fix(helper): project fixture probe events to runtime logs

cai

2026-08-12 ea40c46b8b0dc548b5240df69dcf986254360038

 src/main.rs

@@ -6,6 +6,7 @@
    borrow::Cow,
    collections::HashSet,
    env, fs,
    future::Future,
    path::{Path, PathBuf},
    sync::{
        Arc,
@@ -59,6 +60,338 @@
const STREAM_TIMING_FIRST_CHUNK: u64 = 1;
const STREAM_TIMING_MAX_ELAPSED_MS: u64 = 5_000;
const STREAM_TIMING_SOURCE: &str = "stream_anchor_monotonic";
const CONTROLLED_FIXTURE_PROBE_TOPIC: &str = "controlled_fixture_attribute_probe";
const CONTROLLED_FIXTURE_ACK_TOPIC: &str = "controlled_fixture_attribute_ack";
const CONTROLLED_FIXTURE_PROTOCOL_VERSION: u64 = 1;
const CONTROLLED_FIXTURE_GENERATION: u64 = 1;
const CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY: Duration = Duration::from_millis(25);
const CONTROLLED_FIXTURE_PROBE_TTL: Duration = Duration::from_millis(250);

const CONTROLLED_FIXTURE_ACK_RESULTS: [&str; 4] =
    ["observed", "rejected", "timeout", "publish_failed"];
const CONTROLLED_FIXTURE_REJECT_REASONS: [&str; 10] = [
    "missing_attributes",
    "wrong_source",
    "missing_sequence",
    "wrong_sequence",
    "wrong_participant",
    "expired",
    "duplicate_or_old_sequence",
    "no_current_participant",
    "ack_publish_failed",
    "unknown",
];

#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
struct ControlledFixtureAttributeProbe {
    #[serde(rename = "type")]
    message_type: String,
    protocol_version: u64,
    call_id_hash: String,
    call_trace_id_hash: String,
    generation: u64,
    client_fixture_sequence: String,
}

#[derive(Debug, Serialize)]
#[serde(rename_all = "camelCase")]
struct ControlledFixtureAttributeAck {
    #[serde(rename = "type")]
    message_type: &'static str,
    protocol_version: u64,
    call_id_hash: String,
    call_trace_id_hash: String,
    generation: u64,
    client_fixture_sequence: String,
    result: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    input_source_category: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    reject_reason: Option<&'static str>,
}

#[derive(Clone, Debug)]
struct PendingControlledFixtureProbe {
    sender: ParticipantIdentity,
    call_id_hash: String,
    call_trace_id_hash: String,
    generation: u64,
    sequence: String,
    expires_at: Instant,
}

fn sha256_hex(value: &str) -> String {
    let mut digest = Sha256::new();
    digest.update(value.as_bytes());
    digest
        .finalize()
        .iter()
        .map(|byte| format!("{byte:02x}"))
        .collect()
}

fn controlled_fixture_ack_classification(
    decision: Result<(), &'static str>,
) -> (&'static str, Option<&'static str>, bool) {
    match decision {
        Ok(()) => ("observed", None, true),
        Err("timeout") => ("timeout", Some("expired"), false),
        Err(reason) if CONTROLLED_FIXTURE_REJECT_REASONS.contains(&reason) => {
            ("rejected", Some(reason), false)
        }
        Err(_) => ("rejected", Some("unknown"), false),
    }
}

fn record_controlled_fixture_probe_event(
    stage: &'static str,
    call_id_hash: &str,
    trace_id_hash: &str,
    generation: u64,
    sequence: &str,
    observed: bool,
    ack_result: Option<&'static str>,
    reject_reason: Option<&'static str>,
) {
    debug_assert!(ack_result.is_none_or(|value| CONTROLLED_FIXTURE_ACK_RESULTS.contains(&value)));
    debug_assert!(
        reject_reason.is_none_or(|value| CONTROLLED_FIXTURE_REJECT_REASONS.contains(&value))
    );
    println!(
        "{}",
        controlled_fixture_probe_event(
            stage,
            call_id_hash,
            trace_id_hash,
            generation,
            sequence,
            observed,
            ack_result,
            reject_reason,
        )
    );
}

fn controlled_fixture_probe_event(
    stage: &'static str,
    call_id_hash: &str,
    trace_id_hash: &str,
    generation: u64,
    sequence: &str,
    observed: bool,
    ack_result: Option<&'static str>,
    reject_reason: Option<&'static str>,
) -> serde_json::Value {
    json!({
        "event": "controlled_fixture_attribute_probe",
        "stage": stage,
        "observed": observed,
        "ack_result": ack_result,
        "reject_reason": reject_reason,
        "call_id_hash": call_id_hash,
        "trace_id_hash": trace_id_hash,
        "generation": generation,
        "sequence_hash": sha256_hex(sequence),
    })
}

fn record_controlled_fixture_attribute_decision(
    decision: Result<(), &'static str>,
    call_id_hash: &str,
    trace_id_hash: &str,
    generation: u64,
    sequence: &str,
) -> (&'static str, Option<&'static str>, bool) {
    let classification = controlled_fixture_ack_classification(decision);
    record_controlled_fixture_probe_event(
        "attributes_classified",
        call_id_hash,
        trace_id_hash,
        generation,
        sequence,
        classification.2,
        Some(classification.0),
        classification.1,
    );
    classification
}

async fn complete_controlled_fixture_ack_publish<F, E>(
    publish: F,
    observed: bool,
    ack_result: &'static str,
    reject_reason: Option<&'static str>,
    call_id_hash: &str,
    trace_id_hash: &str,
    generation: u64,
    sequence: &str,
    acknowledged_probe_sequences: &mut HashSet<String>,
) -> bool
where
    F: Future<Output = Result<(), E>>,
{
    if publish.await.is_ok() {
        record_controlled_fixture_probe_event(
            "ack_publish_completed",
            call_id_hash,
            trace_id_hash,
            generation,
            sequence,
            observed,
            Some(ack_result),
            reject_reason,
        );
        acknowledged_probe_sequences.insert(sequence.to_string());
        observed
    } else {
        record_controlled_fixture_probe_event(
            "ack_publish_completed",
            call_id_hash,
            trace_id_hash,
            generation,
            sequence,
            false,
            Some("publish_failed"),
            Some("ack_publish_failed"),
        );
        false
    }
}

fn controlled_fixture_ack_from_probe(
    probe: &PendingControlledFixtureProbe,
    observed: bool,
    reject_reason: Option<&'static str>,
) -> ControlledFixtureAttributeAck {
    ControlledFixtureAttributeAck {
        message_type: CONTROLLED_FIXTURE_ACK_TOPIC,
        protocol_version: CONTROLLED_FIXTURE_PROTOCOL_VERSION,
        call_id_hash: probe.call_id_hash.clone(),
        call_trace_id_hash: probe.call_trace_id_hash.clone(),
        generation: probe.generation,
        client_fixture_sequence: probe.sequence.clone(),
        result: if observed { "observed" } else { "rejected" },
        input_source_category: observed.then_some("controlled_fixture"),
        reject_reason,
    }
}

