switchroom 0.18.31 → 0.18.33

package/telegram-plugin/uat/scenarios/cross-turn-pending-progress-dm.test.ts

@@ -81,8 +81,16 @@ interface TrailEntry {
   text: string;
 }
 
+// Mirrors the production matcher (`pending-work-progress.ts` SUFFIX_RE):
+// the CURRENT emit is the italic rich-markdown form
+// `\n\n_still working (Nm) · message me anytime, I'll keep you posted_`
+// (#2669) — mtcute's parsed `Message.text` strips the italic markers, so
+// the observed text is `\n\nstill working (Nm) · …`. The legacy em-dash
+// prefix (`— still working`) and a literal-underscore render are also
+// tolerated. The old mandatory-em-dash regex could not match ANY current
+// production edit (stale oracle, diagnosed 2026-07-18).
 const SUFFIX_RE =
-  /\n\n— still working \(\d+m\)( · message me anytime, I'll keep you posted)?$/;
+  /\n\n(?:— |_)?still working \(\d+m\)( · message me anytime, I'll keep you posted)?_?$/;
 
 function pad(s: string, n: number): string {
   return s.length >= n ? s : s + " ".repeat(n - s.length);
@@ -139,11 +147,20 @@ describe("uat: cross-turn pending-async ambient progress (#1445)", () => {
             if (firstAnchorMsgId == null && entry.kind === "fresh") {
               firstAnchorMsgId = entry.messageId;
             }
+            // EXACT match only. The prompt demands the completion signal be
+            // the single word "done" and nothing else; the loose `/\bdone\b/`
+            // fallback false-positived on the model's beat-1 ACK ("…I'll
+            // reply \"done\" when it finishes"), tripping a 10s wind-down that
+            // quit the test ~22s BEFORE the turn even ended — so the ambient
+            // edit mechanism was never observable (#3334 item b, observed UAT
+            // v0.18.32 r2). Requiring `trim() === "done"` makes the terminal
+            // signal deterministic and un-spoofable by an ack that merely
+            // mentions the word.
             const trimmedFinal = entry.text.trim().toLowerCase();
             const looksLikeDone =
               entry.kind === "fresh" &&
               entry.messageId !== firstAnchorMsgId &&
-              (trimmedFinal === "done" || /\bdone\b/.test(trimmedFinal));
+              trimmedFinal === "done";
             if (looksLikeDone) {
               sawDone = true;
               quiescenceDeadline = Date.now() + 10_000;

package/telegram-plugin/uat/scenarios/jtbd-always-on-after-restart-dm.test.ts

@@ -55,8 +55,10 @@
 import { describe, it, expect, beforeAll } from "vitest";
 import { execSync } from "node:child_process";
 import { spinUp } from "../harness.js";
+import { restartCapableOrAnnounceSkip } from "../restart-capability.js";
 
 const AGENT = "test-harness";
+const SCENARIO_TITLE = "uat: always-on after restart";
 
 // Budget for the marker-safe restart itself (per
 // feedback_agent_restart_needs_sudo_when_running.md, restart blocks
@@ -74,15 +76,6 @@ const HARD_REPLY_BUDGET_MS = 120_000;
 // contract but worth logging for forensic visibility.
 const VISION_REPLY_BUDGET_MS = 30_000;
 
-function canShellSudo(): boolean {
-  try {
-    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function restartAgent(name: string): void {
   // Marker-safe restart per memory feedback_compose_rollout.md +
   // feedback_agent_restart_needs_sudo_when_running.md. Apply step
@@ -96,11 +89,12 @@ function restartAgent(name: string): void {
 }
 
 // This scenario requires NOPASSWD sudo + the switchroom CLI on PATH on
-// the harness host. Skip on CI runners that don't expose those.
-const sudoOk = canShellSudo();
+// the harness host. Skip on CI runners that don't expose those — and when
+// we skip, announce it LOUDLY so a green isn't mistaken for live proof.
+const sudoOk = restartCapableOrAnnounceSkip(SCENARIO_TITLE);
 
