switchroom 0.17.10 → 0.18.6

package/telegram-plugin/tests/activity-card-store.test.ts

@@ -35,6 +35,7 @@ import {
   writeActivityCardRecord,
   clearActivityCardRecord,
   runActivityCardBootReaper,
+  runActivityCardMidSessionReaper,
   restartOrphanCardFinalizeText,
   type ActivityCardRecord,
   type ActivityCardStoreFsSeam,
@@ -434,3 +435,96 @@ describe('restartOrphanCardFinalizeText', () => {
     expect(text).not.toContain('was running')
   })
 })
+
+describe('runActivityCardMidSessionReaper (#2918 mid-session sweep)', () => {
+  const NOW = 2_000_000_000_000
+  const TTL = 15 * 60_000
+
+  it('finalizes + unpins an ownerless stale card, and deletes its record', async () => {
+    const dead = card({ turnKey: 'c:dead', activityMessageId: 715, startedAt: NOW - 30 * 60_000 })
+    const { fs, files } = memFs()
+    writeActivityCardRecord(PATH, fs, dead)
+    const finalized: number[] = []
+    const unpinned: number[] = []
+    const res = await runActivityCardMidSessionReaper({
+      path: PATH, fs,
+      isLive: () => false, // process gone, no live owner
+      ttlMs: TTL, now: NOW,
+      finalizeCard: async (r) => { finalized.push(r.activityMessageId); return { message_id: r.activityMessageId } },
+      unpinCard: async (r) => { unpinned.push(r.activityMessageId); return true },
+    })
+    expect(res).toEqual({ finalized: 1, vanished: 0, unpinned: 1, total: 1 })
+    expect(finalized).toEqual([715])
+    expect(unpinned).toEqual([715])
+    // Record deleted BEFORE the edit (at-most-once idempotency guard).
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+    void files
+  })
+
+  it('NEVER touches a live card (isLive true) — spinner keeps spinning', async () => {
+    const live = card({ turnKey: 'c:live', activityMessageId: 900, startedAt: NOW - 6 * 60 * 60_000 })
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, live)
+    let edits = 0
+    const res = await runActivityCardMidSessionReaper({
+      path: PATH, fs,
+      isLive: (r) => r.turnKey === 'c:live',
+      ttlMs: TTL, now: NOW,
+      finalizeCard: async () => { edits++; return {} },
+      unpinCard: async () => true,
+    })
+    expect(res.total).toBe(0)
+    expect(edits).toBe(0)
+    // Live record untouched on disk.
+    expect(loadActivityCards(PATH, fs)).toHaveLength(1)
+  })
+
+  it('does not reap an ownerless card younger than the TTL (race guard)', async () => {
+    const fresh = card({ turnKey: 'c:fresh', startedAt: NOW - 60_000 })
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, fresh)
+    let edits = 0
+    const res = await runActivityCardMidSessionReaper({
+      path: PATH, fs,
+      isLive: () => false,
+      ttlMs: TTL, now: NOW,
+      finalizeCard: async () => { edits++; return {} },
+      unpinCard: async () => true,
+    })
+    expect(res.total).toBe(0)
+    expect(edits).toBe(0)
+    expect(loadActivityCards(PATH, fs)).toHaveLength(1)
+  })
+
+  it('reaps the dead card while sparing a concurrently-live one', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:dead', activityMessageId: 1, startedAt: NOW - 30 * 60_000 }))
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:live', activityMessageId: 2, startedAt: NOW - 30 * 60_000 }))
+    const finalized: number[] = []
+    const res = await runActivityCardMidSessionReaper({
+      path: PATH, fs,
+      isLive: (r) => r.turnKey === 'c:live',
+      ttlMs: TTL, now: NOW,
+      finalizeCard: async (r) => { finalized.push(r.activityMessageId); return {} },
+      unpinCard: async () => true,
+    })
+    expect(res.total).toBe(1)
+    expect(finalized).toEqual([1])
+    const remaining = loadActivityCards(PATH, fs)
+    expect(remaining).toHaveLength(1)
+    expect(remaining[0]!.turnKey).toBe('c:live')
+  })
+
+  it('counts a benign-400 (vanished) card as vanished, not finalized', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:gone', pinned: false, startedAt: NOW - 30 * 60_000 }))
+    const res = await runActivityCardMidSessionReaper({
+      path: PATH, fs,
+      isLive: () => false,
+      ttlMs: TTL, now: NOW,
+      finalizeCard: async () => undefined, // robustApiCall swallowed a benign 400
+      unpinCard: async () => true,
+    })
+    expect(res).toEqual({ finalized: 0, vanished: 1, unpinned: 0, total: 1 })
+  })
+})