fn controlled_fixture_probe(
    payload: &[u8],
    call_id: &str,
    trace_id: &str,
    sender: &ParticipantIdentity,
    expected_participant: Option<&str>,
) -> Option<PendingControlledFixtureProbe> {
    if !is_bound_user_participant(sender.as_str(), expected_participant) {
        return None;
    }
    let probe: ControlledFixtureAttributeProbe = serde_json::from_slice(payload).ok()?;
    if probe.message_type != CONTROLLED_FIXTURE_PROBE_TOPIC
        || probe.protocol_version != CONTROLLED_FIXTURE_PROTOCOL_VERSION
        || probe.generation != CONTROLLED_FIXTURE_GENERATION
        || probe.call_id_hash != sha256_hex(call_id)
        || probe.call_trace_id_hash != sha256_hex(trace_id)
        || probe.client_fixture_sequence.trim().is_empty()
    {
        return None;
    }
    Some(PendingControlledFixtureProbe {
        sender: sender.clone(),
        call_id_hash: probe.call_id_hash,
        call_trace_id_hash: probe.call_trace_id_hash,
        generation: probe.generation,
        sequence: probe.client_fixture_sequence,
        expires_at: Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
    })
}

fn classify_controlled_fixture_attributes(
    actual_participant: &str,
    expected_participant: Option<&str>,
    attributes: &std::collections::HashMap<String, String>,
    requested_sequence: &str,
) -> Result<(), &'static str> {
    if !is_bound_user_participant(actual_participant, expected_participant) {
        return Err("wrong_participant");
    }
    let source = attributes
        .get("inputSourceCategory")
        .map(String::as_str)
        .unwrap_or("");
    if source != "controlled_fixture" {
        return Err(if source.is_empty() {
            "missing_attributes"
        } else {
            "wrong_source"
        });
    }
    let sequence = attributes
        .get("clientFixtureSequence")
        .map(String::as_str)
        .unwrap_or("");
    if sequence.trim().is_empty() {
        return Err("missing_sequence");
    }
    if sequence != requested_sequence {
        return Err("wrong_sequence");
    }
    Ok(())
}

async fn observe_controlled_fixture_attributes<F>(
    expires_at: Instant,
    actual_participant: &str,
    expected_participant: Option<&str>,
    requested_sequence: &str,
    mut read_attributes: F,
) -> Result<(), &'static str>
where
    F: FnMut() -> std::collections::HashMap<String, String>,
{
    loop {
        if Instant::now() > expires_at {
            return Err("timeout");
        }
        let decision = classify_controlled_fixture_attributes(
            actual_participant,
            expected_participant,
            &read_attributes(),
            requested_sequence,
        );
        if decision.is_ok() || !matches!(decision, Err("missing_attributes")) {
            return decision;
        }
        let Some(next_check) = Instant::now().checked_add(CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY)
        else {
            return Err("timeout");
        };
        if next_check > expires_at {
            return Err("timeout");
        }
        sleep(CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY).await;
    }
}

fn controlled_fixture_observer_gate(pending_probe: bool, probe_result: Option<bool>) -> bool {
    !pending_probe || probe_result == Some(true)
}

fn start_observer_after_controlled_fixture_probe<F>(
    pending_probe: bool,
    probe_result: Option<bool>,
    spawn: F,
) -> bool
where
    F: FnOnce(),
{
    if !controlled_fixture_observer_gate(pending_probe, probe_result) {
        return false;
    }
    spawn();
    true
}

#[tokio::main(flavor = "multi_thread")]
async fn main() -> Result<()> {
@@ -737,6 +1070,10 @@
    })
}

fn is_bound_user_participant(identity: &str, expected: Option<&str>) -> bool {
    expected.is_none_or(|value| identity == value)
}

async fn observe_user_audio_events(
    mut events: UnboundedReceiver<RoomEvent>,
    call_id: String,
@@ -764,6 +1101,10 @@
        "runtime helper user_track_subscribe_requested"
    );

    let mut current_user_participant: Option<RemoteParticipant> = None;
    let mut pending_probe: Option<PendingControlledFixtureProbe> = None;
    let mut acknowledged_probe_sequences = HashSet::new();

    while let Some(event) = events.recv().await {
        match event {
            RoomEvent::TrackSubscribed {
@@ -771,10 +1112,10 @@
                publication: _,
                participant,
            } => {
                if user_participant_identity
                    .as_deref()
                    .is_some_and(|expected| participant.identity().to_string() != expected)
                {
                if !is_bound_user_participant(
                    &participant.identity().to_string(),
                    user_participant_identity.as_deref(),
                ) {
                    warn!(call_id = %call_id, trace_id = %trace_id,
                        metadata_status = "wrong_participant",
                        "runtime helper ignored non-user audio participant");
@@ -793,20 +1134,118 @@
                    track_source = %track_source,
                    "runtime helper user_track_subscribed"
                );
                spawn_user_audio_frame_observer(
                    track,
                    call_id.clone(),
                    trace_id.clone(),
                    participant_alias,
                    track_sid_alias,
                    simple_vad_enabled,
                    simple_vad_config.clone(),
                    vad_enabled_gate.clone(),
                    turn_bridge_config.clone(),
                    http.clone(),
                    sink.clone(),
                    participant,
                let pending_binding = pending_probe.clone();
                let participant_for_probe = participant.clone();
                let probe_result = process_controlled_fixture_probe(
                    &mut pending_probe,
                    &mut acknowledged_probe_sequences,
                    Some(&participant_for_probe),
                    &sink,
                    user_participant_identity.as_deref(),
                )
                .await;
                let observer_started = start_observer_after_controlled_fixture_probe(
                    pending_binding.is_some(),
                    probe_result,
                    || {
                        spawn_user_audio_frame_observer(
                            track,
                            call_id.clone(),
                            trace_id.clone(),
                            participant_alias,
                            track_sid_alias,
                            simple_vad_enabled,
                            simple_vad_config.clone(),
                            vad_enabled_gate.clone(),
                            turn_bridge_config.clone(),
                            http.clone(),
                            sink.clone(),
                            user_participant_identity.clone(),
                            participant,
                        );
                    },
                );
                if let Some(probe) = pending_binding.as_ref() {
                    let (ack_result, reject_reason, observed) = match probe_result {
                        Some(true) => (Some("observed"), None, true),
                        Some(false) => (Some("rejected"), Some("unknown"), false),
                        None => (None, Some("no_current_participant"), false),
                    };
                    record_controlled_fixture_probe_event(
                        if observer_started {
                            "audio_observer_allowed"
                        } else {
                            "audio_observer_blocked"
                        },
                        &probe.call_id_hash,
                        &probe.call_trace_id_hash,
                        probe.generation,
                        &probe.sequence,
                        observed,
                        ack_result,
                        reject_reason,
                    );
                }
                if !observer_started {
                    warn!(
                        call_id = %call_id,
                        trace_id = %trace_id,
                        "runtime helper withheld audio observer until controlled fixture ACK"
                    );
                    continue;
                }
                current_user_participant = Some(participant_for_probe);
            }
            RoomEvent::DataReceived {
                payload,
                topic: Some(topic),
                participant: Some(sender),
                ..
            } if topic == CONTROLLED_FIXTURE_PROBE_TOPIC => {
                if let Ok(probe) =
                    serde_json::from_slice::<ControlledFixtureAttributeProbe>(&payload)
                {
                    if acknowledged_probe_sequences.contains(&probe.client_fixture_sequence) {
                        record_controlled_fixture_probe_event(
                            "data_received",
                            &probe.call_id_hash,
                            &probe.call_trace_id_hash,
                            probe.generation,
                            &probe.client_fixture_sequence,
                            false,
                            Some("rejected"),
                            Some("duplicate_or_old_sequence"),
                        );
                        continue;
                    }
                }
                pending_probe = controlled_fixture_probe(
                    &payload,
                    &call_id,
                    &trace_id,
                    &sender.identity(),
                    user_participant_identity.as_deref(),
                );
                if let Some(probe) = pending_probe.as_ref() {
                    record_controlled_fixture_probe_event(
                        "data_received",
                        &probe.call_id_hash,
                        &probe.call_trace_id_hash,
                        probe.generation,
                        &probe.sequence,
                        false,
                        None,
                        None,
                    );
                }
                process_controlled_fixture_probe(
                    &mut pending_probe,
                    &mut acknowledged_probe_sequences,
                    current_user_participant.as_ref(),
                    &sink,
                    user_participant_identity.as_deref(),
                )
                .await;
            }
            RoomEvent::TrackSubscribed {
                track: RemoteTrack::Video(track),
@@ -847,6 +1286,122 @@
            _ => {}
        }
    }
}

