switchroom 0.21.9 → 0.21.11

package/telegram-plugin/tests/forwarded-rich-message-coalesce.test.ts

@@ -140,7 +140,7 @@ describe('wiring: message:rich_message dispatches through the coalescing path',
 // through `handleInboundCoalesced`.
 // ---------------------------------------------------------------------------
 
-const CHAT_ID = -1004223464247
+const CHAT_ID = -1004444444444
 const USER_ID = 777
 
 function makeBotInfo() {
@@ -159,13 +159,13 @@ function makeBotInfo() {
 
 /** Forwarded rich (bot) message, no top-level text/caption — the live shape. */
 function makeForwardedRichUpdate(update_id: number, blocks: unknown[]): Update {
-  const originUser = { id: 8500000001, is_bot: true, first_name: 'Klanker', username: 'meken_klanker_bot' }
+  const originUser = { id: 8500000001, is_bot: true, first_name: 'Sidekick', username: 'example_sidekick_bot' }
   return {
     update_id,
     message: {
       message_id: update_id,
-      chat: { id: CHAT_ID, type: 'supergroup', title: 'ProductOS', is_forum: true },
-      from: { id: USER_ID, is_bot: false, first_name: 'Ken' },
+      chat: { id: CHAT_ID, type: 'supergroup', title: 'Example Supergroup', is_forum: true },
+      from: { id: USER_ID, is_bot: false, first_name: 'Alice' },
       date: 1784837003,
       forward_origin: { type: 'user', date: 1784830000, sender_user: originUser },
       forward_from: originUser,
@@ -180,8 +180,8 @@ function makeTextUpdate(update_id: number, text: string): Update {
     update_id,
     message: {
       message_id: update_id,
-      chat: { id: CHAT_ID, type: 'supergroup', title: 'ProductOS', is_forum: true },
-      from: { id: USER_ID, is_bot: false, first_name: 'Ken' },
+      chat: { id: CHAT_ID, type: 'supergroup', title: 'Example Supergroup', is_forum: true },
+      from: { id: USER_ID, is_bot: false, first_name: 'Alice' },
       date: 1784837004,
       text,
     },

package/telegram-plugin/tests/forwarded-rich-message.test.ts

@@ -85,13 +85,13 @@ function buildHarness() {
  * forward_origin (modern) + legacy forward_from/forward_date siblings +
  * rich_message content, NO top-level text/caption. */
 function makeForwardedRichUpdate(update_id: number, blocks: unknown[]): Update {
-  const originUser = { id: 8500000001, is_bot: true, first_name: 'Klanker', username: 'meken_klanker_bot' }
+  const originUser = { id: 8500000001, is_bot: true, first_name: 'Sidekick', username: 'example_sidekick_bot' }
   return {
     update_id,
     message: {
       message_id: 944,
-      chat: { id: -1004223464247, type: 'supergroup', title: 'ProductOS', is_forum: true },
-      from: { id: 777, is_bot: false, first_name: 'Ken' },
+      chat: { id: -1004444444444, type: 'supergroup', title: 'Example Supergroup', is_forum: true },
+      from: { id: 777, is_bot: false, first_name: 'Alice' },
       date: 1784837003,
       forward_origin: { type: 'user', date: 1784830000, sender_user: originUser },
       forward_from: originUser,
@@ -142,12 +142,12 @@ describe('forwarded rich (bot) message — the row-944 regression oracle', () =>
       (update as unknown as { message: { forward_origin: never } }).message.forward_origin,
     )
     const meta = buildForwardOriginMeta([origin!])
-    expect(meta.forwarded_from).toBe('Klanker (@meken_klanker_bot)')
+    expect(meta.forwarded_from).toBe('Sidekick (@example_sidekick_bot)')
     expect(meta.forwarded_from_type).toBe('user')
     expect(meta.forwarded_date).toBeDefined()
     // Trusted-lane separation (#3162): the delivered BODY carries no
     // provenance strings — those live only in the channel attrs.
-    expect(delivered[0].text).not.toContain('Klanker')
+    expect(delivered[0].text).not.toContain('Sidekick')
   })
 
