From bf538f10cc411d978bc30863085cd98c5ca18b14 Mon Sep 17 00:00:00 2001
From: cai <cai@nbcai.cc>
Date: Wed, 12 Aug 2026 14:56:28 +0800
Subject: [PATCH] test(helper): observe post-expiry attribute visibility

---
 src/main.rs | 1532 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 1,516 insertions(+), 16 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index b880777..8803bba 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -6,6 +6,7 @@
     borrow::Cow,
     collections::HashSet,
     env, fs,
+    future::Future,
     path::{Path, PathBuf},
     sync::{
         Arc,
@@ -59,6 +60,512 @@
 const STREAM_TIMING_FIRST_CHUNK: u64 = 1;
 const STREAM_TIMING_MAX_ELAPSED_MS: u64 = 5_000;
 const STREAM_TIMING_SOURCE: &str = "stream_anchor_monotonic";
+const CONTROLLED_FIXTURE_PROBE_TOPIC: &str = "controlled_fixture_attribute_probe";
+const CONTROLLED_FIXTURE_ACK_TOPIC: &str = "controlled_fixture_attribute_ack";
+const CONTROLLED_FIXTURE_PROTOCOL_VERSION: u64 = 1;
+const CONTROLLED_FIXTURE_GENERATION: u64 = 1;
+const CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY: Duration = Duration::from_millis(25);
+const CONTROLLED_FIXTURE_PROBE_TTL: Duration = Duration::from_millis(250);
+const CONTROLLED_FIXTURE_POST_EXPIRY_WINDOW: Duration = Duration::from_millis(2_000);
+
+const CONTROLLED_FIXTURE_ACK_RESULTS: [&str; 4] =
+    ["observed", "rejected", "timeout", "publish_failed"];
+const CONTROLLED_FIXTURE_REJECT_REASONS: [&str; 10] = [
+    "missing_attributes",
+    "wrong_source",
+    "missing_sequence",
+    "wrong_sequence",
+    "wrong_participant",
+    "expired",
+    "duplicate_or_old_sequence",
+    "no_current_participant",
+    "ack_publish_failed",
+    "unknown",
+];
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ControlledFixtureAttributeProbe {
+    #[serde(rename = "type")]
+    message_type: String,
+    protocol_version: u64,
+    call_id_hash: String,
+    call_trace_id_hash: String,
+    generation: u64,
+    client_fixture_sequence: String,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ControlledFixtureAttributeAck {
+    #[serde(rename = "type")]
+    message_type: &'static str,
+    protocol_version: u64,
+    call_id_hash: String,
+    call_trace_id_hash: String,
+    generation: u64,
+    client_fixture_sequence: String,
+    result: &'static str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    input_source_category: Option<&'static str>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reject_reason: Option<&'static str>,
+}
+
+#[derive(Clone, Debug)]
+struct PendingControlledFixtureProbe {
+    sender: ParticipantIdentity,
+    call_id_hash: String,
+    call_trace_id_hash: String,
+    generation: u64,
+    sequence: String,
+    received_at: Instant,
+    expires_at: Instant,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+struct ControlledFixtureVisibilityEvidence {
+    first_visible_bucket: &'static str,
+    visibility_source: &'static str,
+    binding_matched: bool,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+struct ControlledFixtureAckPublishOutcome {
+    observed: bool,
+    published: bool,
+}
+
+fn sha256_hex(value: &str) -> String {
+    let mut digest = Sha256::new();
+    digest.update(value.as_bytes());
+    digest
+        .finalize()
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+fn controlled_fixture_ack_classification(
+    decision: Result<(), &'static str>,
+) -> (&'static str, Option<&'static str>, bool) {
+    match decision {
+        Ok(()) => ("observed", None, true),
+        Err("timeout") => ("timeout", Some("expired"), false),
+        Err(reason) if CONTROLLED_FIXTURE_REJECT_REASONS.contains(&reason) => {
+            ("rejected", Some(reason), false)
+        }
+        Err(_) => ("rejected", Some("unknown"), false),
+    }
+}
+
+fn record_controlled_fixture_probe_event(
+    runtime_call_id: &str,
+    runtime_trace_id: &str,
+    stage: &'static str,
+    call_id_hash: &str,
+    trace_id_hash: &str,
+    generation: u64,
+    sequence: &str,
+    observed: bool,
+    ack_result: Option<&'static str>,
+    reject_reason: Option<&'static str>,
+) {
+    debug_assert!(ack_result.is_none_or(|value| CONTROLLED_FIXTURE_ACK_RESULTS.contains(&value)));
+    debug_assert!(
+        reject_reason.is_none_or(|value| CONTROLLED_FIXTURE_REJECT_REASONS.contains(&value))
+    );
+    println!(
+        "{}",
+        controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            stage,
+            call_id_hash,
+            trace_id_hash,
+            generation,
+            sequence,
+            observed,
+            ack_result,
+            reject_reason,
+        )
+    );
+}
+
+fn controlled_fixture_probe_event(
+    runtime_call_id: &str,
+    runtime_trace_id: &str,
+    stage: &'static str,
+    call_id_hash: &str,
+    trace_id_hash: &str,
+    generation: u64,
+    sequence: &str,
+    observed: bool,
+    ack_result: Option<&'static str>,
+    reject_reason: Option<&'static str>,
+) -> serde_json::Value {
+    json!({
+        "type": "cv_activity",
+        "callId": runtime_call_id,
+        "traceId": runtime_trace_id,
+        "turnId": null,
+        "eventName": "controlled_fixture_attribute_probe",
+        "eventWallTimeMs": current_time_millis(),
+        "result": "ok",
+        "reasonCode": null,
+        "retryable": null,
+        "extension": {
+            "stage": stage,
+            "observed": observed,
+            "ack_result": ack_result,
+            "reject_reason": reject_reason,
+            "call_id_hash": call_id_hash,
+            "trace_id_hash": trace_id_hash,
+            "generation": generation,
+            "sequence_hash": sha256_hex(sequence),
+        },
+    })
+}
+
+fn record_controlled_fixture_attribute_decision(
+    decision: Result<(), &'static str>,
+    runtime_call_id: &str,
+    runtime_trace_id: &str,
+    call_id_hash: &str,
+    trace_id_hash: &str,
+    generation: u64,
+    sequence: &str,
+) -> (&'static str, Option<&'static str>, bool) {
+    let classification = controlled_fixture_ack_classification(decision);
+    record_controlled_fixture_probe_event(
+        runtime_call_id,
+        runtime_trace_id,
+        "attributes_classified",
+        call_id_hash,
+        trace_id_hash,
+        generation,
+        sequence,
+        classification.2,
+        Some(classification.0),
+        classification.1,
+    );
+    classification
+}
+
+async fn complete_controlled_fixture_ack_publish<F, E>(
+    publish: F,
+    runtime_call_id: &str,
+    runtime_trace_id: &str,
+    observed: bool,
+    ack_result: &'static str,
+    reject_reason: Option<&'static str>,
+    call_id_hash: &str,
+    trace_id_hash: &str,
+    generation: u64,
+    sequence: &str,
+    acknowledged_probe_sequences: &mut HashSet<String>,
+) -> ControlledFixtureAckPublishOutcome
+where
+    F: Future<Output = Result<(), E>>,
+{
+    if publish.await.is_ok() {
+        record_controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            "ack_publish_completed",
+            call_id_hash,
+            trace_id_hash,
