switchroom 0.19.39 → 0.19.41

package/telegram-plugin/tests/outbox-flush-ack-claim-race.test.ts

@@ -0,0 +1,213 @@
+/**
+ * outbox-flush-ack-claim-race.test.ts — outcome regression for the turn-flush
+ * vs outbox-sweep DUPLICATE-MESSAGE race.
+ *
+ * The race (root-caused via journal forensics):
+ *   1. A gateway-visible turn ends with unsent trailing prose → the turn-flush
+ *      backstop delivers it through `runBackstopDelivery` (the flush core). The
+ *      chunks land (Telegram acks) immediately.
+ *   2. The flush's DURABLE exactly-once claim (`journalExternalDelivery`,
+ *      `deliverySource:'flush'`) used to run only in the caller's
+ *      post-`await deliverAnswer` bookkeeping — i.e. AFTER `runBackstopDelivery`
+ *      returned. But `runBackstopDelivery` does not return until its read-back
+ *      probe resolves, and that probe is issued at COSMETIC priority: when the
+ *      edit-flood-fuse is deferring cosmetic edits it blocks ~30s.
+ *   3. The out-of-band outbox sweep waits only `OUTBOX_QUIET_MS` (5s) before
+ *      checking the delivered-keys journal. In the 5–30s gap it saw no journal
+ *      entry (deferred behind the probe) and — because the Stop-hook-captured
+ *      record's text differs in length/hash from the flush text, so the in-memory
+ *      text dedup also misses — it sent a SECOND copy of the same answer.
+ *
+ * The fix claims the nonce at SEND-ACK time (`onAckClaim`), BEFORE the read-back
+ * probe. This test drives the REAL `runBackstopDelivery` with a read-back probe
+ * held open PAST the sweep's quiet window, plus a pending outbox record for the
+ * SAME nonce with DIFFERENT text, and asserts the REAL `sweepOutbox` delivers
+ * NOTHING. It is RED on pre-fix main (no ack-time claim → the journal is empty
+ * when the sweep ticks → the sweep sends the duplicate).
+ *
+ * The oracle is what the user observably received (sweep `send` invocations) and
+ * the durable journal — no assertion names an internal decision function.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import {
+  BackstopDeliveryLedger,
+  runBackstopDelivery,
+  type ReadBackResult,
+} from '../gateway/backstop-delivery.js'
+import { sweepOutbox, journalExternalDelivery } from '../gateway/outbox-sweep.js'
+import {
+  OUTBOX_QUIET_MS,
+  readDeliveredNonces,
+  sha256Hex,
+  writeOutboxRecordAtomic,
+  type OutboxRecord,
+} from '../outbox.js'
+
+const CHAT = '111'
+/** Gateway `deriveTurnId` shape — byte-identical to the Stop-hook record nonce. */
+const NONCE = `${CHAT}:_#42`
+/** The flush's answer (RICH). */
+const FLUSH_TEXT = 'The deploy is green across all three checks. '.padEnd(320, 'a')
+/** The Stop-hook-captured record for the SAME turn — a paraphrase, so its length
+ *  and sha differ from the flush text and the in-memory text dedup CANNOT match. */
+const RECORD_TEXT =
+  'Summary of the above in different words so byte-exact dedup can never catch it. '.padEnd(
+    420,
+    'b',
+  )
+
+/** A pending outbox record, aged PAST the sweep quiet window so it is eligible. */
+function writeAgedRecord(dir: string, createdAt: number): void {
+  const record: OutboxRecord = {
+    turnNonce: NONCE,
+    chatId: CHAT,
+    threadId: null,
+    text: RECORD_TEXT,
+    textSha256: sha256Hex(RECORD_TEXT),
+    createdAt,
+    source: 'channel',
+    replyAlreadyDeliveredThisTurn: false,
+  }
+  const ok = writeOutboxRecordAtomic(record, dir)
+  expect(ok).toBe(true)
+}
+
+describe('turn-flush vs outbox-sweep — the flush claims its nonce at SEND-ACK, before a slow read-back', () => {
+  let dir: string
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'flush-ack-race-'))
+  })
+  afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+  it('a read-back slower than OUTBOX_QUIET_MS + a same-nonce/different-text record ⇒ the sweep sends NOTHING (exactly-once)', async () => {
+    const now = 10_000_000
+    // The captured record was written well before the quiet window elapsed.
+    writeAgedRecord(dir, now - (OUTBOX_QUIET_MS + 5_000))
+
+    // Read-back gate — held OPEN so runBackstopDelivery cannot return until we
+    // release it, simulating the cosmetic-edit flood-fuse deferring the probe
