switchroom 0.17.6 → 0.17.10

package/telegram-plugin/tests/consolidation-legibility.test.ts

@@ -0,0 +1,224 @@
+import { describe, it, expect } from 'vitest'
+import {
+  isConsolidationLegibilityEnabled,
+  detectConsolidationEvent,
+  renderConsolidationLine,
+  consolidationSignature,
+  ConsolidationRateLimiter,
+  HINDSIGHT_WEBHOOK_SOURCE,
+  CONSOLIDATION_COMPLETED_EVENT,
+} from '../consolidation-legibility.js'
+
+describe('isConsolidationLegibilityEnabled — OPT-IN (default OFF)', () => {
+  it('is OFF when unset (opposite of the default-ON tool-observation path)', () => {
+    expect(isConsolidationLegibilityEnabled(undefined)).toBe(false)
+  })
+  it('is OFF for the empty string and for "0"/"false"/"off"', () => {
+    expect(isConsolidationLegibilityEnabled('')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('0')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('false')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('off')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('no')).toBe(false)
+  })
+  it('is ON only for an explicit truthy opt-in', () => {
+    expect(isConsolidationLegibilityEnabled('1')).toBe(true)
+    expect(isConsolidationLegibilityEnabled('true')).toBe(true)
+    expect(isConsolidationLegibilityEnabled('on')).toBe(true)
+    expect(isConsolidationLegibilityEnabled('yes')).toBe(true)
+    expect(isConsolidationLegibilityEnabled(' TRUE ')).toBe(true)
+  })
+})
+
+describe('wire constants', () => {
+  it('names the hindsight consolidation.completed source/event', () => {
+    expect(HINDSIGHT_WEBHOOK_SOURCE).toBe('hindsight')
+    expect(CONSOLIDATION_COMPLETED_EVENT).toBe('consolidation.completed')
+  })
+})
+
+describe('detectConsolidationEvent — MATERIAL-only (sparse)', () => {
+  it('returns null on a routine no-op consolidation (nothing stored/corrected)', () => {
+    expect(detectConsolidationEvent({ stored: 0, corrected: 0 })).toBeNull()
+    expect(detectConsolidationEvent({})).toBeNull()
+    expect(detectConsolidationEvent(undefined)).toBeNull()
+  })
+
+  it('classifies a pure store as "updated"', () => {
+    const ev = detectConsolidationEvent({ stored: 2, subject: 'your deploy preferences' })
+    expect(ev).toEqual({ kind: 'updated', topic: 'your deploy preferences' })
+  })
+
+  it('classifies any correction as "revised" (higher signal), even alongside stores', () => {
+    expect(detectConsolidationEvent({ corrected: 1, subject: 'old runbook' })).toEqual({
+      kind: 'revised',
+      topic: 'old runbook',
+    })
+    expect(detectConsolidationEvent({ stored: 3, corrected: 1, subject: 'X' })).toEqual({
+      kind: 'revised',
+      topic: 'X',
+    })
+  })
+
+  it('tolerates field aliases (created/added/new_observations; invalidated/superseded)', () => {
+    expect(detectConsolidationEvent({ created: 1, topic: 'a' })?.kind).toBe('updated')
+    expect(detectConsolidationEvent({ new_observations: 5, topic: 'a' })?.kind).toBe('updated')
+    expect(detectConsolidationEvent({ invalidated: 2, topic: 'a' })?.kind).toBe('revised')
+    expect(detectConsolidationEvent({ superseded: 1, topic: 'a' })?.kind).toBe('revised')
+  })
+
+  it('counts an observations array by length as a store', () => {
+    const ev = detectConsolidationEvent({
+      observations: [{ statement: 'User prefers TS', subject: 'coding style' }],
+    })
+    expect(ev).toEqual({ kind: 'updated', topic: 'coding style' })
+  })
+