+            generation,
+            sequence,
+            observed,
+            Some(ack_result),
+            reject_reason,
+        );
+        acknowledged_probe_sequences.insert(sequence.to_string());
+        ControlledFixtureAckPublishOutcome {
+            observed,
+            published: true,
+        }
+    } else {
+        record_controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            "ack_publish_completed",
+            call_id_hash,
+            trace_id_hash,
+            generation,
+            sequence,
+            false,
+            Some("publish_failed"),
+            Some("ack_publish_failed"),
+        );
+        ControlledFixtureAckPublishOutcome {
+            observed: false,
+            published: false,
+        }
+    }
+}
+
+fn controlled_fixture_ack_from_probe(
+    probe: &PendingControlledFixtureProbe,
+    observed: bool,
+    reject_reason: Option<&'static str>,
+) -> ControlledFixtureAttributeAck {
+    ControlledFixtureAttributeAck {
+        message_type: CONTROLLED_FIXTURE_ACK_TOPIC,
+        protocol_version: CONTROLLED_FIXTURE_PROTOCOL_VERSION,
+        call_id_hash: probe.call_id_hash.clone(),
+        call_trace_id_hash: probe.call_trace_id_hash.clone(),
+        generation: probe.generation,
+        client_fixture_sequence: probe.sequence.clone(),
+        result: if observed { "observed" } else { "rejected" },
+        input_source_category: observed.then_some("controlled_fixture"),
+        reject_reason,
+    }
+}
+
+fn controlled_fixture_probe(
+    payload: &[u8],
+    call_id: &str,
+    trace_id: &str,
+    sender: &ParticipantIdentity,
+    expected_participant: Option<&str>,
+) -> Option<PendingControlledFixtureProbe> {
+    if !is_bound_user_participant(sender.as_str(), expected_participant) {
+        return None;
+    }
+    let probe: ControlledFixtureAttributeProbe = serde_json::from_slice(payload).ok()?;
+    if probe.message_type != CONTROLLED_FIXTURE_PROBE_TOPIC
+        || probe.protocol_version != CONTROLLED_FIXTURE_PROTOCOL_VERSION
+        || probe.generation != CONTROLLED_FIXTURE_GENERATION
+        || probe.call_id_hash != sha256_hex(call_id)
+        || probe.call_trace_id_hash != sha256_hex(trace_id)
+        || probe.client_fixture_sequence.trim().is_empty()
+    {
+        return None;
+    }
+    let received_at = Instant::now();
+    Some(PendingControlledFixtureProbe {
+        sender: sender.clone(),
+        call_id_hash: probe.call_id_hash,
+        call_trace_id_hash: probe.call_trace_id_hash,
+        generation: probe.generation,
+        sequence: probe.client_fixture_sequence,
+        received_at,
+        expires_at: received_at + CONTROLLED_FIXTURE_PROBE_TTL,
+    })
+}
+
+fn controlled_fixture_visibility_bucket(elapsed: Duration) -> &'static str {
+    if elapsed <= Duration::from_millis(250) {
+        "lte_250ms"
+    } else if elapsed <= Duration::from_millis(500) {
+        "250_500ms"
+    } else if elapsed <= Duration::from_millis(1_000) {
+        "500_1000ms"
+    } else {
+        "1000_2000ms"
+    }
+}
+
+async fn observe_controlled_fixture_post_expiry<F>(
+    received_at: Instant,
+    observation_deadline: Instant,
+    actual_participant: &str,
+    expected_participant: Option<&str>,
+    requested_sequence: &str,
+    lifecycle_active: Arc<AtomicBool>,
+    mut read_attributes: F,
+) -> Option<ControlledFixtureVisibilityEvidence>
+where
+    F: FnMut() -> std::collections::HashMap<String, String>,
+{
+    loop {
+        if !lifecycle_active.load(Ordering::Acquire) {
+            return None;
+        }
+        let now = Instant::now();
+        let decision = classify_controlled_fixture_attributes(
+            actual_participant,
+            expected_participant,
+            &read_attributes(),
+            requested_sequence,
+        );
+        match decision {
+            Ok(()) => {
+                return Some(ControlledFixtureVisibilityEvidence {
+                    first_visible_bucket: controlled_fixture_visibility_bucket(
+                        now.saturating_duration_since(received_at),
+                    ),
+                    visibility_source: "participant_attributes_poll",
+                    binding_matched: true,
+                });
+            }
+            Err("missing_attributes") if now < observation_deadline => {}
+            Err("missing_attributes") => {
+                return Some(ControlledFixtureVisibilityEvidence {
+                    first_visible_bucket: "never_visible_within_observation_window",
+                    visibility_source: "participant_attributes_poll",
+                    binding_matched: true,
+                });
+            }
+            Err(_) => return None,
+        }
+        sleep(CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY).await;
+    }
+}
+
+fn controlled_fixture_visibility_event(
+    runtime_call_id: &str,
+    runtime_trace_id: &str,
+    probe: &PendingControlledFixtureProbe,
+    evidence: &ControlledFixtureVisibilityEvidence,
+) -> serde_json::Value {
+    json!({
+        "type": "cv_activity",
+        "callId": runtime_call_id,
+        "traceId": runtime_trace_id,
+        "turnId": null,
+        "eventName": "controlled_fixture_attribute_probe",
+        "eventWallTimeMs": current_time_millis(),
+        "result": "ok",
+        "reasonCode": null,
+        "retryable": null,
+        "extension": {
+            "stage": "post_expiry_visibility",
+            "first_visible_bucket": evidence.first_visible_bucket,
+            "visibility_source": evidence.visibility_source,
+            "binding_matched": evidence.binding_matched,
+            "call_id_hash": probe.call_id_hash,
+            "trace_id_hash": probe.call_trace_id_hash,
+            "generation": probe.generation,
+            "sequence_hash": sha256_hex(&probe.sequence),
+            "evidence_count": 1,
+        },
+    })
+}
+
+fn spawn_controlled_fixture_post_expiry_observation(
+    probe: PendingControlledFixtureProbe,
+    participant: RemoteParticipant,
+    expected_participant: Option<String>,
+    lifecycle_active: Arc<AtomicBool>,
+    runtime_call_id: String,
+    runtime_trace_id: String,
+) {
+    tokio::spawn(async move {
+        let participant_identity = participant.identity().to_string();
+        let evidence = observe_controlled_fixture_post_expiry(
+            probe.received_at,
+            probe.received_at + CONTROLLED_FIXTURE_POST_EXPIRY_WINDOW,
+            &participant_identity,
+            expected_participant.as_deref(),
+            &probe.sequence,
+            lifecycle_active.clone(),
+            || participant.attributes(),
+        )
+        .await;
+        if lifecycle_active.load(Ordering::Acquire) {
+            if let Some(evidence) = evidence {
+                println!(
+                    "{}",
+                    controlled_fixture_visibility_event(
+                        &runtime_call_id,
+                        &runtime_trace_id,
+                        &probe,
+                        &evidence,
+                    )
+                );
