switchroom 0.13.1 → 0.13.3

package/telegram-plugin/gateway/gateway.ts

@@ -76,7 +76,7 @@ import {
 import { emitRuntimeMetric } from '../runtime-metrics.js'
 import { classifyInbound } from '../inbound-classifier.js'
 import * as silencePoke from '../silence-poke.js'
-import { writeSilentEndState, clearSilentEndState } from '../silent-end.js'
+import { writeSilentEndState, clearSilentEndState, recordSilentTurnEnd } from '../silent-end.js'
 import { createAnswerStream, type AnswerStreamHandle } from '../answer-stream.js'
 import { type SessionEvent } from '../session-tail.js'
 import {
@@ -139,6 +139,16 @@ import { validateStringArray } from './access-validator.js'
  * identical envelope shapes.
  */
 const REPLY_TO_TEXT_MAX = 200
+
+/**
+ * #1161 — user-facing fallback delivered when a user-message turn ends
+ * with zero outbound messages AND the deterministic Stop-hook re-prompt
+ * has already been exhausted. Without this the user only sees the
+ * progress card vanish; silence must never be the failure mode.
+ */
+const SILENT_END_FALLBACK_TEXT =
+  '⚠️ The agent finished working but didn’t send a reply — your last ' +
+  'message may not have been answered. Please try asking again.'
 import { markdownToHtml, splitHtmlChunks, repairEscapedWhitespace, telegramHtmlToPlainText } from '../format.js'
 import {
   validateInlineKeyboard,
@@ -1278,62 +1288,32 @@ function streamKey(chatId: string, threadId?: number | null): string {
   return chatKey(chatId, threadId)
 }
 
-/**
- * Reaction-state cleanup — controller + msg-id maps + active-reaction
- * file removal. PURE reaction-cleanup, no turn-end semantics:
- *   - does NOT emit shadow `turnEnd`
- *   - does NOT clear `activeTurnStartedAt` (turn-active marker)
- *   - does NOT fire the model-idle restart/flush gate
- *
- * Called from mid-turn signals like `endStatusReaction` (post-reply-tool,
- * post-stream-reply-finalize) where the 👍 transition fires but the
- * turn is still active. Per #1603 audit step 2: the reply tool was
- * previously calling `purgeReactionTracking` here, which fired premature
- * shadow `turnEnd` events and cleared `activeTurnStartedAt` mid-turn —
- * the latter would trigger the model-idle restart probe and
- * pendingInbound flush as if claude had gone idle.
- */
-function clearReactionState(key: string): void {
+function purgeReactionTracking(key: string, endingTurn?: CurrentTurn): void {
+  // Phase 2b: turn end. The key was registered via setTurnStarted when
+  // the inbound arrived; purge is the canonical turn-end signal.
+  //
+  // outboundEmitted: read from the explicit `endingTurn` parameter when
+  // provided (canonical path via endCurrentTurnAtomic — module-scope
+  // currentTurn is already null by the time we get here), falling back
+  // to `currentTurn?.replyCalled` for the legacy callsites that haven't
+  // been threaded yet (sibling-key purges, restart-init cleanup).
+  // Without this explicit-turn handoff the shadow trace would report
+  // outboundEmitted=false on every replied turn (the dominant happy
+  // path), producing strictly worse data than the blind `true` it
+  // replaced. Invariant #5's `lastOutboundAt` correctness depends on
+  // this signal being accurate.
+  const outboundEmitted = endingTurn != null
+    ? endingTurn.replyCalled === true
+    : currentTurn?.replyCalled === true
+  shadowEmit({ kind: 'turnEnd', key: key as _ChatKey, at: Date.now(), outboundEmitted })
   const msgInfo = activeReactionMsgIds.get(key)
   activeStatusReactions.delete(key)
   activeReactionMsgIds.delete(key)
+  activeTurnStartedAt.delete(key)
   if (msgInfo) {
     const agentDir = resolveAgentDirFromEnv()
     if (agentDir != null) removeActiveReaction(agentDir, msgInfo.chatId, msgInfo.messageId)
   }
-}
-
-function purgeReactionTracking(
-  key: string,
-  endingTurn?: CurrentTurn,
-  outboundEmittedOverride?: boolean,
-): void {
-  // Phase 2b: turn end. The key was registered via setTurnStarted when
-  // the inbound arrived; purge is the canonical turn-end signal.
-  //
-  // outboundEmitted derivation, in precedence order:
-  //   1. Explicit `outboundEmittedOverride` (e.g. silence-poke
-  //      framework fallback FORCES false because the 5-min fallback
-  //      firing proves visible delivery never happened — regardless of
-  //      whatever `replyCalled` the wedged turn object carries).
-  //   2. `endingTurn.replyCalled` when the canonical caller threads
-  //      the authoritative turn (endCurrentTurnAtomic path; module-scope
-  //      currentTurn is already null by the time we get here).
-  //   3. `currentTurn?.replyCalled` fallback for the (now-vanishing)
-  //      legacy callsites. Without the explicit-turn handoff the shadow
-  //      trace would report outboundEmitted=false on every replied
-  //      turn (the dominant happy path), producing strictly worse data
-  //      than the blind `true` it replaced. Invariant #5's
-  //      `lastOutboundAt` correctness depends on this signal being
-  //      accurate.
-  const outboundEmitted = outboundEmittedOverride !== undefined
-    ? outboundEmittedOverride
-    : endingTurn != null
-      ? endingTurn.replyCalled === true
-      : currentTurn?.replyCalled === true
-  shadowEmit({ kind: 'turnEnd', key: key as _ChatKey, at: Date.now(), outboundEmitted })
-  clearReactionState(key)
-  activeTurnStartedAt.delete(key)
 
