switchroom 0.18.22 → 0.18.24

package/telegram-plugin/reply-owner-resolve.ts

@@ -0,0 +1,160 @@
+/**
+ * Reply owner-turn resolution + answer-delivered latch decision
+ * (2026-07 double-reply-on-DM fix — completes the #3236 turnId-keyed dedup for
+ * the late-reply / DM path).
+ *
+ * ## The bug this closes
+ *
+ * On a DM agent a turn double-sent: the answer-ready quiescence flush posted the
+ * composed terminal answer as message A (no quote), then the model's REAL `reply`
+ * tool call landed a moment later and sent message B (quoted). The user should
+ * have received exactly ONE message (the quoted reply).
+ *
+ * #3236 shipped `flushed-turn-supersede.ts` — a turnId-identity-keyed dedup that
+ * is text-agnostic BY DESIGN. It missed here not because of the text rewording
+ * but because the reply's owner turn resolved to `null` on the late path:
+ *
+ *   - At reply consumption the gateway resolved the owner turn as
+ *     `currentTurn ?? findTurnByOriginId(origin_turn_id) ?? null`.
+ *   - `currentTurn` was already nulled by the flush's synthetic turn_end.
+ *   - `origin_turn_id` is a forum-supergroup field, ABSENT in DMs, so
+ *     `findTurnByOriginId` returned null.
+ *   - ⇒ the resolved live turnId was `null`, and `decideSupersede` deliberately
+ *     never lets a null live turn supersede a turnId-bearing flush record. No
+ *     supersede fired → message A survived AND the reply sent message B.
+ *
+ * The DECISIVE divergence: the gateway's *thread-routing* path DID recover the
+ * owner turn for the same late reply — via `findTurnByQuotedMessageId` (the
+ * framework-owned default quote target) and `findLatestEndedTurnForChat` (the
+ * chat's most-recently-ended turn). The supersede resolver chain omitted BOTH
+ * recoveries, so the two resolvers disagreed on who owned the reply. This module
+ * unifies them onto ONE precedence so they can never diverge again.
+ *
+ * ## Why a pure module
+ *
+ * `gateway.ts` is not importable in tests (heavy top-level side effects), so the
+ * repo's convention — `decideTurnFlush`, `decideSupersede`,
+ * `decideCapturedProseDelivery` — is to extract the decision core into a pure,
+ * unit-testable function and have the gateway run the EXACT code the regression
+ * tests exercise. The gateway performs the four turn lookups (currentTurn,
+ * findTurnByOriginId, findTurnByQuotedMessageId, findLatestEndedTurnForChat) and
+ * feeds their resolved turnIds here; the precedence lives in one place.
+ */
+
+/**
+ * The four owner-turn candidate ids, in the gateway's resolution precedence.
+ * Each is the `turnId` of the turn a given lookup resolved, or null when that
+ * lookup found nothing.
+ */
+export interface ReplyOwnerCandidates {
+  /** The LIVE `currentTurn` at reply-consumption time (null once the flush's
+   *  synthetic turn_end has torn the atom down — the late-reply case). */
+  liveTurnId: string | null
+  /** `findTurnByOriginId(origin_turn_id)` — the turn the model echoed back.
+   *  Null in DMs (no `origin_turn_id`) and when the model omitted the echo. */
+  originTurnId: string | null
+  /** `findTurnByQuotedMessageId(chat_id, reply_to)` — the framework-owned
+   *  quoted message id, resolved with NO model thread assertion. */
+  quotedTurnId: string | null
+  /** `findLatestEndedTurnForChat(chat_id)` — the chat's most-recently-ended
+   *  turn. The deterministic late-reply fallback (the DM path's recovery). */
+  latestEndedTurnId: string | null
+  /** Age (ms) of the latest-ended turn — `now - turn.endedAt`. The latest-ended
+   *  tier carries DESTRUCTIVE authority (it drives supersede deletion), so it is
+   *  honoured ONLY when the turn ended within `latestEndedTtlMs` (the supersede
+   *  TTL). Without the bound, a late reply belonging to an OLDER turn could
+   *  resolve its owner to a NEWER turn now sitting at the registry tail and
+   *  delete THAT turn's legit answer. Undefined/null ⇒ unbounded (back-compat:
+   *  callers that don't supply an age keep the pre-F2 behaviour). */
+  latestEndedAgeMs?: number | null
+  /** The supersede TTL bound applied to `latestEndedAgeMs`. Undefined ⇒
+   *  unbounded. */
+  latestEndedTtlMs?: number
+}
+
+/**
+ * Whether the latest-ended candidate is fresh enough to carry supersede
+ * (deletion) authority. A missing age or TTL means unbounded (back-compat).
