switchroom 0.19.14 → 0.19.16

package/telegram-plugin/tests/session-tail.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, afterEach } from 'vitest'
-import { mkdtempSync, mkdirSync, writeFileSync, appendFileSync, rmSync, utimesSync } from 'fs'
+import { mkdtempSync, mkdirSync, writeFileSync, appendFileSync, rmSync, utimesSync, readFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import {
@@ -1018,3 +1018,93 @@ describe('projectAssistantTextBlocks (shared text→narrative kernel)', () => {
     })
   })
 })
+
+// ─── #3519 sharpen: background-shell liveness markers, from REAL captured data ─
+// Fixtures are VERBATIM lines from a real agent transcript — no hand-written
+// approximations. Provenance (cited so a reviewer can independently verify;
+// this is a SURVIVING, reachable session — the earlier 1db49136 session was
+// rotated off host, so the fixture was regenerated from this one):
+//   file:  /host-home/.switchroom/agents/carrie/.claude/projects/
+//          -home-kenthompson--switchroom-agents-carrie/
+//          a6d2d33a-a8a6-40ce-81d0-cb4bd867ac89.jsonl  (claude CLI v2.1.197)
+//   line 109 → ALIVE: a FOREGROUND Bash (tool_use input has NO
+//            run_in_background) that the CLI auto-moved to the background at its
+//            ~120s foreground window (tool_result at 00:35:56Z) — the exact
+//            #3519 auto-background case. Carries BOTH the structured
+//            `toolUseResult.backgroundTaskId:"bxa4sv3dq"` and the launch string
+//            "Command running in background with ID: bxa4sv3dq. …".
+//   line 175 → DEAD: the CLI's proactive `<task-notification>` for the SAME id
+//            (`<task-id>bxa4sv3dq</task-id>`, `<status>completed</status>`),
+//            enqueued as a queue-operation.
+//   line 180 → the mirrored `type:"attachment"` copy of the same notification.
+// The three lines are copied into tests/fixtures/bg-shell-liveness-3519.jsonl
+// byte-for-byte EXCEPT the operator username, scrubbed in BOTH encodings — the
+// slash home path (`/home/<user>` → `~`) and the dashed tmp-path form
+// (`-home-<user>-` → `-home-user-`) — per repo PII policy
+// (scripts/check-no-pii-secrets.mjs). Every marker-bearing field —
+// backgroundTaskId, the launch string + id, the <task-notification> tags — is
+// untouched.
+describe('projectTranscriptLine — #3519 background-shell liveness (real fixtures)', () => {
+  const FIXTURE = join(__dirname, 'fixtures', 'bg-shell-liveness-3519.jsonl')
+  const lines = readFileSync(FIXTURE, 'utf8').split('\n').filter(l => l.length > 0)
+  const [aliveLine, deadEnqueueLine] = lines
+
+  it('ALIVE: emits backgroundTaskId from the real structured toolUseResult field', () => {
+    // The whole plumbing seam end-to-end: the raw captured bytes → the parsed
+    // tool_result event actually CARRIES backgroundTaskId, so the gateway can
+    // register the shell alive. If this field weren't in the real event, the
+    // signal would be unavailable — this proves it is.
+    const events = projectTranscriptLine(aliveLine)
+    const tr = events.find(e => e.kind === 'tool_result')
+    expect(tr).toBeDefined()
+    expect(tr).toMatchObject({
+      kind: 'tool_result',
+      toolUseId: 'toolu_01B7T3y1t95oHDEqYKwSmqaW',
+      backgroundTaskId: 'bxa4sv3dq',
+    })
+  })
+
+  it('DEAD: projects the real <task-notification> enqueue as a task_notification (completed)', () => {
+    // Proves the DEAD seam: the CLI's completion signal — which arrives as a
+    // queue-operation enqueue, NOT a tool_result — is parsed to the shell id +
+    // status the gateway drops from the alive-set. It must NOT be mis-read as
+    // an inbound user turn (no `enqueue` event).
+    const events = projectTranscriptLine(deadEnqueueLine)
+    expect(events).toEqual([
+      { kind: 'task_notification', taskId: 'bxa4sv3dq', status: 'completed' },
+    ])
+  })
+
+  it('the ALIVE and DEAD ids MATCH — a real launch pairs with its real completion', () => {
+    const alive = projectTranscriptLine(aliveLine).find(e => e.kind === 'tool_result')
+    const dead = projectTranscriptLine(deadEnqueueLine)[0]
+    expect(alive?.kind === 'tool_result' ? alive.backgroundTaskId : null)
+      .toBe(dead.kind === 'task_notification' ? dead.taskId : undefined)
+  })
+
+  it('SAFE DEGRADATION: a CLI that renamed the marker yields NO backgroundTaskId', () => {
+    // Simulate a future CLI that changed the launch shape: drop the structured
+    // field AND mutate the launch string. The parser must return NO id (so the
+    // gateway never registers a phantom-alive shell), which is what lets the
+    // silence-poke layer fall back to the 900s-bounded guard. Built by mutating
+    // the REAL line, so it stays traceable.
+    const obj = JSON.parse(aliveLine)
+    delete obj.toolUseResult.backgroundTaskId // structured field gone
+    obj.message.content[0].content =
+      'Task moved to the background (id withheld by a newer CLI).' // string changed
+    const events = projectTranscriptLine(JSON.stringify(obj))
+    const tr = events.find(e => e.kind === 'tool_result')
+    expect(tr).toBeDefined()
+    expect(tr?.kind === 'tool_result' ? tr.backgroundTaskId : 'X').toBeUndefined()
+  })
+
+  it('secondary path: the launch STRING alone still yields the id when the field is absent', () => {
+    // If a CLI keeps the human string but drops the structured field, the regex
+    // fallback still recovers the id — traceable, built from the real line.
+    const obj = JSON.parse(aliveLine)
+    delete obj.toolUseResult.backgroundTaskId
+    const events = projectTranscriptLine(JSON.stringify(obj))
+    const tr = events.find(e => e.kind === 'tool_result')
+    expect(tr?.kind === 'tool_result' ? tr.backgroundTaskId : null).toBe('bxa4sv3dq')
+  })
+})

