@securecoms/agent-bridge 0.38.0 → 0.40.0

package/connectors/hermes/tests/test_busy_session.py

@@ -0,0 +1,1436 @@
+# packages/connect-agent-bridge/connectors/hermes/tests/test_busy_session.py
+#
+# H0 (audit r1 #3, r2 #1, #2): a Hermes tool decision for a (chat_id, user_id)
+# key can never be lifted while an ungranted turn for that key is still
+# running, or still waiting to run, anywhere in its Hermes session.
+#
+# The fake below is COPIED, branch for branch, from Hermes v2026.9.24 as
+# installed on the Mini (~/.hermes/hermes-agent-v2026.9.24, read 2026-11-11;
+# md5 run_busy.py 9b9052966ef5605ac3d8b63f6f602248, platforms/base.py
+# 6d3da1360844e3043361369f4b89a80f, run_inbound.py
+# 4f490dcbfd4349abd649260573af2083, session.py
+# 53677a3689bf100b9f4202fa46656cc8). Text-only subset: no media, no clarify,
+# no topics, no profile routing, no busy-ack replies.
+#   - build_session_key: gateway/session.py:673-718, copied VERBATIM below
+#     (with _session_key_namespace 644-654 and _canonical_participant
+#     664-670); only Platform.WHATSAPP / SLACK and the WhatsApp canonicaliser
+#     are shimmed. A DM is keyed by chat only, plus the thread when one is set.
+#   - The session store keeps one transcript per session key (session.py:885,
+#     :923, :1040-1143); Runner.transcripts models it.
+#   - HermesBase: gateway/platforms/base.py
+#       merge_pending_message_event 1739-1781 (text merge only)
+#       _event_session_key 2488 -> build_session_key (gateway/session.py
+#         673-713: a DM is keyed by chat only; a group adds the sender when
+#         group_sessions_per_user, default True)
+#       debounce 3757-3832, guard/task helpers 3836-3888,
+#       cancel_session_processing 3890-3914, /stop /new /reset 3916-3948,
+#       handle_message 3950-3990, _handle_message_while_active 3992-4065,
+#       _finish_session_task 4414-4436, _process_message_background
+#       4438-4557 (on_processing_complete fires ONCE per started task, for
+#       the starting event only, BEFORE the debounce flush and the pending
+#       pop), _spawn_drain_task 4560-4567, _cleanup_finished_session_task
+#       4573-4590.
+#   - Runner.busy_session_handler: gateway/run_busy.py 767-860
+#       (_handle_active_session_busy_message): unauthorized drop 782-788,
+#       bot-loop drop 790-791, drain drop 795-797, queue-mode text to the
+#       base debounce 809-814, steer/redirect 816-819 via
+#       _resolve_busy_steer_or_redirect 559-610 (awaits the compression check
+#       at 575), FIFO queue 822-823 via _queue_or_replace_pending_event
+#       358-406 (cap drop 398-404, _BUSY_QUEUE_MAX_PENDING run.py:4034) and
+#       _enqueue_fifo 88-97, interrupt 836-840.
+#   - Runner.__call__ (the gateway message handler): gateway/run_inbound.py
+#       1295-1390: a session the RUNNER holds (turn.agent set) goes to
+#       _hm_handle_running_session_message 675-731 even when the base adapter
+#       started a task for this event (sentinel -> merged into the adapter's
+#       pending slot 690-697; queue / steer / redirect / interrupt); else the
+#       slot is claimed with the pending sentinel (1343), the turn runs, and
+#       the slot is released in the finally (1387) BEFORE the base hook runs.
+#       The durable marker token is set only for the turn's own event
+#       (run_turn.py:2090 -> run_inbound.py:1754-1767) and deleted at turn end
+#       (1793).
+#   - FIFO overflow promotion modelled at turn end (run_busy.py:100-116
+#     _promote_queued_event); /new clears the overflow
+#     (run_agent_cache.py:369 conversation.clear()) and the running slot
+#     (slash_commands_session.py:163).
+
+import asyncio
+import importlib.util
+import logging
+import os
+import types
+from collections import defaultdict
+from enum import Enum
+from typing import Optional
+
+import pytest
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_spec = importlib.util.spec_from_file_location(
+    "_securecoms_wiring_helpers", os.path.join(_HERE, "test_adapter_wiring.py")
+)
+_w = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_w)
+adapter = _w.adapter
+authz = adapter.securecoms_authz
+MessageType = adapter.MessageType
+
+SENTINEL = object()  # gateway.run._AGENT_PENDING_SENTINEL
+
+# --- gateway/session.py, Hermes v2026.9.24 (shims: Platform members, WhatsApp) ---
+Platform = types.SimpleNamespace(WHATSAPP=object(), SLACK=object())
+
+
+def canonical_whatsapp_identifier(x):
+    return x
+
+
+def _session_key_namespace(profile: Optional[str]) -> str:
+    if not profile or profile == "default":
+        return "agent:main"
+    return "agent:main~" if profile == "main" else f"agent:{profile}"
+
+
+def _canonical_participant(source) -> Optional[str]:
+    """Sender id for key isolation; WhatsApp JID/LID aliases are canonicalized so alias flips
+    cannot split one member into two sessions."""
+    participant_id = source.user_id_alt or source.user_id
+    if participant_id and source.platform == Platform.WHATSAPP:
+        participant_id = canonical_whatsapp_identifier(str(participant_id)) or participant_id
+    return participant_id
+
+
+def build_session_key(
+    source, group_sessions_per_user: bool = True,
+    thread_sessions_per_user: bool = False, profile: Optional[str] = None,
+) -> str:
+    is_dm = source.chat_type == "dm"
+    chat_id = source.chat_id
+    if is_dm and source.platform == Platform.WHATSAPP:
+        chat_id = canonical_whatsapp_identifier(chat_id)
+    # Discord auto-thread continuity: key a channel-initiating message on the thread it WILL be
+    # delivered into (prospective_thread_id), and normalize the chat_type slot to "thread" so
+    # in-thread follow-ups byte-match. A real thread_id always wins. DMs use thread_id only.
+    thread_id = source.thread_id or (None if is_dm else source.prospective_thread_id)
+    chat_type_slot = "thread" if thread_id and not source.thread_id else source.chat_type
+    if is_dm:
+        # No chat_id: fall back to the sender id before the bare per-platform sink, or every
+        # chat_id-less DM shares one agent.
+        isolate_user = not chat_id
+    else:
+        # Threads are shared by default; per-user isolation only via thread_sessions_per_user or
+        # outside a thread.
+        isolate_user = group_sessions_per_user and not (thread_id and not thread_sessions_per_user)
+    # Duck-typed sources may lack user_id_alt: read the participant only when it matters.
+    participant_id = _canonical_participant(source) if (isolate_user or not is_dm) else None
+
+    parts = [_session_key_namespace(profile), source.platform.value, chat_type_slot]
+    if source.platform == Platform.SLACK and source.scope_id:
+        parts.append(str(source.scope_id))
+    if chat_id:
+        parts.append(chat_id)
+    # DMs put the participant before the thread; groups/threads put it after.
