switchroom 0.18.15 → 0.18.17

package/telegram-plugin/tests/bot-api.harness.ts

@@ -84,7 +84,11 @@ export function createMockBot(startMessageId = 500): MockBot {
   const api: MockBotApi = {
     sendMessage: vi.fn(async () => ({ message_id: state.nextMessageId++ })),
     sendRichMessage: vi.fn(async () => ({ message_id: state.nextMessageId++ })),
-    editMessageText: vi.fn(async () => undefined),
+    // Faithful to grammy: editMessageText resolves `Message | true`, NEVER
+    // undefined. An `undefined` from the production retry stack means the
+    // send gate shed/skipped the call (#3110) — stream-controller treats it
+    // as not-landed — so the mock default must not be undefined.
+    editMessageText: vi.fn(async () => true as const),
     deleteMessage: vi.fn(async () => true as const),
     setMessageReaction: vi.fn(async () => true as const),
     editMessageReplyMarkup: vi.fn(async () => undefined),
@@ -122,7 +126,8 @@ export function installBotResetHook(bot: MockBot): void {
     bot.api.sendRichMessage.mockImplementation(async () => ({
       message_id: bot.nextMessageId++,
     }))
-    bot.api.editMessageText.mockImplementation(async () => undefined)
+    // Faithful to grammy: `Message | true`, never undefined (see above).
+    bot.api.editMessageText.mockImplementation(async () => true as const)
     bot.api.deleteMessage.mockImplementation(async () => true as const)
     bot.api.setMessageReaction.mockImplementation(async () => true as const)
     bot.api.editMessageReplyMarkup.mockImplementation(async () => undefined)

package/telegram-plugin/tests/draft-stream.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { createDraftStream } from '../draft-stream.js'
+import { createDraftStream, makeDraftEditShedError } from '../draft-stream.js'
 
 interface MockTelegram {
   send: (text: string) => Promise<number>
@@ -137,6 +137,115 @@ describe('createDraftStream', () => {
     expect(stream.isFinal()).toBe(true)
   })
 