package/telegram-plugin/tests/silence-poke.test.ts

@@ -1,4 +1,7 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { readFileSync } from 'fs'
+import { join } from 'path'
+import { projectTranscriptLine } from '../session-tail.js'
 import {
   startTurn,
   noteOutbound,
@@ -7,6 +10,9 @@ import {
   noteToolStart,
   noteToolEnd,
   noteToolLabel,
+  noteBackgroundShellAlive,
+  noteBackgroundShellDead,
+  __bgMarkerParserConfirmedForTests,
   endTurn,
   silenceMsForKey,
   silencePokeEnabled,
@@ -30,6 +36,7 @@ interface TestFixtures {
 function setupDeps(opts?: {
   thresholds?: Partial<typeof DEFAULT_THRESHOLDS> & { fallbackHardCeiling?: number }
   deferFallbackWhileToolInFlight?: boolean
+  isLegitimatelyWorking?: (key: string) => boolean
 }): TestFixtures {
   const fixtures: TestFixtures = { emitted: [], fallbacks: [] }
   __setDepsForTests({
@@ -42,6 +49,9 @@ function setupDeps(opts?: {
     ...(opts?.deferFallbackWhileToolInFlight != null
       ? { deferFallbackWhileToolInFlight: opts.deferFallbackWhileToolInFlight }
       : {}),
+    ...(opts?.isLegitimatelyWorking != null
+      ? { isLegitimatelyWorking: opts.isLegitimatelyWorking }
+      : {}),
   })
   return fixtures
 }
@@ -601,3 +611,273 @@ describe('silence-poke — Fix A: in-flight-tool defer', () => {
     expect(f.fallbacks).toHaveLength(0)
   })
 })
+
+// ─── #3519: CLI-side background-bash defer — the stacked-cards regression ─────
+// Root cause of the operator-visible bug: a single turn ran a foreground `Bash`
+// that the claude CLI auto-moved to the background at its foreground timeout.
+// The tool_result returned (draining `inFlightTools`), so every existing "still
+// working" signal — `isLegitimatelyWorking()`'s foreground/async-dispatch/
+// ask_user checks — went false while the process kept running and the model sat
+// silent waiting on it. At 300s the framework fallback fired: it nulled
+// `currentTurn` and tore down the pinned progress card (the `onFrameworkFallback`
+// callback → liveness-wiring.ts:427-441 `endCurrentTurnForKey`), and the next
+// tool burst minted a BRAND-NEW pinned card. Each > 300s gap repeated it →
+// 2..N stacked cards on ONE turn.
+//
+// These are OUTCOME assertions: `fixtures.fallbacks` counts every fallback fire,
+// and a fire is exactly a currentTurn-null + card teardown (the trigger for a
+// re-minted card). The production wiring is reproduced faithfully:
+// `isLegitimatelyWorking` IS wired (the gateway always wires it) and it returns
+// FALSE for the whole gap (the CLI-side background bash is invisible to it by
+// construction). Reverting the `sawBashThisTurn` defer turns these RED — the
+// fallback fires on every gap and multiple cards are minted.
+describe('silence-poke — #3519 background-bash defer (stacked-cards regression guard)', () => {
+  const PROD = {
+    thresholds: { fallbackHardCeiling: 900_000 }, // SILENCE_FALLBACK_HARD_MS
+    isLegitimatelyWorking: () => false,            // background bash is invisible
+  }
+
+  it('a foreground Bash moved to background does NOT tear down the card at 300s (mid-work)', () => {
+    const f = setupDeps(PROD)
+    startTurn('c:0', 0)
+    // Foreground bash starts, then auto-moves to background at ~120s: its
+    // tool_result returns so inFlightTools drains. isLegitimatelyWorking is
+    // false throughout — every existing signal says "idle".
+    noteToolStart('c:0', 't1', 'Bash', 'find / -name x', 5_000)
+    noteToolEnd('c:0', 't1', 125_000)
+    // The silent gap the model spends waiting on the background process.
+    __tickForTests(300_000)
+    __tickForTests(306_000) // well past the 300s base threshold
+    // BUG behaviour: fallback fires here (currentTurn nulled, card torn down).
+    // FIXED: deferred — the pinned card stays live, no re-mint.
+    expect(f.fallbacks).toHaveLength(0)
+  })
+
+  it('exactly ONE card survives a whole turn with two > 300s background-bash gaps', () => {
+    const f = setupDeps(PROD)
+
