switchroom 0.19.42 → 0.19.44

package/telegram-plugin/stream-controller.ts

@@ -27,6 +27,12 @@ import {
 import { richMessage, isParseEntitiesError } from './rich-send.js'
 import { renderOutboundChunks } from './render/rich-render.js'
 import { isSendGateShed, type SendGateOpts } from './send-gate.js'
+import {
+  buildReplyParameters,
+  dropQuoteFromSendOpts,
+  isQuoteRejectionError,
+  sendOptsHaveQuote,
+} from './reply-quote.js'
 
 /**
  * Minimal bot.api surface the controller needs. Real callers pass grammy's
@@ -59,8 +65,14 @@ export interface StreamSendOpts {
    * message. Only meaningful on the initial `sendMessage` — `editMessageText`
    * cannot add a quote reference to an existing message, so the controller
    * strips this from edit opts internally.
+   *
+   * `quote` is a Bot API **String** — the quoted substring itself. The optional
+   * offset is a SIBLING `quote_position` Integer, which this plugin
+   * deliberately never emits. Typing it as an object is what produced
+   * `400 field "quote" must be of type String` on every quoted reply; see
+   * `reply-quote.ts`.
    */
-  reply_parameters?: { message_id: number; quote?: { text: string; position: number } }
+  reply_parameters?: { message_id: number; quote?: string }
   /**
    * Inline keyboard markup. Included in both sendMessage and editMessageText
    * so that inline buttons persist through text edits. Without this,
@@ -121,7 +133,10 @@ export interface StreamControllerConfig {
   /**
    * Optional quote text for surgical quoting. When set along with
    * `replyToMessageId`, the initial send includes
-   * `reply_parameters: { message_id, quote: { text, position: 0 } }`.
+   * `reply_parameters: { message_id, quote }` — `quote` is a Bot API String
+   * (see `reply-quote.ts`). A quote Telegram cannot find in the replied-to
+   * message is dropped and the send retried unquoted, so the answer still
+   * lands.
    */
   quoteText?: string
   /**
@@ -222,14 +237,16 @@ export function createStreamController(cfg: StreamControllerConfig): DraftStream
     ...(disableLinkPreview ? { link_preview_options: { is_disabled: true } } : {}),
     ...(replyMarkup != null ? { reply_markup: replyMarkup } : {}),
   }
-  const sendOpts: StreamSendOpts = {
+  // `let`, not `const`: a quote Telegram cannot find in the replied-to message
+  // is stripped ONCE for the whole stream (see sendPieceWithQuoteFallback) —
+  // re-attaching it to the next piece would just 400 again.
+  let sendOpts: StreamSendOpts = {
     ...baseOpts,
     ...(replyToMessageId != null
       ? {
-          reply_parameters: {
-            message_id: replyToMessageId,
-            ...(quoteText != null ? { quote: { text: quoteText, position: 0 } } : {}),
-          },
+          // `quote` is a Bot API String; `quote_position` is a separate sibling
+          // Integer we deliberately don't emit. See reply-quote.ts.
+          reply_parameters: buildReplyParameters(replyToMessageId, quoteText),
         }
       : {}),
     ...(protectContent === true ? { protect_content: true } : {}),
@@ -263,6 +280,24 @@ export function createStreamController(cfg: StreamControllerConfig): DraftStream
     delete richOpts.link_preview_options
     return bot.api.sendRichMessage(chatId, richMessage(piece.text), richOpts)
   }
+  // Send a piece, degrading gracefully when the SURGICAL QUOTE is the thing
+  // Telegram rejected. `reply_parameters.quote` must be an exact substring of
+  // the replied-to message; when it isn't, the 400 kills a perfectly good
+  // answer. Drop the highlight (for this send and every later one on this
+  // stream) and re-send — the reply still lands, still threaded under the same
+  // message.
+  const sendPieceWithQuoteFallback = async (piece: { text: string; rich: boolean }) => {
+    try {
+      return await sendPiece(piece, sendOpts)
+    } catch (err) {
+      if (!isQuoteRejectionError(err) || !sendOptsHaveQuote(sendOpts)) throw err
+      warn?.(
+        `stream-controller: quote not found in the replied-to message — re-sending without the quote (${err instanceof Error ? err.message : String(err)})`,
+      )
+      sendOpts = dropQuoteFromSendOpts(sendOpts)
+      return await sendPiece(piece, sendOpts)
+    }
+  }
   const editPiece = (id: number, piece: { text: string; rich: boolean }, opts: StreamSendOpts) => {
     if (!piece.rich) return bot.api.editMessageText(chatId, id, piece.text, opts)
     return bot.api.editMessageText(chatId, id, richMessage(piece.text), opts)
@@ -395,7 +430,7 @@ export function createStreamController(cfg: StreamControllerConfig): DraftStream
     }
     // First emission of this tail piece → a fresh follow-up message.
     try {
-      const sent = await retry(() => sendPiece(piece, sendOpts), { threadId, chat_id: chatId })
+      const sent = await retry(() => sendPieceWithQuoteFallback(piece), { threadId, chat_id: chatId })
       tailIds[ti] = sent.message_id
       tailLastText[ti] = piece.text
       onSend?.(sent.message_id, piece.text.length)
@@ -435,7 +470,7 @@ export function createStreamController(cfg: StreamControllerConfig): DraftStream
       let anchorId: number | undefined
       try {
         const sent = await retry(
-          () => sendPiece(head, sendOpts),
+          () => sendPieceWithQuoteFallback(head),
           { threadId, chat_id: chatId },
         )
         anchorId = sent.message_id