+    // ~30s (far longer than the sweep's 5s quiet window).
+    let releaseReadBack!: () => void
+    const readBackGate = new Promise<void>((resolve) => {
+      releaseReadBack = resolve
+    })
+
+    const ledger = new BackstopDeliveryLedger()
+    ledger.claim(NONCE)
+
+    const sentChunks: string[] = []
+    const flushPromise = runBackstopDelivery(
+      ledger,
+      NONCE,
+      [FLUSH_TEXT],
+      null,
+      {
+        sendChunk: async (_i, text) => {
+          sentChunks.push(text)
+          return [777] // Telegram acked — a fresh non-card chat id.
+        },
+        // Mirrors the real deliverAnswer read-back: paced cosmetic, deferrable.
+        readBack: async (): Promise<ReadBackResult> => {
+          await readBackGate
+          return 'exists'
+        },
+        // The fix: journal the nonce at ack, BEFORE the read-back above resolves.
+        onAckClaim: (ackIds) => {
+          journalExternalDelivery(
+            {
+              turnNonce: NONCE,
+              text: FLUSH_TEXT,
+              tgMessageId: ackIds[0],
+              deliverySource: 'flush',
+            },
+            dir,
+          )
+        },
+      },
+      3,
+    )
+
+    // Let the send loop run its send + (with the fix) the ack claim, then park
+    // on the still-open read-back probe. Bounded macrotask flushes — no timers,
+    // no dependence on the fix, so a missing claim surfaces as a clean assertion
+    // failure below rather than a hang.
+    for (let i = 0; i < 5; i++) await new Promise((r) => setImmediate(r))
+    expect(sentChunks).toEqual([FLUSH_TEXT])
+    // Durable claim landed at ack-time — WHILE the read-back is still open.
+    expect(readDeliveredNonces(dir).has(NONCE)).toBe(true)
+
+    // Now the sweep ticks, past the quiet window, with the text dedup MISSING
+    // (record text ≠ flush text). Its only exactly-once guard is the journal.
+    const swept: string[] = []
+    const summary = await sweepOutbox({
+      stateDir: dir,
+      now: () => now,
+      send: async (_chatId, _threadId, text) => {
+        swept.push(text)
+        return { messageId: 500, chunks: [{ messageId: 500, text }] }
+      },
+      // The exact-text in-memory dedup cannot help — the texts differ.
+      textAlreadyDelivered: () => false,
+    })
+
+    // THE user outcome: the sweep sent nothing — the flush already owns this turn.
+    expect(swept).toEqual([])
+    expect(summary.delivered).toBe(0)
+
+    // Release the (slow) read-back and let the flush finish cleanly.
+    releaseReadBack()
+    const result = await flushPromise
+    expect(result.delivered).toBe(true)
+  })
+
+  it('no-loss guard: a flush whose send never acks does NOT claim, so the sweep still delivers the captured answer once', async () => {
+    const now = 20_000_000
+    writeAgedRecord(dir, now - (OUTBOX_QUIET_MS + 5_000))
+
+    const ledger = new BackstopDeliveryLedger()
+    ledger.claim(NONCE)
+
+    let ackClaimCount = 0
+    const result = await runBackstopDelivery(
+      ledger,
+      NONCE,
+      [FLUSH_TEXT],
+      null,
+      {
+        // Every attempt throws — the answer never lands, so the claim predicate
+        // (all chunks landed + fresh receipt) is never met.
+        sendChunk: async () => {
+          throw new Error('telegram send rejected')
+        },
+        readBack: async (): Promise<ReadBackResult> => 'exists',
+        onAckClaim: () => {
+          ackClaimCount++
+        },
+      },
+      3,
+    )
+    // The flush genuinely failed and never claimed the nonce.
+    expect(result.delivered).toBe(false)
+    expect(ackClaimCount).toBe(0)
+    expect(readDeliveredNonces(dir).has(NONCE)).toBe(false)
+
+    // The safety net now delivers the captured answer — exactly once, no loss.
+    const swept: string[] = []
+    const summary = await sweepOutbox({
+      stateDir: dir,
+      now: () => now,
+      send: async (_chatId, _threadId, text) => {
+        swept.push(text)
+        return { messageId: 501, chunks: [{ messageId: 501, text }] }
+      },
+      textAlreadyDelivered: () => false,
+    })
+    expect(swept).toEqual([RECORD_TEXT])
+    expect(summary.delivered).toBe(1)
+  })
+})