+            }
+        }
+    });
+}
+
+fn classify_controlled_fixture_attributes(
+    actual_participant: &str,
+    expected_participant: Option<&str>,
+    attributes: &std::collections::HashMap<String, String>,
+    requested_sequence: &str,
+) -> Result<(), &'static str> {
+    if !is_bound_user_participant(actual_participant, expected_participant) {
+        return Err("wrong_participant");
+    }
+    let source = attributes
+        .get("inputSourceCategory")
+        .map(String::as_str)
+        .unwrap_or("");
+    if source != "controlled_fixture" {
+        return Err(if source.is_empty() {
+            "missing_attributes"
+        } else {
+            "wrong_source"
+        });
+    }
+    let sequence = attributes
+        .get("clientFixtureSequence")
+        .map(String::as_str)
+        .unwrap_or("");
+    if sequence.trim().is_empty() {
+        return Err("missing_sequence");
+    }
+    if sequence != requested_sequence {
+        return Err("wrong_sequence");
+    }
+    Ok(())
+}
+
+async fn observe_controlled_fixture_attributes<F>(
+    expires_at: Instant,
+    actual_participant: &str,
+    expected_participant: Option<&str>,
+    requested_sequence: &str,
+    mut read_attributes: F,
+) -> Result<(), &'static str>
+where
+    F: FnMut() -> std::collections::HashMap<String, String>,
+{
+    loop {
+        if Instant::now() > expires_at {
+            return Err("timeout");
+        }
+        let decision = classify_controlled_fixture_attributes(
+            actual_participant,
+            expected_participant,
+            &read_attributes(),
+            requested_sequence,
+        );
+        if decision.is_ok() || !matches!(decision, Err("missing_attributes")) {
+            return decision;
+        }
+        let Some(next_check) = Instant::now().checked_add(CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY)
+        else {
+            return Err("timeout");
+        };
+        if next_check > expires_at {
+            return Err("timeout");
+        }
+        sleep(CONTROLLED_FIXTURE_PROBE_RECHECK_DELAY).await;
+    }
+}
+
+fn controlled_fixture_observer_gate(pending_probe: bool, probe_result: Option<bool>) -> bool {
+    !pending_probe || probe_result == Some(true)
+}
+
+fn start_observer_after_controlled_fixture_probe<F>(
+    pending_probe: bool,
+    probe_result: Option<bool>,
+    spawn: F,
+) -> bool
+where
+    F: FnOnce(),
+{
+    if !controlled_fixture_observer_gate(pending_probe, probe_result) {
+        return false;
+    }
+    spawn();
+    true
+}
 
 #[tokio::main(flavor = "multi_thread")]
 async fn main() -> Result<()> {
@@ -768,6 +1275,11 @@
         "runtime helper user_track_subscribe_requested"
     );
 
+    let mut current_user_participant: Option<RemoteParticipant> = None;
+    let mut pending_probe: Option<PendingControlledFixtureProbe> = None;
+    let mut acknowledged_probe_sequences = HashSet::new();
+    let controlled_fixture_lifecycle_active = Arc::new(AtomicBool::new(true));
+
     while let Some(event) = events.recv().await {
         match event {
             RoomEvent::TrackSubscribed {
@@ -797,21 +1309,130 @@
                     track_source = %track_source,
                     "runtime helper user_track_subscribed"
                 );
-                spawn_user_audio_frame_observer(
-                    track,
-                    call_id.clone(),
-                    trace_id.clone(),
-                    participant_alias,
-                    track_sid_alias,
-                    simple_vad_enabled,
-                    simple_vad_config.clone(),
-                    vad_enabled_gate.clone(),
-                    turn_bridge_config.clone(),
-                    http.clone(),
-                    sink.clone(),
-                    user_participant_identity.clone(),
-                    participant,
+                let pending_binding = pending_probe.clone();
+                let participant_for_probe = participant.clone();
+                let probe_result = process_controlled_fixture_probe(
+                    &mut pending_probe,
+                    &mut acknowledged_probe_sequences,
+                    Some(&participant_for_probe),
+                    &sink,
+                    user_participant_identity.as_deref(),
+                    &call_id,
+                    &trace_id,
+                    controlled_fixture_lifecycle_active.clone(),
+                )
+                .await;
+                let observer_started = start_observer_after_controlled_fixture_probe(
+                    pending_binding.is_some(),
+                    probe_result,
+                    || {
+                        spawn_user_audio_frame_observer(
+                            track,
+                            call_id.clone(),
+                            trace_id.clone(),
+                            participant_alias,
+                            track_sid_alias,
+                            simple_vad_enabled,
+                            simple_vad_config.clone(),
+                            vad_enabled_gate.clone(),
+                            turn_bridge_config.clone(),
+                            http.clone(),
+                            sink.clone(),
+                            user_participant_identity.clone(),
+                            participant,
+                        );
+                    },
                 );
+                if let Some(probe) = pending_binding.as_ref() {
+                    let (ack_result, reject_reason, observed) = match probe_result {
+                        Some(true) => (Some("observed"), None, true),
+                        Some(false) => (Some("rejected"), Some("unknown"), false),
+                        None => (None, Some("no_current_participant"), false),
+                    };
+                    record_controlled_fixture_probe_event(
+                        &call_id,
+                        &trace_id,
+                        if observer_started {
+                            "audio_observer_allowed"
+                        } else {
+                            "audio_observer_blocked"
+                        },
+                        &probe.call_id_hash,
+                        &probe.call_trace_id_hash,
+                        probe.generation,
+                        &probe.sequence,
+                        observed,
+                        ack_result,
+                        reject_reason,
+                    );
+                }
+                if !observer_started {
+                    warn!(
+                        call_id = %call_id,
+                        trace_id = %trace_id,
+                        "runtime helper withheld audio observer until controlled fixture ACK"
+                    );
+                    continue;
+                }
+                current_user_participant = Some(participant_for_probe);
+            }
+            RoomEvent::DataReceived {
+                payload,
+                topic: Some(topic),
+                participant: Some(sender),
+                ..
