switchroom 0.21.10 → 0.21.12

package/telegram-plugin/tests/forwarded-rich-message-coalesce.test.ts

@@ -140,7 +140,7 @@ describe('wiring: message:rich_message dispatches through the coalescing path',
 // through `handleInboundCoalesced`.
 // ---------------------------------------------------------------------------
 
-const CHAT_ID = -1004223464247
+const CHAT_ID = -1004444444444
 const USER_ID = 777
 
 function makeBotInfo() {
@@ -159,13 +159,13 @@ function makeBotInfo() {
 
 /** Forwarded rich (bot) message, no top-level text/caption — the live shape. */
 function makeForwardedRichUpdate(update_id: number, blocks: unknown[]): Update {
-  const originUser = { id: 8500000001, is_bot: true, first_name: 'Klanker', username: 'meken_klanker_bot' }
+  const originUser = { id: 8500000001, is_bot: true, first_name: 'Sidekick', username: 'example_sidekick_bot' }
   return {
     update_id,
     message: {
       message_id: update_id,
-      chat: { id: CHAT_ID, type: 'supergroup', title: 'ProductOS', is_forum: true },
-      from: { id: USER_ID, is_bot: false, first_name: 'Ken' },
+      chat: { id: CHAT_ID, type: 'supergroup', title: 'Example Supergroup', is_forum: true },
+      from: { id: USER_ID, is_bot: false, first_name: 'Alice' },
       date: 1784837003,
       forward_origin: { type: 'user', date: 1784830000, sender_user: originUser },
       forward_from: originUser,
@@ -180,8 +180,8 @@ function makeTextUpdate(update_id: number, text: string): Update {
     update_id,
     message: {
       message_id: update_id,
-      chat: { id: CHAT_ID, type: 'supergroup', title: 'ProductOS', is_forum: true },
-      from: { id: USER_ID, is_bot: false, first_name: 'Ken' },
+      chat: { id: CHAT_ID, type: 'supergroup', title: 'Example Supergroup', is_forum: true },
+      from: { id: USER_ID, is_bot: false, first_name: 'Alice' },
       date: 1784837004,
       text,
     },

package/telegram-plugin/tests/forwarded-rich-message.test.ts

@@ -85,13 +85,13 @@ function buildHarness() {
  * forward_origin (modern) + legacy forward_from/forward_date siblings +
  * rich_message content, NO top-level text/caption. */
 function makeForwardedRichUpdate(update_id: number, blocks: unknown[]): Update {
-  const originUser = { id: 8500000001, is_bot: true, first_name: 'Klanker', username: 'meken_klanker_bot' }
+  const originUser = { id: 8500000001, is_bot: true, first_name: 'Sidekick', username: 'example_sidekick_bot' }
   return {
     update_id,
     message: {
       message_id: 944,
-      chat: { id: -1004223464247, type: 'supergroup', title: 'ProductOS', is_forum: true },
-      from: { id: 777, is_bot: false, first_name: 'Ken' },
+      chat: { id: -1004444444444, type: 'supergroup', title: 'Example Supergroup', is_forum: true },
+      from: { id: 777, is_bot: false, first_name: 'Alice' },
       date: 1784837003,
       forward_origin: { type: 'user', date: 1784830000, sender_user: originUser },
       forward_from: originUser,
@@ -142,12 +142,12 @@ describe('forwarded rich (bot) message — the row-944 regression oracle', () =>
       (update as unknown as { message: { forward_origin: never } }).message.forward_origin,
     )
     const meta = buildForwardOriginMeta([origin!])
-    expect(meta.forwarded_from).toBe('Klanker (@meken_klanker_bot)')
+    expect(meta.forwarded_from).toBe('Sidekick (@example_sidekick_bot)')
     expect(meta.forwarded_from_type).toBe('user')
     expect(meta.forwarded_date).toBeDefined()
     // Trusted-lane separation (#3162): the delivered BODY carries no
     // provenance strings — those live only in the channel attrs.
-    expect(delivered[0].text).not.toContain('Klanker')
+    expect(delivered[0].text).not.toContain('Sidekick')
   })
 
