switchroom 0.18.31 → 0.18.32

package/telegram-plugin/tests/gateway-handler-registration-wiring.test.ts

@@ -0,0 +1,303 @@
+/**
+ * Registration-wiring pin for the #2996 P0a leaf move.
+ *
+ * P0a extracted the 62 top-level grammY registration statements — the 60
+ * `bot.use` / `bot.command` / `bot.on` / `bot.catch` calls PLUS the two
+ * interleaved handler-registering helpers (`registerOpsInfoCommands` and the
+ * terminal `installUnhandledMessageCatchAll`) — out of their previously
+ * module-scope-interspersed positions in gateway.ts and into a single
+ * `registerGatewayHandlers(bot, deps)` function, called exactly once at the
+ * same point in module evaluation as the old last registration.
+ *
+ * grammY middleware/handler ORDER is load-bearing — the admin-gate `bot.use`
+ * must run before any command, and the specific `message:*` handlers before
+ * the catch-all. This test is the deterministic guard that the move (and any
+ * future edit to the block) preserves the EXACT ordered registration
+ * sequence. It is outcome-asserting: it fails if a registration is dropped,
+ * reordered, duplicated, or added, and if any registration leaks back out to
+ * module top-level (which would change its evaluation order relative to the
+ * single call site).
+ *
+ * P0b (#2996) update: the single `registerGatewayHandlers(bot, {})` call moved
+ * OFF module top level into the boot function `initGatewayBot()` — because P0b
+ * defers `new Bot` construction to boot, so `bot` no longer exists at import.
+ * The call still fires exactly once, after construction and before the runner,
+ * preserving registration order. The call-site assertion below now pins that
+ * new location (zero top-level calls; exactly one inside initGatewayBot).
+ *
+ * The golden sequence below was captured from `origin/main` immediately
+ * BEFORE the move (parser-extracted top-level `bot.*` order) so the same
+ * assertion holds pre- and post-move — the ordered list is a behaviour
+ * invariant, not an artifact of the new structure.
+ *
+ * Source-parsing (not import) mirrors gateway-pending-command-wiring.test.ts:
+ * gateway.ts is not import-safe under vitest until the #2996 P0 importability
+ * seam lands, so we assert on the parsed source instead.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+import ts from 'typescript'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_PATH = resolve(__dirname, '..', 'gateway', 'gateway.ts')
+const GATEWAY_SRC = readFileSync(GATEWAY_PATH, 'utf8')
+
+/**
+ * The frozen, ordered registration sequence. Order is significant — this is
+ * the exact top-level order captured from origin/main BEFORE the move.
+ * Format: `use` / `catch` (no name), `command:<name>`, `on:<event>`,
+ * `helper:<fn>` for the interleaved handler-registering helper calls.
+ */
+const GOLDEN_REGISTRATIONS: readonly string[] = [
+  'use',
+  'command:start',
+  'command:help',
+  'command:status',
+  'command:agents',
+  'command:inject',
+  'command:compact',
+  'command:clear',
+  'command:model',
+  'command:effort',
+  'command:agentstart',
+  'command:agentstop',
+  'command:stop',
+  'command:restart',
+  'command:new',
+  'command:update',
+  'command:upgradestatus',
+  'command:upgrade',
+  'command:audit',
+  'command:approve',
+  'command:deny',
+  'command:folders',
+  'command:pending',
+  'command:interrupt',
+  'command:connect',
+  'command:auth',
+  'command:vault',
+  'command:topics',
+  'command:logs',
+  'command:memory',
+  'command:issues',
+  'command:usage',
+  'helper:registerOpsInfoCommands',
+  'on:callback_query:data',
+  'on:message:text',
+  'on:message:photo',
+  'on:message:document',
+  'on:message:voice',
+  'on:message:audio',
+  'on:message:video',
+  'on:message:video_note',
+  'on:message:sticker',
+  'on:message:animation',
+  'on:message:contact',
+  'on:message:location',
+  'on:message:venue',
+  'on:message:poll',
+  'on:message:web_app_data',
+  'on:message:users_shared',
+  'on:message:chat_shared',
+  'on:message:dice',
