switchroom 0.18.14 → 0.18.17

package/telegram-plugin/tests/model-unavailable.test.ts

@@ -14,10 +14,52 @@ import { describe, it, expect } from 'vitest'
 import {
   detectModelUnavailable,
   formatModelUnavailableCard,
+  isLitellmProxyLocal429,
+  parseLitellmLimitDetail,
   resolveModelUnavailableFromOperatorEvent,
   type ModelUnavailableDetection,
 } from '../model-unavailable.js'
 
+// Real LiteLLM proxy-local 429 bodies, verbatim shapes from BerriAI/litellm
+// source (see the provenance comment on `litellmProxyLocal429Signals`).
+const LITELLM_DEPLOYMENT_CAP_BODY =
+  'Deployment over user-defined ratelimit. tpm limit=8000. current usage=8241. ' +
+  'id=abc123def, model_group=claude-fable-5'
+const LITELLM_DEPLOYMENT_CAP_MESSAGE =
+  'litellm.RateLimitError: Model rate limit exceeded. TPM limit=8000, current usage=8241'
+const LITELLM_V2_STRATEGY_BODY =
+  "Deployment over defined rpm limit=60. current usage=61. id=abc123def, " +
+  "model_group=claude-fable-5. Get the model info by calling 'router.get_model_info(id)"
+const LITELLM_ROUTER_COOLDOWN_BODY =
+  'No deployments available for selected model, Try again in 27.5 seconds. ' +
+  "Passed model=claude-fable-5. pre-call-checks=False, cooldown_list=['abc123def']"
+const LITELLM_V3_KEY_LIMIT_BODY =
+  'Rate limit exceeded for api_key: hashed-key-1a2b3c. Limit type: tokens. ' +
+  'Current limit: 8000, Remaining: 0. Limit resets at: 2026-07-12 08:05:00 UTC'
+// v1 shape A — the ProxyRateLimitError detail (parallel_request_limiter.py
+// ~line 124; the interpolated CommonProxyErrors.max_parallel_request_limit_
+// reached.value is "Crossed TPM / RPM / Max Parallel Request Limit").
+const LITELLM_V1_PARALLEL_BODY =
+  'LiteLLM Rate Limit Handler for rate limit type = requests. ' +
+  'Crossed TPM / RPM / Max Parallel Request Limit. ' +
+  'current rpm: 61, rpm limit: 60, current tpm: 100, tpm limit: 8000, ' +
+  'current max_parallel_requests: 1, max_parallel_requests: 10'
+// v1 shape B — raise_rate_limit_error's zero-limit branch: the standalone
+// "Max parallel request limit reached" prefix + additional_details
+// (parallel_request_limiter.py ~lines 88 + 183).
+const LITELLM_V1_ZERO_LIMIT_BODY =
+  'Max parallel request limit reached Crossed TPM / RPM / Max Parallel ' +
+  'Request Limit. Hit limit for tokens. Current limits: ' +
+  'max_parallel_requests: 10, tpm_limit: 0, rpm_limit: 60'
+// v3 limiter with a descriptor OUTSIDE any enumerated list — covered by the
+// litellmV3LimiterSignalPair co-occurrence rule (v3 descriptor keys also
+// include organization / team_member / model_per_team / agent / tag_per_key
+// / mcp_per_key and keep growing, so enumeration is a treadmill).
+const LITELLM_V3_TEAM_MODEL_BODY =
+  'Rate limit exceeded for model_per_team: team-1a2b3c:claude-fable-5. ' +
+  'Limit type: tokens. Current limit: 50000, Remaining: 0. ' +
+  'Limit resets at: 2026-07-12 08:05:00 UTC'
+
 // ─── detectModelUnavailable ──────────────────────────────────────────────────
 
 describe('detectModelUnavailable — quota / billing strings', () => {
@@ -117,6 +159,151 @@ describe('detectModelUnavailable — transient upstream 429 vs account quota (#2
   })
 })
 