   it('a rich message with genuinely no extractable text still yields an honest turn', async () => {
@@ -175,7 +175,7 @@ describe('forwarded rich (bot) message — the row-944 regression oracle', () =>
       message: {
         message_id: 950,
         chat: { id: 777, type: 'private' },
-        from: { id: 777, is_bot: false, first_name: 'Ken' },
+        from: { id: 777, is_bot: false, first_name: 'Alice' },
         date: 1784837100,
         rich_message: { blocks: [{ type: 'heading', size: 2, text: 'Release plan' }, { type: 'paragraph', text: 'Ship Friday.' }] },
       },
@@ -196,14 +196,14 @@ describe('working shapes stay unchanged (no regression on existing forwards)', (
     msg.forward_origin = {
       type: 'user',
       date: 1_700_000_000,
-      sender_user: { id: 424242, is_bot: false, first_name: 'Ken', last_name: 'Thompson' },
+      sender_user: { id: 424242, is_bot: false, first_name: 'Alice', last_name: 'Example' },
     }
     await bot.handleUpdate(update)
 
     expect(delivered).toHaveLength(1)
     expect(delivered[0]).toMatchObject({ via: 'text', text: 'here is the brief I forwarded' })
     const meta = buildForwardOriginMeta([parseForwardOrigin(msg.forward_origin as never)!])
-    expect(meta.forwarded_from).toBe('Ken Thompson')
+    expect(meta.forwarded_from).toBe('Alice Example')
     expect(meta.forwarded_date).toBeDefined()
   })
 

package/telegram-plugin/tests/history.test.ts

@@ -546,6 +546,84 @@ describe('hasOutboundDeliveredSince', () => {
       expect(hasOutboundDeliveredSince('-100', openedAt, 6, 1)).toBe(false)
     })
   })
+
+  // #4681 — the optional UPPER bound. The obligation escalate branch's reroute
+  // fallback is licensed by an `EXPLICIT_OVERRIDDEN` record, which is evidence
+  // about ONE instant; an open-ended forward query lets unrelated traffic in the
+  // routed topic, arriving arbitrarily later, read as that record's answer and
+  // close a genuinely unanswered obligation in silence.
+  describe('untilMs parameter (the reroute fallback upper bound)', () => {
+    it('omitted, the query stays open-ended forward (pre-existing behaviour)', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_090_000, // 90_000s later
+      })
+      expect(hasOutboundDeliveredSince('-100', openedAt)).toBe(true)
+    })
+
+    it('excludes a row delivered AFTER the bound', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_090, // 90s after the lower bound
+      })
+      // Inside an 18.5s window it cannot be this record's answer.
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 200, openedAt + 18_500)).toBe(
+        false,
+      )
+    })
+
+    it('includes a row inside the bound, and the boundary second itself', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_018, // 18s after — inside an 18.5s window
+      })
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 200, openedAt + 18_500)).toBe(
+        true,
+      )
+      // The bound is CEILed to whole seconds, so a row written in the second the
+      // bound falls inside is admitted — rounding never drops a real answer.
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 200, openedAt + 17_600)).toBe(
+        true,
+      )
+    })
+
+    it('composes with the thread filter (parameter binding order)', () => {
+      // The `ts <= ?` placeholder is appended BEFORE `thread_id = ?`; if the two
+      // params were pushed in the wrong order the thread id would land in the
+      // timestamp comparison and this would silently misbehave.
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: 5,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_010,
+      })
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: 6,
+        message_ids: [11],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_090,
+      })
+      const until = openedAt + 18_500
+      expect(hasOutboundDeliveredSince('-100', openedAt, 5, 200, until)).toBe(true)
+      expect(hasOutboundDeliveredSince('-100', openedAt, 6, 200, until)).toBe(false) // too late
+      expect(hasOutboundDeliveredSince('-100', openedAt, 6, 200)).toBe(true) // unbounded finds it
+    })
+  })
 })
 
