switchroom 0.21.8 → 0.21.9

package/telegram-plugin/rich-send.ts

@@ -54,16 +54,31 @@ export interface InputRichMessageMarkdown {
  * guards is disjoint in the characters it inspects AND the characters it
  * inserts (`\_ \* \> \. \~ \=\= \|\|` vs `\$`), so no other insertion can
  * create or destroy a signal for a sibling. Verified by composition tests.
+ *
+ * Intentional inline math (`$x^2+y^2$`, a native Telegram construct) is
+ * PROTECTED from every sub-guard: `splitProtectedSegments` treats a compact
+ * non-currency `$…$` span like a code span (see code-segments.ts), so the
+ * dollar guard neither counts nor escapes its `$` and the emphasis/caret
+ * guards never rewrite its interior.
  */
 export function guardAccidentalFormatting(markdown: string): string {
   let out = markdown
-  // Repair Telegram-unrenderable tokens FIRST: `<details>` folds into a `**> `
-  // expandable blockquote whose `> `-with-space lines are invisible to the
-  // block-construct guard (which only escapes space-LESS `>digit`/`>=`), and
-  // `**> ` is the exact marker switchroom's own render path emits — so the
-  // downstream emphasis/block guards treat it identically to a native
-  // expandable quote. Caret/footnote removal inserts no trigger char for any
-  // sibling guard, so this pass neither creates nor destroys their signals.
+  // Repair Telegram-unrenderable tokens FIRST. This pass now strips ONLY caret
+  // pairs (`^x^` → `x`): removing a `^` inserts no trigger char for any
+  // sibling guard, so it neither creates nor destroys their signals.
+  //
+  // What this pass deliberately NO LONGER does (wire-verified 2026-08-13 by
+  // raw `sendRichMessage` probes): it used to fold `<details>` into a `**> `
+  // "expandable blockquote" and delete footnote markers `[^1]`. Both beliefs
+  // were false — `<details><summary>` and footnotes are NATIVE rich-markdown
+  // constructs (typed `details` / footnote nodes on the wire), while `**>` is
+  // MarkdownV2-only syntax the rich path renders as LITERAL `**>` text. The
+  // conversion destroyed a supported construct to emit an unsupported one, so
+  // it is deleted. `<details>`, footnotes, `<sub>`/`<sup>`/`<u>`, `<aside>`,
+  // `tg://` links and task lists all pass through every guard untouched: none
+  // of `< > [ ] : /` is a trigger char for the emphasis / heading /
+  // block-construct / inline-pair / dollar guards ('composition' tests cover
+  // this interaction).
   out = guardUnsupportedTokens(out)
   out = guardAccidentalEmphasis(out)
   out = guardAccidentalHeading(out)

package/telegram-plugin/shared/bot-runtime.ts

@@ -251,8 +251,9 @@ export function installTgPostLogger(bot: Bot): void {
  * call site, `ctx.*` sugar, `lockedBot`, or `bot.api.raw`, so it closes the
  * whole bypass class deterministically.
  *
- * Payload shape (verified against grammy 1.44.0 `out/core/api.js`, the pinned
- * lockfile version):
+ * Payload shape (verified against grammy 1.45.1 `out/core/api.js`, the pinned
+ * lockfile version — byte-identical to the 1.44.0 shape this was originally
+ * written against, re-checked on the 1.45.1 bump):
  *   - `sendRichMessage(chat_id, rich_message, ...)` → raw payload
  *     `{ chat_id, rich_message: { markdown }, ... }`
  *   - `editMessageText(chat_id, message_id, arg, ...)` → raw payload

package/telegram-plugin/telegraph.ts

@@ -193,10 +193,12 @@ export async function createTelegraphPage(
 }
 
 /**
- * A blockquote line: a plain `> ` marker OR the expandable-blockquote opener
- * `**> ` (Bot API 10.1 syntax the switchroom render path emits on the first
- * line of an expandable quote — see `render/render.ts` and
- * `reference/telegram-formatting-guide.md`). Telegra.ph has no collapsible
+ * A blockquote line: a plain `> ` marker OR the LEGACY expandable-blockquote
+ * opener `**> ` (a switchroom encoding once believed to be Bot API 10.1
+ * syntax; wire probes 2026-08-13 showed the rich path renders `**>` as
+ * literal text, so `render/render.ts` no longer emits it — but legacy agent
+ * output still contains it and it must be tolerated on input here).
+ * Telegra.ph has no collapsible
  * blockquote tag, so an expandable quote degrades to a normal `<blockquote>`;
  * the `**` prefix must still be recognised and stripped here, else the
  * unterminated `**` renders as literal `**>` text and the `>` continuation

