switchroom 0.20.21 → 0.21.0

package/telegram-plugin/tests/card-history-lane.test.ts

@@ -0,0 +1,394 @@
+/**
+ * Card history lane — REAL history.db end-to-end (#4571).
+ *
+ * The bug: the gateway posts activity cards, status pins, approval / boot /
+ * issues cards and progress lines as real Telegram messages that consume real
+ * message ids, but ONLY the `reply` family (which calls `recordOutbound`) ever
+ * wrote a row. Measured on a live agent's buffer: 116 rows across a 266-id
+ * span. The operator quote-replies to the activity card — the most recent
+ * message on their screen for most of a turn — Telegram delivers
+ * `reply_to_message_id` pointing at it, the buffer has nothing, and the agent
+ * answers "I can't see the message you replied to".
+ *
+ * This drives the WHOLE chain against a real bun:sqlite DB, because a stored
+ * row nobody can look up is not a fix:
+ *
+ *     robustApiCall resolves → observer → recordSystemOutbound
+ *       → lookupMessageRoleAndText({ includeSystem: true })
+ *       → resolveReplyToFromBuffer → buildInboundEnvelope
+ *       → meta.reply_to_role='system' + meta.reply_to_kind + reply_to_text
+ *
+ * plus the three regressions the lane must not cause: card rows must not be
+ * LISTED by `query()` (get_recent_messages), a real reply must always beat the
+ * provisional card row for the same id, and the schema migration must be
+ * idempotent against a live pre-#4571 DB without losing a row.
+ *
+ * Runs under `bun test` (bun:sqlite is a Bun built-in vitest can't resolve);
+ * vitest-excluded in vitest.config.ts, covered by the bun `tests/` target in
+ * telegram-plugin/scripts/bun-test-ci.sh.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'bun:test'
+import { Database } from 'bun:sqlite'
+import { mkdtempSync, rmSync, existsSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import {
+  initHistory,
+  recordInbound,
+  recordOutbound,
+  recordSystemOutbound,
+  updateSystemOutboundText,
+  lookupMessageRoleAndText,
+  query,
+  _resetForTests,
+} from '../history.js'
+import {
+  resolveReplyToFromBuffer,
+  buildInboundEnvelope,
+  type EnvelopeBuildParams,
+} from '../gateway/inbound-router.js'
+import { makeSystemMessageObserver } from '../gateway/system-message-observer.js'
+
+const CHAT = '5550001'
+const REPLY_TO_TEXT_MAX = 200
+
+/** The gateway's own wiring, verbatim: history writers behind the observer. */
+function makeObserver(now?: () => number) {
+  return makeSystemMessageObserver({
+    insert: recordSystemOutbound,
+    updateText: updateSystemOutboundText,
+    ...(now != null ? { now } : {}),
+  })
+}
+
+/** A Telegram Message response, as `robustApiCall` resolves with. */
+function sentMessage(messageId: number, text: string) {
+  return { message_id: messageId, chat: { id: Number(CHAT) }, text }
+}
+
+/** The reply-antecedent lookup as gateway.ts binds it (#4571: includeSystem). */
+function boundLookup(messageId: number) {
+  return lookupMessageRoleAndText(CHAT, messageId, { includeSystem: true })
+}
+
+function makeEnvelopeParams(overrides: Partial<EnvelopeBuildParams>): EnvelopeBuildParams {
+  return {
+    ctx: { message: { date: 1_700_000_000 } } as unknown as EnvelopeBuildParams['ctx'],
+    chat_id: CHAT,
+    messageThreadId: undefined,
+    msgId: 20268,
+    effectiveText: 'stop what you are doing and check the other repo',
+    imagePath: undefined,
+    attachment: undefined,
+    attachmentCount: 0,
+    extraMeta: {},
+    from: { id: 111, username: 'alice' },
+    access: { groups: {} },
+    isSteering: false,
+    isQueuedPrefix: false,
+    isQueuedMidTurn: false,
+    priorTurnInProgress: false,
+    secondsSinceTurnStart: undefined,
+    priorAssistantPreview: undefined,
+    replyToMessageId: undefined,
+    replyToTextEscaped: undefined,
+    replyToRole: undefined,
+    forwardOriginMeta: {},
+    topicFramingEnabled: false,
+    personDirectory: { byTelegramKey: {} },
+    isDmChatId: () => true,
+    ...overrides,
+  } as EnvelopeBuildParams
+}
+
+let stateDir: string
+
+beforeEach(() => {
+  stateDir = mkdtempSync(join(tmpdir(), 'card-history-lane-'))
+  initHistory(stateDir, 30)
+})
+
+afterEach(() => {
+  _resetForTests()
+  if (existsSync(stateDir)) rmSync(stateDir, { recursive: true, force: true })
+})
+
+describe('a quote-reply to the live activity card is UNDERSTOOD, end to end', () => {
+  it('card posted → id resolvable → the reply carries role=system, the card kind, and its body', () => {
+    const observe = makeObserver()
+    const CARD_ID = 20267
+
+    // 1. The gateway opens the activity card. No `recordOutbound` anywhere —
+    //    this is the exact path that used to leave NO row at all.
