switchroom 0.20.2 → 0.20.4

package/telegram-plugin/tests/feed-open-gate.test.ts

@@ -179,6 +179,48 @@ describe('mayOpenActivityCard — lever 1 exception: post-answer sub-agent liven
   })
 })
 
+describe('mayOpenActivityCard — lever 1 exception: post-substantive MAIN-agent reopen', () => {
+  // The foreground sibling of the sub-agent exemption above: a turn that
+  // delivered a substantive answer early and kept doing tool work sets
+  // `postAnswerMainActivity=true` (via decideFeedReopen().liftLeverOne) so a
+  // fresh activity card can open below the reply. Same 'tool'-only scoping.
+
+  it('post-answer MAIN-agent tool activity DOES open a card (tool + postAnswerMainActivity)', () => {
+    expect(
+      mayOpenActivityCard({
+        producer: 'tool',
+        finalAnswerEverDelivered: true,
+        labeledToolCount: 4,
+        postAnswerMainActivity: true,
+      }),
+    ).toBe(true)
+  })
+
+  it('without the signal Lever 1 stays active (no postAnswerMainActivity → blocked)', () => {
+    expect(
+      mayOpenActivityCard({
+        producer: 'tool',
+        finalAnswerEverDelivered: true,
+        labeledToolCount: 4,
+        postAnswerMainActivity: false,
+      }),
+    ).toBe(false)
+  })
+
+  it('only the tool producer is exempted (liveness/narrative stay blocked with the signal)', () => {
+    for (const producer of ['liveness', 'narrative'] as const) {
+      expect(
+        mayOpenActivityCard({
+          producer,
+          finalAnswerEverDelivered: true,
+          labeledToolCount: 4,
+          postAnswerMainActivity: true,
+        }),
+      ).toBe(false)
+    }
+  })
+})
+
 describe('shouldEarlyOpenLiveness — the early-open WHEN gate (enqueue + heartbeat)', () => {
   // The minimal "Working…" placeholder is due to open for a 0-label turn once it
   // has been alive past the threshold and NO card is open yet. Both the