+            } if topic == CONTROLLED_FIXTURE_PROBE_TOPIC => {
+                if let Ok(probe) =
+                    serde_json::from_slice::<ControlledFixtureAttributeProbe>(&payload)
+                {
+                    if acknowledged_probe_sequences.contains(&probe.client_fixture_sequence) {
+                        record_controlled_fixture_probe_event(
+                            &call_id,
+                            &trace_id,
+                            "data_received",
+                            &probe.call_id_hash,
+                            &probe.call_trace_id_hash,
+                            probe.generation,
+                            &probe.client_fixture_sequence,
+                            false,
+                            Some("rejected"),
+                            Some("duplicate_or_old_sequence"),
+                        );
+                        continue;
+                    }
+                }
+                pending_probe = controlled_fixture_probe(
+                    &payload,
+                    &call_id,
+                    &trace_id,
+                    &sender.identity(),
+                    user_participant_identity.as_deref(),
+                );
+                if let Some(probe) = pending_probe.as_ref() {
+                    record_controlled_fixture_probe_event(
+                        &call_id,
+                        &trace_id,
+                        "data_received",
+                        &probe.call_id_hash,
+                        &probe.call_trace_id_hash,
+                        probe.generation,
+                        &probe.sequence,
+                        false,
+                        None,
+                        None,
+                    );
+                }
+                process_controlled_fixture_probe(
+                    &mut pending_probe,
+                    &mut acknowledged_probe_sequences,
+                    current_user_participant.as_ref(),
+                    &sink,
+                    user_participant_identity.as_deref(),
+                    &call_id,
+                    &trace_id,
+                    controlled_fixture_lifecycle_active.clone(),
+                )
+                .await;
             }
             RoomEvent::TrackSubscribed {
                 track: RemoteTrack::Video(track),
@@ -852,6 +1473,149 @@
             _ => {}
         }
     }
+    controlled_fixture_lifecycle_active.store(false, Ordering::Release);
+}
+
+async fn process_controlled_fixture_probe(
+    pending_probe: &mut Option<PendingControlledFixtureProbe>,
+    acknowledged_probe_sequences: &mut HashSet<String>,
+    participant: Option<&RemoteParticipant>,
+    sink: &BotAudioOutputSink,
+    expected_participant: Option<&str>,
+    runtime_call_id: &str,
+    runtime_trace_id: &str,
+    lifecycle_active: Arc<AtomicBool>,
+) -> Option<bool> {
+    let Some(probe) = pending_probe.take() else {
+        return None;
+    };
+    if acknowledged_probe_sequences.contains(&probe.sequence) {
+        record_controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            "attributes_classified",
+            &probe.call_id_hash,
+            &probe.call_trace_id_hash,
+            probe.generation,
+            &probe.sequence,
+            false,
+            Some("rejected"),
+            Some("duplicate_or_old_sequence"),
+        );
+        return Some(false);
+    }
+    if Instant::now() > probe.expires_at {
+        record_controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            "attributes_classified",
+            &probe.call_id_hash,
+            &probe.call_trace_id_hash,
+            probe.generation,
+            &probe.sequence,
+            false,
+            Some("timeout"),
+            Some("expired"),
+        );
+        return Some(false);
+    }
+    let Some(participant) = participant else {
+        record_controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            "attributes_classified",
+            &probe.call_id_hash,
+            &probe.call_trace_id_hash,
+            probe.generation,
+            &probe.sequence,
+            false,
+            None,
+            Some("no_current_participant"),
+        );
+        *pending_probe = Some(probe);
+        return None;
+    };
+    if participant.identity() != probe.sender {
+        record_controlled_fixture_probe_event(
+            runtime_call_id,
+            runtime_trace_id,
+            "attributes_classified",
+            &probe.call_id_hash,
+            &probe.call_trace_id_hash,
+            probe.generation,
+            &probe.sequence,
+            false,
+            Some("rejected"),
+            Some("wrong_participant"),
+        );
+        return Some(false);
+    }
+    let decision = observe_controlled_fixture_attributes(
+        probe.expires_at,
+        &participant.identity().to_string(),
+        expected_participant,
+        &probe.sequence,
+        || participant.attributes(),
+    )
+    .await;
+    let (ack_result, reject_reason, observed) = record_controlled_fixture_attribute_decision(
+        decision,
+        runtime_call_id,
+        runtime_trace_id,
+        &probe.call_id_hash,
+        &probe.call_trace_id_hash,
+        probe.generation,
+        &probe.sequence,
+    );
+    let ack = controlled_fixture_ack_from_probe(&probe, observed, reject_reason);
+    let payload = match serde_json::to_vec(&ack) {
+        Ok(payload) => payload,
+        Err(_) => return Some(false),
+    };
+    let local_participant = sink.room.local_participant();
+    record_controlled_fixture_probe_event(
+        runtime_call_id,
+        runtime_trace_id,
+        "ack_publish_started",
+        &probe.call_id_hash,
+        &probe.call_trace_id_hash,
+        probe.generation,
+        &probe.sequence,
+        observed,
+        Some(ack_result),
+        reject_reason,
+    );
+    let publish = local_participant.publish_data(DataPacket {
+        payload,
+        topic: Some(CONTROLLED_FIXTURE_ACK_TOPIC.to_string()),
+        reliable: true,
+        destination_identities: vec![probe.sender.clone()],
+    });
+    let outcome = complete_controlled_fixture_ack_publish(
+        publish,
+        runtime_call_id,
+        runtime_trace_id,
+        observed,
+        ack_result,
+        reject_reason,
+        &probe.call_id_hash,
+        &probe.call_trace_id_hash,
+        probe.generation,
+        &probe.sequence,
+        acknowledged_probe_sequences,
+    )
+    .await;
+    if outcome.published && ack_result == "timeout" && reject_reason == Some("expired") {
+        spawn_controlled_fixture_post_expiry_observation(
+            probe,
+            participant.clone(),
+            expected_participant.map(str::to_string),
+            lifecycle_active,
+            runtime_call_id.to_string(),
+            runtime_trace_id.to_string(),
+        );
+    }
+    Some(outcome.observed)
 }
 
 async fn handle_finished_turn(
@@ -3285,7 +4049,9 @@
