switchroom 0.19.6 → 0.19.8

package/telegram-plugin/tests/rich-markdown-guard-transformer.test.ts

@@ -0,0 +1,121 @@
+/**
+ * Wire-level outcome tests for the universal accidental-formatting guard
+ * (`installRichMarkdownGuard`, #3252/#3463 follow-up).
+ *
+ * These MUST go through a REAL grammy `Bot` with a stubbed transport. The
+ * existing unit/golden harnesses (`tests/bot-api.harness.ts` etc.) mock the
+ * `api` object ABOVE the grammy transformer layer, so `api.config.use`
+ * transformers never run there — a test written through them is a FALSE guard
+ * (it stays green with the transformer absent or mis-gated). By stubbing
+ * `client.fetch` we capture the exact serialized wire body AFTER the
+ * transformer has mutated the raw payload, which is the only place the guard's
+ * effect is observable.
+ *
+ * Red-team F-R1: the markdown lives at `payload.rich_message.markdown`, NOT
+ * `payload.markdown`. A guard gating on the latter matches nothing and every
+ * one of these assertions would still fail — so these tests pin the correct
+ * field shape too.
+ */
+import { describe, it, expect } from 'vitest'
+import { Bot } from 'grammy'
+import { installTgPostLogger, installRichMarkdownGuard } from '../shared/bot-runtime.js'
+
+interface CapturedCall {
+  method: string
+  body: Record<string, unknown>
+}
+
+/**
+ * Build a real grammy Bot whose transport is stubbed: every API call is
+ * captured (method + parsed JSON body) and answered with a minimal ok
+ * response. `botInfo` is supplied so `bot.init()` never hits the network.
+ */
+function makeCapturingBot(): { bot: Bot; calls: CapturedCall[] } {
+  const calls: CapturedCall[] = []
+  const fakeFetch = (async (url: unknown, init?: { body?: unknown }) => {
+    const method = String(url).split('/').pop() ?? ''
+    let body: Record<string, unknown> = {}
+    if (typeof init?.body === 'string') {
+      body = JSON.parse(init.body) as Record<string, unknown>
+    }
+    calls.push({ method, body })
+    // Minimal Telegram ok envelope. `result` shape doesn't matter for these
+    // send/edit calls — grammy only reads `ok`/`result`.
+    return {
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true, result: { message_id: 1, date: 0, chat: { id: 1, type: 'private' } } }),
+    } as unknown as Response
+  }) as unknown as typeof fetch
+
+  const bot = new Bot('123456:TEST_TOKEN', {
+    botInfo: {
+      id: 123456,
+      is_bot: true,
+      first_name: 'Test',
+      username: 'test_bot',
+      can_join_groups: false,
+      can_read_all_group_messages: false,
+      supports_inline_queries: false,
+      can_connect_to_business: false,
+      has_main_web_app: false,
+    },
+    client: { fetch: fakeFetch },
+  })
+  // Install exactly the production transformer stack ordering: logger first,
+  // then guard (guard composes outermost — grammy runs last-installed first).