+  it('accepts numeric-string counts', () => {
+    expect(detectConsolidationEvent({ stored: '2', subject: 'x' })?.kind).toBe('updated')
+  })
+
+  it('derives topic from subjects[]/entities[] arrays when no direct subject', () => {
+    expect(detectConsolidationEvent({ stored: 1, subjects: ['travel plans'] })?.topic).toBe(
+      'travel plans',
+    )
+    expect(
+      detectConsolidationEvent({ stored: 1, entities: [{ name: 'Acme Corp' }] })?.topic,
+    ).toBe('Acme Corp')
+  })
+
+  it('falls back to the first observation statement when no subject', () => {
+    const ev = detectConsolidationEvent({
+      observations: [{ statement: 'The user lives in Sydney' }],
+    })
+    expect(ev?.topic).toBe('The user lives in Sydney')
+  })
+
+  it('leaves topic empty when the payload carries no legible subject', () => {
+    expect(detectConsolidationEvent({ stored: 1, bank_id: 'agent-x' })?.topic).toBe('')
+  })
+})
+
+describe('renderConsolidationLine — terse, HTML, notification-free surface', () => {
+  it('renders the updated line with a subject', () => {
+    expect(renderConsolidationLine({ kind: 'updated', topic: 'your deploy preferences' })).toBe(
+      '🧠 <i>updated what I know</i> about "your deploy preferences"',
+    )
+  })
+  it('renders the revised line with a subject', () => {
+    expect(renderConsolidationLine({ kind: 'revised', topic: 'the old runbook' })).toBe(
+      '🧠 <i>revised what I know</i> about "the old runbook"',
+    )
+  })
+  it('falls back to a bare line when there is no legible subject', () => {
+    expect(renderConsolidationLine({ kind: 'updated', topic: '' })).toBe(
+      '🧠 <i>updated what I know about you.</i>',
+    )
+    expect(renderConsolidationLine({ kind: 'revised', topic: '   ' })).toBe(
+      '🧠 <i>revised what I know about you.</i>',
+    )
+  })
+  it('HTML-escapes the subject (no entity injection)', () => {
+    expect(renderConsolidationLine({ kind: 'updated', topic: 'a <b> & c' })).toBe(
+      '🧠 <i>updated what I know</i> about "a &lt;b&gt; &amp; c"',
+    )
+  })
+  it('truncates a very long subject', () => {
+    const long = 'x'.repeat(500)
+    const out = renderConsolidationLine({ kind: 'updated', topic: long })
+    expect(out.length).toBeLessThan(200)
+    expect(out).toContain('…')
+  })
+})
+
+describe('ConsolidationRateLimiter — sparse / non-spammy', () => {
+  it('allows the first line, then blocks a second within the min-interval', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, now: () => t })
+    expect(rl.allow('klanker', 'updated:a')).toBe(true)
+    t += 60_000 // 1 min later
+    expect(rl.allow('klanker', 'updated:b')).toBe(false) // different topic, still capped
+  })
+
+  it('allows again once the min-interval has elapsed', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, now: () => t })
+    expect(rl.allow('klanker', 'updated:a')).toBe(true)
+    t += 600_001
+    expect(rl.allow('klanker', 'updated:b')).toBe(true)
+  })
+
+  it('suppresses an IDENTICAL signature across the dedup window even after the interval', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({
+      minIntervalMs: 600_000,
+      dedupWindowMs: 3_600_000,
+      now: () => t,
+    })
+    expect(rl.allow('klanker', 'updated:deploy')).toBe(true)
+    t += 700_000 // past min-interval…
+    expect(rl.allow('klanker', 'updated:deploy')).toBe(false) // …but same topic, still deduped
+    t += 3_600_000 // past dedup window