package/telegram-plugin/tests/auth-command-format2.test.ts

@@ -94,7 +94,7 @@ describe('renderShowText — Format 2 vs legacy', () => {
     expect(out).toContain('🔋 **Auth — fleet status**');
     expect(out).toContain('Recommendation:');
     // GFM table card (#2700): State emoji per row, not group headers.
-    expect(out).toContain('| State | Account | 5h | 7d | Status |');
+    expect(out).toContain('| State | Account | 5h | 5h resets | 7d | 7d resets |');
     expect(out).toContain('| 🔴 |'); // the blocked account's State cell
     expect(out).toContain('| 🟢 |'); // a healthy account's State cell
     expect(out).not.toContain('**BLOCKED**');

package/telegram-plugin/tests/auth-snapshot-format.test.ts

@@ -262,11 +262,13 @@ describe('renderAuthSnapshotFormat2', () => {
     return rows;
   }
 
-  it('renders a GFM table with the State/Account/5h/7d/Status header', () => {
+  it('renders a GFM table with the State/Account/5h/5h resets/7d/7d resets header', () => {
     const out = renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' });
     expect(out).toContain('🔋 **Auth — fleet status**');
-    expect(out).toContain('| State | Account | 5h | 7d | Status |');
-    expect(out).toContain('| --- | --- | --- | --- | --- |');
+    expect(out).toContain('| State | Account | 5h | 5h resets | 7d | 7d resets |');
+    expect(out).toContain('| --- | --- | --- | --- | --- | --- |');
+    // The single collapsed Status column is gone.
+    expect(out).not.toContain('| 7d | Status |');
     // No legacy group headers / health-section titles remain.
     expect(out).not.toContain('**BLOCKED**');
     expect(out).not.toContain('**HEALTHY**');
@@ -307,16 +309,22 @@ describe('renderAuthSnapshotFormat2', () => {
     expect(bob).toBeLessThan(alice);
   });
 
-  it('Status column shows "back <when>" for a blocked account', () => {
+  it('reset columns show a "<time> (in ...)" cell for a blocked account (7d binding window)', () => {
     const rows = tableRows(renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' }));
     const bob = rows.find((r) => r[1].includes('bob@example.com'))!;
-    expect(bob[4]).toMatch(/^back .* \(in .+\)$/);
+    // bob is 7d-maxed; its 7d reset (2026-05-17T10:00Z) is ~2 days out and still
+    // renders in its own reset cell — no "back" prefix in the new per-window shape.
+    expect(bob[5]).toMatch(/^.* \(in .+\)$/);
+    expect(bob[5]).not.toContain('back');
   });
 
-  it('Status column shows "refills <when>" for a healthy account', () => {
+  it('reset columns show a "<time> (in ...)" cell for each window of a healthy account', () => {
     const rows = tableRows(renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' }));
     const you = rows.find((r) => r[1].includes('you@example.com'))!;
-    expect(you[4]).toMatch(/^refills .* \(in .+\)$/);
+    // 5h resets cell [3] and 7d resets cell [5] both carry a relative hint.
+    expect(you[3]).toMatch(/^.* \(in .+\)$/);
+    expect(you[5]).toMatch(/^.* \(in .+\)$/);
+    expect(you[3]).not.toContain('refills');
   });
 