package/telegram-plugin/stream-reply-handler.ts

@@ -109,9 +109,11 @@ export interface StreamReplyArgs {
   disable_notification?: boolean
   /**
    * Optional surgical quote text. When set along with `reply_to`, the initial
-   * send includes `reply_parameters: { message_id, quote: { text, position: 0 } }`
-   * so Telegram highlights the specific quoted sentence rather than the whole
-   * referenced message. Ignored when `reply_to` is absent.
+   * send includes `reply_parameters: { message_id, quote }` — `quote` is a Bot
+   * API String (see `reply-quote.ts`) — so Telegram highlights the specific
+   * quoted sentence rather than the whole referenced message. It must be an
+   * exact substring of the referenced message; one Telegram cannot find is
+   * dropped and the send retried unquoted. Ignored when `reply_to` is absent.
    */
   quote_text?: string
   /**

package/telegram-plugin/tests/boot-card-render.test.ts

@@ -14,6 +14,7 @@
 
 import { describe, it, expect } from 'vitest'
 import { renderBootCard, resolvePersonaName } from '../gateway/boot-card.js'
+import { NESTED_PREFIX } from '../status-no-truncate.js'
 
 describe('renderBootCard — quiet by default', () => {
   it('returns one-line ack with default ✅ when no probes and no restart reason', () => {
@@ -153,7 +154,7 @@ describe('renderBootCard — degraded conditions', () => {
       },
     })
     expect(out).toContain('🟡 **Skills**  10/10 dangling')
-    expect(out).toContain('    ↳ Run `switchroom agent reconcile lawgpt` to rebuild symlinks')
+    expect(out).toContain(`${NESTED_PREFIX}Run \`switchroom agent reconcile lawgpt\` to rebuild symlinks`)
   })
 
