switchroom 0.18.23 → 0.18.25

package/telegram-plugin/tests/crash-redelivery-resume-exclusion.test.ts

@@ -0,0 +1,133 @@
+import { describe, it, expect } from 'vitest'
+import { decideRedeliverCapture } from '../gateway/redelivery-decision.js'
+import {
+  decideBootResumeKind,
+  RESUME_SYNTHETIC_PROMPT_PREFIX,
+} from '../gateway/resume-inbound-builder.js'
+import type { Turn, TurnEndedVia } from '../registry/turns-schema.js'
+
+/**
+ * Pins the MUTUAL EXCLUSION between crash-survival redelivery and the resume
+ * synthetic — the double-send guard. The gateway boot block composes exactly
+ * these two pure predicates: `decideBootResumeKind` classifies the interrupted
+ * turn, then `decideRedeliverCapture({ willBeResumed: kind === 'resume', ... })`
+ * decides whether to ALSO stage a redelivery.
+ *
+ * The load-bearing outcome: an interrupted turn that WILL be resumed (the model
+ * re-runs and emits a fresh answer) must NOT also redeliver its recovered draft
+ * — otherwise the same answer reaches the user twice. Conversely, a turn that
+ * will NOT be resumed (watchdog report, boot_resume:never suppression,
+ * resume-of-a-resume loop-guard) MUST redeliver, because nothing else re-answers.
+ *
+ * This mirrors the gateway wiring exactly, so it asserts the real composed
+ * outcome, not an isolated code path.
+ */
+
+const RESUME_MAX_AGE_MS = 10_800_000 // 3h, gateway default
+
+function makeTurn(over: Partial<Turn> = {}): Turn {
+  return {
+    turn_key: '900001:_#7',
+    chat_id: '900001',
+    thread_id: null,
+    started_at: Date.now() - 60_000, // 1 min ago — well within maxAge
+    ended_at: null,
+    ended_via: null,
+    last_assistant_msg_id: null,
+    last_assistant_done: null,
+    last_user_msg_id: null,
+    user_prompt_preview: 'deploy the staging stack',
+    assistant_reply_preview: null,
+    tool_call_count: 2,
+    interrupt_reason: null,
+    resumed_at: null,
+    session_id: 'sess-abcd', // durably pinned → redelivery is eligible on the floor
+    ...over,
+  } as Turn
+}
+
+/** Compose the two predicates exactly as the gateway boot block does. */
+function composeGate(turn: Turn, suppressed: boolean) {
+  const bootResumeKind = decideBootResumeKind({
+    pending: turn,
+    suppressed,
+    ageMs: Math.max(0, Date.now() - turn.started_at),
+    maxAgeMs: RESUME_MAX_AGE_MS,
+  })
+  const capture = decideRedeliverCapture({
+    willBeResumed: bootResumeKind === 'resume',
+    hasSessionId: Boolean(turn.session_id),
+  })
+  return { bootResumeKind, capture }
+}
+
+describe('crash-redelivery ↔ resume mutual exclusion (no double-send)', () => {
+  it('(a) an interrupted turn that WILL be resumed does NOT also redeliver', () => {
+    // ended_via 'restart' → decideBootResumeKind returns 'resume': the model
+    // re-runs and emits a fresh answer that supersedes any recovered draft.
+    const turn = makeTurn({ ended_via: 'restart' as TurnEndedVia })
+    const { bootResumeKind, capture } = composeGate(turn, /* suppressed */ false)