 (sudoOk ? describe : describe.skip)(
-  "uat: always-on after restart",
+  SCENARIO_TITLE,
   () => {
     beforeAll(() => {
       restartAgent(AGENT);

package/telegram-plugin/uat/scenarios/jtbd-deliberate-restart-resumes-dm.test.ts

@@ -21,10 +21,13 @@
  */
 
 import { describe, it, expect } from "vitest";
-import { execSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { spinUp } from "../harness.js";
+import { restartCapableOrAnnounceSkip } from "../restart-capability.js";
 
 const AGENT = "test-harness";
+const SCENARIO_TITLE =
+  "uat: deliberate restart mid-turn resumes exactly once (DM, #2988)";
 const MID_TURN_MS = 10_000;        // let the turn get in-flight before the bounce
 const RESUME_BUDGET_MS = 180_000;  // boot + resume + reply
 const QUIET_WINDOW_MS = 90_000;    // after the resume completes, no second resume may fire
@@ -36,15 +39,6 @@ const SAME_TURN_GRACE_MS = 20_000;
 
 const RESUME_FRAMING = /resum|picking .*back|interrupted|cut off|just restarted/i;
 
-function canShellSudo(): boolean {
-  try {
-    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function kickRestartDetached(name: string): void {
   // A deliberate operator restart: clean SIGTERM path, clean-shutdown marker
   // written — the exact class #2988 makes resume in-flight work through.
@@ -57,10 +51,10 @@ function kickRestartDetached(name: string): void {
   child.unref();
 }
 
-const sudoOk = canShellSudo();
+const sudoOk = restartCapableOrAnnounceSkip(SCENARIO_TITLE);
 
 (sudoOk ? describe : describe.skip)(
-  "uat: deliberate restart mid-turn resumes exactly once (DM, #2988)",
+  SCENARIO_TITLE,
   () => {
     it(
       "an operator restart mid-turn resumes the work once, and never a second time",

package/telegram-plugin/uat/scenarios/jtbd-interrupted-turn-resumes-dm.test.ts

@@ -23,26 +23,20 @@
  */
 
 import { describe, it, expect } from "vitest";
-import { execSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { spinUp } from "../harness.js";
+import { restartCapableOrAnnounceSkip } from "../restart-capability.js";
 
 const AGENT = "test-harness";
 const MID_TURN_MS = 10_000;        // let the turn enqueue (become a recorded interrupted turn)
 const RESUME_BUDGET_MS = 180_000;  // boot + resume + reply
 
+const SCENARIO_TITLE = "uat: interrupted turn resumes after restart (DM)";
+
 // The resume builder tells the model to "briefly let the user know you're
 // resuming what was interrupted" — so the reply always opens with this framing.
 const RESUME_FRAMING = /resum|picking .*back|interrupted|cut off|just restarted/i;
 
-function canShellSudo(): boolean {
-  try {
-    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function kickRestartDetached(name: string): void {
   // --force WITHOUT --wait → recreate now, interrupting the in-flight turn.
   const child = spawn(
@@ -54,9 +48,9 @@ function kickRestartDetached(name: string): void {
   child.unref();
 }
 
-const sudoOk = canShellSudo();
+const sudoOk = restartCapableOrAnnounceSkip(SCENARIO_TITLE);
 
-(sudoOk ? describe : describe.skip)("uat: interrupted turn resumes after restart (DM)", () => {
+(sudoOk ? describe : describe.skip)(SCENARIO_TITLE, () => {
   it(
     "a turn interrupted by a restart is resumed and the resume turn completes",
     async () => {

package/telegram-plugin/uat/scenarios/jtbd-multipart-render-dm.test.ts

@@ -70,23 +70,47 @@ const TAIL = "MULTITAIL9";
 