 // Review finding H5 regression: the original PRIMARY KEY (chat_id, thread_id, message_id) does

package/telegram-plugin/tests/multitopic-routing-wiring.test.ts

@@ -26,7 +26,12 @@ const gatewaySrc =
   // P7 PR-10 (#2996): the InboundMessage envelope assembly (origin_turn_id,
   // topic_scope, meta lane) moved verbatim into gateway/inbound-router.ts
   // (buildInboundEnvelope) — include it in the scraped corpus.
-  readFileSync(resolve(__dirname, '..', 'gateway', 'inbound-router.ts'), 'utf-8')
+  readFileSync(resolve(__dirname, '..', 'gateway', 'inbound-router.ts'), 'utf-8') +
+  '\n' +
+  // The reply-route telemetry line (via/RECOVERED/UNROUTED/MISROUTE_RISK/
+  // CROSS_CHAT_ANCHOR_DROPPED) moved verbatim out of resolveAnswerThreadWithLog
+  // into the pure formatReplyRouteLog (#2996 line ratchet) — scrape it too.
+  readFileSync(resolve(__dirname, '..', 'gateway', 'reply-route-log.ts'), 'utf-8')
 // #2996 P4-A: the enqueue handler (turn ctor: `const turnId = deriveTurnId`,
 // `rememberRecentTurn(next)`, `promoteQueuedStatus`) moved VERBATIM into
 // stream-render.ts with handleSessionEvent. Enqueue-seam assertions span both.
@@ -147,6 +152,29 @@ describe('framework-owned origin recovery (determinism residual, 2026-06-05)', (
     expect(gatewaySrc).toMatch(/via === 'quoted' \? ' QUOTED\(framework-origin\)' : ''/)
   })
 
+  it('a thread anchor from ANOTHER chat is dropped before it can be sent (cross-chat guard)', () => {
+    // The routing input carries the target + anchor chat ids, so the pure
+    // resolver can refuse a foreign anchor (Telegram 400 "message thread not
+    // found"). Behaviour is asserted in answer-thread-resolve.test.ts; this
+    // pins the WIRING so a refactor cannot silently stop passing them.
+    //
+    // NOT A SAFETY NET — read before relying on it. Like its ~20 siblings in
+    // this file, this is a source-text CALL-SITE RATCHET: it greps gateway.ts
+    // for the argument spellings. Mutating `isCrossChatAnchor` to
+    // `return false` leaves every assertion here GREEN (verified), because the
+    // call site is still spelled the same way. The behavioural oracles are
+    // `answer-thread-resolve.test.ts` (the pure predicate + precedence),
+    // `reply-route-log.test.ts` (the telemetry), and the
+    // `SWITCHROOM_TURN_ORIGIN_ROUTING=0` block in `send-reply-golden.test.ts`
+    // (the legacy branch, at the wire). Those are what fail on a broken guard.
+    const fn = gatewaySrc.split('function resolveAnswerThreadWithLog')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/targetChatId: chatId/)
+    expect(fn).toMatch(/originChatId: originTurn\?\.sessionChatId/)
+    expect(fn).toMatch(/liveChatId: liveTurn\?\.sessionChatId/)
+    // And the dropped anchor is observable, with both chat ids on the line.
+    expect(gatewaySrc).toMatch(/CROSS_CHAT_ANCHOR_DROPPED\(target=/)
+  })
+
   it('the kill switch defaults ON and is independent of TURN_ORIGIN_ROUTING', () => {
     expect(gatewaySrc).toMatch(/SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'/)
   })

package/telegram-plugin/tests/orphaned-db-sweep.test.ts

@@ -106,7 +106,13 @@ import {
   runOrphanedDbSweepTick,
   startOrphanedDbSweep,
 } from '../gateway/orphaned-db-sweep.js'
-import { GATEWAY_SIGNATURES } from '../../src/fleet-health/detect.js'
+import { GATEWAY_SIGNATURES, detectGatewayFindings } from '../../src/fleet-health/detect.js'
+import { mapSignal } from '../../src/fleet-health/mapping.js'
+
+/** Severity the fleet-health ledger would book for a real sweep log. */
+function ledgerSeverities(log: string): number[] {
+  return detectGatewayFindings('uat', log).findings.map((f) => mapSignal(f.signal).severity)
+}
 
 /**
  * `/proc/self/fd` is Linux-only. Without this guard every detection test would
@@ -294,6 +300,13 @@ describe.skipIf(!onLinux)('orphaned-db-sweep — history.db recovery', () => {
     // alarm has no consumer.
     expect(GATEWAY_SIGNATURES['orphaned-db-handle'].test(log)).toBe(true)
 