+    user_part = [str(participant_id)] if isolate_user and participant_id else []
+    thread_part = [thread_id] if thread_id else []
+    parts += user_part + thread_part if is_dm else thread_part + user_part
+    return ":".join(str(part) for part in parts)
+# --- end of the verbatim copy ---
+
+
+class ProcessingOutcome(Enum):
+    SUCCESS = "success"
+    FAILURE = "failure"
+    CANCELLED = "cancelled"
+
+
+def merge_pending_message_event(pending, key, event, *, merge_text=False):
+    """base.py:1739-1781, text-only events."""
+    existing = pending.get(key)
+    if existing:
+        both_text = existing.message_type == MessageType.TEXT and event.message_type == MessageType.TEXT
+        if merge_text and both_text:
+            if event.text:
+                existing.text = existing.text + "\n" + event.text
+            return
+    pending[key] = event
+
+
+class _TurnState:
+    def __init__(self):
+        self.agent = None
+        self.event = None
+
+
+class _Conversation:
+    def __init__(self):
+        self.queued_events = []
+
+
+class SessionState:
+    def __init__(self):
+        self.turn = _TurnState()
+        self.conversation = _Conversation()
+
+
+class Turn:
+    def __init__(self, event, key):
+        self.event = event
+        self.key = key
+        self.text = event.text
+        self.injected = []  # (verb, text) steered or redirected into this run
+        self.done = False
+        self.interrupted = False
+
+
+class Agent:
+    _supports_active_turn_redirect = True
+
+    def __init__(self, turn, runner):
+        self.turn = turn
+        self.runner = runner
+
+    def redirect(self, text):
+        self.turn.injected.append(("redirect", text))
+        self.runner.transcripts[self.turn.key].append(text)
+        return True
+
+    def steer(self, text):
+        self.turn.injected.append(("steer", text))
+        self.runner.transcripts[self.turn.key].append(text)
+        return True
+
+    def interrupt(self, text):
+        self.turn.interrupted = True
+        self.runner.release(self.turn.event.message_id)
+
+
+def _text_only(event):
+    return event.message_type == MessageType.TEXT and not event.media_urls
+
+
+class Runner:
+    """GatewayRunner: message handler, busy-session handler, session state."""
+
+    BUSY_QUEUE_MAX_PENDING = 32
+
+    def __init__(self, a):
+        self.a = a
+        self.sessions = {}
+        self.gates = {}
+        self.turns = {}
+        self.busy_input_mode = "interrupt"
+        self.draining = False
+        self.unauthorized = set()
+        self.dropped = []
+        self.compression_check = None  # test hook at run_busy.py:575's await
+        self.transcripts = defaultdict(list)  # session key -> user texts (session.py store)
+        self.skip_promotion = False  # an early-exit turn that orphans the overflow (#28503)
+        self.allowed_users = set()
+
+    def admits(self, source):
+        """authz_mixin.py:614-680: admission reads source.user_id (allowlist subset)."""
+        return source.user_id in self.allowed_users
+
+    # run.py:3455-3470
+    def _session_state(self, key):
+        return self.sessions.setdefault(key, SessionState())
+
+    def _peek_session_state(self, key):
+        return self.sessions.get(key)
+
+    def _session_key_for_source(self, source):
+        return self.a._source_session_key(source)
+
+    def gate(self, mid):
+        return self.gates.setdefault(mid, asyncio.Event())
+
+    def release(self, mid):
+        self.gate(mid).set()
+
+    def turn(self, mid):
+        return self.turns.get(mid)
+
+    async def __call__(self, event):
+        key = self._session_key_for_source(event.source)
+        st = self._peek_session_state(key)
+        if st is not None and st.turn.agent is not None:  # run_inbound.py:1303-1305
+            return await self._running_session_message(event, key)
+        st = self._session_state(key)
+        st.turn.agent = SENTINEL  # :1343
+        st.turn.event = event
+        try:
+            turn = Turn(event, key)
+            self.turns[event.message_id] = turn
+            self.transcripts[key].append(event.text)
+            st.turn.agent = Agent(turn, self)
+            event._gateway_active_turn_token = "tok-" + event.message_id  # run_turn.py:2090
+            try:
+                await self.gate(event.message_id).wait()
+            finally:
+                del event._gateway_active_turn_token  # run_inbound.py:1793
+                turn.done = True
+                # run_busy.py:100-116: the overflow head moves into the drained slot.
+                if not self.skip_promotion and st.conversation.queued_events and key not in self.a._pending_messages:
+                    self.a._pending_messages[key] = st.conversation.queued_events.pop(0)
+        finally:
+            st.turn.agent = None  # :1387 _release_running_agent_state
+            st.turn.event = None
+        return None
+
+    async def _running_session_message(self, event, key):
+        """run_inbound.py:675-731."""
+        running_agent = self._peek_session_state(key).turn.agent
+        if running_agent is SENTINEL:  # 690-697
+            merge_pending_message_event(self.a._pending_messages, key, event, merge_text=True)
+            return None
+        if self.busy_input_mode == "queue":
+            self._queue_or_replace_pending_event(key, event)
+            return None
+        if self.busy_input_mode == "steer":
+            if _text_only(event) and event.text and running_agent.steer(event.text):
+                return None
+            self._queue_or_replace_pending_event(key, event)
+            return None
+        if _text_only(event) and running_agent.redirect(event.text):  # _hm_busy_interrupt 650-660
+            return None
+        running_agent.interrupt(event.text)
+        merge_pending_message_event(self.a._pending_messages, key, event, merge_text=True)
+        return None
+
+    def _queue_depth(self, key):
+        """run_busy.py:118-123."""
+        st = self._peek_session_state(key)
+        depth = len(st.conversation.queued_events) if st else 0
+        return depth + (1 if key in self.a._pending_messages else 0)
+
+    def _enqueue_fifo(self, key, event):
+        """run_busy.py:88-97."""
+        if key in self.a._pending_messages:
+            self._session_state(key).conversation.queued_events.append(event)
+        else:
+            self.a._pending_messages[key] = event
+        event._gateway_accepted = True
+
+    def _queue_or_replace_pending_event(self, key, event):
+        """run_busy.py:358-406 (no photo bursts here)."""
+        if self._queue_depth(key) >= self.BUSY_QUEUE_MAX_PENDING:  # 398-404
+            self.dropped.append(event.message_id)
+            return
+        self._enqueue_fifo(key, event)
+
+    async def busy_session_handler(self, event, key):
+        """run_busy.py:767-860 _handle_active_session_busy_message."""
+        if event.source.user_id in self.unauthorized:  # 782-788
+            self.dropped.append(event.message_id)
+            return True
+        effective_mode = self.busy_input_mode  # 794
+        if self.draining:  # 795-797
+            self.dropped.append(event.message_id)
+            return True
+        if (
+            event.message_type == MessageType.TEXT
+            and getattr(self.a, "_busy_text_mode", "interrupt") == "queue"
+            and effective_mode != "steer"
+        ):  # 809-814
+            return False
+        st = self._peek_session_state(key)
+        running_agent = st.turn.agent if st else None
+        # _resolve_busy_steer_or_redirect 559-610
+        if self.compression_check is not None:  # the await at 575
+            await self.compression_check()
+        else:
+            await asyncio.sleep(0)
+        steered = redirected = False
+        agent_live = running_agent is not None and running_agent is not SENTINEL
+        if effective_mode == "steer":
+            if event.text and _text_only(event) and agent_live:
+                steered = running_agent.steer(event.text)
+            if not steered:
+                effective_mode = "queue"
+        elif effective_mode == "interrupt" and _text_only(event) and agent_live:
+            redirected = running_agent.redirect(event.text)
+        if not steered and not redirected:  # 822-823
+            self._queue_or_replace_pending_event(key, event)
+        if effective_mode == "interrupt" and not redirected and agent_live:  # 836-840
+            running_agent.interrupt(event.text)
+        return True
+
+    async def inline_command(self, event, cmd):
+        key = self._session_key_for_source(event.source)
+        if cmd in ("new", "reset"):
+            st = self._peek_session_state(key)
+            if st is not None:
+                st.conversation.queued_events.clear()  # run_agent_cache.py:369
+                st.turn.agent = None  # slash_commands_session.py:163
+
+
+class HermesBase:
+    """gateway/platforms/base.py, the paths this adapter's sessions take."""