package/telegram-plugin/tests/grammy-rich-message-types.test.ts

@@ -0,0 +1,199 @@
+/**
+ * Compile-time contract for the grammy 1.44.0 → 1.45.1 bump
+ * (`@grammyjs/types` 3.28.0 → 4.0.0).
+ *
+ * Why this file exists
+ * --------------------
+ * 4.0.0 turned `InputRichMessage` from a plain interface into a GENERIC one:
+ *
+ *   3.28.0  `export interface InputRichMessage {`            (rich.d.ts:280)
+ *   4.0.0   `export interface InputRichMessage<F> {`         (rich.d.ts:283)
+ *
+ * `F` is the file-payload type threaded through the new Bot API 10.2 `blocks`
+ * / `media` fields. Switchroom never uses either — every outbound message is
+ * the plain `{ markdown }` shape (`rich-send.ts:96`), and the plugin defines
+ * its OWN local `InputRichMessageMarkdown` (`rich-send.ts:28`) rather than
+ * importing grammy's. So the bump is only safe as long as a bare
+ * `{ markdown: string }` literal still satisfies the generic parameter at
+ * every call site.
+ *
+ * That invariant is invisible to the rest of the suite for two reasons, and
+ * both are why this test spends ~1s on a real compile instead of asserting on
+ * runtime values:
+ *
+ *   1. Every send in the regression suite is MOCKED — no mock can notice that
+ *      a payload stopped typechecking.
+ *   2. The repo's `tsc --noEmit` does NOT cover this directory. The root
+ *      `tsconfig.json` `include` is `["src/**\/*.ts", "bin/**\/*.ts",
+ *      "scripts/**\/*.ts"]` — `telegram-plugin/` is absent, so a type error
+ *      here is invisible to `npm run lint` (verified empirically: a deliberate
+ *      `const x: number = "s"` in `rich-send.ts` leaves `tsc --noEmit` at exit
+ *      0). A plain `.ts` fixture would therefore be a NO-OP as a guard.
+ *
+ * So the check has to run the compiler itself. The negative controls below are
+ * load-bearing: if the harness ever silently stopped compiling (bad fixture
+ * path, unresolved `grammy`, swallowed diagnostics), the "must fail" cases
+ * would go green and this file goes red — it cannot rot into a vacuous pass.
+ */
+import { describe, it, expect, afterAll } from 'vitest'
+import ts from 'typescript'
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join, resolve } from 'node:path'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+// Fixtures must live INSIDE the repo tree: they `import 'grammy'`, and module
+// resolution walks up from the file to the hoisted root `node_modules`. A
+// fixture in `os.tmpdir()` would fail to resolve grammy and every case would
+// report a misleading "cannot find module" instead of the real answer.
+const fixtureDir = mkdtempSync(join(here, 'grammy-types-fixture-'))
+afterAll(() => rmSync(fixtureDir, { recursive: true, force: true }))
+
+/** Mirrors the compiler settings the plugin is actually authored against. */
+const COMPILER_OPTIONS: ts.CompilerOptions = {
+  target: ts.ScriptTarget.ES2022,
+  module: ts.ModuleKind.ESNext,
+  moduleResolution: ts.ModuleResolutionKind.Bundler,
+  strict: true,
+  // Matches the root tsconfig: we are asserting on OUR call shapes, not
+  // auditing grammy's own .d.ts files.
+  skipLibCheck: true,
+  noEmit: true,
+}
+
+/**
+ * Typecheck one fixture source and return its syntactic + semantic errors,
+ * formatted `TSxxxx: message`. Empty array means "compiles clean".
+ */
+function typecheck(name: string, source: string): string[] {
+  const file = resolve(fixtureDir, `${name}.ts`)
+  writeFileSync(file, source)
+  const program = ts.createProgram([file], COMPILER_OPTIONS)
+  return ts
+    .getPreEmitDiagnostics(program)
+    .filter((d) => d.file?.fileName === file.split('\\').join('/'))
+    .map((d) => `TS${d.code}: ${ts.flattenDiagnosticMessageText(d.messageText, ' ')}`)
+}
+
+describe('grammy rich-message input still accepts the plain { markdown } shape', () => {
+  it('accepts a bare { markdown } literal on sendRichMessage and editMessageText', () => {
+    expect(
+      typecheck(
+        'plain-literal',
+        `
+        import type { Bot } from 'grammy'
+        declare const bot: Bot
+        export async function send(): Promise<void> {
+          await bot.api.sendRichMessage(1, { markdown: 'hi' })
+          await bot.api.editMessageText(1, 2, { markdown: 'hi' })
+        }