package/telegram-plugin/tests/outbox-reply-then-recap-e2e.test.ts

@@ -268,7 +268,7 @@ async function runTurn(opts: {
       send: async (_chatId, _threadId, text) => {
         delivered.push({ via: 'sweep', text })
         sentLog.push({ text, at: now })
-        return 500
+        return { messageId: 500, chunks: [{ messageId: 500, text }] }
       },
       // Mirrors the gateway's TTL-bounded exact-text `outboundDedup` cache:
       // anything sent (reply or sweep) within the TTL dedups; older evicts.

package/telegram-plugin/tests/outbox-sweep-flood-breaker.test.ts

@@ -61,7 +61,7 @@ describe('outbox sweep vs an open flood window', () => {
 
   it('does not hit the wire while a flood window is open, and keeps the record', async () => {
     writeOutboxRecordAtomic(rec(), dir)
-    const send = vi.fn(async () => 1)
+    const send = vi.fn(async () => ({ messageId: 1, chunks: [{ messageId: 1, text: rec().text }] }))
     const log = vi.fn()
 
     const summary = await sweepOutbox({
@@ -90,7 +90,7 @@ describe('outbox sweep vs an open flood window', () => {
 
   it('delivers the SAME record once the window closes', async () => {
     writeOutboxRecordAtomic(rec(), dir)
-    const send = vi.fn(async () => 42)
+    const send = vi.fn(async () => ({ messageId: 42, chunks: [{ messageId: 42, text: rec().text }] }))
     let remaining = 12_247_000
 
     const deferred = await sweepOutbox({
@@ -120,7 +120,7 @@ describe('outbox sweep vs an open flood window', () => {
 
   it('sweeps normally when no window is open', async () => {
     writeOutboxRecordAtomic(rec(), dir)
-    const send = vi.fn(async () => 7)
+    const send = vi.fn(async () => ({ messageId: 7, chunks: [{ messageId: 7, text: rec().text }] }))
     const summary = await sweepOutbox({
       stateDir: dir,
       send,
@@ -135,7 +135,7 @@ describe('outbox sweep vs an open flood window', () => {
 
   it('FAILS OPEN: a throwing probe must never strand the outbox', async () => {
     writeOutboxRecordAtomic(rec(), dir)
-    const send = vi.fn(async () => 7)
+    const send = vi.fn(async () => ({ messageId: 7, chunks: [{ messageId: 7, text: rec().text }] }))
     const summary = await sweepOutbox({
       stateDir: dir,
       send,

package/telegram-plugin/tests/outbox-sweep-listen-button.test.ts

@@ -20,6 +20,7 @@
  */
 
 import { describe, it, expect } from 'vitest'
+import { GrammyError } from 'grammy'
 import { createOutboxSend } from '../gateway/outbox-sweep.js'
 import { makeOutboxListenMarkupResolver } from '../gateway/outbox-listen-markup.js'
 import {
@@ -38,14 +39,37 @@ const kokoroOnDemand: ListenButtonVoiceOutPlan = {
 // fallback needed for the unit under test).
 const passthroughRetry = <U>(fn: () => Promise<U>): Promise<U> => fn()
 