+
+    _busy_text_mode = "interrupt"
+
+    def _hermes_init(self):
+        self._active_sessions = {}
+        self._pending_messages = {}
+        self._session_tasks = {}
+        self._background_tasks = set()
+        self._expected_cancelled_tasks = set()
+        self._text_debounce = {}
+        self._busy_session_handler = None
+        self.inline_commands = []
+
+    def _source_session_key(self, source):
+        """base.py:2492-2499."""
+        extra = self.config.extra
+        return build_session_key(
+            source, group_sessions_per_user=extra.get("group_sessions_per_user", True),
+            thread_sessions_per_user=extra.get("thread_sessions_per_user", False), profile=None)
+
+    def _event_session_key(self, event):
+        return self._source_session_key(event.source)
+
+    def _text_debounce_store(self):
+        return self._text_debounce
+
+    async def _run_processing_hook(self, hook_name, *args):
+        hook = getattr(self, hook_name, None)
+        if not callable(hook):
+            return
+        try:
+            await hook(*args)
+        except Exception:
+            pass
+
+    async def on_processing_start(self, event):
+        pass
+
+    # 3757-3832 (the timer is long: tests flush at completion, as 4520 does)
+    def _is_queue_text_debounce_candidate(self, event):
+        return self._busy_text_mode == "queue" and event.message_type == MessageType.TEXT
+
+    async def _queue_text_debounce(self, key, event):
+        state = self._text_debounce.get(key)
+        if state is None:
+            self._text_debounce[key] = types.SimpleNamespace(event=event)
+        else:
+            state.event.text = state.event.text + "\n" + event.text
+
+    async def _flush_text_debounce_now(self, key):
+        state = self._text_debounce.get(key)
+        if state is None:
+            return False
+        pending = self._pending_messages.get(key)
+        if pending is not None:
+            return False
+        self._text_debounce.pop(key, None)
+        merge_pending_message_event(self._pending_messages, key, state.event, merge_text=True)
+        return True
+
+    def _discard_text_debounce(self, key):
+        self._text_debounce.pop(key, None)
+
+    # 3836-3888
+    def _release_session_guard(self, key, *, guard=None):
+        current = self._active_sessions.get(key)
+        if current is None or (guard is not None and current is not guard):
+            return
+        del self._active_sessions[key]
+
+    def _session_task_is_stale(self, key):
+        done = getattr(self._session_tasks.get(key), "done", None)
+        return bool(done and done())
+
+    def _heal_stale_session_lock(self, key):
+        if key not in self._active_sessions or not self._session_task_is_stale(key):
+            return False
+        self._active_sessions.pop(key, None)
+        self._pending_messages.pop(key, None)
+        self._session_tasks.pop(key, None)
+        self._discard_text_debounce(key)
+        return True
+
+    def _start_session_processing(self, event, key):
+        guard = asyncio.Event()
+        self._active_sessions[key] = guard
+        task = asyncio.create_task(self._process_message_background(event, key))
+        self._track_session_task(key, task)
+        return True
+
+    def _track_session_task(self, key, task):
+        self._session_tasks[key] = task
+        self._background_tasks.add(task)
+        task.add_done_callback(self._background_tasks.discard)
+        task.add_done_callback(self._expected_cancelled_tasks.discard)
+        return True
+
+    # 3890-3914
+    async def cancel_session_processing(self, key, *, release_guard=True, discard_pending=True):
+        task = self._session_tasks.pop(key, None)
+        if task is not None and not task.done():
+            self._expected_cancelled_tasks.add(task)
+            task.cancel()
+            await asyncio.gather(task, return_exceptions=True)
+        if discard_pending:
+            self._pending_messages.pop(key, None)
+            self._discard_text_debounce(key)
+        if release_guard:
+            self._release_session_guard(key)
+
+    # 3916-3948
+    async def _drain_pending_after_session_command(self, key, command_guard):
+        await self._flush_text_debounce_now(key)
+        pending_event = self._pending_messages.pop(key, None)
+        self._release_session_guard(key, guard=command_guard)
+        if pending_event is not None:
+            self._start_session_processing(pending_event, key)
+
+    async def _dispatch_active_session_command(self, event, key, cmd):
+        command_guard = asyncio.Event()
+        self._active_sessions[key] = command_guard
+        self.inline_commands.append(cmd)
+        await self.gateway_runner.inline_command(event, cmd)
+        await self.cancel_session_processing(key, release_guard=False, discard_pending=False)
+        await self._drain_pending_after_session_command(key, command_guard)
+
+    # 3950-3990
+    async def handle_message(self, event):
+        event._gateway_accepted = False
+        if not self._message_handler:
+            return
+        key = self._event_session_key(event)
+        if key in self._active_sessions:
+            self._heal_stale_session_lock(key)
+        if key in self._active_sessions:
+            await self._handle_message_while_active(event, key)
+            return
+        event._gateway_accepted = self._start_session_processing(event, key)
+
+    # 3992-4065
+    async def _handle_message_while_active(self, event, key):
+        text = event.text or ""
+        cmd = text[1:].split(" ")[0] if text.startswith("/") else None
+        if cmd in ("stop", "new", "reset"):
+            self._discard_text_debounce(key)
+            await self._dispatch_active_session_command(event, key, cmd)
+            return
+        if self._busy_session_handler is not None:
+            if await self._busy_session_handler(event, key):
+                return
+        if self._is_queue_text_debounce_candidate(event):
+            await self._queue_text_debounce(key, event)
+            return
+        merge_pending_message_event(
+            self._pending_messages, key, event, merge_text=event.message_type == MessageType.TEXT
+        )
+        event._gateway_accepted = True
+
+    # 4414-4436
+    def _finish_session_task(self, key, interrupt_event):
+        late_pending = self._pending_messages.pop(key, None)
+        current = asyncio.current_task()
+        if late_pending is not None:
+            existing = self._session_tasks.get(key)
+            if existing is not None and existing is not current:
+                self._pending_messages[key] = late_pending
+            else:
+                self._spawn_drain_task(late_pending, key)
+        elif current is not None and self._session_tasks.get(key) is current:
+            self._cleanup_finished_session_task(key, interrupt_event)
+
+    # 4438-4557
+    async def _process_message_background(self, event, key):
+        interrupt_event = self._active_sessions.get(key) or asyncio.Event()