+    expect(rl.allow('klanker', 'updated:deploy')).toBe(true)
+  })
+
+  it('rate-limits per agent independently', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, now: () => t })
+    expect(rl.allow('klanker', 'updated:a')).toBe(true)
+    expect(rl.allow('reggie', 'updated:a')).toBe(true) // different agent, own budget
+  })
+
+  it('accepts an explicit now override per call', () => {
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000 })
+    expect(rl.allow('klanker', 'updated:a', 0)).toBe(true)
+    expect(rl.allow('klanker', 'updated:a', 100)).toBe(false)
+    expect(rl.allow('klanker', 'updated:a', 700_000)).toBe(false) // dedup window
+    expect(rl.allow('klanker', 'updated:b', 700_000)).toBe(true) // new topic past interval
+  })
+
+  // Regression: the gateway caller (surfaceConsolidationLegibility) MUST pass
+  // Date.now() as the clock, never a payload-derived rec.ts. This test proves
+  // WHY: a spoofed/stale timestamp from the webhook payload poisons the
+  // per-agent min-interval gate. A far-FUTURE payload ts leaves the stored
+  // last-surface time in the future, so a genuine later wall-clock surface
+  // reads as "in the past" and the gate stays jammed shut; a far-PAST ts makes
+  // every subsequent surface look older than the window and the gate never
+  // engages (spam). Feeding wall-clock avoids both.
+  it('a payload-derived far-future timestamp would jam the interval gate shut', () => {
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, dedupWindowMs: 0 })
+    const wallNow = 1_000_000
+    const spoofedFuture = wallNow + 10 * 365 * 24 * 3_600_000 // ~10y ahead
+    // First surface stamped with the attacker's future ts.
+    expect(rl.allow('klanker', 'updated:a', spoofedFuture)).toBe(true)
+    // A genuine later surface (real wall-clock) is now "before" the stored
+    // last time → interval never elapses → legitimate surface suppressed.
+    expect(rl.allow('klanker', 'updated:b', wallNow + 700_000)).toBe(false)
+  })
+
+  it('a payload-derived timestamp lets a spoofer defeat the interval gate (spam)', () => {
+    // Two events arrive ~1ms apart in REALITY, but each carries a payload ts
+    // inflated to appear far apart. Keyed on payload ts, the gate sees them as
+    // past the interval and lets BOTH through — spam.
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, dedupWindowMs: 0 })
+    expect(rl.allow('klanker', 'updated:a', 0)).toBe(true)
+    expect(rl.allow('klanker', 'updated:b', 700_000)).toBe(true) // spoofed far-apart ts → not blocked
+    // Wall-clock (what the fix passes) blocks the same two events 1ms apart.
+    const rl2 = new ConsolidationRateLimiter({ minIntervalMs: 600_000, dedupWindowMs: 0 })
+    const wallNow = 1_000_000_000
+    expect(rl2.allow('klanker', 'updated:a', wallNow)).toBe(true)
+    expect(rl2.allow('klanker', 'updated:b', wallNow + 1)).toBe(false)
+  })
+})
+
+describe('consolidationSignature — stable dedup key', () => {
+  it('normalises whitespace + case so trivially-different topics collapse', () => {
+    expect(consolidationSignature({ kind: 'updated', topic: '  Deploy   Prefs ' })).toBe(
+      'updated:deploy prefs',
+    )
+  })
+  it('separates kind so a store and a correction of the same topic differ', () => {
+    expect(consolidationSignature({ kind: 'updated', topic: 'x' })).not.toBe(
+      consolidationSignature({ kind: 'revised', topic: 'x' }),
+    )
+  })
+})

