switchroom 0.18.32 → 0.19.0

package/telegram-plugin/tests/vault-key-regex-allows-slash.test.ts

@@ -28,13 +28,21 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 // #2996 Phase 5: the callback-query handler families moved verbatim to
-// gateway/callback-query-handlers.ts; these pins read the gateway source
-// COMBINED with that module so the wiring assertions keep covering the
-// same runtime source text.
+// gateway/callback-query-handlers.ts, and the agent-facing card-STAGING
+// execute* tool handlers (vault_request_save & co) moved verbatim to
+// gateway/card-tool-handlers.ts (#2996 P5-tail); these pins read the gateway
+// source COMBINED with those modules so the wiring assertions keep covering
+// the same runtime source text.
 const gatewaySrc =
   readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
   "\n" +
-  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "card-tool-handlers.ts"), "utf-8") +
+  "\n" +
+  // P7 PR-8 (#2996): the vault pending-op intercept (incl. the rename-staged-
+  // key validation) moved verbatim into gateway/inbound-interceptors.ts.
+  readFileSync(resolve(__dirname, "..", "gateway", "inbound-interceptors.ts"), "utf-8");
 
 /** The exported regex literal — what the gateway actually validates against. */
 function extractVaultKeyRegex(): RegExp {
@@ -49,7 +57,10 @@ function extractVaultKeyRegex(): RegExp {
 }
 
 /** Either inline literal with `/`, OR a reference to VAULT_KEY_REGEX. */
-const ACCEPTS_SLASH = /\[A-Za-z0-9_(\/|\\\/|\.)+-\]|VAULT_KEY_REGEX/;
+// `vaultKeyRegex` is the InboundInterceptorDeps field gateway.ts binds to the
+// shared VAULT_KEY_REGEX constant (P7 PR-8) — same runtime regex, new name at
+// the moved call site.
+const ACCEPTS_SLASH = /\[A-Za-z0-9_(\/|\\\/|\.)+-\]|VAULT_KEY_REGEX|vaultKeyRegex/;
 
 describe("vault-key regex accepts canonical slash-namespaced keys (#1047)", () => {
   it("vault_request_save validation includes '/' in the charclass", () => {

package/telegram-plugin/tests/vault-request-access-tool.test.ts

@@ -24,13 +24,16 @@ const bridgeSrc = readFileSync(
   'utf-8',
 )
 // #2996 Phase 5: the callback-query handler families moved verbatim to
-// gateway/callback-query-handlers.ts; these pins read the gateway source
-// COMBINED with that module so the wiring assertions keep covering the
-// same runtime source text.
+// gateway/callback-query-handlers.ts, and the agent-facing card-STAGING
+// execute* tool handlers moved verbatim to gateway/card-tool-handlers.ts
+// (#2996 P5-tail); these pins read the gateway source COMBINED with those
+// modules so the wiring assertions keep covering the same runtime source text.
 const gatewaySrc =
   readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
   '\n' +
-  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'card-tool-handlers.ts'), 'utf-8')
 
 describe('vault_request_access (#1012)', () => {
   it('bridge advertises the tool to MCP clients', () => {
@@ -64,7 +67,9 @@ describe('vault_request_access (#1012)', () => {
   it('gateway routes vault_request_access in executeToolCall', () => {
     // fails when: the switch arm is dropped. Tool would be accepted
     // by ALLOWED_TOOLS but fall through to the `unknown tool` branch.
-    expect(gatewaySrc).toMatch(/case\s+'vault_request_access':\s*\n\s*return\s+executeVaultRequestAccess/)
+    // #2996 P5-tail: the dispatcher arm now routes through the extracted
+    // card-tool-handlers factory instance.
+    expect(gatewaySrc).toMatch(/case\s+'vault_request_access':\s*\n\s*return\s+cardToolHandlers\.executeVaultRequestAccess/)
   })
 
   it('gateway dispatches vra: callback prefix', () => {

package/telegram-plugin/tests/vault-request-access-unlock-resume.test.ts

@@ -29,7 +29,10 @@ import { resolve } from 'node:path'
 const gatewaySrc =
   readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
   '\n' +
-  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8') +
+  '\n' +
+  // P7 PR-8 (#2996): vault pending-op intercept moved to inbound-interceptors.ts.
+  readFileSync(resolve(__dirname, '..', 'gateway', 'inbound-interceptors.ts'), 'utf-8')
 
 describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
   it('declares the passphrase-for-access-approve PendingVaultOp variant', () => {

package/telegram-plugin/tests/vault-subcommands.test.ts

@@ -30,7 +30,12 @@ import { join, dirname } from 'node:path'
 const __dir = dirname(fileURLToPath(import.meta.url))
 const pluginDir = join(__dir, '..')
 
