switchroom 0.19.41 → 0.19.43

package/telegram-plugin/tests/card-hard-truncate-entity-safe.test.ts

@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest'
+import { hardTruncateCard } from '../card-layout.js'
+import { truncateMarkdownSafe, safeMarkdownCut } from '../format.js'
+import { validateRichMarkdown } from './rich-markdown-oracle.js'
+
+/**
+ * #4116 — the LAST-RESORT truncation must not be able to fail the send.
+ *
+ * `hardTruncateCard` is the path `fitCardToBudget` falls to when no shrink
+ * level can get a card under `STATUS_CARD_CHAR_BUDGET` (the #3682 repro: a
+ * 40k-char worker description, where every level keeps the same over-budget
+ * chrome). Its single-over-budget-line branch used to slice the raw markdown
+ * by character count. A cut landing between a `**` pair — or inside a
+ * `` `code` `` span, a `[label](href)`, an open ``` fence, a `~~strike~~`, a
+ * `||spoiler||` — emits a body Telegram parse-REJECTS with "can't find end of
+ * the entity". So the code path whose whole purpose is to guarantee delivery
+ * within budget could itself make the send fail.
+ *
+ * The fix routes the cut through `truncateMarkdownSafe`, which reuses the
+ * chunker's existing entity-boundary reasoning (`safeMarkdownCut` =
+ * fence → table row → inline span back-offs, plus surrogate-pair safety)
+ * rather than adding a second markdown parser.
+ *
+ * These tests assert the OUTCOME — "the emitted text parses" — using the
+ * repo's own parse-accept oracle (`rich-markdown-oracle.ts`, the same one the
+ * formatting-regression suite trusts), at EVERY cut offset rather than at a
+ * handful of hand-picked ones.
+ */
+
+/** A card body carrying one of every entity kind that can straddle a cut. */
+const MIXED_ENTITY_CARD = [
+  '🛠 **Worker · fix/telegram-w0-de** · 2m05s · 12 tools',
+  '~~_✓ Read `telegram-plugin/card-layout.ts` and `format.ts`_~~',
+  '**→ Rewriting the last-resort clip** with a [linked issue](https://github.com/switchroom/switchroom/issues/4116) inline',
+  '⠀⠀⠀↳ _nested_ step with a ||spoiler|| and ~~a struck phrase~~ plus 👍🏽 astral text',
+  '```ts',
+  'const out = hardTruncateCard(text, budget)',
+  'const safe = safeMarkdownCut(text, cut)',
+  '```',
+  'A trailing prose line with **bold**, `code`, _italic_ and an emoji 🧵 at the end.',
+].join('\n')
+
+describe('the source fixture is itself valid markdown', () => {
+  it('guards the property test against a vacuous baseline', () => {
+    // If the fixture were already invalid, "every truncation is valid" could
+    // only ever fail — or, worse, a broken oracle would make it vacuously pass.
+    expect(validateRichMarkdown(MIXED_ENTITY_CARD)).toEqual([])
+  })
+})
+
+describe('PROPERTY: hardTruncateCard emits parseable markdown at every offset (#4116)', () => {
+  it('every budget from 1 to the full length yields a card Telegram can parse', () => {
+    const failures: Array<{ budget: number; kinds: string[]; tail: string }> = []
+    for (let budget = 1; budget <= MIXED_ENTITY_CARD.length; budget++) {
+      const out = hardTruncateCard(MIXED_ENTITY_CARD, budget)
+      const issues = validateRichMarkdown(out)
+      if (issues.length > 0) {
+        failures.push({
+          budget,
+          kinds: [...new Set(issues.map((i) => i.kind))],
+          tail: out.slice(-24),
+        })
+      }
+    }
+    // Fail-before on origin/main: every offset whose cut lands inside a `**`
+    // pair / code span / link / fence produces an unsendable card.
+    expect(failures).toEqual([])
+  })
+
+  it('every truncation stays within its budget and is valid UTF-16', () => {
+    for (let budget = 1; budget <= MIXED_ENTITY_CARD.length; budget++) {
+      const out = hardTruncateCard(MIXED_ENTITY_CARD, budget)
+      expect(out.length, `budget ${budget}`).toBeLessThanOrEqual(budget)
+      // No lone surrogate — a split astral char is invalid UTF-16 on the wire.
