switchroom 0.19.19 → 0.19.22

package/telegram-plugin/tests/status-pin-boot-recovery.test.ts

@@ -33,6 +33,7 @@ import {
 import { reconcilePin } from "../status-pin-driver.js";
 import type { PinState, DesiredPin } from "../status-pin.js";
 import { decidePinAction } from "../status-pin.js";
+import { makeFloodWaitActiveError } from "../retry-api-call.js";
 
 const PATH = "/state/agent/telegram/status-pins.json";
 
@@ -182,6 +183,83 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 
+  it("(C) #3664: a never-confirmed unpin (FLOOD_WAIT_ACTIVE) KEEPS the claim + the durable row, and the next boot clears the pin", async () => {
+    // Defect B: the unpin was refused LOCALLY by the send gate, so the message
+    // is provably still pinned. The old driver returned null anyway, which made
+    // reconcileAndPersistStatusPin delete the row and the gateway delete the
+    // in-memory claim — erasing BOTH records of a live pin. Nothing (reaper or
+    // boot sweep) could ever find it again.
+    const { fs } = memFs();
+    const pinned = new Set<string>();
+    let floodOpen = true;
+    const tg = {
+      pinned,
+      api: {
+        pinChatMessage: async (chat_id: string | number, message_id: number) => {
+          pinned.add(`${chat_id}:${message_id}`);
+        },
+        unpinChatMessage: async (chat_id: string | number, message_id: number) => {
+          // The send gate fail-fast: NO request leaves the process.
+          if (floodOpen) throw makeFloodWaitActiveError(16739, Date.now() + 16739_000, null);
+          pinned.delete(`${chat_id}:${message_id}`);
+        },
+      },
+    };
+
+    const gw1 = makeGateway(fs, tg);
+    await gw1.reconcileStatusPin("fg:c:3", "-100123", { pinned: true, messageId: 715 });
+    expect(pinned.has("-100123:715")).toBe(true);
+
+    // Turn ends → unpin requested → refused locally.
+    await gw1.reconcileStatusPin("fg:c:3", "-100123", { pinned: false });
+
+    // The pin is STILL UP …
+    expect(pinned.has("-100123:715")).toBe(true);
+    // … and BOTH records survive: the in-memory claim …
+    expect(gw1.statusPinState.get("fg:c:3")).toEqual({ messageId: 715 });
+    // … and the durable row (what boot cleanup reads).
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "fg:c:3", chatId: "-100123", messageId: 715 },
+    ]);
+
+    // Same session, flood window closed: the retained claim retries and clears.
+    floodOpen = false;
+    await gw1.reconcileStatusPin("fg:c:3", "-100123", { pinned: false });
+    expect(pinned.has("-100123:715")).toBe(false);
+    expect(gw1.statusPinState.has("fg:c:3")).toBe(false);
+    expect(loadStatusPins(PATH, fs)).toEqual([]);
+  });
+
+  it("(D) #3664: if the process dies while the flood window is open, the retained row lets the NEXT boot clear the orphan", async () => {
+    const { fs } = memFs();
+    const pinned = new Set<string>();
+    let floodOpen = true;
+    const tg = {
+      pinned,
+      api: {
+        pinChatMessage: async (chat_id: string | number, message_id: number) => {
+          pinned.add(`${chat_id}:${message_id}`);
+        },
+        unpinChatMessage: async (chat_id: string | number, message_id: number) => {
+          if (floodOpen) throw makeFloodWaitActiveError(16739, Date.now() + 16739_000, null);
+          pinned.delete(`${chat_id}:${message_id}`);
+        },
+      },
+    };
+
+    const gw1 = makeGateway(fs, tg);
+    await gw1.reconcileStatusPin("fg:c:3", "-100123", { pinned: true, messageId: 715 });
+    await gw1.reconcileStatusPin("fg:c:3", "-100123", { pinned: false }); // refused
+    // CRASH here — in-memory state is gone, only the durable row remains.
+
+    floodOpen = false;
+    const gw2 = makeGateway(fs, tg);
+    const res = await gw2.bootCleanup();
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
+    expect(pinned.has("-100123:715")).toBe(false);
+    expect(loadStatusPins(PATH, fs)).toEqual([]);
+  });
+
   it("clean shutdown (sweep DID run) leaves nothing for boot cleanup to do", async () => {
     // Contrast: when the SIGTERM sweep runs (unpin each key), the store is
     // emptied and the pin removed — boot cleanup is a no-op. This guards the
@@ -241,15 +319,15 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
     const lockIdx = lines.findIndex((l) => l.includes("acquireStartupLock({"));
     expect(lockIdx).toBeGreaterThan(-1);
 
