switchroom 0.18.7 → 0.18.9

package/telegram-plugin/tests/approval-card-restart-outcome.test.ts

@@ -0,0 +1,218 @@
+/**
+ * Outcome-based composition test for the approval/restart continuation
+ * contract in `reference/jobs/approve-what-my-agent-can-touch.md`:
+ *
+ *   - "An approval card survives a gateway restart. A tap on a still-valid
+ *      card after a restart works; a card that expired during the outage is
+ *      re-offered on the operator's return."
+ *   - "Cards time out (60-min default) and the timeout wakes the agent as a
+ *      timeout, not a denial ... An expired card is re-offered when the
+ *      operator returns."
+ *
+ * The sibling suites pin each module in isolation (pending-card-store.test.ts,
+ * pending-card-expiry.test.ts with mocked deps, approval-timeout-inbound-
+ * builders.test.ts) and pending-card-durability-wiring.test.ts pins the
+ * gateway wiring at the source-text level. This suite wires the REAL modules
+ * together — file-backed durable store + real missed-approvals store + real
+ * expiry sweep + real timeout builders — across a simulated gateway bounce
+ * (store re-instantiation from the same state dir), asserting the promised
+ * OUTCOMES rather than any one module's contract.
+ *
+ * SCOPE CAVEAT: the expiry predicate / remove / deliver / recordMiss closures
+ * below are TEST-SUPPLIED stand-ins for gateway.ts's inline closures (which
+ * close over module-level gateway state and can't be imported without a
+ * production refactor). This suite therefore proves the modules COMPOSE
+ * correctly; that gateway.ts actually wires them this way is pinned
+ * separately by pending-card-durability-wiring.test.ts's source greps. The
+ * user-visible acceptance twin is
+ * `uat/scenarios/vault-card-survives-gateway-restart-dm.test.ts`.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import {
+  createPendingCardStore,
+  type PersistedApprovalCard,
+  type PersistedVaultAccessCard,
+} from '../gateway/pending-card-store.js'
+import { createMissedApprovalsStore } from '../gateway/missed-approvals-store.js'
+import { expirePendingCard, sweepExpiredEntries } from '../gateway/pending-card-expiry.js'
+import { buildVaultAccessTimeoutInbound } from '../gateway/approval-timeout-inbound-builders.js'
+import type { InboundMessage } from '../gateway/ipc-protocol.js'
+
+// Test-local stand-in for the 60-min default the spec names. The production
+// TTL comes from approvalTtlMs() in gateway/permission-timeout.ts; this suite
+// does NOT assert that config plumbing — only how the modules behave around
+// whatever TTL the sweep predicate encodes.
+const TTL_MS = 60 * 60_000
+const NOW = 1_700_000_000_000
+
+function accessCard(overrides: Partial<PersistedVaultAccessCard> = {}): PersistedVaultAccessCard {
+  return {
+    family: 'vault_request_access',
+    stageId: 'stage-1',
+    agent: 'test-agent',
+    chatId: '12345',
+    cardMessageId: 777,
+    stagedAt: NOW - 60_000, // staged a minute ago — still valid
+    key: 'example/api-key',
+    scope: 'read',
+    ttlSeconds: 30 * 86_400,
+    ...overrides,
+  }
+}
+
+describe('approval/restart continuation — spec outcomes across a gateway bounce', () => {
+  let stateDir: string
+
+  beforeEach(() => {
+    stateDir = mkdtempSync(join(tmpdir(), 'approval-card-restart-outcome-'))
+  })
+  afterEach(() => {
+    rmSync(stateDir, { recursive: true, force: true })
+  })
+
+  it('a still-valid card record survives the bounce intact, and removing it clears the durable store', () => {
+    // Gateway process #1 stages the card.
+    const before = createPendingCardStore(stateDir)
+    const card = accessCard()
+    before.add(card)
+
+    // ── gateway restarts: all in-memory maps are gone ──
+    const after = createPendingCardStore(stateDir)
+    const restored = after.loadAll()
+    expect(restored).toHaveLength(1)
+    // Metadata roundtrips byte-identical — stagedAt included, so the expiry
+    // deadline the sweep computes from it is unchanged by the bounce.
+    expect(restored[0]).toEqual(card)
+
+    // Post-restart resolution path (what a tap handler does with the store):
+    // remove() drops the durable record so a later boot can't resurrect it.