+ */
+function latestEndedAccepted(candidates: ReplyOwnerCandidates): boolean {
+  if (candidates.latestEndedTurnId == null) return false
+  const age = candidates.latestEndedAgeMs
+  const ttl = candidates.latestEndedTtlMs
+  if (age == null || ttl == null) return true
+  return age <= ttl
+}
+
+/**
+ * Resolve the turnId that OWNS a landing reply, using the SAME full chain the
+ * thread-router uses. Precedence, first non-null wins:
+ *
+ *   1. the live `currentTurn`;
+ *   2. the model-echoed `origin_turn_id` turn;
+ *   3. the framework-owned quoted-message turn;
+ *   4. the chat's most-recently-ended turn.
+ *
+ * Returns null only when EVERY lookup missed (a genuinely unattributable reply),
+ * in which case `decideSupersede` keeps its null-safety semantics and declines
+ * to delete any turnId-bearing flush record.
+ */
+export function resolveReplyOwnerTurnId(candidates: ReplyOwnerCandidates): string | null {
+  return (
+    candidates.liveTurnId ??
+    candidates.originTurnId ??
+    candidates.quotedTurnId ??
+    (latestEndedAccepted(candidates) ? candidates.latestEndedTurnId : null) ??
+    null
+  )
+}
+
+/**
+ * The answer-delivered latch inputs (Part 2 — the race backstop).
+ *
+ * The unified resolver (Part 1) closes the common late-reply case where the
+ * flush fully COMPLETED (recorded its supersede entry) before the reply landed:
+ * supersede then deletes message A and the reply delivers as the single clean
+ * message B. But a residual race remains — a reply whose supersede `take()` runs
+ * in the window AFTER the flush FIRED but BEFORE it recorded its message ids.
+ * There `flushed-turn-supersede` finds no record (nothing to delete yet) and the
+ * reply would ship message B as a duplicate of the flush's message A.
+ *
+ * The latch closes that window: the gateway sets `answerDelivered = true` on the
+ * turn atom SYNCHRONOUSLY at flush-fire time — before the ~500 ms async send and
+ * before the record — and the flag persists on the ended turn (readable via the
+ * unified resolver after `currentTurn` is null). A reply landing in the race
+ * window then sees the latch already set and suppresses itself.
+ */
+export interface AnswerLatchSuppressInput {
+  /** True when Part 1's supersede already fired for THIS reply (message A was
+   *  deleted and this reply IS the sanctioned replacement). The latch must NOT
+   *  then also suppress — that would leave the turn with ZERO messages. */
+  superseded: boolean
+  /** True when the landing reply is a substantive terminal answer (the same
+   *  ≥200-char `FINAL_ANSWER_MIN_CHARS` floor the flush latch is scoped to).
+   *  A sub-floor interim ack (short, `disable_notification`) is never a final
+   *  answer, so it neither sets nor trips the latch. */
+  replySubstantive: boolean
+  /** True when this is a LATE reply — `currentTurn` was already null at
+   *  consumption. The flush-duplicate ALWAYS lands late (the flush's synthetic
+   *  turn_end nulled the atom); scoping suppression to the late path leaves a
+   *  legitimate second in-turn substantive reply (a genuine multi-message
+   *  answer, live currentTurn) untouched. */
+  isLateReply: boolean
+  /** The resolved owner turn's `answerDelivered` latch. */
+  ownerAnswerDelivered: boolean
+}
+
+/**
+ * Decide whether the answer-delivered latch suppresses a landing reply.
