switchroom 0.19.12 → 0.19.13

package/telegram-plugin/tests/silent-end-interrupt-stop-integration.test.ts

@@ -24,12 +24,29 @@ import {
   mkdirSync,
   writeFileSync,
   readFileSync,
+  readdirSync,
   existsSync,
   rmSync,
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 
+/**
+ * Read the single outbox record the guaranteed-delivery capture writes for a
+ * turn that ended with substantive undelivered prose. Returns null when none.
+ */
+function readOutboxRecord(stateDir: string): { text: string; chatId: string | null; turnNonce: string } | null {
+  const dir = join(stateDir, 'outbox')
+  let files: string[]
+  try {
+    files = readdirSync(dir).filter((f) => f.endsWith('.json') && f !== 'delivered.jsonl')
+  } catch {
+    return null
+  }
+  if (files.length !== 1) return null
+  return JSON.parse(readFileSync(join(dir, files[0]), 'utf8'))
+}
+
 const HOOK_PATH = resolve(
   __dirname,
   '..',
@@ -108,7 +125,12 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
     expect(existsSync(join(stateDir, 'silent-end-pending.json'))).toBe(false)
   })
 
-  it("blocks + writes retryCount=1 when transcript shows ack-only (Ken's repro)", () => {
+  it('captures the trailing answer to the outbox + allows when transcript shows ack-only + undelivered verdict (Ken\'s repro, collapsed design)', () => {
+    // Collapsed guaranteed-delivery design: an ack followed by a substantive
+    // plain-text verdict is now CAPTURED to the durable outbox and the stop is
+    // ALLOWED — the gateway sweep is the single deterministic deliverer. The old
+    // block/re-prompt (which depended on the model re-replying) is superseded
+    // for capturable prose.
     const transcript = writeTranscript(tmp, [
       ENQUEUE,
       reply('on it — checking now', { disable_notification: true }),
@@ -124,23 +146,12 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
       stateDir,
     })
     expect(r.status).toBe(0)
-    const out = JSON.parse(r.stdout)
-    expect(out.decision).toBe('block')
-    expect(out.reason).toMatch(/Send your final answer/)
-    expect(out.reason).toMatch(/NO_REPLY/)
-    // Retry-count file was written.
-    const statePath = join(stateDir, 'silent-end-pending.json')
-    expect(existsSync(statePath)).toBe(true)
-    const state = JSON.parse(readFileSync(statePath, 'utf8'))
-    expect(state.retryCount).toBe(1)
-    // Reviewer-flagged regression: the hook's state-file write MUST
-    // include turnKey + chatId derived from the enqueue envelope. Without
-    // these, the gateway's later `recordSilentTurnEnd` write (~175ms after
-    // the hook) sees a turnKey mismatch and resets retryCount to 0,
-    // doubling the effective re-prompt budget. The shape here must match
-    // `chatKey(chatId, threadId)` at telegram-plugin/gateway/chat-key.ts:46.
-    expect(state.chatId).toBe('111')
-    expect(state.turnKey).toBe('111:_')
+    expect(r.stdout.trim()).toBe('') // ALLOW — no block re-prompt
+    const rec = readOutboxRecord(stateDir)
+    expect(rec).not.toBeNull()
+    expect(rec!.text).toBe('A'.repeat(2237))
+    expect(rec!.chatId).toBe('111')
+    expect(rec!.turnNonce).toBe('111:_#42') // shared deriveTurnId nonce (H1)
   })
 
   it('preserves retryCount across the hook→gateway write order (reviewer regression)', () => {
@@ -190,17 +201,12 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
     expect(state.retryCount).toBe(SILENT_END_MAX_RETRIES)
   })
 
