switchroom 0.19.2 → 0.19.4

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -17,6 +17,11 @@ import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { dirname, resolve } from 'node:path'
 import { SESSION_MODEL_FILE } from '../gateway/session-model-file.js'
+import {
+  classifyModelSwitchConfirmation,
+  formatModelRelaunchDiagLog,
+  resolveModelSwitchBootNotice,
+} from '../gateway/model-command.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const MODEL_COMMAND_SRC = readFileSync(
@@ -148,7 +153,7 @@ describe('gateway boot: session-model re-hydration + confirmation + alert relay'
     const win = GATEWAY_SRC.slice(idx - 200, idx + 3200)
     // F1: `launched !== configured` is the deterministic apply-boot signal.
     expect(win).toContain('const isApplyBoot = launched.length > 0 && launched !== configured')
-    expect(win).toContain('sessionModelSource.setOverride(isApplyBoot ? launched : null)')
+    expect(win).toContain('sessionModelSource.setOverride(isApplyBoot ? launched : null, { verify: true })')
     expect(win).toContain('resolveMainModel(raw ?? undefined)')
   })
 
@@ -158,42 +163,193 @@ describe('gateway boot: session-model re-hydration + confirmation + alert relay'
     expect(MODEL_COMMAND_SRC).toContain('gw /model relaunch applied agent=')
   })
 
-  it('logs outcome KIND explicitly on /model switch rehydration (NOT-APPLIED vs applied vs default)', () => {
-    // Formatters live in model-command.ts (gateway line-ratchet); gateway only calls them.
-    expect(GATEWAY_SRC).toContain('formatModelRelaunchDiagLog')
-    expect(GATEWAY_SRC).toContain('formatModelSwitchConfirmationBody')
-    expect(GATEWAY_SRC).toContain('formatModelRelaunchSuppressNotAppliedLog')
-    expect(MODEL_COMMAND_SRC).toContain('gw /model relaunch NOT-APPLIED agent=')
-    expect(MODEL_COMMAND_SRC).toContain('override=set outcome=applied')
-    expect(MODEL_COMMAND_SRC).toContain('override=cleared outcome=default')
-    expect(MODEL_COMMAND_SRC).toContain('gw /model relaunch NOT-APPLIED — suppressing not-applied confirmation')
+  // #3427 item 2: the following are BEHAVIORAL tests — they run the real
+  // classifier → formatter/notice pipeline and assert the EMITTED outcome
+  // (log line / card body), not that a string merely exists in the source.
+  // The thin `wires …` test at the end pins that gateway.ts actually calls
+  // this pipeline (the gateway boot IIFE cannot be unit-booted).
+
+  it('emits the NOT-APPLIED log for a silent revert (classify → formatModelRelaunchDiagLog)', () => {
+    const confirmation = classifyModelSwitchConfirmation({
+      reason: 'user: /model fable (session-only relaunch, menu)',
+      launched: 'claude-opus-4-8',
+      configured: 'claude-opus-4-8',
+    })
+    expect(confirmation.kind).toBe('not-applied')
+    const log = formatModelRelaunchDiagLog({
+      agent: 'klanker',
+      launched: 'claude-opus-4-8',
+      configured: 'claude-opus-4-8',
+      confirmation,
+      isApplyBoot: false,
+    })
+    expect(log).toContain('gw /model relaunch NOT-APPLIED agent=klanker')
+    expect(log).toContain('target=fable')
+    expect(log).toContain('revertedTo=claude-opus-4-8')
   })
 
-  it('sends ONE switch-confirmation from the ACTUAL launched model, keyed on the /model reason (F1/N4)', () => {
-    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
-    expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 2500)
-    expect(win).toContain('if (confirmation != null && modelSwitchMarkerChat)')
-    expect(win).toContain('formatModelSwitchConfirmationBody')
-    expect(MODEL_COMMAND_SRC).toContain('✅ Now running')
-    expect(MODEL_COMMAND_SRC).toContain('(the configured default)')
+  it('emits outcome=applied for a landed switch and outcome=default for a revert', () => {
+    const applied = classifyModelSwitchConfirmation({
+      reason: 'user: /model claude-haiku-4-5 (session-only relaunch)',
+      launched: 'claude-haiku-4-5',
+      configured: 'claude-opus-4-8',
+    })
+    expect(
+      formatModelRelaunchDiagLog({