 // We need the composed reply to exceed the 32768-char cap so the gateway
 // chunks it. Asking a model to emit ~40k literal chars is flaky (it'll
-// summarize or truncate). Instead we ask it to REPEAT a fixed, cheap-to-
-// generate padding block a deterministic number of times — a task an agent
-// reliably obeys because it's mechanical, not generative.
-const PAD_LINE = "The quick brown fox jumps over the lazy dog. ";
-// Overshoot the cap by a comfortable margin so a slightly-short reply still
-// splits: (cap / line) rounded up, times a 1.3 safety factor.
-const REPEATS = Math.ceil((RICH_MESSAGE_MAX_CHARS / PAD_LINE.length) * 1.3);
+// summarize or truncate). We keep the task MECHANICAL (cycle a fixed
+// sentence list, prefix each line with its index) so an agent reliably
+// obeys — but every emitted line is UNIQUE. Verbatim repetition of one
+// sentence 900+ times reads as degenerate output to Anthropic's content
+// filter and 4xx-kills the turn before any reply exists to send (observed
+// live 2026-07-18, ci-uat run 29634400115: four "unknown-4xx / Output
+// blocked by content filtering policy" events, gateway-supervisor.log
+// 06:43–06:53Z — the reply never reached the send path).
+const PAD_SENTENCES = [
+  "The quick brown fox jumps over the lazy dog.",
+  "Pack my box with five dozen liquor jugs.",
+  "How vexingly quick daft zebras jump.",
+  "Sphinx of black quartz, judge my vow.",
+  "The five boxing wizards jump quickly.",
+  "Jackdaws love my big sphinx of quartz.",
+  "Waltz, bad nymph, for quick jigs vex.",
+  "Glib jocks quiz nymph to vex dwarf.",
+  "Bright vixens jump; dozy fowl quack.",
+  "Quick zephyrs blow, vexing daft Jim.",
+];
+// Conservative per-line floor: the SHORTEST pad sentence plus the numeric
+// prefix. Overshoot the cap by a 1.3 safety factor so a slightly-short
+// reply still splits.
+const PER_LINE_MIN =
+  Math.min(...PAD_SENTENCES.map((s) => s.length)) + "Line 1: ".length;
+const LINE_COUNT = Math.ceil((RICH_MESSAGE_MAX_CHARS / PER_LINE_MIN) * 1.3);
 
 const PROMPT = [
   `I need a LONG reply to test message chunking. Do EXACTLY this, nothing else:`,
   ``,
   `1. Start your reply with: ${HEAD}: **head bold marker**`,
-  `2. Then output this exact sentence ${REPEATS} times, each on its own line:`,
-  `   "${PAD_LINE.trim()}"`,
+  `2. Then output ${LINE_COUNT} numbered lines. Line i (1-based) must be:`,
+  `   "Line i: " followed by sentence number (i mod 10) from this list`,
+  `   (list index 0-9):`,
+  ...PAD_SENTENCES.map((s, idx) => `     ${idx}: "${s}"`),
+  `   So line 1 is "Line 1: ${PAD_SENTENCES[1]}", line 2 is`,
+  `   "Line 2: ${PAD_SENTENCES[2]}", and so on, wrapping the list.`,
   `3. End your reply with: ${TAIL}: **tail bold marker**`,
   ``,
-  `Do not summarize or shorten. Emit all ${REPEATS} repetitions verbatim.`,
+  `Every line is unique because of its number. Do not summarize, do not`,
+  `stop early — emit all ${LINE_COUNT} lines.`,
 ].join("\n");
 
 function kinds(msg: ObservedMessage): Set<string> {
@@ -104,9 +128,17 @@ function kinds(msg: ObservedMessage): Set<string> {
           await sc.sendDM(PROMPT);
 
           // Chunk 1: the part carrying the HEAD marker.
+          //
+          // Budget: 240s, not 120s. When the model stages the long output
+          // via a file Write+Read (a 900+-line, ~90k-token turn), the
+          // inbound→chunks wall time runs ~3m49s (observed UAT v0.18.32 r2:
+          // test gave up at 120s / 08:42:13; the correctly-chunked reply
+          // actually landed 08:44:02 — a timing-budget oracle defect, not a
+          // delivery failure, since both ordered chunks delivered with zero
+          // 4xx). 240s clears that staging path with headroom (#3334 item a).
           const first = await sc.expectMessage(
             (m: ObservedMessage) => m.text.includes(HEAD) || m.text === "\x01",
-            { from: "bot", timeout: 120_000 },
+            { from: "bot", timeout: 240_000 },
           );
           // Chunk 2 (final): the part carrying the TAIL marker. This is a
           // DIFFERENT message than `first` — if the reply hadn't chunked,
@@ -116,7 +148,7 @@ function kinds(msg: ObservedMessage): Set<string> {
             (m: ObservedMessage) =>
               (m.text.includes(TAIL) || m.text === "\x01") &&
               m.messageId !== first.messageId,
-            { from: "bot", timeout: 120_000 },
+            { from: "bot", timeout: 240_000 },
           );
 