-  it('blocks + writes retryCount=1 when an early qualifying reply is followed by an undelivered verdict (trailing-content bug repro)', () => {
-    // Confirmed-incident shape: (1) a background-task notification
-    // arrives, (2) the agent calls reply ONCE early with a stale,
-    // notification-bearing ack ("running now" — disable_notification
-    // unset, so it satisfies isFinalAnswerReply regardless of length),
-    // (3) the agent then does more work and writes a large substantive
-    // verdict as plain assistant text with NO second reply call. Pre-fix,
-    // the hook's "reply called at least once this turn" check allowed
-    // this to slip through silently — the trailing verdict never reached
-    // the user. Post-fix the hook must block on this shape exactly like
-    // the zero-reply case.
+  it('captures the trailing verdict to the outbox + allows when an early qualifying reply is followed by an undelivered verdict (trailing-content bug repro, collapsed design)', () => {
+    // Confirmed-incident shape: (1) a background-task notification arrives,
+    // (2) the agent calls reply ONCE early with a notification-bearing ack,
+    // (3) it then writes a large substantive verdict as plain assistant text
+    // with NO second reply call. The trailing verdict is now CAPTURED to the
+    // outbox and the stop is ALLOWED — the sweep delivers it deterministically.
     const transcript = writeTranscript(tmp, [
       ENQUEUE,
       reply('running now'),
@@ -216,15 +222,11 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
       stateDir,
     })
     expect(r.status).toBe(0)
-    const out = JSON.parse(r.stdout)
-    expect(out.decision).toBe('block')
-    expect(out.reason).toMatch(/Send your final answer/)
-    const statePath = join(stateDir, 'silent-end-pending.json')
-    expect(existsSync(statePath)).toBe(true)
-    const state = JSON.parse(readFileSync(statePath, 'utf8'))
-    expect(state.retryCount).toBe(1)
-    expect(state.chatId).toBe('111')
-    expect(state.turnKey).toBe('111:_')
+    expect(r.stdout.trim()).toBe('')
+    const rec = readOutboxRecord(stateDir)
+    expect(rec).not.toBeNull()
+    expect(rec!.text).toBe('Here is the actual verdict: ' + 'X'.repeat(300))
+    expect(rec!.turnNonce).toBe('111:_#42')
   })
 
   it('does NOT false-positive on a normal single-reply turn ending on the reply tool_use', () => {
@@ -303,10 +305,10 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
       writeFileSync(join(stateDir, 'gateway-heartbeat'), String(Date.now()), 'utf8')
     }
 
-    it('zero-reply ≥200 + FRESH gateway heartbeat → ALLOW (no block re-prompt), state file still written for the flush', () => {
-      // The duplicate repro: today this BLOCKS *and* the gateway flush fires →
-      // two messages. With a fresh heartbeat the election ALLOWS the stop so
-      // the gateway flush is the single writer.
+    it('zero-reply ≥200 + FRESH gateway heartbeat → CAPTURE + ALLOW (sweep is the single writer)', () => {
+      // Collapsed design: the duplicate repro is killed structurally — the
+      // trailing prose is captured to the outbox and the stop is allowed. The
+      // sweep is the single deterministic deliverer; no election, no re-prompt.
       writeFreshHeartbeat()
       const transcript = writeTranscript(tmp, [
         ENQUEUE,
@@ -314,35 +316,31 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
       ])
       const r = runHook({ event: { session_id: 's1', transcript_path: transcript }, stateDir })
       expect(r.status).toBe(0)
-      // ALLOW → no block JSON on stdout.
-      expect(r.stdout.trim()).toBe('')
-      expect(r.stderr).toMatch(/single-writer election ALLOWED/)
-      // State file IS written so the gateway's captured-prose bridge has its
-      // input (turnKey/turnId/pendingText); retryCount stays 0 (not a re-prompt).
-      const statePath = join(stateDir, 'silent-end-pending.json')
-      expect(existsSync(statePath)).toBe(true)
-      const state = JSON.parse(readFileSync(statePath, 'utf8'))
-      expect(state.retryCount).toBe(0)
-      expect(state.turnKey).toBe('111:_')
-      expect(state.pendingText).toBe('A'.repeat(300))
+      expect(r.stdout.trim()).toBe('') // ALLOW
+      const rec = readOutboxRecord(stateDir)
+      expect(rec).not.toBeNull()
+      expect(rec!.text).toBe('A'.repeat(300))
+      expect(rec!.turnNonce).toBe('111:_#42')
     })
 
