switchroom 0.19.41 → 0.19.42

package/telegram-plugin/gateway/approval-callback-consume-record.test.ts

@@ -0,0 +1,132 @@
+/**
+ * Regression test for #4069 — the "kernel record failed" false toast.
+ *
+ * The kernel's approval_consume_record reply carries `decision_id`, but
+ * the client decodes every reply through ResponseSchema (a plain
+ * z.union, first-match wins, unknown keys stripped). With
+ * OkApprovalConsumeResponseSchema ordered before
+ * OkApprovalConsumeRecordResponseSchema, the consume_record reply
+ * matched the prefix schema and `decision_id` was silently stripped —
+ * so handleApprovalCallback hit its defensive `!result.decision_id`
+ * branch, toasted "kernel record failed", and returned before editing
+ * the card to its granted state. Deterministic on EVERY `apv:` approval
+ * tap. The audit row was never lost — the kernel committed it — this
+ * was purely the client's mangled view of the reply.
+ *
+ * This test drives handleApprovalCallback end-to-end against a fake
+ * kernel serving a REAL wire frame through the REAL
+ * rpcRaw/decodeResponse path (the kernel suites parse the wire with raw
+ * JSON.parse and bypass decodeResponse — which is exactly why they
+ * missed this). It asserts the tap lands: no "kernel record failed"
+ * toast, and the card advances to its granted body carrying the
+ * decision_id revoke hint.
+ */
+
+import { afterEach, describe, expect, it } from "vitest";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { Context } from "grammy";
+import { handleApprovalCallback } from "./approval-callback.js";
+
+const REQUEST_ID = "0123456789abcdef0123456789abcdef";
+const DECISION_ID = "dec-4069";
+
+/** One-shot fake kernel: replies to the first request line with `reply`. */
+function startFakeKernel(
+  socketPath: string,
+  reply: Record<string, unknown>,
+  seen: string[],
+): Promise<net.Server> {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer((conn) => {
+      let buf = "";
+      conn.on("data", (chunk) => {
+        buf += chunk.toString("utf8");
+        const idx = buf.indexOf("\n");
+        if (idx === -1) return;
+        seen.push(buf.slice(0, idx));
+        conn.write(JSON.stringify(reply) + "\n");
+      });
+    });
+    server.on("error", reject);
+    server.listen(socketPath, () => resolve(server));
+  });
+}
+
+function makeFakeCtx(): {
+  ctx: Context;
+  toasts: string[];
+  edits: Array<{ markdown: string }>;
+} {
+  const toasts: string[] = [];
+  const edits: Array<{ markdown: string }> = [];
+  const ctx = {
+    from: { id: 42 },
+    answerCallbackQuery: async (args?: { text?: string }) => {
+      toasts.push(args?.text ?? "");
+      return true;
+    },
+    editMessageText: async (body: { markdown: string }) => {
+      edits.push(body);
+      return true;
+    },
+  } as unknown as Context;
+  return { ctx, toasts, edits };
+}
+
+describe("handleApprovalCallback × real decodeResponse (#4069)", () => {
+  let server: net.Server | undefined;
+  let tmpDir: string | undefined;
+  const savedEnv = process.env.SWITCHROOM_KERNEL_SOCKET;
+
+  afterEach(async () => {
+    if (server) await new Promise((r) => server!.close(r));
+    server = undefined;
+    if (savedEnv === undefined) delete process.env.SWITCHROOM_KERNEL_SOCKET;
+    else process.env.SWITCHROOM_KERNEL_SOCKET = savedEnv;
+    if (tmpDir) fs.rmSync(tmpDir, { recursive: true, force: true });
+    tmpDir = undefined;
+  });
+
+  it("approve tap records + advances the card — no false 'kernel record failed'", async () => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "sr4069-"));
+    const socketPath = path.join(tmpDir, "kernel.sock");
+    const seen: string[] = [];
+    server = await startFakeKernel(
+      socketPath,
+      {
+        ok: true,
+        consumed: true,
+        decision_id: DECISION_ID,
+        agent_unit: "clerk",
+        scope: "doc:gdrive:D1",
+        action: "write",
+        why: null,
+      },
+      seen,
+    );
+    process.env.SWITCHROOM_KERNEL_SOCKET = socketPath;
+
+    const { ctx, toasts, edits } = makeFakeCtx();
+    await handleApprovalCallback(ctx, `apv:${REQUEST_ID}:once`);
+
+    // The fake kernel really received the atomic consume+record op.
+    expect(seen.length).toBe(1);
+    expect(JSON.parse(seen[0]!)).toMatchObject({
+      op: "approval_consume_record",
+      request_id: REQUEST_ID,
+      decision: "allow_once",
+    });
+
+    // Outcome: the tap must land as Approved, never the false-failure
+    // toast, and the card must advance to its granted body carrying the
+    // decision_id revoke hint.
+    expect(toasts).not.toContain("kernel record failed");
+    expect(toasts).toContain("Approved");
+    expect(edits.length).toBe(1);
+    expect(edits[0]!.markdown).toContain(DECISION_ID);
+    expect(edits[0]!.markdown).toContain("granted once");
+  });
+});