           // (4) Neither part is the unsupported-media sentinel.
@@ -163,7 +195,9 @@ function kinds(msg: ObservedMessage): Set<string> {
           await sc.tearDown();
         }
       },
-      180_000,
+      // Outer budget must exceed the two sequential 240s expectMessage
+      // windows (chunk 1, then chunk 2) plus spinUp settle + slack.
+      540_000,
     );
   },
 );

package/telegram-plugin/worker-activity-feed.ts

@@ -54,11 +54,12 @@ import {
   stripMarkdown,
   truncate,
 } from './card-format.js'
-import { STATUS_ROLLING_LINES } from './status-no-truncate.js'
+import { WORKER_HISTORY_MAX } from './status-no-truncate.js'
 import {
   renderStatusCard,
   formatStepSuffix,
   renderCombinedWorkerFeed,
+  workerHistoryDepth,
   type CombinedWorkerRow,
 } from './tool-activity-summary.js'
 import { isSendGateShed } from './send-gate.js'
@@ -213,6 +214,9 @@ export function renderWorkerActivity(v: WorkerActivityView, liveSuffix = ''): st
     final: finished,
     liveSuffix: finished ? '' : liveSuffix,
     result,
+    // Lone-worker card: window to the w=1 point of Ken's curve (6) so it shows
+    // the full recent trail, not the 5-line agent-card default (#3349).
+    historyWindow: workerHistoryDepth(1),
   })
   if (card == null) {
     // Unreachable (header always present) — defensive.
@@ -420,7 +424,7 @@ interface WorkerRow {
   agentId: string
   /**
    * Accumulated narrative lines (oldest→newest), deduped within the whole
-   * rolling window. Rolling-window capped to STATUS_ROLLING_LINES. Grows the
+   * rolling window. Rolling-window capped to WORKER_HISTORY_MAX. Grows the
    * live render so the feed reads like the main agent's answer.
    */
   narrative: string[]
@@ -471,6 +475,14 @@ interface WorkerRow {
    * once past STEP_TIMER_MIN_MS.
    */
   stepStartedAtMs: number | null
+  /**
+   * Stable 1-based ordinal within the group's CURRENT card, assigned from the
+   * group's monotonic counter when the row is first registered and IMMUTABLE
+   * thereafter. The combined feed renders it as a `{n}. ` header prefix when
+   * 2+ workers are running; survivors keep their numbers when an earlier
+   * worker finishes (never renumbered positionally — #3298).
+   */
+  ordinal: number
 }
 
 /**
@@ -511,6 +523,14 @@ interface FeedGroup {
   chain: Promise<void>
   /** Live workers in this group, keyed by agentId (insertion ≈ dispatch order). */
   workers: Map<string, WorkerRow>
+  /**
+   * Monotonic per-card worker counter — `++counter` hands each newly
+   * registered row its stable {@link WorkerRow.ordinal}. Reset to 0 whenever a
+   * fresh card starts (group creation, and registration into an emptied group
+   * — which covers the group-reuse-after-terminal repaint, since finalize
+   * drops rows from `workers` immediately), so every new card numbers from 1.
+   */
+  workerOrdinalCounter: number
   /**
    * Terminal renders (per finishing worker's recap) staged because a 429
    * cooldown / flood window blocked the edit. Keyed by agentId so a SECOND
@@ -781,8 +801,10 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     row.narrative.push(line)
     // The `→` current-step line just CHANGED — reset the per-step timer.
     row.stepStartedAtMs = nowFn()
-    if (row.narrative.length > STATUS_ROLLING_LINES) {
-      row.narrative.splice(0, row.narrative.length - STATUS_ROLLING_LINES)
+    // Retain up to WORKER_HISTORY_MAX (6) — the lone-worker card's deepest
+    // window (#3349). STATUS_ROLLING_LINES (5) governs the agent card, not this.
+    if (row.narrative.length > WORKER_HISTORY_MAX) {
+      row.narrative.splice(0, row.narrative.length - WORKER_HISTORY_MAX)
     }
   }
 