-    it('zero-reply ≥200 + STALE/missing heartbeat → BLOCK (never allow into a possibly-dead gateway)', () => {
-      // No heartbeat file → the liveness gate forces today's BLOCK behaviour.
+    it('zero-reply ≥200 + STALE/missing heartbeat → STILL CAPTURE + ALLOW (record persists on disk; swept at next boot — strictly better than block-and-hope)', () => {
+      // Capture no longer depends on gateway liveness: even into a possibly-dead
+      // gateway the answer is durably captured and swept whenever the gateway is
+      // next alive — strictly stronger than the old block-and-hope re-prompt.
       const transcript = writeTranscript(tmp, [
         ENQUEUE,
         { type: 'assistant', message: { content: [{ type: 'text', text: 'A'.repeat(300) }] } },
       ])
       const r = runHook({ event: { session_id: 's1', transcript_path: transcript }, stateDir })
       expect(r.status).toBe(0)
-      expect(JSON.parse(r.stdout).decision).toBe('block')
-      const state = JSON.parse(readFileSync(join(stateDir, 'silent-end-pending.json'), 'utf8'))
-      expect(state.retryCount).toBe(1)
+      expect(r.stdout.trim()).toBe('')
+      expect(readOutboxRecord(stateDir)!.text).toBe('A'.repeat(300))
     })
 
-    it('retryCount>0 (prior failed delivery) + fresh heartbeat → BLOCK (preserve #3228 send-failure net)', () => {
+    it('retryCount>0 (prior state) + capturable prose → CAPTURE + ALLOW (nonce-scoped; the outbox journal handles redelivery, not the chat-global counter)', () => {
       writeFreshHeartbeat()
-      // Seed a prior state file with retryCount=1 (a delivery already failed).
+      // A stale chat-global silent-end record must NOT poison the capture of a
+      // genuine trailing answer (Defect B fix — retry state no longer gates it).
       writeFileSync(
         join(stateDir, 'silent-end-pending.json'),
         JSON.stringify({ chatId: '111', threadId: null, turnKey: '111:_', retryCount: 1, timestamp: Date.now() }),
@@ -354,9 +352,8 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
       ])
       const r = runHook({ event: { session_id: 's1', transcript_path: transcript }, stateDir })
       expect(r.status).toBe(0)
-      // retryCount was 1 → not the exhaustion boundary (MAX=2) → still blocks,
-      // and the election does NOT allow (retry-ladder-in-flight).
-      expect(JSON.parse(r.stdout).decision).toBe('block')
+      expect(r.stdout.trim()).toBe('')
+      expect(readOutboxRecord(stateDir)!.text).toBe('A'.repeat(300))
     })
   })
 })

package/telegram-plugin/tests/silent-end.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdtempSync, readFileSync, existsSync, rmSync, writeFileSync, mkdirSync } from 'node:fs'
+import { mkdtempSync, readFileSync, readdirSync, existsSync, rmSync, writeFileSync, mkdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { execFileSync } from 'node:child_process'
@@ -570,7 +570,7 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
     expect(r.stdout.trim()).toBe('')
   })
 
