switchroom 0.17.10 → 0.18.3

package/telegram-plugin/tests/auth-snapshot-format.test.ts

@@ -262,11 +262,13 @@ describe('renderAuthSnapshotFormat2', () => {
     return rows;
   }
 
-  it('renders a GFM table with the State/Account/5h/7d/Status header', () => {
+  it('renders a GFM table with the State/Account/5h/5h resets/7d/7d resets header', () => {
     const out = renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' });
     expect(out).toContain('🔋 **Auth — fleet status**');
-    expect(out).toContain('| State | Account | 5h | 7d | Status |');
-    expect(out).toContain('| --- | --- | --- | --- | --- |');
+    expect(out).toContain('| State | Account | 5h | 5h resets | 7d | 7d resets |');
+    expect(out).toContain('| --- | --- | --- | --- | --- | --- |');
+    // The single collapsed Status column is gone.
+    expect(out).not.toContain('| 7d | Status |');
     // No legacy group headers / health-section titles remain.
     expect(out).not.toContain('**BLOCKED**');
     expect(out).not.toContain('**HEALTHY**');
@@ -307,16 +309,22 @@ describe('renderAuthSnapshotFormat2', () => {
     expect(bob).toBeLessThan(alice);
   });
 
-  it('Status column shows "back <when>" for a blocked account', () => {
+  it('reset columns show a "<time> (in ...)" cell for a blocked account (7d binding window)', () => {
     const rows = tableRows(renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' }));
     const bob = rows.find((r) => r[1].includes('bob@example.com'))!;
-    expect(bob[4]).toMatch(/^back .* \(in .+\)$/);
+    // bob is 7d-maxed; its 7d reset (2026-05-17T10:00Z) is ~2 days out and still
+    // renders in its own reset cell — no "back" prefix in the new per-window shape.
+    expect(bob[5]).toMatch(/^.* \(in .+\)$/);
+    expect(bob[5]).not.toContain('back');
   });
 
-  it('Status column shows "refills <when>" for a healthy account', () => {
+  it('reset columns show a "<time> (in ...)" cell for each window of a healthy account', () => {
     const rows = tableRows(renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' }));
     const you = rows.find((r) => r[1].includes('you@example.com'))!;
-    expect(you[4]).toMatch(/^refills .* \(in .+\)$/);
+    // 5h resets cell [3] and 7d resets cell [5] both carry a relative hint.
+    expect(you[3]).toMatch(/^.* \(in .+\)$/);
+    expect(you[5]).toMatch(/^.* \(in .+\)$/);
+    expect(you[3]).not.toContain('refills');
   });
 
   it('NEVER displays a percentage over 100% even on an over-cap account', () => {
@@ -330,13 +338,15 @@ describe('renderAuthSnapshotFormat2', () => {
     ];
     const rows = tableRows(renderAuthSnapshotFormat2(overSnaps, { now: NOW, tz: 'UTC' }));
     expect(rows[0][2]).toBe('100%'); // 5h
-    expect(rows[0][3]).toBe('100%'); // 7d
-    // And the blocked state still surfaces via the emoji (🔴) + Status.
+    expect(rows[0][4]).toBe('100%'); // 7d
+    // And the blocked state still surfaces via the emoji (🔴). No resets known
+    // (fixture has no reset timestamps) → both reset cells degrade to "—".
     expect(rows[0][0]).toBe('🔴');
-    expect(rows[0][4]).toMatch(/^back/);
+    expect(rows[0][3]).toBe('—'); // 5h resets
+    expect(rows[0][5]).toBe('—'); // 7d resets
   });
 
-  it('renders dates in the Status column only when NOT today (user tz)', () => {
+  it('renders dates in the reset columns only when NOT today (user tz)', () => {
     // now = Fri 3:00 PM Melbourne. A reset later the SAME Melbourne day shows
     // time-only; a reset on the next day shows the weekday.
     const MEL = 'Australia/Melbourne';
@@ -349,8 +359,9 @@ describe('renderAuthSnapshotFormat2', () => {
       }) }),
     ];
     const todayRows = tableRows(renderAuthSnapshotFormat2(sameDay, { now: NOW_MEL, tz: MEL }));
-    expect(todayRows[0][4]).toContain('9:00 PM');
-    expect(todayRows[0][4]).not.toMatch(/Mon|Tue|Wed|Thu|Fri|Sat|Sun/);
+    // 5h resets cell [3] — same Melbourne day → time only.
+    expect(todayRows[0][3]).toContain('9:00 PM');
+    expect(todayRows[0][3]).not.toMatch(/Mon|Tue|Wed|Thu|Fri|Sat|Sun/);
 