+        self._active_sessions[key] = interrupt_event
+        try:
+            await self._run_processing_hook("on_processing_start", event)
+            await self._message_handler(event)
+            await self._run_processing_hook("on_processing_complete", event, ProcessingOutcome.SUCCESS)
+            await self._flush_text_debounce_now(key)
+            if key in self._pending_messages:
+                pending_event = self._pending_messages.pop(key)
+                self._clear_session_guard(key)
+                self._spawn_drain_task(pending_event, key)
+                return
+        except asyncio.CancelledError:
+            expected = asyncio.current_task() in self._expected_cancelled_tasks
+            await self._run_processing_hook(
+                "on_processing_complete", event,
+                ProcessingOutcome.CANCELLED if expected else ProcessingOutcome.FAILURE)
+            raise
+        except BaseException:
+            await self._run_processing_hook("on_processing_complete", event, ProcessingOutcome.FAILURE)
+        finally:
+            await self._flush_text_debounce_now(key)
+            self._finish_session_task(key, interrupt_event)
+
+    def _spawn_drain_task(self, pending_event, key):
+        self._clear_session_guard(key)
+        self._track_session_task(key, asyncio.create_task(self._process_message_background(pending_event, key)))
+
+    def _clear_session_guard(self, key):
+        guard = self._active_sessions.get(key)
+        if guard is not None:
+            guard.clear()
+
+    def _cleanup_finished_session_task(self, key, interrupt_event):
+        self._release_session_guard(key, guard=interrupt_event)
+        if key not in self._active_sessions:
+            self._session_tasks.pop(key, None)
+
+    async def cancel_background_tasks(self):
+        for _ in range(5):
+            tasks = [t for t in self._background_tasks if not t.done()]
+            if not tasks:
+                return
+            for t in tasks:
+                t.cancel()
+            await asyncio.gather(*tasks, return_exceptions=True)
+
+
+class _RecWS:
+    def __init__(self):
+        self.sent = []
+        self.closed = False
+
+    async def send_json(self, payload):
+        self.sent.append(payload)
+
+
+# ---------------------------------------------------------------------------
+# Driver
+# ---------------------------------------------------------------------------
+
+GRANTS = [{"tool": "current_time", "mode": "read"}]
+NON_OWNER = authz.NON_OWNER_THREAD
+
+
+def _auth(audience, grants, **kw):
+    block = {"version": 1, "audience": audience, "sender_membership": "active", "tool_grants": list(grants)}
+    block.update(kw)
+    return block
+
+
+def owner_relay(mid, text, chan="dm"):
+    aud = "other_human_dm" if chan == "dm" else "team_room"
+    return {"type": "message", "message_id": mid, "channel_id": chan, "sender_id": "relay", "text": text,
+            "authorization": _auth(aud, GRANTS, relay_speaker="owner")}
+
+
+def guest_relay(mid, text, chan="dm"):
+    aud = "other_human_dm" if chan == "dm" else "team_room"
+    return {"type": "message", "message_id": mid, "channel_id": chan, "sender_id": "relay", "text": text,
+            "authorization": _auth(aud, [])}
+
+
+def owner_direct(mid, text, chan="dm", grants=GRANTS):
+    return {"type": "message", "message_id": mid, "channel_id": chan, "sender_id": "owner", "text": text,
+            "authorization": _auth("owner_dm", grants)}
+
+
+def no_block(mid, text, chan="dm", sender="stranger"):
+    return {"type": "message", "message_id": mid, "channel_id": chan, "sender_id": sender, "text": text}
+
+
+async def settle(n=40):
+    for _ in range(n):
+        await asyncio.sleep(0)
+
+
+@pytest.fixture
+def gate_state(monkeypatch):
+    monkeypatch.setattr(adapter, "_TURN_AUTHZ", authz.TurnAuthzLedger())
+    monkeypatch.setattr(adapter, "_ATTACHED", {})
+    monkeypatch.setattr(adapter, "_IDLE_INPUTS_WARNED", False)
+    monkeypatch.setattr(adapter, "_SHARED_ROOMS_WARNED", False)
+    monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
+    monkeypatch.setattr(adapter, "_TURN_TRACKING_WARNED", False, raising=False)
+    monkeypatch.setattr(adapter, "_ACCEPT_WAIT_S", 30.0)
+
+
+@pytest.fixture(params=["shared", "threaded"])
+def threaded(request, monkeypatch):
+    """shared: H0.2c's non-owner thread switched off (every DM sender shares one
+    key and one session, the HEAD condition); threaded: H0.2c on."""
+    if request.param == "shared":
+        monkeypatch.setattr(authz, "is_owner_turn", lambda frame: True)
+    return request.param == "threaded"
+
+
+def make(extra=None, mode="interrupt"):
+    class Faithful(HermesBase, adapter.SecureComsAdapter):
+        pass
+
+    a = Faithful(types.SimpleNamespace(extra=dict(extra or {})))
+    a._hermes_init()
+    a._bound_identity = "A"
+    a._channels = {"room": {"name": "room", "is_dm": False}, "dm": {"name": "dm", "is_dm": True}}
+    a._ws = _RecWS()
+    r = Runner(a)
+    r.busy_input_mode = mode
+    a.set_message_handler(r)
+    a.gateway_runner = r
+    a._busy_session_handler = r.busy_session_handler
+    return a, r
+
+
+async def teardown(a):
+    for t in list(a._ack_waiters):
+        t.cancel()
+    await asyncio.gather(*list(a._ack_waiters), return_exceptions=True)
+    await a.cancel_background_tasks()
+
+
+async def deliver(a, frame):
+    await a._receive_message(frame)
+    await settle()
+
+
+def tools(key):
+    return adapter._TURN_AUTHZ.tools_allowed(*key)
+
+
+def inflight(key):
+    return adapter._TURN_AUTHZ.ungranted_in_flight(*key)
+
+
+OWNER_SESSION = "agent:main:securecoms:dm:dm"
+GUEST_SESSION = "agent:main:securecoms:dm:dm:sc-non-owner"
+UNCLASSIFIED_SESSION = "agent:main:securecoms:dm:dm:sc-unclassified"
+UNCLASSIFIED = getattr(authz, "UNCLASSIFIED_THREAD", "sc-unclassified")
+OWNER_RELAY = ("dm", "relay", None)
+ROOM = ("room", "relay", None)  # a room guest relay key
+SHARED = ("dm", "relay", None)  # a DM with the H0.2c split off: owner and guest relay share key and session
+
+
+def guest_key(threaded_on):
+    return ("dm", "relay", NON_OWNER if threaded_on else None)
+
+
+def guest_session(threaded_on):
+    return GUEST_SESSION if threaded_on else OWNER_SESSION
+
+
+# ---------------------------------------------------------------------------
+# H0.1c: redirect, steer, merge (each with and without the non-owner thread)
+# ---------------------------------------------------------------------------
+
+
+class TestRedirect:
+    @pytest.mark.asyncio
+    async def test_guest_text_redirected_into_a_running_owner_turn(self, gate_state, threaded):
+        a, r = make()
+        guest = guest_key(threaded)
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        t_owner = r.turn("o1")
+        assert t_owner is not None and tools(OWNER_RELAY)
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        if not threaded:
+            # One key, one session: the guest's text is inside the owner's run.
