switchroom 0.19.2 → 0.19.3

package/telegram-plugin/tests/reply-owner-resolve.test.ts

@@ -34,8 +34,10 @@ import {
   resolveReplyOwnerTurnId,
   decideAnswerLatchSuppression,
   type ReplyOwnerCandidates,
+  type AnswerDeliveredLatch,
 } from '../reply-owner-resolve.js'
 import { FlushedTurnSupersedeRegistry, DEFAULT_SUPERSEDE_TTL_MS } from '../flushed-turn-supersede.js'
+import { OutboundDedupCache } from '../recent-outbound-dedup.js'
 
 const NONE: ReplyOwnerCandidates = {
   liveTurnId: null,
@@ -129,13 +131,13 @@ describe('Part 1 end-to-end: unified resolver drives the flush supersede', () =>
 
 describe('decideAnswerLatchSuppression — race backstop (Part 2)', () => {
   it('RACE: a late substantive reply lands in the flush post-fire pre-record ' +
-    'window (no supersede record yet) → SUPPRESSED by the latch', () => {
+    'window (no supersede record yet) → SUPPRESSED by the flush-armed latch', () => {
     expect(
       decideAnswerLatchSuppression({
         superseded: false,
         replySubstantive: true,
         isLateReply: true,
-        ownerAnswerDelivered: true,
+        ownerAnswerDelivered: 'flush',
       }),
     ).toBe(true)
   })
@@ -147,7 +149,7 @@ describe('decideAnswerLatchSuppression — race backstop (Part 2)', () => {
         superseded: true,
         replySubstantive: true,
         isLateReply: true,
-        ownerAnswerDelivered: true,
+        ownerAnswerDelivered: 'flush',
       }),
     ).toBe(false)
   })
@@ -159,7 +161,7 @@ describe('decideAnswerLatchSuppression — race backstop (Part 2)', () => {
         superseded: false,
         replySubstantive: false,
         isLateReply: true,
-        ownerAnswerDelivered: true,
+        ownerAnswerDelivered: 'flush',
       }),
     ).toBe(false)
   })
@@ -171,7 +173,7 @@ describe('decideAnswerLatchSuppression — race backstop (Part 2)', () => {
         superseded: false,
         replySubstantive: true,
         isLateReply: false,
-        ownerAnswerDelivered: true,
+        ownerAnswerDelivered: 'flush',
       }),
     ).toBe(false)
   })
@@ -195,7 +197,7 @@ describe('F1 — flush send failure must NOT suppress the late reply (zero-messa
   // latch armed would make a genuine late reply suppress itself → the user gets
   // ZERO messages. The gateway's send-failure catch resets `answerDelivered =
   // false`; these assert the resulting coordination outcome at the pure core.
-  const lateSubstantiveReply = (ownerAnswerDelivered: boolean) =>
+  const lateSubstantiveReply = (ownerAnswerDelivered: AnswerDeliveredLatch) =>
     decideAnswerLatchSuppression({
       superseded: false,
       replySubstantive: true,
@@ -205,8 +207,8 @@ describe('F1 — flush send failure must NOT suppress the late reply (zero-messa
 
   it('WITHOUT the catch-reset (latch still armed) the late reply is suppressed ' +
     '— the zero-message bug', () => {
-    // Models the buggy state: flush armed the latch, send failed, latch left true.
-    expect(lateSubstantiveReply(true)).toBe(true)
+    // Models the buggy state: flush armed the latch, send failed, latch left armed.
+    expect(lateSubstantiveReply('flush')).toBe(true)
   })
 
   it('WITH the catch-reset (answerDelivered=false) the late reply DELIVERS', () => {
@@ -293,15 +295,15 @@ describe('F2 — recency-bound the destructive latest-ended supersede tier', ()
  * consumed — the retry takes the no-record branch. Without a latch the retry
  * would ship a fresh B alongside the stale narration A (both visible).
