switchroom 0.19.39 → 0.19.41

package/telegram-plugin/gateway/turn-record-status.ts

@@ -27,6 +27,38 @@ export type DeliveryOutcome = 'delivered' | 'failed' | 'suppressed'
 /** The status strings written to turns.jsonl. `send_failed` is new in PR B. */
 export type TurnStatus = 'complete' | 'no_reply' | 'send_failed'
 
+/**
+ * How this turn's answer actually reached (or failed to reach) the user — the
+ * honest delivery route, recorded alongside `status` so the fleet-health
+ * detector can tell a flush-recovered turn apart from a genuine silent no-op.
+ *
+ * - `reply`  — the reply tool delivered the answer (the normal path), OR the
+ *              flush short-circuited because reply had already delivered.
+ * - `stream` — the answer landed via the streaming/draft path without a reply
+ *              tool call (final answer delivered, `replyCalled` false).
+ * - `flush`  — a turn-flush / outbox-sweep backstop delivered the answer after
+ *              the reply tool was bypassed (terminal prose, `tools:0`). This is
+ *              the case that used to masquerade as a silent no-op.
+ * - `none`   — nothing reached the user (send failed, or a genuine no-reply).
+ */
+export type TurnRoute = 'reply' | 'stream' | 'flush' | 'none'
+
+/**
+ * Epoch of when the honest `route` field shipped on turns.jsonl rows — a FIXED
+ * literal cutoff the fleet-health detector uses to age out the pre-route legacy
+ * backlog (rows written before this field existed carry no `route`, so the
+ * detector cannot classify them and must not escalate them as silent no-ops).
+ *
+ * UNIX SECONDS, not milliseconds: turns.jsonl `ts` is written as
+ * `Math.floor(endedAt / 1000)` (see `buildTurnRecord`), and the detector
+ * compares this constant against that seconds-valued `ts`. It intentionally
+ * mirrors the units of `SILENT_NOOP_FLOOR_TS` in `src/fleet-health/detect.ts`.
+ *
+ * Value = 2026-07-31T00:00:00Z (`date -u -d @1785456000`). Fixed, not rolling:
+ * a rolling window would hide a genuine ongoing regression that drops the field.
+ */
+export const ROUTE_FIELD_SHIP_TS = 1_785_456_000
+
 /**
  * Derive the recorded turn status from the turn's flags.
  *
@@ -58,6 +90,41 @@ export function computeTurnStatus(turn: {
   }
 }
 
