switchroom 0.14.84 → 0.14.86

package/dist/auth-broker/index.js

@@ -13941,24 +13941,24 @@ class AuthBroker {
   }
   servingAccount(identity2) {
     const account = this.callerAccount(identity2);
-    if (identity2.kind !== "consumer")
+    if (identity2.kind === "operator")
       return account;
-    return this.consumerAccountWithFailover(account);
+    return this.accountWithFailover(account);
   }
   isAccountExhausted(account) {
     const q = this.quota[account];
     return q !== undefined && q.exhausted_until > this.now();
   }
-  consumerAccountWithFailover(pinned) {
-    if (!pinned || !this.isAccountExhausted(pinned))
-      return pinned;
+  accountWithFailover(account) {
+    if (!account || !this.isAccountExhausted(account))
+      return account ?? null;
     for (const cand of this.config.auth?.fallback_order ?? []) {
-      if (cand === pinned || this.isAccountExhausted(cand))
+      if (cand === account || this.isAccountExhausted(cand))
         continue;
       if (readAccountCredentials(cand, this.home))
         return cand;
     }
-    return pinned;
+    return account;
   }
   async opGetCredentials(socket, id, identity2) {
     const account = this.servingAccount(identity2);
@@ -14600,7 +14600,7 @@ class AuthBroker {
     const auth = this.config.auth ?? {};
     const fanned = [];
     for (const [name, agent] of Object.entries(this.config.agents ?? {})) {
-      const effective = agent.auth?.override ?? auth.active;
+      const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
       if (effective === label) {
         if (this.fanoutForAgent(name))
           fanned.push(name);
@@ -14645,7 +14645,7 @@ class AuthBroker {
     const agent = (this.config.agents ?? {})[name];
     if (!agent)
       return false;
-    const effective = agent.auth?.override ?? auth.active;
+    const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
     if (!effective)
       return false;
     return this.mirrorAccountToAgent(effective, name);

package/dist/cli/autoaccept-poll.js

@@ -176,7 +176,7 @@ function sendKeys2(agentName, keys) {
 
 // src/agents/wedge-watchdog.ts
 var WEDGE_FOOTER_SIGNATURE = /(?=[\s\S]*[Ee]sc(?:ape)?[^\n]*cancel)(?=[\s\S]*(?:to select|to navigate|\u2191\/\u2193))/;
-var RATE_LIMIT_MENU_SIGNATURE = /(?=[\s\S]*\/rate-limit-options)(?=[\s\S]*(?:Switch to usage credits|Upgrade your plan))/;
+var RATE_LIMIT_MENU_SIGNATURE = /(?=[\s\S]*Stop and wait for)(?=[\s\S]*(?:usage credits|Upgrade your plan|\/rate-limit-options))/;
 var MONTHS = {
   jan: 0,
   feb: 1,

package/dist/cli/switchroom.js

@@ -49815,8 +49815,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.84";
-var COMMIT_SHA = "af97bc41";
+var VERSION = "0.14.86";
+var COMMIT_SHA = "8c518120";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.84",
+  "version": "0.14.86",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/credits-watch.ts

@@ -27,20 +27,53 @@ import { join } from "path";
 const STATE_FILE = "credits-watch.json";
 
