switchroom 0.18.28 → 0.18.30

package/telegram-plugin/tests/catch-all-unhandled-message.test.ts

@@ -0,0 +1,264 @@
+/**
+ * Regression tests for the terminal catch-all message handler + diagnostic
+ * update tap (#3300).
+ *
+ * THE CLASS OF BUG: the gateway registered ONLY content-specific handlers —
+ * `bot.on('message:text')`, `:photo`, `:document`, … `:paid_media`. grammy
+ * ^1.44 routes `bot.on` as filtering middleware (`on → filter(pred, handler)
+ * → branch(pred, handler, pass)`, verified in grammy/out/composer.js); when
+ * NO registered filter matches an inbound `message`, grammy SILENTLY drops
+ * it — no log, no ack, no history row. Live signature (2026-07-16, klanker
+ * DM): message_id 19090 was allocated between an outbound reply and the next
+ * inbound with ZERO gateway trace while polling stayed healthy.
+ *
+ * THE FIX under test is the REAL production module
+ * (`gateway/unhandled-message.ts`) — the same `installUpdateTap` /
+ * `installUnhandledMessageCatchAll` gateway.ts wires — driven through a real
+ * grammy 1.44 Bot via `bot.handleUpdate`, with a real `bot.on('message:text')`
+ * registered BEFORE the catch-all exactly like the gateway's registration
+ * order. (gateway.ts itself is a side-effecting module that cannot be
+ * imported into a unit test — the extraction into unhandled-message.ts exists
+ * precisely so the registered composer path is testable; a structural suite
+ * below guards that gateway.ts actually wires it in that order.)
+ *
+ * Outcomes asserted:
+ *   (b) an unregistered content type reaches the catch-all, is logged, and
+ *       yields a turn with the placeholder text naming the content type;
+ *   (c) a plain text message is consumed by the specific handler and does
+ *       NOT double-handle in the catch-all;
+ *   service-noise messages (forum topic lifecycle etc.) are logged but do
+ *       NOT become turns;
+ *   the tap observes every update and rate-limits with a suppression summary.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { Bot, type Context } from 'grammy'
+import type { Update } from 'grammy/types'
+import { makeMessageUpdate, resetUpdateCounters } from './update-factory.js'
+import {
+  installUpdateTap,
+  installUnhandledMessageCatchAll,
+  planUnhandledMessage,
+  SERVICE_NOISE_KEYS,
+  TAP_MAX_LINES_PER_MINUTE,
+} from '../gateway/unhandled-message.js'
+
+interface DeliveredTurn {
+  via: 'text' | 'catch-all'
+  text: string
+  update_id: number
+}
+
+/**
+ * Wire a real grammy Bot in the gateway's registration order using the REAL
+ * production install functions: tap first, specific `message:text` handler,
+ * terminal catch-all LAST. `onInbound` records what would flow into
+ * handleInboundCoalesced.
+ */
+function buildHarness() {
+  const delivered: DeliveredTurn[] = []
+  const logLines: string[] = []
+
+  const bot = new Bot('12345:TEST_TOKEN_NOT_REAL')
+  bot.botInfo = {
+    id: 999,
+    is_bot: true,
+    first_name: 'TestBot',
+    username: 'test_bot',
+    can_join_groups: true,
+    can_read_all_group_messages: false,
+    supports_inline_queries: false,
+    can_connect_to_business: false,
+    has_main_web_app: false,
+  }
+
+  // REAL production tap (same call gateway.ts makes).
+  installUpdateTap(bot, line => logLines.push(line))
+
+  // Specific handler — representative of the gateway's message:text
+  // registration, placed BEFORE the catch-all exactly as in gateway.ts.
+  bot.on('message:text', async ctx => {
+    delivered.push({ via: 'text', text: ctx.message.text, update_id: ctx.update.update_id })
+  })
+
+  // REAL production catch-all, registered LAST (same call gateway.ts makes).
+  installUnhandledMessageCatchAll(
+    bot,
+    async (ctx: Context, text: string) => {
+      delivered.push({ via: 'catch-all', text, update_id: ctx.update.update_id })
+    },
+    line => logLines.push(line),
+  )
+
+  return { bot, delivered, logLines }
+}
+
+/** A message update carrying content that no `message:*` filter covers. */