+/**
+ * Derive the honest delivery `route` from the SAME resolved delivery state
+ * `computeTurnStatus` reads — never speculative. `deliveryOutcome` (when
+ * present) is authoritative; when absent we fall back to the legacy
+ * `finalAnswerDelivered` / `replyCalled` reading, exactly as `computeTurnStatus`
+ * does for `status`.
+ *
+ *   failed              → none    (nothing reached the user)
+ *   delivered           → flush   (a backstop send delivered the answer)
+ *   suppressed          → reply   (flush short-circuited; reply already delivered)
+ *   undefined (legacy)  → finalAnswerDelivered
+ *                            ? (replyCalled ? reply : stream)
+ *                            : none
+ */
+export function computeTurnRoute(turn: {
+  finalAnswerDelivered: boolean
+  replyCalled: boolean
+  deliveryOutcome?: DeliveryOutcome
+}): TurnRoute {
+  switch (turn.deliveryOutcome) {
+    case 'failed':
+      return 'none'
+    case 'delivered':
+      return 'flush'
+    case 'suppressed':
+      return 'reply'
+    default:
+      return turn.finalAnswerDelivered
+        ? turn.replyCalled
+          ? 'reply'
+          : 'stream'
+        : 'none'
+  }
+}
+
 /**
  * Resolve a backstop send's outcome from what actually happened on the wire.
  * A throw is a failure; a no-throw send that delivered fewer chunks than it
@@ -148,6 +215,13 @@ export interface TurnRecordRow {
   tools: number
   status: TurnStatus
   turn_id: string
+  /**
+   * The honest delivery route for this turn (see `TurnRoute`). Recorded on every
+   * row so the fleet-health detector can distinguish a flush-recovered turn
+   * (`route: 'flush'`, answer delivered by a backstop after the reply tool was
+   * bypassed) from a genuine silent no-op (`route: 'none'`). Always emitted.
+   */
+  route: TurnRoute
   /**
    * How many landed message ids of this turn's backstop delivery the read-back
    * probe never corroborated (`sentIds` minus the confirmed subset). OMITTED
@@ -178,6 +252,7 @@ export function buildTurnRecord(
     toolCallCount: number
     turnId: string
     finalAnswerDelivered: boolean
+    replyCalled?: boolean
     deliveryOutcome?: DeliveryOutcome
     landedUnconfirmed?: number
   },
@@ -190,6 +265,11 @@ export function buildTurnRecord(
     tools: turn.toolCallCount ?? 0,
     status: computeTurnStatus(turn),
     turn_id: turn.turnId,
+    route: computeTurnRoute({
+      finalAnswerDelivered: turn.finalAnswerDelivered,
+      replyCalled: turn.replyCalled ?? false,
+      deliveryOutcome: turn.deliveryOutcome,
+    }),
     // Emitted ONLY when non-zero (see `TurnRecordRow.landed_unconfirmed`).
     ...(turn.landedUnconfirmed != null && turn.landedUnconfirmed > 0
       ? { landed_unconfirmed: turn.landedUnconfirmed }

package/telegram-plugin/hooks/compaction-marker-precompact.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+/**
+ * PreCompact hook — marks "compaction in flight" for the gateway (#4058).
+ *
+ * Claude Code PreCompact protocol:
+ *   Input:  JSON on stdin — { session_id, transcript_path, cwd,
+ *           hook_event_name: "PreCompact", trigger: "auto"|"manual",
+ *           custom_instructions }
+ *   Output: exit 0 + empty stdout → proceed. We NEVER block compaction and
+ *           NEVER exit non-zero.
+ *
+ * Side effect: writes (overwrites) ONE small JSON file
+ *   $TELEGRAM_STATE_DIR/compaction-in-flight.json
+ * with shape { ts, session_id, trigger }.
+ *
+ * Why: during mid-turn auto-compaction the model emits zero output and runs
+ * zero tools for minutes, so the gateway's silence-poke saw pure silence and
+ * fired its 300s "stalled turn" fallback on a healthy turn. The transcript
+ * only records compaction at its END (`system/compact_boundary` carries the
+ * compaction's own durationMs), so this hook is the one observable START
+ * signal. The gateway reads the marker's mtime (compaction-marker.ts) to
+ * DEFER the fallback — bounded by the same hard ceiling as the in-flight-tool
+ * defer — and removes it when the compact_boundary lands.
+ *
+ * If $TELEGRAM_STATE_DIR is unset → silent skip (dev / one-shot contexts;
+ * the fallback just keeps its pre-#4058 behaviour).
+ */
+
+import { readFileSync, mkdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8')
+  } catch {
+    return ''
+  }
+}
+
+function main() {
+  const stateDir = process.env.TELEGRAM_STATE_DIR
+  if (!stateDir) return
+
+  let payload = {}
+  try {
+    payload = JSON.parse(readStdin() || '{}')
+  } catch {
+    // Unparseable stdin — still write the marker: the mtime alone carries
+    // the load-bearing signal; the body fields are diagnostics.
+  }
+
+  try {
+    mkdirSync(stateDir, { recursive: true })
+    writeFileSync(
+      join(stateDir, 'compaction-in-flight.json'),
+      JSON.stringify({
+        ts: Date.now(),
+        session_id: typeof payload.session_id === 'string' ? payload.session_id : null,
+        trigger: typeof payload.trigger === 'string' ? payload.trigger : null,
+      }) + '\n',
+      { mode: 0o600 },
+    )
+  } catch {
+    // Best-effort: a missed marker just reverts one fallback decision to
+    // the pre-#4058 behaviour. Never fail the hook (never block compaction).
+  }
+}
+
+main()
+process.exit(0)