  *
- * The fix latches `ownerTurn.answerDelivered = true` at record consumption, so
- * the retry (resolving the SAME ended owner turn) is caught by
+ * The fix latches `ownerTurn.answerDelivered = 'flush'` at record consumption,
+ * so the retry (resolving the SAME ended owner turn) is caught by
  * `decideAnswerLatchSuppression` and suppressed — exactly one message survives.
  */
 describe('reply-flicker edit-in-place — mid-path throw + retry never resurrects the duplicate (L1)', () => {
   const CHAT = '636363'
 
   /** Minimal model of the ended owner turn atom the gateway mutates + reads. */
-  interface OwnerTurn { turnId: string; answerDelivered: boolean }
+  interface OwnerTurn { turnId: string; answerDelivered: AnswerDeliveredLatch }
 
   /**
    * Drive the two gateway `reply` calls the incident produces, threading the
@@ -325,8 +327,9 @@ describe('reply-flicker edit-in-place — mid-path throw + retry never resurrect
     const d1 = reg.take(CHAT, undefined, { liveTurnId: owner.turnId, now: now + 10 })
     const firstSuperseded = d1.supersede
     if (d1.supersede && setLatchOnSupersede) {
-      // The fix: latch at consumption, BEFORE the arg-validation throw.
-      owner.answerDelivered = true
+      // The fix: latch at consumption, BEFORE the arg-validation throw. Tagged
+      // 'flush' (#3426) — a flush record existed for this turn.
+      owner.answerDelivered = 'flush'
     }
     // Arg-validation throw fires here (oversized file / invalid keyboard):
     // the correction never runs → A is neither deleted nor edited, B not sent.
@@ -367,3 +370,244 @@ describe('reply-flicker edit-in-place — mid-path throw + retry never resurrect
     expect(r.visible).toEqual(['A(flush-narration)', 'B(retry-reply)'])
   })
 })
+
+/**
+ * #3426 — async sub-agent handback silently dropped by a stale answer-delivered
+ * latch.
+ *
+ * ## The incident these tests pin (overlord, chat 12345, turn …#10473)
+ *
+ *   11:28:00  interim ack `reply` (321 chars — ABOVE the ≥200 substantive
+ *             floor) lands in the LIVE turn; the gateway records the answer on
+ *             the turn atom (outbound-send-path no-record branch tail).
+ *   11:28:10  turn_end (replyCalled=true, finalAnswer=true); the atom persists
+ *             in recentTurnsById with endedAt stamped.
+ *   11:28:51  the async sub-agent completes and the agent's handback `reply`
+ *             (1365 chars, GENUINELY DIFFERENT content) lands with NO live
+ *             gateway turn (a sub-agent completion is not a new inbound, so no
+ *             new turn atom exists). The owner resolves to the ENDED ack turn
+ *             via the latest-ended tier (41 s ≤ the 60 s supersede TTL), whose
+ *             boolean latch was still armed → the handback was suppressed as a
+ *             "flush duplicate" and a false "deduped" success returned. The
+ *             user never saw the sub-agent's findings.
+ *
+ * ## The fix
+ *
+ * The latch is SOURCE-TAGGED (`AnswerDeliveredLatch`): 'flush' when the
+ * turn-flush backstop armed it (the two races the suppression exists for),
+ * 'reply' when a normally-delivered reply carried the answer.
+ * `decideAnswerLatchSuppression` suppresses a late reply ONLY for a
+ * flush-armed latch — a 'reply'-armed latch never suppresses, so the
+ * dispatch → ack → turn_end → handback sequence always delivers. Genuine
+ * byte-identical replays of the delivered reply remain covered by the
+ * content-keyed #546 outbound dedup, asserted below. (Honest bound: the dedup
+ * TTL is anchored at reply RECORD time, the latest-ended owner tier at
+ * `endedAt` — a replay landing in the gap between those 60 s windows now
+ * delivers as a rare duplicate rather than being suppressed; a conscious
+ * trade against the silent handback drop. See the `AnswerDeliveredLatch`
+ * docblock.)