   it('NEVER displays a percentage over 100% even on an over-cap account', () => {
@@ -330,13 +338,15 @@ describe('renderAuthSnapshotFormat2', () => {
     ];
     const rows = tableRows(renderAuthSnapshotFormat2(overSnaps, { now: NOW, tz: 'UTC' }));
     expect(rows[0][2]).toBe('100%'); // 5h
-    expect(rows[0][3]).toBe('100%'); // 7d
-    // And the blocked state still surfaces via the emoji (🔴) + Status.
+    expect(rows[0][4]).toBe('100%'); // 7d
+    // And the blocked state still surfaces via the emoji (🔴). No resets known
+    // (fixture has no reset timestamps) → both reset cells degrade to "—".
     expect(rows[0][0]).toBe('🔴');
-    expect(rows[0][4]).toMatch(/^back/);
+    expect(rows[0][3]).toBe('—'); // 5h resets
+    expect(rows[0][5]).toBe('—'); // 7d resets
   });
 
-  it('renders dates in the Status column only when NOT today (user tz)', () => {
+  it('renders dates in the reset columns only when NOT today (user tz)', () => {
     // now = Fri 3:00 PM Melbourne. A reset later the SAME Melbourne day shows
     // time-only; a reset on the next day shows the weekday.
     const MEL = 'Australia/Melbourne';
@@ -349,8 +359,9 @@ describe('renderAuthSnapshotFormat2', () => {
       }) }),
     ];
     const todayRows = tableRows(renderAuthSnapshotFormat2(sameDay, { now: NOW_MEL, tz: MEL }));
-    expect(todayRows[0][4]).toContain('9:00 PM');
-    expect(todayRows[0][4]).not.toMatch(/Mon|Tue|Wed|Thu|Fri|Sat|Sun/);
+    // 5h resets cell [3] — same Melbourne day → time only.
+    expect(todayRows[0][3]).toContain('9:00 PM');
+    expect(todayRows[0][3]).not.toMatch(/Mon|Tue|Wed|Thu|Fri|Sat|Sun/);
 
     const nextDay = [
       snap({ label: 'tomorrow@example.com', isActive: true, quota: quota({
@@ -360,7 +371,8 @@ describe('renderAuthSnapshotFormat2', () => {
       }) }),
     ];
     const tomorrowRows = tableRows(renderAuthSnapshotFormat2(nextDay, { now: NOW_MEL, tz: MEL }));
-    expect(tomorrowRows[0][4]).toContain('Sat 1:00 AM');
+    // 5h resets cell [3] — next Melbourne day → weekday prefix.
+    expect(tomorrowRows[0][3]).toContain('Sat 1:00 AM');
   });
 
   it('emits a recommendation footer that names a healthy alternative when active is throttling', () => {
@@ -419,6 +431,27 @@ describe('renderAuthSnapshotFormat2', () => {
     expect(out).not.toContain('Live · refreshed');
   });
 
+  it('#2959 honesty fix — probeFailed renders an explicit marker instead of a false bare "Live" footer', () => {
+    // Total probe failure: no rows, no cache. The footer must not claim
+    // "Live" next to no-data rows. Pre-fix this rendered a bare `_Live_`.
+    const out = renderAuthSnapshotFormat2(fixtureSnaps.slice(0, 1), {
+      now: NOW,
+      probeFailed: true,
+    });
+    expect(out).toContain('_⚠ probe failed — no live data_');
+    expect(out).not.toContain('_Live_');
+  });
+
+  it('#2959 honesty fix — staleCachedAtMs (real cached data) takes precedence over probeFailed', () => {
+    const out = renderAuthSnapshotFormat2(fixtureSnaps.slice(0, 1), {
+      now: NOW,
+      staleCachedAtMs: NOW.getTime() - 2 * 60_000,
+      probeFailed: true,
+    });
+    expect(out).toContain('⚠ cached 2m ago');
+    expect(out).not.toContain('probe failed');
+  });
+
   // ── demo mode (the `/usage demo` / `/auth demo` suffix) ──────────────
   describe('demo mode masks email labels', () => {
     it('WITHOUT demo, the real account emails still render', () => {
@@ -1120,14 +1153,16 @@ describe('#2494 — renderAuthSnapshotFormat2 row rendering (out_of_credits demo
     expect(allText).toContain('Switch fleet → carol@example.com');
   });
 