+  'on:message:game',
+  'on:message:story',
+  'on:message:paid_media',
+  'on:message:successful_payment',
+  'on:message:passport_data',
+  'on:message:checklist_tasks_done',
+  'on:message:checklist_tasks_added',
+  'on:message:pinned_message',
+  'helper:installUnhandledMessageCatchAll',
+  'on:message_reaction',
+  'catch',
+]
+
+/**
+ * The interleaved handler-registering helper calls. Their position in the
+ * sequence is load-bearing: `installUnhandledMessageCatchAll` MUST come after
+ * every `message:*` handler (grammY no-double-handling; see
+ * catch-all-unhandled-message.test.ts) and before `message_reaction`.
+ */
+const HELPER_REGISTRARS = new Set(['registerOpsInfoCommands', 'installUnhandledMessageCatchAll'])
+
+const sourceFile = ts.createSourceFile(
+  GATEWAY_PATH,
+  GATEWAY_SRC,
+  ts.ScriptTarget.Latest,
+  true,
+  ts.ScriptKind.TS,
+)
+
+/** `bot.<verb>` for a CallExpression whose callee is `bot.<verb>`, else null. */
+function botVerb(expr: ts.Expression): string | null {
+  if (!ts.isCallExpression(expr)) return null
+  const callee = expr.expression
+  if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.expression)) {
+    if (callee.expression.text === 'bot') return callee.name.text
+  }
+  return null
+}
+
+/** Unwrap a possibly `as`-cast string literal to its text; else null. */
+function stringArg(arg: ts.Expression | undefined): string | null {
+  if (!arg) return null
+  let node: ts.Expression = arg
+  if (ts.isAsExpression(node)) node = node.expression
+  if (ts.isStringLiteralLike(node)) return node.text
+  return null
+}
+
+/** Canonical signature for a registration statement, or null if not one. */
+function registrationSig(stmt: ts.Statement): string | null {
+  if (!ts.isExpressionStatement(stmt)) return null
+  const expr = stmt.expression
+  if (!ts.isCallExpression(expr)) return null
+  // Interleaved handler-registering helper: `helperName(bot, ...)`.
+  if (ts.isIdentifier(expr.expression) && HELPER_REGISTRARS.has(expr.expression.text)) {
+    return `helper:${expr.expression.text}`
+  }
+  const verb = botVerb(expr)
+  if (verb === null) return null
+  if (verb === 'command' || verb === 'on') {
+    const name = stringArg(expr.arguments[0])
+    return name === null ? `${verb}:<non-literal>` : `${verb}:${name}`
+  }
+  return verb // use / catch / anything else with no name key
+}
+
+function findFunction(name: string): ts.FunctionDeclaration | undefined {
+  for (const s of sourceFile.statements) {
+    if (ts.isFunctionDeclaration(s) && s.name?.text === name) return s
+  }
+  return undefined
+}
+
+describe('gateway #2996 P0a: registerGatewayHandlers is the single ordered registration unit', () => {
+  it('defines registerGatewayHandlers(bot, deps) at module top level', () => {
+    const fn = findFunction('registerGatewayHandlers')
+    expect(fn).toBeDefined()
+    expect(fn!.parameters.length).toBe(2)
+    expect(fn!.parameters[0].name.getText(sourceFile)).toBe('bot')
+    expect(fn!.parameters[1].name.getText(sourceFile)).toBe('deps')
+  })
+
+  it('registers the EXACT golden ordered sequence inside the function', () => {
+    const fn = findFunction('registerGatewayHandlers')
+    expect(fn?.body).toBeDefined()
+    const actual: string[] = []
+    for (const stmt of fn!.body!.statements) {
+      const sig = registrationSig(stmt)
+      if (sig !== null) actual.push(sig)
+    }
+    // Deep, ordered equality — fails on drop, reorder, duplicate, or add.
+    expect(actual).toEqual([...GOLDEN_REGISTRATIONS])
+  })
+
+  it('has no duplicate registrations', () => {
+    const fn = findFunction('registerGatewayHandlers')
+    const sigs: string[] = []
+    for (const stmt of fn!.body!.statements) {
+      const sig = registrationSig(stmt)
+      if (sig !== null) sigs.push(sig)
+    }
+    expect(new Set(sigs).size).toBe(sigs.length)
+  })
+
+  it('leaves ZERO bot.* registrations at module top level (all live in the function)', () => {
+    const leaked: string[] = []