+    expect(bootResumeKind).toBe('resume')
+    expect(capture.capture).toBe(false)
+    expect(capture.skipReason).toBe('will-be-resumed')
+  })
+
+  it('(a2) a still-open (ended_via=null) killed-mid-flight turn is resumed, not redelivered', () => {
+    const turn = makeTurn({ ended_via: null })
+    const { bootResumeKind, capture } = composeGate(turn, false)
+    expect(bootResumeKind).toBe('resume')
+    expect(capture.capture).toBe(false)
+  })
+
+  it('(b) a watchdog-timeout turn (report, no auto re-answer) DOES redeliver', () => {
+    // ended_via 'timeout' → 'report': the synthetic only ASKS the user whether
+    // to retry — it does not auto-re-answer. Redelivery is the correct recovery.
+    const turn = makeTurn({ ended_via: 'timeout' as TurnEndedVia })
+    const { bootResumeKind, capture } = composeGate(turn, false)
+    expect(bootResumeKind).toBe('report')
+    expect(capture.capture).toBe(true)
+    expect(capture.skipReason).toBeUndefined()
+  })
+
+  it('(b2) a boot_resume:never-suppressed turn (defer-suppressed) DOES redeliver', () => {
+    // suppressed=true → 'defer-suppressed': no synthetic re-run, so redelivery
+    // is the ONLY recovery send.
+    const turn = makeTurn({ ended_via: 'restart' as TurnEndedVia })
+    const { bootResumeKind, capture } = composeGate(turn, /* suppressed */ true)
+    expect(bootResumeKind).toBe('defer-suppressed')
+    expect(capture.capture).toBe(true)
+  })
+
+  it('(b3) a resume-of-a-resume (loop-guard → defer-loop) turn DOES redeliver', () => {
+    // A turn whose prompt is itself a resume synthetic → 'defer-loop': the chain
+    // is capped, no re-run happens, so redelivery must still recover the answer.
+    const turn = makeTurn({
+      ended_via: 'restart' as TurnEndedVia,
+      user_prompt_preview: `${RESUME_SYNTHETIC_PROMPT_PREFIX} Continue the interrupted deploy.`,
+    })
+    const { bootResumeKind, capture } = composeGate(turn, false)
+    expect(bootResumeKind).toBe('defer-loop')
+    expect(capture.capture).toBe(true)
+  })
+
+  it('(b4) a STALE resume downgraded to report DOES redeliver (not suppressed)', () => {
+    // A 'restart' turn older than maxAge downgrades resume→report in
+    // selectResumeBuilder. Because the final kind is 'report' (no re-run),
+    // redelivery must fire — the gate keys on the FINAL kind, not the raw
+    // ended_via.
+    const turn = makeTurn({
+      ended_via: 'restart' as TurnEndedVia,
+      started_at: Date.now() - (RESUME_MAX_AGE_MS + 60_000),
+    })
+    const { bootResumeKind, capture } = composeGate(turn, false)
+    expect(bootResumeKind).toBe('report')
+    expect(capture.capture).toBe(true)
+  })
+
+  it('eligibility floor still applies: no session_id → no redelivery even when not resumed', () => {
+    const turn = makeTurn({ ended_via: 'timeout' as TurnEndedVia, session_id: null })
+    const { capture } = composeGate(turn, false)
+    expect(capture.capture).toBe(false)
+    expect(capture.skipReason).toBe('no-session-id')
+  })
+})