async fn process_controlled_fixture_probe(
    pending_probe: &mut Option<PendingControlledFixtureProbe>,
    acknowledged_probe_sequences: &mut HashSet<String>,
    participant: Option<&RemoteParticipant>,
    sink: &BotAudioOutputSink,
    expected_participant: Option<&str>,
) -> Option<bool> {
    let Some(probe) = pending_probe.take() else {
        return None;
    };
    if acknowledged_probe_sequences.contains(&probe.sequence) {
        record_controlled_fixture_probe_event(
            "attributes_classified",
            &probe.call_id_hash,
            &probe.call_trace_id_hash,
            probe.generation,
            &probe.sequence,
            false,
            Some("rejected"),
            Some("duplicate_or_old_sequence"),
        );
        return Some(false);
    }
    if Instant::now() > probe.expires_at {
        record_controlled_fixture_probe_event(
            "attributes_classified",
            &probe.call_id_hash,
            &probe.call_trace_id_hash,
            probe.generation,
            &probe.sequence,
            false,
            Some("timeout"),
            Some("expired"),
        );
        return Some(false);
    }
    let Some(participant) = participant else {
        record_controlled_fixture_probe_event(
            "attributes_classified",
            &probe.call_id_hash,
            &probe.call_trace_id_hash,
            probe.generation,
            &probe.sequence,
            false,
            None,
            Some("no_current_participant"),
        );
        *pending_probe = Some(probe);
        return None;
    };
    if participant.identity() != probe.sender {
        record_controlled_fixture_probe_event(
            "attributes_classified",
            &probe.call_id_hash,
            &probe.call_trace_id_hash,
            probe.generation,
            &probe.sequence,
            false,
            Some("rejected"),
            Some("wrong_participant"),
        );
        return Some(false);
    }
    let decision = observe_controlled_fixture_attributes(
        probe.expires_at,
        &participant.identity().to_string(),
        expected_participant,
        &probe.sequence,
        || participant.attributes(),
    )
    .await;
    let (ack_result, reject_reason, observed) = record_controlled_fixture_attribute_decision(
        decision,
        &probe.call_id_hash,
        &probe.call_trace_id_hash,
        probe.generation,
        &probe.sequence,
    );
    let ack = controlled_fixture_ack_from_probe(&probe, observed, reject_reason);
    let payload = match serde_json::to_vec(&ack) {
        Ok(payload) => payload,
        Err(_) => return Some(false),
    };
    let local_participant = sink.room.local_participant();
    record_controlled_fixture_probe_event(
        "ack_publish_started",
        &probe.call_id_hash,
        &probe.call_trace_id_hash,
        probe.generation,
        &probe.sequence,
        observed,
        Some(ack_result),
        reject_reason,
    );
    let publish = local_participant.publish_data(DataPacket {
        payload,
        topic: Some(CONTROLLED_FIXTURE_ACK_TOPIC.to_string()),
        reliable: true,
        destination_identities: vec![probe.sender],
    });
    Some(
        complete_controlled_fixture_ack_publish(
            publish,
            observed,
            ack_result,
            reject_reason,
            &probe.call_id_hash,
            &probe.call_trace_id_hash,
            probe.generation,
            &probe.sequence,
            acknowledged_probe_sequences,
        )
        .await,
    )
}

async fn handle_finished_turn(
@@ -2917,6 +3472,7 @@
    turn_bridge_config: TurnBridgeConfig,
    http: Client,
    sink: Arc<BotAudioOutputSink>,
    expected_participant_identity: Option<String>,
    participant: RemoteParticipant,
) -> JoinHandle<()> {
    tokio::spawn(async move {
@@ -2996,6 +3552,7 @@
            None
        };
        let mut realtime_asr_upload: Option<RealtimeAsrUpload> = None;
        let mut last_fixture_sequence: Option<String> = None;

        while let Some(drained) = frame_rx.recv().await {
            let frame = drained.frame;
@@ -3029,8 +3586,11 @@

            if let Some(vad) = simple_vad.as_mut() {
                if vad_enabled_gate.load(Ordering::Acquire) {
                    let was_in_speech = vad.in_speech;
                    let turn = vad.observe_frame(
                    let participant_identity = participant.identity().to_string();
                    let (was_in_speech, is_in_speech, turn) = observe_bound_participant_frame(
                        &participant_identity,
                        expected_participant_identity.as_deref(),
                        vad,
                        &call_id,
                        &trace_id,
                        &participant_alias,
@@ -3038,41 +3598,15 @@
                        frame_count,
                        elapsed_ms,
                        &frame,
                        http.clone(),
                        turn_bridge_config.realtime_asr_config(),
                        || participant.attributes(),
                        &mut realtime_asr_upload,
                        &mut last_fixture_sequence,
                        turn_bridge_config.asr_realtime_enabled,
                    );
                    let is_in_speech = vad.in_speech;