-  it('quota-exhausted row shows a 🔴 + "back <when>" Status, not "billing disabled"', () => {
+  it('quota-exhausted row shows a 🔴 + its 5h reset time in the reset cell, not "billing disabled"', () => {
     const futureReset = new Date(NOW.getTime() + 45 * 60_000);
     const out = renderAuthSnapshotFormat2(
       [snap({ label: 'ex@x', isActive: true, quota: quota({ fiveHourUtilizationPct: 100, fiveHourResetAt: futureReset }) })],
       { now: NOW },
     );
     expect(out).toContain('| 🔴 |');
-    expect(out).toMatch(/back .* \(in 45m\)/);
+    // The 5h reset (45m out) renders in its own reset cell — no "back" prefix.
+    expect(out).toMatch(/\(in 45m\)/);
+    expect(out).not.toContain('back ');
     expect(out).not.toContain('billing disabled');
     expect(out).not.toContain('overage off');
   });

package/telegram-plugin/tests/claude-code-event-contract.test.ts

@@ -137,6 +137,54 @@ describe('Claude Code event-stream contract (canary)', () => {
     ).toBe(false)
   })
 
+  it('CANARY (Fix 3 precondition): Task tool_use still projects {id, name, input} — the shape the foreground-sub-agent-tracking / post-answer-liveness-freeze fix keys "still dispatched" off of', () => {
+    // The Fix 3 gap-closer (turn-liveness-floor.ts `stillDispatched`) is only
+    // as good as `turn.foregroundSubAgents` staying populated for the
+    // lifetime of a real Task dispatch. That population is driven by THIS
+    // exact tool_use projection (toolName === 'Task') plus the matching
+    // tool_result closing it out — if a future Claude Code release renames
+    // `name`/`input`/`id` or nests them differently, the fix silently goes
+    // inert (stillDispatched always false, freeze regresses) rather than
+    // failing loudly. Pin the shape here so drift fails CI instead.
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        id: 'msg_task',
+        stop_reason: 'tool_use',
+        content: [
+          {
+            type: 'tool_use',
+            id: 'toolu_task_1',
+            name: 'Task',
+            input: { description: 'Investigate the freeze bug', subagent_type: 'worker' },
+          },
+        ],
+      },
+    })
+    const evs = projectTranscriptLine(line)
+    expect(evs).toEqual([
+      {
+        kind: 'tool_use',
+        toolName: 'Task',
+        toolUseId: 'toolu_task_1',
+        input: { description: 'Investigate the freeze bug', subagent_type: 'worker' },
+      },
+    ])
+    // The matching tool_result (Task returning) must still carry tool_use_id
+    // so the gateway can close out the foreground-sub-agent tracking entry.
+    const resultLine = JSON.stringify({
+      type: 'user',
+      message: { content: [{ type: 'tool_result', tool_use_id: 'toolu_task_1', is_error: false, content: 'done' }] },
+    })
+    const resultEvs = projectTranscriptLine(resultLine)
+    expect(resultEvs).toHaveLength(1)
+    // `is_error: false` projects to `isError: undefined` (only `true` is
+    // ever stamped — see session-tail.ts's `c.is_error === true ? true :
+    // undefined`), so assert the falsy/absent form, not a literal `false`.
+    expect(resultEvs[0]).toMatchObject({ kind: 'tool_result', toolUseId: 'toolu_task_1' })
+    expect((resultEvs[0] as { isError?: boolean }).isError).toBeFalsy()
+  })
+
   it('sub-agent kickoff: first user message string prompt fires sub_agent_started', () => {
     const st = { hasEmittedStart: false }
     const line = JSON.stringify({

package/telegram-plugin/tests/feed-heartbeat-liveness-open.test.ts

@@ -153,6 +153,17 @@ describe('H-2: feedHeartbeatTick post-answer background-agent liveness (Fix 2 /
     expect(postAnswerBlock).toMatch(/livenessVerdict\s*!==\s*'emit'/)
   })
 