@@ -844,6 +866,9 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       const currentStep = r.narrative.length > 0 ? r.narrative[r.narrative.length - 1] : v.latestSummary
       return {
         description: v.description,
+        // Stable per-card ordinal — assigned at registration, kept for the
+        // card's life (survivors don't renumber when an earlier worker ends).
+        ordinal: r.ordinal,
         elapsedMs: elapsedFor(r),
         toolCount: v.toolCount,
         totalTokens: v.totalTokens,
@@ -1488,6 +1513,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           cooldownUntil: 0,
           chain: Promise.resolve(),
           workers: new Map(),
+          workerOrdinalCounter: 0,
           pendingFinalize: new Map(),
           terminalPainted: false,
         }
@@ -1512,8 +1538,12 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       }
       let row = g.workers.get(agentId)
       if (row == null) {
+        // A registration into an EMPTIED group starts a fresh card — number
+        // from 1 again rather than continuing the dead card's sequence.
+        if (g.workers.size === 0) g.workerOrdinalCounter = 0
         row = {
           agentId,
+          ordinal: ++g.workerOrdinalCounter,
           narrative: [],
           lastView: null,
           state: 'running',

package/telegram-plugin/gateway/busy-key-reaper.ts

@@ -1,113 +0,0 @@
-/**
- * #2787 Mechanism B — the `claudeBusyKeys` orphan-reaper lifecycle, extracted
- * so the gateway glue that mutates the busy-key set stays in lockstep with its
- * shadow insertion-timestamp map and is unit-testable WITHOUT importing
- * `gateway.ts` (which boots the bot + IPC listener on module load and so cannot
- * run inside a unit test). The gateway keeps ownership of the two containers
- * (`claudeBusyKeys: Set`, `claudeBusyKeySince: Map`) and calls these helpers at
- * every mark / reap site; `disconnect-flush.ts` clears them at bridge death.
- * The test harness (`tests/busy-key-reaper.test.ts`) wires the SAME containers,
- * the SAME delivery queue, and the real `flushOnAgentDisconnect` to reproduce
- * the disconnect → reconnect → re-mark and slow-vs-orphan delivery sequences.
- *
- * Two invariants this module enforces:
- *
- *  1. LOCKSTEP. The timestamp map shadows actual SET MEMBERSHIP, not its own
- *     prior presence. `markBusyKeyLockstep` stamps a fresh timestamp whenever a
- *     key transitions idle→busy (`claudeBusyKeys.has(key) === false`). Gating on
- *     the set — not on `since.has` — is load-bearing: a disconnect flush clears
- *     `claudeBusyKeys` directly, so if the shadow map ever lagged, a `!since.has`
- *     guard would decline to re-stamp on the reconnect→re-mark and leave a
- *     stale, >TTL-old timestamp on a freshly-marked key — which the reaper would
- *     then reap out from under a live delivery.
- *
- *  2. SLOW-DELIVERY SAFETY (the #1922 hazard). `busy` is marked EAGERLY at
- *     delivery, and the gateway→claude enqueue-ack lag can be up to ~5 MINUTES
- *     under load (#1922). During that eager-mark→enqueue window the gateway's
- *     `currentTurn` is null yet the turn is real-and-merely-slow. A bare
- *     time-grace reaper cannot tell "slow" from "orphaned" and would reap a
- *     genuine delivery, re-opening the idle-drain gate while claude is about to