+      expect(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])/.test(out), `budget ${budget}`).toBe(false)
+      expect(/(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(out), `budget ${budget}`).toBe(false)
+    }
+  })
+
+  it('a clipped card is still a card — it never collapses to (nearly) nothing', () => {
+    // The clip exists because "a clipped card beats no card". A back-off that
+    // retreated past a huge entity could return an empty string, which is the
+    // dropped card all over again. From a budget with room for real content,
+    // at least half of it survives — minus the handful of delimiter characters
+    // an opener-drop repair removes (measured worst case on this fixture: 8).
+    const REPAIR_SLACK = 12
+    for (let budget = 24; budget <= MIXED_ENTITY_CARD.length; budget++) {
+      const out = hardTruncateCard(MIXED_ENTITY_CARD, budget)
+      expect(out.length * 2 + REPAIR_SLACK, `budget ${budget}`).toBeGreaterThanOrEqual(budget)
+    }
+  })
+})
+
+describe('the specific entity kinds that can straddle a cut (#4116)', () => {
+  const cases: Array<[string, string]> = [
+    ['bold', 'lead in **a bold run that is long enough to straddle** tail'],
+    ['italic-underscore', 'lead in _an italic run long enough to straddle_ tail'],
+    ['bold-italic', 'lead in ***a bold-italic run long enough to straddle*** tail'],
+    ['inline code', 'lead in `a code span long enough to straddle the cut` tail'],
+    ['link', 'lead in [a label](https://example.com/a/long/path/here) tail'],
+    ['strikethrough', 'lead in ~~a struck run long enough to straddle~~ tail'],
+    ['spoiler', 'lead in ||a spoiler run long enough to straddle|| tail'],
+    ['table row', 'lead in\n| col a | col b | col c | col d |\ntail'],
+    ['fenced block', 'lead in\n```ts\nconst x = 1\nconst y = 2\n```\ntail'],
+  ]
+
+  for (const [kind, body] of cases) {
+    it(`never bisects a ${kind}`, () => {
+      expect(validateRichMarkdown(body)).toEqual([])
+      const bad: number[] = []
+      for (let budget = 1; budget <= body.length; budget++) {
+        if (validateRichMarkdown(hardTruncateCard(body, budget)).length > 0) bad.push(budget)
+      }
+      expect(bad).toEqual([])
+    })
+  }
+})
+
+describe('truncateMarkdownSafe — the shared mechanism', () => {
+  it('backs off rather than cutting inside a span, keeping formatting intact', () => {
+    const text = 'abcdefghij **bold text here** klmno'
+    // Budget 20 lands inside the bold span (which opens at 11).
+    const out = truncateMarkdownSafe(text, 20)
+    expect(out).toBe('abcdefghij ')
+    expect(validateRichMarkdown(out)).toEqual([])
+  })
+
+  it('drops the opener instead of returning a near-empty result when one entity swallows the budget', () => {
+    // The #3682 shape: a single span longer than the whole window. Backing off
+    // would return `🛠 ` — a card with no content. Dropping the (unrenderable,
+    // because its closer is far past the budget) opener keeps the text.
+    const text = `🛠 **${'d'.repeat(500)}**`
+    const out = truncateMarkdownSafe(text, 64)
+    // Within budget, and only the dropped `**` short of it — the window is
+    // held fixed in SOURCE terms so the repair can never pull the span's
+    // closing delimiter into the output.
+    expect(out.length).toBe(62)
+    expect(out.startsWith('🛠 d')).toBe(true)
+    expect(out).not.toContain('*')
+    expect(validateRichMarkdown(out)).toEqual([])
+  })
+
+  it('is a no-op when the text already fits', () => {
+    expect(truncateMarkdownSafe('**short**', 64)).toBe('**short**')
+  })
+
+  it('safeMarkdownCut never splits a surrogate pair', () => {
+    const text = 'ab👍cd'
+    // Index 3 is between the two halves of the astral char.
+    expect(safeMarkdownCut(text, 3)).toBe(2)
+    expect(safeMarkdownCut(text, 4)).toBe(4)
+  })
+})