package/telegram-plugin/tests/feed-reopen-gate.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 
 import {
+  SUBSTANTIVE_REOPEN_MIN_LABELS,
   decideFeedReopen,
   shouldReopenFeedAfterAck,
 } from '../gateway/feed-reopen-gate.js'
@@ -131,3 +132,116 @@ describe('decideFeedReopen — tool_label branch outcome for a delivered turn',
     expect(outcome.reset).toBeUndefined()
   })
 })
+
+/**
+ * Post-SUBSTANTIVE feed reopen — a turn that delivered a real answer EARLY and
+ * then kept doing tool work for minutes had its live feed go dark for the rest
+ * of the turn. It reopens once >= SUBSTANTIVE_REOPEN_MIN_LABELS post-answer
+ * labels arrive, WITHOUT clearing finalAnswerDelivered (which would trip the
+ * turn-end re-prompt → duplicate answer). Gated by
+ * `reopenAfterSubstantiveEnabled` (SWITCHROOM_FEED_REOPEN_AFTER_SUBSTANTIVE).
+ */
+describe('post-substantive feed reopen', () => {
+  const substantiveBase = {
+    finalAnswerDelivered: true,
+    finalAnswerSubstantive: true,
+    enabled: true,
+    reopenAfterSubstantiveEnabled: true,
+  }
+
+  it('reopens once >= SUBSTANTIVE_REOPEN_MIN_LABELS post-answer labels have arrived', () => {
+    // The bug: with the flag ON but the counter at threshold, the old gate
+    // hard-returned false. Now it reopens.
+    expect(
+      shouldReopenFeedAfterAck({
+        ...substantiveBase,
+        postSubstantiveToolLabelCount: SUBSTANTIVE_REOPEN_MIN_LABELS,
+      }),
+    ).toBe(true)
+    // And it keeps returning true for further labels (a long multi-phase turn).
+    expect(
+      shouldReopenFeedAfterAck({
+        ...substantiveBase,
+        postSubstantiveToolLabelCount: SUBSTANTIVE_REOPEN_MIN_LABELS + 5,
+      }),
+    ).toBe(true)
+  })
+
+  it('does NOT reopen before the threshold (0 or 1 post-answer labels → no flap)', () => {
+    // A genuinely-final single-reply turn with a stray housekeeping tool must
+    // not flap the card.
+    for (const n of [0, 1]) {
+      expect(
+        shouldReopenFeedAfterAck({
+          ...substantiveBase,
+          postSubstantiveToolLabelCount: n,
+        }),
+      ).toBe(false)
+    }
+    // The threshold is exactly 2 (not 1) by design.
+    expect(SUBSTANTIVE_REOPEN_MIN_LABELS).toBe(2)
+  })
+
+  it('flag OFF → never reopens after a substantive final, even past the threshold (legacy)', () => {
+    expect(
+      shouldReopenFeedAfterAck({
+        finalAnswerDelivered: true,
+        finalAnswerSubstantive: true,
+        enabled: true,
+        reopenAfterSubstantiveEnabled: false,
+        postSubstantiveToolLabelCount: SUBSTANTIVE_REOPEN_MIN_LABELS + 10,
+      }),
+    ).toBe(false)
+    // Omitting the flag entirely is also legacy (default-off at the pure gate).
+    expect(
+      shouldReopenFeedAfterAck({
+        finalAnswerDelivered: true,
+        finalAnswerSubstantive: true,
+        enabled: true,
+        postSubstantiveToolLabelCount: SUBSTANTIVE_REOPEN_MIN_LABELS + 10,
+      }),
+    ).toBe(false)
+  })
+
+  it('decideFeedReopen: at threshold → reopen with liftLeverOne and NO reset (finalAnswerDelivered stays true)', () => {
+    const outcome = decideFeedReopen({
+      ...substantiveBase,
+      postSubstantiveToolLabelCount: SUBSTANTIVE_REOPEN_MIN_LABELS,
+    })
+    expect(outcome.dropLabel).toBe(false)
+    // Crucially NO reset: finalAnswerDelivered must stay true so the turn-end
+    // silent-end re-prompt does not fire → no duplicate answer.
+    expect(outcome.reset).toBeUndefined()
+    // Lever 1 must be lifted so the fresh card opens below the delivered reply.
+    expect(outcome.liftLeverOne).toBe(true)
+  })
+
+  it('decideFeedReopen: below threshold → drops the label (feed stays gated, no flap)', () => {
+    const outcome = decideFeedReopen({
+      ...substantiveBase,
+      postSubstantiveToolLabelCount: 1,
+    })
+    expect(outcome.dropLabel).toBe(true)
+    expect(outcome.reset).toBeUndefined()
+    expect(outcome.liftLeverOne).toBeUndefined()
+  })
+
+  it('ack reopen is unchanged: reset clears finalAnswerDelivered and does NOT lift lever 1', () => {
+    // The ack path (non-substantive) is orthogonal — the new flag/counter must
+    // not perturb it.
+    const outcome = decideFeedReopen({
+      finalAnswerDelivered: true,
+      finalAnswerSubstantive: false,
+      enabled: true,
+      reopenAfterSubstantiveEnabled: true,
+      postSubstantiveToolLabelCount: 99,
+    })
+    expect(outcome.dropLabel).toBe(false)
+    expect(outcome.reset).toEqual({
+      finalAnswerDelivered: false,
+      activityMessageId: null,
+      activityLastSentRender: null,
+    })
+    expect(outcome.liftLeverOne).toBeUndefined()
+  })
+})