+    // #4680 — but this tick RECOVERED: the reopen landed in the same tick and
+    // the writer self-check proved the handle durable. The ledger must book
+    // that as the informational lane, not a severity-3 silent-loss incident.
+    // Asserted against the REAL sweep output, so a wording change in either the
+    // emitter or the detector fails here instead of drifting silently.
+    expect(ledgerSeverities(log)).toEqual([1])
+
     // 7. THE FIX, half one: the deleted-inode handles are actually GONE. A
     //    close that leaves un-finalized statements behind leaves them open
     //    (measured), so this is the assertion that pins the hard close.
@@ -439,6 +452,9 @@ describe.skipIf(!onLinux)('orphaned-db-sweep — registry.db and unowned lanes',
       expect(log).toContain('registry.db')
       expect(log).toContain('RESTART')
       expect(GATEWAY_SIGNATURES['orphaned-db-handle'].test(log)).toBe(true)
+      // #4680 — the registry lane has NO in-process recovery, so it stays the
+      // severity-3 alarm. This is the half of the split that must not be lost.
+      expect(ledgerSeverities(log)).toEqual([3])
 
       // Detection ONLY: the raw handle is left alone, so its consumers (the
       // by-value `turnsDb` captures in gateway.ts) are never handed a closed DB.

package/telegram-plugin/tests/render/html-dialect-content-loss.test.ts

@@ -1,9 +1,17 @@
 // Outcome tests for the content-loss regressions found in the raw-HTML
 // dialect fold (#4691, merged as fa9018a7, unreleased).
 //
-// Every assertion here FAILS on fa9018a7. They drive the real `renderOutbound`
-// (`parse` -> `renderSafe`), i.e. exactly what the live send path calls, so
-// they assert the WIRE OUTCOME rather than an internal code path.
+// 29 of the 37 tests here fail on fa9018a7 — measured by running this exact
+// file against that revision, not asserted. The other 8 pass on both and are
+// guards: they pin behaviour the fix must not disturb. (An earlier revision of
+// this header claimed "every assertion fails on fa9018a7"; at 31 tests the
+// true figure was 23.) Five of the 29 — the `<pre>` fence-width cases — also
+// fail on 6c120cee, the first fix's own merge commit, which emitted a
+// hardcoded three-backtick fence.
+//
+// They drive the real `renderOutbound` (`parse` -> `renderSafe`), i.e. exactly
+// what the live send path calls, so they assert the WIRE OUTCOME rather than
+// an internal code path.
 //
 // The through-line: fa9018a7's degrade bucket DELETED any token it could not
 // fold or pass through. That is safe for markup but catastrophic for prose —
@@ -111,6 +119,71 @@ describe("MAJOR 1: `<pre>` folds to a fenced block, not a broken code span", ()
     expect(render("# a <pre>x</pre> b")).toBe("# a `x` b");
     expect(render("| h |\n| --- |\n| <pre>x</pre> |")).toContain("| `x` |");
   });
+
+  // ── Regression: the fold's fence must be WIDER than its own body ────────
+  // `buildPreBlock` emitted a hardcoded three-backtick delimiter as a `raw`
+  // node (verbatim wire passthrough — nothing downstream widens it). A `<pre>`
+  // whose body carried its own ``` therefore shipped THREE delimiters: the
+  // wire opens at #1, closes at #2, reads the remainder as prose, and #3 opens
+  // a fence that never terminates -> `can't find end of Pre entity` 400 and a
+  // whole-message plain-text resend. `fa9018a7` escaped the backticks instead
+  // — cosmetically worse, but wire-correct; this restores wire-correctness
+  // using the same width rule `renderCodeBlock` already applies.
+  it("widens the fence past a three-backtick run in the body", () => {
+    expect(render("<pre>\na\n```\nb\n</pre>")).toBe("````\na\n```\nb\n````");
+  });
+
+  it("widens the fence past a longer run than three", () => {
+    expect(render("<pre>\na\n````\nb\n</pre>")).toBe("`````\na\n````\nb\n`````");
+    expect(render("<pre>\na\n`````\nb\n</pre>")).toBe(
+      "``````\na\n`````\nb\n``````",
+    );
+  });
+
+  it("widens past a run that shares a line with other text", () => {
+    expect(render("<pre><code>x ``` y</code></pre>")).toBe(
+      "````\nx ``` y\n````",
+    );
+  });
+
+  it("still emits a plain three-backtick fence when the body has no run", () => {
+    // The widening must not inflate the common case.
+    expect(render("<pre>\nplain body\n</pre>")).toBe("```\nplain body\n```");
+    expect(render("<pre>\na ` b `` c\n</pre>")).toBe("```\na ` b `` c\n```");
+  });
+
+  it("keeps the language hint attached to the widened delimiter", () => {
+    expect(
+      render('<pre><code class="language-md">see ```\n</code></pre>'),
+    ).toBe("````md\nsee ```\n````");
+  });
+
+  it("emits a terminating fence for every inner backtick run length", () => {
+    // Outcome, not shape: whatever the body carries, the delimiter run must
+    // appear on exactly TWO lines (open and close) and be strictly longer than
+    // every run inside, so the wire can neither close it early nor leave it
+    // open. This is the property whose violation produced the 400.
+    for (const inner of ["```", "````", "`````", "` `` ```", "a```b", "```` x"]) {
+      const src = `<pre>\nhead\n${inner}\ntail\n</pre>`;
+      const out = render(src);
+      const lines = out.split("\n");
+      const delim = lines[0];
+      expect(delim, `open delimiter for ${JSON.stringify(inner)}`).toMatch(
+        /^`{3,}$/,
+      );
+      expect(lines[lines.length - 1], `close delimiter for ${inner}`).toBe(
+        delim,
+      );
+      // Every backtick run in the BODY is strictly shorter than the delimiter.
+      const body = lines.slice(1, -1).join("\n");
+      for (const run of body.match(/`+/g) ?? []) {
+        expect(
+          run.length,
+          `body run ${JSON.stringify(run)} vs delimiter ${delim}`,
+        ).toBeLessThan(delim.length);
+      }
+    }
+  });
 });
 
