switchroom 0.17.6 → 0.18.3

package/telegram-plugin/tests/feed-survival.test.ts

@@ -47,6 +47,8 @@ import { ToolFlightTracker } from '../gateway/interrupt-defer.js'
 import {
   ORPHANED_REPLY_TIMEOUT_MS,
   ORPHANED_REPLY_MAX_REARMS,
+  ORPHANED_REPLY_STREAM_WINDOW_MS,
+  LivenessTracker,
 } from '../context-exhaustion.js'
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -524,3 +526,40 @@ describe('silence-poke — hard ceiling bounds the defer', () => {
     expect(__getStateForTests('chat:0')!.fallbackFired).toBe(true)
   })
 })
+
+// ─── Thinking-pause liveness via the REAL LivenessTracker (orphaned-reply fix) ─
+
+describe('silence-poke — thinking-pause liveness via the real LivenessTracker', () => {
+  // Drives the REAL LivenessTracker as the isLegitimatelyWorking source: a
+  // genuine stream event within ORPHANED_REPLY_STREAM_WINDOW_MS keeps the feed
+  // alive (a model reasoning pause is survivable); a gap longer than the window
+  // with no work tears the feed down.
+  it('a stream event within the window keeps the feed alive (thinking-pause survivable)', () => {
+    let clockNow = 0
+    const tracker = new LivenessTracker(0)
+    const f = setupSilenceDeps({
+      thresholds: { fallback: 300_000, fallbackHardCeiling: 900_000 },
+      isLegitimatelyWorking: () => tracker.recentlyStreaming(clockNow, ORPHANED_REPLY_STREAM_WINDOW_MS),
+    })
+    startTurn('chat:0', 0)
+    // A genuine stream event lands mid-turn (e.g. the model resumes after a
+    // reasoning pause) — only 50s before the 300s fallback tick.
+    tracker.onStreamEvent('text', undefined, 250_000)
+    clockNow = 300_000
+    __tickForTests(300_000) // 50s since last stream < 120s window → deferred
+    expect(f.fallbacks).toHaveLength(0)
+  })
+
+  it('no stream event for longer than the window tears the feed down', () => {
+    let clockNow = 0
+    const tracker = new LivenessTracker(0) // seed at t=0, nothing after
+    const f = setupSilenceDeps({
+      thresholds: { fallback: 300_000, fallbackHardCeiling: 900_000 },
+      isLegitimatelyWorking: () => tracker.recentlyStreaming(clockNow, ORPHANED_REPLY_STREAM_WINDOW_MS),
+    })
+    startTurn('chat:0', 0)
+    clockNow = 300_000
+    __tickForTests(300_000) // 300s since last stream >> 120s window → fires
+    expect(f.fallbacks).toHaveLength(1)
+  })
+})

package/telegram-plugin/tests/gateway-boot-marker-clear.test.ts

@@ -43,7 +43,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // window to ~5KB so we don't pick up the unrelated
     // `removeTurnActiveMarker` call in the onTurnComplete handler
     // way down at the bottom of the file.
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 5000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
     const clearMatches = setupWindow.match(/removeTurnActiveMarker\s*\(\s*STATE_DIR\s*\)/g) ?? []
     expect(clearMatches.length).toBe(1)
   })
@@ -53,7 +53,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // must not prevent the gateway from coming up. Pin the try-wrapping
     // to make sure a future refactor doesn't drop it.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 5000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
     expect(setupWindow).toMatch(/try\s*\{\s*removeTurnActiveMarker\(STATE_DIR\)\s*\}\s*catch/)
   })
 
@@ -62,7 +62,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // Clearing the marker first means the watchdog sees a clean slate
     // immediately, even if pin sweep takes 30s+ to finish.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 5000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
     const clearIdx = setupWindow.indexOf('removeTurnActiveMarker(STATE_DIR)')
     const pinSweepIdx = setupWindow.indexOf('Boot-time pin sweep')
     expect(clearIdx).toBeGreaterThan(0)