-  it('blocks the stop when transcript shows ack-only (no final reply) — Ken-2026-05-25 repro', () => {
+  it('captures the trailing answer to the outbox + allows on ack-only (no final reply) — Ken-2026-05-25 repro, collapsed design', () => {
     const transcript = writeTranscript([
       ENQUEUE,
       replyToolUse('on it — checking now', { disable_notification: true }),
@@ -579,14 +579,14 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
     ])
     const r = runHook({ session_id: 's', transcript_path: transcript, hook_event_name: 'Stop' })
     expect(r.exit).toBe(0)
-    const out = JSON.parse(r.stdout.trim())
-    expect(out.decision).toBe('block')
-    expect(out.reason).toContain('reply')
-    // #1664 — the re-prompt must offer the NO_REPLY escape hatch.
-    expect(out.reason).toContain('NO_REPLY')
-    // retryCount incremented to 1 (the budget bookkeeping still
-    // uses the state file).
-    expect(readSilentEndState()!.retryCount).toBe(1)
+    // Collapsed design: the substantive trailing answer is CAPTURED to the
+    // outbox and the stop is ALLOWED (the sweep is the single deliverer).
+    expect(r.stdout.trim()).toBe('')
+    const recs = readdirSync(join(stateDir, 'outbox')).filter((f) => f.endsWith('.json') && f !== 'delivered.jsonl')
+    expect(recs).toHaveLength(1)
+    const rec = JSON.parse(readFileSync(join(stateDir, 'outbox', recs[0]), 'utf8'))
+    expect(rec.text).toBe('A'.repeat(2237))
+    expect(rec.chatId).toBe('c')
   })
 
   it('allows the stop when retryCount >= MAX_RETRIES, even if transcript still shows no reply', () => {
@@ -694,10 +694,12 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
   describe('captured-prose delivery bridge (#3227)', () => {
     const ANSWER = 'That was actually your FY25 NOA, not Bloomfield. ' + 'A'.repeat(2200)
 
-    it('FIRST silent-end with a genuine plain-text answer → hook persists pendingText and decide → deliver', () => {
+    it('FIRST silent-end with a genuine plain-text answer → hook captures it to the outbox + allows (collapsed design supersedes the pendingText bridge)', () => {
       // A turn that ended with a substantive answer written as plain text
-      // (never sent via the reply tool). The Stop hook scans, blocks, and now
-      // persists the answer prose into silent-end-pending.json.
+      // (never sent via the reply tool). Under the collapsed guaranteed-delivery
+      // design the Stop hook captures the answer to the durable outbox and
+      // allows the stop — the sweep delivers it. This supersedes the legacy
+      // silent-end-pending.json pendingText bridge for capturable prose.
       const transcript = writeTranscript([
         ENQUEUE,
         replyToolUse('on it — checking now', { disable_notification: true }),
@@ -706,21 +708,12 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
       ])
       const r = runHook({ session_id: 's', transcript_path: transcript, hook_event_name: 'Stop' })
       expect(r.exit).toBe(0)
-      expect(JSON.parse(r.stdout.trim()).decision).toBe('block')
-
-      // The bridge: the hook wrote the answer prose into the state file...
-      const state = readSilentEndState()!
-      expect(state.pendingText).toBe(ANSWER)
-      expect(state.turnKey).toBe('c:_')
-
-      // ...and the gateway's pure decision core reads it back and decides to
-      // deliver directly on this FIRST silent-end (retryCount just went to 1).
-      const decision = decideCapturedProseDelivery({ turnKey: 'c:_' })
-      expect(decision.deliver).toBe(true)
-      expect(decision.text).toBe(ANSWER)
-      expect(decision.reason).toBe('captured-prose')
-      // FIRST silent-end: this is the retry-budget's first block, not exhaustion.
-      expect(state.retryCount).toBe(1)
+      expect(r.stdout.trim()).toBe('') // ALLOW
+      const recs = readdirSync(join(stateDir, 'outbox')).filter((f) => f.endsWith('.json') && f !== 'delivered.jsonl')
+      expect(recs).toHaveLength(1)
+      const rec = JSON.parse(readFileSync(join(stateDir, 'outbox', recs[0]), 'utf8'))
+      expect(rec.text).toBe(ANSWER)
+      expect(rec.chatId).toBe('c')
     })
 
