switchroom 0.18.32 → 0.19.0

package/telegram-plugin/tests/checklist-message-handler.test.ts

@@ -0,0 +1,160 @@
+/**
+ * Outcome pins for the checklist service-message handler extracted from
+ * gateway.ts (switchroom#2996 P6). Asserts the fail-closed allowlist gate
+ * (#472 finding #13), the exact per-task InboundMessage envelope broadcast to
+ * bridges (kind="checklist_task_changed"), the done/undone/added state
+ * derivation, and swallow-with-log error containment.
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  handleChecklistUpdate,
+  type ChecklistHandlerDeps,
+} from '../gateway/checklist-message-handler.js'
+
+function makeDeps(over: Partial<ChecklistHandlerDeps> = {}) {
+  const broadcast = vi.fn()
+  const log = vi.fn()
+  const deps: ChecklistHandlerDeps = {
+    loadAccess: () => ({ allowFrom: ['42'] }),
+    broadcast,
+    log,
+    ...over,
+  }
+  return { deps, broadcast, log }
+}
+
+function ctxWith(message: Record<string, unknown> | undefined, chatId: number | undefined = 42): any {
+  return {
+    message,
+    chat: chatId == null ? undefined : { id: chatId },
+  }
+}
+
+describe('handleChecklistUpdate — allowlist gate (fail-closed)', () => {
+  it('drops updates from non-allowlisted chats', () => {
+    const { deps, broadcast } = makeDeps({ loadAccess: () => ({ allowFrom: ['99'] }) })
+    handleChecklistUpdate(
+      ctxWith({ message_id: 7, date: 1000, checklist_tasks_done: [{ id: 1 }] }),
+      'checklist_tasks_done',
+      deps,
+    )
+    expect(broadcast).not.toHaveBeenCalled()
+  })
+
+  it('drops EVERYTHING when the allowlist is empty (the #472 fail-open bug)', () => {
+    const { deps, broadcast } = makeDeps({ loadAccess: () => ({ allowFrom: [] }) })
+    handleChecklistUpdate(
+      ctxWith({ message_id: 7, date: 1000, checklist_tasks_done: [{ id: 1 }] }),
+      'checklist_tasks_done',
+      deps,
+    )
+    expect(broadcast).not.toHaveBeenCalled()
+  })
+
+  it('does nothing without a message or chat', () => {
+    const { deps, broadcast } = makeDeps()
+    handleChecklistUpdate(ctxWith(undefined), 'checklist_tasks_done', deps)
+    handleChecklistUpdate(ctxWith({ message_id: 7 }, undefined), 'checklist_tasks_done', deps)
+    expect(broadcast).not.toHaveBeenCalled()
+  })
+})
+
+describe('handleChecklistUpdate — envelope', () => {
+  it('broadcasts one checklist_task_changed event per done task with the exact envelope', () => {
+    const { deps, broadcast, log } = makeDeps()
+    handleChecklistUpdate(
+      ctxWith({
+        message_id: 7,
+        date: 1_700_000_000,
+        checklist_tasks_done: [
+          { id: 3, user: { id: 11, username: 'ken' } },
+          { id: 4, user: { id: 12 }, done: false },
+        ],
+      }),
+      'checklist_tasks_done',
+      deps,
+    )
+    expect(broadcast).toHaveBeenCalledTimes(2)
+    expect(broadcast.mock.calls[0][0]).toEqual({
+      type: 'inbound',
+      chatId: '42',
+      messageId: 7,
+      user: 'ken',
+      userId: 11,
+      ts: 1_700_000_000,
+      text: '(checklist task done: id=3)',
+      meta: {
+        chat_id: '42',
+        message_id: '7',
+        kind: 'checklist_task_changed',
+        task_id: '3',
+        state: 'done',
+        user: 'ken',
+        user_id: '11',
+        ts: new Date(1_700_000_000 * 1000).toISOString(),
+      },
+    })
+    // done === false → 'undone'; username absent → numeric id string.
+    const second = broadcast.mock.calls[1][0]
+    expect(second.meta.state).toBe('undone')
+    expect(second.user).toBe('12')
+    expect(log).toHaveBeenCalledTimes(2)
+    expect(log.mock.calls[0][0]).toContain('checklist checklist_tasks_done')
+  })
+
+  it('broadcasts added tasks with state=added', () => {
+    const { deps, broadcast } = makeDeps()
+    handleChecklistUpdate(
+      ctxWith({
+        message_id: 8,
+        date: 1000,
+        checklist_tasks_added: [{ id: 9, text: 'new task' }],
+      }),
+      'checklist_tasks_added',
+      deps,
+    )
+    expect(broadcast).toHaveBeenCalledTimes(1)
+    const evt = broadcast.mock.calls[0][0]
+    expect(evt.meta.state).toBe('added')
+    expect(evt.meta.task_id).toBe('9')
+    expect(evt.user).toBe('unknown')
+    expect(evt.userId).toBe(0)
+  })
+
+  it('reads only the field matching the kind argument', () => {
+    const { deps, broadcast } = makeDeps()
+    handleChecklistUpdate(
+      ctxWith({
+        message_id: 8,
+        date: 1000,
+        checklist_tasks_done: [{ id: 1 }],
+        checklist_tasks_added: [{ id: 2 }, { id: 3 }],
+      }),
+      'checklist_tasks_added',
+      deps,
+    )
+    expect(broadcast).toHaveBeenCalledTimes(2)
+    expect(broadcast.mock.calls.map(c => c[0].meta.task_id)).toEqual(['2', '3'])
+  })
+})
+
+describe('handleChecklistUpdate — error containment', () => {
+  it('swallows a throwing broadcast and logs the handler error', () => {
+    const { deps, log } = makeDeps({
+      broadcast: vi.fn(() => {
+        throw new Error('ipc down')
+      }),
+    })
+    expect(() =>
+      handleChecklistUpdate(
+        ctxWith({ message_id: 7, date: 1000, checklist_tasks_done: [{ id: 1 }] }),
+        'checklist_tasks_done',
+        deps,
+      ),
+    ).not.toThrow()
+    const line = log.mock.calls.at(-1)?.[0] as string
+    expect(line).toContain('checklist handler error (checklist_tasks_done)')
+    expect(line).toContain('ipc down')
+  })
+})