+ */
+describe('#3426 — async sub-agent handback after an interim-ack turn', () => {
+  const CHAT = '12345'
+  const ACK_TURN = '12345:_#10473'
+  /** ms between turn_end (11:28:10) and the handback landing (11:28:51). */
+  const HANDBACK_AGE_MS = 41_000
+
+  interface OwnerTurn { turnId: string; answerDelivered: AnswerDeliveredLatch }
+
+  /** The OLD (pre-#3426) decision, reproduced verbatim for the red-on-main
+   *  contrast: the latch was a plain boolean, so ANY armed latch suppressed a
+   *  late substantive reply regardless of which path armed it. */
+  function oldBooleanLatchSuppression(input: {
+    superseded: boolean
+    replySubstantive: boolean
+    isLateReply: boolean
+    ownerAnswerDelivered: boolean
+  }): boolean {
+    if (input.superseded) return false
+    if (!input.replySubstantive) return false
+    if (!input.isLateReply) return false
+    return input.ownerAnswerDelivered
+  }
+
+  /**
+   * Drive the incident timeline through the SAME pure cores the gateway runs.
+   * `latchSemantics` toggles the fixed source-tagged decision ('tagged') vs
+   * the pre-fix boolean decision ('boolean' — red-on-main contrast).
+   * Returns what the user ends up seeing.
+   */
+  function runDispatchAckHandback(latchSemantics: 'tagged' | 'boolean'): {
+    delivered: string[]
+    ownerId: string | null
+    handbackSuppressed: boolean
+  } {
+    const reg = new FlushedTurnSupersedeRegistry()
+    const now = 1_000_000
+    const owner: OwnerTurn = { turnId: ACK_TURN, answerDelivered: false }
+    const delivered: string[] = []
+
+    // ── 1. Interim ack lands IN the live turn (substantive: 321 ≥ 200). ──
+    // Live turn ⇒ isLateReply=false ⇒ never suppressed; the gateway then
+    // arms the latch on the owner turn (outbound-send-path no-record tail).
+    const ackSuppressed = decideAnswerLatchSuppression({
+      superseded: false,
+      replySubstantive: true,
+      isLateReply: false, // currentTurn is live at ack time
+      ownerAnswerDelivered: owner.answerDelivered,
+    })
+    expect(ackSuppressed).toBe(false)
+    delivered.push('ack("Kicked off a fable researcher…")')
+    owner.answerDelivered = 'reply' // the fixed arm site tags the source
+
+    // ── 2. turn_end — the atom persists (endedAt stamped), latch still armed. ──
+
+    // ── 3. The async handback lands 41 s later with NO live gateway turn. ──
+    // DM ⇒ no origin_turn_id; no quote recovery; the latest-ended tier
+    // resolves the ENDED ack turn as owner (41 s ≤ 60 s TTL) — the latch IS
+    // genuinely reachable, which is exactly how the incident happened.
+    const ownerId = resolveReplyOwnerTurnId({
+      liveTurnId: null,
+      originTurnId: null,
+      quotedTurnId: null,
+      latestEndedTurnId: owner.turnId,
+      latestEndedAgeMs: HANDBACK_AGE_MS,
+      latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
+    })
+    expect(ownerId).toBe(ACK_TURN)
+
+    // No flush ever fired this turn ⇒ no supersede record to take.
+    const supersede = reg.take(CHAT, undefined, { liveTurnId: ownerId, now: now + HANDBACK_AGE_MS })
+    expect(supersede.supersede).toBe(false)
+
+    const handbackSuppressed = latchSemantics === 'tagged'
+      ? decideAnswerLatchSuppression({
+          superseded: false,
+          replySubstantive: true, // 1365 chars
+          isLateReply: true, // no live gateway turn at handback time
+          ownerAnswerDelivered: owner.answerDelivered,
+        })
+      : oldBooleanLatchSuppression({
+          superseded: false,
+          replySubstantive: true,
+          isLateReply: true,
+          // Pre-fix the latch was `true` (a bare boolean, source-blind).