- *     process the very inbound whose key it just reaped (duplicate / concurrent
- *     delivery on the CORE inbound path). So the reap is PROOF-GATED: a key is
- *     reaped ONLY when it has NO entry in the delivery-confirm queue. A
- *     slow-but-real inbound is tracked there from delivery until claude's
- *     `enqueue` ack (via the never-drop re-deliver loop), so any key still
- *     awaiting its turn is present and skipped — no matter how slow. The time
- *     grace is retained as defense-in-depth, defaulting well above the observed
- *     ack-lag tail. Only a busy-marked key with NO pending delivery AND age past
- *     the grace is a true orphan (its turn acked and should have cleared busy at
- *     turn_end, or it was a steer/interrupt inbound excluded from tracking that
- *     amends a now-absent turn) — reaping those can never clobber a slow one.
- */
-
-/** Lockstep mark: add to the busy set and, on the idle→busy transition only,
- *  stamp the insertion time. Keyed on set membership so a re-mark after a
- *  disconnect flush (which cleared the set directly) always re-stamps fresh. */
-export function markBusyKeyLockstep(
-  keys: Set<string>,
-  since: Map<string, number>,
-  key: string,
-  now: number,
-): void {
-  const wasBusy = keys.has(key)
-  keys.add(key)
-  if (!wasBusy) since.set(key, now)
-}
-
-/** Lockstep clear: delete from both containers. */
-export function clearBusyKeyLockstep(
-  keys: Set<string>,
-  since: Map<string, number>,
-  key: string,
-): void {
-  keys.delete(key)
-  since.delete(key)
-}
-
-export interface ReapOptions {
-  /** Grace before a busy-marked key with no pending delivery is a true orphan. */
-  ttlMs: number
-  /** True iff a delivery-confirm entry is still tracked for this key — i.e. a
-   *  slow-but-real inbound awaiting its enqueue ack. Such keys are NEVER reaped,
-   *  regardless of age (the #1922 slow-delivery guarantee). */
-  hasPendingDelivery: (key: string) => boolean
-  /** Optional line logger for each reaped key (observability). */
-  log?: (msg: string) => void
-}
-
-/**
- * Reap orphaned busy markers. Call ONLY once the gateway has asserted no turn is
- * in flight (`currentTurn == null`). Returns the keys reaped (for the caller's
- * metrics / assertions). Also prunes shadow-map entries whose key already left
- * the set, so the map can't grow unbounded.
- */
-export function reapOrphanBusyKeys(
-  keys: Set<string>,
-  since: Map<string, number>,
-  now: number,
-  opts: ReapOptions,
-): string[] {
-  const reaped: string[] = []
-  for (const key of [...since.keys()]) {
-    if (!keys.has(key)) {
-      since.delete(key)
-      continue
-    }
-    // Proof gate: a key with a pending delivery is a slow-but-real inbound still
-    // awaiting its enqueue ack (the never-drop re-deliver loop owns it) — NEVER
-    // an orphan, regardless of age. Skip so a multi-minute (#1922) delivery
-    // can't be reaped out from under claude.
-    if (opts.hasPendingDelivery(key)) continue
-    const stampedAt = since.get(key) ?? now
-    if (now - stampedAt >= opts.ttlMs) {
-      keys.delete(key)
-      since.delete(key)
-      reaped.push(key)
-      opts.log?.(
-        `telegram gateway: reaped orphan busy key=${key} (no turn in flight, ` +
-          `no pending delivery, >${opts.ttlMs}ms) — unwedging idle-drain`,
-      )
-    }
-  }
-  return reaped
-}

