switchroom 0.18.15 → 0.18.18

package/telegram-plugin/tests/premium-recovery-wiring.test.ts

@@ -0,0 +1,150 @@
+/**
+ * Integration test for the premium-recovery ping GLUE
+ * (`runPremiumRecoveryPing`, premium-recovery-wiring.ts) — the never-storm
+ * orchestration the pure `decidePremiumRecovery` / `renderPremiumRecoveryPing`
+ * tests do NOT cover. This is the P0 at-most-once guarantee (claim-gate → clear-
+ * marker-before-send → per-chat fan-out) that was inline in the gateway and so
+ * had ZERO coverage; the same untested-glue gap the tier-downgrade extraction
+ * closed for the downgrade path.
+ *
+ * It drives the real runner with injected seams and PINS:
+ *   - clear-BEFORE-send ordering (never-storm) + exactly one send per chat;
+ *   - claim !granted → marker cleared, NO send;
+ *   - decision.fire === false → no clear, no claim, no send;
+ *   - no marker / no agent dir → no-op;
+ *   - the button `callback_data` is EXACTLY `mdl:alias:<premium>` (a future edit
+ *     can't silently break the session-scoped switch-back path).
+ * These are outcome assertions that FAIL if the guard logic is reordered/dropped.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  runPremiumRecoveryPing,
+  type PremiumRecoveryPingDeps,
+  type PremiumRecoveryMarkerView,
+  type PremiumRecoveryKeyboard,
+} from '../gateway/premium-recovery-wiring.js'
+import type { PremiumRecoveryPing } from '../premium-recovery.js'
+
+interface Recorder {
+  /** Ordered event log — pins clear-before-send. */
+  events: string[]
+  clears: number
+  claims: string[]
+  sends: Array<{ chatId: string; ping: PremiumRecoveryPing; keyboard: PremiumRecoveryKeyboard }>
+  decides: number
+  logs: string[]
+}
+
+function makeDeps(
+  over: {
+    agentDir?: string | null
+    marker?: PremiumRecoveryMarkerView | null
+    fire?: boolean
+    granted?: boolean
+    fallbackChats?: string[]
+  } = {},
+): { deps: PremiumRecoveryPingDeps; rec: Recorder } {
+  const rec: Recorder = { events: [], clears: 0, claims: [], sends: [], decides: 0, logs: [] }
+  const deps: PremiumRecoveryPingDeps = {
+    getAgentDir: () => (over.agentDir === undefined ? '/tmp/agent' : over.agentDir),
+    readMarker: () =>
+      over.marker === undefined
+        ? { premiumModel: 'fable', chats: ['111', '222'] }
+        : over.marker,
+    clearMarker: () => {
+      rec.clears += 1
+      rec.events.push('clear')
+    },
+    getAgent: () => 'klanker',
+    decide: () => {
+      rec.decides += 1
+      return over.fire === undefined ? true : over.fire
+    },
+    claimNotification: async (key) => {
+      rec.claims.push(key)
+      return over.granted === undefined ? true : over.granted
+    },
+    fallbackChats: () => over.fallbackChats ?? ['999'],
+    sendToChat: (chatId, ping, keyboard) => {
+      rec.sends.push({ chatId, ping, keyboard })
+      rec.events.push(`send:${chatId}`)
+    },
+    log: (msg) => rec.logs.push(msg),
+  }
+  return { deps, rec }
+}
+
+describe('runPremiumRecoveryPing — never-storm at-most-once ordering', () => {
+  it('fire + granted: marker cleared BEFORE any send, exactly one send per chat', async () => {
+    const { deps, rec } = makeDeps({ marker: { premiumModel: 'fable', chats: ['111', '222'] } })
+    await runPremiumRecoveryPing(deps)
+    expect(rec.clears).toBe(1)
+    // One send per recorded chat, in order, no duplicates.
+    expect(rec.sends.map((s) => s.chatId)).toEqual(['111', '222'])
+    // The clear MUST precede the first send (a double-send is unrecoverable).
+    const clearIdx = rec.events.indexOf('clear')
+    const firstSendIdx = rec.events.findIndex((e) => e.startsWith('send:'))
+    expect(clearIdx).toBeGreaterThanOrEqual(0)
+    expect(firstSendIdx).toBeGreaterThanOrEqual(0)
+    expect(clearIdx).toBeLessThan(firstSendIdx)
+    // The fleet claim was keyed on agent + the dropped premium token.
+    expect(rec.claims).toEqual(['premium-recovery:klanker:fable'])
+    expect(rec.logs).toHaveLength(1)
+  })
+
+  it('claim NOT granted: marker cleared (no lingering re-attempt), NO send', async () => {
+    const { deps, rec } = makeDeps({ granted: false })
+    await runPremiumRecoveryPing(deps)
+    expect(rec.claims).toEqual(['premium-recovery:klanker:fable'])
+    expect(rec.clears).toBe(1)
+    expect(rec.sends).toHaveLength(0)
+  })
+
+  it('decision.fire === false: NO clear, NO claim, NO send (marker survives for a later tick)', async () => {
+    const { deps, rec } = makeDeps({ fire: false })
+    await runPremiumRecoveryPing(deps)
+    expect(rec.decides).toBe(1)
+    expect(rec.clears).toBe(0)
+    expect(rec.claims).toHaveLength(0)
+    expect(rec.sends).toHaveLength(0)
+  })
+
+  it('no marker present: no-op — no decide, no claim, no clear, no send', async () => {
+    const { deps, rec } = makeDeps({ marker: null })
+    await runPremiumRecoveryPing(deps)
+    expect(rec.decides).toBe(0)
+    expect(rec.clears).toBe(0)
+    expect(rec.claims).toHaveLength(0)
+    expect(rec.sends).toHaveLength(0)
+  })
+
+  it('no agent dir: immediate no-op (marker is never even read)', async () => {
+    const { deps, rec } = makeDeps({ agentDir: null })
+    await runPremiumRecoveryPing(deps)
+    expect(rec.decides).toBe(0)
+    expect(rec.clears).toBe(0)
+    expect(rec.sends).toHaveLength(0)
+  })
+
+  it('marker with no chats falls back to the access allowFrom chats', async () => {
+    const { deps, rec } = makeDeps({
+      marker: { premiumModel: 'fable', chats: [] },
+      fallbackChats: ['999'],
+    })
+    await runPremiumRecoveryPing(deps)
+    expect(rec.sends.map((s) => s.chatId)).toEqual(['999'])
+  })
+})
+
+describe('runPremiumRecoveryPing — session-scoped switch-back button', () => {
+  it('the button callback_data is EXACTLY mdl:alias:<premium> (routes the model-menu apply path)', async () => {
+    const { deps, rec } = makeDeps({ marker: { premiumModel: 'fable', chats: ['111'] } })
+    await runPremiumRecoveryPing(deps)
+    const button = rec.sends[0].keyboard.inline_keyboard[0][0]
+    // Pin the exact wire format — a change to MODEL_CALLBACK_ALIAS or the button
+    // construction that broke the session-scoped `/model` apply path must fail here.
+    expect(button.callback_data).toBe('mdl:alias:fable')
+    expect(button.text).toBe('Switch to fable')
+  })
+})