+    for (const stmt of sourceFile.statements) {
+      const sig = registrationSig(stmt)
+      if (sig !== null) leaked.push(sig)
+    }
+    expect(leaked).toEqual([])
+  })
+
+  it('calls registerGatewayHandlers(bot, ...) exactly once, inside initGatewayBot (P0b), never at module top level', () => {
+    // P0b (#2996): the call moved off module top level into the boot function
+    // initGatewayBot(). Assert (a) ZERO top-level calls — proving the deferral —
+    // and (b) exactly one call in the whole file, with `bot` as its first arg,
+    // located inside initGatewayBot's body.
+    let topLevelCalls = 0
+    for (const stmt of sourceFile.statements) {
+      if (
+        ts.isExpressionStatement(stmt) &&
+        ts.isCallExpression(stmt.expression) &&
+        ts.isIdentifier(stmt.expression.expression) &&
+        stmt.expression.expression.text === 'registerGatewayHandlers'
+      ) {
+        topLevelCalls++
+      }
+    }
+    expect(topLevelCalls).toBe(0)
+
+    // Count every registerGatewayHandlers(...) call anywhere in the module, and
+    // record whether it is lexically inside the initGatewayBot function.
+    const initGatewayBot = findFunction('initGatewayBot')
+    expect(initGatewayBot).toBeDefined()
+    const initStart = initGatewayBot!.getStart(sourceFile)
+    const initEnd = initGatewayBot!.getEnd()
+
+    let totalCalls = 0
+    let callsInsideInit = 0
+    const visit = (node: ts.Node): void => {
+      if (
+        ts.isCallExpression(node) &&
+        ts.isIdentifier(node.expression) &&
+        node.expression.text === 'registerGatewayHandlers'
+      ) {
+        totalCalls++
+        // first arg is the bot singleton
+        expect(node.arguments[0]?.getText(sourceFile)).toBe('bot')
+        const start = node.getStart(sourceFile)
+        if (start >= initStart && node.getEnd() <= initEnd) callsInsideInit++
+      }
+      ts.forEachChild(node, visit)
+    }
+    visit(sourceFile)
+
+    expect(totalCalls).toBe(1)
+    expect(callsInsideInit).toBe(1)
+  })
+
+  it('registers the admin-gate middleware (bot.use) FIRST and the error boundary (bot.catch) LAST', () => {
+    const fn = findFunction('registerGatewayHandlers')
+    const sigs: string[] = []
+    for (const stmt of fn!.body!.statements) {
+      const sig = registrationSig(stmt)
+      if (sig !== null) sigs.push(sig)
+    }
+    expect(sigs[0]).toBe('use')
+    expect(sigs[sigs.length - 1]).toBe('catch')
+    // the catch-all-ish specific media handlers precede message_reaction, which
+    // precedes the error boundary
+    expect(sigs.indexOf('on:message:text')).toBeGreaterThan(sigs.indexOf('use'))
+    expect(sigs.indexOf('on:message_reaction')).toBeGreaterThan(sigs.indexOf('on:message:text'))
+  })
+
+  it('installs the terminal catch-all AFTER every message:* handler and before message_reaction', () => {
+    const fn = findFunction('registerGatewayHandlers')
+    const sigs: string[] = []
+    for (const stmt of fn!.body!.statements) {
+      const sig = registrationSig(stmt)
+      if (sig !== null) sigs.push(sig)
+    }
+    const catchAllIdx = sigs.indexOf('helper:installUnhandledMessageCatchAll')
+    expect(catchAllIdx).toBeGreaterThan(0)
+    // Every message:* handler precedes the catch-all (grammY no-double-handling).
+    const messageHandlers = sigs.filter(s => /^on:message(:|$)/.test(s) && s !== 'on:message_reaction')
+    expect(messageHandlers.length).toBeGreaterThan(0)
+    for (const mh of messageHandlers) {
+      expect(sigs.indexOf(mh)).toBeLessThan(catchAllIdx)
+    }
+    // message_reaction (a different update type) is registered AFTER the catch-all.
+    expect(sigs.indexOf('on:message_reaction')).toBeGreaterThan(catchAllIdx)
+    // ops-info commands register between the last /command and callback_query:data.
+    const opsIdx = sigs.indexOf('helper:registerOpsInfoCommands')
+    expect(opsIdx).toBeGreaterThan(sigs.indexOf('command:usage'))
+    expect(opsIdx).toBeLessThan(sigs.indexOf('on:callback_query:data'))
+  })
+})