package/telegram-plugin/tests/progress-cap.test.ts

@@ -0,0 +1,182 @@
+/**
+ * Integration test for the `progress_update` attention-cap RESERVATION path
+ * (`gateway/progress-fallback-cap.ts` `reserveProgressSlot` /
+ * `sendWithProgressCap`).
+ *
+ * These are the REAL functions the gateway's `executeProgressUpdate` calls —
+ * not a mirror re-implementation. `executeProgressUpdate` wires
+ * `sendWithProgressCap({ key, now, turnStart, turnCount }, () => robustApiCall(...))`
+ * and returns `turn_limit` on `{ capped: true }`, so an ordering regression
+ * INSIDE the reserve/release/cap logic is caught here. (The surrounding
+ * executeProgressUpdate — truncation, the 20s floor, secret scrub — is covered
+ * by `progress-update.test.ts`; isolating the whole async function would drag in
+ * the entire gateway module, so the counter-ordering + cap logic is the seam
+ * bound directly.)
+ *
+ * What it proves:
+ *   (a) the turn-less fallback path caps at 5 and refuses the 6th;
+ *   (b) a thrown send consumes NO slot on either path (release-on-throw);
+ *   (c) N truly-concurrent same-key sends never exceed the cap (Low 1 — the
+ *       reservation happens BEFORE the await, so a concurrent caller sees it).
+ */
+import { describe, it, expect, beforeEach } from 'bun:test'
+import {
+  reserveProgressSlot,
+  sendWithProgressCap,
+  _resetProgressFallbackCap,
+  PROGRESS_TURN_MAX,
+} from '../gateway/progress-fallback-cap.js'
+
+const KEY = 'chat123:_'
+
+/** A send that resolves on the next microtask (models the real async send). */
+function asyncSend<T>(value: T, counter?: { n: number }): () => Promise<T> {
+  return async () => {
+    await Promise.resolve()
+    if (counter) counter.n += 1
+    return value
+  }
+}
+
+describe('progress cap reservation (real gateway path)', () => {
+  beforeEach(() => {
+    _resetProgressFallbackCap()
+  })
+
+  // (a) turn-less path caps at PROGRESS_TURN_MAX, refuses the next.
+  it('turn-less path allows exactly PROGRESS_TURN_MAX then caps (a)', async () => {
+    const turnCount = new Map<string, number>()
+    const now = 1_000
+    for (let i = 0; i < PROGRESS_TURN_MAX; i++) {
+      const r = await sendWithProgressCap(
+        { key: KEY, now, turnStart: undefined, turnCount },
+        asyncSend({ message_id: i }),
+      )
+      expect(r.capped).toBe(false)
+    }
+    const over = await sendWithProgressCap(
+      { key: KEY, now, turnStart: undefined, turnCount },
+      asyncSend({ message_id: 99 }),
+    )
+    expect(over.capped).toBe(true)
+  })
+
+  // (a') turn-scoped path caps too, and does not touch the fallback window.
+  it('turn-scoped path caps at PROGRESS_TURN_MAX (a)', async () => {
+    const turnCount = new Map<string, number>()
+    const deps = { key: KEY, now: 1_000, turnStart: 1_000, turnCount }
+    for (let i = 0; i < PROGRESS_TURN_MAX; i++) {
+      const r = await sendWithProgressCap(deps, asyncSend({ message_id: i }))
+      expect(r.capped).toBe(false)
+    }
+    expect(turnCount.get(KEY)).toBe(PROGRESS_TURN_MAX)
+    const over = await sendWithProgressCap(deps, asyncSend({ message_id: 99 }))
+    expect(over.capped).toBe(true)
+    // Still exactly at the cap — the refused call did not increment.
+    expect(turnCount.get(KEY)).toBe(PROGRESS_TURN_MAX)
+  })
+
+  // (b) a thrown send releases the turn-counter slot.
+  it('a thrown send consumes no turn-counter slot (b)', async () => {
+    const turnCount = new Map<string, number>([[KEY, 0]])
+    const deps = { key: KEY, now: 1_000, turnStart: 1_000, turnCount }
+    await expect(
+      sendWithProgressCap(deps, async () => {
+        throw new Error('telegram 500')
+      }),
+    ).rejects.toThrow('telegram 500')
+    // Slot released → counter back to 0.
+    expect(turnCount.get(KEY)).toBe(0)
+    // Full budget still available afterwards.