package/telegram-plugin/tests/crash-redelivery-wiring.test.ts

@@ -0,0 +1,72 @@
+import { describe, it, expect } from 'vitest'
+import { projectTrailingAnswerFromTranscript } from '../session-tail.js'
+import { decideRedeliver, REDELIVERY_PREFIX } from '../gateway/redelivery-decision.js'
+
+/**
+ * Pins the crash-survival redelivery WIRING GLUE — the composition
+ * `maybeRedeliverUndeliveredAnswer` performs in the boot send: project the
+ * interrupted turn's trailing answer from its transcript, then feed
+ * (`text`, `trailingIsText`) plus the durable oracle result into
+ * `decideRedeliver`. The oracle (`hasOutboundWithText`) and the projector are
+ * unit-tested in their own suites (history.test.ts / trailing-answer-projector
+ * .test.ts); this asserts the two ends plumb together — the projected answer is
+ * what gets framed, and a dangling mid-tool turn is refused before any send.
+ *
+ * The raw Telegram socket send and the post-`getMe()` connect sequencing are NOT
+ * unit-testable here (they require a connected grammy client); the ordering
+ * guarantee is documented on `maybeRedeliverUndeliveredAnswer` and enforced by
+ * its single call site inside the `didOneTimeSetup` block, which is unreachable
+ * until `bot.api.getMe()` resolves.
+ */
+
+const FINAL_ANSWER = 'The deploy finished — all three services are green and healthy.'
+
+function compose(transcript: string, hasDeliveredText: boolean) {
+  const projected = projectTrailingAnswerFromTranscript(transcript)
+  return decideRedeliver({
+    capturedText: projected.text,
+    trailingIsText: projected.trailingIsText,
+    hasDeliveredText,
+    alreadyRedelivered: false,
+    ageMs: 60_000,
+    maxAgeMs: 10_800_000,
+  })
+}
+
+function line(obj: unknown): string {
+  return JSON.stringify(obj)
+}
+const completedTurn = [
+  line({ type: 'user', message: { role: 'user', content: 'deploy status?' } }),
+  line({ type: 'assistant', message: { content: [{ type: 'text', text: 'Checking.' }] } }),
+  line({ type: 'assistant', message: { content: [{ type: 'tool_use', name: 'Bash', id: 'toolu_x', input: {} }] } }),
+  line({ type: 'assistant', message: { content: [{ type: 'text', text: FINAL_ANSWER }] } }),
+].join('\n')
+const danglingToolTurn = [
+  line({ type: 'user', message: { role: 'user', content: 'run the migration' } }),
+  line({ type: 'assistant', message: { content: [{ type: 'text', text: 'On it.' }] } }),
+  line({ type: 'assistant', message: { content: [{ type: 'tool_use', name: 'Bash', id: 'toolu_y', input: {} }] } }),
+].join('\n')
+
+describe('crash-redelivery wiring glue (project → decide)', () => {
+  it('frames the PROJECTED trailing answer when the oracle says it was not delivered', () => {
+    const d = compose(completedTurn, /* hasDeliveredText */ false)
+    expect(d.redeliver).toBe(true)
+    expect(d.framedText?.startsWith(REDELIVERY_PREFIX)).toBe(true)
+    expect(d.framedText).toContain(FINAL_ANSWER)
+  })
+
+  it('skips when the oracle reports the projected answer was already delivered', () => {
+    expect(compose(completedTurn, /* hasDeliveredText */ true).skipReason).toBe('already-delivered')
+  })
+
+  it('refuses a turn killed mid-tool before any send', () => {
+    // The projector RESETS the buffer on the trailing tool_use, so the recovered
+    // text is empty AND trailingIsText is false — either guard refuses. The
+    // decision reports 'empty-text' (checked first); the load-bearing property is
+    // simply that no send happens for a dangling mid-tool turn.
+    const d = compose(danglingToolTurn, false)
+    expect(d.redeliver).toBe(false)
+    expect(d.skipReason).toBe('empty-text')
+  })
+})

package/telegram-plugin/tests/history.test.ts

@@ -14,6 +14,8 @@ import {
   getRecentOutboundCount,
   getLatestInboundMessageId,
   hasOutboundDeliveredSince,
+  hasOutboundWithText,
+  normalizeDeliveryText,
   _resetForTests,
 } from '../history.js'
 
