switchroom 0.18.8 → 0.18.10

package/telegram-plugin/tests/chat-lock-unhandled-rejection.test.ts

@@ -0,0 +1,101 @@
+/**
+ * Regression test for the #klanker 2026-07-10 gateway crash.
+ *
+ * A `sendPhoto` that failed with PHOTO_INVALID_DIMENSIONS took the WHOLE
+ * gateway down with an `unhandledRejection`, even though the reply-tool
+ * call site `await`s the send and `onToolCall` wraps it in try/catch.
+ *
+ * Root cause was in `chat-lock.ts`'s `run()`: it stores a SECOND promise
+ * (`tracked = next.finally(...)`) in the per-key chain map and returns the
+ * separate `next` to the caller. The caller handles `next`'s rejection, but
+ * `tracked` — which rejects with the same reason — is only ever handled by
+ * the NEXT queued call chaining onto it. On the TAIL call of a lane (the
+ * common single-reply case) nothing attaches a handler to `tracked`, so its
+ * rejection escapes as an `unhandledRejection` and crashes the process.
+ *
+ * These tests assert:
+ *   1. a rejecting TAIL call does NOT emit an `unhandledRejection`, and
+ *   2. the caller STILL receives the real error (so error handling / the
+ *      photo→document fallback still runs).
+ */
+
+import { describe, it, expect } from 'vitest'
+import { createChatLock } from '../chat-lock.js'
+
+/** Run `body`, capturing any process-level unhandledRejection during it. */
+async function captureUnhandledRejections(
+  body: () => Promise<void>,
+): Promise<unknown[]> {
+  const seen: unknown[] = []
+  const onUnhandled = (reason: unknown) => { seen.push(reason) }
+  process.on('unhandledRejection', onUnhandled)
+  try {
+    await body()
+    // Let any orphaned rejections surface: unhandledRejection fires on a
+    // later microtask/macrotask tick, so flush both.
+    await new Promise((r) => setTimeout(r, 0))
+    await Promise.resolve()
+  } finally {
+    process.off('unhandledRejection', onUnhandled)
+  }
+  return seen
+}
+
+describe('chat-lock run() — tail-call rejection safety', () => {
+  it('does NOT emit an unhandledRejection when the tail call rejects', async () => {
+    const boom = new Error('PHOTO_INVALID_DIMENSIONS')
+    const unhandled = await captureUnhandledRejections(async () => {
+      const lock = createChatLock()
+      // Single call on this key → it IS the tail. Caller handles the error.
+      await expect(lock.run('chat:1', () => Promise.reject(boom))).rejects.toBe(boom)
+    })
+    expect(unhandled).toEqual([])
+  })
+
+  it('still surfaces the real error to the caller', async () => {
+    const lock = createChatLock()
+    const boom = new Error('boom')
+    await expect(lock.run('k', () => Promise.reject(boom))).rejects.toBe(boom)
+  })
+
+  it('is quiet even when the failing call is the last of a burst', async () => {
+    const boom = new Error('PHOTO_INVALID_DIMENSIONS')
+    const unhandled = await captureUnhandledRejections(async () => {
+      const lock = createChatLock()
+      // First call succeeds, second (tail) rejects — mirrors the incident:
+      // a document then a photo on the same (chat,thread) lane.
+      const okP = lock.run('chat:9', () => Promise.resolve('doc-sent'))
+      const failP = lock.run('chat:9', () => Promise.reject(boom))
+      await expect(okP).resolves.toBe('doc-sent')
+      await expect(failP).rejects.toBe(boom)
+    })
+    expect(unhandled).toEqual([])
+  })
+
+  it('one failure does not poison later work on the same key', async () => {
+    const lock = createChatLock()
+    await expect(lock.run('k2', () => Promise.reject(new Error('x')))).rejects.toThrow('x')
+    // A subsequent call on the same key must still run and resolve.
+    await expect(lock.run('k2', () => Promise.resolve('ok'))).resolves.toBe('ok')
+  })
+
+  it('wrapBot surfaces a bot.api rejection without crashing (tail call)', async () => {
+    const boom = new Error('PHOTO_INVALID_DIMENSIONS')
+    const unhandled = await captureUnhandledRejections(async () => {
+      const lock = createChatLock()
+      const bot = {
+        api: {
+          sendPhoto: (_chatId: string, _file: unknown, _opts?: unknown) =>
+            Promise.reject(boom),
+        },
+      }
+      const wrapped = lock.wrapBot(bot)
+      await expect(
+        (wrapped.api.sendPhoto as (c: string, f: unknown, o?: unknown) => Promise<unknown>)(
+          '123', {}, {},
+        ),
+      ).rejects.toBe(boom)
+    })
+    expect(unhandled).toEqual([])
+  })
+})

