switchroom 0.19.0 → 0.19.2

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -7,10 +7,13 @@ import {
   pinnedMessageIsOurs,
   reconcileAndPersistStatusPin,
   runStatusPinBootCleanup,
+  withPinReconcileLock,
   type PersistedStatusPin,
   type StatusPinStoreFsSeam,
   type TrackedStatusPin,
 } from "../gateway/status-pin-store.js";
+import { decidePinAction, type PinState, type DesiredPin } from "../status-pin.js";
+import { reconcilePin, type PinBotApi } from "../status-pin-driver.js";
 
 /** In-memory fs seam with an atomic rename, so the store's tmp→rename
  *  crash-safety contract is exercised without touching the real disk. */
@@ -718,4 +721,199 @@ describe("reconcileAndPersistStatusPin — persist-before-pin ordering", () => {
     expect(next).toBeNull();
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
+
+  // F1 (invisible-worker-cards review): a `clear` op is emitted for BOTH a real
+  // unpin AND a `noop: already pinned`. For a noop, reconcilePin issues NO
+  // Telegram call and returns the LIVE claim (non-null). The pre-fix clear
+  // branch dropped the row unconditionally, so the worker feed's per-edit
+  // syncPin (every steady-state edit maps to a noop-clear) erased the durable
+  // row for a still-live pin — a crash after that left a stuck pinned card boot
+  // cleanup could never see. The row MUST be preserved when applyPin returns a
+  // live claim.
+  it("clear op with a LIVE claim (noop-already-pinned) PRESERVES the durable row", async () => {
+    const { fs, calls } = memFs();
+    persistStatusPins(PATH, fs, [pin({ pinKey: "wk:group:g1", messageId: 715 })]);
+    const before = calls.length;
+    // applyPin returns the live claim unchanged (what reconcilePin does on noop).
+    const next = await reconcileAndPersistStatusPin({
+      path: PATH,
+      fs,
+      pinKey: "wk:group:g1",
+      chatId: "-100123",
+      op: { kind: "clear" },
+      applyPin: async () => ({ messageId: 715 }),
+      log: () => {},
+    });
+    expect(next).toEqual({ messageId: 715 });
+    // Row survives (rewritten confirmed, no `pending`).
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "wk:group:g1", chatId: "-100123", messageId: 715 },
+    ]);
+    // Sanity: at least one disk write happened (the confirm rewrite) — the fix
+    // does not skip persistence, it changes the CONTENT from delete to upsert.
+    expect(calls.length).toBeGreaterThan(before);
+  });
+
+  it("repeated steady-state noop-clears keep the row present across many edits", async () => {
+    const { fs } = memFs();
+    persistStatusPins(PATH, fs, [pin({ pinKey: "wk:group:g1", messageId: 715 })]);
+    for (let i = 0; i < 5; i++) {
+      await reconcileAndPersistStatusPin({
+        path: PATH,
+        fs,
+        pinKey: "wk:group:g1",
+        chatId: "-100123",
+        op: { kind: "clear" },
+        applyPin: async () => ({ messageId: 715 }),
+        log: () => {},
+      });
+    }
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "wk:group:g1", chatId: "-100123", messageId: 715 },
+    ]);
+  });
+});
+
+/**
+ * F2 (invisible-worker-cards review): the gateway's status-pin reconcile reads
+ * its `prev` claim from an in-memory map at the top of the reconcile, then
+ * awaits. Two overlapping reconciles for ONE key with OPPOSITE desires could
+ * both capture a stale `prev` → a turn-end `{pinned:false}` clears the durable
+ * row while a flood-delayed open-pin lands, leaving a stuck pin with no row.
+ *
+ * These tests exercise the REAL fix primitives — `withPinReconcileLock` +
+ * `reconcileAndPersistStatusPin` + `reconcilePin` + `decidePinAction` — composed
+ * exactly as the gateway wires them (read prev INSIDE the per-key lock), and
+ * prove the row survives. The `noLock` control models the pre-fix ordering
+ * (prev read OUTSIDE the lock) and shows it regresses — so the lock, not luck,
+ * is what fixes it.
+ */
+describe("status-pin-store — F2 per-key reconcile serialization", () => {
+  // A gateway-faithful reconcile: an in-memory claim map (the `prev` source read
+  // at the TOP of the reconcile), the real decide→op mapping, and
+  // reconcileAndPersistStatusPin driving reconcilePin against a call-counting
+  // pin API. An optional gate lets a test hold ONE reconcile's applyPin open to
+  // force the exact interleave. `serialize` toggles the F2 fix.
+  function makeReconciler(fs: StatusPinStoreFsSeam, opts: { serialize: boolean }) {
+    const claims = new Map<string, PinState>();
+    const pinCalls: number[] = [];
+    const unpinCalls: number[] = [];
+    const api: PinBotApi = {
+      pinChatMessage: async (_c, id) => {
+        pinCalls.push(id);
+      },
+      unpinChatMessage: async (_c, id) => {
+        unpinCalls.push(id);
+      },
+    };
+    async function core(
+      pinKey: string,
+      chatId: string,
+      desired: DesiredPin,
+      gate?: Promise<void>,
+    ) {
