switchroom 0.17.6 → 0.18.3

package/telegram-plugin/tests/activity-card-wiring.test.ts

@@ -0,0 +1,88 @@
+/**
+ * Activity-card durability WIRING (deterministic-turn-liveness.md Known Gap 1 +
+ * the #2895 review fix). The 20 behavioural tests in activity-card-store.test.ts
+ * drive the pure store/reaper in ISOLATION — they prove the routine is correct
+ * but say nothing about whether the GATEWAY actually calls it. That is exactly
+ * the decision-vs-delivery gap the whole RFC exists to close, applied to its own
+ * follow-up: a refactor that drops the `writeActivityCardRecord` call on card
+ * open would keep every store test green while silently un-delivering the
+ * guarantee.
+ *
+ * The gateway IIFE can't be instantiated in-process (same constraint as
+ * silence-liveness-wiring.test.ts / multitopic-routing-wiring.test.ts), so these
+ * are STRUCTURAL assertions that pin the three load-bearing call sites. They
+ * COMPLEMENT (never replace) the behavioural store tests — the RFC's "structural
+ * grep may not be the SOLE coverage" bar is met because the outcome is proven at
+ * the routine level; this only guards the wiring the routine depends on.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
+
+function between(src: string, startMarker: string, endMarker: string): string {
+  const after = src.split(startMarker)[1] ?? ''
+  return after.split(endMarker)[0] ?? ''
+}
+
+describe('activity-card durability wiring', () => {
+  it('the card-OPEN path persists the durable handle (writeActivityCardRecord)', () => {
+    // The open branch runs when activityMessageId transitions null → set.
+    const openBranch = between(
+      gatewaySrc,
+      'if (turn.activityMessageId == null) {',
+      'turn.activityLastSentRender = target',
+    )
+    expect(openBranch.length).toBeGreaterThan(100)
+    expect(openBranch).toMatch(/writeActivityCardRecord\(/)
+    // Persist is gated on the feature flag, not unconditional.
+    expect(openBranch).toMatch(/activityCardPersistEnabled/)
+    // Pin honesty: the persisted RECORD mirrors the ACTUAL pin decision, never
+    // a bare `pinned: true` (the #2895 review fix). Scope the negative check to
+    // the writeActivityCardRecord argument block — the reconcileStatusPin call
+    // further down legitimately passes `{ pinned: true }` as the desired state.
+    const recordBlock = between(openBranch, 'writeActivityCardRecord(', 'void reconcileStatusPin(')
+    expect(recordBlock).toMatch(/pinned: PIN_STATUS_WHILE_WORKING/)
+    // Strip comment lines (the code comment legitimately quotes the old
+    // `pinned: true` shape it's warning against) before checking the CODE.
+    const recordCode = recordBlock
+      .split('\n')
+      .filter((l) => !l.trim().startsWith('//'))
+      .join('\n')
+    expect(recordCode).not.toMatch(/pinned: true/)
+  })
+
+  it('the normal-CLOSE path clears the durable handle, id-scoped (reap-race guard)', () => {
+    const closeBody = between(
+      gatewaySrc,
+      'const id = turn.activityMessageId\n    turn.activityMessageId = null',
+      'if (CLEAR_STATUS_ON_COMPLETION)',
+    )
+    expect(closeBody.length).toBeGreaterThan(50)
+    expect(closeBody).toMatch(/clearActivityCardRecord\(/)
+    // Must pass the id so it only drops THIS card's row (not a fresher upsert).
+    expect(closeBody).toMatch(/\n\s*id,\s*\n/)
+  })
+
+  it('the boot reaper runs ONLY after the startup mutex is won (never at import time)', () => {
+    // Both invocation sites (mutex-won + mutex-fallback) sit AFTER
+    // acquireStartupLock, alongside statusPinBootCleanup.
+    const afterLock = between(gatewaySrc, 'await acquireStartupLock({', 'catch (err)')
+    expect(afterLock).toMatch(/void activityCardBootReaper\(\)/)
+    // And it must NOT be invoked at module import time — the same losing-double-
+    // boot hazard the NOTE at statusPinBootCleanup documents.
+    const beforeMain = gatewaySrc.split('await acquireStartupLock({')[0] ?? ''
+    expect(beforeMain).not.toMatch(/^\s*void activityCardBootReaper\(\)/m)
+  })
+
+  it('the reaper wrapper counts a benign-400 as vanished, not finalized (honest boot log)', () => {
+    const wrapper = between(
+      gatewaySrc,
+      'async function activityCardBootReaper()',
+      '\n// NOTE: statusPinBootCleanup()',
+    )
+    expect(wrapper).toMatch(/vanished/)
+    expect(wrapper).toMatch(/at-most-once/)
+  })
+})