     const nextDay = [
       snap({ label: 'tomorrow@example.com', isActive: true, quota: quota({
@@ -360,7 +371,8 @@ describe('renderAuthSnapshotFormat2', () => {
       }) }),
     ];
     const tomorrowRows = tableRows(renderAuthSnapshotFormat2(nextDay, { now: NOW_MEL, tz: MEL }));
-    expect(tomorrowRows[0][4]).toContain('Sat 1:00 AM');
+    // 5h resets cell [3] — next Melbourne day → weekday prefix.
+    expect(tomorrowRows[0][3]).toContain('Sat 1:00 AM');
   });
 
   it('emits a recommendation footer that names a healthy alternative when active is throttling', () => {
@@ -1120,14 +1132,16 @@ describe('#2494 — renderAuthSnapshotFormat2 row rendering (out_of_credits demo
     expect(allText).toContain('Switch fleet → carol@example.com');
   });
 
-  it('quota-exhausted row shows a 🔴 + "back <when>" Status, not "billing disabled"', () => {
+  it('quota-exhausted row shows a 🔴 + its 5h reset time in the reset cell, not "billing disabled"', () => {
     const futureReset = new Date(NOW.getTime() + 45 * 60_000);
     const out = renderAuthSnapshotFormat2(
       [snap({ label: 'ex@x', isActive: true, quota: quota({ fiveHourUtilizationPct: 100, fiveHourResetAt: futureReset }) })],
       { now: NOW },
     );
     expect(out).toContain('| 🔴 |');
-    expect(out).toMatch(/back .* \(in 45m\)/);
+    // The 5h reset (45m out) renders in its own reset cell — no "back" prefix.
+    expect(out).toMatch(/\(in 45m\)/);
+    expect(out).not.toContain('back ');
     expect(out).not.toContain('billing disabled');
     expect(out).not.toContain('overage off');
   });

package/telegram-plugin/tests/claude-code-event-contract.test.ts

@@ -137,6 +137,54 @@ describe('Claude Code event-stream contract (canary)', () => {
     ).toBe(false)
   })
 
+  it('CANARY (Fix 3 precondition): Task tool_use still projects {id, name, input} — the shape the foreground-sub-agent-tracking / post-answer-liveness-freeze fix keys "still dispatched" off of', () => {
+    // The Fix 3 gap-closer (turn-liveness-floor.ts `stillDispatched`) is only
+    // as good as `turn.foregroundSubAgents` staying populated for the
+    // lifetime of a real Task dispatch. That population is driven by THIS
+    // exact tool_use projection (toolName === 'Task') plus the matching
+    // tool_result closing it out — if a future Claude Code release renames
+    // `name`/`input`/`id` or nests them differently, the fix silently goes
+    // inert (stillDispatched always false, freeze regresses) rather than
+    // failing loudly. Pin the shape here so drift fails CI instead.
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        id: 'msg_task',
+        stop_reason: 'tool_use',
+        content: [
+          {
+            type: 'tool_use',
+            id: 'toolu_task_1',
+            name: 'Task',
+            input: { description: 'Investigate the freeze bug', subagent_type: 'worker' },
+          },
+        ],
+      },
+    })
+    const evs = projectTranscriptLine(line)
+    expect(evs).toEqual([
+      {
+        kind: 'tool_use',
+        toolName: 'Task',
+        toolUseId: 'toolu_task_1',
+        input: { description: 'Investigate the freeze bug', subagent_type: 'worker' },
+      },
+    ])
+    // The matching tool_result (Task returning) must still carry tool_use_id
+    // so the gateway can close out the foreground-sub-agent tracking entry.
+    const resultLine = JSON.stringify({
+      type: 'user',
+      message: { content: [{ type: 'tool_result', tool_use_id: 'toolu_task_1', is_error: false, content: 'done' }] },
+    })
+    const resultEvs = projectTranscriptLine(resultLine)
+    expect(resultEvs).toHaveLength(1)
+    // `is_error: false` projects to `isError: undefined` (only `true` is
+    // ever stamped — see session-tail.ts's `c.is_error === true ? true :
+    // undefined`), so assert the falsy/absent form, not a literal `false`.
+    expect(resultEvs[0]).toMatchObject({ kind: 'tool_result', toolUseId: 'toolu_task_1' })
+    expect((resultEvs[0] as { isError?: boolean }).isError).toBeFalsy()
+  })
+
   it('sub-agent kickoff: first user message string prompt fires sub_agent_started', () => {
     const st = { hasEmittedStart: false }
     const line = JSON.stringify({