 describe("MAJOR 2: structural tags do not glue their content together", () => {

package/telegram-plugin/tests/send-reply-golden.test.ts

@@ -31,7 +31,7 @@
  *   - structural: gateway constructs EXACTLY ONE OutboundDedupCache and the
  *     extracted module constructs NONE (the re-`new` hard-fail rule)
  */
-import { describe, it, expect, afterEach } from 'vitest'
+import { describe, it, expect, afterEach, vi } from 'vitest'
 import { GrammyError } from 'grammy'
 import { readFileSync, mkdtempSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -209,6 +209,17 @@ function makeHarness(opts?: {
   failNext?: Partial<Record<string, unknown[]>>
   voicePlan?: VoiceOutPlan | null
   synth?: (plan: { ttsText: string }) => Promise<Uint8Array | null>
+  /** `SWITCHROOM_TURN_ORIGIN_ROUTING !== '0'` — the gateway's turn-origin
+   *  routing kill switch. Default true (the shipped default); pass false to
+   *  drive the legacy `resolveThreadId` branch. */
+  turnOriginRouting?: boolean
+  /** Backing store for the `resolveThreadId` stub's last-seen fallback — the
+   *  real resolver (`gateway.ts`, `resolveThreadId`) is
+   *  `if (explicit != null) return Number(explicit); return chatThreadMap.get(chat_id)`,
+   *  so a case that cares about what a DROPPED anchor falls through TO must
+   *  populate this. Omitted → empty map → the fallback misses, which is the
+   *  behaviour every pre-existing case here assumes. */
+  chatThreadMap?: Map<string, number>
 }): Harness {
   const { api, calls } = makeFakeBot(opts?.failNext)
   const dedup = opts?.dedup ?? new OutboundDedupCache()
@@ -237,7 +248,7 @@ function makeHarness(opts?: {
     getCurrentTurn,
     getLastActiveTurnChatId: () => undefined,
     HISTORY_ENABLED: false,
-    TURN_ORIGIN_ROUTING_ENABLED: true,
+    TURN_ORIGIN_ROUTING_ENABLED: opts?.turnOriginRouting ?? true,
     AUTOCLASSIFY_MIDTURN_SHADOW: false,
     MAX_ATTACHMENT_BYTES: 50 * 1024 * 1024,
     MAX_CHUNK_LIMIT: 4096,
@@ -265,7 +276,12 @@ function makeHarness(opts?: {
     findTurnByOriginId: () => null,
     findTurnByQuotedMessageId: () => null,
     resolveAnswerThreadWithLog: (_c, explicit) => explicit,
-    resolveThreadId: (_c, explicit) => (explicit != null ? Number(explicit) : undefined),
+    // Mirrors the real `resolveThreadId` (`gateway.ts`): explicit wins, else
+    // the chat's LAST-SEEN topic from `chatThreadMap`. The map is per-harness
+    // and chat-scoped, so a dropped cross-chat anchor falls through to the
+    // TARGET chat's own last-seen topic — never to the anchor chat's.
+    resolveThreadId: (c, explicit) =>
+      explicit != null ? Number(explicit) : (opts?.chatThreadMap?.get(c) ?? undefined),
     getLatestInboundMessageId: () => null,
     recordOutbound: () => effects.push('recordOutbound'),
     emissionAuthorityFor: () =>
@@ -2127,3 +2143,176 @@ describe('#4176 — a BACKGROUND SUB-AGENT reply can never silently edit over a
     expect(sendSrc).toContain('subagentCouldOwnReply,')
   })
 })
+
+// ── cross-chat thread anchor, kill-switch branch (bug c) ──────────────────
+//
+// The default (`TURN_ORIGIN_ROUTING_ENABLED: true`) branch resolves the thread
+// through `resolveAnswerThreadWithLog`, which drops a wrong-chat anchor inside
+// `resolveAnswerThreadId`. The legacy branch (`SWITCHROOM_TURN_ORIGIN_ROUTING=0`)
+// does NOT go through that resolver at all — it passes the pinned turn's
+// `sessionThreadId` straight into `resolveThreadId`. When the pinned turn
+// belongs to a DIFFERENT chat (the routine multi-chat case: one sequential CLI,
+// a singleton live turn, replies fanning out to several chats) that hands chat
+// B's topic id to a send into chat A, and Telegram answers
+// `400 Bad Request: message thread not found` — the exact failure the guard
+// exists to prevent, still reachable behind the switch.
+//
+// These drive the REAL `sendReply` and assert on the `message_thread_id` the