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Structural pins for the session-only model relaunch wiring in gateway.ts.
+ *
+ * The behaviour lives in un-exported inline closures (buildModelDeps's
+ * scheduleModelRelaunch, the model-menu callback sr-* branch, and the boot
+ * re-hydration / alert-sentinel block inside the startup IIFE), so — mirroring
+ * the other gateway-*.test.ts source-pins — we assert on the source structure.
+ * The end-to-end behaviour of the carrier itself is exercised in
+ * tests/scaffold.session-model-override.test.ts (rendered start.sh) and the
+ * handler contract in telegram-plugin/tests/model-command.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+describe('gateway: scheduleModelRelaunch dep', () => {
+  it('writes the carrier with exact "<model>\\n" bytes', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toMatch(/writeFileSync\(\s*join\(agentDir, '\.session-model-override'\),\s*`\$\{model\}\\n`/)
+  })
+
+  it('sets the in-memory activeSessionModelOverride before dispatching the restart', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const setIdx = win.indexOf('activeSessionModelOverride = model')
+    const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
+    expect(setIdx).toBeGreaterThan(0)
+    expect(restartIdx).toBeGreaterThan(setIdx)
+  })
+
+  it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toContain('await deps.scheduleRestart(reason)')
+  })
+})
+
+describe('gateway: model-menu sr-* target relaunches via the carrier', () => {
+  it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
+    const idx = GATEWAY_SRC.indexOf('if (data.startsWith(MODEL_CALLBACK_SR))')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1400)
+    expect(win).toContain('modelDeps.scheduleModelRelaunch(srName')
+    // It must return before falling through to handleModelMenuCallback (which
+    // would inject an sr-* id claude's picker rejects).
+    expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
+  })
+})
+
+describe('gateway boot: session-model re-hydration + LiteLLM-down alert', () => {
+  it('re-hydrates activeSessionModelOverride from .active-session-model', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx - 200, idx + 1400)
+    // Only an override when the launched model differs from the configured one.
+    expect(win).toMatch(/launched\.length > 0 && launched !== configured \? launched : null/)
+    // The configured value must be resolved through resolveMainModel (the SAME
+    // resolver start.sh's scaffold uses) so an unset/`default` model config does
+    // not get flagged as a phantom session override on an ordinary restart.
+    expect(win).toContain('resolveMainModel(raw ?? undefined)')
+  })
+
+  it('consumes the .session-model-alert sentinel, notifies ALL operators, and deletes it', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.session-model-alert')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1100)
+    expect(win).toContain('unlinkSync(alertPath)')
+    // Broadcasts to every operator in allowFrom, not just allowFrom[0].
+    expect(win).toContain('const operators = loadAccess().allowFrom')
+    expect(win).toContain('for (const operator of operators)')
+    expect(win).toContain('lockedBot.api')
+    expect(win).toContain('.sendMessage(operator')
+  })
+})

package/telegram-plugin/tests/inbound-emit-after-intercepts.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Structural pin: the delivery state machine's `inbound` event MUST be
+ * emitted from `handleInbound` only AFTER the intercept/early-return
+ * gauntlet — never eagerly at handler entry.
+ *
