switchroom 0.19.1 → 0.19.3

package/telegram-plugin/tests/session-model-source.test.ts

@@ -10,6 +10,8 @@
  */
 import { describe, it, expect } from 'vitest'
 import { createSessionModelSource } from '../gateway/session-model-source.js'
+import type { SessionModelDivergence } from '../gateway/session-model-source.js'
+import { servedModelMatchesRequested } from '../gateway/model-command.js'
 
 describe('createSessionModelSource — freshest observation wins', () => {
   it('returns null when neither source has reported', () => {
@@ -76,3 +78,143 @@ describe('createSessionModelSource — freshest observation wins', () => {
     expect(s.getOverride()).toBe('sr-glm-5')
   })
 })
+
+// ── #3427 item 4: requested-vs-served divergence tripwire ────────────────────
+//
+// `--fallback-model` masks an invalid requested id: the override carries the
+// requested token while claude silently serves the fallback. The FIRST live
+// transcript observation of the post-relaunch session is the earliest
+// deterministic verification point — these assert the handler FIRES on a
+// mismatch (with the right payload), fires at most once per armed override,
+// and — the #3437 H1/H2 false-positive contract — NEVER fires from a
+// command-time (unarmed) override set or from a first-attach replay line.
+
+describe('createSessionModelSource — divergence tripwire (#3427)', () => {
+  function armed() {
+    const fired: SessionModelDivergence[] = []
+    const s = createSessionModelSource({ servedMatchesRequested: servedModelMatchesRequested })
+    s.setDivergenceHandler((d) => fired.push(d))
+    return { s, fired }
+  }
+
+  it('fires ONCE with requested+served when the first post-boot line serves a different model', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true }) // boot rehydration: invalid id, fallback will substitute
+    s.noteTranscriptModel('claude-opus-4-8') // first assistant line: the fallback
+    expect(fired).toEqual([{ requested: 'claude-sonnet-9', served: 'claude-opus-4-8' }])
+    // Subsequent lines do not re-fire (once per armed override).
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(1)
+  })
+
+  it('does NOT fire when the served model satisfies the requested token (alias → full id)', () => {
+    const { s, fired } = armed()
+    s.setOverride('sonnet', { verify: true })
+    s.noteTranscriptModel('claude-sonnet-5')
+    expect(fired).toHaveLength(0)
+  })
+
+  it('verification is consumed by the FIRST live observation — a later different model is a normal switch, not a divergence', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-opus-4-8', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8') // verified OK
+    s.noteTranscriptModel('claude-sonnet-5') // e.g. a native in-session switch
+    expect(fired).toHaveLength(0)
+  })
+
+  it('re-arms on every verify-set', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-opus-4-8', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8') // ok
+    s.setOverride('claude-sonnet-9', { verify: true }) // next apply-boot, bogus id
+    s.noteTranscriptModel('claude-opus-4-8') // fallback again
+    expect(fired).toEqual([{ requested: 'claude-sonnet-9', served: 'claude-opus-4-8' }])
+  })
+
+  it('clearing the override disarms (nothing to verify)', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.setOverride(null)
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+  })
+
+  // H1 (#3437 review blocker): the command-time scheduleModelRelaunch record —
+  // setOverride(model) with NO verify — must not arm. The prior boot may have
+  // left the handler registered and its own arm consumed; an assistant line in
