switchroom 0.18.30 → 0.18.32

package/telegram-plugin/tests/inbound-delivery-cutover-flip.test.ts

@@ -1,37 +1,25 @@
 /**
- * PR3c cutover flip (#2794 / #2996 item 1) — the inbound-routing flip.
+ * Machine-authoritative inbound routing (#2794 cutover; kill switch
+ * removed in #2996 P1).
  *
- * `handleInbound` now dispatches the machine's captured `inbound` effects
+ * `handleInbound` dispatches the machine's captured `inbound` effects
  * through `dispatchEffects` as the AUTHORITATIVE deliver-vs-buffer routing.
- * These tests pin the two contract halves the flip rests on:
+ * These tests pin the delivery outcomes that routing rests on: fresh turn →
+ * setTurnStarted + deliverToBridge (real send); mid-turn → buffer (no send,
+ * drainable); steer mid-turn → deliverToBridge without setTurnStarted.
  *
- *   1. DEFAULT ON — with no env override, both the cutover gate
- *      (`isDeliveryCutoverEnabled`) and the dispatcher (`isDispatchEnabled`)
- *      are enabled, and the machine's effect sequences execute real I/O
- *      (fresh turn → setTurnStarted + deliverToBridge; mid-turn → buffer).
+ * Plus the `onDeliverResult` observer: the gateway's machine-deliver path
+ * branches on the send outcome (delivered → steer-ack + delivery-confirm
+ * tracking; miss → durable-buffer + restart notice), so the callback
+ * contract (fires once per deliverToBridge, with the real ok, and never
+ * breaks delivery when the observer throws) is load-bearing.
  *
- *   2. KILL SWITCH — `SWITCHROOM_DELIVERY_MACHINE_CUTOVER=0` restores
- *      legacy behavior: the gate reads legacy claudeBusyKeys (gate returns
- *      false from `isDeliveryCutoverEnabled`) and `dispatchEffects` is a
- *      total no-op, so the imperative twin in gateway.ts is the only
- *      executor. Env is read at module load, so the kill-switch tests use
- *      vi.resetModules + a fresh dynamic import.
- *
- * Plus the `onDeliverResult` observer added for the flip: the gateway's
- * machine-deliver path branches on the send outcome (delivered → busy-mark
- * + delivery-confirm tracking; miss → release + durable-buffer + restart
- * notice), so the callback contract (fires once per deliverToBridge, with
- * the real ok, and never breaks delivery when the observer throws) is
- * load-bearing.
+ * The `SWITCHROOM_DELIVERY_MACHINE_CUTOVER=0` kill-switch subprocess suite
+ * and its fixture probe were deleted in #2996 P1 with the switch itself.
  */
 
 import { describe, expect, it, vi } from 'vitest'
-import { spawnSync } from 'node:child_process'
-import { join } from 'node:path'
-import {
-  dispatchEffects,
-  isDispatchEnabled,
-} from '../gateway/inbound-delivery-machine-dispatch'
+import { dispatchEffects } from '../gateway/inbound-delivery-machine-dispatch'
 import type { DispatchCtx } from '../gateway/inbound-delivery-machine-dispatch'
 import { createPendingInboundBuffer } from '../gateway/pending-inbound-buffer'
 import { createPendingPermissionBuffer } from '../gateway/pending-permission-decisions'
@@ -41,9 +29,6 @@ import {
   type ChatKey,
   type State,
 } from '../gateway/inbound-delivery-machine'
-import {
-  isDeliveryCutoverEnabled,
-} from '../gateway/inbound-delivery-machine-shadow'
 
 const KEY = '111:_' as ChatKey
 
@@ -87,13 +72,7 @@ function aliveIdle(): State {
   return transition(initialState(), { kind: 'bridgeUp', at: 1000 }).state
 }
 
-describe('cutover default — ON without env override', () => {
-  it('dispatcher and gate are enabled by default (no kill-switch in test env)', () => {
-    expect(process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER).toBeUndefined()
-    expect(isDispatchEnabled()).toBe(true)
-    expect(isDeliveryCutoverEnabled()).toBe(true)
-  })
-
+describe('machine-authoritative routing — delivery outcomes', () => {
   it('fresh-turn inbound: machine effects execute setTurnStarted + deliverToBridge', () => {
     const state = aliveIdle()
     const msg = ipcMsg()
@@ -240,79 +219,71 @@ describe('onDeliverResult observer contract (the flip’s post-send branch sourc
   })
 })
 