   it('crash row carries a tail-logs next-step', () => {

package/telegram-plugin/tests/card-budget-never-overflows.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect } from 'vitest'
+import { renderStatusCard, renderCombinedWorkerFeed } from '../tool-activity-summary.js'
+import { fitCardToBudget, hardTruncateCard, renderCardSpec } from '../card-layout.js'
+import { STATUS_CARD_CHAR_BUDGET } from '../status-no-truncate.js'
+
+/**
+ * #3833 (and its duplicate #3682) — a rendered card must NEVER exceed
+ * `STATUS_CARD_CHAR_BUDGET`. An over-budget card is not a cosmetic problem: it
+ * is rejected by the Bot API, so the user's progress card simply does not
+ * appear (or stops updating) for the whole turn.
+ *
+ * Two defects produced over-budget cards, and both are asserted here:
+ *
+ *  1. UNDER-COUNTED FIXED COST. The deepest shrink level charged its
+ *     header/footer as `[...chrome, ...footer].join('\n')`, but cards are
+ *     rendered by `stackCard`, which emits a collapse separator plus a
+ *     two-space GFM hard break at every line boundary — 4 chars per boundary,
+ *     not 1 — and it also charges the collapsed parent-marker line. The budget
+ *     the fitter handed the body was therefore too generous and the card came
+ *     out a few chars over.
+ *
+ *  2. NO RE-CHECK ON THE LAST RESORT. `fitCardToBudget` returned the deepest
+ *     render unmeasured. When the FIXED chrome alone is over budget (the #3682
+ *     repro: a 40k-char worker description), no shrink level can help — every
+ *     level keeps the chrome — so a 40k-char card went to the wire.
+ */
+
+const HEADER = { emoji: '🛠', label: 'Worker', elapsedMs: 61_000, toolCount: 7, state: 'running' as const }
+
+function card(opts: { desc?: string; steps?: string[]; children?: string[]; final?: boolean; result?: string }): string {
+  return renderStatusCard({
+    header: { ...HEADER, description: opts.desc ?? 'a task', state: opts.final === true ? 'done' : 'running' },
+    steps: opts.steps ?? ['step one'],
+    childSteps: opts.children,
+    final: opts.final ?? false,
+    stepCount: 3,
+    result: opts.result != null ? { emoji: '✅', text: opts.result } : undefined,
+  })!
+}
+
+describe('a rendered card never exceeds the char budget (#3833 / #3682)', () => {
+  it('the #3682 repro — a 40k-char description — comes back under budget', () => {
+    // Fail-before: 40069 chars against a 32768 budget on origin/main.
+    const out = card({ desc: 'd'.repeat(40_000), steps: ['x'.repeat(4_000)], children: ['y'.repeat(4_000)] })
+    expect(out.length).toBeLessThanOrEqual(STATUS_CARD_CHAR_BUDGET)
+    // And it is still a card, not an empty string.
+    expect(out.length).toBeGreaterThan(100)
+    expect(out.startsWith('🛠')).toBe(true)
+  })
+
+  it('the join-cost under-count boundary — every description length near the budget fits', () => {
+    // Fail-before: on origin/main the lengths 32693…32800 each rendered 1…98
+    // chars OVER budget. That band is exactly the fixed-cost under-count: the
+    // renderer's per-boundary separator + hard break, which the arithmetic
+    // estimate charged as one newline.
+    const over: Array<{ n: number; by: number }> = []
+    for (let n = 32_600; n <= 32_900; n++) {
+      const out = card({ desc: 'd'.repeat(n), steps: ['a', 'b', 'c'], result: 'done' })
+      if (out.length > STATUS_CARD_CHAR_BUDGET) over.push({ n, by: out.length - STATUS_CARD_CHAR_BUDGET })
+    }
+    expect(over).toEqual([])
+  })
+
+  it('PROPERTY: no combination of description / steps / children / result overflows', () => {
+    // A deterministic sweep over the shape space rather than a handful of
+    // hand-picked cases: the guarantee is universal, so the test is too.
+    //
+    // Fillers matter as much as sizes — escaping EXPANDS text (`&` → `&amp;`
+    // is 5×, markdown specials are 2×), which is what the fitter's clip loop
+    // has to converge against, and `👍` is astral so a naive slice could split
+    // a surrogate pair.
+    //
+    // Every filler is swept at the small/medium sizes; the huge sizes (where a
