switchroom 0.17.5 → 0.17.10

package/telegram-plugin/tests/activity-card-store.test.ts

@@ -0,0 +1,436 @@
+/**
+ * activity-card-store.test.ts — outcome-based tests for the mid-turn
+ * activity-card restart-survivability fix (Known Gap 1,
+ * `reference/rfcs/deterministic-turn-liveness.md`).
+ *
+ * PRE-FIX PROOF: before this PR, no persistence existed for
+ * `CurrentTurn.activityMessageId` at all — `../gateway/activity-card-store.js`
+ * did not exist, so `import` itself failed at collection time:
+ *
+ *   Error: Cannot find module '../gateway/activity-card-store.js'
+ *   (or its corresponding .ts source) imported from
+ *   telegram-plugin/tests/activity-card-store.test.ts
+ *
+ * i.e. every test below fails on today's (pre-fix) base — there was no seam
+ * to test. Recorded run against `origin/main` (this PR's parent commit)
+ * before the module was added:
+ *
+ *   FAIL  telegram-plugin/tests/activity-card-store.test.ts
+ *   [vitest] Cannot find module '../gateway/activity-card-store.js'
+ *
+ * This file exercises the REAL exported store + boot-reaper functions (not a
+ * structural grep), mirroring `status-pin-store.test.ts`'s in-memory fs seam
+ * convention, plus a transport-boundary reaper test (mirrors
+ * `silent-end-transport.test.ts`'s spy-transport convention) proving the
+ * exact outcome contract: (a) card open persists a record; (b) clean close
+ * clears it; (c) a boot reaper run against a leftover record performs
+ * EXACTLY ONE finalizing edit + one unpin and deletes the record; (d) a
+ * second boot performs ZERO edits and ZERO unpins; (e) a corrupt state file
+ * never crashes boot and is dropped without an edit.
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  loadActivityCards,
+  persistActivityCards,
+  writeActivityCardRecord,
+  clearActivityCardRecord,
+  runActivityCardBootReaper,
+  restartOrphanCardFinalizeText,
+  type ActivityCardRecord,
+  type ActivityCardStoreFsSeam,
+} from '../gateway/activity-card-store.js'
+
+/** In-memory fs seam with an atomic rename — same convention as
+ *  status-pin-store.test.ts's memFs, so the tmp→rename crash-safety
+ *  contract is exercised without touching real disk. */
+function memFs(seed: Record<string, string> = {}) {
+  const files = new Map<string, string>(Object.entries(seed))
+  const calls: string[] = []
+  const fs: ActivityCardStoreFsSeam = {
+    readFileSync: (p) => {
+      if (!files.has(p)) throw new Error(`ENOENT ${p}`)
+      return files.get(p)!
+    },
+    writeFileSync: (p, d) => {
+      calls.push(`write:${p}`)
+      files.set(p, d)
+    },
+    renameSync: (a, b) => {
+      calls.push(`rename:${a}->${b}`)
+      if (!files.has(a)) throw new Error(`ENOENT ${a}`)
+      files.set(b, files.get(a)!)
+      files.delete(a)
+    },
+    existsSync: (p) => files.has(p),
+  }
+  return { fs, files, calls }
+}
+
+const PATH = '/state/agent/telegram/activity-cards-pending.json'
+
+function card(over: Partial<ActivityCardRecord> = {}): ActivityCardRecord {
+  return {
+    turnKey: 'c:_',
+    chatId: '-100123',
+    threadId: null,
+    activityMessageId: 715,
+    startedAt: Date.now() - 60_000,
+    pinned: true,
+    ...over,
+  }
+}
+
+describe('activity-card-store — persistence primitives', () => {
+  it('loads [] when no file exists (fresh boot)', () => {
+    const { fs } = memFs()
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('(a) card open → state persisted (round-trips a written record)', () => {
+    const { fs } = memFs()
+    // Construct ONCE — card() stamps `startedAt: Date.now() - 60_000`, so two
+    // separate calls can straddle a millisecond and flake the deep-equal.