+ * The wedge this guards (overlord `/usage` went dead, 2026-07-08). The
+ * inbound emit drives the now-AUTHORITATIVE turn-in-flight gate
+ * (turnInFlightForGate → isMachineInTurn). When it fired at handler entry
+ * — before the permission-reply / `/auth` paste-back / interrupt-empty /
+ * secret-detect-drop intercepts — an intercepted message (e.g. an approval
+ * reply) drove the machine idle→`bridge_alive_in_turn`, then early-returned
+ * as an intercept: no delivery, no claudeBusyKeys mark, and critically no
+ * `turnEnd`. The machine held the gate closed until the 5-min TTL tick
+ * force-cleared it, buffering every inbound (including `/usage`) meanwhile —
+ * the dangerous `machine_over_holds` divergence gate-parity-probe.ts flags.
+ *
+ * The behaviour lives inside the un-exported `handleInbound` closure, so —
+ * mirroring the other gateway-*.test.ts source-pins — we assert on source
+ * structure: the single inbound `shadowEmit` must sit below the intercepts
+ * and carry the real `isSteering` classification. Machine self-heal + gate
+ * accessors are behaviour-tested in inbound-delivery-cutover-gate.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+/** Byte offset of the sole `shadowEmit({ kind: 'inbound' ... })` call. */
+function inboundEmitOffset(): number {
+  const m = GATEWAY_SRC.match(/shadowEmit\(\{\s*\n\s*kind:\s*'inbound'/)
+  expect(m, 'expected exactly one multi-line inbound shadowEmit').not.toBeNull()
+  const idx = GATEWAY_SRC.indexOf(m![0])
+  // There must be only ONE such emit — a second eager site would reintroduce
+  // the wedge.
+  const second = GATEWAY_SRC.indexOf(m![0], idx + 1)
+  expect(second, 'a second inbound shadowEmit would reintroduce the eager-emit wedge').toBe(-1)
+  return idx
+}
+
+describe('gateway: inbound machine-emit is deferred past the intercepts', () => {
+  it('carries the DEFERRED_INBOUND_EMIT marker so the intent is greppable', () => {
+    expect(GATEWAY_SRC).toContain('DEFERRED_INBOUND_EMIT')
+  })
+
+  it('emits the machine `inbound` event AFTER the permission-reply intercept', () => {
+    const emitIdx = inboundEmitOffset()
+    // The permission-reply intercept is one of the early-return paths that
+    // must NOT drive the machine into a turn.
+    const permIdx = GATEWAY_SRC.indexOf('const permMatch = PERMISSION_REPLY_RE.exec(text)')
+    expect(permIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(permIdx)
+  })
+
+  it('emits AFTER the `/auth add` paste-back intercept', () => {
+    const emitIdx = inboundEmitOffset()
+    const authIdx = GATEWAY_SRC.indexOf('pendingAuthAddFlows.get(interceptKey)')
+    expect(authIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(authIdx)
+  })
+
+  it('emits AFTER isSteering is classified, and passes the real value (not a hardcoded false)', () => {
+    const emitIdx = inboundEmitOffset()
+    const steerIdx = GATEWAY_SRC.indexOf('isSteering = priorTurnInFlight && isSteerPrefix')
+    expect(steerIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeGreaterThan(steerIdx)
+    // The emit's msg object must forward the live `isSteering` binding, so a
+    // mid-turn steer is not mis-modelled as a fresh turn.
+    const win = GATEWAY_SRC.slice(emitIdx, emitIdx + 260)
+    expect(win).toMatch(/msg:\s*\{[\s\S]*?\bisSteering,[\s\S]*?\}/)
+  })
+
+  it('emits BEFORE the deliver-or-buffer decision (reserveInboundDelivery)', () => {
+    const emitIdx = inboundEmitOffset()
+    const gateIdx = GATEWAY_SRC.indexOf('const deliveryGate = reserveInboundDelivery({')
+    expect(gateIdx).toBeGreaterThan(0)
+    expect(emitIdx).toBeLessThan(gateIdx)
+  })
+})