@@ -872,3 +874,92 @@ describe('forwarded-message origin columns', () => {
     expect(stored).toContain('Bob') // surrounding name preserved
   })
 })
+
+// ---------------------------------------------------------------------------
+// hasOutboundWithText — durable text-identity delivery oracle (crash-survival
+// redelivery). Keys on the ANSWER TEXT, not a chat+time window, so an interim
+// progress_update earlier in the same turn does NOT false-positive "delivered".
+// ---------------------------------------------------------------------------
+
+describe('hasOutboundWithText (durable text-identity oracle)', () => {
+  it('does NOT match an interim progress message against the (undelivered) final answer', () => {
+    initHistory(stateDir, 30)
+    // The turn sent only an interim progress_update; the real final answer was
+    // lost in the crash and never recorded. The time-windowed oracle would say
+    // "delivered" off the progress row — the text-identity oracle must not.
+    recordOutbound({
+      chat_id: '1', thread_id: null, message_ids: [10],
+      texts: ['on it — pulling yesterday’s GitHub activity'], ts: 200,
+    })
+    const finalAnswer = 'The deploy finished — all three services are green.'
+    expect(hasOutboundWithText('1', finalAnswer, null)).toBe(false)
+    // sanity: the coarse time-window oracle DOES false-positive here (this is
+    // exactly why we cannot use it as the redelivery gate).
+    expect(hasOutboundDeliveredSince('1', 100 * 1000, null, 1)).toBe(true)
+  })
+
+  it('matches when the final answer text was actually delivered', () => {
+    initHistory(stateDir, 30)
+    const finalAnswer = 'The deploy finished — all three services are green.'
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [11], texts: [finalAnswer], ts: 300 })
+    expect(hasOutboundWithText('1', finalAnswer, null)).toBe(true)
+  })
+
+  it('matches a delivered chunk-1 against a longer projected answer (multi-chunk, no double-send)', () => {
+    initHistory(stateDir, 30)
+    const chunk1 = 'Part one of a long answer that was split across chunks.'
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [12], texts: [chunk1], ts: 300 })
+    // The re-projected full answer starts with chunk-1 → treated as delivered.
+    expect(hasOutboundWithText('1', chunk1 + ' Part two continues here.', null)).toBe(true)
+  })
+
+  it('ignores whitespace/spacer differences via normalization', () => {
+    initHistory(stateDir, 30)
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [13], texts: ['hello   world'], ts: 300 })
+    expect(hasOutboundWithText('1', 'hello world', null)).toBe(true)
+    expect(normalizeDeliveryText('hello   world')).toBe('hello world')
+  })
+
+  it('empty/whitespace text never matches', () => {
+    initHistory(stateDir, 30)
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [14], texts: ['real'], ts: 300 })
+    expect(hasOutboundWithText('1', '   ', null)).toBe(false)
+  })
+
+  it('scopes by chat (a different chat does not satisfy the match)', () => {
+    initHistory(stateDir, 30)
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [15], texts: ['scoped answer'], ts: 300 })
+    expect(hasOutboundWithText('2', 'scoped answer', null)).toBe(false)
+    expect(hasOutboundWithText('1', 'scoped answer', null)).toBe(true)
+  })
+
+  // diff-review defect #1 — a SHORT final answer must not false-positive-match an
+  // unrelated earlier row via the bidirectional-prefix rule (that would suppress a
+  // genuine redelivery = permanent silence). Short texts require full equality.
+  it('does NOT suppress a short answer that merely shares a prefix with an unrelated row', () => {
+    initHistory(stateDir, 30)
+    // An earlier turn delivered a longer line that starts with the short answer.
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [20], texts: ['Done, deploying now.'], ts: 300 })
+    // The interrupted turn's real final answer was the short "Done." — never sent.
+    expect(hasOutboundWithText('1', 'Done.', null)).toBe(false)
+  })
+
+  it('still suppresses a short answer that was genuinely delivered (exact match)', () => {
+    initHistory(stateDir, 30)
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [21], texts: ['Done.'], ts: 300 })
+    expect(hasOutboundWithText('1', 'Done.', null)).toBe(true)
+  })
+
+  // sinceMs scope: only rows delivered at/after the interrupted turn's started_at
+  // count, so an unrelated PRIOR turn's identical text can never suppress.
+  it('scopes by sinceMs (a prior-turn row before the floor does not match)', () => {
+    initHistory(stateDir, 30)
+    // Prior turn delivered this exact text at ts=200s.
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [22], texts: ['repeated answer'], ts: 200 })
+    // Interrupted turn started at 250s (250_000 ms) — the prior row is out of scope.
+    expect(hasOutboundWithText('1', 'repeated answer', null, 250_000)).toBe(false)
+    // A row delivered within the turn window (ts=300s) does match.
+    recordOutbound({ chat_id: '1', thread_id: null, message_ids: [23], texts: ['repeated answer'], ts: 300 })
+    expect(hasOutboundWithText('1', 'repeated answer', null, 250_000)).toBe(true)
+  })
+})

package/telegram-plugin/tests/model-command.test.ts

@@ -200,6 +200,91 @@ describe("handleModelCommand — show / help never inject (picker-wedge guard)",
   });
 });
 