-const gatewaySrc = readFileSync(join(pluginDir, 'gateway', 'gateway.ts'), 'utf8')
+const gatewaySrc =
+  readFileSync(join(pluginDir, 'gateway', 'gateway.ts'), 'utf8') +
+  '\n' +
+  // P7 PR-8 (#2996): the vault pending-op intercept (incl. the unlock branch)
+  // moved verbatim into gateway/inbound-interceptors.ts (interceptVault).
+  readFileSync(join(pluginDir, 'gateway', 'inbound-interceptors.ts'), 'utf8')
 
 // ─── helpers ─────────────────────────────────────────────────────────────────
 

package/telegram-plugin/tests/voice-message-handler.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Outcome pins for the voice inbound handler extracted from gateway.ts
+ * (switchroom#2996 P6 cluster E). Drives the engine-selection + transcription
+ * fallback branch against injected access / host-capability / transcribe
+ * surfaces + a mock coalescing dispatch. Asserts the EXACT envelope forwarded
+ * to handleInboundCoalesced for each path (local/cloud transcript, caption
+ * prefix, disabled, and every fallback to the legacy "(voice message)").
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { handleVoiceMessage, type VoiceHandlerDeps } from '../gateway/voice-message-handler.js'
+
+const VOICE_META = { kind: 'voice', file_id: 'v1', size: 100, mime: 'audio/ogg' }
+
+function makeDeps(over: Partial<VoiceHandlerDeps> = {}) {
+  const handleInboundCoalesced = vi.fn(async () => {})
+  const deps: VoiceHandlerDeps = {
+    loadAccess: () => ({ voice_in: { enabled: true, provider: 'openai', api_key: 'k', language: 'en' } }),
+    loadHostCapabilities: () => null,
+    maybeTranscribeVoiceLocal: vi.fn(async () => 'LOCAL TEXT'),
+    maybeTranscribeVoice: vi.fn(async () => 'CLOUD TEXT'),
+    handleInboundCoalesced,
+    ...over,
+  }
+  return { deps, handleInboundCoalesced }
+}
+
+function ctxWith(caption?: string): any {
+  return { message: { voice: { file_id: 'v1', file_size: 100, mime_type: 'audio/ogg' }, caption }, chat: { id: 42 } }
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  delete process.env.SWITCHROOM_VOICE_ENGINE
+})
+
+describe('handleVoiceMessage — cloud path', () => {
+  it('transcribes via cloud and forwards a [voice transcript] envelope', async () => {
+    delete process.env.SWITCHROOM_VOICE_ENGINE
+    const { deps, handleInboundCoalesced } = makeDeps()
+    await handleVoiceMessage(ctxWith(), deps)
+    expect(deps.maybeTranscribeVoice).toHaveBeenCalledWith('v1', 'audio/ogg', 'en', 'k')
+    expect(deps.maybeTranscribeVoiceLocal).not.toHaveBeenCalled()
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      expect.anything(), '[voice transcript] CLOUD TEXT', undefined, VOICE_META,
+    )
+  })
+
+  it('prefixes the caption to the transcript when present', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps()
+    await handleVoiceMessage(ctxWith('note:'), deps)
+    expect(handleInboundCoalesced.mock.calls[0][1]).toBe('note:\n\n[voice transcript] CLOUD TEXT')
+  })
+})
+
+describe('handleVoiceMessage — local path', () => {
+  it('routes to the local sidecar when the engine env is local', async () => {
+    process.env.SWITCHROOM_VOICE_ENGINE = 'local'
+    // voice_in.provider need not be openai for the local path.
+    const { deps, handleInboundCoalesced } = makeDeps({
+      loadAccess: () => ({ voice_in: { enabled: true, language: 'de' } }),
+    })
+    await handleVoiceMessage(ctxWith(), deps)
+    expect(deps.maybeTranscribeVoiceLocal).toHaveBeenCalledWith('v1', 'audio/ogg', 'de')
+    expect(deps.maybeTranscribeVoice).not.toHaveBeenCalled()
+    expect(handleInboundCoalesced.mock.calls[0][1]).toBe('[voice transcript] LOCAL TEXT')
+  })
+
+  it('reads the engine from host-capabilities when env is unset', async () => {
+    delete process.env.SWITCHROOM_VOICE_ENGINE
+    const { deps } = makeDeps({
+      loadAccess: () => ({ voice_in: { enabled: true } }),
+      loadHostCapabilities: () => ({ voice: { engine: 'local' } }),
+    })
+    await handleVoiceMessage(ctxWith(), deps)
+    expect(deps.maybeTranscribeVoiceLocal).toHaveBeenCalled()
+  })
+})
+
+describe('handleVoiceMessage — fallbacks to the legacy envelope', () => {
+  it('falls back when voice_in is disabled', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps({ loadAccess: () => ({}) })
+    await handleVoiceMessage(ctxWith(), deps)
+    expect(deps.maybeTranscribeVoice).not.toHaveBeenCalled()
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      expect.anything(), '(voice message)', undefined, VOICE_META,
+    )
+  })
+
+  it('falls back to the legacy envelope on transcription failure', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps({ maybeTranscribeVoice: vi.fn(async () => null) })
+    await handleVoiceMessage(ctxWith(), deps)
+    expect(handleInboundCoalesced).toHaveBeenCalledWith(
+      expect.anything(), '(voice message)', undefined, VOICE_META,
+    )
+  })
+
+  it('uses the caption as the legacy envelope when present', async () => {
+    const { deps, handleInboundCoalesced } = makeDeps({ loadAccess: () => ({}) })
+    await handleVoiceMessage(ctxWith('hi there'), deps)
+    expect(handleInboundCoalesced.mock.calls[0][1]).toBe('hi there')
+  })
+
+  it('does not use the cloud path when provider is not openai', async () => {
+    delete process.env.SWITCHROOM_VOICE_ENGINE
+    const { deps } = makeDeps({ loadAccess: () => ({ voice_in: { enabled: true } }) })
+    await handleVoiceMessage(ctxWith(), deps)
+    expect(deps.maybeTranscribeVoice).not.toHaveBeenCalled()
+    expect(deps.maybeTranscribeVoiceLocal).not.toHaveBeenCalled()
+  })
+})