+function makeContentUpdate(update_id: number, content: Record<string, unknown>): Update {
+  return {
+    update_id,
+    message: {
+      message_id: 5000 + update_id,
+      chat: { id: 777, type: 'private' },
+      from: { id: 777, is_bot: false, first_name: 'Test' },
+      date: Math.floor(Date.now() / 1000),
+      ...content,
+    },
+  } as unknown as Update
+}
+
+describe('terminal catch-all — real module on a real grammy 1.44 composer (#3300)', () => {
+  beforeEach(() => resetUpdateCounters())
+
+  it('(c) a plain-text message is consumed by message:text and does NOT reach the catch-all', async () => {
+    const { bot, delivered, logLines } = buildHarness()
+    await bot.handleUpdate(makeMessageUpdate({ text: 'hello brief', update_id: 42 }))
+
+    expect(delivered).toHaveLength(1)
+    expect(delivered[0]).toMatchObject({ via: 'text', text: 'hello brief' })
+    // No catch-all log line — specific handler won (no double-handling).
+    expect(logLines.filter(l => l.includes('catch-all inbound'))).toHaveLength(0)
+  })
+
+  it('(b) an unregistered content type reaches the catch-all, is logged, and yields a placeholder turn', async () => {
+    const { bot, delivered, logLines } = buildHarness()
+    await bot.handleUpdate(makeContentUpdate(99, { unknown_future_type: { some: 'payload' } }))
+
+    // Logged with content KEYS + ids only (never the payload body).
+    const catchAllLines = logLines.filter(l => l.includes('catch-all inbound'))
+    expect(catchAllLines).toHaveLength(1)
+    expect(catchAllLines[0]).toContain('update_id=99')
+    expect(catchAllLines[0]).toContain('content_keys=[unknown_future_type]')
+    expect(catchAllLines[0]).not.toContain('payload')
+
+    // Produced a delivered turn with placeholder text naming the content type.
+    expect(delivered).toHaveLength(1)
+    expect(delivered[0]).toMatchObject({
+      via: 'catch-all',
+      text: '(unhandled message content: unknown_future_type)',
+    })
+  })
+
+  it('a caption on an unhandled content type is used as the turn text (best-effort)', async () => {
+    const { bot, delivered } = buildHarness()
+    await bot.handleUpdate(
+      makeContentUpdate(120, { some_new_media: { id: 'x' }, caption: 'read this brief' }),
+    )
+    expect(delivered).toHaveLength(1)
+    expect(delivered[0]).toMatchObject({ via: 'catch-all', text: 'read this brief' })
+  })
+
+  it('known-noise service messages are LOGGED but produce NO agent turn', async () => {
+    const { bot, delivered, logLines } = buildHarness()
+    await bot.handleUpdate(
+      makeContentUpdate(130, { forum_topic_created: { name: 'spam topic', icon_color: 1 } }),
+    )
+    await bot.handleUpdate(
+      makeContentUpdate(131, { new_chat_members: [{ id: 5, is_bot: false, first_name: 'X' }] }),
+    )
+
+    // No turns delivered — service noise never reaches the agent.
+    expect(delivered).toHaveLength(0)
+    // But both were explicitly logged (never silently dropped).
+    const noiseLines = logLines.filter(l => l.includes('action=log-only'))
+    expect(noiseLines).toHaveLength(2)
+    expect(noiseLines[0]).toContain('content_keys=[forum_topic_created]')
+    expect(noiseLines[1]).toContain('content_keys=[new_chat_members]')
+  })
+
+  it('the diagnostic tap observes EVERY update (pass-through, both routed and caught)', async () => {
+    const { bot, logLines } = buildHarness()
+    await bot.handleUpdate(makeMessageUpdate({ text: 'routed', update_id: 1 }))
+    await bot.handleUpdate(makeContentUpdate(2, { unknown_future_type: {} }))
+
+    const rx = logLines.filter(l => l.includes('rx update_id='))
+    expect(rx).toHaveLength(2)
+    expect(rx[0]).toContain('rx update_id=1 type=message')
+    expect(rx[1]).toContain('rx update_id=2 type=message')
+  })
+})
+
+describe('planUnhandledMessage — service-noise classification', () => {
+  it('every SERVICE_NOISE_KEYS entry classifies log-only', () => {