+describe('detectModelUnavailable — LiteLLM-proxy-LOCAL 429s (never quota)', () => {
+  // A 429 raised by LiteLLM's OWN limiter never reached Anthropic — it must
+  // classify to the calm retryable kind, never quota_exhausted (which drives
+  // the scary card + mark-exhausted + fleet failover for an account that was
+  // never touched). Bodies are verbatim LiteLLM source shapes.
+  it.each([
+    ['deployment tpm cap (model_rate_limit_check body)', LITELLM_DEPLOYMENT_CAP_BODY],
+    ['deployment tpm cap (RateLimitError message)', LITELLM_DEPLOYMENT_CAP_MESSAGE],
+    ['usage-based-routing v2 rpm wording', LITELLM_V2_STRATEGY_BODY],
+    ['router cooldown (RouterRateLimitError)', LITELLM_ROUTER_COOLDOWN_BODY],
+    ['virtual-key tpm_limit (parallel_request_limiter_v3)', LITELLM_V3_KEY_LIMIT_BODY],
+    ['team model cap — non-enumerated v3 descriptor (co-occurrence rule)', LITELLM_V3_TEAM_MODEL_BODY],
+    ['v1 parallel-request limiter (Rate Limit Handler detail)', LITELLM_V1_PARALLEL_BODY],
+    ['v1 zero-limit branch (Max parallel request limit reached prefix)', LITELLM_V1_ZERO_LIMIT_BODY],
+  ])('classifies %s as overload, NOT quota_exhausted', (_name, body) => {
+    const d = detectModelUnavailable(body)
+    expect(d?.kind).toBe('overload')
+  })
+
+  it('a rate-limited operator event with a LiteLLM-local body resolves to NO model-unavailable card', () => {
+    // End-to-end seam the gateway uses: resolveModelUnavailableFromOperatorEvent
+    // returning null is what keeps the calm 🚦 card AND blocks the
+    // auto-fallback branch (fallback only fires when a detection resolves).
+    for (const body of [
+      LITELLM_DEPLOYMENT_CAP_BODY,
+      LITELLM_V3_KEY_LIMIT_BODY,
+      LITELLM_ROUTER_COOLDOWN_BODY,
+    ]) {
+      expect(
+        resolveModelUnavailableFromOperatorEvent({ kind: 'rate-limited', detail: body }),
+      ).toBeNull()
+    }
+  })
+})
+
+describe('isLitellmProxyLocal429 — signal matching', () => {
+  it('matches every canonical LiteLLM limiter wording', () => {
+    for (const body of [
+      LITELLM_DEPLOYMENT_CAP_BODY,
+      LITELLM_DEPLOYMENT_CAP_MESSAGE,
+      LITELLM_V2_STRATEGY_BODY,
+      LITELLM_ROUTER_COOLDOWN_BODY,
+      LITELLM_V3_KEY_LIMIT_BODY,
+      LITELLM_V1_PARALLEL_BODY,
+      LITELLM_V1_ZERO_LIMIT_BODY,
+    ]) {
+      expect(isLitellmProxyLocal429(body)).toBe(true)
+    }
+  })
+
+  it('matches ANY v3 descriptor via the co-occurrence pair, not an enumerated list', () => {
+    // model_per_team is not in litellmProxyLocal429Signals — only the
+    // "rate limit exceeded for " + "limit type:" pair catches it. Same for
+    // any descriptor litellm adds later.
+    expect(isLitellmProxyLocal429(LITELLM_V3_TEAM_MODEL_BODY)).toBe(true)
+    expect(
+      isLitellmProxyLocal429(
+        'Rate limit exceeded for organization: org-1a2b3c. Limit type: requests. ' +
+          'Current limit: 100, Remaining: 0. Limit resets at: 2026-07-12 08:05:00 UTC',
+      ),
+    ).toBe(true)
+    // HALF the pair is not enough — "rate limit exceeded for" prose without
+    // the v3 "Limit type:" field must not classify proxy-local.
+    expect(
+      isLitellmProxyLocal429('Rate limit exceeded for this account, try later'),
+    ).toBe(false)
+    expect(isLitellmProxyLocal429('Limit type: tokens')).toBe(false)
+  })
+
+  it('does NOT match Anthropic account/wall/server wordings', () => {
