kept being edited live but was never re-pinned → scroll-buried / invisible.
  *
- * These tests wire the feed's `reconcilePin` hook into the REAL status-pin
- * driver + a claim map exactly as the gateway does (`wk:group:<feedKey>` key,
- * `void reconcileStatusPin`), and assert the PIN-CALL OUTCOMES:
+ * These tests wire the feed's `reconcilePin` hook into the REAL unified reconcile
+ * path (`runStatusPinReconcile` over `executePinLeg`) + a claim map exactly as
+ * the gateway does (`wk:group:<feedKey>` key, `void reconcileStatusPin`), and
+ * assert the PIN-CALL OUTCOMES:
  *   1. a steady-state edit re-pins when the claim was lost — and does NOT re-pin
  *      (no storm) when the claim is already correct.
  *   2. routing an unpin through the reconciler CLEARS the claim, so a later edit
@@ -68,13 +78,13 @@ function makeFakeBot(): FakeBot {
 }
 
 /**
- * Mirror the gateway's status-pin reconcile: a `Map<key,PinState>` claim store
- * driven through the real `reconcilePin` driver against a fake pin API that
- * records every pin/unpin call. This is the seam that turns a `reconcilePin`
- * hook call into an observable Telegram pin/unpin — proving OUTCOMES, not paths.
+ * Mirror the gateway's status-pin reconcile: ONE claim registry driven through
+ * the real orchestrator + driver against a fake pin API that records every
+ * pin/unpin call. This is the seam that turns a `reconcilePin` hook call into an
+ * observable Telegram pin/unpin — proving OUTCOMES, not paths.
  */
 function makePinHarness() {
-  const state = new Map<string, PinState>()
+  const claims = new Map<string, StatusPinClaim>()
   const pinCalls: number[] = []
   const unpinCalls: number[] = []
   let lastKey: string | null = null
@@ -87,10 +97,16 @@ function makePinHarness() {
     },
   }
   async function reconcile(key: string, chatId: string, desired: DesiredPin): Promise<void> {
-    const prev = state.get(key) ?? null
-    const next = await reconcilePin({ api, chatId, prevState: prev, desired })
-    if (next == null) state.delete(key)
-    else state.set(key, next)
+    const claim = claims.get(key)
+    await runStatusPinReconcile({
+      pinKey: key,
+      chatId,
+      prev: claim == null ? null : { messageId: claim.messageId },
+      desired,
+      persist: null,
+      runPin: (action, from) => executePinLeg({ api, chatId, prevState: from, action }),
+      claims,
+    })
   }
   const reconcilePinFn = (args: {
     feedKey: string
@@ -104,7 +120,8 @@ function makePinHarness() {
     else void reconcile(key, args.chatId, { pinned: false })
   }
   return {
-    state,
+    claims,
+    reconcile,
     pinCalls,
     unpinCalls,
     reconcilePinFn,
@@ -114,7 +131,7 @@ function makePinHarness() {
     },
     /** Directly drop the claim to simulate a pin lost out-of-band. */
     dropClaim(): void {
-      state.clear()
+      claims.clear()
     },
   }
 }
@@ -147,14 +164,15 @@ function memFs(): { fs: StatusPinStoreFsSeam; files: Map<string, string> } {
 