+      const prev = claims.get(pinKey) ?? null; // read BEFORE the store op (the F2 window)
+      const action = decidePinAction(prev, desired);
+      const op =
+        action.kind === "pin"
+          ? ({ kind: "pin", messageId: action.messageId } as const)
+          : ({ kind: "clear" } as const);
+      const next = await reconcileAndPersistStatusPin({
+        path: PATH,
+        fs,
+        pinKey,
+        chatId,
+        op,
+        applyPin: async () => {
+          if (gate) await gate; // hold the pin open inside the store lock
+          return reconcilePin({ api, chatId, prevState: prev, desired });
+        },
+        log: () => {},
+      });
+      if (next == null) claims.delete(pinKey);
+      else claims.set(pinKey, next);
+    }
+    function reconcile(
+      pinKey: string,
+      chatId: string,
+      desired: DesiredPin,
+      gate?: Promise<void>,
+    ) {
+      return opts.serialize
+        ? withPinReconcileLock(pinKey, () => core(pinKey, chatId, desired, gate))
+        : core(pinKey, chatId, desired, gate);
+    }
+    return { reconcile, claims, pinCalls, unpinCalls };
+  }
+
+  // The exact review sequence: a flood-delayed OPEN-pin (A) is in-flight inside
+  // the store lock; a turn-end UNPIN (B) starts during A's await window and
+  // reads prev=null (A has not set the claim yet). Pre-fix, B's clear then drops
+  // the disk row A wrote — stranding a live in-memory claim with NO durable row.
+  async function runStrandingSequence(serialize: boolean) {
+    const { fs } = memFs();
+    const r = makeReconciler(fs, { serialize });
+    let releaseA!: () => void;
+    const gateA = new Promise<void>((res) => {
+      releaseA = res;
+    });
+    // A: open-pin 900, held open at applyPin.
+    const aDone = r.reconcile("fg:c:3", "-100123", { pinned: true, messageId: 900 }, gateA);
+    // Let A reach its applyPin await (pending row on disk; claim NOT yet set).
+    await Promise.resolve();
+    await Promise.resolve();
+    // B: turn-end unpin, starts now — reads prev from the in-memory claim map.
+    const bDone = r.reconcile("fg:c:3", "-100123", { pinned: false });
+    await Promise.resolve();
+    releaseA();
+    await Promise.all([aDone, bDone]);
+    return { fs, claims: r.claims, unpinCalls: r.unpinCalls, pinCalls: r.pinCalls };
+  }
+
+  it("serialized: turn-end unpin waits for the in-flight open-pin, so the pinned message is genuinely UNPINNED (not stranded)", async () => {
+    const { fs, claims, pinCalls, unpinCalls } = await runStrandingSequence(true);
+    const rows = loadStatusPins(PATH, fs);
+    // Under serialization B runs only after A fully settles, so B reads
+    // prev={900}, issues a REAL unpin of the pinned message, and clears the row
+    // and claim together. The Telegram pin is cleaned up — nothing stuck.
+    expect(pinCalls).toEqual([900]); // A pinned it
+    expect(unpinCalls).toEqual([900]); // B unpinned it (the fix)
+    expect(rows).toEqual([]);
+    expect(claims.get("fg:c:3") ?? null).toBeNull();
+  });
+
+  it("pre-fix control (no per-key lock): the same interleave STRANDS the pinned message — pinned, row cleared, NEVER unpinned", async () => {
+    const { fs, unpinCalls, pinCalls } = await runStrandingSequence(false);
+    const rows = loadStatusPins(PATH, fs);
+    // Reproduces the F2 defect the lock removes: B read prev=null during A's
+    // await window, so its clear was a NO-OP unpin (issued no Telegram unpin)
+    // yet still dropped the durable row A wrote — while A's pin call landed. The
+    // message 900 stays pinned on Telegram with NO durable row and no unpin ever
+    // issued → stuck until a boot cleanup that can no longer see it.
+    expect(pinCalls).toEqual([900]); // message 900 WAS pinned
+    expect(unpinCalls).toEqual([]); // …but never unpinned (no-op clear on prev=null)
+    expect(rows).toEqual([]); // …and the durable row is gone → unreapable
+  });
+
+  it("serialized steady-state noop reconciles add ZERO pin/unpin API calls (finn-flood guard)", async () => {
+    const { fs } = memFs();
+    const r = makeReconciler(fs, { serialize: true });
+    // First open pins exactly once.
+    await r.reconcile("wk:group:g1", "-100123", { pinned: true, messageId: 900 });
+    expect(r.pinCalls).toEqual([900]);
+    expect(r.unpinCalls).toEqual([]);
+
+    // 20 steady-state edits — each a re-pin of the SAME id → decidePinAction
+    // noop → reconcilePin issues NO Telegram call. The serialization + F1
+    // row-preservation must not add a single pin/unpin API call.
+    for (let i = 0; i < 20; i++) {
+      await r.reconcile("wk:group:g1", "-100123", { pinned: true, messageId: 900 });
+    }
+    expect(r.pinCalls).toEqual([900]); // still exactly one pin, ever
+    expect(r.unpinCalls).toEqual([]); // never unpinned
+    // The durable row is intact throughout (F1).
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "wk:group:g1", chatId: "-100123", messageId: 900 },
+    ]);
+  });
 });