+  installTgPostLogger(bot)
+  installRichMarkdownGuard(bot)
+  return { bot, calls }
+}
+
+function lastRichMarkdown(calls: CapturedCall[]): unknown {
+  const c = calls[calls.length - 1]
+  return (c.body.rich_message as { markdown?: unknown } | undefined)?.markdown
+}
+
+describe('installRichMarkdownGuard — universal wire seam', () => {
+  it('(a) escapes a raw { markdown } sendRichMessage on the wire', async () => {
+    const { bot, calls } = makeCapturingBot()
+    await bot.api.sendRichMessage(1, { markdown: '#3460 done' })
+    expect(calls[calls.length - 1].method).toBe('sendRichMessage')
+    expect(lastRichMarkdown(calls)).toBe('\\#3460 done')
+  })
+
+  it('(b) escapes an editMessageText object-arg { markdown } on the wire', async () => {
+    const { bot, calls } = makeCapturingBot()
+    await bot.api.editMessageText(1, 42, { markdown: '#3460 done' })
+    expect(calls[calls.length - 1].method).toBe('editMessageText')
+    expect(lastRichMarkdown(calls)).toBe('\\#3460 done')
+  })
+
+  it('(c) leaves a literalText / string-arg edit UNTOUCHED (carries text, not rich_message)', async () => {
+    const { bot, calls } = makeCapturingBot()
+    await bot.api.editMessageText(1, 42, '#3460 done')
+    const c = calls[calls.length - 1]
+    expect(c.method).toBe('editMessageText')
+    expect(c.body.text).toBe('#3460 done')
+    expect(c.body.rich_message).toBeUndefined()
+  })
+
+  it('(d) leaves a genuine heading byte-identical', async () => {
+    const { bot, calls } = makeCapturingBot()
+    await bot.api.sendRichMessage(1, { markdown: '# Title\n## Sub' })
+    expect(lastRichMarkdown(calls)).toBe('# Title\n## Sub')
+  })
+
+  it('(e) is idempotent on an already-guarded (richMessage-wrapped) body', async () => {
+    const { bot, calls } = makeCapturingBot()
+    // Simulate a body that already went through richMessage()'s internal guard.
+    await bot.api.sendRichMessage(1, { markdown: '\\#3460 done' })
+    expect(lastRichMarkdown(calls)).toBe('\\#3460 done')
+  })
+
+  it('does not mutate the caller\'s shared input object', async () => {
+    const { bot } = makeCapturingBot()
+    const input = { markdown: '#3460 done' }
+    await bot.api.sendRichMessage(1, input)
+    // Caller's object is unchanged; only the cloned wire payload is escaped.
+    expect(input.markdown).toBe('#3460 done')
+  })
+})

package/telegram-plugin/tests/send-reply-golden.test.ts

@@ -46,7 +46,7 @@ import {
 } from '../gateway/outbound-send-path.js'
 import { OutboundDedupCache } from '../recent-outbound-dedup.js'
 import { FlushedTurnSupersedeRegistry } from '../flushed-turn-supersede.js'
-import { SubagentHandbackMarker } from '../gateway/subagent-handback-marker.js'
+import { SubagentHandbackMarker, stampsHandbackMarker } from '../gateway/subagent-handback-marker.js'
 import { createPendingInboundBuffer } from '../gateway/pending-inbound-buffer.js'
 import { redact } from '../secret-detect/redact.js'
 import type { CurrentTurn, Access } from '../gateway/gateway.js'
@@ -887,7 +887,7 @@ describe('#3429 — post-turn-end handback vs flush-delivered supersede (real se
     const marker = new SubagentHandbackMarker()
     const buffer = createPendingInboundBuffer({
       log: () => {},
-      onHandbackEnqueue: (chatId, ts) => marker.record(chatId, ts),
+      onHandbackEnqueue: (chatId, threadId, ts) => marker.record(chatId, threadId, ts),
     })
 
     // Simulate the boot-replay re-push of an un-acked spooled handback envelope.
@@ -905,14 +905,14 @@ describe('#3429 — post-turn-end handback vs flush-delivered supersede (real se
       meta: { source: 'subagent_handback' },
     })
     // The chokepoint stamped the marker from the replay push (pre-fix: empty).
-    expect(marker.lastAt(CHAT)).toBe(handbackTs)
+    expect(marker.lastAt(CHAT, undefined)).toBe(handbackTs)
 
     const h = makeHarness()
     const owner = makeFlushDeliveredEndedTurn()
     seedRecord(h, owner)
     h.deps.resolveReplyOwnerTurn = () => ({ turn: owner, tier: 'latest-ended' })
-    // The gateway reads the marker the boot-replay stamped.
-    h.deps.getLastSubagentHandbackAt = (chatId) => marker.lastAt(chatId)
+    // The gateway reads the marker the boot-replay stamped (chat-wide gate).