package/telegram-plugin/tests/premium-recovery.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Unit tests for the "premium model recovered" ping.
+ *
+ *  - `decidePremiumRecovery` is the PURE recovery predicate: fires iff a marker
+ *    is pending AND the broker shows the premium tier servable again (at least
+ *    one account neither `exhausted` nor `premium_walled`) — the exact
+ *    complement of the `all-blocked` condition that fired the downgrade. This
+ *    IS the deterministic recovery signal: both fields are the broker's live-
+ *    authoritative verdicts, so the ping never depends on model judgement.
+ *  - `renderPremiumRecoveryPing` pins the honest, session-scoped wording +
+ *    button label.
+ *  - `premiumRecoveryClaimKey` keys the fleet-wide dedup on agent + token.
+ *  - the `.premium-recovery` carrier round-trips + is shape-gated (parity with
+ *    the `.session-model` / `.session-effort` carriers).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  decidePremiumRecovery,
+  renderPremiumRecoveryPing,
+  premiumRecoveryClaimKey,
+} from '../premium-recovery.js'
+import {
+  writePremiumRecoveryFile,
+  readPremiumRecoveryFile,
+  clearPremiumRecoveryFile,
+  parsePremiumRecovery,
+  PREMIUM_RECOVERY_FILE,
+} from '../gateway/session-model-file.js'
+
+describe('decidePremiumRecovery — deterministic recovery predicate', () => {
+  it('no marker → never fires', () => {
+    expect(
+      decidePremiumRecovery({ hasMarker: false, accounts: [{ exhausted: false, premiumWalled: false }] }),
+    ).toEqual({ fire: false, reason: 'no-marker' })
+  })
+
+  it('marker pending but EVERY account still walled/exhausted → no fire (still-walled)', () => {
+    const d = decidePremiumRecovery({
+      hasMarker: true,
+      accounts: [
+        { exhausted: true, premiumWalled: false },
+        { exhausted: false, premiumWalled: true },
+        { exhausted: true, premiumWalled: true },
+      ],
+    })
+    expect(d).toEqual({ fire: false, reason: 'still-walled' })
+  })
+
+  it('marker pending AND one account can serve the premium tier again → fire', () => {
+    const d = decidePremiumRecovery({
+      hasMarker: true,
+      accounts: [
+        { exhausted: true, premiumWalled: true },
+        { exhausted: false, premiumWalled: false }, // recovered
+      ],
+    })
+    expect(d).toEqual({ fire: true, reason: 'recovered' })
+  })
+
+  it('an account that is exhausted-but-not-premium-walled does NOT count as recovered', () => {
+    // The premium tier is only servable on an account that is BOTH not
+    // exhausted AND not premium-walled.
+    const d = decidePremiumRecovery({
+      hasMarker: true,
+      accounts: [{ exhausted: true, premiumWalled: false }],
+    })
+    expect(d.fire).toBe(false)
+  })
+
+  it('an account that is premium-walled-but-not-exhausted does NOT count as recovered', () => {
+    const d = decidePremiumRecovery({
+      hasMarker: true,
+      accounts: [{ exhausted: false, premiumWalled: true }],
+    })
+    expect(d.fire).toBe(false)
+  })
+
+  it('empty account list with a pending marker → no fire (nothing servable)', () => {
+    expect(decidePremiumRecovery({ hasMarker: true, accounts: [] }).fire).toBe(false)
+  })
+})
+
+describe('renderPremiumRecoveryPing — honest wording', () => {
+  it('names the model, says available again, and offers a session-scoped switch', () => {