package/telegram-plugin/tests/subagent-tracker-hooks.test.ts

@@ -147,6 +147,56 @@ describe('subagent-tracker-pretool', () => {
     expect(row?.model ?? null).toBeNull()
   })
 
+  // F3 (progress-card fork model): a fork dispatch inherits the parent's model
+  // and IGNORES tool_input.model, so seeding the row's first-paint model from
+  // that ignored override made the worker card show a WRONG model (e.g. "sonnet"
+  // while the fork runs Opus) until the transcript overwrote it. The seed must
+  // be suppressed for forks — model stays NULL and the card omits it until the
+  // watcher records the real model from the fork's own transcript.
+  it('leaves model null for a FORK dispatch even when tool_input.model is set (F3)', () => {
+    const event = {
+      session_id: 'sess-fork',
+      tool_name: 'Agent',
+      tool_use_id: 'toolu_fork001',
+      tool_input: {
+        subagent_type: 'fork',
+        description: 'Fork the session',
+        run_in_background: true,
+        model: 'sonnet', // override a fork ignores — must NOT be persisted
+      },
+    }
+    const result = runHook(PRETOOL_SCRIPT, event)
+    expect(result.status).toBe(0)
+
+    const db = openDb()
+    const row = db.prepare('SELECT model FROM subagents WHERE id = ?').get('toolu_fork001') as
+      | { model: string | null }
+      | undefined
+    expect(row?.model ?? null).toBeNull()
+  })
+
+  it('still persists tool_input.model for a NON-fork dispatch (fork suppression is scoped)', () => {
+    const event = {
+      session_id: 'sess-nonfork',
+      tool_name: 'Agent',
+      tool_use_id: 'toolu_nonfork001',
+      tool_input: {
+        subagent_type: 'researcher',
+        description: 'Research with a pinned model',
+        run_in_background: true,
+        model: 'claude-opus-4-8',
+      },
+    }
+    const result = runHook(PRETOOL_SCRIPT, event)
+    expect(result.status).toBe(0)
+
+    const db = openDb()
+    const row = db.prepare('SELECT model FROM subagents WHERE id = ?').get('toolu_nonfork001') as
+      | { model: string | null }
+      | undefined
+    expect(row?.model).toBe('claude-opus-4-8')
+  })
+
   it('does not write a row when tool_name is not Agent', () => {
     const event = {
       session_id: 'sess-abc123',