-function fakeBot() {
+// The sweep now renders via sendRichMessage (raw GFM markdown → entities), the
+// SAME path the reply path uses; a markdown parse-reject falls back to plain
+// sendMessage. `calls` records the CANONICAL rich sends (with the raw markdown
+// pulled out of the `{ markdown }` body as `text`) so the existing assertions
+// keep asserting the bytes handed to the wire; `plainCalls` records the
+// parse-reject fallback sends.
+function fakeBot(opts?: { failRich?: boolean }) {
   const calls: Array<{ chatId: string; text: string; opts: Record<string, unknown> }> = []
+  const plainCalls: Array<{ chatId: string; text: string; opts: Record<string, unknown> }> = []
   let n = 100
   return {
     calls,
+    plainCalls,
     api: {
-      sendMessage: async (chatId: string, text: string, opts: object) => {
-        calls.push({ chatId, text, opts: opts as Record<string, unknown> })
+      sendRichMessage: async (chatId: string, body: { markdown: string }, o: object) => {
+        if (opts?.failRich) {
+          // A real Telegram markdown parse-reject (isParseEntitiesError keys on
+          // `instanceof GrammyError` + the description), so the sweep falls back
+          // to a plain sendMessage of the same chunk.
+          throw new GrammyError(
+            'Call to sendRichMessage failed!',
+            { ok: false, error_code: 400, description: "Bad Request: can't parse entities" },
+            'sendRichMessage',
+            {} as never,
+          )
+        }
+        calls.push({ chatId, text: body.markdown, opts: o as Record<string, unknown> })
+        return { message_id: n++ }
+      },
+      sendMessage: async (chatId: string, text: string, o: object) => {
+        plainCalls.push({ chatId, text, opts: o as Record<string, unknown> })
         return { message_id: n++ }
       },
     },
@@ -99,6 +123,44 @@ describe('planListenButton — shared Listen-button decision', () => {
   })
 })
 
+describe('createOutboxSend — RENDER PARITY (markdown is rendered, not raw)', () => {
+  it('sends through sendRichMessage with the markdown body, NOT a raw sendMessage', async () => {
+    // The bug: the sweep sent via a plain bot.api.sendMessage with no parse_mode
+    // and no rich render, so `**bold**` reached the operator verbatim. The fix
+    // routes each chunk through richMessage → sendRichMessage. This asserts the
+    // rendered payload (a `{ markdown }` body on the rich API), which the pre-fix
+    // raw-sendMessage path never produced.
+    const bot = fakeBot()
+    const send = createOutboxSend({ getBot: () => bot, retry: passthroughRetry })
+
+    const result = await send('123', null, 'Here is **bold** and `code`.')
+
+    // Rendered via the rich path (markdown preserved for Telegram to parse)…
+    expect(bot.calls).toHaveLength(1)
+    expect(bot.calls[0]!.text).toBe('Here is **bold** and `code`.')
+    // …and NOT via the raw plain-text path (the pre-fix bug).
+    expect(bot.plainCalls).toHaveLength(0)
+    // The landed chunk (id + text) is reported back for history persistence.
+    expect(result.chunks).toEqual([{ messageId: 100, text: 'Here is **bold** and `code`.' }])
+    expect(result.messageId).toBe(100)
+  })
+
+  it('falls back to a PLAIN sendMessage of the same chunk on a markdown parse-reject', async () => {
+    // Mirrors the reply path's plaintext fallback: if Telegram rejects the
+    // markdown entities, resend the raw source as plain text (readable prose)
+    // rather than dropping the answer.
+    const bot = fakeBot({ failRich: true })
+    const send = createOutboxSend({ getBot: () => bot, retry: passthroughRetry })
+
+    const result = await send('123', null, 'weird **[unbalanced markdown')
+
+    expect(bot.calls).toHaveLength(0) // rich rejected
+    expect(bot.plainCalls).toHaveLength(1) // plain fallback delivered
+    expect(bot.plainCalls[0]!.text).toBe('weird **[unbalanced markdown')
+    expect(result.chunks).toHaveLength(1) // still reported for history
+  })
+})
+
 describe('createOutboxSend — net-delivered answer carries the Listen button (#3502)', () => {
   it('attaches the Listen keyboard as reply_markup when voice-out on-demand is enabled', async () => {
     const bot = fakeBot()
@@ -128,8 +190,8 @@ describe('createOutboxSend — net-delivered answer carries the Listen button (#
       resolveReplyMarkup: () => markup,
     })
 