+    observe(sentMessage(CARD_ID, '⚙️ Working — reading history.ts, 3 tools'), {
+      chat_id: CHAT,
+      verb: 'activity-summary.send',
+    })
+
+    // 2. The operator quote-replies to it. Telegram gives the id but NOT the
+    //    text (the bot authored it), so the live reply text is empty.
+    const resolved = resolveReplyToFromBuffer({
+      replyToMessageId: CARD_ID,
+      replyToText: undefined,
+      replyToTextEscaped: undefined,
+      historyEnabled: true,
+      replyToTextMax: REPLY_TO_TEXT_MAX,
+      lookup: boundLookup,
+    })
+
+    // 3. The antecedent resolves — this is the assertion the bug fails.
+    expect(resolved.replyToRole).toBe('system')
+    expect(resolved.replyToKind).toBe('activity-summary')
+    expect(resolved.replyToText).toBe('⚙️ Working — reading history.ts, 3 tools')
+
+    // 4. …and reaches the agent on the inbound envelope, so it can read the
+    //    card body instead of reporting amnesia.
+    const msg = buildInboundEnvelope(
+      makeEnvelopeParams({
+        replyToMessageId: CARD_ID,
+        replyToTextEscaped: resolved.replyToTextEscaped,
+        replyToRole: resolved.replyToRole,
+        replyToKind: resolved.replyToKind,
+      }),
+    )
+    expect(msg.meta?.reply_to_message_id).toBe(String(CARD_ID))
+    expect(msg.meta?.reply_to_role).toBe('system')
+    expect(msg.meta?.reply_to_kind).toBe('activity-summary')
+    expect(msg.meta?.reply_to_text).toBe('⚙️ Working — reading history.ts, 3 tools')
+  })
+
+  it('WITHOUT the observer the same reply resolves to nothing (the bug, pinned)', () => {
+    // No observe() call — i.e. pre-#4571 behaviour for a card send.
+    const resolved = resolveReplyToFromBuffer({
+      replyToMessageId: 20267,
+      replyToText: undefined,
+      replyToTextEscaped: undefined,
+      historyEnabled: true,
+      replyToTextMax: REPLY_TO_TEXT_MAX,
+      lookup: boundLookup,
+    })
+    expect(resolved.replyToRole).toBeUndefined()
+    expect(resolved.replyToText).toBeUndefined()
+  })
+
+  it('surfaces the LATEST card body, not the text it was opened with', () => {
+    let t = 1_000
+    const observe = makeObserver(() => t)
+    observe(sentMessage(20267, '⚙️ Working — starting'), {
+      chat_id: CHAT,
+      verb: 'activity-summary.send',
+    })
+    t += 60_000
+    observe(sentMessage(20267, '⚙️ Working — 11 tools, editing gateway.ts'), {
+      chat_id: CHAT,
+      verb: 'activity-summary.edit',
+    })
+
+    const resolved = resolveReplyToFromBuffer({
+      replyToMessageId: 20267,
+      replyToText: undefined,
+      replyToTextEscaped: undefined,
+      historyEnabled: true,
+      replyToTextMax: REPLY_TO_TEXT_MAX,
+      lookup: boundLookup,
+    })
+    expect(resolved.replyToText).toBe('⚙️ Working — 11 tools, editing gateway.ts')
+  })
+})
+
+describe('the card lane does not pollute normal history reads', () => {
+  it('query() (get_recent_messages) lists the conversation, never the cards', () => {
+    const observe = makeObserver()
+    recordInbound({
+      chat_id: CHAT,
+      thread_id: null,
+      message_id: 20200,
+      user: 'alice',
+      user_id: '111',
+      ts: 1_000,
+      text: 'what is the status of the migration?',
+    })
+    for (const id of [20209, 20210, 20212, 20213]) {
+      observe(sentMessage(id, `card ${id}`), { chat_id: CHAT, verb: 'activity-summary.send' })
+    }
+    recordOutbound({
+      chat_id: CHAT,
+      thread_id: null,
+      message_ids: [20214],
+      texts: ['Migration is applied on all three boxes.'],
+      ts: 2_000,
+    })
+
+    const listed = query({ chat_id: CHAT, limit: 50 })
+    expect(listed.map((r) => r.message_id)).toEqual([20200, 20214])
+    expect(listed.some((r) => r.role === 'system')).toBe(false)
+
+    // Opt-in still sees them — resolvable, just not listed.