+          ownerAnswerDelivered: owner.answerDelivered !== false,
+        })
+    if (!handbackSuppressed) delivered.push('handback("Fable\'s back. The /model fix…")')
+    return { delivered, ownerId, handbackSuppressed }
+  }
+
+  it('CORE REGRESSION (the fix): the handback is NOT suppressed — the user ' +
+    'receives BOTH the interim ack AND the sub-agent findings', () => {
+    const r = runDispatchAckHandback('tagged')
+    expect(r.handbackSuppressed).toBe(false)
+    expect(r.delivered).toEqual([
+      'ack("Kicked off a fable researcher…")',
+      'handback("Fable\'s back. The /model fix…")',
+    ])
+  })
+
+  it('RED-ON-MAIN CONTRAST: the pre-fix boolean latch suppresses the handback ' +
+    '— the silent drop (only the ack ever reaches the user)', () => {
+    const r = runDispatchAckHandback('boolean')
+    // Owner resolution is identical in both worlds — the ended ack turn.
+    expect(r.ownerId).toBe(ACK_TURN)
+    expect(r.handbackSuppressed).toBe(true)
+    expect(r.delivered).toEqual(['ack("Kicked off a fable researcher…")'])
+  })
+
+  it('pure core: a reply-armed latch never suppresses a late substantive reply', () => {
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive: true,
+        isLateReply: true,
+        ownerAnswerDelivered: 'reply',
+      }),
+    ).toBe(false)
+  })
+
+  it('flush race NOT reopened: the same late-landing shape against a ' +
+    'FLUSH-armed latch is still suppressed (the Part 2 backstop holds)', () => {
+    // Same timeline shape, but the turn's answer went out via the turn-flush
+    // backstop (post-fire pre-record window): latch = 'flush', no record yet.
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive: true,
+        isLateReply: true,
+        ownerAnswerDelivered: 'flush',
+      }),
+    ).toBe(true)
+  })
+
+  it('double-send NOT reopened: a byte-identical replay of the delivered ' +
+    'reply is still caught by the #546 content dedup (60 s TTL)', () => {
+    const dedup = new OutboundDedupCache()
+    const now = 5_000_000
+    const answer =
+      'Fable is back. The /model fix landed in release 1.0.128 and the fallback ' +
+      'behaviour matches what we saw in the transcripts yesterday evening.'
+    // The reply path records what it sent (with its turn key)…
+    dedup.record(CHAT, undefined, answer, now, ACK_TURN)
+    // …and a late byte-identical replay (no live turn ⇒ null turnKey, which
+    // matches any recorded entry) is deduped before the latch is ever consulted.
+    const replay = dedup.check(CHAT, undefined, answer, now + HANDBACK_AGE_MS, null)
+    expect(replay).not.toBeNull()
+    // While the DIFFERENT-content handback sails past the content dedup…
+    const handback = dedup.check(
+      CHAT, undefined,
+      'Completely different sub-agent findings text, long enough to clear the dedup floor.',
+      now + HANDBACK_AGE_MS, null,
+    )
+    expect(handback).toBeNull()
+  })
+})
+
+/**
+ * #3429 — content evidence in the answer-delivered latch.
+ *
+ * A flush-armed latch used to suppress ANY late substantive reply resolving
+ * the flush-delivered ended turn. With the supersede path now declining
+ * new-content handbacks (they must send FRESH, not edit the flushed message in
+ * place), those handbacks fall through to this latch — which would have
+ * converted the #3429 silent edit into a #3426-style silent drop. The
+ * `replyMatchesFlushedAnswer` evidence closes that: positive FALSE (the reply
+ * is NOT the flushed answer) never suppresses; TRUE or unknown (null/omitted)
+ * preserves the #2996 Part 2 flush-race backstop exactly as before.
