@inetafrica/open-claudia 3.4.6 → 3.4.11

package/channels/kazee/call/session.js

@@ -73,7 +73,7 @@ const ACK_CHIME_PCM48 = tonePcm48([{ freq: 660, ms: 90 }, { freq: 990, ms: 110 }
 const THINK_TICK_PCM48 = tonePcm48([{ freq: 520, ms: 90 }], 0.045);
 
 class KazeeCallSession {
-  constructor({ roomId, chatId, callerId, botUserId, janusUrl, iceServers = [], onTranscript, onEnded,
+  constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], onTranscript, onEnded, onMediaReady,
     maxCallMs, idleMs, finalWaitMs, synthesize = synthesizePcm, synthesizeStream = null, asCaller = false, greeting = null,
     JanusClientImpl = JanusClient, PeerConnectionImpl = RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
     this.roomId = Number(roomId);
@@ -81,18 +81,29 @@ class KazeeCallSession {
     this.callerId = String(callerId);
     this.botUserId = String(botUserId);
     this.asCaller = !!asCaller;
+    this.managedRoom = managedRoom;
+    this.janusTokenExpiresAt = janusTokenExpiresAt;
+    this.roomToken = roomToken;
+    this.roomTokenExpiresAt = roomTokenExpiresAt;
+    this.refreshRoomAccess = refreshRoomAccess;
+    this.privateId = null;
     this.greeting = greeting ? String(greeting) : null;
     this._greeted = false;
     this._publisherUp = false;
     this._createdRoom = false;
     this._joined = false;
     this._publishTimer = null;
-    this.janus = new JanusClientImpl({ url: janusUrl });
+    this.janus = new JanusClientImpl({ url: janusUrl, token: janusToken });
     this.PeerConnectionImpl = PeerConnectionImpl;
     this.SpeechStreamImpl = SpeechStreamImpl;
     this.iceServers = iceServers;
     this.onTranscript = onTranscript || (() => {});
     this.onEnded = onEnded || (() => {});
+    this.onMediaReady = onMediaReady || (() => {});
+    this._sentRtp = false;
+    this._receivedRtp = false;
+    this._reportedMediaReady = false;
+    this._roomRefresh = null;
     this.synthesize = synthesize;
     // Tests and the jig inject a custom synthesize; only pair the streaming
     // path with the service client it belongs to.
@@ -123,11 +134,32 @@ class KazeeCallSession {
     this.ssrc = Math.floor(Math.random() * 0xffffffff);
   }
 
