switchroom 0.18.7 → 0.18.8

package/telegram-plugin/tests/busy-ack-wiring.test.ts

@@ -0,0 +1,118 @@
+/**
+ * #2995 — mid-flight busy ack: gateway wiring guards.
+ *
+ * The gateway IIFE is too entangled to instantiate in-process, so these
+ * are source-level assertions (the established pattern —
+ * multitopic-routing-wiring.test.ts, buffer-gate-broadened.test.ts). They
+ * pin the load-bearing wiring: the buffered-inbound and steer call sites,
+ * the silent send, the shared queuedStatusMsgIds lifecycle (promote/reap
+ * cleanup for free), the per-turn dedupe reset, and the kill switch. The
+ * POLICY and the rendered text are behaviourally tested in
+ * busy-ack.test.ts; the live end-to-end shape in
+ * uat/scenarios/jtbd-midflight-busy-ack-dm.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const gatewaySrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
+  'utf-8',
+)
+
+describe('#2995 mid-flight busy ack — gateway wiring', () => {
+  it('the buffer-until-idle branch calls maybePostBusyAck for the inbound own chat/topic', () => {
+    expect(gatewaySrc).toMatch(
+      /maybePostBusyAck\('buffer-until-idle', chat_id, messageThreadId \?\? undefined\)/,
+    )
+    // …AFTER the pendingInboundBuffer.push (the ack narrates a real queue).
+    const branch = gatewaySrc.split("deliveryGate.decision === 'buffer-until-idle'")[1] ?? ''
+    const pushIdx = branch.indexOf('pendingInboundBuffer.push(selfAgent, inboundMsg)')
+    const ackIdx = branch.indexOf("maybePostBusyAck('buffer-until-idle'")
+    expect(pushIdx).toBeGreaterThanOrEqual(0)
+    expect(ackIdx).toBeGreaterThan(pushIdx)
+  })
+
+  it('cross-topic queued status and the busy ack are mutually exclusive (no double-card race)', () => {
+    // Both helpers record into queuedStatusMsgIds only AFTER their
+    // sendMessage awaits resolve, so calling both in the same handler pass
+    // would race past each other's has(key) check and double-card the
+    // topic. The buffer branch must pick exactly one.
+    expect(gatewaySrc).toMatch(
+      /if \(crossTopicQueuedCard\) \{\s*postQueuedStatus\(chat_id, messageThreadId, inFlightThread\)\s*\} else \{/,
+    )
+  })
+
+  it('a mid-turn steer gets the steer-worded variant only AFTER successful bridge dispatch', () => {
+    // A "Steer noted" card for a send that missed (bridge offline) would
+    // be untrue — the ack lives inside the `if (delivered)` branch.
+    expect(gatewaySrc).toMatch(
+      /if \(delivered\) \{[\s\S]{0,700}if \(isSteering\) \{\s*maybePostBusyAck\('steer', chat_id, messageThreadId \?\? undefined\)/,
+    )
+  })
+
+  it('an under-threshold miss arms ONE deferred re-check pinned to the running turn', () => {
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    // Armed only for the young-step miss, for the remaining age gap.
+    expect(fn).toMatch(/stepAgeMs < BUSY_ACK_STEP_AGE_THRESHOLD_MS &&\s*!busyAckRecheckTimers\.has\(key\)/)
+    expect(fn).toMatch(/BUSY_ACK_STEP_AGE_THRESHOLD_MS - stepAgeMs \+ 250/)
+    // The re-fire is guarded on the SAME turn still running.