-    // > 4000 chars → two chunks.
-    await send('123', null, 'x'.repeat(4500))
+    // > RICH_MESSAGE_MAX_CHARS (32768) of a single unbreakable token → two chunks.
+    await send('123', null, 'x'.repeat(40000))
 
     expect(bot.calls).toHaveLength(2)
     expect(bot.calls[0]!.opts.reply_markup).toBeUndefined()
@@ -162,10 +224,10 @@ describe('createOutboxSend — net-delivered answer carries the Listen button (#
     expect(bot.calls[0]!.opts.reply_markup).toBeUndefined()
   })
 
-  it('empty text sends NOTHING and returns undefined (no empty-message retry wedge)', async () => {
+  it('empty text sends NOTHING and reports an empty result (no empty-message retry wedge)', async () => {
     // Telegram rejects an empty message body; a stray '' chunk would throw
     // every sweep tick and wedge the record in a permanent retry. The send
-    // must short-circuit instead of calling sendMessage.
+    // must short-circuit instead of calling sendMessage/sendRichMessage.
     const bot = fakeBot()
     const resolverCalls: string[] = []
     const send = createOutboxSend({
@@ -179,8 +241,9 @@ describe('createOutboxSend — net-delivered answer carries the Listen button (#
 
     const result = await send('123', null, '')
 
-    expect(result).toBeUndefined()
+    expect(result).toEqual({ messageId: undefined, chunks: [] })
     expect(bot.calls).toHaveLength(0)
+    expect(bot.plainCalls).toHaveLength(0)
     // No point resolving a Listen button for a body we never send.
     expect(resolverCalls).toEqual([])
   })

package/telegram-plugin/tests/send-reply-golden.test.ts

@@ -547,6 +547,53 @@ describe('deliverCapturedProse — silent-end recovery (routed into the send mod
     expect(h.calls).toHaveLength(0)
   })
 