 /**
  * A pin harness that routes the feed's `reconcilePin` hook through the REAL
- * persistence path (`reconcileAndPersistStatusPin`) against a memFs-backed
- * status-pins.json — exactly as the gateway wires it: read prev claim → decide
- * → map to a persist op → reconcileAndPersistStatusPin(applyPin=reconcilePin).
- * This lets a test INSPECT THE FILE across steady-state edits (F1).
+ * persistence path against a memFs-backed status-pins.json — exactly as the
+ * gateway wires it: read prev claim → runStatusPinReconcile (which decides ONCE,
+ * maps each leg to a persist op, and drives executePinLeg through
+ * reconcileAndPersistStatusPin). This lets a test INSPECT THE FILE across
+ * steady-state edits (F1).
  */
 function makePersistingPinHarness(path: string) {
   const { fs } = memFs()
-  const claims = new Map<string, PinState>()
+  const claims = new Map<string, StatusPinClaim>()
   const pinCalls: number[] = []
   const unpinCalls: number[] = []
   const api: PinBotApi = {
@@ -166,22 +184,16 @@ function makePersistingPinHarness(path: string) {
     },
   }
   async function reconcile(key: string, chatId: string, desired: DesiredPin): Promise<void> {
-    const prev = claims.get(key) ?? null
-    const action = decidePinAction(prev, desired)
-    const op = action.kind === 'pin'
-      ? ({ kind: 'pin', messageId: action.messageId } as const)
-      : ({ kind: 'clear' } as const)
-    const next = await reconcileAndPersistStatusPin({
-      path,
-      fs,
+    const claim = claims.get(key)
+    await runStatusPinReconcile({
       pinKey: key,
       chatId,
-      op,
-      applyPin: () => reconcilePin({ api, chatId, prevState: prev, desired }),
-      log: () => {},
+      prev: claim == null ? null : { messageId: claim.messageId },
+      desired,
+      persist: { path, fs },
+      runPin: (action, from) => executePinLeg({ api, chatId, prevState: from, action }),
+      claims,
     })
-    if (next == null) claims.delete(key)
-    else claims.set(key, next)
   }
   const reconcilePinFn = (args: {
     feedKey: string
@@ -226,7 +238,7 @@ describe('worker-feed pin persistence — durable status-pins.json survives stea
     expect(pin.rows()).toHaveLength(1)
     const pinKey = pin.rows()[0].pinKey
     expect(pinKey).toMatch(/^wk:group:/)
-    expect(pin.rows()).toEqual([
+    expect(idOnly(pin.rows())).toEqual([
       { pinKey, chatId: 'chat', messageId: msgId },
     ])
 
@@ -241,7 +253,7 @@ describe('worker-feed pin persistence — durable status-pins.json survives stea
 
     // The durable row is STILL on disk (inspect the file), and no extra pin/
     // unpin API call was issued across all those steady-state edits.
-    expect(pin.rows()).toEqual([
+    expect(idOnly(pin.rows())).toEqual([
       { pinKey, chatId: 'chat', messageId: msgId },
     ])
     expect(pin.pinCalls).toEqual([msgId]) // exactly one pin, ever
@@ -269,7 +281,7 @@ describe('worker-feed pin persistence — steady-state re-pin (invisible-worker-
     expect(bot.sent).toHaveLength(1)
     const msgId = bot.sent[0].messageId
     expect(pin.pinCalls).toEqual([msgId])
-    expect(pin.state.get(pin.key())?.messageId).toBe(msgId)
+    expect(pin.claims.get(pin.key())?.messageId).toBe(msgId)
 
     // Steady-state edit while the pin is already correct → NO new pin (no storm).
     clock = 2000
@@ -284,7 +296,7 @@ describe('worker-feed pin persistence — steady-state re-pin (invisible-worker-
     await feed.update('w1', 'chat', view({ elapsedMs: 3000, toolCount: 9 }))
     await flush()
     expect(pin.pinCalls).toEqual([msgId, msgId]) // re-pinned the SAME live message
-    expect(pin.state.get(pin.key())?.messageId).toBe(msgId)
+    expect(pin.claims.get(pin.key())?.messageId).toBe(msgId)
   })
 })
 
@@ -306,27 +318,12 @@ describe('worker-feed pin persistence — unpin clears the claim', () => {
     await flush()
     const msgId = bot.sent[0].messageId
     const key = pin.key()
-    expect(pin.state.get(key)?.messageId).toBe(msgId)
+    expect(pin.claims.get(key)?.messageId).toBe(msgId)
 