 /**
- * Possible values of `cachedExtraUsageDisabledReason` in `.claude.json`
- * that warrant a user-facing notification. Other values (null,
- * undefined, transient unknowns) are treated as "no notification
- * needed".
+ * Which `cachedExtraUsageDisabledReason` values warrant a user-facing alarm.
  *
- * Conservative list: only fatal-billing reasons. We don't want to fire
- * on every transient API blip the cache happens to write.
+ * IMPORTANT — empty by default (subscription-only model). The flag name says it
+ * all: `cachedExtraUsageDisabledReason` is *always* "why **extra usage** (the
+ * optional pay-as-you-go layer beyond the Pro/Max plan) is disabled." switchroom
+ * is subscription-only by design (compliance pillar 3 — "the plan is the
+ * ceiling, no API/pay-as-you-go"), so extra usage being OFF is the **expected,
+ * desired** state. Every value (`out_of_credits`, `extra_usage_disabled`,
+ * `credits_exhausted`, even `org_level_disabled` = "org admin disabled extra
+ * usage") describes that benign state — none indicates a real switchroom
+ * failure. Firing a "cron + replies will fail, buy credits" card on it is a
+ * false alarm AND advises something that contradicts the subscription-honest
+ * model.
+ *
+ * The genuine failure modes are covered elsewhere:
+ *   - an account's subscription window exhausts → stderr → fleet auto-fallback
+ *     (model-unavailable.ts → fireFleetAutoFallback) rolls to a healthy account;
+ *   - the WHOLE fleet exhausts → the quota-watch all-exhausted operator alert.
+ *
+ * So credits-watch defaults to silent. An operator who actually runs on
+ * pay-as-you-go and wants the alarm can opt specific reasons back in via
+ * `SWITCHROOM_CREDITS_WATCH_FATAL_REASONS` (comma-separated). See
+ * `resolveCreditWatchFatalReasons`.
  */
-const FATAL_REASONS = new Set([
+export const DEFAULT_CREDIT_FATAL_REASONS = new Set<string>();
+
+/** All reason strings recognized for opt-in via the env var. */
+const KNOWN_CREDIT_REASONS = [
   "out_of_credits",
   "org_level_disabled",
   "credits_exhausted",
   "extra_usage_disabled",
-]);
+] as const;
+
+/**
+ * Resolve the active fatal-reason set. Empty by default (subscription-only);
+ * if `SWITCHROOM_CREDITS_WATCH_FATAL_REASONS` is set, parse it as a
+ * comma-separated list (tokens kept verbatim — an unknown token is harmless,
+ * it simply never matches a real reason value). `*` opts in all known reasons.
+ */
+export function resolveCreditWatchFatalReasons(env: NodeJS.ProcessEnv): Set<string> {
+  const raw = env.SWITCHROOM_CREDITS_WATCH_FATAL_REASONS;
+  if (!raw || raw.trim().length === 0) return new Set(DEFAULT_CREDIT_FATAL_REASONS);
+  if (raw.trim() === "*") return new Set(KNOWN_CREDIT_REASONS);
+  const wanted = new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
+  return wanted;
+}
 
 export interface CreditState {
   /** Last reason we notified the user about. null when healthy / never notified. */
@@ -103,15 +136,22 @@ export function evaluateCreditState(args: {
   currentReason: string | null;
   prev: CreditState;
   now: number;
+  /**
+   * Which reasons are treated as fatal (worth alarming). Defaults to
+   * `DEFAULT_CREDIT_FATAL_REASONS` (empty — subscription-only: extra-usage-off
+   * is never a real failure). The gateway passes the env-resolved set.
+   */
+  fatalReasons?: Set<string>;
 }): CreditDecision {
   const { agentName, currentReason, prev, now } = args;
+  const fatalReasons = args.fatalReasons ?? DEFAULT_CREDIT_FATAL_REASONS;
 
   // Non-fatal current state (null, or some unknown reason) — no
   // notification regardless of prev (we already notified on entry to
   // fatal; recovery from a known-fatal state below is the only path
   // that fires when current is null).
-  const currentIsFatal = currentReason != null && FATAL_REASONS.has(currentReason);
-  const prevIsFatal = prev.lastNotifiedReason != null && FATAL_REASONS.has(prev.lastNotifiedReason);
+  const currentIsFatal = currentReason != null && fatalReasons.has(currentReason);
+  const prevIsFatal = prev.lastNotifiedReason != null && fatalReasons.has(prev.lastNotifiedReason);
 
   // Recovery path: last-notified was fatal, current is null/non-fatal.
   if (!currentIsFatal && prevIsFatal) {