package/telegram-plugin/tests/emission-authority-facade.test.ts

@@ -315,7 +315,7 @@ describe('façade delegates to the existing emission primitives (call-site liter
   })
 })
 
-describe('the 7 drain sites route through the façade with producers preserved verbatim', () => {
+describe('the drain sites route through the façade with producers preserved verbatim', () => {
   it('the narrative SHOW site routes via openOrEditCard("narrative") + the producer-"narrative" drain', () => {
     const body = fnSrc('showNarrativeStep')
     expect(body).toMatch(/openOrEditCard\('narrative'/)
@@ -325,26 +325,30 @@ describe('the 7 drain sites route through the façade with producers preserved v
     expect(body).toMatch(/ea\.mayDrain\(turn\)/)
   })
 
-  it('both liveness sites route via openOrEditCard("liveness") + producer-"liveness" drains (one in openLivenessFeedIfDue, one in feedHeartbeatTick)', () => {
+  it('all liveness sites route via openOrEditCard("liveness") + producer-"liveness" drains (one in openLivenessFeedIfDue, two in feedHeartbeatTick)', () => {
     // The early-card-open refactor extracted the 0-tool liveness OPEN out of
     // feedHeartbeatTick into the shared `openLivenessFeedIfDue` helper (so the
     // 6 s heartbeat and the enqueue-time early-open timer reach ONE open path
-    // and never double-open). So the two liveness sites now live in:
-    //   - openLivenessFeedIfDue: the 0-tool early-open / climb;
-    //   - feedHeartbeatTick:     the labelled-feed stale-step maintain.
-    // Both must still route via the façade with the producer arg verbatim.
+    // and never double-open). deterministic-turn-liveness.md Phase 1 then added
+    // the 0-label CLIMB of an already-open card back into feedHeartbeatTick (an
+    // EDIT, never an OPEN — so it does not double-open). So the liveness sites now
+    // live in:
+    //   - openLivenessFeedIfDue: the 0-tool early-OPEN;
+    //   - feedHeartbeatTick:     the 0-label CLIMB of an already-open card
+    //                            (Phase 1) + the labelled-feed stale-step maintain.
+    // All must still route via the façade with the producer arg verbatim.
     const earlyOpen = fnSrc('openLivenessFeedIfDue')
     const heartbeat = fnSrc('feedHeartbeatTick')
     const opens = [
       ...earlyOpen.matchAll(/openOrEditCard\('liveness'/g),
       ...heartbeat.matchAll(/openOrEditCard\('liveness'/g),
     ]
-    expect(opens).toHaveLength(2)
+    expect(opens).toHaveLength(3)
     const drains = [
       ...earlyOpen.matchAll(/drainActivitySummary\(turn,\s*'liveness'\)/g),
       ...heartbeat.matchAll(/drainActivitySummary\(turn,\s*'liveness'\)/g),
     ]
-    expect(drains).toHaveLength(2)
+    expect(drains).toHaveLength(3)
     // The literal the feed-heartbeat oracle greps must still be present in both.
     expect(earlyOpen).toMatch(/turn\.activityInFlight = drainActivitySummary/)
     expect(heartbeat).toMatch(/turn\.activityInFlight = drainActivitySummary/)
@@ -366,8 +370,14 @@ describe('the 7 drain sites route through the façade with producers preserved v
 
   it('every routed drain site guards the single-flight via ea.mayDrain(turn), not a bare activityInFlight read', () => {
     const mayDrainGuards = [...gatewaySrc.matchAll(/if \(ea\.mayDrain\(turn\)\)/g)]
-    // narrative + 2 liveness + tool + 2 sub-agent + 1 post-answer bg-liveness (Fix 2) = 7.
+    // narrative + 2 liveness + tool + 2 sub-agent + 1 post-answer bg-liveness
+    // (Fix 2) = 7. The Phase-1 0-label climb (deterministic-turn-liveness.md)
+    // consults the SAME guard, but its `if (deps.mayDrain())` lives in the
+    // extracted tick body (feed-heartbeat-climb.ts) with `() => ea.mayDrain(turn)`
+    // injected at the gateway call site — pinned by
+    // feed-heartbeat-liveness-open.test.ts + silent-turn-climb-transport.test.ts.
     expect(mayDrainGuards).toHaveLength(7)
+    expect(gatewaySrc).toMatch(/mayDrain:\s*\(\)\s*=>\s*ea\.mayDrain\(turn\)/)
   })
 })
 
@@ -487,11 +497,16 @@ describe('mayDrainCardNow — PR-4d card-drain gate (pure read; gateway holds th
     expect(ctxFn).toMatch(/turnInFlight:\s*turnInFlightForGate\(\)/)
   })
 