+    expect(fn).toMatch(/currentTurn\?\.turnId !== turnIdAtSchedule\) return/)
+    // A posted card cancels the pending re-check.
+    expect(fn).toMatch(/clearTimeout\(pendingRecheck\)/)
+  })
+
+  it('the decision is fed from live tool-flight + step-age readings (pure module owns policy)', () => {
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/shouldPostBusyAck\(\{ gateDecision, midToolCall, stepAgeMs, alreadyAcked \}\)/)
+    expect(fn).toMatch(/const midToolCall = toolFlightTracker\.isMidToolCall\(\)/)
+    expect(fn).toMatch(/silencePoke\.longestInFlightTool\(/)
+    expect(fn).toMatch(/const stepAgeMs = step\?\.durationMs \?\? null/)
+  })
+
+  it('dedupe: alreadyAcked couples the live card map AND the per-turn key set', () => {
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(
+      /const alreadyAcked = queuedStatusMsgIds\.has\(key\) \|\| busyAckPostedKeys\.has\(key\)/,
+    )
+    expect(fn).toMatch(/busyAckPostedKeys\.add\(key\)/)
+  })
+
+  it('the card is sent SILENT (disable_notification: true) through the swallowing wrapper', () => {
+    const fn = gatewaySrc.split('function postBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/swallowingApiCall\(/)
+    expect(fn).toMatch(/disable_notification: true/)
+    // Thread-optional: a DM send must NOT pass message_thread_id.
+    expect(fn).toMatch(/\.\.\.\(threadId != null \? \{ message_thread_id: threadId \} : \{\}\)/)
+  })
+
+  it('the card shares queuedStatusMsgIds — promote/reap lifecycle cleans it up', () => {
+    const fn = gatewaySrc.split('function postBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    // Idempotent against the shared key (never stacks on the cross-topic card).
+    expect(fn).toMatch(/if \(queuedStatusMsgIds\.has\(key\)\) return/)
+    expect(fn).toMatch(/queuedStatusMsgIds\.set\(key, \{ chatId, threadId: threadId \?\? null, messageId \}\)/)
+    // Post-race orphan cleanup, same pattern as postQueuedStatus.
+    expect(fn).toMatch(/busy-ack\.post-race-cleanup/)
+  })
+
+  it('turn-end cleanup is PER-KEY: dedupe entry deleted and re-check timer cancelled for the ending turn only', () => {
+    const purge = gatewaySrc.split('function purgeReactionTracking')[1]?.split('\nfunction ')[0] ?? ''
+    // Per-key delete — a purge for topic A must not reset topic B's dedupe.
+    expect(purge).toMatch(/busyAckPostedKeys\.delete\(key\)/)
+    expect(purge).not.toMatch(/busyAckPostedKeys\.clear\(\)/)
+    expect(purge).toMatch(/busyAckRecheckTimers\.delete\(key\)/)
+    expect(purge).toMatch(/clearTimeout\(busyAckRecheck\)/)
+  })
+
+  it('DM cards are promoted too (promoteQueuedStatus no longer early-returns on a null thread)', () => {
+    const fn = gatewaySrc.split('function promoteQueuedStatus')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).not.toMatch(/if \(thread == null\) return/)
+  })
+
+  it('kill switch defaults ON, independently disableable', () => {
+    expect(gatewaySrc).toMatch(/SWITCHROOM_MIDFLIGHT_BUSY_ACK !== '0'/)
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/if \(!MIDFLIGHT_BUSY_ACK_ENABLED\) return/)
+  })
+})