+    for (const key of SERVICE_NOISE_KEYS) {
+      const plan = planUnhandledMessage({ message_id: 1, chat: {}, date: 0, [key]: {} })
+      expect(plan.action, `key ${key} should be log-only`).toBe('log-only')
+    }
+  })
+
+  it('an unknown content type classifies as a turn (fail-toward-delivery)', () => {
+    const plan = planUnhandledMessage({ message_id: 1, chat: {}, date: 0, mystery_type: {} })
+    expect(plan).toMatchObject({
+      action: 'turn',
+      text: '(unhandled message content: mystery_type)',
+    })
+  })
+
+  it('a message mixing noise with real content still becomes a turn', () => {
+    const plan = planUnhandledMessage({
+      message_id: 1, chat: {}, date: 0,
+      boost_added: {}, mystery_media: {}, caption: 'look',
+    })
+    expect(plan).toMatchObject({ action: 'turn', text: 'look' })
+  })
+})
+
+describe('installUpdateTap — rate limit', () => {
+  it('caps lines per minute and emits ONE suppression summary on window rollover', async () => {
+    const logLines: string[] = []
+    let now = 1_000_000
+    const mw: Array<(ctx: unknown, next: () => Promise<void>) => Promise<void>> = []
+    const fakeBot = { use: (fn: (ctx: unknown, next: () => Promise<void>) => Promise<void>) => { mw.push(fn) } }
+    installUpdateTap(fakeBot as never, l => logLines.push(l), () => now)
+
+    const fire = (update_id: number) =>
+      mw[0]({ update: { update_id }, message: undefined } as never, async () => {})
+
+    for (let i = 0; i < TAP_MAX_LINES_PER_MINUTE + 50; i++) await fire(i)
+    expect(logLines.filter(l => l.includes('rx update_id='))).toHaveLength(TAP_MAX_LINES_PER_MINUTE)
+
+    // Roll the window: the 50 suppressed lines surface as ONE summary.
+    now += 61_000
+    await fire(9999)
+    const summaries = logLines.filter(l => l.includes('suppressed 50 update lines'))
+    expect(summaries).toHaveLength(1)
+    // And logging resumes in the fresh window.
+    expect(logLines.filter(l => l.includes('rx update_id=9999'))).toHaveLength(1)
+  })
+})
+
+// ─── Structural guard on the real gateway.ts wiring ────────────────────────
+// The functional harness above proves the composer contract using the REAL
+// production install functions; this guards that gateway.ts wires those same
+// functions in the required order. Hardened beyond a naive regex: it fails
+// if the install call disappears (e.g. refactored away) OR if ANY
+// `bot.on('message…')` registration appears after the catch-all install.
+describe('gateway.ts catch-all registration invariant', () => {
+  const SRC = readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8')
+
+  it('imports and installs the real catch-all + tap from unhandled-message.ts', () => {
+    expect(SRC).toContain("from './unhandled-message.js'")
+    expect(SRC).toContain('installUpdateTap(bot,')
+    expect(SRC).toContain('installUnhandledMessageCatchAll(')
+  })
+
+  it('the catch-all install is AFTER every message handler registration', () => {
+    const installIdx = SRC.indexOf('installUnhandledMessageCatchAll(')
+    expect(installIdx).toBeGreaterThan(0)
+    const after = SRC.slice(installIdx)
+    // No message-filter registration of any spelling may follow the terminal
+    // catch-all — grammy ordering is the no-double-handling guarantee.
+    // (`message_reaction` etc. are DIFFERENT update types, not `message`
+    // filters — the pattern requires `message` exactly or `message:<sub>`.)
+    expect(after).not.toMatch(/bot\.on\(\s*['"`]message(:|['"`])/)
+    // And there must be exactly one catch-all install (no duplicate turns).
+    expect(SRC.indexOf('installUnhandledMessageCatchAll(', installIdx + 1)).toBe(-1)
+  })
+
+  it('routes the catch-all through handleInboundCoalesced (same gating + forward-origin path)', () => {
+    const installIdx = SRC.indexOf('installUnhandledMessageCatchAll(')
+    const body = SRC.slice(installIdx, installIdx + 400)
+    expect(body).toMatch(/handleInboundCoalesced\(ctx, text, undefined\)/)
+  })
+})