+    const record = card()
+    writeActivityCardRecord(PATH, fs, record)
+    const loaded = loadActivityCards(PATH, fs)
+    expect(loaded).toHaveLength(1)
+    expect(loaded[0]).toEqual(record)
+  })
+
+  it('a fresh OPEN for the same topic replaces (upserts) the stale row, not appends', () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ activityMessageId: 715 }))
+    writeActivityCardRecord(PATH, fs, card({ activityMessageId: 900 }))
+    const loaded = loadActivityCards(PATH, fs)
+    expect(loaded).toHaveLength(1)
+    expect(loaded[0]!.activityMessageId).toBe(900)
+  })
+
+  it('(b) clean close → state cleared', () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card())
+    expect(loadActivityCards(PATH, fs)).toHaveLength(1)
+    clearActivityCardRecord(PATH, fs, 'c:_')
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('clearing an absent/mismatched turnKey is a no-op (never throws)', () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:other' }))
+    clearActivityCardRecord(PATH, fs, 'c:_')
+    expect(loadActivityCards(PATH, fs)).toHaveLength(1)
+  })
+
+  it('writes via tmp + atomic rename (crash-safe)', () => {
+    const { fs, calls } = memFs()
+    persistActivityCards(PATH, fs, [card()])
+    expect(calls).toEqual([`write:${PATH}.tmp`, `rename:${PATH}.tmp->${PATH}`])
+  })
+
+  it('(e) corrupt state file: boot survives, loads as [] (fail-open, never throws)', () => {
+    const { fs } = memFs({ [PATH]: '{not json' })
+    expect(() => loadActivityCards(PATH, fs)).not.toThrow()
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('fail-open: wrong envelope version / malformed shape loads as []', () => {
+    const { fs: f1 } = memFs({ [PATH]: JSON.stringify({ v: 2, cards: [card()] }) })
+    expect(loadActivityCards(PATH, f1)).toEqual([])
+    const { fs: f2 } = memFs({ [PATH]: JSON.stringify({ v: 1, cards: 'nope' }) })
+    expect(loadActivityCards(PATH, f2)).toEqual([])
+  })
+
+  it('drops malformed rows but keeps valid ones', () => {
+    const { fs } = memFs({
+      [PATH]: JSON.stringify({
+        v: 1,
+        cards: [
+          card({ activityMessageId: 715 }),
+          { turnKey: '', chatId: 'c', threadId: null, activityMessageId: 1, startedAt: 1 },
+          { turnKey: 'k', chatId: 'c', threadId: null, startedAt: 1 }, // missing activityMessageId
+        ],
+      }),
+    })
+    const loaded = loadActivityCards(PATH, fs)
+    expect(loaded).toHaveLength(1)
+    expect(loaded[0]!.activityMessageId).toBe(715)
+  })
+
+  it('persist never throws on a failing fs (durability degrades, live path unaffected)', () => {
+    const throwingFs: ActivityCardStoreFsSeam = {
+      readFileSync: () => {
+        throw new Error('boom')
+      },
+      writeFileSync: () => {
+        throw new Error('disk full')
+      },
+      renameSync: () => {
+        throw new Error('nope')
+      },
+      existsSync: () => false,
+    }
+    const logs: string[] = []
+    expect(() => persistActivityCards(PATH, throwingFs, [card()], (l) => logs.push(l))).not.toThrow()
+    expect(logs.join('')).toContain('persist FAILED')
+  })
+})
+
+/**
+ * Boot reaper — transport-boundary outcome tests (mirrors
+ * silent-end-transport.test.ts's spy-transport convention): a spy stands in
+ * for `bot.api.editMessageText` / `bot.api.unpinChatMessage`, asserting an
+ * actual finalizing edit + unpin land, not a stubbed decision callback.
+ */
+describe('runActivityCardBootReaper — transport-boundary outcome tests', () => {
+  it('(c) leftover record → exactly one finalizing edit + one unpin, record deleted', async () => {
+    const { fs } = memFs()
+    const startedAt = Date.now() - 90_000
+    writeActivityCardRecord(PATH, fs, card({ startedAt }))
+
+    const edits: Array<{ chatId: string; messageId: number; text: string }> = []
+    const unpins: Array<{ chatId: string; messageId: number }> = []
+
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async (record) => {
+        edits.push({
+          chatId: record.chatId,
+          messageId: record.activityMessageId,
+          text: restartOrphanCardFinalizeText(record.startedAt),
+        })
+        // A truthy result models a REAL delivered edit (grammy returns the
+        // edited Message); a benign-400 would resolve to undefined instead.