package/telegram-plugin/tests/feed-heartbeat-liveness-open.test.ts

@@ -153,6 +153,17 @@ describe('H-2: feedHeartbeatTick post-answer background-agent liveness (Fix 2 /
     expect(postAnswerBlock).toMatch(/livenessVerdict\s*!==\s*'emit'/)
   })
 
+  it('Fix 3: post-answer branch feeds stillDispatched from turn.foregroundSubAgents so a tracked foreground sub-agent bypasses the staleness cap', () => {
+    const body = feedHeartbeatTickSrc()
+    const afterPostAnswer = body.split('if (turn.finalAnswerDelivered)')[1] ?? ''
+    const postAnswerBlock = afterPostAnswer.split('\n  }\n')[0] ?? ''
+    // A positive foreground-tracking signal must be computed and threaded
+    // into the pure decision — this is what stops the card freezing mid-
+    // delegation while a foreground Task/Agent is still outstanding.
+    expect(postAnswerBlock).toMatch(/stillDispatched\s*=\s*turn\.foregroundSubAgents\.size\s*>\s*0/)
+    expect(postAnswerBlock).toMatch(/stillDispatched,/)
+  })
+
   it('staleness cap (concern 3) is parsed default-ON (30s) from SWITCHROOM_POST_ANSWER_LIVENESS_STALE_MS', () => {
     // The cap const must default to 30_000 when the env is unset (the `|| 30_000`
     // fallback over the positive-or-0 parse) so the post-answer card stops

package/telegram-plugin/tests/feed-survival.test.ts

@@ -47,6 +47,8 @@ import { ToolFlightTracker } from '../gateway/interrupt-defer.js'
 import {
   ORPHANED_REPLY_TIMEOUT_MS,
   ORPHANED_REPLY_MAX_REARMS,
+  ORPHANED_REPLY_STREAM_WINDOW_MS,
+  LivenessTracker,
 } from '../context-exhaustion.js'
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -524,3 +526,40 @@ describe('silence-poke — hard ceiling bounds the defer', () => {
     expect(__getStateForTests('chat:0')!.fallbackFired).toBe(true)
   })
 })
+
+// ─── Thinking-pause liveness via the REAL LivenessTracker (orphaned-reply fix) ─
+
+describe('silence-poke — thinking-pause liveness via the real LivenessTracker', () => {
+  // Drives the REAL LivenessTracker as the isLegitimatelyWorking source: a
+  // genuine stream event within ORPHANED_REPLY_STREAM_WINDOW_MS keeps the feed
+  // alive (a model reasoning pause is survivable); a gap longer than the window
+  // with no work tears the feed down.
+  it('a stream event within the window keeps the feed alive (thinking-pause survivable)', () => {
+    let clockNow = 0
+    const tracker = new LivenessTracker(0)
+    const f = setupSilenceDeps({
+      thresholds: { fallback: 300_000, fallbackHardCeiling: 900_000 },
+      isLegitimatelyWorking: () => tracker.recentlyStreaming(clockNow, ORPHANED_REPLY_STREAM_WINDOW_MS),
+    })
+    startTurn('chat:0', 0)
+    // A genuine stream event lands mid-turn (e.g. the model resumes after a
+    // reasoning pause) — only 50s before the 300s fallback tick.
+    tracker.onStreamEvent('text', undefined, 250_000)
+    clockNow = 300_000
+    __tickForTests(300_000) // 50s since last stream < 120s window → deferred
+    expect(f.fallbacks).toHaveLength(0)
+  })
+
+  it('no stream event for longer than the window tears the feed down', () => {
+    let clockNow = 0
+    const tracker = new LivenessTracker(0) // seed at t=0, nothing after
+    const f = setupSilenceDeps({
+      thresholds: { fallback: 300_000, fallbackHardCeiling: 900_000 },
+      isLegitimatelyWorking: () => tracker.recentlyStreaming(clockNow, ORPHANED_REPLY_STREAM_WINDOW_MS),
+    })
+    startTurn('chat:0', 0)
+    clockNow = 300_000
+    __tickForTests(300_000) // 300s since last stream >> 120s window → fires
+    expect(f.fallbacks).toHaveLength(1)
+  })
+})