+        agent: 'a', launched: 'claude-haiku-4-5', configured: 'claude-opus-4-8',
+        confirmation: applied, isApplyBoot: true,
+      }),
+    ).toContain('override=set outcome=applied')
+    const dflt = classifyModelSwitchConfirmation({
+      reason: 'user: /model default (revert relaunch)',
+      launched: 'claude-opus-4-8',
+      configured: 'claude-opus-4-8',
+    })
+    expect(
+      formatModelRelaunchDiagLog({
+        agent: 'a', launched: 'claude-opus-4-8', configured: 'claude-opus-4-8',
+        confirmation: dflt, isApplyBoot: false,
+      }),
+    ).toContain('override=cleared outcome=default')
   })
 
-  it('warns instead of a green ✅ when a non-default switch silently reverted to the default (silent-revert fix)', () => {
-    expect(GATEWAY_SRC).toContain('classifyModelSwitchConfirmation({')
-    expect(GATEWAY_SRC).toContain('formatModelSwitchConfirmationBody')
-    expect(MODEL_COMMAND_SRC).toContain('⚠️ Your switch to')
-    expect(MODEL_COMMAND_SRC).toContain("didn't apply")
-    // LOW-3: re-issue hint keeps target in backticks
-    expect(MODEL_COMMAND_SRC).toContain('Re-issue `/model ')
+  it('sends the green applied card for a landed switch, the default card for an intended revert (F1/N4)', () => {
+    const applied = resolveModelSwitchBootNotice({
+      agent: 'a',
+      confirmation: classifyModelSwitchConfirmation({
+        reason: 'user: /model fable (session-only relaunch)',
+        launched: 'fable',
+        configured: 'claude-opus-4-8',
+      }),
+      hasSessionModelAlert: false,
+    })
+    expect(applied.kind).toBe('card')
+    if (applied.kind === 'card') {
+      expect(applied.body).toContain('✅ Now running `fable`')
+      expect(applied.body).toContain('session-only')
+    }
+    // N4: launched===configured on a /model default reason still confirms.
+    const dflt = resolveModelSwitchBootNotice({
+      agent: 'a',
+      confirmation: classifyModelSwitchConfirmation({
+        reason: 'user: /model default (revert relaunch)',
+        launched: 'claude-opus-4-8',
+        configured: 'claude-opus-4-8',
+      }),
+      hasSessionModelAlert: false,
+    })
+    expect(dflt.kind).toBe('card')
+    if (dflt.kind === 'card') {
+      expect(dflt.body).toContain('✅ Now running `claude-opus-4-8` (the configured default)')
+    }
   })
 
-  it('dedups the not-applied card against a tailored .session-model-alert (LOW-2)', () => {
+  it('warns (⚠️, not a green ✅) when a non-default switch silently reverted to the default (silent-revert fix)', () => {
+    const notice = resolveModelSwitchBootNotice({
+      agent: 'a',
+      confirmation: classifyModelSwitchConfirmation({
+        reason: 'user: /model fable (session-only relaunch, menu)',
+        launched: 'claude-opus-4-8',
+        configured: 'claude-opus-4-8',
+      }),
+      hasSessionModelAlert: false,
+    })
+    expect(notice.kind).toBe('card')
+    if (notice.kind === 'card') {
+      expect(notice.body).toContain("⚠️ Your switch to `fable` didn't apply")
+      expect(notice.body).toContain('reverted to `claude-opus-4-8`')
+      // LOW-3: the re-issue hint keeps the target inside backticks.
+      expect(notice.body).toContain('Re-issue `/model fable`')
+      expect(notice.body).not.toContain('✅')
+    }
+  })
+
+  it('suppresses ONLY the not-applied card when a tailored .session-model-alert is present (LOW-2)', () => {
+    const reverted = classifyModelSwitchConfirmation({
+      reason: 'user: /model fable (session-only relaunch)',
+      launched: 'claude-opus-4-8',
+      configured: 'claude-opus-4-8',
+    })
+    const suppressed = resolveModelSwitchBootNotice({
+      agent: 'klanker',
+      confirmation: reverted,
+      hasSessionModelAlert: true,
+    })
+    expect(suppressed.kind).toBe('suppress')
+    if (suppressed.kind === 'suppress') {
+      expect(suppressed.log).toContain('suppressing not-applied confirmation')
+      expect(suppressed.log).toContain('agent=klanker')
+      expect(suppressed.log).toContain('target=fable')
+    }
+    // An APPLIED switch still confirms even when an (unrelated) alert exists.