package/telegram-plugin/tests/usage-footer-freshness.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Adversarial-review F1 + F2 — the /usage card must NEVER stamp "Live" when
+ * no account row carries usable live data.
+ *
+ * Root cause (F1): the gateway `/usage` handler decided the freshness footer
+ * from `probeResp.results.length > 0`. But opProbeQuota
+ * (src/auth/broker/server.ts) returns `{result:{ok:false}, served:"live"}`
+ * for a failed live probe against an EMPTY cache — a non-empty results array
+ * where every row is `ok:false`. `zipProbeResults` only marks
+ * `served==="cache"` rows stale, so those failed rows carry no cache stamp
+ * either. Result: on a fresh restart (empty cache) + a transient probe
+ * failure, every row rendered "⚠️ no data — probe failed" UNDER a false
+ * "Live · refreshed 0s ago" stamp.
+ *
+ * F2 (test gap): the footer decision had zero coverage. This drives the
+ * extracted decision (`deriveUsageFooterFreshness`) composed with the real
+ * card renderer (`renderUsageCard`) with an all-`ok:false`, no-cache broker
+ * stub and asserts the rendered footer is NOT "Live" — i.e. it would fail
+ * against the pre-fix `.length > 0` gate.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  deriveUsageFooterFreshness,
+  type AccountSnapshot,
+  type ProbeQuotaResultRow,
+} from '../auth-snapshot-format.js'
+import { renderUsageCard } from '../quota-bar-format.js'
+
+const NOW = new Date('2026-07-19T12:00:00Z')
+
+// Two accounts, no usable quota (the probe failed, nothing cached) — mirrors
+// what the gateway hands renderUsageCard when the broker cache is empty and
+// the live probe threw for every account.
+const NO_DATA_SNAPSHOTS: AccountSnapshot[] = [
+  { label: 'alice@example.com', isActive: true, quota: null, quotaError: 'probe failed' },
+  { label: 'bob@example.com', isActive: false, quota: null, quotaError: 'probe failed' },
+]
+
+// A broker probe-quota response where every row failed and nothing was served
+// from cache — the exact shape opProbeQuota returns for a failed live probe
+// against an empty cache.
+const ALL_FAILED_NO_CACHE: ProbeQuotaResultRow[] = [
+  { label: 'alice@example.com', result: { ok: false, reason: 'network error' }, served: 'live' },
+  { label: 'bob@example.com', result: { ok: false, reason: 'network error' }, served: 'live' },
+]
+
+const EXHAUSTED = new Map<string, boolean>()
+
+describe('deriveUsageFooterFreshness (F1)', () => {
+  it('flags probeFailed when every row is ok:false and there is no cache', () => {
+    const opts = deriveUsageFooterFreshness(ALL_FAILED_NO_CACHE, undefined, NOW.getTime())
+    // Would have been { liveProbedAtMs } under the old `.length > 0` gate.
+    expect(opts).toEqual({ probeFailed: true })
+    expect(opts.liveProbedAtMs).toBeUndefined()
+  })
+
+  it('stamps liveProbedAtMs when at least one row carries usable data', () => {
+    const rows: ProbeQuotaResultRow[] = [
+      ALL_FAILED_NO_CACHE[0],
+      {
+        label: 'bob@example.com',
+        result: {
+          ok: true,
+          data: {
+            fiveHourUtilizationPct: 12,
+            sevenDayUtilizationPct: 34,
+            fiveHourResetAt: null,
+            sevenDayResetAt: null,
+            representativeClaim: null,
+            overageStatus: null,
+            overageDisabledReason: null,
+            fiveHourUtilPresent: true,
+            sevenDayUtilPresent: true,
+          },
+        },
+        served: 'live',
+      },
+    ]
+    const opts = deriveUsageFooterFreshness(rows, undefined, NOW.getTime())
+    expect(opts).toEqual({ liveProbedAtMs: NOW.getTime() })
+    expect(opts.probeFailed).toBeUndefined()
+  })
+
+  it('gives cache-served data precedence over both live and failed', () => {
+    const capturedAt = NOW.getTime() - 60_000
+    expect(deriveUsageFooterFreshness(ALL_FAILED_NO_CACHE, capturedAt, NOW.getTime())).toEqual({
+      staleCachedAtMs: capturedAt,
+    })
+  })
+
+  it('flags probeFailed for a totally empty results array', () => {
+    expect(deriveUsageFooterFreshness([], undefined, NOW.getTime())).toEqual({ probeFailed: true })
+  })
+})
+
+describe('/usage card footer end-to-end (F2)', () => {
+  it('renders "probe failed", NOT "Live", when no row carries live data', () => {
+    const freshness = deriveUsageFooterFreshness(ALL_FAILED_NO_CACHE, undefined, NOW.getTime())
+    const card = renderUsageCard(NO_DATA_SNAPSHOTS, EXHAUSTED, { now: NOW, ...freshness })
+    expect(card).toContain('probe failed — no live data')
+    // The honesty invariant: no "Live" stamp when every row shows no data.
+    expect(card).not.toContain('Live')
+    // And the rows themselves are the no-data warning, not a fake 0% bar.
+    expect(card).toContain('no data — probe failed')
+  })
+
+  it('renders a "Live" footer when a row carries usable data', () => {
+    const liveSnapshots: AccountSnapshot[] = [
+      {
+        label: 'bob@example.com',
+        isActive: true,
+        quota: {
+          fiveHourUtilizationPct: 12,
+          sevenDayUtilizationPct: 34,
+          fiveHourResetAt: null,
+          sevenDayResetAt: null,
+          representativeClaim: null,
+          overageStatus: null,
+          overageDisabledReason: null,
+          fiveHourUtilPresent: true,
+          sevenDayUtilPresent: true,
+        },
+      },
+    ]
+    const freshness = deriveUsageFooterFreshness(
+      [
+        {
+          label: 'bob@example.com',
+          result: { ok: true, data: liveSnapshots[0].quota! },
+          served: 'live',
+        },
+      ],
+      undefined,
+      NOW.getTime(),
+    )
+    const card = renderUsageCard(liveSnapshots, EXHAUSTED, { now: NOW, ...freshness })
+    expect(card).toContain('Live · refreshed')
+    expect(card).not.toContain('probe failed')
+  })
+})