+  it('Fix 3: post-answer branch feeds stillDispatched from turn.foregroundSubAgents so a tracked foreground sub-agent bypasses the staleness cap', () => {
+    const body = feedHeartbeatTickSrc()
+    const afterPostAnswer = body.split('if (turn.finalAnswerDelivered)')[1] ?? ''
+    const postAnswerBlock = afterPostAnswer.split('\n  }\n')[0] ?? ''
+    // A positive foreground-tracking signal must be computed and threaded
+    // into the pure decision — this is what stops the card freezing mid-
+    // delegation while a foreground Task/Agent is still outstanding.
+    expect(postAnswerBlock).toMatch(/stillDispatched\s*=\s*turn\.foregroundSubAgents\.size\s*>\s*0/)
+    expect(postAnswerBlock).toMatch(/stillDispatched,/)
+  })
+
   it('staleness cap (concern 3) is parsed default-ON (30s) from SWITCHROOM_POST_ANSWER_LIVENESS_STALE_MS', () => {
     // The cap const must default to 30_000 when the env is unset (the `|| 30_000`
     // fallback over the positive-or-0 parse) so the post-answer card stops

package/telegram-plugin/tests/feed-survival.test.ts

@@ -47,6 +47,8 @@ import { ToolFlightTracker } from '../gateway/interrupt-defer.js'
 import {
   ORPHANED_REPLY_TIMEOUT_MS,
   ORPHANED_REPLY_MAX_REARMS,
+  ORPHANED_REPLY_STREAM_WINDOW_MS,
+  LivenessTracker,
 } from '../context-exhaustion.js'
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -524,3 +526,40 @@ describe('silence-poke — hard ceiling bounds the defer', () => {
     expect(__getStateForTests('chat:0')!.fallbackFired).toBe(true)
   })
 })
+
+// ─── Thinking-pause liveness via the REAL LivenessTracker (orphaned-reply fix) ─
+
+describe('silence-poke — thinking-pause liveness via the real LivenessTracker', () => {
+  // Drives the REAL LivenessTracker as the isLegitimatelyWorking source: a
+  // genuine stream event within ORPHANED_REPLY_STREAM_WINDOW_MS keeps the feed
+  // alive (a model reasoning pause is survivable); a gap longer than the window
+  // with no work tears the feed down.
+  it('a stream event within the window keeps the feed alive (thinking-pause survivable)', () => {
+    let clockNow = 0
+    const tracker = new LivenessTracker(0)
+    const f = setupSilenceDeps({
+      thresholds: { fallback: 300_000, fallbackHardCeiling: 900_000 },
+      isLegitimatelyWorking: () => tracker.recentlyStreaming(clockNow, ORPHANED_REPLY_STREAM_WINDOW_MS),
+    })
+    startTurn('chat:0', 0)
+    // A genuine stream event lands mid-turn (e.g. the model resumes after a
+    // reasoning pause) — only 50s before the 300s fallback tick.
+    tracker.onStreamEvent('text', undefined, 250_000)
+    clockNow = 300_000
+    __tickForTests(300_000) // 50s since last stream < 120s window → deferred
+    expect(f.fallbacks).toHaveLength(0)
+  })
+
+  it('no stream event for longer than the window tears the feed down', () => {
+    let clockNow = 0
+    const tracker = new LivenessTracker(0) // seed at t=0, nothing after
+    const f = setupSilenceDeps({
+      thresholds: { fallback: 300_000, fallbackHardCeiling: 900_000 },
+      isLegitimatelyWorking: () => tracker.recentlyStreaming(clockNow, ORPHANED_REPLY_STREAM_WINDOW_MS),
+    })
+    startTurn('chat:0', 0)
+    clockNow = 300_000
+    __tickForTests(300_000) // 300s since last stream >> 120s window → fires
+    expect(f.fallbacks).toHaveLength(1)
+  })
+})