+    const applied = resolveModelSwitchBootNotice({
+      agent: 'klanker',
+      confirmation: classifyModelSwitchConfirmation({
+        reason: 'user: /model fable (session-only relaunch)',
+        launched: 'fable',
+        configured: 'claude-opus-4-8',
+      }),
+      hasSessionModelAlert: true,
+    })
+    expect(applied.kind).toBe('card')
+  })
+
+  it('wires the pipeline into the boot rehydration (gateway calls classify → diag log → notice)', () => {
     const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
-    const win = GATEWAY_SRC.slice(idx, idx + 2500)
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 4200)
+    expect(win).toContain('classifyModelSwitchConfirmation({')
+    expect(win).toContain('formatModelRelaunchDiagLog')
+    expect(win).toContain('if (confirmation != null)')
+    expect(win).toContain('deliverModelSwitchBootNotice({')
     expect(win).toContain("existsSync(join(smAgentDir, '.session-model-alert'))")
-    expect(win).toContain("confirmation.kind === 'not-applied' && hasSessionModelAlert")
-    expect(win).toContain('formatModelRelaunchSuppressNotAppliedLog')
+    // Both notice arms (suppress → stderr, card → sendMessage) now live in
+    // model-command.ts (deliverModelSwitchBootNotice — behaviorally tested in
+    // model-command.test.ts); the gateway injects the shared boot-card deps
+    // (stderr log sink + one raw thread-aware send closure).
+    expect(win).toContain('...modelBootCardDeps')
+    expect(win).toContain('log: (line) => process.stderr.write(line)')
+    expect(win).toContain('lockedBot.api.sendMessage(chatId, body, opts)')
+  })
+
+  it('arms the #3427 requested-vs-served tripwire on an apply-boot (comparator + handler)', () => {
+    // The source is constructed with the conservative comparator…
+    expect(GATEWAY_SRC).toContain('createSessionModelSource({ servedMatchesRequested: servedModelMatchesRequested })')
+    // …and the apply-boot rehydration verify-ARMS the override (H1: the ONLY
+    // arming site) and registers the handler that logs + warns.
+    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
+    const win = GATEWAY_SRC.slice(idx, idx + 4500)
+    expect(win).toContain('sessionModelSource.setOverride(isApplyBoot ? launched : null, { verify: true })')
+    // The handler body lives in model-command.ts (buildServedModelDivergenceHandler,
+    // behaviorally tested in model-command.test.ts — log line + operator card);
+    // the gateway registers it ONLY on an apply-boot, fed by the shared deps.
+    expect(win).toContain(
+      'sessionModelSource.setDivergenceHandler(buildServedModelDivergenceHandler(modelBootCardDeps))',
+    )
+    const armIdx = win.indexOf('sessionModelSource.setDivergenceHandler(')
+    expect(win.slice(0, armIdx)).toContain('if (isApplyBoot) {')
+    // M2: the handler must NOT destroy the override record — a transient
+    // fallback substitution self-corrects; freshness already fixes /status.
+    // Structurally guaranteed post-extraction: the injected ModelBootCardDeps
+    // surface (agent/chat/log/sendCard) carries NO handle to the source, so
+    // the handler CANNOT call setOverride. Pin that the deps object stays free
+    // of any source handle.
+    const depsStart = win.indexOf('const modelBootCardDeps')
+    expect(depsStart).toBeGreaterThan(0)
+    const depsWin = win.slice(depsStart, win.indexOf('if (isApplyBoot)'))
+    expect(depsWin).not.toContain('sessionModelSource')
+  })
+
+  it('H1 (#3437): the command-time relaunch record does NOT verify-arm the tripwire', () => {
+    // scheduleModelRelaunch sets the pre-restart status-honesty override with a
+    // BARE setOverride — arming it would let an OLD-model assistant line in the
+    // pre-restart window false-accuse a valid NEW token. The behavioral guard
+    // lives in session-model-source.test.ts; this pins the gateway call sites.