+    h.deps.getLastSubagentHandbackAt = (chatId) => marker.lastAtInChat(chatId)
 
     const res = await sendReply(h.deps, req(HANDBACK))
 
@@ -929,12 +929,226 @@ describe('#3429 — post-turn-end handback vs flush-delivered supersede (real se
     const marker = new SubagentHandbackMarker()
     const buffer = createPendingInboundBuffer({
       log: () => {},
-      onHandbackEnqueue: (chatId, ts) => marker.record(chatId, ts),
+      onHandbackEnqueue: (chatId, threadId, ts) => marker.record(chatId, threadId, ts),
     })
     buffer.push('marko', {
       type: 'inbound', chatId: CHAT, messageId: 5, user: 'ken', userId: 1,
       ts: Date.now(), text: 'hi', meta: {},
     })
-    expect(marker.lastAt(CHAT)).toBe(null)
+    expect(marker.lastAt(CHAT, undefined)).toBe(null)
+  })
+
+  // ─── MUST-FIX 2 (dup-audit / Fable): the gate is un-steerable by a model
+  //     thread arg — a cross-topic handback still keeps the content gate ───
+  //
+  // Fable's PROVEN regression: F2's thread-keyed gate read let a foreign-content
+  // reply carrying `message_thread_id=<other topic>` dodge a handback marker
+  // stamped on the real topic → silent edit-over (the #3429 double-loss). Because
+  // `findLatestEndedTurnForChat` resolves owners CHAT-WIDE, a topic-A handback can
+  // resolve — and supersede — topic B's ended turn. The gate read is therefore
+  // chat-wide (`lastAtInChat`): any in-window handback in the chat keeps the gate,
+  // so the reply's own thread arg cannot bypass it. Drives the REAL buffer
+  // chokepoint + REAL send path.
+  it('MUST-FIX 2: a handback stamped in topic A keeps the content gate for a ' +
+    'foreign reply steered to topic B (message_thread_id) — FRESH send, no silent edit-over', async () => {
+    const TOPIC_A = 111
+    const TOPIC_B = 222
+    const marker = new SubagentHandbackMarker()
+    const buffer = createPendingInboundBuffer({
+      log: () => {},
+      onHandbackEnqueue: (chatId, threadId, ts) => marker.record(chatId, threadId, ts),
+    })
+    // A background handback lands in TOPIC A (envelope threadId=A) via the real
+    // chokepoint — after topic B's turn ended (now-30s), within the 60s TTL.
+    const handbackTs = Date.now() - 15_000
+    buffer.push('marko', {
+      type: 'inbound', chatId: CHAT, threadId: TOPIC_A, messageId: handbackTs,
+      user: 'subagent-watcher', userId: 0, ts: handbackTs, text: 'handback',
+      meta: { source: 'subagent_handback' },
+    })
+
+    // Topic B has its OWN flush-delivered ended turn with a real answer.
+    const h = makeHarness()
+    const owner = { ...makeFlushDeliveredEndedTurn(), sessionThreadId: TOPIC_B } as unknown as CurrentTurn
+    h.deps.flushedTurnSupersede.record(
+      CHAT, TOPIC_B,
+      { turnId: (owner as CurrentTurn).turnId, messageIds: [FLUSH_MSG_ID], text: FLUSHED_TEXT },
+      Date.now(),
+    )
+    // The topic-A handback's reply is STEERED to topic B (message_thread_id=222)
+    // and resolves topic B's ended turn chat-wide (latest-ended), carrying FOREIGN
+    // content. The gate read is chat-wide, so the topic-A stamp is seen.
+    h.deps.resolveReplyOwnerTurn = () => ({ turn: owner as CurrentTurn, tier: 'latest-ended' })
+    h.deps.getLastSubagentHandbackAt = (chatId) => marker.lastAtInChat(chatId)
+
+    const res = await sendReply(
+      h.deps,
+      req(HANDBACK, { message_thread_id: TOPIC_B }),
+    )
+
+    // Gate kept → FRESH notifying send; topic B's flushed answer is NEITHER
+    // edited nor deleted. (Under the F2 thread-keyed gate this was editMessageText
+    // ×1 over msg 4242 — the silent-loss regression this closes.)