package/telegram-plugin/dist/gateway/gateway.js

@@ -41381,6 +41381,15 @@ function createFleetFallbackGate(opts) {
   };
 }
 
+// gateway/exhaust-until.ts
+var EXHAUST_WEEKLY_FLOOR_MS = 7 * 24 * 60 * 60 * 1000;
+function resolveExhaustUntil(resetAtMs, now = Date.now()) {
+  if (typeof resetAtMs === "number" && Number.isFinite(resetAtMs) && resetAtMs > now) {
+    return resetAtMs;
+  }
+  return now + EXHAUST_WEEKLY_FLOOR_MS;
+}
+
 // gateway/auth-add-flow.ts
 import { spawn } from "node:child_process";
 import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync9, rmSync as rmSync3 } from "node:fs";
@@ -52507,12 +52516,22 @@ function extractFlowItems(line) {
 import { readFileSync as readFileSync32, writeFileSync as writeFileSync21, existsSync as existsSync33, mkdirSync as mkdirSync21 } from "fs";
 import { join as join30 } from "path";
 var STATE_FILE = "credits-watch.json";
-var FATAL_REASONS = new Set([
+var DEFAULT_CREDIT_FATAL_REASONS = new Set;
+var KNOWN_CREDIT_REASONS = [
   "out_of_credits",
   "org_level_disabled",
   "credits_exhausted",
   "extra_usage_disabled"
-]);
+];
+function resolveCreditWatchFatalReasons(env) {
+  const raw = env.SWITCHROOM_CREDITS_WATCH_FATAL_REASONS;
+  if (!raw || raw.trim().length === 0)
+    return new Set(DEFAULT_CREDIT_FATAL_REASONS);
+  if (raw.trim() === "*")
+    return new Set(KNOWN_CREDIT_REASONS);
+  const wanted = new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
+  return wanted;
+}
 function emptyCreditState() {
   return { lastNotifiedReason: null, lastNotifiedAt: 0 };
 }
@@ -52541,8 +52560,9 @@ function readClaudeJsonOverage(claudeConfigDir) {
 }
 function evaluateCreditState(args) {
   const { agentName: agentName3, currentReason, prev, now } = args;
-  const currentIsFatal = currentReason != null && FATAL_REASONS.has(currentReason);
-  const prevIsFatal = prev.lastNotifiedReason != null && FATAL_REASONS.has(prev.lastNotifiedReason);
+  const fatalReasons = args.fatalReasons ?? DEFAULT_CREDIT_FATAL_REASONS;
+  const currentIsFatal = currentReason != null && fatalReasons.has(currentReason);
+  const prevIsFatal = prev.lastNotifiedReason != null && fatalReasons.has(prev.lastNotifiedReason);
   if (!currentIsFatal && prevIsFatal) {
     return {
       kind: "notify",
@@ -52869,11 +52889,11 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.84";
-var COMMIT_SHA = "af97bc41";
-var COMMIT_DATE = "2026-06-07T13:38:19+10:00";
-var LATEST_PR = null;
-var COMMITS_AHEAD_OF_TAG = 2;
+var VERSION = "0.14.86";
+var COMMIT_SHA = "8c518120";
+var COMMIT_DATE = "2026-06-07T05:43:21Z";
+var LATEST_PR = 2223;
+var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {
@@ -55234,7 +55254,8 @@ function emitGatewayOperatorEvent(event) {
     });
     renderedKeyboard = undefined;
     if (willActuallyFire) {
-      fireFleetAutoFallback(agent);
+      const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime());
+      fireFleetAutoFallback(agent, untilMs);
     }
   } else {
     try {
@@ -56171,8 +56192,7 @@ var ipcServer = createIpcServer({
     }
   },
   onQuotaWallDetected(_client, msg) {
-    const WEEKLY_MS = 604800000;
-    const untilMs = typeof msg.resetAt === "number" && Number.isFinite(msg.resetAt) && msg.resetAt > Date.now() ? msg.resetAt : Date.now() + WEEKLY_MS;
+    const untilMs = resolveExhaustUntil(msg.resetAt);
     process.stderr.write(`telegram gateway: quota_wall_detected agent=${msg.agentName} until=${new Date(untilMs).toISOString()}` + (msg.resetAt == null ? " (reset unparsed \u2192 +7d default)" : "") + ` \u2014 triggering fleet auto-fallback
 `);
     fireFleetAutoFallback(msg.agentName, untilMs);
@@ -61040,7 +61060,8 @@ async function runCreditWatch() {
     agentName: agentName3,
     currentReason: reason,
     prev,
-    now: Date.now()
+    now: Date.now(),
+    fatalReasons: resolveCreditWatchFatalReasons(process.env)
   });
   if (decision.kind === "skip") {
     return;