     // Route an unpin of the worker message through the reconciler (the sanctioned
     // path): the claim is dropped AND the Telegram unpin is issued.
-    await (async () => {
-      const prev = pin.state.get(key) ?? null
-      const next = await reconcilePin({
-        api: {
-          pinChatMessage: async () => {},
-          unpinChatMessage: async (_c, id) => {
-            pin.unpinCalls.push(id)
-          },
-        },
-        chatId: 'chat',
-        prevState: prev,
-        desired: { pinned: false },
-      })
-      if (next == null) pin.state.delete(key)
-      else pin.state.set(key, next)
-    })()
-    expect(pin.state.has(key)).toBe(false) // claim cleared
+    await pin.reconcile(key, 'chat', { pinned: false })
+    expect(pin.claims.has(key)).toBe(false) // claim cleared
     expect(pin.unpinCalls).toContain(msgId)
 
     // A later steady edit now re-pins (the claim being clear is what lets
@@ -335,7 +332,7 @@ describe('worker-feed pin persistence — unpin clears the claim', () => {
     await feed.update('w1', 'chat', view({ elapsedMs: 2000, toolCount: 7 }))
     await flush()
     expect(pin.pinCalls).toContain(msgId)
-    expect(pin.state.get(key)?.messageId).toBe(msgId)
+    expect(pin.claims.get(key)?.messageId).toBe(msgId)
   })
 })
 
@@ -378,7 +375,7 @@ describe('worker-feed pin persistence — group-message lifetime cap rotation',
     // re-established on the new id (deterministic, no burst: one unpin + one pin).
     expect(pin.unpinCalls).toContain(msgA)
     expect(pin.pinCalls).toContain(msgB)
-    expect(pin.state.get(pin.key())?.messageId).toBe(msgB)
+    expect(pin.claims.get(pin.key())?.messageId).toBe(msgB)
 
     // FIX 1: the retired message was collapsed to the honest "moved" note with
     // exactly ONE edit (not left frozen showing live rows, not re-edited per tick).