package/telegram-plugin/gateway/gateway.ts

@@ -457,7 +457,7 @@ import {
   type SendReplyGatewayDeps,
   type DeliverCapturedProseDeps,
 } from './outbound-send-path.js'
-import { handleSessionEvent as handleSessionEventCore } from './stream-render.js'
+import { handleSessionEvent as handleSessionEventCore, drainParkedTurnStartsForChat } from './stream-render.js'
 import { createNarrativeLane } from './narrative-lane.js'
 import {
   parseAgentCallback,
@@ -9669,14 +9669,14 @@ function gatewayLivenessWiringDeps() {
     turnLiveForItsTopic,
     endCurrentTurnForKey,
     // Getter, not an eager read: `pendingInboundBuffer` (const) is declared
-    // LATER in this module (~9863) than the module-load `startTimer` call that
-    // invokes this builder (isGatewayMain path). A by-value capture here is a
-    // temporal-dead-zone ReferenceError that crash-loops every gateway boot
-    // (#3392 regression). Deferring to a getter — matching getInboundSpool /
-    // getTurnsDb / ipcServer — means the binding is only read when the
-    // fallback actually fires, well after module eval.
+    // LATER than the module-load `startTimer` call that invokes this builder,
+    // so a by-value capture is a temporal-dead-zone ReferenceError that
+    // crash-loops boot (#3392). A getter (matching getInboundSpool / getTurnsDb
+    // / ipcServer) is read only when the fallback fires, well after module eval.
     getPendingInboundBuffer: () => pendingInboundBuffer,
     trackRedeliveredInbound,
+    // Two-state desync unwedge (#3927): drain the parked store the fallback else leaves latched — see liveness-wiring + stream-render drainParkedTurnStartsForChat.
+    drainParkedTurnStarts: (chatId: string, threadId: number | null): number => drainParkedTurnStartsForChat(gatewayStreamRenderDeps(), chatId, threadId != null ? String(threadId) : null).length,
     closeActivityLane,
     closeProgressLane,
     // Stage B: escalate a mid-tool + marker-stale fallback to a real restart.

package/telegram-plugin/gateway/liveness-wiring.ts

@@ -62,6 +62,7 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
     endCurrentTurnForKey,
     getPendingInboundBuffer,
     trackRedeliveredInbound,
+    drainParkedTurnStarts,
     closeActivityLane,
     closeProgressLane,
     hangRestart,
@@ -593,6 +594,16 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
       getInboundSpool(),
       trackRedeliveredInbound,
     )
+    // Two-state desync unwedge. `pendingInboundBuffer` (above) is NOT where a
+    // wedge-behind-a-dead-lock message sits: an already-`enqueue`d message lives
+    // in stream-render's `parkedTurnStarts`, and the busy park gate stays latched
+    // while that store is non-empty. A hung REPL never emits the `dequeue`/
+    // `remove` that drain it, so drain it HERE, scoped to the wedged chat/thread,
+    // routing each envelope back through the real `dequeue` turn-start path. The
+    // count joins the `drained_buffered` field below so the log stops reading a
+    // misleading `0/0` while real user messages were stranded. Guarded getter:
+    // absent (older deps) → 0, so the fallback degrades to its prior behaviour.
+    const fbDrainedParked = drainParkedTurnStarts?.(fbChatId, fbThreadId ?? null) ?? 0
     process.stderr.write(
       `telegram gateway: silence-poke framework-fallback ended wedged turn ` +
       `chat=${fbChatId} thread=${ctx.threadId ?? '-'} silence_ms=${ctx.silenceMs} ` +
@@ -601,6 +612,7 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
       // keyed liveness check skipped the teardown, so the field lied.
       `currentTurn_nulled=${tearsDownLiveTurn} ` +
       `drained_buffered=${fbRedeliver.redelivered}/${fbRedeliver.drained}` +
+      `${fbDrainedParked > 0 ? ` drained_parked=${fbDrainedParked}` : ''}` +
       `${fbRedeliver.rebuffered > 0 ? ` rebuffered=${fbRedeliver.rebuffered}` : ''}` +
       `${fbExtraPurge.purged.length > 0 ? ` extra_keys_purged=${fbExtraPurge.purged.length}` : ''}\n`,
     )