package/telegram-plugin/tests/busy-ack.test.ts

@@ -0,0 +1,121 @@
+/**
+ * #2995 — mid-flight busy ack: pure decision module.
+ *
+ * Pins the deterministic policy (`shouldPostBusyAck`) and the rendered
+ * card text (`formatBusyAckText`) — the model-free ack a buffered/steered
+ * mid-turn inbound gets while the running turn sits inside one long tool
+ * step. Behavioral assertions on the RENDERED text (wording contract:
+ * "Queued" for the buffered path per the steer-or-queue classification-
+ * visibility invariant; never "Queued" for a steer).
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  BUSY_ACK_STEP_AGE_THRESHOLD_MS,
+  shouldPostBusyAck,
+  formatBusyAckText,
+} from '../gateway/busy-ack.js'
+
+const base = {
+  gateDecision: 'buffer-until-idle' as const,
+  midToolCall: true,
+  stepAgeMs: BUSY_ACK_STEP_AGE_THRESHOLD_MS + 1,
+  alreadyAcked: false,
+}
+
+describe('shouldPostBusyAck', () => {
+  it('fires for a buffered inbound behind an old tool step', () => {
+    expect(shouldPostBusyAck(base)).toBe(true)
+  })
+
+  it('fires for a steer behind an old tool step', () => {
+    expect(shouldPostBusyAck({ ...base, gateDecision: 'steer' })).toBe(true)
+  })
+
+  it('never fires for a plain fresh-turn deliver', () => {
+    expect(shouldPostBusyAck({ ...base, gateDecision: 'deliver' })).toBe(false)
+  })
+
+  it('never fires when not mid-tool-call (turn thinking between tools)', () => {
+    expect(shouldPostBusyAck({ ...base, midToolCall: false })).toBe(false)
+  })
+
+  it('never fires below the step-age threshold (agent seconds from answering)', () => {
+    expect(
+      shouldPostBusyAck({ ...base, stepAgeMs: BUSY_ACK_STEP_AGE_THRESHOLD_MS - 1 }),
+    ).toBe(false)
+    // exactly at the threshold → fires (>= semantics)
+    expect(
+      shouldPostBusyAck({ ...base, stepAgeMs: BUSY_ACK_STEP_AGE_THRESHOLD_MS }),
+    ).toBe(true)
+  })
+
+  it('never fires with no tracked step age', () => {
+    expect(shouldPostBusyAck({ ...base, stepAgeMs: null })).toBe(false)
+  })
+
+  it('fires at most once per key — a second ping gets no second card', () => {
+    // The gateway feeds `alreadyAcked` from its per-turn key set + the live
+    // card map; the policy must refuse when either says "already acked".
+    expect(shouldPostBusyAck({ ...base, alreadyAcked: true })).toBe(false)
+  })
+
+  it('threshold constant sits between the fast-tool envelope and the ignored horizon', () => {
+    expect(BUSY_ACK_STEP_AGE_THRESHOLD_MS).toBeGreaterThanOrEqual(5_000)
+    expect(BUSY_ACK_STEP_AGE_THRESHOLD_MS).toBeLessThanOrEqual(30_000)
+  })
+})
+
+describe('formatBusyAckText — rendered card text', () => {
+  it('buffered path says "Queued", names the blocking activity, and promises the answer', () => {
+    const text = formatBusyAckText({
+      gateDecision: 'buffer-until-idle',
+      toolName: 'Bash',
+      toolLabel: 'gh pr checks --watch',
+    })
+    expect(text).toContain('Queued')
+    expect(text).toContain('`Bash: gh pr checks --watch`')
+    expect(text).toMatch(/I'll answer when this step finishes/)
+  })
+
+  it('carries no point-in-time elapsed figure (a static card must not decay)', () => {
+    // The card is posted once and never re-rendered while the blocking
+    // step runs — any "(Nm elapsed)" would silently go stale on screen.
+    const text = formatBusyAckText({
+      gateDecision: 'buffer-until-idle',
+      toolName: 'Bash',
+      toolLabel: 'sleep 90',
+    })
+    expect(text).not.toMatch(/elapsed|\b\d+[sm]\b/)
+  })
+
+  it('steer path never says "Queued" (classification-visibility invariant)', () => {
+    const text = formatBusyAckText({
+      gateDecision: 'steer',
+      toolName: 'Bash',
+      toolLabel: 'sleep 90',
+    })
+    expect(text).not.toContain('Queued')
+    expect(text).toContain('Steer noted')
+    expect(text).toContain('`Bash: sleep 90`')
+  })
+
+  it('degrades honestly when the tool label is unknown', () => {
+    const text = formatBusyAckText({
+      gateDecision: 'buffer-until-idle',
+      toolName: null,
+      toolLabel: null,
+    })
+    expect(text).toContain('Queued')
+    expect(text).toContain('a long-running step')
+  })
+
+  it('uses the bare tool name when no label was derived', () => {
+    const text = formatBusyAckText({
+      gateDecision: 'buffer-until-idle',
+      toolName: 'Bash',
+      toolLabel: null,
+    })
+    expect(text).toContain('`Bash`')
+  })
+})