package/telegram-plugin/tests/card-variants.golden.txt

@@ -29,9 +29,9 @@ _1m35s · 12 tools · 41.2k tok · opus 4.8_
 ~~_✓ Searching memory for card render paths_~~   
 ~~_✓ Reading telegram-plugin/tool-activity-summary.ts_~~   
 ~~_✓ Reading telegram-plugin/worker-activity-feed.ts_~~   
-   ↳ ~~_Reading the repo conventions_~~   
-   ↳ ~~_Running the scoped test suite_~~   
-   ↳ **→ Summarising findings · 24s**
+⠀⠀⠀↳ ~~_Reading the repo conventions_~~   
+⠀⠀⠀↳ ~~_Running the scoped test suite_~~   
+⠀⠀⠀↳ **→ Summarising findings · 24s**
 
 ===== CARD ===== Agent card — liveness early-open (no tools yet)
 🤖 **Agent**   
@@ -203,9 +203,9 @@ _✓ +9 earlier…_
 _1m35s · 12 tools · 41.2k tok · opus 4.8_   
 ~~_✓ Searching memory for card render paths_~~   
 ~~_✓ Reading telegram-plugin/tool-activity-summary.ts_~~   
-   ↳ _+6 earlier…_   
-   ↳ ~~_Child step 7_~~   
-   ↳ ~~_Child step 8_~~   
-   ↳ ~~_Child step 9_~~   
-   ↳ ~~_Child step 10_~~   
-   ↳ **→ Child step 11**
+⠀⠀⠀↳ _+6 earlier…_   
+⠀⠀⠀↳ ~~_Child step 7_~~   
+⠀⠀⠀↳ ~~_Child step 8_~~   
+⠀⠀⠀↳ ~~_Child step 9_~~   
+⠀⠀⠀↳ ~~_Child step 10_~~   
+⠀⠀⠀↳ **→ Child step 11**

package/telegram-plugin/tests/flood-reply-queue.test.ts

@@ -36,7 +36,7 @@ import {
   floodQueueNonce,
   FLOOD_QUEUED_SOURCE,
 } from '../gateway/flood-reply-queue.js'
-import { sweepOutbox } from '../gateway/outbox-sweep.js'
+import { sweepOutbox, type OutboxSendResult } from '../gateway/outbox-sweep.js'
 import { listPendingRecords, resolveOutboxDir, type OutboxRecord } from '../outbox.js'
 import {
   floodStatePath,
@@ -60,6 +60,32 @@ function wrappedReplyFailure(): Error {
   return new Error('reply failed after 0 of 1 chunk(s) sent: FLOOD_WAIT_ACTIVE')
 }
 
+/**
+ * A sweep `send` stub with the REAL {@link OutboxSendResult} shape (#4044).
+ *
+ * These tests used to stub `send` as `async () => 4242` — a bare number, the
+ * pre-#3510 contract. `sweepOutbox` has read `.messageId` / `.chunks` off the
+ * result since, so the stub was silently lying: it journalled
+ * `tgMessageId: undefined` and would have THROWN on `.chunks.length` had the
+ * test wired `recordOutbound` — which the sweep's catch turns into a
+ * `sendFailure` and a re-send on the next tick, i.e. a duplicate delivery of
+ * the very answer this file exists to protect. The `journals the landed message id`
+ * test below asserts that outcome; this helper is what makes it representable.
+ */
+function makeSendStub(firstMessageId = 4242) {
+  let next = firstMessageId
+  return vi.fn(
+    async (
+      _chatId: string,
+      _threadId: number | null,
+      text: string,
+    ): Promise<OutboxSendResult> => {
+      const messageId = next++
+      return { messageId, chunks: [{ messageId, text }] }
+    },
+  )
+}
+
 function readRecords(dir: string): OutboxRecord[] {
   const outbox = resolveOutboxDir(dir)
   return readdirSync(outbox)
@@ -280,7 +306,7 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
 