package/telegram-plugin/gateway/model-command.ts

@@ -34,6 +34,27 @@ import {
   type ModelPickerOption,
 } from '../../src/agents/model-picker.js'
 import { assessThinkingEffortRisk } from '../../src/config/thinking-effort-risk.js'
+// The model-alias tables + expansion helpers live in the shared
+// `src/agents/model-aliases.ts` module so the gateway `/model` path and
+// scaffold-time config-default resolution expand from ONE table (#3998).
+// Imported for this module's internal use and re-exported below to preserve the
+// existing `model-command.js` public API (every importer keeps its entrypoint).
+import {
+  CLAUDE_MODEL_ALIASES,
+  SR_MODEL_ALIASES,
+  expandClaudeAlias,
+  expandSrAlias,
+  canonicalModelToken,
+  expandModelAlias,
+} from '../../src/agents/model-aliases.js'
+export {
+  CLAUDE_MODEL_ALIASES,
+  SR_MODEL_ALIASES,
+  expandClaudeAlias,
+  expandSrAlias,
+  canonicalModelToken,
+  expandModelAlias,
+}
 
 /**
  * Aliases the claude CLI resolves natively (`claude --help`: "an alias for
@@ -51,34 +72,6 @@ import { assessThinkingEffortRisk } from '../../src/config/thinking-effort-risk.
  */
 export const MODEL_ALIASES = ['opus', 'sonnet', 'haiku', 'fable', 'default'] as const
 
-/**
- * Short SWITCHROOM-side spellings for pinned **Anthropic** model ids. These are
- * expanded to the full `claude-*` id on the `/model` path BEFORE any
- * Claude-vs-external classification runs, so what reaches the `.session-model`
- * carrier (and therefore `claude --model`) is always the canonical id — the CLI
- * never sees the short spelling.
- *
- * Deliberately NOT `SR_MODEL_ALIASES`: that map means "external / OpenRouter /
- * the Anthropic OAuth header is NOT forwarded". These targets are Anthropic
- * OAuth-passthrough models, so putting them there would flip the
- * header-forwarding + external-billing classification and surface them under the
- * "🌐 External models" keyboard page with an `srFriendlyLabel`.
- *
- * Also NOT `MODEL_ALIASES`: that list is the aliases the claude CLI resolves
- * *itself*, and its members double as FAMILY tokens in `modelFamilyToken` /
- * `canonicalClaudeToken` / `servedModelMatchesRequested`. A pinned-id shortcut
- * is neither.
- *
- * NB the repo prefers family aliases over pinned ids (an alias tracks the
- * current flagship, a pinned id goes stale) — these exist because an operator
- * sometimes wants a specific pinned Opus, and typing `claude-opus-4-8` on a
- * phone is hostile. Keys are matched case-insensitively.
- */
-export const CLAUDE_MODEL_ALIASES: Record<string, string> = {
-  opus48: 'claude-opus-4-8',
-  'opus-4-8': 'claude-opus-4-8',
-}
-
 /**
  * Shape gate for the model argument. This string is typed literally
  * into the agent's tmux pane, so the gate is strict by construction:
@@ -1166,35 +1159,6 @@ export const SR_MODEL_LABELS: Record<string, string> = {
   'sr-gpt-5.6-luna': 'GPT-5.6 Luna',
 }
 