+    expect(
+      isLitellmProxyLocal429(
+        "This request would exceed your account's rate limit. Please try again later.",
+      ),
+    ).toBe(false)
+    expect(
+      isLitellmProxyLocal429('Server is temporarily limiting requests (not your usage limit)'),
+    ).toBe(false)
+    expect(isLitellmProxyLocal429("You've hit your limit · resets 8:50am")).toBe(false)
+  })
+
+  it('does NOT match the bare litellm.RateLimitError exception-mapping prefix', () => {
+    // The pass-through wraps FORWARDED upstream 429s with the same prefix —
+    // it is not evidence the limit was proxy-local.
+    expect(
+      isLitellmProxyLocal429(
+        "litellm.RateLimitError: RateLimitError: This request would exceed your account's rate limit.",
+      ),
+    ).toBe(false)
+  })
+
+  it('never throws on weird input', () => {
+    expect(isLitellmProxyLocal429('')).toBe(false)
+    expect(isLitellmProxyLocal429(undefined as unknown as string)).toBe(false)
+    expect(isLitellmProxyLocal429(42 as unknown as string)).toBe(false)
+    // Slice guard: signal past the 16KB sample is not scanned.
+    expect(isLitellmProxyLocal429('A'.repeat(100_000) + LITELLM_DEPLOYMENT_CAP_BODY)).toBe(false)
+  })
+})
+
+describe('parseLitellmLimitDetail — instrumentation extraction', () => {
+  const NOW = new Date(Date.UTC(2026, 6, 12, 8, 0, 0))
+
+  it('extracts tpm limit + current usage from the deployment-cap body', () => {
+    const d = parseLitellmLimitDetail(LITELLM_DEPLOYMENT_CAP_BODY, NOW)
+    expect(d.limitType).toBe('tpm')
+    expect(d.limit).toBe(8000)
+    expect(d.currentUsage).toBe(8241)
+    expect(d.resetAtMs).toBeNull()
+  })
+
+  it('extracts rpm limit from the v2 strategy body', () => {
+    const d = parseLitellmLimitDetail(LITELLM_V2_STRATEGY_BODY, NOW)
+    expect(d.limitType).toBe('rpm')
+    expect(d.limit).toBe(60)
+    expect(d.currentUsage).toBe(61)
+  })
+
+  it('extracts the v3 limiter limit type, limit, and "Limit resets at" UTC timestamp', () => {
+    const d = parseLitellmLimitDetail(LITELLM_V3_KEY_LIMIT_BODY, NOW)
+    expect(d.limitType).toBe('tokens')
+    expect(d.limit).toBe(8000)
+    expect(d.resetAtMs).toBe(Date.UTC(2026, 6, 12, 8, 5, 0))
+  })
+
+  it('extracts the router-cooldown "Try again in N seconds" relative reset', () => {
+    const d = parseLitellmLimitDetail(LITELLM_ROUTER_COOLDOWN_BODY, NOW)
+    expect(d.resetAtMs).toBe(NOW.getTime() + 27_500)
+  })
+
+  it('extracts the v1 limiter colon-form rpm limit', () => {
+    const d = parseLitellmLimitDetail(LITELLM_V1_PARALLEL_BODY, NOW)
+    expect(d.limitType).toBe('rpm')
+    expect(d.limit).toBe(60)
+  })
+
+  it('returns all-null on non-LiteLLM prose and never throws on weird input', () => {
+    const empty = { limitType: null, limit: null, currentUsage: null, resetAtMs: null }
+    expect(parseLitellmLimitDetail('Please try again later.', NOW)).toEqual(empty)
+    expect(parseLitellmLimitDetail('', NOW)).toEqual(empty)
+    expect(parseLitellmLimitDetail(undefined as unknown as string, NOW)).toEqual(empty)
+    expect(parseLitellmLimitDetail({} as unknown as string, NOW)).toEqual(empty)
+  })
+})
+
 describe('detectModelUnavailable — network failures', () => {
   it('classifies ECONNREFUSED', () => {
     expect(detectModelUnavailable('connect ECONNREFUSED 1.2.3.4:443')?.kind).toBe('network')