package/telegram-plugin/hooks/hooks.json

@@ -71,6 +71,17 @@
         ]
       }
     ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/compaction-marker-precompact.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
     "Stop": [
       {
         "hooks": [

package/telegram-plugin/session-tail.ts

@@ -158,6 +158,12 @@ export type SessionEvent =
    * ~300s wedge recovery once the launching bash is no longer running.
    */
   | { kind: 'task_notification'; taskId: string; status: string }
+  // #4058 — system compact_boundary: the CLI finished compacting the session
+  // mid-turn (the record is written at compaction END — it embeds the
+  // compaction's own durationMs). Consumed by silence-poke wiring to clear
+  // the PreCompact "compaction in flight" marker and count the boundary as
+  // production so the resumed turn gets a fresh silence window.
+  | { kind: 'compact_boundary'; trigger: string | null; compactDurationMs: number | null }
   // `reason` is set ONLY by an internal gateway-synthesized turn_end (never by
   // the JSONL projection). `answer-ready-quiescence` (PR A) marks the positive
   // deterministic quiescence-flush signal, which — unlike the orphaned-reply
@@ -702,6 +708,20 @@ export function projectTranscriptLine(line: string): SessionEvent[] {
     ]
   }
 
+  // #4058 — system compact_boundary: written when a mid-turn (auto or manual)
+  // compaction FINISHES. Real shape observed in live transcripts:
+  //   { type:"system", subtype:"compact_boundary", content:"Conversation
+  //     compacted", compactMetadata:{ trigger:"auto", preTokens, postTokens,
+  //     durationMs, ... } }
+  if (type === 'system' && obj.subtype === 'compact_boundary') {
+    const meta = obj.compactMetadata as { trigger?: unknown; durationMs?: unknown } | undefined
+    return [{
+      kind: 'compact_boundary',
+      trigger: typeof meta?.trigger === 'string' ? meta.trigger : null,
+      compactDurationMs: typeof meta?.durationMs === 'number' ? meta.durationMs : null,
+    }]
+  }
+
   return []
 }
 

package/telegram-plugin/silence-poke.ts

@@ -265,6 +265,25 @@ export interface SilencePokeDeps {
    * exactly as before.
    */
   isTurnLive?: (key: string) => boolean
+  /**
+   * #4058 — mid-turn auto-compaction defer predicate. Returns true while the
+   * Claude CLI is compacting the session for `key`'s turn (the PreCompact hook
+   * wrote the compaction marker and the `compact_boundary` transcript record
+   * hasn't landed / the marker isn't stale — see gateway/compaction-marker.ts).
+   *
+   * Why: during compaction the model emits ZERO output and runs ZERO tools
+   * for minutes, so every other work signal (`isLegitimatelyWorking`,
+   * in-flight tools, alive shells) is false and the 300s fallback fired on a
+   * healthy turn — a spurious "framework ended that stalled turn" card + a
+   * harmless re-ask, recurring on any session near the context ceiling.
+   *
+   * Semantics mirror the #1292/#3519 defers exactly: the silence CLOCK is
+   * never reset here; the terminal unwedge is DEFERRED (`continue` without
+   * setting fallbackFired) and remains bounded by `fallbackHardCeiling`, so
+   * a genuinely-wedged compaction still unwedges at the ceiling. Optional:
+   * absent (legacy fixtures) ⇒ behaviour unchanged.
+   */
+  isCompactionInFlight?: (key: string) => boolean
 }
 