+        `,
+      ),
+    ).toEqual([])
+  })
+
+  it("accepts the production helper's return type (rich-send.ts richMessage())", () => {
+    // The real seam: `richMessage()` returns the plugin's OWN local
+    // `InputRichMessageMarkdown`, which must stay structurally assignable to
+    // grammy's generic parameter. This is the assertion that would break if a
+    // future @grammyjs/types made `blocks`/`media` mandatory or constrained `F`.
+    expect(
+      typecheck(
+        'production-helper',
+        `
+        import type { Bot } from 'grammy'
+        import { richMessage } from '${join(here, '..', 'rich-send.js').split('\\').join('/')}'
+        declare const bot: Bot
+        export async function send(): Promise<void> {
+          await bot.api.sendRichMessage(1, richMessage('hi'))
+          await bot.api.editMessageText(1, 2, richMessage('hi'))
+        }
+        `,
+      ),
+    ).toEqual([])
+  })
+
+  it('still accepts a { markdown } payload through bot.api.raw', () => {
+    // `installRichMarkdownGuard` (shared/bot-runtime.ts) inspects the RAW
+    // payload `{ chat_id, rich_message: { markdown } }`, so pin that shape too.
+    expect(
+      typecheck(
+        'raw-payload',
+        `
+        import type { Bot } from 'grammy'
+        declare const bot: Bot
+        export async function send(): Promise<void> {
+          await bot.api.raw.sendRichMessage({ chat_id: 1, rich_message: { markdown: 'hi' } })
+        }
+        `,
+      ),
+    ).toEqual([])
+  })
+
+  // ── Negative controls: prove the harness has teeth ──────────────────────
+  // Without these, every assertion above would pass just as happily against a
+  // harness that had silently stopped compiling anything at all.
+
+  it('NEGATIVE CONTROL: rejects a wrongly-typed markdown field', () => {
+    const errors = typecheck(
+      'wrong-type',
+      `
+      import type { Bot } from 'grammy'
+      declare const bot: Bot
+      export async function send(): Promise<void> {
+        await bot.api.sendRichMessage(1, { markdown: 123 })
+      }
+      `,
+    )
+    expect(errors.join('\n')).toContain('TS2322')
+  })
+
+  it('NEGATIVE CONTROL: rejects an unknown field on the rich-message literal', () => {
+    const errors = typecheck(
+      'unknown-field',
+      `
+      import type { Bot } from 'grammy'
+      declare const bot: Bot
+      export async function send(): Promise<void> {
+        await bot.api.sendRichMessage(1, { markdwon: 'typo' })
+      }
+      `,
+    )
+    expect(errors.length).toBeGreaterThan(0)
+  })
+})
+
+describe('grammy supply-chain pin', () => {
+  // Assert on `bun.lock` rather than the resolved package: grammy's `exports`
+  // map deliberately hides `./package.json`, and the lockfile is the artifact
+  // CI actually installs from (`bun install --frozen-lockfile`), so it is both
+  // reachable and the more honest source of truth for what ships.
+  const lock = readFileSync(resolve(here, '..', '..', 'bun.lock'), 'utf8')
+
+  /** Pull the resolved version bun.lock pins for a package. */
+  function lockedVersion(pkg: string): string {
+    const escaped = pkg.replace('/', '\\/')
+    const m = new RegExp(`"${escaped}": \\["${escaped}@(\\d+\\.\\d+\\.\\d+)"`).exec(lock)
+    if (!m) throw new Error(`no bun.lock pin found for ${pkg}`)
+    return m[1]
+  }
+
+  // These assert a FLOOR, not an exact version: a later 1.46/5.x bump is a
+  // legitimate change and must not go red here for no substantive reason. What
+  // must never happen silently is a slide BACK below the floor — that would
+  // return @grammyjs/types to 3.28.0 and drop the Bot API 10.2 surface this
+  // bump exists to unlock, while every assertion above stayed green (the plain
+  // `{ markdown }` shape compiles under both).
+
+  it('keeps grammy at or above 1.45 (the floor that ships @grammyjs/types 4.x)', () => {
+    const [major, minor] = lockedVersion('grammy').split('.').map(Number)
+    expect(major).toBe(1)
+    expect(minor).toBeGreaterThanOrEqual(45)
+  })
+
+  it('keeps @grammyjs/types at or above the 4.x major grammy 1.45 depends on', () => {
+    const [major] = lockedVersion('@grammyjs/types').split('.').map(Number)
+    expect(major).toBeGreaterThanOrEqual(4)
+  })
+})