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Structural pins for the session-only model relaunch wiring in gateway.ts.
+ *
+ * The behaviour lives in un-exported inline closures (buildModelDeps's
+ * scheduleModelRelaunch, the model-menu callback sr-* branch, and the boot
+ * re-hydration / alert-sentinel block inside the startup IIFE), so — mirroring
+ * the other gateway-*.test.ts source-pins — we assert on the source structure.
+ * The end-to-end behaviour of the carrier itself is exercised in
+ * tests/scaffold.session-model-override.test.ts (rendered start.sh) and the
+ * handler contract in telegram-plugin/tests/model-command.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+describe('gateway: scheduleModelRelaunch dep', () => {
+  it('writes the carrier with exact "<model>\\n" bytes', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toMatch(/writeFileSync\(\s*join\(agentDir, '\.session-model-override'\),\s*`\$\{model\}\\n`/)
+  })
+
+  it('sets the in-memory activeSessionModelOverride before dispatching the restart', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const setIdx = win.indexOf('activeSessionModelOverride = model')
+    const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
+    expect(setIdx).toBeGreaterThan(0)
+    expect(restartIdx).toBeGreaterThan(setIdx)
+  })
+
+  it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toContain('await deps.scheduleRestart(reason)')
+  })
+})
+
+describe('gateway: model-menu sr-* target relaunches via the carrier', () => {
+  it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
+    const idx = GATEWAY_SRC.indexOf('if (data.startsWith(MODEL_CALLBACK_SR))')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1400)
+    expect(win).toContain('modelDeps.scheduleModelRelaunch(srName')
+    // It must return before falling through to handleModelMenuCallback (which
+    // would inject an sr-* id claude's picker rejects).
+    expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
+  })
+})
+
+describe('gateway boot: session-model re-hydration + LiteLLM-down alert', () => {
+  it('re-hydrates activeSessionModelOverride from .active-session-model', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx - 200, idx + 1400)
+    // Only an override when the launched model differs from the configured one.
+    expect(win).toMatch(/launched\.length > 0 && launched !== configured \? launched : null/)
+    // The configured value must be resolved through resolveMainModel (the SAME
+    // resolver start.sh's scaffold uses) so an unset/`default` model config does
+    // not get flagged as a phantom session override on an ordinary restart.
+    expect(win).toContain('resolveMainModel(raw ?? undefined)')
+  })
+
+  it('consumes the .session-model-alert sentinel, notifies ALL operators, and deletes it', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.session-model-alert')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1100)
+    expect(win).toContain('unlinkSync(alertPath)')
+    // Broadcasts to every operator in allowFrom, not just allowFrom[0].
+    expect(win).toContain('const operators = loadAccess().allowFrom')
+    expect(win).toContain('for (const operator of operators)')
+    expect(win).toContain('lockedBot.api')
+    expect(win).toContain('.sendMessage(operator')
+  })
+})