+            assert ("redirect", authz.COMMAND_ESCAPE + "guest speaks") in t_owner.injected
+            assert not tools(OWNER_RELAY)
+            await deliver(a, owner_relay("o2", "owner again"))  # a later grant for the same key
+            assert not tools(OWNER_RELAY)
+            r.release("o1")
+            await settle()
+            assert t_owner.done
+            assert tools(OWNER_RELAY) and inflight(guest) == 0
+        else:
+            assert t_owner.injected == []
+            t_guest = r.turn("g1")
+            assert t_guest is not None and t_guest.key == GUEST_SESSION != t_owner.key
+            assert tools(OWNER_RELAY) and not tools(guest)
+            r.release("g1")
+            await settle()
+            assert inflight(guest) == 0 and not tools(guest)
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_owner_text_redirected_into_a_running_guest_turn(self, gate_state, threaded):
+        a, r = make()
+        guest = guest_key(threaded)
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        t_guest = r.turn("g1")
+        assert t_guest is not None and not tools(guest)
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        if not threaded:
+            assert ("redirect", "owner speaks") in t_guest.injected
+            # The latest decision for the key is the owner's grant; the turn
+            # still carries the guest's text, so it has no tools.
+            assert not tools(OWNER_RELAY)
+            r.release("g1")
+            await settle()
+            assert tools(OWNER_RELAY) and inflight(guest) == 0
+        else:
+            assert t_guest.injected == []
+            assert r.turn("o1").key == OWNER_SESSION
+            assert tools(OWNER_RELAY) and not tools(guest)
+            r.release("g1")
+            await settle()
+            assert inflight(guest) == 0
+        await teardown(a)
+
+
+class TestSteer:
+    @pytest.mark.asyncio
+    async def test_guest_text_steered_into_a_running_owner_turn(self, gate_state, threaded):
+        a, r = make(mode="steer")
+        guest = guest_key(threaded)
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        t_owner = r.turn("o1")
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        if not threaded:
+            assert ("steer", authz.COMMAND_ESCAPE + "guest speaks") in t_owner.injected
+            assert not tools(OWNER_RELAY)
+            r.release("o1")
+            await settle()
+            assert inflight(guest) == 0
+        else:
+            assert t_owner.injected == []
+            assert tools(OWNER_RELAY) and not tools(guest)
+            r.release("g1")
+            await settle()
+            assert inflight(guest) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_owner_text_steered_into_a_running_guest_turn(self, gate_state, threaded):
+        a, r = make(mode="steer")
+        guest = guest_key(threaded)
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        t_guest = r.turn("g1")
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        if not threaded:
+            assert ("steer", "owner speaks") in t_guest.injected
+            assert not tools(OWNER_RELAY)
+        else:
+            assert t_guest.injected == []
+            assert tools(OWNER_RELAY)
+        r.release("g1")
+        await settle()
+        assert inflight(guest) == 0
+        await teardown(a)
+
+
+class TestPendingSentinelMerge:
+    @pytest.mark.asyncio
+    async def test_a_guest_event_parked_behind_the_sentinel_is_held_until_its_turn_ends_and_idle(
+        self, gate_state, threaded
+    ):
+        a, r = make()
+        guest = guest_key(threaded)
+        session = guest_session(threaded)
+        # The runner holds the guest session's slot with the pending sentinel
+        # (a resumed session, run_startup.py:607) while the base adapter is
+        # idle for it: the guest event starts its own base task, the runner
+        # parks it in the pending slot (run_inbound.py:697), and that base
+        # task completes at once.
+        r._session_state(session).turn.agent = SENTINEL
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        assert r.turn("g1") is None
+        assert inflight(guest) == 1 and not tools(guest)
+        r._session_state(session).turn.agent = None  # the resumed turn ends
+        await settle()
+        t_guest = r.turn("g1")
+        assert t_guest is not None and not t_guest.done  # the parked text runs now
+        assert inflight(guest) == 1
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        if not threaded:
+            assert ("redirect", "owner speaks") in t_guest.injected
+            assert not tools(OWNER_RELAY)  # owner's grant recorded, guest's text still running
+        else:
+            assert tools(OWNER_RELAY)
+        r.release("g1")
+        await settle()
+        assert inflight(guest) == 0
+        if not threaded:
+            assert tools(OWNER_RELAY)
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_guest_event_queued_behind_a_sentinel_turn_waits_for_the_pending_turn(self, gate_state):
+        # Base-level variant: the running turn holds the sentinel when the
+        # guest arrives, so the guest is queued in the pending slot; it is
+        # released only after the pending turn that carries it completes,
+        # not at the completion of the turn that was running when it arrived.
+        a, r = make()
+        session = "agent:main:securecoms:group:room:relay"
+        await deliver(a, guest_relay("g0", "first guest", chan="room"))
+        r.sessions[session].turn.agent = SENTINEL  # agent still building
+        await deliver(a, guest_relay("g1", "second guest", chan="room"))
+        r.sessions[session].turn.agent = Agent(r.turn("g0"), r)
+        assert inflight(ROOM) == 2
+        r.release("g0")
+        await settle()
+        assert r.turn("g0").done
+        t1 = r.turn("g1")
+        assert t1 is not None and not t1.done
+        assert inflight(ROOM) == 2  # g0's completion found g1 pending: not idle
+        r.release("g1")
+        await settle()
+        assert inflight(ROOM) == 0
+        await teardown(a)
+
+
+# ---------------------------------------------------------------------------
+# H0.1c: drops, discards, later grants. A DM with the H0.2c split switched
+# off: owner and guest relay share one key and one session (the HEAD
+# condition), the case the count alone must hold. (The daemon marks
+# relay_speaker only in DMs, so no room has a granted relay key.)