   it('a rich message with genuinely no extractable text still yields an honest turn', async () => {
@@ -175,7 +175,7 @@ describe('forwarded rich (bot) message — the row-944 regression oracle', () =>
       message: {
         message_id: 950,
         chat: { id: 777, type: 'private' },
-        from: { id: 777, is_bot: false, first_name: 'Ken' },
+        from: { id: 777, is_bot: false, first_name: 'Alice' },
         date: 1784837100,
         rich_message: { blocks: [{ type: 'heading', size: 2, text: 'Release plan' }, { type: 'paragraph', text: 'Ship Friday.' }] },
       },
@@ -196,14 +196,14 @@ describe('working shapes stay unchanged (no regression on existing forwards)', (
     msg.forward_origin = {
       type: 'user',
       date: 1_700_000_000,
-      sender_user: { id: 424242, is_bot: false, first_name: 'Ken', last_name: 'Thompson' },
+      sender_user: { id: 424242, is_bot: false, first_name: 'Alice', last_name: 'Example' },
     }
     await bot.handleUpdate(update)
 
     expect(delivered).toHaveLength(1)
     expect(delivered[0]).toMatchObject({ via: 'text', text: 'here is the brief I forwarded' })
     const meta = buildForwardOriginMeta([parseForwardOrigin(msg.forward_origin as never)!])
-    expect(meta.forwarded_from).toBe('Ken Thompson')
+    expect(meta.forwarded_from).toBe('Alice Example')
     expect(meta.forwarded_date).toBeDefined()
   })
 

package/telegram-plugin/tests/history.test.ts

@@ -546,6 +546,84 @@ describe('hasOutboundDeliveredSince', () => {
       expect(hasOutboundDeliveredSince('-100', openedAt, 6, 1)).toBe(false)
     })
   })
+
+  // #4681 — the optional UPPER bound. The obligation escalate branch's reroute
+  // fallback is licensed by an `EXPLICIT_OVERRIDDEN` record, which is evidence
+  // about ONE instant; an open-ended forward query lets unrelated traffic in the
+  // routed topic, arriving arbitrarily later, read as that record's answer and
+  // close a genuinely unanswered obligation in silence.
+  describe('untilMs parameter (the reroute fallback upper bound)', () => {
+    it('omitted, the query stays open-ended forward (pre-existing behaviour)', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_090_000, // 90_000s later
+      })
+      expect(hasOutboundDeliveredSince('-100', openedAt)).toBe(true)
+    })
+
+    it('excludes a row delivered AFTER the bound', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_090, // 90s after the lower bound
+      })
+      // Inside an 18.5s window it cannot be this record's answer.
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 200, openedAt + 18_500)).toBe(
+        false,
+      )
+    })
+
+    it('includes a row inside the bound, and the boundary second itself', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_018, // 18s after — inside an 18.5s window
+      })
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 200, openedAt + 18_500)).toBe(
+        true,
+      )
+      // The bound is CEILed to whole seconds, so a row written in the second the
+      // bound falls inside is admitted — rounding never drops a real answer.
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 200, openedAt + 17_600)).toBe(
+        true,
+      )
+    })
+
+    it('composes with the thread filter (parameter binding order)', () => {
+      // The `ts <= ?` placeholder is appended BEFORE `thread_id = ?`; if the two
+      // params were pushed in the wrong order the thread id would land in the
+      // timestamp comparison and this would silently misbehave.
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: 5,
+        message_ids: [10],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_010,
+      })
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: 6,
+        message_ids: [11],
+        texts: [SUBSTANTIVE],
+        ts: 1_000_090,
+      })
+      const until = openedAt + 18_500
+      expect(hasOutboundDeliveredSince('-100', openedAt, 5, 200, until)).toBe(true)
+      expect(hasOutboundDeliveredSince('-100', openedAt, 6, 200, until)).toBe(false) // too late
+      expect(hasOutboundDeliveredSince('-100', openedAt, 6, 200)).toBe(true) // unbounded finds it
+    })
+  })
 })
 
