switchroom 0.18.23 → 0.18.25

package/telegram-plugin/tests/tool-activity-summary.test.ts

@@ -7,7 +7,9 @@ import {
   renderActivityFeed,
   renderActivityFeedWithNested,
   renderActivityHeader,
+  renderCombinedWorkerFeed,
   formatFeedElapsed,
+  formatTokenCount,
   formatStepSuffix,
   STEP_TIMER_MIN_MS,
   type SessionActivityHeader,
@@ -745,6 +747,80 @@ describe("renderActivityHeader — two-line header builder", () => {
     const [, h2synth] = renderActivityHeader("🤖", "Agent", "", 15_000, 7, "running", "<synthetic>");
     expect(h2synth).toBe("_15s · 7 tools_");
   });
+
+  it("inserts the token segment between tool count and model (running)", () => {
+    const [, h2] = renderActivityHeader("🛠", "Worker", "run tests", 120_000, 14, "running", "claude-opus-4-8", 12_400);
+    expect(h2).toBe("_2m00s · 14 tools · 12.4k tok · opus 4.8_");
+  });
+
+  it("inserts the token segment before elapsed on the done line", () => {
+    const [, h2] = renderActivityHeader("🛠", "Worker", "run tests", 65_000, 3, "done", undefined, 940);
+    expect(h2).toBe("_done · 3 tools · 940 tok · 1m05s_");
+  });
+
+  it("omits the token segment when total is 0 / undefined (both variants consistent)", () => {
+    const [, running] = renderActivityHeader("🛠", "Worker", "", 15_000, 7, "running", undefined, 0);
+    expect(running).toBe("_15s · 7 tools_");
+    const [, undef] = renderActivityHeader("🛠", "Worker", "", 15_000, 7, "running");
+    expect(undef).toBe("_15s · 7 tools_");
+    const [, doneZero] = renderActivityHeader("🛠", "Worker", "", 65_000, 3, "done", undefined, 0);
+    expect(doneZero).toBe("_done · 3 tools · 1m05s_");
+  });
+
+  it("renders tokens and model together, in order", () => {
+    const [, h2] = renderActivityHeader("🛠", "Worker", "", 10_000, 2, "running", "sr-glm-5", 1_200_000);
+    expect(h2).toBe("_10s · 2 tools · 1.2M tok · sr-glm-5_");
+  });
+});
+
+describe("formatTokenCount — compact token formatter", () => {
+  it("renders sub-1000 as a raw integer", () => {
+    expect(formatTokenCount(0)).toBe("0");
+    expect(formatTokenCount(1)).toBe("1");
+    expect(formatTokenCount(999)).toBe("999");
+  });
+
+  it("renders >=1000 as one-decimal k at the boundary", () => {
+    expect(formatTokenCount(1000)).toBe("1.0k");
+    expect(formatTokenCount(12_400)).toBe("12.4k");
+    expect(formatTokenCount(999_499)).toBe("999.5k");
+  });
+
+  it("renders >=1e6 as one-decimal M at the boundary", () => {
+    expect(formatTokenCount(1_000_000)).toBe("1.0M");
+    expect(formatTokenCount(1_200_000)).toBe("1.2M");
+  });
+
+  it("promotes the k→M rounding boundary (never renders 1000.0k)", () => {
+    // 999_949 rounds down to 999.9k; from 999_950 the 1-decimal k rounds to
+    // 1000.0 which must roll into the M branch as 1.0M.
+    expect(formatTokenCount(999_949)).toBe("999.9k");
+    expect(formatTokenCount(999_950)).toBe("1.0M");
+    expect(formatTokenCount(999_999)).toBe("1.0M");
+    expect(formatTokenCount(1_000_000)).toBe("1.0M");
+  });
+
+  it("clamps negatives / non-finite to 0", () => {
+    expect(formatTokenCount(-5)).toBe("0");
+    expect(formatTokenCount(Number.NaN)).toBe("0");
+    expect(formatTokenCount(Number.POSITIVE_INFINITY)).toBe("0");
+  });
+});
+
+describe("renderCombinedWorkerFeed — token segment on the row header", () => {
+  it("shows `· N tok` per worker row and omits it at 0", () => {
+    const body = renderCombinedWorkerFeed(
+      [
+        { description: "alpha", elapsedMs: 15_000, toolCount: 3, currentStep: "Reading a.ts", totalTokens: 12_400 },
+        { description: "beta", elapsedMs: 20_000, toolCount: 5, currentStep: "Running tests", totalTokens: 0 },
+      ],
+      { maxRows: 5 },
+    );
+    expect(body).not.toBeNull();
+    expect(body!).toContain("**alpha** _· 15s · 3 tools · 12.4k tok_");
+    expect(body!).toContain("**beta** _· 20s · 5 tools_");
+    expect(body!).not.toContain("beta** _· 20s · 5 tools · 0 tok");
+  });
 });
 
