Pin the spent-base cap and state the boundary the merge rule covers

AGENTS.md

@@ -247,9 +247,10 @@ exactly 140.
   straggler for a message whose group is gone cannot be told from a receipt for a later message the
   peer handed the same ids — an SMSC whose id counter restarts with its process is the realistic
   case. `DlrMerger` remembers the bases it has finished with, capped and expiring exactly like the
-  groups, and refuses to open one a second time. Neither message merges: the later one gets no
-  `messageDlr`, and an earlier one whose receipts are still arriving is dropped rather than left to
-  collect the later one's. Every segment still reaches the application as a `dlr`.
+  groups, and refuses to open one a second time: the later message gets no `messageDlr`, and an
+  earlier one whose receipts are still arriving is dropped rather than left to collect the later
+  one's. Every segment still reaches the application as a `dlr`. The rule covers the bases the
+  merger opened — `expect()` ignores a lone id, so a single-part message never claims one.
 
 - **The TLS tests build their own self-signed certificate in DER** (`test/tls.test.ts`) instead of
   adding a devDependency or shelling out to openssl. Maintainer's call, 2026-08-26: the dev image

test/session.test.ts

@@ -1621,6 +1621,10 @@ describe('merged delivery report bounds', () => {
 		dlrMerger.expect(['reused-1', 'reused-2']);
 
 		assert.equal(dlrMerger.size, 0);
+
+		dlrMerger.expect(['other-1', 'other-2']);
+
+		assert.equal(dlrMerger.size, 1);
 	});
 
 	test('keeps another message when a held base is opened again', () => {