package/telegram-plugin/tests/emission-authority-facade.test.ts

@@ -56,6 +56,26 @@ const sendPathSrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
   'utf-8',
 )
+// #2996 P4-A: `handleSessionEvent`'s body (the tool_label / sub-agent drains
+// and their `ea.mayDrain(turn)` single-flight guards) moved VERBATIM to
+// stream-render.ts. Drain-site assertions that grep for the full population of
+// façade call sites therefore scan gateway.ts + stream-render.ts combined —
+// the wiring contract they pin is unchanged, only its file home split.
+const streamRenderSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'stream-render.ts'),
+  'utf-8',
+)
+// #2996 P4-B: the narrative/activity lane (showNarrativeStep,
+// openLivenessFeedIfDue, feedHeartbeatTick, drainActivitySummary,
+// clearActivitySummary + the cardDrainGate-wrapped drains inside them) moved
+// VERBATIM into narrative-lane.ts (factory scope, bodies indented +2).
+// gateway.ts keeps thin same-name wrappers, so lane-body assertions must read
+// the MODULE source, not the wrapper.
+const laneSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'narrative-lane.ts'),
+  'utf-8',
+)
+const gatewayAndStreamSrc = gatewaySrc + '\n' + streamRenderSrc + '\n' + laneSrc
 /** The sendReply window: from the function decl to the next export. */
 function sendReplyWindow(): string {
   const after = sendPathSrc.split('export async function sendReply(')[1] ?? ''
@@ -68,6 +88,13 @@ function fnSrc(name: string): string {
   return after.split('\nasync function ')[0]?.split('\nfunction ')[0] ?? after
 }
 