package/telegram-plugin/tests/render/dollar-math-guard.test.ts

@@ -160,3 +160,46 @@ describe("guardDollarMath — link / table awareness (findings 1 & 3)", () => {
     expect(out).not.toMatch(/(?<!\\)\$/);
   });
 });
+
+describe("guardDollarMath — intentional math spans are exempt (wire-verified 2026-08-13)", () => {
+  it("never escapes a compact `$…$` math span", () => {
+    // Telegram renders `$x^2+y^2$` as a native mathematical_expression node;
+    // escaping it destroys a SUPPORTED construct. On the pre-fix guard this
+    // input came back as `inline \$x^2+y^2\$ done`.
+    const s = "inline $x^2+y^2$ done";
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  it("math span dollars do not count toward the 2+ arming threshold", () => {
+    // Only ONE prose `$` outside the math span → can never pair → untouched.
+    const s = "solve $x^2+y^2$ for the $BUDGET case";
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  it("still escapes currency in the SAME message as an exempt math span", () => {
+    const out = guardDollarMath("sum $x^2+y^2$ costs $5 and $10");
+    expect(out).toContain("$x^2+y^2$");
+    expect(out).toContain("\\$5");
+    expect(out).toContain("\\$10");
+  });
+
+  it("a currency-shaped compact pair (`$5M-$10M`) is NOT treated as math", () => {
+    // The `$5M-$` inner run is digits/magnitude punctuation only — two
+    // adjacent amounts, the exact #3252 accident. Must still be escaped.
+    const out = guardDollarMath("the range is $5M-$10M this year");
+    expect(out).not.toMatch(/(?<!\\)\$/);
+  });
+
+  it("spaced `$…$` spans are NOT exempt (indistinguishable from currency prose)", () => {
+    // Documented residual: `$a + b$` cannot be told apart from two stray
+    // currency signs, so when a currency signal arms the guard it is escaped
+    // (renders as literal text — legible, not broken).
+    const out = guardDollarMath("we know $a + b$ plus $5 fees");
+    expect(out).not.toMatch(/(?<!\\)\$/);
+  });
+
+  it("is idempotent with a math span present", () => {
+    const once = guardDollarMath("sum $x^2+y^2$ costs $5 and $10");
+    expect(guardDollarMath(once)).toBe(once);
+  });
+});