package/telegram-plugin/tests/flood-circuit-breaker.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  computeFloodWait,
+  floodWaitRemainingMs,
+  isFloodWaitActive,
+  readFloodState,
+  writeFloodState,
+  makeFloodWaitRecorder,
+  suppressNonEssentialSendMs,
+  floodStatePath,
+  type FloodWaitState,
+} from '../flood-circuit-breaker.js'
+
+describe('#2923 flood circuit-breaker', () => {
+  let dir: string
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'flood-cb-'))
+  })
+  afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+  it('records a flood-wait window from retry_after', () => {
+    const now = 1_000_000
+    const s = computeFloodWait(null, 4116, now)
+    expect(s.untilTs).toBe(now + 4116_000)
+    expect(s.retryAfterSec).toBe(4116)
+    expect(isFloodWaitActive(s, now)).toBe(true)
+    expect(isFloodWaitActive(s, s.untilTs + 1)).toBe(false)
+  })
+
+  it('EXTENDS (never shrinks) an existing window on a fresh, shorter 429', () => {
+    const now = 1_000_000
+    const long = computeFloodWait(null, 4000, now)
+    // A later 429 reporting a shorter ban must not pull the expiry earlier.
+    const shorter = computeFloodWait(long, 10, now + 1000)
+    expect(shorter.untilTs).toBe(long.untilTs)
+  })
+
+  it('floodWaitRemainingMs is 0 for no state / expired state', () => {
+    expect(floodWaitRemainingMs(null, 5)).toBe(0)
+    const expired: FloodWaitState = { untilTs: 100, retryAfterSec: 1, recordedTs: 0 }
+    expect(floodWaitRemainingMs(expired, 200)).toBe(0)
+  })
+
+  it('persists + reads back the window; corrupt marker → null', () => {
+    const p = floodStatePath(dir)
+    expect(readFloodState(p)).toBeNull()
+    const s = computeFloodWait(null, 60, 1000)
+    writeFloodState(p, s)
+    expect(readFloodState(p)).toEqual(s)
+    writeFileSync(p, '{bad')
+    expect(readFloodState(p)).toBeNull()
+  })
+
+  it('makeFloodWaitRecorder persists the window (the onFloodWait hook)', () => {
+    const p = floodStatePath(dir)
+    const record = makeFloodWaitRecorder(p, () => 500_000)
+    record(4116)
+    const s = readFloodState(p)
+    expect(s).not.toBeNull()
+    expect(s!.untilTs).toBe(500_000 + 4116_000)
+  })
+
+  it('suppressNonEssentialSendMs > 0 while a ban is open, 0 after it lifts', () => {
+    const p = floodStatePath(dir)
+    writeFloodState(p, computeFloodWait(null, 68 * 60, 1_000_000))
+    // A restart mid-ban: the boot card must be suppressed.
+    expect(suppressNonEssentialSendMs(p, 1_000_000)).toBeGreaterThan(0)
+    // After the window: send proceeds.
+    expect(suppressNonEssentialSendMs(p, 1_000_000 + 68 * 60_000 + 1)).toBe(0)
+  })
+})

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -1,13 +1,15 @@
 /**
- * Structural pins for the session-only model relaunch wiring in gateway.ts.
+ * Structural pins for the session-model stickiness wiring in gateway.ts
+ * (reference/rfcs/session-model-stickiness.md).
  *
  * The behaviour lives in un-exported inline closures (buildModelDeps's
- * scheduleModelRelaunch, the model-menu callback sr-* branch, and the boot
- * re-hydration / alert-sentinel block inside the startup IIFE), so — mirroring
- * the other gateway-*.test.ts source-pins — we assert on the source structure.
- * The end-to-end behaviour of the carrier itself is exercised in
- * tests/scaffold.session-model-override.test.ts (rendered start.sh) and the
- * handler contract in telegram-plugin/tests/model-command.test.ts.
+ * scheduleModelRelaunch/scheduleRestart, triggerSelfRestart, the /restart and
+ * /new handlers, the model-menu callback branches, and the boot re-hydration
+ * block inside the startup IIFE), so — mirroring the other gateway-*.test.ts
+ * source-pins — we assert on the source structure. The end-to-end behaviour
+ * of the boot resolver is exercised in tests/scaffold.session-model.test.ts
+ * (rendered start.sh), the file helpers in session-model-file.test.ts, and
+ * the handler contract in model-command.test.ts.
  */
 
 import { describe, it, expect } from 'vitest'
@@ -18,54 +20,199 @@ import { dirname, resolve } from 'node:path'
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
 
