* fix(whatsapp): unknown-sender quota RPC fails open to the throttled greeting path (#1599)
When check_and_increment_whatsapp_sender_quota errored, handleUnknownSender
logged, wrote a fail-closed trace row and returned: a transient DB hiccup
silenced a first-time sender at the exact moment they were trying to link.
The limiter being unavailable now falls through to the existing greeting
path, whose own throttle (1 M1 per hour for text, 10-minute media burst,
3 per day, fail-closed on its own read error) and the single-use link-code
claim already bound outbound volume. A thrown RPC (network) is treated the
same as a PostgREST error.
Over-quota (ok: false) is untouched: silent by design, decline trace kept.
In degraded mode a valid code still binds and gets M3; a bad code gets the
throttled M1 instead of M2, because only the quota bounds M2. The greeting
dispositions carry a ' (quota limiter unavailable)' suffix so support can
tell the two modes apart; suffix rather than prefix because last-event.ts
matches dispositions with startsWith.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2
* fix(whatsapp): answer a bad link code with a throttled M2 in degraded mode
Review finding on #1991: withholding M2 while the quota RPC is down left
the worst sub-path of the linking moment silent. A sender greeted with M1
inside the last hour who then sends an expired or mistyped code fell
through to the greeting path, where the 1/hour rule declined M1, so they
heard nothing at all; exactly the silence issue #1599 targets.
M2 now gets its own small bound instead of being withheld: a new
badCodeThrottled read in lib/conversation.ts (mirrors greetingThrottled,
keyed on raw_payload->>template = m2_bad_code: 1 per 10 minutes, 3 per
day per phone hash, fail-closed on read error). In degraded mode a bad
code sends M2 when that throttle allows and otherwise falls through to
the existing M1/silence path. The normal path is untouched: the
short-circuit only does the extra read when the quota RPC was
unavailable. The M2 trace disposition carries the degraded suffix.
Tests: the replaced "withholds M2" case now asserts M2 goes out once
under its own throttle with the degraded trace suffix; new cases cover a
repeated bad code inside the 10 min window (silent skipped trace via the
greeting throttle), the 3/day cap, and an unreadable M2 window failing
closed to the M1 path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg
57ff2eda96