-describe('machine deliver path — send-miss busy-key handling (review fix, PR #3012)', () => {
-  // Mirrors the gateway's machine-deliver wiring: onSetTurnStarted stamps
-  // the busy mirror AND records the key; the miss branch releases ONLY a
-  // key THIS dispatch stamped. A steer-miss must keep the original turn's
-  // key (the twin never reserves for steers), else the wiped key fires a
-  // false machine_over_holds parity drift and the pending-restart gate
-  // (claudeBusyKeys.size) could green-light a mid-turn restart.
-  function runMissHarness(
-    effects: ReturnType<typeof transition>['effects'],
-    busyKeys: Set<string>,
-  ): { stamped: string | null } {
+describe('machine deliver path — steer vs fresh-turn setTurnStarted contract', () => {
+  // The gateway's machine-deliver wiring keys "was this a fresh turn?" off
+  // the setTurnStarted effect: a mid-turn steer emits deliverToBridge
+  // WITHOUT setTurnStarted (it amends the running turn, it does not open
+  // one). A machine change that started emitting setTurnStarted for steers
+  // would mis-classify steers as fresh turns at the live call site.
+  it('steer mid-turn emits NO setTurnStarted even on a send-miss', () => {
+    const s1 = transition(aliveIdle(), {
+      kind: 'inbound',
+      key: KEY,
+      msg: machineMsg(ipcMsg()),
+      at: 2000,
+    }).state
+    const { effects } = transition(s1, {
+      kind: 'inbound',
+      key: KEY,
+      msg: machineMsg(ipcMsg(), true),
+      at: 3000,
+    })
+    expect(effects.some((e) => e.kind === 'setTurnStarted')).toBe(false)
     let stamped: string | null = null
-    let delivered = false
+    let delivered = true
     const { ctx } = makeCtx({ ipcServer: { sendToAgent: vi.fn(() => false) } as never })
     dispatchEffects(effects, {
       ...ctx,
       onSetTurnStarted: (k) => {
         stamped = k
-        busyKeys.add(k)
       },
       onDeliverResult: (_k, ok) => {
         delivered = ok
       },
     })
+    expect(stamped).toBeNull()
     expect(delivered).toBe(false)
-    // Gateway miss branch (guarded release):
-    if (stamped != null) busyKeys.delete(stamped)
-    return { stamped }
-  }
+  })
 
-  it('fresh-turn miss: the key THIS dispatch stamped is released', () => {
-    const busyKeys = new Set<string>()
+  it('fresh turn fires setTurnStarted exactly once, before the send', () => {
     const { effects } = transition(aliveIdle(), {
       kind: 'inbound',
       key: KEY,
       msg: machineMsg(ipcMsg()),
       at: 2000,
     })
-    const { stamped } = runMissHarness(effects, busyKeys)
-    expect(stamped).toBe(KEY)
-    expect(busyKeys.has(KEY)).toBe(false)
-  })
-
-  it('steer miss: no setTurnStarted fired, the ORIGINAL turn\'s key survives', () => {
-    // Original fresh turn holds the busy key.
-    const busyKeys = new Set<string>([KEY])
-    const s1 = transition(aliveIdle(), {
-      kind: 'inbound',
-      key: KEY,
-      msg: machineMsg(ipcMsg()),
-      at: 2000,
-    }).state
-    const { effects } = transition(s1, {
-      kind: 'inbound',
-      key: KEY,
-      msg: machineMsg(ipcMsg(), true),
-      at: 3000,
+    const order: string[] = []
+    const sendToAgent = vi.fn(() => {
+      order.push('send')
+      return true
     })
-    expect(effects.some((e) => e.kind === 'setTurnStarted')).toBe(false)
-    const { stamped } = runMissHarness(effects, busyKeys)
-    expect(stamped).toBeNull()
-    // The in-flight turn's key was NOT wiped by the steer's send-miss.
-    expect(busyKeys.has(KEY)).toBe(true)
+    const { ctx } = makeCtx({ ipcServer: { sendToAgent } as never })
+    dispatchEffects(effects, {
+      ...ctx,
+      onSetTurnStarted: () => order.push('setTurnStarted'),
+    })
+    expect(order).toEqual(['setTurnStarted', 'send'])
   })
 })
 