package/telegram-plugin/tests/voice-ondemand-callback-handler.test.ts

@@ -0,0 +1,140 @@
+/**
+ * Outcome pins for the on-demand voice ('🔊 Listen') callback family
+ * (`voice:<token>`) extracted from the gateway's callback_query dispatcher
+ * (switchroom#2996 P6). Uses the REAL voice-ondemand token helpers and the
+ * REAL sendVoiceReusingFileId contract via injected send fns: asserts the
+ * fall-through for non-voice data, the auth gate, expiry toast, the
+ * file_id fast path (no upload), the upload path capturing the returned
+ * file_id, and the single-use keyboard strip on success only.
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  handleVoiceOnDemandCallback,
+  type VoiceOnDemandCallbackDeps,
+} from '../gateway/voice-ondemand-callback-handler.js'
+
+const TOKEN = 'tok123'
+const DATA = `voice:${TOKEN}`
+
+function makeCtx(over: Record<string, unknown> = {}) {
+  return {
+    from: { id: 42 },
+    chat: { id: 42 },
+    callbackQuery: { message: { message_id: 77 } },
+    answerCallbackQuery: vi.fn(async () => {}),
+    ...over,
+  } as any
+}
+
+function makeDeps(over: Partial<VoiceOnDemandCallbackDeps> = {}) {
+  const setTelegramFileId = vi.fn()
+  const sendVoiceByFileId = vi.fn(async () => ({ voice: { file_id: 'same' } }))
+  const sendVoiceByUpload = vi.fn(async () => ({ voice: { file_id: 'fresh-id' } }))
+  const stripListenKeyboard = vi.fn(async () => {})
+  const log = vi.fn()
+  const deps: VoiceOnDemandCallbackDeps = {
+    loadAccess: () => ({ allowFrom: ['42'] }),
+    voiceOnDemandCache: {
+      get: () => null,
+      setTelegramFileId,
+    },
+    sendVoiceByFileId,
+    sendVoiceByUpload,
+    stripListenKeyboard,
+    log,
+    ...over,
+  }
+  return { deps, setTelegramFileId, sendVoiceByFileId, sendVoiceByUpload, stripListenKeyboard, log }
+}
+
+describe('handleVoiceOnDemandCallback — routing + gates', () => {
+  it('returns false for non-voice callback data', async () => {
+    const { deps } = makeDeps()
+    const ctx = makeCtx()
+    expect(await handleVoiceOnDemandCallback(ctx, 'agent:whatever', deps)).toBe(false)
+    expect(ctx.answerCallbackQuery).not.toHaveBeenCalled()
+  })
+
+  it('gates non-allowlisted senders', async () => {
+    const { deps, sendVoiceByFileId } = makeDeps()
+    const ctx = makeCtx({ from: { id: 666 } })
+    expect(await handleVoiceOnDemandCallback(ctx, DATA, deps)).toBe(true)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: 'Not authorized.' })
+    expect(sendVoiceByFileId).not.toHaveBeenCalled()
+  })
+
+  it('acks an expired token politely', async () => {
+    const { deps } = makeDeps() // cache.get → null
+    const ctx = makeCtx()
+    expect(await handleVoiceOnDemandCallback(ctx, DATA, deps)).toBe(true)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({
+      text: 'Voice expired — send again to hear it.',