package/telegram-plugin/tests/operator-events-session-tail.test.ts

@@ -198,6 +198,61 @@ describe('detectErrorInTranscriptLine — error detection', () => {
     expect(detection).toBeNull()
   })
 
+  // A 429 whose body carries LiteLLM-proxy-LOCAL limiter wording is the
+  // proxy's own tpm_limit/rpm_limit cap tripping BEFORE the request reached
+  // Anthropic. Nothing about the account is exhausted — it must take the
+  // calm rate-limited path (no model-unavailable card, no mark-exhausted,
+  // no fleet failover). Prerequisite for enabling litellm tpm caps on the
+  // fleet: without this, every cap trip would bench a healthy account.
+  it('classifies a LiteLLM-proxy-local 429 as rate-limited, NOT quota-exhausted', () => {
+    const litellmBodies = [
+      // Deployment tpm cap (model_rate_limit_check.py body, verbatim shape).
+      'API Error: 429 Deployment over user-defined ratelimit. tpm limit=8000. ' +
+        'current usage=8241. id=abc123def, model_group=claude-fable-5',
+      // Virtual-key tpm_limit (parallel_request_limiter_v3.py).
+      'API Error: 429 Rate limit exceeded for api_key: hashed-key-1a2b3c. ' +
+        'Limit type: tokens. Current limit: 8000, Remaining: 0. ' +
+        'Limit resets at: 2026-07-12 08:05:00 UTC',
+      // Router cooldown (RouterRateLimitError).
+      'API Error: 429 No deployments available for selected model, ' +
+        'Try again in 27.5 seconds. Passed model=claude-fable-5.',
+      // Team-level model cap — a v3 descriptor OUTSIDE the enumerated signal
+      // list, covered only by the co-occurrence pair
+      // (litellmV3LimiterSignalPair). Pre-fix this missed every signal →
+      // quota-exhausted → scary card + failover.
+      'API Error: 429 Rate limit exceeded for model_per_team: ' +
+        'team-1a2b3c:claude-fable-5. Limit type: tokens. ' +
+        'Current limit: 50000, Remaining: 0. ' +
+        'Limit resets at: 2026-07-12 08:05:00 UTC',
+    ]
+    for (const text of litellmBodies) {
+      const line = JSON.stringify({
+        type: 'assistant',
+        message: {
+          role: 'assistant',
+          model: '<synthetic>',
+          content: [{ type: 'text', text }],
+        },
+        error: 'rate_limit',
+        isApiErrorMessage: true,
+        apiErrorStatus: 429,
+      })
+      const result = detectErrorInTranscriptLine(line)
+      expect(result).not.toBeNull()
+      expect(result!.kind).toBe('rate-limited')
+      expect(result!.transient).toBe(true)
+      // End-to-end: the resolver must NOT produce a model-unavailable card —
+      // null is what keeps the calm 🚦 card and blocks the auto-fallback
+      // branch in emitGatewayOperatorEvent.
+      expect(
+        resolveModelUnavailableFromOperatorEvent({
+          kind: result!.kind,
+          detail: result!.detail,
+        }),
+      ).toBeNull()
+    }
+  })
+
   // Guard against over-correcting: a GENUINE quota wall (no transient marker)
   // must STILL be quota-exhausted AND still resolve to a card.
   it('a genuine quota-wall 429 still produces the quota-exhausted card', () => {