package/telegram-plugin/tests/auth-command-format2.test.ts

@@ -94,7 +94,7 @@ describe('renderShowText — Format 2 vs legacy', () => {
     expect(out).toContain('🔋 **Auth — fleet status**');
     expect(out).toContain('Recommendation:');
     // GFM table card (#2700): State emoji per row, not group headers.
-    expect(out).toContain('| State | Account | 5h | 7d | Status |');
+    expect(out).toContain('| State | Account | 5h | 5h resets | 7d | 7d resets |');
     expect(out).toContain('| 🔴 |'); // the blocked account's State cell
     expect(out).toContain('| 🟢 |'); // a healthy account's State cell
     expect(out).not.toContain('**BLOCKED**');

package/telegram-plugin/tests/auth-snapshot-format.test.ts

@@ -262,11 +262,13 @@ describe('renderAuthSnapshotFormat2', () => {
     return rows;
   }
 
-  it('renders a GFM table with the State/Account/5h/7d/Status header', () => {
+  it('renders a GFM table with the State/Account/5h/5h resets/7d/7d resets header', () => {
     const out = renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' });
     expect(out).toContain('🔋 **Auth — fleet status**');
-    expect(out).toContain('| State | Account | 5h | 7d | Status |');
-    expect(out).toContain('| --- | --- | --- | --- | --- |');
+    expect(out).toContain('| State | Account | 5h | 5h resets | 7d | 7d resets |');
+    expect(out).toContain('| --- | --- | --- | --- | --- | --- |');
+    // The single collapsed Status column is gone.
+    expect(out).not.toContain('| 7d | Status |');
     // No legacy group headers / health-section titles remain.
     expect(out).not.toContain('**BLOCKED**');
     expect(out).not.toContain('**HEALTHY**');
@@ -307,16 +309,22 @@ describe('renderAuthSnapshotFormat2', () => {
     expect(bob).toBeLessThan(alice);
   });
 
-  it('Status column shows "back <when>" for a blocked account', () => {
+  it('reset columns show a "<time> (in ...)" cell for a blocked account (7d binding window)', () => {
     const rows = tableRows(renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' }));
     const bob = rows.find((r) => r[1].includes('bob@example.com'))!;
-    expect(bob[4]).toMatch(/^back .* \(in .+\)$/);
+    // bob is 7d-maxed; its 7d reset (2026-05-17T10:00Z) is ~2 days out and still
+    // renders in its own reset cell — no "back" prefix in the new per-window shape.
+    expect(bob[5]).toMatch(/^.* \(in .+\)$/);
+    expect(bob[5]).not.toContain('back');
   });
 
-  it('Status column shows "refills <when>" for a healthy account', () => {
+  it('reset columns show a "<time> (in ...)" cell for each window of a healthy account', () => {
     const rows = tableRows(renderAuthSnapshotFormat2(fixtureSnaps, { now: NOW, tz: 'UTC' }));
     const you = rows.find((r) => r[1].includes('you@example.com'))!;
-    expect(you[4]).toMatch(/^refills .* \(in .+\)$/);
+    // 5h resets cell [3] and 7d resets cell [5] both carry a relative hint.
+    expect(you[3]).toMatch(/^.* \(in .+\)$/);
+    expect(you[5]).toMatch(/^.* \(in .+\)$/);
+    expect(you[3]).not.toContain('refills');
   });
 
   it('NEVER displays a percentage over 100% even on an over-cap account', () => {
@@ -330,13 +338,15 @@ describe('renderAuthSnapshotFormat2', () => {
     ];
     const rows = tableRows(renderAuthSnapshotFormat2(overSnaps, { now: NOW, tz: 'UTC' }));
     expect(rows[0][2]).toBe('100%'); // 5h
-    expect(rows[0][3]).toBe('100%'); // 7d
-    // And the blocked state still surfaces via the emoji (🔴) + Status.
+    expect(rows[0][4]).toBe('100%'); // 7d
+    // And the blocked state still surfaces via the emoji (🔴). No resets known
+    // (fixture has no reset timestamps) → both reset cells degrade to "—".
     expect(rows[0][0]).toBe('🔴');
-    expect(rows[0][4]).toMatch(/^back/);
+    expect(rows[0][3]).toBe('—'); // 5h resets
+    expect(rows[0][5]).toBe('—'); // 7d resets
   });
 