+    // Model the gateway's pinned-card lifecycle so the surviving card is
+    // asserted POSITIVELY, not merely inferred from zero teardowns. In
+    // production a fallback fire IS a card teardown (currentTurn nulled +
+    // pinned card unpinned, liveness-wiring.ts:427-441), and the next tool
+    // burst mints a BRAND-NEW pinned card — that re-mint is exactly the
+    // stacking. Here: mint one card when the turn starts, and replay a
+    // teardown + fresh re-mint for every fallback the silence-poke tick
+    // records. `mintedCards.length` is then the true number of cards that
+    // ever existed for the turn, and `pinnedCardId` is the live one.
+    const mintedCards: string[] = []
+    let pinnedCardId: string | null = null
+    const mintCard = (): void => {
+      const id = `card-${mintedCards.length + 1}`
+      mintedCards.push(id)
+      pinnedCardId = id
+    }
+    const syncCardsAfterTick = (): void => {
+      // Each recorded fallback == one teardown of the live card + a fresh
+      // re-mint by the resuming burst (the stacked-cards mechanism). Replay
+      // any teardown not yet modelled.
+      while (mintedCards.length - 1 < f.fallbacks.length) {
+        pinnedCardId = null // teardown unpins the live card
+        mintCard() // next tool burst mints a brand-new pinned card (a stack)
+      }
+    }
+
+    startTurn('c:0', 0)
+    mintCard() // the turn's first pinned progress card ("card-1")
+    // Gap 1 — first backgrounded find.
+    noteToolStart('c:0', 't1', 'Bash', 'find / -name a', 5_000)
+    noteToolEnd('c:0', 't1', 125_000)
+    __tickForTests(306_000)
+    syncCardsAfterTick()
+    expect(f.fallbacks).toHaveLength(0) // no Card B minted (zero teardowns)
+    // POSITIVE: the ORIGINAL pinned card is still the live one after gap 1,
+    // and it is the ONLY card that has ever existed.
+    expect(pinnedCardId).toBe('card-1')
+    expect(mintedCards).toHaveLength(1)
+    // Model resumes and updates the SAME pinned card (production resets the
+    // silence clock on that render), then launches a second backgrounded find.
+    noteProduction('c:0', 310_000)
+    noteToolStart('c:0', 't2', 'Bash', 'find / -name b', 315_000)
+    noteToolEnd('c:0', 't2', 435_000)
+    // Gap 2 — > 300s of silence since the last render (310_000).
+    __tickForTests(620_000)
+    syncCardsAfterTick()
+    expect(f.fallbacks).toHaveLength(0) // no Card C minted (zero teardowns)
+    // POSITIVE: still the same single original card, updated in place across
+    // BOTH gaps — no second/third card was ever minted (no stacking).
+    expect(pinnedCardId).toBe('card-1')
+    expect(mintedCards).toEqual(['card-1'])
+  })
+
+  it('still bounded: a genuinely wedged bash-turn unwedges ONCE at the hard ceiling (not 3×)', () => {
+    const f = setupDeps(PROD)
+    startTurn('c:0', 0)
+    noteToolStart('c:0', 't1', 'Bash', 'find /', 5_000)
+    noteToolEnd('c:0', 't1', 125_000)
+    __tickForTests(306_000)
+    expect(f.fallbacks).toHaveLength(0) // deferred, not fired 3×
+    __tickForTests(900_000) // crosses SILENCE_FALLBACK_HARD_MS
+    expect(f.fallbacks).toHaveLength(1) // exactly one bounded unwedge
+  })
+
+  it('the defer is Bash-specific: a non-Bash idle turn still fires at 300s (fix is scoped)', () => {
+    const f = setupDeps(PROD)
+    startTurn('c:0', 0)
+    noteToolStart('c:0', 't1', 'Grep', 'foo', 5_000)
+    noteToolEnd('c:0', 't1', 60_000) // Grep can't be a background process
+    __tickForTests(306_000)
+    expect(f.fallbacks).toHaveLength(1) // genuine silence → unwedges normally
+  })
+
+  it('honours the SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS=0 kill switch', () => {
+    const prev = process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS
+    process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS = '0'
+    try {
+      const f = setupDeps(PROD)
+      startTurn('c:0', 0)
+      noteToolStart('c:0', 't1', 'Bash', 'find /', 5_000)
+      noteToolEnd('c:0', 't1', 125_000)