+    for (let i = 0; i < PROGRESS_TURN_MAX; i++) {
+      const r = await sendWithProgressCap(deps, asyncSend({ message_id: i }))
+      expect(r.capped).toBe(false)
+    }
+    expect(turnCount.get(KEY)).toBe(PROGRESS_TURN_MAX)
+  })
+
+  // (b) a thrown send releases the fallback-window slot.
+  it('a thrown send consumes no fallback-window slot (b)', async () => {
+    const turnCount = new Map<string, number>()
+    const now = 1_000
+    // PROGRESS_TURN_MAX throwing sends on the turn-less path.
+    for (let i = 0; i < PROGRESS_TURN_MAX; i++) {
+      await expect(
+        sendWithProgressCap(
+          { key: KEY, now, turnStart: undefined, turnCount },
+          async () => {
+            throw new Error('telegram 500')
+          },
+        ),
+      ).rejects.toThrow('telegram 500')
+    }
+    // Window is still empty — every throw released its slot, so a full budget
+    // of real deliveries is allowed, and only the (MAX+1)th is capped.
+    for (let i = 0; i < PROGRESS_TURN_MAX; i++) {
+      const r = await sendWithProgressCap(
+        { key: KEY, now, turnStart: undefined, turnCount },
+        asyncSend({ message_id: i }),
+      )
+      expect(r.capped).toBe(false)
+    }
+    const over = await sendWithProgressCap(
+      { key: KEY, now, turnStart: undefined, turnCount },
+      asyncSend({ message_id: 99 }),
+    )
+    expect(over.capped).toBe(true)
+  })
+
+  // (c) N concurrent same-key sends never exceed the cap — fallback path.
+  // Pre-Low-1 (check atCap → await → record) this delivered all N, because the
+  // record only ran after the await, so every concurrent caller read count 0.
+  it('concurrent same-key sends never exceed the cap — fallback path (c)', async () => {
+    const turnCount = new Map<string, number>()
+    const now = 1_000
+    const delivered = { n: 0 }
+    const N = 25
+    const results = await Promise.all(
+      Array.from({ length: N }, () =>
+        sendWithProgressCap(
+          { key: KEY, now, turnStart: undefined, turnCount },
+          asyncSend({ message_id: 1 }, delivered),
+        ),
+      ),
+    )
+    const proceeded = results.filter((r) => !r.capped).length
+    expect(proceeded).toBe(PROGRESS_TURN_MAX)
+    expect(delivered.n).toBe(PROGRESS_TURN_MAX)
+  })
+
+  // (c) N concurrent same-key sends never exceed the cap — turn-counter path.
+  it('concurrent same-key sends never exceed the cap — turn path (c)', async () => {
+    const turnCount = new Map<string, number>([[KEY, 0]])
+    const delivered = { n: 0 }
+    const N = 25
+    const deps = { key: KEY, now: 1_000, turnStart: 1_000, turnCount }
+    const results = await Promise.all(
+      Array.from({ length: N }, () =>
+        sendWithProgressCap(deps, asyncSend({ message_id: 1 }, delivered)),
+      ),
+    )
+    const proceeded = results.filter((r) => !r.capped).length
+    expect(proceeded).toBe(PROGRESS_TURN_MAX)
+    expect(delivered.n).toBe(PROGRESS_TURN_MAX)
+    // The counter settled exactly at the cap — no overshoot, no leaked slot.
+    expect(turnCount.get(KEY)).toBe(PROGRESS_TURN_MAX)
+  })
+
+  // Non-concurrent behaviour is identical to before: a successful reserve keeps
+  // the slot, so reserveProgressSlot alone (no send) accounts the delivery.
+  it('reserveProgressSlot keeps the slot on success, releases on demand', () => {
+    const turnCount = new Map<string, number>([[KEY, 0]])
+    const deps = { key: KEY, now: 1_000, turnStart: 1_000, turnCount }
+    const first = reserveProgressSlot(deps)
+    expect(first).not.toBeNull()
+    expect(turnCount.get(KEY)).toBe(1)
+    // Releasing hands the slot back; a second release is a no-op.
+    first!.release()
+    expect(turnCount.get(KEY)).toBe(0)
+    first!.release()
+    expect(turnCount.get(KEY)).toBe(0)
+  })
+})