package/telegram-plugin/gateway/exhaust-until.ts

@@ -0,0 +1,45 @@
+/**
+ * exhaust-until.ts — the single decision for the `until` (epoch-ms) handed to
+ * the broker's mark-exhausted, shared by BOTH quota-wall paths in the gateway:
+ *   - the /rate-limit-options menu signal (onQuotaWallDetected), and
+ *   - the inference-path 429 (the model-unavailable operator-event path).
+ *
+ * Factored out of gateway.ts so the decision is unit-testable without importing
+ * the gateway module (heavy import-time side effects). Pure: no IPC, no clock
+ * except the injectable `now`.
+ *
+ * The ONE invariant both paths depend on: NEVER return undefined. A weekly wall
+ * reaches the gateway as a reset hint the parser can't always read:
+ *   - Menu path: the sidecar's parseWeeklyReset handles "resets Jun 9, 5am (tz)"
+ *     → a finite future epoch flows straight through.
+ *   - 429 path: model-unavailable.ts's parseResetTime handles the ROLLING
+ *     wordings ("resets in 2h", "retry after 60s") → a finite ~hours epoch. But
+ *     the WEEKLY wording reaches it as "resets <Mon> <D>, <H>am", which
+ *     parseResetTime CANNOT parse (`new Date('Jun 9, 5am 2026')` → Invalid Date)
+ *     → resetAtMs is undefined here EXACTLY when the wall is weekly.
+ *
+ * undefined (or a past / NaN reset) is the dangerous case: markExhausted's ~5h
+ * default would un-exhaust a weekly-walled account after 5h and let the broker
+ * re-mirror it onto the fleet (the #2218 rollback). So undefined → the +7d
+ * floor. A too-long `until` only delays the broker's re-probe of the account;
+ * it never serves an exhausted account, so erring long is the compliance-safe
+ * direction (vision.md pillar 3).
+ */
+
+/** Weekly-quota window — the safety floor for an exhaustion `until`. */
+export const EXHAUST_WEEKLY_FLOOR_MS = 7 * 24 * 60 * 60 * 1000
+
+/**
+ * Resolve the exhaustion `until` (epoch-ms) from a best-effort reset timestamp.
+ * Returns `resetAtMs` when it is a finite epoch in the future; otherwise the
+ * +7d floor anchored at `now`. NEVER returns undefined.
+ */
+export function resolveExhaustUntil(
+  resetAtMs: number | undefined,
+  now: number = Date.now(),
+): number {
+  if (typeof resetAtMs === 'number' && Number.isFinite(resetAtMs) && resetAtMs > now) {
+    return resetAtMs
+  }
+  return now + EXHAUST_WEEKLY_FLOOR_MS
+}