+    // single render costs seconds purely in `escapeMarkdown`, unchanged by this
+    // PR) are swept with the cheap-but-still-expanding fillers.
+    const cases: Array<{ size: number; fill: string }> = []
+    for (const size of [0, 1, 7, 200, 4_000, 16_000]) {
+      for (const fill of ['x', '&', '_*[`', '👍', 'é']) cases.push({ size, fill })
+    }
+    for (const size of [32_700, 33_000, 90_000]) {
+      for (const fill of ['x', '&', '👍']) cases.push({ size, fill })
+    }
+    for (const { size, fill } of cases) {
+      const blob = fill.repeat(Math.ceil(size / fill.length)).slice(0, size)
+      for (const final of [false, true]) {
+        for (const withChildren of [false, true]) {
+          const out = renderStatusCard({
+            header: { ...HEADER, description: blob, state: final ? 'done' : 'running' },
+            steps: [blob, blob, 'plain step'],
+            childSteps: withChildren ? [blob, blob] : undefined,
+            final,
+            liveSuffix: ' · 22s',
+            stepCount: 12,
+            result: { emoji: '✅', text: blob },
+          })
+          if (out == null) continue
+          expect(
+            out.length,
+            `over budget: size=${size} fill=${JSON.stringify(fill)} final=${final} children=${withChildren}`,
+          ).toBeLessThanOrEqual(STATUS_CARD_CHAR_BUDGET)
+          // Never blanked, and never sliced through a surrogate pair.
+          expect(out.length).toBeGreaterThan(0)
+          expect(/[\uD800-\uDBFF]$/.test(out)).toBe(false)
+        }
+      }
+    }
+  }, 60_000)
+
+  it('PROPERTY: the combined worker card also stays under budget for any fan-out', () => {
+    for (const rows of [1, 2, 6, 25]) {
+      for (const size of [50, 5_000, 40_000]) {
+        const out = renderCombinedWorkerFeed(
+          Array.from({ length: rows }, (_, i) => ({
+            ordinal: i + 1,
+            description: 'w'.repeat(size),
+            currentStep: 's'.repeat(size),
+            historyLines: ['h'.repeat(size), 'h2'],
+            elapsedMs: 60_000,
+            toolCount: 3,
+          })),
+          { maxRows: 8 },
+        )!
+        expect(out.length, `rows=${rows} size=${size}`).toBeLessThanOrEqual(STATUS_CARD_CHAR_BUDGET)
+      }
+    }
+  })
+
+  it('fitCardToBudget itself guarantees the budget even when every level overflows', () => {
+    // The mechanism, isolated from any particular card: a build function whose
+    // deepest level is still hopeless. Fail-before: this returned the raw
+    // 50k-char render.
+    const huge = 'q'.repeat(50_000)
+    const out = fitCardToBudget(() => ({ spec: { chrome: [huge], sections: [], footer: [] } }), 3)
+    expect(out.length).toBeLessThanOrEqual(STATUS_CARD_CHAR_BUDGET)
+    expect(out.length).toBeGreaterThan(0)
+  })
+
+  it('fitCardToBudget still returns the FIRST fitting level untouched', () => {
+    // The backstop must not change the normal path: a level that fits is
+    // returned byte-for-byte, and deeper levels are never built.
+    const built: number[] = []
+    const spec = { chrome: ['🛠 **Worker**'], sections: [], footer: ['_✓ 3 steps_'] }
+    const out = fitCardToBudget((level) => {
+      built.push(level)
+      return { spec }
+    }, 5)
+    expect(built).toEqual([0])
+    expect(out).toBe(renderCardSpec(spec))
+  })
+
+  it('hardTruncateCard cuts at a line boundary and never returns invalid UTF-16', () => {
+    const lines = ['aaaa', 'bbbb', 'cccc'].join('  \n')
+    // Budget lands inside the third line → cut back to the second boundary.
+    const cut = hardTruncateCard(lines, 12)
+    expect(cut.length).toBeLessThanOrEqual(12)
+    expect(cut).toBe('aaaa  \nbbbb')
+    // Under budget → identity.
+    expect(hardTruncateCard(lines, 1000)).toBe(lines)
+    // A single over-long line with an astral char at the cut → no lone surrogate.
+    const astral = '👍'.repeat(50)
+    const sliced = hardTruncateCard(astral, 11)
+    expect(sliced.length).toBeLessThanOrEqual(11)
+    expect(/[\uD800-\uDBFF]$/.test(sliced)).toBe(false)
+  })
+})