package/telegram-plugin/tests/gateway-outbound-redact.test.ts

@@ -22,6 +22,13 @@ describe('gateway outbound secret-scrub — structural wiring', () => {
     new URL('../gateway/gateway.ts', import.meta.url),
     'utf8',
   )
+  // #2996 P2: executeReply's body moved VERBATIM to outbound-send-path.ts
+  // (`sendReply`); the reply-path scrub-ordering assertion reads there. The
+  // injected redactor (`redactOutboundText`) still lives in gateway.ts.
+  const sendPathSrc = readFileSync(
+    new URL('../gateway/outbound-send-path.ts', import.meta.url),
+    'utf8',
+  )
 
   it('imports the shared redactor', () => {
     expect(src).toMatch(/import \{ redact \} from '\.\.\/secret-detect\/redact\.js'/)
@@ -39,9 +46,9 @@ describe('gateway outbound secret-scrub — structural wiring', () => {
     // voice-scrub) is extracted into outbound-send-path.ts. The reply path now
     // delegates via `normalizeOutboundBody(rawText, 'reply', redactOutboundText)`
     // — the injected redactor still runs at entry, before the stderr preview.
-    const start = src.indexOf('async function executeReply(')
-    const redactIdx = src.indexOf(`normalizeOutboundBody(rawText, 'reply', redactOutboundText)`, start)
-    const previewIdx = src.indexOf('reply: invoked chatId=', start)
+    const start = sendPathSrc.indexOf('export async function sendReply(')
+    const redactIdx = sendPathSrc.indexOf(`normalizeOutboundBody(rawText, 'reply', redactOutboundText)`, start)
+    const previewIdx = sendPathSrc.indexOf('reply: invoked chatId=', start)
     expect(start).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(start)
     expect(previewIdx).toBeGreaterThan(redactIdx) // mask BEFORE the preview is logged