-describe('gateway: scheduleModelRelaunch dep', () => {
-  it('writes the carrier with exact "<model>\\n" bytes', () => {
+describe('gateway: triggerSelfRestart stamps relaunch-model intent BEFORE the kill', () => {
+  it('docker branch: writeRelaunchModelIntent(intentForRestartReason(reason)) precedes the SIGTERM scheduling', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('function triggerSelfRestart(')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 3000)
+    const writeIdx = win.indexOf('writeRelaunchModelIntent(smDir, intentForRestartReason(reason), reason)')
+    const killIdx = win.indexOf("process.kill(1, 'SIGTERM')")
+    // Write-before-kill invariant: boot default is REVERT, so the intent must
+    // be on disk synchronously before the SIGTERM is even scheduled.
+    expect(writeIdx).toBeGreaterThan(0)
+    expect(killIdx).toBeGreaterThan(writeIdx)
+    // And before the setTimeout that schedules it.
+    const timeoutIdx = win.indexOf('setTimeout(')
+    expect(timeoutIdx).toBeGreaterThan(writeIdx)
+  })
+
+  it('legacy systemd branch stamps intent too (self-target only)', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('function triggerSelfRestart(')
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 4200)
+    const legacyIdx = win.indexOf('// Legacy systemd path.')
+    expect(legacyIdx).toBeGreaterThan(0)
+    const legacyWin = win.slice(legacyIdx)
+    expect(legacyWin).toContain('writeRelaunchModelIntent(smDir, intentForRestartReason(reason), reason)')
+    expect(legacyWin.indexOf('writeRelaunchModelIntent')).toBeLessThan(legacyWin.indexOf('spawn('))
+  })
+})
+
+describe('gateway: scheduleModelRelaunch dep (durable .session-model)', () => {
+  it('writes the durable file via writeSessionModelFile before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 900)
-    expect(win).toMatch(/writeFileSync\(\s*join\(agentDir, '\.session-model-override'\),\s*`\$\{model\}\\n`/)
+    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const writeIdx = win.indexOf('writeSessionModelFile(')
+    const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
+    expect(writeIdx).toBeGreaterThan(0)
+    expect(restartIdx).toBeGreaterThan(writeIdx)
   })
 
   it('sets the in-memory session-model override before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 900)
-    // The override now lives on the freshness-aware sessionModelSource
-    // (session-model-source.ts) rather than a bare module-level variable.
+    const win = GATEWAY_SRC.slice(idx, idx + 1800)
     const setIdx = win.indexOf('sessionModelSource.setOverride(model)')
     const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
     expect(setIdx).toBeGreaterThan(0)
     expect(restartIdx).toBeGreaterThan(setIdx)
   })
 
+  it('rolls back the prior file content (not just deletion) on a non-in-flight dispatch failure', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    expect(win).toContain('const prevFileRaw = readSessionModelFileRaw(agentDir)')
+    expect(win).toContain('restoreSessionModelFileRaw(agentDir, prevFileRaw)')
+    expect(win).toContain("!== 'restart_in_flight'")
+  })
+
+  it('the non-in-flight rollback ALSO clears the keep-intent (a live intent with no restart coming would wrongly KEEP across a crash)', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
+    const win = GATEWAY_SRC.slice(idx, idx + 2400)
+    const inFlightIdx = win.indexOf("!== 'restart_in_flight'")
+    const clearIdx = win.indexOf('clearRelaunchModelIntent(agentDir)')
+    expect(inFlightIdx).toBeGreaterThan(0)
+    expect(clearIdx).toBeGreaterThan(inFlightIdx)
+  })
+
   it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const win = GATEWAY_SRC.slice(idx, idx + 1800)
     expect(win).toContain('await deps.scheduleRestart(reason)')
   })
 })
 