package/telegram-plugin/tests/progress-fallback-cap.test.ts

@@ -0,0 +1,91 @@
+/**
+ * Unit tests for the `progress_update` turn-less fallback attention cap
+ * (`gateway/progress-fallback-cap.ts`).
+ *
+ * The bug this guards: when an inbound mints no turn atom (handback / progress
+ * inbound turns), the per-turn 5-call cap never applied, so a worker could
+ * `progress_update` at the 20s floor indefinitely. This is the real module the
+ * gateway calls — it exercises the rolling-window cap, the delivery-only
+ * counting, and the prune-to-empty memory behaviour directly.
+ */
+import { describe, it, expect, beforeEach } from 'bun:test'
+import {
+  progressFallbackAtCap,
+  recordProgressFallbackSend,
+  _resetProgressFallbackCap,
+  PROGRESS_FALLBACK_MAX,
+  PROGRESS_FALLBACK_WINDOW_MS,
+} from '../gateway/progress-fallback-cap.js'
+
+const KEY = 'chat123:_'
+
+describe('progress fallback cap', () => {
+  beforeEach(() => {
+    _resetProgressFallbackCap()
+  })
+
+  it('allows exactly PROGRESS_FALLBACK_MAX deliveries then caps', () => {
+    let now = 1_000
+    for (let i = 0; i < PROGRESS_FALLBACK_MAX; i++) {
+      expect(progressFallbackAtCap(KEY, now)).toBe(false)
+      recordProgressFallbackSend(KEY, now)
+      now += 25_000 // past the 20s floor, still well inside the window
+    }
+    // The (MAX+1)th within the window is refused.
+    expect(progressFallbackAtCap(KEY, now)).toBe(true)
+  })
+
+  it('rolls: a delivery ages out after the window and frees a slot', () => {
+    const start = 1_000
+    let now = start
+    for (let i = 0; i < PROGRESS_FALLBACK_MAX; i++) {
+      recordProgressFallbackSend(KEY, now)
+      now += 25_000
+    }
+    expect(progressFallbackAtCap(KEY, now)).toBe(true)
+
+    // Jump past the window relative to the FIRST send: the oldest entries age
+    // out, so we are under cap again.
+    now = start + PROGRESS_FALLBACK_WINDOW_MS + 1
+    expect(progressFallbackAtCap(KEY, now)).toBe(false)
+  })
+
+  it('a slot is consumed only by recordProgressFallbackSend, not by the check', () => {
+    const now = 1_000
+    // Checking the cap repeatedly must not itself consume slots (models a
+    // thrown send: cap checked, send throws, nothing recorded).
+    for (let i = 0; i < 100; i++) {
+      expect(progressFallbackAtCap(KEY, now)).toBe(false)
+    }
+    // Full budget still available.
+    for (let i = 0; i < PROGRESS_FALLBACK_MAX; i++) {
+      expect(progressFallbackAtCap(KEY, now)).toBe(false)
+      recordProgressFallbackSend(KEY, now + i)
+    }
+    expect(progressFallbackAtCap(KEY, now + PROGRESS_FALLBACK_MAX)).toBe(true)
+  })
+
+  it('keys are independent', () => {
+    const now = 1_000
+    for (let i = 0; i < PROGRESS_FALLBACK_MAX; i++) {
+      recordProgressFallbackSend('a:_', now + i)
+    }
+    expect(progressFallbackAtCap('a:_', now + PROGRESS_FALLBACK_MAX)).toBe(true)
+    expect(progressFallbackAtCap('b:_', now + PROGRESS_FALLBACK_MAX)).toBe(false)
+  })
+
+  it('prunes an emptied key so the map does not grow unbounded', () => {
+    // A single delivery, then a check well past the window: the key should be
+    // dropped, restoring the full budget (proves the array was pruned, not
+    // just skipped over).
+    recordProgressFallbackSend(KEY, 1_000)
+    const later = 1_000 + PROGRESS_FALLBACK_WINDOW_MS + 1
+    expect(progressFallbackAtCap(KEY, later)).toBe(false)
+    // And a fresh full budget is available from `later`.
+    for (let i = 0; i < PROGRESS_FALLBACK_MAX; i++) {
+      expect(progressFallbackAtCap(KEY, later + i)).toBe(false)
+      recordProgressFallbackSend(KEY, later + i)
+    }
+    expect(progressFallbackAtCap(KEY, later + PROGRESS_FALLBACK_MAX)).toBe(true)
+  })
+})

package/telegram-plugin/tests/progress-update.test.ts

@@ -8,6 +8,11 @@
  * (failed 9/1931) for the original symptom.
  */
 import { describe, it, expect, beforeEach, afterEach, spyOn, type Mock } from 'bun:test'
+import {
+  progressFallbackAtCap,
+  recordProgressFallbackSend,
+  _resetProgressFallbackCap,
+} from '../gateway/progress-fallback-cap.js'
 
 // Mock state shared across tests (simulates the module-level state in server.ts / gateway.ts)
 const progressUpdateLastSent = new Map<string, number>()
@@ -25,17 +30,24 @@ type ProgressUpdateResult =
 
 /**
  * Simplified progress_update implementation for testing.
- * Returns the same shape as the real tool handler.
+ * Mirrors the real tool handler's ORDERING (gateway.ts `executeProgressUpdate`):
+ * check caps → send (may throw) → count the delivery only AFTER it lands. The
+ * turn-less fallback path calls the REAL cap module, not a copy.
+ *
+ * `send` is an injectable seam so a test can make the send throw and assert no
+ * slot is consumed (Fix 2). It defaults to a successful send.
  */
 function executeProgressUpdate(args: {
   chat_id: string
   text: string
   message_thread_id?: number
+  send?: () => number
 }): ProgressUpdateResult {
   const { chat_id, message_thread_id } = args
   let { text } = args
   const threadId = message_thread_id
   const key = statusKey(chat_id, threadId)
+  const send = args.send ?? (() => Math.floor(Math.random() * 100000))
 