+    const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async (model: string, reason: string)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
+    expect(win).toContain('sessionModelSource.setOverride(model)')
+    expect(win).not.toContain('verify')
   })
 
   it('N4/reason: the /model switch reason is captured from the clean-shutdown marker', () => {

package/telegram-plugin/tests/model-command.test.ts

@@ -32,6 +32,13 @@ import {
   parseModelSwitchTarget,
   modelFamilyToken,
   MODEL_ALIASES,
+  servedModelMatchesRequested,
+  formatServedModelDivergenceLog,
+  formatServedModelDivergenceCard,
+  buildServedModelDivergenceHandler,
+  deliverModelSwitchBootNotice,
+  unvalidatedIdCaveat,
+  type ModelBootCardDeps,
   type ModelCommandDeps,
 } from "../gateway/model-command.js";
 
@@ -691,3 +698,216 @@ describe("modelFamilyToken", () => {
     expect(modelFamilyToken("sr-gemini-2.5-flash")).toBe("sr-gemini-2.5-flash");
   });
 });
+
+// ── #3427 item 4: requested-vs-served divergence (fallback-model masking) ────
+
+describe("servedModelMatchesRequested", () => {
+  it("matches a requested alias against its resolved full id (family)", () => {
+    expect(servedModelMatchesRequested("sonnet", "claude-sonnet-5")).toBe(true);
+    expect(servedModelMatchesRequested("opus", "claude-opus-4-8")).toBe(true);
+    expect(servedModelMatchesRequested("fable", "claude-fable-5")).toBe(true);
+  });
+
+  it("flags a requested alias served by a DIFFERENT family (fallback substituted)", () => {
+    expect(servedModelMatchesRequested("sonnet", "claude-opus-4-8")).toBe(false);
+    expect(servedModelMatchesRequested("haiku", "claude-sonnet-5")).toBe(false);
+  });
+
+  it("matches a full id exactly and as a date-stamped descendant", () => {
+    expect(servedModelMatchesRequested("claude-sonnet-5", "claude-sonnet-5")).toBe(true);
+    expect(servedModelMatchesRequested("claude-sonnet-5", "claude-sonnet-5-20260203")).toBe(true);
+    expect(servedModelMatchesRequested("Claude-Sonnet-5", "claude-sonnet-5")).toBe(true);
+  });
+
+  it("flags an invalid/unknown full id served by the fallback — the masking case", () => {
+    // THE #3427 item-4 case: `/model claude-sonnet-9` (nonexistent) launches,
+    // --fallback-model silently serves opus. A test that wouldn't fail on the
+    // masking is not a test: this must be a MISMATCH.
+    expect(servedModelMatchesRequested("claude-sonnet-9", "claude-opus-4-8")).toBe(false);
+    // Same-family but wrong version is still a mismatch (sonnet-9 ≠ sonnet-5).
+    expect(servedModelMatchesRequested("claude-sonnet-9", "claude-sonnet-5")).toBe(false);
+  });
+
+  it("is conservative: non-claude served ids and non-comparable requests never accuse", () => {
+    // LiteLLM/sr-* served names are not deterministically comparable.
+    expect(servedModelMatchesRequested("sr-glm-5", "glm-5")).toBe(true);
+    expect(servedModelMatchesRequested("claude-sonnet-5", "sr-glm-5")).toBe(true);
+    // Legacy friendly-label overrides ("Opus 4.8") are not comparable either.
+    expect(servedModelMatchesRequested("Opus 4.8", "claude-opus-4-8")).toBe(true);
+    // The default sentinel never diverges.
+    expect(servedModelMatchesRequested("default", "claude-opus-4-8")).toBe(true);
+  });
+
+  it("L3 (#3437): legacy id shapes (family after version) never false-accuse an alias request", () => {
+    // `claude-3-opus-20240229` → modelFamilyToken yields "3", not "opus"; the
+    // segment fallback must still match the alias.
+    expect(servedModelMatchesRequested("opus", "claude-3-opus-20240229")).toBe(true);
+    expect(servedModelMatchesRequested("haiku", "claude-3-5-haiku-20241022")).toBe(true);
+    // …while a genuinely different family still fires.