                    if !was_in_speech && is_in_speech {
                        let turn_id = format!("turn-{:04}", vad.turn_index);
                        match RealtimeAsrUpload::start_with_participant_attributes(
                            http.clone(),
                            turn_bridge_config.realtime_asr_config(),
                            &call_id,
                            &trace_id,
                            &turn_id,
                            &vad.speech_samples,
                            || participant.attributes(),
                        ) {
                            Ok(upload) => {
                                info!(
                                    call_id = %call_id,
                                    trace_id = %trace_id,
                                    turn_id = %turn_id,
                                    "runtime helper asr_realtime_session_started"
                                );
                                realtime_asr_upload = Some(upload);
                            }
                            Err(error) if turn_bridge_config.asr_realtime_enabled => {
                                warn!(
                                    call_id = %call_id,
                                    trace_id = %trace_id,
                                    turn_id = %turn_id,
                                    error = %safe_error(&error.to_string()),
                                    "runtime helper asr_realtime_start_failed_fallback"
                                );
                            }
                            Err(_) => {}
                        }
                    } else if was_in_speech {
                    if was_in_speech {
                        let push_failed = realtime_asr_upload
                            .as_mut()
                            .and_then(|upload| upload.push_48k_samples(frame.data.as_ref()).err());
@@ -3189,6 +3723,176 @@
            "runtime helper user_audio_stream_ended"
        );
    })
}

fn observe_frame_and_start_session<F>(
    vad: &mut SimpleVad,
    call_id: &str,
    trace_id: &str,
    participant_alias: &str,
    track_sid_alias: &str,
    frame_count: u64,
    elapsed_ms: u64,
    frame: &AudioFrame<'_>,
    http: Client,
    config: RealtimeAsrConfig,
    read_attributes: F,
    upload_slot: &mut Option<RealtimeAsrUpload>,
    last_fixture_sequence: &mut Option<String>,
    realtime_enabled: bool,
) -> (bool, bool, Option<FinishedSpeechTurn>)
where
    F: FnOnce() -> std::collections::HashMap<String, String>,
{
    let was_in_speech = vad.in_speech;
    let turn = vad.observe_frame(
        call_id,
        trace_id,
        participant_alias,
        track_sid_alias,
        frame_count,
        elapsed_ms,
        frame,
    );
    let is_in_speech = vad.in_speech;
    if !was_in_speech && is_in_speech {
        start_realtime_session_for_new_speech(
            http,
            config,
            call_id,
            trace_id,
            vad,
            read_attributes,
            upload_slot,
            last_fixture_sequence,
            realtime_enabled,
        );
    }
    (was_in_speech, is_in_speech, turn)
}

fn observe_bound_participant_frame<F>(
    participant_identity: &str,
    expected_participant: Option<&str>,
    vad: &mut SimpleVad,
    call_id: &str,
    trace_id: &str,
    participant_alias: &str,
    track_sid_alias: &str,
    frame_count: u64,
    elapsed_ms: u64,
    frame: &AudioFrame<'_>,
    http: Client,
    config: RealtimeAsrConfig,
    read_attributes: F,
    upload_slot: &mut Option<RealtimeAsrUpload>,
    last_fixture_sequence: &mut Option<String>,
    realtime_enabled: bool,
) -> (bool, bool, Option<FinishedSpeechTurn>)
where
    F: FnOnce() -> std::collections::HashMap<String, String>,
{
    if !is_bound_user_participant(participant_identity, expected_participant) {
        warn!(
            "audioIngressOriginStatus" = "wrong_participant_or_track",
            "runtime helper rejected audio participant before VAD/session"
        );
        return (vad.in_speech, vad.in_speech, None);
    }
    observe_frame_and_start_session(
        vad,
        call_id,
        trace_id,
        participant_alias,
        track_sid_alias,
        frame_count,
        elapsed_ms,
        frame,
        http,
        config,
        read_attributes,
        upload_slot,
        last_fixture_sequence,
        realtime_enabled,
    )
}

fn start_realtime_session_for_new_speech(
    http: Client,
    config: RealtimeAsrConfig,
    call_id: &str,
    trace_id: &str,
    vad: &SimpleVad,
    read_attributes: impl FnOnce() -> std::collections::HashMap<String, String>,
    upload_slot: &mut Option<RealtimeAsrUpload>,
    last_fixture_sequence: &mut Option<String>,
    realtime_enabled: bool,
) {
    let turn_id = format!("turn-{:04}", vad.turn_index);
    let attributes = read_attributes();
    let origin_status = AudioIngressMetadata::origin_status(&attributes);
    let metadata = match AudioIngressMetadata::from_participant(&attributes) {
        Ok(metadata) => metadata,
        Err(reason) => {
            warn!(call_id = %call_id, trace_id = %trace_id, turn_id = %turn_id,
                reason, audioIngressOriginStatus = %AudioIngressMetadata::rejected_origin_status(
                    reason, &attributes
                ),
                "runtime helper asr_realtime_metadata_rejected");
            return;
        }
    };
    if let Some(metadata) = metadata.as_ref() {
        if !fixture_sequence_is_new(
            last_fixture_sequence.as_deref(),
            &metadata.client_fixture_sequence,
        ) {
            warn!(call_id = %call_id, trace_id = %trace_id, turn_id = %turn_id,
                audioIngressOriginStatus = "sequence_replayed_or_regressed",
                "runtime helper asr_realtime_metadata_sequence_rejected");
            return;
        }
    }
    match RealtimeAsrUpload::start(
        http,
        config,
        call_id,
        trace_id,
        &turn_id,
        &vad.speech_samples,
        metadata.as_ref(),
    ) {
        Ok(upload) => {
            if let Some(metadata) = metadata {
                *last_fixture_sequence = Some(metadata.client_fixture_sequence);
            }
            info!(call_id = %call_id, trace_id = %trace_id, turn_id = %turn_id,
                origin_status, "runtime helper asr_realtime_session_started");
            *upload_slot = Some(upload);
        }
        Err(error) if realtime_enabled => {
            warn!(call_id = %call_id, trace_id = %trace_id, turn_id = %turn_id,
                error = %safe_error(&error.to_string()),
                "runtime helper asr_realtime_start_failed_fallback");
        }
        Err(_) => {}
    }
}

fn fixture_sequence_is_new(previous: Option<&str>, current: &str) -> bool {
    let Some(previous) = previous else {
        return true;
    };
    let current_number = current
        .rsplit_once('-')
        .and_then(|(_, value)| value.parse::<u64>().ok());
    let previous_number = previous
        .rsplit_once('-')
        .and_then(|(_, value)| value.parse::<u64>().ok());
    match (previous_number, current_number) {
        (Some(previous), Some(current)) => current > previous,
        _ => previous != current,
    }
}

struct DrainedUserAudioFrame {
@@ -3943,12 +4647,464 @@

#[cfg(test)]
mod tests {
    use super::{
        ReplyChunkMarker, ReplyChunkMarkerState, RuntimeTurnDeviceOutput, RuntimeTurnStreamEvent,
        RuntimeTurnStreamState, RuntimeTurnStreamTimingPhase, runtime_session_nonce_hash,
        should_publish_device_output,
    use super::*;
    use std::{
        collections::{HashMap, HashSet},
        io::{Read, Write},
        net::TcpListener,
        sync::{
            Arc,
            atomic::{AtomicUsize, Ordering},
            mpsc,
        },
        thread,
        time::Duration,
    };
    use std::collections::HashSet;