package/telegram-plugin/tests/crash-breadcrumb.test.ts

@@ -0,0 +1,57 @@
+/**
+ * Pins the #3033 bridge crash-breadcrumb contract: uncaughtException /
+ * unhandledRejection in the bridge process persist a bounded, greppable
+ * line to bridge-crash.log (Claude Code drops MCP stderr after startup,
+ * so this file is the only durable trace of why a bridge died).
+ */
+
+import { describe, it, expect } from 'vitest'
+import { mkdtempSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { appendCrashBreadcrumb } from '../bridge/crash-breadcrumb.js'
+
+function tmpLog(): string {
+  return join(mkdtempSync(join(tmpdir(), 'crash-bc-')), 'bridge-crash.log')
+}
+
+describe('appendCrashBreadcrumb', () => {
+  it('appends a single line with kind, pid and folded stack', () => {
+    const log = tmpLog()
+    const err = new Error('boom')
+    appendCrashBreadcrumb(log, 'uncaughtException', err, new Date('2026-07-11T01:40:59Z'))
+    const content = readFileSync(log, 'utf8')
+    const lines = content.trimEnd().split('\n')
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('2026-07-11T01:40:59')
+    expect(lines[0]).toContain('uncaughtException')
+    expect(lines[0]).toContain(`pid=${process.pid}`)
+    expect(lines[0]).toContain('Error: boom')
+    expect(lines[0]).not.toContain('\n')
+  })
+
+  it('handles non-Error rejections and appends across calls', () => {
+    const log = tmpLog()
+    appendCrashBreadcrumb(log, 'unhandledRejection', 'string reason')
+    appendCrashBreadcrumb(log, 'unhandledRejection', { odd: true })
+    const lines = readFileSync(log, 'utf8').trimEnd().split('\n')
+    expect(lines).toHaveLength(2)
+    expect(lines[0]).toContain('string reason')
+  })
+
+  it('rotates once past the size cap instead of growing unbounded', () => {
+    const log = tmpLog()
+    writeFileSync(log, 'x'.repeat(1024 * 1024 + 1))
+    appendCrashBreadcrumb(log, 'uncaughtException', new Error('after rotation'))
+    expect(existsSync(`${log}.1`)).toBe(true)
+    const content = readFileSync(log, 'utf8')
+    expect(content).toContain('after rotation')
+    expect(content.length).toBeLessThan(5000)
+  })
+
+  it('never throws when the path is unwritable', () => {
+    expect(() =>
+      appendCrashBreadcrumb('/nonexistent-dir-xyz/bridge-crash.log', 'uncaughtException', new Error('x')),
+    ).not.toThrow()
+  })
+})

package/telegram-plugin/tests/effort-command.test.ts

@@ -107,7 +107,7 @@ describe("effort-command: handler", () => {
     const { deps } = makeDeps({ getConfiguredEffort: () => "medium" });
     const r = await handleEffortCommand({ kind: "show" }, deps);
     expect(r.text).toContain("medium");
-    expect(r.text).toMatch(/reverts to the configured default/);
+    expect(r.text).toMatch(/persists across restarts and deploys/);
   });
 
   it("show falls back to low when effort is unreadable", async () => {
@@ -121,7 +121,7 @@ describe("effort-command: handler", () => {
     const r = await handleEffortCommand({ kind: "set", level: "high" }, deps);
     expect(calls).toEqual([{ agent: "carrie", level: "high" }]);
     expect(r.text).toContain("Set effort level to high");
-    expect(r.text).toMatch(/reverts to the configured default/);
+    expect(r.text).toMatch(/persists across restarts and deploys/);
   });
 