+  async _roomAuth(force = false) {
+    if (!this.managedRoom) return this.roomToken ? { token: this.roomToken } : {};
+    if (force || !this.roomToken || this.roomTokenExpiresAt <= Date.now() + 10000) {
+      if (!this.refreshRoomAccess) throw new Error("Call room credentials expired");
+      if (!this._roomRefresh) {
+        this._roomRefresh = Promise.resolve().then(() => this.refreshRoomAccess()).then(access => {
+          if (this.closed) throw new Error("Call ended during credential refresh");
+          this.roomToken = access.roomToken;
+          this.roomTokenExpiresAt = access.roomTokenExpiresAt;
+          if (access.janusToken) this.janus.token = access.janusToken;
+          if (access.janusTokenExpiresAt !== undefined) this.janusTokenExpiresAt = access.janusTokenExpiresAt;
+        }).finally(() => { this._roomRefresh = null; });
+      }
+      await this._roomRefresh;
+    }
+    if (!this.roomToken || !Number.isFinite(this.roomTokenExpiresAt) || this.roomTokenExpiresAt <= Date.now()) throw new Error("Call room credentials unavailable");
+    return { token: this.roomToken };
+  }
+
   async start() {
     await this.janus.connect();
+    if (this.closed) { await this.janus.close(); throw new Error("Call ended during setup"); }
     this.publisherHandle = await this.janus.attach();
+    if (this.closed) { await this.janus.detach(this.publisherHandle); throw new Error("Call ended during setup"); }
     this.janus.onHandle(this.publisherHandle, (frame) => this._onPublisherEvent(frame));
-    if (this.asCaller) {
+    if (this.asCaller && !this.managedRoom) {
       // Outbound: the caller side owns room lifecycle, mirroring the web
       // client's create params (audio-only, so no videocodec).
       const created = await this.janus.message(this.publisherHandle, {
@@ -151,8 +183,9 @@ class KazeeCallSession {
     // receiver's retry loop in CallContext.startVideoRoom.
     let joined;
     for (let attempt = 0; ; attempt += 1) {
+      if (this.closed) throw new Error("Call ended during setup");
       joined = await this.janus.message(this.publisherHandle, {
-        request: "join", ptype: "publisher", room: this.roomId, display: `open-claudia:${this.botUserId}`,
+        ...(await this._roomAuth()), request: "join", ptype: "publisher", room: this.roomId, display: `open-claudia:${this.botUserId}`,
       });
       const data = joined?.plugindata?.data || {};
       const noRoom = Number(data.error_code) === 426 || /no such room/i.test(String(data.error || ""));
@@ -180,6 +213,7 @@ class KazeeCallSession {
       if (data.error_code != null) error.code = Number(data.error_code);
       throw error;
     }
+    if (data.videoroom === "joined") this.privateId = data.private_id ?? null;
     for (const publisher of data.publishers || []) {
       const feedId = Number(publisher.id);
       if (!this.subscribers.has(feedId) && !String(publisher.display || "").startsWith("open-claudia:")) {
@@ -291,6 +325,7 @@ class KazeeCallSession {
     clog(`Kazee call subscribing: feed=${feedId} display=${String(display || "")}`);
     try {
       const handle = await this.janus.attach();
+      if (this.closed) { await this.janus.detach(handle); this.subscribers.delete(feedId); return; }
       const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
       pc.iceConnectionStateChange?.subscribe?.((state) => clog(`Kazee call subscriber ICE: ${state} feed=${feedId}`));
       const sub = {
@@ -322,7 +357,7 @@ class KazeeCallSession {
         if (track.kind === "audio") track.onReceiveRtp.subscribe((packet) => this._onFeedRtp(feedId, packet));
       });
       this.janus.onHandle(handle, (frame) => this._onSubscriberEvent(feedId, frame));
-      const attached = await this.janus.message(handle, { request: "join", ptype: "subscriber", room: this.roomId, feed: feedId });
+      const attached = await this.janus.message(handle, { ...(await this._roomAuth()), request: "join", ptype: "subscriber", room: this.roomId, feed: feedId, ...(this.privateId != null ? { private_id: this.privateId } : {}) });
       await this._consumeSubscriberFrame(feedId, attached);
       await sub.stt.connect().then(
         () => clog(`Kazee call STT connected: feed=${feedId}`),
@@ -470,7 +505,14 @@ class KazeeCallSession {
     });
   }
 
+  _reportMediaReady() {
+    if (this.closed || this._reportedMediaReady || !this._sentRtp || !this._receivedRtp) return;
+    this._reportedMediaReady = true;
+    this.onMediaReady();
+  }
+
   _writeFrame(frame) {
+    if (this.closed || !this.publisher?.track?.writeRtp) return;
     if (frame.length < WEBRTC_SAMPLES * 2) frame = Buffer.concat([frame, Buffer.alloc(WEBRTC_SAMPLES * 2 - frame.length)]);
     const opus = this.codec.encode(frame);
     const payloadType = this.publisher?.sender?.codec?.payloadType || 111;
@@ -478,6 +520,8 @@ class KazeeCallSession {
       payloadType, sequenceNumber: this.sequence++ & 0xffff, timestamp: this.timestamp >>> 0, ssrc: this.ssrc,
     }), opus));
     this.timestamp = (this.timestamp + WEBRTC_SAMPLES) >>> 0;
+    this._sentRtp = true;
+    this._reportMediaReady();
   }
 
   // Writes a short cue into the outbound track. Yields to real speech: the
@@ -512,6 +556,8 @@ class KazeeCallSession {
     if (this.closed || !packet?.payload?.length) return;
     const sub = this.subscribers.get(feedId);
     if (!sub) return;
+    this._receivedRtp = true;
+    this._reportMediaReady();
     if (!sub.firstRtpAt) {
       sub.firstRtpAt = Date.now();
       clog(`Kazee call first RTP: feed=${feedId}`);
@@ -712,6 +758,12 @@ class KazeeCallSession {
   async _enforceLimits() {
     if (this.closed || this._ending) return;
     const now = Date.now();
+    if (this.managedRoom && this.janusTokenExpiresAt !== undefined && this.janusTokenExpiresAt <= now + 60000) {
+      if (this.janusTokenExpiresAt <= now) { await this.close("credentials-expired"); return; }
+      // Uses the same single in-flight request as subscriber room-token refresh.
+      // The next limit tick still closes at expiry if this request stalls.
+      this._roomAuth(true).catch(() => {});
+    }
     const overMax = now - this._startedAt >= this.maxCallMs;
     // An audible thinking loop means a turn is still being worked on — that is
     // not idleness, or long provider turns would get hung up on mid-answer.
@@ -743,6 +795,7 @@ class KazeeCallSession {
   async close(reason = "ended") {
     if (this.closed) return;
     this.closed = true;
+    this._leaseHeartbeat?.close();
     console.log(`Kazee call session closed: room=${this.roomId} reason=${reason}`);
     if (this._limitTimer) { clearInterval(this._limitTimer); this._limitTimer = null; }
     this._clearPublishTimer();

