test(send): pin that the authoritative read-back carries no degradation marker

[andrei-hasna]

What this is

A test-only assertion that missed PR #86's merge. The runtime fix shipped complete in 0.5.25 — this closes a coverage gap in the guard, not a defect in behaviour.

Why it missed

PR #86's head was b7a1f9b when it merged at 01:12:58Z; this commit (9b1b012) had been pushed to the branch but the PR object had not picked it up yet. So it was reviewed and tested, and simply did not land.

The gap

sendMessage has two authoritative return paths:

:651   if (returned.uuid === messageUuid) return attachSendRedaction(opts.content, returned)   <- create-echo
:659   if (exact) return attachSendRedaction(opts.content, exact)                              <- by-uuid read-back

write_confirmation: { degraded: true, ... } must appear on neither, because its whole purpose is to distinguish a degraded confirmation from an authoritative one — and its eventual disappearance is what will mark the routing-echo fallback dead once the deployed server serves /messages/by-uuid.

Only the create-echo path was guarded. The read-back test asserted with toMatchObject, which is a subset match and would silently accept a stray key.

No live defect: :659 returns the row unflagged today. The risk is forward-looking — a future regression flagging a genuine read-back would ship undetected, corrupting exactly the signal the field exists to provide.

Evidence that the assertion can fail

Not assumed — mutated. Forcing degraded: true onto the read-back path:

MUTANT EXIT=1     34 pass, 1 fail
restored          35 pass, 0 fail   (72 expect() calls)

Found by the adversarial reviewer on PR #86 as a P3 during the scoped re-review.

Refs: todos d8f3f963

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #87 @ 8dd7ed7 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main at e83fd2e.

What I read:

• git log --oneline origin/main..HEAD — exit 0; one commit, 8dd7ed7.
• git diff origin/main...HEAD --stat — exit 0; one changed file, src/lib/store/api-store.test.ts, with 7 insertions.
• The complete diff for the changed file, the full surrounding ApiStore.sendMessage wire body test suite, and the relevant implementation paths in src/lib/store/api-store.ts, src/lib/messages.ts, and src/lib/content-safety.ts: caller-bound UUID handling, authoritative by-UUID read-back, fallback-only write_confirmation, message parsing, and redaction-notice attachment.

Commands and results:

• bun install — exit 0; setup only, 166 packages installed. This is not reported as a repository gate.
• bun run typecheck — exit 0; 0 type errors (the command emitted no test-style pass/fail count).
• bun run test — exit 0; 1587 pass, 0 fail, 5149 expect() calls across 97 files.

Blocking P0/P1 findings: none.

The added assertion matches the reachable authoritative-return path: a successful getMessageByUuid result returns before the fallback branch constructs write_confirmation, while attachSendRedaction preserves the message unchanged when content was not rewritten. The test directly guards that no fallback degradation marker appears on this authoritative result. No production code, trust boundary, credential handling, mutation path, or migration changed.

Non-blocking follow-ups: none.