-/**
- * Short text-command aliases for sr-* models. These let the operator type
- * `/model flash`, `/model codex`, etc. instead of the full `sr-*` id.
- * Expanded in handleModelCommand before injection; the full sr-* id is what
- * reaches the agent session and LiteLLM.
- */
-export const SR_MODEL_ALIASES: Record<string, string> = {
-  flash: 'sr-gemini-2.5-flash',
-  gemini: 'sr-gemini-2.5-pro',
-  deepseek: 'sr-deepseek-v3',
-  r1: 'sr-deepseek-r1',
-  glm: 'sr-glm-5',
-  codex: 'sr-codex-5.5',
-  // Flagship keyboard buttons for the three providers added 2026-07-19. Each
-  // points at that provider's top tier; the cheaper tiers (grok-4.3,
-  // kimi-k2.7-code, gpt-5.6-terra/luna) stay typeable via `/model sr-<id>` and
-  // keep a friendly label above, matching the "labels are a superset of buttons"
-  // design (SR_MODEL_LABELS doc comment).
-  grok: 'sr-grok-4.5',
-  kimi: 'sr-kimi-k3',
-  gpt: 'sr-gpt-5.6-sol',
-  // Per-tier buttons for the GPT-5.6 line so each is a one-word shortcut
-  // (`gpt` stays the flagship-Sol default). Added 2026-07-19.
-  sol: 'sr-gpt-5.6-sol',
-  terra: 'sr-gpt-5.6-terra',
-  luna: 'sr-gpt-5.6-luna',
-}
-
-/** Expand a short alias (case-insensitive) to its full sr-* id, or return the original. */
 /**
  * #3042 review blocker 2a: can `token` be trusted for a boot-applied
  * `.session-model` carrier persist WITHOUT a live confirmation from claude?
@@ -1230,58 +1194,6 @@ export function isOfflineTrustedModelToken(token: string): boolean {
   return Object.values(CLAUDE_MODEL_ALIASES).includes(lower)
 }
 
-export function expandSrAlias(arg: string): string {
-  return SR_MODEL_ALIASES[arg.toLowerCase()] ?? arg
-}
-
-/**
- * The ONE canonical form of a model token — what `claude --model` is handed and
- * what every downstream gate compares against.
- *
- * Two normalizations, both narrow:
- *   - **trim** — unconditional. `unvalidatedIdCaveat` already trimmed while
- *     expansion did not, so the two disagreed on a padded token.
- *   - **lowercase, `claude-*` ONLY.** Every real Anthropic model id is lowercase
- *     and a phone autocapitalizes, so `/model Claude-Opus-4-8` used to be launched
- *     VERBATIM as an unvalidated id while the caveat exemption (which lowercases)
- *     suppressed the warning — a clean green ack for a token the caveat was
- *     written for. Non-`claude-` tokens are left alone: `sr-*` ids are matched
- *     case-insensitively by their own maps, and rewriting an arbitrary external
- *     id's case is not ours to do.
- *
- * Applied by `expandModelAlias`, so canonicalization happens on every `/model`
- * path (typed apply, mid-turn queue, menu tap, queued-across-restart persist)
- * whether or not the token hit a shortcut map — one canonical form flows to
- * `claude --model`, and `unvalidatedIdCaveat` sees exactly that form.
- */
-export function canonicalModelToken(arg: string): string {
-  const trimmed = arg.trim()
-  const lower = trimmed.toLowerCase()
-  return lower.startsWith('claude-') ? lower : trimmed
-}
-
-/** Expand a short pinned-Claude spelling (case-insensitive) to its full `claude-*` id. */
-export function expandClaudeAlias(arg: string): string {
-  return CLAUDE_MODEL_ALIASES[arg.trim().toLowerCase()] ?? arg
-}
-
-/**
- * The ONE expansion every `/model` argument goes through, on every path that
- * consumes a user-supplied token (typed apply, mid-turn queue, menu tap,
- * queued-across-restart persist). Claude shortcuts resolve first, then sr-*
- * shortcuts; the two key sets are disjoint by construction (a Claude shortcut
- * never expands to an `sr-*` id and vice versa), so order only documents intent.
- * The result is `canonicalModelToken`-normalized, so a miss can no longer emit a
- * verbatim mixed-case `claude-*` id that the caveat exemption then mis-matches.
- *
- * Expanding HERE — before `isClaudeModel` / `isSrModel` / `externalModelNames`
- * ever see the token — is what keeps a pinned-Claude shortcut on the Anthropic
- * OAuth passthrough instead of being misread as an external route.
- */
-export function expandModelAlias(arg: string): string {
-  return canonicalModelToken(expandSrAlias(expandClaudeAlias(arg)))
-}
-
 export function srFriendlyLabel(srName: string): string {
   return SR_MODEL_LABELS[srName] ?? srName.replace(/^sr-/, '').replace(/-/g, ' ')
 }

package/telegram-plugin/gateway/stream-render.ts

@@ -232,6 +232,63 @@ export function __parkedTurnStartCountForTest(): number {
   return parkedTurnStarts.length
 }
 