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def shared_dm(monkeypatch):
+    monkeypatch.setattr(authz, "dm_thread", lambda frame: None)
+
+
+class TestDropsAndDiscards:
+    @pytest.mark.asyncio
+    async def test_queue_cap_drop_while_the_session_goes_idle_releases_at_once(self, gate_state, shared_dm):
+        a, r = make(mode="queue")
+        r.BUSY_QUEUE_MAX_PENDING = 0  # the cap drop needs no backlog
+
+        async def owner_turn_finishes():
+            r.release("o1")
+            await settle()
+
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        r.compression_check = owner_turn_finishes
+        await a._receive_message(guest_relay("g1", "guest speaks"))
+        assert r.dropped == ["g1"]
+        assert inflight(SHARED) == 0  # not accepted, session idle: released at once
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_queue_cap_drop_while_busy_waits_for_idle(self, gate_state, shared_dm):
+        a, r = make(mode="queue")
+        r.BUSY_QUEUE_MAX_PENDING = 0
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        assert r.dropped == ["g1"]
+        assert inflight(SHARED) == 1
+        r.release("o1")
+        await settle()
+        assert inflight(SHARED) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_unauthorized_drop_while_busy_waits_for_idle(self, gate_state, shared_dm):
+        a, r = make()
+        await deliver(a, owner_relay("o1", "owner speaks"))  # admitted on the cold path (not modelled)
+        r.unauthorized.add("relay")
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        assert r.dropped == ["g1"]
+        assert inflight(SHARED) == 1
+        r.release("o1")
+        await settle()
+        assert inflight(SHARED) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_stop_then_the_pending_guest_turn_runs_and_releases_at_idle(self, gate_state, shared_dm):
+        a, r = make(mode="queue")
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "guest speaks"))  # queued in the pending slot
+        assert inflight(SHARED) == 1
+        await deliver(a, owner_relay("o2", "/stop"))
+        assert a.inline_commands == ["stop"]
+        assert r.turn("o1").done
+        t_guest = r.turn("g1")
+        assert t_guest is not None and not t_guest.done
+        assert inflight(SHARED) == 1 and not tools(SHARED)
+        r.release("g1")
+        await settle()
+        assert inflight(SHARED) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_new_discards_a_queued_guest_event_released_at_the_next_idle_completion(self, gate_state, shared_dm):
+        a, r = make(mode="queue")
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, owner_relay("o2", "owner follow-up"))  # pending slot head
+        await deliver(a, guest_relay("g1", "guest speaks"))  # FIFO overflow
+        assert inflight(SHARED) == 1
+        await deliver(a, owner_relay("o3", "/new"))
+        assert r.turn("o1").done
+        assert r.turn("g1") is None  # discarded by /new
+        assert inflight(SHARED) == 1  # the cancelled turn's completion found o2 pending
+        r.release("o2")
+        await settle()
+        assert inflight(SHARED) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_later_granted_owner_turn_never_releases_an_attached_count(self, gate_state, shared_dm):
+        a, r = make(mode="queue")
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        await deliver(a, owner_relay("o2", "owner again"))  # queued behind g1, grant recorded
+        assert adapter._TURN_AUTHZ._entries[("dm", "relay", "")] is True
+        assert inflight(SHARED) == 1 and not tools(SHARED)
+        r.release("o1")
+        await settle()
+        assert inflight(SHARED) == 1 and not tools(SHARED)  # g1 runs now
+        r.release("g1")
+        await settle()
+        assert r.turn("o2") is not None and not r.turn("o2").done
+        assert inflight(SHARED) == 1 and not tools(SHARED)  # o2 still to finish: not idle
+        r.release("o2")
+        await settle()
+        assert inflight(SHARED) == 0 and tools(SHARED)
+        await teardown(a)
+
+
+# ---------------------------------------------------------------------------
+# Audit F3: one test per idle-predicate clause
+# ---------------------------------------------------------------------------
+
+
+class TestIdleClauses:
+    @pytest.mark.asyncio
+    async def test_a_runner_held_live_turn_with_no_adapter_task_keeps_the_count(self, gate_state):
+        # turn.agent clause: a resumed runner turn is live in the session but
+        # the adapter has no task for it. The guest event starts its own base
+        # task, the runner redirects its text into the live turn, and the base
+        # task completes at once.
+        a, r = make()
+        session = "agent:main:securecoms:group:room:relay"
+        resumed = Turn(types.SimpleNamespace(message_id="resumed", text="resumed turn"), session)
+        r._session_state(session).turn.agent = Agent(resumed, r)
+        await deliver(a, guest_relay("g1", "guest speaks", chan="room"))
+        assert ("redirect", authz.COMMAND_ESCAPE + "guest speaks") in resumed.injected
+        assert a._session_tasks.get(session) is None  # the guest's own base task is done
+        assert inflight(ROOM) == 1  # still inside the resumed turn
+        r._session_state(session).turn.agent = None
+        await deliver(a, guest_relay("g2", "guest again", chan="room"))
+        r.release("g2")
+        await settle()
+        assert inflight(ROOM) == 0  # the next idle completion clears it
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_an_orphaned_runner_fifo_keeps_the_count(self, gate_state):
+        # queued_events clause: an early-exit turn leaves the overflow behind
+        # with the pending slot empty (#28503).
+        a, r = make(mode="queue")
+        await deliver(a, guest_relay("g0", "zero", chan="room"))
+        await deliver(a, guest_relay("g1", "one", chan="room"))  # pending slot
+        await deliver(a, guest_relay("g2", "two", chan="room"))  # overflow
+        session = "agent:main:securecoms:group:room:relay"
+        assert [e.message_id for e in r.sessions[session].conversation.queued_events] == ["g2"]
+        r.release("g0")
+        await settle()
+        r.skip_promotion = True
+        r.release("g1")
+        await settle()
+        assert a._pending_messages == {} and r.sessions[session].conversation.queued_events
+        assert inflight(ROOM) == 3  # g2 still waits in the runner FIFO
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_debounced_text_keeps_the_count(self, gate_state):
+        # debounce clause: busy_text_mode=queue buffers the guest text; the
+        # running turn's completion fires BEFORE the debounce flush.
+        a, r = make()
+        a._busy_text_mode = "queue"
+        await deliver(a, guest_relay("g0", "zero", chan="room"))
+        await deliver(a, guest_relay("g1", "one", chan="room"))
+        session = "agent:main:securecoms:group:room:relay"
+        assert session in a._text_debounce
+        r.release("g0")
+        await settle()
+        t1 = r.turn("g1")
+        assert t1 is not None and not t1.done
+        assert inflight(ROOM) == 2
+        r.release("g1")
+        await settle()
+        assert inflight(ROOM) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_just_started_task_keeps_the_count(self, gate_state):
+        # live-task clause: right after handle_message returns, the guest's
+        # own task exists but has not run (no runner turn yet).
+        a, r = make()
+        await a._receive_message(guest_relay("g1", "guest speaks", chan="room"))
+        assert inflight(ROOM) == 1
+        await settle()
+        assert inflight(ROOM) == 1
+        r.release("g1")
+        await settle()
+        assert inflight(ROOM) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_stop_command_guard_keeps_the_count_until_a_later_completion(self, gate_state, shared_dm):
+        # command-guard clause: /stop installs its guard, then cancels the
+        # running turn; that turn's completion sees a guard with no owner task.