+    // The tap handler's Telegram/grant side is NOT exercised here — that's
+    // the UAT twin's job.
+    after.remove(card.stageId)
+    expect(after.loadAll()).toHaveLength(0)
+  })
+
+  it('a card that expired during the outage wakes the agent ONCE as timeout-not-denial and records the re-offer', () => {
+    // Staged well past the TTL before the bounce.
+    const expired = accessCard({ stageId: 'stage-expired', stagedAt: NOW - TTL_MS - 60_000 })
+    createPendingCardStore(stateDir).add(expired)
+
+    // ── restart: restore into the in-memory map, then the reaper sweeps ──
+    const store = createPendingCardStore(stateDir)
+    const missed = createMissedApprovalsStore(stateDir)
+    const map = new Map<string, PersistedVaultAccessCard>(
+      store.loadAll().map(e => [e.stageId, e as PersistedVaultAccessCard]),
+    )
+    expect(map.size).toBe(1)
+
+    const delivered: InboundMessage[] = []
+    const sweep = () =>
+      sweepExpiredEntries(
+        map,
+        (v, now) => v.stagedAt < now - TTL_MS,
+        (stageId, v) => {
+          expirePendingCard({
+            remove: () => {
+              map.delete(stageId)
+              store.remove(stageId)
+            },
+            editCard: () => {},
+            buildInbound: () =>
+              buildVaultAccessTimeoutInbound({
+                agent: v.agent,
+                chatId: v.chatId,
+                stageId,
+                timeoutMinutes: Math.round(TTL_MS / 60_000),
+                nowMs: NOW,
+                key: v.key,
+                scope: v.scope,
+              }),
+            deliver: m => {
+              delivered.push(m)
+              return true
+            },
+            recordMiss: () =>
+              missed.add({
+                requestId: `approval-card:${stageId}`,
+                toolName: 'vault_request_access',
+                action: `vault access to ${v.key}`,
+                chatId: v.chatId,
+                timedOutAt: NOW,
+              }),
+            log: () => {},
+          })
+        },
+        NOW,
+        () => {},
+      )
+
+    sweep()
+
+    // Exactly one wake, and it is a TIMEOUT, never a denial.
+    expect(delivered).toHaveLength(1)
+    expect(delivered[0].text).toMatch(/TIMEOUT, not a denial/)
+    expect(delivered[0].text).toContain('example/api-key')
+    expect(delivered[0].meta?.source).toBe('vault_grant_timeout')
+
+    // The re-offer is durably recorded for the operator's return.
+    const pending = missed.listPending()
+    expect(pending).toHaveLength(1)
+    expect(pending[0].requestId).toBe('approval-card:stage-expired')
+
+    // Durable record is gone — a later boot can't resurrect the card.
+    expect(store.loadAll()).toHaveLength(0)
+
+    // A second boot's sweep restores from the (now empty) durable store and
+    // therefore fires nothing — the remove() step cleared BOTH the in-memory
+    // map and the store, so no later process can re-deliver the wake. (The
+    // intra-process single-shot ordering guarantee — remove() before any
+    // fallible side effect — is pinned behaviorally in
+    // pending-card-expiry.test.ts, not here.)
+    const rebootMap = new Map<string, PersistedVaultAccessCard>(
+      createPendingCardStore(stateDir)
+        .loadAll()
+        .map(e => [e.stageId, e as PersistedVaultAccessCard]),
+    )
+    expect(rebootMap.size).toBe(0)
+    let secondBootExpiries = 0
+    sweepExpiredEntries(
+      rebootMap,
+      (v, now) => v.stagedAt < now - TTL_MS,
+      () => {
+        secondBootExpiries += 1
+      },
+      NOW,
+      () => {},
+    )
+    expect(secondBootExpiries).toBe(0)
+    expect(delivered).toHaveLength(1)
+  })
+
+  it('the post-restart sweep never expires a still-valid card (no false timeout on bounce)', () => {
+    const valid = accessCard({ stageId: 'stage-valid', stagedAt: NOW - 60_000 })
+    createPendingCardStore(stateDir).add(valid)
+
+    const store = createPendingCardStore(stateDir)
+    const map = new Map<string, PersistedApprovalCard>(store.loadAll().map(e => [e.stageId, e]))
+
+    let expiredCount = 0
+    sweepExpiredEntries(
+      map,
+      (v, now) => v.stagedAt < now - TTL_MS,
+      () => {
+        expiredCount += 1
+      },
+      NOW,
+      () => {},
+    )
+
+    expect(expiredCount).toBe(0)
+    expect(map.size).toBe(1) // the card stays live and tappable
+    expect(store.loadAll()).toHaveLength(1)
+  })
+})

package/telegram-plugin/tests/approval-card-stores.test.ts

@@ -0,0 +1,124 @@
+/**
+ * Race/ordering pins for the in-memory approval-card stores
+ * (gateway/approval-card-stores.ts) extracted in #2996 Phase 3 step 1.