+  // the pre-restart window is served by the OLD model and would otherwise
+  // false-accuse a perfectly valid NEW token.
+  it('H1: a command-time setOverride (no verify) NEVER arms — no false DIVERGENCE in the pre-restart window', () => {
+    const { s, fired } = armed()
+    // Prior apply-boot: armed, verified OK on the first line.
+    s.setOverride('claude-opus-4-8', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8')
+    // Operator issues /model <valid new id>; scheduleModelRelaunch records it
+    // pre-restart (status honesty) WITHOUT verify.
+    s.setOverride('claude-sonnet-5')
+    // The still-running OLD session emits another assistant line before the
+    // restart lands — served by the OLD model. Must NOT fire.
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+    // …and the override record itself is intact for /status honesty.
+    expect(s.getOverride()).toBe('claude-sonnet-5')
+  })
+
+  it('H1: a verify-arm is CLEARED by a later plain set (the newest write wins, unarmed)', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true }) // armed, not yet verified
+    s.setOverride('claude-haiku-4-5') // command-time re-set before any line
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+  })
+
+  // H2 (#3437 review blocker): the session-tail's first-attach replay delivers
+  // the PRIOR session's in-flight turn AFTER boot — OLD-model lines. They must
+  // neither fire nor consume verification; the first LIVE line still verifies.
+  it('H2: replayed observations neither fire nor consume — the first LIVE line still verifies (valid switch, no card)', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-5', { verify: true }) // apply-boot onto a VALID id
+    // Boot replay of the pre-relaunch in-flight turn (old model claude-opus-4-8).
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true })
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true })
+    expect(fired).toHaveLength(0) // the false-positive path the review flagged
+    // First LIVE line of the new session: the requested model. Verified clean.
+    s.noteTranscriptModel('claude-sonnet-5')
+    expect(fired).toHaveLength(0)
+  })
+
+  it('H2: a genuinely bogus id still fires on the first LIVE line after replay', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true }) // replayed old-turn line: ignored
+    expect(fired).toHaveLength(0)
+    s.noteTranscriptModel('claude-opus-4-8') // first LIVE line: the fallback
+    expect(fired).toEqual([{ requested: 'claude-sonnet-9', served: 'claude-opus-4-8' }])
+  })
+
+  it('replayed observations still update /status freshness exactly as before', () => {
+    const { s } = armed()
+    s.setOverride('claude-sonnet-5', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true })
+    // Freshness contract unchanged: the newer observation (transcript) wins.
+    expect(s.resolve()).toEqual({ model: 'claude-opus-4-8', source: 'transcript' })
+  })
+
+  it('never fires without a comparator (default construction) — old callers unchanged', () => {
+    const fired: SessionModelDivergence[] = []
+    const s = createSessionModelSource()
+    s.setDivergenceHandler((d) => fired.push(d))
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+  })
+
+  it('a handler that clears the override does not break resolution', () => {
+    const s = createSessionModelSource({ servedMatchesRequested: servedModelMatchesRequested })
+    s.setDivergenceHandler(() => s.setOverride(null))
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(s.getOverride()).toBeNull()
+    expect(s.resolve()).toEqual({ model: 'claude-opus-4-8', source: 'transcript' })
+  })
+})