+    const fresh = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(fresh).toHaveLength(1)
+    expect(h.calls.filter((c) => c.method === 'editMessageText')).toHaveLength(0)
+    expect(h.calls.filter((c) => c.method === 'deleteMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+    // Topic B's flush record NOT consumed — the delivered answer stands.
+    expect(
+      h.deps.flushedTurnSupersede.peek(CHAT, TOPIC_B, {
+        liveTurnId: (owner as CurrentTurn).turnId,
+        replyText: CANONICAL_REPLY,
+        now: Date.now(),
+      }).supersede,
+    ).toBe(true)
+  })
+
+  // Thread-keyed COLLAPSE still routes per-topic: a topic reply supersedes its
+  // OWN topic's flush record (via the framework-resolved owner thread, not the
+  // raw arg), so a genuine own-reply in a forum topic collapses to one message.
+  it('F2 positive: a topic own-reply (no handback) supersedes its own topic\'s ' +
+    'flush record — one message, on the framework-resolved thread lane', async () => {
+    const TOPIC = 222
+    const h = makeHarness()
+    const owner = { ...makeFlushDeliveredEndedTurn(), sessionThreadId: TOPIC } as unknown as CurrentTurn
+    // Flush recorded on the owner turn's OWN topic lane (what the flush does).
+    h.deps.flushedTurnSupersede.record(
+      CHAT, TOPIC,
+      { turnId: (owner as CurrentTurn).turnId, messageIds: [FLUSH_MSG_ID], text: FLUSHED_TEXT },
+      Date.now(),
+    )
+    h.deps.resolveReplyOwnerTurn = () => ({ turn: owner as CurrentTurn, tier: 'latest-ended' })
+    h.deps.getLastSubagentHandbackAt = () => null // no handback anywhere
+
+    const res = await sendReply(h.deps, req(REWORDED_SAME_TURN_ANSWER, { message_thread_id: TOPIC }))
+
+    // Collapses to ONE message: the topic's flushed message edited in place.
+    const edits = h.calls.filter((c) => c.method === 'editMessageText')
+    expect(edits).toHaveLength(1)
+    expect(edits[0]!.message_id).toBe(FLUSH_MSG_ID)
+    expect(h.calls.filter((c) => c.method === 'sendRichMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent/)
+  })
+
+  // ─── F1 (dup-audit): negative outcome guard — no silent edit-over ───
+  //
+  // The content-gate bypass must NEVER silently edit over a flush-delivered
+  // answer with FOREIGN content on a non-live tier. A decoupled completion (the
+  // handback class the marker covers) landing with genuinely different content,
+  // resolving an ended flushed turn via the latest-ended tier, must SEND FRESH —
+  // the flushed answer left untouched (Telegram edits do not re-notify, so an
+  // edit-over is a silent double-loss: the handback never surfaces AND the answer
+  // is destroyed — the #3429 incident). This pins the invariant's OUTCOME: the
+  // stamp (driven by the single chokepoint predicate) keeps the gate, and the
+  // foreign reply never touches the delivered answer.
+  it('F1: a decoupled foreign-content reply on a non-live tier resolving a ' +
+    'DIFFERENT ended turn sends FRESH — the flushed answer is never edited/deleted', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    seedRecord(h, owner)
+    // The reply resolves the flush-delivered ENDED turn via the ambiguous
+    // latest-ended tier (no live turn, no positive attribution) and carries
+    // FOREIGN content (a worker report, not this turn's answer nor a rewording).
+    h.deps.resolveReplyOwnerTurn = () => ({ turn: owner, tier: 'latest-ended' })
+    // A decoupled completion IS in the window (the marker stamped it) — so this
+    // late reply might BE it. The invariant keeps the content gate.