package/telegram-plugin/tests/inbound-delivery-cutover-flip.test.ts

@@ -1,37 +1,25 @@
 /**
- * PR3c cutover flip (#2794 / #2996 item 1) — the inbound-routing flip.
+ * Machine-authoritative inbound routing (#2794 cutover; kill switch
+ * removed in #2996 P1).
  *
- * `handleInbound` now dispatches the machine's captured `inbound` effects
+ * `handleInbound` dispatches the machine's captured `inbound` effects
  * through `dispatchEffects` as the AUTHORITATIVE deliver-vs-buffer routing.
- * These tests pin the two contract halves the flip rests on:
+ * These tests pin the delivery outcomes that routing rests on: fresh turn →
+ * setTurnStarted + deliverToBridge (real send); mid-turn → buffer (no send,
+ * drainable); steer mid-turn → deliverToBridge without setTurnStarted.
  *
- *   1. DEFAULT ON — with no env override, both the cutover gate
- *      (`isDeliveryCutoverEnabled`) and the dispatcher (`isDispatchEnabled`)
- *      are enabled, and the machine's effect sequences execute real I/O
- *      (fresh turn → setTurnStarted + deliverToBridge; mid-turn → buffer).
+ * Plus the `onDeliverResult` observer: the gateway's machine-deliver path
+ * branches on the send outcome (delivered → steer-ack + delivery-confirm
+ * tracking; miss → durable-buffer + restart notice), so the callback
+ * contract (fires once per deliverToBridge, with the real ok, and never
+ * breaks delivery when the observer throws) is load-bearing.
  *
- *   2. KILL SWITCH — `SWITCHROOM_DELIVERY_MACHINE_CUTOVER=0` restores
- *      legacy behavior: the gate reads legacy claudeBusyKeys (gate returns
- *      false from `isDeliveryCutoverEnabled`) and `dispatchEffects` is a
- *      total no-op, so the imperative twin in gateway.ts is the only
- *      executor. Env is read at module load, so the kill-switch tests use
- *      vi.resetModules + a fresh dynamic import.
- *
- * Plus the `onDeliverResult` observer added for the flip: the gateway's
- * machine-deliver path branches on the send outcome (delivered → busy-mark
- * + delivery-confirm tracking; miss → release + durable-buffer + restart
- * notice), so the callback contract (fires once per deliverToBridge, with
- * the real ok, and never breaks delivery when the observer throws) is
- * load-bearing.
+ * The `SWITCHROOM_DELIVERY_MACHINE_CUTOVER=0` kill-switch subprocess suite
+ * and its fixture probe were deleted in #2996 P1 with the switch itself.
  */
 
 import { describe, expect, it, vi } from 'vitest'
-import { spawnSync } from 'node:child_process'
-import { join } from 'node:path'
-import {
-  dispatchEffects,
-  isDispatchEnabled,
-} from '../gateway/inbound-delivery-machine-dispatch'
+import { dispatchEffects } from '../gateway/inbound-delivery-machine-dispatch'
 import type { DispatchCtx } from '../gateway/inbound-delivery-machine-dispatch'
 import { createPendingInboundBuffer } from '../gateway/pending-inbound-buffer'
 import { createPendingPermissionBuffer } from '../gateway/pending-permission-decisions'
@@ -41,9 +29,6 @@ import {
   type ChatKey,
   type State,
 } from '../gateway/inbound-delivery-machine'
-import {
-  isDeliveryCutoverEnabled,
-} from '../gateway/inbound-delivery-machine-shadow'
 
 const KEY = '111:_' as ChatKey
 
@@ -87,13 +72,7 @@ function aliveIdle(): State {
   return transition(initialState(), { kind: 'bridgeUp', at: 1000 }).state
 }
 
-describe('cutover default — ON without env override', () => {
-  it('dispatcher and gate are enabled by default (no kill-switch in test env)', () => {
-    expect(process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER).toBeUndefined()
-    expect(isDispatchEnabled()).toBe(true)
-    expect(isDeliveryCutoverEnabled()).toBe(true)
-  })
-
+describe('machine-authoritative routing — delivery outcomes', () => {
   it('fresh-turn inbound: machine effects execute setTurnStarted + deliverToBridge', () => {
     const state = aliveIdle()
     const msg = ipcMsg()
@@ -240,79 +219,71 @@ describe('onDeliverResult observer contract (the flip’s post-send branch sourc
   })
 })
 