package/telegram-plugin/tests/render/guard-composition.test.ts

@@ -135,4 +135,106 @@ describe("guardAccidentalFormatting composition (#3252)", () => {
     // And re-wrapping (streaming re-render) is byte-stable.
     expect(richMessage(wire.markdown).markdown).toBe(wire.markdown);
   });
+
+  // ── Wire-verified NATIVE constructs survive the FULL pipeline ────────────
+  // Raw sendRichMessage probes (2026-08-13) proved Telegram's rich markdown
+  // path natively renders `<details>`, `$…$` inline math, and footnotes. The
+  // pre-fix pipeline destroyed all three (details → the unsupported `**>`
+  // marker, `$x^2+y^2$` → `\$x^2+y^2\$`, `[^n1]` deleted) — each assertion
+  // below FAILS on that pipeline.
+  describe("native constructs pass through the full composed guard", () => {
+    it("<details open><summary> block survives byte-identical", () => {
+      const src = "<details open><summary>S</summary>\n\nbody\n\n</details>";
+      expect(guardAccidentalFormatting(src)).toBe(src);
+      expect(richMessage(src).markdown).toBe(src);
+    });
+
+    it("compact $math$ span survives byte-identical", () => {
+      const src = "inline $x^2+y^2$ done";
+      expect(guardAccidentalFormatting(src)).toBe(src);
+    });
+
+    it("footnote reference + definition survive byte-identical", () => {
+      const src = "claim[^n1]\n\n[^n1]: body";
+      expect(guardAccidentalFormatting(src)).toBe(src);
+    });
+
+    it("`**>` is never emitted for any input the pipeline repairs", () => {
+      const out = guardAccidentalFormatting(
+        "<details><summary>T</summary>\nbody\n</details>",
+      );
+      expect(out).not.toContain("**>");
+    });
+  });
+
+  // ── Guard-interaction cases for the now-passing-through constructs ───────
+  // Removing the old token conversions changes what the sibling guards see (a
+  // surviving `$`, a surviving `<`). These prove the emphasis / heading /
+  // block-construct / inline-pair / dollar guards do not mangle the natives,
+  // while their own repairs still fire in the SAME message.
+  describe("native constructs vs sibling guards (interaction)", () => {
+    it("math span is exempt while surrounding currency is still broken apart", () => {
+      const src = "sum $x^2+y^2$ costs $5 and $10 total";
+      const out = guardAccidentalFormatting(src);
+      // The math span reaches the wire byte-identical…
+      expect(out).toContain("$x^2+y^2$");
+      // …while the accidental currency pair is still defused (#3252).
+      expect(out).toContain("\$5");
+      expect(out).toContain("\$10");
+    });
+
+    it("currency-shaped adjacent amounts are NOT mistaken for math", () => {
+      // `$5M-$10M` has a whitespace-free `$…$` pair (`$5M-$`) — the currency
+      // shape must keep it guardable, else #3252 regresses.
+      const out = guardAccidentalFormatting("range is $5M-$10M this year");
+      expect(out).not.toMatch(/(?<!\\)\$/);
+    });
+
+    it("math span interior is protected from the emphasis and caret guards", () => {
+      // `a_b*c` inside math would trip the intra-word `_`/`*` escapes, and
+      // `^2y^` is an alphanumeric caret pair the token guard would strip —
+      // both must stay verbatim inside the protected span. The `_`/`*`
+      // OUTSIDE the span are still guarded — note the protected span's
+      // delimiters do NOT count toward the 2+ pairing threshold, so the
+      // prose needs its own pairable signals (`2*3 and 4*5`).
+      const src = "$a_b*c$ and file_name_here times 2*3 and 4*5";
+      const out = guardAccidentalFormatting(src);
+      expect(out).toContain("$a_b*c$");
+      expect(out).toContain("file\\_name\\_here");
+      expect(out).toContain("2\\*3");
+      expect(out).toContain("4\\*5");
+      expect(guardAccidentalFormatting("inline $x^2y^2$ done")).toBe(
+        "inline $x^2y^2$ done",
+      );
+    });
+
+    it("<details> lines are invisible to the line-start and heading guards", () => {
+      // A details block whose body carries genuine accidental signals: the
+      // guards must fire on the BODY prose without touching the tags.
+      const src =
+        "<details open><summary>Stats</summary>\n\n>2x growth and #1 priority\n\n</details>";
+      const out = guardAccidentalFormatting(src);
+      expect(out).toContain("<details open><summary>Stats</summary>");
+      expect(out).toContain("</details>");
+      // Line-start `>2x` and glued `#1` are still repaired inside the body.
+      expect(out).toContain("\>2x");
+      expect(out).toContain("\#1");
+    });
+
+    it("footnote markers survive alongside a firing dollar guard", () => {
+      const src = "cost[^1] was $5 then $9\n\n[^1]: the note";
+      const out = guardAccidentalFormatting(src);
+      expect(out).toContain("cost[^1]");
+      expect(out).toContain("[^1]: the note");
+      expect(out).toContain("\$5");
+      expect(out).toContain("\$9");
+    });
+
+    it("the whole composition stays idempotent with natives present", () => {
+      const src =
+        "claim[^1] and $x^2+y^2$ in <details><summary>T</summary>\nb\n</details> with $5 and $10\n\n[^1]: n";
+      const once = guardAccidentalFormatting(src);
+      expect(guardAccidentalFormatting(once)).toBe(once);
+    });
+  });
 });

package/telegram-plugin/tests/render/parse.test.ts

@@ -336,7 +336,7 @@ describe("parse: nested lists", () => {
   });
 });
 