+        return { message_id: record.activityMessageId }
+      },
+      unpinCard: async (record) => {
+        unpins.push({ chatId: record.chatId, messageId: record.activityMessageId })
+      },
+    })
+
+    expect(edits).toHaveLength(1)
+    expect(edits[0]!.chatId).toBe('-100123')
+    expect(edits[0]!.messageId).toBe(715)
+    expect(edits[0]!.text).toContain('Interrupted by a gateway restart')
+    expect(edits[0]!.text).toContain('was running')
+
+    expect(unpins).toHaveLength(1)
+    expect(unpins[0]).toEqual({ chatId: '-100123', messageId: 715 })
+
+    expect(res).toEqual({ finalized: 1, vanished: 0, unpinned: 1, total: 1 })
+    // Record gone — nothing left for a future boot to re-finalize.
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('(d) second boot with an already-empty store → zero edits, zero unpins', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card())
+
+    let edits = 0
+    let unpins = 0
+    // First boot reaps the one leftover record.
+    await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        edits++
+        return { ok: true }
+      },
+      unpinCard: async () => {
+        unpins++
+      },
+    })
+    expect(edits).toBe(1)
+    expect(unpins).toBe(1)
+
+    // Second boot re-reads the (now empty) file — the idempotency guarantee.
+    const res2 = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        edits++
+        return { ok: true }
+      },
+      unpinCard: async () => {
+        unpins++
+      },
+    })
+    expect(edits).toBe(1) // unchanged
+    expect(unpins).toBe(1) // unchanged
+    expect(res2).toEqual({ finalized: 0, vanished: 0, unpinned: 0, total: 0 })
+  })
+
+  it('a record with pinned:false (or absent) is finalized but never unpinned', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ pinned: false }))
+    let unpins = 0
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => ({ ok: true }),
+      unpinCard: async () => {
+        unpins++
+      },
+    })
+    expect(res.finalized).toBe(1)
+    expect(unpins).toBe(0)
+  })
+
+  it('no-op on a fresh boot with no persisted cards (zero edits, zero unpins)', async () => {
+    const { fs } = memFs()
+    let calls = 0
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        calls++
+        return { ok: true }
+      },
+      unpinCard: async () => {
+        calls++
+      },
+    })
+    expect(res).toEqual({ finalized: 0, vanished: 0, unpinned: 0, total: 0 })
+    expect(calls).toBe(0)
+  })
+
+  it('a failing finalize edit is non-fatal, still attempts the unpin, and the store is still emptied', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card())
+    let unpinCalled = false
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        throw new Error('message to edit not found')
+      },
+      unpinCard: async () => {
+        unpinCalled = true
+      },
+    })
+    expect(res).toEqual({ finalized: 0, vanished: 0, unpinned: 1, total: 1 })
+    expect(unpinCalled).toBe(true)
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('a failing unpin (already unpinned / no rights) is non-fatal and does not re-run the edit', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card())
+    let editCalls = 0
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        editCalls++
+        return { ok: true }
+      },
+      unpinCard: async () => {
+        throw new Error('message to unpin not found')
+      },
+    })
+    expect(res).toEqual({ finalized: 1, vanished: 0, unpinned: 0, total: 1 })
+    expect(editCalls).toBe(1)
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('reaps multiple leftover records from distinct topics independently', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:1', chatId: '-100111', activityMessageId: 1 }))
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:2', chatId: '-100222', activityMessageId: 2 }))
+    const edited: number[] = []
+    const unpinned: number[] = []
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async (r) => {
+        edited.push(r.activityMessageId)
+        return { message_id: r.activityMessageId }
+      },
+      unpinCard: async (r) => {
+        unpinned.push(r.activityMessageId)
+      },
+    })
+    expect(res).toEqual({ finalized: 2, vanished: 0, unpinned: 2, total: 2 })
+    expect(edited.sort()).toEqual([1, 2])
+    expect(unpinned.sort()).toEqual([1, 2])
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('idempotency guard: the record is removed from disk BEFORE the finalize/unpin calls run (crash-mid-reap safety)', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card())
+    let onDiskDuringFinalize: ActivityCardRecord[] = []
+    await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        onDiskDuringFinalize = loadActivityCards(PATH, fs)
+      },
+      unpinCard: async () => {},
+    })
+    // At the moment finalizeCard ran, the record was ALREADY gone from disk —
+    // so a crash right here (or a concurrent second boot) can never re-reap it.