   // Truncate to 300 chars
   if (text.length > 300) {
@@ -53,20 +65,30 @@ function executeProgressUpdate(args: {
     }
   }
 
-  // Turn cap: max 5 calls per turn
+  // Attention cap: max 5 deliveries per turn atom, else a rolling fallback
+  // window when no turn atom exists. Checked BEFORE the send; the count is
+  // advanced only after a successful send (below).
   const turnStart = activeTurnStartedAt.get(key)
-  if (turnStart != null) {
-    const currentCount = progressUpdateTurnCount.get(key) ?? 0
-    if (currentCount >= 5) {
-      return { ok: false, reason: 'turn_limit' }
-    }
-    progressUpdateTurnCount.set(key, currentCount + 1)
+  const atCap =
+    turnStart != null
+      ? (progressUpdateTurnCount.get(key) ?? 0) >= 5
+      : progressFallbackAtCap(key, now)
+  if (atCap) {
+    return { ok: false, reason: 'turn_limit' }
   }
 
+  // Send. A throw here must NOT consume a slot — it propagates before any
+  // bookkeeping runs.
+  const message_id = send()
+
   progressUpdateLastSent.set(key, now)
+  if (turnStart != null) {
+    progressUpdateTurnCount.set(key, (progressUpdateTurnCount.get(key) ?? 0) + 1)
+  } else {
+    recordProgressFallbackSend(key, now)
+  }
 
-  // Mock message_id
-  return { ok: true, message_id: Math.floor(Math.random() * 100000) }
+  return { ok: true, message_id }
 }
 
 // Manual time mocking — bun:test compatible (bun lacks vi.setSystemTime).
@@ -81,6 +103,7 @@ describe('progress_update tool', () => {
     progressUpdateLastSent.clear()
     progressUpdateTurnCount.clear()
     activeTurnStartedAt.clear()
+    _resetProgressFallbackCap()
     mockNow = 1000
     dateSpy = spyOn(Date, 'now').mockImplementation(() => mockNow)
   })
@@ -220,7 +243,7 @@ describe('progress_update tool', () => {
     expect(progressUpdateTurnCount.get(key2)).toBe(1)
   })
 
-  it('when no active turn, still rate-limits but does not increment counter', () => {
+  it('when no active turn, still rate-limits but does not increment the turn counter', () => {
     // No activeTurnStartedAt entry for this chat
     const r1 = executeProgressUpdate({ chat_id: '999', text: 'First' })
     expect(r1.ok).toBe(true)
@@ -229,8 +252,81 @@ describe('progress_update tool', () => {
     const r2 = executeProgressUpdate({ chat_id: '999', text: 'Second' })
     expect(r2.ok).toBe(false)
 