+    const withCards = query({ chat_id: CHAT, limit: 50, include_system: true })
+    expect(withCards.map((r) => r.message_id).sort((a, b) => a - b)).toEqual([
+      20200, 20209, 20210, 20212, 20213, 20214,
+    ])
+  })
+
+  it('an authorship-sensitive lookup (reaction trigger) still cannot see a card', () => {
+    makeObserver()(sentMessage(20267, 'card'), { chat_id: CHAT, verb: 'activity-summary.send' })
+    // Default (no includeSystem) — the pre-#4571 contract, unchanged.
+    expect(lookupMessageRoleAndText(CHAT, 20267)).toBeNull()
+    expect(lookupMessageRoleAndText(CHAT, 20267, { includeSystem: true })?.role).toBe('system')
+  })
+})
+
+describe('a real reply always beats the provisional card row', () => {
+  it('recordOutbound promotes the id to assistant and leaves exactly one row', () => {
+    const observe = makeObserver()
+    const ID = 20261
+    // The observer fires first — it runs when the API call resolves, strictly
+    // before the caller reaches its own recordOutbound.
+    observe(sentMessage(ID, 'Migration is applied on all three boxes.'), {
+      chat_id: CHAT,
+      verb: 'reply',
+    })
+    recordOutbound({
+      chat_id: CHAT,
+      thread_id: null,
+      message_ids: [ID],
+      texts: ['Migration is applied on all three boxes.'],
+      ts: 2_000,
+    })
+
+    const rows = query({ chat_id: CHAT, limit: 50, include_system: true })
+    expect(rows.filter((r) => r.message_id === ID)).toHaveLength(1)
+    expect(rows[0]?.role).toBe('assistant')
+    // And a reply pointing at it reads as an ANSWER, not a card.
+    const resolved = resolveReplyToFromBuffer({
+      replyToMessageId: ID,
+      replyToText: undefined,
+      replyToTextEscaped: undefined,
+      historyEnabled: true,
+      replyToTextMax: REPLY_TO_TEXT_MAX,
+      lookup: boundLookup,
+    })
+    expect(resolved.replyToRole).toBe('assistant')
+    expect(resolved.replyToKind).toBeUndefined()
+  })
+
+  it('promotes even when the observer recorded a DIFFERENT thread for the id', () => {
+    // Telegram stamps message_thread_id on reply chains in plain supergroups,
+    // so the observer's thread can differ from the gateway's. The unique key
+    // folds thread_id, so without the explicit delete BOTH rows would survive
+    // and the card could shadow the answer.
+    recordSystemOutbound({
+      chat_id: CHAT,
+      thread_id: 77,
+      message_id: 20263,
+      kind: 'activity-summary',
+      text: 'card',
+    })
+    recordOutbound({
+      chat_id: CHAT,
+      thread_id: null,
+      message_ids: [20263],
+      texts: ['the real answer'],
+      ts: 2_000,
+    })
+    const rows = query({ chat_id: CHAT, limit: 50, include_system: true })
+    expect(rows).toHaveLength(1)
+    expect(rows[0]?.role).toBe('assistant')
+  })
+
+  it('a card never overwrites an inbound that already owns the id', () => {
+    recordInbound({
+      chat_id: CHAT,
+      thread_id: null,
+      message_id: 20300,
+      user: 'alice',
+      user_id: '111',
+      ts: 1_000,
+      text: 'the operator said this',
+    })
+    expect(
+      recordSystemOutbound({
+        chat_id: CHAT,
+        thread_id: null,
+        message_id: 20300,
+        kind: 'activity-summary',
+        text: 'card',
+      }),
+    ).toBe(false)
+    expect(updateSystemOutboundText({ chat_id: CHAT, message_id: 20300, text: 'card' })).toBe(false)
+    const row = lookupMessageRoleAndText(CHAT, 20300, { includeSystem: true })
+    expect(row?.role).toBe('user')
+    expect(row?.text).toBe('the operator said this')
+  })
+})
+
+describe('migration onto a live pre-#4571 history.db', () => {
+  it('adds `kind` without losing a row, and is a no-op when already migrated', () => {
+    _resetForTests()
+    const legacyDir = mkdtempSync(join(tmpdir(), 'card-history-legacy-'))
+    try {
+      // A pre-#4571 schema: no `kind` column, no logical-key index.