package/telegram-plugin/tests/gateway-boot-marker-clear.test.ts

@@ -43,7 +43,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // window to ~5KB so we don't pick up the unrelated
     // `removeTurnActiveMarker` call in the onTurnComplete handler
     // way down at the bottom of the file.
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 9000)
     const clearMatches = setupWindow.match(/removeTurnActiveMarker\s*\(\s*STATE_DIR\s*\)/g) ?? []
     expect(clearMatches.length).toBe(1)
   })
@@ -53,7 +53,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // must not prevent the gateway from coming up. Pin the try-wrapping
     // to make sure a future refactor doesn't drop it.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 9000)
     expect(setupWindow).toMatch(/try\s*\{\s*removeTurnActiveMarker\(STATE_DIR\)\s*\}\s*catch/)
   })
 
@@ -62,7 +62,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // Clearing the marker first means the watchdog sees a clean slate
     // immediately, even if pin sweep takes 30s+ to finish.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 9000)
     const clearIdx = setupWindow.indexOf('removeTurnActiveMarker(STATE_DIR)')
     const pinSweepIdx = setupWindow.indexOf('Boot-time pin sweep')
     expect(clearIdx).toBeGreaterThan(0)

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Structural pins for the session-only model relaunch wiring in gateway.ts.
+ *
+ * The behaviour lives in un-exported inline closures (buildModelDeps's
+ * scheduleModelRelaunch, the model-menu callback sr-* branch, and the boot
+ * re-hydration / alert-sentinel block inside the startup IIFE), so — mirroring
+ * the other gateway-*.test.ts source-pins — we assert on the source structure.
+ * The end-to-end behaviour of the carrier itself is exercised in
+ * tests/scaffold.session-model-override.test.ts (rendered start.sh) and the
+ * handler contract in telegram-plugin/tests/model-command.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+describe('gateway: scheduleModelRelaunch dep', () => {
+  it('writes the carrier with exact "<model>\\n" bytes', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toMatch(/writeFileSync\(\s*join\(agentDir, '\.session-model-override'\),\s*`\$\{model\}\\n`/)
+  })
+
+  it('sets the in-memory activeSessionModelOverride before dispatching the restart', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const setIdx = win.indexOf('activeSessionModelOverride = model')
+    const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
+    expect(setIdx).toBeGreaterThan(0)
+    expect(restartIdx).toBeGreaterThan(setIdx)
+  })
+
+  it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toContain('await deps.scheduleRestart(reason)')
+  })
+})
+
+describe('gateway: model-menu sr-* target relaunches via the carrier', () => {
+  it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
+    const idx = GATEWAY_SRC.indexOf('if (data.startsWith(MODEL_CALLBACK_SR))')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1400)
+    expect(win).toContain('modelDeps.scheduleModelRelaunch(srName')
+    // It must return before falling through to handleModelMenuCallback (which
+    // would inject an sr-* id claude's picker rejects).
+    expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
+  })
+})
+
+describe('gateway boot: session-model re-hydration + LiteLLM-down alert', () => {
+  it('re-hydrates activeSessionModelOverride from .active-session-model', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx - 200, idx + 1400)
+    // Only an override when the launched model differs from the configured one.
+    expect(win).toMatch(/launched\.length > 0 && launched !== configured \? launched : null/)
+    // The configured value must be resolved through resolveMainModel (the SAME
+    // resolver start.sh's scaffold uses) so an unset/`default` model config does
+    // not get flagged as a phantom session override on an ordinary restart.
+    expect(win).toContain('resolveMainModel(raw ?? undefined)')
+  })
+
+  it('consumes the .session-model-alert sentinel, notifies ALL operators, and deletes it', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.session-model-alert')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1100)
+    expect(win).toContain('unlinkSync(alertPath)')
+    // Broadcasts to every operator in allowFrom, not just allowFrom[0].
+    expect(win).toContain('const operators = loadAccess().allowFrom')
+    expect(win).toContain('for (const operator of operators)')
+    expect(win).toContain('lockedBot.api')
+    expect(win).toContain('.sendMessage(operator')
+  })
+})