-describe('gateway: model-menu sr-* target relaunches via the carrier', () => {
+describe('gateway: intent writers on the restart verbs', () => {
+  it('model-switch scheduleRestart stamps keep-intent before the hostd dispatch', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleRestart: async (reason: string)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 3200)
+    const keepIdx = win.indexOf("writeRelaunchModelIntent(smDir, 'keep', reason)")
+    const dispatchIdx = win.indexOf("op: 'agent_restart'")
+    expect(keepIdx).toBeGreaterThan(0)
+    expect(dispatchIdx).toBeGreaterThan(keepIdx)
+  })
+
+  it('scheduleRestart clears the keep-intent when hostd refuses (failed dispatch → no live intent on disk)', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleRestart: async (reason: string)')
+    const win = GATEWAY_SRC.slice(idx, idx + 3200)
+    const failIdx = win.indexOf('hostd restart failed')
+    const clearIdx = win.indexOf('clearRelaunchModelIntent(smDir)')
+    expect(clearIdx).toBeGreaterThan(0)
+    expect(failIdx).toBeGreaterThan(clearIdx) // cleared before the throw's message
+    // And it sits in the same error branch as clearRestartMarker.
+    const markerIdx = win.indexOf('clearRestartMarker()')
+    expect(clearIdx).toBeGreaterThan(markerIdx)
+  })
+
+  it('/restart stamps an explicit revert intent (reason honesty) before dispatch', () => {
+    const idx = GATEWAY_SRC.indexOf("stampUserRestartReason('user: /restart from chat')")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const revertIdx = win.indexOf("writeRelaunchModelIntent(smDir, 'revert', 'user: /restart from chat')")
+    const dispatchIdx = win.indexOf("hostdRequestId('gw-restart')")
+    expect(revertIdx).toBeGreaterThan(0)
+    expect(dispatchIdx).toBeGreaterThan(revertIdx)
+  })
+
+  it('/new and /reset stamp keep-intent (fresh conversation, same model — contract row 7)', () => {
+    const idx = GATEWAY_SRC.indexOf('stampUserRestartReason(`user: /${kind} from chat`)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 700)
+    const keepIdx = win.indexOf("writeRelaunchModelIntent(agentDir, 'keep', `user: /${kind} from chat`)")
+    const dispatchIdx = win.indexOf('tryHostdDispatch')
+    expect(keepIdx).toBeGreaterThan(0)
+    expect(dispatchIdx).toBeGreaterThan(keepIdx)
+  })
+})
+
+describe('gateway: model-menu callback persists the sticky override', () => {
+  it('a confirmed selection persists the canonical token (selectedModelToken), never the display label', () => {
+    const idx = GATEWAY_SRC.indexOf('const outcome = await handleModelMenuCallback(data, modelDeps)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1600)
+    expect(win).toContain('outcome.selectedModelToken')
+    expect(win).toMatch(/writeSessionModelFile\(\s*smDir,\s*outcome\.selectedModelToken/)
+  })
+
+  it('a confirmed "Default" selection CLEARS the sticky file', () => {
+    const idx = GATEWAY_SRC.indexOf('const outcome = await handleModelMenuCallback(data, modelDeps)')
+    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    expect(win).toContain('outcome.clearedDefault')
+    expect(win).toContain('clearSessionModelFile(smDir)')
+  })
+
   it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
     const idx = GATEWAY_SRC.indexOf('if (data.startsWith(MODEL_CALLBACK_SR))')
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx, idx + 1400)
     expect(win).toContain('modelDeps.scheduleModelRelaunch(srName')
-    // It must return before falling through to handleModelMenuCallback (which
-    // would inject an sr-* id claude's picker rejects).
     expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
   })
+
+  it('the sr-to-claude transition writes the durable file (and clears it on a Default tap)', () => {
+    const idx = GATEWAY_SRC.indexOf('isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 3600)
+    expect(win).toMatch(/writeSessionModelFile\(\s*agentDir,\s*token/)
+    expect(win).toContain('clearSessionModelFile(agentDir)')
+    // Restart rides triggerSelfRestart with a keep-classified reason.
+    expect(win).toContain("triggerSelfRestart(agentName, 'sr-to-claude-model-switch'")
+  })
 })
 