 describe("agent flat path routes through the shared step-feed primitive", () => {
@@ -852,6 +928,39 @@ describe("renderActivityFeed — header param (main-session card fix)", () => {
     expect(nested).toContain("· opus 4.8_");
   });
 
+  it("threads the parent's OWN totalTokens through the flat and nested turn-card paths", () => {
+    const header: SessionActivityHeader = {
+      label: "Agent",
+      elapsedMs: 120_000,
+      toolCount: 14,
+      state: "running",
+      model: "claude-opus-4-8",
+      totalTokens: 12_400,
+    };
+    // Flat path (no foreground sub-agent).
+    const flat = renderActivityFeed(["Searching memory"], false, "", undefined, header)!;
+    expect(flat).toContain("_2m00s · 14 tools · 12.4k tok · opus 4.8_");
+    // Nested path (with a child line) carries the same token segment.
+    const nested = renderActivityFeedWithNested(["Reading"], ["nested step"], false, "", undefined, header)!;
+    expect(nested).toContain("· 12.4k tok ·");
+  });
+
+  it("omits the token segment on the turn card when totalTokens is 0 / undefined", () => {
+    const zero: SessionActivityHeader = {
+      label: "Agent",
+      elapsedMs: 15_000,
+      toolCount: 7,
+      state: "running",
+      totalTokens: 0,
+    };
+    const outZero = renderActivityFeed(["Searching memory"], false, "", undefined, zero)!;
+    expect(outZero).toContain("_15s · 7 tools_");
+    expect(outZero).not.toContain("tok");
+    // undefined behaves identically.
+    const undef: SessionActivityHeader = { label: "Agent", elapsedMs: 15_000, toolCount: 7, state: "running" };
+    expect(renderActivityFeed(["Searching memory"], false, "", undefined, undef)).toBe(outZero);
+  });
+
   it("prepends the done header when final=true", () => {
     const header: SessionActivityHeader = {
       label: "Agent",