+      __tickForTests(306_000)
+      expect(f.fallbacks).toHaveLength(1) // defer force-disabled → legacy fire
+    } finally {
+      if (prev != null) process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS = prev
+      else delete process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS
+    }
+  })
+})
+
+// ─── #3519 SHARPEN: PROVEN-alive defer, driven by REAL captured markers ───────
+// The coarse `sawBashThisTurn` guard above deferred EVERY bash-turn to the 900s
+// ceiling. This sharpens it: defer only while a background shell is PROVEN
+// alive (its structured `backgroundTaskId` launch marker seen, no completion
+// yet), and recover at ~300s the moment it finishes. The alive/dead facts here
+// are PARSED FROM REAL JSONL (tests/fixtures/bg-shell-liveness-3519.jsonl —
+// carrie session a6d2d33a-…, claude v2.1.197; line 109 auto-background launch,
+// line 175 `<task-notification>` completion — verbatim but for the operator username
+// scrubbed in both encodings per repo PII policy) through the SAME projectTranscriptLine
+// path the gateway uses, then fed to silence-poke exactly as the gateway feeds
+// it (tool_result.backgroundTaskId → noteBackgroundShellAlive; task_notification
+// → noteBackgroundShellDead). So every fixture value is traceable to a real byte.
+describe('silence-poke — #3519 sharpen: proven-alive defer (real markers)', () => {
+  const PROD = {
+    thresholds: { fallbackHardCeiling: 900_000 }, // SILENCE_FALLBACK_HARD_MS
+    isLegitimatelyWorking: () => false,            // background bash invisible to it
+  }
+  const FIXTURE = join(__dirname, 'fixtures', 'bg-shell-liveness-3519.jsonl')
+  const fxLines = readFileSync(FIXTURE, 'utf8').split('\n').filter(l => l.length > 0)
+  // Derive the REAL ids straight from the fixtures via the production parser.
+  const aliveEv = projectTranscriptLine(fxLines[0]).find(e => e.kind === 'tool_result')
+  const deadEv = projectTranscriptLine(fxLines[1])[0]
+  const LIVE_ID = aliveEv?.kind === 'tool_result' ? aliveEv.backgroundTaskId! : ''
+  const DEAD_ID = deadEv.kind === 'task_notification' ? deadEv.taskId : ''
+
+  it('sanity: the fixtures really carry a matching background-shell id', () => {
+    expect(LIVE_ID).toBe('bxa4sv3dq')
+    expect(DEAD_ID).toBe('bxa4sv3dq')
+  })
+
+  // (a) A shell PROVEN alive across a > 300s gap must NOT tear down the card —
+  //     and exactly ONE card survives (positive assertion, not inferred).
+  it('(a) live shell across a > 300s gap → no teardown, exactly one card', () => {
+    const f = setupDeps(PROD)
+    const mintedCards: string[] = []
+    let pinnedCardId: string | null = null
+    const mintCard = (): void => {
+      mintedCards.push(`card-${mintedCards.length + 1}`)
+      pinnedCardId = mintedCards[mintedCards.length - 1]
+    }
+    const syncCardsAfterTick = (): void => {
+      while (mintedCards.length - 1 < f.fallbacks.length) { pinnedCardId = null; mintCard() }
+    }
+
+    startTurn('c:0', 0)
+    mintCard() // the turn's first pinned progress card
+    // Foreground Bash auto-moved to background at ~120s: its tool_result
+    // returns (drains inFlightTools) carrying the real backgroundTaskId.
+    noteToolStart('c:0', 't1', 'Bash', 'find / -name x', 5_000)
+    noteToolEnd('c:0', 't1', 125_000)
+    noteBackgroundShellAlive('c:0', LIVE_ID) // gateway does this from the parsed event
+    __tickForTests(306_000)
+    syncCardsAfterTick()
+    __tickForTests(500_000) // still alive, still silent, still well past 300s
+    syncCardsAfterTick()
+    expect(f.fallbacks).toHaveLength(0)     // deferred — no teardown
+    expect(pinnedCardId).toBe('card-1')     // POSITIVE: original card still live
+    expect(mintedCards).toEqual(['card-1']) // and it is the ONLY card ever minted
+    expect(__bgMarkerParserConfirmedForTests()).toBe(true) // marker proven working
+  })
+
+  // (b) THE NEW capability: once the shell FINISHES (real completion marker),