package/telegram-plugin/tests/forward-origin.test.ts

@@ -30,10 +30,15 @@ import {
   FORWARDED_FROM_NAME_MAX,
   type ForwardOriginInfo,
 } from '../gateway/forward-origin.js'
+import { fmtLocalStamp, resolveEnvTimezone } from '../shared/local-time.js'
 
 // Synthetic fixtures only — no real Telegram ids/names (check-no-pii-secrets).
 const DATE = 1750000000 // unix seconds
-const DATE_ISO = new Date(DATE * 1000).toISOString()
+// switchroom #tz-fix: forwarded_date is now the agent's LOCAL am/pm wall clock
+// (NOT UTC ISO), so it can't compete with the local-time hint. Compute the
+// expected value through the SAME helper production uses, so the assertion is
+// deterministic under whatever TZ the runner env carries.
+const DATE_LOCAL = fmtLocalStamp(DATE * 1000, resolveEnvTimezone())
 
 function userOrigin(overrides: Partial<{
   first_name: string
@@ -204,7 +209,7 @@ describe('buildForwardOriginMeta — channel-tag attrs', () => {
       forwarded_from: 'Ada Lovelace (@adalove)',
       forwarded_from_type: 'user',
       forwarded_from_id: '42',
-      forwarded_date: DATE_ISO,
+      forwarded_date: DATE_LOCAL,
     })
   })
 
@@ -245,6 +250,28 @@ describe('buildForwardOriginMeta — channel-tag attrs', () => {
   it('no origins → empty record (no attrs on a normal message)', () => {
     expect(buildForwardOriginMeta([])).toEqual({})
   })
+
+  // switchroom #tz-fix (deterministic outcome): under a real configured zone
+  // the forwarded_date the MODEL sees is LOCAL am/pm with NO "UTC" / trailing-Z.
+  it('renders forwarded_date as LOCAL am/pm — never a UTC ISO string', () => {
+    const prevTz = process.env.SWITCHROOM_TIMEZONE
+    const prevTZ = process.env.TZ
+    process.env.SWITCHROOM_TIMEZONE = 'Australia/Melbourne'
+    delete process.env.TZ
+    try {
+      const meta = buildForwardOriginMeta([{ name: 'Ada', type: 'user', id: 42, date: DATE }])
+      const d = meta.forwarded_date!
+      // e.g. "Sunday 2025-06-15 08:26 PM AEST" — weekday, ISO date, am/pm, abbrev.
+      expect(d).toMatch(/ (?:AM|PM) [A-Za-z]{2,5}$/)
+      expect(d).not.toContain('UTC')
+      expect(d.endsWith('Z')).toBe(false)
+    } finally {
+      if (prevTz === undefined) delete process.env.SWITCHROOM_TIMEZONE
+      else process.env.SWITCHROOM_TIMEZONE = prevTz
+      if (prevTZ === undefined) delete process.env.TZ
+      else process.env.TZ = prevTZ
+    }
+  })
 })
 
 describe('coalesced bursts — dedupe + numbered siblings', () => {
@@ -264,7 +291,7 @@ describe('coalesced bursts — dedupe + numbered siblings', () => {
     expect(meta.forwarded_from).toBe('Alice Q (@aliceq)')
     expect(meta.forwarded_from_2).toBeUndefined()
     // First occurrence wins — the emitted date is the first part's.
-    expect(meta.forwarded_date).toBe(DATE_ISO)
+    expect(meta.forwarded_date).toBe(DATE_LOCAL)
   })
 
   it('multi-origin burst: first origin bare, second gets _2 keys in order', () => {