-  it('renders dates in the Status column only when NOT today (user tz)', () => {
+  it('renders dates in the reset columns only when NOT today (user tz)', () => {
     // now = Fri 3:00 PM Melbourne. A reset later the SAME Melbourne day shows
     // time-only; a reset on the next day shows the weekday.
     const MEL = 'Australia/Melbourne';
@@ -349,8 +359,9 @@ describe('renderAuthSnapshotFormat2', () => {
       }) }),
     ];
     const todayRows = tableRows(renderAuthSnapshotFormat2(sameDay, { now: NOW_MEL, tz: MEL }));
-    expect(todayRows[0][4]).toContain('9:00 PM');
-    expect(todayRows[0][4]).not.toMatch(/Mon|Tue|Wed|Thu|Fri|Sat|Sun/);
+    // 5h resets cell [3] — same Melbourne day → time only.
+    expect(todayRows[0][3]).toContain('9:00 PM');
+    expect(todayRows[0][3]).not.toMatch(/Mon|Tue|Wed|Thu|Fri|Sat|Sun/);
 
     const nextDay = [
       snap({ label: 'tomorrow@example.com', isActive: true, quota: quota({
@@ -360,7 +371,8 @@ describe('renderAuthSnapshotFormat2', () => {
       }) }),
     ];
     const tomorrowRows = tableRows(renderAuthSnapshotFormat2(nextDay, { now: NOW_MEL, tz: MEL }));
-    expect(tomorrowRows[0][4]).toContain('Sat 1:00 AM');
+    // 5h resets cell [3] — next Melbourne day → weekday prefix.
+    expect(tomorrowRows[0][3]).toContain('Sat 1:00 AM');
   });
 
   it('emits a recommendation footer that names a healthy alternative when active is throttling', () => {
@@ -1120,14 +1132,16 @@ describe('#2494 — renderAuthSnapshotFormat2 row rendering (out_of_credits demo
     expect(allText).toContain('Switch fleet → carol@example.com');
   });
 
-  it('quota-exhausted row shows a 🔴 + "back <when>" Status, not "billing disabled"', () => {
+  it('quota-exhausted row shows a 🔴 + its 5h reset time in the reset cell, not "billing disabled"', () => {
     const futureReset = new Date(NOW.getTime() + 45 * 60_000);
     const out = renderAuthSnapshotFormat2(
       [snap({ label: 'ex@x', isActive: true, quota: quota({ fiveHourUtilizationPct: 100, fiveHourResetAt: futureReset }) })],
       { now: NOW },
     );
     expect(out).toContain('| 🔴 |');
-    expect(out).toMatch(/back .* \(in 45m\)/);
+    // The 5h reset (45m out) renders in its own reset cell — no "back" prefix.
+    expect(out).toMatch(/\(in 45m\)/);
+    expect(out).not.toContain('back ');
     expect(out).not.toContain('billing disabled');
     expect(out).not.toContain('overage off');
   });

package/telegram-plugin/tests/claude-code-event-contract.test.ts

@@ -137,6 +137,54 @@ describe('Claude Code event-stream contract (canary)', () => {
     ).toBe(false)
   })
 
+  it('CANARY (Fix 3 precondition): Task tool_use still projects {id, name, input} — the shape the foreground-sub-agent-tracking / post-answer-liveness-freeze fix keys "still dispatched" off of', () => {
+    // The Fix 3 gap-closer (turn-liveness-floor.ts `stillDispatched`) is only
+    // as good as `turn.foregroundSubAgents` staying populated for the
+    // lifetime of a real Task dispatch. That population is driven by THIS
+    // exact tool_use projection (toolName === 'Task') plus the matching
+    // tool_result closing it out — if a future Claude Code release renames
+    // `name`/`input`/`id` or nests them differently, the fix silently goes
+    // inert (stillDispatched always false, freeze regresses) rather than
+    // failing loudly. Pin the shape here so drift fails CI instead.
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        id: 'msg_task',
+        stop_reason: 'tool_use',
+        content: [
+          {
+            type: 'tool_use',
+            id: 'toolu_task_1',
+            name: 'Task',
+            input: { description: 'Investigate the freeze bug', subagent_type: 'worker' },
+          },
+        ],
+      },
+    })
+    const evs = projectTranscriptLine(line)
+    expect(evs).toEqual([
+      {
+        kind: 'tool_use',
+        toolName: 'Task',
+        toolUseId: 'toolu_task_1',
+        input: { description: 'Investigate the freeze bug', subagent_type: 'worker' },
+      },
+    ])
+    // The matching tool_result (Task returning) must still carry tool_use_id
+    // so the gateway can close out the foreground-sub-agent tracking entry.
+    const resultLine = JSON.stringify({
+      type: 'user',
+      message: { content: [{ type: 'tool_result', tool_use_id: 'toolu_task_1', is_error: false, content: 'done' }] },
+    })
+    const resultEvs = projectTranscriptLine(resultLine)
+    expect(resultEvs).toHaveLength(1)
+    // `is_error: false` projects to `isError: undefined` (only `true` is
+    // ever stamped — see session-tail.ts's `c.is_error === true ? true :
+    // undefined`), so assert the falsy/absent form, not a literal `false`.
+    expect(resultEvs[0]).toMatchObject({ kind: 'tool_result', toolUseId: 'toolu_task_1' })
+    expect((resultEvs[0] as { isError?: boolean }).isError).toBeFalsy()
+  })
+
   it('sub-agent kickoff: first user message string prompt fires sub_agent_started', () => {
     const st = { hasEmittedStart: false }
     const line = JSON.stringify({