 describe('carve-out routing anchors (gateway keys off these machine facts)', () => {
   it('PIN: bridge-dead inbound emits the exact `inbound_bridge_dead_buffer` trace stage', () => {
     // gateway.ts's machineBridgeDead carve-out matches this string verbatim
-    // to route bridge-dead inbounds to the imperative twin. A rename here
-    // silently reroutes them to the machine's buffer+persist (losing the
-    // twin's shouldTrackDelivery drop semantics + restart notice) — this
-    // pin makes the rename loud. Deleted in PR4 with the twin.
+    // to route bridge-dead inbounds to the imperative delivery body. A
+    // rename here silently reroutes them to the machine's buffer+persist
+    // (losing the shouldTrackDelivery drop semantics + restart notice) —
+    // this pin makes the rename loud. Deleted with the carve-out when the
+    // machine grows bridge_dead send semantics (#2794 PR4 remainder).
     const dead = initialState() // bridge_dead is the initial global state
     const { effects } = transition(dead, {
       kind: 'inbound',
@@ -349,70 +320,3 @@ describe('carve-out routing anchors (gateway keys off these machine facts)', ()
     expect(effects.some((e) => e.kind === 'deliverToBridge')).toBe(false)
   })
 })
-
-// The env var is read at MODULE LOAD in the dispatch + shadow modules, and
-// bun's `vi` shim has no resetModules/stubEnv — so the kill-switch/default
-// assertions run the fixture probe in a SUBPROCESS with a controlled env
-// (same pattern as bridge-anonymous-refuse.test.ts).
-describe('kill switch — SWITCHROOM_DELIVERY_MACHINE_CUTOVER=0 restores legacy (subprocess)', () => {
-  const PROBE = join(__dirname, 'fixtures', 'cutover-killswitch-probe.ts')
-
-  function bunBin(): string | null {
-    const r = spawnSync('which', ['bun'], { encoding: 'utf-8' })
-    const p = r.status === 0 ? r.stdout.trim() : ''
-    return p !== '' ? p : null
-  }
-
-  function runProbe(env: Record<string, string | undefined>) {
-    const bun = bunBin()
-    if (bun == null) return null
-    const r = spawnSync(bun, ['run', PROBE], {
-      encoding: 'utf-8',
-      env: { ...process.env, ...env },
-      timeout: 30_000,
-    })
-    expect(r.status).toBe(0)
-    const line = r.stdout.trim().split('\n').pop() ?? ''
-    return JSON.parse(line) as {
-      dispatchEnabled: boolean
-      cutoverEnabled: boolean
-      shadowEnabled: boolean
-      sendCalls: number
-      buffered: number
-      setTurnStartedCalls: number
-      deliverResults: boolean[]
-    }
-  }
-
-  it('default (no env): machine authoritative — dispatcher executes the deliver', () => {
-    const v = runProbe({ SWITCHROOM_DELIVERY_MACHINE_CUTOVER: undefined })
-    if (v == null) return // bun not on PATH — covered by the in-process default tests above
-    expect(v.dispatchEnabled).toBe(true)
-    expect(v.cutoverEnabled).toBe(true)
-    expect(v.sendCalls).toBe(1)
-    expect(v.setTurnStartedCalls).toBe(1)
-    expect(v.deliverResults).toEqual([true])
-    expect(v.buffered).toBe(0)
-  })
-
-  it('=0: dispatcher is a total no-op and the gate reverts to legacy; shadow stays on', () => {
-    const v = runProbe({ SWITCHROOM_DELIVERY_MACHINE_CUTOVER: '0' })
-    if (v == null) return
-    expect(v.dispatchEnabled).toBe(false)
-    expect(v.cutoverEnabled).toBe(false)
-    // Shadow trace continues for the bake; only authoritative reads flip off.
-    expect(v.shadowEnabled).toBe(true)
-    expect(v.sendCalls).toBe(0)
-    expect(v.buffered).toBe(0)
-    expect(v.setTurnStartedCalls).toBe(0)
-    expect(v.deliverResults).toEqual([])
-  })
-
-  it('=1 (explicit on): identical to the default', () => {
-    const v = runProbe({ SWITCHROOM_DELIVERY_MACHINE_CUTOVER: '1' })
-    if (v == null) return
-    expect(v.dispatchEnabled).toBe(true)
-    expect(v.cutoverEnabled).toBe(true)
-    expect(v.sendCalls).toBe(1)
-  })
-})