+// send-path actually put on the wire, so they fail on the bug rather than on a
+// refactor of how the decision is spelled.
+//
+// What the drop resolves TO: dropping the anchor does NOT mean "no thread id".
+// The legacy branch still calls `resolveThreadId`, whose real body
+// (`gateway.ts`) is `explicit ?? chatThreadMap.get(chat_id)` — so a dropped
+// anchor falls through to the TARGET chat's own last-seen topic. That fallback
+// is chat-scoped, so it can only ever yield a topic id valid for chat A; the
+// class of failure the guard closes (chat B's topic on a send into chat A →
+// `400 message thread not found`) stays closed either way. Cases below cover
+// BOTH ends: an empty map (fallback misses → undefined) and a populated one
+// (fallback hits → chat A's topic).
+describe('kill switch SWITCHROOM_TURN_ORIGIN_ROUTING=0 still drops a cross-chat anchor', () => {
+  const OTHER_CHAT = '2002'
+
+  /** A live turn pinned at executeReply entry, owned by `chatId`. */
+  function turnFor(chatId: string, threadId: number | undefined): CurrentTurn {
+    return {
+      turnId: `turn-${chatId}`,
+      sessionChatId: chatId,
+      sessionThreadId: threadId,
+      replyCalled: false,
+    } as unknown as CurrentTurn
+  }
+
+  const threadOnWire = (h: Harness): unknown =>
+    h.calls.filter((c) => c.method === 'sendRichMessage')[0]!.opts.message_thread_id
+
+  it('a reply into chat A pinned to a chat-B forum turn does NOT carry chat B\'s ' +
+    'topic id — with no last-seen topic for chat A it resolves to no thread', async () => {
+    // Empty `chatThreadMap`: the post-drop `resolveThreadId` fallback misses,
+    // so the wire carries no thread. This is the fallback-misses END of the
+    // behaviour, not the whole of it — see the populated-map case below.
+    const h = makeHarness({ turnOriginRouting: false })
+    const res = await sendReply(
+      h.deps,
+      req('The answer to the question asked in chat A.', {}, turnFor(OTHER_CHAT, 77)),
+    )
+    const sends = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(sends).toHaveLength(1)
+    expect(sends[0]!.chat_id).toBe(CHAT)
+    // Pre-fix this is 77 — chat B's topic id on a send into chat A.
+    expect(threadOnWire(h)).toBeUndefined()
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+  })
+
+  it('the dropped anchor falls through to the TARGET chat\'s last-seen topic, ' +
+    'not to no-thread: chat A last saw topic 12 → the send lands in A/12', async () => {
+    // The production shape the empty-map case above cannot show: the agent is
+    // live in supergroup B (topic 77) and replies into forum chat A, whose
+    // `chatThreadMap` last saw topic 12. Dropping B's anchor hands the decision
+    // to `resolveThreadId`, which is chat-scoped — so the send lands in A's own
+    // topic 12. 77 on the wire here would be the `400 message thread not found`
+    // the guard exists to prevent.
+    const h = makeHarness({
+      turnOriginRouting: false,
+      chatThreadMap: new Map([[CHAT, 12], [OTHER_CHAT, 77]]),
+    })
+    const res = await sendReply(
+      h.deps,
+      req('Late answer into chat A.', {}, turnFor(OTHER_CHAT, 77)),
+    )
+    const sends = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(sends).toHaveLength(1)
+    expect(sends[0]!.chat_id).toBe(CHAT)
+    expect(threadOnWire(h)).toBe(12)
+    expect(threadOnWire(h)).not.toBe(77)
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+  })
+
+  it('an explicit message_thread_id from the model does NOT rescue a cross-chat ' +
+    'anchor — but it is still honoured on its own', async () => {
+    // Explicit wins in the legacy branch, so it must survive untouched.
+    const h = makeHarness({ turnOriginRouting: false })
+    await sendReply(
+      h.deps,
+      req('Explicit thread.', { message_thread_id: '31' }, turnFor(OTHER_CHAT, 77)),