 // Review finding H5 regression: the original PRIMARY KEY (chat_id, thread_id, message_id) does

package/telegram-plugin/tests/multitopic-routing-wiring.test.ts

@@ -26,7 +26,12 @@ const gatewaySrc =
   // P7 PR-10 (#2996): the InboundMessage envelope assembly (origin_turn_id,
   // topic_scope, meta lane) moved verbatim into gateway/inbound-router.ts
   // (buildInboundEnvelope) — include it in the scraped corpus.
-  readFileSync(resolve(__dirname, '..', 'gateway', 'inbound-router.ts'), 'utf-8')
+  readFileSync(resolve(__dirname, '..', 'gateway', 'inbound-router.ts'), 'utf-8') +
+  '\n' +
+  // The reply-route telemetry line (via/RECOVERED/UNROUTED/MISROUTE_RISK/
+  // CROSS_CHAT_ANCHOR_DROPPED) moved verbatim out of resolveAnswerThreadWithLog
+  // into the pure formatReplyRouteLog (#2996 line ratchet) — scrape it too.
+  readFileSync(resolve(__dirname, '..', 'gateway', 'reply-route-log.ts'), 'utf-8')
 // #2996 P4-A: the enqueue handler (turn ctor: `const turnId = deriveTurnId`,
 // `rememberRecentTurn(next)`, `promoteQueuedStatus`) moved VERBATIM into
 // stream-render.ts with handleSessionEvent. Enqueue-seam assertions span both.
@@ -147,6 +152,29 @@ describe('framework-owned origin recovery (determinism residual, 2026-06-05)', (
     expect(gatewaySrc).toMatch(/via === 'quoted' \? ' QUOTED\(framework-origin\)' : ''/)
   })
 
+  it('a thread anchor from ANOTHER chat is dropped before it can be sent (cross-chat guard)', () => {
+    // The routing input carries the target + anchor chat ids, so the pure
+    // resolver can refuse a foreign anchor (Telegram 400 "message thread not
+    // found"). Behaviour is asserted in answer-thread-resolve.test.ts; this
+    // pins the WIRING so a refactor cannot silently stop passing them.
+    //
+    // NOT A SAFETY NET — read before relying on it. Like its ~20 siblings in
+    // this file, this is a source-text CALL-SITE RATCHET: it greps gateway.ts
+    // for the argument spellings. Mutating `isCrossChatAnchor` to
+    // `return false` leaves every assertion here GREEN (verified), because the
+    // call site is still spelled the same way. The behavioural oracles are
+    // `answer-thread-resolve.test.ts` (the pure predicate + precedence),
+    // `reply-route-log.test.ts` (the telemetry), and the
+    // `SWITCHROOM_TURN_ORIGIN_ROUTING=0` block in `send-reply-golden.test.ts`
+    // (the legacy branch, at the wire). Those are what fail on a broken guard.
+    const fn = gatewaySrc.split('function resolveAnswerThreadWithLog')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/targetChatId: chatId/)
+    expect(fn).toMatch(/originChatId: originTurn\?\.sessionChatId/)
+    expect(fn).toMatch(/liveChatId: liveTurn\?\.sessionChatId/)
+    // And the dropped anchor is observable, with both chat ids on the line.
+    expect(gatewaySrc).toMatch(/CROSS_CHAT_ANCHOR_DROPPED\(target=/)
+  })
+
   it('the kill switch defaults ON and is independent of TURN_ORIGIN_ROUTING', () => {
     expect(gatewaySrc).toMatch(/SWITCHROOM_FRAMEWORK_ORIGIN_ROUTING !== '0'/)
   })

package/telegram-plugin/tests/orphaned-db-sweep.test.ts

@@ -106,7 +106,13 @@ import {
   runOrphanedDbSweepTick,
   startOrphanedDbSweep,
 } from '../gateway/orphaned-db-sweep.js'
-import { GATEWAY_SIGNATURES } from '../../src/fleet-health/detect.js'
+import { GATEWAY_SIGNATURES, detectGatewayFindings } from '../../src/fleet-health/detect.js'
+import { mapSignal } from '../../src/fleet-health/mapping.js'
+
+/** Severity the fleet-health ledger would book for a real sweep log. */
+function ledgerSeverities(log: string): number[] {
+  return detectGatewayFindings('uat', log).findings.map((f) => mapSignal(f.signal).severity)
+}
 
 /**
  * `/proc/self/fd` is Linux-only. Without this guard every detection test would
@@ -294,6 +300,13 @@ describe.skipIf(!onLinux)('orphaned-db-sweep — history.db recovery', () => {
     // alarm has no consumer.
     expect(GATEWAY_SIGNATURES['orphaned-db-handle'].test(log)).toBe(true)
 