package/telegram-plugin/tests/inbound-delivery-cutover-gate.test.ts

@@ -1,13 +1,14 @@
 /**
- * PR3b cutover — the turn-in-flight GATE now reads the delivery state
- * machine (`isMachineInTurn`) instead of the PR3b `claudeBusyKeys` set.
+ * The turn-in-flight GATE reads the delivery state machine
+ * (`isMachineInTurn`) — since #2996 P1 the machine is the SOLE authority
+ * (the legacy `claudeBusyKeys` set was deleted).
  *
- * The bug this closes (gymbro/clerk, 2026-05-28): `claudeBusyKeys` is a
- * per-delivery Set — every delivery `.add`s a key, but turn-end `.delete`s
- * exactly one. When a turn-end is missed (or fires under a non-matching
- * key) the set keeps an orphan, `size > 0` reads true forever, and EVERY
- * subsequent inbound buffers as "held mid-turn" until the 5-min
- * framework-fallback force-drains it.
+ * The bug the machine gate closes (gymbro/clerk, 2026-05-28): the legacy
+ * set was per-delivery — every delivery `.add`ed a key, but turn-end
+ * `.delete`d exactly one. When a turn-end was missed (or fired under a
+ * non-matching key) the set kept an orphan, `size > 0` read true forever,
+ * and EVERY subsequent inbound buffered as "held mid-turn" until the 5-min
+ * framework-fallback force-drained it.
  *
  * The machine cannot accumulate orphans: global state holds ONE
  * `activeTurn`, so any matching turnEnd returns it to idle, and the TTL
@@ -19,7 +20,6 @@ import { describe, expect, it, beforeEach } from 'vitest'
 import {
   shadowEmit,
   isMachineInTurn,
-  isDeliveryCutoverEnabled,
   __shadowResetForTests,
 } from '../gateway/inbound-delivery-machine-shadow.js'
 import { TURN_TTL_MS, type ChatKey } from '../gateway/inbound-delivery-machine.js'
@@ -31,13 +31,9 @@ function inbound(key: ChatKey, at: number, msgId = 1) {
   shadowEmit({ kind: 'inbound', key, msg: { msgId, isSteering: false, payload: null }, at })
 }
 
-describe('PR3b cutover gate accessors', () => {
+describe('machine turn-in-flight gate accessors (sole authority, #2996 P1)', () => {
   beforeEach(() => __shadowResetForTests())
 
-  it('enabled by default (shadow on, no kill-switch in test env)', () => {
-    expect(isDeliveryCutoverEnabled()).toBe(true)
-  })
-
   it('reads idle before any turn (bridge alive)', () => {
     shadowEmit({ kind: 'bridgeUp', at: 1000 })
     expect(isMachineInTurn()).toBe(false)

package/telegram-plugin/tests/inbound-delivery-dispatch-equivalence.test.ts

@@ -18,13 +18,12 @@
  *   3. Invariant #1 at the dispatch layer: an inbound is delivered XOR
  *      (buffered AND persisted) — never both, never neither.
  *
- * It does NOT invoke the imperative twins (`markClaudeBusyForInbound`,
- * the legacy `turnInFlightForGate` claudeBusyKeys branch,
- * `dispatchPermissionVerdict`, the silence-poke ladder), so it is NOT a
- * proof that machine path and imperative path produce identical I/O.
- * Twin-equivalence evidence for PR4 (twin deletion) must come from the
- * live shadow trace + gate-parity-probe bake per the RFC's cutover
- * protocol — do NOT cite this file as that proof.
+ * It does NOT invoke the remaining imperative delivery body (the twin
+ * carve-outs for `!`-interrupt / bridge_dead, `dispatchPermissionVerdict`,
+ * the silence-poke ladder), so it is NOT a proof that machine path and
+ * imperative path produce identical I/O. (#2996 P1 deleted the legacy
+ * gate/claudeBusyKeys twins after the cutover bake; the carve-out body's
+ * eventual deletion — the #2794 PR4 remainder — needs its own evidence.)
  *
  * What it DOES gate: if a future edit adds an effect kind the
  * dispatcher doesn't execute, the "no unhandled effect" assertion fails