    #[derive(Debug)]
    enum PreAudioOrderEvent {
        DataReceived {
            sender: String,
            sequence: String,
        },
        TrackSubscribed {
            participant: String,
            attributes: HashMap<String, String>,
        },
    }

    fn drive_pre_audio_order_test_seam(events: &[PreAudioOrderEvent]) -> Vec<&'static str> {
        let mut pending_sequence = None;
        let mut effects = Vec::new();
        for event in events {
            match event {
                PreAudioOrderEvent::DataReceived { sender, sequence } if sender == "user-1" => {
                    pending_sequence = Some(sequence.as_str());
                }
                PreAudioOrderEvent::TrackSubscribed {
                    participant,
                    attributes,
                } => {
                    let pending = pending_sequence.is_some();
                    let probe_result = pending_sequence.map(|sequence| {
                        classify_controlled_fixture_attributes(
                            participant,
                            Some("user-1"),
                            attributes,
                            sequence,
                        )
                        .is_ok()
                    });
                    let mut ack_observed = false;
                    let mut observer_started = false;
                    start_observer_after_controlled_fixture_probe(pending, probe_result, || {
                        if pending && probe_result == Some(true) {
                            ack_observed = true;
                        }
                        observer_started = true;
                    });
                    if ack_observed {
                        effects.push("ack_observed");
                    }
                    if observer_started {
                        effects.push("observer_started");
                    }
                    pending_sequence = None;
                }
                PreAudioOrderEvent::DataReceived { .. } => {}
            }
        }
        effects
    }

    #[test]
    fn production_vad_session_boundary_reads_updated_attributes() {
        let config = SimpleVadConfig {
            rms_threshold: 0.001,
            peak_threshold: 0.01,
            start_frames: 2,
            end_silence_ms: 100,
            min_speech_ms: 1,
            max_turn_ms: 1_000,
            initial_ignore_ms: 0,
        };
        let mut vad = SimpleVad::new(config);
        let samples = vec![1_000i16; 160];
        let frame = AudioFrame {
            data: samples.as_slice().into(),
            sample_rate: 16_000,
            num_channels: 1,
            samples_per_channel: 160,
        };
        let mut attributes = std::collections::HashMap::from([
            (
                "inputSourceCategory".to_string(),
                "controlled_fixture".to_string(),
            ),
            (
                "clientFixtureSequence".to_string(),
                "fixture-01".to_string(),
            ),
        ]);
        let mut starts = Vec::new();
        for (session_index, sequence) in [(1, "fixture-01"), (2, "fixture-02")] {
            let was_in_speech = vad.in_speech;
            vad.observe_frame(
                "call-001",
                "trace-001",
                "participant",
                "track",
                session_index * 2 - 1,
                1_000 * session_index,
                &frame,
            );
            vad.observe_frame(
                "call-001",
                "trace-001",
                "participant",
                "track",
                session_index * 2,
                1_000 * session_index + 10,
                &frame,
            );
            let is_in_speech = vad.in_speech;
            assert!(!was_in_speech && is_in_speech);
            attributes.insert("clientFixtureSequence".to_string(), sequence.to_string());
            let metadata = AudioIngressMetadata::from_participant(&attributes)
                .expect("valid participant attributes")
                .expect("controlled fixture metadata");
            let session_line = asr_realtime::session_start_line(
                "call-001",
                "trace-001",
                &format!("turn-{session_index:04}"),
                "nonce-001",
                Some(&metadata),
            )
            .expect("session start line");
            let session_json: serde_json::Value =
                serde_json::from_slice(&session_line).expect("session start json");
            assert_eq!(sequence, session_json["clientFixtureSequence"]);
            starts.push(metadata.client_fixture_sequence);
            vad.reset_current_turn();
        }
        assert_eq!(vec!["fixture-01", "fixture-02"], starts);
        attributes.insert("inputSourceCategory".to_string(), "other".to_string());
        assert!(AudioIngressMetadata::from_participant(&attributes).is_err());
        assert!(
            AudioIngressMetadata::from_participant(&std::collections::HashMap::new())
                .expect("missing attributes is absent")
                .is_none()
        );
        attributes.insert(
            "clientFixtureSequence".to_string(),
            "fixture-01".to_string(),
        );
        assert!(AudioIngressMetadata::from_participant(&attributes).is_err());
    }

    #[test]
    fn production_observer_rejects_wrong_participant_before_vad_session() {
        assert!(!is_bound_user_participant(
            "participant-other",
            Some("participant-user")
        ));
        assert!(is_bound_user_participant(
            "participant-user",
            Some("participant-user")
        ));
        assert!(is_bound_user_participant("participant-any", None));
    }

    #[tokio::test]
    async fn production_observer_vad_to_session_entry_reads_each_updated_attribute() {
        let listener = TcpListener::bind("127.0.0.1:0").expect("bind local ASR fixture");
        let address = listener.local_addr().expect("fixture address");
        let (request_tx, request_rx) = mpsc::channel::<String>();
        let captured_count = Arc::new(AtomicUsize::new(0));
        let captured_count_for_server = Arc::clone(&captured_count);
        let server = thread::spawn(move || {
            for _ in 0..2 {
                let (mut stream, _) = listener.accept().expect("accept ASR session");
                stream
                    .set_read_timeout(Some(Duration::from_secs(2)))
                    .expect("set fixture timeout");
                let mut bytes = Vec::new();
                let mut buffer = [0_u8; 4096];
                loop {
                    match stream.read(&mut buffer) {
                        Ok(0) => break,
                        Ok(size) => {
                            bytes.extend_from_slice(&buffer[..size]);
                            if bytes.windows(7).any(|window| window == b"0\r\n\r\n") {
                                break;
                            }
                        }
                        Err(_) => break,
                    }
                }
                request_tx
                    .send(String::from_utf8_lossy(&bytes).into_owned())
                    .expect("capture ASR request");
                captured_count_for_server.fetch_add(1, Ordering::SeqCst);
                stream
                    .write_all(b"HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: 39\r\nconnection: close\r\n\r\n{\"code\":0,\"data\":{\"status\":\"ok\"}}")
                    .expect("write fixture response");
            }
        });
        let mut vad = SimpleVad::new(SimpleVadConfig {
            rms_threshold: 0.001,
            peak_threshold: 0.01,
            start_frames: 1,
            end_silence_ms: 100,
            min_speech_ms: 1,
            max_turn_ms: 1_000,
            initial_ignore_ms: 0,
        });
        let frame_data = vec![1_000i16; 160];
        let frame = AudioFrame {
            data: frame_data.as_slice().into(),
            sample_rate: 16_000,
            num_channels: 1,
            samples_per_channel: 160,
        };
        let mut attrs = std::collections::HashMap::from([
            (
                "inputSourceCategory".to_string(),
                "controlled_fixture".to_string(),
            ),
            (
                "clientFixtureSequence".to_string(),
                "fixture-01".to_string(),
            ),
        ]);
        let mut upload = None;
        let mut last_fixture_sequence = None;
        let config = RealtimeAsrConfig {
            enabled: true,
            url: Some(format!("http://{address}/runtime/asr/realtime")),
            runtime_token: Some("test".to_string()),
            runtime_session_nonce: Some("test".to_string()),
            chunk_duration_ms: 200,
        };
        let (was, is, turn) = observe_bound_participant_frame(
            "participant-user",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-user",
            "track-001",
            1,
            1_000,
            &frame,
            Client::new(),
            config.clone(),
            || attrs.clone(),
            &mut upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(!was && is && turn.is_none());
        assert!(upload.is_some());
        upload.take().unwrap().cancel("test").await;
        vad.reset_current_turn();
        attrs.insert(
            "clientFixtureSequence".to_string(),
            "fixture-02".to_string(),
        );
        let (was, is, turn) = observe_bound_participant_frame(
            "participant-user",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-user",
            "track-001",
            2,
            2_000,
            &frame,
            Client::new(),
            config,
            || attrs.clone(),
            &mut upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(!was && is && turn.is_none());
        assert!(upload.is_some());
        upload.take().unwrap().cancel("test").await;