package/telegram-plugin/tests/card-hard-truncate-entity-safe.test.ts

@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest'
+import { hardTruncateCard } from '../card-layout.js'
+import { truncateMarkdownSafe, safeMarkdownCut } from '../format.js'
+import { validateRichMarkdown } from './rich-markdown-oracle.js'
+
+/**
+ * #4116 — the LAST-RESORT truncation must not be able to fail the send.
+ *
+ * `hardTruncateCard` is the path `fitCardToBudget` falls to when no shrink
+ * level can get a card under `STATUS_CARD_CHAR_BUDGET` (the #3682 repro: a
+ * 40k-char worker description, where every level keeps the same over-budget
+ * chrome). Its single-over-budget-line branch used to slice the raw markdown
+ * by character count. A cut landing between a `**` pair — or inside a
+ * `` `code` `` span, a `[label](href)`, an open ``` fence, a `~~strike~~`, a
+ * `||spoiler||` — emits a body Telegram parse-REJECTS with "can't find end of
+ * the entity". So the code path whose whole purpose is to guarantee delivery
+ * within budget could itself make the send fail.
+ *
+ * The fix routes the cut through `truncateMarkdownSafe`, which reuses the
+ * chunker's existing entity-boundary reasoning (`safeMarkdownCut` =
+ * fence → table row → inline span back-offs, plus surrogate-pair safety)
+ * rather than adding a second markdown parser.
+ *
+ * These tests assert the OUTCOME — "the emitted text parses" — using the
+ * repo's own parse-accept oracle (`rich-markdown-oracle.ts`, the same one the
+ * formatting-regression suite trusts), at EVERY cut offset rather than at a
+ * handful of hand-picked ones.
+ */
+
+/** A card body carrying one of every entity kind that can straddle a cut. */
+const MIXED_ENTITY_CARD = [
+  '🛠 **Worker · fix/telegram-w0-de** · 2m05s · 12 tools',
+  '~~_✓ Read `telegram-plugin/card-layout.ts` and `format.ts`_~~',
+  '**→ Rewriting the last-resort clip** with a [linked issue](https://github.com/switchroom/switchroom/issues/4116) inline',
+  '⠀⠀⠀↳ _nested_ step with a ||spoiler|| and ~~a struck phrase~~ plus 👍🏽 astral text',
+  '```ts',
+  'const out = hardTruncateCard(text, budget)',
+  'const safe = safeMarkdownCut(text, cut)',
+  '```',
+  'A trailing prose line with **bold**, `code`, _italic_ and an emoji 🧵 at the end.',
+].join('\n')
+
+describe('the source fixture is itself valid markdown', () => {
+  it('guards the property test against a vacuous baseline', () => {
+    // If the fixture were already invalid, "every truncation is valid" could
+    // only ever fail — or, worse, a broken oracle would make it vacuously pass.
+    expect(validateRichMarkdown(MIXED_ENTITY_CARD)).toEqual([])
+  })
+})
+
+describe('PROPERTY: hardTruncateCard emits parseable markdown at every offset (#4116)', () => {
+  it('every budget from 1 to the full length yields a card Telegram can parse', () => {
+    const failures: Array<{ budget: number; kinds: string[]; tail: string }> = []
+    for (let budget = 1; budget <= MIXED_ENTITY_CARD.length; budget++) {
+      const out = hardTruncateCard(MIXED_ENTITY_CARD, budget)
+      const issues = validateRichMarkdown(out)
+      if (issues.length > 0) {
+        failures.push({
+          budget,
+          kinds: [...new Set(issues.map((i) => i.kind))],
+          tail: out.slice(-24),
+        })
+      }
+    }
+    // Fail-before on origin/main: every offset whose cut lands inside a `**`
+    // pair / code span / link / fence produces an unsendable card.
+    expect(failures).toEqual([])
+  })
+
+  it('every truncation stays within its budget and is valid UTF-16', () => {
+    for (let budget = 1; budget <= MIXED_ENTITY_CARD.length; budget++) {
+      const out = hardTruncateCard(MIXED_ENTITY_CARD, budget)
+      expect(out.length, `budget ${budget}`).toBeLessThanOrEqual(budget)
+      // No lone surrogate — a split astral char is invalid UTF-16 on the wire.