package/telegram-plugin/tests/worker-feed-terminal-edit-class.test.ts

@@ -0,0 +1,335 @@
+/**
+ * Regression suite for switchroom#3848 — the terminal worker-card frame must
+ * not be shed with the heartbeat repaints.
+ *
+ * #3847 made the edit-flood fuse class-aware and tagged EVERY worker-feed edit
+ * `cosmetic`. That is right for a liveness repaint (dropping one costs
+ * nothing — the next render carries full state) and wrong for the TERMINAL
+ * frame: it is the last frame the operator ever reads for that card, and
+ * nothing newer is coming to repaint it. Classed cosmetic, the single frame
+ * carrying the finished state competed in the same starved budget as a
+ * heartbeat, and under sustained cosmetic pressure it was the frame dropped —
+ * leaving the card frozen mid-run forever.
+ *
+ * Every test here asserts an OUTCOME (did the call reach the API / what class
+ * did it carry), under the exact pressure scenario that sheds it. Each one
+ * goes RED if the terminal frame is classed `cosmetic` again — at the feed
+ * (`{ terminal: … }` no longer passed), at the mapping
+ * (`workerFeedEditPriorityClass`), or at the fuse.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { createEditFloodFuse, EDIT_FLOOD_FUSE_DEFAULTS } from '../edit-flood-fuse.js'
+import { withOutboundClass } from '../outbound-class.js'
+import type { Clock, PriorityClass } from '../send-gate.js'
+import {
+  createWorkerActivityFeed,
+  workerFeedEditPriorityClass,
+  type BotApiForWorkerFeed,
+  type WorkerActivityView,
+  type WorkerFeedEditMeta,
+} from '../worker-activity-feed.js'
+
+const CHAT = '1001'
+
+class FakeClock implements Clock {
+  private cur = 0
+  private seq = 0
+  private timers: { at: number; id: number; resolve: () => void }[] = []
+
+  now(): number { return this.cur }
+
+  sleep(ms: number): Promise<void> {
+    return new Promise<void>((resolve) => {
+      this.timers.push({ at: this.cur + ms, id: this.seq++, resolve })
+    })
+  }
+
+  async advance(ms: number): Promise<void> {
+    const target = this.cur + ms
+    for (;;) {
+      await flush()
+      const due = this.timers.filter((t) => t.at <= target).sort((a, b) => a.at - b.at || a.id - b.id)
+      if (due.length === 0) break
+      const t = due[0]!
+      this.timers = this.timers.filter((x) => x !== t)
+      this.cur = t.at
+      t.resolve()
+      await flush()
+    }
+    this.cur = target
+    await flush()
+  }
+}
+
+function flush(): Promise<void> {
+  return new Promise((r) => setImmediate(r))
+}
+
+async function drain(): Promise<void> {
+  for (let i = 0; i < 12; i++) await flush()
+}
+
+function view(step: string, elapsedMs: number, state: 'running' | 'done' = 'running'): WorkerActivityView {
+  return { description: 'ship the fix', lastTool: null, toolCount: 2, latestSummary: step, elapsedMs, state }
+}
+
+/**
+ * The gateway's worker-feed edit adapter, reproduced EXACTLY as
+ * `gateway.ts` wires it (see the `createWorkerActivityFeed({ bot: { … } })`
+ * block): map the feed's out-of-band `meta` to a priority class with
+ * `workerFeedEditPriorityClass`, publish it on the AsyncLocalStorage the fuse
+ * reads, then hand the call to the transformer.
+ *
+ * `withOutboundClass` is what the real send gate does with `priorityClass`;
+ * doing it here keeps this test on the production mapping rather than a
+ * hand-written class literal.
+ */
+function gatewayEditAdapter(
+  fuse: { apply: <R>(m: string, p: unknown, next: () => Promise<R>) => Promise<R> },
+  onLand: (messageId: number, cls: PriorityClass) => void,
+) {
+  return (chatId: string, messageId: number, text: string, meta?: WorkerFeedEditMeta): Promise<unknown> => {
+    const cls: PriorityClass = workerFeedEditPriorityClass(meta)
+    return withOutboundClass(cls, () =>
+      fuse.apply('editMessageText', { chat_id: chatId, message_id: messageId, text }, async () => {
+        onLand(messageId, cls)
+        return true
+      }),
+    )
+  }
+}
+
+const D = EDIT_FLOOD_FUSE_DEFAULTS
+
+/**
+ * Offset at which the frame under test is offered, relative to the pressure
+ * burst. Small and non-zero: the frame must arrive AFTER the chat's cosmetic
+ * allowance is spent (so it has to wait) but early enough that its own
+ * `maxDeferMs` deadline still falls inside the pressure window — which is
+ * precisely the "sustained cosmetic pressure" #3848 describes. Offering it at
+ * t=0 would race the burst's own late releases at the same instant.
+ */
+const OFFER_AT_MS = 1_000
+
+/**
+ * Saturate a chat's cosmetic allowance the way a busy agent does: N distinct
+ * worker cards all repainting at once. Both the per-chat cosmetic ceiling
+ * (`cosmeticPerChatMaxPerWindow`, 6/60s) and the bounded R1 late-release
+ * budget (`lateReleaseMaxPerWindow`, 2/60s) get spent — the latter matters