+    h.deps.getLastSubagentHandbackAt = () => Date.now() - 15_000
+
+    const res = await sendReply(h.deps, req(HANDBACK))
+
+    // FRESH notifying send; the flushed answer is NEITHER edited nor deleted.
+    const fresh = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(fresh).toHaveLength(1)
+    expect(fresh[0]!.text).toContain('migration audit')
+    expect(fresh[0]!.message_id).not.toBe(FLUSH_MSG_ID)
+    expect(h.calls.filter((c) => c.method === 'editMessageText')).toHaveLength(0)
+    expect(h.calls.filter((c) => c.method === 'deleteMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+    // The flush record is NOT consumed — the flushed answer stands, and the
+    // turn's OWN canonical replay can still correct it.
+    expect(
+      h.deps.flushedTurnSupersede.peek(CHAT, undefined, {
+        liveTurnId: OWNER_TURN_ID,
+        replyText: CANONICAL_REPLY,
+        now: Date.now(),
+      }).supersede,
+    ).toBe(true)
+  })
+
+  // Structural: the stamp membership lives in exactly ONE predicate, consulted
+  // at the ONE buffer chokepoint. If a future refactor inlines a bare
+  // `=== 'subagent_handback'` check at the chokepoint (bypassing the predicate),
+  // the invariant's single-extension-point guarantee is lost — fail loudly.
+  it('F1: the buffer chokepoint stamps via the stampsHandbackMarker predicate, ' +
+    'not an inlined source literal', () => {
+    const bufferSrc = readFileSync(new URL('../gateway/pending-inbound-buffer.ts', import.meta.url), 'utf8')
+    expect(bufferSrc).toContain('stampsHandbackMarker(msg.meta?.source)')
+    // The predicate itself is the single membership definition.
+    expect(stampsHandbackMarker('subagent_handback')).toBe(true)
+    expect(stampsHandbackMarker('cron')).toBe(false)
+    expect(stampsHandbackMarker('resume_interrupted')).toBe(false)
+    expect(stampsHandbackMarker(undefined)).toBe(false)
+  })
+
+  // ─── MUST-FIX 1 (dup-audit / Fable): model-steerable tiers NEVER bypass ───
+  //
+  // The `quoted`/`origin` tiers resolve from MODEL-supplied args (reply_to /
+  // origin_turn_id), so a reply can steer ITSELF onto a different ended turn's
+  // record. Marker-absence proves "own answer" only for the framework-derived
+  // latest-ended tier — a quoted/origin resolution with no marker is NOT
+  // ownership evidence. Fable executed this exact path (quoted tier, no marker,
+  // foreign content → editMessageText ×1 over the flushed answer). With the tier
+  // restriction, quoted/origin ALWAYS traverse the content gate → foreign content
+  // sends FRESH, the flushed answer untouched. RED on pre-fix code
+  // (replyIsOwnAnswer = tier==='live' || !handbackCouldOwnReply → quoted bypassed).
+  it('MUST-FIX 1: a quoted-tier reply with NO marker and FOREIGN content does NOT ' +
+    'bypass the content gate — FRESH send, flushed answer never edited/deleted', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    seedRecord(h, owner)
+    // Model-steered `quoted` attribution to a DIFFERENT ended flushed turn, with
+    // NO decoupled completion anywhere in the chat (the residual F1 vector).
+    h.deps.resolveReplyOwnerTurn = () => ({ turn: owner, tier: 'quoted' })
+    h.deps.getLastSubagentHandbackAt = () => null
+
+    const res = await sendReply(h.deps, req(HANDBACK))
+
+    // FRESH notifying send; the flushed answer is NEITHER edited nor deleted.
+    const fresh = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(fresh).toHaveLength(1)
+    expect(fresh[0]!.text).toContain('migration audit')
+    expect(fresh[0]!.message_id).not.toBe(FLUSH_MSG_ID)
+    expect(h.calls.filter((c) => c.method === 'editMessageText')).toHaveLength(0)
+    expect(h.calls.filter((c) => c.method === 'deleteMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+    // Flush record NOT consumed — the delivered answer stands.