+    })
+  })
+})
+
+describe('handleVoiceOnDemandCallback — send paths', () => {
+  it('file_id fast path: sends BY id, strips the keyboard, no upload', async () => {
+    const { deps, sendVoiceByFileId, sendVoiceByUpload, stripListenKeyboard } = makeDeps({
+      voiceOnDemandCache: {
+        get: () => ({ text: 'hello', speed: 1, telegramFileId: 'cached-id' }),
+        setTelegramFileId: vi.fn(),
+      },
+    })
+    const ctx = makeCtx()
+    expect(await handleVoiceOnDemandCallback(ctx, DATA, deps)).toBe(true)
+    expect(sendVoiceByFileId).toHaveBeenCalledWith(
+      '42',
+      'cached-id',
+      expect.objectContaining({ reply_parameters: { message_id: 77 } }),
+      undefined,
+    )
+    expect(sendVoiceByUpload).not.toHaveBeenCalled()
+    expect(stripListenKeyboard).toHaveBeenCalledWith('42', 77, undefined)
+    expect(ctx.answerCallbackQuery).toHaveBeenCalledWith({ text: '🔊' })
+  })
+
+  it('pre-synth file path: uploads the on-disk audio and captures the returned file_id', async () => {
+    const { mkdtempSync, writeFileSync } = await import('node:fs')
+    const { tmpdir } = await import('node:os')
+    const { join } = await import('node:path')
+    const dir = mkdtempSync(join(tmpdir(), 'voice-od-'))
+    const fp = join(dir, 'a.ogg')
+    writeFileSync(fp, Buffer.from([1, 2, 3]))
+    const setTelegramFileId = vi.fn()
+    const { deps, sendVoiceByUpload, stripListenKeyboard } = makeDeps({
+      voiceOnDemandCache: {
+        get: () => ({ text: 'hello', speed: 1, filePath: fp }),
+        setTelegramFileId,
+      },
+    })
+    const ctx = makeCtx()
+    await handleVoiceOnDemandCallback(ctx, DATA, deps)
+    expect(sendVoiceByUpload).toHaveBeenCalled()
+    // Returned message's file_id captured back into the cache for reuse.
+    expect(setTelegramFileId).toHaveBeenCalledWith(TOKEN, 'fresh-id')
+    expect(stripListenKeyboard).toHaveBeenCalled()
+  })
+
+  it('send failure: logs non-fatally and leaves the keyboard intact (retryable)', async () => {
+    const { deps, stripListenKeyboard, log } = makeDeps({
+      voiceOnDemandCache: {
+        get: () => ({ text: 'hello', speed: 1, telegramFileId: 'cached-id' }),
+        setTelegramFileId: vi.fn(),
+      },
+      sendVoiceByFileId: vi.fn(async () => {
+        throw new Error('boom')
+      }),
+      // Stale-id fallback then tries upload; make it fail too so the send
+      // resolves as send-failed overall. filePath absent → lazy synth path
+      // would need the sidecar; keep it simple: upload throws.
+      sendVoiceByUpload: vi.fn(async () => {
+        throw new Error('boom2')
+      }),
+    })
+    const ctx = makeCtx()
+    expect(await handleVoiceOnDemandCallback(ctx, DATA, deps)).toBe(true)
+    expect(stripListenKeyboard).not.toHaveBeenCalled()
+  })
+})