-    // Counter should not have been incremented (no active turn)
+    // The per-turn counter is untouched on the turn-less path (the fallback
+    // window carries the count instead).
     const key = statusKey('999')
     expect(progressUpdateTurnCount.get(key)).toBeUndefined()
   })
+
+  // Fix 1: with NO turn atom, the fallback rolling window still caps at 5.
+  it('null-turn-atom context caps at 5 sends per window (Fix 1)', () => {
+    // No activeTurnStartedAt entry — the pre-fix code applied no cap here at
+    // all, so this loop would let a 6th (and every subsequent) send through.
+    for (let i = 1; i <= 5; i++) {
+      advance(25_000) // clear the 20s floor each time
+      const r = executeProgressUpdate({ chat_id: '888', text: `Update ${i}` })
+      expect(r.ok).toBe(true)
+    }
+    advance(25_000)
+    const r6 = executeProgressUpdate({ chat_id: '888', text: 'Update 6' })
+    expect(r6.ok).toBe(false)
+    if (!r6.ok) {
+      expect(r6.reason).toBe('turn_limit')
+    }
+  })
+
+  // Fix 2: a thrown send must NOT consume a cap slot (turn-scoped path).
+  it('a thrown send does not consume a turn-cap slot (Fix 2)', () => {
+    const key = statusKey('777')
+    activeTurnStartedAt.set(key, 1000)
+    progressUpdateTurnCount.set(key, 0)
+
+    // A send that throws: the cap was checked, but nothing was delivered.
+    expect(() =>
+      executeProgressUpdate({
+        chat_id: '777',
+        text: 'boom',
+        send: () => {
+          throw new Error('telegram 500')
+        },
+      }),
+    ).toThrow('telegram 500')
+
+    // Slot NOT consumed — pre-fix the counter incremented before the send.
+    expect(progressUpdateTurnCount.get(key)).toBe(0)
+
+    // A subsequent successful send still has its full budget and counts once.
+    advance(25_000)
+    const r = executeProgressUpdate({ chat_id: '777', text: 'real' })
+    expect(r.ok).toBe(true)
+    expect(progressUpdateTurnCount.get(key)).toBe(1)
+  })
+
+  // Fix 2 composed with Fix 1: a thrown send on the turn-less path records
+  // nothing in the fallback window either.
+  it('a thrown send does not consume a fallback-window slot (Fix 2 × Fix 1)', () => {
+    // Five throwing sends on the turn-less path.
+    for (let i = 0; i < 5; i++) {
+      advance(25_000)
+      expect(() =>
+        executeProgressUpdate({
+          chat_id: '666',
+          text: 'boom',
+          send: () => {
+            throw new Error('telegram 500')
+          },
+        }),
+      ).toThrow('telegram 500')
+    }
+    // The window is still empty — five throws consumed no slots, so five real
+    // sends are still allowed.
+    for (let i = 1; i <= 5; i++) {
+      advance(25_000)
+      const r = executeProgressUpdate({ chat_id: '666', text: `real ${i}` })
+      expect(r.ok).toBe(true)
+    }
+    advance(25_000)
+    const capped = executeProgressUpdate({ chat_id: '666', text: 'over' })
+    expect(capped.ok).toBe(false)
+  })
 })

package/telegram-plugin/tests/subagent-handback-inbound-builder.test.ts

@@ -165,3 +165,49 @@ describe('buildSubagentHandbackInbound', () => {
     expect(inbound.meta.message_thread_id).toBeUndefined()
   })
 })
+
+// ─── msg-6897 misroute regression (2026-08-04): meta.chat_id is LOAD-BEARING ──
+// The gateway's enqueue handler (`beginTurn`, stream-render.ts) gates the
+// ENTIRE turn-atom mint — `recordTurnStart` (the `turns` row) AND
+// `writeTurnActiveMarker` (the #2085 dispatch-time stamp source) — on
+// `ev.chatId`, which is parsed from the channel XML's `chat_id` attribute,
+// rendered ONLY from meta (bridge.ts onInbound → mcp.notification meta).
+// Without meta.chat_id a handback turn registers NO surface, so a worker
+// dispatched from inside it has a NULL parent_turn_key (no marker to stamp
+// from, no turn window for the backfill) and its card/handback misroutes to
+// the owner DM with the thread stripped. Mirrors the real-inbound shape
+// (inbound-router.ts buildInboundEnvelope meta.chat_id) and the
+// resume_interrupted builder's identical fix.
+describe('buildSubagentHandbackInbound — meta.chat_id turn registration (msg-6897)', () => {
+  it('carries the origin chat as meta.chat_id so the handback turn mints a turn atom', () => {
+    const inbound = buildSubagentHandbackInbound({
+      ctx: {
+        chatId: '-1004223464247',
+        threadId: 77,
+        taskDescription: 'Topic-dispatched work',
+        resultText: 'done',
+        outcome: 'completed',
+      },
+      nowMs: FIXED_NOW,
+    })
+    expect(inbound.meta.chat_id).toBe('-1004223464247')
+    // The thread carrier must still ride alongside — chat_id + thread_id is
+    // the full origin surface the minted turn (and any worker dispatched
+    // inside it) inherits.
+    expect(inbound.meta.message_thread_id).toBe('77')
+  })
+
+  it('carries meta.chat_id for DM-shaped chats too (no thread)', () => {
+    const inbound = buildSubagentHandbackInbound({
+      ctx: {
+        chatId: '12345',
+        taskDescription: 'x',
+        resultText: 'y',
+        outcome: 'failed',
+      },
+      nowMs: FIXED_NOW,
+    })
+    expect(inbound.meta.chat_id).toBe('12345')
+    expect(inbound.meta.message_thread_id).toBeUndefined()
+  })
+})