+ * because a LONE cosmetic frame is otherwise released late rather than
+ * dropped. That late-release budget is the partial mitigation #3848 records,
+ * and running it out is what turns the degradation into a guaranteed drop.
+ *
+ * Returns the still-pending burst; the caller advances the clock past
+ * `maxDeferMs` once, resolving the burst and the frame under test together.
+ */
+function startCosmeticPressure(
+  fuse: { apply: <R>(m: string, p: unknown, next: () => Promise<R>) => Promise<R> },
+  landed: number[],
+): Promise<unknown>[] {
+  const total = D.cosmeticPerChatMaxPerWindow + D.lateReleaseMaxPerWindow
+  const pending: Promise<unknown>[] = []
+  for (let i = 0; i < total; i++) {
+    pending.push(
+      withOutboundClass('cosmetic', () =>
+        fuse.apply('editMessageText', { chat_id: CHAT, message_id: 9000 + i, text: `card ${i}` }, async () => {
+          landed.push(9000 + i)
+          return true
+        }),
+      ),
+    )
+  }
+  return pending
+}
+
+/**
+ * Offer ONE lone edit to a fresh message id under an already-exhausted
+ * cosmetic budget, as `cls`, and report whether it reached the API.
+ */
+async function offerLoneEditUnderPressure(cls: PriorityClass): Promise<boolean> {
+  const clock = new FakeClock()
+  const fuse = createEditFloodFuse({ clock })
+  const landed: number[] = []
+  const pressure = startCosmeticPressure(fuse, landed)
+  await clock.advance(OFFER_AT_MS)
+
+  let reachedApi = false
+  const call = withOutboundClass(cls, () =>
+    fuse.apply(
+      'editMessageText',
+      { chat_id: CHAT, message_id: 4242, text: '✅ done · 12 tools' },
+      async () => { reachedApi = true; return true },
+    ),
+  )
+  await clock.advance(D.maxDeferMs + 1_000)
+  await Promise.all([...pressure, call])
+  // Sanity: the pressure really did consume the whole cosmetic allowance.
+  expect(landed).toHaveLength(D.cosmeticPerChatMaxPerWindow + D.lateReleaseMaxPerWindow)
+  return reachedApi
+}
+
+describe('#3848 — a terminal worker-card frame survives an exhausted cosmetic budget', () => {
+  it('drops the terminal frame when it is classed cosmetic, and lands it when classed useful', async () => {
+    // Both halves run the SAME fuse config under the SAME pressure, so the
+    // ONLY difference is the class the terminal frame carries. The classes
+    // come from the production mapping, so reverting the promotion turns the
+    // second assertion into the first.
+    const asCosmetic = await offerLoneEditUnderPressure(workerFeedEditPriorityClass({ terminal: false }))
+    const asUseful = await offerLoneEditUnderPressure(workerFeedEditPriorityClass({ terminal: true }))
+
+    // The defect (#3848): with the cosmetic budget spent, the frame carrying
+    // the finished state never reaches Telegram — the card freezes mid-run.
+    expect(asCosmetic).toBe(false)
+    // The fix: the same frame, promoted because it is terminal, gets through.
+    expect(asUseful).toBe(true)
+  })
+
+  it('still holds INTERMEDIATE repaints to the cosmetic ceiling after the fix', async () => {
+    // Guards the other direction: promoting the terminal frame must not
+    // promote the heartbeat stream, or #3847's whole flood defence is undone.
+    expect(workerFeedEditPriorityClass({ terminal: false })).toBe('cosmetic')
+    expect(await offerLoneEditUnderPressure('cosmetic')).toBe(false)
+  })
+})
+
+describe('#3848 — the REAL feed tags its terminal frame, through the REAL gateway mapping', () => {
+  /**
+   * End-to-end over the production pieces: `createWorkerActivityFeed` drives
+   * the gateway's own edit adapter into a real `createEditFloodFuse`. Nothing
+   * here hand-writes a class — the class comes from whatever the feed passes
+   * as `meta`. If the feed stops passing `{ terminal: … }`, or the adapter
+   * stops consulting it, the terminal recap is shed and this goes RED.
+   */
+  it('lands the finish recap at the API while the chat cosmetic budget is exhausted', async () => {
+    const clock = new FakeClock()
+    const fuse = createEditFloodFuse({ clock })
+    const preLanded: number[] = []
+    const pressure = startCosmeticPressure(fuse, preLanded)
+    await clock.advance(OFFER_AT_MS)
+
+    const CARD = 777
+    const landedEdits: { messageId: number; cls: PriorityClass }[] = []
+    const edit = gatewayEditAdapter(fuse, (messageId, cls) => landedEdits.push({ messageId, cls }))
+
+    const bot: BotApiForWorkerFeed = {
+      sendMessage: async () => ({ message_id: CARD }),
+      editMessageText: (chatId, messageId, text, _opts, meta) => edit(chatId, messageId, text, meta),
+    }
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock.now(),
+      minEditIntervalMs: 0,
+      elapsedRefreshMs: 0,
+      firstPaintMinMs: 0,
+      setInterval: () => 0,
+      clearInterval: () => {},
+    })
+