 const state = new Map<string, SilencePokeState>()
@@ -773,6 +792,15 @@ function tick(now: number): void {
       const ceiling = thresholds.fallbackHardCeiling ?? Number.POSITIVE_INFINITY
       const underCeiling = silence < ceiling
       if (underCeiling) {
+        // #4058 — mid-turn auto-compaction: the CLI is summarizing the
+        // session, so the model provably CANNOT produce output or tool
+        // events; the silence is healthy, not a wedge. Defer exactly like
+        // the in-flight-tool paths below (clock untouched, fallbackFired
+        // unset, re-checked next tick) and stay bounded by the same hard
+        // ceiling via the enclosing `underCeiling` guard. Deliberately NOT
+        // gated by SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS=0 — that flag
+        // scopes the TOOL defers; compaction has no tool in flight.
+        if (activeDeps.isCompactionInFlight?.(key) === true) continue
         const forceDisable = process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS === '0'
         if (!forceDisable && activeDeps.isLegitimatelyWorking != null) {
           if (activeDeps.isLegitimatelyWorking(key)) continue

package/telegram-plugin/tests/checklist-fallback.test.ts

@@ -0,0 +1,317 @@
+/**
+ * Outcome pins for checklist graceful degradation
+ * (gateway/checklist-fallback.ts).
+ *
+ * The bug this guards: `send_checklist` built a FLAT
+ * `{ chat_id, title, tasks: [{ text, is_completed }] }` payload for
+ * Telegram's `sendChecklist`, which requires (a) `title`/`tasks` nested
+ * inside a single `checklist` object, (b) a REQUIRED integer `id` per task,
+ * (c) NO completion flag, and (d) a `business_connection_id` — native
+ * checklists are Business-account-only, so every ordinary bot chat got a raw
+ * `400: Bad Request: parameter "checklist" is required`.
+ *
+ * Pinned outcomes: the normal (no business connection) path sends a
+ * formatted ✅/⬜ text message and reports `degraded: "text"`; the native
+ * payload, when built, is CORRECT per Bot API 9.1; and no native failure
+ * escapes as a raw error — it falls back to text.
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  buildChecklistTasks,
+  renderChecklistText,
+  applyChecklistPatch,
+  buildNativeChecklistPayload,
+  buildNativeEditChecklistPayload,
+  createChecklistStore,
+  checklistStoreKey,
+  performSendChecklist,
+  performUpdateChecklist,
+  sendChecklistToolText,
+  updateChecklistToolText,
+  CHECKLIST_MAX_TASKS,
+  type ChecklistState,
+  type SendChecklistDeps,
+  type UpdateChecklistDeps,
+} from '../gateway/checklist-fallback.js'
+
+function sendDeps(over: Partial<SendChecklistDeps> = {}) {
+  const sendNative = vi.fn(async () => ({ message_id: 100 }))
+  const sendText = vi.fn(async () => ({ message_id: 200 }))
+  const log = vi.fn()
+  const deps: SendChecklistDeps = {
+    businessConnectionId: undefined,
+    nativeAvailable: true,
+    sendNative,
+    sendText,
+    literalText: false,
+    log,
+    ...over,
+  }
+  return { deps, sendNative, sendText, log }
+}
+
+function updateDeps(over: Partial<UpdateChecklistDeps> = {}) {
+  const editNative = vi.fn(async () => {})
+  const editText = vi.fn(async () => {})
+  const log = vi.fn()
+  const deps: UpdateChecklistDeps = {
+    state: undefined,
+    businessConnectionId: undefined,
+    nativeAvailable: true,
+    editNative,
+    editText,
+    literalText: false,
+    log,