package/core/scheduler.js

@@ -120,6 +120,7 @@ function createSchedulerService(dependencies = {}) {
   const admit = dependencies.admitRunContext || ((...args) => require("./runner").admitRunContext(...args));
   const timers = new Map();
   const checksInFlight = new Set();
+  const firesInFlight = new Set();
   // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
   // agent; non-zero → still idle, skip silently. Runs in the job's project
   // dir with the process env, output discarded (exit code is the contract),
@@ -344,18 +345,15 @@ function createSchedulerService(dependencies = {}) {
   function markBusy(job) {
     const latest = jobsStore.get(job.id) || job;
     const busyDeferralCount = (latest.busyDeferralCount || 0) + 1;
-    const dead = busyDeferralCount >= (latest.maxAttempts || 1);
     const patch = {
-      status: dead ? "dead-letter" : "deferred",
-      disabled: dead,
+      status: "deferred",
+      disabled: false,
       busyDeferralCount,
-      nextAttemptAt: dead ? null : now() + busyDelayMs,
-      lastError: dead ? { code: "SCHEDULED_BUSY_EXHAUSTED", message: "Channel remained busy through every bounded deferral" } : null,
+      nextAttemptAt: now() + busyDelayMs,
     };
     const updated = jobsStore.update(job.id, patch) || { ...latest, ...patch };
-    if (!dead) armRetry(updated, busyDelayMs);
-    else unscheduleJob(job.id);
-    return { ok: false, deferred: !dead, status: updated.status, job: updated };
+    armRetry(updated, busyDelayMs);
+    return { ok: false, deferred: true, status: updated.status, job: updated };
   }
 
   async function settleSuccess(job, result, target) {
@@ -396,6 +394,10 @@ function createSchedulerService(dependencies = {}) {
       attemptCount: 0,
       busyDeferralCount: 0,
       nextAttemptAt: null,
+      watchTriggeredOccurrenceId: null,
+      watchTriggeredAt: null,
+      watchExpired: false,
+      advisoryOccurrenceId: null,
     });
     if (reset && timers.get(job.id)?.timeout) scheduleJob(reset);
     return reset
@@ -404,6 +406,14 @@ function createSchedulerService(dependencies = {}) {
   }
 