+    const p = renderPremiumRecoveryPing('fable')
+    expect(p.text).toContain('`fable`')
+    expect(p.text.toLowerCase()).toContain('available again')
+    expect(p.text.toLowerCase()).toContain('this session')
+    expect(p.buttonText).toBe('Switch to fable')
+    // Must NOT over-promise a durable pin.
+    expect(p.text.toLowerCase()).not.toContain('permanently')
+    expect(p.text.toLowerCase()).not.toContain('forever')
+  })
+})
+
+describe('premiumRecoveryClaimKey', () => {
+  it('keys the dedup on agent + token so different drops never collide', () => {
+    expect(premiumRecoveryClaimKey('klanker', 'fable')).toBe('premium-recovery:klanker:fable')
+    expect(premiumRecoveryClaimKey('klanker', 'fable')).not.toBe(
+      premiumRecoveryClaimKey('klanker', 'opus'),
+    )
+  })
+})
+
+describe('.premium-recovery carrier — round-trip + shape gate', () => {
+  let dir: string
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'premium-recovery-'))
+  })
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('write → read round-trips model + chats (a VALID marker is NOT swept)', () => {
+    writePremiumRecoveryFile(dir, 'fable', ['12345', '67890'])
+    const rec = readPremiumRecoveryFile(dir)
+    expect(rec?.premiumModel).toBe('fable')
+    expect(rec?.chats).toEqual(['12345', '67890'])
+    expect(typeof rec?.ts).toBe('number')
+    // A well-formed marker must survive a read — only corrupt files are swept.
+    expect(existsSync(join(dir, PREMIUM_RECOVERY_FILE))).toBe(true)
+  })
+
+  it('clear removes the marker', () => {
+    writePremiumRecoveryFile(dir, 'fable', ['12345'])
+    expect(existsSync(join(dir, PREMIUM_RECOVERY_FILE))).toBe(true)
+    clearPremiumRecoveryFile(dir)
+    expect(existsSync(join(dir, PREMIUM_RECOVERY_FILE))).toBe(false)
+    expect(readPremiumRecoveryFile(dir)).toBeNull()
+  })
+
+  it('refuses a non-canonical model token (shell-injection shape)', () => {
+    expect(() => writePremiumRecoveryFile(dir, 'bad name; rm -rf /', ['12345'])).toThrow()
+  })
+
+  it('refuses an empty chat list (a marker with nowhere to ping is a bug)', () => {
+    expect(() => writePremiumRecoveryFile(dir, 'fable', [])).toThrow()
+  })
+
+  it('parse rejects corrupt JSON / bad shape / bad token / empty chats', () => {
+    expect(parsePremiumRecovery('{broken')).toBeNull()
+    expect(parsePremiumRecovery(JSON.stringify({ premiumModel: 'fable', chats: [], ts: 1 }))).toBeNull()
+    expect(
+      parsePremiumRecovery(JSON.stringify({ premiumModel: 'bad;name', chats: ['1'], ts: 1 })),
+    ).toBeNull()
+    expect(
+      parsePremiumRecovery(JSON.stringify({ premiumModel: 'fable', chats: [1, 2], ts: 1 })),
+    ).toBeNull()
+    expect(parsePremiumRecovery(JSON.stringify({ premiumModel: 'fable', chats: ['1'] }))).toBeNull()
+  })
+
+  it('read returns null on a corrupt on-disk marker AND sweeps the garbled file', () => {
+    writeFileSync(join(dir, PREMIUM_RECOVERY_FILE), '{not json\n')
+    expect(existsSync(join(dir, PREMIUM_RECOVERY_FILE))).toBe(true)
+    expect(readPremiumRecoveryFile(dir)).toBeNull()
+    // LOW-1: a corrupt marker is garbage-collected on read so it can't linger
+    // forever (neither the ping path nor the manual-switch clear could ever
+    // delete it — both read null first).
+    expect(existsSync(join(dir, PREMIUM_RECOVERY_FILE))).toBe(false)
+  })
+})