     it('a turn that DID call a final reply → no state, no pendingText, decide → no synthetic send', () => {

package/telegram-plugin/tests/temporal-normalize.test.ts

@@ -0,0 +1,222 @@
+import { describe, it, expect } from 'vitest'
+import {
+  normalizeTemporal,
+  normalizeUtcDatetimes,
+  normalizeRelativeDays,
+} from '../temporal-normalize.js'
+
+// All cases run in the agent's configured tz with a FIXED nowMs — the pure
+// signature means no env / clock mocking is needed.
+const TZ = 'Australia/Melbourne'
+// Midday Melbourne on Thursday 2026-07-23 (AEST, UTC+10): 02:00Z = 12:00 local.
+const NOW_THU_23_JUL = Date.UTC(2026, 6, 23, 2, 0, 0)
+
+describe('normalizeRelativeDays — relative-day accuracy (#3501)', () => {
+  it('1. stale-forward: "closed tomorrow (Thu 23 Jul)" on Thu 23 Jul → "today"', () => {
+    // The reported incident.
+    const out = normalizeRelativeDays('closed tomorrow (Thu 23 Jul)', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('closed today (Thu 23 Jul)')
+  })
+
+  it('2. stale-backward: "today (Wed 22 Jul)" on Thu 23 Jul → "yesterday"', () => {
+    const out = normalizeRelativeDays('sent today (Wed 22 Jul)', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('sent yesterday (Wed 22 Jul)')
+  })
+
+  it('3. "yesterday" wrong forward: "(Fri 24 Jul)" → "tomorrow"', () => {
+    const out = normalizeRelativeDays('due yesterday (Fri 24 Jul)', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('due tomorrow (Fri 24 Jul)')
+  })
+
+  it('4. correct word untouched — byte-identical', () => {
+    const src = 'ships today (Thu 23 Jul)'
+    expect(normalizeRelativeDays(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('5. relative word with NO adjacent date — untouched', () => {
+    const src = "I'll get to it today, promise."
+    expect(normalizeRelativeDays(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('6. multi-date message — each pair resolved independently', () => {
+    const out = normalizeRelativeDays(
+      'opened tomorrow (Thu 23 Jul), closes tomorrow (Fri 24 Jul)',
+      TZ,
+      NOW_THU_23_JUL,
+    )
+    // First pair is actually today; second is genuinely tomorrow.
+    expect(out).toBe('opened today (Thu 23 Jul), closes tomorrow (Fri 24 Jul)')
+  })
+
+  it('7. midnight boundary: UTC date (22nd) disagrees with Melbourne date (23rd)', () => {
+    // 2026-07-22T23:00Z is already Thu 23 Jul 09:00 in Melbourne.
+    const now = Date.UTC(2026, 6, 22, 23, 0, 0)
+    const out = normalizeRelativeDays('reminder tomorrow (Thu 23 Jul)', TZ, now)
+    expect(out).toBe('reminder today (Thu 23 Jul)')
+  })
+
+  it('16. weekday repair: "(Wed 23 Jul)" when 23 Jul is a Thursday → "(Thu 23 Jul)"', () => {
+    const out = normalizeRelativeDays('meeting today (Wed 23 Jul)', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('meeting today (Thu 23 Jul)')
+  })
+
+  it('numeric date form 23/07 (DD/MM) resolves like a named date', () => {
+    const out = normalizeRelativeDays('billed tomorrow (23/07)', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('billed today (23/07)')
+  })
+
+  it('ISO yyyy-mm-dd adjacent date resolves', () => {
+    const out = normalizeRelativeDays('expires tomorrow 2026-07-22', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('expires yesterday 2026-07-22')
+  })