+/**
+ * Silence-fallback unwedge for the parked store (the two-state desync fix).
+ *
+ * The park gate in `case 'enqueue'` treats the session as busy while EITHER a
+ * live `currentTurn` exists OR `parkedTurnStarts` is non-empty. The 300 s
+ * framework-fallback (`liveness-wiring.ts` onFrameworkFallback) that recovers a
+ * hung turn nulls `currentTurn` and redelivers `pendingInboundBuffer` — but
+ * before this it NEVER touched `parkedTurnStarts`. When the claude REPL hangs
+ * mid-turn the CLI's own `dequeue` / `remove` events (the only real drains of
+ * this store) never arrive, so a leftover parked envelope latches the busy gate
+ * permanently and every later inbound parks unseen until a manual container
+ * restart (gymbro parked msgs 4502→4504 behind a dead lock until SIGTERM). The
+ * `drained_buffered=0/0` fallback log was honest-but-misleading: it counted the
+ * empty `pendingInboundBuffer`, not this store, where the real messages sat.
+ *
+ * This drains the parked envelopes for ONE chat/thread — scoped, never global,
+ * so a fallback fired for chat A cannot release chat B's queued messages — and
+ * hands each back into turn processing through the EXACT `beginTurn` path a real
+ * `dequeue` uses. Envelopes are re-begun in arrival order (oldest first) so the
+ * NEWEST, the message the user is actually waiting on, ends up the live turn and
+ * the older ones are cleanly superseded (never silently dropped). The store is
+ * kept module-encapsulated: callers get a function, not the array. Returns the
+ * drained envelopes so the caller can log an honest count. Idempotent w.r.t. a
+ * late CLI event: once drained, a subsequent `dequeue` finds an empty store and
+ * `takeParkedTurnStart` returns null, so a message can never be double-started.
+ */
+export function drainParkedTurnStartsForChat(
+  deps: StreamRenderDeps,
+  chatId: string | null,
+  threadId: string | null,
+): TurnStartEnvelope[] {
+  const wantThread = envThreadIdNum(threadId)
+  const drained: ParkedTurnStart[] = []
+  // Splice out the matching entries, preserving arrival order (oldest first).
+  for (let i = 0; i < parkedTurnStarts.length; ) {
+    const entry = parkedTurnStarts[i]!
+    if (entry.chatId === chatId && envThreadIdNum(entry.threadId) === wantThread) {
+      drained.push(entry)
+      parkedTurnStarts.splice(i, 1)
+    } else {
+      i++
+    }
+  }
+  for (const env of drained) {
+    process.stderr.write(
+      `telegram gateway: parked-turn-start drained on silence-fallback ` +
+        `chat=${env.chatId ?? '-'} thread=${envThreadIdNum(env.threadId) ?? '-'} ` +
+        `msg=${env.messageId ?? '-'}\n`,
+    )
+    // Reuse the dequeue turn-start path verbatim — beginTurn adopts the parked
+    // envelope's queued card (Part B) so the frozen "⏳ Queued" surface becomes
+    // the live progress card rather than lingering.
+    beginTurn(deps, env)
+  }
+  return drained
+}
+
 // ─── Queued-turn card send / finalize (Part B) ───────────────────────────────
 // These use the ALREADY-injected `bot` + `robustApiCall` deps, so the whole
 // feature lives in stream-render.ts with zero new wiring in gateway.ts. No