-  it('the 7 card-drain sites each route their guarded block through cardDrainGate (single-flight gate stays byte-identical)', () => {
+  it('the card-drain sites each route their guarded block through cardDrainGate (single-flight gate stays byte-identical)', () => {
     // Option A: the 7 `if (ea.mayDrain(turn))` guards + drainActivitySummary
     // thunks stay byte-identical, wrapped by the centralized helper.
     // 6 original + 1 new post-answer background-agent liveness drain (Fix 2).
     const wraps = [...gatewaySrc.matchAll(/cardDrainGate\(turn, ea, \(\) => \{/g)]
     expect(wraps).toHaveLength(7)
+    // The Phase-1 0-label climb (deterministic-turn-liveness.md) routes through
+    // the SAME helper via an injected thunk — its call lives in the extracted
+    // tick body (feed-heartbeat-climb.ts), wired at the gateway call site as
+    // `cardDrainGate: (run) => cardDrainGate(turn, ea, run)`.
+    expect(gatewaySrc).toMatch(/cardDrainGate:\s*\(run\)\s*=>\s*cardDrainGate\(turn, ea, run\)/)
   })
 })

package/telegram-plugin/tests/feed-heartbeat-liveness-open.test.ts

@@ -25,9 +25,12 @@
  *      `openLivenessFeedIfDue` BEFORE the drain — a turn that hasn't passed the
  *      threshold, or one whose card is already open, returns early (no
  *      double-open).
- *   4. The 0-tool branch of `feedHeartbeatTick` delegates to that one shared
- *      helper rather than inlining the open — so the heartbeat and the
- *      enqueue-time timer can never double-open.
+ *   4. The 0-tool branch of `feedHeartbeatTick` OPENS via that one shared helper
+ *      (so the heartbeat and the enqueue-time timer can never double-open) AND,
+ *      once a card is open, CLIMBS it every tick via `silentTurnClimbRender`
+ *      (deterministic-turn-liveness.md Phase 1) — the freeze this test used to
+ *      enshrine is inverted. The outcome-based proof is the transport test
+ *      `silent-turn-climb-transport.test.ts`.
  *
  * These are STRUCTURAL (source-read) assertions; the gateway IIFE can't be
  * instantiated in-process. Pattern matches silence-liveness-wiring.test.ts.
@@ -71,17 +74,38 @@ describe('H-1: feedHeartbeatTick liveness-open threshold', () => {
     expect(initBlock).toMatch(/1[_]?200/)
   })
 
-  it('the 0-tool liveness branch delegates to the shared openLivenessFeedIfDue helper', () => {
-    // The open logic lives in ONE place so the heartbeat and the enqueue-time
-    // early-open timer cannot double-open. The 0-tool branch must call the
-    // shared helper rather than inline its own open.
+  it('the 0-label tick routes through the REAL extracted tick body with the gateway deps wired verbatim', () => {
+    // deterministic-turn-liveness.md Phase 1 + Phase 4(d): the prior version of
+    // this test enshrined the freeze — it asserted only that the branch delegates
+    // to `openLivenessFeedIfDue` (which no-ops once a card is open), which is
+    // exactly why a busy-but-silent 0-label card used to freeze. The property is
+    // now INVERTED: the 0-label tick must route through the extracted
+    // `runSilentTurnHeartbeatTick` (feed-heartbeat-climb.ts) — the shipped tick
+    // body that CLIMBS an already-open card — with the gateway's REAL deps
+    // (the shared OPEN helper, cardDrainGate, ea.mayDrain,
+    // ea.openOrEditCard('liveness'), the 'liveness' drain) wired at the call
+    // site. Removing or mis-wiring this call site fails HERE; the tick body's
+    // behaviour is proven outcome-based in
+    // tests/silent-turn-climb-transport.test.ts (>=4 climbing edits across a
+    // 40s silent tool, edit-only, gate sequence in order).
     const body = feedHeartbeatTickSrc()
-    const start = body.indexOf('if (turn.mirrorLines.length === 0)')
+    const start = body.indexOf('runSilentTurnHeartbeatTick(')
     expect(start).toBeGreaterThan(-1)
     const branch = body.slice(start)
     const end = branch.indexOf('// Labelled-feed heartbeat')
     const scoped = end === -1 ? branch : branch.slice(0, end)
-    expect(scoped).toMatch(/openLivenessFeedIfDue\(turn\)/)
+    // The real deps, wired verbatim at the call site:
+    expect(scoped).toMatch(/openLivenessFeedIfDue:\s*\(\)\s*=>\s*openLivenessFeedIfDue\(turn\)/)
+    expect(scoped).toMatch(/setPendingRender:\s*\(rendered\)\s*=>\s*\{\s*turn\.activityPendingRender = rendered\s*\}/)
+    expect(scoped).toMatch(/cardDrainGate:\s*\(run\)\s*=>\s*cardDrainGate\(turn, ea, run\)/)
+    expect(scoped).toMatch(/mayDrain:\s*\(\)\s*=>\s*ea\.mayDrain\(turn\)/)
+    expect(scoped).toMatch(/openOrEditCard:\s*\(apply\)\s*=>\s*ea\.openOrEditCard\('liveness', apply\)/)
+    expect(scoped).toMatch(/drain:\s*\(\)\s*=>\s*\{\s*turn\.activityInFlight = drainActivitySummary\(turn, 'liveness'\)\s*\}/)
+    // The view carries the wall-clock elapsed + the labelled branch's stale floor.
+    expect(scoped).toMatch(/ageMs:\s*Date\.now\(\)\s*-\s*turn\.startedAt/)
+    expect(scoped).toMatch(/minStaleMs:\s*FEED_HEARTBEAT_MIN_STALE_MS/)
+    // A handled tick (0-label branch) stops before the labelled heartbeat.
+    expect(scoped).toMatch(/if \(handled\) return/)
   })
 