     // 4. Sweeping WHILE the window is open must not touch the wire, and must
     //    not lose the record.
-    const send = vi.fn(async () => 4242)
+    const send = makeSendStub(4242)
     const during = await sweepOutbox({
       stateDir: dir,
       send,
@@ -318,6 +344,65 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
     expect(listPendingRecords(dir)).toHaveLength(0)
   })
 
+  it('journals the landed message id and records history parity — not a send failure (#4044)', async () => {
+    // Regression for the stale `send` stub. `sweepOutbox` reads `.messageId`
+    // and `.chunks` off its `send` result (`OutboxSendResult`, outbox-sweep.ts
+    // :63-80). While these tests stubbed `send` as a bare number the contract
+    // was unguarded, and a stub-shaped production sender would (a) journal
+    // `tgMessageId: undefined`, losing the pointer to the delivered message,
+    // and (b) throw on `sendResult.chunks.length` — which the sweep's catch
+    // converts into `sendFailures++` and a claim RELEASE, so the next tick
+    // re-sends the operator's answer a second time. This asserts the outcome:
+    // delivered once, journalled with the REAL id, mirrored to history.
+    const answer = 'the answer that must land exactly once'
+    const t0 = 1_000_000
+    queueFloodBlockedReply({
+      err: floodWaitActiveError(30),
+      chatId: '777',
+      threadId: null,
+      text: answer,
+      priorityClass: 'critical',
+      stateDir: dir,
+      createdAt: t0,
+    })
+
+    const send = makeSendStub(9001)
+    const recorded: Array<[string, number | null, number[], string[]]> = []
+    const summary = await sweepOutbox({
+      stateDir: dir,
+      send,
+      recordOutbound: (chatId, threadId, messageIds, texts) => {
+        recorded.push([chatId, threadId, messageIds, texts])
+      },
+      textAlreadyDelivered: () => false,
+      now: () => t0 + 10_000,
+    })
+
+    // Delivered — and NOT counted as a send failure.
+    expect(summary.delivered).toBe(1)
+    expect(summary.sendFailures).toBe(0)
+    expect(send).toHaveBeenCalledTimes(1)
+
+    // The journal carries the id the wire actually returned, so a duplicate is
+    // provable from the journal alone (#3510).
+    const journal = readFileSync(join(resolveOutboxDir(dir), 'delivered.jsonl'), 'utf8')
+      .split('\n')
+      .filter((l) => l.trim() !== '')
+      .map((l) => JSON.parse(l) as { tgMessageId?: number; deliverySource?: string })
+    expect(journal).toHaveLength(1)
+    expect(journal[0]!.tgMessageId).toBe(9001)
+    expect(journal[0]!.deliverySource).toBe('sweep')
+
+    // And history got the landed ids + their delivered texts.
+    expect(recorded).toHaveLength(1)
+    expect(recorded[0]![0]).toBe('777')
+    expect(recorded[0]![2]).toEqual([9001])
+    expect(recorded[0]![3]!.join('')).toContain(answer)
+
+    // Nothing left to re-send.
+    expect(listPendingRecords(dir)).toHaveLength(0)
+  })
+
   it('does not double-deliver when the caller retries after the window closed', async () => {
     const answer = 'the one answer'
     const t0 = 1_000_000
@@ -331,7 +416,7 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
       createdAt: t0,
     })
 