+/** Source of a named narrative-lane function (factory scope, indented +2) up
+ *  to the next lane function definition (#2996 P4-B). */
+function laneFnSrc(name: string): string {
+  const after = laneSrc.split(`function ${name}(`)[1] ?? ''
+  return after.split('\n  async function ')[0]?.split('\n  function ')[0] ?? after
+}
+
 describe('SWITCHROOM_EMISSION_AUTHORITY kill-switch (default OFF)', () => {
   it('parses with `=== "1"` semantic so an unset env var is OFF (default off)', () => {
     expect(facadeSrc).toMatch(
@@ -328,7 +355,7 @@ describe('façade delegates to the existing emission primitives (call-site liter
 
 describe('the drain sites route through the façade with producers preserved verbatim', () => {
   it('the narrative SHOW site routes via openOrEditCard("narrative") + the producer-"narrative" drain', () => {
-    const body = fnSrc('showNarrativeStep')
+    const body = laneFnSrc('showNarrativeStep')
     expect(body).toMatch(/openOrEditCard\('narrative'/)
     // The drain literal (producer arg verbatim) is preserved in the delegate.
     expect(body).toMatch(/drainActivitySummary\(turn,\s*'narrative'\)/)
@@ -348,8 +375,8 @@ describe('the drain sites route through the façade with producers preserved ver
     //   - feedHeartbeatTick:     the 0-label CLIMB of an already-open card
     //                            (Phase 1) + the labelled-feed stale-step maintain.
     // All must still route via the façade with the producer arg verbatim.
-    const earlyOpen = fnSrc('openLivenessFeedIfDue')
-    const heartbeat = fnSrc('feedHeartbeatTick')
+    const earlyOpen = laneFnSrc('openLivenessFeedIfDue')
+    const heartbeat = laneFnSrc('feedHeartbeatTick')
     const opens = [
       ...earlyOpen.matchAll(/openOrEditCard\('liveness'/g),
       ...heartbeat.matchAll(/openOrEditCard\('liveness'/g),
@@ -372,15 +399,20 @@ describe('the drain sites route through the façade with producers preserved ver
   it('both foreground sub-agent drains route via openOrEditCard("tool") with producer made EXPLICIT', () => {
     // Previously these called drainActivitySummary(turn) with the implicit
     // 'tool' default; PR-4a makes 'tool' explicit at both, per the plan.
-    const opens = [...gatewaySrc.matchAll(/ea\.openOrEditCard\('tool', \(\) => \{\s*\n\s*turn\.activityInFlight = drainActivitySummary\(turn, 'tool'\)/g)]
+    // #2996 P4-A: these sites now live in stream-render.ts (tool_label + the
+    // sub-agent drains moved with handleSessionEvent), so scan the combined src.
+    const opens = [...gatewayAndStreamSrc.matchAll(/ea\.openOrEditCard\('tool', \(\) => \{\s*\n\s*turn\.activityInFlight = drainActivitySummary\(turn, 'tool'\)/g)]
     // tool_label site (1) + the two sub-agent drains (2) = 3 'tool' openers.
     expect(opens.length).toBeGreaterThanOrEqual(3)
     // No foreground drain still uses the bare implicit-producer form.
-    expect(gatewaySrc).not.toMatch(/turn\.activityInFlight = drainActivitySummary\(turn\)\n/)
+    expect(gatewayAndStreamSrc).not.toMatch(/turn\.activityInFlight = drainActivitySummary\(turn\)\n/)
   })
 
   it('every routed drain site guards the single-flight via ea.mayDrain(turn), not a bare activityInFlight read', () => {
-    const mayDrainGuards = [...gatewaySrc.matchAll(/if \(ea\.mayDrain\(turn\)\)/g)]
+    // #2996 P4-A: the tool / sub-agent / post-answer bg-liveness guards moved
+    // to stream-render.ts with handleSessionEvent; the narrative + liveness
+    // guards stay in gateway.ts. The full population (8) spans both files.
+    const mayDrainGuards = [...gatewayAndStreamSrc.matchAll(/if \(ea\.mayDrain\(turn\)\)/g)]
     // narrative SHOW + narrative RETRACT (timer-flush early-paint retract,
     // narrative-flush.ts) + 2 liveness + tool + 2 sub-agent + 1 post-answer
     // bg-liveness (Fix 2) = 8. The Phase-1 0-label climb
@@ -390,7 +422,7 @@ describe('the drain sites route through the façade with producers preserved ver
     // gateway call site — pinned by feed-heartbeat-liveness-open.test.ts +
     // silent-turn-climb-transport.test.ts.
     expect(mayDrainGuards).toHaveLength(8)
-    expect(gatewaySrc).toMatch(/mayDrain:\s*\(\)\s*=>\s*ea\.mayDrain\(turn\)/)
+    expect(gatewayAndStreamSrc).toMatch(/mayDrain:\s*\(\)\s*=>\s*ea\.mayDrain\(turn\)/)
   })
 })
 