+    // #4680 — but this tick RECOVERED: the reopen landed in the same tick and
+    // the writer self-check proved the handle durable. The ledger must book
+    // that as the informational lane, not a severity-3 silent-loss incident.
+    // Asserted against the REAL sweep output, so a wording change in either the
+    // emitter or the detector fails here instead of drifting silently.
+    expect(ledgerSeverities(log)).toEqual([1])
+
     // 7. THE FIX, half one: the deleted-inode handles are actually GONE. A
     //    close that leaves un-finalized statements behind leaves them open
     //    (measured), so this is the assertion that pins the hard close.
@@ -439,6 +452,9 @@ describe.skipIf(!onLinux)('orphaned-db-sweep — registry.db and unowned lanes',
       expect(log).toContain('registry.db')
       expect(log).toContain('RESTART')
       expect(GATEWAY_SIGNATURES['orphaned-db-handle'].test(log)).toBe(true)
+      // #4680 — the registry lane has NO in-process recovery, so it stays the
+      // severity-3 alarm. This is the half of the split that must not be lost.
+      expect(ledgerSeverities(log)).toEqual([3])
 
       // Detection ONLY: the raw handle is left alone, so its consumers (the
       // by-value `turnsDb` captures in gateway.ts) are never handed a closed DB.

package/telegram-plugin/tests/render/html-dialect-content-loss.test.ts

@@ -0,0 +1,326 @@
+// Outcome tests for the content-loss regressions found in the raw-HTML
+// dialect fold (#4691, merged as fa9018a7, unreleased).
+//
+// 29 of the 37 tests here fail on fa9018a7 — measured by running this exact
+// file against that revision, not asserted. The other 8 pass on both and are
+// guards: they pin behaviour the fix must not disturb. (An earlier revision of
+// this header claimed "every assertion fails on fa9018a7"; at 31 tests the
+// true figure was 23.) Five of the 29 — the `<pre>` fence-width cases — also
+// fail on 6c120cee, the first fix's own merge commit, which emitted a
+// hardcoded three-backtick fence.
+//
+// They drive the real `renderOutbound` (`parse` -> `renderSafe`), i.e. exactly
+// what the live send path calls, so they assert the WIRE OUTCOME rather than
+// an internal code path.
+//
+// The through-line: fa9018a7's degrade bucket DELETED any token it could not
+// fold or pass through. That is safe for markup but catastrophic for prose —
+// `<service>/<key>`, `<agent>` and "the `<b>` tag" are pervasive in this
+// project's own agent output, and they were silently vanishing from replies.
+// The discriminator is now MATCHING, not the tag name: a balanced pair is
+// markup (drop it, keep the content), an unmatched marker is prose (keep it,
+// HTML-entity-escaped so the wire cannot read it as a tag).
+
+import { describe, it, expect } from "vitest";
+import { renderOutbound } from "../../render/rich-render.js";
+import { parse } from "../../render/parse.js";
+import { escapeLinkHref } from "../../format.js";
+
+const render = (src: string): string => renderOutbound(src).text;
+
+describe("BLOCKER: angle-bracket placeholders in prose survive (#4691 regression)", () => {
+  it("keeps a `<service>/<key>` convention line intact", () => {
+    // fa9018a7: "Use the / convention."
+    expect(render("Use the <service>/<key> convention.")).toBe(
+      "Use the &lt;service&gt;/&lt;key&gt; convention.",
+    );
+  });
+
+  it("keeps a trailing `<key>` placeholder on a command line", () => {
+    // fa9018a7: "run switchroom vault get "
+    expect(render("run switchroom vault get <key>")).toBe(
+      "run switchroom vault get &lt;key&gt;",
+    );
+  });
+
+  it("keeps an `<agent>` path segment", () => {
+    // fa9018a7: "logs live at /host-home/.switchroom/logs//"
+    expect(render("logs live at /host-home/.switchroom/logs/<agent>/")).toBe(
+      "logs live at /host-home/.switchroom/logs/&lt;agent&gt;/",
+    );
+  });
+
+  it("keeps a tag NAMED in prose when nothing closes it", () => {