+
+  it('time-of-day word with diff==0 (today) is kept as-is', () => {
+    const src = 'closing tonight (Thu 23 Jul)'
+    expect(normalizeRelativeDays(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('REVIEW FIX 2 — time-of-day word with diff≠0 is left UNTOUCHED (never remapped)', () => {
+    // "tonight" next to tomorrow's date must NOT become "tomorrow" — it is left
+    // exactly as written.
+    const src = 'party tonight (Fri 24 Jul)'
+    expect(normalizeRelativeDays(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('out-of-range relative word (diff > 1) is left untouched, NOT auto-deleted', () => {
+    const src = 'launch tomorrow (Mon 3 Aug)'
+    expect(normalizeRelativeDays(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('preserves original casing on rewrite', () => {
+    const out = normalizeRelativeDays('Tomorrow (Thu 23 Jul) we ship', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('Today (Thu 23 Jul) we ship')
+  })
+
+  it('excludes blockquote (>) lines from rewriting (quoted third-party text)', () => {
+    const src = '> forwarded: closed tomorrow (Thu 23 Jul)'
+    expect(normalizeRelativeDays(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+})
+
+describe('normalizeUtcDatetimes — no raw UTC outbound (#3501)', () => {
+  it('8. ISO-Z → local: 2026-07-23T09:15:00Z → Thu 23 Jul 7:15 pm AEST', () => {
+    const out = normalizeUtcDatetimes('window opens 2026-07-23T09:15:00Z', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('window opens Thu 23 Jul 7:15 pm AEST')
+  })
+
+  it('9a. +00:00 offset variant', () => {
+    const out = normalizeUtcDatetimes('at 2026-07-23T09:15:00+00:00 sharp', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('at Thu 23 Jul 7:15 pm AEST sharp')
+  })
+
+  it('9b. no-seconds and fractional-seconds variants', () => {
+    expect(normalizeUtcDatetimes('t=2026-07-23T09:15Z', TZ, NOW_THU_23_JUL)).toBe('t=Thu 23 Jul 7:15 pm AEST')
+    expect(normalizeUtcDatetimes('t=2026-07-23T09:15:00.500Z', TZ, NOW_THU_23_JUL)).toBe(
+      't=Thu 23 Jul 7:15 pm AEST',
+    )
+  })
+
+  it('10. labelled "14:00 UTC" → local time-only', () => {
+    // 14:00Z on the 23rd is 00:00 (midnight) of the 24th in Melbourne.
+    const out = normalizeUtcDatetimes('cutoff 14:00 UTC', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('cutoff 12:00 am AEST')
+  })
+
+  it('10b. labelled "2 pm GMT" → local', () => {
+    const out = normalizeUtcDatetimes('call at 2 pm GMT', TZ, NOW_THU_23_JUL)
+    expect(out).toBe('call at 12:00 am AEST')
+  })
+
+  it('11. DST: an AEDT-side instant renders AEDT wall clock', () => {
+    // 2026-01-15T09:15:00Z, Melbourne is on AEDT (UTC+11).
+    const summerNow = Date.UTC(2026, 0, 15, 2, 0, 0)
+    const out = normalizeUtcDatetimes('summer 2026-01-15T09:15:00Z', TZ, summerNow)
+    expect(out).toBe('summer Thu 15 Jan 8:15 pm AEDT')
+  })
+
+  it('12. already-local text ("7:15 pm AEST") — untouched', () => {
+    const src = 'opens 7:15 pm AEST'
+    expect(normalizeUtcDatetimes(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('REVIEW — "9 to 5 GMT" (bare labelled hour, no minutes/ampm) is NOT converted', () => {
+    const src = 'hours are 9 to 5 GMT'
+    expect(normalizeUtcDatetimes(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+})
+