-    const send = vi.fn(async () => 1)
+    const send = makeSendStub(1)
     await sweepOutbox({
       stateDir: dir,
       send,
@@ -381,7 +466,7 @@ describe('end-to-end: queued during the window, delivered after it closes', () =
       })
     })
 
-    const send = vi.fn(async () => 1)
+    const send = makeSendStub(1)
     await sweepOutbox({
       stateDir: dir,
       send,

package/telegram-plugin/tests/format-consistency.test.ts

@@ -397,20 +397,166 @@ describe('stripExcessBold', () => {
     expect(stripExcessBold(input)).toBe(input)
   })
 
-  test('48/49-char pseudo-heading boundary honoured under global strip', () => {
-    // Heading length is measured WITH the `**` markers. 44 inner chars → 48
-    // total (exempt); 45 inner chars → 49 total (stripped).
-    const heading48 = '**' + 'H'.repeat(44) + '**' // length 48
-    const heading49 = '**' + 'H'.repeat(45) + '**' // length 49
-    expect(heading48.length).toBe(48)
-    expect(heading49.length).toBe(49)
-
-    const out48 = stripExcessBold(`${heading48}\n\n${boldDenseBody}`)
-    expect(out48).toContain(heading48)
-
-    const out49 = stripExcessBold(`${heading49}\n\n${boldDenseBody}`)
-    expect(out49).not.toContain(heading49)
-    expect(out49).toContain('H'.repeat(45))
+  test('64/65-char pseudo-heading boundary honoured under global strip', () => {
+    // Heading length is measured WITH the `**` markers. 60 inner chars → 64
+    // total (exempt); 61 inner chars → 65 total (stripped).
+    const heading64 = '**' + 'H'.repeat(60) + '**' // length 64
+    const heading65 = '**' + 'H'.repeat(61) + '**' // length 65
+    expect(heading64.length).toBe(64)
+    expect(heading65.length).toBe(65)
+
+    const out64 = stripExcessBold(`${heading64}\n\n${boldDenseBody}`)
+    expect(out64).toContain(heading64)
+
+    const out65 = stripExcessBold(`${heading65}\n\n${boldDenseBody}`)
+    expect(out65).not.toContain(heading65)
+    expect(out65).toContain('H'.repeat(61))
+  })
+
+  // ── #4021: long-but-legitimate bold section labels survive ───────────────
+  // At PSEUDO_HEADING_MAX_CHARS=48 a real section label of 50-63 chars was
+  // read as an over-bolded paragraph and flattened. The cap is 64.
+
+  test.each([
+    // [label, survives?]
+    ['**Deployment status across all three regions:**', true], // 46
+    ['**Deployment status across all three AWS regions:**', true], // 50
+    ['**What changed in the delivery path since last Tuesday:**', true], // 56
+    ['**What actually changed in the delivery path since Tue:**', true], // 56
+    ['**Everything that changed across the delivery path this week:**', true], // 62
+    ['**Everything that changed across the whole delivery path today:**', false], // 65
+  ])('bold section label %s survives=%s under global strip', (label, survives) => {
+    // Sanity: the fixtures must straddle the 64-char boundary.
+    expect(label.length <= 64).toBe(survives)
+
+    const out = stripExcessBold(`${label}\n\n${boldDenseBody}`)
+    const inner = label.slice(2, -2)
+    if (survives) {
+      expect(out).toContain(label)
+    } else {
+      expect(out).not.toContain(label)
+      expect(out).toContain(inner)
+    }
+    // Either way the body is still flattened — the ratio guard is intact.
+    expect(out).not.toContain('**alpha**')
+  })
+
+  // ── #4017: a message that is ALL pseudo-headings still strips ────────────
+  // Every block exempted meant `out === masked`: a 100%-bold digest stayed
+  // fully bold and onStrip never fired.
+
+  test('all-pseudo-heading message strips (no body to contrast against)', () => {
+    const input = [
+      '**Deploy status**',
+      '**Open incidents**',
+      '**Merged today**',
+      '**Blocked on review**',
+      '**Rollout window tomorrow**',
+      '**Next steps:**',
+    ].join('\n\n')
+    expect(input.length).toBeGreaterThan(100)
+
+    const calls: Array<{ rule: string; ratio: number }> = []
+    const out = stripExcessBold(input, (d) => calls.push(d))
+
+    expect(out).not.toContain('**')
+    expect(out).toContain('Deploy status')
+    expect(out).toContain('Next steps:')
+    // Blank-line gaps between the headings are preserved.
+    expect(out).toBe(input.replace(/\*\*/g, ''))
+    // …and the strip is logged.