   it("set notes the re-read cost when a confirmation was needed", async () => {
@@ -198,3 +198,60 @@ describe("effort-command: menu + callback", () => {
     expect(out.selectedEffort).toBeUndefined();
   });
 });
+
+// ─── #3039: /effort default + durable-override surfaces ─────────────────────
+
+describe("effort-command: /effort default (#3039)", () => {
+  it("parses `/effort default` as an explicit clear", () => {
+    expect(parseEffortCommand("/effort default")).toEqual({ kind: "default" });
+    expect(parseEffortCommand("/effort DEFAULT")).toEqual({ kind: "default" });
+  });
+
+  it("default restores the configured level, THEN clears the durable override (order pins the wrapper undo)", async () => {
+    const events: string[] = [];
+    const { deps } = makeDeps({
+      getConfiguredEffort: () => "medium",
+      applyEffort: async (_a, level) => {
+        events.push(`apply:${level}`);
+        return applyOk(level);
+      },
+      clearSessionEffort: () => events.push("clear"),
+    });
+    const r = await handleEffortCommand({ kind: "default" }, deps);
+    expect(events).toEqual(["apply:medium", "clear"]);
+    expect(r.text).toContain("override cleared");
+    expect(r.text).toContain("`medium`");
+  });
+
+  it("default still clears the override when the live apply fails (boots on default from now on)", async () => {
+    let cleared = false;
+    const { deps } = makeDeps({
+      applyEffort: async () => applyFail("apply_unverified"),
+      clearSessionEffort: () => { cleared = true; },
+    });
+    const r = await handleEffortCommand({ kind: "default" }, deps);
+    expect(cleared).toBe(true);
+    expect(r.text).toContain("override cleared");
+    // Honest: does not claim the live session switched.
+    expect(r.text).toContain("Couldn't switch the live session right now");
+  });
+
+  it("show surfaces an active session override next to the configured default", async () => {
+    const { deps } = makeDeps({ getConfiguredEffort: () => "low", getSessionEffort: () => "xhigh" });
+    const r = await handleEffortCommand({ kind: "show" }, deps);
+    expect(r.text).toContain("session override: `xhigh`");
+  });
+
+  it("menu marks the durable override as the live level", () => {
+    const { deps } = makeDeps({ getConfiguredEffort: () => "low", getSessionEffort: () => "max" });
+    const menu = buildEffortMenu(deps);
+    const marked = menu.keyboard!.flat().find((b) => b.text.startsWith("✅"));
+    expect(marked?.text).toBe("✅ max");
+  });
+
+  it("help text advertises /effort default and the sticky contract", async () => {
+    const r = await handleEffortCommand({ kind: "help" }, makeDeps().deps);
+    expect(r.text).toContain("/effort default");
+    expect(r.text).toContain("persists across restarts and deploys");
+  });
+});

package/telegram-plugin/tests/emission-determinism-wiring.test.ts

@@ -131,10 +131,17 @@ describe('lever 2 — finalize the card BEFORE a substantive reply send', () =>
     return after.split('\nasync function ')[0]?.split('\nfunction ')[0] ?? after
   }
 
-  it('executeReply finalizes (clearActivitySummary) before the chunk loop, gated on substantive', () => {
+  // #2996 step 1: the chunk send loop was relocated verbatim from executeReply
+  // into outbound-send-path.ts's `sendReplyChunks`, invoked here as
+  // `await sendReplyChunks(chunkSendDeps, …)`. This guard's INTENT — the
+  // lever-2 card finalize runs BEFORE the reply send — is unchanged; the send
+  // marker is now the delegation call rather than the inline `for` loop.
+  const SEND_MARKER = 'sendReplyChunks('
+
+  it('executeReply finalizes (clearActivitySummary) before the reply send, gated on substantive', () => {
     const src = executeReplySrc()
     const clearIdx = src.indexOf('clearActivitySummary(')
-    const loopIdx = src.indexOf('for (let i = 0; i < chunks.length')
+    const loopIdx = src.indexOf(SEND_MARKER)
     expect(clearIdx).toBeGreaterThan(-1)
     expect(loopIdx).toBeGreaterThan(-1)
     expect(clearIdx).toBeLessThan(loopIdx)
@@ -148,8 +155,8 @@ describe('lever 2 — finalize the card BEFORE a substantive reply send', () =>
     // An ack (non-substantive) falls through and never finalizes early, so the
     // reopen path keeps owning the card (the #2141 ack-then-work feed).
     const replySrc = executeReplySrc()
-    // The pre-loop clearActivitySummary must be the substantive-gated one.
-    const preLoop = replySrc.split('for (let i = 0; i < chunks.length')[0] ?? ''
+    // The pre-send clearActivitySummary must be the substantive-gated one.
+    const preLoop = replySrc.split(SEND_MARKER)[0] ?? ''
     const clears = [...preLoop.matchAll(/clearActivitySummary\(/g)]
     expect(clears).toHaveLength(1)
   })