+    expect(servedModelMatchesRequested("sonnet", "claude-3-opus-20240229")).toBe(false);
+  });
+});
+
+describe("served-model divergence formatters (#3427 item 4)", () => {
+  it("log line is greppable and names requested + served", () => {
+    const log = formatServedModelDivergenceLog({
+      agent: "klanker",
+      requested: "claude-sonnet-9",
+      served: "claude-opus-4-8",
+    });
+    expect(log).toContain("gw /model served-model DIVERGENCE agent=klanker");
+    expect(log).toContain("requested=claude-sonnet-9");
+    expect(log).toContain("served=claude-opus-4-8");
+    expect(log.endsWith("\n")).toBe(true);
+  });
+
+  it("card warns, names both models in backticks, and says how to recover", () => {
+    const card = formatServedModelDivergenceCard({
+      requested: "claude-sonnet-9",
+      served: "claude-opus-4-8",
+    });
+    expect(card).toContain("⚠️");
+    expect(card).toContain("`claude-opus-4-8`");
+    expect(card).toContain("`claude-sonnet-9`");
+    expect(card).toContain("/model");
+    expect(card).not.toContain("✅");
+  });
+
+  it("M2 (#3437): the card and log name BOTH causes — never a flat 'invalid' accusation", () => {
+    // --fallback-model also substitutes on transient overload/unavailability;
+    // the signal cannot distinguish that from a bogus id, so neither surface
+    // may assert invalidity as fact.
+    const card = formatServedModelDivergenceCard({
+      requested: "claude-sonnet-9",
+      served: "claude-opus-4-8",
+    });
+    expect(card).toContain("temporarily unavailable");
+    expect(card).toContain("invalid");
+    expect(card).toContain("If it persists");
+    expect(card).toContain("Either"); // hedged alternatives, not an assertion of invalidity
+    const log = formatServedModelDivergenceLog({
+      agent: "a", requested: "claude-sonnet-9", served: "claude-opus-4-8",
+    });
+    expect(log).toContain("invalid/unknown OR model transiently unavailable");
+  });
+});
+
+describe("boot /model cards — buildServedModelDivergenceHandler / deliverModelSwitchBootNotice (#2996 extraction)", () => {
+  function makeCardDeps(overrides: Partial<ModelBootCardDeps> = {}) {
+    const logs: string[] = [];
+    const sends: Array<{ chatId: string; body: string; opts: Record<string, unknown> }> = [];
+    const deps: ModelBootCardDeps = {
+      agent: "klanker",
+      chat: { chatId: "-100123", threadId: 42 },
+      log: (line) => { logs.push(line); },
+      sendCard: (chatId, body, opts) => {
+        sends.push({ chatId, body, opts });
+        return Promise.resolve();
+      },
+      ...overrides,
+    };
+    return { deps, logs, sends };
+  }
+
+  it("divergence handler logs the DIVERGENCE line and sends the card to the marker chat + thread", () => {
+    const { deps, logs, sends } = makeCardDeps();
+    buildServedModelDivergenceHandler(deps)({ requested: "claude-sonnet-9", served: "claude-opus-4-8" });
+    expect(logs.some((l) => l.includes("gw /model served-model DIVERGENCE agent=klanker"))).toBe(true);
+    expect(sends).toHaveLength(1);
+    expect(sends[0].chatId).toBe("-100123");
+    expect(sends[0].body).toContain("`claude-opus-4-8`");
+    expect(sends[0].opts).toEqual({ parse_mode: "Markdown", message_thread_id: 42 });
+  });
+
+  it("divergence handler with NO marker chat still logs but never sends", () => {
+    const { deps, logs, sends } = makeCardDeps({ chat: null });
+    buildServedModelDivergenceHandler(deps)({ requested: "sonnet", served: "claude-opus-4-8" });
+    expect(logs.some((l) => l.includes("DIVERGENCE"))).toBe(true);
+    expect(sends).toHaveLength(0);
+  });
+
+  it("divergence card send rejection is swallowed and logged — never throws", async () => {
+    const { deps, logs } = makeCardDeps({