+  //     a subsequent > 300s wedge recovers at ~300s — NOT held to 900s.
+  it('(b) shell went DEAD then a > 300s wedge → fallback fires at ~300s (fast recovery)', () => {
+    const f = setupDeps(PROD)
+    startTurn('c:0', 0)
+    noteToolStart('c:0', 't1', 'Bash', 'find / -name x', 5_000)
+    noteToolEnd('c:0', 't1', 125_000)
+    noteBackgroundShellAlive('c:0', LIVE_ID)   // backgrounded at ~120s
+    noteBackgroundShellDead('c:0', DEAD_ID)    // real <task-notification> completed at ~200s
+    // Model then goes silent on a genuine wedge. Because the CLI marker PARSED
+    // (confirmed), the coarse sawBash degradation is OFF, so the empty
+    // alive-set means this is real silence → recover at the 300s base window,
+    // not the 900s ceiling.
+    __tickForTests(306_000)
+    expect(f.fallbacks).toHaveLength(1) // FAST recovery restored (would be 0 under the old coarse guard)
+  })
+
+  // (c) SAFE DEGRADATION: if a future CLI renames the markers so NOTHING parses
+  //     (backgroundTaskId never resolves → parser never confirmed), we must not
+  //     regress to stacking — fall back to the 900s-bounded coarse guard.
+  it('(c) unmatched/changed CLI marker → degrades to the 900s-bounded guard', () => {
+    const f = setupDeps(PROD)
+    // Mutate the REAL alive line so neither the structured field nor the string
+    // matches — exactly what a marker rename looks like. Parse it as the gateway
+    // would; it yields NO backgroundTaskId, so noteBackgroundShellAlive is never
+    // called and the parser stays unconfirmed.
+    const mutated = JSON.parse(fxLines[0])
+    delete mutated.toolUseResult.backgroundTaskId
+    mutated.message.content[0].content = 'Task moved to background (id withheld by a newer CLI).'
+    const ev = projectTranscriptLine(JSON.stringify(mutated)).find(e => e.kind === 'tool_result')
+    expect(ev?.kind === 'tool_result' ? ev.backgroundTaskId : 'X').toBeUndefined()
+
+    startTurn('c:0', 0)
+    noteToolStart('c:0', 't1', 'Bash', 'find / -name x', 5_000) // sawBashThisTurn armed
+    noteToolEnd('c:0', 't1', 125_000)
+    // No alive registration (marker unparseable) → parser NOT confirmed.
+    expect(__bgMarkerParserConfirmedForTests()).toBe(false)
+    __tickForTests(306_000)
+    expect(f.fallbacks).toHaveLength(0) // still deferred by the coarse guard (no stacking)
+    __tickForTests(900_000)             // crosses the hard ceiling
+    expect(f.fallbacks).toHaveLength(1) // bounded unwedge — never hangs forever
+  })
+
+  // (d) Still bounded even while genuinely alive: a shell that never reports
+  //     dead still unwedges ONCE at the 900s ceiling (not indefinitely).
+  it('(d) a never-completing live shell still unwedges once at the 900s ceiling', () => {
+    const f = setupDeps(PROD)
+    startTurn('c:0', 0)
+    noteToolStart('c:0', 't1', 'Bash', 'find /', 5_000)
+    noteToolEnd('c:0', 't1', 125_000)
+    noteBackgroundShellAlive('c:0', LIVE_ID) // alive, never dies
+    __tickForTests(306_000)
+    expect(f.fallbacks).toHaveLength(0) // deferred while alive
+    __tickForTests(900_000)             // hard ceiling
+    expect(f.fallbacks).toHaveLength(1) // exactly one bounded unwedge
+  })
+
+  it('honours the SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS=0 kill switch even with a live shell', () => {
+    const prev = process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS
+    process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS = '0'
+    try {
+      const f = setupDeps(PROD)
+      startTurn('c:0', 0)
+      noteToolStart('c:0', 't1', 'Bash', 'find /', 5_000)
+      noteToolEnd('c:0', 't1', 125_000)
+      noteBackgroundShellAlive('c:0', LIVE_ID)
+      __tickForTests(306_000)
+      expect(f.fallbacks).toHaveLength(1) // force-disabled → no defer at all
+    } finally {
+      if (prev != null) process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS = prev
+      else delete process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS
+    }
+  })
+})