package/telegram-plugin/gateway/gateway.ts

@@ -125,6 +125,7 @@ import {
 } from './microsoft-connect-flow.js'
 import { resolveAuthBrokerSocketPath } from '../../src/auth/broker/client.js'
 import { createFleetFallbackGate } from '../fleet-fallback-gate.js'
+import { resolveExhaustUntil } from './exhaust-until.js'
 import {
   pendingAuthAddFlows,
   startAccountAuthSession,
@@ -408,6 +409,7 @@ import { synthesizeAllowRuleDiff, extractAddedAllowRule } from '../permission-di
 import {
   readClaudeJsonOverage,
   evaluateCreditState,
+  resolveCreditWatchFatalReasons,
   loadCreditState,
   saveCreditState,
 } from '../credits-watch.js'
@@ -4399,8 +4401,17 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     // separately with the causal-shape headline ("5-hour limit on
     // ken" instead of generic "quota exhausted") — see
     // auth-snapshot-format.ts → renderFallbackAnnouncement.
+    //
+    // Thread the parsed reset as markExhausted's `until` via the shared
+    // resolveExhaustUntil floor. parseResetTime gives a finite epoch for
+    // ROLLING wordings ("resets in 2h", "retry after 60s"); a WEEKLY wall
+    // ("resets Jun 9, 5am") is UNPARSEABLE here → undefined → +7d floor.
+    // Pre-fix this called fireFleetAutoFallback(agent) with no until, so a
+    // weekly wall that surfaced as a 429 got markExhausted's ~5h default and
+    // the broker re-mirrored the still-walled account onto the fleet after 5h.
     if (willActuallyFire) {
-      void fireFleetAutoFallback(agent)
+      const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime())
+      void fireFleetAutoFallback(agent, untilMs)
     }
   } else {
     try {
@@ -6270,11 +6281,7 @@ const ipcServer: IpcServer = createIpcServer({
   // existing chain handles the rest (roll to a fallback subscription account,
   // or the all-exhausted operator alert when none has quota). Fire-and-forget.
   onQuotaWallDetected(_client: IpcClient, msg: QuotaWallDetectedMessage) {
-    const WEEKLY_MS = 7 * 24 * 60 * 60 * 1000
-    const untilMs =
-      typeof msg.resetAt === 'number' && Number.isFinite(msg.resetAt) && msg.resetAt > Date.now()
-        ? msg.resetAt
-        : Date.now() + WEEKLY_MS
+    const untilMs = resolveExhaustUntil(msg.resetAt)
     process.stderr.write(
       `telegram gateway: quota_wall_detected agent=${msg.agentName} ` +
         `until=${new Date(untilMs).toISOString()}` +
@@ -14680,10 +14687,12 @@ async function doFireFleetAutoFallback(triggerAgent: string, untilMs?: number):
       // operator is explicitly choosing, and is admin); only this automatic
       // path moves to the non-admin verb.
       failover: async () => {
-        // The 429 inference path passes no `until` (broker ~5h default). The
-        // rate-limit-MENU path (quota_wall_detected) passes the parsed WEEKLY
-        // reset, so the walled account isn't re-probed (and re-wedged) within
-        // the 5h default while it's weekly-capped.
+        // BOTH paths now pass a resolved `untilMs` via resolveExhaustUntil
+        // (never undefined): the rate-limit-MENU path threads the parsed weekly
+        // reset, and the 429 inference path threads parseResetTime's value or
+        // the +7d floor when it's a weekly wall it can't parse. So a
+        // weekly-capped account is never re-probed (and re-wedged) within the
+        // broker's ~5h default.
         const r = await client.markExhausted(untilMs)
         return { rolledTo: r.rolledTo ?? null, rolled: r.rolled }
       },
@@ -14742,6 +14751,9 @@ async function runCreditWatch(): Promise<void> {
     currentReason: reason,
     prev,
     now: Date.now(),
+    // Subscription-only: empty by default → extra-usage-off never alarms.
+    // Opt back in via SWITCHROOM_CREDITS_WATCH_FATAL_REASONS. See credits-watch.ts.
+    fatalReasons: resolveCreditWatchFatalReasons(process.env),
   })
   if (decision.kind === 'skip') {
     return

package/telegram-plugin/tests/credits-watch.test.ts

@@ -13,6 +13,7 @@ import { join } from "path";
 import {
   readClaudeJsonOverage,
   evaluateCreditState,
+  resolveCreditWatchFatalReasons,
   loadCreditState,
   saveCreditState,
   emptyCreditState,
@@ -81,10 +82,14 @@ describe("readClaudeJsonOverage", () => {
   });
 });
 
-describe("evaluateCreditState — transition decisions", () => {
+describe("evaluateCreditState — transition decisions (machinery, explicit fatal set)", () => {
   const NOW = 1_780_000_000_000;
   const HEALTHY = emptyCreditState();
   const FATAL_OUT = { lastNotifiedReason: "out_of_credits", lastNotifiedAt: NOW - 1000 };
+  // The transition machinery is policy-agnostic — pass an explicit fatal set so
+  // these tests pin entered/changed/exited behaviour independent of the (now
+  // empty) subscription-only default.
+  const FATAL = new Set(["out_of_credits", "org_level_disabled", "credits_exhausted", "extra_usage_disabled"]);
 