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -6,7 +6,7 @@ import {
   type WorkerActivityView,
   type BotApiForWorkerFeed,
 } from '../worker-activity-feed.js'
-import { STATUS_ROLLING_LINES, STATUS_LINE_MAX } from '../status-no-truncate.js'
+import { STATUS_ROLLING_LINES, WORKER_HISTORY_MAX, STATUS_LINE_MAX } from '../status-no-truncate.js'
 import { SEND_GATE_SHED } from '../send-gate.js'
 
 describe('isWorkerActivityFeedEnabled (default ON)', () => {
@@ -188,17 +188,31 @@ describe('renderWorkerActivity', () => {
     expect(stepCount(out)).toBe(2)
   })
 
-  it('shows a "+N earlier…" header when the feed exceeds STATUS_ROLLING_LINES (worker surface)', () => {
-    const total = STATUS_ROLLING_LINES + 3
+  it('shows a "+N earlier…" header when the feed exceeds WORKER_HISTORY_MAX (worker surface, #3349)', () => {
+    const total = WORKER_HISTORY_MAX + 3
     const lines = Array.from({ length: total }, (_, i) => `step ${i + 1}`)
     const out = renderWorkerActivity(view({ narrativeLines: lines }))
-    expect(out).toContain(`_✓ +${total - STATUS_ROLLING_LINES} earlier…_`)
+    expect(out).toContain(`_✓ +${total - WORKER_HISTORY_MAX} earlier…_`)
     expect(out).not.toContain('step 1<')
-    const firstVisible = total - STATUS_ROLLING_LINES + 1
+    const firstVisible = total - WORKER_HISTORY_MAX + 1
     expect(out).toContain(`~~_✓ step ${firstVisible}_~~`)
     expect(out).toContain(`**→ step ${total}**`)
-    // STATUS_ROLLING_LINES visible step lines (the overflow header isn't a step).
-    expect(out.match(/step \d/g) ?? []).toHaveLength(STATUS_ROLLING_LINES)
+    // WORKER_HISTORY_MAX visible step lines (the overflow header isn't a step).
+    expect(out.match(/step \d/g) ?? []).toHaveLength(WORKER_HISTORY_MAX)
+  })
+
+  it('the lone-worker card shows the full 6-step trail — the raised ceiling (#3349)', () => {
+    // Ken's curve at w=1 is 6; the single-worker surface must reach it (the old
+    // STATUS_ROLLING_LINES=5 cap could never show the 6th step).
+    expect(WORKER_HISTORY_MAX).toBe(6)
+    const lines = Array.from({ length: 8 }, (_, n) => `ln-${n + 1}`)
+    const out = renderWorkerActivity(view({ narrativeLines: lines }))
+    // Last 6 render (ln-3 … ln-8); the two oldest collapse into a "+2 earlier…".
+    for (let n = 3; n <= 8; n++) expect(out).toContain(`ln-${n}`)
+    expect(out).toContain('_✓ +2 earlier…_')
+    expect(out).toContain('**→ ln-8**') // newest last, bold in-progress
+    // Exactly 6 rendered step bullets (the +N header is not a bullet).
+    expect((out.match(/ln-\d/g) ?? []).length).toBe(6)
   })
 
   it('strips the CONTENT Markdown markup (the card keeps its own ** / _ wrappers, #2669)', () => {
@@ -457,7 +471,7 @@ describe('createWorkerActivityFeed', () => {
     expect(last.text.match(/[✓→]/g) ?? []).toHaveLength(1)
   })
 