+  it('finalize(finalText) flushes the supplied snapshot with the stream already final (#3110)', async () => {
+    const m = makeMock()
+    // Capture what isFinal() reads AT EDIT TIME — the transport layer
+    // (stream-controller) classifies the send-gate priority from exactly
+    // this signal, so the final snapshot MUST flush with final=true.
+    const finalAtEdit: boolean[] = []
+    const stream = createDraftStream(
+      m.send,
+      async (id, text) => {
+        finalAtEdit.push(stream.isFinal())
+        await m.edit(id, text)
+      },
+      { throttleMs: 1000 },
+    )
+
+    void stream.update('initial')
+    await microtaskFlush()
+    expect(m.sendCalls.length).toBe(1)
+
+    // A stale draft is pending; finalize(text) supersedes it (last-write-wins).
+    void stream.update('stale draft')
+    await microtaskFlush()
+    await stream.finalize('the completed answer')
+
+    expect(m.editCalls.length).toBe(1)
+    expect(m.editCalls[0].text).toBe('the completed answer')
+    expect(finalAtEdit).toEqual([true])
+    expect(stream.isFinal()).toBe(true)
+  })
+
+  it('a shed flush preserves the snapshot; argument-less finalize() re-delivers it (#3110 F2)', async () => {
+    const m = makeMock()
+    let shedNext = true
+    const stream = createDraftStream(
+      m.send,
+      async (id, text) => {
+        if (shedNext) {
+          shedNext = false
+          throw makeDraftEditShedError(id)
+        }
+        await m.edit(id, text)
+      },
+      { throttleMs: 1000 },
+    )
+
+    void stream.update('v1')
+    await microtaskFlush()
+    expect(m.sendCalls.length).toBe(1)
+
+    void stream.update('v2 — shed by the gate')
+    vi.advanceTimersByTime(1000)
+    await microtaskFlush()
+    // The edit was shed: nothing landed, and the snapshot must NOT be
+    // recorded as sent.
+    expect(m.editCalls.length).toBe(0)
+
+    // The gateway's cleanup paths finalize with NO argument — the shed
+    // snapshot must be re-flushed as the stream's final state, not lost.
+    await stream.finalize()
+    expect(m.editCalls.length).toBe(1)
+    expect(m.editCalls[0].text).toBe('v2 — shed by the gate')
+  })
+
+  it('a newer landed flush supersedes an earlier shed snapshot (no stale resurrect)', async () => {
+    const m = makeMock()
+    let shedNext = true
+    const stream = createDraftStream(
+      m.send,
+      async (id, text) => {
+        if (shedNext) {
+          shedNext = false
+          throw makeDraftEditShedError(id)
+        }
+        await m.edit(id, text)
+      },
+      { throttleMs: 1000 },
+    )
+
+    void stream.update('v1')
+    await microtaskFlush()
+    void stream.update('v2 — shed')
+    vi.advanceTimersByTime(1000)
+    await microtaskFlush()
+    expect(m.editCalls.length).toBe(0)
+
+    // A NEWER snapshot lands normally — the shed one is now stale.
+    void stream.update('v3 — landed')
+    vi.advanceTimersByTime(1000)
+    await microtaskFlush()
+    expect(m.editCalls.map((c) => c.text)).toEqual(['v3 — landed'])
+
+    // finalize() must NOT resurrect the superseded shed snapshot.
+    await stream.finalize()
+    expect(m.editCalls.map((c) => c.text)).toEqual(['v3 — landed'])
+  })
+
+  it('finalize(finalText) still dedupes against text that actually landed', async () => {
+    const m = makeMock()
+    const stream = createDraftStream(m.send, m.edit, { throttleMs: 1000 })
+
+    void stream.update('the answer')
+    await microtaskFlush()
+    expect(m.sendCalls.length).toBe(1)
+
+    // Same text again as the final snapshot → already on screen, no edit.
+    await stream.finalize('the answer')
+    expect(m.editCalls.length).toBe(0)
+  })
+
   it('updates after finalize are silently dropped', async () => {
     const m = makeMock()
     const stream = createDraftStream(m.send, m.edit, { throttleMs: 1000 })

package/telegram-plugin/tests/effort-command.test.ts

@@ -107,7 +107,7 @@ describe("effort-command: handler", () => {
     const { deps } = makeDeps({ getConfiguredEffort: () => "medium" });
     const r = await handleEffortCommand({ kind: "show" }, deps);
     expect(r.text).toContain("medium");
-    expect(r.text).toMatch(/persists across restarts and deploys/);
+    expect(r.text).toMatch(/lasts until the agent’s next restart/);
   });
 
   it("show falls back to low when effort is unreadable", async () => {
@@ -121,7 +121,7 @@ describe("effort-command: handler", () => {
     const r = await handleEffortCommand({ kind: "set", level: "high" }, deps);
     expect(calls).toEqual([{ agent: "carrie", level: "high" }]);
     expect(r.text).toContain("Set effort level to high");
-    expect(r.text).toMatch(/persists across restarts and deploys/);
+    expect(r.text).toMatch(/lasts until the agent’s next restart/);
   });
 
   it("set notes the re-read cost when a confirmation was needed", async () => {
@@ -249,9 +249,9 @@ describe("effort-command: /effort default (#3039)", () => {
     expect(marked?.text).toBe("✅ max");
   });
 
-  it("help text advertises /effort default and the sticky contract", async () => {
+  it("help text advertises /effort default and the session-only contract", async () => {
     const r = await handleEffortCommand({ kind: "help" }, makeDeps().deps);
     expect(r.text).toContain("/effort default");
-    expect(r.text).toContain("persists across restarts and deploys");
+    expect(r.text).toContain("lasts until the agent’s next restart");
   });
 });

package/telegram-plugin/tests/flood-windows-persistence.test.ts

@@ -14,7 +14,7 @@ import {
   FLOOD_STATE_MODE,
   FLOOD_WINDOWS_CORRUPT_SUPPRESS_MS,
 } from '../flood-circuit-breaker.js'
-import { createSendGate, type Clock } from '../send-gate.js'
+import { createSendGate, SEND_GATE_SHED, type Clock } from '../send-gate.js'
 