+ */
+describe('#3429 — flush-armed latch with content evidence', () => {
+  const base = {
+    superseded: false,
+    replySubstantive: true,
+    isLateReply: true,
+    ownerAnswerDelivered: 'flush' as const,
+  }
+
+  it('CORE: positive new-content evidence (matches === false) is NEVER suppressed ' +
+    '— the handback after a flush-delivered turn delivers fresh', () => {
+    expect(decideAnswerLatchSuppression({ ...base, replyMatchesFlushedAnswer: false })).toBe(false)
+  })
+
+  it('the flushed answer landing again (matches === true) is still suppressed ' +
+    '(the flush race the latch exists for)', () => {
+    expect(decideAnswerLatchSuppression({ ...base, replyMatchesFlushedAnswer: true })).toBe(true)
+  })
+
+  it('unknown evidence (null) keeps the conservative pre-#3429 suppression', () => {
+    expect(decideAnswerLatchSuppression({ ...base, replyMatchesFlushedAnswer: null })).toBe(true)
+  })
+
+  it('omitted evidence keeps the conservative pre-#3429 suppression (back-compat)', () => {
+    expect(decideAnswerLatchSuppression(base)).toBe(true)
+  })
+
+  it('evidence never overrides the reply-armed/unarmed rules (still no suppression)', () => {
+    expect(
+      decideAnswerLatchSuppression({ ...base, ownerAnswerDelivered: 'reply', replyMatchesFlushedAnswer: true }),
+    ).toBe(false)
+    expect(
+      decideAnswerLatchSuppression({ ...base, ownerAnswerDelivered: false, replyMatchesFlushedAnswer: true }),
+    ).toBe(false)
+  })
+})

package/telegram-plugin/tests/send-reply-golden.test.ts

@@ -569,3 +569,157 @@ describe('structural wiring — the singleton + the gateway entry point (#2996 P
     expect(win.match(/getCurrentTurn\(\)/g)!.length).toBeGreaterThanOrEqual(5)
   })
 })
+
+/**
+ * #3429 — GATEWAY-LEVEL regression: an async handback landing after a
+ * flush-delivered turn ENDED must produce a FRESH, notifying message — never a
+ * silent edit-in-place of the prior turn's flushed message.
+ *
+ * This drives the REAL `sendReply` body (the exact gateway send path: the
+ * supersede consumption at outbound-send-path.ts ~874-905 and the deferred
+ * `decideSupersedeCorrection` edit-in-place lane at ~1462-1477) against the
+ * fake bot API, with a REAL `FlushedTurnSupersedeRegistry` seeded exactly the
+ * way the turn-flush backstop seeds it (record + 'flush'-armed ended owner
+ * turn). The incident (msgs 10482/10486, 2026-07-20): the handback resolved
+ * the flush-delivered ENDED turn as owner via the latest-ended tier (inside
+ * the 60 s TTL), consumed the supersede record, and EDITED the flushed message
+ * in place — Telegram edits never push-notify, so genuinely new content failed
+ * to surface client-side. Red on pre-fix code: these first asserts see an
+ * `editMessageText` call and no fresh send.
+ *
+ * The turn-end-funnel flag (SWITCHROOM_TURN_END_FUNNEL_V2, default ON) does
+ * not fork this path — the flush branch records into the SAME registry and the
+ * reply path consumes it identically under both settings — so this covers the
+ * v2 funnel default.
+ */
+describe('#3429 — post-turn-end handback vs flush-delivered supersede (real send path)', () => {
+  const OWNER_TURN_ID = `${CHAT}:_#ended-40`
+  const FLUSH_MSG_ID = 4242
+  const FLUSHED_TEXT =
+    'Checking the fleet status now.\n\n' +
+    'All twelve agents are healthy: the gateway, the vault broker, and the approval kernel ' +
+    'all report green health checks, and no container has restarted in the last twenty-four hours. ' +
+    'Nothing needs attention right now.'
+  const CANONICAL_REPLY =
+    'All twelve agents are healthy: the gateway, the vault broker, and the approval kernel ' +
+    'all report green health checks, and no container has restarted in the last twenty-four hours. ' +
+    'Nothing needs attention right now.'