package/telegram-plugin/tests/silent-end-interrupt-stop-scan.test.ts

@@ -404,10 +404,13 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
   const NARRATION_B = "Now let me query the second source; it is slower than expected, hang tight…" // opener + …
   const NARRATION_C = "I'll cross-reference the last set of figures against the ledger before I summarise…" // opener + …
 
-  it('zero-delivery turn of only NARRATION blocks → block WITHOUT pendingText (#3228 Finding 2 / flush parity)', () => {
-    // Combined length of the three blocks is ≥ 200, so the OLD joined-floor code
-    // would join them and set pendingText (masquerade). The NEW code mirrors the
-    // flush's narration strip: every block is narration → nothing to deliver.
+  it('narration interleaved with work-tools, ending on a terminal narration line → only the terminal block, never the join (#3513 structural coalescer)', () => {
+    // #3513 follow-up — A and B are each followed by a turn-continuing tool_use
+    // (Bash / Read) → structurally intra-turn → UNCONDITIONALLY suppressed.
+    // C is the terminal block (no tool after it), so the deterministic coalescer
+    // delivers C ALONE. The #3228 Finding-2 join-masquerade (concatenating short
+    // narration to cross the 200-char floor) is STILL prevented: the 200-floor
+    // `pendingText` stays undefined, and the delivered text is never the join.
     expect((NARRATION_A + '\n\n' + NARRATION_B + '\n\n' + NARRATION_C).length)
       .toBeGreaterThanOrEqual(200)
     const text = jsonl(
@@ -421,8 +424,12 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
     const r = scanTurnForFinalReply(text)
     expect(r.decided).toBe('block')
     expect(r.reason).toBe('no-final-reply')
-    // The masquerade must NOT happen — no answer to deliver, take the re-prompt.
-    expect(r.pendingText).toBeUndefined()
+    // Never the join of the suppressed A/B blocks (masquerade guard preserved).
+    expect(r.pendingText).not.toContain(NARRATION_A)
+    expect(r.pendingText).not.toContain(NARRATION_B)
+    // The terminal block is the coalescer's selection (delivered via the
+    // zero-reply lowered floor); the 200-char masquerade path yields nothing.
+    expect(r.pendingText).toBe(NARRATION_C)
   })
 
   it('zero-delivery turn of MULTIPLE sub-200 REAL-CONTENT blocks → JOINED pendingText (review item 3 drop fix)', () => {
@@ -445,15 +452,34 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
     expect(r.hasTrailingProse).toBe(true)
   })
 