+    expect(
+      h.deps.flushedTurnSupersede.peek(CHAT, undefined, {
+        liveTurnId: OWNER_TURN_ID,
+        replyText: CANONICAL_REPLY,
+        now: Date.now(),
+      }).supersede,
+    ).toBe(true)
+  })
+
+  // Sibling positive: a quoted-tier reply carrying the turn's OWN answer (same
+  // content, contained in the flushed blob) still collapses through the content
+  // gate — the tier restriction only blocks FOREIGN content, not genuine replays.
+  it('MUST-FIX 1 sibling: a quoted-tier reply with the SAME answer still collapses ' +
+    '(content gate passes) — one message', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    seedRecord(h, owner)
+    h.deps.resolveReplyOwnerTurn = () => ({ turn: owner, tier: 'quoted' })
+    h.deps.getLastSubagentHandbackAt = () => null
+
+    const res = await sendReply(h.deps, req(CANONICAL_REPLY))
+
+    const edits = h.calls.filter((c) => c.method === 'editMessageText')
+    expect(edits).toHaveLength(1)
+    expect(edits[0]!.message_id).toBe(FLUSH_MSG_ID)
+    expect(h.calls.filter((c) => c.method === 'sendRichMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent/)
   })
 })

package/telegram-plugin/tests/stream-render-golden.test.ts

@@ -56,7 +56,12 @@ function makeFakeBot() {
   const api = {
     sendRichMessage: async (c: string, b: { markdown: string }, o: Record<string, unknown> = {}) => rec('sendRichMessage', c, b.markdown, o),
     sendMessage: async (c: string, t: string, o: Record<string, unknown> = {}) => rec('sendMessage', c, t, o),
-    editMessageText: async (c: string, m: number, b: unknown, o: Record<string, unknown> = {}) => { rec('editMessageText', c, typeof b === 'string' ? b : (b as { markdown: string }).markdown, o); return {} },
+    editMessageText: async (c: string, m: number, b: unknown, o: Record<string, unknown> = {}) => {
+      // Preserve the REAL edit target id (m) so tests can assert an edit-in-place
+      // hit the flushed message, not a synthetic fresh id.
+      calls.push({ method: 'editMessageText', chat_id: c, text: typeof b === 'string' ? b : (b as { markdown: string }).markdown, opts: o, reply_markup: o.reply_markup ?? null, message_id: m })
+      return {}
+    },
     deleteMessage: async (c: string, m: number) => { rec('deleteMessage', c, null); return true },
   }
   return { api, calls }
@@ -100,6 +105,7 @@ function makeStreamDeps(opts?: {
   dedup?: OutboundDedupCache
   turn?: CurrentTurn | null
   deliverResult?: { sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean }
+  flushedTurnSupersede?: FlushedTurnSupersedeRegistry
 }): StreamHarness {
   const { api, calls } = makeFakeBot()
   const dedup = opts?.dedup ?? new OutboundDedupCache()
@@ -135,7 +141,7 @@ function makeStreamDeps(opts?: {
     activeTurnStartedAt: new Map(),
     backstopDeliveryLedger: ledger,
     bot: { api },
-    flushedTurnSupersede: new FlushedTurnSupersedeRegistry(),
+    flushedTurnSupersede: opts?.flushedTurnSupersede ?? new FlushedTurnSupersedeRegistry(),
     idleTracker: { noteEvent: noop },
     lastPtyPreviewByChat: new Map(),
     obligationLedger: { close: noop, noteTurnEnded: noop },
@@ -206,12 +212,12 @@ function makeStreamDeps(opts?: {
 }
 
 // ── the P2 sendReply harness (same content, sharing the ONE cache) ─────────
-function makeSendReplyDeps(dedup: OutboundDedupCache) {
+function makeSendReplyDeps(dedup: OutboundDedupCache, sharedSupersede?: FlushedTurnSupersedeRegistry) {
   const { api, calls } = makeFakeBot()
   const key = (c: string, t?: number | null) => `${c}:${t ?? 'main'}`
   const deps = {
     outboundDedup: dedup,
-    flushedTurnSupersede: new FlushedTurnSupersedeRegistry(),