+    // First paint (a send — never dropped), then the worker finishes.
+    await feed.update('w1', CHAT, view('reading gateway.ts', 30_000))
+    await drain()
+
+    const finish = feed.finish('w1', view('opened the PR', 60_000, 'done'))
+    await clock.advance(D.maxDeferMs + 1_000)
+    await finish
+    await Promise.all(pressure)
+    await drain()
+
+    // The pressure really did spend the whole cosmetic allowance…
+    expect(preLanded).toHaveLength(D.cosmeticPerChatMaxPerWindow + D.lateReleaseMaxPerWindow)
+    // …and the terminal recap still reached Telegram, as `useful`.
+    expect(landedEdits.map((e) => e.messageId)).toContain(CARD)
+    expect(landedEdits.filter((e) => e.messageId === CARD).every((e) => e.cls === 'useful')).toBe(true)
+  })
+
+  it('classes the running repaints cosmetic and only the finish frame useful', async () => {
+    const clock = new FakeClock()
+    const CARD = 888
+    const seen: { text: string; meta?: WorkerFeedEditMeta }[] = []
+    const bot: BotApiForWorkerFeed = {
+      sendMessage: async () => ({ message_id: CARD }),
+      editMessageText: async (_c, _m, text, _opts, meta) => { seen.push({ text, meta }); return true },
+    }
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock.now(),
+      minEditIntervalMs: 0,
+      elapsedRefreshMs: 0,
+      firstPaintMinMs: 0,
+      setInterval: () => 0,
+      clearInterval: () => {},
+    })
+
+    await feed.update('w1', CHAT, view('first step', 10_000))
+    await drain()
+    await feed.update('w1', CHAT, view('second step', 20_000))
+    await drain()
+    await feed.update('w1', CHAT, view('third step', 30_000))
+    await drain()
+    const beforeFinish = seen.length
+    await feed.finish('w1', view('all done', 40_000, 'done'))
+    await drain()
+
+    // At least one intermediate repaint and exactly the finish frame after it.
+    expect(beforeFinish).toBeGreaterThan(0)
+    expect(seen.length).toBeGreaterThan(beforeFinish)
+    for (const e of seen.slice(0, beforeFinish)) {
+      expect(e.meta?.terminal).toBe(false)
+      expect(workerFeedEditPriorityClass(e.meta)).toBe('cosmetic')
+    }
+    for (const e of seen.slice(beforeFinish)) {
+      expect(e.meta?.terminal).toBe(true)
+      expect(workerFeedEditPriorityClass(e.meta)).toBe('useful')
+    }
+  })
+})
+
+describe('#3848 — gateway.ts actually wires the mapping', () => {
+  /**
+   * `gateway.ts` is not unit-importable (a single 24k-line module with a live
+   * bot at construction), so `gatewayEditAdapter` above can only MIRROR its
+   * adapter. That mirror would keep passing if someone hard-coded
+   * `priorityClass: 'cosmetic'` back into the real adapter, which is exactly
+   * the regression #3848 fixes. This asserts the real wiring at the source,
+   * deterministically, instead of trusting the mirror.
+   */
+  const GATEWAY = new URL('../gateway/gateway.ts', import.meta.url)
+
+  it('passes the feed edit meta through workerFeedEditPriorityClass', () => {
+    const src = readFileSync(GATEWAY, 'utf8')
+    // The adapter must actually RECEIVE the meta argument from the feed.
+    const ANCHOR = 'editMessageText: (cid, mid, text, editOpts, editMeta) =>'
+    const at = src.indexOf(ANCHOR)
+    expect(at, `gateway.ts no longer declares the worker-feed edit adapter as \`${ANCHOR}\``).toBeGreaterThan(-1)
+
+    // Bound the slice to this one adapter: it ends at the `verb: 'worker-feed'`
+    // options object it passes to robustApiCall.
+    const verbAt = src.indexOf("verb: 'worker-feed'", at)
+    expect(verbAt).toBeGreaterThan(at)
+    const feedAdapter = src.slice(at, verbAt + 500)
+
+    expect(feedAdapter).toContain('priorityClass: workerFeedEditPriorityClass(editMeta)')
+    // The hard-coded class #3848 removed must not come back.
+    expect(feedAdapter).not.toContain("priorityClass: 'cosmetic'")
+    // And the symbol must be imported, or the above is dead source text.
+    expect(src).toContain('workerFeedEditPriorityClass')
+  })
+})
+
+describe('#3848 — the class mapping itself', () => {
+  it('maps terminal → useful and everything else → cosmetic', () => {
+    expect(workerFeedEditPriorityClass({ terminal: true })).toBe('useful')
+    expect(workerFeedEditPriorityClass({ terminal: false })).toBe('cosmetic')
+    // An adapter that forgets to forward `meta` must degrade to the SAFE
+    // class, not silently promote every repaint.
+    expect(workerFeedEditPriorityClass(undefined)).toBe('cosmetic')
+  })
+
+  it('returns a value assignable to the send gate PriorityClass union', () => {
+    // Compile-time half: this line fails `tsc` if the mapping ever returns a
+    // class the gate does not know (#3847's OutboundClass/PriorityClass lock).
+    const cls: PriorityClass = workerFeedEditPriorityClass({ terminal: true })
+    expect(['critical', 'useful', 'cosmetic']).toContain(cls)
+  })
+})