-  it('rolls the narrative block to the last STATUS_ROLLING_LINES lines', async () => {
+  it('rolls the narrative block to the last WORKER_HISTORY_MAX lines (#3349)', async () => {
     const bot = makeFakeBot()
     let clock = 10_000
     const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
@@ -469,12 +483,34 @@ describe('createWorkerActivityFeed', () => {
     }
 
     const last = bot.edits.at(-1)!
-    expect(last.text.match(/[✓→]/g) ?? []).toHaveLength(STATUS_ROLLING_LINES)
-    const firstVisible = total - STATUS_ROLLING_LINES + 1
+    expect(last.text.match(/[✓→]/g) ?? []).toHaveLength(WORKER_HISTORY_MAX)
+    const firstVisible = total - WORKER_HISTORY_MAX + 1
     for (let i = 1; i < firstVisible; i++) expect(last.text).not.toContain(`ln-${String(i).padStart(3, '0')}`)
     for (let i = firstVisible; i <= total; i++) expect(last.text).toContain(`ln-${String(i).padStart(3, '0')}`)
   })
 
+  it('the deeper 6-step trail does NOT add edits — one landed render per substantive step (#3349, no #3270 flood)', async () => {
+    // Render-only change: edit frequency is a function of SUBSTANTIVE changes
+    // (new narrative step), never of how many trail lines a render carries. Push
+    // 8 distinct steps to a lone worker; with the edit floor at 0 exactly one
+    // render lands per step: 1 send + 7 edits = 8 landed renders, regardless of
+    // the 6-line trail depth. A widened window that re-fired edits would break
+    // this (that is the #3270 flood we must not reintroduce).
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
+    for (let i = 1; i <= 8; i++) {
+      clock += 1000
+      await feed.update('w1', 'chat', view({ toolCount: i, latestSummary: `edit-step-${i}` }))
+    }
+    expect(bot.sent).toHaveLength(1)
+    expect(bot.edits).toHaveLength(7)
+    // Re-pushing the SAME newest step (no substance change) fires NO extra edit.
+    clock += 1000
+    await feed.update('w1', 'chat', view({ toolCount: 8, latestSummary: 'edit-step-8' }))
+    expect(bot.edits).toHaveLength(7)
+  })
+
   it('grows the narrative even while throttled (line surfaces on next edit)', async () => {
     const bot = makeFakeBot()
     let clock = 10_000
@@ -576,10 +612,10 @@ describe('createWorkerActivityFeed — log sink', () => {
 // char-budget backstop is the only wire-limit ceiling.
 
 describe('rolling window + STATUS_LINE_MAX — renderWorkerActivity', () => {
-  it('with 12 narrative lines, exactly the last STATUS_ROLLING_LINES render + a +N earlier header', () => {
+  it('with 12 narrative lines, exactly the last WORKER_HISTORY_MAX render + a +N earlier header (#3349)', () => {
     const narrativeLines = Array.from({ length: 12 }, (_, i) => `stp-${String(i + 1).padStart(3, '0')}`)
     const out = renderWorkerActivity(view({ narrativeLines }))
-    const firstVisible = 12 - STATUS_ROLLING_LINES + 1
+    const firstVisible = 12 - WORKER_HISTORY_MAX + 1
     for (let i = firstVisible; i <= 12; i++) {
       expect(out).toContain(`stp-${String(i).padStart(3, '0')}`)
     }
@@ -587,7 +623,7 @@ describe('rolling window + STATUS_LINE_MAX — renderWorkerActivity', () => {
       expect(out).not.toContain(`stp-${String(i).padStart(3, '0')}`)
     }
     // Overflow header now appears on the worker surface too.
-    expect(out).toContain(`_✓ +${12 - STATUS_ROLLING_LINES} earlier…_`)
+    expect(out).toContain(`_✓ +${12 - WORKER_HISTORY_MAX} earlier…_`)
     expect(out).toContain('**→ stp-012**')
   })
 