+      const raw = new Database(join(legacyDir, 'history.db'))
+      raw.exec(`
+        CREATE TABLE messages (
+          chat_id TEXT NOT NULL, thread_id INTEGER, message_id INTEGER NOT NULL,
+          role TEXT NOT NULL, user TEXT, user_id TEXT, ts INTEGER NOT NULL,
+          text TEXT NOT NULL, attachment_kind TEXT, group_id INTEGER,
+          PRIMARY KEY (chat_id, thread_id, message_id)
+        )
+      `)
+      const ins = raw.prepare(
+        `INSERT INTO messages (chat_id, thread_id, message_id, role, user, user_id, ts, text)
+         VALUES (?, NULL, ?, ?, ?, ?, ?, ?)`,
+      )
+      const nowSec = Math.floor(Date.now() / 1000)
+      for (let i = 0; i < 200; i++) {
+        ins.run(CHAT, 19000 + i, i % 2 === 0 ? 'user' : 'assistant', 'alice', '111', nowSec, `row ${i}`)
+      }
+      raw.close()
+
+      const countRows = () => {
+        const d = new Database(join(legacyDir, 'history.db'), { readonly: true })
+        try {
+          return (d.prepare('SELECT COUNT(*) AS c FROM messages').get() as { c: number }).c
+        } finally {
+          d.close()
+        }
+      }
+      expect(countRows()).toBe(200)
+
+      // First migration.
+      initHistory(legacyDir, 30)
+      expect(countRows()).toBe(200)
+      // The new column is usable, and every legacy row kept its exact contents.
+      expect(lookupMessageRoleAndText(CHAT, 19000)).toEqual({
+        role: 'user',
+        text: 'row 0',
+        kind: null,
+      })
+      recordSystemOutbound({
+        chat_id: CHAT,
+        thread_id: null,
+        message_id: 19500,
+        kind: 'boot-card',
+        text: 'booted',
+      })
+      _resetForTests()
+
+      // Re-run against the ALREADY-migrated file: idempotent, non-destructive.
+      initHistory(legacyDir, 30)
+      expect(countRows()).toBe(201)
+      expect(lookupMessageRoleAndText(CHAT, 19500, { includeSystem: true })).toEqual({
+        role: 'system',
+        text: 'booted',
+        kind: 'boot-card',
+      })
+      _resetForTests()
+    } finally {
+      rmSync(legacyDir, { recursive: true, force: true })
+      // Restore the per-test DB the shared afterEach expects to close.
+      initHistory(stateDir, 30)
+    }
+  })
+})

package/telegram-plugin/tests/system-message-observer.test.ts

@@ -0,0 +1,216 @@
+/**
+ * system-message-observer — the card-lane recorder's pure behaviour (#4571).
+ *
+ * The observer hangs off gateway.ts's single `robustApiCall` chokepoint and
+ * turns every card the gateway posts (activity summary, status pin, approval /
+ * boot / issues cards, progress lines) into ONE resolvable history row. The
+ * two properties that make it safe to run on the hot send path are asserted
+ * here against a fake writer pair:
+ *
+ *   1. an EDIT of a card it already recorded never creates a second row, and
+ *      inside the refresh window costs zero writer calls at all;
+ *   2. an id that turns out to belong to a real reply / inbound is demoted to
+ *      `foreign` and never written to again.
+ *
+ * The end-to-end proof (card posted → id resolvable → a reply pointing at it
+ * is understood) needs a real bun:sqlite history.db and lives in
+ * card-history-lane.test.ts (bun).