+    flushedTurnSupersede: sharedSupersede ?? new FlushedTurnSupersedeRegistry(),
     firstTextReplyLogged: new Set<string>(),
     suppressPtyPreview: new Set<string>(),
     activeDraftStreams: new Map(),
@@ -386,6 +392,136 @@ describe('cross-surface dedup — ONE OutboundDedupCache across P4 stream + P2 r
   })
 })
 
+// ── F3 (dup-audit 2026-07-21): the flush RECORD wiring is load-bearing ──────
+//
+// The entire flush→reply dedup depends on stream-render.ts recording the
+// flush's delivered ids into the shared FlushedTurnSupersedeRegistry
+// (`flushedTurnSupersede.record(...)`). Every OTHER outcome test seeds that
+// record by hand (send-reply-golden's seedRecord/seedFlushRecord), so DELETING
+// the record call would reintroduce the dominant flush→reply duplicate with all
+// those tests still green. This drives the REAL flush record() end-to-end (no
+// pre-seed) across ONE shared registry and asserts the reworded same-turn reply
+// collapses to EXACTLY ONE message — so it goes RED if the record() call is
+// removed. This is the guard the audit flagged as missing.
+describe('F3 — flush record() → same-turn reworded reply collapse (end-to-end, no pre-seed)', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  const FLUSHED_ANSWER =
+    'All twelve agents are healthy right now. The gateway, the vault broker and the ' +
+    'approval kernel all report green health checks, and no container has restarted in ' +
+    'the last twenty four hours, so there is nothing that needs your attention at the moment.'
+  const REWORDED =
+    'Good news on the fleet. Every one of the twelve agents is running fine at the moment. ' +
+    'Gateway, vault broker and approval kernel are all green, and nothing has restarted in ' +
+    'the past day, so you do not need to do anything right now.'
+
+  it('flush → record → late reworded reply collapses to ONE message ' +
+    '(RED if stream-render flushedTurnSupersede.record is removed)', async () => {
+    // ONE shared supersede registry across BOTH surfaces — exactly the gateway
+    // singleton wiring. The flush RECORDS (the real stream-render.ts:1828 call);
+    // the reply CONSUMES. Nothing is pre-seeded.
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const turn = makeTurn({ capturedText: [FLUSHED_ANSWER], capturedBlockMeta: [true] })
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+
+    // Drive the REAL turn-flush path: it delivers message A (deliverAnswer → id
+    // 4242) AND records {turnId, [4242]} into the shared registry.
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 })
+    await settleFlush()
+    expect(sh.delivered).toContain(FLUSHED_ANSWER)
+    // The record actually landed (this is what a removal breaks first).
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() }).reason,
+    ).toBe('supersede')
+
+    // The model's REAL reply lands late with a REWORDED version of the same
+    // answer: no live turn, latest-ended tier, NO handback in flight (CASE A).
+    const s = makeSendReplyDeps(new OutboundDedupCache(), supersede)
+    s.deps.resolveReplyOwnerTurn = () => ({ turn, tier: 'latest-ended' as const })
+    // (getLastSubagentHandbackAt returns null in the base deps → own answer.)
+
+    const res = await sendReply(s.deps, req(REWORDED))
+
+    // EXACTLY ONE client-visible message: the flushed message (4242) edited in
+    // place into the reworded reply — NO fresh second bubble. Without the
+    // record(), the reply finds no record, falls to the latch branch, sees
+    // reworded ≠ flushed content, does NOT suppress, and ships a DUPLICATE
+    // sendRichMessage (edits=0, sends=1) → these assertions fail.