 /**
  * #3084 PR 2 — restart-proof SCOPED flood windows (part3-design §7). Verifies
@@ -119,7 +119,7 @@ describe('#3084 scoped flood-window persistence', () => {
       chat_id: '7',
       priorityClass: 'cosmetic',
     })
-    expect(res).toBeUndefined()
+    expect(res).toBe(SEND_GATE_SHED) // shed sentinel (#3110 F1)
     expect(gate2.stats().global.shed).toBe(1)
 
     // And a critical into the still-long window fails fast — restart did not

package/telegram-plugin/tests/gateway-pending-command-wiring.test.ts

@@ -89,36 +89,50 @@ describe('gateway: unconfirmed queued model tokens are gated before durable pers
   })
 })
 
-describe('gateway: /restart keeps the session-model override (#3039)', () => {
-  it('the /restart chat command stamps keep, never revert', () => {
-    expect(GATEWAY_SRC).toContain("writeRelaunchModelIntent(smDir, 'keep', 'user: /restart from chat')")
-    expect(GATEWAY_SRC).not.toContain("writeRelaunchModelIntent(smDir, 'revert'")
+describe('gateway: /restart reverts the session-model override (rev 4, session-scoped)', () => {
+  it('no restart verb stamps a relaunch-model intent (the subsystem is retired)', () => {
+    expect(GATEWAY_SRC).not.toContain('writeRelaunchModelIntent')
   })
 })
 
-describe('gateway: /effort persistence choke point (#3039)', () => {
-  it('buildEffortDeps persists a confirmed apply to .session-effort and wires clearSessionEffort', () => {
+describe('gateway: /effort is session-scoped (#3186)', () => {
+  it('buildEffortDeps records a confirmed live apply IN MEMORY only — no durable carrier write', () => {
     const fnIdx = GATEWAY_SRC.indexOf('function buildEffortDeps(')
     expect(fnIdx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 2500)
-    expect(win).toContain('writeSessionEffortFile(')
+    expect(win).not.toContain('writeSessionEffortFile(')
+    expect(win).toContain('sessionEffortOverride = level')
+    // /effort default clears the in-memory level AND any leftover carrier.
+    expect(win).toContain('sessionEffortOverride = null')
     expect(win).toContain('clearSessionEffortFile(')
-    expect(win).toContain('readSessionEffortFile(')
   })
-})
 
-describe('gateway: keep-intent stamp narrowing (#3018 finding 4)', () => {
-  it('the shutdown keep-intent stamp carries the gateway-shutdown reason prefix', () => {
-    expect(GATEWAY_SRC).toContain(
-      "writeRelaunchModelIntent(smDir, 'keep', `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful ${signal} shutdown",
-    )
+  it('the queued-command shutdown persist is the ONLY .session-effort writer', () => {
+    const writes = [...GATEWAY_SRC.matchAll(/writeSessionEffortFile\(/g)]
+    expect(writes.length).toBe(1)
+    const fnIdx = GATEWAY_SRC.indexOf('function persistQueuedCommandForRestart(')
+    expect(fnIdx).toBeGreaterThan(0)
+    expect(writes[0].index).toBeGreaterThan(fnIdx)
+    expect(writes[0].index).toBeLessThan(fnIdx + 3000)
   })
 