package/telegram-plugin/tests/consolidation-legibility.test.ts

@@ -0,0 +1,224 @@
+import { describe, it, expect } from 'vitest'
+import {
+  isConsolidationLegibilityEnabled,
+  detectConsolidationEvent,
+  renderConsolidationLine,
+  consolidationSignature,
+  ConsolidationRateLimiter,
+  HINDSIGHT_WEBHOOK_SOURCE,
+  CONSOLIDATION_COMPLETED_EVENT,
+} from '../consolidation-legibility.js'
+
+describe('isConsolidationLegibilityEnabled — OPT-IN (default OFF)', () => {
+  it('is OFF when unset (opposite of the default-ON tool-observation path)', () => {
+    expect(isConsolidationLegibilityEnabled(undefined)).toBe(false)
+  })
+  it('is OFF for the empty string and for "0"/"false"/"off"', () => {
+    expect(isConsolidationLegibilityEnabled('')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('0')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('false')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('off')).toBe(false)
+    expect(isConsolidationLegibilityEnabled('no')).toBe(false)
+  })
+  it('is ON only for an explicit truthy opt-in', () => {
+    expect(isConsolidationLegibilityEnabled('1')).toBe(true)
+    expect(isConsolidationLegibilityEnabled('true')).toBe(true)
+    expect(isConsolidationLegibilityEnabled('on')).toBe(true)
+    expect(isConsolidationLegibilityEnabled('yes')).toBe(true)
+    expect(isConsolidationLegibilityEnabled(' TRUE ')).toBe(true)
+  })
+})
+
+describe('wire constants', () => {
+  it('names the hindsight consolidation.completed source/event', () => {
+    expect(HINDSIGHT_WEBHOOK_SOURCE).toBe('hindsight')
+    expect(CONSOLIDATION_COMPLETED_EVENT).toBe('consolidation.completed')
+  })
+})
+
+describe('detectConsolidationEvent — MATERIAL-only (sparse)', () => {
+  it('returns null on a routine no-op consolidation (nothing stored/corrected)', () => {
+    expect(detectConsolidationEvent({ stored: 0, corrected: 0 })).toBeNull()
+    expect(detectConsolidationEvent({})).toBeNull()
+    expect(detectConsolidationEvent(undefined)).toBeNull()
+  })
+
+  it('classifies a pure store as "updated"', () => {
+    const ev = detectConsolidationEvent({ stored: 2, subject: 'your deploy preferences' })
+    expect(ev).toEqual({ kind: 'updated', topic: 'your deploy preferences' })
+  })
+
+  it('classifies any correction as "revised" (higher signal), even alongside stores', () => {
+    expect(detectConsolidationEvent({ corrected: 1, subject: 'old runbook' })).toEqual({
+      kind: 'revised',
+      topic: 'old runbook',
+    })
+    expect(detectConsolidationEvent({ stored: 3, corrected: 1, subject: 'X' })).toEqual({
+      kind: 'revised',
+      topic: 'X',
+    })
+  })
+
+  it('tolerates field aliases (created/added/new_observations; invalidated/superseded)', () => {
+    expect(detectConsolidationEvent({ created: 1, topic: 'a' })?.kind).toBe('updated')
+    expect(detectConsolidationEvent({ new_observations: 5, topic: 'a' })?.kind).toBe('updated')
+    expect(detectConsolidationEvent({ invalidated: 2, topic: 'a' })?.kind).toBe('revised')
+    expect(detectConsolidationEvent({ superseded: 1, topic: 'a' })?.kind).toBe('revised')
+  })
+
+  it('counts an observations array by length as a store', () => {
+    const ev = detectConsolidationEvent({
+      observations: [{ statement: 'User prefers TS', subject: 'coding style' }],
+    })
+    expect(ev).toEqual({ kind: 'updated', topic: 'coding style' })
+  })
+
+  it('accepts numeric-string counts', () => {
+    expect(detectConsolidationEvent({ stored: '2', subject: 'x' })?.kind).toBe('updated')
+  })
+
+  it('derives topic from subjects[]/entities[] arrays when no direct subject', () => {
+    expect(detectConsolidationEvent({ stored: 1, subjects: ['travel plans'] })?.topic).toBe(
+      'travel plans',
+    )
+    expect(
+      detectConsolidationEvent({ stored: 1, entities: [{ name: 'Acme Corp' }] })?.topic,
+    ).toBe('Acme Corp')
+  })
+
+  it('falls back to the first observation statement when no subject', () => {
+    const ev = detectConsolidationEvent({
+      observations: [{ statement: 'The user lives in Sydney' }],
+    })
+    expect(ev?.topic).toBe('The user lives in Sydney')
+  })
+
+  it('leaves topic empty when the payload carries no legible subject', () => {
+    expect(detectConsolidationEvent({ stored: 1, bank_id: 'agent-x' })?.topic).toBe('')
+  })
+})
+
+describe('renderConsolidationLine — terse, HTML, notification-free surface', () => {
+  it('renders the updated line with a subject', () => {
+    expect(renderConsolidationLine({ kind: 'updated', topic: 'your deploy preferences' })).toBe(
+      '🧠 <i>updated what I know</i> about "your deploy preferences"',
+    )
+  })
+  it('renders the revised line with a subject', () => {
+    expect(renderConsolidationLine({ kind: 'revised', topic: 'the old runbook' })).toBe(
+      '🧠 <i>revised what I know</i> about "the old runbook"',
+    )
+  })
+  it('falls back to a bare line when there is no legible subject', () => {
+    expect(renderConsolidationLine({ kind: 'updated', topic: '' })).toBe(
+      '🧠 <i>updated what I know about you.</i>',
+    )
+    expect(renderConsolidationLine({ kind: 'revised', topic: '   ' })).toBe(