+describe('temporal masking — false-positive guards (#3501)', () => {
+  it('13a. ISO inside an inline code span — untouched', () => {
+    const src = 'log line `2026-07-23T09:15:00Z` seen'
+    expect(normalizeTemporal(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('13b. ISO inside a fenced code block — untouched', () => {
+    const src = 'trace:\n```\nts=2026-07-23T09:15:00Z\n```\nend'
+    expect(normalizeTemporal(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('REVIEW FIX 1 (failing-first) — ISO inside a markdown link href is untouched', () => {
+    const src = 'see [log](https://x/2026-07-23T09:15:00Z) for detail'
+    expect(normalizeTemporal(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('REVIEW FIX 1 — ISO inside an angle-bracket autolink is untouched', () => {
+    const src = 'ref <https://x/2026-07-23T09:15:00Z> here'
+    expect(normalizeTemporal(src, TZ, NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('but a bare ISO in prose alongside a masked one IS still converted', () => {
+    const out = normalizeTemporal(
+      'live 2026-07-23T09:15:00Z, code `2026-07-23T09:15:00Z`',
+      TZ,
+      NOW_THU_23_JUL,
+    )
+    expect(out).toBe('live Thu 23 Jul 7:15 pm AEST, code `2026-07-23T09:15:00Z`')
+  })
+})
+
+describe('normalizeTemporal — composition, idempotency, robustness (#3501)', () => {
+  it('runs UTC→local first, then relative-day on the produced date', () => {
+    // The UTC pass yields "Thu 23 Jul …"; the relative pass then sees that date
+    // adjacent to "tomorrow" and corrects it to "today".
+    const out = normalizeTemporal('tomorrow 2026-07-22T09:15:00Z', TZ, NOW_THU_23_JUL)
+    // 2026-07-22T09:15Z → Wed 22 Jul 7:15 pm AEST; 22 Jul is yesterday.
+    expect(out).toBe('yesterday Wed 22 Jul 7:15 pm AEST')
+  })
+
+  it('14. idempotent: f(f(x)) === f(x) for every representative fixture', () => {
+    const fixtures = [
+      'closed tomorrow (Thu 23 Jul)',
+      'window opens 2026-07-23T09:15:00Z',
+      'cutoff 14:00 UTC',
+      'meeting today (Wed 23 Jul)',
+      'plain prose with no temporal content at all',
+      'see [log](https://x/2026-07-23T09:15:00Z)',
+    ]
+    for (const f of fixtures) {
+      const once = normalizeTemporal(f, TZ, NOW_THU_23_JUL)
+      const twice = normalizeTemporal(once, TZ, NOW_THU_23_JUL)
+      expect(twice).toBe(once)
+    }
+  })
+
+  it('15. invalid tz — no-op, never throws (both passes)', () => {
+    const src = 'closed tomorrow (Thu 23 Jul), at 2026-07-23T09:15:00Z'
+    expect(() => normalizeTemporal(src, 'Not/AZone', NOW_THU_23_JUL)).not.toThrow()
+    expect(normalizeTemporal(src, 'Not/AZone', NOW_THU_23_JUL)).toBe(src)
+  })
+
+  it('empty / whitespace input is returned unchanged', () => {
+    expect(normalizeTemporal('', TZ, NOW_THU_23_JUL)).toBe('')
+    expect(normalizeUtcDatetimes('', TZ, NOW_THU_23_JUL)).toBe('')
+    expect(normalizeRelativeDays('', TZ, NOW_THU_23_JUL)).toBe('')
+  })
+
+  it('reproduces the cron/mail-watcher incident end-to-end', () => {
+    // The exact shape of the reported cron notification.
+    const incident = 'Heads up: the office is closed tomorrow (Thu 23 Jul).'
+    const out = normalizeTemporal(incident, TZ, NOW_THU_23_JUL)
+    expect(out).toBe('Heads up: the office is closed today (Thu 23 Jul).')
+  })
+})