-  it('boot clears a stale gateway-shutdown-stamped intent (gateway-only bounce never runs start.sh)', () => {
-    const idx = GATEWAY_SRC.indexOf('clearStaleGatewayShutdownIntent(bootSmDir)')
+  it('boot re-hydrates the in-memory effort override from .active-session-effort', () => {
+    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-effort')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 800)
+    expect(win).toContain('getConfiguredEffortForPersist()')
+    expect(win).toContain('sessionEffortOverride =')
+  })
+})
+
+describe('gateway: graceful shutdown no longer preserves a session model (rev 4)', () => {
+  it('the shutdown handler stamps no keep-intent — a deploy reverts to config', () => {
+    const idx = GATEWAY_SRC.indexOf('async function shutdown(signal: string)')
     expect(idx).toBeGreaterThan(0)
-    // The cleanup runs at module top-level (gateway boot), BEFORE the shutdown
-    // handler could stamp a fresh one for THIS process's own exit.
-    expect(idx).toBeLessThan(GATEWAY_SRC.indexOf('async function shutdown(signal: string)'))
+    const win = GATEWAY_SRC.slice(idx, idx + 6000)
+    expect(win).not.toContain('writeRelaunchModelIntent')
+    expect(win).not.toContain('GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX')
+    // The queued-command persist at shutdown still writes a consume-once carrier.
+    expect(win).toContain('persistQueuedCommandForRestart')
   })
 })

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -1,15 +1,14 @@
 /**
- * Structural pins for the session-model stickiness wiring in gateway.ts
- * (reference/rfcs/session-model-stickiness.md).
+ * Structural pins for the session-scoped /model wiring in gateway.ts
+ * (reference/rfcs/session-model-stickiness.md §0.1, rev 4 — consume-once).
  *
  * The behaviour lives in un-exported inline closures (buildModelDeps's
- * scheduleModelRelaunch/scheduleRestart, triggerSelfRestart, the /restart and
- * /new handlers, the model-menu callback branches, and the boot re-hydration
- * block inside the startup IIFE), so — mirroring the other gateway-*.test.ts
- * source-pins — we assert on the source structure. The end-to-end behaviour
- * of the boot resolver is exercised in tests/scaffold.session-model.test.ts
- * (rendered start.sh), the file helpers in session-model-file.test.ts, and
- * the handler contract in model-command.test.ts.
+ * scheduleModelRelaunch/scheduleRestart, the typed/menu recorders, and the
+ * boot re-hydration block inside the startup IIFE), so — mirroring the other
+ * gateway-*.test.ts source-pins — we assert on the source structure. The
+ * end-to-end boot behaviour is exercised in tests/scaffold.session-model.test.ts
+ * (rendered start.sh), the file helpers in session-model-file.test.ts, and the
+ * handler contract in model-command.test.ts.
  */
 
 import { describe, it, expect } from 'vitest'
@@ -20,35 +19,27 @@ import { dirname, resolve } from 'node:path'
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
 
-describe('gateway: triggerSelfRestart stamps relaunch-model intent BEFORE the kill', () => {
-  it('docker branch: writeRelaunchModelIntent(intentForRestartReason(reason)) precedes the SIGTERM scheduling', () => {
-    const fnIdx = GATEWAY_SRC.indexOf('function triggerSelfRestart(')
-    expect(fnIdx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 3000)
-    const writeIdx = win.indexOf('writeRelaunchModelIntent(smDir, intentForRestartReason(reason), reason)')
-    const killIdx = win.indexOf("process.kill(1, 'SIGTERM')")
-    // Write-before-kill invariant: boot default is REVERT, so the intent must
-    // be on disk synchronously before the SIGTERM is even scheduled.
-    expect(writeIdx).toBeGreaterThan(0)
-    expect(killIdx).toBeGreaterThan(writeIdx)
-    // And before the setTimeout that schedules it.
-    const timeoutIdx = win.indexOf('setTimeout(')
-    expect(timeoutIdx).toBeGreaterThan(writeIdx)
+describe('gateway: the .relaunch-model-intent subsystem is retired (rev 4)', () => {
+  it('gateway.ts no longer writes/clears/imports any relaunch-model intent', () => {
+    expect(GATEWAY_SRC).not.toContain('writeRelaunchModelIntent')
+    expect(GATEWAY_SRC).not.toContain('clearRelaunchModelIntent')
+    expect(GATEWAY_SRC).not.toContain('intentForRestartReason')
+    expect(GATEWAY_SRC).not.toContain('clearStaleGatewayShutdownIntent')
+    expect(GATEWAY_SRC).not.toContain('GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX')
+    expect(GATEWAY_SRC).not.toContain('.relaunch-model-intent')
   })
 