+ *
+ * These lock the exact orderings the gateway's reaper + callback handlers +
+ * boot restore depend on, BEFORE the storage moved behind the store module:
+ *
+ *   1. verdict-during-sweep is single-shot — an operator tap (`.delete`) that
+ *      lands while the sweep is iterating fires the expiry synthetic AT MOST
+ *      once for a given card; a second sweep tick never double-wakes it.
+ *   2. verdict-during-restore is desync-free — a `.set` (restore) then a
+ *      `.delete` (tap) operate on one Map instance, so a tap can't resurrect a
+ *      restored entry nor a restore resurrect a tapped one.
+ *   3. sweep cadence/fault-isolation is byte-identical to the old inline
+ *      `sweepExpiredEntries(...)`: only past-TTL entries expire, and one
+ *      throwing expiry never skips the remaining entries.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  createSweepableCardStore,
+  type SweepableCardStore,
+} from '../gateway/approval-card-stores.js'
+
+interface Card {
+  staged_at: number
+  agent: string
+}
+
+const TTL = 1000
+
+function makeStore(
+  expire: (stageId: string, v: Card, now: number) => void,
+  log: (msg: string) => void = () => {},
+): SweepableCardStore<Card> {
+  return createSweepableCardStore<Card>({
+    isExpired: (v, now) => now - v.staged_at > TTL,
+    expire: () => expire,
+    log: () => log,
+  })
+}
+
+describe('approval-card-stores: sweep cadence', () => {
+  it('expires only entries past TTL', () => {
+    const expired: string[] = []
+    const store = makeStore((id) => {
+      expired.push(id)
+      store.delete(id) // mirror the gateway's expire.remove()
+    })
+    store.set('fresh', { staged_at: 5000, agent: 'a' })
+    store.set('stale', { staged_at: 1000, agent: 'b' })
+    store.sweep(5000) // fresh: 0ms old, stale: 4000ms old > TTL
+    expect(expired).toEqual(['stale'])
+    expect(store.has('fresh')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+
+  it('is single-shot across two reaper ticks (verdict-during-sweep safe)', () => {
+    const wakes: string[] = []
+    const store = makeStore((id) => {
+      // The pure expire core removes BEFORE the fallible wake; model that here.
+      store.delete(id)
+      wakes.push(id)
+    })
+    store.set('c1', { staged_at: 0, agent: 'a' })
+    store.sweep(5000)
+    store.sweep(5000) // second tick — entry already gone
+    expect(wakes).toEqual(['c1']) // exactly one wake, never two
+  })
+
+  it('a throwing expiry never skips the remaining entries', () => {
+    const seen: string[] = []
+    const store = makeStore((id) => {
+      seen.push(id)
+      if (id === 'boom') throw new Error('dead socket')
+      store.delete(id)
+    })
+    store.set('boom', { staged_at: 0, agent: 'a' })
+    store.set('ok', { staged_at: 0, agent: 'b' })
+    expect(() => store.sweep(5000)).not.toThrow()
+    expect(seen).toContain('boom')
+    expect(seen).toContain('ok')
+    expect(store.has('ok')).toBe(false) // 'ok' still expired despite 'boom' throwing
+  })
+})
+
+describe('approval-card-stores: verdict-during-restore desync-free', () => {
+  it('a tap after restore removes the restored entry (no resurrection)', () => {
+    const store = makeStore(() => {})
+    store.set('r1', { staged_at: 0, agent: 'a' }) // restore populates
+    expect(store.get('r1')).toBeDefined()
+    const removed = store.delete('r1') // operator tap resolves it
+    expect(removed).toBe(true)
+    expect(store.has('r1')).toBe(false)
+  })
+
+  it('a sweep after a tap on the same instance is a no-op for that card', () => {
+    const wakes: string[] = []
+    const store = makeStore((id) => {
+      store.delete(id)
+      wakes.push(id)
+    })
+    store.set('r2', { staged_at: 0, agent: 'a' })
+    store.delete('r2') // tap resolves before the reaper runs
+    store.sweep(5000)
+    expect(wakes).toEqual([]) // already resolved — no timeout wake