package/telegram-plugin/tests/inbound-spool.test.ts

@@ -99,6 +99,48 @@ describe('spoolId — stable dedup key', () => {
     )
     expect(a).not.toBe(b)
   })
+  // #2793 part B: a cron BOOT-REPLAY carries meta.replay_fire_ms (the
+  // minute-aligned fire being replayed). spoolId() keys on it + the
+  // schedule index so a re-replay of the SAME missed fire across a gateway
+  // restart — which mints a fresh synthetic messageId=ts each boot —
+  // collapses to one live entry instead of stacking a fresh one each boot.
+  it('cron boot-replay → s:cron-replay:chat:idx:fireMs, stable across ts/messageId', () => {
+    const a = spoolId(
+      msg({
+        messageId: 1700_000_000_000,
+        ts: 1700_000_000_000,
+        meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '1699999980000' },
+      }),
+    )
+    const b = spoolId(
+      msg({
+        messageId: 1700_000_999_999,
+        ts: 1700_000_999_999,
+        meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '1699999980000' },
+      }),
+    )
+    expect(a).toBe('s:cron-replay:c1:3:1699999980000')
+    expect(b).toBe(a) // stable across the fresh per-boot messageId/ts
+  })
+  it('cron boot-replays for distinct missed fires stay distinct', () => {
+    const a = spoolId(
+      msg({ messageId: 0, meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '100' } }),
+    )
+    const b = spoolId(
+      msg({ messageId: 0, meta: { source: 'cron', schedule_index: '3', replay_fire_ms: '200' } }),
+    )
+    const c = spoolId(
+      msg({ messageId: 0, meta: { source: 'cron', schedule_index: '4', replay_fire_ms: '100' } }),
+    )
+    expect(a).not.toBe(b) // different fire minute
+    expect(a).not.toBe(c) // different schedule index
+  })
+  it('a LIVE cron tick (no replay_fire_ms) keeps its per-fire identity', () => {
+    // Live ticks are not routed through the spool, but assert the id path
+    // is unchanged so live fires never collapse into a replay bucket.
+    const live = spoolId(msg({ messageId: 0, meta: { source: 'cron' }, ts: 500 }))
+    expect(live).toBe('s:c1:cron:500')
+  })
   it('subagent_handback without jsonl id falls back to legacy id (back-compat)', () => {
     const a = spoolId(
       msg({ messageId: 555, meta: { source: 'subagent_handback' }, ts: 100 }),
@@ -578,3 +620,66 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
     expect(events).toEqual([true, false]) // degraded → recovered
   })
 })
+
+// #2793 part B — cron boot-replay accept-vs-consume durability. A missed
+// scheduled fire re-injected at boot is routed through this spool by the
+// gateway's onInjectInbound handler (put on accept, ack on confirmed
+// delivery). These tests pin the two windows the ledger closes.
+describe('#2793 — cron boot-replay accept vs consume', () => {
+  function replayMsg(fireMs: number, boot: number): InboundMessage {
+    // A fresh synthetic messageId/ts is minted every replay attempt; the
+    // stable identity is (schedule_index, replay_fire_ms).
+    return msg({
+      messageId: boot,
+      ts: boot,
+      user: 'cron',
+      userId: 0,
+      meta: { source: 'cron', schedule_index: '3', replay_fire_ms: String(fireMs) },
+    })
+  }
+
+  it('accepted-but-NOT-consumed replay survives a restart and re-fires', () => {
+    const fs = fakeFs()
+    // Boot 1: the gateway accepts the replay (put) but the session never
+    // came up, so it is never delivered → never acked.
+    createInboundSpool({ path: PATH, fs, log: () => {} }).put('a', replayMsg(1000, 111))
+    // Boot 2: a fresh gateway rehydrates from the durable log. The un-acked
+    // replay is STILL live, so the boot-replay path re-delivers it — the
+    // silent-loss window (accepted, never consumed) is closed.
+    const s2 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    const live = s2.liveEntries()
+    expect(live).toHaveLength(1)
+    expect(live[0]!.msg.meta?.replay_fire_ms).toBe('1000')
+  })
+
+  it('a CONSUMED replay (acked on delivery) does NOT re-fire on restart', () => {
+    const fs = fakeFs()
+    const s1 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    const m = replayMsg(1000, 111)
+    s1.put('a', m)
+    s1.ack(m) // gateway delivered it to a live bridge → tombstone
+    // A fresh gateway sees the tombstone and does not re-deliver — the
+    // double-fire window is closed for a consumed replay.
+    const s2 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(s2.liveEntries()).toHaveLength(0)
+  })
+
+  it('a re-replay of the SAME missed fire dedups (at-least-once with dedup)', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    // First accept.
+    expect(s.put('a', replayMsg(1000, 111))).toBe(true)
+    // The scheduler re-replays the same missed fire on a later boot (fresh
+    // messageId/ts) while the first is still un-acked → collapses to one.
+    expect(s.put('a', replayMsg(1000, 222))).toBe(false)
+    expect(s.liveCount()).toBe(1)
+  })
+
+  it('distinct missed fires are each retained (no cross-fire collapse)', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(s.put('a', replayMsg(1000, 111))).toBe(true)
+    expect(s.put('a', replayMsg(2000, 222))).toBe(true)
+    expect(s.liveCount()).toBe(2)
+  })
+})