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -1,10 +1,11 @@
 /**
- * Structural pins for the session-scoped /model wiring in gateway.ts
- * (reference/rfcs/session-model-stickiness.md §0.1, rev 4 — consume-once).
+ * Structural pins for the DETERMINISTIC /model wiring in gateway.ts
+ * (reference/rfcs/session-model-stickiness.md §0.05, rev 5 — every switch
+ * relaunches through the consume-once carrier; the inject/scrape path retired).
  *
  * The behaviour lives in un-exported inline closures (buildModelDeps's
- * scheduleModelRelaunch/scheduleRestart, the typed/menu recorders, and the
- * boot re-hydration block inside the startup IIFE), so — mirroring the other
+ * scheduleModelRelaunch / scheduleModelDefaultRelaunch / scheduleRestart, and
+ * the boot re-hydration block inside the startup IIFE), so — mirroring the other
  * gateway-*.test.ts source-pins — we assert on the source structure. The
  * end-to-end boot behaviour is exercised in tests/scaffold.session-model.test.ts
  * (rendered start.sh), the file helpers in session-model-file.test.ts, and the
@@ -42,7 +43,7 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
   it('writes the carrier via writeSessionModelFile before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     const writeIdx = win.indexOf('writeSessionModelFile(')
     const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
     expect(writeIdx).toBeGreaterThan(0)
@@ -51,7 +52,7 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
 
   it('sets the in-memory session-model override before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     const setIdx = win.indexOf('sessionModelSource.setOverride(model)')
     const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
     expect(setIdx).toBeGreaterThan(0)
@@ -60,7 +61,7 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
 
   it('rolls back the prior carrier content (not just deletion) on a non-in-flight dispatch failure', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     expect(win).toContain('const prevFileRaw = readSessionModelFileRaw(agentDir)')
     expect(win).toContain('restoreSessionModelFileRaw(agentDir, prevFileRaw)')
     expect(win).toContain("!== 'restart_in_flight'")
@@ -68,84 +69,134 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
 
   it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     expect(win).toContain('await deps.scheduleRestart(reason)')
   })
 })
 
-describe('gateway: menu callback carrier handling (session-scoped)', () => {
-  it('a live Claude selection records the in-memory override but writes NO carrier', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordModelMenuSideEffects')
-    expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 900)
-    // The first (live-switch) block sets the override but no longer persists.
-    expect(win).toContain('sessionModelSource.setOverride(outcome.selectedModel)')
-    const overrideIdx = win.indexOf('sessionModelSource.setOverride(outcome.selectedModel)')
-    const nextClearIdx = win.indexOf('outcome.clearedDefault')
-    const writeBetween = win.slice(overrideIdx, nextClearIdx)
-    expect(writeBetween).not.toContain('writeSessionModelFile(')
+describe('gateway: the retired scrape-recorders are GONE (rev 5 inversion)', () => {
+  it('recordTypedModelSwitch and recordModelMenuSideEffects no longer exist', () => {
+    // INVERTED from rev 4: these helpers recorded a scrape-derived selectedModel
+    // and drove the sr-to-claude special case. Every switch now relaunches, so
+    // they are deleted — their presence would mean the retired path survived.
+    expect(GATEWAY_SRC).not.toContain('function recordTypedModelSwitch')
+    expect(GATEWAY_SRC).not.toContain('function recordModelMenuSideEffects')
   })
 
-  it('a confirmed "Default" selection CLEARS the carrier', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordModelMenuSideEffects')
-    const win = GATEWAY_SRC.slice(idx, idx + 2400)
-    expect(win).toContain('outcome.clearedDefault')
-    expect(win).toContain('clearSessionModelFile(smDir)')
+  it('no isSrToClaudeTransition wiring (every switch relaunches — no distinct transition)', () => {
+    expect(GATEWAY_SRC).not.toContain('isSrToClaudeTransition')
   })
 
-  it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
-    const idx = GATEWAY_SRC.indexOf('const srLabel = escapeHtmlForTg(srFriendlyLabel(srName))')
+  it('buildModelDeps wires neither the inject nor the select terminal-driver dep', () => {
+    const idx = GATEWAY_SRC.indexOf('function buildModelDeps')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 1400)
-    expect(win).toContain('modelDeps.scheduleModelRelaunch(srName')
-    expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
+    const win = GATEWAY_SRC.slice(idx, idx + 4000)
+    expect(win).not.toContain('inject: injectSlashCommandImpl')
+    expect(win).not.toContain('select: (a, label) => selectModel')
   })
+})
 