+      '🧠 <i>revised what I know about you.</i>',
+    )
+  })
+  it('HTML-escapes the subject (no entity injection)', () => {
+    expect(renderConsolidationLine({ kind: 'updated', topic: 'a <b> & c' })).toBe(
+      '🧠 <i>updated what I know</i> about "a &lt;b&gt; &amp; c"',
+    )
+  })
+  it('truncates a very long subject', () => {
+    const long = 'x'.repeat(500)
+    const out = renderConsolidationLine({ kind: 'updated', topic: long })
+    expect(out.length).toBeLessThan(200)
+    expect(out).toContain('…')
+  })
+})
+
+describe('ConsolidationRateLimiter — sparse / non-spammy', () => {
+  it('allows the first line, then blocks a second within the min-interval', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, now: () => t })
+    expect(rl.allow('klanker', 'updated:a')).toBe(true)
+    t += 60_000 // 1 min later
+    expect(rl.allow('klanker', 'updated:b')).toBe(false) // different topic, still capped
+  })
+
+  it('allows again once the min-interval has elapsed', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, now: () => t })
+    expect(rl.allow('klanker', 'updated:a')).toBe(true)
+    t += 600_001
+    expect(rl.allow('klanker', 'updated:b')).toBe(true)
+  })
+
+  it('suppresses an IDENTICAL signature across the dedup window even after the interval', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({
+      minIntervalMs: 600_000,
+      dedupWindowMs: 3_600_000,
+      now: () => t,
+    })
+    expect(rl.allow('klanker', 'updated:deploy')).toBe(true)
+    t += 700_000 // past min-interval…
+    expect(rl.allow('klanker', 'updated:deploy')).toBe(false) // …but same topic, still deduped
+    t += 3_600_000 // past dedup window
+    expect(rl.allow('klanker', 'updated:deploy')).toBe(true)
+  })
+
+  it('rate-limits per agent independently', () => {
+    let t = 1_000_000
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, now: () => t })
+    expect(rl.allow('klanker', 'updated:a')).toBe(true)
+    expect(rl.allow('reggie', 'updated:a')).toBe(true) // different agent, own budget
+  })
+
+  it('accepts an explicit now override per call', () => {
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000 })
+    expect(rl.allow('klanker', 'updated:a', 0)).toBe(true)
+    expect(rl.allow('klanker', 'updated:a', 100)).toBe(false)
+    expect(rl.allow('klanker', 'updated:a', 700_000)).toBe(false) // dedup window
+    expect(rl.allow('klanker', 'updated:b', 700_000)).toBe(true) // new topic past interval
+  })
+
+  // Regression: the gateway caller (surfaceConsolidationLegibility) MUST pass
+  // Date.now() as the clock, never a payload-derived rec.ts. This test proves
+  // WHY: a spoofed/stale timestamp from the webhook payload poisons the
+  // per-agent min-interval gate. A far-FUTURE payload ts leaves the stored
+  // last-surface time in the future, so a genuine later wall-clock surface
+  // reads as "in the past" and the gate stays jammed shut; a far-PAST ts makes
+  // every subsequent surface look older than the window and the gate never
+  // engages (spam). Feeding wall-clock avoids both.
+  it('a payload-derived far-future timestamp would jam the interval gate shut', () => {
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, dedupWindowMs: 0 })
+    const wallNow = 1_000_000
+    const spoofedFuture = wallNow + 10 * 365 * 24 * 3_600_000 // ~10y ahead
+    // First surface stamped with the attacker's future ts.
+    expect(rl.allow('klanker', 'updated:a', spoofedFuture)).toBe(true)
+    // A genuine later surface (real wall-clock) is now "before" the stored
+    // last time → interval never elapses → legitimate surface suppressed.
+    expect(rl.allow('klanker', 'updated:b', wallNow + 700_000)).toBe(false)
+  })
+
+  it('a payload-derived timestamp lets a spoofer defeat the interval gate (spam)', () => {
+    // Two events arrive ~1ms apart in REALITY, but each carries a payload ts
+    // inflated to appear far apart. Keyed on payload ts, the gate sees them as
+    // past the interval and lets BOTH through — spam.
+    const rl = new ConsolidationRateLimiter({ minIntervalMs: 600_000, dedupWindowMs: 0 })
+    expect(rl.allow('klanker', 'updated:a', 0)).toBe(true)
+    expect(rl.allow('klanker', 'updated:b', 700_000)).toBe(true) // spoofed far-apart ts → not blocked
+    // Wall-clock (what the fix passes) blocks the same two events 1ms apart.
+    const rl2 = new ConsolidationRateLimiter({ minIntervalMs: 600_000, dedupWindowMs: 0 })
+    const wallNow = 1_000_000_000
+    expect(rl2.allow('klanker', 'updated:a', wallNow)).toBe(true)
+    expect(rl2.allow('klanker', 'updated:b', wallNow + 1)).toBe(false)
+  })
+})
+
+describe('consolidationSignature — stable dedup key', () => {
+  it('normalises whitespace + case so trivially-different topics collapse', () => {
+    expect(consolidationSignature({ kind: 'updated', topic: '  Deploy   Prefs ' })).toBe(
+      'updated:deploy prefs',
+    )
+  })
+  it('separates kind so a store and a correction of the same topic differ', () => {
+    expect(consolidationSignature({ kind: 'updated', topic: 'x' })).not.toBe(
+      consolidationSignature({ kind: 'revised', topic: 'x' }),
+    )
+  })
+})