package/telegram-plugin/tests/trailing-answer-projector.test.ts

@@ -0,0 +1,124 @@
+import { describe, it, expect } from 'vitest'
+import { projectTrailingAnswerFromTranscript } from '../session-tail.js'
+
+/**
+ * Pins the crash-survival redelivery transcript projector: recovering the
+ * finished-but-never-sent trailing answer from a session JSONL after a
+ * pre-flush crash, and refusing to redeliver a dangling mid-tool preamble.
+ */
+
+function assistantText(text: string): string {
+  return JSON.stringify({ type: 'assistant', message: { content: [{ type: 'text', text }] } })
+}
+function assistantToolUse(name: string): string {
+  return JSON.stringify({
+    type: 'assistant',
+    message: { content: [{ type: 'tool_use', name, id: 'toolu_x', input: {} }] },
+  })
+}
+function enqueue(text: string): string {
+  return JSON.stringify({ type: 'queue-operation', operation: 'enqueue', content: text })
+}
+/** A real inbound user message line (string content) — a turn separator the
+ *  projection kernel emits NO event for, unlike an `enqueue`. */
+function userMessage(text: string): string {
+  return JSON.stringify({ type: 'user', message: { role: 'user', content: text } })
+}
+/** A tool_result carrier user line — NOT a turn boundary. */
+function toolResult(toolUseId: string): string {
+  return JSON.stringify({
+    type: 'user',
+    message: { role: 'user', content: [{ type: 'tool_result', tool_use_id: toolUseId, content: 'ok' }] },
+  })
+}
+
+describe('projectTrailingAnswerFromTranscript', () => {
+  it('recovers the trailing answer text after the last tool_use', () => {
+    const transcript = [
+      enqueue('what is the deploy status?'),
+      assistantText('Let me check.'),
+      assistantToolUse('Bash'),
+      assistantText('The deploy finished — all three services are green.'),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.trailingIsText).toBe(true)
+    expect(r.text).toBe('The deploy finished — all three services are green.')
+  })
+
+  it('does NOT treat a dangling tool_use as a redeliverable answer', () => {
+    const transcript = [
+      enqueue('run the migration'),
+      assistantText('On it — running the migration now.'),
+      assistantToolUse('Bash'),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.trailingIsText).toBe(false)
+    // the preamble was reset by the tool_use; nothing trailing to send
+    expect(r.text).toBe('')
+  })
+
+  it('scopes to the LAST turn only (a prior turn answer is not resurfaced)', () => {
+    const transcript = [
+      enqueue('first question'),
+      assistantText('First answer.'),
+      enqueue('second question'),
+      assistantText('Second answer.'),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.text).toBe('Second answer.')
+  })
+
+  it('suppresses an isApiErrorMessage synthetic line (never redeliver an error string)', () => {
+    const transcript = [
+      enqueue('do the thing'),
+      JSON.stringify({
+        type: 'assistant',
+        isApiErrorMessage: true,
+        message: { content: [{ type: 'text', text: "You've hit your limit · resets 5pm" }] },
+      }),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.text).toBe('')
+    expect(r.trailingIsText).toBe(false)
+  })
+
+  // diff-review defect #2 — a real claude .jsonl separates turns with a plain
+  // `type:"user"` message line the kernel ignores, NOT always an interleaved
+  // enqueue queue-operation. Two turns with no intervening tool_use must not
+  // concatenate; only the LAST turn's trailing text is projected.
+  it('breaks turns on a plain user-message separator (no enqueue, no tool_use)', () => {
+    const transcript = [
+      userMessage('first question'),
+      assistantText('First answer.'),
+      userMessage('second question'),
+      assistantText('Second answer.'),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.text).toBe('Second answer.')
+    expect(r.trailingIsText).toBe(true)
+  })
+
+  it('does NOT treat a tool_result user line as a turn boundary (answer still accretes)', () => {
+    const transcript = [
+      userMessage('do the thing'),
+      assistantToolUse('Bash'),
+      toolResult('toolu_x'),
+      assistantText('All done — the thing is done.'),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.text).toBe('All done — the thing is done.')
+    expect(r.trailingIsText).toBe(true)
+  })
+
+  it('concatenates multiple trailing text blocks of the final answer', () => {
+    const transcript = [
+      enqueue('q'),
+      assistantToolUse('Read'),
+      assistantText('Part one. '),
+      assistantText('Part two.'),
+    ].join('\n')
+    const r = projectTrailingAnswerFromTranscript(transcript)
+    expect(r.text).toBe('Part one. Part two.')
+    expect(r.trailingIsText).toBe(true)
+  })
+})

package/telegram-plugin/tests/vault-grant-inbound-builders.test.ts

@@ -16,6 +16,8 @@ import { describe, it, expect } from 'vitest'
 import {
   buildVaultGrantApprovedInbound,
   buildVaultGrantApprovedCardText,
+  normalizeGrantReason,
+  MAX_GRANT_REASON_CHARS,
   buildVaultGrantDeniedInbound,
   buildVaultSaveCompletedInbound,
   buildVaultSaveFailedInbound,
@@ -85,6 +87,55 @@ describe('buildVaultGrantApprovedCardText — the [object Object] regression gua
     expect(noFooter.endsWith('(grant `vg_a1b2c3`)')).toBe(true)
   })
 