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  makeSystemMessageObserver,
+  normalizeSendVerb,
+  extractSentMessage,
+  DEFAULT_EDIT_REFRESH_MS,
+} from '../gateway/system-message-observer.js'
+
+const CHAT = '5550001'
+
+/** A Telegram `Message` response as the Bot API returns it from sendMessage /
+ *  editMessageText. */
+function sentMessage(messageId: number, text: string, threadId?: number) {
+  return {
+    message_id: messageId,
+    chat: { id: Number(CHAT) },
+    ...(threadId != null ? { message_thread_id: threadId } : {}),
+    text,
+  }
+}
+
+/** A writer pair backed by a Map, mirroring recordSystemOutbound /
+ *  updateSystemOutboundText's real return contract. */
+function fakeStore(seed?: Record<number, { role: 'system' | 'other'; text: string }>) {
+  const rows = new Map<number, { role: 'system' | 'other'; text: string; kind: string | null }>()
+  for (const [id, r] of Object.entries(seed ?? {})) {
+    rows.set(Number(id), { role: r.role, text: r.text, kind: null })
+  }
+  const calls = { insert: 0, update: 0 }
+  return {
+    rows,
+    calls,
+    insert(args: { message_id: number; kind: string | null; text: string }): boolean {
+      calls.insert++
+      if (rows.has(args.message_id)) return false
+      rows.set(args.message_id, { role: 'system', text: args.text, kind: args.kind })
+      return true
+    },
+    updateText(args: { message_id: number; text: string }): boolean {
+      calls.update++
+      const row = rows.get(args.message_id)
+      if (row == null || row.role !== 'system') return false
+      row.text = args.text
+      return true
+    },
+  }
+}
+
+describe('normalizeSendVerb', () => {
+  it('strips the transport suffix so a card OPEN and its EDITs classify identically', () => {
+    expect(normalizeSendVerb('activity-summary.send')).toBe('activity-summary')
+    expect(normalizeSendVerb('activity-summary.edit')).toBe('activity-summary')
+  })
+
+  it('passes a suffix-less verb through and returns null for an untagged send', () => {
+    expect(normalizeSendVerb('boot-card')).toBe('boot-card')
+    expect(normalizeSendVerb(undefined)).toBeNull()
+    expect(normalizeSendVerb('   ')).toBeNull()
+  })
+})
+
+describe('extractSentMessage', () => {
+  it('ignores non-Message results (pins/deletes/reactions return true, swallowed 400s undefined)', () => {
+    expect(extractSentMessage(true, { chat_id: CHAT })).toBeNull()
+    expect(extractSentMessage(undefined, { chat_id: CHAT })).toBeNull()
+    expect(extractSentMessage({ ok: true }, { chat_id: CHAT })).toBeNull()
+  })
+
+  it("prefers the response's own chat and thread over the caller's opts", () => {
+    const out = extractSentMessage(sentMessage(20267, 'card body', 77), {
+      chat_id: 'wrong',
+      threadId: 5,
+    })
+    expect(out).toEqual({ chatId: CHAT, messageId: 20267, threadId: 77, text: 'card body' })
+  })
+
+  it('falls back to the caller chat/thread when the response omits them', () => {
+    const out = extractSentMessage({ message_id: 9, text: 'x' }, { chat_id: CHAT, threadId: 5 })
+    expect(out).toEqual({ chatId: CHAT, messageId: 9, threadId: 5, text: 'x' })
+  })
+})
+
+describe('makeSystemMessageObserver', () => {
+  it('records a posted card once, and an EDIT of it never adds a second row', () => {
+    const store = fakeStore()
+    let now = 1_000
+    const observe = makeSystemMessageObserver({ insert: store.insert, updateText: store.updateText, now: () => now })
+
+    observe(sentMessage(20267, 'Working… reading history.ts'), {
+      chat_id: CHAT,
+      verb: 'activity-summary.send',
+    })
+    expect(store.rows.size).toBe(1)
+    expect(store.rows.get(20267)?.kind).toBe('activity-summary')
+
+    // 40 edits of the SAME card, spread well past the refresh window.
+    for (let i = 0; i < 40; i++) {
+      now += DEFAULT_EDIT_REFRESH_MS + 1
+      observe(sentMessage(20267, `Working… step ${i}`), {
+        chat_id: CHAT,
+        verb: 'activity-summary.edit',
+      })
+    }
+    // The outcome that matters: still exactly one row for that card.
+    expect(store.rows.size).toBe(1)
+    // …carrying a recent snapshot of the card body, not the stale open text.