package/telegram-plugin/tests/quota-watch.test.ts

@@ -1170,4 +1170,25 @@ describe("buildFleetRollMessage — reason attribution (#3031 PR 2 reason field)
       expect(msg).toContain("7-day window at 96% on");
     }
   });
+
+  it("model-tier-wall (#3176) names the flagship tier and reassures opus/haiku are unaffected — not a generic quota window", () => {
+    // A tier wall binds on the 7d_oi bucket; window/pct are absent (5h/7d read
+    // healthy). exhausted_until carries the tier reset.
+    const roll: FleetRollInfo = {
+      from: "alice@example.com",
+      to: "bob@example.com",
+      at: NOW - 60_000,
+      reason: "model-tier-wall",
+      bucket: "seven_day_overage_included",
+      exhausted_until: NOW + 2.8 * 60 * 60 * 1000,
+    };
+    const msg = buildFleetRollMessage(roll, NOW);
+    expect(msg).toContain("Flagship (premium) tier weekly limit reached");
+    expect(msg).toContain("opus/haiku on that account are unaffected");
+    // Must NOT mislead as a generic 5h/7d window roll.
+    expect(msg).not.toContain("quota window");
+    expect(msg).not.toContain("Proactive switch");
+    // The tier reset is surfaced.
+    expect(msg).toContain("resets");
+  });
 });

package/telegram-plugin/tests/reaction-gate-routing.test.ts

@@ -29,7 +29,7 @@
 import { describe, it, expect, vi } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
-import { createSendGate, type Clock } from '../send-gate.js'
+import { createSendGate, SEND_GATE_SHED, type Clock } from '../send-gate.js'
 import { createRetryApiCall } from '../retry-api-call.js'
 import { errors } from './fake-bot-api.js'
 
@@ -95,7 +95,7 @@ describe('#3155 reactions route through the send gate (cosmetic)', () => {
     // resolves undefined (fire-and-forget callers .catch nothing), and the gate
     // counts the shed.
     expect(setMessageReaction).not.toHaveBeenCalled()
-    expect(result).toBeUndefined()
+    expect(result).toBe(SEND_GATE_SHED) // shed sentinel (#3110 F1)
     expect(sendGate.stats().global.shed).toBe(1)
   })
 

package/telegram-plugin/tests/runtime-metrics.test.ts

@@ -91,6 +91,30 @@ describe('runtime-metrics — JSONL sink', () => {
     expect(typeof parsed.ts).toBe('number')
   })
 
+  it('rate_limit_429_classified carries classification + action + limit/reset detail', () => {
+    emitRuntimeMetric({
+      kind: 'rate_limit_429_classified',
+      agent: 'carrie',
+      classification: 'litellm-local',
+      action: 'calm',
+      reset_at_ms: 1_783_850_700_000,
+      reset_in_ms: 300_000,
+      limit_type: 'tpm',
+      limit: 8000,
+      current_usage: 8241,
+    })
+    const parsed = JSON.parse(readFileSync(metricsPath, 'utf-8').trim())
+    expect(parsed.kind).toBe('rate_limit_429_classified')
+    expect(parsed.agent).toBe('carrie')
+    expect(parsed.classification).toBe('litellm-local')
+    expect(parsed.action).toBe('calm')
+    expect(parsed.reset_in_ms).toBe(300_000)
+    expect(parsed.limit_type).toBe('tpm')
+    expect(parsed.limit).toBe(8000)
+    expect(parsed.current_usage).toBe(8241)
+    expect(typeof parsed.ts).toBe('number')
+  })
+
   it('appends — does not overwrite — across calls', () => {
     for (let i = 0; i < 5; i++) {
       emitRuntimeMetric({

package/telegram-plugin/tests/session-model-file.test.ts

@@ -1,10 +1,12 @@
 /**
- * Durable session-model file helpers (session-model-file.ts) — the gateway
- * side of the stickiness contract (reference/rfcs/session-model-stickiness.md).
+ * Session-model file helpers (session-model-file.ts) — the gateway side of the
+ * session-scoped /model contract (reference/rfcs/session-model-stickiness.md
+ * §0.1, rev 4 — consume-once). The `.relaunch-model-intent` subsystem and the
+ * crashloop counter were retired with rev 4; their tests are gone.
  */
 