package/telegram-plugin/tests/fallback-card-collapse.test.ts

@@ -0,0 +1,104 @@
+/**
+ * #3031 PR 3 — reactive-path message collapse.
+ *
+ * The model-unavailable card is deliberately sent BEFORE the fallback
+ * outcome is known; on a SUCCESSFUL swap the announcement is folded into an
+ * EDIT of that card (single evolving card). CRITICAL promise-honesty
+ * constraint (2026-06-06→07 incident): every failure / no-op path must still
+ * deliver a SEPARATE message — these tests pin that the collapse decision
+ * can never eat a failure notice.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  createModelUnavailableCardRegistry,
+  decideAnnouncementDelivery,
+  foldAnnouncementIntoCard,
+  CARD_COLLAPSE_MAX_AGE_MS,
+  type ModelUnavailableCardRecord,
+  type FallbackDeliveryOutcomeKind,
+} from "../fallback-card-collapse.js";
+
+const NOW = 1_780_000_000_000;
+
+function rec(overrides: Partial<ModelUnavailableCardRecord> = {}): ModelUnavailableCardRecord {
+  return {
+    messageId: 4242,
+    text: "⚠️ Model unavailable — auto-failover in progress",
+    atMs: NOW - 5_000,
+    promisedFallback: true,
+    ...overrides,
+  };
+}
+
+describe("createModelUnavailableCardRegistry", () => {
+  it("take returns a fresh fallback-promising card exactly once (one edit per card)", () => {
+    const reg = createModelUnavailableCardRegistry();
+    reg.record("123", rec());
+    const first = reg.take("123", NOW);
+    expect(first?.messageId).toBe(4242);
+    // One-shot: a second take finds nothing (a card absorbs one announcement).
+    expect(reg.take("123", NOW)).toBeNull();
+    expect(reg.size()).toBe(0);
+  });
+
+  it("a stale card is not editable (belongs to a previous incident) and is cleared", () => {
+    const reg = createModelUnavailableCardRegistry();
+    reg.record("123", rec({ atMs: NOW - CARD_COLLAPSE_MAX_AGE_MS - 1 }));
+    expect(reg.take("123", NOW)).toBeNull();
+    expect(reg.size()).toBe(0);
+  });
+
+  it("a card that never promised auto-failover never absorbs the announcement", () => {
+    const reg = createModelUnavailableCardRegistry();
+    reg.record("123", rec({ promisedFallback: false }));
+    expect(reg.take("123", NOW)).toBeNull();
+  });
+
+  it("cards are per-chat: taking one chat's card leaves the other's intact", () => {
+    const reg = createModelUnavailableCardRegistry();
+    reg.record("123", rec({ messageId: 1 }));
+    reg.record("456", rec({ messageId: 2 }));
+    expect(reg.take("123", NOW)?.messageId).toBe(1);
+    expect(reg.take("456", NOW)?.messageId).toBe(2);
+  });
+
+  it("a newer card replaces the prior record for the same chat", () => {
+    const reg = createModelUnavailableCardRegistry();
+    reg.record("123", rec({ messageId: 1 }));
+    reg.record("123", rec({ messageId: 2 }));
+    expect(reg.take("123", NOW)?.messageId).toBe(2);
+  });
+});
+
+describe("decideAnnouncementDelivery — promise-honesty on every error path", () => {
+  it("edits ONLY on a successful swap with a fresh promising card", () => {
+    expect(decideAnnouncementDelivery("switched", rec())).toBe("edit");
+  });
+
+  it("sends separately on a successful swap when no card was recorded (e.g. card-less quota_wall_detected trigger)", () => {
+    expect(decideAnnouncementDelivery("switched", null)).toBe("send");
+  });
+
+  it("EVERY failure / no-op outcome is a separate send — even with a fresh card on record", () => {
+    const failureKinds: FallbackDeliveryOutcomeKind[] = [
+      "all-blocked",
+      "no-old-active",
+      "no-eligible-target",
+      "error",
+    ];
+    for (const kind of failureKinds) {
+      expect(decideAnnouncementDelivery(kind, rec()), `kind=${kind}`).toBe("send");
+      expect(decideAnnouncementDelivery(kind, null), `kind=${kind} (no card)`).toBe("send");
+    }
+  });
+});
+
+describe("foldAnnouncementIntoCard", () => {
+  it("keeps the original card text and appends the announcement (single evolving card)", () => {
+    const folded = foldAnnouncementIntoCard("CARD", "ANNOUNCEMENT");
+    expect(folded.startsWith("CARD")).toBe(true);
+    expect(folded).toContain("ANNOUNCEMENT");
+    expect(folded.indexOf("CARD")).toBeLessThan(folded.indexOf("ANNOUNCEMENT"));
+  });
+});