package/telegram-plugin/tests/usage-mask.test.ts

@@ -0,0 +1,35 @@
+/**
+ * Adversarial-review F4 — `/usage` account-label masking policy.
+ *
+ * A group with an empty `allowFrom` authorizes every member, so the quota
+ * card would leak per-account email labels to a broadly shared group unless
+ * masked. `shouldMaskUsageLabels` (gateway/usage-mask.ts) is the pure
+ * decision the gateway feeds into the existing demo-mask machinery.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { shouldMaskUsageLabels } from '../gateway/usage-mask.js'
+
+describe('shouldMaskUsageLabels (F4)', () => {
+  it('never masks in a private (operator DM) chat', () => {
+    expect(shouldMaskUsageLabels('private', undefined)).toBe(false)
+    expect(shouldMaskUsageLabels('private', [])).toBe(false)
+    expect(shouldMaskUsageLabels('private', ['123'])).toBe(false)
+  })
+
+  it('masks in a group with an EMPTY allowFrom (open membership)', () => {
+    expect(shouldMaskUsageLabels('group', [])).toBe(true)
+    expect(shouldMaskUsageLabels('group', undefined)).toBe(true)
+    expect(shouldMaskUsageLabels('supergroup', [])).toBe(true)
+  })
+
+  it('does NOT mask in a group with a curated non-empty allowFrom', () => {
+    expect(shouldMaskUsageLabels('group', ['123'])).toBe(false)
+    expect(shouldMaskUsageLabels('supergroup', ['123', '456'])).toBe(false)
+  })
+
+  it('masks defensively for any other chat type reaching a quota render', () => {
+    expect(shouldMaskUsageLabels('channel', undefined)).toBe(true)
+    expect(shouldMaskUsageLabels(undefined, undefined)).toBe(true)
+  })
+})