+ *
+ * Suppress IFF: Part 1 did NOT already supersede, the reply is a substantive
+ * final answer, it is a late reply (no live turn), AND the owner turn's latch is
+ * already set (the flush delivered the same substantive answer as message A in
+ * the pre-record race window). Otherwise the reply sends.
+ */
+export function decideAnswerLatchSuppression(input: AnswerLatchSuppressInput): boolean {
+  if (input.superseded) return false
+  if (!input.replySubstantive) return false
+  if (!input.isLateReply) return false
+  return input.ownerAnswerDelivered
+}

package/telegram-plugin/tests/reply-owner-resolve.test.ts

@@ -0,0 +1,279 @@
+/**
+ * Regression coverage for the 2026-07 double-reply-on-DM fix — completes the
+ * #3236 turnId-keyed dedup (`flushed-turn-supersede.ts`) for the late-reply / DM
+ * path.
+ *
+ * ## The incident these tests pin
+ *
+ * On a DM agent a turn DOUBLE-SENT: the answer-ready quiescence flush posted the
+ * composed terminal answer as message A (no quote), then the model's REAL
+ * `reply` tool call landed and sent message B (quoted). The user should have
+ * received exactly ONE message (the quoted reply).
+ *
+ * #3236's supersede is turnId-identity-keyed and text-agnostic BY DESIGN, so the
+ * 275-vs-249-char rewording is NOT why it missed. It missed because the reply's
+ * owner turn resolved to `null` on the late path: `currentTurn` was nulled by the
+ * flush's synthetic turn_end, and `origin_turn_id` (a forum-supergroup field) is
+ * absent in DMs — so the OLD 2-tier chain `currentTurn ?? findTurnByOriginId`
+ * yielded null, and `decideSupersede` never lets a null live turn supersede a
+ * turnId-bearing record.
+ *
+ * The router recovered the SAME reply's owner via `findTurnByQuotedMessageId` and
+ * `findLatestEndedTurnForChat`; the supersede chain omitted BOTH. The fix
+ * (`resolveReplyOwnerTurnId`) unifies the two onto one precedence.
+ *
+ * These tests exercise the extracted pure cores — the exact precedence and latch
+ * decision the gateway runs (`gateway.ts` is not importable in tests; the repo's
+ * `decideTurnFlush` / `decideSupersede` pattern). The core test also asserts the
+ * OLD 2-tier chain FAILS to recover the owner (the red-on-main contrast) while
+ * the unified chain recovers it and the supersede fires.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  resolveReplyOwnerTurnId,
+  decideAnswerLatchSuppression,
+  type ReplyOwnerCandidates,
+} from '../reply-owner-resolve.js'
+import { FlushedTurnSupersedeRegistry, DEFAULT_SUPERSEDE_TTL_MS } from '../flushed-turn-supersede.js'
+
+const NONE: ReplyOwnerCandidates = {
+  liveTurnId: null,
+  originTurnId: null,
+  quotedTurnId: null,
+  latestEndedTurnId: null,
+}
+
+/** The OLD (pre-fix) resolver chain the gateway ran on main — the 2-tier
+ *  `currentTurn ?? findTurnByOriginId` — reproduced here to prove the incident
+ *  went unrecovered before the fix (red-on-main contrast). */
+function oldTwoTierResolve(c: ReplyOwnerCandidates): string | null {
+  return c.liveTurnId ?? c.originTurnId ?? null
+}
+
+describe('resolveReplyOwnerTurnId — unified owner-turn precedence (Part 1)', () => {
+  it('prefers the live currentTurn when present', () => {
+    expect(
+      resolveReplyOwnerTurnId({ ...NONE, liveTurnId: 'live', originTurnId: 'origin', latestEndedTurnId: 'ended' }),
+    ).toBe('live')
+  })
+
+  it('falls to the model-echoed origin turn when no live turn', () => {
+    expect(
+      resolveReplyOwnerTurnId({ ...NONE, originTurnId: 'origin', quotedTurnId: 'quoted', latestEndedTurnId: 'ended' }),
+    ).toBe('origin')
+  })
+
+  it('falls to the framework-owned quoted-message turn when no live/origin', () => {
+    expect(
+      resolveReplyOwnerTurnId({ ...NONE, quotedTurnId: 'quoted', latestEndedTurnId: 'ended' }),
+    ).toBe('quoted')
+  })
+
+  it('falls to the chat latest-ended turn as the final tier — the DM recovery', () => {
+    expect(resolveReplyOwnerTurnId({ ...NONE, latestEndedTurnId: 'ended' })).toBe('ended')
+  })
+
+  it('returns null only when every lookup missed', () => {
+    expect(resolveReplyOwnerTurnId(NONE)).toBeNull()
+  })
+
+  it('RED-ON-MAIN CONTRAST: the DM late reply (no live turn, no origin) is ' +
+    'unrecovered by the old 2-tier chain but recovered by the unified chain', () => {
+    // The exact incident inputs: flush nulled currentTurn (liveTurnId=null),
+    // DM has no origin_turn_id (originTurnId=null); the owner survives only in
+    // the latest-ended registry (latestEndedTurnId).