@@ -406,7 +438,9 @@ describe('per-turn construction — one façade per turn, explicit chat/thread k
   it('the turn ctor constructs a fresh EmissionAuthority with the explicit statusKey', () => {
     // Per-turn: born in the CurrentTurn object literal so it is discarded with
     // the turn and never persists across turns.
-    expect(gatewaySrc).toMatch(/emissionAuthority: new EmissionAuthority\(\s*\n\s*statusKey\(/)
+    // #2996 P4-A: the turn ctor lives in handleSessionEvent's `enqueue` branch,
+    // which moved to stream-render.ts.
+    expect(gatewayAndStreamSrc).toMatch(/emissionAuthority: new EmissionAuthority\(\s*\n\s*statusKey\(/)
   })
 
   it('the façade constructor takes the chat/thread key EXPLICITLY (the PR-4e map seam)', () => {
@@ -514,12 +548,15 @@ describe('mayDrainCardNow — PR-4d card-drain gate (pure read; gateway holds th
     // thunks stay byte-identical, wrapped by the centralized helper.
     // 6 original + 1 post-answer background-agent liveness drain (Fix 2) + 1
     // narrative-retract drain (timer-flush early-paint retract, narrative-flush.ts).
-    const wraps = [...gatewaySrc.matchAll(/cardDrainGate\(turn, ea, \(\) => \{/g)]
+    // #2996 P4-A: one of these guarded drains (the post-answer bg-liveness
+    // drain) moved to stream-render.ts with handleSessionEvent; the population
+    // of 8 now spans gateway.ts + stream-render.ts.
+    const wraps = [...gatewayAndStreamSrc.matchAll(/cardDrainGate\(turn, ea, \(\) => \{/g)]
     expect(wraps).toHaveLength(8)
     // The Phase-1 0-label climb (deterministic-turn-liveness.md) routes through
     // the SAME helper via an injected thunk — its call lives in the extracted
     // tick body (feed-heartbeat-climb.ts), wired at the gateway call site as
     // `cardDrainGate: (run) => cardDrainGate(turn, ea, run)`.
-    expect(gatewaySrc).toMatch(/cardDrainGate:\s*\(run\)\s*=>\s*cardDrainGate\(turn, ea, run\)/)
+    expect(gatewayAndStreamSrc).toMatch(/cardDrainGate:\s*\(run\)\s*=>\s*cardDrainGate\(turn, ea, run\)/)
   })
 })

package/telegram-plugin/tests/emission-determinism-wiring.test.ts

@@ -24,25 +24,43 @@ const sendPathSrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'outbound-send-path.ts'),
   'utf-8',
 )
+// #2996 P4-A: the per-turn CurrentTurn object literal (which initialises the
+// sticky `finalAnswerEverDelivered: false` latch) is constructed in
+// handleSessionEvent's `enqueue` branch, which moved VERBATIM to
+// stream-render.ts. The init-latch assertions scan gateway.ts + that module.
+const streamSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'stream-render.ts'),
+  'utf-8',
+)
+// #2996 P4-B: the narrative/activity lane (drainActivitySummary,
+// showNarrativeStep, feedHeartbeatTick, clearActivitySummary) moved VERBATIM
+// into narrative-lane.ts (factory scope, bodies indented +2); gateway keeps
+// thin same-name wrappers. Lane-body windows read the module source.
+const laneSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'narrative-lane.ts'),
+  'utf-8',
+)
+const gatewayAndStreamSrc = gatewaySrc + '\n' + streamSrc + '\n' + laneSrc
 