+    expect(onDiskDuringFinalize).toEqual([])
+  })
+
+  it('a benign-400 (finalizeCard resolves undefined) counts as vanished, not finalized', async () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ pinned: false }))
+    // robustApiCall swallows "message to edit not found" / "not modified" and
+    // resolves to undefined — nothing was delivered, so it must not be counted
+    // as a finalize (the pre-fix boot log over-reported the guarantee).
+    const res = await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => undefined,
+      unpinCard: async () => {},
+    })
+    expect(res).toEqual({ finalized: 0, vanished: 1, unpinned: 0, total: 1 })
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+
+  it('reap-race guard: an id-scoped clear leaves a live turn\'s fresh upsert (same turnKey) intact', async () => {
+    const { fs } = memFs()
+    // The reaper loads this OLD card (id=715) and finalizes it…
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:_', activityMessageId: 715 }))
+    await runActivityCardBootReaper({
+      path: PATH,
+      fs,
+      finalizeCard: async () => {
+        // …but MID-REAP (e.g. during a 429 flood-wait) a fresh live turn opens a
+        // NEW card under the same topic key (id=999). Its record must survive.
+        writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:_', activityMessageId: 999 }))
+        return { ok: true }
+      },
+      unpinCard: async () => {},
+    })
+    // The id-scoped clear removed only the OLD (715) row; the live 999 row is
+    // still protected. A turnKey-only clear would have wiped it.
+    const remaining = loadActivityCards(PATH, fs)
+    expect(remaining).toHaveLength(1)
+    expect(remaining[0]!.activityMessageId).toBe(999)
+  })
+
+  it('clearActivityCardRecord with a mismatched id is a no-op (does not drop a same-turnKey different-id row)', () => {
+    const { fs } = memFs()
+    writeActivityCardRecord(PATH, fs, card({ turnKey: 'c:_', activityMessageId: 999 }))
+    clearActivityCardRecord(PATH, fs, 'c:_', 715) // wrong id
+    expect(loadActivityCards(PATH, fs)).toHaveLength(1)
+    clearActivityCardRecord(PATH, fs, 'c:_', 999) // matching id
+    expect(loadActivityCards(PATH, fs)).toEqual([])
+  })
+})
+
+describe('restartOrphanCardFinalizeText', () => {
+  it('is honest about elapsed time', () => {
+    const text = restartOrphanCardFinalizeText(Date.now() - 45_000)
+    expect(text).toContain('Interrupted by a gateway restart')
+    expect(text).toMatch(/was running \d+s/)
+  })
+
+  it('omits a nonsensical elapsed clause for a degenerate startedAt', () => {
+    const text = restartOrphanCardFinalizeText(Date.now() + 10_000) // future — negative elapsed
+    expect(text).toContain('Interrupted by a gateway restart')
+    expect(text).not.toContain('was running')
+  })
+})

package/telegram-plugin/tests/activity-card-wiring.test.ts

@@ -0,0 +1,88 @@
+/**
+ * Activity-card durability WIRING (deterministic-turn-liveness.md Known Gap 1 +
+ * the #2895 review fix). The 20 behavioural tests in activity-card-store.test.ts
+ * drive the pure store/reaper in ISOLATION — they prove the routine is correct
+ * but say nothing about whether the GATEWAY actually calls it. That is exactly
+ * the decision-vs-delivery gap the whole RFC exists to close, applied to its own
+ * follow-up: a refactor that drops the `writeActivityCardRecord` call on card
+ * open would keep every store test green while silently un-delivering the
+ * guarantee.