+    const incident: ReplyOwnerCandidates = { ...NONE, latestEndedTurnId: 'turn-T' }
+    // Old behaviour (what shipped on main): null → no supersede → duplicate.
+    expect(oldTwoTierResolve(incident)).toBeNull()
+    // Fixed behaviour: recovers the owning turn T.
+    expect(resolveReplyOwnerTurnId(incident)).toBe('turn-T')
+  })
+})
+
+describe('Part 1 end-to-end: unified resolver drives the flush supersede', () => {
+  const CHAT = '424242'
+
+  it('CORE INCIDENT: flush records message A for turn T, then a late DM reply ' +
+    '(currentTurn=null, no origin_turn_id) SUPERSEDES via the recovered owner', () => {
+    const reg = new FlushedTurnSupersedeRegistry()
+    const now = 1_000
+    // Flush commits message A for turn T.
+    reg.record(CHAT, undefined, { turnId: 'turn-T', messageIds: [5001], text: 'A' }, now)
+
+    // Late DM reply: no live turn, no origin echo; owner survives in the
+    // latest-ended registry as turn-T.
+    const incident: ReplyOwnerCandidates = { ...NONE, latestEndedTurnId: 'turn-T' }
+
+    // Old 2-tier chain → null → supersede DECLINES (the duplicate ships).
+    const oldId = oldTwoTierResolve(incident)
+    expect(reg.peek(CHAT, undefined, { liveTurnId: oldId, now: now + 10 }).supersede).toBe(false)
+
+    // Unified chain → turn-T → supersede FIRES and deletes message A, so the
+    // reply below delivers as the single clean message.
+    const newId = resolveReplyOwnerTurnId(incident)
+    const decision = reg.take(CHAT, undefined, { liveTurnId: newId, now: now + 10 })
+    expect(decision.supersede).toBe(true)
+    expect(decision.deleteMessageIds).toEqual([5001])
+  })
+
+  it('a DIFFERENT newer turn recovered as owner does NOT supersede turn T', () => {
+    const reg = new FlushedTurnSupersedeRegistry()
+    const now = 2_000
+    reg.record(CHAT, undefined, { turnId: 'turn-T', messageIds: [7001], text: 'A' }, now)
+    // Owner recovers to a newer turn (its own flush isn't recorded here).