 /** Source of `drainActivitySummary` up to the next top-level function. */
 function drainSrc(): string {
-  const after = gatewaySrc.split('async function drainActivitySummary(')[1] ?? ''
-  return after.split('\nasync function ')[0]?.split('\nfunction ')[0] ?? after
+  // #2996 P4-B: reads the lane module (factory scope — next fn at 2-space indent).
+  const after = laneSrc.split('async function drainActivitySummary(')[1] ?? ''
+  return after.split('\n  async function ')[0]?.split('\n  function ')[0] ?? after
 }
 
 describe('sticky finalAnswerEverDelivered latch (lever 1 precondition / R0)', () => {
   it('is initialised false in the turn object literal (per-turn reset at turn start)', () => {
-    expect(gatewaySrc).toMatch(/finalAnswerEverDelivered:\s*false/)
+    expect(gatewayAndStreamSrc).toMatch(/finalAnswerEverDelivered:\s*false/)
   })
 
   it('is reset to false in exactly ONE place — the turn initialiser (never cleared by reopen)', () => {
     // Mirrors activityEverOpened's sticky-true contract: the only `false` is the
     // per-turn init. A standalone `= false` reassignment would let reopen clear
     // the latch and reintroduce the reorder (the R0 correction).
-    const initFalse = [...gatewaySrc.matchAll(/finalAnswerEverDelivered:\s*false/g)]
+    const initFalse = [...gatewayAndStreamSrc.matchAll(/finalAnswerEverDelivered:\s*false/g)]
     expect(initFalse).toHaveLength(1)
-    const resetFalse = [...gatewaySrc.matchAll(/finalAnswerEverDelivered\s*=\s*false/g)]
+    const resetFalse = [...gatewayAndStreamSrc.matchAll(/finalAnswerEverDelivered\s*=\s*false/g)]
     expect(resetFalse).toHaveLength(0)
   })
 
@@ -118,14 +136,14 @@ describe('drainActivitySummary OPEN gate (levers 1 + 5, heartbeat-covered)', ()
 
 describe('drain producers — narrative may not OPEN, liveness + tool may', () => {
   it('showNarrativeStep drains with producer "narrative" (lever 5 base case)', () => {
-    const after = gatewaySrc.split('function showNarrativeStep(')[1] ?? ''
-    const body = after.split('\nfunction ')[0] ?? after
+    const after = laneSrc.split('function showNarrativeStep(')[1] ?? ''
+    const body = after.split('\n  function ')[0] ?? after
     expect(body).toMatch(/drainActivitySummary\(turn,\s*'narrative'\)/)
   })
 
   it('the liveness-open path drains with producer "liveness" (producer C preserved)', () => {
-    const after = gatewaySrc.split('function feedHeartbeatTick(')[1] ?? ''
-    const body = after.split('\nfunction ')[0] ?? after
+    const after = laneSrc.split('function feedHeartbeatTick(')[1] ?? ''
+    const body = after.split('\n  function ')[0] ?? after
     expect(body).toMatch(/drainActivitySummary\(turn,\s*'liveness'\)/)
   })
 

package/telegram-plugin/tests/feed-heartbeat-liveness-open.test.ts

@@ -43,18 +43,41 @@ const gatewaySrc = readFileSync(
   resolve(__dirname, '..', 'gateway', 'gateway.ts'),
   'utf-8',
 )
+// #2996 P4-A: the enqueue-time `scheduleEarlyLivenessOpen(next)` moved with
+// handleSessionEvent into stream-render.ts; the turn-end teardown stays in
+// gateway.ts. The timer-lifecycle assertion spans both files.
+const streamSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'stream-render.ts'),
+  'utf-8',
+)
+// #2996 P4-B: feedHeartbeatTick / openLivenessFeedIfDue (and the whole
+// activity lane) moved VERBATIM into narrative-lane.ts (factory scope, bodies
+// indented +2); gateway keeps thin same-name wrappers, so the body helpers
+// below read the module source.
+const laneSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'narrative-lane.ts'),
+  'utf-8',
+)
+// #2996 P8 PR-B: the turn-end funnel (incl. the `stopEarlyLivenessOpen(key as
+// string)` teardown inside purgeReactionTracking) moved verbatim to turn-end.ts.
+const turnEndSrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'turn-end.ts'),
+  'utf-8',
+)
+const gatewayAndStreamSrc = gatewaySrc + '\n' + streamSrc + '\n' + laneSrc + '\n' + turnEndSrc
 