+  it('renders the reason as a trailing italic clause when provided, before the footer', () => {
+    const text = buildVaultGrantApprovedCardText({
+      ...BASE,
+      reasonEscaped: 'deploy the staging build',
+      footer: '\n_Approver verified by Telegram identity._',
+    })
+    expect(text).toContain('_Reason: deploy the staging build_')
+    // reason clause sits BEFORE the footer (auth-mode note stays last)
+    expect(text.indexOf('_Reason:')).toBeLessThan(text.indexOf('_Approver verified'))
+    // still one clean string
+    const rich = richMessage(text)
+    expect(rich.markdown).toBe(text)
+    expect(rich.markdown).not.toContain('[object Object]')
+  })
+
+  it('omits the reason clause when reason is undefined or empty — no dangling "Reason:" label', () => {
+    const none = buildVaultGrantApprovedCardText(BASE)
+    expect(none).not.toContain('Reason:')
+    expect(none.endsWith('(grant `vg_a1b2c3`)')).toBe(true)
+
+    const empty = buildVaultGrantApprovedCardText({ ...BASE, reasonEscaped: '' })
+    expect(empty).not.toContain('Reason:')
+    expect(empty.endsWith('(grant `vg_a1b2c3`)')).toBe(true)
+  })
+
+  it('reason clause + reason-less both stay clean when combined with a footer', () => {
+    const footer = '\n_Approver verified by Telegram identity._'
+    const withReason = buildVaultGrantApprovedCardText({ ...BASE, reasonEscaped: 'x', footer })
+    expect(withReason.endsWith(footer)).toBe(true)
+    const noReason = buildVaultGrantApprovedCardText({ ...BASE, footer })
+    expect(noReason.endsWith(footer)).toBe(true)
+    expect(noReason).not.toContain('Reason:')
+  })
+
+  it('carries an already-escaped reason verbatim — HTML-special chars stay escaped, no corruption', () => {
+    // The callsite escapes agent-supplied free text with escapeHtmlForTg
+    // BEFORE passing it (same contract as agentEscaped). Simulate that:
+    // `<b> & "co" *_` → escaped form. The builder must not re-corrupt it,
+    // and the single-richMessage wrap must still hold.
+    const escaped = '&lt;b&gt; &amp; drop &amp;&amp; run *_'
+    const text = buildVaultGrantApprovedCardText({ ...BASE, reasonEscaped: escaped })
+    expect(text).toContain(`_Reason: ${escaped}_`)
+    // No raw unescaped angle brackets leaked into the card text.
+    expect(text).not.toContain('<b>')
+    const rich = richMessage(text)
+    expect(rich.markdown).toBe(text)
+    expect(rich.markdown).not.toContain('[object Object]')
+  })
+
   it('DOCUMENTS the original bug: bare-string + richMessage() coerces to [object Object]', () => {
     // Demonstrates why the fix matters — if a future edit reintroduces the
     // "concatenate a string onto the richMessage object" pattern, the result
@@ -94,6 +145,80 @@ describe('buildVaultGrantApprovedCardText — the [object Object] regression gua
   })
 })
 
+describe('normalizeGrantReason — single-line, trimmed, length-capped', () => {
+  it('returns "" for undefined, null, empty, or whitespace-only input (clean no-op)', () => {
+    expect(normalizeGrantReason(undefined)).toBe('')
+    expect(normalizeGrantReason(null)).toBe('')
+    expect(normalizeGrantReason('')).toBe('')
+    expect(normalizeGrantReason('   ')).toBe('')
+    expect(normalizeGrantReason('\n\t  \n')).toBe('')
+  })
+
+  it('collapses newlines and whitespace runs to a single space (protects the _…_ emphasis)', () => {
+    expect(normalizeGrantReason('deploy\nthe   staging\tbuild')).toBe('deploy the staging build')
+    // no newline survives to break the italic clause
+    expect(normalizeGrantReason('a\nb')).not.toContain('\n')
+  })
+
+  it('trims leading/trailing whitespace', () => {
+    expect(normalizeGrantReason('  clone the repo  ')).toBe('clone the repo')
+  })
+
+  it('caps over-long input with a trailing ellipsis, at MAX_GRANT_REASON_CHARS', () => {
+    const long = 'x'.repeat(MAX_GRANT_REASON_CHARS + 50)
+    const out = normalizeGrantReason(long)
+    expect(out.length).toBe(MAX_GRANT_REASON_CHARS)
+    expect(out.endsWith('…')).toBe(true)
+    expect(out.slice(0, -1)).toBe('x'.repeat(MAX_GRANT_REASON_CHARS - 1))
+  })
+
+  it('leaves an at-limit reason untouched (no spurious ellipsis)', () => {
+    const exact = 'y'.repeat(MAX_GRANT_REASON_CHARS)
+    const out = normalizeGrantReason(exact)
+    expect(out).toBe(exact)
+    expect(out.endsWith('…')).toBe(false)
+  })
+
+  it('feeds cleanly through the card builder: whitespace-only → no clause, newline → single-line clause', () => {
+    // whitespace-only normalizes to '' → builder omits the clause
+    const wsCard = buildVaultGrantApprovedCardText({
+      agentEscaped: 'gymbro',
+      scope: 'read',
+      key: 'k',
+      days: 30,
+      grantId: 'vg_x',
+      reasonEscaped: normalizeGrantReason('   ') || undefined,
+    })
+    expect(wsCard).not.toContain('Reason:')
+
+    // newline reason renders as a single-line italic clause, no broken emphasis
+    const nlCard = buildVaultGrantApprovedCardText({
+      agentEscaped: 'gymbro',
+      scope: 'read',
+      key: 'k',
+      days: 30,
+      grantId: 'vg_x',
+      reasonEscaped: normalizeGrantReason('line one\nline two') || undefined,
+    })
+    expect(nlCard).toContain('_Reason: line one line two_')
+    expect(nlCard).not.toContain('\nline two')
+  })
+
+  it('over-long reason renders truncated with ellipsis inside the clause', () => {
+    const reason = normalizeGrantReason('z'.repeat(MAX_GRANT_REASON_CHARS + 100)) || undefined
+    const card = buildVaultGrantApprovedCardText({
+      agentEscaped: 'gymbro',
+      scope: 'read',
+      key: 'k',
+      days: 30,
+      grantId: 'vg_x',
+      reasonEscaped: reason,
+    })
+    expect(card).toContain('…_')
+    expect(card).toContain(`_Reason: ${'z'.repeat(MAX_GRANT_REASON_CHARS - 1)}…_`)
+  })
+})
+
 describe('buildVaultGrantApprovedInbound', () => {
   it('emits the canonical envelope (type, chat_id, user, userId, ts, messageId)', () => {
     const msg = buildVaultGrantApprovedInbound({