+    const id = resolveReplyOwnerTurnId({ ...NONE, latestEndedTurnId: 'turn-NEWER' })
+    expect(reg.take(CHAT, undefined, { liveTurnId: id, now: now + 10 }).supersede).toBe(false)
+  })
+})
+
+describe('decideAnswerLatchSuppression — race backstop (Part 2)', () => {
+  it('RACE: a late substantive reply lands in the flush post-fire pre-record ' +
+    'window (no supersede record yet) → SUPPRESSED by the latch', () => {
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive: true,
+        isLateReply: true,
+        ownerAnswerDelivered: true,
+      }),
+    ).toBe(true)
+  })
+
+  it('does NOT double-suppress when Part 1 already superseded (else the turn ' +
+    'ends with ZERO messages)', () => {
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: true,
+        replySubstantive: true,
+        isLateReply: true,
+        ownerAnswerDelivered: true,
+      }),
+    ).toBe(false)
+  })
+
+  it('NEGATIVE: an interim sub-floor ack (not substantive) is never suppressed ' +
+    '— so interim-ack-then-final both send', () => {
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive: false,
+        isLateReply: true,
+        ownerAnswerDelivered: true,
+      }),
+    ).toBe(false)
+  })
+
+  it('NEGATIVE: a normal in-turn reply with a live currentTurn is never ' +
+    'suppressed (a legitimate second substantive reply still sends)', () => {
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive: true,
+        isLateReply: false,
+        ownerAnswerDelivered: true,
+      }),
+    ).toBe(false)
+  })
+
+  it('does not suppress when the owner latch is unset (a normal answer)', () => {
+    expect(
+      decideAnswerLatchSuppression({
+        superseded: false,
+        replySubstantive: true,
+        isLateReply: true,
+        ownerAnswerDelivered: false,
+      }),
+    ).toBe(false)
+  })
+})
+
+describe('F1 — flush send failure must NOT suppress the late reply (zero-message guard)', () => {
+  // The flush arms `answerDelivered` synchronously at FIRE time, BEFORE the async
+  // send. If the send then throws and NOTHING was delivered, the supersede record
+  // is never written (gated on sentIds>0), so Part 1 cannot fire. Leaving the
+  // latch armed would make a genuine late reply suppress itself → the user gets
+  // ZERO messages. The gateway's send-failure catch resets `answerDelivered =
+  // false`; these assert the resulting coordination outcome at the pure core.
+  const lateSubstantiveReply = (ownerAnswerDelivered: boolean) =>
+    decideAnswerLatchSuppression({
+      superseded: false,
+      replySubstantive: true,
+      isLateReply: true,
+      ownerAnswerDelivered,
+    })
+
+  it('WITHOUT the catch-reset (latch still armed) the late reply is suppressed ' +
+    '— the zero-message bug', () => {
+    // Models the buggy state: flush armed the latch, send failed, latch left true.
+    expect(lateSubstantiveReply(true)).toBe(true)
+  })
+
+  it('WITH the catch-reset (answerDelivered=false) the late reply DELIVERS', () => {
+    // Models the fixed state: catch reset the latch, so the genuine late reply
+    // is not suppressed and the user still receives the answer.
+    expect(lateSubstantiveReply(false)).toBe(false)
+  })
+})
+
+describe('F2 — recency-bound the destructive latest-ended supersede tier', () => {
+  const CHAT = '515151'
+  const base: ReplyOwnerCandidates = {
+    liveTurnId: null,
+    originTurnId: null,
+    quotedTurnId: null,
+    latestEndedTurnId: null,
+  }
+
+  it('accepts a latest-ended turn that ended within the supersede TTL', () => {
+    expect(
+      resolveReplyOwnerTurnId({
+        ...base,
+        latestEndedTurnId: 'turn-T',
+        latestEndedAgeMs: DEFAULT_SUPERSEDE_TTL_MS - 1,
+        latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
+      }),
+    ).toBe('turn-T')
+  })
+
+  it('REJECTS a STALE latest-ended turn (ended past the supersede TTL) so it ' +
+    'cannot inherit deletion authority — resolver returns null', () => {
+    expect(
+      resolveReplyOwnerTurnId({
+        ...base,
+        latestEndedTurnId: 'turn-STALE',
+        latestEndedAgeMs: DEFAULT_SUPERSEDE_TTL_MS + 5_000,
+        latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
+      }),
+    ).toBeNull()
+  })
+
+  it('end-to-end: a stale latest-ended turn does NOT delete a live flush ' +
+    "record it doesn't own", () => {
+    const reg = new FlushedTurnSupersedeRegistry()
+    const now = 1_000_000
+    // A fresh flush record for the newer turn T2 (its owner, well within TTL).
+    reg.record(CHAT, undefined, { turnId: 'turn-T2', messageIds: [9001], text: 'A2' }, now)
+    // A late reply whose only recoverable owner is a STALE turn (ended long ago).