-describe("expandable blockquote (Bot API 10.1 `**>` marker)", () => {
+describe("expandable blockquote (LEGACY switchroom `**>` marker — input repair only)", () => {
   it("parses a single-line `**>` quote into an expandable blockquote", () => {
     const md = "**> a collapsible line";
     const doc = parse(md);
@@ -374,10 +374,10 @@ describe("expandable blockquote (Bot API 10.1 `**>` marker)", () => {
   });
 
   it("only recognises the marker at column 0 (leading indent is not expandable)", () => {
-    // The renderer only ever emits `**>` at column 0; a leading-indented
-    // variant is deliberately NOT treated as an expandable quote (matching it
-    // would push the length-preserving rewrite past the 3-space blockquote
-    // budget into indented-code-block territory).
+    // The legacy encoding only ever placed `**>` at column 0; a
+    // leading-indented variant is deliberately NOT treated as an expandable
+    // quote (matching it would push the length-preserving rewrite past the
+    // 3-space blockquote budget into indented-code-block territory).
     const md = "   **> indented";
     const doc = parse(md);
     const bq = doc.blocks[0] as any;
@@ -391,3 +391,28 @@ describe("expandable blockquote (Bot API 10.1 `**>` marker)", () => {
     expect(doc.blocks[0].type).toBe("paragraph");
   });
 });
+
+describe("footnotes fold to verbatim `raw` nodes (native Telegram construct)", () => {
+  it("a footnote reference marker folds to a raw inline carrying its source bytes", () => {
+    // GFM only recognises a reference when a matching definition exists in
+    // the document (a lone `[^n1]` is ordinary text).
+    const doc = parse("claim[^n1] more\n\n[^n1]: body");
+    const para = doc.blocks[0] as Extract<Block, { type: "paragraph" }>;
+    const raw = para.children.find((c: Inline) => c.type === "raw") as
+      | Extract<Inline, { type: "raw" }>
+      | undefined;
+    expect(raw).toBeDefined();
+    expect(raw!.text).toBe("[^n1]");
+  });
+
+  it("a footnote definition folds to a paragraph with one raw inline (verbatim slice)", () => {
+    const doc = parse("[^n1]: body text");
+    const para = doc.blocks[0] as Extract<Block, { type: "paragraph" }>;
+    expect(para.type).toBe("paragraph");
+    expect(para.children).toHaveLength(1);
+    expect(para.children[0].type).toBe("raw");
+    expect((para.children[0] as Extract<Inline, { type: "raw" }>).text).toBe(
+      "[^n1]: body text",
+    );
+  });
+});

package/telegram-plugin/tests/render/render.test.ts

@@ -195,7 +195,10 @@ describe("render: block palette", () => {
   it("plain blockquote", () => {
     expect(render(parse("> quoted line"))).toBe("> quoted line");
   });
-  it("expandable blockquote uses **> on the first line", () => {
+  it("expandable IR flag renders as a PLAIN quote — the retired `**>` marker is never emitted", () => {
+    // `**>` is MarkdownV2-only syntax; the rich markdown path renders it as
+    // LITERAL `**>` text (wire-proved 2026-08-13 via raw sendRichMessage
+    // probes), so the renderer degrades an expandable node to a plain quote.
     const doc: Document = {
       blocks: [
         {
@@ -214,9 +217,10 @@ describe("render: block palette", () => {
         },
       ],
     };
-    expect(render(doc)).toBe("**> hidden gem");
+    expect(render(doc)).toBe("> hidden gem");
+    expect(render(doc)).not.toContain("**>");
   });
-  it("multi-line expandable blockquote continues with a plain > marker", () => {
+  it("multi-line expandable blockquote renders every line with a plain > marker", () => {
     const doc: Document = {
       blocks: [
         {
@@ -242,8 +246,9 @@ describe("render: block palette", () => {
       ],
     };
     const out = render(doc);
+    expect(out).not.toContain("**>");
     const lines = out.split("\n");
-    expect(lines[0]).toBe("**> line one");
+    expect(lines[0]).toBe("> line one");
     for (const line of lines.slice(1)) {
       expect(line.startsWith("> ") || line === ">").toBe(true);
     }