   it('the WHEN-gate (shouldEarlyOpenLiveness) precedes the drain call inside openLivenessFeedIfDue', () => {

package/telegram-plugin/tests/gateway-boot-marker-clear.test.ts

@@ -43,7 +43,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // window to ~5KB so we don't pick up the unrelated
     // `removeTurnActiveMarker` call in the onTurnComplete handler
     // way down at the bottom of the file.
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 5000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
     const clearMatches = setupWindow.match(/removeTurnActiveMarker\s*\(\s*STATE_DIR\s*\)/g) ?? []
     expect(clearMatches.length).toBe(1)
   })
@@ -53,7 +53,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // must not prevent the gateway from coming up. Pin the try-wrapping
     // to make sure a future refactor doesn't drop it.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 5000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
     expect(setupWindow).toMatch(/try\s*\{\s*removeTurnActiveMarker\(STATE_DIR\)\s*\}\s*catch/)
   })
 
@@ -62,7 +62,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // Clearing the marker first means the watchdog sees a clean slate
     // immediately, even if pin sweep takes 30s+ to finish.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 5000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
     const clearIdx = setupWindow.indexOf('removeTurnActiveMarker(STATE_DIR)')
     const pinSweepIdx = setupWindow.indexOf('Boot-time pin sweep')
     expect(clearIdx).toBeGreaterThan(0)