   async function fireJob(idOrJob, options = {}) {
+    const id = typeof idOrJob === "string" ? idOrJob : idOrJob?.id;
+    if (firesInFlight.has(id)) return { ok: false, status: "running", skipped: true, inFlight: true };
+    firesInFlight.add(id);
+    try { return await executeJob(idOrJob, options); }
+    finally { firesInFlight.delete(id); }
+  }
+
+  async function executeJob(idOrJob, options = {}) {
     const requested = typeof idOrJob === "string" ? jobsStore.get(idOrJob) : idOrJob;
     let job = requested?.id && jobsStore.get(requested.id) ? jobsStore.get(requested.id) : requested;
     if (!job) return { ok: false, status: "missing" };
@@ -423,7 +433,7 @@ function createSchedulerService(dependencies = {}) {
     // runs the check and only wakes the agent when it exits 0. A non-zero exit
     // is the normal idle case: skip silently, mark nothing, leave the job
     // pending so the next tick polls again. Never marks failure; never chats.
-    if (job.check) {
+    if (job.check && job.watchTriggeredOccurrenceId !== job.occurrenceId) {
       if (!watchesEnabled()) {
         logWatch(job, "skipped (watches disabled globally)");
         return { ok: false, status: "watch-disabled", skipped: true };
@@ -443,27 +453,30 @@ function createSchedulerService(dependencies = {}) {
           logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
           return { ok: false, status: "watch-idle", skipped: true };
         }
-        logWatch(job, `expired without firing (check exit ${check ? check.code : "?"}) — waking agent`);
         // Expiry ends the watch's window: one-shot removal even for --repeat
         // (the woken agent re-arms if still wanted). Persisted so a retry of a
         // failed expiry fire keeps the same semantics across restarts.
-        try {
-          const marked = jobsStore.update(job.id, { repeat: false, watchExpired: true });
-          if (marked) job = marked;
-          else { job.repeat = false; job.watchExpired = true; }
-        } catch (_) { job.repeat = false; job.watchExpired = true; }
+        job = { ...job, repeat: false, watchExpired: true };
       } else {
-        logWatch(job, "triggered (check passed) — waking agent");
-        if (job.watchExpired) {
-          // A prior expiry fire failed and the condition came true before the
-          // retry: report it as a real trigger, not an expiry.
-          try {
-            const cleared = jobsStore.update(job.id, { watchExpired: false });
-            if (cleared) job = cleared;
-            else job.watchExpired = false;
-          } catch (_) { job.watchExpired = false; }
-        }
+        job = { ...job, watchExpired: false };
       }
+      // Latch the condition before admission or notification. Delivery retries
+      // and restarts must not run the check again or change an expiry's meaning.
+      try {
+        const marked = jobsStore.update(job.id, {
+          status: "deferred",
+          nextAttemptAt: now(),
+          repeat: job.repeat,
+          watchExpired: job.watchExpired,
+          watchTriggeredOccurrenceId: job.occurrenceId,
+          watchTriggeredAt: now(),
+        });
+        if (!marked) throw new Error("watch trigger could not be persisted");
+        job = marked;
+      } catch (error) {
+        return { ok: false, status: "failed", error: stableFailure(error) };
+      }
+      logWatch(job, job.watchExpired ? "expired without firing — delivery queued" : "triggered (check passed) — delivery queued");
     }
 
     const adapter = resolveAdapter(job);
@@ -557,7 +570,14 @@ function createSchedulerService(dependencies = {}) {
         : target.fallbackFrom
           ? `\n⚠️ ${target.fallbackFrom} is unavailable — running on fallback ${target.provider}.`
           : "";
-      try { await send(`${advisory}${providerNote}`); } catch (_) { /* advisory only */ }
+      if (job.advisoryOccurrenceId !== job.occurrenceId) {
+        // At-most-once advisory: persist before sending so a restart cannot
+        // repeat it. A crash between these steps may omit this optional notice.
+        try {
+          if (!jobsStore.update(job.id, { advisoryOccurrenceId: job.occurrenceId })) throw new Error("advisory marker could not be persisted");
+          await send(`${advisory}${providerNote}`);
+        } catch (_) { /* advisory only */ }
+      }
       let result;
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {

package/docs/PROVIDER_MIGRATION.md

@@ -64,4 +64,8 @@ The pointer, provider-tagged history lineage, and tuple-scoped usage checkpoint
 
 Scheduled work uses a versioned `{schemaVersion, jobs, archived}` document. Every runnable occurrence stores its canonical user, channel, project, provider, provider-settings snapshot, native session lineage, origin run, and stable occurrence ID. A fresh foreground turn can create a job before its native session is known; terminal session persistence binds that job by origin run ID. Compaction descendants are followed only when recorded lineage proves the relationship, and an older scheduled branch cannot replace an unrelated live session pointer.
 