         Ok(metadata) => metadata,
         Err(reason) => {
             warn!(call_id = %call_id, trace_id = %trace_id, turn_id = %turn_id,
-                reason, audioIngressOriginStatus = %AudioIngressMetadata::rejection_status(reason),
+                reason, audioIngressOriginStatus = %AudioIngressMetadata::rejected_origin_status(
+                    reason, &attributes
+                ),
                 "runtime helper asr_realtime_metadata_rejected");
             return;
         }
@@ -4097,7 +4863,7 @@
 mod tests {
     use super::*;
     use std::{
-        collections::HashSet,
+        collections::{HashMap, HashSet},
         io::{Read, Write},
         net::TcpListener,
         sync::{
@@ -4108,6 +4874,62 @@
         thread,
         time::Duration,
     };
+
+    #[derive(Debug)]
+    enum PreAudioOrderEvent {
+        DataReceived {
+            sender: String,
+            sequence: String,
+        },
+        TrackSubscribed {
+            participant: String,
+            attributes: HashMap<String, String>,
+        },
+    }
+
+    fn drive_pre_audio_order_test_seam(events: &[PreAudioOrderEvent]) -> Vec<&'static str> {
+        let mut pending_sequence = None;
+        let mut effects = Vec::new();
+        for event in events {
+            match event {
+                PreAudioOrderEvent::DataReceived { sender, sequence } if sender == "user-1" => {
+                    pending_sequence = Some(sequence.as_str());
+                }
+                PreAudioOrderEvent::TrackSubscribed {
+                    participant,
+                    attributes,
+                } => {
+                    let pending = pending_sequence.is_some();
+                    let probe_result = pending_sequence.map(|sequence| {
+                        classify_controlled_fixture_attributes(
+                            participant,
+                            Some("user-1"),
+                            attributes,
+                            sequence,
+                        )
+                        .is_ok()
+                    });
+                    let mut ack_observed = false;
+                    let mut observer_started = false;
+                    start_observer_after_controlled_fixture_probe(pending, probe_result, || {
+                        if pending && probe_result == Some(true) {
+                            ack_observed = true;
+                        }
+                        observer_started = true;
+                    });
+                    if ack_observed {
+                        effects.push("ack_observed");
+                    }
+                    if observer_started {
+                        effects.push("observer_started");
+                    }
+                    pending_sequence = None;
+                }
+                PreAudioOrderEvent::DataReceived { .. } => {}
+            }
+        }
+        effects
+    }
 
     #[test]
     fn production_vad_session_boundary_reads_updated_attributes() {
@@ -4433,6 +5255,38 @@
         );
         assert!(upload.is_none());
         vad.reset_current_turn();
+        attrs.remove("clientFixtureSequence");
+        let (_, _, missing_sequence_turn) = observe_bound_participant_frame(
+            "participant-user",
+            Some("participant-user"),
+            &mut vad,
+            "call-001",
+            "trace-001",
+            "participant-user",
+            "track-001",
+            6,
+            6_000,
+            &frame,
+            Client::new(),
+            RealtimeAsrConfig {
+                enabled: true,
+                url: Some(format!("http://{address}/runtime/asr/realtime")),
+                runtime_token: Some("test".to_string()),
+                runtime_session_nonce: Some("test".to_string()),
+                chunk_duration_ms: 200,
+            },
+            || attrs.clone(),
+            &mut upload,
+            &mut last_fixture_sequence,
+            true,
+        );
+        assert!(missing_sequence_turn.is_none() && upload.is_none());
+        assert_eq!(
+            "sequence_absent",
+            AudioIngressMetadata::rejected_origin_status("incomplete_metadata", &attrs)
+        );
+        assert_eq!(2, captured_count.load(Ordering::SeqCst));
+        vad.reset_current_turn();
         attrs.insert("inputSourceCategory".to_string(), "other".to_string());
         let mut invalid_upload = None;
         let (_, _, invalid_turn) = observe_bound_participant_frame(
@@ -4594,4 +5448,650 @@
             assert!(published.is_empty());
         }
     }
+
+    #[test]
+    fn controlled_fixture_probe_requires_bound_hashes_and_protocol() {
+        let call_id = "call-ack-1";
+        let trace_id = "trace-ack-1";
+        let payload = serde_json::to_vec(&json!({
+            "type": CONTROLLED_FIXTURE_PROBE_TOPIC,
+            "protocolVersion": CONTROLLED_FIXTURE_PROTOCOL_VERSION,
+            "callIdHash": sha256_hex(call_id),
+            "callTraceIdHash": sha256_hex(trace_id),
+            "generation": CONTROLLED_FIXTURE_GENERATION,
+            "clientFixtureSequence": "fixture-01"
+        }))
+        .unwrap();
+        let sender = ParticipantIdentity("user-1".to_string());
+        let pending =
+            controlled_fixture_probe(&payload, call_id, trace_id, &sender, Some("user-1"))
+                .expect("valid probe");
+        assert_eq!(pending.sequence, "fixture-01");
+        assert_eq!(pending.call_id_hash, sha256_hex(call_id));
+        assert_eq!(pending.call_trace_id_hash, sha256_hex(trace_id));
+        assert_eq!(pending.generation, CONTROLLED_FIXTURE_GENERATION);
+        assert!(
+            controlled_fixture_probe(&payload, call_id, "other-trace", &sender, Some("user-1"),)
+                .is_none()
+        );
+        assert!(
+            controlled_fixture_probe(
+                &payload,
+                call_id,
+                trace_id,
+                &ParticipantIdentity("other-user".to_string()),
+                Some("user-1"),
+            )
+            .is_none()
+        );
+    }
+
+    #[test]
+    fn controlled_fixture_attributes_ack_only_on_exact_current_sequence() {
+        let mut attributes = std::collections::HashMap::from([
+            (
+                "inputSourceCategory".to_string(),
+                "controlled_fixture".to_string(),
+            ),
+            (
+                "clientFixtureSequence".to_string(),
+                "fixture-01".to_string(),
+            ),
+        ]);
+        assert!(
+            classify_controlled_fixture_attributes(
+                "user-1",
+                Some("user-1"),
+                &attributes,
+                "fixture-01"
+            )
+            .is_ok()
+        );
+        attributes.insert(
+            "clientFixtureSequence".to_string(),
+            "fixture-02".to_string(),
+        );
+        assert_eq!(
+            classify_controlled_fixture_attributes(
+                "user-1",
+                Some("user-1"),
+                &attributes,