+    chatId: 42,
+    messageId: 7,
+    ...over,
+  }
+  return { deps, editNative, editText, log }
+}
+
+const textState = (over: Partial<ChecklistState> = {}): ChecklistState => ({
+  title: 'Trip prep',
+  tasks: [
+    { id: 1, text: 'book flights', done: false },
+    { id: 2, text: 'renew passport', done: true },
+  ],
+  mode: 'text',
+  ...over,
+})
+
+describe('buildChecklistTasks', () => {
+  it('assigns sequential 1-based ids and normalizes done', () => {
+    expect(buildChecklistTasks([{ text: 'a' }, { text: 'b', done: true }])).toEqual([
+      { id: 1, text: 'a', done: false },
+      { id: 2, text: 'b', done: true },
+    ])
+  })
+
+  it('rejects more than the 30-task API limit', () => {
+    const tasks = Array.from({ length: CHECKLIST_MAX_TASKS + 1 }, (_, i) => ({ text: `t${i}` }))
+    expect(() => buildChecklistTasks(tasks)).toThrow(/30-task limit/)
+  })
+})
+
+describe('renderChecklistText', () => {
+  it('renders bold title + ✅/⬜ lines honoring done', () => {
+    expect(renderChecklistText(textState())).toBe('**Trip prep**\n⬜ book flights\n✅ renew passport')
+  })
+
+  it('literal mode drops the markdown bold (parseMode: text sends are not parsed)', () => {
+    expect(renderChecklistText(textState(), { literal: true })).toBe('Trip prep\n⬜ book flights\n✅ renew passport')
+  })
+})
+
+describe('applyChecklistPatch', () => {
+  it('updates by id, appends without id, replaces title; input untouched', () => {
+    const base = textState()
+    const next = applyChecklistPatch(base, {
+      title: 'Trip prep v2',
+      tasks: [{ id: '1', done: true }, { text: 'pack bags' }],
+    })
+    expect(next).toEqual({
+      title: 'Trip prep v2',
+      tasks: [
+        { id: 1, text: 'book flights', done: true },
+        { id: 2, text: 'renew passport', done: true },
+        { id: 3, text: 'pack bags', done: false },
+      ],
+    })
+    expect(base.tasks[0].done).toBe(false) // pure — no mutation
+  })
+
+  it('appends a task with an unknown id, preserving that id', () => {
+    const next = applyChecklistPatch(textState(), { tasks: [{ id: 9, text: 'buy sim', done: false }] })
+    expect(next.tasks[2]).toEqual({ id: 9, text: 'buy sim', done: false })
+  })
+})
+
+describe('native payloads — correct Bot API 9.1 shape', () => {
+  it('sendChecklist nests title/tasks inside `checklist`, carries ids, has NO is_completed', () => {
+    const payload = buildNativeChecklistPayload({
+      businessConnectionId: 'bc1',
+      chatId: 42,
+      title: 'T',
+      tasks: buildChecklistTasks([{ text: 'a', done: true }, { text: 'b' }]),
+      replyToMessageId: 5,
+    })
+    expect(payload).toEqual({
+      business_connection_id: 'bc1',
+      chat_id: 42,
+      checklist: { title: 'T', tasks: [{ id: 1, text: 'a' }, { id: 2, text: 'b' }] },
+      reply_parameters: { message_id: 5 },
+    })
+    expect(JSON.stringify(payload)).not.toContain('is_completed')
+  })
+
+  it('editMessageChecklist sends the FULL checklist (native edits replace it)', () => {
+    const payload = buildNativeEditChecklistPayload({
+      businessConnectionId: 'bc1',
+      chatId: 42,
+      messageId: 7,
+      title: 'T',
+      tasks: [{ id: 3, text: 'kept', done: false }],
+    })
+    expect(payload).toEqual({
+      business_connection_id: 'bc1',
+      chat_id: 42,
+      message_id: 7,
+      checklist: { title: 'T', tasks: [{ id: 3, text: 'kept' }] },
+    })
+  })
+})