+  const HANDBACK =
+    'Worker handback: the researcher sub-agent finished the migration audit. It found three ' +
+    'schema drifts in the staging database, wrote the full report to the shared drive, and ' +
+    'opened PR #3430 with the corrective migration. Tests are green and it is ready for review.'
+
+  /** An ENDED, flush-delivered owner turn — exactly the atom state the
+   *  turn-flush fire site leaves in `recentTurnsById` (latch 'flush', flushed
+   *  text stamped, endedAt within the supersede TTL). */
+  function makeFlushDeliveredEndedTurn(): CurrentTurn {
+    return {
+      turnId: OWNER_TURN_ID,
+      sessionChatId: CHAT,
+      answerDelivered: 'flush',
+      flushedAnswerText: FLUSHED_TEXT,
+      endedAt: Date.now() - 30_000,
+      replyCalled: false,
+      finalAnswerDelivered: true,
+      finalAnswerSubstantive: true,
+    } as unknown as CurrentTurn
+  }
+
+  function seedFlushRecord(h: ReturnType<typeof makeHarness>, owner: CurrentTurn): void {
+    h.deps.flushedTurnSupersede.record(
+      CHAT,
+      undefined,
+      { turnId: owner.turnId, messageIds: [FLUSH_MSG_ID], text: FLUSHED_TEXT },
+      Date.now(),
+    )
+    // The late reply resolves the ENDED flush-delivered turn as its owner
+    // (latest-ended tier — no live turn, no origin echo, no quote in a DM).
+    h.deps.resolveReplyOwnerTurn = () => owner
+  }
+
+  it('CORE REGRESSION (red pre-fix): a handback with genuinely NEW content sends a ' +
+    'FRESH message — no silent edit-in-place of the flushed message', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    seedFlushRecord(h, owner)
+
+    // The handback lands LATE: req.turn = null (no live gateway turn — a
+    // sub-agent completion is not a new inbound).
+    const res = await sendReply(h.deps, req(HANDBACK))
+
+    // A NEW client-visible message shipped (fresh send ⇒ Telegram push
+    // notifies)…
+    const fresh = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(fresh).toHaveLength(1)
+    expect(fresh[0]!.text).toContain('migration audit')
+    expect(fresh[0]!.message_id).not.toBe(FLUSH_MSG_ID)
+    // …and the flushed message was NEITHER edited nor deleted (edits never
+    // re-notify — the pre-fix silent path).
+    expect(h.calls.filter((c) => c.method === 'editMessageText')).toHaveLength(0)
+    expect(h.calls.filter((c) => c.method === 'deleteMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+
+    // The supersede record was NOT consumed: the turn's own canonical replay
+    // could still correct the flushed message afterwards.
+    expect(
+      h.deps.flushedTurnSupersede.peek(CHAT, undefined, {
+        liveTurnId: OWNER_TURN_ID,
+        replyText: CANONICAL_REPLY,
+        now: Date.now(),
+      }).supersede,
+    ).toBe(true)
+  })
+
+  it('PRESERVED: the turn\'s OWN canonical late replay (same answer, contained in ' +
+    'the flushed blob) still supersedes via edit-in-place — no duplicate bubble', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    seedFlushRecord(h, owner)
+
+    const res = await sendReply(h.deps, req(CANONICAL_REPLY))
+
+    // The single flushed message was edited into the canonical reply…
+    const edits = h.calls.filter((c) => c.method === 'editMessageText')
+    expect(edits).toHaveLength(1)
+    expect(edits[0]!.message_id).toBe(FLUSH_MSG_ID)
+    expect(edits[0]!.text).toContain('All twelve agents are healthy')
+    // …and NO second bubble shipped (the #3236/#2996 duplicate class stays closed).
+    expect(h.calls.filter((c) => c.method === 'sendRichMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent/)
+    // Record consumed — a retry cannot re-target the now-corrected message.