        let first_request = request_rx
            .recv_timeout(Duration::from_secs(2))
            .expect("first session request");
        let second_request = request_rx
            .recv_timeout(Duration::from_secs(2))
            .expect("second session request");
        assert!(first_request.contains("\"clientFixtureSequence\":\"fixture-01\""));
        assert!(second_request.contains("\"clientFixtureSequence\":\"fixture-02\""));
        assert!(
            first_request.contains("\"audioIngressOriginStatus\":\"controlled_fixture_bound\"")
        );
        assert!(
            second_request.contains("\"audioIngressOriginStatus\":\"controlled_fixture_bound\"")
        );
        // The same production boundary rejects a wrong participant before VAD/session creation.
        assert!(!is_bound_user_participant(
            "participant-other",
            Some("participant-user")
        ));
        assert_eq!(0, request_rx.try_iter().count());
        vad.reset_current_turn();
        attrs.insert(
            "clientFixtureSequence".to_string(),
            "fixture-03".to_string(),
        );
        let (_, is_wrong, wrong_turn) = observe_bound_participant_frame(
            "participant-other",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-user",
            "track-001",
            3,
            3_000,
            &frame,
            Client::new(),
            RealtimeAsrConfig {
                enabled: true,
                url: Some(format!("http://{address}/runtime/asr/realtime")),
                runtime_token: Some("test".to_string()),
                runtime_session_nonce: Some("test".to_string()),
                chunk_duration_ms: 200,
            },
            || attrs.clone(),
            &mut upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(!is_wrong && wrong_turn.is_none() && upload.is_none());
        vad.reset_current_turn();
        attrs.insert(
            "clientFixtureSequence".to_string(),
            "fixture-01".to_string(),
        );
        let (_, _, _) = observe_bound_participant_frame(
            "participant-user",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-user",
            "track-001",
            4,
            4_000,
            &frame,
            Client::new(),
            RealtimeAsrConfig {
                enabled: true,
                url: Some(format!("http://{address}/runtime/asr/realtime")),
                runtime_token: Some("test".to_string()),
                runtime_session_nonce: Some("test".to_string()),
                chunk_duration_ms: 200,
            },
            || attrs.clone(),
            &mut upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(upload.is_none());
        vad.reset_current_turn();
        let (_, _, _) = observe_bound_participant_frame(
            "participant-user",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-user",
            "track-001",
            5,
            5_000,
            &frame,
            Client::new(),
            RealtimeAsrConfig {
                enabled: true,
                url: Some(format!("http://{address}/runtime/asr/realtime")),
                runtime_token: Some("test".to_string()),
                runtime_session_nonce: Some("test".to_string()),
                chunk_duration_ms: 200,
            },
            || attrs.clone(),
            &mut upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(upload.is_none());
        vad.reset_current_turn();
        attrs.remove("clientFixtureSequence");
        let (_, _, missing_sequence_turn) = observe_bound_participant_frame(
            "participant-user",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-user",
            "track-001",
            6,
            6_000,
            &frame,
            Client::new(),
            RealtimeAsrConfig {
                enabled: true,
                url: Some(format!("http://{address}/runtime/asr/realtime")),
                runtime_token: Some("test".to_string()),
                runtime_session_nonce: Some("test".to_string()),
                chunk_duration_ms: 200,
            },
            || attrs.clone(),
            &mut upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(missing_sequence_turn.is_none() && upload.is_none());
        assert_eq!(
            "sequence_absent",
            AudioIngressMetadata::rejected_origin_status("incomplete_metadata", &attrs)
        );
        assert_eq!(2, captured_count.load(Ordering::SeqCst));
        vad.reset_current_turn();
        attrs.insert("inputSourceCategory".to_string(), "other".to_string());
        let mut invalid_upload = None;
        let (_, _, invalid_turn) = observe_bound_participant_frame(
            "participant-user",
            Some("participant-user"),
            &mut vad,
            "call-001",
            "trace-001",
            "participant-other",
            "track-001",
            3,
            3_000,
            &frame,
            Client::new(),
            RealtimeAsrConfig {
                enabled: true,
                url: Some("http://127.0.0.1:9".to_string()),
                runtime_token: Some("test".to_string()),
                runtime_session_nonce: Some("test".to_string()),
                chunk_duration_ms: 200,
            },
            || attrs,
            &mut invalid_upload,
            &mut last_fixture_sequence,
            true,
        );
        assert!(invalid_turn.is_none());
        assert!(invalid_upload.is_none());
        assert_eq!(2, captured_count.load(Ordering::SeqCst));
        assert_eq!(0, request_rx.try_iter().count());
        server.join().expect("fixture server");
    }

    #[test]
    fn reply_chunk_marker_state_emits_turn_first_once_and_later_segment_first_once() {
@@ -4078,4 +5234,474 @@
            assert!(published.is_empty());
        }
    }

    #[test]
    fn controlled_fixture_probe_requires_bound_hashes_and_protocol() {
        let call_id = "call-ack-1";
        let trace_id = "trace-ack-1";
        let payload = serde_json::to_vec(&json!({
            "type": CONTROLLED_FIXTURE_PROBE_TOPIC,
            "protocolVersion": CONTROLLED_FIXTURE_PROTOCOL_VERSION,
            "callIdHash": sha256_hex(call_id),
            "callTraceIdHash": sha256_hex(trace_id),
            "generation": CONTROLLED_FIXTURE_GENERATION,
            "clientFixtureSequence": "fixture-01"
        }))
        .unwrap();
        let sender = ParticipantIdentity("user-1".to_string());
        let pending =
            controlled_fixture_probe(&payload, call_id, trace_id, &sender, Some("user-1"))
                .expect("valid probe");
        assert_eq!(pending.sequence, "fixture-01");
        assert_eq!(pending.call_id_hash, sha256_hex(call_id));
        assert_eq!(pending.call_trace_id_hash, sha256_hex(trace_id));
        assert_eq!(pending.generation, CONTROLLED_FIXTURE_GENERATION);
        assert!(
            controlled_fixture_probe(&payload, call_id, "other-trace", &sender, Some("user-1"),)
                .is_none()
        );
        assert!(
            controlled_fixture_probe(
                &payload,
                call_id,
                trace_id,
                &ParticipantIdentity("other-user".to_string()),
                Some("user-1"),
            )
            .is_none()
        );
    }