-  it('the sr-to-claude transition (a relaunch) writes the carrier, and clears it on a Default tap', () => {
-    const idx = GATEWAY_SRC.indexOf('isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)')
+describe('gateway: scheduleModelDefaultRelaunch (G1 — clear + revert relaunch)', () => {
+  it('clears the carrier + override and mirrors scheduleModelRelaunch rollback', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelDefaultRelaunch: async')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 3600)
-    expect(win).toMatch(/writeSessionModelFile\(\s*agentDir,\s*token/)
-    expect(win).toContain('clearSessionModelFile(agentDir)')
-    expect(win).toContain("triggerSelfRestart(agentName, 'sr-to-claude-model-switch'")
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const clearIdx = win.indexOf('clearSessionModelFile(agentDir)')
+    const overrideIdx = win.indexOf('sessionModelSource.setOverride(null)')
+    const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
+    expect(clearIdx).toBeGreaterThan(0)
+    expect(overrideIdx).toBeGreaterThan(clearIdx)
+    expect(restartIdx).toBeGreaterThan(overrideIdx)
+    // G1 rollback on a non-in-flight dispatch failure.
+    expect(win).toContain('restoreSessionModelFileRaw(agentDir, prevFileRaw)')
+    expect(win).toContain("!== 'restart_in_flight'")
   })
 })
 
-describe('gateway: typed /model is session-scoped (live Claude switch writes no carrier)', () => {
-  it('the Claude path sets the in-memory override but never persists a carrier', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordTypedModelSwitch')
+describe('gateway: the live callback dispatcher routes every switch tap to the handler', () => {
+  it('calls handleModelMenuCallback and no longer post-processes a scrape outcome', () => {
+    const idx = GATEWAY_SRC.indexOf('const outcome = await handleModelMenuCallback(data, modelDeps)')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 1400)
-    expect(win).toContain('sessionModelSource.setOverride(reply.selectedModel)')
-    // No durable carrier write on the live-switch path.
-    expect(win).not.toContain('writeSessionModelFile(')
-  })
-
-  it('`/model default` clears the carrier + in-memory override (silent-switch path must not resurrect)', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordTypedModelSwitch')
-    const win = GATEWAY_SRC.slice(idx, idx + 1400)
-    expect(win).toContain("requested?.toLowerCase() === 'default'")
-    expect(win).toContain('clearSessionModelFile(smDir)')
-    expect(win).toContain('sessionModelSource.setOverride(null)')
-    // The file-clear is not gated on a positive confirmation.
-    const clearIdx = win.indexOf('if (smDir) clearSessionModelFile(smDir)')
-    const gatedOverrideIdx = win.indexOf('if (reply.selectedModel) sessionModelSource.setOverride(null)')
-    expect(clearIdx).toBeGreaterThan(0)
-    expect(gatedOverrideIdx).toBeGreaterThan(clearIdx)
+    const win = GATEWAY_SRC.slice(idx, idx + 600)
+    expect(win).not.toContain('recordModelMenuSideEffects')
+  })
+
+  it('the typed dispatcher relays the handler reply directly (no recordTypedModelSwitch)', () => {
+    const idx = GATEWAY_SRC.indexOf('const reply = await handleModelCommand(parsed, deps)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 400)
+    expect(win).not.toContain('recordTypedModelSwitch')
+    expect(win).toContain('switchroomReply(ctx, reply.text')
   })
 })
 
-describe('gateway boot: session-model re-hydration + alert relay', () => {
-  it('re-hydrates the override from .active-session-model', () => {
+describe('gateway boot: session-model re-hydration + confirmation + alert relay', () => {
+  it('re-hydrates the override from .active-session-model (launched !== configured)', () => {
     const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx - 200, idx + 1400)
-    expect(win).toMatch(/launched\.length > 0 && launched !== configured \? launched : null/)
+    const win = GATEWAY_SRC.slice(idx - 200, idx + 3200)
+    // F1: `launched !== configured` is the deterministic apply-boot signal.
+    expect(win).toContain('const isApplyBoot = launched.length > 0 && launched !== configured')
+    expect(win).toContain('sessionModelSource.setOverride(isApplyBoot ? launched : null)')
     expect(win).toContain('resolveMainModel(raw ?? undefined)')
   })
 