package/telegram-plugin/tests/quota-watch.test.ts

@@ -1170,4 +1170,25 @@ describe("buildFleetRollMessage — reason attribution (#3031 PR 2 reason field)
       expect(msg).toContain("7-day window at 96% on");
     }
   });
+
+  it("model-tier-wall (#3176) names the flagship tier and reassures opus/haiku are unaffected — not a generic quota window", () => {
+    // A tier wall binds on the 7d_oi bucket; window/pct are absent (5h/7d read
+    // healthy). exhausted_until carries the tier reset.
+    const roll: FleetRollInfo = {
+      from: "alice@example.com",
+      to: "bob@example.com",
+      at: NOW - 60_000,
+      reason: "model-tier-wall",
+      bucket: "seven_day_overage_included",
+      exhausted_until: NOW + 2.8 * 60 * 60 * 1000,
+    };
+    const msg = buildFleetRollMessage(roll, NOW);
+    expect(msg).toContain("Flagship (premium) tier weekly limit reached");
+    expect(msg).toContain("opus/haiku on that account are unaffected");
+    // Must NOT mislead as a generic 5h/7d window roll.
+    expect(msg).not.toContain("quota window");
+    expect(msg).not.toContain("Proactive switch");
+    // The tier reset is surfaced.
+    expect(msg).toContain("resets");
+  });
 });