    #[test]
    fn controlled_fixture_attributes_ack_only_on_exact_current_sequence() {
        let mut attributes = std::collections::HashMap::from([
            (
                "inputSourceCategory".to_string(),
                "controlled_fixture".to_string(),
            ),
            (
                "clientFixtureSequence".to_string(),
                "fixture-01".to_string(),
            ),
        ]);
        assert!(
            classify_controlled_fixture_attributes(
                "user-1",
                Some("user-1"),
                &attributes,
                "fixture-01"
            )
            .is_ok()
        );
        attributes.insert(
            "clientFixtureSequence".to_string(),
            "fixture-02".to_string(),
        );
        assert_eq!(
            classify_controlled_fixture_attributes(
                "user-1",
                Some("user-1"),
                &attributes,
                "fixture-01"
            ),
            Err("wrong_sequence")
        );
        attributes.remove("clientFixtureSequence");
        assert_eq!(
            classify_controlled_fixture_attributes(
                "user-1",
                Some("user-1"),
                &attributes,
                "fixture-01"
            ),
            Err("missing_sequence")
        );
        assert_eq!(
            classify_controlled_fixture_attributes(
                "other-user",
                Some("user-1"),
                &attributes,
                "fixture-01"
            ),
            Err("wrong_participant")
        );
    }

    #[test]
    fn controlled_fixture_probe_runtime_projection_binds_request_hashes_and_audio_gate() {
        let call_id = "private-call-value";
        let trace_id = "private-trace-value";
        let sequence = "private-sequence-value";
        let call_id_hash = sha256_hex(call_id);
        let trace_id_hash = sha256_hex(trace_id);
        let mut observer_starts = 0;
        let (ack_result, reject_reason, observed) =
            controlled_fixture_ack_classification(Err("wrong_source"));
        let stages = [
            ("data_received", None, None),
            ("attributes_classified", Some(ack_result), reject_reason),
            ("ack_publish_started", Some(ack_result), reject_reason),
            ("ack_publish_completed", Some(ack_result), reject_reason),
            ("audio_observer_blocked", Some(ack_result), reject_reason),
        ];
        for (stage, result, reason) in stages {
            let event = controlled_fixture_probe_event(
                stage,
                &call_id_hash,
                &trace_id_hash,
                CONTROLLED_FIXTURE_GENERATION,
                sequence,
                observed,
                result,
                reason,
            );
            assert_eq!(event["call_id_hash"], call_id_hash);
            assert_eq!(event["trace_id_hash"], trace_id_hash);
            assert_eq!(event["stage"], stage);
            let output = event.to_string();
            assert!(!output.contains(call_id));
            assert!(!output.contains(trace_id));
            assert!(!output.contains(sequence));
        }
        assert!(!start_observer_after_controlled_fixture_probe(
            true,
            Some(observed),
            || observer_starts += 1,
        ));
        assert_eq!(observer_starts, 0);

        let (ack_result, reject_reason, observed) = controlled_fixture_ack_classification(Ok(()));
        let allowed = controlled_fixture_probe_event(
            "audio_observer_allowed",
            &call_id_hash,
            &trace_id_hash,
            CONTROLLED_FIXTURE_GENERATION,
            sequence,
            observed,
            Some(ack_result),
            reject_reason,
        );
        assert_eq!(allowed["trace_id_hash"], trace_id_hash);
        assert!(start_observer_after_controlled_fixture_probe(
            true,
            Some(observed),
            || observer_starts += 1,
        ));
        assert_eq!(observer_starts, 1);
    }

    #[test]
    fn controlled_fixture_probe_observed_and_failure_enums_are_stable() {
        assert_eq!(
            controlled_fixture_ack_classification(Ok(())),
            ("observed", None, true)
        );
        assert_eq!(
            controlled_fixture_ack_classification(Err("timeout")),
            ("timeout", Some("expired"), false)
        );
        for reason in [
            "missing_attributes",
            "wrong_source",
            "missing_sequence",
            "wrong_sequence",
            "wrong_participant",
        ] {
            assert_eq!(
                controlled_fixture_ack_classification(Err(reason)),
                ("rejected", Some(reason), false)
            );
        }
        assert_eq!(
            controlled_fixture_ack_classification(Err("unclassified")),
            ("rejected", Some("unknown"), false)
        );
    }

    #[test]
    fn production_probe_binding_drives_rejected_and_observed_ack_without_local_rehash() {
        let request_call_hash = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
        let request_trace_hash = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
        let probe = PendingControlledFixtureProbe {
            sender: ParticipantIdentity("user-1".to_string()),
            call_id_hash: request_call_hash.to_string(),
            call_trace_id_hash: request_trace_hash.to_string(),
            generation: CONTROLLED_FIXTURE_GENERATION,
            sequence: "fixture-01".to_string(),
            expires_at: Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
        };

        let (ack_result, reject_reason, observed) =
            controlled_fixture_ack_classification(Err("wrong_sequence"));
        let rejected_ack = controlled_fixture_ack_from_probe(&probe, observed, reject_reason);
        let rejected_json = serde_json::to_value(&rejected_ack).unwrap();
        let mut rejected_observer_starts = 0;
        assert_eq!(ack_result, "rejected");
        assert_eq!(rejected_json["callIdHash"], request_call_hash);
        assert_eq!(rejected_json["callTraceIdHash"], request_trace_hash);
        assert_eq!(rejected_json["rejectReason"], "wrong_sequence");
        assert!(!start_observer_after_controlled_fixture_probe(
            true,
            Some(observed),
            || rejected_observer_starts += 1,
        ));
        assert_eq!(rejected_observer_starts, 0);

        let (ack_result, reject_reason, observed) = controlled_fixture_ack_classification(Ok(()));
        let observed_ack = controlled_fixture_ack_from_probe(&probe, observed, reject_reason);
        let observed_json = serde_json::to_value(&observed_ack).unwrap();
        let mut observed_observer_starts = 0;
        assert_eq!(ack_result, "observed");
        assert_eq!(observed_json["callIdHash"], request_call_hash);
        assert_eq!(observed_json["callTraceIdHash"], request_trace_hash);
        assert!(observed_json.get("rejectReason").is_none());
        assert!(start_observer_after_controlled_fixture_probe(
            true,
            Some(observed),
            || observed_observer_starts += 1,
        ));
        assert_eq!(observed_observer_starts, 1);
    }