+    const edits = s.calls.filter((c) => c.method === 'editMessageText')
+    expect(edits).toHaveLength(1)
+    expect(edits[0]!.message_id).toBe(4242)
+    expect(s.calls.filter((c) => c.method === 'sendRichMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent/)
+  })
+})
+
+// ── F5 (dup-audit): true take()-before-record() interleaving ────────────────
+//
+// The residual race the supersede registry cannot reach: a reply whose
+// supersede take() runs in the window AFTER the flush FIRED but BEFORE it
+// recorded its message ids. The flush arms `turn.answerDelivered='flush'` (+
+// flushedAnswerText) SYNCHRONOUSLY at fire time — before its async deliver and
+// before record — so a same-answer reply landing in that window is suppressed by
+// the latch, not shipped as a duplicate. This drives a genuine two-emitter
+// interleave (inverted ordering: reply take() strictly before flush record())
+// and asserts exactly one delivered message.
+describe('F5 — take()-before-record() interleaving delivers exactly one message', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  // ≥200 chars so the late reply is a substantive final answer (the floor the
+  // flush latch is scoped to) — else it would never trip the suppression.
+  const ANSWER =
+    'Yes, that is all done and confirmed. The migration ran cleanly against the staging ' +
+    'database, every integration check passed on the first attempt, the rollback plan is ' +
+    'staged in case it is ever needed, and I have written the full run log to the shared ' +
+    'drive so the team can review exactly what changed and when it happened.'
+
+  it('a reply whose take() runs BEFORE the flush record() is suppressed by the ' +
+    'flush-armed latch — one delivered message, not two', async () => {
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const turn = makeTurn({ capturedText: [ANSWER], capturedBlockMeta: [true] })
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+
+    // Fire the flush. Its latch is set SYNCHRONOUSLY here; deliverAnswer + record
+    // run in the async IIFE that has NOT completed — the pre-record window.
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 })
+    // INVERTED ORDERING: the reply's take() runs now, before the flush record().
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() }).reason,
+    ).toBe('no-record') // record genuinely not written yet
+
+    const s = makeSendReplyDeps(new OutboundDedupCache(), supersede)
+    s.deps.resolveReplyOwnerTurn = () => ({ turn, tier: 'latest-ended' as const })
+    // The same answer landing again in the race window → latch backstop suppresses.
+    const res = await sendReply(s.deps, req(ANSWER))
+
+    expect(s.calls).toHaveLength(0) // the reply shipped nothing
+    expect(res.content[0]!.text).toContain('deduped')
+
+    await settleFlush() // let the flush's async deliver + record complete
+    // Exactly one message reached the user: the flush's message A.
+    expect(sh.delivered).toHaveLength(1)
+    expect(sh.delivered[0]).toContain('done and confirmed')
+  })
+})
+
+// ── Double-flush idempotency at the delivery primitive (audit §3.5) ─────────
+//
+// The E2-vs-E3 double flush (answer-ready quiescence THEN turn-end backstop for
+// the SAME turn) is guarded by backstopDeliveryLedger.claim. The ledger is
+// unit-tested, but the audit wanted it pinned at the SEND-COUNT level in the
+// flush integration. Two turn_end dispatches for one turn must deliver once.
+describe('double-flush idempotency — deliverAnswer fires once (send-count level)', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  it('two turn_end dispatches for the same turn deliver the answer EXACTLY once', async () => {
+    const turn = makeTurn()
+    const answer = turn.capturedText.join('')
+    const sh = makeStreamDeps({ turn })
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 }) // claims the latch
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 }) // claim fails → no-op
+    await settleFlush()
+    expect(sh.delivered).toEqual([answer])
+  })
+})
+
 describe('structural — the singleton lives once in gateway, never in the modules (Amendment 1)', () => {
   const gatewaySrc = readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8')
   const streamSrc = readFileSync(new URL('../gateway/stream-render.ts', import.meta.url), 'utf8')