+      sendCard: () => Promise.reject(new Error("THREAD_NOT_FOUND")),
+    });
+    expect(() =>
+      buildServedModelDivergenceHandler(deps)({ requested: "claude-sonnet-9", served: "claude-opus-4-8" }),
+    ).not.toThrow();
+    await new Promise((r) => setTimeout(r, 0));
+    expect(logs.some((l) => l.includes("served-model divergence send failed: THREAD_NOT_FOUND"))).toBe(true);
+  });
+
+  it("boot notice: applied confirmation sends the ✅ card (thread-aware), no suppress log", () => {
+    const { deps, logs, sends } = makeCardDeps();
+    deliverModelSwitchBootNotice({
+      ...deps,
+      confirmation: { kind: "applied", launched: "claude-opus-4-8" },
+      hasSessionModelAlert: false,
+    });
+    expect(sends).toHaveLength(1);
+    expect(sends[0].body).toContain("✅ Now running `claude-opus-4-8`");
+    expect(sends[0].opts).toEqual({ parse_mode: "Markdown", message_thread_id: 42 });
+    expect(logs).toHaveLength(0);
+  });
+
+  it("boot notice: not-applied + .session-model-alert suppresses the card and writes the suppress log", () => {
+    const { deps, logs, sends } = makeCardDeps({ chat: { chatId: "-100123", threadId: null } });
+    deliverModelSwitchBootNotice({
+      ...deps,
+      confirmation: { kind: "not-applied", target: "fable", revertedTo: "claude-sonnet-5" },
+      hasSessionModelAlert: true,
+    });
+    expect(sends).toHaveLength(0);
+    expect(logs.some((l) => l.includes("suppressing not-applied confirmation") && l.includes("target=fable"))).toBe(true);
+  });
+
+  it("boot notice: no marker chat is a full no-op (matches pre-extraction inline behavior)", () => {
+    const { deps, logs, sends } = makeCardDeps({ chat: null });
+    deliverModelSwitchBootNotice({
+      ...deps,
+      confirmation: { kind: "not-applied", target: "fable", revertedTo: "claude-sonnet-5" },
+      hasSessionModelAlert: true,
+    });
+    expect(sends).toHaveLength(0);
+    expect(logs).toHaveLength(0);
+  });
+
+  it("boot notice: threadId null omits message_thread_id from send opts", () => {
+    const { deps, sends } = makeCardDeps({ chat: { chatId: "777", threadId: null } });
+    deliverModelSwitchBootNotice({
+      ...deps,
+      confirmation: { kind: "default", launched: "claude-sonnet-5" },
+      hasSessionModelAlert: false,
+    });
+    expect(sends).toHaveLength(1);
+    expect(sends[0].chatId).toBe("777");
+    expect(sends[0].opts).toEqual({ parse_mode: "Markdown" });
+  });
+});
+
+describe("unvalidatedIdCaveat — immediate fail-fast warn on free-text claude-* ids (#3427 item 4)", () => {
+  const esc = { escapeHtml: (s: string) => s };
+
+  it("warns for a full claude-* id (cannot be pre-validated)", () => {
+    const caveat = unvalidatedIdCaveat(esc, "claude-sonnet-9");
+    expect(caveat).not.toBeNull();
+    expect(caveat).toContain("claude-sonnet-9");
+    expect(caveat).toContain("fallback");
+  });
+
+  it("stays silent for aliases, sr-* ids and the default sentinel", () => {
+    expect(unvalidatedIdCaveat(esc, "opus")).toBeNull();
+    expect(unvalidatedIdCaveat(esc, "sonnet")).toBeNull();
+    expect(unvalidatedIdCaveat(esc, "sr-glm-5")).toBeNull();
+    expect(unvalidatedIdCaveat(esc, "default")).toBeNull();
+  });
+
+  it("the /model set ACK carries the caveat for a typed full id — and not for an alias", async () => {
+    const { deps } = makeDeps();
+    const full = await handleModelCommand({ kind: "set", model: "claude-sonnet-9" }, deps);
+    expect(full.text).toContain("can't be validated before launch");
+    expect(full.text).toContain("fallback");
+    const alias = await handleModelCommand({ kind: "set", model: "opus" }, deps);
+    expect(alias.text).not.toContain("can't be validated before launch");
+  });
+});