+describe("handleModelCommand — set — #3241 poll-until-signal wiring", () => {
+  it("forwards successPattern + errorPattern + settleBeforeSendMs to the inject primitive", async () => {
+    const seen: Array<{ command: string; opts: unknown }> = [];
+    const { deps } = makeDeps({
+      inject: async (_agent, command, opts) => {
+        seen.push({ command, opts });
+        return okResult("⏺ Set model to Sonnet 5 for this session");
+      },
+    });
+    await handleModelCommand({ kind: "set", model: "sonnet" }, deps);
+    expect(seen).toHaveLength(1);
+    const opts = seen[0].opts as {
+      successPattern?: RegExp;
+      errorPattern?: RegExp;
+      settleBeforeSendMs?: number;
+    };
+    // A success pattern that matches claude's confirmation line, an error pattern
+    // that matches the "not found" line, and a clean-prompt pre-send wait.
+    expect(opts.successPattern?.test("⏺ Set model to Sonnet 5")).toBe(true);
+    expect(opts.errorPattern?.test("⎿  Model 'x' not found")).toBe(true);
+    expect(typeof opts.settleBeforeSendMs).toBe("number");
+    expect(opts.settleBeforeSendMs).toBeGreaterThan(0);
+  });
+
+  it("confirmation that lands after a banner → records the live model for /status", async () => {
+    // The inject primitive (poll-until-signal) is responsible for returning the
+    // confirmation and not the banner; here the handler receives that confirmation
+    // and must record it as the session override.
+    const { deps } = makeDeps({
+      inject: async () =>
+        okResult("⠋ extending Claude Fable 5 access…\n⎿  Set model to Fable 5 for this session"),
+    });
+    const reply = await handleModelCommand({ kind: "set", model: "fable" }, deps);
+    expect(reply.selectedModel).toBe("Fable 5");
+    expect(reply.optimistic).toBeUndefined();
+    expect(reply.text).toContain("Set model to Fable 5");
+    // The banner is scrollback and must not leak as prose above the confirmation.
+    expect(reply.text).not.toContain("extending Claude Fable 5 access");
+  });
+
+  it("scraped error line → failure verdict AND no override recorded (retract)", async () => {
+    const { deps } = makeDeps({
+      inject: async () => okResult("⎿  Model 'claude-bogus-99' not found"),
+    });
+    const reply = await handleModelCommand({ kind: "set", model: "claude-bogus-99" }, deps);
+    expect(reply.text).toContain("did not take");
+    expect(reply.selectedModel).toBeUndefined();
+    expect(reply.optimistic).toBeUndefined();
+  });
+
+  // #3242 review MEDIUM 1 — an access/entitlement denial must NOT be recorded
+  // optimistically. Each of these lines matches neither the confirmation prefix
+  // nor the OLD bad-id error regex, so before the widen they slipped into the
+  // optimistic branch and falsely recorded the switch.
+  for (const denial of [
+    "⎿  Fable is not available on your plan",
+    "⎿  access denied",
+    "⎿  Fable requires a Pro subscription",
+    "⎿  This model is not enabled for your account",
+    "⎿  No access to Fable on this tier",
+    "⎿  Fable 5 is currently unavailable",
+  ]) {
+    it(`access-denial line → failure verdict AND no override (retract): ${JSON.stringify(denial)}`, async () => {
+      const { deps } = makeDeps({ inject: async () => okResult(denial) });
+      const reply = await handleModelCommand({ kind: "set", model: "fable" }, deps);
+      expect(reply.text).toContain("did not take");
+      expect(reply.selectedModel).toBeUndefined();
+      expect(reply.optimistic).toBeUndefined();
+    });
+  }
+
+  it("a genuine confirmation is NEVER flipped to a failure by the widened denial regex", async () => {
+    // Confirmation-first ordering: even if scrollback in the same region says
+    // something "unavailable", a real "Set model to …" line wins.
+    const mixed = [
+      "the metrics endpoint was unavailable earlier",
+      "⎿  Set model to Fable 5 for this session",
+    ].join("\n");
+    const { deps } = makeDeps({ inject: async () => okResult(mixed) });
+    const reply = await handleModelCommand({ kind: "set", model: "fable" }, deps);
+    expect(reply.text).not.toContain("did not take");
+    expect(reply.selectedModel).toBe("Fable 5");
+  });
+});
+
 describe("handleModelCommand — set", () => {
   it("injects exactly `/model <name>` once and relays a genuine confirmation + persistence note", async () => {
     const { deps, calls } = makeDeps();
@@ -228,13 +313,17 @@ describe("handleModelCommand — set", () => {
     expect(reply.text).not.toContain("summary you asked for");
     expect(reply.text).not.toContain("rollback plan");
     expect(reply.text).not.toContain("<pre>");
-    // No confirmation line was captured, so the switch is UNVERIFIED — report it
-    // honestly (never a false "switched") and record NO session override.
+    // #3241 part B — poll-until-signal already waited the full window, so a
+    // missing confirmation line with NO scraped error is a SILENT switch, not a
+    // failure. Record the requested model optimistically so /status is right,
+    // and say so honestly (no false "switched (session)", no scrollback leak).
     expect(reply.text).toContain("/model fable");
-    expect(reply.text).toContain("couldn't confirm the switch");
+    expect(reply.text).toContain("couldn't read a confirmation");
     expect(reply.text).toContain("/status");
+    expect(reply.text).not.toContain("Recorded");
     expect(reply.text).not.toContain("switched (session)");
-    expect(reply.selectedModel).toBeUndefined();
+    expect(reply.selectedModel).toBe("Fable");
+    expect(reply.optimistic).toBe(true);
     expect(reply.html).toBe(true);
   });
 