package/telegram-plugin/tests/inbound-emit-after-intercepts.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Structural pin: the delivery state machine's `inbound` event MUST be
+ * emitted from `handleInbound` only AFTER the intercept/early-return
+ * gauntlet — never eagerly at handler entry.
+ *
+ * The wedge this guards (overlord `/usage` went dead, 2026-07-08). The
+ * inbound emit drives the now-AUTHORITATIVE turn-in-flight gate
+ * (turnInFlightForGate → isMachineInTurn). When it fired at handler entry
+ * — before the permission-reply / `/auth` paste-back / interrupt-empty /
+ * secret-detect-drop intercepts — an intercepted message (e.g. an approval
+ * reply) drove the machine idle→`bridge_alive_in_turn`, then early-returned
+ * as an intercept: no delivery, no claudeBusyKeys mark, and critically no
+ * `turnEnd`. The machine held the gate closed until the 5-min TTL tick
+ * force-cleared it, buffering every inbound (including `/usage`) meanwhile —
+ * the dangerous `machine_over_holds` divergence gate-parity-probe.ts flags.
+ *
+ * The behaviour lives inside the un-exported `handleInbound` closure, so —
+ * mirroring the other gateway-*.test.ts source-pins — we assert on source
+ * structure: the single inbound `shadowEmit` must sit below the intercepts
+ * and carry the real `isSteering` classification. Machine self-heal + gate
+ * accessors are behaviour-tested in inbound-delivery-cutover-gate.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+/** Byte offset of the sole `shadowEmit({ kind: 'inbound' ... })` call. */
+function inboundEmitOffset(): number {
+  const m = GATEWAY_SRC.match(/shadowEmit\(\{\s*\n\s*kind:\s*'inbound'/)
+  expect(m, 'expected exactly one multi-line inbound shadowEmit').not.toBeNull()
+  const idx = GATEWAY_SRC.indexOf(m![0])
+  // There must be only ONE such emit — a second eager site would reintroduce
+  // the wedge.
+  const second = GATEWAY_SRC.indexOf(m![0], idx + 1)
+  expect(second, 'a second inbound shadowEmit would reintroduce the eager-emit wedge').toBe(-1)
+  return idx
+}
+
+describe('gateway: inbound machine-emit is deferred past the intercepts', () => {
+  it('carries the DEFERRED_INBOUND_EMIT marker so the intent is greppable', () => {
+    expect(GATEWAY_SRC).toContain('DEFERRED_INBOUND_EMIT')
+  })
+
+  it('emits the machine `inbound` event AFTER the permission-reply intercept', () => {
+    const emitIdx = inboundEmitOffset()
+    // The permission-reply intercept is one of the early-return paths that
+    // must NOT drive the machine into a turn.
+    const permIdx = GATEWAY_SRC.indexOf('const permMatch = PERMISSION_REPLY_RE.exec(text)')
+    expect(permIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(permIdx)
+  })
+
+  it('emits AFTER the `/auth add` paste-back intercept', () => {
+    const emitIdx = inboundEmitOffset()
+    const authIdx = GATEWAY_SRC.indexOf('pendingAuthAddFlows.get(interceptKey)')
+    expect(authIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(authIdx)
+  })
+
+  it('emits AFTER isSteering is classified, and passes the real value (not a hardcoded false)', () => {
+    const emitIdx = inboundEmitOffset()
+    const steerIdx = GATEWAY_SRC.indexOf('isSteering = priorTurnInFlight && isSteerPrefix')
+    expect(steerIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(steerIdx)
+    // The emit's msg object must forward the live `isSteering` binding, so a
+    // mid-turn steer is not mis-modelled as a fresh turn.
+    const win = GATEWAY_SRC.slice(emitIdx, emitIdx + 260)
+    expect(win).toMatch(/msg:\s*\{[\s\S]*?\bisSteering,[\s\S]*?\}/)
+  })
+
+  it('emits BEFORE the deliver-or-buffer decision (reserveInboundDelivery)', () => {
+    const emitIdx = inboundEmitOffset()
+    const gateIdx = GATEWAY_SRC.indexOf('const deliveryGate = reserveInboundDelivery({')
+    expect(gateIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeLessThan(gateIdx)
+  })
+})