-describe('machine deliver path — send-miss busy-key handling (review fix, PR #3012)', () => {
-  // Mirrors the gateway's machine-deliver wiring: onSetTurnStarted stamps
-  // the busy mirror AND records the key; the miss branch releases ONLY a
-  // key THIS dispatch stamped. A steer-miss must keep the original turn's
-  // key (the twin never reserves for steers), else the wiped key fires a
-  // false machine_over_holds parity drift and the pending-restart gate
-  // (claudeBusyKeys.size) could green-light a mid-turn restart.
-  function runMissHarness(
-    effects: ReturnType<typeof transition>['effects'],
-    busyKeys: Set<string>,
-  ): { stamped: string | null } {
+describe('machine deliver path — steer vs fresh-turn setTurnStarted contract', () => {
+  // The gateway's machine-deliver wiring keys "was this a fresh turn?" off
+  // the setTurnStarted effect: a mid-turn steer emits deliverToBridge
+  // WITHOUT setTurnStarted (it amends the running turn, it does not open
+  // one). A machine change that started emitting setTurnStarted for steers
+  // would mis-classify steers as fresh turns at the live call site.
+  it('steer mid-turn emits NO setTurnStarted even on a send-miss', () => {
+    const s1 = transition(aliveIdle(), {
+      kind: 'inbound',
+      key: KEY,
+      msg: machineMsg(ipcMsg()),
+      at: 2000,
+    }).state
+    const { effects } = transition(s1, {
+      kind: 'inbound',
+      key: KEY,
+      msg: machineMsg(ipcMsg(), true),
+      at: 3000,
+    })
+    expect(effects.some((e) => e.kind === 'setTurnStarted')).toBe(false)
     let stamped: string | null = null
-    let delivered = false
+    let delivered = true
     const { ctx } = makeCtx({ ipcServer: { sendToAgent: vi.fn(() => false) } as never })
     dispatchEffects(effects, {
       ...ctx,
       onSetTurnStarted: (k) => {
         stamped = k
-        busyKeys.add(k)
       },
       onDeliverResult: (_k, ok) => {
         delivered = ok
       },
     })
+    expect(stamped).toBeNull()
     expect(delivered).toBe(false)
-    // Gateway miss branch (guarded release):
-    if (stamped != null) busyKeys.delete(stamped)
-    return { stamped }
-  }
+  })
 
-  it('fresh-turn miss: the key THIS dispatch stamped is released', () => {
-    const busyKeys = new Set<string>()
+  it('fresh turn fires setTurnStarted exactly once, before the send', () => {
     const { effects } = transition(aliveIdle(), {
       kind: 'inbound',
       key: KEY,
       msg: machineMsg(ipcMsg()),
       at: 2000,
     })
-    const { stamped } = runMissHarness(effects, busyKeys)
-    expect(stamped).toBe(KEY)
-    expect(busyKeys.has(KEY)).toBe(false)
-  })
-
-  it('steer miss: no setTurnStarted fired, the ORIGINAL turn\'s key survives', () => {
-    // Original fresh turn holds the busy key.
-    const busyKeys = new Set<string>([KEY])
-    const s1 = transition(aliveIdle(), {
-      kind: 'inbound',
-      key: KEY,
-      msg: machineMsg(ipcMsg()),
-      at: 2000,
-    }).state
-    const { effects } = transition(s1, {
-      kind: 'inbound',
-      key: KEY,
-      msg: machineMsg(ipcMsg(), true),
-      at: 3000,
+    const order: string[] = []
+    const sendToAgent = vi.fn(() => {
+      order.push('send')
+      return true
     })
-    expect(effects.some((e) => e.kind === 'setTurnStarted')).toBe(false)
-    const { stamped } = runMissHarness(effects, busyKeys)
-    expect(stamped).toBeNull()
-    // The in-flight turn's key was NOT wiped by the steer's send-miss.
-    expect(busyKeys.has(KEY)).toBe(true)
+    const { ctx } = makeCtx({ ipcServer: { sendToAgent } as never })
+    dispatchEffects(effects, {
+      ...ctx,
+      onSetTurnStarted: () => order.push('setTurnStarted'),
+    })
+    expect(order).toEqual(['setTurnStarted', 'send'])
   })
 })
 