+        a, r = make()
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "guest speaks"))  # redirected into o1
+        assert inflight(SHARED) == 1
+        await deliver(a, owner_relay("o2", "/stop"))
+        assert r.turn("o1").done and a._pending_messages == {}
+        assert inflight(SHARED) == 1  # next-turn-clears case (stated in the PR)
+        await deliver(a, owner_relay("o3", "owner again"))
+        r.release("o3")
+        await settle()
+        assert inflight(SHARED) == 0
+        await teardown(a)
+
+
+# ---------------------------------------------------------------------------
+# H0.2d: non-owner text never enters the owner session
+# ---------------------------------------------------------------------------
+
+
+class TestOwnerSessionIsolation:
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("order", ["owner_first", "guest_first"])
+    async def test_classification_of_dm_turns(self, gate_state, order):
+        a, r = make()
+        frames = [owner_direct("o1", "typed"), owner_relay("o2", "voice"), guest_relay("g1", "guest"),
+                  no_block("x1", "nobody")]  # x1: unclassified (audit r2)
+        if order == "guest_first":
+            frames.reverse()
+        for f in frames:  # each turn finishes before the next arrives
+            await deliver(a, f)
+            r.release(f["message_id"])
+            await settle()
+        ev = {mid: r.turn(mid).event for mid in ("o1", "o2", "g1", "x1")}
+        assert ev["o1"].source.thread_id is None and ev["o2"].source.thread_id is None
+        assert r.turn("o1").key == r.turn("o2").key == OWNER_SESSION
+        assert ev["g1"].source.thread_id == NON_OWNER and ev["x1"].source.thread_id == UNCLASSIFIED
+        assert r.turn("g1").key == GUEST_SESSION and r.turn("x1").key == UNCLASSIFIED_SESSION
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_an_owners_ungranted_turn_stays_in_the_owner_session(self, gate_state):
+        a, r = make()
+        await deliver(a, owner_direct("o1", "typed", grants=[]))  # grants kill switch
+        assert r.turn("o1").key == OWNER_SESSION
+        assert inflight(("dm", "owner", None)) == 1
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("order", ["owner_first", "guest_first"])
+    async def test_a_guest_canary_never_reaches_the_owner_transcript(self, gate_state, order):
+        a, r = make()
+        canary = "CANARY-guest-7f3a"
+        first, second = (owner_direct("o1", "what time is it"), guest_relay("g1", canary))
+        if order == "guest_first":
+            first, second = second, first
+        await deliver(a, first)
+        await deliver(a, second)
+        assert r.turn("o1") is not None and r.turn("g1") is not None
+        assert OWNER_SESSION not in a._pending_messages and OWNER_SESSION not in a._text_debounce
+        st = r._peek_session_state(OWNER_SESSION)
+        assert st is None or st.conversation.queued_events == []
+        r.release("o1")
+        r.release("g1")
+        await settle()
+        assert not any(canary in t for t in r.transcripts[OWNER_SESSION])
+        assert any(canary in t for t in r.transcripts[GUEST_SESSION])
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_owner_tools_stay_available_while_a_guest_turn_is_in_flight(self, gate_state):
+        a, r = make()
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        assert inflight(("dm", "relay", NON_OWNER)) == 1
+        env = {"HERMES_SESSION_PLATFORM": "securecoms", "HERMES_SESSION_CHAT_ID": "dm",
+               "HERMES_SESSION_USER_ID": "relay", "HERMES_SESSION_THREAD_ID": ""}
+        assert authz.pre_tool_call_decision(lambda n, d="": env[n], adapter._TURN_AUTHZ) is None
+        assert a.toolsets_for_source(r.turn("o1").event.source) is None
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_tool_call_bound_to_the_guest_session_is_blocked(self, gate_state):
+        a, r = make()
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        r.release("g1")
+        await settle()  # the guest's count is released: the key itself must refuse
+        await deliver(a, owner_relay("o1", "owner speaks"))  # the LATEST record: granted (dm, relay, "")
+        assert tools(OWNER_RELAY)
+        env = {"HERMES_SESSION_PLATFORM": "securecoms", "HERMES_SESSION_CHAT_ID": "dm",
+               "HERMES_SESSION_USER_ID": "relay", "HERMES_SESSION_THREAD_ID": NON_OWNER}
+        assert authz.pre_tool_call_decision(lambda n, d="": env[n], adapter._TURN_AUTHZ)["action"] == "block"
+        assert a.toolsets_for_source(r.turn("g1").event.source) == list(authz.NO_TOOLS_TOOLSETS)
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_granted_frame_recorded_under_the_non_owner_thread_is_forced_off(self, gate_state):
+        adapter._TURN_AUTHZ.record("dm", "relay", True, NON_OWNER)
+        assert not tools(("dm", "relay", NON_OWNER))
+
+    @pytest.mark.asyncio
+    async def test_a_no_block_dm_frame_is_an_unclassified_turn(self, gate_state):
+        a, r = make()
+        await deliver(a, no_block("x1", "hello", sender="owner"))  # even the owner's id, without a block
+        assert r.turn("x1").event.source.thread_id == UNCLASSIFIED
+        assert r.turn("x1").key == UNCLASSIFIED_SESSION
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("order", ["owner_first", "stale_first"])
+    async def test_a_stale_roster_owner_frame_runs_in_the_unclassified_session(self, gate_state, order):
+        # Audit r2: the owner's text during a stale roster (sender_membership
+        # "unknown") lands in neither the guest transcript nor the owner's.
+        a, r = make()
+        stale = owner_direct("s1", "STALE-owner-91c")
+        stale["authorization"]["sender_membership"] = "unknown"
+        frames = [stale, guest_relay("g1", "CANARY-guest-4d2"), owner_direct("o1", "fresh owner")]
+        if order == "stale_first":
+            frames = [frames[0], frames[2], frames[1]]
+        for f in frames:
+            await deliver(a, f)
+            r.release(f["message_id"])
+            await settle()
+        assert r.turn("s1").event.source.thread_id == UNCLASSIFIED
+        assert r.turn("g1").event.source.thread_id == NON_OWNER
+        assert r.turn("o1").event.source.thread_id is None
+        assert any("STALE-owner-91c" in t for t in r.transcripts[UNCLASSIFIED_SESSION])
+        assert not any("STALE-owner-91c" in t for t in r.transcripts[GUEST_SESSION] + r.transcripts[OWNER_SESSION])
+        assert not any("CANARY-guest-4d2" in t for t in r.transcripts[UNCLASSIFIED_SESSION] + r.transcripts[OWNER_SESSION])
+        assert not tools(("dm", "owner", UNCLASSIFIED))
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("cache", ["empty", "refresh_failed", "stale_says_room"])
+    async def test_a_dm_block_splits_even_when_the_channel_cache_misses(self, gate_state, cache):
+        # Audit r2: the block says DM (owner_dm / other_human_dm / relay
+        # mark), so the split applies whatever the channel cache says.
+        a, r = make()
+        if cache == "empty":
+            a._channels = {}
+        elif cache == "refresh_failed":
+            a._channels = {}
+            a._session = object()
+
+            async def failing_refresh():
+                return None
+
+            a._refresh_channels = failing_refresh
+        else:
+            a._channels = {"dm": {"name": "dm", "is_dm": False}}
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "CANARY-guest-cache"))
+        assert r.turn("o1").event.source.chat_type == "dm"
+        assert r.turn("g1").event.source.thread_id == NON_OWNER
+        assert r.turn("g1").key == GUEST_SESSION != r.turn("o1").key
+        r.release("o1")
+        r.release("g1")
+        await settle()
+        assert not any("CANARY-guest-cache" in t for t in r.transcripts[OWNER_SESSION])
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_send_with_thread_metadata_posts_to_the_channel_only(self, gate_state):
+        a, r = make()
+        sess = _w.FakeSession(post_response=(200, {"message_id": "m9"}))
+        a._session = sess
+        a.bridge_url = "http://127.0.0.1:9"
+        res = await a.send("dm", "reply", metadata={"thread_id": NON_OWNER})
+        assert res.success
+        assert sess.post_calls[0][2] == {"channel_id": "dm", "text": "reply"}
+
+    @pytest.mark.asyncio
+    async def test_admission_is_by_user_id_so_both_relay_turns_are_admitted(self, gate_state):
+        a, r = make()
+        r.allowed_users = {"relay"}  # SECURECOMS_ALLOWED_USERS lists only the relay