+  })
+})
+
+describe('approval-card-stores: Map surface parity', () => {
+  it('supports get/set/delete/has/size/iteration used by call sites', () => {
+    const store = makeStore(() => {})
+    store.set('a', { staged_at: 1, agent: 'x' })
+    store.set('b', { staged_at: 2, agent: 'y' })
+    expect(store.size).toBe(2)
+    expect(store.get('a')?.agent).toBe('x')
+    const seen: string[] = []
+    for (const [id] of store) seen.push(id)
+    expect(seen.sort()).toEqual(['a', 'b'])
+    expect([...store.values()].map((v) => v.agent).sort()).toEqual(['x', 'y'])
+    expect(store.delete('a')).toBe(true)
+    expect(store.has('a')).toBe(false)
+  })
+})

package/telegram-plugin/tests/boot-card-flood-suppress.test.ts

@@ -0,0 +1,111 @@
+/**
+ * #2923 — boot-card flood-wait suppression. When a Telegram per-bot flood ban
+ * is active, a restart's boot card is a NON-ESSENTIAL send straight into the
+ * open window that can reset/extend the ban. startBootCard must SKIP the send
+ * (and log) while the flood-wait is active, and post normally once it lifts.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { startBootCard } from '../gateway/boot-card.js'
+import type { BotApiForBootCard } from '../gateway/boot-card.js'
+import { computeFloodWait, writeFloodState, floodStatePath, makeFloodWaitRecorder } from '../flood-circuit-breaker.js'
+import { createRetryApiCall } from '../retry-api-call.js'
+import { errors } from './fake-bot-api.js'
+
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'boot-card-flood-'))
+})
+afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+function makeBot() {
+  const sends: string[] = []
+  const bot: BotApiForBootCard = {
+    sendMessage: async (chatId, _text, _opts) => {
+      sends.push(chatId)
+      return { message_id: 1001 }
+    },
+    editMessageText: async () => ({}),
+  }
+  return { bot, sends }
+}
+
+function mkOpts(floodPath: string, nowMs: number, overrides: Record<string, unknown> = {}) {
+  return {
+    agentName: 'TestAgent',
+    agentSlug: 'test-agent',
+    version: 'v0.0.0-test',
+    agentDir: dir,
+    gatewayInfo: { pid: 1, startedAtMs: nowMs },
+    restartReason: 'graceful' as const,
+    agentLiveWindowMs: 0,
+    settleWindowMs: 1_000_000,
+    floodStatePath: floodPath,
+    nowMs: () => nowMs,
+    ...overrides,
+  } as unknown as Parameters<typeof startBootCard>[3]
+}
+
+it('SUPPRESSES the boot card while a flood-wait is active', async () => {
+  const p = floodStatePath(dir)
+  const now = 1_000_000
+  writeFloodState(p, computeFloodWait(null, 68 * 60, now)) // ~68 min ban
+  const logs: string[] = []
+  const { bot, sends } = makeBot()
+  const handle = await startBootCard('chat1', undefined, bot, mkOpts(p, now), undefined, (l) =>
+    logs.push(l),
+  )
+  expect(sends).toEqual([]) // nothing sent into the open ban window
+  expect(handle.messageId).toBe(-1)
+  expect(logs.join('')).toMatch(/SUPPRESSED/)
+})
+
+it('POSTS the boot card once the flood-wait has lifted', async () => {
+  const p = floodStatePath(dir)
+  const banStart = 1_000_000
+  writeFloodState(p, computeFloodWait(null, 60, banStart))
+  const afterBan = banStart + 60_000 + 1
+  const { bot, sends } = makeBot()
+  await startBootCard('chat1', undefined, bot, mkOpts(p, afterBan), undefined, () => {})
+  expect(sends).toEqual(['chat1'])
+})
+
+it('POSTS normally when no flood state file exists (back-compat)', async () => {
+  const p = floodStatePath(dir) // never written
+  const { bot, sends } = makeBot()
+  await startBootCard('chat1', undefined, bot, mkOpts(p, 1_000_000), undefined, () => {})
+  expect(sends).toEqual(['chat1'])
+})
+
+it('INTEGRATION: a 429 through the real retry path suppresses a later boot card', async () => {
+  // Wire the two halves exactly as gateway.ts does: the retry wrapper's
+  // onFloodWait recorder and the boot card BOTH point at the same file.