+    // Without the recency bound the resolver would hand back the stale turn id
+    // and a take() keyed on it could mis-target; with the bound it resolves null,
+    // so no deletion authority is granted and T2's record survives untouched.
+    const ownerId = resolveReplyOwnerTurnId({
+      ...base,
+      latestEndedTurnId: 'turn-STALE',
+      latestEndedAgeMs: DEFAULT_SUPERSEDE_TTL_MS + 5_000,
+      latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
+    })
+    expect(ownerId).toBeNull()
+    const decision = reg.take(CHAT, undefined, { liveTurnId: ownerId, now: now + 10 })
+    expect(decision.supersede).toBe(false)
+    // T2's record is intact (a null owner never reaches its turnId-keyed lane).
+    expect(reg.peek(CHAT, undefined, { liveTurnId: 'turn-T2', now: now + 10 }).supersede).toBe(true)
+  })
+
+  it('unbounded when no age is supplied (back-compat: pre-F2 precedence intact)', () => {
+    expect(
+      resolveReplyOwnerTurnId({ ...base, latestEndedTurnId: 'turn-T' }),
+    ).toBe('turn-T')
+  })
+})

package/telegram-plugin/tests/worker-feed-coalesce.test.ts

@@ -768,7 +768,7 @@ describe('renderCombinedWorkerFeed (pure)', () => {
  * authoritative terminal sweep (`terminate`, driven by `onTerminalCleanup`)
  * PLUS a backstop TTL sweep. These assert the OUTCOMES, not the code paths.
  */
-function ghostHarness(opts: { staleWorkerTtlMs?: number; now: () => number }) {
+function ghostHarness(opts: { staleWorkerTtlMs?: number; absoluteRowLifetimeCapMs?: number; now: () => number }) {
   const edits: { messageId: number; text: string }[] = []
   const sends: { text: string }[] = []
   const pins: { messageId: number | null }[] = []
@@ -792,6 +792,7 @@ function ghostHarness(opts: { staleWorkerTtlMs?: number; now: () => number }) {
     setInterval: () => 0,
     clearInterval: () => {},
     staleWorkerTtlMs: opts.staleWorkerTtlMs,
+    absoluteRowLifetimeCapMs: opts.absoluteRowLifetimeCapMs,
     reconcilePin: ({ messageId }) => pins.push({ messageId }),
   })
   return { feed, edits, sends, pins }
@@ -891,6 +892,121 @@ describe('worker-feed ghost-leak — deterministic terminal removal + backstop',
     expect(feed.size).toBe(1)
   })
 
+  // ── ABSOLUTE row-lifetime cap (Carrie 5h zombie pin, v0.18.23) ──────────────
+  // The silence-keyed `staleWorkerTtlMs` backstop is defeated by a leaked row
+  // that never finishes AND keeps receiving `update()` cues every heartbeat:
+  // each cue resets `lastUpdateAt`, so the silence sweep can NEVER match and the
+  // pinned card lives forever (observed: 5h, re-edited 3000+ times). The
+  // absolute cap is anchored to the row's IMMUTABLE creation time, so it reaps
+  // the row regardless of how recently it updated.
+  it('ABSOLUTE cap reaps an immortal-but-UPDATING row that resets lastUpdateAt every tick, then unpins', async () => {
+    let t = 0
+    // Silence TTL huge (would never fire); absolute cap small. The row keeps
+    // updating just under the silence TTL each step, so ONLY the absolute cap
+    // (immune to the lastUpdateAt reset) can catch it.
+    const { feed, edits, pins } = ghostHarness({
+      staleWorkerTtlMs: 1_000_000,
+      absoluteRowLifetimeCapMs: 5000,
+      now: () => t,
+    })
+    await feed.update('z', 'chat', view('zombie task', 's0', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+    expect(pins.at(-1)?.messageId).not.toBeNull()
+
+    // Drive continuous updates past the absolute cap — each resets lastUpdateAt,
+    // so the silence sweep stays defeated (exactly the Carrie failure mode).