 /** Return the source text of `feedHeartbeatTick` (everything up to the next top-level function). */
 function feedHeartbeatTickSrc(): string {
-  const after = gatewaySrc.split('function feedHeartbeatTick(): void {')[1] ?? ''
-  // Stop at the next top-level function definition.
-  return after.split('\nfunction ')[0] ?? after
+  // #2996 P4-B: reads narrative-lane.ts; next lane fn sits at 2-space indent.
+  const after = laneSrc.split('function feedHeartbeatTick(): void {')[1] ?? ''
+  return after.split('\n  async function ')[0]?.split('\n  function ')[0] ?? after
 }
 
 /** Return the source text of `openLivenessFeedIfDue` (the shared open helper). */
 function openLivenessFeedIfDueSrc(): string {
-  const after = gatewaySrc.split('function openLivenessFeedIfDue(turn: CurrentTurn): void {')[1] ?? ''
-  return after.split('\nfunction ')[0] ?? after
+  // #2996 P4-B: reads narrative-lane.ts; next lane fn sits at 2-space indent.
+  const after = laneSrc.split('function openLivenessFeedIfDue(turn: CurrentTurn): void {')[1] ?? ''
+  return after.split('\n  async function ')[0]?.split('\n  function ')[0] ?? after
 }
 
 describe('H-1: feedHeartbeatTick liveness-open threshold', () => {
@@ -121,8 +144,8 @@ describe('H-1: feedHeartbeatTick liveness-open threshold', () => {
     // The enqueue-time early-open (the dead-air fix): a one-shot timer fires the
     // shared open helper at turn start, and it is cancelled at the canonical
     // turn-end so a leaked timer can never fire against a successor turn.
-    expect(gatewaySrc).toMatch(/scheduleEarlyLivenessOpen\(next\)/)
-    expect(gatewaySrc).toMatch(/stopEarlyLivenessOpen\(key as string\)/)
+    expect(gatewayAndStreamSrc).toMatch(/scheduleEarlyLivenessOpen\(next\)/)
+    expect(gatewayAndStreamSrc).toMatch(/stopEarlyLivenessOpen\(key as string\)/)
   })
 })
 