   it("entry: healthy → fatal triggers a notify", () => {
     const d = evaluateCreditState({
@@ -92,6 +97,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: "out_of_credits",
       prev: HEALTHY,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("notify");
     if (d.kind !== "notify") return;
@@ -108,6 +114,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: "out_of_credits",
       prev: FATAL_OUT,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("skip");
     if (d.kind !== "skip") return;
@@ -120,6 +127,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: "org_level_disabled",
       prev: FATAL_OUT,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("notify");
     if (d.kind !== "notify") return;
@@ -134,6 +142,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: null,
       prev: FATAL_OUT,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("notify");
     if (d.kind !== "notify") return;
@@ -148,6 +157,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: "some_unknown_transient_reason",
       prev: HEALTHY,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("skip");
     if (d.kind !== "skip") return;
@@ -160,6 +170,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: null,
       prev: HEALTHY,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("skip");
   });
@@ -170,6 +181,7 @@ describe("evaluateCreditState — transition decisions", () => {
       currentReason: "out_of_credits",
       prev: HEALTHY,
       now: NOW,
+      fatalReasons: FATAL,
     });
     expect(d.kind).toBe("notify");
     if (d.kind !== "notify") return;
@@ -178,6 +190,58 @@ describe("evaluateCreditState — transition decisions", () => {
   });
 });
 
+describe("evaluateCreditState — subscription-only default (the fix)", () => {
+  const NOW = 1_780_000_000_000;
+  const HEALTHY = emptyCreditState();
+
+  // With the default (empty) fatal set, NONE of the extra-usage reasons alarm —
+  // because for subscription-only switchroom, extra-usage-off is the expected
+  // state and real exhaustion is handled by failover. This is the bug fix.
+  for (const reason of ["out_of_credits", "extra_usage_disabled", "credits_exhausted", "org_level_disabled"]) {
+    it(`default: '${reason}' does NOT alarm (no false 'out of credits' card)`, () => {
+      const d = evaluateCreditState({
+        agentName: "clerk",
+        currentReason: reason,
+        prev: HEALTHY,
+        now: NOW,
+        // fatalReasons omitted → DEFAULT_CREDIT_FATAL_REASONS (empty)
+      });
+      expect(d.kind).toBe("skip");
+    });
+  }
+
+  it("opt-in via explicit set restores the alarm (operator on pay-as-you-go)", () => {
+    const d = evaluateCreditState({
+      agentName: "clerk",
+      currentReason: "out_of_credits",
+      prev: HEALTHY,
+      now: NOW,
+      fatalReasons: new Set(["out_of_credits"]),
+    });
+    expect(d.kind).toBe("notify");
+  });
+});
+
+describe("resolveCreditWatchFatalReasons", () => {
+  it("defaults to EMPTY (subscription-only)", () => {
+    expect(resolveCreditWatchFatalReasons({}).size).toBe(0);
+  });
+  it("parses a comma-separated opt-in list", () => {
+    const s = resolveCreditWatchFatalReasons({ SWITCHROOM_CREDITS_WATCH_FATAL_REASONS: "out_of_credits, org_level_disabled" });
+    expect(s.has("out_of_credits")).toBe(true);
+    expect(s.has("org_level_disabled")).toBe(true);
+    expect(s.size).toBe(2);
+  });
+  it("'*' opts in all known reasons", () => {
+    const s = resolveCreditWatchFatalReasons({ SWITCHROOM_CREDITS_WATCH_FATAL_REASONS: "*" });
+    expect(s.has("out_of_credits")).toBe(true);
+    expect(s.size).toBeGreaterThanOrEqual(4);
+  });
+  it("blank/whitespace → empty", () => {
+    expect(resolveCreditWatchFatalReasons({ SWITCHROOM_CREDITS_WATCH_FATAL_REASONS: "  " }).size).toBe(0);
+  });
+});
+
 describe("loadCreditState / saveCreditState — round-trip", () => {
   let tmp: string;
 