package/telegram-plugin/tests/reaction-gate-routing.test.ts

@@ -29,7 +29,7 @@
 import { describe, it, expect, vi } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
-import { createSendGate, type Clock } from '../send-gate.js'
+import { createSendGate, SEND_GATE_SHED, type Clock } from '../send-gate.js'
 import { createRetryApiCall } from '../retry-api-call.js'
 import { errors } from './fake-bot-api.js'
 
@@ -95,7 +95,7 @@ describe('#3155 reactions route through the send gate (cosmetic)', () => {
     // resolves undefined (fire-and-forget callers .catch nothing), and the gate
     // counts the shed.
     expect(setMessageReaction).not.toHaveBeenCalled()
-    expect(result).toBeUndefined()
+    expect(result).toBe(SEND_GATE_SHED) // shed sentinel (#3110 F1)
     expect(sendGate.stats().global.shed).toBe(1)
   })
 
@@ -130,7 +130,12 @@ describe('#3155 reactions route through the send gate (cosmetic)', () => {
     // The reaction actually reached the API (was admitted, not shed)...
     expect(setMessageReaction).toHaveBeenCalled()
     // ...and its 429 was recorded by the breaker — the whole gap this closes.
-    expect(onFloodWait).toHaveBeenCalledWith(7)
+    // #3111: the retry policy now also passes the call's opts so the gateway can
+    // open a scope-precise window (a reaction 429 implies only that chat).
+    expect(onFloodWait).toHaveBeenCalledWith(
+      7,
+      expect.objectContaining({ chat_id: 'chatA', priorityClass: 'cosmetic' }),
+    )
   })
 })
 

package/telegram-plugin/tests/retry-api-call.test.ts

@@ -576,6 +576,27 @@ describe('#2923 — LOCAL resource exhaustion is NOT retried (avoids flood ban)'
     expect(out).toBe('ok')
     expect(seen).toEqual([42])
   })
+
+  it('passes the call opts to onFloodWait so the gateway can open a scope-precise window (#3111)', async () => {
+    const seen: { sec: number; chat_id?: string; chatType?: string }[] = []
+    const sleep = vi.fn(async () => {})
+    let n = 0
+    const retry = createRetryApiCall({
+      maxRetries: 3,
+      sleep,
+      onFloodWait: (sec, opts) => seen.push({ sec, chat_id: opts?.chat_id, chatType: opts?.chatType }),
+    })
+    const out = await retry(
+      async () => {
+        if (n++ === 0) throw errors.floodWait(7)
+        return 'ok'
+      },
+      { chat_id: '42', chatType: 'supergroup' },
+    )
+    expect(out).toBe('ok')
+    // The hook received the same chat scope the send carried — not a bare number.
+    expect(seen).toEqual([{ sec: 7, chat_id: '42', chatType: 'supergroup' }])
+  })
 })
 
 describe('#3084 — a long flood ban fails FAST instead of sleeping for hours', () => {

package/telegram-plugin/tests/session-model-file.test.ts

@@ -1,10 +1,12 @@
 /**
- * Durable session-model file helpers (session-model-file.ts) — the gateway
- * side of the stickiness contract (reference/rfcs/session-model-stickiness.md).
+ * Session-model file helpers (session-model-file.ts) — the gateway side of the
+ * session-scoped /model contract (reference/rfcs/session-model-stickiness.md
+ * §0.1, rev 4 — consume-once). The `.relaunch-model-intent` subsystem and the
+ * crashloop counter were retired with rev 4; their tests are gone.
  */
 