-Wakeups and crons wait for terminal provider completion, transcript/usage/session persistence, and required delivery. A one-shot receives a durable success marker before deletion. Busy or failed occurrences retain their occurrence ID and bounded attempt state across restart; exhaustion and wakeups outside the missed-fire grace window remain visible as disabled dead letters. Provider fallback is empty by default. When `PROVIDER_FALLBACKS` is explicitly configured, a fallback starts a fresh provider session with an archived provider-neutral brief and never receives another provider's native session ID. Legacy `crons.json` remains byte-for-byte untouched after its ambiguous records are copied into the disabled archive.
+Wakeups and crons wait for terminal provider completion, transcript/usage/session persistence, and required delivery. A one-shot receives a durable success marker before deletion. Busy occurrences retain their occurrence ID across restart and wait until the chat is idle, without consuming execution attempts or expiring under the missed-fire grace window. Genuine execution failures still have bounded retries; exhaustion and wakeups never admitted within the missed-fire grace window remain visible as disabled dead letters.
+
+A watch persists its trigger (or expiry) before delivery and does not poll its check again while that occurrence is pending. Repeat watches resume polling only after successful delivery advances the occurrence. An in-process guard prevents overlapping callbacks from starting the same occurrence, even when a run lasts longer than its retry delay. Advisory notifications are marked before sending and attempted at most once per occurrence across retries/restarts; a crash between marking and sending can omit this optional notice. An interrupted provider run may still retry with the same occurrence ID if no durable success marker exists; this is not an exactly-once guarantee for external side effects. Previously dead-lettered jobs are not automatically revived because their queued actions may now be stale.
+
+Provider fallback is empty by default. When `PROVIDER_FALLBACKS` is explicitly configured, a fallback starts a fresh provider session with an archived provider-neutral brief and never receives another provider's native session ID. Legacy `crons.json` remains byte-for-byte untouched after its ambiguous records are copied into the disabled archive.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.6",
+  "version": "3.4.11",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -150,7 +150,7 @@
   "dependencies": {
     "node-cron": "^4.2.1",
     "node-telegram-bot-api": "^0.67.0",
-    "opusscript": "^0.1.1",
+    "opusscript": "0.1.1",
     "socket.io-client": "^4.7.5",
     "werift": "^0.23.0",
     "ws": "^8.21.1"

package/test-cursor-removal.js

@@ -116,11 +116,14 @@ function migrationOrderingAndRollbackProbe(migrationApi) {
         OPEN_CLAUDIA_TEST: "1",
       },
       encoding: "utf8",
-      timeout: 30000,
+      // This probes durable migration ordering, not a latency contract.
+      // Shared CI disks can take tens of seconds for the required fsyncs.
+      timeout: 120000,
     });
     fs.mkdirSync(path.join(temp, "home"), { recursive: true });
     fs.mkdirSync(path.join(temp, "workspace"), { recursive: true });
     const first = runUpgrade();
+    assert.ifError(first.error);
     assert.strictEqual(first.status, 0, first.stderr || first.stdout);
     const upgraded = JSON.parse(first.stdout);
     assert.strictEqual(upgraded.state.schemaVersion, 3);

package/test-kazee-call-audio.js

@@ -24,8 +24,30 @@ const packet = codec.encode(source);
 const decoded = codec.decode(packet);
 assert.strictEqual(decoded.length, source.length, "Opus round trip preserves the 20ms frame size");
 assert(rmsDbfs(decoded) > -20, "decoded tone has useful signal energy");
+const OriginalOpus=require('opusscript');
+const original=new OriginalOpus(48000,1,OriginalOpus.Application.VOIP);
+try {
+  assert(rmsDbfs(Buffer.from(original.decode(packet)))>-20,'original package decodes new wrapper');
+  assert(rmsDbfs(codec.decode(original.encode(source,WEBRTC_SAMPLES)))>-20,'new wrapper decodes original package');
+} finally {original.delete();}
 codec.close();
 
+// Force shared WASM growth after earlier instances cached their inputs/outputs.
+const many = [];
+try {
+  for (let i=0;i<100;i++) many.push(new OpusAudioCodec());
+  for (const active of many) {
+    const encoded=active.encode(source);
+    const audio=active.decode(encoded);
+    assert.equal(audio.length,source.length);
+    assert(rmsDbfs(audio)>-20);
+  }
+  // Keep the first codec alive while the others free/reallocate memory.
+  for (const active of many.slice(1)) active.close();
+  for (let i=0;i<100;i++) {const next=new OpusAudioCodec(); next.close();}
+  assert.equal(many[0].decode(many[0].encode(source)).length,source.length);
+} finally {for(const active of many)active.close();}
+
 const pcm16 = downsample48To16(source);
 assert.strictEqual(pcm16.length, 320 * 2, "48k→16k produces 320 samples for a 20ms frame");
 const pcm48 = upsampleTo48(pcm16, 16000);

package/test-kazee-call-janus.js

@@ -10,10 +10,12 @@ async function main() {
   await new Promise((resolve) => server.once("listening", resolve));
   const port = server.address().port;
   const seen = [];
+  let expectedToken = "root-test-token";
 
   server.on("connection", (socket) => socket.on("message", (raw) => {
     const frame = JSON.parse(raw.toString());
     seen.push(frame.janus);
+    assert.strictEqual(frame.token, expectedToken, "root authentication is present on every actual WebSocket request");
     if (frame.janus === "create") {
       socket.send(JSON.stringify({ janus: "success", transaction: frame.transaction, data: { id: 42 } }));
     } else if (frame.janus === "attach") {
@@ -32,7 +34,7 @@ async function main() {
     }
   }));
 