-  it('legacy systemd branch stamps intent too (self-target only)', () => {
+  it('triggerSelfRestart just signals — no intent stamp before the kill', () => {
     const fnIdx = GATEWAY_SRC.indexOf('function triggerSelfRestart(')
-    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 4200)
-    const legacyIdx = win.indexOf('// Legacy systemd path.')
-    expect(legacyIdx).toBeGreaterThan(0)
-    const legacyWin = win.slice(legacyIdx)
-    expect(legacyWin).toContain('writeRelaunchModelIntent(smDir, intentForRestartReason(reason), reason)')
-    expect(legacyWin.indexOf('writeRelaunchModelIntent')).toBeLessThan(legacyWin.indexOf('spawn('))
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 3000)
+    expect(win).toContain("process.kill(1, 'SIGTERM')")
+    expect(win).not.toContain('writeRelaunchModelIntent')
   })
 })
 
-describe('gateway: scheduleModelRelaunch dep (durable .session-model)', () => {
-  it('writes the durable file via writeSessionModelFile before dispatching the restart', () => {
+describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrier)', () => {
+  it('writes the carrier via writeSessionModelFile before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx, idx + 1800)
@@ -67,7 +58,7 @@ describe('gateway: scheduleModelRelaunch dep (durable .session-model)', () => {
     expect(restartIdx).toBeGreaterThan(setIdx)
   })
 
-  it('rolls back the prior file content (not just deletion) on a non-in-flight dispatch failure', () => {
+  it('rolls back the prior carrier content (not just deletion) on a non-in-flight dispatch failure', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
     const win = GATEWAY_SRC.slice(idx, idx + 1800)
     expect(win).toContain('const prevFileRaw = readSessionModelFileRaw(agentDir)')
@@ -75,15 +66,6 @@ describe('gateway: scheduleModelRelaunch dep (durable .session-model)', () => {
     expect(win).toContain("!== 'restart_in_flight'")
   })
 
-  it('the non-in-flight rollback ALSO clears the keep-intent (a live intent with no restart coming would wrongly KEEP across a crash)', () => {
-    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 2400)
-    const inFlightIdx = win.indexOf("!== 'restart_in_flight'")
-    const clearIdx = win.indexOf('clearRelaunchModelIntent(agentDir)')
-    expect(inFlightIdx).toBeGreaterThan(0)
-    expect(clearIdx).toBeGreaterThan(inFlightIdx)
-  })
-
   it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
     const win = GATEWAY_SRC.slice(idx, idx + 1800)
@@ -91,63 +73,20 @@ describe('gateway: scheduleModelRelaunch dep (durable .session-model)', () => {
   })
 })
 