package/telegram-plugin/tests/liveness-tracker.test.ts

@@ -0,0 +1,228 @@
+/**
+ * liveness-tracker.test.ts — drives the REAL LivenessTracker (the testability
+ * seam of the orphaned-reply thinking-pause fix).
+ *
+ * Root cause being fixed: the orphaned-reply fuse (ORPHANED_REPLY_TIMEOUT_MS =
+ * 30 s) was reset ONLY by `tool_label` / `text` events. During a long model
+ * reasoning pause the gateway sees NO such events (thinking carries no text),
+ * so the fuse ran down and force-ended a genuinely-live turn mid-work.
+ *
+ * The fix stamps `lastStreamEventAt` on ANY genuine stream event; if a genuine
+ * event landed within `windowMs` (default 120 s) the turn is "recently
+ * streaming" and the fuse re-arms instead of firing. A genuine multi-minute
+ * hang (no events at all) still fires.
+ *
+ * These tests use the REAL class — no replica helpers.
+ *
+ * NOTE on onStreamEvent's signature: it is `(kind, durationMs, now)`. The
+ * tracker is time-only — it never reads text content (the "Prompt is too long"
+ * marker matters to the gateway's context-exhaustion detection, not to the
+ * tracker). Where the fix spec wrote `onStreamEvent('text','Prompt is too
+ * long',0)` we pass `undefined` as durationMs (it is not a turn_end).
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  LivenessTracker,
+  ORPHANED_REPLY_STREAM_WINDOW_MS,
+  ORPHANED_REPLY_TIMEOUT_MS,
+  ORPHANED_REPLY_MAX_REARMS,
+} from '../context-exhaustion.js'
+
+const W = ORPHANED_REPLY_STREAM_WINDOW_MS // 120_000
+const MAX = ORPHANED_REPLY_MAX_REARMS // 20
+const FUSE = ORPHANED_REPLY_TIMEOUT_MS // 30_000
+
+function expiry(
+  t: LivenessTracker,
+  now: number,
+  opts?: { working?: boolean; humanWaiting?: boolean },
+) {
+  return t.decideOnExpiry({
+    working: opts?.working ?? false,
+    humanWaiting: opts?.humanWaiting ?? false,
+    now,
+    windowMs: W,
+    maxRearms: MAX,
+  })
+}
+
+describe('LivenessTracker — pinned constants', () => {
+  it('window is 120 s and fuse tick is 30 s', () => {
+    expect(W).toBe(120_000)
+    expect(FUSE).toBe(30_000)
+    expect(MAX).toBe(20)
+  })
+})
+
+describe('T1 — thinking-pause survival', () => {
+  it('text→tool_use→tool_result then a 45s stream gap keeps re-arming (gap < window)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('text', undefined, 0)
+    t.onStreamEvent('tool_use', undefined, 1_000)
+    t.onStreamEvent('tool_result', undefined, 2_000)
+
+    // +30s past the last event (t=32s): recently streaming → re-arm.
+    const d1 = expiry(t, 32_000)
+    expect(d1).toEqual({ rearm: true, countsAgainstCap: true })
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    // +45s past the last event (t=47s): still within the 120s window → re-arm.
+    const d2 = expiry(t, 47_000)
+    expect(d2).toEqual({ rearm: true, countsAgainstCap: true })
+    expect(t.orphanedReplyRearmCount).toBe(2)
+  })
+
+  it('the next genuine stream event ZEROES the rearm counter and re-stamps liveness', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('tool_result', undefined, 2_000)
+    expiry(t, 32_000)
+    expiry(t, 47_000)
+    expect(t.orphanedReplyRearmCount).toBe(2)
+
+    t.onStreamEvent('tool_label', undefined, 48_000)
+    expect(t.orphanedReplyRearmCount).toBe(0)
+    expect(t.lastStreamEventAt).toBe(48_000)
+  })
+
+  it('a synthetic turn_end (durationMs === -1) does NOT stamp or reset (F4 boundary)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('tool_label', undefined, 48_000)
+    expiry(t, 60_000) // counter → 1
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    t.onStreamEvent('turn_end', -1, 70_000)
+    expect(t.lastStreamEventAt).toBe(48_000) // unchanged — synthetic excluded
+    expect(t.orphanedReplyRearmCount).toBe(1) // not reset
+
+    // A REAL turn_end (durationMs >= 0) DOES stamp — harmless, the turn is
+    // ending anyway (spec #3).
+    t.onStreamEvent('turn_end', 0, 71_000)
+    expect(t.lastStreamEventAt).toBe(71_000)
+    expect(t.orphanedReplyRearmCount).toBe(0)
+  })
+})
+
+describe('T2 — production repro (48s tool_result, 78s expiry)', () => {
+  it('text@0, tool_use@1s, tool_result@48s → expiry@78s re-arms (78-48=30 < 120)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('text', undefined, 0)
+    t.onStreamEvent('tool_use', undefined, 1_000)
+    t.onStreamEvent('tool_result', undefined, 48_000)
+
+    const d = expiry(t, 78_000)
+    expect(d.rearm).toBe(true)
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    // tool_label@80s zeroes the counter (progress observed).
+    t.onStreamEvent('tool_label', undefined, 80_000)