-  it('leading narration + a real sub-200 answer block → only the answer is delivered (narration stripped)', () => {
+  it('leading narration FOLLOWED BY A TOOL + a real sub-200 answer block → only the answer is delivered (structural strip)', () => {
+    // #3513 follow-up — the narration is stripped by the STRUCTURAL signal (a
+    // work-tool followed it), not by wording. The terminal answer block (no tool
+    // after it) is the coalescer's selection.
     const NARR = 'Let me pull the numbers first…' // narration opener + …
     const ANSWER = 'Revenue was up 12% quarter-over-quarter, driven mostly by the new enterprise tier.' // ~85, real
-    const text = jsonl(ENQUEUE, assistantText(NARR), assistantText(ANSWER))
+    const text = jsonl(
+      ENQUEUE,
+      assistantText(NARR),
+      assistantToolUse('Bash', { command: 'psql -c "select ..."' }),
+      assistantText(ANSWER),
+    )
     const r = scanTurnForFinalReply(text)
     expect(r.decided).toBe('block')
     expect(r.pendingText).toBe(ANSWER)
   })
 
+  it('leading narration with NO tool + a real answer → both delivered joined (fail-open; no wording strip on the backstop path, #3513)', () => {
+    // Without a structural continuation signal the coalescer delivers the full
+    // terminal run — the wording-based strip is gone (it was provably incomplete).
+    const NARR = 'Let me pull the numbers first…'
+    const ANSWER = 'Revenue was up 12% quarter-over-quarter, driven mostly by the new enterprise tier.'
+    const text = jsonl(ENQUEUE, assistantText(NARR), assistantText(ANSWER))
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('block')
+    expect(r.pendingText).toBe(`${NARR}\n\n${ANSWER}`)
+  })
+
   it('trailing narration after a delivered reply, all sub-floor → block only if a real ≥floor block exists; here → allow, no pendingText', () => {
     // Each trailing block is sub-floor, so `sawUndeliveredTextAfterAllow` is
     // false → allow. (The old joined-floor logic never affected the block
@@ -469,18 +495,21 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
     expect(r.pendingText).toBeUndefined()
   })
 
-  it('a genuine ≥floor answer followed by a SHORT closer → pendingText is the answer, not the closer', () => {
-    // "big answer then short closer" — the LAST substantive (≥floor) block is
-    // the answer; the trailing short closer must not displace it.
+  it('a genuine ≥floor answer followed by a SHORT closer → both delivered as the terminal run (answer never dropped, #3513)', () => {
+    // #3513 follow-up — "big answer then short closer", NO tool after either
+    // block, so both are the terminal run and are delivered JOINED. The #3228
+    // concern (a short closer DISPLACING the answer) cannot happen: the coalescer
+    // never drops the answer — it delivers the whole terminal run.
     const answer = 'Here is the real answer you were waiting for: ' + 'A'.repeat(300)
+    const closer = 'Let me know if you need anything else.'
     const text = jsonl(
       ENQUEUE,
       assistantText(answer),
-      assistantText('Let me know if you need anything else.'),
+      assistantText(closer),
     )
     const r = scanTurnForFinalReply(text)
     expect(r.decided).toBe('block')
-    expect(r.pendingText).toBe(answer)
+    expect(r.pendingText).toBe(`${answer}\n\n${closer}`)
   })
 
   it('substance-floor boundary: a single trailing block at 199/200/201 chars', () => {

package/telegram-plugin/tests/silent-end.test.ts

@@ -787,11 +787,17 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
       expect(lowered.text).toBe(joined)
     })
 
-    it('review item 3: NARRATION-only multi-block → still NO pendingText (no masquerade, #3228 Finding 2)', () => {
+    it('review item 3: intra-turn narration blocks each FOLLOWED BY A TOOL → NO pendingText (structural suppression, #3513)', () => {
+      // #3513 follow-up — each narration block is followed by a turn-continuing
+      // tool_use, so the deterministic coalescer suppresses BOTH unconditionally.
+      // The terminal run is empty and the last (tool-followed) block is sub-200 →
+      // the empty-terminal corner returns null → no pendingText, no masquerade.
       const transcript = writeTranscript([
         ENQUEUE,
         { type: 'assistant', message: { content: [{ type: 'text', text: 'Let me check the first source now, scanning the rows…' }] } },
+        { type: 'assistant', message: { content: [{ type: 'tool_use', id: 't1', name: 'Bash', input: { command: 'ls' } }] } },
         { type: 'assistant', message: { content: [{ type: 'text', text: "Now let me query the second source; hang tight…" }] } },
+        { type: 'assistant', message: { content: [{ type: 'tool_use', id: 't2', name: 'Read', input: { file_path: '/tmp/x' } }] } },
       ])
       const r = runHook({ session_id: 's', transcript_path: transcript, hook_event_name: 'Stop' })
       expect(JSON.parse(r.stdout.trim()).decision).toBe('block')