package/telegram-plugin/tests/session-tail-first-attach.test.ts

@@ -1,8 +1,13 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdtempSync, rmSync, writeFileSync, statSync } from 'node:fs'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, appendFileSync, statSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { computeFirstAttachCursor } from '../session-tail.js'
+import {
+  computeFirstAttachCursor,
+  getProjectsDirForCwd,
+  startSessionTail,
+  type SessionEvent,
+} from '../session-tail.js'
 
 /**
  * computeFirstAttachCursor: on first attach to a transcript, seek to EOF
@@ -63,3 +68,111 @@ describe('computeFirstAttachCursor', () => {
     expect(computeFirstAttachCursor(missing, 0)).toBe(0)
   })
 })
+
+// ── #3427 H2: first-attach replay marks `model` events as replayed ───────────
+//
+// A /model relaunch during an active turn is EXACTLY the shape that triggers
+// the in-flight-turn replay above: the new gateway attaches to the OLD
+// session's JSONL and replays its enqueue + assistant lines — which carry the
+// PRE-relaunch model. Those replayed `model` observations must be flagged so
+// the divergence tripwire (session-model-source) ignores them; live lines
+// appended after attach must NOT be flagged. Outcome-asserted against the
+// real tailer, not the source.
+
+describe('startSessionTail — replayed model events are flagged (#3427 H2)', () => {
+  const tempDirs: string[] = []
+  afterEach(() => {
+    for (const d of tempDirs) {
+      try { rmSync(d, { recursive: true, force: true }) } catch { /* ignore */ }
+    }
+    tempDirs.length = 0
+  })
+
+  function mkProjectsDir(): { claudeHome: string; cwd: string; projectsDir: string } {
+    const base = mkdtempSync(join(tmpdir(), 'first-attach-replayed-'))
+    tempDirs.push(base)
+    const cwd = join(base, 'agent')
+    const claudeHome = join(base, 'claude-home')
+    const projectsDir = getProjectsDirForCwd(cwd, claudeHome)
+    mkdirSync(projectsDir, { recursive: true })
+    return { claudeHome, cwd, projectsDir }
+  }
+
+  const wait = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms))
+
+  const assistantModelLine = (model: string): string =>
+    JSON.stringify({
+      type: 'assistant',
+      message: { model, content: [{ type: 'text', text: 'hi' }] },
+    }) + '\n'
+
+  function modelEvents(events: SessionEvent[]): Array<{ model: string; replayed?: boolean }> {
+    return events.filter((e): e is Extract<SessionEvent, { kind: 'model' }> => e.kind === 'model')
+  }
+
+  it('mid-turn restart: replayed OLD-model lines carry replayed:true; a live line appended after attach does not', async () => {
+    const { claudeHome, cwd, projectsDir } = mkProjectsDir()
+    const file = join(projectsDir, 'sess.jsonl')
+    // The pre-relaunch session ended mid-turn: enqueue with no turn_duration,
+    // followed by an assistant line served by the OLD model.
+    writeFileSync(
+      file,
+      ENQUEUE + '\n' + DEQUEUE + '\n' + assistantModelLine('claude-opus-4-8'),
+    )
+
+    const events: SessionEvent[] = []
+    const handle = startSessionTail({
+      cwd,
+      claudeHome,
+      rescanIntervalMs: 50,
+      onEvent: (ev) => { events.push(ev) },
+    })
+    try {
+      await wait(200) // attach + replay the in-flight turn
+      const replayedBatch = modelEvents(events)
+      expect(replayedBatch.length).toBeGreaterThan(0)
+      // THE H2 false-positive shape: the old model arrives AFTER boot — but
+      // flagged, so the divergence tripwire skips it.
+      expect(replayedBatch[0]).toMatchObject({ model: 'claude-opus-4-8', replayed: true })
+
+      // The live session now writes its first assistant line (new model).
+      appendFileSync(file, assistantModelLine('claude-sonnet-5'))
+      await wait(200)
+      const all = modelEvents(events)
+      const live = all[all.length - 1]
+      expect(live.model).toBe('claude-sonnet-5')
+      expect(live.replayed).not.toBe(true)
+    } finally {
+      handle.stop()
+    }
+  })
+
+  it('completed-turn attach (no replay): appended model lines are never flagged', async () => {
+    const { claudeHome, cwd, projectsDir } = mkProjectsDir()
+    const file = join(projectsDir, 'sess.jsonl')
+    writeFileSync(
+      file,
+      ENQUEUE + '\n' + assistantModelLine('claude-opus-4-8') + TURN_DURATION + '\n',
+    )
+
+    const events: SessionEvent[] = []
+    const handle = startSessionTail({
+      cwd,
+      claudeHome,
+      rescanIntervalMs: 50,
+      onEvent: (ev) => { events.push(ev) },
+    })
+    try {
+      await wait(200) // attach seeks to EOF — no replay
+      expect(modelEvents(events)).toHaveLength(0)
+      appendFileSync(file, assistantModelLine('claude-sonnet-5'))
+      await wait(200)
+      const all = modelEvents(events)
+      expect(all.length).toBeGreaterThan(0)
+      expect(all[all.length - 1].model).toBe('claude-sonnet-5')
+      expect(all[all.length - 1].replayed).not.toBe(true)
+    } finally {
+      handle.stop()
+    }
+  })
+})

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -7,10 +7,13 @@ import {
   pinnedMessageIsOurs,
   reconcileAndPersistStatusPin,
   runStatusPinBootCleanup,
+  withPinReconcileLock,
   type PersistedStatusPin,
   type StatusPinStoreFsSeam,
   type TrackedStatusPin,
 } from "../gateway/status-pin-store.js";
+import { decidePinAction, type PinState, type DesiredPin } from "../status-pin.js";
+import { reconcilePin, type PinBotApi } from "../status-pin-driver.js";
 