+  it('logs the applied model for diagnosability (F1)', () => {
+    expect(GATEWAY_SRC).toContain('gw /model relaunch applied agent=')
+    expect(GATEWAY_SRC).toContain('gw /model relaunch scheduled agent=')
+  })
+
+  it('sends ONE switch-confirmation from the ACTUAL launched model, keyed on the /model reason (F1/N4)', () => {
+    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 5200)
+    // Keyed on the deterministic /model switch reason, so it also fires on a
+    // launched===configured apply-boot (/model default) — N4. Never optimistic.
+    expect(win).toContain('if (modelSwitchReason != null && modelSwitchMarkerChat)')
+    expect(win).toContain('✅ Now running')
+    // N4: the launched===configured branch still confirms.
+    expect(win).toContain('(the configured default)')
+  })
+
+  it('warns instead of a green ✅ when a non-default switch silently reverted to the default (silent-revert fix)', () => {
+    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
+    const win = GATEWAY_SRC.slice(idx, idx + 5200)
+    // The confirmation card is derived from the pure classifier, not an inline
+    // isApplyBoot ternary — so a reverted non-default switch yields the ⚠️ card.
+    expect(win).toContain('classifyModelSwitchConfirmation({')
+    expect(win).toContain("confirmation.kind === 'applied'")
+    expect(win).toContain("confirmation.kind === 'not-applied'")
+    expect(win).toContain("⚠️ Your switch to")
+    expect(win).toContain("didn't apply")
+    // LOW-3: the re-issue hint interpolates the target inside backticks so a
+    // token containing Markdown metachars can't italicize / 400 the send.
+    expect(win).toContain('Re-issue \\`/model ${confirmation.target}\\`')
+  })
+
+  it('dedups the not-applied card against a tailored .session-model-alert (LOW-2)', () => {
+    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
+    const win = GATEWAY_SRC.slice(idx, idx + 5200)
+    // When start.sh wrote a specific alert for this revert, the classifier's
+    // generic not-applied card is suppressed (the alert relay is the message).
+    expect(win).toContain("existsSync(join(smAgentDir, '.session-model-alert'))")
+    expect(win).toContain("confirmation.kind === 'not-applied' && hasSessionModelAlert")
+  })
+
+  it('N4/reason: the /model switch reason is captured from the clean-shutdown marker', () => {
+    expect(GATEWAY_SRC).toContain("cleanMarker.reason.startsWith('user: /model')")
+    expect(GATEWAY_SRC).toContain('let modelSwitchReason: string | null = null')
+  })
+
+  it('N3: the generic boot card is suppressed on a /model apply-boot (one card per switch)', () => {
+    const idx = GATEWAY_SRC.indexOf('const suppressBootCardForModelSwitch')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 800)
+    expect(win).toContain('modelSwitchReason != null && modelSwitchMarkerChat != null')
+    expect(win).toContain('else if (target)')
+  })
+
   it('consumes the .session-model-alert sentinel, notifies ALL operators, and deletes it', () => {
-    const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.session-model-alert')")
+    const idx = GATEWAY_SRC.indexOf("const alertPath = join(smAgentDir, '.session-model-alert')")
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx, idx + 1100)
     expect(win).toContain('unlinkSync(alertPath)')

package/telegram-plugin/tests/history.test.ts

@@ -16,6 +16,7 @@ import {
   hasOutboundDeliveredSince,
   hasOutboundWithText,
   normalizeDeliveryText,
+  verifyHistoryWritable,
   _resetForTests,
 } from '../history.js'
 