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import {
@@ -15,17 +17,8 @@ import {
   readSessionModelFileRaw,
   restoreSessionModelFileRaw,
   clearSessionModelFile,
-  clearSessionModelBootAttempts,
-  SESSION_MODEL_BOOT_ATTEMPTS_FILE,
-  writeRelaunchModelIntent,
-  clearRelaunchModelIntent,
   readConfiguredDefaultModel,
-  intentForRestartReason,
-  readRelaunchModelIntent,
-  clearStaleGatewayShutdownIntent,
-  GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX,
   SESSION_MODEL_FILE,
-  RELAUNCH_MODEL_INTENT_FILE,
   CONFIGURED_DEFAULT_MODEL_FILE,
   parseSessionEffort,
   writeSessionEffortFile,
@@ -87,86 +80,6 @@ describe('rollback snapshot (scheduleModelRelaunch dispatch failure)', () => {
   })
 })
 
-describe('relaunch intent', () => {
-  it('writes one-line JSON with intent, reason, and embedded ts (the freshness clock)', () => {
-    writeRelaunchModelIntent(dir, 'keep', 'user: /new from chat')
-    const raw = readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')
-    const parsed = JSON.parse(raw)
-    expect(parsed.intent).toBe('keep')
-    expect(parsed.reason).toBe('user: /new from chat')
-    expect(Math.abs(Date.now() - parsed.ts)).toBeLessThan(5000)
-  })
-
-  it('last-writer-wins and clearable', () => {
-    writeRelaunchModelIntent(dir, 'keep', 'a')
-    writeRelaunchModelIntent(dir, 'revert', 'b')
-    expect(JSON.parse(readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')).intent).toBe('revert')
-    clearRelaunchModelIntent(dir)
-    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
-  })
-})
-
-describe('intentForRestartReason — the triggerSelfRestart per-reason table (RFC §3)', () => {
-  it.each([
-    'schedule-restart-immediate',
-    'restart-drain-cap-forced',
-    'turn-complete-pending-restart',
-    'fleet-fallback-resume',
-    'sr-to-claude-model-switch',
-  ])('switchroom-managed relaunch %s → keep', (reason) => {
-    expect(intentForRestartReason(reason)).toBe('keep')
-  })
-
-  it('inline-button-restart → keep (#3039: a restart is not "clear my model")', () => {
-    expect(intentForRestartReason('inline-button-restart')).toBe('keep')
-  })
-
-  it('unknown gateway reasons default to keep (only gateway code calls triggerSelfRestart; crashes never do)', () => {
-    expect(intentForRestartReason('some-future-recovery-path')).toBe('keep')
-  })
-})
-
-describe('readRelaunchModelIntent', () => {
-  it('round-trips a stamped intent; null when absent / corrupt / malformed', () => {
-    expect(readRelaunchModelIntent(dir)).toBeNull()
-    writeRelaunchModelIntent(dir, 'keep', 'watchdog recovery')
-    const rec = readRelaunchModelIntent(dir)!
-    expect(rec.intent).toBe('keep')
-    expect(rec.reason).toBe('watchdog recovery')
-    expect(Math.abs(Date.now() - rec.ts)).toBeLessThan(5000)
-    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), '{broken')
-    expect(readRelaunchModelIntent(dir)).toBeNull()
-    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), '{"intent":"maybe","reason":"x","ts":1}\n')
-    expect(readRelaunchModelIntent(dir)).toBeNull()
-  })
-})
-
-describe('clearStaleGatewayShutdownIntent (#3018 finding 4 — a gateway-only bounce must not leave a keep stamp)', () => {
-  it('clears ONLY a gateway-shutdown-stamped intent and reports it', () => {
-    writeRelaunchModelIntent(
-      dir,
-      'keep',
-      `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful SIGTERM shutdown (deploy/rolling restart) — preserving user-chosen session model`,
-    )
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(true)
-    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
-    // Idempotent: a second call finds nothing.
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-  })
-
-  it('never touches a triggerSelfRestart / user-slash stamp (un-prefixed reason)', () => {
-    writeRelaunchModelIntent(dir, 'keep', 'sr-to-claude-model-switch')
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-    expect(readRelaunchModelIntent(dir)!.reason).toBe('sr-to-claude-model-switch')
-  })
-
-  it('is a safe no-op on an absent or corrupt intent file', () => {
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'not json')
-    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
-  })
-})
-
 describe('readConfiguredDefaultModel', () => {
   it('reads the trimmed value; null when absent or empty', () => {
     expect(readConfiguredDefaultModel(dir)).toBeNull()
@@ -181,9 +94,9 @@ describe('readConfiguredDefaultModel', () => {
   })
 })
 