    #[tokio::test]
    async fn production_ack_publish_failure_keeps_observer_session_and_audio_closed() {
        let mut acknowledged = HashSet::new();
        let probe_result = complete_controlled_fixture_ack_publish(
            async { Err::<(), ()>(()) },
            true,
            "observed",
            None,
            "call-publish-failure",
            "trace-publish-failure",
            CONTROLLED_FIXTURE_GENERATION,
            "fixture-01",
            &mut acknowledged,
        )
        .await;
        let mut observer_starts = 0;
        let mut session_starts = 0;
        let mut audio_starts = 0;
        let mut speaking_starts = 0;
        assert!(!start_observer_after_controlled_fixture_probe(
            true,
            Some(probe_result),
            || {
                observer_starts += 1;
                session_starts += 1;
                audio_starts += 1;
                speaking_starts += 1;
            },
        ));
        assert!(!probe_result);
        assert!(acknowledged.is_empty());
        assert_eq!(observer_starts, 0);
        assert_eq!(session_starts, 0);
        assert_eq!(audio_starts, 0);
        assert_eq!(speaking_starts, 0);

        let observed_result = complete_controlled_fixture_ack_publish(
            async { Ok::<(), ()>(()) },
            true,
            "observed",
            None,
            "call-publish-success",
            "trace-publish-success",
            CONTROLLED_FIXTURE_GENERATION,
            "fixture-02",
            &mut acknowledged,
        )
        .await;
        let mut successful_observer_starts = 0;
        assert!(start_observer_after_controlled_fixture_probe(
            true,
            Some(observed_result),
            || successful_observer_starts += 1,
        ));
        assert!(observed_result);
        assert!(acknowledged.contains("fixture-02"));
        assert_eq!(successful_observer_starts, 1);
    }

    #[tokio::test]
    async fn production_attribute_observation_accepts_server_visibility_within_probe_ttl() {
        let expected = HashMap::from([
            (
                "inputSourceCategory".to_string(),
                "controlled_fixture".to_string(),
            ),
            (
                "clientFixtureSequence".to_string(),
                "fixture-01".to_string(),
            ),
        ]);
        let mut reads = 0;
        let result = observe_controlled_fixture_attributes(
            Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
            "user-1",
            Some("user-1"),
            "fixture-01",
            || {
                reads += 1;
                if reads <= 3 {
                    HashMap::new()
                } else {
                    expected.clone()
                }
            },
        )
        .await;
        assert_eq!(result, Ok(()));
        assert_eq!(reads, 4);
    }

    #[tokio::test]
    async fn production_attribute_observation_rejects_wrong_sequence_without_audio_effect() {
        let attributes = HashMap::from([
            (
                "inputSourceCategory".to_string(),
                "controlled_fixture".to_string(),
            ),
            (
                "clientFixtureSequence".to_string(),
                "fixture-02".to_string(),
            ),
        ]);
        let result = observe_controlled_fixture_attributes(
            Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
            "user-1",
            Some("user-1"),
            "fixture-01",
            || attributes.clone(),
        )
        .await;
        let mut observer_starts = 0;
        assert_eq!(result, Err("wrong_sequence"));
        assert!(!start_observer_after_controlled_fixture_probe(
            true,
            Some(result.is_ok()),
            || observer_starts += 1,
        ));
        assert_eq!(observer_starts, 0);
    }

    #[test]
    fn controlled_fixture_ack_payload_is_reliable_and_redacted() {
        let ack = ControlledFixtureAttributeAck {
            message_type: CONTROLLED_FIXTURE_ACK_TOPIC,
            protocol_version: CONTROLLED_FIXTURE_PROTOCOL_VERSION,
            call_id_hash: sha256_hex("call-1"),
            call_trace_id_hash: sha256_hex("trace-1"),
            generation: CONTROLLED_FIXTURE_GENERATION,
            client_fixture_sequence: "fixture-01".to_string(),
            result: "observed",
            input_source_category: Some("controlled_fixture"),
            reject_reason: None,
        };
        let encoded = serde_json::to_vec(&ack).unwrap();
        let decoded: serde_json::Value = serde_json::from_slice(&encoded).unwrap();
        assert_eq!(decoded["type"], CONTROLLED_FIXTURE_ACK_TOPIC);
        assert_eq!(
            decoded["protocolVersion"],
            CONTROLLED_FIXTURE_PROTOCOL_VERSION
        );
        assert_eq!(decoded["result"], "observed");
        assert!(decoded.get("callId").is_none());
        assert!(decoded.get("traceId").is_none());
        assert!(decoded.get("participantIdentity").is_none());
        assert!(decoded.get("audio").is_none());
    }

    #[test]
    fn controlled_fixture_probe_does_not_create_session_or_audio_side_effects() {
        let attributes = std::collections::HashMap::new();
        assert_eq!(
            classify_controlled_fixture_attributes(
                "user-1",
                Some("user-1"),
                &attributes,
                "fixture-01"
            ),
            Err("missing_attributes")
        );
        assert_eq!(
            CONTROLLED_FIXTURE_PROBE_TOPIC,
            "controlled_fixture_attribute_probe"
        );
        assert_eq!(
            CONTROLLED_FIXTURE_ACK_TOPIC,
            "controlled_fixture_attribute_ack"
        );
    }

    #[test]
    fn controlled_fixture_probe_must_be_observed_before_audio_observer() {
        assert!(controlled_fixture_observer_gate(false, None));
        assert!(controlled_fixture_observer_gate(true, Some(true)));
        assert!(!controlled_fixture_observer_gate(true, Some(false)));
        assert!(!controlled_fixture_observer_gate(true, None));
    }

    #[test]
    fn production_event_order_probe_then_track_publishes_ack_before_observer() {
        let attributes = HashMap::from([
            (
                "inputSourceCategory".to_string(),
                "controlled_fixture".to_string(),
            ),
            (
                "clientFixtureSequence".to_string(),
                "fixture-01".to_string(),
            ),
        ]);
        let effects = drive_pre_audio_order_test_seam(&[
            PreAudioOrderEvent::DataReceived {
                sender: "user-1".to_string(),
                sequence: "fixture-01".to_string(),
            },
            PreAudioOrderEvent::TrackSubscribed {
                participant: "user-1".to_string(),
                attributes,
            },
        ]);
        assert_eq!(effects, ["ack_observed", "observer_started"]);
    }

    #[test]
    fn production_event_order_negative_probe_has_no_observer_or_session_effect() {
        let mut invalid = HashMap::new();
        invalid.insert(
            "inputSourceCategory".to_string(),
            "ordinary_mic".to_string(),
        );
        let effects = drive_pre_audio_order_test_seam(&[
            PreAudioOrderEvent::DataReceived {
                sender: "user-1".to_string(),
                sequence: "fixture-01".to_string(),
            },
            PreAudioOrderEvent::TrackSubscribed {
                participant: "user-1".to_string(),
                attributes: invalid,
            },
        ]);
        assert!(effects.is_empty());
    }

    #[test]
    fn production_audio_branch_orders_probe_before_spawn_callsite() {
        let source = include_str!("main.rs");
        let branch = source
            .find("RoomEvent::TrackSubscribed {\n                track: RemoteTrack::Audio")
            .expect("audio TrackSubscribed production branch");
        let branch_source = &source[branch..];
        let probe = branch_source
            .find("let probe_result = process_controlled_fixture_probe")
            .expect("probe must be processed in audio branch");
        let spawn = branch_source
            .find("start_observer_after_controlled_fixture_probe")
            .expect("spawn must use shared order entry");
        assert!(
            probe < spawn,
            "probe must precede shared observer spawn entry"
        );
    }
}