+  it('PERSIST PARITY: the exhausted-boundary plain-text fallback records the recovered answer to history', async () => {
+    // #3228 exhausted-boundary: the rich send fails on the attempt where the
+    // re-prompt budget is already spent, so deliverCapturedProse delivers the
+    // real answer as PLAIN text. Pre-fix that plain-text delivery recorded only
+    // to the in-memory dedup and NEVER called recordOutbound — so the recovered
+    // answer reached the user but was silently absent from history.db. This
+    // asserts recordOutbound now fires once with the delivered message_id + the
+    // recovered text.
+    const dedup = new OutboundDedupCache()
+    // Rich send parse-rejects (one chunk → one queued failure); the plain
+    // sendMessage fallback succeeds.
+    const { api, calls } = makeFakeBot({ sendRichMessage: [grammy400("can't parse entities")] })
+    const recorded: Array<{ chat_id: string; thread_id: number | null; message_ids: number[]; texts: string[] }> = []
+    const text = 'The exhausted-boundary recovered answer.'
+    const deps: DeliverCapturedProseDeps = {
+      outboundDedup: dedup,
+      bot: { api } as unknown as DeliverCapturedProseDeps['bot'],
+      robustApiCall: (fn) => fn(),
+      redactOutboundText: (t) => redact(t),
+      recordOutbound: (rec) => recorded.push({ chat_id: rec.chat_id, thread_id: rec.thread_id, message_ids: rec.message_ids, texts: rec.texts }),
+      HISTORY_ENABLED: true,
+      OBLIGATION_LEDGER_ENABLED: true,
+      obligationLedger: { close: () => {} },
+      clearSilentEndState: () => {},
+      // Budget already spent → the fallback path fires.
+      recordUndeliveredTurnEnd: () => ({ exhausted: true }),
+      hasOutboundDeliveredSince: () => false,
+    }
+    await deliverCapturedProse(deps, {
+      chatId: CHAT,
+      threadId: undefined,
+      statusKeyStr: `${CHAT}:main`,
+      registryKey: null,
+      originTurnId: 'turn-45',
+      text,
+    })
+    // The plain-text fallback actually delivered.
+    const plainSends = calls.filter((c) => c.method === 'sendMessage')
+    expect(plainSends).toHaveLength(1)
+    expect(plainSends[0]!.text).toBe(text)
+    // …and it was persisted to history exactly once with the delivered id + text.
+    expect(recorded).toHaveLength(1)
+    expect(recorded[0]!.chat_id).toBe(CHAT)
+    expect(recorded[0]!.message_ids).toEqual([plainSends[0]!.message_id])
+    expect(recorded[0]!.texts).toEqual([text])
+  })
+
   it('already-deduped content settles bookkeeping WITHOUT a wire send', async () => {
     const dedup = new OutboundDedupCache()
     const text = 'Already went out earlier via the stream.'