+
+describe('performSendChecklist — degradation outcomes', () => {
+  it('no business connection (the fleet norm) → sends the ✅/⬜ text render, never native', async () => {
+    const { deps, sendNative, sendText } = sendDeps()
+    const r = await performSendChecklist(deps, {
+      title: 'Trip prep',
+      tasks: [{ text: 'book flights' }, { text: 'renew passport', done: true }],
+      chatId: 42,
+    })
+    expect(sendNative).not.toHaveBeenCalled()
+    expect(sendText).toHaveBeenCalledWith('**Trip prep**\n⬜ book flights\n✅ renew passport')
+    expect(r).toMatchObject({ message_id: 200, mode: 'text' })
+    expect(r.state).toEqual({
+      title: 'Trip prep',
+      tasks: [
+        { id: 1, text: 'book flights', done: false },
+        { id: 2, text: 'renew passport', done: true },
+      ],
+      mode: 'text',
+    })
+  })
+
+  it('business connection configured → sends the correct nested native payload', async () => {
+    const { deps, sendNative, sendText } = sendDeps({ businessConnectionId: 'bc1' })
+    const r = await performSendChecklist(deps, { title: 'T', tasks: [{ text: 'a' }], chatId: 42 })
+    expect(sendText).not.toHaveBeenCalled()
+    expect(sendNative).toHaveBeenCalledWith({
+      business_connection_id: 'bc1',
+      chat_id: 42,
+      checklist: { title: 'T', tasks: [{ id: 1, text: 'a' }] },
+    })
+    expect(r).toMatchObject({ message_id: 100, mode: 'native' })
+  })
+
+  it('native failure does NOT escape — falls back to the text render', async () => {
+    const { deps, sendText, log } = sendDeps({
+      businessConnectionId: 'bc1',
+      sendNative: vi.fn(async () => { throw new Error('400: Bad Request: parameter "checklist" is required') }),
+    })
+    const r = await performSendChecklist(deps, { title: 'T', tasks: [{ text: 'a' }], chatId: 42 })
+    expect(r).toMatchObject({ message_id: 200, mode: 'text' })
+    expect(sendText).toHaveBeenCalledWith('**T**\n⬜ a')
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('falling back to text'))
+  })
+
+  it('checklist API not available in this grammY version → text render, no native attempt', async () => {
+    const { deps, sendNative } = sendDeps({ businessConnectionId: 'bc1', nativeAvailable: false })
+    const r = await performSendChecklist(deps, { title: 'T', tasks: [{ text: 'a' }], chatId: 42 })
+    expect(sendNative).not.toHaveBeenCalled()
+    expect(r.mode).toBe('text')
+  })
+})
+
+describe('performUpdateChecklist — degradation outcomes', () => {
+  it('text-mode: patch applies to stored state and re-renders the ✅/⬜ text', async () => {
+    const { deps, editText, editNative } = updateDeps({ state: textState() })
+    const r = await performUpdateChecklist(deps, { tasks: [{ id: 1, done: true }] })
+    expect(editNative).not.toHaveBeenCalled()
+    expect(editText).toHaveBeenCalledWith('**Trip prep**\n✅ book flights\n✅ renew passport')
+    expect(r).toMatchObject({ ok: true, mode: 'text' })
+  })
+
+  it('no stored state + partial patch → structured unknown_checklist, no edit attempted', async () => {
+    const { deps, editText, editNative } = updateDeps()
+    const r = await performUpdateChecklist(deps, { tasks: [{ id: 1, done: true }] })
+    expect(r).toMatchObject({ ok: false, reason: 'unknown_checklist' })
+    expect(editText).not.toHaveBeenCalled()
+    expect(editNative).not.toHaveBeenCalled()
+  })
+