-describe('gateway boot: session-model re-hydration + LiteLLM-down alert', () => {
-  it('re-hydrates activeSessionModelOverride from .active-session-model', () => {
+describe('gateway: typed /model persists the REQUESTED canonical token', () => {
+  it('persists expandSrAlias(parsed.model), and `/model default` clears file + in-memory override', () => {
+    const idx = GATEWAY_SRC.indexOf("const requested = parsed.kind === 'set' ? expandSrAlias(parsed.model) : null")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 2400)
+    expect(win).toContain("requested?.toLowerCase() === 'default'")
+    expect(win).toContain('sessionModelSource.setOverride(null)')
+    expect(win).toContain('clearSessionModelFile(smDir)')
+    // Non-default: the requested token (shape-gated, non-sr) is what persists.
+    expect(win).toContain('isValidModelArg(requested) && !isSrModel(requested)')
+    expect(win).toMatch(/writeSessionModelFile\(\s*smDir,\s*requested/)
+  })
+
+  it('`/model default` file-clear is NOT gated on a positive confirmation (silent-switch path must not resurrect)', () => {
+    const idx = GATEWAY_SRC.indexOf("const requested = parsed.kind === 'set' ? expandSrAlias(parsed.model) : null")
+    const win = GATEWAY_SRC.slice(idx, idx + 2400)
+    // The default branch clears the file unconditionally, and only the
+    // in-memory override change is confirmation-gated inside it.
+    const clearIdx = win.indexOf('if (smDir) clearSessionModelFile(smDir)')
+    const gatedOverrideIdx = win.indexOf('if (reply.selectedModel) sessionModelSource.setOverride(null)')
+    expect(clearIdx).toBeGreaterThan(0)
+    expect(gatedOverrideIdx).toBeGreaterThan(clearIdx)
+    // And the whole default branch is not nested in an `if (reply.selectedModel)` block:
+    const between = win.slice(0, clearIdx)
+    expect(between).not.toContain('if (reply.selectedModel) {')
+  })
+
+  it('a persist failure is surfaced ON THE REPLY, not just stderr (typed + menu paths)', () => {
+    expect(GATEWAY_SRC.match(/won’t survive a relaunch/g)?.length ?? 0).toBeGreaterThanOrEqual(2)
+    const typedIdx = GATEWAY_SRC.indexOf('persistWarning =')
+    expect(typedIdx).toBeGreaterThan(0)
+    expect(GATEWAY_SRC).toContain('reply.text + persistWarning')
+    // Menu path appends onto the outgoing card text.
+    expect(GATEWAY_SRC).toContain('outcome.reply.text +=')
+  })
+})
+
+describe('gateway boot: session-model re-hydration + alert relay', () => {
+  it('re-hydrates the override from .active-session-model', () => {
     const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx - 200, idx + 1400)
-    // Only an override when the launched model differs from the configured one.
     expect(win).toMatch(/launched\.length > 0 && launched !== configured \? launched : null/)
-    // The configured value must be resolved through resolveMainModel (the SAME
-    // resolver start.sh's scaffold uses) so an unset/`default` model config does
-    // not get flagged as a phantom session override on an ordinary restart.
     expect(win).toContain('resolveMainModel(raw ?? undefined)')
   })
 
@@ -74,10 +221,15 @@ describe('gateway boot: session-model re-hydration + LiteLLM-down alert', () =>
     expect(idx).toBeGreaterThan(0)
     const win = GATEWAY_SRC.slice(idx, idx + 1100)
     expect(win).toContain('unlinkSync(alertPath)')
-    // Broadcasts to every operator in allowFrom, not just allowFrom[0].
     expect(win).toContain('const operators = loadAccess().allowFrom')
     expect(win).toContain('for (const operator of operators)')
     expect(win).toContain('lockedBot.api')
     expect(win).toContain('.sendMessage(operator')
   })
 })
+
+describe('gateway: the legacy one-shot carrier is no longer written', () => {
+  it('no gateway code writes .session-model-override anymore (start.sh migration shim only reads it)', () => {
+    expect(GATEWAY_SRC).not.toMatch(/writeFileSync\([^)]*\.session-model-override/)
+  })
+})