+      expect(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])/.test(out), `budget ${budget}`).toBe(false)
+      expect(/(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(out), `budget ${budget}`).toBe(false)
+    }
+  })
+
+  it('a clipped card is still a card — it never collapses to (nearly) nothing', () => {
+    // The clip exists because "a clipped card beats no card". A back-off that
+    // retreated past a huge entity could return an empty string, which is the
+    // dropped card all over again. From a budget with room for real content,
+    // at least half of it survives — minus the handful of delimiter characters
+    // an opener-drop repair removes (measured worst case on this fixture: 8).
+    const REPAIR_SLACK = 12
+    for (let budget = 24; budget <= MIXED_ENTITY_CARD.length; budget++) {
+      const out = hardTruncateCard(MIXED_ENTITY_CARD, budget)
+      expect(out.length * 2 + REPAIR_SLACK, `budget ${budget}`).toBeGreaterThanOrEqual(budget)
+    }
+  })
+})
+
+describe('the specific entity kinds that can straddle a cut (#4116)', () => {
+  const cases: Array<[string, string]> = [
+    ['bold', 'lead in **a bold run that is long enough to straddle** tail'],
+    ['italic-underscore', 'lead in _an italic run long enough to straddle_ tail'],
+    ['bold-italic', 'lead in ***a bold-italic run long enough to straddle*** tail'],
+    ['inline code', 'lead in `a code span long enough to straddle the cut` tail'],
+    ['link', 'lead in [a label](https://example.com/a/long/path/here) tail'],
+    ['strikethrough', 'lead in ~~a struck run long enough to straddle~~ tail'],
+    ['spoiler', 'lead in ||a spoiler run long enough to straddle|| tail'],
+    ['table row', 'lead in\n| col a | col b | col c | col d |\ntail'],
+    ['fenced block', 'lead in\n```ts\nconst x = 1\nconst y = 2\n```\ntail'],
+  ]
+
+  for (const [kind, body] of cases) {
+    it(`never bisects a ${kind}`, () => {
+      expect(validateRichMarkdown(body)).toEqual([])
+      const bad: number[] = []
+      for (let budget = 1; budget <= body.length; budget++) {
+        if (validateRichMarkdown(hardTruncateCard(body, budget)).length > 0) bad.push(budget)
+      }
+      expect(bad).toEqual([])
+    })
+  }
+})
+
+describe('truncateMarkdownSafe — the shared mechanism', () => {
+  it('backs off rather than cutting inside a span, keeping formatting intact', () => {
+    const text = 'abcdefghij **bold text here** klmno'
+    // Budget 20 lands inside the bold span (which opens at 11).
+    const out = truncateMarkdownSafe(text, 20)
+    expect(out).toBe('abcdefghij ')
+    expect(validateRichMarkdown(out)).toEqual([])
+  })
+
+  it('drops the opener instead of returning a near-empty result when one entity swallows the budget', () => {
+    // The #3682 shape: a single span longer than the whole window. Backing off
+    // would return `🛠 ` — a card with no content. Dropping the (unrenderable,
+    // because its closer is far past the budget) opener keeps the text.
+    const text = `🛠 **${'d'.repeat(500)}**`
+    const out = truncateMarkdownSafe(text, 64)
+    // Within budget, and only the dropped `**` short of it — the window is
+    // held fixed in SOURCE terms so the repair can never pull the span's
+    // closing delimiter into the output.
+    expect(out.length).toBe(62)
+    expect(out.startsWith('🛠 d')).toBe(true)
+    expect(out).not.toContain('*')
+    expect(validateRichMarkdown(out)).toEqual([])
+  })
+
+  it('is a no-op when the text already fits', () => {
+    expect(truncateMarkdownSafe('**short**', 64)).toBe('**short**')
+  })
+
+  it('safeMarkdownCut never splits a surrogate pair', () => {
+    const text = 'ab👍cd'
+    // Index 3 is between the two halves of the astral char.
+    expect(safeMarkdownCut(text, 3)).toBe(2)
+    expect(safeMarkdownCut(text, 4)).toBe(4)
+  })
+})