 /** In-memory fs seam with an atomic rename, so the store's tmp→rename
  *  crash-safety contract is exercised without touching the real disk. */
@@ -718,4 +721,199 @@ describe("reconcileAndPersistStatusPin — persist-before-pin ordering", () => {
     expect(next).toBeNull();
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
+
+  // F1 (invisible-worker-cards review): a `clear` op is emitted for BOTH a real
+  // unpin AND a `noop: already pinned`. For a noop, reconcilePin issues NO
+  // Telegram call and returns the LIVE claim (non-null). The pre-fix clear
+  // branch dropped the row unconditionally, so the worker feed's per-edit
+  // syncPin (every steady-state edit maps to a noop-clear) erased the durable
+  // row for a still-live pin — a crash after that left a stuck pinned card boot
+  // cleanup could never see. The row MUST be preserved when applyPin returns a
+  // live claim.
+  it("clear op with a LIVE claim (noop-already-pinned) PRESERVES the durable row", async () => {
+    const { fs, calls } = memFs();
+    persistStatusPins(PATH, fs, [pin({ pinKey: "wk:group:g1", messageId: 715 })]);
+    const before = calls.length;
+    // applyPin returns the live claim unchanged (what reconcilePin does on noop).
+    const next = await reconcileAndPersistStatusPin({
+      path: PATH,
+      fs,
+      pinKey: "wk:group:g1",
+      chatId: "-100123",
+      op: { kind: "clear" },
+      applyPin: async () => ({ messageId: 715 }),
+      log: () => {},
+    });
+    expect(next).toEqual({ messageId: 715 });
+    // Row survives (rewritten confirmed, no `pending`).
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "wk:group:g1", chatId: "-100123", messageId: 715 },
+    ]);
+    // Sanity: at least one disk write happened (the confirm rewrite) — the fix
+    // does not skip persistence, it changes the CONTENT from delete to upsert.
+    expect(calls.length).toBeGreaterThan(before);
+  });
+
+  it("repeated steady-state noop-clears keep the row present across many edits", async () => {
+    const { fs } = memFs();
+    persistStatusPins(PATH, fs, [pin({ pinKey: "wk:group:g1", messageId: 715 })]);
+    for (let i = 0; i < 5; i++) {
+      await reconcileAndPersistStatusPin({
+        path: PATH,
+        fs,
+        pinKey: "wk:group:g1",
+        chatId: "-100123",
+        op: { kind: "clear" },
+        applyPin: async () => ({ messageId: 715 }),
+        log: () => {},
+      });
+    }
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "wk:group:g1", chatId: "-100123", messageId: 715 },
+    ]);
+  });
+});
+
+/**
+ * F2 (invisible-worker-cards review): the gateway's status-pin reconcile reads
+ * its `prev` claim from an in-memory map at the top of the reconcile, then
+ * awaits. Two overlapping reconciles for ONE key with OPPOSITE desires could
+ * both capture a stale `prev` → a turn-end `{pinned:false}` clears the durable
+ * row while a flood-delayed open-pin lands, leaving a stuck pin with no row.
+ *
+ * These tests exercise the REAL fix primitives — `withPinReconcileLock` +
+ * `reconcileAndPersistStatusPin` + `reconcilePin` + `decidePinAction` — composed
+ * exactly as the gateway wires them (read prev INSIDE the per-key lock), and
+ * prove the row survives. The `noLock` control models the pre-fix ordering
+ * (prev read OUTSIDE the lock) and shows it regresses — so the lock, not luck,
+ * is what fixes it.
+ */
+describe("status-pin-store — F2 per-key reconcile serialization", () => {
+  // A gateway-faithful reconcile: an in-memory claim map (the `prev` source read
+  // at the TOP of the reconcile), the real decide→op mapping, and
+  // reconcileAndPersistStatusPin driving reconcilePin against a call-counting
+  // pin API. An optional gate lets a test hold ONE reconcile's applyPin open to
+  // force the exact interleave. `serialize` toggles the F2 fix.
+  function makeReconciler(fs: StatusPinStoreFsSeam, opts: { serialize: boolean }) {
+    const claims = new Map<string, PinState>();
+    const pinCalls: number[] = [];
+    const unpinCalls: number[] = [];
+    const api: PinBotApi = {
+      pinChatMessage: async (_c, id) => {
+        pinCalls.push(id);
+      },
+      unpinChatMessage: async (_c, id) => {
+        unpinCalls.push(id);
+      },
+    };
+    async function core(
+      pinKey: string,
+      chatId: string,
+      desired: DesiredPin,
+      gate?: Promise<void>,
+    ) {
+      const prev = claims.get(pinKey) ?? null; // read BEFORE the store op (the F2 window)
+      const action = decidePinAction(prev, desired);
+      const op =
+        action.kind === "pin"
+          ? ({ kind: "pin", messageId: action.messageId } as const)
+          : ({ kind: "clear" } as const);