-// ─── #3039: durable session-effort carrier ───────────────────────────────────
+// ─── #3186: consume-once session-effort carrier (queued-command boot apply) ──
 
-describe('session-effort file helpers (#3039)', () => {
+describe('session-effort file helpers (#3186)', () => {
   let dir: string
   beforeEach(() => {
     dir = mkdtempSync(join(tmpdir(), 'sr-session-effort-'))
@@ -218,64 +131,3 @@ describe('session-effort file helpers (#3039)', () => {
     expect(readSessionEffortFile(dir)).toBeNull()
   })
 })
-
-describe('intentForRestartReason is keep-for-everything (#3039)', () => {
-  it('every reason keeps — restarts never clear a user model choice', () => {
-    for (const reason of [
-      'inline-button-restart',
-      'user: /restart from chat',
-      'schedule-restart-immediate',
-      'anything-else',
-    ]) {
-      expect(intentForRestartReason(reason)).toBe('keep')
-    }
-  })
-})
-
-describe('clearSessionModelBootAttempts (#3043 item 2: bridge-register clears the crashloop counter)', () => {
-  const bootAttemptsPath = () => join(dir, SESSION_MODEL_BOOT_ATTEMPTS_FILE)
-
-  // Faithful model of start.sh.hbs "Override crashloop self-heal": each boot
-  // within 150s of the previous stamp bumps the count; a stale stamp resets to
-  // 1. Reproduced here so the accumulate-vs-reset OUTCOME is asserted, not just
-  // the delete call.
-  function simulateBootStamp(nowSec: number): number {
-    let count = 0
-    let prev = 0
-    if (existsSync(bootAttemptsPath())) {
-      const [c, p] = readFileSync(bootAttemptsPath(), 'utf8').trim().split(/\s+/)
-      count = Number(c) || 0
-      prev = Number(p) || 0
-    }
-    count = nowSec - prev < 150 ? count + 1 : 1
-    writeFileSync(bootAttemptsPath(), `${count} ${nowSec}\n`)
-    return count
-  }
-
-  it('WITHOUT a bridge register, three fast boots accumulate toward the 3-strike clear', () => {
-    // Three operator hand-bounces, each <150s apart, with no register between.
-    expect(simulateBootStamp(1000)).toBe(1)
-    expect(simulateBootStamp(1010)).toBe(2)
-    expect(simulateBootStamp(1020)).toBe(3) // start.sh would now clear a HEALTHY override — the false positive
-  })
-
-  it('a bridge register between boots resets the counter, so a healthy agent never reaches 3', () => {
-    expect(simulateBootStamp(1000)).toBe(1)
-    // Boot 1 came all the way up and the bridge registered → gateway clears it.
-    clearSessionModelBootAttempts(dir)
-    expect(existsSync(bootAttemptsPath())).toBe(false)
-
-    // Next fast boot starts fresh at 1 (no accumulation), and register clears again.
-    expect(simulateBootStamp(1010)).toBe(1)
-    clearSessionModelBootAttempts(dir)
-    expect(simulateBootStamp(1020)).toBe(1)
-    // The healthy agent's counter never climbs to the 3-strike clear.
-    const [count] = readFileSync(bootAttemptsPath(), 'utf8').trim().split(/\s+/)
-    expect(Number(count)).toBeLessThan(3)
-  })
-
-  it('is best-effort — no throw when the counter file is absent', () => {
-    expect(existsSync(bootAttemptsPath())).toBe(false)
-    expect(() => clearSessionModelBootAttempts(dir)).not.toThrow()
-  })
-})