+    for (let step = 1; step <= 8; step++) {
+      t = step * 1000
+      await feed.update('z', 'chat', view('zombie task', `s${step}`, t))
+      await drain()
+      feed.heartbeatTick()
+      await drain()
+    }
+    // The absolute cap (5s) has been crossed while the row kept updating →
+    // reaped despite the fresh cues, and the shared card UNPINNED.
+    expect(feed.size).toBe(0)
+    expect(pins.at(-1)?.messageId).toBeNull()
+
+    // Immortality closed for good: the finalized gate blocks a late cue from
+    // resurrecting the row, and further heartbeats produce no edits.
+    await feed.update('z', 'chat', view('zombie task', 's-late', t))
+    await drain()
+    expect(feed.size).toBe(0)
+    const after = edits.length
+    t += 10000
+    feed.heartbeatTick()
+    await drain()
+    expect(edits.length).toBe(after)
+  })
+
+  it('ABSOLUTE cap reaps a row past the cap even when the silence TTL would never fire', async () => {
+    let t = 0
+    const { feed, pins } = ghostHarness({
+      staleWorkerTtlMs: 1_000_000,
+      absoluteRowLifetimeCapMs: 5000,
+      now: () => t,
+    })
+    await feed.update('f', 'chat', view('task f', 's0', 0))
+    await drain()
+    expect(pins.at(-1)?.messageId).not.toBeNull()
+    // Past the absolute cap with no update at all — the age anchor alone reaps.
+    t = 6000
+    feed.heartbeatTick()
+    await drain()
+    expect(feed.size).toBe(0)
+    expect(pins.at(-1)?.messageId).toBeNull()
+  })
+
+  // ── Boot/reconnect purge (Ken's key ask) ───────────────────────────────────
+  // Every tracked row is a dead child sub-agent after a restart/reconnect. On a
+  // bare bridge reconnect the OLD feed's `wk:group:` pins are orphaned — the new
+  // empty feed never knew those groups, so it can never unpin them, and no full-
+  // boot pin sweep runs. `purgeAllOnBoot()` must reconcile the feed to empty AND
+  // release the pin unconditionally.
+  it('purgeAllOnBoot empties a restored running row + pinned card and UNPINS', async () => {
+    let t = 0
+    const { feed, pins } = ghostHarness({ now: () => t })
+    // A running worker with a live pinned card (the "restored at startup" state).
+    await feed.update('p', 'chat', view('task p', 'working', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+    expect(pins.at(-1)?.messageId).not.toBeNull()
+
+    feed.purgeAllOnBoot()
+
+    // Feed reconciled to empty AND the coalesced card unpinned (messageId null).
+    expect(feed.size).toBe(0)
+    expect(pins.at(-1)?.messageId).toBeNull()
+
+    // A late cue on the torn-down feed must NOT resurrect a row (finalized gate).
+    t = 100
+    await feed.update('p', 'chat', view('task p', 'zombie tick', 100))
+    await drain()
+    expect(feed.size).toBe(0)
+  })
+
+  it('purgeAllOnBoot unpins EVERY group (multiple chats) and is a no-op when already empty', async () => {
+    let t = 0
+    const { feed, pins } = ghostHarness({ now: () => t })
+    await feed.update('g1', 'chatA', view('a', 's', 0))
+    await feed.update('g2', 'chatB', view('b', 's', 0))
+    await drain()
+    expect(feed.size).toBe(2)
+
+    const pinsBefore = pins.length
+    feed.purgeAllOnBoot()
+    expect(feed.size).toBe(0)
+    // Both groups emitted a final unpin (messageId null).
+    const unpinsAfter = pins.slice(pinsBefore).filter((p) => p.messageId === null)
+    expect(unpinsAfter.length).toBe(2)
+
+    // Idempotent: a second purge on an empty feed emits no further pin calls.
+    const afterFirst = pins.length
+    feed.purgeAllOnBoot()
+    expect(pins.length).toBe(afterFirst)
+  })
+
   it('no-op re-render is skipped (byte-identical body → no redundant edit)', async () => {
     let t = 0
     const { feed, edits } = ghostHarness({ now: () => t })