+    expect(store.rows.get(20267)?.text).toBe('Working… step 39')
+  })
+
+  it('does no DB work at all for edits inside the refresh window', () => {
+    const store = fakeStore()
+    let now = 1_000
+    const observe = makeSystemMessageObserver({ insert: store.insert, updateText: store.updateText, now: () => now })
+
+    observe(sentMessage(30, 'open'), { chat_id: CHAT, verb: 'activity-summary.send' })
+    const afterOpen = { ...store.calls }
+
+    for (let i = 0; i < 25; i++) {
+      now += 100 // ~2.5s of a climbing activity card
+      observe(sentMessage(30, `tick ${i}`), { chat_id: CHAT, verb: 'activity-summary.edit' })
+    }
+    expect(store.calls.insert).toBe(afterOpen.insert)
+    expect(store.calls.update).toBe(afterOpen.update)
+  })
+
+  it('leaves a real reply / inbound alone and stops probing it', () => {
+    // 4242 already belongs to a non-system row (recordOutbound got there first).
+    const store = fakeStore({ 4242: { role: 'other', text: 'the real answer' } })
+    let now = 1_000
+    const observe = makeSystemMessageObserver({ insert: store.insert, updateText: store.updateText, now: () => now })
+
+    observe(sentMessage(4242, 'edited answer'), { chat_id: CHAT, verb: 'reply' })
+    expect(store.rows.get(4242)).toEqual({ role: 'other', text: 'the real answer', kind: null })
+
+    const afterProbe = { ...store.calls }
+    for (let i = 0; i < 10; i++) {
+      now += DEFAULT_EDIT_REFRESH_MS + 1
+      observe(sentMessage(4242, `edited answer ${i}`), { chat_id: CHAT, verb: 'reply' })
+    }
+    // One probing update total — then the id is marked foreign forever.
+    expect(store.calls.insert).toBe(afterProbe.insert)
+    expect(store.calls.update).toBe(afterProbe.update)
+    expect(store.rows.get(4242)?.text).toBe('the real answer')
+  })
+
+  it('demotes a card that got promoted to a real reply mid-turn', () => {
+    const store = fakeStore()
+    let now = 1_000
+    const observe = makeSystemMessageObserver({ insert: store.insert, updateText: store.updateText, now: () => now })
+
+    observe(sentMessage(55, 'card'), { chat_id: CHAT, verb: 'activity-summary.send' })
+    // recordOutbound promotes the row to a real assistant reply.
+    store.rows.set(55, { role: 'other', text: 'the real answer', kind: null })
+
+    now += DEFAULT_EDIT_REFRESH_MS + 1
+    observe(sentMessage(55, 'card edit'), { chat_id: CHAT, verb: 'activity-summary.edit' })
+    expect(store.rows.get(55)?.text).toBe('the real answer')
+
+    const after = { ...store.calls }
+    now += DEFAULT_EDIT_REFRESH_MS + 1
+    observe(sentMessage(55, 'card edit 2'), { chat_id: CHAT, verb: 'activity-summary.edit' })
+    expect(store.calls.update).toBe(after.update)
+  })
+
+  it('never throws when the writer blows up — observing a send cannot break the send', () => {
+    const observe = makeSystemMessageObserver({
+      insert: () => {
+        throw new Error('disk full')
+      },
+      updateText: () => {
+        throw new Error('disk full')
+      },
+    })
+    expect(() => observe(sentMessage(1, 'x'), { chat_id: CHAT })).not.toThrow()
+  })
+
+  it('evicts under load without losing the one-row-per-card guarantee', () => {
+    const store = fakeStore()
+    let now = 1_000
+    const observe = makeSystemMessageObserver(
+      { insert: store.insert, updateText: store.updateText, now: () => now },
+      { maxTracked: 8 },
+    )
+
+    for (let id = 1; id <= 64; id++) {
+      observe(sentMessage(id, `card ${id}`), { chat_id: CHAT, verb: 'boot-card' })
+    }
+    expect(store.rows.size).toBe(64)
+
+    // An evicted id re-observed: the insert is refused by the store, the probe
+    // finds a system row, and no duplicate appears.
+    now += DEFAULT_EDIT_REFRESH_MS + 1
+    observe(sentMessage(1, 'card 1 edited'), { chat_id: CHAT, verb: 'boot-card' })
+    expect(store.rows.size).toBe(64)
+    expect(store.rows.get(1)?.text).toBe('card 1 edited')
+  })
+})