package/telegram-plugin/tests/tts-normalize.test.ts

@@ -4,6 +4,7 @@
  */
 import { describe, test, expect, beforeEach, afterEach } from 'bun:test'
 import { normalizeForTts, ttsNormalizeEnabled } from '../tts-normalize.js'
+import { normalizeForSpeech } from '../voice-normalize-text.js'
 
 const KILL = 'SWITCHROOM_DISABLE_TTS_NORMALIZE'
 
@@ -240,3 +241,68 @@ describe('conservatism', () => {
     expect(normalizeForTts(input)).toBe(normalizeForTts(input))
   })
 })
+
+describe('normalizeForTts — backslash escapes & HTML entities (last-line defence)', () => {
+  test('strips a literal \\b so the engine never speaks "backslash b"', () => {
+    const out = normalizeForTts('the regex \\b boundary')
+    expect(out).toBe('the regex b boundary')
+    expect(out).not.toContain('\\')
+  })
+
+  test('unescapes MarkdownV2 punctuation escapes (\\. \\! \\-)', () => {
+    expect(normalizeForTts('done\\. next\\! wait\\-')).toBe('done. next! wait-')
+  })
+
+  test('decodes HTML entities (& < ')', () => {
+    expect(normalizeForTts('Tom & Jerry')).toBe('Tom and Jerry')
+    expect(normalizeForTts('5 &lt; 10')).toBe('5 < 10')
+    expect(normalizeForTts("it&#39;s here")).toBe("it's here")
+  })
+
+  test('rich mixed reply → clean spoken text (no backslash/backtick/entity)', () => {
+    const reply =
+      '**Bold** and `code\\b` and a [label](https://example.com/x) ' +
+      'with Tom &amp; Jerry and a regex \\b\\.'
+    const out = normalizeForTts(reply)
+    expect(out).not.toContain('\\')
+    expect(out).not.toContain('`')
+    expect(out).not.toContain('&amp;')
+    expect(out).toContain('label')
+    expect(out).toContain('Tom and Jerry')
+  })
+
+  test('kill switch still returns byte-identical input (escapes preserved)', () => {
+    process.env[KILL] = '1'
+    expect(normalizeForTts('a \\b &amp; b')).toBe('a \\b &amp; b')
+    delete process.env[KILL]
+  })
+
+  test('idempotent after normalizeForSpeech already unescaped', () => {
+    const reply = 'a \\b and Tom &amp; Jerry \\. end'
+    const once = normalizeForTts(reply)
+    expect(normalizeForTts(once)).toBe(once)
+  })
+})
+
+describe('normalizeForTts — review findings (fixpoint decode, metachar, nits)', () => {
+  test('L2 parity: immediate (speech+tts) and single-tts agree on a double-encoded entity', () => {
+    const x = '&amp;amp;lt;'
+    const immediate = normalizeForTts(normalizeForSpeech(x))
+    const singleTts = normalizeForTts(x)
+    expect(immediate).toBe('<')
+    expect(singleTts).toBe('<')
+    expect(immediate).toBe(singleTts)
+    expect(normalizeForTts('&amp;amp;amp;')).toBe('&')
+  })
+
+  test('L1: entity → line-leading metachar keeps a spoken form (hash/asterisk)', () => {
+    expect(normalizeForTts('&#35; Heading')).toBe('hash Heading')
+    expect(normalizeForTts('2 &#42; 3')).toBe('2 asterisk 3')
+  })
+
+  test('nit: dangling trailing backslash dropped; &#92; decodes then strips', () => {
+    expect(normalizeForTts('ends here\\')).toBe('ends here')
+    expect(normalizeForTts('X&#92;Y')).toBe('XY')
+    expect(normalizeForTts('X&#92;Y')).not.toContain('\\')
+  })
+})