@@ -623,7 +659,7 @@ describe('rolling window + STATUS_LINE_MAX — renderWorkerActivity', () => {
 })
 
 describe('rolling window — createWorkerActivityFeed narrative accumulation', () => {
-  it('with 12 pushes, only the last STATUS_ROLLING_LINES appear in the render', async () => {
+  it('with 12 pushes, only the last WORKER_HISTORY_MAX appear in the render (#3349)', async () => {
     const bot = makeFakeBot()
     let clock = 10_000
     const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
@@ -634,16 +670,16 @@ describe('rolling window — createWorkerActivityFeed narrative accumulation', (
     }
 
     const last = bot.edits.at(-1)!
-    const firstVisible = 12 - STATUS_ROLLING_LINES + 1
+    const firstVisible = 12 - WORKER_HISTORY_MAX + 1
     for (let i = firstVisible; i <= 12; i++) {
       expect(last.text).toContain(`ln-${String(i).padStart(3, '0')}`)
     }
     for (let i = 1; i < firstVisible; i++) {
       expect(last.text).not.toContain(`ln-${String(i).padStart(3, '0')}`)
     }
-    // The manager caps the in-memory narrative at STATUS_ROLLING_LINES, so the
+    // The manager caps the in-memory narrative at WORKER_HISTORY_MAX, so the
     // render never sees overflow — no "+N earlier…" marker on the manager path
-    // (it surfaces only on direct renderWorkerActivity calls with >5 lines).
+    // (it surfaces only on direct renderWorkerActivity calls with >6 lines).
     expect(last.text).not.toContain('earlier…')
     expect(last.text).toContain('**→ ln-012**')
   })
@@ -1027,6 +1063,37 @@ describe('createWorkerActivityFeed — resurrection guard + deferred finalize',
     expect(bot.sent[1].text).toContain('back to work')
   })
 
+  it('#3373: a GENUINE terminal then a SendMessage resume re-surfaces a live card (resurrect+update), while an un-resumed terminal stays dead', async () => {
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
+
+    // Worker runs, then GENUINELY completes (a real turn_end handback) — the
+    // row is dropped and the agentId latched into the terminal `finalized` gate.
+    await feed.update('w1', 'chat', view({ toolCount: 1, latestSummary: 'step one' }))
+    await feed.finish('w1', view({ state: 'done', toolCount: 1, latestSummary: 'real result' }))
+    expect(feed.has('w1')).toBe(false)
+
+    // Anti-zombie: with NO resume signal, later cues stay swallowed forever — a
+    // genuinely-finished worker must never zombie-resurface on a stray tick.
+    clock = 12_000
+    await feed.update('w1', 'chat', view({ toolCount: 2, latestSummary: 'stray tick' }))
+    expect(bot.sent).toHaveLength(1)
+    expect(feed.has('w1')).toBe(false)
+
+    // Now the worker is RESUMED via SendMessage: the watcher observes jsonl
+    // growth past the terminal boundary (#3315) and fires onResume, which the
+    // gateway wires to feed.resurrect — clearing the finalized latch.
+    feed.resurrect('w1')
+
+    // The resumed worker's next progress cue re-surfaces a fresh live card.
+    clock = 13_000
+    await feed.update('w1', 'chat', view({ toolCount: 3, latestSummary: 'resumed work' }))
+    expect(bot.sent).toHaveLength(2)
+    expect(feed.has('w1')).toBe(true)
+    expect(bot.sent[1].text).toContain('resumed work')
+  })
+
   it('#3023: resurrect() on a never-finalized worker is a harmless no-op', () => {
     const bot = makeFakeBot()
     const feed = createWorkerActivityFeed({ bot, now: () => 10_000 })
@@ -1337,8 +1404,8 @@ describe('narrative dedup — non-adjacent repeats collapse (A,B,A)', () => {
     const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
 
     await feed.update('w2', 'chat', view({ latestSummary: 'step-repeat' }))
-    // Push STATUS_ROLLING_LINES distinct lines so 'step-repeat' scrolls out.
-    for (let i = 0; i < STATUS_ROLLING_LINES; i++) {
+    // Push WORKER_HISTORY_MAX distinct lines so 'step-repeat' scrolls out (#3349).
+    for (let i = 0; i < WORKER_HISTORY_MAX; i++) {
       clock += 1000
       await feed.update('w2', 'chat', view({ latestSummary: `filler-${i}` }))
     }