package/telegram-plugin/tests/framework-fallback-drains-parked.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Two-state desync wedge — the silence-fallback must drain `parkedTurnStarts`.
+ *
+ * The gateway carries TWO independent "turn in flight" states. The park gate in
+ * `stream-render.ts` (`case 'enqueue'`) treats the session as busy if EITHER a
+ * live `currentTurn` exists OR `parkedTurnStarts` is non-empty. The 300 s
+ * framework-fallback (`liveness-wiring.ts` onFrameworkFallback) that recovers a
+ * hung turn nulls `currentTurn` and redelivers `pendingInboundBuffer` — but
+ * before the fix it NEVER touched `parkedTurnStarts`. That store's only real
+ * drains are the CLI's own `dequeue` / `remove` stream events, so when the
+ * claude REPL hangs mid-turn those never arrive, a leftover parked envelope
+ * latches the busy gate permanently, and every later inbound parks unseen until
+ * a manual container restart (gymbro parked msgs 4502→4504 behind a dead lock
+ * until SIGTERM). #3927 introduced the parked store but never wired it into
+ * fallback recovery.
+ *
+ * This drives the REAL `handleSessionEvent` (the extracted-module golden
+ * harness, same standard as `turn-mint-defers-until-dequeue.test.ts`) and the
+ * REAL `onFrameworkFallback` (via `buildSilencePokeOptions`, same standard as
+ * `silence-poke-teardown-notice.test.ts`), sharing ONE world: the fallback's
+ * `drainParkedTurnStarts` dep routes to the real store + `beginTurn` over the
+ * harness deps. It asserts the OUTCOME, not a code path: after the fallback the
+ * parked store is emptied AND the parked message was handed back into turn
+ * processing (its turn begun, its card opened) rather than silently dropped.
+ */
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  handleSessionEvent,
+  drainParkedTurnStartsForChat,
+  __resetParkedTurnStartsForTest,
+  __parkedTurnStartCountForTest,
+} from '../gateway/stream-render.js'
+import { buildSilencePokeOptions } from '../gateway/liveness-wiring.js'
+import { makeLivenessFixture, makeTurn, statusKeyForTests } from './helpers/liveness-wiring-fixture.js'
+import { CHAT, enqueue, makeHarness } from './turn-mint-harness.js'
+
+beforeEach(() => {
+  __resetParkedTurnStartsForTest()
+})
+
+describe('silence-fallback drains parkedTurnStarts so a hung REPL cannot wedge the park gate', () => {
+  it('empties the parked store AND redelivers the parked message into turn processing', async () => {
+    const h = makeHarness()
+
+    // ── turn A mints on the idle enqueue and its ms-later dequeue ─────────────
+    handleSessionEvent(h.deps, enqueue('501'))
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    const turnA = h.current()!
+    expect(turnA.sourceMessageId).toBe(501)
+
+    // ── the operator sends B mid-turn; the CLI queues it (enqueue) but the
+    //    REPL hangs, so the paired `dequeue` never comes and B stays parked ──
+    handleSessionEvent(h.deps, enqueue('502', 'still there?'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // ── the REAL 300 s framework-fallback fires, wired to the REAL parked
+    //    drain over the harness deps so both states share one world ──────────
+    const KEY = statusKeyForTests(CHAT, null)
+    const fx = makeLivenessFixture({
+      drainParkedTurnStarts: (chatId: string, threadId: number | null) =>
+        drainParkedTurnStartsForChat(
+          h.deps,
+          chatId,
+          threadId != null ? String(threadId) : null,
+        ).length,
+    })
+    // The wedged turn the fallback tears down — same chat/thread as parked B.
+    fx.activeTurnStartedAt.set(KEY, 0)
+    fx.setCurrentTurn(makeTurn({ sessionChatId: CHAT, sessionThreadId: undefined, turnId: `${KEY}#42` }))
+
+    const opts = buildSilencePokeOptions(fx.deps)
+    await opts.onFrameworkFallback({
+      key: KEY,
+      chatId: CHAT,
+      threadId: null,
+      fallbackKind: 'working',
+      silenceMs: 302_000,
+      inFlightTools: [],
+    })
+
+    // The fallback nulled the wedged turn (its one load-bearing job).
+    expect(fx.endedKeys).toContain(KEY)
+
+    // OUTCOME 1 — the parked store is emptied, so the busy park gate unlatches
+    // and the NEXT inbound can mint its own turn instead of parking unseen.
+    expect(__parkedTurnStartCountForTest()).toBe(0)
+
+    // OUTCOME 2 — B was actually dispatched back into turn processing, not
+    // dropped: its turn was begun (it is now the live turn) and its progress
+    // card was opened. Pre-fix, B stayed parked and this never happened.
+    expect(h.current()!.sourceMessageId).toBe(502)
+    expect(h.cardsOpened.some((c) => c.sourceMessageId === 502)).toBe(true)
+  })
+
+  it('is scoped to the wedged chat — a fallback for chat A leaves chat B parked', () => {
+    const h = makeHarness()
+
+    // A live turn on CHAT, plus a parked entry on CHAT.
+    handleSessionEvent(h.deps, enqueue('601'))
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    handleSessionEvent(h.deps, enqueue('602'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // A fallback for a DIFFERENT chat must not touch CHAT's parked entry.
+    const drainedOther = drainParkedTurnStartsForChat(h.deps, '9999', null)
+    expect(drainedOther).toHaveLength(0)
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // The correctly-scoped drain releases it.
+    const drainedHere = drainParkedTurnStartsForChat(h.deps, CHAT, null)
+    expect(drainedHere).toHaveLength(1)
+    expect(drainedHere[0]!.messageId).toBe('602')
+    expect(__parkedTurnStartCountForTest()).toBe(0)
+  })
+
+  it('is idempotent w.r.t. a late CLI dequeue — no double-start', () => {
+    const h = makeHarness()
+    handleSessionEvent(h.deps, enqueue('701'))
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    handleSessionEvent(h.deps, enqueue('702'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // Fallback drains + begins 702.
+    expect(drainParkedTurnStartsForChat(h.deps, CHAT, null)).toHaveLength(1)
+    expect(h.current()!.sourceMessageId).toBe(702)
+    const cardsAfterDrain = h.cardsOpened.length
+
+    // The REPL finally un-hangs and emits its late `dequeue`. The store is empty
+    // so `takeParkedTurnStart` returns null and no second turn/card is minted.
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    expect(h.cardsOpened).toHaveLength(cardsAfterDrain)
+    expect(h.current()!.sourceMessageId).toBe(702)
+  })
+})