package/telegram-plugin/tests/inbound-emit-after-intercepts.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Structural pin: the delivery state machine's `inbound` event MUST be
+ * emitted from `handleInbound` only AFTER the intercept/early-return
+ * gauntlet — never eagerly at handler entry.
+ *
+ * The wedge this guards (overlord `/usage` went dead, 2026-07-08). The
+ * inbound emit drives the now-AUTHORITATIVE turn-in-flight gate
+ * (turnInFlightForGate → isMachineInTurn). When it fired at handler entry
+ * — before the permission-reply / `/auth` paste-back / interrupt-empty /
+ * secret-detect-drop intercepts — an intercepted message (e.g. an approval
+ * reply) drove the machine idle→`bridge_alive_in_turn`, then early-returned
+ * as an intercept: no delivery, no claudeBusyKeys mark, and critically no
+ * `turnEnd`. The machine held the gate closed until the 5-min TTL tick
+ * force-cleared it, buffering every inbound (including `/usage`) meanwhile —
+ * the dangerous `machine_over_holds` divergence gate-parity-probe.ts flags.
+ *
+ * The behaviour lives inside the un-exported `handleInbound` closure, so —
+ * mirroring the other gateway-*.test.ts source-pins — we assert on source
+ * structure: the single inbound `shadowEmit` must sit below the intercepts
+ * and carry the real `isSteering` classification. Machine self-heal + gate
+ * accessors are behaviour-tested in inbound-delivery-cutover-gate.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+/** Byte offset of the sole `shadowEmit({ kind: 'inbound' ... })` call. */
+function inboundEmitOffset(): number {
+  const m = GATEWAY_SRC.match(/shadowEmit\(\{\s*\n\s*kind:\s*'inbound'/)
+  expect(m, 'expected exactly one multi-line inbound shadowEmit').not.toBeNull()
+  const idx = GATEWAY_SRC.indexOf(m![0])
+  // There must be only ONE such emit — a second eager site would reintroduce
+  // the wedge.
+  const second = GATEWAY_SRC.indexOf(m![0], idx + 1)
+  expect(second, 'a second inbound shadowEmit would reintroduce the eager-emit wedge').toBe(-1)
+  return idx
+}
+
+describe('gateway: inbound machine-emit is deferred past the intercepts', () => {
+  it('carries the DEFERRED_INBOUND_EMIT marker so the intent is greppable', () => {
+    expect(GATEWAY_SRC).toContain('DEFERRED_INBOUND_EMIT')
+  })
+
+  it('emits the machine `inbound` event AFTER the permission-reply intercept', () => {
+    const emitIdx = inboundEmitOffset()
+    // The permission-reply intercept is one of the early-return paths that
+    // must NOT drive the machine into a turn.
+    const permIdx = GATEWAY_SRC.indexOf('const permMatch = PERMISSION_REPLY_RE.exec(text)')
+    expect(permIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(permIdx)
+  })
+
+  it('emits AFTER the `/auth add` paste-back intercept', () => {
+    const emitIdx = inboundEmitOffset()
+    const authIdx = GATEWAY_SRC.indexOf('pendingAuthAddFlows.get(interceptKey)')
+    expect(authIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(authIdx)
+  })
+
+  it('emits AFTER isSteering is classified, and passes the real value (not a hardcoded false)', () => {
+    const emitIdx = inboundEmitOffset()
+    const steerIdx = GATEWAY_SRC.indexOf('isSteering = priorTurnInFlight && isSteerPrefix')
+    expect(steerIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(steerIdx)
+    // The emit's msg object must forward the live `isSteering` binding, so a
+    // mid-turn steer is not mis-modelled as a fresh turn.
+    const win = GATEWAY_SRC.slice(emitIdx, emitIdx + 260)
+    expect(win).toMatch(/msg:\s*\{[\s\S]*?\bisSteering,[\s\S]*?\}/)
+  })
+
+  it('emits BEFORE the deliver-or-buffer decision (reserveInboundDelivery)', () => {
+    const emitIdx = inboundEmitOffset()
+    const gateIdx = GATEWAY_SRC.indexOf('const deliveryGate = reserveInboundDelivery({')
+    expect(gateIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeLessThan(gateIdx)
+  })
+})