+  const p = floodStatePath(dir)
+  const now = 5_000_000
+  const retry = createRetryApiCall({
+    sleep: async () => {}, // don't actually wait out the flood
+    onFloodWait: makeFloodWaitRecorder(p, () => now),
+  })
+
+  // Drive a real GrammyError 429 through the wrapper (first call floods, then
+  // succeeds) — this is what records the window on disk.
+  let n = 0
+  await retry(async () => {
+    if (n++ === 0) throw errors.floodWait(4116) // ~68 min ban
+    return 'ok'
+  })
+
+  // Now a restart's boot card must be suppressed via the SAME file.
+  const { bot, sends } = makeBot()
+  const logs: string[] = []
+  const handle = await startBootCard('chat1', undefined, bot, mkOpts(p, now), undefined, (l) =>
+    logs.push(l),
+  )
+  expect(sends).toEqual([]) // not posted into the open ban window
+  expect(handle.messageId).toBe(-1)
+  expect(logs.join('')).toMatch(/SUPPRESSED/)
+})

package/telegram-plugin/tests/busy-ack-wiring.test.ts

@@ -0,0 +1,118 @@
+/**
+ * #2995 — mid-flight busy ack: gateway wiring guards.
+ *
+ * The gateway IIFE is too entangled to instantiate in-process, so these
+ * are source-level assertions (the established pattern —
+ * multitopic-routing-wiring.test.ts, buffer-gate-broadened.test.ts). They
+ * pin the load-bearing wiring: the buffered-inbound and steer call sites,
+ * the silent send, the shared queuedStatusMsgIds lifecycle (promote/reap
+ * cleanup for free), the per-turn dedupe reset, and the kill switch. The
+ * POLICY and the rendered text are behaviourally tested in
+ * busy-ack.test.ts; the live end-to-end shape in
+ * uat/scenarios/jtbd-midflight-busy-ack-dm.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const gatewaySrc = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
+  'utf-8',
+)
+
+describe('#2995 mid-flight busy ack — gateway wiring', () => {
+  it('the buffer-until-idle branch calls maybePostBusyAck for the inbound own chat/topic', () => {
+    expect(gatewaySrc).toMatch(
+      /maybePostBusyAck\('buffer-until-idle', chat_id, messageThreadId \?\? undefined\)/,
+    )
+    // …AFTER the pendingInboundBuffer.push (the ack narrates a real queue).
+    const branch = gatewaySrc.split("deliveryGate.decision === 'buffer-until-idle'")[1] ?? ''
+    const pushIdx = branch.indexOf('pendingInboundBuffer.push(selfAgent, inboundMsg)')
+    const ackIdx = branch.indexOf("maybePostBusyAck('buffer-until-idle'")
+    expect(pushIdx).toBeGreaterThanOrEqual(0)
+    expect(ackIdx).toBeGreaterThan(pushIdx)
+  })
+
+  it('cross-topic queued status and the busy ack are mutually exclusive (no double-card race)', () => {
+    // Both helpers record into queuedStatusMsgIds only AFTER their
+    // sendMessage awaits resolve, so calling both in the same handler pass
+    // would race past each other's has(key) check and double-card the
+    // topic. The buffer branch must pick exactly one.
+    expect(gatewaySrc).toMatch(
+      /if \(crossTopicQueuedCard\) \{\s*postQueuedStatus\(chat_id, messageThreadId, inFlightThread\)\s*\} else \{/,
+    )
+  })
+
+  it('a mid-turn steer gets the steer-worded variant only AFTER successful bridge dispatch', () => {
+    // A "Steer noted" card for a send that missed (bridge offline) would
+    // be untrue — the ack lives inside the `if (delivered)` branch.