+    // fa9018a7: "The  tag is bold and  is italic"
+    expect(render("The <b> tag is bold and <i> is italic")).toBe(
+      "The &lt;b&gt; tag is bold and &lt;i&gt; is italic",
+    );
+  });
+
+  it("never emits a bare `<` for a token it kept as prose", () => {
+    // The escape is what makes keeping the token safe: Rich HTML documents
+    // `&lt;`/`&gt;`/`&amp;` as supported named entities, so this cannot trip
+    // `unsupported start tag` the way a bare `<service>` would.
+    const out = render("Use <service>/<key> and <agent>.");
+    expect(out).not.toMatch(/<[A-Za-z/]/);
+    expect(out).toBe("Use &lt;service&gt;/&lt;key&gt; and &lt;agent&gt;.");
+  });
+
+  it("does not double-escape when its own output is re-parsed", () => {
+    // Re-parsing decodes `&lt;` back to a text-node `<`, which never reaches
+    // the fold at all (the documented residual in html-fold.ts's header), so
+    // the second pass is NOT byte-idempotent. What must never happen is a
+    // compounding `&amp;lt;` that the reader actually sees.
+    const once = render("Use the <service>/<key> convention.");
+    expect(once).toBe("Use the &lt;service&gt;/&lt;key&gt; convention.");
+    expect(render(once)).not.toContain("&amp;");
+  });
+
+  it("still DROPS the markup of a balanced unknown pair (content kept)", () => {
+    // The other half of the discriminator: a matched pair really is markup.
+    expect(render("<marquee>scrolling</marquee>")).toBe("scrolling");
+    expect(render(`<span data-x="1">t</span>`)).toBe("t");
+  });
+});
+
+describe("MAJOR 1: `<pre>` folds to a fenced block, not a broken code span", () => {
+  it("renders `<pre><code>` as a real fence", () => {
+    // fa9018a7: "`const a = 1;\nconst b = 2;`" — a backtick span wrapping a
+    // newline, which Telegram will not parse, so the reader sees literal
+    // backticks around broken text.
+    expect(render("<pre><code>const a = 1;\nconst b = 2;</code></pre>")).toBe(
+      "```\nconst a = 1;\nconst b = 2;\n```",
+    );
+  });
+
+  it("never emits a code span containing a newline", () => {
+    const out = render("<pre><code>a\nb</code></pre>");
+    expect(out).not.toMatch(/(^|[^`])`[^`]*\n[^`]*`/);
+  });
+
+  it("carries the `class=\"language-…\"` hint into the fence info string", () => {
+    expect(
+      render(`<pre><code class="language-python">print(1)</code></pre>`),
+    ).toBe("```python\nprint(1)\n```");
+  });
+
+  it("handles a bare `<pre>` with no inner `<code>`", () => {
+    expect(render("<pre>one\ntwo</pre>")).toBe("```\none\ntwo\n```");
+  });
+
+  it("leaves no stray leading or trailing newline around the fence", () => {
+    // The layout newlines a `<pre>` block carries are not content.
+    expect(render("<pre>\nbody\n</pre>")).toBe("```\nbody\n```");
+    expect(render("<pre>\nbody\n</pre>")).not.toMatch(/^\n|\n$/);
+  });
+
+  it("degrades to an inline code span where a fence cannot survive", () => {
+    // A fence inside a `#` line or a table cell would end the block/row.
+    expect(render("# a <pre>x</pre> b")).toBe("# a `x` b");
+    expect(render("| h |\n| --- |\n| <pre>x</pre> |")).toContain("| `x` |");
+  });
+
+  // ── Regression: the fold's fence must be WIDER than its own body ────────
+  // `buildPreBlock` emitted a hardcoded three-backtick delimiter as a `raw`
+  // node (verbatim wire passthrough — nothing downstream widens it). A `<pre>`
+  // whose body carried its own ``` therefore shipped THREE delimiters: the
+  // wire opens at #1, closes at #2, reads the remainder as prose, and #3 opens
+  // a fence that never terminates -> `can't find end of Pre entity` 400 and a
+  // whole-message plain-text resend. `fa9018a7` escaped the backticks instead
+  // — cosmetically worse, but wire-correct; this restores wire-correctness
+  // using the same width rule `renderCodeBlock` already applies.
+  it("widens the fence past a three-backtick run in the body", () => {