package/telegram-plugin/tests/turn-flush-safety.test.ts

@@ -287,7 +287,7 @@ describe('#2798 turn-flush punctuation/bold parity with reply', () => {
     // #2996 P2: the reply orchestration itself now lives in the module
     // (`sendReply`); the delegation line is pinned there.
     const replyDelegates = moduleSrc.indexOf(
-      `normalizeOutboundBody(rawText, 'reply', redactOutboundText)`,
+      `normalizeOutboundBody(rawText, 'reply', redactOutboundText`,
       moduleSrc.indexOf('export async function sendReply('),
     )
     expect(replyDelegates).toBeGreaterThan(0)
@@ -302,24 +302,29 @@ describe('#2798 turn-flush punctuation/bold parity with reply', () => {
     expect(scrubIdx).toBeGreaterThan(normIdx) // ...and BEFORE the voice scrub
   })
 
-  it('turn-flush backstop: applies the SAME normalization in the SAME slot (REDS if the line is removed)', () => {
-    const redactIdx = streamSrc.indexOf(`redactOutboundText(capturedText, 'turn_flush')`)
-    // The normalization call the reply path uses, verbatim, on the turn_flush
-    // variable. This indexOf is what returns -1 (→ assertion fails) if the
-    // `stripExcessBold(normalizePunctuation(capturedText))` line is deleted
-    // from the turn_flush branch.
-    const normIdx = streamSrc.indexOf('stripExcessBold(normalizePunctuation(capturedText))', redactIdx)
-    const scrubIdx = streamSrc.indexOf('scrubVoice(capturedText)', redactIdx)
-    expect(redactIdx).toBeGreaterThan(0)
-    expect(normIdx).toBeGreaterThan(redactIdx) // normalize AFTER the turn_flush redact
-    expect(scrubIdx).toBeGreaterThan(normIdx) // ...and BEFORE the voice scrub — mirrors reply
-  })
-
-  it('both send sites share the identical `stripExcessBold(normalizePunctuation(` wrapper', () => {
-    // Parity, structurally: the exact normalization wrapper the reply path uses
-    // is the one the turn_flush branch uses — same call, not a lookalike.
+  it('turn-flush backstop: routes through the shared normalizeOutboundBody seam (#3501)', () => {
+    // #3501 consolidation: the turn_flush branch no longer hand-mirrors the
+    // reply pipeline inline — it calls the SINGLE shared seam
+    // `normalizeOutboundBody(flushDecision.text, 'turn_flush', redactOutboundText)`.
+    // That call IS the redact→normalize→scrub pipeline (pinned above in the
+    // module source), so the same-slot ordering guarantee now lives in ONE
+    // place. This indexOf returns -1 (→ assertion fails) if the seam call is
+    // deleted from the turn_flush branch.
+    const seamIdx = streamSrc.indexOf(`normalizeOutboundBody(`)
+    const siteIdx = streamSrc.indexOf(`'turn_flush',`, seamIdx)
+    expect(seamIdx).toBeGreaterThan(0)
+    expect(siteIdx).toBeGreaterThan(seamIdx) // the seam is invoked with the turn_flush site
+    // The former inline mirror must be GONE — no hand-rolled copy left to drift.
+    expect(streamSrc).not.toContain('stripExcessBold(normalizePunctuation(capturedText))')
+  })
+
+  it('both send sites share the identical normalizeOutboundBody seam (#3501)', () => {
+    // Parity, structurally: after consolidation the reply and turn_flush sites
+    // share ONE normalization implementation — the punctuation/bold wrapper
+    // lives only inside normalizeOutboundBody, and both sites invoke it.
     expect(replyModuleSrc).toContain('stripExcessBold(normalizePunctuation(text))')
-    expect(streamSrc).toContain('stripExcessBold(normalizePunctuation(capturedText))')
+    expect(streamSrc).toContain('normalizeOutboundBody(')
+    expect(streamSrc).toContain(`'turn_flush',`)
   })
 
   // Behavioural coverage (kept from the original suite): reconstruct the