+                "fixture-01"
+            ),
+            Err("wrong_sequence")
+        );
+        attributes.remove("clientFixtureSequence");
+        assert_eq!(
+            classify_controlled_fixture_attributes(
+                "user-1",
+                Some("user-1"),
+                &attributes,
+                "fixture-01"
+            ),
+            Err("missing_sequence")
+        );
+        assert_eq!(
+            classify_controlled_fixture_attributes(
+                "other-user",
+                Some("user-1"),
+                &attributes,
+                "fixture-01"
+            ),
+            Err("wrong_participant")
+        );
+    }
+
+    #[test]
+    fn controlled_fixture_probe_runtime_projection_binds_request_hashes_and_audio_gate() {
+        let call_id = "private-call-value";
+        let trace_id = "private-trace-value";
+        let sequence = "private-sequence-value";
+        let call_id_hash = sha256_hex(call_id);
+        let trace_id_hash = sha256_hex(trace_id);
+        let mut observer_starts = 0;
+        let (ack_result, reject_reason, observed) =
+            controlled_fixture_ack_classification(Err("wrong_source"));
+        let stages = [
+            ("data_received", None, None),
+            ("attributes_classified", Some(ack_result), reject_reason),
+            ("ack_publish_started", Some(ack_result), reject_reason),
+            ("ack_publish_completed", Some(ack_result), reject_reason),
+            ("audio_observer_blocked", Some(ack_result), reject_reason),
+        ];
+        for (stage, result, reason) in stages {
+            let event = controlled_fixture_probe_event(
+                call_id,
+                trace_id,
+                stage,
+                &call_id_hash,
+                &trace_id_hash,
+                CONTROLLED_FIXTURE_GENERATION,
+                sequence,
+                observed,
+                result,
+                reason,
+            );
+            assert_eq!(event["type"], "cv_activity");
+            assert_eq!(event["eventName"], "controlled_fixture_attribute_probe");
+            assert_eq!(event["extension"]["call_id_hash"], call_id_hash);
+            assert_eq!(event["extension"]["trace_id_hash"], trace_id_hash);
+            assert_eq!(event["extension"]["stage"], stage);
+            let output = event.to_string();
+            assert!(!output.contains(sequence));
+        }
+        assert!(!start_observer_after_controlled_fixture_probe(
+            true,
+            Some(observed),
+            || observer_starts += 1,
+        ));
+        assert_eq!(observer_starts, 0);
+
+        let (ack_result, reject_reason, observed) = controlled_fixture_ack_classification(Ok(()));
+        let allowed = controlled_fixture_probe_event(
+            call_id,
+            trace_id,
+            "audio_observer_allowed",
+            &call_id_hash,
+            &trace_id_hash,
+            CONTROLLED_FIXTURE_GENERATION,
+            sequence,
+            observed,
+            Some(ack_result),
+            reject_reason,
+        );
+        assert_eq!(allowed["extension"]["trace_id_hash"], trace_id_hash);
+        assert!(start_observer_after_controlled_fixture_probe(
+            true,
+            Some(observed),
+            || observer_starts += 1,
+        ));
+        assert_eq!(observer_starts, 1);
+    }
+
+    #[test]
+    fn controlled_fixture_probe_observed_and_failure_enums_are_stable() {
+        assert_eq!(
+            controlled_fixture_ack_classification(Ok(())),
+            ("observed", None, true)
+        );
+        assert_eq!(
+            controlled_fixture_ack_classification(Err("timeout")),
+            ("timeout", Some("expired"), false)
+        );
+        for reason in [
+            "missing_attributes",
+            "wrong_source",
+            "missing_sequence",
+            "wrong_sequence",
+            "wrong_participant",
+        ] {
+            assert_eq!(
+                controlled_fixture_ack_classification(Err(reason)),
+                ("rejected", Some(reason), false)
+            );
+        }
+        assert_eq!(
+            controlled_fixture_ack_classification(Err("unclassified")),
+            ("rejected", Some("unknown"), false)
+        );
+    }
+
+    #[test]
+    fn production_probe_binding_drives_rejected_and_observed_ack_without_local_rehash() {
+        let request_call_hash = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        let request_trace_hash = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+        let probe = PendingControlledFixtureProbe {
+            sender: ParticipantIdentity("user-1".to_string()),
+            call_id_hash: request_call_hash.to_string(),
+            call_trace_id_hash: request_trace_hash.to_string(),
+            generation: CONTROLLED_FIXTURE_GENERATION,
+            sequence: "fixture-01".to_string(),
+            received_at: Instant::now(),
+            expires_at: Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
+        };
+
+        let (ack_result, reject_reason, observed) =
+            controlled_fixture_ack_classification(Err("wrong_sequence"));
+        let rejected_ack = controlled_fixture_ack_from_probe(&probe, observed, reject_reason);
+        let rejected_json = serde_json::to_value(&rejected_ack).unwrap();
+        let mut rejected_observer_starts = 0;
+        assert_eq!(ack_result, "rejected");
+        assert_eq!(rejected_json["callIdHash"], request_call_hash);
+        assert_eq!(rejected_json["callTraceIdHash"], request_trace_hash);
+        assert_eq!(rejected_json["rejectReason"], "wrong_sequence");
+        assert!(!start_observer_after_controlled_fixture_probe(
+            true,
+            Some(observed),
+            || rejected_observer_starts += 1,
+        ));
+        assert_eq!(rejected_observer_starts, 0);
+
+        let (ack_result, reject_reason, observed) = controlled_fixture_ack_classification(Ok(()));
+        let observed_ack = controlled_fixture_ack_from_probe(&probe, observed, reject_reason);
+        let observed_json = serde_json::to_value(&observed_ack).unwrap();
+        let mut observed_observer_starts = 0;
+        assert_eq!(ack_result, "observed");
+        assert_eq!(observed_json["callIdHash"], request_call_hash);
+        assert_eq!(observed_json["callTraceIdHash"], request_trace_hash);
+        assert!(observed_json.get("rejectReason").is_none());
+        assert!(start_observer_after_controlled_fixture_probe(
+            true,
+            Some(observed),
+            || observed_observer_starts += 1,
+        ));
+        assert_eq!(observed_observer_starts, 1);
+    }
+
+    #[tokio::test]
+    async fn production_ack_publish_failure_keeps_observer_session_and_audio_closed() {
+        let mut acknowledged = HashSet::new();
+        let probe_result = complete_controlled_fixture_ack_publish(
+            async { Err::<(), ()>(()) },
+            "runtime-call-publish-failure",
+            "runtime-trace-publish-failure",
+            true,