package/telegram-plugin/tests/fixtures/cutover-killswitch-probe.ts

@@ -0,0 +1,75 @@
+/**
+ * Subprocess probe for the SWITCHROOM_DELIVERY_MACHINE_CUTOVER kill switch.
+ *
+ * The cutover env var is read at MODULE LOAD in both
+ * `inbound-delivery-machine-dispatch.ts` and
+ * `inbound-delivery-machine-shadow.ts`, so an in-process test can't flip it
+ * after import (and bun's `vi` shim has no resetModules/stubEnv). The
+ * cutover-flip test spawns this script under `bun` with the env it wants
+ * and asserts the JSON verdict printed on stdout.
+ *
+ * Output: one JSON line —
+ *   {
+ *     dispatchEnabled, cutoverEnabled, shadowEnabled,
+ *     sendCalls, buffered, setTurnStartedCalls, deliverResults
+ *   }
+ * after driving a fresh-turn inbound effect set through dispatchEffects
+ * against a recording fake ctx.
+ */
+
+import { dispatchEffects, isDispatchEnabled } from '../../gateway/inbound-delivery-machine-dispatch'
+import {
+  isDeliveryCutoverEnabled,
+  __shadowEnabledForTests,
+} from '../../gateway/inbound-delivery-machine-shadow'
+import { createPendingInboundBuffer } from '../../gateway/pending-inbound-buffer'
+import { createPendingPermissionBuffer } from '../../gateway/pending-permission-decisions'
+import { initialState, transition, type ChatKey } from '../../gateway/inbound-delivery-machine'
+
+const KEY = '111:_' as ChatKey
+const msg = { type: 'inbound', chatId: '111', messageId: 42, text: 'hello' }
+
+const alive = transition(initialState(), { kind: 'bridgeUp', at: 1000 }).state
+const { effects } = transition(alive, {
+  kind: 'inbound',
+  key: KEY,
+  msg: { msgId: 42, isSteering: false, payload: msg },
+  at: 2000,
+})
+
+let sendCalls = 0
+const buffer = createPendingInboundBuffer()
+let setTurnStartedCalls = 0
+const deliverResults: boolean[] = []
+
+dispatchEffects(effects, {
+  selfAgent: 'probe-agent',
+  ipcServer: {
+    sendToAgent: () => {
+      sendCalls++
+      return true
+    },
+  } as never,
+  pendingInboundBuffer: buffer,
+  inboundSpool: null,
+  pendingPermissionBuffer: createPendingPermissionBuffer(),
+  log: () => {},
+  onSetTurnStarted: () => {
+    setTurnStartedCalls++
+  },
+  onDeliverResult: (_k, ok) => {
+    deliverResults.push(ok)
+  },
+})
+
+process.stdout.write(
+  JSON.stringify({
+    dispatchEnabled: isDispatchEnabled(),
+    cutoverEnabled: isDeliveryCutoverEnabled(),
+    shadowEnabled: __shadowEnabledForTests(),
+    sendCalls,
+    buffered: buffer.drain('probe-agent').length,
+    setTurnStartedCalls,
+    deliverResults,
+  }) + '\n',
+)