 describe('carve-out routing anchors (gateway keys off these machine facts)', () => {
   it('PIN: bridge-dead inbound emits the exact `inbound_bridge_dead_buffer` trace stage', () => {
     // gateway.ts's machineBridgeDead carve-out matches this string verbatim
-    // to route bridge-dead inbounds to the imperative twin. A rename here
-    // silently reroutes them to the machine's buffer+persist (losing the
-    // twin's shouldTrackDelivery drop semantics + restart notice) — this
-    // pin makes the rename loud. Deleted in PR4 with the twin.
+    // to route bridge-dead inbounds to the imperative delivery body. A
+    // rename here silently reroutes them to the machine's buffer+persist
+    // (losing the shouldTrackDelivery drop semantics + restart notice) —
+    // this pin makes the rename loud. Deleted with the carve-out when the
+    // machine grows bridge_dead send semantics (#2794 PR4 remainder).
     const dead = initialState() // bridge_dead is the initial global state
     const { effects } = transition(dead, {
       kind: 'inbound',
@@ -349,70 +320,3 @@ describe('carve-out routing anchors (gateway keys off these machine facts)', ()
     expect(effects.some((e) => e.kind === 'deliverToBridge')).toBe(false)
   })
 })
-
-// The env var is read at MODULE LOAD in the dispatch + shadow modules, and
-// bun's `vi` shim has no resetModules/stubEnv — so the kill-switch/default
-// assertions run the fixture probe in a SUBPROCESS with a controlled env
-// (same pattern as bridge-anonymous-refuse.test.ts).
-describe('kill switch — SWITCHROOM_DELIVERY_MACHINE_CUTOVER=0 restores legacy (subprocess)', () => {
-  const PROBE = join(__dirname, 'fixtures', 'cutover-killswitch-probe.ts')
-
-  function bunBin(): string | null {
-    const r = spawnSync('which', ['bun'], { encoding: 'utf-8' })
-    const p = r.status === 0 ? r.stdout.trim() : ''
-    return p !== '' ? p : null
-  }
-
-  function runProbe(env: Record<string, string | undefined>) {
-    const bun = bunBin()
-    if (bun == null) return null
-    const r = spawnSync(bun, ['run', PROBE], {
-      encoding: 'utf-8',
-      env: { ...process.env, ...env },
-      timeout: 30_000,
-    })
-    expect(r.status).toBe(0)
-    const line = r.stdout.trim().split('\n').pop() ?? ''
-    return JSON.parse(line) as {
-      dispatchEnabled: boolean
-      cutoverEnabled: boolean
-      shadowEnabled: boolean
-      sendCalls: number
-      buffered: number
-      setTurnStartedCalls: number
-      deliverResults: boolean[]
-    }
-  }
-
-  it('default (no env): machine authoritative — dispatcher executes the deliver', () => {
-    const v = runProbe({ SWITCHROOM_DELIVERY_MACHINE_CUTOVER: undefined })
-    if (v == null) return // bun not on PATH — covered by the in-process default tests above
-    expect(v.dispatchEnabled).toBe(true)
-    expect(v.cutoverEnabled).toBe(true)
-    expect(v.sendCalls).toBe(1)
-    expect(v.setTurnStartedCalls).toBe(1)
-    expect(v.deliverResults).toEqual([true])
-    expect(v.buffered).toBe(0)
-  })
-
-  it('=0: dispatcher is a total no-op and the gate reverts to legacy; shadow stays on', () => {
-    const v = runProbe({ SWITCHROOM_DELIVERY_MACHINE_CUTOVER: '0' })
-    if (v == null) return
-    expect(v.dispatchEnabled).toBe(false)
-    expect(v.cutoverEnabled).toBe(false)
-    // Shadow trace continues for the bake; only authoritative reads flip off.
-    expect(v.shadowEnabled).toBe(true)
-    expect(v.sendCalls).toBe(0)
-    expect(v.buffered).toBe(0)
-    expect(v.setTurnStartedCalls).toBe(0)
-    expect(v.deliverResults).toEqual([])
-  })
-
-  it('=1 (explicit on): identical to the default', () => {
-    const v = runProbe({ SWITCHROOM_DELIVERY_MACHINE_CUTOVER: '1' })
-    if (v == null) return
-    expect(v.dispatchEnabled).toBe(true)
-    expect(v.cutoverEnabled).toBe(true)
-    expect(v.sendCalls).toBe(1)
-  })
-})