-  const client = new JanusClient({ url: `ws://127.0.0.1:${port}`, keepaliveMs: 60000 });
+  const client = new JanusClient({ url: `ws://127.0.0.1:${port}`, keepaliveMs: 60000, token: "root-test-token" });
   await client.connect();
   assert.strictEqual(client.sessionId, 42);
   const handle = await client.attach();
@@ -42,9 +44,12 @@ async function main() {
   const joined = await client.message(handle, { request: "join", ptype: "publisher", room: 7 });
   assert.strictEqual(joined.plugindata.data.videoroom, "joined", "ack is ignored until the plugin event arrives");
   assert.strictEqual(handleEvent?.sender, 84, "plugin event is also delivered to the handle listener");
+  expectedToken = client.token = "renewed-root-token";
+  await client.message(handle, { request: "configure", audio: true });
+  assert.strictEqual(client.sessionId, 42, "renewal retains the same live session");
   await client.close();
   await new Promise((resolve) => server.close(resolve));
-  assert.deepStrictEqual(seen.slice(0, 4), ["create", "attach", "message", "destroy"]);
+  assert.deepStrictEqual(seen, ["create", "attach", "message", "message", "destroy"]);
   console.log("kazee call Janus control plane: ok");
 }
 

package/test-kazee-call-manager.js

@@ -27,7 +27,7 @@ function fixture() {
   await f.manager.incoming({ fromUserId: "owner-1", fromUserName: "Owner", chatId: "chat", roomId: 12, callType: "audio" });
   // Ringing must go out first (caller UI feedback), then the accept.
   assert.strictEqual(f.events[0].name, "call:ringing");
-  assert.deepStrictEqual(f.events[0].payload, { toUserId: "owner-1", chatId: "chat" });
+  assert.deepStrictEqual(f.events[0].payload, { toUserId: "owner-1", chatId: "chat", roomId: 12 });
   assert.strictEqual(f.events[1].name, "call:accept");
   f.manager.session.options.onTranscript("What is on my agenda?");
   assert.strictEqual(f.inbound[0].payload.raw.ephemeralAudio, true);
@@ -49,12 +49,11 @@ function fixture() {
   assert.ok(outSession.options.greeting);
   assert.strictEqual(outSession.started, true);
   const invite = f.events.find((e) => e.name === "call:invite");
-  assert.deepStrictEqual(invite.payload, { toUserId: "owner-1", callType: "audio", chatId: "chat-2", roomId: res.roomId });
+  assert.deepStrictEqual(invite.payload, { toUserId: "owner-1", callType: "audio", chatId: "chat-2", roomId: res.roomId, callAttemptId: res.callAttemptId });
   assert.ok(f.manager._ringTimer);
-  // A callee device auto-ending its ring must NOT tear down the outbound call —
-  // chat-central revives the CallLog if the human answers late.
-  await f.manager.ended({ chatId: "chat-2" });
-  assert.ok(f.manager.session, "ended-while-ringing is ignored");
+  // A stale previous-attempt termination must not affect the active ring.
+  await f.manager.ended({ chatId: "chat-2", callAttemptId: "previous-attempt-123456" });
+  assert.ok(f.manager.session, "stale ended is ignored");
   f.manager.accepted({ chatId: "chat-2" });
   assert.strictEqual(f.manager._ringTimer, null);
   // Outbound transcripts dispatch with the remote human as the "from" side.
@@ -80,7 +79,137 @@ function fixture() {
   f.manager._clearRingTimer();
   await f.manager._ringTimeout("owner-1", "chat-3", res2.roomId);
   const end = f.events.find((e) => e.name === "call:end");
-  assert.deepStrictEqual(end.payload, { toUserId: "owner-1", chatId: "chat-3" });
+  assert.deepStrictEqual(end.payload, { toUserId: "owner-1", chatId: "chat-3", roomId: res2.roomId, callAttemptId: res2.callAttemptId });
   assert.strictEqual(f.manager.session, null);
+  // Managed allocation is completed before Session.start, and credentials stay off relays.
+  f = fixture();
+  const { EventEmitter } = require("events");
+  const socket = new EventEmitter();
+  socket.connected = true;
+  const emitted = [];
+  let replyPlacement = {nodeId: "secondary", server: "wss://assigned/janus"};
+  const originalEmit = socket.emit.bind(socket);
+  socket.emit = (name, payload) => {
+    emitted.push({ name, payload });
+    if (["call:allocate", "call:room-access"].includes(name)) {
+      setImmediate(() => originalEmit(`${name}-result`, { requestId: payload.requestId, ok: true, protocolVersion: 3,