@@ -260,15 +349,17 @@ describe("handleModelCommand — set", () => {
     const { deps } = makeDeps({ inject: async () => okResult(prose) });
     const reply = await handleModelCommand({ kind: "set", model: "fable" }, deps);
     // The anchored regex rejects all three lines, so nothing leaks and there is
-    // no <pre> block. With no confirmation captured, the switch is UNVERIFIED —
-    // report it honestly, never a false "switched".
+    // no <pre> block. No confirmation AND no scraped error → #3241 optimistic
+    // record: the switch is reported as sent + recorded, never a false
+    // "switched", and no scrollback prose leaks.
     expect(reply.text).not.toContain("<pre>");
     expect(reply.text).not.toContain("switched the deploy");
     expect(reply.text).not.toContain("set model behaviour");
     expect(reply.text).not.toContain("kept model changes");
-    expect(reply.text).toContain("couldn't confirm the switch");
+    expect(reply.text).toContain("couldn't read a confirmation");
     expect(reply.text).not.toContain("switched (session)");
-    expect(reply.selectedModel).toBeUndefined();
+    expect(reply.selectedModel).toBe("Fable");
+    expect(reply.optimistic).toBe(true);
     expect(reply.html).toBe(true);
   });
 
@@ -290,7 +381,13 @@ describe("handleModelCommand — set", () => {
       }),
     });
     const reply = await handleModelCommand({ kind: "set", model: "sonnet" }, deps);
-    expect(reply.text).toContain("no response captured");
+    // #3241 part B — an empty capture can't carry an error line, so the send is
+    // treated as a silent switch and the requested model is recorded
+    // optimistically (was: "no response captured", recorded nothing).
+    expect(reply.text).toContain("couldn't read a confirmation");
+    expect(reply.text).toContain("/status");
+    expect(reply.selectedModel).toBe("Sonnet");
+    expect(reply.optimistic).toBe(true);
   });
 
   it("session_missing failure surfaces the tmux-supervisor hint", async () => {
@@ -475,9 +572,12 @@ describe("handleModelCommand — busy gate + honest unverified reporting", () =>
     const reply = await handleModelCommand({ kind: "set", model: "opus" }, deps);
     expect(reply.text).not.toContain("did not take");
     expect(reply.text).not.toContain("model not found");
-    // No confirmation either → honest unverified message, nothing recorded.
-    expect(reply.text).toContain("couldn't confirm the switch");
-    expect(reply.selectedModel).toBeUndefined();
+    // No LINE-ANCHORED error and no confirmation → #3241 optimistic record: the
+    // mid-sentence "model not found" prose does NOT flip the switch to a failure,
+    // and the requested model is recorded (was: "couldn't confirm", nothing).
+    expect(reply.text).toContain("couldn't read a confirmation");
+    expect(reply.selectedModel).toBe("Opus");
+    expect(reply.optimistic).toBe(true);
   });
 
   it("recognises claude v2.1.205's real arg-form confirmation (⎿ glyph + 'and saved as your default')", async () => {
@@ -713,6 +813,7 @@ import {
   EXTRA_CLAUDE_ALIASES,
   externalModelNames,
   isSrToClaudeTransition,
+  optimisticModelRecordLabel,
   type ModelMenuDeps,
 } from "../gateway/model-command.js";
 import { labelTag } from "../../src/agents/model-picker.js";
@@ -909,6 +1010,62 @@ describe("handleModelMenuCallback", () => {
   });
 });
 