package/telegram-plugin/tests/inbound-delivery-machine-dispatch.test.ts

@@ -17,7 +17,6 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import {
   __dispatchOneForTests,
   dispatchEffects,
-  isDispatchEnabled,
 } from '../gateway/inbound-delivery-machine-dispatch'
 import type { DispatchCtx } from '../gateway/inbound-delivery-machine-dispatch'
 import { createPendingInboundBuffer } from '../gateway/pending-inbound-buffer'
@@ -50,12 +49,6 @@ function makeCtx(overrides?: Partial<DispatchCtx>): {
   return { ctx, logs, sendToAgent, clientSend, inbound, perm }
 }
 
-describe('isDispatchEnabled', () => {
-  it('defaults to true when the kill-switch env-var is unset', () => {
-    expect(isDispatchEnabled()).toBe(true)
-  })
-})
-
 describe('dispatchEffects — drainBuffer', () => {
   it('redelivers buffered inbound to the registered client', () => {
     const { ctx, clientSend, inbound } = makeCtx()
@@ -175,15 +168,6 @@ describe('dispatchEffects — bridgeUp composite (all three effects in order)',
   })
 })
 
-describe('dispatchEffects — kill switch', () => {
-  // The kill switch is checked at module-load time so we can't toggle
-  // it inside the test process easily. We validate the contract that
-  // the helper exists and respects the env-var — see isDispatchEnabled.
-  it('exposes the kill-switch check', () => {
-    expect(typeof isDispatchEnabled()).toBe('boolean')
-  })
-})
-
 describe('dispatchEffects — inbound-routing effects (PR3c wiring)', () => {
   const k = 'c1:_' as never
   const ipcMsg = { type: 'inbound' as const, id: 'm1', chat_id: '1', text: 'hi', meta: { source: 'telegram' } }

package/telegram-plugin/tests/inbound-emit-after-intercepts.test.ts

@@ -9,10 +9,10 @@
  * — before the permission-reply / `/auth` paste-back / interrupt-empty /
  * secret-detect-drop intercepts — an intercepted message (e.g. an approval
  * reply) drove the machine idle→`bridge_alive_in_turn`, then early-returned
- * as an intercept: no delivery, no claudeBusyKeys mark, and critically no
- * `turnEnd`. The machine held the gate closed until the 5-min TTL tick
- * force-cleared it, buffering every inbound (including `/usage`) meanwhile —
- * the dangerous `machine_over_holds` divergence gate-parity-probe.ts flags.
+ * as an intercept: no delivery, and critically no `turnEnd`. The machine
+ * held the gate closed until the 5-min TTL tick force-cleared it, buffering
+ * every inbound (including `/usage`) meanwhile — the dangerous over-hold
+ * direction the bake-era gate-parity probe flagged.
  *
  * The behaviour lives inside the un-exported `handleInbound` closure, so —
  * mirroring the other gateway-*.test.ts source-pins — we assert on source

package/telegram-plugin/tests/litellm-proxy-auth-misconfig.test.ts

@@ -227,39 +227,94 @@ describe('PendingUserNoticeGate — notice fires IFF the turn dies reply-less',
     }
   }
 
+  // The single-turn norm: the error surfaced while topic A's turn was live, so
+  // the notice is keyed to A and topic A's turn end resolves it. `TOPIC_A` is a
+  // `statusKey(chatId, threadId)`-shaped value.
+  const TOPIC_A = '5000000002'
+  const TOPIC_B = '5000000009:42'
+
   it('DROPS the notice when the turn recovered (delivered a reply)', () => {
     const gate = new PendingUserNoticeGate()
-    gate.schedule(makeNotice())
-    expect(gate.resolveTurnEnd(true, 1_001_000)).toEqual([])
+    gate.schedule(makeNotice({ key: TOPIC_A }))
+    expect(gate.resolveTurnEnd(TOPIC_A, true, 1_001_000)).toEqual([])
     // And it does not resurrect on a later failed turn end.
-    expect(gate.resolveTurnEnd(false, 1_002_000)).toEqual([])
+    expect(gate.resolveTurnEnd(TOPIC_A, false, 1_002_000)).toEqual([])
   })
 