+            "observed",
+            None,
+            "call-publish-failure",
+            "trace-publish-failure",
+            CONTROLLED_FIXTURE_GENERATION,
+            "fixture-01",
+            &mut acknowledged,
+        )
+        .await;
+        let mut observer_starts = 0;
+        let mut session_starts = 0;
+        let mut audio_starts = 0;
+        let mut speaking_starts = 0;
+        assert!(!start_observer_after_controlled_fixture_probe(
+            true,
+            Some(probe_result.observed),
+            || {
+                observer_starts += 1;
+                session_starts += 1;
+                audio_starts += 1;
+                speaking_starts += 1;
+            },
+        ));
+        assert_eq!(
+            probe_result,
+            ControlledFixtureAckPublishOutcome {
+                observed: false,
+                published: false,
+            }
+        );
+        assert!(acknowledged.is_empty());
+        assert_eq!(observer_starts, 0);
+        assert_eq!(session_starts, 0);
+        assert_eq!(audio_starts, 0);
+        assert_eq!(speaking_starts, 0);
+
+        let observed_result = complete_controlled_fixture_ack_publish(
+            async { Ok::<(), ()>(()) },
+            "runtime-call-publish-success",
+            "runtime-trace-publish-success",
+            true,
+            "observed",
+            None,
+            "call-publish-success",
+            "trace-publish-success",
+            CONTROLLED_FIXTURE_GENERATION,
+            "fixture-02",
+            &mut acknowledged,
+        )
+        .await;
+        let mut successful_observer_starts = 0;
+        assert!(start_observer_after_controlled_fixture_probe(
+            true,
+            Some(observed_result.observed),
+            || successful_observer_starts += 1,
+        ));
+        assert_eq!(
+            observed_result,
+            ControlledFixtureAckPublishOutcome {
+                observed: true,
+                published: true,
+            }
+        );
+        assert!(acknowledged.contains("fixture-02"));
+        assert_eq!(successful_observer_starts, 1);
+    }
+
+    #[tokio::test]
+    async fn production_attribute_observation_accepts_server_visibility_within_probe_ttl() {
+        let expected = HashMap::from([
+            (
+                "inputSourceCategory".to_string(),
+                "controlled_fixture".to_string(),
+            ),
+            (
+                "clientFixtureSequence".to_string(),
+                "fixture-01".to_string(),
+            ),
+        ]);
+        let mut reads = 0;
+        let result = observe_controlled_fixture_attributes(
+            Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
+            "user-1",
+            Some("user-1"),
+            "fixture-01",
+            || {
+                reads += 1;
+                if reads <= 3 {
+                    HashMap::new()
+                } else {
+                    expected.clone()
+                }
+            },
+        )
+        .await;
+        assert_eq!(result, Ok(()));
+        assert_eq!(reads, 4);
+    }
+
+    #[tokio::test]
+    async fn production_attribute_observation_rejects_wrong_sequence_without_audio_effect() {
+        let attributes = HashMap::from([
+            (
+                "inputSourceCategory".to_string(),
+                "controlled_fixture".to_string(),
+            ),
+            (
+                "clientFixtureSequence".to_string(),
+                "fixture-02".to_string(),
+            ),
+        ]);
+        let result = observe_controlled_fixture_attributes(
+            Instant::now() + CONTROLLED_FIXTURE_PROBE_TTL,
+            "user-1",
+            Some("user-1"),
+            "fixture-01",
+            || attributes.clone(),
+        )
+        .await;
+        let mut observer_starts = 0;
+        assert_eq!(result, Err("wrong_sequence"));
+        assert!(!start_observer_after_controlled_fixture_probe(
+            true,
+            Some(result.is_ok()),
+            || observer_starts += 1,
+        ));
+        assert_eq!(observer_starts, 0);
+    }
+
+    #[tokio::test]
+    async fn production_post_expiry_observation_records_bounded_visibility_without_second_ack() {
+        let started_at = Instant::now();
+        let active = Arc::new(AtomicBool::new(true));
+        let expected = HashMap::from([
+            (
+                "inputSourceCategory".to_string(),
+                "controlled_fixture".to_string(),
+            ),
+            (
+                "clientFixtureSequence".to_string(),
+                "fixture-01".to_string(),
+            ),
+        ]);
+        let mut acknowledged = HashSet::new();
+        let expired_ack = complete_controlled_fixture_ack_publish(
+            async { Ok::<(), ()>(()) },
+            "runtime-call-post-expiry",
+            "runtime-trace-post-expiry",
+            false,
+            "timeout",
+            Some("expired"),
+            "call-post-expiry",
+            "trace-post-expiry",
+            CONTROLLED_FIXTURE_GENERATION,
+            "fixture-01",
+            &mut acknowledged,
+        )
+        .await;
+        assert_eq!(
+            expired_ack,
+            ControlledFixtureAckPublishOutcome {
+                observed: false,
+                published: true,
+            }
+        );
+        let evidence = observe_controlled_fixture_post_expiry(
+            started_at,
+            started_at + CONTROLLED_FIXTURE_POST_EXPIRY_WINDOW,
+            "user-1",
+            Some("user-1"),
+            "fixture-01",
+            active,
+            || {
+                if started_at.elapsed() >= Duration::from_millis(300) {
+                    expected.clone()
+                } else {
+                    HashMap::new()
+                }
+            },
+        )
+        .await;
+        assert_eq!(acknowledged.len(), 1);
+        assert_eq!(
+            evidence,
+            Some(ControlledFixtureVisibilityEvidence {
+                first_visible_bucket: "250_500ms",
+                visibility_source: "participant_attributes_poll",
+                binding_matched: true,
+            })
+        );
+
+        let never_started_at = Instant::now();
+        assert_eq!(
+            observe_controlled_fixture_post_expiry(
+                never_started_at,
+                never_started_at + Duration::from_millis(40),
+                "user-1",
+                Some("user-1"),
+                "fixture-01",
+                Arc::new(AtomicBool::new(true)),
+                HashMap::new,
+            )
+            .await,
+            Some(ControlledFixtureVisibilityEvidence {
+                first_visible_bucket: "never_visible_within_observation_window",
+                visibility_source: "participant_attributes_poll",
+                binding_matched: true,
+            })
+        );
+
+        assert_eq!(
+            observe_controlled_fixture_post_expiry(
+                Instant::now(),