+    expect(calls).toHaveLength(1)
+    expect(calls[0].rule).toBe('global')
+    expect(calls[0].ratio).toBeGreaterThan(0.3)
+  })
+
+  test.each([
+    [
+      'all headings, no body → strip',
+      `**Deploy status**\n\n**Open incidents this morning**\n\n**Merged today since the last release**\n\n**Next steps:**`,
+      false,
+    ],
+    [
+      'headings + bold-dense body → headings survive',
+      `**Deploy status**\n\n${boldDenseBody}`,
+      true,
+    ],
+    [
+      'headings around a bold-dense body → headings survive',
+      `**Deploy status**\n\n**Open incidents**\n\n${boldDenseBody}\n\n**Next steps:**`,
+      true,
+    ],
+  ])('all-heading guard: %s', (_name, input, headingSurvives) => {
+    expect(input.length).toBeGreaterThan(100)
+    const out = stripExcessBold(input)
+    expect(out.includes('**Deploy status**')).toBe(headingSurvives)
+    expect(out).toContain('Deploy status')
+  })
+
+  // ── #4114: a code-only block is NOT body for the all-heading guard ───────
+  // #4108's short-circuit tested `blocks.every(isPseudoHeadingBlock)` on every
+  // non-blank block. A masked code block satisfies neither side, so ONE code
+  // fence in an all-headings digest flipped `every(...)` to false, re-exempted
+  // every heading, and reproduced #4017 exactly: 100% bold, onStrip silent.
+  // Decision pinned here: masked code is not body — it is invisible to every
+  // other measurement in stripExcessBold (it is stripped before the ratio is
+  // taken), so it does not buy the headings an exemption either.
+
+  const HEADINGS = ['**Deploy status**', '**Open incidents**', '**Merged today**']
+  const TAIL = ['**Blocked on review**', '**Rollout window tomorrow**', '**Next steps:**']
+
+  test.each([
+    ['fenced code block', '```\nswitchroom agent restart klanker\n```'],
+    ['inline code span', '`switchroom agent restart klanker`'],
+    ['fenced block with a language tag', '```bash\nswitchroom agent restart klanker\n```'],
+    ['several inline spans on one line', '`alpha` `beta` `gamma` `delta` `epsilon`'],
+  ])('all-heading guard: headings + a code-only block (%s) still strips', (_name, code) => {
+    const input = [...HEADINGS, code, ...TAIL].join('\n\n')
+    expect(input.length).toBeGreaterThan(100)
+
+    const calls: Array<{ rule: string; ratio: number }> = []
+    const out = stripExcessBold(input, (d) => calls.push(d))
+
+    // Outcome 1: no bold survives — this is the assertion that fails on the
+    // real bug, where `out` was the input verbatim.
+    expect(out).not.toContain('**')
+    expect(out).toContain('Deploy status')
+    expect(out).toContain('Next steps:')
+    // Outcome 2: the code block itself is preserved byte-for-byte.
+    expect(out).toContain(code)
+    expect(out).toBe(input.replace(/\*\*/g, ''))
+    // Outcome 3: the strip is logged (the #4017 silence is what made this
+    // class of bug invisible in the first place).
+    expect(calls).toHaveLength(1)
+    expect(calls[0].rule).toBe('global')
+    expect(calls[0].ratio).toBeGreaterThan(0.3)
+  })
+
+  test('all-heading guard: real prose body CONTAINING inline code keeps headings', () => {
+    // The counterpart that stops the #4114 fix from over-correcting: a block
+    // with visible text around its code span IS body, so the headings keep
+    // their bold. Only blocks that are *nothing but* code are skipped.
+    const input = [
+      ...HEADINGS,
+      'Run `switchroom agent restart klanker` now, then check the gateway log for errors.',
+      ...TAIL,
+    ].join('\n\n')
+
+    const calls: Array<{ rule: string; ratio: number }> = []
+    const out = stripExcessBold(input, (d) => calls.push(d))
+
+    expect(out).toContain('**Deploy status**')
+    expect(out).toContain('**Next steps:**')
+    expect(calls).toHaveLength(0)
+  })
+
+  test('all-heading guard: a code-only block does not rescue a headings-only digest', () => {
+    // Degenerate shape: the code block is the ONLY non-heading block and sits
+    // last. Same verdict, so the rule does not depend on block position.
+    const input = [...HEADINGS, ...TAIL, '```\nok\n```'].join('\n\n')
+    const out = stripExcessBold(input)
+    expect(out).not.toContain('**')
+    expect(out).toContain('```\nok\n```')
   })
 