+        callAttemptId: "managed-attempt-123456789", organizationId: "tenant-a", roomId: 100, chatId: "managed-chat",
+        deviceId: payload.deviceId, generation: 0, ...replyPlacement, janusToken: "root-token", roomToken: "room-token", roomTokenExpiresAt: Date.now() + 300000, leaseExpiresAt: Date.now() + 120000 }));
+    }
+    return originalEmit(name, payload);
+  };
+  f.manager.adapter._socket = socket;
+  f.manager.adapter._request = async () => ({ config: { roomAdmissionEnabled: true, janusServer: "wss://managed/janus", iceServers: [{ urls: ["turn:relay:3478", "turn:relay:3478?transport=tcp"], username: "test", credential: "test" }] } });
+  await f.manager.outgoing({ chatId: "managed-chat" });
+  assert.strictEqual(f.manager.session.options.managedRoom, true);
+  assert.strictEqual(f.manager.session.options.janusToken, "root-token");
+  assert.strictEqual(f.manager.session.options.roomToken, "room-token");
+  assert.strictEqual(f.manager.session.options.janusUrl, "wss://assigned/janus");
+  assert.deepStrictEqual(f.manager.session.options.iceServers[0].urls, ["turn:relay:3478"]);
+  const refreshed = await f.manager.session.options.refreshRoomAccess();
+  assert.strictEqual(refreshed.server, "wss://assigned/janus");
+  replyPlacement = {nodeId: "secondary", server: "wss://other/janus"};
+  await assert.rejects(f.manager.session.options.refreshRoomAccess(), /placement changed/);
+  replyPlacement = {nodeId: "secondary", server: "wss://assigned/janus", generation: 1};
+  await assert.rejects(f.manager.session.options.refreshRoomAccess(), /placement changed/);
+  replyPlacement = {nodeId: "other", server: "wss://assigned/janus"};
+  await assert.rejects(f.manager.session.options.refreshRoomAccess(), /placement changed/);
+  replyPlacement = {nodeId: "secondary", server: "wss://assigned/janus"};
+  assert.strictEqual(f.manager.session.callIdentity.deviceId, f.manager.deviceId);
+  const managedInvite = emitted.find(event => event.name === "call:invite").payload;
+  assert.strictEqual(managedInvite.callAttemptId, "managed-attempt-123456789");
+  assert.strictEqual(managedInvite.deviceId, f.manager.deviceId);
+  assert.strictEqual(managedInvite.generation, 0);
+  assert.strictEqual(managedInvite.janusToken, undefined);
+  assert.strictEqual(managedInvite.roomToken, undefined);
+  f.manager.accepted({ chatId: "managed-chat", callAttemptId: "stale-attempt-123456789" });
+  assert.ok(f.manager._ringTimer, "stale acceptance must not stop ring deadline");
+  const managedSession = f.manager.session;
+  managedSession.options.onMediaReady();
+  assert.strictEqual(emitted.filter(event => event.name === "call:heartbeat").length, 0, "unaccepted media cannot renew a lease");
+  f.manager.accepted({ chatId: "managed-chat", callAttemptId: managedInvite.callAttemptId });
+  const heartbeat = emitted.find(event => event.name === "call:heartbeat").payload;
+  assert.strictEqual(heartbeat.mediaReady, true);
+  assert.strictEqual(heartbeat.deviceId, f.manager.deviceId);
+  assert.strictEqual(heartbeat.callAttemptId, managedInvite.callAttemptId);
+  assert.strictEqual(heartbeat.roomToken, undefined);
+  originalEmit("call:heartbeat-result", { requestId: heartbeat.requestId, ok: true, leaseExpiresAt: Date.now() + 120000 });
+
+  await f.manager.ended({ chatId: "managed-chat", roomId: 100, callAttemptId: managedInvite.callAttemptId });
+  assert.strictEqual(f.manager.session, null, "authoritative end also ends an unanswered modern call");
+  assert.strictEqual(socket.listenerCount("call:allocate-result"), 0);
+  assert.strictEqual(socket.listenerCount("call:heartbeat-result"), 0, "ended manager session releases lease listener");
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "audio", callAttemptId: managedInvite.callAttemptId, organizationId: "tenant-a" });
+  const incomingManaged = f.manager.session;
+  const managedAccept = emitted.filter(event => event.name === "call:accept").at(-1).payload;
+  assert.strictEqual(managedAccept.deviceId, f.manager.deviceId);
+  assert.strictEqual(managedAccept.generation, 0);
+  const previousBeats = emitted.filter(event => event.name === "call:heartbeat").length;
+  assert.strictEqual(incomingManaged._accepted, true);
+  incomingManaged.options.onMediaReady();