package/telegram-plugin/tests/inbound-delivery-cutover-gate.test.ts

@@ -1,13 +1,14 @@
 /**
- * PR3b cutover — the turn-in-flight GATE now reads the delivery state
- * machine (`isMachineInTurn`) instead of the PR3b `claudeBusyKeys` set.
+ * The turn-in-flight GATE reads the delivery state machine
+ * (`isMachineInTurn`) — since #2996 P1 the machine is the SOLE authority
+ * (the legacy `claudeBusyKeys` set was deleted).
  *
- * The bug this closes (gymbro/clerk, 2026-05-28): `claudeBusyKeys` is a
- * per-delivery Set — every delivery `.add`s a key, but turn-end `.delete`s
- * exactly one. When a turn-end is missed (or fires under a non-matching
- * key) the set keeps an orphan, `size > 0` reads true forever, and EVERY
- * subsequent inbound buffers as "held mid-turn" until the 5-min
- * framework-fallback force-drains it.
+ * The bug the machine gate closes (gymbro/clerk, 2026-05-28): the legacy
+ * set was per-delivery — every delivery `.add`ed a key, but turn-end
+ * `.delete`d exactly one. When a turn-end was missed (or fired under a
+ * non-matching key) the set kept an orphan, `size > 0` read true forever,
+ * and EVERY subsequent inbound buffered as "held mid-turn" until the 5-min
+ * framework-fallback force-drained it.
  *
  * The machine cannot accumulate orphans: global state holds ONE
  * `activeTurn`, so any matching turnEnd returns it to idle, and the TTL
@@ -19,7 +20,6 @@ import { describe, expect, it, beforeEach } from 'vitest'
 import {
   shadowEmit,
   isMachineInTurn,
-  isDeliveryCutoverEnabled,
   __shadowResetForTests,
 } from '../gateway/inbound-delivery-machine-shadow.js'
 import { TURN_TTL_MS, type ChatKey } from '../gateway/inbound-delivery-machine.js'
@@ -31,13 +31,9 @@ function inbound(key: ChatKey, at: number, msgId = 1) {
   shadowEmit({ kind: 'inbound', key, msg: { msgId, isSteering: false, payload: null }, at })
 }
 
-describe('PR3b cutover gate accessors', () => {
+describe('machine turn-in-flight gate accessors (sole authority, #2996 P1)', () => {
   beforeEach(() => __shadowResetForTests())
 
-  it('enabled by default (shadow on, no kill-switch in test env)', () => {
-    expect(isDeliveryCutoverEnabled()).toBe(true)
-  })
-
   it('reads idle before any turn (bridge alive)', () => {
     shadowEmit({ kind: 'bridgeUp', at: 1000 })
     expect(isMachineInTurn()).toBe(false)

package/telegram-plugin/tests/inbound-delivery-dispatch-equivalence.test.ts

@@ -18,13 +18,12 @@
  *   3. Invariant #1 at the dispatch layer: an inbound is delivered XOR
  *      (buffered AND persisted) — never both, never neither.
  *
- * It does NOT invoke the imperative twins (`markClaudeBusyForInbound`,
- * the legacy `turnInFlightForGate` claudeBusyKeys branch,
- * `dispatchPermissionVerdict`, the silence-poke ladder), so it is NOT a
- * proof that machine path and imperative path produce identical I/O.
- * Twin-equivalence evidence for PR4 (twin deletion) must come from the
- * live shadow trace + gate-parity-probe bake per the RFC's cutover
- * protocol — do NOT cite this file as that proof.
+ * It does NOT invoke the remaining imperative delivery body (the twin
+ * carve-outs for `!`-interrupt / bridge_dead, `dispatchPermissionVerdict`,
+ * the silence-poke ladder), so it is NOT a proof that machine path and
+ * imperative path produce identical I/O. (#2996 P1 deleted the legacy
+ * gate/claudeBusyKeys twins after the cutover bake; the carve-out body's
+ * eventual deletion — the #2794 PR4 remainder — needs its own evidence.)
  *
  * What it DOES gate: if a future edit adds an effect kind the
  * dispatcher doesn't execute, the "no unhandled effect" assertion fails