package/telegram-plugin/tests/gateway-outbound-redact.test.ts

@@ -35,8 +35,12 @@ describe('gateway outbound secret-scrub — structural wiring', () => {
   })
 
   it('reply: scrubs at entry, before the stderr preview log', () => {
+    // #2996: the entry pipeline (normalize → redact → punctuation/bold →
+    // voice-scrub) is extracted into outbound-send-path.ts. The reply path now
+    // delegates via `normalizeOutboundBody(rawText, 'reply', redactOutboundText)`
+    // — the injected redactor still runs at entry, before the stderr preview.
     const start = src.indexOf('async function executeReply(')
-    const redactIdx = src.indexOf(`redactOutboundText(text, 'reply')`, start)
+    const redactIdx = src.indexOf(`normalizeOutboundBody(rawText, 'reply', redactOutboundText)`, start)
     const previewIdx = src.indexOf('reply: invoked chatId=', start)
     expect(start).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(start)

package/telegram-plugin/tests/gateway-pending-command-wiring.test.ts

@@ -0,0 +1,124 @@
+/**
+ * Structural pins for the #3018 fixes to the mid-turn ack-queue-apply-confirm
+ * wiring in gateway.ts (/model + /effort, #3017).
+ *
+ * The behaviour lives in un-exported inline closures (the pendingStateReaper
+ * interval, enqueueSessionCommand, drainPendingSessionCommand, and the
+ * shutdown() handler), so — mirroring gateway-session-model-relaunch.test.ts —
+ * we assert on the source structure. The pure contract (per-kind slots,
+ * drainCapDecision, shutdownResolutionActions) is unit-tested in
+ * pending-session-command.test.ts.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+describe('gateway: reaper drain-cap defers while a turn is in flight (#3018 finding 1)', () => {
+  it('feeds turnInFlightForGate() into drainCapDecision and only forces on the force branch', () => {
+    const idx = GATEWAY_SRC.indexOf('pendingCmdDrainCapDecision(')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 1200)
+    // The decision reads the live turn gate…
+    expect(win).toContain('turnInFlightForGate()')
+    // …has an explicit defer branch that does NOT drain…
+    const deferIdx = win.indexOf("'defer-turn-in-flight'")
+    expect(deferIdx).toBeGreaterThan(0)
+    const forceIdx = win.indexOf("cmdDecision === 'force'")
+    expect(forceIdx).toBeGreaterThan(deferIdx)
+    // …and the ONLY drain call in the reaper block sits after the force check.
+    const drainIdx = win.indexOf('void drainPendingSessionCommand()')
+    expect(drainIdx).toBeGreaterThan(forceIdx)
+    expect(win.slice(0, forceIdx)).not.toContain('drainPendingSessionCommand()')
+  })
+})
+
+describe('gateway: post-enqueue idle kick (#3018 finding 5)', () => {
+  it('enqueueSessionCommand drains immediately when the session went idle between the busy check and the enqueue', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('function enqueueSessionCommand(')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 1500)
+    expect(win).toContain('if (!turnInFlightForGate()) void drainPendingSessionCommand()')
+  })
+})
+
+describe('gateway: shutdown resolves queued ack cards (#3018 finding 3)', () => {
+  it('shutdown() empties the slots via shutdownResolutionActions, PERSISTS each typed choice, and edits each card, before the force-exit timer', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('async function shutdown(signal: string)')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, GATEWAY_SRC.indexOf('forceExitTimer', fnIdx))
+    const resolveIdx = win.indexOf('pendingCmdShutdownResolutionActions(pendingSessionCommand')
+    expect(resolveIdx).toBeGreaterThan(0)
+    // #3039: the queued choice is carried across the bounce via the durable
+    // carriers, not dropped with a "re-issue" note.
+    expect(win.indexOf('persistQueuedCommandForRestart(', resolveIdx)).toBeGreaterThan(resolveIdx)
+    expect(win.indexOf('editPendingCommandCard(', resolveIdx)).toBeGreaterThan(resolveIdx)
+    // Bounded: raced against a timeout so a wedged Telegram API can't block shutdown.
+    expect(win.slice(resolveIdx)).toContain('Promise.race')
+  })
+})
+