   test('multi-line fully-bolded block is NOT mislabelled a heading (global)', () => {

package/telegram-plugin/tests/framework-fallback-drains-parked.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Two-state desync wedge — the silence-fallback must drain `parkedTurnStarts`.
+ *
+ * The gateway carries TWO independent "turn in flight" states. The park gate in
+ * `stream-render.ts` (`case 'enqueue'`) treats the session as busy if EITHER a
+ * live `currentTurn` exists OR `parkedTurnStarts` is non-empty. The 300 s
+ * framework-fallback (`liveness-wiring.ts` onFrameworkFallback) that recovers a
+ * hung turn nulls `currentTurn` and redelivers `pendingInboundBuffer` — but
+ * before the fix it NEVER touched `parkedTurnStarts`. That store's only real
+ * drains are the CLI's own `dequeue` / `remove` stream events, so when the
+ * claude REPL hangs mid-turn those never arrive, a leftover parked envelope
+ * latches the busy gate permanently, and every later inbound parks unseen until
+ * a manual container restart (gymbro parked msgs 4502→4504 behind a dead lock
+ * until SIGTERM). #3927 introduced the parked store but never wired it into
+ * fallback recovery.
+ *
+ * This drives the REAL `handleSessionEvent` (the extracted-module golden
+ * harness, same standard as `turn-mint-defers-until-dequeue.test.ts`) and the
+ * REAL `onFrameworkFallback` (via `buildSilencePokeOptions`, same standard as
+ * `silence-poke-teardown-notice.test.ts`), sharing ONE world: the fallback's
+ * `drainParkedTurnStarts` dep routes to the real store + `beginTurn` over the
+ * harness deps. It asserts the OUTCOME, not a code path: after the fallback the
+ * parked store is emptied AND the parked message was handed back into turn
+ * processing (its turn begun, its card opened) rather than silently dropped.
+ */
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  handleSessionEvent,
+  drainParkedTurnStartsForChat,
+  __resetParkedTurnStartsForTest,
+  __parkedTurnStartCountForTest,
+} from '../gateway/stream-render.js'
+import { buildSilencePokeOptions } from '../gateway/liveness-wiring.js'
+import { makeLivenessFixture, makeTurn, statusKeyForTests } from './helpers/liveness-wiring-fixture.js'
+import { CHAT, enqueue, makeHarness } from './turn-mint-harness.js'
+
+beforeEach(() => {
+  __resetParkedTurnStartsForTest()
+})
+
+describe('silence-fallback drains parkedTurnStarts so a hung REPL cannot wedge the park gate', () => {
+  it('empties the parked store AND redelivers the parked message into turn processing', async () => {
+    const h = makeHarness()
+
+    // ── turn A mints on the idle enqueue and its ms-later dequeue ─────────────
+    handleSessionEvent(h.deps, enqueue('501'))
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    const turnA = h.current()!
+    expect(turnA.sourceMessageId).toBe(501)
+
+    // ── the operator sends B mid-turn; the CLI queues it (enqueue) but the
+    //    REPL hangs, so the paired `dequeue` never comes and B stays parked ──
+    handleSessionEvent(h.deps, enqueue('502', 'still there?'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // ── the REAL 300 s framework-fallback fires, wired to the REAL parked
+    //    drain over the harness deps so both states share one world ──────────