package/telegram-plugin/tests/liveness-tracker.test.ts

@@ -0,0 +1,228 @@
+/**
+ * liveness-tracker.test.ts — drives the REAL LivenessTracker (the testability
+ * seam of the orphaned-reply thinking-pause fix).
+ *
+ * Root cause being fixed: the orphaned-reply fuse (ORPHANED_REPLY_TIMEOUT_MS =
+ * 30 s) was reset ONLY by `tool_label` / `text` events. During a long model
+ * reasoning pause the gateway sees NO such events (thinking carries no text),
+ * so the fuse ran down and force-ended a genuinely-live turn mid-work.
+ *
+ * The fix stamps `lastStreamEventAt` on ANY genuine stream event; if a genuine
+ * event landed within `windowMs` (default 120 s) the turn is "recently
+ * streaming" and the fuse re-arms instead of firing. A genuine multi-minute
+ * hang (no events at all) still fires.
+ *
+ * These tests use the REAL class — no replica helpers.
+ *
+ * NOTE on onStreamEvent's signature: it is `(kind, durationMs, now)`. The
+ * tracker is time-only — it never reads text content (the "Prompt is too long"
+ * marker matters to the gateway's context-exhaustion detection, not to the
+ * tracker). Where the fix spec wrote `onStreamEvent('text','Prompt is too
+ * long',0)` we pass `undefined` as durationMs (it is not a turn_end).
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  LivenessTracker,
+  ORPHANED_REPLY_STREAM_WINDOW_MS,
+  ORPHANED_REPLY_TIMEOUT_MS,
+  ORPHANED_REPLY_MAX_REARMS,
+} from '../context-exhaustion.js'
+
+const W = ORPHANED_REPLY_STREAM_WINDOW_MS // 120_000
+const MAX = ORPHANED_REPLY_MAX_REARMS // 20
+const FUSE = ORPHANED_REPLY_TIMEOUT_MS // 30_000
+
+function expiry(
+  t: LivenessTracker,
+  now: number,
+  opts?: { working?: boolean; humanWaiting?: boolean },
+) {
+  return t.decideOnExpiry({
+    working: opts?.working ?? false,
+    humanWaiting: opts?.humanWaiting ?? false,
+    now,
+    windowMs: W,
+    maxRearms: MAX,
+  })
+}
+
+describe('LivenessTracker — pinned constants', () => {
+  it('window is 120 s and fuse tick is 30 s', () => {
+    expect(W).toBe(120_000)
+    expect(FUSE).toBe(30_000)
+    expect(MAX).toBe(20)
+  })
+})
+
+describe('T1 — thinking-pause survival', () => {
+  it('text→tool_use→tool_result then a 45s stream gap keeps re-arming (gap < window)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('text', undefined, 0)
+    t.onStreamEvent('tool_use', undefined, 1_000)
+    t.onStreamEvent('tool_result', undefined, 2_000)
+
+    // +30s past the last event (t=32s): recently streaming → re-arm.
+    const d1 = expiry(t, 32_000)
+    expect(d1).toEqual({ rearm: true, countsAgainstCap: true })
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    // +45s past the last event (t=47s): still within the 120s window → re-arm.
+    const d2 = expiry(t, 47_000)
+    expect(d2).toEqual({ rearm: true, countsAgainstCap: true })
+    expect(t.orphanedReplyRearmCount).toBe(2)
+  })
+
+  it('the next genuine stream event ZEROES the rearm counter and re-stamps liveness', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('tool_result', undefined, 2_000)
+    expiry(t, 32_000)
+    expiry(t, 47_000)
+    expect(t.orphanedReplyRearmCount).toBe(2)
+
+    t.onStreamEvent('tool_label', undefined, 48_000)
+    expect(t.orphanedReplyRearmCount).toBe(0)
+    expect(t.lastStreamEventAt).toBe(48_000)
+  })
+
+  it('a synthetic turn_end (durationMs === -1) does NOT stamp or reset (F4 boundary)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('tool_label', undefined, 48_000)
+    expiry(t, 60_000) // counter → 1
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    t.onStreamEvent('turn_end', -1, 70_000)
+    expect(t.lastStreamEventAt).toBe(48_000) // unchanged — synthetic excluded
+    expect(t.orphanedReplyRearmCount).toBe(1) // not reset
+
+    // A REAL turn_end (durationMs >= 0) DOES stamp — harmless, the turn is
+    // ending anyway (spec #3).
+    t.onStreamEvent('turn_end', 0, 71_000)
+    expect(t.lastStreamEventAt).toBe(71_000)
+    expect(t.orphanedReplyRearmCount).toBe(0)
+  })
+})
+
+describe('T2 — production repro (48s tool_result, 78s expiry)', () => {
+  it('text@0, tool_use@1s, tool_result@48s → expiry@78s re-arms (78-48=30 < 120)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('text', undefined, 0)
+    t.onStreamEvent('tool_use', undefined, 1_000)
+    t.onStreamEvent('tool_result', undefined, 48_000)
+
+    const d = expiry(t, 78_000)
+    expect(d.rearm).toBe(true)
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    // tool_label@80s zeroes the counter (progress observed).
+    t.onStreamEvent('tool_label', undefined, 80_000)