package/telegram-plugin/tests/worker-feed-dispatch.test.ts

@@ -72,6 +72,33 @@ describe('resolveWorkerFeedDispatch (#2002 regression pin)', () => {
     expect(resolveWorkerFeedDispatch(null, 'sub-agent').feedModel).toBeNull()
     expect(resolveWorkerFeedDispatch(makeSub({ model: null }), 'sub-agent').feedModel).toBeNull()
   })
+
+  // F3 (progress-card fork model) — outcome coverage. The dispatch-time seed is
+  // suppressed for forks at the hook (subagent-tracker-pretool.mjs), so a fork
+  // row carries model=null and the card omits the model until the watcher writes
+  // the transcript model. resolveWorkerFeedDispatch simply surfaces the row's
+  // CURRENT model, so these assert the feed-level outcomes on top of that.
+  it('(b) a fork row carries no dispatch-time model → feedModel null (card omits it until transcript)', () => {
+    // What the hook now writes for a fork dispatch: agent_type 'fork', model null
+    // (the ignored override is not persisted).
+    const forkRow = makeSub({ background: true, agent_type: 'fork', model: null })
+    expect(resolveWorkerFeedDispatch(forkRow, 'sub-agent').feedModel).toBeNull()
+  })
+
+  it('(a) once the watcher overwrites the row model from the transcript, feedModel reflects the transcript model', () => {
+    // Transcript wins: the watcher (recordSubagentModel) overwrites the row's
+    // model column in place, so the resolved feedModel is the transcript value —
+    // even for a fork that started with model=null.
+    const afterTranscript = makeSub({ background: true, agent_type: 'fork', model: 'claude-opus-4-8' })
+    expect(resolveWorkerFeedDispatch(afterTranscript, 'sub-agent').feedModel).toBe('claude-opus-4-8')
+  })
+
+  it('(c) a mid-run model switch is reflected: feedModel tracks the row’s latest recorded model', () => {
+    // The watcher writes model-on-change; the row holds the LATEST model, so a
+    // later substantive tick resolves the switched-to model.
+    const switchedTo = makeSub({ background: true, model: 'sr-glm-5' })
+    expect(resolveWorkerFeedDispatch(switchedTo, 'sub-agent').feedModel).toBe('sr-glm-5')
+  })
 })
 
 describe('gateway onFinish — fix #1: resultText-driven handback fallback (model)', () => {

package/telegram-plugin/tests/worker-feed-pin-persistence.test.ts

@@ -5,7 +5,12 @@ import {
   type BotApiForWorkerFeed,
 } from '../worker-activity-feed.js'
 import { reconcilePin, type PinBotApi } from '../status-pin-driver.js'
-import type { PinState, DesiredPin } from '../status-pin.js'
+import { decidePinAction, type PinState, type DesiredPin } from '../status-pin.js'
+import {
+  reconcileAndPersistStatusPin,
+  loadStatusPins,
+  type StatusPinStoreFsSeam,
+} from '../gateway/status-pin-store.js'
 
 /**
  * Outcome tests for the invisible-worker-cards fix (2026-07-15).
@@ -119,6 +124,131 @@ async function flush(): Promise<void> {
   for (let i = 0; i < 8; i++) await new Promise((r) => setImmediate(r))
 }
 