+                Instant::now() + Duration::from_millis(50),
+                "cross-call-user",
+                Some("user-1"),
+                "fixture-01",
+                Arc::new(AtomicBool::new(true)),
+                || expected.clone(),
+            )
+            .await,
+            None
+        );
+
+        let inactive = Arc::new(AtomicBool::new(false));
+        assert_eq!(
+            observe_controlled_fixture_post_expiry(
+                Instant::now(),
+                Instant::now() + Duration::from_millis(50),
+                "user-1",
+                Some("user-1"),
+                "fixture-01",
+                inactive,
+                HashMap::new,
+            )
+            .await,
+            None
+        );
+        assert_eq!(acknowledged.len(), 1);
+
+        let probe = PendingControlledFixtureProbe {
+            sender: ParticipantIdentity("user-1".to_string()),
+            call_id_hash: "call-post-expiry".to_string(),
+            call_trace_id_hash: "trace-post-expiry".to_string(),
+            generation: CONTROLLED_FIXTURE_GENERATION,
+            sequence: "fixture-01".to_string(),
+            received_at: started_at,
+            expires_at: started_at + CONTROLLED_FIXTURE_PROBE_TTL,
+        };
+        let event = controlled_fixture_visibility_event(
+            "runtime-call-post-expiry",
+            "runtime-trace-post-expiry",
+            &probe,
+            &evidence.unwrap(),
+        );
+        let extension = event["extension"].as_object().unwrap();
+        let mut keys = extension.keys().map(String::as_str).collect::<Vec<_>>();
+        keys.sort_unstable();
+        assert_eq!(
+            keys,
+            vec![
+                "binding_matched",
+                "call_id_hash",
+                "evidence_count",
+                "first_visible_bucket",
+                "generation",
+                "sequence_hash",
+                "stage",
+                "trace_id_hash",
+                "visibility_source",
+            ]
+        );
+        let encoded = event.to_string();
+        for forbidden in [
+            "\"participant\":",
+            "\"room\":",
+            "\"track\":",
+            "\"payload\":",
+            "\"audio\":",
+        ] {
+            assert!(!encoded.contains(forbidden));
+        }
+    }
+
+    #[test]
+    fn controlled_fixture_ack_payload_is_reliable_and_redacted() {
+        let ack = ControlledFixtureAttributeAck {
+            message_type: CONTROLLED_FIXTURE_ACK_TOPIC,
+            protocol_version: CONTROLLED_FIXTURE_PROTOCOL_VERSION,
+            call_id_hash: sha256_hex("call-1"),
+            call_trace_id_hash: sha256_hex("trace-1"),
+            generation: CONTROLLED_FIXTURE_GENERATION,
+            client_fixture_sequence: "fixture-01".to_string(),
+            result: "observed",
+            input_source_category: Some("controlled_fixture"),
+            reject_reason: None,
+        };
+        let encoded = serde_json::to_vec(&ack).unwrap();
+        let decoded: serde_json::Value = serde_json::from_slice(&encoded).unwrap();
+        assert_eq!(decoded["type"], CONTROLLED_FIXTURE_ACK_TOPIC);
+        assert_eq!(
+            decoded["protocolVersion"],
+            CONTROLLED_FIXTURE_PROTOCOL_VERSION
+        );
+        assert_eq!(decoded["result"], "observed");
+        assert!(decoded.get("callId").is_none());
+        assert!(decoded.get("traceId").is_none());
+        assert!(decoded.get("participantIdentity").is_none());
+        assert!(decoded.get("audio").is_none());
+    }
+
+    #[test]
+    fn controlled_fixture_probe_does_not_create_session_or_audio_side_effects() {
+        let attributes = std::collections::HashMap::new();
+        assert_eq!(
+            classify_controlled_fixture_attributes(
+                "user-1",
+                Some("user-1"),
+                &attributes,
+                "fixture-01"
+            ),
+            Err("missing_attributes")
+        );
+        assert_eq!(
+            CONTROLLED_FIXTURE_PROBE_TOPIC,
+            "controlled_fixture_attribute_probe"
+        );
+        assert_eq!(
+            CONTROLLED_FIXTURE_ACK_TOPIC,
+            "controlled_fixture_attribute_ack"
+        );
+    }
+
+    #[test]
+    fn controlled_fixture_probe_must_be_observed_before_audio_observer() {
+        assert!(controlled_fixture_observer_gate(false, None));
+        assert!(controlled_fixture_observer_gate(true, Some(true)));
+        assert!(!controlled_fixture_observer_gate(true, Some(false)));
+        assert!(!controlled_fixture_observer_gate(true, None));
+    }
+
+    #[test]
+    fn production_event_order_probe_then_track_publishes_ack_before_observer() {
+        let attributes = HashMap::from([
+            (
+                "inputSourceCategory".to_string(),
+                "controlled_fixture".to_string(),
+            ),
+            (
+                "clientFixtureSequence".to_string(),
+                "fixture-01".to_string(),
+            ),
+        ]);
+        let effects = drive_pre_audio_order_test_seam(&[
+            PreAudioOrderEvent::DataReceived {
+                sender: "user-1".to_string(),
+                sequence: "fixture-01".to_string(),
+            },
+            PreAudioOrderEvent::TrackSubscribed {
+                participant: "user-1".to_string(),
+                attributes,
+            },
+        ]);
+        assert_eq!(effects, ["ack_observed", "observer_started"]);
+    }
+
+    #[test]
+    fn production_event_order_negative_probe_has_no_observer_or_session_effect() {
+        let mut invalid = HashMap::new();
+        invalid.insert(
+            "inputSourceCategory".to_string(),
+            "ordinary_mic".to_string(),
+        );
+        let effects = drive_pre_audio_order_test_seam(&[
+            PreAudioOrderEvent::DataReceived {
+                sender: "user-1".to_string(),
+                sequence: "fixture-01".to_string(),
+            },
+            PreAudioOrderEvent::TrackSubscribed {
+                participant: "user-1".to_string(),
+                attributes: invalid,
+            },
+        ]);
+        assert!(effects.is_empty());
+    }
+
+    #[test]
+    fn production_audio_branch_orders_probe_before_spawn_callsite() {
+        let source = include_str!("main.rs");
+        let branch = source
+            .find("RoomEvent::TrackSubscribed {\n                track: RemoteTrack::Audio")
+            .expect("audio TrackSubscribed production branch");
+        let branch_source = &source[branch..];
+        let probe = branch_source
+            .find("let probe_result = process_controlled_fixture_probe")
+            .expect("probe must be processed in audio branch");
+        let spawn = branch_source
+            .find("start_observer_after_controlled_fixture_probe")
+            .expect("spawn must use shared order entry");
+        assert!(
+            probe < spawn,
+            "probe must precede shared observer spawn entry"
+        );
+    }
 }

--
Gitblit v1.9.3