+      const next = await reconcileAndPersistStatusPin({
+        path: PATH,
+        fs,
+        pinKey,
+        chatId,
+        op,
+        applyPin: async () => {
+          if (gate) await gate; // hold the pin open inside the store lock
+          return reconcilePin({ api, chatId, prevState: prev, desired });
+        },
+        log: () => {},
+      });
+      if (next == null) claims.delete(pinKey);
+      else claims.set(pinKey, next);
+    }
+    function reconcile(
+      pinKey: string,
+      chatId: string,
+      desired: DesiredPin,
+      gate?: Promise<void>,
+    ) {
+      return opts.serialize
+        ? withPinReconcileLock(pinKey, () => core(pinKey, chatId, desired, gate))
+        : core(pinKey, chatId, desired, gate);
+    }
+    return { reconcile, claims, pinCalls, unpinCalls };
+  }
+
+  // The exact review sequence: a flood-delayed OPEN-pin (A) is in-flight inside
+  // the store lock; a turn-end UNPIN (B) starts during A's await window and
+  // reads prev=null (A has not set the claim yet). Pre-fix, B's clear then drops
+  // the disk row A wrote — stranding a live in-memory claim with NO durable row.
+  async function runStrandingSequence(serialize: boolean) {
+    const { fs } = memFs();
+    const r = makeReconciler(fs, { serialize });
+    let releaseA!: () => void;
+    const gateA = new Promise<void>((res) => {
+      releaseA = res;
+    });
+    // A: open-pin 900, held open at applyPin.
+    const aDone = r.reconcile("fg:c:3", "-100123", { pinned: true, messageId: 900 }, gateA);
+    // Let A reach its applyPin await (pending row on disk; claim NOT yet set).
+    await Promise.resolve();
+    await Promise.resolve();
+    // B: turn-end unpin, starts now — reads prev from the in-memory claim map.
+    const bDone = r.reconcile("fg:c:3", "-100123", { pinned: false });
+    await Promise.resolve();
+    releaseA();
+    await Promise.all([aDone, bDone]);
+    return { fs, claims: r.claims, unpinCalls: r.unpinCalls, pinCalls: r.pinCalls };
+  }
+
+  it("serialized: turn-end unpin waits for the in-flight open-pin, so the pinned message is genuinely UNPINNED (not stranded)", async () => {
+    const { fs, claims, pinCalls, unpinCalls } = await runStrandingSequence(true);
+    const rows = loadStatusPins(PATH, fs);
+    // Under serialization B runs only after A fully settles, so B reads
+    // prev={900}, issues a REAL unpin of the pinned message, and clears the row
+    // and claim together. The Telegram pin is cleaned up — nothing stuck.
+    expect(pinCalls).toEqual([900]); // A pinned it
+    expect(unpinCalls).toEqual([900]); // B unpinned it (the fix)
+    expect(rows).toEqual([]);
+    expect(claims.get("fg:c:3") ?? null).toBeNull();
+  });
+
+  it("pre-fix control (no per-key lock): the same interleave STRANDS the pinned message — pinned, row cleared, NEVER unpinned", async () => {
+    const { fs, unpinCalls, pinCalls } = await runStrandingSequence(false);
+    const rows = loadStatusPins(PATH, fs);
+    // Reproduces the F2 defect the lock removes: B read prev=null during A's
+    // await window, so its clear was a NO-OP unpin (issued no Telegram unpin)
+    // yet still dropped the durable row A wrote — while A's pin call landed. The
+    // message 900 stays pinned on Telegram with NO durable row and no unpin ever
+    // issued → stuck until a boot cleanup that can no longer see it.
+    expect(pinCalls).toEqual([900]); // message 900 WAS pinned
+    expect(unpinCalls).toEqual([]); // …but never unpinned (no-op clear on prev=null)
+    expect(rows).toEqual([]); // …and the durable row is gone → unreapable
+  });
+
+  it("serialized steady-state noop reconciles add ZERO pin/unpin API calls (finn-flood guard)", async () => {
+    const { fs } = memFs();
+    const r = makeReconciler(fs, { serialize: true });
+    // First open pins exactly once.
+    await r.reconcile("wk:group:g1", "-100123", { pinned: true, messageId: 900 });
+    expect(r.pinCalls).toEqual([900]);
+    expect(r.unpinCalls).toEqual([]);
+
+    // 20 steady-state edits — each a re-pin of the SAME id → decidePinAction
+    // noop → reconcilePin issues NO Telegram call. The serialization + F1
+    // row-preservation must not add a single pin/unpin API call.
+    for (let i = 0; i < 20; i++) {
+      await r.reconcile("wk:group:g1", "-100123", { pinned: true, messageId: 900 });
+    }
+    expect(r.pinCalls).toEqual([900]); // still exactly one pin, ever
+    expect(r.unpinCalls).toEqual([]); // never unpinned
+    // The durable row is intact throughout (F1).
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "wk:group:g1", chatId: "-100123", messageId: 900 },
+    ]);
+  });
 });