+// #3242 review MEDIUM 2 — the alias BUTTON (mdl:alias:<alias>, e.g. the Fable
+// button) must be symmetric with the typed set path: record-on-send / retract-
+// on-scraped-error, handling BOTH ok and ok_no_output. Before the fix a silent
+// successful button-switch (ok_no_output, or ok with no confirmation line) fell
+// through to "Switch failed" and dropped the override.
+describe("handleModelMenuCallback — alias button symmetry (#3242 MEDIUM 2)", () => {
+  it("ok_no_output (silent switch via the button) → optimistic record, not a failure", async () => {
+    const { deps } = makeMenuDeps({
+      inject: async () => ({
+        outcome: "ok_no_output" as const,
+        output: "",
+        truncated: false,
+        command: "/model",
+        meta: { description: "Open model picker", expectsOutput: true },
+      }),
+    });
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_ALIAS}fable`, deps);
+    expect(out.selectedModel).toBe("Fable"); // normalized display form
+    expect(out.selectedModelToken).toBe("fable");
+    // Provisional copy (#3242 FIX 2): doesn't assert the switch succeeded, points
+    // at /status, and never reads as a failure.
+    expect(out.reply.text).not.toContain("failed");
+    expect(out.reply.text).toContain("/status");
+    expect(out.reply.text).toContain("/model fable");
+  });
+
+  it("ok with no confirmation line (banner-only) → optimistic record", async () => {
+    const { deps } = makeMenuDeps({
+      inject: async () => okResult("⠋ extending Claude Fable 5 access…"),
+    });
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_ALIAS}fable`, deps);
+    expect(out.selectedModel).toBe("Fable");
+    expect(out.selectedModelToken).toBe("fable");
+    // The banner must not leak as the confirmation.
+    expect(out.reply.text).not.toContain("extending Claude Fable 5 access");
+  });
+
+  it("scraped access-denial line via the button → failure, no override (retract)", async () => {
+    const { deps } = makeMenuDeps({
+      inject: async () => okResult("⎿  Fable is not available on your plan"),
+    });
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_ALIAS}fable`, deps);
+    expect(out.selectedModel).toBeUndefined();
+    expect(out.reply.text).toContain("did not take");
+  });
+
+  it("genuine confirmation via the button still records the display name", async () => {
+    const { deps } = makeMenuDeps({
+      inject: async () => okResult("⎿  Set model to Fable 5 for this session"),
+    });
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_ALIAS}fable`, deps);
+    expect(out.selectedModel).toBe("Fable 5");
+    expect(out.selectedModelToken).toBe("fable");
+  });
+});
+
 describe("sessionModelFromConfirmation", () => {
   it("pulls the model name from claude's session-switch confirmation", () => {
     expect(sessionModelFromConfirmation("Set model to Fable 5 for this session only")).toBe("Fable 5");
@@ -1170,6 +1327,26 @@ describe("isSrToClaudeTransition", () => {
     expect(isSrToClaudeTransition("sr-gemini-2.5-pro", "sr-deepseek-r1")).toBe(false);
   });
 
+  // #3242 review FIX 1 — optimisticModelRecordLabel must NOT de-prefix an sr-*
+  // token: the stored selectedModel doubles as the sr-*→Claude sentinel that
+  // isSrToClaudeTransition (prevModel.startsWith('sr-')) reads. De-prefixing to
+  // a friendly label ("kimi k2") would silently kill the graceful restart that
+  // tears down LiteLLM routing on a subsequent Claude switch.
+  it("optimisticModelRecordLabel keeps sr-* tokens verbatim so the sentinel survives", () => {
+    const recorded = optimisticModelRecordLabel("sr-kimi-k2");
+    expect(recorded).toBe("sr-kimi-k2"); // NOT "kimi k2"
+    // The recorded value still trips the sr→Claude transition on a later switch.
+    expect(isSrToClaudeTransition(recorded, "opus")).toBe(true);
+    // Regression guard: the de-prefixed form would NOT — that was the bug.
+    expect(isSrToClaudeTransition("kimi k2", "opus")).toBe(false);
+  });
+
+  it("optimisticModelRecordLabel Title-cases a bare Claude alias, leaves full ids as-is", () => {
+    expect(optimisticModelRecordLabel("fable")).toBe("Fable");
+    expect(optimisticModelRecordLabel("opus")).toBe("Opus");
+    expect(optimisticModelRecordLabel("claude-opus-4-8")).toBe("claude-opus-4-8");
+  });
+
   it("false when switching to sr-* from Claude (Claude → sr-*)", () => {
     expect(isSrToClaudeTransition("Sonnet", "sr-gemini-2.5-pro")).toBe(false);
   });