   // If no more active turns and a restart is pending, perform it now.
   //
@@ -1623,24 +1603,12 @@ async function resolveCompactCard(
 }
 
 function endStatusReaction(chatId: string, threadId: number | undefined, outcome: 'done' | 'error'): void {
-  // Mid-turn signal: the reply tool fired, or stream_reply finalized,
-  // and the status-reaction needs to transition to its terminal emoji
-  // (👍 / ⚠️). The turn itself is still active — the canonical turn-end
-  // signal is `endCurrentTurnAtomic(turn)`, which runs later via the
-  // turn_end handler / context-exhaust path / silent-marker path.
-  //
-  // Pre-#1603 audit step 2 (this commit), this called
-  // `purgeReactionTracking(key)` directly, which would fire shadow
-  // `turnEnd` and clear the turn-active marker mid-turn — the latter
-  // triggering the model-idle restart probe + pendingInbound flush as
-  // if claude had gone idle. Use `clearReactionState` to only do the
-  // reaction-cleanup work.
   const key = statusKey(chatId, threadId)
   const ctrl = activeStatusReactions.get(key)
   if (!ctrl) return
   if (outcome === 'done') ctrl.setDone()
   else ctrl.setError()
-  clearReactionState(key)
+  purgeReactionTracking(key)
 }
 