package/telegram-plugin/tests/helpers/liveness-wiring-fixture.ts

@@ -154,6 +154,9 @@ export function makeLivenessFixture(
     purgeReactionTracking: () => {},
     getPendingInboundBuffer: () => ({ drain: () => [] }),
     trackRedeliveredInbound: () => {},
+    // Default: no parked store wired (returns 0). Tests exercising the parked
+    // drain override this with the real `drainParkedTurnStartsForChat`.
+    drainParkedTurnStarts: (_chatId: string, _threadId: number | null) => 0,
     closeActivityLane: () => {},
     closeProgressLane: () => {},
     hangRestart: null,

package/vendor/hindsight-memory/CHANGELOG.md

@@ -54,6 +54,34 @@
 
 ### Changed (switchroom divergence)
 
+- **Recall/retain hygiene guard-rail batch** (`scripts/recall.py`,
+  `scripts/subagent_retain.py`, `scripts/lib/content.py`, `scripts/tests/**`).
+  Closes guard-rail debt in the fork's hook scripts before extending them:
+  - **#3766** — `shape_recall_query` no longer drops a single-char SUBJECT
+    ('C', 'R', a single-digit version) before the stopword fallback runs. The
+    `len(t) > 1` guard moved into the fallback, so a single-char content word
+    survives while single-char stopwords are still removed.
+  - **#3578** — `_overlap_tokens` (the #3369 transcript-fallback tokenizer) now
+    accumulates alphanumeric runs (`isalnum`), so issue numbers, ports and
+    versions ('3993', ':9077', 'v0') carry signal and match symmetrically on
+    both the query and transcript sides. A lone digit is still dropped as noise.
+  - **#3994** — the sidechain volume gate counts ONLY the chars the text-only
+    retain path keeps (`retained_text_char_count` → `_extract_text_content`),
+    not the `tool_use` inputs the payload drops. Gate and payload now measure
+    the same char set, so a tool-heavy / prose-light fork that used to clear the
+    gate and retain a near-empty document is now correctly skipped. The
+    2,000-char floor was re-measured against the corrected metric —
+    `docs/measurements/subagent-volume-gate-3994.md`, replay harness
+    `scripts/tests/data/replay_volume_gate_3994.py`.
+  - **#4001** — the "window formatted to empty despite clearing the gate" skip
+    now emits an unconditional stderr line, not a debug-only log that was silent
+    in shipped settings.
+  - **#3999 / #3777** — rewrote the vacuous sidechain config-mutation test to
+    assert on the config object the code actually receives (RED when the copy
+    fix is deleted), and restored direct characterisation of `_overlap_tokens`
+    (`scripts/tests/test_overlap_tokens.py`) that was deleted with the removed
+    lexical gate while the tokenizer stayed load-bearing.
+
 - **`MAX_DIRECTIVES` 15 → 30, and truncation is no longer SILENT**
   (`scripts/lib/directives.py`). Live fleet active-directive counts were 24
   (assistant), 17 (klanker), 15 (carrie) against a client-side cap of 15, so the