package/telegram-plugin/tests/silence-poke-compaction.test.ts

@@ -0,0 +1,222 @@
+/**
+ * #4058 — mid-turn auto-compaction must not trip the 300s silence fallback.
+ *
+ * The bug: during compaction the model emits zero output and runs zero tools,
+ * so the gateway saw pure silence and fired the framework fallback ("⚠️ no
+ * output for 5 min — the framework ended that stalled turn") on a healthy
+ * turn that completed correctly right after compaction. Observed live:
+ * ~1m50s of tools + ~3m25s compacting = 304s silence → false fire.
+ *
+ * The fix: the PreCompact hook writes a compaction marker; silence-poke gets
+ * an `isCompactionInFlight` dep consulted in the SAME `underCeiling` defer
+ * branch as the #1292/#3519 in-flight-tool defers; the transcript's
+ * `compact_boundary` record (compaction END) clears the marker and counts as
+ * production. These tests drive the REAL tick loop and assert outcomes:
+ *   - a compaction gap past 300s but under the hard ceiling → NO fire;
+ *   - a genuinely-wedged turn (no compaction) → STILL fires at 300s;
+ *   - a compaction stuck past the hard ceiling → STILL fires (bounded defer).
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync, existsSync, utimesSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { projectTranscriptLine } from '../session-tail.js'
+import { applySilencePokeSessionEvent } from '../gateway/silence-poke-session-event.js'
+import {
+  COMPACTION_MARKER_FILE,
+  readCompactionMarkerAgeMs,
+  removeCompactionMarker,
+} from '../gateway/compaction-marker.js'
+import * as silencePoke from '../silence-poke.js'
+import * as pendingProgress from '../pending-work-progress.js'
+import {
+  startTurn,
+  __tickForTests,
+  __setDepsForTests,
+  __getStateForTests,
+  __resetAllForTests,
+  DEFAULT_THRESHOLDS,
+  type SilencePokeMetric,
+  type FrameworkFallbackContext,
+} from '../silence-poke.js'
+
+const HARD_CEILING = 900_000 // SILENCE_FALLBACK_HARD_MS default
+
+interface TestFixtures {
+  emitted: SilencePokeMetric[]
+  fallbacks: FrameworkFallbackContext[]
+}
+
+function setupDeps(opts?: {
+  isCompactionInFlight?: (key: string) => boolean
+  isLegitimatelyWorking?: (key: string) => boolean
+}): TestFixtures {
+  const fixtures: TestFixtures = { emitted: [], fallbacks: [] }
+  __setDepsForTests({
+    emitMetric: (e) => fixtures.emitted.push(e),
+    onFrameworkFallback: (ctx) => { fixtures.fallbacks.push(ctx) },
+    thresholdsMs: { ...DEFAULT_THRESHOLDS, fallbackHardCeiling: HARD_CEILING },
+    // Mirror production wiring: the callback path is active (liveness-wiring
+    // always wires isLegitimatelyWorking), returning false = "no tool work".
+    isLegitimatelyWorking: opts?.isLegitimatelyWorking ?? (() => false),
+    ...(opts?.isCompactionInFlight != null
+      ? { isCompactionInFlight: opts.isCompactionInFlight }
+      : {}),
+  })
+  return fixtures
+}
+
+beforeEach(() => {
+  __resetAllForTests()
+  delete process.env.SWITCHROOM_DISABLE_SILENCE_POKE
+})
+
+afterEach(() => {
+  __resetAllForTests()
+})
+
+describe('silence-poke — #4058 compaction defer (outcome)', () => {
+  it('a compaction gap longer than 300s but under the hard ceiling does NOT fire the fallback', () => {
+    // Real observed shape: tools until t=110s, compaction t=110s..415s (305s
+    // of pure silence — past the 300s window), turn completes after.
+    let compacting = false
+    const fx = setupDeps({ isCompactionInFlight: () => compacting })
+    startTurn('chat:1', 0)
+    // Tools produced feed renders until 110s → production reset at 110s.
+    silencePoke.noteProduction('chat:1', 110_000)
+    compacting = true // PreCompact hook fired
+    __tickForTests(300_000) // 190s silent — under threshold anyway
+    __tickForTests(415_000) // 305s silent — WOULD fire without the fix
+    __tickForTests(500_000) // 390s silent — still compacting
+    expect(fx.fallbacks).toHaveLength(0)
+    expect(fx.emitted).toHaveLength(0)
+    // Compaction ends: the compact_boundary handler clears the marker AND
+    // counts the boundary as production (fresh window for the resumed turn).
+    compacting = false
+    silencePoke.noteProduction('chat:1', 505_000)
+    __tickForTests(510_000)
+    expect(fx.fallbacks).toHaveLength(0) // healthy turn: never fired
+  })
+
+  it('a genuinely-wedged turn with no compaction STILL fires at 300s', () => {
+    const fx = setupDeps({ isCompactionInFlight: () => false })
+    startTurn('chat:2', 0)
+    __tickForTests(300_000)
+    expect(fx.fallbacks).toHaveLength(1)