+  it('no stored state + full replacement (title + all task texts) → rebuilds and edits as text', async () => {
+    const { deps, editText } = updateDeps()
+    const r = await performUpdateChecklist(deps, {
+      title: 'Rebuilt',
+      tasks: [{ text: 'a', done: true }, { text: 'b' }],
+    })
+    expect(r).toMatchObject({ ok: true, mode: 'text' })
+    expect(editText).toHaveBeenCalledWith('**Rebuilt**\n✅ a\n⬜ b')
+  })
+
+  it('native-mode: edits with the FULL post-patch checklist payload', async () => {
+    const { deps, editNative } = updateDeps({
+      state: textState({ mode: 'native' }),
+      businessConnectionId: 'bc1',
+    })
+    const r = await performUpdateChecklist(deps, { tasks: [{ text: 'new task' }] })
+    expect(r).toMatchObject({ ok: true, mode: 'native' })
+    expect(editNative).toHaveBeenCalledWith({
+      business_connection_id: 'bc1',
+      chat_id: 42,
+      message_id: 7,
+      checklist: {
+        title: 'Trip prep',
+        tasks: [
+          { id: 1, text: 'book flights' },
+          { id: 2, text: 'renew passport' },
+          { id: 3, text: 'new task' },
+        ],
+      },
+    })
+  })
+
+  it('a failed edit never throws a raw Telegram error — structured edit_failed instead', async () => {
+    const { deps } = updateDeps({
+      state: textState(),
+      editText: vi.fn(async () => { throw new Error('400: Bad Request: message to edit not found') }),
+    })
+    const r = await performUpdateChecklist(deps, { tasks: [{ id: 1, done: true }] })
+    expect(r).toMatchObject({ ok: false, reason: 'edit_failed' })
+    expect((r as { hint: string }).hint).toContain('message to edit not found')
+  })
+
+  it('native-mode checklist with the business connection gone → structured edit_failed', async () => {
+    const { deps, editNative } = updateDeps({ state: textState({ mode: 'native' }) })
+    const r = await performUpdateChecklist(deps, { tasks: [{ id: 1, done: true }] })
+    expect(r).toMatchObject({ ok: false, reason: 'edit_failed' })
+    expect(editNative).not.toHaveBeenCalled()
+  })
+})
+
+describe('tool-result text', () => {
+  it('send: degraded text result carries degraded:"text" so the agent knows', () => {
+    const parsed = JSON.parse(sendChecklistToolText({
+      message_id: 200, mode: 'text', state: textState(),
+    }))
+    expect(parsed).toMatchObject({ ok: true, message_id: 200, mode: 'text', degraded: 'text' })
+    expect(parsed.note).toContain('Business connection')
+  })
+
+  it('send: native result has no degraded marker', () => {
+    expect(JSON.parse(sendChecklistToolText({
+      message_id: 100, mode: 'native', state: textState({ mode: 'native' }),
+    }))).toEqual({ ok: true, message_id: 100, mode: 'native' })
+  })
+
+  it('update: structured failure round-trips reason + hint', () => {
+    expect(JSON.parse(updateChecklistToolText(
+      { ok: false, reason: 'unknown_checklist', hint: 'resend it' }, 7,
+    ))).toEqual({ ok: false, reason: 'unknown_checklist', hint: 'resend it' })
+  })
+})
+
+describe('createChecklistStore', () => {
+  it('evicts oldest entries past the cap', () => {
+    const store = createChecklistStore(2)
+    store.set(checklistStoreKey('1', 1), textState())
+    store.set(checklistStoreKey('1', 2), textState())
+    store.set(checklistStoreKey('1', 3), textState())
+    expect(store.get('1:1')).toBeUndefined()
+    expect(store.get('1:2')).toBeDefined()
+    expect(store.get('1:3')).toBeDefined()
+  })
+})