+    expect(render("<pre>\na\n```\nb\n</pre>")).toBe("````\na\n```\nb\n````");
+  });
+
+  it("widens the fence past a longer run than three", () => {
+    expect(render("<pre>\na\n````\nb\n</pre>")).toBe("`````\na\n````\nb\n`````");
+    expect(render("<pre>\na\n`````\nb\n</pre>")).toBe(
+      "``````\na\n`````\nb\n``````",
+    );
+  });
+
+  it("widens past a run that shares a line with other text", () => {
+    expect(render("<pre><code>x ``` y</code></pre>")).toBe(
+      "````\nx ``` y\n````",
+    );
+  });
+
+  it("still emits a plain three-backtick fence when the body has no run", () => {
+    // The widening must not inflate the common case.
+    expect(render("<pre>\nplain body\n</pre>")).toBe("```\nplain body\n```");
+    expect(render("<pre>\na ` b `` c\n</pre>")).toBe("```\na ` b `` c\n```");
+  });
+
+  it("keeps the language hint attached to the widened delimiter", () => {
+    expect(
+      render('<pre><code class="language-md">see ```\n</code></pre>'),
+    ).toBe("````md\nsee ```\n````");
+  });
+
+  it("emits a terminating fence for every inner backtick run length", () => {
+    // Outcome, not shape: whatever the body carries, the delimiter run must
+    // appear on exactly TWO lines (open and close) and be strictly longer than
+    // every run inside, so the wire can neither close it early nor leave it
+    // open. This is the property whose violation produced the 400.
+    for (const inner of ["```", "````", "`````", "` `` ```", "a```b", "```` x"]) {
+      const src = `<pre>\nhead\n${inner}\ntail\n</pre>`;
+      const out = render(src);
+      const lines = out.split("\n");
+      const delim = lines[0];
+      expect(delim, `open delimiter for ${JSON.stringify(inner)}`).toMatch(
+        /^`{3,}$/,
+      );
+      expect(lines[lines.length - 1], `close delimiter for ${inner}`).toBe(
+        delim,
+      );
+      // Every backtick run in the BODY is strictly shorter than the delimiter.
+      const body = lines.slice(1, -1).join("\n");
+      for (const run of body.match(/`+/g) ?? []) {
+        expect(
+          run.length,
+          `body run ${JSON.stringify(run)} vs delimiter ${delim}`,
+        ).toBeLessThan(delim.length);
+      }
+    }
+  });
+});
+
+describe("MAJOR 2: structural tags do not glue their content together", () => {
+  it("separates list items instead of emitting `onetwo`", () => {
+    expect(render("<ul><li>one</li><li>two</li></ul>")).toBe("one  \ntwo");
+  });
+
+  it("separates paragraphs instead of emitting `para onepara two`", () => {
+    expect(render("<p>para one</p><p>para two</p>")).toBe(
+      "para one  \npara two",
+    );
+  });
+
+  it("separates table cells", () => {
+    expect(render("<table><tr><td>a</td><td>b</td></tr></table>")).toBe(
+      "a  \nb",
+    );
+  });
+
+  it("leaves no separator hanging at the edges of the block", () => {
+    const out = render("<div>only</div>");
+    expect(out).toBe("only");
+  });
+
+  it("still renders a markup-only block to nothing", () => {
+    // Regression guard for the separator: an empty structural block must not
+    // become a whitespace-only paragraph and a spurious `\n\n`.
+    expect(render("a\n\n<div></div>\n\nb")).toBe("a\n\nb");
+    expect(render("a\n\n<!-- c -->\n\nb")).toBe("a\n\nb");
+  });
+
+  it("uses a space, not a newline, inside a table cell", () => {
+    // A newline in a cell ends the row.
+    const out = render("| h |\n| --- |\n| <p>x</p><p>y</p> |");
+    expect(out).toContain("| x y |");
+  });
+});
+
+describe("MAJOR 3: the passthrough bucket is balance-checked", () => {
+  it("does not ship an unmatched `<u>` raw", () => {
+    // fa9018a7 emitted this verbatim -> `unclosed start tag` 400 -> the
+    // fallback resends the WHOLE message as plain text. One stray marker in
+    // relayed content was a denial-of-formatting on the agent's reply.
+    expect(render("hello <u>world")).toBe("hello &lt;u&gt;world");
+  });