+    expect(
+      h.deps.flushedTurnSupersede.peek(CHAT, undefined, {
+        liveTurnId: OWNER_TURN_ID,
+        now: Date.now(),
+      }).reason,
+    ).toBe('no-record')
+  })
+
+  it('PRE-RECORD RACE, new content: flush fired (latch armed + text stamped) but ' +
+    'record not yet written — the handback still delivers FRESH, not suppressed', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    // NO registry record (the post-fire pre-record window); owner resolution
+    // still recovers the ended flush-armed turn.
+    h.deps.resolveReplyOwnerTurn = () => owner
+
+    const res = await sendReply(h.deps, req(HANDBACK))
+
+    const fresh = h.calls.filter((c) => c.method === 'sendRichMessage')
+    expect(fresh).toHaveLength(1)
+    expect(fresh[0]!.text).toContain('migration audit')
+    expect(res.content[0]!.text).toMatch(/^sent \(id: \d+\)$/)
+  })
+
+  it('PRE-RECORD RACE, same answer: the flushed answer landing again in the race ' +
+    'window is still suppressed (the #2996 Part 2 backstop holds)', async () => {
+    const h = makeHarness()
+    const owner = makeFlushDeliveredEndedTurn()
+    h.deps.resolveReplyOwnerTurn = () => owner
+
+    const res = await sendReply(h.deps, req(FLUSHED_TEXT))
+
+    expect(h.calls).toHaveLength(0) // nothing sent, nothing edited
+    expect(res.content[0]!.text).toContain('deduped')
+  })
+})

package/telegram-plugin/tests/session-model-source.test.ts

@@ -10,6 +10,8 @@
  */
 import { describe, it, expect } from 'vitest'
 import { createSessionModelSource } from '../gateway/session-model-source.js'
+import type { SessionModelDivergence } from '../gateway/session-model-source.js'
+import { servedModelMatchesRequested } from '../gateway/model-command.js'
 
 describe('createSessionModelSource — freshest observation wins', () => {
   it('returns null when neither source has reported', () => {
@@ -76,3 +78,143 @@ describe('createSessionModelSource — freshest observation wins', () => {
     expect(s.getOverride()).toBe('sr-glm-5')
   })
 })
+
+// ── #3427 item 4: requested-vs-served divergence tripwire ────────────────────
+//
+// `--fallback-model` masks an invalid requested id: the override carries the
+// requested token while claude silently serves the fallback. The FIRST live
+// transcript observation of the post-relaunch session is the earliest
+// deterministic verification point — these assert the handler FIRES on a
+// mismatch (with the right payload), fires at most once per armed override,
+// and — the #3437 H1/H2 false-positive contract — NEVER fires from a
+// command-time (unarmed) override set or from a first-attach replay line.
+
+describe('createSessionModelSource — divergence tripwire (#3427)', () => {
+  function armed() {
+    const fired: SessionModelDivergence[] = []
+    const s = createSessionModelSource({ servedMatchesRequested: servedModelMatchesRequested })
+    s.setDivergenceHandler((d) => fired.push(d))
+    return { s, fired }
+  }
+
+  it('fires ONCE with requested+served when the first post-boot line serves a different model', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true }) // boot rehydration: invalid id, fallback will substitute
+    s.noteTranscriptModel('claude-opus-4-8') // first assistant line: the fallback
+    expect(fired).toEqual([{ requested: 'claude-sonnet-9', served: 'claude-opus-4-8' }])
+    // Subsequent lines do not re-fire (once per armed override).