+    expect(t.orphanedReplyRearmCount).toBe(0)
+  })
+})
+
+describe('T3 — long active turn (A2: counter reset is load-bearing)', () => {
+  it('tool_label every 60s + expiry every 60s+30s NEVER fires across 15 min; counter never exceeds 1', () => {
+    const t = new LivenessTracker(0)
+    for (let k = 0; k < 15; k++) {
+      t.onStreamEvent('tool_label', undefined, k * 60_000) // progress → reset
+      const d = expiry(t, k * 60_000 + 30_000, { working: true })
+      expect(d.rearm).toBe(true) // never fires
+      expect(t.orphanedReplyRearmCount).toBeLessThanOrEqual(1)
+    }
+  })
+
+  it('WITHOUT the progress reset the SAME cadence hits cap=20 near t=600s (proves reset load-bearing)', () => {
+    const t = new LivenessTracker(0)
+    let firedAt = -1
+    for (let k = 1; k <= 25; k++) {
+      const now = k * 30_000
+      // working:true so it would re-arm indefinitely IF the counter didn't
+      // accumulate — but with no onStreamEvent reset it climbs to the cap.
+      const d = expiry(t, now, { working: true })
+      if (!d.rearm) {
+        firedAt = now
+        break
+      }
+    }
+    // 20th re-arm lands at t=600s; the 21st expiry (t=630s) fires at the cap.
+    expect(t.orphanedReplyRearmCount).toBe(MAX)
+    expect(firedAt).toBeGreaterThanOrEqual(600_000)
+  })
+})
+
+describe('T4 — genuine hang caught (no events at all)', () => {
+  it('tool_result@0 then silence: re-arms via recentlyStreaming @30/60/90s, FIRES @120s (window lapsed)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('tool_result', undefined, 0)
+
+    for (const now of [30_000, 60_000, 90_000]) {
+      const d = expiry(t, now) // working:false — kept alive only by recentlyStreaming
+      expect(d.rearm).toBe(true)
+    }
+
+    // t=120s: now - lastStreamEventAt = 120_000 >= window → not recently
+    // streaming, working false → fail-safe FIRE.
+    const d = expiry(t, 120_000)
+    expect(d).toEqual({ rearm: false, countsAgainstCap: false })
+  })
+})
+
+describe('T5 — context-exhaustion recovery COMPLETES (not suppressed forever)', () => {
+  it('a "Prompt is too long" text event stamps liveness; defensive-guard predicate is true@30s, false@>=120s', () => {
+    const t = new LivenessTracker(0)
+    // The marker is a genuine `text` event (content is not a tracker concern).
+    t.onStreamEvent('text', undefined, 0)
+
+    // Context exhaustion means no tool is in flight: working === false. The
+    // defensive-guard suppression predicate is `working || recentlyStreaming`.
+    const working = false
+
+    // @30s: recentlyStreaming true → synthetic turn_end is suppressed. This
+    // DOCUMENTS the accepted ~30s→~120s recovery-latency growth (F3).
+    expect(working || t.recentlyStreaming(30_000, W)).toBe(true)
+
+    // @120s: window lapsed → NOT suppressed → teardown COMPLETES.
+    expect(working || t.recentlyStreaming(120_000, W)).toBe(false)
+
+    // @150s: still not suppressed — recovery is delayed, never forever.
+    expect(working || t.recentlyStreaming(150_000, W)).toBe(false)
+  })
+})
+
+describe('T7 — cap semantics', () => {
+  it('interleaved expiry/genuine-event: count 1 → 0 → 1 → 2', () => {
+    const t = new LivenessTracker(0)
+
+    expect(expiry(t, 10_000).rearm).toBe(true)
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    t.onStreamEvent('tool_label', undefined, 11_000) // genuine event resets
+    expect(t.orphanedReplyRearmCount).toBe(0)
+
+    expiry(t, 20_000)
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    expiry(t, 30_000) // consecutive silence (last event 11_000, gap 19s < 120s)
+    expect(t.orphanedReplyRearmCount).toBe(2)
+  })
+
+  it('21 consecutive recently-streaming expiries (no reset): 21st fires at the cap', () => {
+    const t = new LivenessTracker(0)
+    let last: { rearm: boolean; countsAgainstCap: boolean } | undefined
+    for (let k = 1; k <= 21; k++) {
+      // now = k*1000 keeps the gap from the seed (0) under the 120s window,
+      // so recentlyStreaming stays true throughout — the ONLY bound is the cap.
+      last = expiry(t, k * 1_000)
+    }
+    expect(last).toEqual({ rearm: false, countsAgainstCap: true })
+    expect(t.orphanedReplyRearmCount).toBe(MAX)
+
+    // humanWaiting past the cap → uncapped re-arm.
+    const dHuman = expiry(t, 22_000, { humanWaiting: true })
+    expect(dHuman).toEqual({ rearm: true, countsAgainstCap: false })
+
+    // recentlyStreaming false + working false + humanWaiting false → fail-safe FIRE.
+    const dFire = expiry(t, 200_000)
+    expect(dFire).toEqual({ rearm: false, countsAgainstCap: false })
+  })
+})