package/telegram-plugin/tests/render/rich-render.test.ts

@@ -5,6 +5,7 @@ import {
   renderOutbound,
   maybeRenderOutbound,
 } from "../../render/rich-render.js";
+import { guardAccidentalFormatting } from "../../rich-send.js";
 
 describe("parseRichRenderEnabled", () => {
   it("defaults ON when unset (escape hatch, not opt-in)", () => {
@@ -52,8 +53,10 @@ describe("maybeRenderOutbound", () => {
   it("default (env unset) routes through parse -> renderSafe", () => {
     const r = maybeRenderOutbound("**> collapsible", {} as NodeJS.ProcessEnv);
     expect(r.mode).toBe("markdown");
-    // The expandable blockquote round-trips back to the `**> ` marker.
-    expect(r.text).toContain("**> ");
+    // The legacy expandable marker is REPAIRED to a plain quote: `**>` is
+    // MarkdownV2-only syntax the rich path renders as literal text
+    // (wire-proved 2026-08-13), so the renderer must never re-emit it.
+    expect(r.text).toBe("> collapsible");
   });
 
   it("default preserves plain prose through the round-trip", () => {
@@ -84,15 +87,53 @@ describe("maybeRenderOutbound", () => {
       SWITCHROOM_RICH_RENDER: "maybe",
     } as NodeJS.ProcessEnv);
     expect(r.mode).toBe("markdown");
-    expect(r.text).toContain("**> ");
+    expect(r.text).toBe("> collapsible");
   });
 });
 
 describe("renderOutbound (flag-independent)", () => {
-  it("renders an expandable blockquote round-trip end to end", () => {
+  it("repairs a legacy `**>` quote to a plain quote end to end", () => {
     const r = renderOutbound("**> hidden line one\n> hidden line two");
     expect(r.mode).toBe("markdown");
-    expect(r.text.split("\n")[0]).toMatch(/^\*\*> /);
+    // One coherent quote, no retired marker: on the pre-fix renderer the
+    // first line came back as `**> hidden line one`, which Telegram rendered
+    // as LITERAL `**>` paragraph text (wire-proved 2026-08-13).
+    expect(r.text).not.toContain("**>");
+    expect(r.text.split("\n")[0]).toBe("> hidden line one");
+    expect(r.text).toContain("> hidden line two");
+  });
+
+  it("passes native constructs through: <details>, $math$, footnotes", () => {
+    // Wire-verified natives (2026-08-13) must survive parse -> renderSafe
+    // BYTE-IDENTICAL. On the pre-fix pipeline the footnote case failed:
+    // escapeMarkdown turned `[^n1]` into `\[^n1\]`, breaking the construct.
+    const details =
+      "<details open><summary>S</summary>\n\nbody\n\n</details>";
+    expect(renderOutbound(details).text).toBe(details);
+
+    const math = "inline $x^2+y^2$ done";
+    expect(renderOutbound(math).text).toBe(math);
+
+    const footnotes = "claim[^n1] more\n\n[^n1]: body text";
+    expect(renderOutbound(footnotes).text).toBe(footnotes);
+  });
+
+  it("a tg:// inline entity and a footnote survive TOGETHER in one message", () => {
+    // Cross-feature composition (#4683 x #4685): the `tg-entity` fold (mdast
+    // image position) and the footnote `raw` fold (footnoteReference /
+    // footnoteDefinition) land in the SAME foldInline/foldBlock walk — this
+    // pins that neither eats the other. On #4683 alone the footnote came back
+    // as `claim\[^n1\]`; on #4685 alone (pre-rebase) the entity came back as
+    // `!\[now\](tg://time?unix\=…)` literal text.
+    const combined =
+      "meet at ![now](tg://time?unix=1755000000&format=wDT) as promised[^n1]\n\n[^n1]: agreed yesterday";
+    expect(renderOutbound(combined).text).toBe(combined);
+
+    // Same pair inside ONE paragraph plus the guard seam on top: the composed
+    // wire body (renderOutbound then the richMessage guard, i.e. the full
+    // streamed send path) is still byte-identical.
+    const guarded = guardAccidentalFormatting(renderOutbound(combined).text);
+    expect(guarded).toBe(combined);
   });
 
   it("falls back to plain mode for oversized atomic content", () => {