+    )
+    expect(threadOnWire(h)).toBe(31)
+  })
+
+  it('BACK-COMPAT: a SAME-chat forum turn still lends its topic id (the guard ' +
+    'must not over-fire and strip legitimate topic routing)', async () => {
+    const h = makeHarness({ turnOriginRouting: false })
+    await sendReply(h.deps, req('Same-chat topic reply.', {}, turnFor(CHAT, 77)))
+    expect(threadOnWire(h)).toBe(77)
+  })
+
+  it('BACK-COMPAT: no pinned turn at all → no thread id, unchanged', async () => {
+    const h = makeHarness({ turnOriginRouting: false })
+    await sendReply(h.deps, req('Orphaned proactive send.'))
+    expect(threadOnWire(h)).toBeUndefined()
+  })
+
+  // ── telemetry parity with the flag-on path ──────────────────────────────
+  //
+  // The flag-ON branch emits `CROSS_CHAT_ANCHOR_DROPPED(...)` through
+  // `resolveAnswerThreadWithLog` → `formatReplyRouteLog`. Without the same line
+  // here, a deployment running `SWITCHROOM_TURN_ORIGIN_ROUTING=0` silently
+  // loses the audit trail the rest of this fix is built on: the drop still
+  // happens, but nothing records that it did. The line is built by the SAME
+  // `formatReplyRouteLog` — there is exactly one authoritative implementation.
+  describe('telemetry: the legacy-branch drop is not silent', () => {
+    const captureStderr = (): { lines: string[]; restore: () => void } => {
+      const lines: string[] = []
+      const spy = vi
+        .spyOn(process.stderr, 'write')
+        .mockImplementation(((chunk: unknown) => {
+          lines.push(String(chunk))
+          return true
+        }) as unknown as typeof process.stderr.write)
+      return { lines, restore: () => spy.mockRestore() }
+    }
+
+    it('emits CROSS_CHAT_ANCHOR_DROPPED naming both chats and what it routed to', async () => {
+      const h = makeHarness({
+        turnOriginRouting: false,
+        chatThreadMap: new Map([[CHAT, 12]]),
+      })
+      const cap = captureStderr()
+      try {
+        await sendReply(h.deps, req('Late answer into chat A.', {}, turnFor(OTHER_CHAT, 77)))
+      } finally {
+        cap.restore()
+      }
+      const line = cap.lines.find((l) => l.includes('CROSS_CHAT_ANCHOR_DROPPED('))
+      expect(line).toBeDefined()
+      // Same marker shape the flag-on path emits: target chat, the anchor's
+      // chat + topic, and the thread the send actually routed to.
+      expect(line).toContain('reply-route surface=reply')
+      expect(line).toContain(`chat=${CHAT}`)
+      expect(line).toContain(`live_chat=${OTHER_CHAT}`)
+      expect(line).toContain('live_thread=77')
+      expect(line).toContain('routed→12')
+    })
+
+    // NEGATIVE CONTROL (green against the pre-fix code by construction — the
+    // pre-fix branch emits nothing at all). It earns its place under mutation:
+    // asserting on the whole `reply-route` line rather than just the marker is
+    // what makes it fail an UNCONDITIONAL emit, the plausible wrong shape here.
+    // (Asserting only "no CROSS_CHAT_ANCHOR_DROPPED" would NOT — the formatter
+    // omits the marker for a same-chat anchor anyway, so that weaker assertion
+    // passes for a conditional and an unconditional emit alike.) The legacy
+    // branch is a kill-switch path: it must stay byte-silent on the ordinary
+    // send it exists to serve, and only speak when it drops something.
+    it('stays silent on a SAME-chat anchor — no drop, and no reply-route line at all', async () => {
+      const h = makeHarness({ turnOriginRouting: false })
+      const cap = captureStderr()
+      try {
+        await sendReply(h.deps, req('Same-chat topic reply.', {}, turnFor(CHAT, 77)))
+      } finally {
+        cap.restore()
+      }
+      expect(cap.lines.some((l) => l.includes('CROSS_CHAT_ANCHOR_DROPPED'))).toBe(false)
+      expect(cap.lines.some((l) => l.includes('reply-route surface='))).toBe(false)
+    })
+  })
+})