 function resolveThreadId(chat_id: string, explicit?: string | number | null): number | undefined {
@@ -3135,15 +3103,7 @@ silencePoke.startTimer({
     // Drop silence-poke state and clear turn-active so the next inbound
     // for this chat starts a fresh turn instead of queueing forever.
     silencePoke.endTurn(fbKey)
-    // PR 3b step 5 (#1603 audit): force outboundEmitted=false. The
-    // framework fallback fires precisely because visible delivery
-    // didn't happen in 5 min — `wedgedTurn.replyCalled` may have been
-    // set during the turn (e.g. reply tool invoked but Telegram side
-    // never confirmed delivery), but from the user's perspective no
-    // outbound landed. The state machine's `noteOutbound` effect
-    // must NOT fire for this path. Pass `undefined` for endingTurn
-    // and `false` as the explicit override.
-    purgeReactionTracking(fbKey, undefined, false)
+    purgeReactionTracking(fbKey)
     // Defense-in-depth: the fallback's purgeReactionTracking above
     // clears the canonical statusKey(chatId, threadId) for fbKey
     // only. activeTurnStartedAt can hold sibling entries for the
@@ -3156,14 +3116,10 @@ silencePoke.startTimer({
     // purger. Multi-chat-safe — only touches keys for fbChatId, so
     // #1546's intentional cross-chat safety guard is preserved.
     // See turn-state-purge.ts.
-    //
-    // Same `outboundEmitted=false` rationale as the bare call above —
-    // wrap the purger so every sibling-key purge emits a fallback
-    // shadow turnEnd with the truthful "no visible delivery" signal.
     const fbExtraPurge = purgeStaleTurnsForChat(
       fbChatId,
       activeTurnStartedAt.keys(),
-      (k) => purgeReactionTracking(k, undefined, false),
+      purgeReactionTracking,
     )
     // Null `currentTurn` if it's still pointing at the wedged turn —
     // when claude eventually fires a late `turn_end` for this session
@@ -5882,10 +5838,7 @@ function handleSessionEvent(ev: SessionEvent): void {
         const ceKey = statusKey(chatId, threadId)
         const ctrl = activeStatusReactions.get(ceKey)
         if (ctrl) ctrl.setError()
-        // Duplicate-emit removed (#1603 audit, step 1): the canonical
-        // endCurrentTurnAtomic(turn) call at line ~5851 below already
-        // invokes purgeReactionTracking on the same ceKey. The bare
-        // call here was firing a second shadow `turnEnd` per traversal.
+        purgeReactionTracking(ceKey)
         // Surfaced during CC-5 investigation (`docs/status-ask-cause-classes.md`):
         // the context-exhaust bail path teardown was missing
         // `silencePoke.endTurn(key)`. Without it, the silence-poke state for
@@ -6043,10 +5996,7 @@ function handleSessionEvent(ev: SessionEvent): void {
         // Fall through to normal state cleanup (ctrl.setDone, purge, etc.)
         // but skip the regular closeProgressLane so we don't re-finalize.
         if (ctrl) ctrl.setDone()
-        // Duplicate-emit removed (#1603 audit, step 1): endCurrentTurnAtomic(turn)
-        // at line ~6049 below invokes purgeReactionTracking on the same key
-        // (statusKey(chatId, threadId)). The bare call here was firing a
-        // second shadow `turnEnd` per silent-marker traversal.
+        purgeReactionTracking(statusKey(chatId, threadId))
         // Match the normal turn_end path's telemetry so silent-marker turns
         // still appear in turn-duration graphs.
         {
@@ -6187,15 +6137,7 @@ function handleSessionEvent(ev: SessionEvent): void {
                 // mirroring this contract — so reply-only turns transition
                 // to terminal 👍 in their own success path rather than
                 // relying on this dedup heuristic.
-                //
-                // PR 3b step 3 (#1603 audit): thread the captured `turn`
-                // explicitly. `endCurrentTurnAtomic(turn)` ran at line ~6120
-                // before this IIFE started, so `currentTurn === null` by
-                // now — without an explicit endingTurn argument, the shadow
-                // trace would read `outboundEmitted=false` for this dedup
-                // path even though `recentCount > 0` proves the reply tool
-                // did fire (turn.replyCalled === true).
-                purgeReactionTracking(statusKey(backstopChatId, backstopThreadId), turn)
+                purgeReactionTracking(statusKey(backstopChatId, backstopThreadId))
                 return
               }
             } catch {}
@@ -6323,35 +6265,14 @@ function handleSessionEvent(ev: SessionEvent): void {
             process.stderr.write(`telegram gateway: turn-flush send failed: ${(err as Error).message}\n`)
             if (backstopCtrl) backstopCtrl.setError()
           } finally {
-            // PR 3b step 3 (#1603 audit): thread the captured `turn`
-            // explicitly. The turn-flush backstop runs inside this IIFE
-            // after `endCurrentTurnAtomic(turn)` already nulled
-            // `currentTurn` at line ~6120. Without threading, the shadow
-            // trace would read `outboundEmitted=currentTurn?.replyCalled
-            // === undefined` → false. For the turn-flush path
-            // `turn.replyCalled` is `false` regardless (the model didn't
-            // call the reply tool — the gateway backstop did the work),
-            // so the threaded value matches the existing fallback here.
-            // But pinning the source via the captured turn matches the
-            // canonical pattern and survives any future change to how
-            // `currentTurn` is sequenced.
-            purgeReactionTracking(statusKey(backstopChatId, backstopThreadId), turn)
+            purgeReactionTracking(statusKey(backstopChatId, backstopThreadId))
           }
         })()
         return
       }
 