+    expect(t.orphanedReplyRearmCount).toBe(0)
+  })
+})
+
+describe('T3 — long active turn (A2: counter reset is load-bearing)', () => {
+  it('tool_label every 60s + expiry every 60s+30s NEVER fires across 15 min; counter never exceeds 1', () => {
+    const t = new LivenessTracker(0)
+    for (let k = 0; k < 15; k++) {
+      t.onStreamEvent('tool_label', undefined, k * 60_000) // progress → reset
+      const d = expiry(t, k * 60_000 + 30_000, { working: true })
+      expect(d.rearm).toBe(true) // never fires
+      expect(t.orphanedReplyRearmCount).toBeLessThanOrEqual(1)
+    }
+  })
+
+  it('WITHOUT the progress reset the SAME cadence hits cap=20 near t=600s (proves reset load-bearing)', () => {
+    const t = new LivenessTracker(0)
+    let firedAt = -1
+    for (let k = 1; k <= 25; k++) {
+      const now = k * 30_000
+      // working:true so it would re-arm indefinitely IF the counter didn't
+      // accumulate — but with no onStreamEvent reset it climbs to the cap.
+      const d = expiry(t, now, { working: true })
+      if (!d.rearm) {
+        firedAt = now
+        break
+      }
+    }
+    // 20th re-arm lands at t=600s; the 21st expiry (t=630s) fires at the cap.
+    expect(t.orphanedReplyRearmCount).toBe(MAX)
+    expect(firedAt).toBeGreaterThanOrEqual(600_000)
+  })
+})
+
+describe('T4 — genuine hang caught (no events at all)', () => {
+  it('tool_result@0 then silence: re-arms via recentlyStreaming @30/60/90s, FIRES @120s (window lapsed)', () => {
+    const t = new LivenessTracker(0)
+    t.onStreamEvent('tool_result', undefined, 0)
+
+    for (const now of [30_000, 60_000, 90_000]) {
+      const d = expiry(t, now) // working:false — kept alive only by recentlyStreaming
+      expect(d.rearm).toBe(true)
+    }
+
+    // t=120s: now - lastStreamEventAt = 120_000 >= window → not recently
+    // streaming, working false → fail-safe FIRE.
+    const d = expiry(t, 120_000)
+    expect(d).toEqual({ rearm: false, countsAgainstCap: false })
+  })
+})
+
+describe('T5 — context-exhaustion recovery COMPLETES (not suppressed forever)', () => {
+  it('a "Prompt is too long" text event stamps liveness; defensive-guard predicate is true@30s, false@>=120s', () => {
+    const t = new LivenessTracker(0)
+    // The marker is a genuine `text` event (content is not a tracker concern).
+    t.onStreamEvent('text', undefined, 0)
+
+    // Context exhaustion means no tool is in flight: working === false. The
+    // defensive-guard suppression predicate is `working || recentlyStreaming`.
+    const working = false
+
+    // @30s: recentlyStreaming true → synthetic turn_end is suppressed. This
+    // DOCUMENTS the accepted ~30s→~120s recovery-latency growth (F3).
+    expect(working || t.recentlyStreaming(30_000, W)).toBe(true)
+
+    // @120s: window lapsed → NOT suppressed → teardown COMPLETES.
+    expect(working || t.recentlyStreaming(120_000, W)).toBe(false)
+
+    // @150s: still not suppressed — recovery is delayed, never forever.
+    expect(working || t.recentlyStreaming(150_000, W)).toBe(false)
+  })
+})
+
+describe('T7 — cap semantics', () => {
+  it('interleaved expiry/genuine-event: count 1 → 0 → 1 → 2', () => {
+    const t = new LivenessTracker(0)
+
+    expect(expiry(t, 10_000).rearm).toBe(true)
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    t.onStreamEvent('tool_label', undefined, 11_000) // genuine event resets
+    expect(t.orphanedReplyRearmCount).toBe(0)
+
+    expiry(t, 20_000)
+    expect(t.orphanedReplyRearmCount).toBe(1)
+
+    expiry(t, 30_000) // consecutive silence (last event 11_000, gap 19s < 120s)
+    expect(t.orphanedReplyRearmCount).toBe(2)
+  })
+
+  it('21 consecutive recently-streaming expiries (no reset): 21st fires at the cap', () => {
+    const t = new LivenessTracker(0)
+    let last: { rearm: boolean; countsAgainstCap: boolean } | undefined
+    for (let k = 1; k <= 21; k++) {
+      // now = k*1000 keeps the gap from the seed (0) under the 120s window,
+      // so recentlyStreaming stays true throughout — the ONLY bound is the cap.
+      last = expiry(t, k * 1_000)
+    }
+    expect(last).toEqual({ rearm: false, countsAgainstCap: true })
+    expect(t.orphanedReplyRearmCount).toBe(MAX)
+
+    // humanWaiting past the cap → uncapped re-arm.
+    const dHuman = expiry(t, 22_000, { humanWaiting: true })
+    expect(dHuman).toEqual({ rearm: true, countsAgainstCap: false })
+
+    // recentlyStreaming false + working false + humanWaiting false → fail-safe FIRE.
+    const dFire = expiry(t, 200_000)
+    expect(dFire).toEqual({ rearm: false, countsAgainstCap: false })
+  })
+})