+    const KEY = statusKeyForTests(CHAT, null)
+    const fx = makeLivenessFixture({
+      drainParkedTurnStarts: (chatId: string, threadId: number | null) =>
+        drainParkedTurnStartsForChat(
+          h.deps,
+          chatId,
+          threadId != null ? String(threadId) : null,
+        ).length,
+    })
+    // The wedged turn the fallback tears down — same chat/thread as parked B.
+    fx.activeTurnStartedAt.set(KEY, 0)
+    fx.setCurrentTurn(makeTurn({ sessionChatId: CHAT, sessionThreadId: undefined, turnId: `${KEY}#42` }))
+
+    const opts = buildSilencePokeOptions(fx.deps)
+    await opts.onFrameworkFallback({
+      key: KEY,
+      chatId: CHAT,
+      threadId: null,
+      fallbackKind: 'working',
+      silenceMs: 302_000,
+      inFlightTools: [],
+    })
+
+    // The fallback nulled the wedged turn (its one load-bearing job).
+    expect(fx.endedKeys).toContain(KEY)
+
+    // OUTCOME 1 — the parked store is emptied, so the busy park gate unlatches
+    // and the NEXT inbound can mint its own turn instead of parking unseen.
+    expect(__parkedTurnStartCountForTest()).toBe(0)
+
+    // OUTCOME 2 — B was actually dispatched back into turn processing, not
+    // dropped: its turn was begun (it is now the live turn) and its progress
+    // card was opened. Pre-fix, B stayed parked and this never happened.
+    expect(h.current()!.sourceMessageId).toBe(502)
+    expect(h.cardsOpened.some((c) => c.sourceMessageId === 502)).toBe(true)
+  })
+
+  it('is scoped to the wedged chat — a fallback for chat A leaves chat B parked', () => {
+    const h = makeHarness()
+
+    // A live turn on CHAT, plus a parked entry on CHAT.
+    handleSessionEvent(h.deps, enqueue('601'))
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    handleSessionEvent(h.deps, enqueue('602'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // A fallback for a DIFFERENT chat must not touch CHAT's parked entry.
+    const drainedOther = drainParkedTurnStartsForChat(h.deps, '9999', null)
+    expect(drainedOther).toHaveLength(0)
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // The correctly-scoped drain releases it.
+    const drainedHere = drainParkedTurnStartsForChat(h.deps, CHAT, null)
+    expect(drainedHere).toHaveLength(1)
+    expect(drainedHere[0]!.messageId).toBe('602')
+    expect(__parkedTurnStartCountForTest()).toBe(0)
+  })
+
+  it('is idempotent w.r.t. a late CLI dequeue — no double-start', () => {
+    const h = makeHarness()
+    handleSessionEvent(h.deps, enqueue('701'))
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    handleSessionEvent(h.deps, enqueue('702'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // Fallback drains + begins 702.
+    expect(drainParkedTurnStartsForChat(h.deps, CHAT, null)).toHaveLength(1)
+    expect(h.current()!.sourceMessageId).toBe(702)
+    const cardsAfterDrain = h.cardsOpened.length
+
+    // The REPL finally un-hangs and emits its late `dequeue`. The store is empty
+    // so `takeParkedTurnStart` returns null and no second turn/card is minted.
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    expect(h.cardsOpened).toHaveLength(cardsAfterDrain)
+    expect(h.current()!.sourceMessageId).toBe(702)
+  })
+})