       if (ctrl) ctrl.setDone()
-      // Duplicate-emit removed (#1603 audit, step 4 — the audit's
-      // original "route through endCurrentTurnAtomic" recommendation
-      // missed that this same code path already calls
-      // `endCurrentTurnAtomic(turn)` ~90 lines below at line ~6412
-      // on the same key — `chatId === turn.sessionChatId` and
-      // `threadId === turn.sessionThreadId` per the bindings at
-      // ~5946-5947. Removing this bare call closes the last duplicate
-      // shadow-`turnEnd` emit on the dominant happy-path turn-end
-      // tail; the canonical primitive below still fires the single
-      // authoritative turnEnd with the threaded turn).
+      purgeReactionTracking(statusKey(chatId, threadId))
       {
         const sKey = streamKey(chatId, threadId)
         const turnDurationMs = turn.startedAt > 0 ? Date.now() - turn.startedAt : 0
@@ -6379,16 +6300,44 @@ function handleSessionEvent(ev: SessionEvent): void {
           longest_silent_gap_ms: outboundMetrics.longestOutboundGapMs,
           ended_via: outboundMetrics.outboundCount > 0 ? 'reply' : 'silent',
         })
-        // #1122 PR4 fix: deterministic silent-end detection (see the
-        // silent-marker path above for the rationale). The Stop hook
-        // reads the file we write here and blocks the session-end so
-        // the agent can be re-prompted to call reply.
+        // #1122 PR4 / #1161: deterministic silent-end handling (see the
+        // silent-marker path above for the rationale).
+        //   - first silent-end → recordSilentTurnEnd writes the state
+        //     file so the Stop hook (silent-end-interrupt-stop.mjs)
+        //     blocks the session-end and re-prompts the agent to reply.
+        //   - the Stop-hook re-prompt is already spent and the agent is
+        //     STILL silent → recordSilentTurnEnd returns exhausted:true;
+        //     deliver a user-facing fallback so the turn never just
+        //     vanishes (the user otherwise only sees the card disappear).
         if (outboundMetrics.outboundCount === 0) {
-          writeSilentEndState({
+          const silentEnd = recordSilentTurnEnd({
             chatId,
             threadId: threadId ?? null,
             turnKey: tKey,
           })
+          if (silentEnd.exhausted) {
+            process.stderr.write(
+              `telegram gateway: WARN silent-end fallback — agent stayed ` +
+              `silent after the Stop-hook re-prompt; delivering fallback ` +
+              `message chat=${chatId} turnKey=${tKey} (#1161)\n`,
+            )
+            void retryWithThreadFallback(
+              robustApiCall,
+              (tid) =>
+                bot.api.sendMessage(
+                  chatId,
+                  SILENT_END_FALLBACK_TEXT,
+                  tid != null ? { message_thread_id: tid } : {},
+                ),
+              { threadId, chat_id: chatId, verb: 'silent-end-fallback.sendMessage' },
+            ).catch((err) => {
+              process.stderr.write(
+                `telegram gateway: silent-end fallback send failed: ${
+                  err instanceof Error ? err.message : String(err)
+                }\n`,
+              )
+            })
+          }
         }
         signalTracker.clear(tKey)
         silencePoke.endTurn(tKey)

package/telegram-plugin/hooks/silent-end-interrupt-stop.mjs

@@ -9,7 +9,9 @@
  * decision:block to re-prompt the agent instead of letting the session close.
  *
  * On the second silent-end (retryCount >= MAX_RETRIES), the hook allows the
- * stop so the gateway can render the "🙊 Ended without reply" warning card.
+ * stop. The gateway's turn-end path (recordSilentTurnEnd in silent-end.ts)
+ * detects the exhausted re-prompt and delivers a user-facing fallback
+ * message so the turn never silently vanishes (#1161).
  *
  * Carve-outs preserved:
  *   - wasAutonomous=true turns: the gateway never writes a state file for
@@ -30,6 +32,8 @@ import { readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
 
+// MUST stay in sync with SILENT_END_MAX_RETRIES in telegram-plugin/silent-end.ts
+// (this hook is a standalone .mjs and can't import the TS module).
 const MAX_RETRIES = 1
 
 function readStdin() {

package/telegram-plugin/silent-end.ts

@@ -51,6 +51,14 @@ export interface SilentEndDeps {
   log?: (line: string) => void
 }
 