package/telegram-plugin/gateway/gate-parity-probe.ts

@@ -1,102 +0,0 @@
-/**
- * Gate-parity drift probe — scaffolding for the inbound-delivery
- * state-machine cutover (#2794, RFC PR3b→PR4).
- *
- * ## Why this exists
- *
- * The inbound-delivery pipeline is mid-migration and TRIPLE-maintained:
- *
- *   1. the pure state machine (`inbound-delivery-machine.ts`) — the model,
- *   2. the shadow (`inbound-delivery-machine-shadow.ts`) — module-scope
- *      machine state advanced by `shadowEmit`, now AUTHORITATIVE for the
- *      turn-in-flight gate via `isMachineInTurn()`,
- *   3. the legacy imperative `claudeBusyKeys` set — still fully maintained
- *      in parallel and read as the kill-switch fallback.
- *
- * Per #2794 the standing risk is DRIFT: because the same turn-lifecycle
- * fact ("is a turn in flight?") is tracked in two live places, a fix in
- * one can silently diverge from the other. The machine is authoritative
- * today, but `claudeBusyKeys` is still wired and still read on the
- * kill-switch path — so the two MUST NOT drift in the dangerous direction.
- *
- * ## What "agree" means (and the ONE intended divergence)
- *
- * The machine and `claudeBusyKeys` are designed to agree on every
- * WELL-FORMED schedule (every turnStart has a matching turnEnd). They are
- * deliberately allowed to diverge in exactly ONE direction on a MALFORMED
- * schedule — an orphaned turnStart (turn B opens before turn A's turnEnd
- * ever lands, the gymbro/clerk 5-min dangle of 2026-05-28):
- *
- *   - `busykeys_dangle`  — machine reads idle (self-healed via TTL tick or
- *                          single-activeTurn reopen) while `claudeBusyKeys`
- *                          still holds an orphan key. This is EXPECTED and
- *                          GOOD: it is precisely the wedge the machine was
- *                          made authoritative to kill. Not a drift alarm.
- *
- *   - `machine_over_holds` — machine reads in-flight while `claudeBusyKeys`
- *                            is empty. This is the DANGEROUS direction: the
- *                            now-authoritative gate would hold closed while
- *                            the imperative view says idle — a NEW wedge
- *                            class the cutover must never introduce. This
- *                            is the drift #2794 warns about; surface it.
- *
- * This module is a pure classifier plus a log-only runtime probe. It
- * performs NO I/O of its own beyond an optional injected log sink and
- * changes NO delivery behaviour — it only observes. Deleting it once the
- * `claudeBusyKeys` shadow is removed in PR4 is a no-op for behaviour.
- */
-
-export type GateParityDivergence = 'none' | 'busykeys_dangle' | 'machine_over_holds'
-
-/**
- * Classify the relationship between the machine's authoritative
- * turn-in-flight read and the legacy imperative `claudeBusyKeys` size.
- * Pure — no side effects.
- */
-export function gateParityDivergence(
-  machineInTurn: boolean,
-  busyKeysSize: number,
-): GateParityDivergence {
-  const busy = busyKeysSize > 0
-  if (machineInTurn === busy) return 'none'
-  // machine idle, busyKeys non-empty → the orphan dangle the machine heals.
-  if (!machineInTurn && busy) return 'busykeys_dangle'
-  // machine in-flight, busyKeys empty → the dangerous over-hold.
-  return 'machine_over_holds'
-}
-
-/**
- * True only for divergences that indicate a real cutover regression
- * (the machine holding a gate the imperative shadow believes is open).
- * The benign `busykeys_dangle` — the very wedge the machine fixes — is
- * NOT flagged, so this probe has zero false positives on the known-good
- * self-heal path.
- */
-export function isDangerousGateDivergence(d: GateParityDivergence): boolean {
-  return d === 'machine_over_holds'
-}
-
-/**
- * Log-only runtime drift canary. Call at the authoritative gate read.
- * Emits a single grep-friendly `gw-trace gate-drift` line ONLY on the
- * dangerous over-hold direction. Returns the machine value UNCHANGED so
- * it can wrap the gate read without altering behaviour:
- *
- *   return probeGateParity(isMachineInTurn(), claudeBusyKeys.size)
- *
- * @param log  optional sink (default stderr) — test hook.
- */
-export function probeGateParity(
-  machineInTurn: boolean,
-  busyKeysSize: number,
-  log: (line: string) => void = (line) => process.stderr.write(line),
-): boolean {
-  const d = gateParityDivergence(machineInTurn, busyKeysSize)
-  if (isDangerousGateDivergence(d)) {
-    log(
-      `gw-trace gate-drift kind=${d} machineInTurn=${machineInTurn} ` +
-        `busyKeys=${busyKeysSize} note=machine-authoritative-gate-holds-while-imperative-idle\n`,
-    )
-  }
-  return machineInTurn
-}