@@ -963,3 +964,90 @@ describe('hasOutboundWithText (durable text-identity oracle)', () => {
     expect(hasOutboundWithText('1', 'repeated answer', null, 250_000)).toBe(true)
   })
 })
+
+// ── 2026-07-16 incident hardening: writer durability across restart + surfacing
+//    swallowed insert failures. Root cause: turn-flush deliveries (18944/18958)
+//    reached Telegram but were absent from history.db, blinding
+//    getRecentOutboundCount / hasOutboundDeliveredSince. The gateway had already
+//    logged "history capture enabled" on both restarts, so DB-open success was
+//    NOT proof the row-insert path worked. These tests pin the durable fix.
+describe('history writer durability (2026-07-16 incident)', () => {
+  it('verifyHistoryWritable proves the INSERT path works on a live DB', () => {
+    initHistory(stateDir, 30)
+    const res = verifyHistoryWritable()
+    expect(res.ok).toBe(true)
+    // The self-check must leave NO sentinel residue behind.
+    expect(getRecentOutboundCount('__history_selfcheck__', 86_400)).toBe(0)
+  })
+
+  it('verifyHistoryWritable reports not-ok before init (no silent success)', () => {
+    // No initHistory() this test — the writer is uninitialised.
+    const res = verifyHistoryWritable()
+    expect(res.ok).toBe(false)
+    expect(res.error).toMatch(/initHistory/)
+  })
+
+  // The core recovery contract: recording must survive a shutdown + reinit
+  // (a gateway restart, which nulls the module singleton and re-opens the same
+  // file). Rows written before AND after the boundary must all be queryable.
+  it('recording continues across a simulated restart (reinit of the same DB)', () => {
+    const nowSec = Math.floor(Date.now() / 1000)
+    initHistory(stateDir, 30)
+    recordOutbound({ chat_id: '9', thread_id: null, message_ids: [100], texts: ['before restart'], ts: nowSec - 60 })
+    // Simulate a gateway restart: close + forget the singleton, then reinit
+    // against the SAME stateDir (fresh process, db=null → re-open).
+    _resetForTests()
+    initHistory(stateDir, 30)
+    // Boot self-check must still pass against the existing, populated file.
+    expect(verifyHistoryWritable().ok).toBe(true)
+    recordOutbound({ chat_id: '9', thread_id: null, message_ids: [101], texts: ['after restart'], ts: nowSec })
+    const rows = query({ chat_id: '9' })
+    expect(rows.map((r) => r.message_id)).toEqual([100, 101])
+    // The backstop suppression counter (the surface blinded by the incident)
+    // must see BOTH the pre- and post-restart outbounds.
+    expect(getRecentOutboundCount('9', 10_000_000_000)).toBe(2)
+  })
+
+  // The exact incident shape: a malformed send result yields an invalid
+  // message_id. OLD behaviour: the NOT NULL PRIMARY KEY throws inside the tx and
+  // the caller's `catch {}` swallows it — the row is lost AND invisible. NEW
+  // behaviour: the invalid chunk is filtered + logged, valid chunks still land,
+  // and no throw escapes to be swallowed.
+  it('drops an invalid message_id chunk loudly but records the valid ones (no silent total loss)', () => {
+    initHistory(stateDir, 30)
+    const errs: string[] = []
+    const orig = process.stderr.write.bind(process.stderr)
+    // @ts-expect-error narrow test shim over the write overloads
+    process.stderr.write = (chunk: string) => { errs.push(String(chunk)); return true }
+    try {
+      recordOutbound({
+        chat_id: '9',
+        thread_id: null,
+        // chunk 0 is a malformed (undefined) id; chunk 1 is real.
+        message_ids: [undefined as unknown as number, 200],
+        texts: ['lost chunk', 'kept chunk'],
+        ts: 3000,
+      })
+    } finally {
+      process.stderr.write = orig
+    }
+    // The valid chunk is recorded (delivery accounting is NOT silently zeroed).
+    const rows = query({ chat_id: '9' })
+    expect(rows.map((r) => r.message_id)).toEqual([200])
+    // The drop was surfaced loudly, not swallowed.
+    expect(errs.join('')).toMatch(/invalid message_id/)
+  })
+
+  it('recordOutbound with an all-invalid id set no-ops without throwing', () => {
+    initHistory(stateDir, 30)
+    expect(() =>
+      recordOutbound({
+        chat_id: '9',
+        thread_id: null,
+        message_ids: [NaN, null as unknown as number],
+        texts: ['a', 'b'],
+      }),
+    ).not.toThrow()
+    expect(getRecentOutboundCount('9', 10_000_000_000)).toBe(0)
+  })
+})