+/**
+ * How many times the Stop hook re-prompts a silent-end turn before it
+ * gives up. MUST stay in sync with `MAX_RETRIES` in the Stop hook
+ * (`telegram-plugin/hooks/silent-end-interrupt-stop.mjs`) — the hook is a
+ * standalone `.mjs` and can't import this module.
+ */
+export const SILENT_END_MAX_RETRIES = 1
+
 function resolveStateDir(deps?: SilentEndDeps): string {
   if (deps?.stateDir != null) return deps.stateDir
   const env = process.env.TELEGRAM_STATE_DIR
@@ -172,3 +180,51 @@ export function readSilentEndState(deps?: SilentEndDeps): SilentEndState | null
     return null
   }
 }
+
+/**
+ * Record a user-message turn that ended with zero outbound messages and
+ * report whether the deterministic re-prompt has been exhausted. This is
+ * the gateway's single entry point for the main turn-end path.
+ *
+ *   - First silent-end of a turn (no prior state, or prior `retryCount`
+ *     still below `SILENT_END_MAX_RETRIES`) → writes the state file via
+ *     `writeSilentEndState`, so `silent-end-interrupt-stop.mjs` blocks
+ *     the stop and re-prompts the agent. Returns `{ exhausted: false }`.
+ *
+ *   - A silent-end where the prior state for the SAME turn already shows
+ *     `retryCount >= SILENT_END_MAX_RETRIES` → the Stop hook already
+ *     spent its re-prompt and the agent is STILL silent. Recovery has
+ *     failed. Clears the state file (so the Stop hook on this final turn
+ *     finds nothing pending and allows the stop cleanly) and returns
+ *     `{ exhausted: true }` — the caller MUST then deliver a user-facing
+ *     fallback so the turn never just vanishes (#1161).
+ *
+ * Chat-less autonomous wakeup turns never reach here: the gateway only
+ * creates a `currentTurn` (and therefore only runs a turn-end handler)
+ * when the inbound event carries a chat id. Cron-fired turns DO carry a
+ * topic chat and reach this path — a cron task that means to stay silent
+ * must emit a NO_REPLY sentinel, which routes to the gateway's
+ * silent-marker branch and never gets a fallback.
+ */
+export function recordSilentTurnEnd(
+  args: { chatId: string; threadId: number | null; turnKey: string },
+  deps?: SilentEndDeps,
+): { exhausted: boolean } {
+  const prev = readSilentEndState(deps)
+  if (
+    prev != null &&
+    prev.turnKey === args.turnKey &&
+    prev.retryCount >= SILENT_END_MAX_RETRIES
+  ) {
+    clearSilentEndState(args.turnKey, deps)
+    emitLog(
+      deps,
+      `silent-end: re-prompt exhausted for turnKey=${args.turnKey} ` +
+        `(retryCount=${prev.retryCount} >= ${SILENT_END_MAX_RETRIES}) — ` +
+        `caller should deliver a fallback\n`,
+    )
+    return { exhausted: true }
+  }
+  writeSilentEndState(args, deps)
+  return { exhausted: false }
+}

package/telegram-plugin/tests/boot-probes.test.ts

@@ -1185,8 +1185,15 @@ describe('uptimeMsForStarttime', () => {
 // the probes covered by the boot-card-dedup-and-next-steps PR so we don't
 // silently lose the hint on a future refactor.
 
-describe('nextStep — agent systemd states', () => {
-  it('attaches a journalctl hint when the unit is failed', async () => {
+describe('nextStep — agent states', () => {
+  const savedRuntime = process.env.SWITCHROOM_RUNTIME
+  afterEach(() => {
+    if (savedRuntime === undefined) delete process.env.SWITCHROOM_RUNTIME
+    else process.env.SWITCHROOM_RUNTIME = savedRuntime
+  })
+
+  it('attaches a journalctl hint when the unit is failed (non-docker runtime)', async () => {
+    delete process.env.SWITCHROOM_RUNTIME
     const exec = makeSequence([makeSystemctlOutput('failed')])
     const r = await probeAgentProcess('klanker', {
       execFileImpl: exec as unknown as (cmd: string, args: string[]) => Promise<{ stdout: string; stderr: string }>,
@@ -1199,6 +1206,23 @@ describe('nextStep — agent systemd states', () => {
     expect(r.nextStep).toMatch(/switchroom-klanker/)
   })
 
+  // #1382: the failed/unknown-state hints must follow SWITCHROOM_RUNTIME the
+  // same way the boot-card crash row does (#1376) — no journalctl in-container.
+  it('attaches a docker-logs hint when the unit is failed under SWITCHROOM_RUNTIME=docker', async () => {
+    process.env.SWITCHROOM_RUNTIME = 'docker'
+    const exec = makeSequence([makeSystemctlOutput('failed')])
+    const r = await probeAgentProcess('klanker', {
+      execFileImpl: exec as unknown as (cmd: string, args: string[]) => Promise<{ stdout: string; stderr: string }>,
+      sleepImpl: async () => {},
+      retryIntervalMs: 1,
+      retryMaxMs: 0,
+    })
+    expect(r.status).toBe('fail')
+    expect(r.nextStep).toMatch(/docker logs/)
+    expect(r.nextStep).toMatch(/switchroom-klanker/)
+    expect(r.nextStep).not.toMatch(/journalctl/)
+  })
+
   it('attaches a transient-state hint when the unit is activating after retry budget', async () => {
     const exec = makeSequence([makeSystemctlOutput('activating')])
     const r = await probeAgentProcess('klanker', {