package/telegram-plugin/tests/exhaust-until.test.ts

@@ -0,0 +1,86 @@
+/**
+ * Unit tests for the shared exhaustion-`until` decision (exhaust-until.ts) and
+ * the 429-path composition it sits in.
+ *
+ * The load-bearing invariant (vision.md pillar 3 + the #2218 weekly-wall
+ * rollback): the value handed to markExhausted is NEVER undefined, so a weekly
+ * wall can never fall back to the broker's ~5h default and un-exhaust early.
+ *
+ * The 429-path composition test runs the REAL detectModelUnavailable
+ * (model-unavailable.ts) into the REAL resolveExhaustUntil — proving the gateway
+ * 429 branch (`resolveExhaustUntil(modelUnavailable.resetAt?.getTime())`) threads
+ * a finite `until` for both the rolling and the unparseable-weekly wordings.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { resolveExhaustUntil, EXHAUST_WEEKLY_FLOOR_MS } from '../gateway/exhaust-until.js'
+import { detectModelUnavailable } from '../model-unavailable.js'
+
+const NOW = Date.UTC(2026, 5, 7, 0, 0, 0) // 2026-06-07
+
+describe('resolveExhaustUntil', () => {
+  it('passes through a finite reset in the future', () => {
+    const reset = NOW + 2 * 60 * 60 * 1000 // +2h (a rolling window)
+    expect(resolveExhaustUntil(reset, NOW)).toBe(reset)
+  })
+
+  it('undefined → +7d floor (the WEEKLY-wall case), never undefined', () => {
+    const until = resolveExhaustUntil(undefined, NOW)
+    expect(until).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(until).toBeGreaterThan(NOW + 5 * 60 * 60 * 1000) // past the ~5h default
+  })
+
+  it('a past / now / NaN / non-finite reset → +7d floor (treated as unparsed)', () => {
+    expect(resolveExhaustUntil(NOW - 1, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(resolveExhaustUntil(NOW, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(resolveExhaustUntil(Number.NaN, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(resolveExhaustUntil(Number.POSITIVE_INFINITY, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+  })
+
+  it('the floor is comfortably longer than the broker ~5h mark-exhausted default', () => {
+    expect(EXHAUST_WEEKLY_FLOOR_MS).toBeGreaterThan(5 * 60 * 60 * 1000)
+    expect(EXHAUST_WEEKLY_FLOOR_MS).toBe(7 * 24 * 60 * 60 * 1000)
+  })
+})
+
+describe('429-path composition: detectModelUnavailable → resolveExhaustUntil', () => {
+  // This mirrors gateway.ts's 429 branch:
+  //   const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime())
+  // NB: parseResetTime anchors RELATIVE wordings ("in 2h", "retry after Ns") at
+  // the real Date.now() — not injectable through detectModelUnavailable — so the
+  // rolling-window assertions check the SHAPE (finite, future, well below the
+  // +7d floor, no longer than the stated window), never an exact epoch.
+  function untilFor(stderr: string): { u: number; before: number } {
+    const before = Date.now()
+    const d = detectModelUnavailable(stderr)
+    expect(d).not.toBeNull()
+    return { u: resolveExhaustUntil(d?.resetAt?.getTime(), before), before }
+  }
+
+  it('ROLLING wording ("resets in 2h 15m") → a finite ~2h until, NOT the +7d floor', () => {
+    const { u, before } = untilFor('usage limit reached · resets in 2h 15m')
+    expect(Number.isFinite(u)).toBe(true)
+    expect(u).toBeGreaterThan(before)
+    const window = (2 * 60 + 15) * 60 * 1000
+    expect(u).toBeLessThanOrEqual(before + window + 2000) // ~2h15m, allow detect/resolve skew
+    expect(u).toBeLessThan(before + EXHAUST_WEEKLY_FLOOR_MS / 2) // unmistakably NOT the floor
+  })
+
+  it('ROLLING wording ("retry after 60 seconds") → a finite ~60s until, NOT the +7d floor', () => {
+    const { u, before } = untilFor('rate_limit_error: retry after 60 seconds — usage limit')
+    expect(u).toBeGreaterThan(before)
+    expect(u).toBeLessThanOrEqual(before + 60 * 1000 + 2000)
+    expect(u).toBeLessThan(before + EXHAUST_WEEKLY_FLOOR_MS / 2)
+  })
+
+  it("WEEKLY wording (\"resets Jun 9, 5am (tz)\") is UNPARSEABLE on the 429 path → +7d floor, NOT undefined/5h", () => {
+    // parseResetTime can't read the calendar weekly wording — Invalid Date →
+    // resetAt undefined. resolveExhaustUntil MUST floor it to +7d, otherwise
+    // markExhausted's ~5h default re-wedges the weekly-walled account.
+    const d = detectModelUnavailable("You've hit your limit · resets Jun 9, 5am (Australia/Melbourne)")
+    expect(d?.kind).toBe('quota_exhausted')
+    expect(d?.resetAt).toBeUndefined() // pins the parser-blind-spot premise
+    const u = resolveExhaustUntil(d?.resetAt?.getTime(), NOW)
+    expect(u).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+  })
+})