fix: repair four correctness defects in the send/state/handler paths

- send: the PHOTO_INVALID_DIMENSIONS marker never matched (the description is
  lower-cased, the marker was not), so oversized photos sent by URL were
  classified Permanent instead of taking the download-and-downscale fallback.
- inline: the debounce state was one global slot, so a second user's query
  cancelled the first user's pending answer entirely; it is now per user.
- state: prune_expired wrote back a stale snapshot without the per-chat lock,
  clobbering a concurrent update() (lost edit-message record -> "Expired");
  it now re-reads and prunes under the same lock update() uses.
- send/queue: a task dead-lettered on retry exhaustion kept its keep-alive
  temp media (ugoira MP4) alive until process exit; dead_letter_notify now
  releases it, and enqueue_retry releases when the enqueue itself fails.

Also folds the duplicated retry enqueue in post_send_actions into
send::enqueue_retry (single clock source, single place that releases).

Tests: +6 (marker, per-user debounce x3, keep-alive release, prune contract
x2); the marker and keep-alive cases were verified to fail before the fix.
cargo fmt/clippy clean, 52 + 69 tests pass.

crates/xmedia-bot/src/handlers/callback.rs

@@ -1,7 +1,6 @@
 //! Callback query handling: the edit-before-forward prompt's "forward" and
 //! "template|<name>" buttons.
 
-use super::urls::enqueue_retry;
 use super::{CHAT_STORE, CONFIG, TASK_QUEUE};
 use crate::db::unix_now;
 use crate::send::{self, Task};
@@ -83,7 +82,7 @@ pub async fn callback_query_handler(bot: Bot, query: CallbackQuery) -> Result<()
                         task,
                     }) => {
                         log::info!("forward queued for retry in {delay_seconds:.1}s");
-                        enqueue_retry(&TASK_QUEUE, *task, delay_seconds).await;
+                        send::enqueue_retry(&TASK_QUEUE, *task, delay_seconds).await;
                         bot.answer_callback_query(callback_query_id)
                             .text("Forward queued for retry.")
                             .await?;

crates/xmedia-bot/src/handlers/inline.rs

@@ -3,6 +3,7 @@
 //! inline cache instead of re-fetching.
 
 use super::log_key;
+use std::collections::HashMap;
 use std::sync::LazyLock;
 use teloxide::RequestError;
 use teloxide::prelude::*;
@@ -19,16 +20,65 @@ use x_media::media::Media;
 /// post id. Only answer once the query has been stable for this long.
 const INLINE_DEBOUNCE: std::time::Duration = std::time::Duration::from_millis(800);
 
-/// Last seen inline query and whether it was already answered. Guards the
-/// debounce timer: a repeat of an answered query is served by Telegram's
-/// inline cache (see `cache_time`), not by another fetch.
+/// Last seen inline query per user and whether it was already answered.
+/// Guards the debounce timer: a repeat of an answered query is served by
+/// Telegram's inline cache (see `cache_time`), not by another fetch. Keyed by
+/// user id — a single shared slot would let one user's typing burst (or a
+/// different user's query) cancel another user's pending answer.
 struct InlineDebounceState {
     query: String,
     answered: bool,
 }
 
-static INLINE_DEBOUNCE_STATE: LazyLock<parking_lot::Mutex<Option<InlineDebounceState>>> =
-    LazyLock::new(|| parking_lot::Mutex::new(None));
+#[derive(Default)]
+struct DebounceStates(HashMap<u64, InlineDebounceState>);
+
+impl DebounceStates {
+    /// Records `query` as the user's newest query. Returns false when it is a
+    /// repeat whose answer already went out (Telegram's inline cache serves
+    /// it; re-fetching would only hit the source site again).
+    fn note(&mut self, user_id: u64, query: &str) -> bool {
+        if let Some(prev) = self.0.get(&user_id)
+            && prev.query == query
+            && prev.answered
+        {
+            return false;
+        }
+        self.0.insert(
+            user_id,
+            InlineDebounceState {
+                query: query.to_string(),
+                answered: false,
+            },
+        );
+        true
+    }
+
+    /// Claims the answer for the user's newest query; false when a newer query
+    /// superseded it or the answer was already claimed.
+    fn claim(&mut self, user_id: u64, query: &str) -> bool {
+        let Some(state) = self.0.get_mut(&user_id) else {
+            return false;
+        };
+        if state.query != query || state.answered {
+            return false;
+        }
+        state.answered = true;
+        true
+    }
+
+    /// Releases a claimed-but-unsent answer so a repeat can retry the fetch.
+    fn release(&mut self, user_id: u64, query: &str) {
+        if let Some(state) = self.0.get_mut(&user_id)
+            && state.query == query
+        {
+            state.answered = false;
+        }
+    }
+}
+
+static INLINE_DEBOUNCE_STATE: LazyLock<parking_lot::Mutex<DebounceStates>> =
+    LazyLock::new(|| parking_lot::Mutex::new(DebounceStates::default()));
 