-describe('gateway: intent writers on the restart verbs', () => {
-  it('model-switch scheduleRestart stamps keep-intent before the hostd dispatch', () => {
-    const idx = GATEWAY_SRC.indexOf('scheduleRestart: async (reason: string)')
-    expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 3200)
-    const keepIdx = win.indexOf("writeRelaunchModelIntent(smDir, 'keep', reason)")
-    const dispatchIdx = win.indexOf("op: 'agent_restart'")
-    expect(keepIdx).toBeGreaterThan(0)
-    expect(dispatchIdx).toBeGreaterThan(keepIdx)
-  })
-
-  it('scheduleRestart clears the keep-intent when hostd refuses (failed dispatch → no live intent on disk)', () => {
-    const idx = GATEWAY_SRC.indexOf('scheduleRestart: async (reason: string)')
-    const win = GATEWAY_SRC.slice(idx, idx + 3200)
-    const failIdx = win.indexOf('hostd restart failed')
-    const clearIdx = win.indexOf('clearRelaunchModelIntent(smDir)')
-    expect(clearIdx).toBeGreaterThan(0)
-    expect(failIdx).toBeGreaterThan(clearIdx) // cleared before the throw's message
-    // And it sits in the same error branch as clearRestartMarker.
-    const markerIdx = win.indexOf('clearRestartMarker()')
-    expect(clearIdx).toBeGreaterThan(markerIdx)
-  })
-
-  it('/restart stamps a KEEP intent before dispatch (#3039: a restart is not "clear my model")', () => {
-    const idx = GATEWAY_SRC.indexOf("stampUserRestartReason('user: /restart from chat')")
-    expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 900)
-    const keepIdx = win.indexOf("writeRelaunchModelIntent(smDir, 'keep', 'user: /restart from chat')")
-    const dispatchIdx = win.indexOf("hostdRequestId('gw-restart')")
-    expect(keepIdx).toBeGreaterThan(0)
-    expect(dispatchIdx).toBeGreaterThan(keepIdx)
-  })
-
-  it('/new and /reset stamp keep-intent (fresh conversation, same model — contract row 7)', () => {
-    const idx = GATEWAY_SRC.indexOf('stampUserRestartReason(`user: /${kind} from chat`)')
-    expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 700)
-    const keepIdx = win.indexOf("writeRelaunchModelIntent(agentDir, 'keep', `user: /${kind} from chat`)")
-    const dispatchIdx = win.indexOf('tryHostdDispatch')
-    expect(keepIdx).toBeGreaterThan(0)
-    expect(dispatchIdx).toBeGreaterThan(keepIdx)
-  })
-})
-
-describe('gateway: model-menu callback persists the sticky override', () => {
-  it('a confirmed selection persists the canonical token (selectedModelToken), never the display label', () => {
-    // Recording extracted into recordModelMenuSideEffects (#3017) — shared by the
-    // live dispatcher and the deferred (queued mid-turn) apply so both record
-    // identically.
+describe('gateway: menu callback carrier handling (session-scoped)', () => {
+  it('a live Claude selection records the in-memory override but writes NO carrier', () => {
     const idx = GATEWAY_SRC.indexOf('function recordModelMenuSideEffects')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 2400)
-    expect(win).toContain('outcome.selectedModelToken')
-    expect(win).toMatch(/writeSessionModelFile\(\s*smDir,\s*outcome\.selectedModelToken/)
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    // The first (live-switch) block sets the override but no longer persists.
+    expect(win).toContain('sessionModelSource.setOverride(outcome.selectedModel)')
+    const overrideIdx = win.indexOf('sessionModelSource.setOverride(outcome.selectedModel)')
+    const nextClearIdx = win.indexOf('outcome.clearedDefault')
+    const writeBetween = win.slice(overrideIdx, nextClearIdx)
+    expect(writeBetween).not.toContain('writeSessionModelFile(')
   })
 
-  it('a confirmed "Default" selection CLEARS the sticky file', () => {
+  it('a confirmed "Default" selection CLEARS the carrier', () => {
     const idx = GATEWAY_SRC.indexOf('function recordModelMenuSideEffects')
     const win = GATEWAY_SRC.slice(idx, idx + 2400)
     expect(win).toContain('outcome.clearedDefault')
@@ -155,9 +94,6 @@ describe('gateway: model-menu callback persists the sticky override', () => {
   })
 
   it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
-    // Anchor on the sr-* TARGET dispatcher branch specifically (a mid-turn
-    // busy-gate #3017 also matches `if (data.startsWith(MODEL_CALLBACK_SR))`, so
-    // anchor on the relaunch call that is unique to the idle apply branch).
     const idx = GATEWAY_SRC.indexOf('const srLabel = escapeHtmlForTg(srFriendlyLabel(srName))')
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx, idx + 1400)
@@ -165,53 +101,37 @@ describe('gateway: model-menu callback persists the sticky override', () => {
     expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
   })
 