   it('SENDS the notice exactly once when the turn ends without a reply', () => {
     const gate = new PendingUserNoticeGate()
-    const notice = makeNotice()
-    gate.schedule(notice)
-    const flushed = gate.resolveTurnEnd(false, 1_001_000)
+    gate.schedule(makeNotice({ key: TOPIC_A }))
+    const flushed = gate.resolveTurnEnd(TOPIC_A, false, 1_001_000)
     expect(flushed).toHaveLength(1)
     expect(flushed[0].chatIds).toEqual(['5000000002', '5000000003'])
     // Exactly once — a second turn end flushes nothing.
-    expect(gate.resolveTurnEnd(false, 1_002_000)).toEqual([])
+    expect(gate.resolveTurnEnd(TOPIC_A, false, 1_002_000)).toEqual([])
   })
 
-  it('collapses an error burst within one turn to ONE pending notice per agent', () => {
+  it('collapses an error burst within one turn to ONE pending notice per topic', () => {
     const gate = new PendingUserNoticeGate()
-    gate.schedule(makeNotice({ atMs: 1_000_000 }))
-    gate.schedule(makeNotice({ atMs: 1_000_500 }))
-    gate.schedule(makeNotice({ atMs: 1_001_000 }))
-    expect(gate.resolveTurnEnd(false, 1_002_000)).toHaveLength(1)
+    gate.schedule(makeNotice({ atMs: 1_000_000, key: TOPIC_A }))
+    gate.schedule(makeNotice({ atMs: 1_000_500, key: TOPIC_A }))
+    gate.schedule(makeNotice({ atMs: 1_001_000, key: TOPIC_A }))
+    expect(gate.resolveTurnEnd(TOPIC_A, false, 1_002_000)).toHaveLength(1)
   })
 
   it('expires an unresolved notice after the TTL (bias to silence over false failure)', () => {
     const gate = new PendingUserNoticeGate()
-    gate.schedule(makeNotice({ atMs: 1_000_000 }))
+    gate.schedule(makeNotice({ atMs: 1_000_000, key: TOPIC_A }))
     const after = 1_000_000 + PENDING_USER_NOTICE_TTL_MS + 1
     expect(gate.hasPending(after)).toBe(false)
-    expect(gate.resolveTurnEnd(false, after)).toEqual([])
+    expect(gate.resolveTurnEnd(TOPIC_A, false, after)).toEqual([])
+  })
+
+  // ── #3294 — keyed by turn/topic so concurrent per-topic turns don't
+  //    cross-resolve each other's pending notices. ─────────────────────────────
+  it("does NOT flush topic A's notice when a DIFFERENT topic's turn ends reply-less", () => {
+    const gate = new PendingUserNoticeGate()
+    gate.schedule(makeNotice({ atMs: 1_000_000, key: TOPIC_A }))
+    // Topic B's turn ends WITHOUT a reply. Pre-#3294 this flushed A's notice
+    // (a false "couldn't complete" for a turn that may still recover). Now B's
+    // end resolves nothing keyed to A.
+    expect(gate.resolveTurnEnd(TOPIC_B, false, 1_000_500)).toEqual([])
+    // A's notice is still pending, and A's OWN reply-less end flushes it.
+    expect(gate.hasPending(1_000_600)).toBe(true)
+    const flushed = gate.resolveTurnEnd(TOPIC_A, false, 1_000_700)
+    expect(flushed).toHaveLength(1)
+    expect(flushed[0].key).toBe(TOPIC_A)
+  })
+
+  it("does NOT drop topic A's notice when a DIFFERENT topic's turn recovers", () => {
+    const gate = new PendingUserNoticeGate()
+    gate.schedule(makeNotice({ atMs: 1_000_000, key: TOPIC_A }))
+    // Topic B's turn recovered (delivered a reply). It must not drop A's notice.
+    expect(gate.resolveTurnEnd(TOPIC_B, true, 1_000_500)).toEqual([])
+    // A's notice survives and still flushes on A's reply-less end.
+    expect(gate.resolveTurnEnd(TOPIC_A, false, 1_000_700)).toHaveLength(1)
+  })
+
+  it('keeps a per-topic pending notice for each concurrent topic (no cross-collapse)', () => {
+    const gate = new PendingUserNoticeGate()
+    gate.schedule(makeNotice({ atMs: 1_000_000, key: TOPIC_A, chatIds: ['5000000002'] }))
+    gate.schedule(makeNotice({ atMs: 1_000_100, key: TOPIC_B, chatIds: ['5000000009'] }))
+    // A's end flushes only A.
+    const a = gate.resolveTurnEnd(TOPIC_A, false, 1_000_200)
+    expect(a).toHaveLength(1)
+    expect(a[0].chatIds).toEqual(['5000000002'])
+    // B is still pending and flushes on B's end.
+    const b = gate.resolveTurnEnd(TOPIC_B, false, 1_000_300)
+    expect(b).toHaveLength(1)
+    expect(b[0].chatIds).toEqual(['5000000009'])
+  })
+
+  it('an UNATTRIBUTED (undefined-key) notice resolves on any turn end (legacy single-turn behavior)', () => {
+    const gate = new PendingUserNoticeGate()
+    // No key — the error arrived with no live turn (between turns / post-poke).
+    gate.schedule(makeNotice({ atMs: 1_000_000 }))
+    // Any topic's reply-less end flushes it (preserves pre-#3294 behavior so a
+    // genuine death on a single-turn gateway still notifies the user).
+    const flushed = gate.resolveTurnEnd(TOPIC_B, false, 1_000_500)
+    expect(flushed).toHaveLength(1)
+    expect(flushed[0].key).toBeUndefined()
   })
 })
 