package/telegram-plugin/tests/emission-authority-facade.test.ts

@@ -315,7 +315,7 @@ describe('façade delegates to the existing emission primitives (call-site liter
   })
 })
 
-describe('the 7 drain sites route through the façade with producers preserved verbatim', () => {
+describe('the drain sites route through the façade with producers preserved verbatim', () => {
   it('the narrative SHOW site routes via openOrEditCard("narrative") + the producer-"narrative" drain', () => {
     const body = fnSrc('showNarrativeStep')
     expect(body).toMatch(/openOrEditCard\('narrative'/)
@@ -325,26 +325,30 @@ describe('the 7 drain sites route through the façade with producers preserved v
     expect(body).toMatch(/ea\.mayDrain\(turn\)/)
   })
 
-  it('both liveness sites route via openOrEditCard("liveness") + producer-"liveness" drains (one in openLivenessFeedIfDue, one in feedHeartbeatTick)', () => {
+  it('all liveness sites route via openOrEditCard("liveness") + producer-"liveness" drains (one in openLivenessFeedIfDue, two in feedHeartbeatTick)', () => {
     // The early-card-open refactor extracted the 0-tool liveness OPEN out of
     // feedHeartbeatTick into the shared `openLivenessFeedIfDue` helper (so the
     // 6 s heartbeat and the enqueue-time early-open timer reach ONE open path
-    // and never double-open). So the two liveness sites now live in:
-    //   - openLivenessFeedIfDue: the 0-tool early-open / climb;
-    //   - feedHeartbeatTick:     the labelled-feed stale-step maintain.
-    // Both must still route via the façade with the producer arg verbatim.
+    // and never double-open). deterministic-turn-liveness.md Phase 1 then added
+    // the 0-label CLIMB of an already-open card back into feedHeartbeatTick (an
+    // EDIT, never an OPEN — so it does not double-open). So the liveness sites now
+    // live in:
+    //   - openLivenessFeedIfDue: the 0-tool early-OPEN;
+    //   - feedHeartbeatTick:     the 0-label CLIMB of an already-open card
+    //                            (Phase 1) + the labelled-feed stale-step maintain.
+    // All must still route via the façade with the producer arg verbatim.
     const earlyOpen = fnSrc('openLivenessFeedIfDue')
     const heartbeat = fnSrc('feedHeartbeatTick')
     const opens = [
       ...earlyOpen.matchAll(/openOrEditCard\('liveness'/g),
       ...heartbeat.matchAll(/openOrEditCard\('liveness'/g),
     ]
-    expect(opens).toHaveLength(2)
+    expect(opens).toHaveLength(3)
     const drains = [
       ...earlyOpen.matchAll(/drainActivitySummary\(turn,\s*'liveness'\)/g),
       ...heartbeat.matchAll(/drainActivitySummary\(turn,\s*'liveness'\)/g),
     ]
-    expect(drains).toHaveLength(2)
+    expect(drains).toHaveLength(3)
     // The literal the feed-heartbeat oracle greps must still be present in both.
     expect(earlyOpen).toMatch(/turn\.activityInFlight = drainActivitySummary/)
     expect(heartbeat).toMatch(/turn\.activityInFlight = drainActivitySummary/)
@@ -366,8 +370,14 @@ describe('the 7 drain sites route through the façade with producers preserved v
 