package/telegram-plugin/tests/subagent-tracker-hooks.test.ts

@@ -147,6 +147,56 @@ describe('subagent-tracker-pretool', () => {
     expect(row?.model ?? null).toBeNull()
   })
 
+  // F3 (progress-card fork model): a fork dispatch inherits the parent's model
+  // and IGNORES tool_input.model, so seeding the row's first-paint model from
+  // that ignored override made the worker card show a WRONG model (e.g. "sonnet"
+  // while the fork runs Opus) until the transcript overwrote it. The seed must
+  // be suppressed for forks — model stays NULL and the card omits it until the
+  // watcher records the real model from the fork's own transcript.
+  it('leaves model null for a FORK dispatch even when tool_input.model is set (F3)', () => {
+    const event = {
+      session_id: 'sess-fork',
+      tool_name: 'Agent',
+      tool_use_id: 'toolu_fork001',
+      tool_input: {
+        subagent_type: 'fork',
+        description: 'Fork the session',
+        run_in_background: true,
+        model: 'sonnet', // override a fork ignores — must NOT be persisted
+      },
+    }
+    const result = runHook(PRETOOL_SCRIPT, event)
+    expect(result.status).toBe(0)
+
+    const db = openDb()
+    const row = db.prepare('SELECT model FROM subagents WHERE id = ?').get('toolu_fork001') as
+      | { model: string | null }
+      | undefined
+    expect(row?.model ?? null).toBeNull()
+  })
+
+  it('still persists tool_input.model for a NON-fork dispatch (fork suppression is scoped)', () => {
+    const event = {
+      session_id: 'sess-nonfork',
+      tool_name: 'Agent',
+      tool_use_id: 'toolu_nonfork001',
+      tool_input: {
+        subagent_type: 'researcher',
+        description: 'Research with a pinned model',
+        run_in_background: true,
+        model: 'claude-opus-4-8',
+      },
+    }
+    const result = runHook(PRETOOL_SCRIPT, event)
+    expect(result.status).toBe(0)
+
+    const db = openDb()
+    const row = db.prepare('SELECT model FROM subagents WHERE id = ?').get('toolu_nonfork001') as
+      | { model: string | null }
+      | undefined
+    expect(row?.model).toBe('claude-opus-4-8')
+  })
+
   it('does not write a row when tool_name is not Agent', () => {
     const event = {
       session_id: 'sess-abc123',