package/telegram-plugin/tests/silent-end.test.ts

@@ -7,6 +7,8 @@ import {
   writeSilentEndState,
   clearSilentEndState,
   readSilentEndState,
+  recordSilentTurnEnd,
+  SILENT_END_MAX_RETRIES,
 } from '../silent-end.js'
 
 let stateDir: string
@@ -118,6 +120,73 @@ describe('silent-end.ts — gateway state writer', () => {
   })
 })
 
+describe('recordSilentTurnEnd — #1161 exhaustion detection', () => {
+  it('first silent-end of a turn writes state and reports exhausted:false', () => {
+    const r = recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    expect(r.exhausted).toBe(false)
+    expect(readSilentEndState()).toMatchObject({ turnKey: 'c:_', retryCount: 0 })
+  })
+
+  it('reports exhausted:false while prior retryCount is still below the cap', () => {
+    // The Stop hook has not yet been able to push retryCount to the cap.
+    const path = join(stateDir, 'silent-end-pending.json')
+    writeFileSync(path, JSON.stringify({
+      chatId: 'c', threadId: null, turnKey: 'c:_',
+      retryCount: SILENT_END_MAX_RETRIES - 1, timestamp: 0,
+    }))
+    const r = recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    expect(r.exhausted).toBe(false)
+    // State is (re)written, inheriting the prior counter for the same turn.
+    expect(readSilentEndState()!.retryCount).toBe(SILENT_END_MAX_RETRIES - 1)
+  })
+
+  it('reports exhausted:true and clears state once the re-prompt cap is reached', () => {
+    // The Stop hook already blocked once and pushed retryCount to the cap;
+    // the agent is STILL silent on this re-prompted turn.
+    const path = join(stateDir, 'silent-end-pending.json')
+    writeFileSync(path, JSON.stringify({
+      chatId: 'c', threadId: null, turnKey: 'c:_',
+      retryCount: SILENT_END_MAX_RETRIES, timestamp: 0,
+    }))
+    const r = recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    expect(r.exhausted).toBe(true)
+    // State cleared so the Stop hook on this final turn allows the stop.
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('treats a capped prior state for a DIFFERENT turn as a fresh silent-end', () => {
+    const path = join(stateDir, 'silent-end-pending.json')
+    writeFileSync(path, JSON.stringify({
+      chatId: 'old', threadId: null, turnKey: 'old:_',
+      retryCount: SILENT_END_MAX_RETRIES, timestamp: 0,
+    }))
+    const r = recordSilentTurnEnd({ chatId: 'new', threadId: 9, turnKey: 'new:9' })
+    expect(r.exhausted).toBe(false)
+    expect(readSilentEndState()).toMatchObject({ turnKey: 'new:9', retryCount: 0 })
+  })
+
+  it('full lifecycle: silent → re-prompt → still silent → exhausted', () => {
+    // 1. Turn ends silent — first record.
+    expect(recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' }).exhausted).toBe(false)
+    // 2. Stop hook blocks and increments retryCount (simulated).
+    const path = join(stateDir, 'silent-end-pending.json')
+    const s = readSilentEndState()!
+    writeFileSync(path, JSON.stringify({ ...s, retryCount: s.retryCount + 1 }))
+    // 3. Re-prompted turn ends silent again — recovery exhausted.
+    expect(recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' }).exhausted).toBe(true)
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('SILENT_END_MAX_RETRIES matches MAX_RETRIES in the Stop hook', () => {
+    // The hook is a standalone .mjs and hardcodes its own copy — this
+    // guards the two from drifting apart.
+    const hookSrc = readFileSync(join(__dirname, '..', 'hooks', 'silent-end-interrupt-stop.mjs'), 'utf8')
+    const m = hookSrc.match(/const MAX_RETRIES = (\d+)/)
+    expect(m).not.toBeNull()
+    expect(Number(m![1])).toBe(SILENT_END_MAX_RETRIES)
+  })
+})
+
 describe('silent-end-interrupt-stop hook — integration', () => {
   const hookPath = join(__dirname, '..', 'hooks', 'silent-end-interrupt-stop.mjs')