+    expect(fx.emitted.at(-1)).toMatchObject({ kind: 'silence_fallback_sent' })
+  })
+
+  it('a turn that goes silent AFTER compaction ends still fires one window later', () => {
+    let compacting = true
+    const fx = setupDeps({ isCompactionInFlight: () => compacting })
+    startTurn('chat:3', 0)
+    __tickForTests(310_000)
+    expect(fx.fallbacks).toHaveLength(0) // deferred while compacting
+    compacting = false
+    silencePoke.noteProduction('chat:3', 320_000) // compact_boundary landed
+    __tickForTests(325_000)
+    expect(fx.fallbacks).toHaveLength(0)
+    // …but the model never resumes → real wedge → fires 300s after boundary.
+    __tickForTests(620_000)
+    expect(fx.fallbacks).toHaveLength(1)
+  })
+
+  it('a compaction stuck past the hard ceiling STILL fires (bounded defer)', () => {
+    const fx = setupDeps({ isCompactionInFlight: () => true })
+    startTurn('chat:4', 0)
+    __tickForTests(899_000)
+    expect(fx.fallbacks).toHaveLength(0) // deferred under the ceiling
+    __tickForTests(900_000) // silence ≥ fallbackHardCeiling → defer expires
+    expect(fx.fallbacks).toHaveLength(1)
+  })
+
+  it('absent dep (legacy fixtures) leaves behaviour unchanged — fires at 300s', () => {
+    const fx = setupDeps()
+    startTurn('chat:5', 0)
+    __tickForTests(300_000)
+    expect(fx.fallbacks).toHaveLength(1)
+  })
+})
+
+describe('session-tail — compact_boundary projection', () => {
+  it('projects a real transcript compact_boundary line', () => {
+    // Verbatim shape from a live agent transcript (trimmed to the fields the
+    // projection reads).
+    const line = JSON.stringify({
+      parentUuid: null,
+      isSidechain: false,
+      type: 'system',
+      subtype: 'compact_boundary',
+      content: 'Conversation compacted',
+      level: 'info',
+      compactMetadata: { trigger: 'auto', preTokens: 283797, postTokens: 224551, durationMs: 111959 },
+    })
+    expect(projectTranscriptLine(line)).toEqual([
+      { kind: 'compact_boundary', trigger: 'auto', compactDurationMs: 111959 },
+    ])
+  })
+
+  it('tolerates missing compactMetadata', () => {
+    const line = JSON.stringify({ type: 'system', subtype: 'compact_boundary', content: 'Conversation compacted' })
+    expect(projectTranscriptLine(line)).toEqual([
+      { kind: 'compact_boundary', trigger: null, compactDurationMs: null },
+    ])
+  })
+})
+
+describe('compaction-marker + session-event wiring', () => {
+  let dir: string
+  const envBefore = process.env.TELEGRAM_STATE_DIR
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'sp-compact-'))
+    process.env.TELEGRAM_STATE_DIR = dir
+  })
+
+  afterEach(() => {
+    if (envBefore != null) process.env.TELEGRAM_STATE_DIR = envBefore
+    else delete process.env.TELEGRAM_STATE_DIR
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('readCompactionMarkerAgeMs: absent → null; present → mtime age', () => {
+    expect(readCompactionMarkerAgeMs(dir, 1_000)).toBeNull()
+    const p = join(dir, COMPACTION_MARKER_FILE)
+    writeFileSync(p, '{"ts":1}\n')
+    const at = new Date(Date.now() - 10_000)
+    utimesSync(p, at, at)
+    const age = readCompactionMarkerAgeMs(dir)
+    expect(age).not.toBeNull()
+    expect(age!).toBeGreaterThanOrEqual(9_000)
+    expect(age!).toBeLessThan(60_000)
+    removeCompactionMarker(dir)
+    expect(readCompactionMarkerAgeMs(dir)).toBeNull()
+    removeCompactionMarker(dir) // idempotent
+  })
+
+  it('compact_boundary session event clears the marker and resets the silence clock', () => {
+    writeFileSync(join(dir, COMPACTION_MARKER_FILE), '{"ts":1}\n')
+    startTurn('c:9', 0)
+    setupDeps()
+    applySilencePokeSessionEvent(silencePoke, pendingProgress, 'c:9', {
+      kind: 'compact_boundary',
+      trigger: 'auto',
+      compactDurationMs: 111_959,
+    })
+    expect(existsSync(join(dir, COMPACTION_MARKER_FILE))).toBe(false)
+    // Clock reset: lastOutboundAt stamped by noteProduction.
+    expect(__getStateForTests('c:9')?.lastOutboundAt).not.toBeNull()
+  })
+
+  it('PreCompact hook writes the marker from its stdin payload', () => {
+    const hook = join(__dirname, '..', 'hooks', 'compaction-marker-precompact.mjs')
+    execFileSync('node', [hook], {
+      env: { ...process.env, TELEGRAM_STATE_DIR: dir },
+      input: JSON.stringify({ session_id: 's-1', trigger: 'auto', hook_event_name: 'PreCompact' }),
+    })
+    const age = readCompactionMarkerAgeMs(dir)
+    expect(age).not.toBeNull()
+    expect(age!).toBeLessThan(30_000)
+  })
+})