+/** In-memory fs seam with atomic rename, mirroring status-pin-store.test.ts. */
+function memFs(): { fs: StatusPinStoreFsSeam; files: Map<string, string> } {
+  const files = new Map<string, string>()
+  const fs: StatusPinStoreFsSeam = {
+    readFileSync: (p) => {
+      if (!files.has(p)) throw new Error(`ENOENT ${p}`)
+      return files.get(p)!
+    },
+    writeFileSync: (p, d) => {
+      files.set(p, d)
+    },
+    renameSync: (a, b) => {
+      if (!files.has(a)) throw new Error(`ENOENT ${a}`)
+      files.set(b, files.get(a)!)
+      files.delete(a)
+    },
+    existsSync: (p) => files.has(p),
+  }
+  return { fs, files }
+}
+
+/**
+ * A pin harness that routes the feed's `reconcilePin` hook through the REAL
+ * persistence path (`reconcileAndPersistStatusPin`) against a memFs-backed
+ * status-pins.json — exactly as the gateway wires it: read prev claim → decide
+ * → map to a persist op → reconcileAndPersistStatusPin(applyPin=reconcilePin).
+ * This lets a test INSPECT THE FILE across steady-state edits (F1).
+ */
+function makePersistingPinHarness(path: string) {
+  const { fs } = memFs()
+  const claims = new Map<string, PinState>()
+  const pinCalls: number[] = []
+  const unpinCalls: number[] = []
+  const api: PinBotApi = {
+    pinChatMessage: async (_c, id) => {
+      pinCalls.push(id)
+    },
+    unpinChatMessage: async (_c, id) => {
+      unpinCalls.push(id)
+    },
+  }
+  async function reconcile(key: string, chatId: string, desired: DesiredPin): Promise<void> {
+    const prev = claims.get(key) ?? null
+    const action = decidePinAction(prev, desired)
+    const op = action.kind === 'pin'
+      ? ({ kind: 'pin', messageId: action.messageId } as const)
+      : ({ kind: 'clear' } as const)
+    const next = await reconcileAndPersistStatusPin({
+      path,
+      fs,
+      pinKey: key,
+      chatId,
+      op,
+      applyPin: () => reconcilePin({ api, chatId, prevState: prev, desired }),
+      log: () => {},
+    })
+    if (next == null) claims.delete(key)
+    else claims.set(key, next)
+  }
+  const reconcilePinFn = (args: {
+    feedKey: string
+    chatId: string
+    threadId?: number
+    messageId: number | null
+  }): void => {
+    const key = `wk:group:${args.feedKey}`
+    if (args.messageId != null) void reconcile(key, args.chatId, { pinned: true, messageId: args.messageId })
+    else void reconcile(key, args.chatId, { pinned: false })
+  }
+  return {
+    reconcilePinFn,
+    fs,
+    pinCalls,
+    unpinCalls,
+    rows: () => loadStatusPins(path, fs),
+  }
+}
+
+describe('worker-feed pin persistence — durable status-pins.json survives steady-state edits (F1)', () => {
+  const PATH = '/state/agent/telegram/status-pins.json'
+
+  it('preserves the wk:group row across many steady-state edits (noop-clear must NOT delete it)', async () => {
+    const bot = makeFakeBot()
+    const pin = makePersistingPinHarness(PATH)
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    // First paint → message posted, pinned once, durable row written.
+    clock = 1000
+    await feed.update('w1', 'chat', view({ elapsedMs: 1000, toolCount: 1 }))
+    await flush()
+    const msgId = bot.sent[0].messageId
+    expect(pin.pinCalls).toEqual([msgId])
+    expect(pin.rows()).toHaveLength(1)
+    const pinKey = pin.rows()[0].pinKey
+    expect(pinKey).toMatch(/^wk:group:/)
+    expect(pin.rows()).toEqual([
+      { pinKey, chatId: 'chat', messageId: msgId },
+    ])
+
+    // Many steady-state edits — the feed calls syncPin on EVERY edit, each a
+    // re-pin of the SAME id → noop → a `clear` op with a LIVE claim. Pre-fix the
+    // clear branch deleted the durable row here; the fix preserves it.
+    for (let i = 2; i <= 8; i++) {
+      clock = i * 1000
+      await feed.update('w1', 'chat', view({ elapsedMs: i * 1000, toolCount: i }))
+      await flush()
+    }
+
+    // The durable row is STILL on disk (inspect the file), and no extra pin/
+    // unpin API call was issued across all those steady-state edits.
+    expect(pin.rows()).toEqual([
+      { pinKey, chatId: 'chat', messageId: msgId },
+    ])
+    expect(pin.pinCalls).toEqual([msgId]) // exactly one pin, ever
+    expect(pin.unpinCalls).toEqual([]) // never unpinned
+  })
+})
+
 describe('worker-feed pin persistence — steady-state re-pin (invisible-worker-cards)', () => {
   it('re-pins on a steady-state edit when the claim was lost, and does NOT re-pin when already correct (no storm)', async () => {
     const bot = makeFakeBot()