package/telegram-plugin/tests/card-variants.golden.txt

@@ -29,9 +29,9 @@ _1m35s · 12 tools · 41.2k tok · opus 4.8_
 ~~_✓ Searching memory for card render paths_~~   
 ~~_✓ Reading telegram-plugin/tool-activity-summary.ts_~~   
 ~~_✓ Reading telegram-plugin/worker-activity-feed.ts_~~   
-   ↳ ~~_Reading the repo conventions_~~   
-   ↳ ~~_Running the scoped test suite_~~   
-   ↳ **→ Summarising findings · 24s**
+⠀⠀⠀↳ ~~_Reading the repo conventions_~~   
+⠀⠀⠀↳ ~~_Running the scoped test suite_~~   
+⠀⠀⠀↳ **→ Summarising findings · 24s**
 
 ===== CARD ===== Agent card — liveness early-open (no tools yet)
 🤖 **Agent**   
@@ -203,9 +203,9 @@ _✓ +9 earlier…_
 _1m35s · 12 tools · 41.2k tok · opus 4.8_   
 ~~_✓ Searching memory for card render paths_~~   
 ~~_✓ Reading telegram-plugin/tool-activity-summary.ts_~~   
-   ↳ _+6 earlier…_   
-   ↳ ~~_Child step 7_~~   
-   ↳ ~~_Child step 8_~~   
-   ↳ ~~_Child step 9_~~   
-   ↳ ~~_Child step 10_~~   
-   ↳ **→ Child step 11**
+⠀⠀⠀↳ _+6 earlier…_   
+⠀⠀⠀↳ ~~_Child step 7_~~   
+⠀⠀⠀↳ ~~_Child step 8_~~   
+⠀⠀⠀↳ ~~_Child step 9_~~   
+⠀⠀⠀↳ ~~_Child step 10_~~   
+⠀⠀⠀↳ **→ Child step 11**

package/telegram-plugin/tests/flood-reply-queue.test.ts

@@ -36,7 +36,7 @@ import {
   floodQueueNonce,
   FLOOD_QUEUED_SOURCE,
 } from '../gateway/flood-reply-queue.js'
-import { sweepOutbox } from '../gateway/outbox-sweep.js'
+import { sweepOutbox, type OutboxSendResult } from '../gateway/outbox-sweep.js'
 import { listPendingRecords, resolveOutboxDir, type OutboxRecord } from '../outbox.js'
 import {
   floodStatePath,
@@ -60,6 +60,32 @@ function wrappedReplyFailure(): Error {
   return new Error('reply failed after 0 of 1 chunk(s) sent: FLOOD_WAIT_ACTIVE')
 }
 
+/**
+ * A sweep `send` stub with the REAL {@link OutboxSendResult} shape (#4044).
+ *
+ * These tests used to stub `send` as `async () => 4242` — a bare number, the
+ * pre-#3510 contract. `sweepOutbox` has read `.messageId` / `.chunks` off the
+ * result since, so the stub was silently lying: it journalled
+ * `tgMessageId: undefined` and would have THROWN on `.chunks.length` had the
+ * test wired `recordOutbound` — which the sweep's catch turns into a
+ * `sendFailure` and a re-send on the next tick, i.e. a duplicate delivery of
+ * the very answer this file exists to protect. The `journals the landed message id`
+ * test below asserts that outcome; this helper is what makes it representable.
+ */
+function makeSendStub(firstMessageId = 4242) {
+  let next = firstMessageId
+  return vi.fn(
+    async (
+      _chatId: string,
+      _threadId: number | null,
+      text: string,
+    ): Promise<OutboxSendResult> => {
+      const messageId = next++
+      return { messageId, chunks: [{ messageId, text }] }
+    },
+  )
+}
+
 function readRecords(dir: string): OutboxRecord[] {
   const outbox = resolveOutboxDir(dir)
   return readdirSync(outbox)
@@ -280,7 +306,7 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
 