+    expect(gatewaySrc).toMatch(
+      /if \(delivered\) \{[\s\S]{0,700}if \(isSteering\) \{\s*maybePostBusyAck\('steer', chat_id, messageThreadId \?\? undefined\)/,
+    )
+  })
+
+  it('an under-threshold miss arms ONE deferred re-check pinned to the running turn', () => {
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    // Armed only for the young-step miss, for the remaining age gap.
+    expect(fn).toMatch(/stepAgeMs < BUSY_ACK_STEP_AGE_THRESHOLD_MS &&\s*!busyAckRecheckTimers\.has\(key\)/)
+    expect(fn).toMatch(/BUSY_ACK_STEP_AGE_THRESHOLD_MS - stepAgeMs \+ 250/)
+    // The re-fire is guarded on the SAME turn still running.
+    expect(fn).toMatch(/currentTurn\?\.turnId !== turnIdAtSchedule\) return/)
+    // A posted card cancels the pending re-check.
+    expect(fn).toMatch(/clearTimeout\(pendingRecheck\)/)
+  })
+
+  it('the decision is fed from live tool-flight + step-age readings (pure module owns policy)', () => {
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/shouldPostBusyAck\(\{ gateDecision, midToolCall, stepAgeMs, alreadyAcked \}\)/)
+    expect(fn).toMatch(/const midToolCall = toolFlightTracker\.isMidToolCall\(\)/)
+    expect(fn).toMatch(/silencePoke\.longestInFlightTool\(/)
+    expect(fn).toMatch(/const stepAgeMs = step\?\.durationMs \?\? null/)
+  })
+
+  it('dedupe: alreadyAcked couples the live card map AND the per-turn key set', () => {
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(
+      /const alreadyAcked = queuedStatusMsgIds\.has\(key\) \|\| busyAckPostedKeys\.has\(key\)/,
+    )
+    expect(fn).toMatch(/busyAckPostedKeys\.add\(key\)/)
+  })
+
+  it('the card is sent SILENT (disable_notification: true) through the swallowing wrapper', () => {
+    const fn = gatewaySrc.split('function postBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/swallowingApiCall\(/)
+    expect(fn).toMatch(/disable_notification: true/)
+    // Thread-optional: a DM send must NOT pass message_thread_id.
+    expect(fn).toMatch(/\.\.\.\(threadId != null \? \{ message_thread_id: threadId \} : \{\}\)/)
+  })
+
+  it('the card shares queuedStatusMsgIds — promote/reap lifecycle cleans it up', () => {
+    const fn = gatewaySrc.split('function postBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    // Idempotent against the shared key (never stacks on the cross-topic card).
+    expect(fn).toMatch(/if \(queuedStatusMsgIds\.has\(key\)\) return/)
+    expect(fn).toMatch(/queuedStatusMsgIds\.set\(key, \{ chatId, threadId: threadId \?\? null, messageId \}\)/)
+    // Post-race orphan cleanup, same pattern as postQueuedStatus.
+    expect(fn).toMatch(/busy-ack\.post-race-cleanup/)
+  })
+
+  it('turn-end cleanup is PER-KEY: dedupe entry deleted and re-check timer cancelled for the ending turn only', () => {
+    const purge = gatewaySrc.split('function purgeReactionTracking')[1]?.split('\nfunction ')[0] ?? ''
+    // Per-key delete — a purge for topic A must not reset topic B's dedupe.
+    expect(purge).toMatch(/busyAckPostedKeys\.delete\(key\)/)
+    expect(purge).not.toMatch(/busyAckPostedKeys\.clear\(\)/)
+    expect(purge).toMatch(/busyAckRecheckTimers\.delete\(key\)/)
+    expect(purge).toMatch(/clearTimeout\(busyAckRecheck\)/)
+  })
+
+  it('DM cards are promoted too (promoteQueuedStatus no longer early-returns on a null thread)', () => {
+    const fn = gatewaySrc.split('function promoteQueuedStatus')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).not.toMatch(/if \(thread == null\) return/)
+  })
+
+  it('kill switch defaults ON, independently disableable', () => {
+    expect(gatewaySrc).toMatch(/SWITCHROOM_MIDFLIGHT_BUSY_ACK !== '0'/)
+    const fn = gatewaySrc.split('function maybePostBusyAck')[1]?.split('\nfunction ')[0] ?? ''
+    expect(fn).toMatch(/if \(!MIDFLIGHT_BUSY_ACK_ENABLED\) return/)
+  })
+})