package/telegram-plugin/tests/redelivery-decision.test.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest'
+import {
+  decideRedeliver,
+  frameRedelivery,
+  REDELIVERY_PREFIX,
+  type RedeliverDecisionInput,
+} from '../gateway/redelivery-decision.js'
+
+/**
+ * Pins the crash-survival redelivery decision predicate. The load-bearing
+ * property is the DURABLE TEXT-IDENTITY oracle: an interim `progress_update`
+ * earlier in the same turn must NOT suppress a genuinely-undelivered final
+ * answer (the exact MISS = permanent-silence bug this fix closes), while an
+ * already-delivered final answer MUST be suppressed.
+ */
+
+const base: RedeliverDecisionInput = {
+  capturedText: 'The deploy finished — all three services are green.',
+  trailingIsText: true,
+  hasDeliveredText: false,
+  alreadyRedelivered: false,
+  ageMs: 60_000,
+  maxAgeMs: 10_800_000, // 3h
+}
+
+describe('decideRedeliver — text-identity oracle', () => {
+  it('REDELIVERS an undelivered final answer even when an interim message was sent (the MISS bug)', () => {
+    // The MISS scenario: a progress_update landed a role=assistant row earlier
+    // in the turn, so a chat+time-window oracle would say "delivered" and skip.
+    // The text-identity oracle keys on the ANSWER text — which was never sent —
+    // so hasDeliveredText is false and redelivery fires.
+    const d = decideRedeliver({ ...base, hasDeliveredText: false })
+    expect(d.redeliver).toBe(true)
+    expect(d.framedText).toContain(base.capturedText)
+    expect(d.framedText?.startsWith(REDELIVERY_PREFIX)).toBe(true)
+  })
+
+  it('SUPPRESSES when the final answer text was already delivered', () => {
+    const d = decideRedeliver({ ...base, hasDeliveredText: true })
+    expect(d.redeliver).toBe(false)
+    expect(d.skipReason).toBe('already-delivered')
+  })
+})
+
+describe('decideRedeliver — other skip reasons', () => {
+  it('skips empty / whitespace text', () => {
+    expect(decideRedeliver({ ...base, capturedText: '   ' }).skipReason).toBe('empty-text')
+  })
+
+  it('skips when trailing content is a dangling tool_use (mid-stream, not an answer)', () => {
+    expect(decideRedeliver({ ...base, trailingIsText: false }).skipReason).toBe('trailing-not-text')
+  })
+
+  it('skips an already-redelivered turn (at-most-once ledger)', () => {
+    expect(decideRedeliver({ ...base, alreadyRedelivered: true }).skipReason).toBe('already-redelivered')
+  })
+
+  it('skips a stale turn beyond maxAgeMs', () => {
+    expect(decideRedeliver({ ...base, ageMs: 4 * 3_600_000 }).skipReason).toBe('stale')
+  })
+
+  it('precedence: empty-text wins over delivered/redelivered/stale', () => {
+    const d = decideRedeliver({
+      ...base,
+      capturedText: '',
+      hasDeliveredText: true,
+      alreadyRedelivered: true,
+      ageMs: 999_999_999,
+    })
+    expect(d.skipReason).toBe('empty-text')
+  })
+
+  it('precedence: already-redelivered is checked before the age failsafe', () => {
+    const d = decideRedeliver({ ...base, alreadyRedelivered: true, ageMs: 999_999_999 })
+    expect(d.skipReason).toBe('already-redelivered')
+  })
+})
+
+describe('frameRedelivery', () => {
+  it('frames as a recovered draft, never a clean final answer', () => {
+    const framed = frameRedelivery('  hello world  ')
+    expect(framed).toBe(`${REDELIVERY_PREFIX}\n\nhello world`)
+  })
+})