package/telegram-plugin/tests/status-pin.test.ts

@@ -404,7 +404,7 @@ describe('unified reconcile path — pin-rights 400 must never crash (marko 2026
     // rejection to the process.
     const next = await reconcilePin({
       api,
-      chatId: '-1003831053471',
+      chatId: '-1001234567890',
       prevState: null,
       desired: { pinned: true, messageId: 4 },
       onError: (phase, err) =>
@@ -437,7 +437,7 @@ describe('unified reconcile path — pin-rights 400 must never crash (marko 2026
       // Fire-and-forget, exactly as the gateway's auto-pin callsites do.
       void reconcilePin({
         api,
-        chatId: '-1003831053471',
+        chatId: '-1001234567890',
         prevState: null,
         desired: { pinned: true, messageId: 4 },
         onError: () => {},

package/telegram-plugin/tests/subagent-handback-inbound-builder.test.ts

@@ -182,7 +182,7 @@ describe('buildSubagentHandbackInbound — meta.chat_id turn registration (msg-6
   it('carries the origin chat as meta.chat_id so the handback turn mints a turn atom', () => {
     const inbound = buildSubagentHandbackInbound({
       ctx: {
-        chatId: '-1004223464247',
+        chatId: '-1004444444444',
         threadId: 77,
         taskDescription: 'Topic-dispatched work',
         resultText: 'done',
@@ -190,7 +190,7 @@ describe('buildSubagentHandbackInbound — meta.chat_id turn registration (msg-6
       },
       nowMs: FIXED_NOW,
     })
-    expect(inbound.meta.chat_id).toBe('-1004223464247')
+    expect(inbound.meta.chat_id).toBe('-1004444444444')
     // The thread carrier must still ride alongside — chat_id + thread_id is
     // the full origin surface the minted turn (and any worker dispatched
     // inside it) inherits.

package/telegram-plugin/tests/subagent-progress-inbound-builder.test.ts

@@ -364,7 +364,7 @@ describe('buildSubagentProgressInbound — meta.chat_id turn registration (msg-6
   it('carries the origin chat as meta.chat_id', () => {
     const inbound = buildSubagentProgressInbound({
       ctx: {
-        chatId: '-1004223464247',
+        chatId: '-1004444444444',
         threadId: 77,
         subagentJsonlId: 'stem1',
         taskDescription: 'Topic work',
@@ -375,7 +375,7 @@ describe('buildSubagentProgressInbound — meta.chat_id turn registration (msg-6
       },
       nowMs: 1_700_000_000_000,
     })
-    expect(inbound.meta.chat_id).toBe('-1004223464247')
+    expect(inbound.meta.chat_id).toBe('-1004444444444')
     expect(inbound.meta.message_thread_id).toBe('77')
   })
 })