package/telegram-plugin/tests/gateway-outbound-redact.test.ts

@@ -114,21 +114,25 @@ describe('gateway outbound secret-scrub — structural wiring', () => {
     expect(sendIdx).toBeGreaterThan(redactIdx) // mask BEFORE the question is sent
   })
 
-  it('send_checklist: redacts title + task text BEFORE rawSendChecklist', () => {
-    // F2 — checklist title + task strings were sent unredacted.
+  it('send_checklist: redacts title + task text BEFORE the send orchestration', () => {
+    // F2 — checklist title + task strings were sent unredacted. The send now
+    // routes through performSendChecklist (native OR text fallback), so the
+    // scrub must land before that orchestration call — both paths receive
+    // only redacted strings.
     const start = src.indexOf('async function executeSendChecklist(')
     const redactIdx = src.indexOf('redactChecklistFields(', start)
-    const sendIdx = src.indexOf('rawSendChecklist({', start)
+    const sendIdx = src.indexOf('performSendChecklist({', start)
     expect(start).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(start)
     expect(sendIdx).toBeGreaterThan(redactIdx) // mask BEFORE the send
   })
 
-  it('update_checklist: redacts title + task text BEFORE rawEditMessageChecklist', () => {
-    // F2 sibling — update_checklist shares the identical leak class.
+  it('update_checklist: redacts title + task text BEFORE the edit orchestration', () => {
+    // F2 sibling — update_checklist shares the identical leak class; the edit
+    // routes through performUpdateChecklist (native OR text fallback).
     const start = src.indexOf('async function executeUpdateChecklist(')
     const redactIdx = src.indexOf('redactChecklistFields(', start)
-    const editIdx = src.indexOf('rawEditMessageChecklist({', start)
+    const editIdx = src.indexOf('performUpdateChecklist({', start)
     expect(start).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(start)
     expect(editIdx).toBeGreaterThan(redactIdx) // mask BEFORE the edit

package/telegram-plugin/tests/outbox-delivery.test.ts

@@ -119,7 +119,8 @@ describe('sweepOutbox — end to end (exactly-once, siblings, dedup)', () => {
       sent,
       send: async (chatId: string, threadId: number | null, text: string) => {
         sent.push({ chatId, threadId, text })
-        return sent.length
+        const id = sent.length
+        return { messageId: id, chunks: [{ messageId: id, text }] }
       },
     }
   }
@@ -136,6 +137,42 @@ describe('sweepOutbox — end to end (exactly-once, siblings, dedup)', () => {
     expect(listPendingRecords(dir)).toHaveLength(0)
   })
 
+  it('persist parity: recordOutbound fires ONCE with the delivered message_id(s) + text after a successful sweep', async () => {
+    // The safety-net delivery must land in history.db, exactly like the reply
+    // path and the turn-flush backstop. Pre-fix the sweep never called
+    // recordOutbound, so every net-delivered handback was silently absent from
+    // history — this asserts the recorder fires with the ACTUAL delivered ids +
+    // text, and exactly once across repeated (idempotent) sweeps.
+    writeOutboxRecordAtomic(rec({ turnNonce: 'p1', chatId: '444', text: 'the recovered final answer', createdAt: 0 }), dir)
+    const s = sink()
+    const recorded: Array<{ chatId: string; threadId: number | null; messageIds: number[]; texts: string[] }> = []
+    const deps = {
+      ...s,
+      recordOutbound: (chatId: string, threadId: number | null, messageIds: number[], texts: string[]) => {
+        recorded.push({ chatId, threadId, messageIds, texts })
+      },
+      textAlreadyDelivered: () => false,
+      stateDir: dir,
+      now: () => 10_000,
+    }
+    await sweepOutbox(deps)
+    await sweepOutbox(deps) // journal suppresses — recorder must NOT fire again
+    await sweepOutbox(deps)
+    expect(s.sent).toHaveLength(1)
+    expect(recorded).toHaveLength(1)
+    expect(recorded[0].chatId).toBe('444')
+    expect(recorded[0].messageIds).toEqual([1])
+    expect(recorded[0].texts).toEqual(['the recovered final answer'])
+  })
+
+  it('persist parity: a missing recordOutbound never throws (safety-net stays intact)', async () => {
+    // The recorder is optional; a sweep with no recorder wired must still deliver.
+    writeOutboxRecordAtomic(rec({ turnNonce: 'p2', chatId: '444', text: 'no recorder wired', createdAt: 0 }), dir)
+    const s = sink()
+    await sweepOutbox({ ...s, textAlreadyDelivered: () => false, stateDir: dir, now: () => 10_000 })
+    expect(s.sent).toHaveLength(1)
+  })
+
   it('two concurrent sibling handbacks with distinct nonces both deliver, no clobber', async () => {
     // Same content, distinct enqueue timestamps → distinct nonces (H2).
     const n1 = deriveTurnNonce({ chatId: null, threadId: null, messageId: null, anchorTimestampMs: 1000, anchorContent: 'sib' })