package/telegram-plugin/tests/worker-feed-coalesce.test.ts

@@ -768,7 +768,7 @@ describe('renderCombinedWorkerFeed (pure)', () => {
  * authoritative terminal sweep (`terminate`, driven by `onTerminalCleanup`)
  * PLUS a backstop TTL sweep. These assert the OUTCOMES, not the code paths.
  */
-function ghostHarness(opts: { staleWorkerTtlMs?: number; now: () => number }) {
+function ghostHarness(opts: { staleWorkerTtlMs?: number; absoluteRowLifetimeCapMs?: number; now: () => number }) {
   const edits: { messageId: number; text: string }[] = []
   const sends: { text: string }[] = []
   const pins: { messageId: number | null }[] = []
@@ -792,6 +792,7 @@ function ghostHarness(opts: { staleWorkerTtlMs?: number; now: () => number }) {
     setInterval: () => 0,
     clearInterval: () => {},
     staleWorkerTtlMs: opts.staleWorkerTtlMs,
+    absoluteRowLifetimeCapMs: opts.absoluteRowLifetimeCapMs,
     reconcilePin: ({ messageId }) => pins.push({ messageId }),
   })
   return { feed, edits, sends, pins }
@@ -891,6 +892,121 @@ describe('worker-feed ghost-leak — deterministic terminal removal + backstop',
     expect(feed.size).toBe(1)
   })
 