package/telegram-plugin/tests/multitopic-routing-wiring.test.ts

@@ -12,6 +12,13 @@ import { describe, it, expect } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 
+// #2996 P2: executeReply's body moved VERBATIM to outbound-send-path.ts
+// (`sendReply`); the reply-path routing assertions read the window there.
+const sendPathSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
+  'utf-8',
+)
+const sendReplyFn = sendPathSrc.split('export async function sendReply(')[1]?.split('\nexport ')[0] ?? ''
 const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
@@ -54,7 +61,7 @@ describe('component 3 — turn-origin reply routing', () => {
   })
 
   it('executeReply resolves the answer thread via the origin turn, not the live currentTurn', () => {
-    const fn = gatewaySrc.split('async function executeReply')[1]?.split('\nasync function ')[0] ?? ''
+    const fn = sendReplyFn
     expect(fn).toMatch(/TURN_ORIGIN_ROUTING_ENABLED/)
     expect(fn).toMatch(/findTurnByOriginId\(args\.origin_turn_id/)
     // The resolution + reply-route telemetry go through resolveAnswerThreadWithLog,
@@ -85,8 +92,7 @@ describe('framework-owned origin recovery (determinism residual, 2026-06-05)', (
   })
 
   it('the reply path recovers origin from the quoted message_id when the model omits the echo', () => {
-    for (const name of ['executeReply']) {
-      const fn = gatewaySrc.split(new RegExp(`async function ${name}`))[1]?.split('\nasync function ')[0] ?? ''
+    for (const fn of [sendReplyFn]) {
       // Echo first (authoritative), quoted message_id as the framework fallback.
       expect(fn).toMatch(/const echoedTurn = findTurnByOriginId\(args\.origin_turn_id/)
       // Quoted lookup is CHAT-SCOPED (cross-chat message-id collision guard).

package/telegram-plugin/tests/obligation-ledger.test.ts

@@ -620,3 +620,43 @@ describe("ObligationLedger — escalation suppression predicate (Fix 4)", () =>
     expect(snapshots[1]).toEqual([]);
   });
 });
+
+// #3282 — the durable captured-answer snapshot attaches to the OPEN obligation
+// so a partial backstop delivery is resumed (tail only) rather than regenerated.
+describe("ObligationLedger — noteCapturedDelivery (#3282)", () => {
+  function input(id: string, openedAt: number) {
+    return { originTurnId: id, chatId: "-100123", threadId: 3, messageId: 1, text: "q", openedAt };
+  }
+  const snap = { chunks: ["c0", "c1"], chunkStates: [{ index: 0, messageIds: [10], confirmed: true }] };
+
+  it("attaches the snapshot to an OPEN obligation and persists it", () => {
+    const snapshots: Obligation[][] = [];
+    const L = new ObligationLedger(2, { onChange: (s) => snapshots.push(s) });
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.noteCapturedDelivery("c:3#1", snap);
+    expect(L.list()[0]!.capturedDelivery).toEqual(snap);
+    // The mutation persisted (onChange fired again after open).
+    expect(snapshots.at(-1)![0]!.capturedDelivery).toEqual(snap);
+  });
+
+  it("is a no-op for an obligation that is not open (a delivered turn has none to resume)", () => {
+    const L = new ObligationLedger(2);
+    L.noteCapturedDelivery("c:3#missing", snap); // never opened
+    expect(L.isOpen("c:3#missing")).toBe(false);
+  });
+
+  it("ignores an EMPTY snapshot (nothing to resume)", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.noteCapturedDelivery("c:3#1", { chunks: [], chunkStates: [] });
+    expect(L.list()[0]!.capturedDelivery).toBeUndefined();
+  });
+
+  it("close drops the snapshot with the obligation (bounded lifetime, A6)", () => {
+    const L = new ObligationLedger(2);
+    L.openIfAbsent(input("c:3#1", 1000));
+    L.noteCapturedDelivery("c:3#1", snap);
+    expect(L.close("c:3#1")).toBe(true);
+    expect(L.isOpen("c:3#1")).toBe(false);
+  });
+});