   it('every routed drain site guards the single-flight via ea.mayDrain(turn), not a bare activityInFlight read', () => {
     const mayDrainGuards = [...gatewaySrc.matchAll(/if \(ea\.mayDrain\(turn\)\)/g)]
-    // narrative + 2 liveness + tool + 2 sub-agent + 1 post-answer bg-liveness (Fix 2) = 7.
+    // narrative + 2 liveness + tool + 2 sub-agent + 1 post-answer bg-liveness
+    // (Fix 2) = 7. The Phase-1 0-label climb (deterministic-turn-liveness.md)
+    // consults the SAME guard, but its `if (deps.mayDrain())` lives in the
+    // extracted tick body (feed-heartbeat-climb.ts) with `() => ea.mayDrain(turn)`
+    // injected at the gateway call site — pinned by
+    // feed-heartbeat-liveness-open.test.ts + silent-turn-climb-transport.test.ts.
     expect(mayDrainGuards).toHaveLength(7)
+    expect(gatewaySrc).toMatch(/mayDrain:\s*\(\)\s*=>\s*ea\.mayDrain\(turn\)/)
   })
 })
 
@@ -487,11 +497,16 @@ describe('mayDrainCardNow — PR-4d card-drain gate (pure read; gateway holds th
     expect(ctxFn).toMatch(/turnInFlight:\s*turnInFlightForGate\(\)/)
   })
 
-  it('the 7 card-drain sites each route their guarded block through cardDrainGate (single-flight gate stays byte-identical)', () => {
+  it('the card-drain sites each route their guarded block through cardDrainGate (single-flight gate stays byte-identical)', () => {
     // Option A: the 7 `if (ea.mayDrain(turn))` guards + drainActivitySummary
     // thunks stay byte-identical, wrapped by the centralized helper.
     // 6 original + 1 new post-answer background-agent liveness drain (Fix 2).
     const wraps = [...gatewaySrc.matchAll(/cardDrainGate\(turn, ea, \(\) => \{/g)]
     expect(wraps).toHaveLength(7)
+    // The Phase-1 0-label climb (deterministic-turn-liveness.md) routes through
+    // the SAME helper via an injected thunk — its call lives in the extracted
+    // tick body (feed-heartbeat-climb.ts), wired at the gateway call site as
+    // `cardDrainGate: (run) => cardDrainGate(turn, ea, run)`.
+    expect(gatewaySrc).toMatch(/cardDrainGate:\s*\(run\)\s*=>\s*cardDrainGate\(turn, ea, run\)/)
   })
 })

package/telegram-plugin/tests/feed-heartbeat-liveness-open.test.ts

@@ -25,9 +25,12 @@
  *      `openLivenessFeedIfDue` BEFORE the drain — a turn that hasn't passed the
  *      threshold, or one whose card is already open, returns early (no
  *      double-open).
- *   4. The 0-tool branch of `feedHeartbeatTick` delegates to that one shared
- *      helper rather than inlining the open — so the heartbeat and the
- *      enqueue-time timer can never double-open.
+ *   4. The 0-tool branch of `feedHeartbeatTick` OPENS via that one shared helper
+ *      (so the heartbeat and the enqueue-time timer can never double-open) AND,
+ *      once a card is open, CLIMBS it every tick via `silentTurnClimbRender`
+ *      (deterministic-turn-liveness.md Phase 1) — the freeze this test used to
+ *      enshrine is inverted. The outcome-based proof is the transport test
+ *      `silent-turn-climb-transport.test.ts`.
  *
  * These are STRUCTURAL (source-read) assertions; the gateway IIFE can't be
  * instantiated in-process. Pattern matches silence-liveness-wiring.test.ts.
@@ -71,17 +74,38 @@ describe('H-1: feedHeartbeatTick liveness-open threshold', () => {
     expect(initBlock).toMatch(/1[_]?200/)
   })
 