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import {
@@ -15,17 +17,8 @@ import {
   readSessionModelFileRaw,
   restoreSessionModelFileRaw,
   clearSessionModelFile,
-  clearSessionModelBootAttempts,
-  SESSION_MODEL_BOOT_ATTEMPTS_FILE,
-  writeRelaunchModelIntent,
-  clearRelaunchModelIntent,
   readConfiguredDefaultModel,
-  intentForRestartReason,
-  readRelaunchModelIntent,
-  clearStaleGatewayShutdownIntent,
-  GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX,
   SESSION_MODEL_FILE,
-  RELAUNCH_MODEL_INTENT_FILE,
   CONFIGURED_DEFAULT_MODEL_FILE,
   parseSessionEffort,
   writeSessionEffortFile,
@@ -87,86 +80,6 @@ describe('rollback snapshot (scheduleModelRelaunch dispatch failure)', () => {
   })
 })
 
-describe('relaunch intent', () => {
-  it('writes one-line JSON with intent, reason, and embedded ts (the freshness clock)', () => {
-    writeRelaunchModelIntent(dir, 'keep', 'user: /new from chat')
-    const raw = readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')
-    const parsed = JSON.parse(raw)
-    expect(parsed.intent).toBe('keep')
-    expect(parsed.reason).toBe('user: /new from chat')
-    expect(Math.abs(Date.now() - parsed.ts)).toBeLessThan(5000)
-  })
-
-  it('last-writer-wins and clearable', () => {
-    writeRelaunchModelIntent(dir, 'keep', 'a')
-    writeRelaunchModelIntent(dir, 'revert', 'b')
-    expect(JSON.parse(readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')).intent).toBe('revert')
-    clearRelaunchModelIntent(dir)
-    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
-  })
-})
-
-describe('intentForRestartReason — the triggerSelfRestart per-reason table (RFC §3)', () => {
-  it.each([
-    'schedule-restart-immediate',
-    'restart-drain-cap-forced',
-    'turn-complete-pending-restart',
-    'fleet-fallback-resume',
-    'sr-to-claude-model-switch',
-  ])('switchroom-managed relaunch %s → keep', (reason) => {
-    expect(intentForRestartReason(reason)).toBe('keep')
-  })
-
-  it('inline-button-restart → keep (#3039: a restart is not "clear my model")', () => {
-    expect(intentForRestartReason('inline-button-restart')).toBe('keep')
-  })
-
-  it('unknown gateway reasons default to keep (only gateway code calls triggerSelfRestart; crashes never do)', () => {
-    expect(intentForRestartReason('some-future-recovery-path')).toBe('keep')
-  })
-})
-
-describe('readRelaunchModelIntent', () => {
-  it('round-trips a stamped intent; null when absent / corrupt / malformed', () => {
-    expect(readRelaunchModelIntent(dir)).toBeNull()
-    writeRelaunchModelIntent(dir, 'keep', 'watchdog recovery')
-    const rec = readRelaunchModelIntent(dir)!
-    expect(rec.intent).toBe('keep')
-    expect(rec.reason).toBe('watchdog recovery')
-    expect(Math.abs(Date.now() - rec.ts)).toBeLessThan(5000)
-    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), '{broken')
-    expect(readRelaunchModelIntent(dir)).toBeNull()
-    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), '{"intent":"maybe","reason":"x","ts":1}\n')
-    expect(readRelaunchModelIntent(dir)).toBeNull()
-  })
-})
-
-describe('clearStaleGatewayShutdownIntent (#3018 finding 4 — a gateway-only bounce must not leave a keep stamp)', () => {
-  it('clears ONLY a gateway-shutdown-stamped intent and reports it', () => {
-    writeRelaunchModelIntent(
-      dir,
-      'keep',
-      `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful SIGTERM shutdown (deploy/rolling restart) — preserving user-chosen session model`,
-    )
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(true)
-    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
-    // Idempotent: a second call finds nothing.
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-  })
-
-  it('never touches a triggerSelfRestart / user-slash stamp (un-prefixed reason)', () => {
-    writeRelaunchModelIntent(dir, 'keep', 'sr-to-claude-model-switch')
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-    expect(readRelaunchModelIntent(dir)!.reason).toBe('sr-to-claude-model-switch')
-  })
-
-  it('is a safe no-op on an absent or corrupt intent file', () => {
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'not json')
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-  })
-})
-
 describe('readConfiguredDefaultModel', () => {
   it('reads the trimmed value; null when absent or empty', () => {
     expect(readConfiguredDefaultModel(dir)).toBeNull()
@@ -181,9 +94,9 @@ describe('readConfiguredDefaultModel', () => {
   })
 })
 