package/telegram-plugin/tests/obligation-store.test.ts

@@ -118,6 +118,49 @@ describe("obligation-store", () => {
     expect(loaded[0]!.representCount).toBe(1);
   });
 
+  it("round-trips a valid capturedDelivery snapshot through persist → load (#3282)", () => {
+    const { fs } = memFs();
+    const capturedDelivery = {
+      chunks: ["c0", "c1"],
+      chunkStates: [
+        { index: 0, messageIds: [10], confirmed: true },
+        { index: 1, messageIds: [11, 12], confirmed: false },
+      ],
+    };
+    persistObligations(PATH, fs, [ob("c:3#715", { capturedDelivery })]);
+    const loaded = loadObligations(PATH, fs);
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]!.capturedDelivery).toEqual(capturedDelivery);
+  });
+
+  it("STRIPS a malformed capturedDelivery (fail-open to fresh-generation represent) (#3282)", () => {
+    // A partial write / forward-incompatible shape must not crash the resume: the
+    // row survives (obligation preserved), the bad blob is dropped.
+    const bad = {
+      v: 1,
+      obligations: [
+        { ...ob("c:3#715"), capturedDelivery: { chunks: "not-an-array", chunkStates: [] } },
+        { ...ob("c:3#716"), capturedDelivery: { chunks: ["c0"], chunkStates: [{ index: 0 }] } },
+      ],
+    };
+    const { fs } = memFs({ [PATH]: JSON.stringify(bad) });
+    const loaded = loadObligations(PATH, fs);
+    expect(loaded.map((o) => o.originTurnId)).toEqual(["c:3#715", "c:3#716"]);
+    expect(loaded[0]!.capturedDelivery).toBeUndefined();
+    expect(loaded[1]!.capturedDelivery).toBeUndefined();
+  });
+
+  it("STRIPS an empty-chunks capturedDelivery (nothing to resume → fresh-gen, bounded) (#3282)", () => {
+    const bad = {
+      v: 1,
+      obligations: [{ ...ob("c:3#715"), capturedDelivery: { chunks: [], chunkStates: [] } }],
+    };
+    const { fs } = memFs({ [PATH]: JSON.stringify(bad) });
+    const loaded = loadObligations(PATH, fs);
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]!.capturedDelivery).toBeUndefined();
+  });
+
   it("never throws on a write failure — degrades to in-memory (logs)", () => {
     const logs: string[] = [];
     const fs: ObligationStoreFsSeam = {

package/telegram-plugin/tests/pending-card-durability-wiring.test.ts

@@ -143,7 +143,8 @@ describe('resolution clears the durable store (Defect A)', () => {
 
 describe('TTL expiry wakes the parked agent (Defect B)', () => {
   it('the periodic reaper runs the approval-card expiry sweep inside try/catch', () => {
-    const reaper = slice(GATEWAY, 'const pendingStateReaper = setInterval', 12000)
+    // Anchor tolerates the #2996 P0c `isGatewayMain ? setInterval(...)` boot gate.
+    const reaper = slice(GATEWAY, 'const pendingStateReaper = ', 12000)
     // The sweep call must be guarded like the sibling sweepStaleTurnActiveMarker:
     // an escaped throw inside this setInterval callback reaches uncaughtException
     // and takes the whole gateway down.