+ *
+ * The gateway IIFE can't be instantiated in-process (same constraint as
+ * silence-liveness-wiring.test.ts / multitopic-routing-wiring.test.ts), so these
+ * are STRUCTURAL assertions that pin the three load-bearing call sites. They
+ * COMPLEMENT (never replace) the behavioural store tests — the RFC's "structural
+ * grep may not be the SOLE coverage" bar is met because the outcome is proven at
+ * the routine level; this only guards the wiring the routine depends on.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
+
+function between(src: string, startMarker: string, endMarker: string): string {
+  const after = src.split(startMarker)[1] ?? ''
+  return after.split(endMarker)[0] ?? ''
+}
+
+describe('activity-card durability wiring', () => {
+  it('the card-OPEN path persists the durable handle (writeActivityCardRecord)', () => {
+    // The open branch runs when activityMessageId transitions null → set.
+    const openBranch = between(
+      gatewaySrc,
+      'if (turn.activityMessageId == null) {',
+      'turn.activityLastSentRender = target',
+    )
+    expect(openBranch.length).toBeGreaterThan(100)
+    expect(openBranch).toMatch(/writeActivityCardRecord\(/)
+    // Persist is gated on the feature flag, not unconditional.
+    expect(openBranch).toMatch(/activityCardPersistEnabled/)
+    // Pin honesty: the persisted RECORD mirrors the ACTUAL pin decision, never
+    // a bare `pinned: true` (the #2895 review fix). Scope the negative check to
+    // the writeActivityCardRecord argument block — the reconcileStatusPin call
+    // further down legitimately passes `{ pinned: true }` as the desired state.
+    const recordBlock = between(openBranch, 'writeActivityCardRecord(', 'void reconcileStatusPin(')
+    expect(recordBlock).toMatch(/pinned: PIN_STATUS_WHILE_WORKING/)
+    // Strip comment lines (the code comment legitimately quotes the old
+    // `pinned: true` shape it's warning against) before checking the CODE.
+    const recordCode = recordBlock
+      .split('\n')
+      .filter((l) => !l.trim().startsWith('//'))
+      .join('\n')
+    expect(recordCode).not.toMatch(/pinned: true/)
+  })
+
+  it('the normal-CLOSE path clears the durable handle, id-scoped (reap-race guard)', () => {
+    const closeBody = between(
+      gatewaySrc,
+      'const id = turn.activityMessageId\n    turn.activityMessageId = null',
+      'if (CLEAR_STATUS_ON_COMPLETION)',
+    )
+    expect(closeBody.length).toBeGreaterThan(50)
+    expect(closeBody).toMatch(/clearActivityCardRecord\(/)
+    // Must pass the id so it only drops THIS card's row (not a fresher upsert).
+    expect(closeBody).toMatch(/\n\s*id,\s*\n/)
+  })
+
+  it('the boot reaper runs ONLY after the startup mutex is won (never at import time)', () => {
+    // Both invocation sites (mutex-won + mutex-fallback) sit AFTER
+    // acquireStartupLock, alongside statusPinBootCleanup.
+    const afterLock = between(gatewaySrc, 'await acquireStartupLock({', 'catch (err)')
+    expect(afterLock).toMatch(/void activityCardBootReaper\(\)/)
+    // And it must NOT be invoked at module import time — the same losing-double-
+    // boot hazard the NOTE at statusPinBootCleanup documents.