-  it('the sr-to-claude transition writes the durable file (and clears it on a Default tap)', () => {
+  it('the sr-to-claude transition (a relaunch) writes the carrier, and clears it on a Default tap', () => {
     const idx = GATEWAY_SRC.indexOf('isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)')
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx, idx + 3600)
     expect(win).toMatch(/writeSessionModelFile\(\s*agentDir,\s*token/)
     expect(win).toContain('clearSessionModelFile(agentDir)')
-    // Restart rides triggerSelfRestart with a keep-classified reason.
     expect(win).toContain("triggerSelfRestart(agentName, 'sr-to-claude-model-switch'")
   })
 })
 
-describe('gateway: typed /model persists the REQUESTED canonical token', () => {
-  it('persists expandSrAlias(parsed.model), and `/model default` clears file + in-memory override', () => {
-    // Recording extracted into recordTypedModelSwitch (#3017) — shared by the
-    // live `bot.command('model')` handler and the deferred (queued mid-turn) apply.
+describe('gateway: typed /model is session-scoped (live Claude switch writes no carrier)', () => {
+  it('the Claude path sets the in-memory override but never persists a carrier', () => {
     const idx = GATEWAY_SRC.indexOf('function recordTypedModelSwitch')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 2400)
-    expect(win).toContain("requested?.toLowerCase() === 'default'")
-    expect(win).toContain('sessionModelSource.setOverride(null)')
-    expect(win).toContain('clearSessionModelFile(smDir)')
-    // Non-default: the requested token (shape-gated, non-sr) is what persists.
-    expect(win).toContain('isValidModelArg(requested) && !isSrModel(requested)')
-    expect(win).toMatch(/writeSessionModelFile\(\s*smDir,\s*requested/)
+    const win = GATEWAY_SRC.slice(idx, idx + 1400)
+    expect(win).toContain('sessionModelSource.setOverride(reply.selectedModel)')
+    // No durable carrier write on the live-switch path.
+    expect(win).not.toContain('writeSessionModelFile(')
   })
 
-  it('`/model default` file-clear is NOT gated on a positive confirmation (silent-switch path must not resurrect)', () => {
+  it('`/model default` clears the carrier + in-memory override (silent-switch path must not resurrect)', () => {
     const idx = GATEWAY_SRC.indexOf('function recordTypedModelSwitch')
-    const win = GATEWAY_SRC.slice(idx, idx + 2400)
-    // The default branch clears the file unconditionally, and only the
-    // in-memory override change is confirmation-gated inside it.
+    const win = GATEWAY_SRC.slice(idx, idx + 1400)
+    expect(win).toContain("requested?.toLowerCase() === 'default'")
+    expect(win).toContain('clearSessionModelFile(smDir)')
+    expect(win).toContain('sessionModelSource.setOverride(null)')
+    // The file-clear is not gated on a positive confirmation.
     const clearIdx = win.indexOf('if (smDir) clearSessionModelFile(smDir)')
     const gatedOverrideIdx = win.indexOf('if (reply.selectedModel) sessionModelSource.setOverride(null)')
     expect(clearIdx).toBeGreaterThan(0)
     expect(gatedOverrideIdx).toBeGreaterThan(clearIdx)
-    // And the whole default branch is not nested in an `if (reply.selectedModel)` block:
-    const between = win.slice(0, clearIdx)
-    expect(between).not.toContain('if (reply.selectedModel) {')
-  })
-
-  it('a persist failure is surfaced ON THE REPLY, not just stderr (typed + menu paths)', () => {
-    expect(GATEWAY_SRC.match(/won’t survive a relaunch/g)?.length ?? 0).toBeGreaterThanOrEqual(2)
-    const typedIdx = GATEWAY_SRC.indexOf('persistWarning =')
-    expect(typedIdx).toBeGreaterThan(0)
-    expect(GATEWAY_SRC).toContain('reply.text + persistWarning')
-    // Menu path appends onto the outgoing card text.
-    expect(GATEWAY_SRC).toContain('outcome.reply.text +=')
   })
 })