-  it('the 0-tool liveness branch delegates to the shared openLivenessFeedIfDue helper', () => {
-    // The open logic lives in ONE place so the heartbeat and the enqueue-time
-    // early-open timer cannot double-open. The 0-tool branch must call the
-    // shared helper rather than inline its own open.
+  it('the 0-label tick routes through the REAL extracted tick body with the gateway deps wired verbatim', () => {
+    // deterministic-turn-liveness.md Phase 1 + Phase 4(d): the prior version of
+    // this test enshrined the freeze — it asserted only that the branch delegates
+    // to `openLivenessFeedIfDue` (which no-ops once a card is open), which is
+    // exactly why a busy-but-silent 0-label card used to freeze. The property is
+    // now INVERTED: the 0-label tick must route through the extracted
+    // `runSilentTurnHeartbeatTick` (feed-heartbeat-climb.ts) — the shipped tick
+    // body that CLIMBS an already-open card — with the gateway's REAL deps
+    // (the shared OPEN helper, cardDrainGate, ea.mayDrain,
+    // ea.openOrEditCard('liveness'), the 'liveness' drain) wired at the call
+    // site. Removing or mis-wiring this call site fails HERE; the tick body's
+    // behaviour is proven outcome-based in
+    // tests/silent-turn-climb-transport.test.ts (>=4 climbing edits across a
+    // 40s silent tool, edit-only, gate sequence in order).
     const body = feedHeartbeatTickSrc()
-    const start = body.indexOf('if (turn.mirrorLines.length === 0)')
+    const start = body.indexOf('runSilentTurnHeartbeatTick(')
     expect(start).toBeGreaterThan(-1)
     const branch = body.slice(start)
     const end = branch.indexOf('// Labelled-feed heartbeat')
     const scoped = end === -1 ? branch : branch.slice(0, end)
-    expect(scoped).toMatch(/openLivenessFeedIfDue\(turn\)/)
+    // The real deps, wired verbatim at the call site:
+    expect(scoped).toMatch(/openLivenessFeedIfDue:\s*\(\)\s*=>\s*openLivenessFeedIfDue\(turn\)/)
+    expect(scoped).toMatch(/setPendingRender:\s*\(rendered\)\s*=>\s*\{\s*turn\.activityPendingRender = rendered\s*\}/)
+    expect(scoped).toMatch(/cardDrainGate:\s*\(run\)\s*=>\s*cardDrainGate\(turn, ea, run\)/)
+    expect(scoped).toMatch(/mayDrain:\s*\(\)\s*=>\s*ea\.mayDrain\(turn\)/)
+    expect(scoped).toMatch(/openOrEditCard:\s*\(apply\)\s*=>\s*ea\.openOrEditCard\('liveness', apply\)/)
+    expect(scoped).toMatch(/drain:\s*\(\)\s*=>\s*\{\s*turn\.activityInFlight = drainActivitySummary\(turn, 'liveness'\)\s*\}/)
+    // The view carries the wall-clock elapsed + the labelled branch's stale floor.
+    expect(scoped).toMatch(/ageMs:\s*Date\.now\(\)\s*-\s*turn\.startedAt/)
+    expect(scoped).toMatch(/minStaleMs:\s*FEED_HEARTBEAT_MIN_STALE_MS/)
+    // A handled tick (0-label branch) stops before the labelled heartbeat.
+    expect(scoped).toMatch(/if \(handled\) return/)
   })
 
   it('the WHEN-gate (shouldEarlyOpenLiveness) precedes the drain call inside openLivenessFeedIfDue', () => {
@@ -129,6 +153,17 @@ describe('H-2: feedHeartbeatTick post-answer background-agent liveness (Fix 2 /
     expect(postAnswerBlock).toMatch(/livenessVerdict\s*!==\s*'emit'/)
   })
 
+  it('Fix 3: post-answer branch feeds stillDispatched from turn.foregroundSubAgents so a tracked foreground sub-agent bypasses the staleness cap', () => {
+    const body = feedHeartbeatTickSrc()
+    const afterPostAnswer = body.split('if (turn.finalAnswerDelivered)')[1] ?? ''
+    const postAnswerBlock = afterPostAnswer.split('\n  }\n')[0] ?? ''
+    // A positive foreground-tracking signal must be computed and threaded
+    // into the pure decision — this is what stops the card freezing mid-
+    // delegation while a foreground Task/Agent is still outstanding.
+    expect(postAnswerBlock).toMatch(/stillDispatched\s*=\s*turn\.foregroundSubAgents\.size\s*>\s*0/)
+    expect(postAnswerBlock).toMatch(/stillDispatched,/)
+  })
+
   it('staleness cap (concern 3) is parsed default-ON (30s) from SWITCHROOM_POST_ANSWER_LIVENESS_STALE_MS', () => {
     // The cap const must default to 30_000 when the env is unset (the `|| 30_000`
     // fallback over the positive-or-0 parse) so the post-answer card stops