+    const beforeMain = gatewaySrc.split('await acquireStartupLock({')[0] ?? ''
+    expect(beforeMain).not.toMatch(/^\s*void activityCardBootReaper\(\)/m)
+  })
+
+  it('the reaper wrapper counts a benign-400 as vanished, not finalized (honest boot log)', () => {
+    const wrapper = between(
+      gatewaySrc,
+      'async function activityCardBootReaper()',
+      '\n// NOTE: statusPinBootCleanup()',
+    )
+    expect(wrapper).toMatch(/vanished/)
+    expect(wrapper).toMatch(/at-most-once/)
+  })
+})

package/telegram-plugin/tests/auth-snapshot-format.test.ts

@@ -18,6 +18,7 @@ import {
   renderFallbackAnnouncement,
   buildSnapshotKeyboard,
   buildSnapshotsFromState,
+  zipProbeResults,
   buildSnapshotsFromCachedState,
   reviveLastQuota,
   THROTTLING_THRESHOLD_PCT,
@@ -720,6 +721,80 @@ describe('buildSnapshotKeyboard', () => {
       .flat().map((b) => b.text);
     expect(before).not.toContain('Switch fleet → refilled@x');
   });
+
+  it('demo mode masks the switch-button label but keeps the real label in callback_data', () => {
+    __resetDemoMaskCachesForTest();
+    const snaps: AccountSnapshot[] = [
+      snap({ label: 'ken.real@example.com', isActive: true, quota: quota({ fiveHourUtilizationPct: 5 }) }),
+      snap({ label: 'alt.real@example.com', quota: quota({ fiveHourUtilizationPct: 5 }) }),
+    ];
+    const rows = buildSnapshotKeyboard(snaps, { now: NOW, demo: true });
+    const switchBtn = rows.flat().find((b) => b.callbackData?.startsWith('auth:use:'));
+    expect(switchBtn).toBeDefined();
+    // Label masked — the real email never appears on screen…
+    expect(switchBtn!.text).not.toContain('alt.real@example.com');
+    // …but the broker still gets the real label to act on.
+    expect(switchBtn!.callbackData).toBe('auth:use:alt.real@example.com');
+  });
+
+  it('demo mode flips the refresh callback to auth:refresh:demo so a ↻ tap stays masked', () => {
+    const snaps: AccountSnapshot[] = [
+      snap({ label: 'a@x', isActive: true, quota: quota({}) }),
+    ];
+    const demoRows = buildSnapshotKeyboard(snaps, { demo: true }).flat();
+    expect(demoRows.find((b) => b.text === '↻ Refresh')?.callbackData).toBe('auth:refresh:demo');
+    const plainRows = buildSnapshotKeyboard(snaps).flat();
+    expect(plainRows.find((b) => b.text === '↻ Refresh')?.callbackData).toBe('auth:refresh');
+  });
+});
+
+// ── zipProbeResults ──────────────────────────────────────────────────
+
+describe('zipProbeResults', () => {
+  const okResult = { ok: true as const, data: quota({ fiveHourUtilizationPct: 5 }) };
+
+  it('returns quotas parallel to labels with no staleCachedAtMs when everything is live', () => {
+    const { quotas, staleCachedAtMs } = zipProbeResults(
+      ['a@x', 'b@x'],
+      [
+        { label: 'a@x', result: okResult, served: 'live' },
+        { label: 'b@x', result: okResult, served: 'live' },
+      ],
+    );
+    expect(quotas).toHaveLength(2);
+    expect(quotas.every((q) => q.ok)).toBe(true);
+    expect(staleCachedAtMs).toBeUndefined();
+  });
+
+  it('surfaces the OLDEST capturedAt among cache-served rows (#2495 Change 2)', () => {
+    const { staleCachedAtMs } = zipProbeResults(
+      ['a@x', 'b@x', 'c@x'],
+      [
+        { label: 'a@x', result: okResult, served: 'live' },
+        { label: 'b@x', result: okResult, served: 'cache', capturedAt: 5_000 },
+        { label: 'c@x', result: okResult, served: 'cache', capturedAt: 2_000 },
+      ],
+    );
+    expect(staleCachedAtMs).toBe(2_000);
+  });
+
+  it('degrades a missing per-label row to ok:false, preserving input order', () => {
+    const { quotas } = zipProbeResults(
+      ['a@x', 'gone@x'],
+      [{ label: 'a@x', result: okResult }],
+    );
+    expect(quotas[0]!.ok).toBe(true);
+    expect(quotas[1]!.ok).toBe(false);
+    expect((quotas[1] as { ok: false; reason: string }).reason).toContain('no result');
+  });
+
+  it('ignores served:"cache" rows without capturedAt (no false staleness)', () => {
+    const { staleCachedAtMs } = zipProbeResults(
+      ['a@x'],
+      [{ label: 'a@x', result: okResult, served: 'cache' }],
+    );
+    expect(staleCachedAtMs).toBeUndefined();
+  });
 });
 
 // ── buildSnapshotsFromState ──────────────────────────────────────────