package/telegram-plugin/tests/inbound-spool.test.ts

@@ -99,6 +99,48 @@ describe('spoolId — stable dedup key', () => {
     )
     expect(a).not.toBe(b)
   })
+  // #2793 part B: a cron BOOT-REPLAY carries meta.replay_fire_ms (the
+  // minute-aligned fire being replayed). spoolId() keys on it + the
+  // schedule index so a re-replay of the SAME missed fire across a gateway
+  // restart — which mints a fresh synthetic messageId=ts each boot —
+  // collapses to one live entry instead of stacking a fresh one each boot.
+  it('cron boot-replay → s:cron-replay:chat:idx:fireMs, stable across ts/messageId', () => {
+    const a = spoolId(
+      msg({
+        messageId: 1700_000_000_000,
+        ts: 1700_000_000_000,
+        meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '1699999980000' },
+      }),
+    )
+    const b = spoolId(
+      msg({
+        messageId: 1700_000_999_999,
+        ts: 1700_000_999_999,
+        meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '1699999980000' },
+      }),
+    )
+    expect(a).toBe('s:cron-replay:c1:3:1699999980000')
+    expect(b).toBe(a) // stable across the fresh per-boot messageId/ts
+  })
+  it('cron boot-replays for distinct missed fires stay distinct', () => {
+    const a = spoolId(
+      msg({ messageId: 0, meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '100' } }),
+    )
+    const b = spoolId(
+      msg({ messageId: 0, meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '200' } }),
+    )
+    const c = spoolId(
+      msg({ messageId: 0, meta: { source: 'cron', schedule_index: '4', replay_fire_ms: '100' } }),
+    )
+    expect(a).not.toBe(b) // different fire minute
+    expect(a).not.toBe(c) // different schedule index
+  })
+  it('a LIVE cron tick (no replay_fire_ms) keeps its per-fire identity', () => {
+    // Live ticks are not routed through the spool, but assert the id path
+    // is unchanged so live fires never collapse into a replay bucket.
+    const live = spoolId(msg({ messageId: 0, meta: { source: 'cron' }, ts: 500 }))
+    expect(live).toBe('s:c1:cron:500')
+  })
   it('subagent_handback without jsonl id falls back to legacy id (back-compat)', () => {
     const a = spoolId(
       msg({ messageId: 555, meta: { source: 'subagent_handback' }, ts: 100 }),
@@ -578,3 +620,66 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
     expect(events).toEqual([true, false]) // degraded → recovered
   })
 })
+
+// #2793 part B — cron boot-replay accept-vs-consume durability. A missed
+// scheduled fire re-injected at boot is routed through this spool by the
+// gateway's onInjectInbound handler (put on accept, ack on confirmed
+// delivery). These tests pin the two windows the ledger closes.
+describe('#2793 — cron boot-replay accept vs consume', () => {
+  function replayMsg(fireMs: number, boot: number): InboundMessage {
+    // A fresh synthetic messageId/ts is minted every replay attempt; the
+    // stable identity is (schedule_index, replay_fire_ms).
+    return msg({
+      messageId: boot,
+      ts: boot,
+      user: 'cron',
+      userId: 0,
+      meta: { source: 'cron', schedule_index: '3', replay_fire_ms: String(fireMs) },
+    })
+  }
+
+  it('accepted-but-NOT-consumed replay survives a restart and re-fires', () => {
+    const fs = fakeFs()
+    // Boot 1: the gateway accepts the replay (put) but the session never
+    // came up, so it is never delivered → never acked.
+    createInboundSpool({ path: PATH, fs, log: () => {} }).put('a', replayMsg(1000, 111))
+    // Boot 2: a fresh gateway rehydrates from the durable log. The un-acked
+    // replay is STILL live, so the boot-replay path re-delivers it — the
+    // silent-loss window (accepted, never consumed) is closed.
+    const s2 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    const live = s2.liveEntries()
+    expect(live).toHaveLength(1)
+    expect(live[0]!.msg.meta?.replay_fire_ms).toBe('1000')
+  })
+
+  it('a CONSUMED replay (acked on delivery) does NOT re-fire on restart', () => {
+    const fs = fakeFs()
+    const s1 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    const m = replayMsg(1000, 111)
+    s1.put('a', m)
+    s1.ack(m) // gateway delivered it to a live bridge → tombstone
+    // A fresh gateway sees the tombstone and does not re-deliver — the
+    // double-fire window is closed for a consumed replay.
+    const s2 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(s2.liveEntries()).toHaveLength(0)
+  })
+
+  it('a re-replay of the SAME missed fire dedups (at-least-once with dedup)', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    // First accept.
+    expect(s.put('a', replayMsg(1000, 111))).toBe(true)
+    // The scheduler re-replays the same missed fire on a later boot (fresh
+    // messageId/ts) while the first is still un-acked → collapses to one.
+    expect(s.put('a', replayMsg(1000, 222))).toBe(false)
+    expect(s.liveCount()).toBe(1)
+  })
+
+  it('distinct missed fires are each retained (no cross-fire collapse)', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(s.put('a', replayMsg(1000, 111))).toBe(true)
+    expect(s.put('a', replayMsg(2000, 222))).toBe(true)
+    expect(s.liveCount()).toBe(2)
+  })
+})