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(1)
+  })
+
+  it('does NOT fire when the served model satisfies the requested token (alias → full id)', () => {
+    const { s, fired } = armed()
+    s.setOverride('sonnet', { verify: true })
+    s.noteTranscriptModel('claude-sonnet-5')
+    expect(fired).toHaveLength(0)
+  })
+
+  it('verification is consumed by the FIRST live observation — a later different model is a normal switch, not a divergence', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-opus-4-8', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8') // verified OK
+    s.noteTranscriptModel('claude-sonnet-5') // e.g. a native in-session switch
+    expect(fired).toHaveLength(0)
+  })
+
+  it('re-arms on every verify-set', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-opus-4-8', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8') // ok
+    s.setOverride('claude-sonnet-9', { verify: true }) // next apply-boot, bogus id
+    s.noteTranscriptModel('claude-opus-4-8') // fallback again
+    expect(fired).toEqual([{ requested: 'claude-sonnet-9', served: 'claude-opus-4-8' }])
+  })
+
+  it('clearing the override disarms (nothing to verify)', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.setOverride(null)
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+  })
+
+  // H1 (#3437 review blocker): the command-time scheduleModelRelaunch record —
+  // setOverride(model) with NO verify — must not arm. The prior boot may have
+  // left the handler registered and its own arm consumed; an assistant line in
+  // the pre-restart window is served by the OLD model and would otherwise
+  // false-accuse a perfectly valid NEW token.
+  it('H1: a command-time setOverride (no verify) NEVER arms — no false DIVERGENCE in the pre-restart window', () => {
+    const { s, fired } = armed()
+    // Prior apply-boot: armed, verified OK on the first line.
+    s.setOverride('claude-opus-4-8', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8')
+    // Operator issues /model <valid new id>; scheduleModelRelaunch records it
+    // pre-restart (status honesty) WITHOUT verify.
+    s.setOverride('claude-sonnet-5')
+    // The still-running OLD session emits another assistant line before the
+    // restart lands — served by the OLD model. Must NOT fire.
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+    // …and the override record itself is intact for /status honesty.
+    expect(s.getOverride()).toBe('claude-sonnet-5')
+  })
+
+  it('H1: a verify-arm is CLEARED by a later plain set (the newest write wins, unarmed)', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true }) // armed, not yet verified
+    s.setOverride('claude-haiku-4-5') // command-time re-set before any line
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+  })
+
+  // H2 (#3437 review blocker): the session-tail's first-attach replay delivers
+  // the PRIOR session's in-flight turn AFTER boot — OLD-model lines. They must
+  // neither fire nor consume verification; the first LIVE line still verifies.
+  it('H2: replayed observations neither fire nor consume — the first LIVE line still verifies (valid switch, no card)', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-5', { verify: true }) // apply-boot onto a VALID id
+    // Boot replay of the pre-relaunch in-flight turn (old model claude-opus-4-8).
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true })
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true })
+    expect(fired).toHaveLength(0) // the false-positive path the review flagged
+    // First LIVE line of the new session: the requested model. Verified clean.
+    s.noteTranscriptModel('claude-sonnet-5')
+    expect(fired).toHaveLength(0)
+  })
+
+  it('H2: a genuinely bogus id still fires on the first LIVE line after replay', () => {
+    const { s, fired } = armed()
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true }) // replayed old-turn line: ignored
+    expect(fired).toHaveLength(0)
+    s.noteTranscriptModel('claude-opus-4-8') // first LIVE line: the fallback
+    expect(fired).toEqual([{ requested: 'claude-sonnet-9', served: 'claude-opus-4-8' }])
+  })
+
+  it('replayed observations still update /status freshness exactly as before', () => {
+    const { s } = armed()
+    s.setOverride('claude-sonnet-5', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8', { replayed: true })
+    // Freshness contract unchanged: the newer observation (transcript) wins.
+    expect(s.resolve()).toEqual({ model: 'claude-opus-4-8', source: 'transcript' })
+  })
+
+  it('never fires without a comparator (default construction) — old callers unchanged', () => {
+    const fired: SessionModelDivergence[] = []
+    const s = createSessionModelSource()
+    s.setDivergenceHandler((d) => fired.push(d))
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(fired).toHaveLength(0)
+  })
+
+  it('a handler that clears the override does not break resolution', () => {
+    const s = createSessionModelSource({ servedMatchesRequested: servedModelMatchesRequested })
+    s.setDivergenceHandler(() => s.setOverride(null))
+    s.setOverride('claude-sonnet-9', { verify: true })
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(s.getOverride()).toBeNull()
+    expect(s.resolve()).toEqual({ model: 'claude-opus-4-8', source: 'transcript' })
+  })
+})