+  // ── ABSOLUTE row-lifetime cap (Carrie 5h zombie pin, v0.18.23) ──────────────
+  // The silence-keyed `staleWorkerTtlMs` backstop is defeated by a leaked row
+  // that never finishes AND keeps receiving `update()` cues every heartbeat:
+  // each cue resets `lastUpdateAt`, so the silence sweep can NEVER match and the
+  // pinned card lives forever (observed: 5h, re-edited 3000+ times). The
+  // absolute cap is anchored to the row's IMMUTABLE creation time, so it reaps
+  // the row regardless of how recently it updated.
+  it('ABSOLUTE cap reaps an immortal-but-UPDATING row that resets lastUpdateAt every tick, then unpins', async () => {
+    let t = 0
+    // Silence TTL huge (would never fire); absolute cap small. The row keeps
+    // updating just under the silence TTL each step, so ONLY the absolute cap
+    // (immune to the lastUpdateAt reset) can catch it.
+    const { feed, edits, pins } = ghostHarness({
+      staleWorkerTtlMs: 1_000_000,
+      absoluteRowLifetimeCapMs: 5000,
+      now: () => t,
+    })
+    await feed.update('z', 'chat', view('zombie task', 's0', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+    expect(pins.at(-1)?.messageId).not.toBeNull()
+
+    // Drive continuous updates past the absolute cap — each resets lastUpdateAt,
+    // so the silence sweep stays defeated (exactly the Carrie failure mode).
+    for (let step = 1; step <= 8; step++) {
+      t = step * 1000
+      await feed.update('z', 'chat', view('zombie task', `s${step}`, t))
+      await drain()
+      feed.heartbeatTick()
+      await drain()
+    }
+    // The absolute cap (5s) has been crossed while the row kept updating →
+    // reaped despite the fresh cues, and the shared card UNPINNED.
+    expect(feed.size).toBe(0)
+    expect(pins.at(-1)?.messageId).toBeNull()
+
+    // Immortality closed for good: the finalized gate blocks a late cue from
+    // resurrecting the row, and further heartbeats produce no edits.
+    await feed.update('z', 'chat', view('zombie task', 's-late', t))
+    await drain()
+    expect(feed.size).toBe(0)
+    const after = edits.length
+    t += 10000
+    feed.heartbeatTick()
+    await drain()
+    expect(edits.length).toBe(after)
+  })
+
+  it('ABSOLUTE cap reaps a row past the cap even when the silence TTL would never fire', async () => {
+    let t = 0
+    const { feed, pins } = ghostHarness({
+      staleWorkerTtlMs: 1_000_000,
+      absoluteRowLifetimeCapMs: 5000,
+      now: () => t,
+    })
+    await feed.update('f', 'chat', view('task f', 's0', 0))
+    await drain()
+    expect(pins.at(-1)?.messageId).not.toBeNull()
+    // Past the absolute cap with no update at all — the age anchor alone reaps.
+    t = 6000
+    feed.heartbeatTick()
+    await drain()
+    expect(feed.size).toBe(0)
+    expect(pins.at(-1)?.messageId).toBeNull()
+  })
+
+  // ── Boot/reconnect purge (Ken's key ask) ───────────────────────────────────
+  // Every tracked row is a dead child sub-agent after a restart/reconnect. On a
+  // bare bridge reconnect the OLD feed's `wk:group:` pins are orphaned — the new
+  // empty feed never knew those groups, so it can never unpin them, and no full-
+  // boot pin sweep runs. `purgeAllOnBoot()` must reconcile the feed to empty AND
+  // release the pin unconditionally.
+  it('purgeAllOnBoot empties a restored running row + pinned card and UNPINS', async () => {
+    let t = 0
+    const { feed, pins } = ghostHarness({ now: () => t })
+    // A running worker with a live pinned card (the "restored at startup" state).
+    await feed.update('p', 'chat', view('task p', 'working', 0))
+    await drain()
+    expect(feed.size).toBe(1)
+    expect(pins.at(-1)?.messageId).not.toBeNull()
+
+    feed.purgeAllOnBoot()
+
+    // Feed reconciled to empty AND the coalesced card unpinned (messageId null).
+    expect(feed.size).toBe(0)
+    expect(pins.at(-1)?.messageId).toBeNull()
+
+    // A late cue on the torn-down feed must NOT resurrect a row (finalized gate).
+    t = 100
+    await feed.update('p', 'chat', view('task p', 'zombie tick', 100))
+    await drain()
+    expect(feed.size).toBe(0)
+  })
+
+  it('purgeAllOnBoot unpins EVERY group (multiple chats) and is a no-op when already empty', async () => {
+    let t = 0
+    const { feed, pins } = ghostHarness({ now: () => t })
+    await feed.update('g1', 'chatA', view('a', 's', 0))
+    await feed.update('g2', 'chatB', view('b', 's', 0))
+    await drain()
+    expect(feed.size).toBe(2)
+
+    const pinsBefore = pins.length
+    feed.purgeAllOnBoot()
+    expect(feed.size).toBe(0)
+    // Both groups emitted a final unpin (messageId null).
+    const unpinsAfter = pins.slice(pinsBefore).filter((p) => p.messageId === null)
+    expect(unpinsAfter.length).toBe(2)
+
+    // Idempotent: a second purge on an empty feed emits no further pin calls.
+    const afterFirst = pins.length
+    feed.purgeAllOnBoot()
+    expect(pins.length).toBe(afterFirst)
+  })
+
   it('no-op re-render is skipped (byte-identical body → no redundant edit)', async () => {
     let t = 0
     const { feed, edits } = ghostHarness({ now: () => t })