package/telegram-plugin/tests/worker-visibility-prose-silent-harness.test.ts

@@ -253,7 +253,7 @@ describe('prose-silent background worker — end-to-end visibility harness (PR 2
     expect(h.bot.sent).toHaveLength(1)
     expect(h.feed.messageIdOf(h.agentId)).not.toBeNull()
     expect(h.bot.sent[0].chatId).toBe('chat-42')
-    expect(h.bot.sent[0].text).toContain('🛠 **Worker**')
+    expect(h.bot.sent[0].text.startsWith('🛠 **WORKER**')).toBe(true)
 
     // (b) KEEPS UPDATING: later heartbeats edit the message with a climbing
     // `· Ns` suffix so the still-alive worker visibly advances.

package/telegram-plugin/tier-downgrade.ts

@@ -33,9 +33,10 @@
  *
  * Effort is NATIVE. A live `/effort` override records in gateway memory only
  * (no carrier), so the self-restart sheds it and the downgraded default boots at
- * the configured `thinking_effort` (the fleet `low` pin, #1978 /
+ * the configured `thinking_effort` (#1978 /
  * src/config/thinking-effort-risk.ts). This module writes NO effort carrier —
- * that is the whole point: the downgraded opus must resolve LOW.
+ * that is the whole point: the downgraded opus must resolve to the configured
+ * default, whatever that is.
  *
  * Loop guard — the natural on-default guard is the real bound. After the
  * downgrade boot the session runs the configured default (the override is gone