+describe('gateway: drain never confirms a busy refusal and never drops the batch (#3039, #3042 blocker 1)', () => {
+  it('drainPendingSessionCommand routes takeAll() through the unit-tested drainTakenCommands with the loss-safe IO', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('async function drainPendingSessionCommand(')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 3000)
+    // Iteration + loss-safety invariants live in pending-session-command.ts
+    // (drainTakenCommands, functionally tested); the gateway only supplies IO.
+    expect(win).toContain('pendingCmdDrainTaken(pendingSessionCommand.takeAll()')
+    expect(win).toContain('turnInFlightForGate()')
+    expect(win).toContain('isBusyRefusal: isBusyRefusalText')
+    expect(win).toContain('reEnqueue: reEnqueueUnlessSuperseded')
+    // The pending-restart branch persists rather than telling the user to re-issue.
+    expect(win).toContain('pendingCmdResolveForRestart(cmd')
+    expect(win).toContain('persistQueuedCommandForRestart(')
+  })
+})
+
+describe('gateway: unconfirmed queued model tokens are gated before durable persist (#3042 blocker 2a)', () => {
+  it('persistQueuedCommandForRestart refuses offline-unverifiable tokens', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('function persistQueuedCommandForRestart(')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 2500)
+    expect(win).toContain('isOfflineTrustedModelToken(action.arg)')
+    expect(win).toContain('NOT saved')
+  })
+})
+
+describe('gateway: /restart keeps the session-model override (#3039)', () => {
+  it('the /restart chat command stamps keep, never revert', () => {
+    expect(GATEWAY_SRC).toContain("writeRelaunchModelIntent(smDir, 'keep', 'user: /restart from chat')")
+    expect(GATEWAY_SRC).not.toContain("writeRelaunchModelIntent(smDir, 'revert'")
+  })
+})
+
+describe('gateway: /effort persistence choke point (#3039)', () => {
+  it('buildEffortDeps persists a confirmed apply to .session-effort and wires clearSessionEffort', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('function buildEffortDeps(')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 2500)
+    expect(win).toContain('writeSessionEffortFile(')
+    expect(win).toContain('clearSessionEffortFile(')
+    expect(win).toContain('readSessionEffortFile(')
+  })
+})
+
+describe('gateway: keep-intent stamp narrowing (#3018 finding 4)', () => {
+  it('the shutdown keep-intent stamp carries the gateway-shutdown reason prefix', () => {
+    expect(GATEWAY_SRC).toContain(
+      "writeRelaunchModelIntent(smDir, 'keep', `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful ${signal} shutdown",
+    )
+  })
+
+  it('boot clears a stale gateway-shutdown-stamped intent (gateway-only bounce never runs start.sh)', () => {
+    const idx = GATEWAY_SRC.indexOf('clearStaleGatewayShutdownIntent(bootSmDir)')
+    expect(idx).toBeGreaterThan(0)
+    // The cleanup runs at module top-level (gateway boot), BEFORE the shutdown
+    // handler could stamp a fresh one for THIS process's own exit.
+    expect(idx).toBeLessThan(GATEWAY_SRC.indexOf('async function shutdown(signal: string)'))
+  })
+})

package/telegram-plugin/tests/gateway-secret-detect.test.ts

@@ -128,8 +128,14 @@ describe('gateway secret-detect intercept — structural wiring', () => {
   })
 
   it('staging follow-up commands (stash/ignore/rename/forget) are wired', () => {
+    // Guarded property: the staging follow-up parser lives INSIDE
+    // handleInbound (so it runs on the inbound-text path, gated by the same
+    // allowFrom check). The window is a generous bound on handleInbound's
+    // pre-staging body, not a precise offset — it has grown before (#3020's
+    // stop-keyword block pushed it past the old 30k) and may grow again;
+    // bump it when new early-return branches land above the staging block.
     const handleInboundIdx = src.indexOf('async function handleInbound(')
-    const tail = src.slice(handleInboundIdx, handleInboundIdx + 30000)
+    const tail = src.slice(handleInboundIdx, handleInboundIdx + 50000)
     expect(tail).toMatch(/\(stash\|ignore\|rename\|forget\)/)
     expect(tail).toMatch(/secretStaging\.latestForChat\(chat_id\)/)
   })