+
+  it("does not ship a stray close marker raw", () => {
+    expect(render("</details>")).toBe("&lt;/details&gt;");
+  });
+
+  it("keeps the balanced inner pair and escapes only the unmatched outer", () => {
+    expect(render("<u><u>x</u>")).toBe("&lt;u&gt;<u>x</u>");
+  });
+
+  it("still passes a BALANCED allowlist tag through raw", () => {
+    for (const src of [
+      "<u>under</u>",
+      "H<sub>2</sub>O",
+      "x<sup>2</sup>",
+      "<aside><cite>note</cite></aside>",
+    ]) {
+      expect(render(src)).toBe(src);
+    }
+  });
+
+  it("passes a `<details>` block through even though it spans mdast blocks", () => {
+    // The balance check MUST be document-level: micromark splits this into
+    // three separate `html` nodes, so a per-node check would wrongly call the
+    // open and close markers unmatched and escape them.
+    const src = "<details open><summary>S</summary>\n\nbody\n\n</details>";
+    expect(render(src)).toBe(src);
+  });
+
+  it("does not let a tag inside a code fence balance a prose marker", () => {
+    // Tags in a fence are not markup and must not satisfy anything outside it.
+    const out = render("```\n</u>\n```\n\nhello <u>world");
+    expect(out).toContain("```\n</u>\n```");
+    expect(out).toContain("hello &lt;u&gt;world");
+  });
+});
+
+describe("MAJOR 4: the fence comment's claimed safety property (pinned)", () => {
+  it("PINS the lazy-continuation counterexample the comment gets wrong", () => {
+    // The `**>` rewrite tracks TOP-LEVEL fences only, so the `> ``` ` opener
+    // here is invisible to it and the column-0 `**> lazy` line is rewritten,
+    // eating the `**`. CommonMark forbids lazy continuation into fenced code,
+    // so that line should CLOSE the blockquote and stay literal.
+    //
+    // This is PRE-EXISTING and identical before #4691 — NOT a regression — and
+    // fixing it needs real container tracking, not a wider fence regex. Pinned
+    // so any future container-aware rewrite has to decide it deliberately;
+    // `FENCE_DELIM_RE`'s doc comment now describes this instead of claiming
+    // the case cannot happen.
+    expect(render("> ```\n**> lazy\n> ```")).toBe("> ```\n> lazy\n> ```");
+  });
+});
+
+describe("nits: breaks, nested links, and href hygiene", () => {
+  it("does not break a heading block with `<br>`", () => {
+    // fa9018a7: "# a  \nb" — the hard break ends the heading and orphans `b`.
+    expect(render("# a<br>b")).toBe("# a b");
+    expect(parse("# a<br>b").blocks).toHaveLength(1);
+  });
+
+  it("keeps a `<br>` a real break in ordinary prose", () => {
+    expect(render("one<br>two")).toBe("one  \ntwo");
+    // Two explicit breaks are the author's, not synthesized separators — they
+    // must not be collapsed by the separator normalizer.
+    expect(render("a<br><br>b")).toBe("a  \n  \nb");
+  });
+
+  it("does not silently drop a nested `<a>`'s href", () => {
+    // fa9018a7: "[out in](https://o.example)" — the inner URL vanished.
+    const out = render(
+      '<a href="https://o.example">out <a href="https://i.example">in</a></a>',
+    );
+    expect(out).toContain("i.example");
+  });
+
+  it("percent-encodes whitespace in a link destination", () => {
+    // A bare destination ends at the first whitespace character, so a raw
+    // space turned the rest of the URL into a title and a raw newline
+    // terminated the link outright.
+    expect(render('<a href="https://ex.com/a b">x</a>')).toBe(
+      "[x](https://ex.com/a%20b)",
+    );
+    expect(render('<a href="https://ex.com/a\nb">x</a>')).toBe(
+      "[x](https://ex.com/a%0Ab)",
+    );
+  });
+
+  it("escapeLinkHref still balances parens and is a no-op for clean URLs", () => {
+    expect(escapeLinkHref("https://e.com/a_(b)")).toBe(
+      "https://e.com/a_\\(b\\)",
+    );
+    expect(escapeLinkHref("https://e.com/plain?a=1&b=2")).toBe(
+      "https://e.com/plain?a=1&b=2",
+    );
+  });
+});