package/telegram-plugin/tests/gateway-boot-side-effect-gating.test.ts

@@ -5,36 +5,41 @@
  * `startGateway()` at the bottom of the file.
  *
  * WHY this asserts on the parsed SOURCE, not a real `import()`:
- * gateway.ts statically reaches modules whose bun:sqlite access + the still-
- * ungated P0d process-handler / reaction-sweep registrations make a hermetic
- * `await import()` under vitest impractical without heavy mocking (see the P0e
- * note in the PR). The repo's oracle for "pin gateway structure without booting
- * it" is source-parsing via `ts.createSourceFile` — the same pattern as
+ * the repo's oracle for "pin gateway structure without booting it" is
+ * source-parsing via `ts.createSourceFile` — the same pattern as
  * gateway-bot-construction-deferral.test.ts (P0b) and
- * gateway-handler-registration-wiring.test.ts (P0a). This test follows it and
- * asserts OUTCOMES:
+ * gateway-handler-registration-wiring.test.ts (P0a). (Since P0e, #3318, a
+ * hermetic `await import()` of gateway.ts does complete cleanly; upgrading
+ * this oracle to a real runtime import is possible but deliberately out of
+ * scope here — the source parse stays the pinned pattern.) This test follows
+ * it and asserts OUTCOMES:
  *
  *   1. `isGatewayMain` is a module-scope const whose value is the argv[1]
  *      main-check (true only when this module is the process entrypoint).
  *   2. The boot sequence is `async function startGateway()`, invoked EXACTLY
  *      once, and that sole invocation is guarded by `isGatewayMain`. The old
  *      top-level boot IIFE (`void (async () => …)()`) is gone.
- *   3. No UNGUARDED module-scope P0c side effect remains: every top-level
+ *   3. No UNGUARDED module-scope side effect remains: every top-level
  *      `setInterval` / `setTimeout` / `<x>.startTimer(…)` / `mkdirSync` /
  *      `runHistoryReaperNow` / `openTurnsDb` / `initHistory` /
  *      `acquireStartupLock` / `startWebhookIngestServer` /
- *      `createPollHealthCheck` / `loadObligations` call, and every module-scope
- *      `await`, sits inside an `isGatewayMain` guard (an `if (isGatewayMain …)`
- *      or an `isGatewayMain ? … : …` ternary) — or inside a function body.
+ *      `createPollHealthCheck` / `loadObligations` /
+ *      `installPosthogErrorHandlers` / `sweepActiveReactions` /
+ *      `process.on(…)` call, and every module-scope `await`, sits inside an
+ *      `isGatewayMain` guard (an `if (isGatewayMain …)` or an
+ *      `isGatewayMain ? … : …` ternary) — or inside a function body.
  *
  * A regression that re-hoists a timer, the startup-lock await, the boot IIFE,
  * or the turn-registry open back to unguarded module scope fails (3).
  *
- * OUT OF SCOPE (P0d, deliberately still unguarded — see the PR/issue): the
- * process signal/error handlers (`process.on('SIGTERM'|'SIGINT'|'beforeExit'|
- * 'unhandledRejection'|'uncaughtException')`, `installPosthogErrorHandlers()`)
- * and the startup reaction sweep (`sweepActiveReactions`). Those are NOT in the
- * sentinel set below.
+ * The process signal/error handlers (`process.on('SIGTERM'|'SIGINT'|
+ * 'beforeExit'|'unhandledRejection'|'uncaughtException')`,
+ * `installPosthogErrorHandlers()`) and the startup reaction sweep
+ * (`sweepActiveReactions`) — the "P0d" inventory from the P0c handback — were
+ * gated behind `isGatewayMain` by P0e (#3318, `ab34bb7b`) too; #2996 P0d was
+ * verified already-delivered and closed with no PR (plan Amendment 11). They
+ * ARE in the sentinel set below, so a regression that un-gates any of them
+ * back to bare module scope fails (3) as well.
  */
 
 import { describe, it, expect } from 'vitest'
@@ -71,8 +76,9 @@ function lineOf(n: ts.Node): number {
   return sourceFile.getLineAndCharacterOfPosition(n.getStart(sourceFile)).line + 1
 }
 
-// The P0c-scoped side-effect sentinels. Each of these, at module scope, MUST be
-// isGatewayMain-guarded after P0c.
+// The side-effect sentinels. Each of these, at module scope, MUST be
+// isGatewayMain-guarded: the first block since P0c, the last two — the "P0d"
+// process-wiring inventory, gated by P0e (#3318) — since P0e.
 const CALL_SENTINELS = new Set([
   'setInterval',
   'setTimeout',
@@ -84,6 +90,8 @@ const CALL_SENTINELS = new Set([
   'startWebhookIngestServer',
   'createPollHealthCheck',
   'loadObligations',
+  'installPosthogErrorHandlers',
+  'sweepActiveReactions',
 ])
 
 function sentinelName(n: ts.Node): string | null {
@@ -94,6 +102,19 @@ function sentinelName(n: ts.Node): string | null {
     if (ts.isPropertyAccessExpression(e) && e.name.text === 'startTimer') {
       return `${e.expression.getText(sourceFile)}.startTimer`
     }
+    // `process.on(...)` — the P0d signal/error-handler registrations
+    // (SIGTERM / SIGINT / beforeExit / unhandledRejection /
+    // uncaughtException), gated by P0e. Several route through shutdown() →
+    // process.exit, so an unguarded registration makes exit reachable from a
+    // bare import.
+    if (
+      ts.isPropertyAccessExpression(e) &&
+      e.name.text === 'on' &&
+      ts.isIdentifier(e.expression) &&
+      e.expression.text === 'process'
+    ) {
+      return 'process.on'
+    }
   }
   if (n.kind === ts.SyntaxKind.AwaitExpression) return 'await'
   return null