-// ─── #3039: durable session-effort carrier ───────────────────────────────────
+// ─── #3186: consume-once session-effort carrier (queued-command boot apply) ──
 
-describe('session-effort file helpers (#3039)', () => {
+describe('session-effort file helpers (#3186)', () => {
   let dir: string
   beforeEach(() => {
     dir = mkdtempSync(join(tmpdir(), 'sr-session-effort-'))
@@ -218,64 +131,3 @@ describe('session-effort file helpers (#3039)', () => {
     expect(readSessionEffortFile(dir)).toBeNull()
   })
 })
-
-describe('intentForRestartReason is keep-for-everything (#3039)', () => {
-  it('every reason keeps — restarts never clear a user model choice', () => {
-    for (const reason of [
-      'inline-button-restart',
-      'user: /restart from chat',
-      'schedule-restart-immediate',
-      'anything-else',
-    ]) {
-      expect(intentForRestartReason(reason)).toBe('keep')
-    }
-  })
-})
-
-describe('clearSessionModelBootAttempts (#3043 item 2: bridge-register clears the crashloop counter)', () => {
-  const bootAttemptsPath = () => join(dir, SESSION_MODEL_BOOT_ATTEMPTS_FILE)
-
-  // Faithful model of start.sh.hbs "Override crashloop self-heal": each boot
-  // within 150s of the previous stamp bumps the count; a stale stamp resets to
-  // 1. Reproduced here so the accumulate-vs-reset OUTCOME is asserted, not just
-  // the delete call.
-  function simulateBootStamp(nowSec: number): number {
-    let count = 0
-    let prev = 0
-    if (existsSync(bootAttemptsPath())) {
-      const [c, p] = readFileSync(bootAttemptsPath(), 'utf8').trim().split(/\s+/)
-      count = Number(c) || 0
-      prev = Number(p) || 0
-    }
-    count = nowSec - prev < 150 ? count + 1 : 1
-    writeFileSync(bootAttemptsPath(), `${count} ${nowSec}\n`)
-    return count
-  }
-
-  it('WITHOUT a bridge register, three fast boots accumulate toward the 3-strike clear', () => {
-    // Three operator hand-bounces, each <150s apart, with no register between.
-    expect(simulateBootStamp(1000)).toBe(1)
-    expect(simulateBootStamp(1010)).toBe(2)
-    expect(simulateBootStamp(1020)).toBe(3) // start.sh would now clear a HEALTHY override — the false positive
-  })
-
-  it('a bridge register between boots resets the counter, so a healthy agent never reaches 3', () => {
-    expect(simulateBootStamp(1000)).toBe(1)
-    // Boot 1 came all the way up and the bridge registered → gateway clears it.
-    clearSessionModelBootAttempts(dir)
-    expect(existsSync(bootAttemptsPath())).toBe(false)
-
-    // Next fast boot starts fresh at 1 (no accumulation), and register clears again.
-    expect(simulateBootStamp(1010)).toBe(1)
-    clearSessionModelBootAttempts(dir)
-    expect(simulateBootStamp(1020)).toBe(1)
-    // The healthy agent's counter never climbs to the 3-strike clear.
-    const [count] = readFileSync(bootAttemptsPath(), 'utf8').trim().split(/\s+/)
-    expect(Number(count)).toBeLessThan(3)
-  })
-
-  it('is best-effort — no throw when the counter file is absent', () => {
-    expect(existsSync(bootAttemptsPath())).toBe(false)
-    expect(() => clearSessionModelBootAttempts(dir)).not.toThrow()
-  })
-})