+        await deliver(a, owner_relay("o1", "owner speaks"))
+        await deliver(a, guest_relay("g1", "guest speaks"))
+        assert r.admits(r.turn("o1").event.source) and r.admits(r.turn("g1").event.source)
+        await teardown(a)
+
+
+# ---------------------------------------------------------------------------
+# H0.3, audit F2, F8
+# ---------------------------------------------------------------------------
+
+
+class TestReleaseBookkeeping:
+    @pytest.mark.asyncio
+    async def test_a_second_completion_for_one_started_event_releases_once(self, gate_state):
+        a, r = make()
+        await deliver(a, guest_relay("g1", "guest speaks", chan="room"))
+        adapter._TURN_AUTHZ.begin_ungranted(*ROOM)  # some other in-flight count
+        assert inflight(ROOM) == 2
+        ev = r.turn("g1").event
+        r.release("g1")
+        await settle()
+        assert inflight(ROOM) == 1
+        await a.on_processing_complete(ev, ProcessingOutcome.SUCCESS)
+        assert inflight(ROOM) == 1
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_dispatch_exception_before_handle_message_releases(self, gate_state):
+        a, r = make()
+
+        def boom(event):
+            raise RuntimeError("session lookup failed")
+
+        a._session_was_busy = boom
+        with pytest.raises(RuntimeError):
+            await a._receive_message(guest_relay("g1", "guest speaks", chan="room"))
+        assert inflight(ROOM) == 0
+        assert adapter._ATTACHED == {}
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_handle_message_exception_keeps_the_count_until_idle(self, gate_state):
+        a, r = make()
+
+        async def broken(event):
+            raise RuntimeError("hermes failed mid-intake")
+
+        await deliver(a, guest_relay("g0", "running", chan="room"))
+        a.handle_message = broken
+        with pytest.raises(RuntimeError):
+            await a._receive_message(guest_relay("g1", "guest speaks", chan="room"))
+        assert inflight(ROOM) == 2  # session busy (g0 runs): attached, not released
+        r.release("g0")
+        await settle()
+        assert inflight(ROOM) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_granted_turn_alone_keeps_todays_behaviour(self, gate_state):
+        a, r = make()
+        await deliver(a, owner_direct("o1", "hi"))
+        assert tools(("dm", "owner", None))
+        assert inflight(("dm", "owner", None)) == 0
+        assert a.toolsets_for_source(r.turn("o1").event.source) is None
+        r.release("o1")
+        await settle()
+        assert tools(("dm", "owner", None))
+        assert adapter._ATTACHED == {}
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_two_concurrent_ungranted_turns_need_two_releases(self, gate_state):
+        a, r = make(mode="queue")
+        await deliver(a, guest_relay("g1", "one", chan="room"))
+        await deliver(a, guest_relay("g2", "two", chan="room"))
+        assert inflight(ROOM) == 2
+        r.release("g1")
+        await settle()
+        assert r.turn("g2") is not None
+        assert inflight(ROOM) == 2
+        r.release("g2")
+        await settle()
+        assert inflight(ROOM) == 0
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_an_owner_dm_key_is_unaffected_by_a_room_key(self, gate_state):
+        a, r = make()
+        await deliver(a, guest_relay("g1", "guest speaks", chan="room"))
+        await deliver(a, owner_direct("o1", "hi"))
+        assert inflight(ROOM) == 1
+        assert tools(("dm", "owner", None))
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_an_unreadable_idle_input_counts_as_busy(self, gate_state):
+        a, r = make()
+        await deliver(a, guest_relay("g1", "guest speaks", chan="room"))
+
+        def broken(key):
+            raise RuntimeError("state unreadable")
+
+        r._peek_session_state = broken
+        r.release("g1")
+        await settle()
+        assert inflight(ROOM) == 1  # fail closed: never released on an unreadable input
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_an_acceptance_timeout_releases_nothing(self, gate_state, monkeypatch):
+        monkeypatch.setattr(adapter, "_ACCEPT_WAIT_S", 0.05)
+        a, r = make()
+        a.gateway_runner = None  # no runner state: idle cannot be proven
+        await deliver(a, guest_relay("g1", "guest speaks", chan="room"))
+        await asyncio.sleep(0.1)
+        assert inflight(ROOM) == 1
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    async def test_a_replaced_adapter_releases_a_count_whose_task_never_ran(self, gate_state):
+        # F2: the guest's task is cancelled before its first step (no hook
+        # ever fires for it) and the adapter instance is replaced; the next
+        # idle completion in the same session, on the new instance, releases it.
+        a1, r1 = make()
+        session = "agent:main:securecoms:group:room:relay"
+        await a1._receive_message(guest_relay("g1", "guest speaks", chan="room"))
+        task = a1._session_tasks[session]
+        task.cancel()
+        await asyncio.gather(task, return_exceptions=True)
+        assert r1.turn("g1") is None and inflight(ROOM) == 1
+        await teardown(a1)
+        a2, r2 = make()
+        await deliver(a2, guest_relay("g2", "guest again", chan="room"))
+        assert inflight(ROOM) == 2
+        r2.release("g2")
+        await settle()
+        assert inflight(ROOM) == 0
+        await teardown(a2)
+
+    @pytest.mark.asyncio
+    async def test_a_missing_idle_input_warns_once(self, gate_state, caplog):
+        a, r = make()
+        a.gateway_runner = None
+        with caplog.at_level(logging.WARNING, logger=adapter.logger.name):
+            await deliver(a, guest_relay("g1", "one", chan="room"))
+            await deliver(a, guest_relay("g2", "two", chan="dm"))
+        lines = [rec for rec in caplog.records if "idle state" in rec.getMessage()]
+        assert len(lines) == 1 and lines[0].args == ()
+        await teardown(a)
+
+
+# ---------------------------------------------------------------------------
+# H0.2b: group_sessions_per_user off -> room turns ungranted
+# ---------------------------------------------------------------------------
+
+
+class TestSessionSeparationGuard:
+    async def _connect(self, a, monkeypatch):
+        monkeypatch.setattr(adapter, "resolve_bound_identity", lambda *args: None)
+        assert await a.connect() is False  # stops at the (absent) binding
+
+    @pytest.mark.asyncio
+    async def test_off_makes_every_room_turn_ungranted_and_logs_once(self, gate_state, monkeypatch, caplog):
+        # Defence in depth: today the daemon marks relay_speaker only in DMs,
+        # so no room frame carries a grant the connector honours. Simulate a
+        # granted room relay frame by not reading the block's DM mark.
+        monkeypatch.setattr(authz, "block_says_dm", lambda frame: False)
+        a, r = make(extra={"group_sessions_per_user": False})
+        with caplog.at_level(logging.WARNING, logger=adapter.logger.name):
+            await self._connect(a, monkeypatch)
+            await self._connect(a, monkeypatch)
+            a2, _ = make(extra={"group_sessions_per_user": False})
+            await self._connect(a2, monkeypatch)
+        assert len([rec for rec in caplog.records if "group_sessions_per_user" in rec.getMessage()]) == 1
+        await deliver(a, owner_relay("o1", "owner speaks", chan="room"))
+        ev = r.turn("o1").event
+        assert ev.metadata["securecoms"]["tools_allowed"] is False
+        assert not tools(ROOM)
+        assert a.toolsets_for_source(ev.source) == list(authz.NO_TOOLS_TOOLSETS)
+        # A DM is unaffected.
+        await deliver(a, owner_direct("d1", "hi"))
+        assert tools(("dm", "owner", None))
+        await teardown(a)
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("extra", [{}, {"group_sessions_per_user": True}])
+    async def test_absent_or_true_is_unchanged(self, gate_state, monkeypatch, caplog, extra):
+        monkeypatch.setattr(authz, "block_says_dm", lambda frame: False)  # as in the test above
+        a, r = make(extra=extra)
+        with caplog.at_level(logging.WARNING, logger=adapter.logger.name):
+            await self._connect(a, monkeypatch)
+        assert not any("group_sessions_per_user" in rec.getMessage() for rec in caplog.records)
+        await deliver(a, owner_relay("o1", "owner speaks", chan="room"))
+        assert tools(ROOM)
+        assert a.toolsets_for_source(r.turn("o1").event.source) is None
+        await teardown(a)