 pub async fn inline_query_handler(bot: Bot, query: InlineQuery) -> Result<(), RequestError> {
     if query.query.is_empty() {
@@ -41,48 +91,23 @@ pub async fn inline_query_handler(bot: Bot, query: InlineQuery) -> Result<(), Re
     // Debounce: record the query and answer only after it has been stable for
     // INLINE_DEBOUNCE (the timer below). An already-answered repeat of the
     // same query is left to Telegram's inline cache instead of re-fetching.
-    {
-        let mut state = INLINE_DEBOUNCE_STATE.lock();
-        if let Some(prev) = state.as_ref()
-            && prev.query == query.query
-            && prev.answered
-        {
-            return respond(());
-        }
-        *state = Some(InlineDebounceState {
-            query: query.query.clone(),
-            answered: false,
-        });
+    let user_id = query.from.id.0;
+    if !INLINE_DEBOUNCE_STATE.lock().note(user_id, &query.query) {
+        return respond(());
     }
     let query_text = query.query.clone();
     tokio::spawn(async move {
         tokio::time::sleep(INLINE_DEBOUNCE).await;
-        // Only the last query of a typing burst survives: earlier timers see
-        // the query changed and give up without answering.
-        {
-            let mut state = INLINE_DEBOUNCE_STATE.lock();
-            let Some(state) = state.as_mut() else {
-                return;
-            };
-            if state.query != query_text || state.answered {
-                return;
-            }
-            // Claim the answer so a repeat of the same query cannot start a
-            // second fetch; reset below when no answer was produced.
-            state.answered = true;
+        // Only the user's last query of a typing burst survives: earlier
+        // timers see the query changed and give up without answering.
+        if !INLINE_DEBOUNCE_STATE.lock().claim(user_id, &query_text) {
+            return;
         }
         match answer_inline_query(bot, query).await {
             Ok(true) => {}
             // No results produced (or nothing to answer): let a repeat of the
             // same query retry the fetch.
-            Ok(false) | Err(_) => {
-                let mut state = INLINE_DEBOUNCE_STATE.lock();
-                if let Some(state) = state.as_mut()
-                    && state.query == query_text
-                {
-                    state.answered = false;
-                }
-            }
+            Ok(false) | Err(_) => INLINE_DEBOUNCE_STATE.lock().release(user_id, &query_text),
         }
     });
     respond(())
@@ -159,3 +184,49 @@ async fn answer_inline_query(bot: Bot, query: InlineQuery) -> Result<bool, Reque
     }
     Ok(false)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::DebounceStates;
+
+    const URL_A: &str = "https://x.com/a/status/1";
+    const URL_B: &str = "https://x.com/b/status/2";
+
+    #[test]
+    fn debounce_state_is_per_user() {
+        let mut states = DebounceStates::default();
+        // Two users query different links: both proceed, and neither timer
+        // cancels the other (a single shared slot dropped one of them).
+        assert!(states.note(1, URL_A));
+        assert!(states.note(2, URL_B));
+        assert!(states.claim(1, URL_A), "user 1's answer was cancelled");
+        assert!(states.claim(2, URL_B), "user 2's answer was cancelled");
+    }
+
+    #[test]
+    fn answered_query_is_suppressed_per_user_only() {
+        let mut states = DebounceStates::default();
+        assert!(states.note(1, URL_A));
+        assert!(states.claim(1, URL_A));
+        // A repeat of the answered query by the same user is left to
+        // Telegram's inline cache.
+        assert!(!states.note(1, URL_A));
+        // Another user pasting the same link still gets an answer.
+        assert!(states.note(2, URL_A));
+        assert!(states.claim(2, URL_A));
+    }
+
+    #[test]
+    fn newer_query_supersedes_and_failed_answer_is_released() {
+        let mut states = DebounceStates::default();
+        assert!(states.note(1, URL_A));
+        assert!(states.note(1, URL_B));
+        // The stale timer for the half-typed query gives up…
+        assert!(!states.claim(1, URL_A));
+        // …and the newest one answers.
+        assert!(states.claim(1, URL_B));
+        // No results → release so a repeat may retry the fetch.
+        states.release(1, URL_B);
+        assert!(states.claim(1, URL_B));
+    }
+}

crates/xmedia-bot/src/handlers/urls.rs

@@ -3,7 +3,6 @@
 
 use super::{CHAT_STORE, CONFIG, LINK_CACHE, TASK_QUEUE, log_key, reply};
 use crate::config::Config;
-use crate::db::now_f64;
 use crate::link_cache::{CachedMediaKind, CachedPost, LinkCache};
 use crate::media_sender::MediaSender;
 use crate::queue::PersistentTaskQueue;
@@ -174,14 +173,6 @@ fn media_to_payload(media: &Media, sensitive: bool) -> MediaItemPayload {
     }
 }
 
-pub(crate) async fn enqueue_retry(queue: &PersistentTaskQueue, task: Task, delay_seconds: f64) {
-    let payload = serde_json::to_value(task).expect("task serializes");
-    let run_after = now_f64() + delay_seconds;
-    if let Err(e) = queue.enqueue(payload, run_after).await {
-        log::error!("failed to enqueue retry: {e}");
-    }
-}
-
 /// Sends a task and handles the outcome: post-send actions on success, retry
 /// enqueue on retryable failure, reply + link-cache invalidation on
 /// permanent failure (a stale cached file id must not repeat forever).
@@ -216,7 +207,7 @@ async fn dispatch_send(
                 "send for [key={}] failed, queued for retry in {delay_seconds:.1}s",
                 log_key(url)
             );
-            enqueue_retry(ctx.task_queue, *task, delay_seconds).await;
+            send::enqueue_retry(ctx.task_queue, *task, delay_seconds).await;
             let _ = reply(
                 ctx.sender,
                 chat_id,