     // 4. Sweeping WHILE the window is open must not touch the wire, and must
     //    not lose the record.
-    const send = vi.fn(async () => 4242)
+    const send = makeSendStub(4242)
     const during = await sweepOutbox({
       stateDir: dir,
       send,
@@ -318,6 +344,65 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
     expect(listPendingRecords(dir)).toHaveLength(0)
   })
 
+  it('journals the landed message id and records history parity — not a send failure (#4044)', async () => {
+    // Regression for the stale `send` stub. `sweepOutbox` reads `.messageId`
+    // and `.chunks` off its `send` result (`OutboxSendResult`, outbox-sweep.ts
+    // :63-80). While these tests stubbed `send` as a bare number the contract
+    // was unguarded, and a stub-shaped production sender would (a) journal
+    // `tgMessageId: undefined`, losing the pointer to the delivered message,
+    // and (b) throw on `sendResult.chunks.length` — which the sweep's catch
+    // converts into `sendFailures++` and a claim RELEASE, so the next tick
+    // re-sends the operator's answer a second time. This asserts the outcome:
+    // delivered once, journalled with the REAL id, mirrored to history.
+    const answer = 'the answer that must land exactly once'
+    const t0 = 1_000_000
+    queueFloodBlockedReply({
+      err: floodWaitActiveError(30),
+      chatId: '777',
+      threadId: null,
+      text: answer,
+      priorityClass: 'critical',
+      stateDir: dir,
+      createdAt: t0,
+    })
+
+    const send = makeSendStub(9001)
+    const recorded: Array<[string, number | null, number[], string[]]> = []
+    const summary = await sweepOutbox({
+      stateDir: dir,
+      send,
+      recordOutbound: (chatId, threadId, messageIds, texts) => {
+        recorded.push([chatId, threadId, messageIds, texts])
+      },
+      textAlreadyDelivered: () => false,
+      now: () => t0 + 10_000,
+    })
+
+    // Delivered — and NOT counted as a send failure.
+    expect(summary.delivered).toBe(1)
+    expect(summary.sendFailures).toBe(0)
+    expect(send).toHaveBeenCalledTimes(1)
+
+    // The journal carries the id the wire actually returned, so a duplicate is
+    // provable from the journal alone (#3510).
+    const journal = readFileSync(join(resolveOutboxDir(dir), 'delivered.jsonl'), 'utf8')
+      .split('\n')
+      .filter((l) => l.trim() !== '')
+      .map((l) => JSON.parse(l) as { tgMessageId?: number; deliverySource?: string })
+    expect(journal).toHaveLength(1)
+    expect(journal[0]!.tgMessageId).toBe(9001)
+    expect(journal[0]!.deliverySource).toBe('sweep')
+
+    // And history got the landed ids + their delivered texts.
+    expect(recorded).toHaveLength(1)
+    expect(recorded[0]![0]).toBe('777')
+    expect(recorded[0]![2]).toEqual([9001])
+    expect(recorded[0]![3]!.join('')).toContain(answer)
+
+    // Nothing left to re-send.
+    expect(listPendingRecords(dir)).toHaveLength(0)
+  })
+
   it('does not double-deliver when the caller retries after the window closed', async () => {
     const answer = 'the one answer'
     const t0 = 1_000_000
@@ -331,7 +416,7 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
       createdAt: t0,
     })
 
-    const send = vi.fn(async () => 1)
+    const send = makeSendStub(1)
     await sweepOutbox({
       stateDir: dir,
       send,
@@ -381,7 +466,7 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
       })
     })
 
-    const send = vi.fn(async () => 1)
+    const send = makeSendStub(1)
     await sweepOutbox({
       stateDir: dir,
       send,