+  assert.strictEqual(emitted.filter(event => event.name === "call:heartbeat").length, previousBeats + 1);
+  const deniedBeat = emitted.filter(event => event.name === "call:heartbeat").at(-1).payload;
+  originalEmit("call:heartbeat-result", { requestId: deniedBeat.requestId, ok: false });
+  await new Promise(resolve => setImmediate(resolve));
+  assert.strictEqual(f.manager.session, null, "explicit lease denial closes the call");
+  assert.strictEqual(incomingManaged.closed, "lease-denied");
+  assert.strictEqual(socket.listenerCount("call:heartbeat-result"), 0);
+
+
+  f = fixture();
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "video", callAttemptId: "managed-attempt-123456789", organizationId: "tenant-a", generation: 7 });
+  assert.strictEqual(f.events[0].payload.generation, 7, "pre-access decline preserves recipient reinvite generation");
+  assert.strictEqual(f.events[0].payload.deviceId, f.manager.deviceId);
+
+  f = fixture();
+  await f.manager.outgoing({ chatId: "local-end" });
+  const localSession = f.manager.session;
+  localSession.options.onEnded("max-duration");
+  localSession.options.onEnded("max-duration");
+  assert.strictEqual(f.events.filter(event => event.name === "call:end").length, 1);
+  assert.strictEqual(f.events.at(-1).payload.callAttemptId, localSession.callIdentity.callAttemptId);
+  assert.strictEqual(f.manager.session, null);
+
+  // Stop during configuration cancels setup; a late fetch cannot start media.
+  f = fixture();
+  let finishConfig;
+  f.manager.adapter._request = () => new Promise(resolve => { finishConfig = resolve; });
+  const incoming = f.manager.incoming({ fromUserId: "owner-1", chatId: "late", roomId: 80, callType: "audio" });
+  await f.manager.stop();
+  finishConfig({ config: { roomAdmissionEnabled: false, iceServers: [{ urls: "turn:relay:3478" }] } });
+  await incoming;
+  assert.strictEqual(f.manager.session, null);
+  assert.ok(!f.events.some(event => event.name === "call:accept"));
+
+  // Configuration errors never fall back to unauthenticated STUN-only media.
+  f = fixture();
+  f.manager.adapter._request = async () => { throw new Error("unavailable"); };
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "fail", roomId: 81, callType: "audio" });
+  assert.strictEqual(f.manager.session, null);
+  assert.strictEqual(f.events.at(-1).payload.reason, "connection_failed");
+  await assert.rejects(() => f.manager.outgoing({ chatId: "chat", toUserId: "stranger" }), /owner/);
+  // Correlated access requests reject expiry/mismatch and detach on cancellation.
+  const { requestRoomAccess } = require("./channels/kazee/call/access");
+  const accessSocket = new EventEmitter();
+  accessSocket.connected = true;
+  let requested;
+  accessSocket.on("call:allocate", payload => { requested = payload; });
+  const accessPromise = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" });
+  accessSocket.emit("call:allocate-result", { requestId: "other-request", ok: false });
+  assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 1);
+  accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "different-device", generation: 0, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000 });
+  await assert.rejects(accessPromise, /Invalid call room/);
+  assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
+  for (const server of ["http://assigned/janus", "wss://user:password@assigned/janus", "wss://assigned/janus#fragment", 123]) {
+    const invalid = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" });
+    accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "device-1234567890", generation: 0, server, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000 });
+    await assert.rejects(invalid, /Invalid call room/);
+    assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
+  }
+  const controller = new AbortController();
+  const cancelledAccess = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" }, { signal: controller.signal });
+  controller.abort();
+  await assert.rejects(cancelledAccess, /cancelled/);
+  assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
   console.log("kazee call manager: ok");
 })().catch((error) => { console.error(error); process.exitCode = 1; });