-    // Every `void runBootPinCleanupAndDmSweep()` invocation must come AFTER
-    // the acquireStartupLock outcome is available (the boot block the winner
-    // — or the link()-unsupported fallback — reaches).
+    // #3664: the winner ARMS the bot-ready gate rather than dispatching the
+    // sweep inline. Every arm() site must still come AFTER the
+    // acquireStartupLock outcome is available (the boot block the winner — or
+    // the link()-unsupported fallback — reaches).
     const callIdxs = lines
       .map((l, i) => ({ l, i }))
       .filter(
         ({ l }) =>
-          /void runBootPinCleanupAndDmSweep\(\)/.test(l) &&
-          !l.trimStart().startsWith("//"),
+          /bootPinSweepGate\.arm\(\)/.test(l) && !l.trimStart().startsWith("//"),
       )
       .map(({ i }) => i);
     expect(callIdxs.length).toBeGreaterThan(0);
@@ -257,15 +335,17 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
       expect(idx).toBeGreaterThan(lockIdx);
     }
 
-    // statusPinBootCleanup() itself must only ever be invoked from INSIDE
-    // that orchestrator — never at a bare post-import call site that a
-    // losing double-boot could reach.
+    // statusPinBootCleanup itself must only ever be REACHED from INSIDE that
+    // orchestrator — never at a bare post-import call site that a losing
+    // double-boot could reach. Since the #3664 S2 salvage the orchestrator
+    // hands it to runBootPinSweepSteps BY REFERENCE (per-step isolation), so
+    // the step binding counts as a reach, not just a `()` call.
     const declIdx = lines.findIndex((l) =>
       /async function statusPinBootCleanup/.test(l),
     );
     expect(declIdx).toBeGreaterThan(-1);
     const orchestratorIdx = lines.findIndex((l) =>
-      /async function runBootPinCleanupAndDmSweep/.test(l),
+      /function runBootPinCleanupAndDmSweep/.test(l),
     );
     expect(orchestratorIdx).toBeGreaterThan(-1);
     const invocationIdxs = lines
@@ -273,7 +353,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
       .filter(
         ({ l, i }) =>
           i !== declIdx &&
-          /statusPinBootCleanup\(\)/.test(l) &&
+          /statusPinBootCleanup\(\)|:\s*statusPinBootCleanup,/.test(l) &&
           !l.trimStart().startsWith("//") &&
           !l.includes("statusPinBootCleanup() is deliberately NOT"),
       )
@@ -292,7 +372,10 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
     expect(blockedIdx).toBeGreaterThan(-1);
     const afterBlocked = gatewaySrc.slice(blockedIdx);
     const exitIdx = afterBlocked.indexOf("process.exit(1)");
-    const cleanupIdx = afterBlocked.indexOf("void runBootPinCleanupAndDmSweep()");
+    // #3664: the winner now ARMS a two-condition gate instead of dispatching
+    // the sweep inline (the sweep also needs `lockedBot`), so the marker for
+    // "the winner's cleanup path" is the arm() call.
+    const cleanupIdx = afterBlocked.indexOf("bootPinSweepGate.arm()");
     expect(exitIdx).toBeGreaterThan(-1);
     expect(cleanupIdx).toBeGreaterThan(-1);
     // The exit for the blocked branch appears before the winner's cleanup call.

package/telegram-plugin/tests/status-pin.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import { GrammyError } from 'grammy'
-import { decidePinAction, isPinRightsError, PinRightsCache } from '../status-pin.js'
+import { decidePinAction, isPinRightsError, isUnpinTerminalError, PinRightsCache } from '../status-pin.js'
+import { makeFloodWaitActiveError, GIVE_UP_MESSAGE } from '../retry-api-call.js'
 import { reconcilePin, type PinBotApi } from '../status-pin-driver.js'
 import type { PinState } from '../status-pin.js'
 
@@ -88,9 +89,18 @@ describe('reconcilePin (driver)', () => {
     expect(calls).toEqual([{ verb: 'unpin', messageId: 42 }])
   })
 
-  it('CRITICAL: drops the claim even when unpinChatMessage throws', async () => {
+  it('CRITICAL: drops the claim on a TERMINAL unpin failure — never stays stuck pinned', async () => {
+    // A 400 means the call REACHED Telegram and was rejected for a reason that
+    // cannot change on retry (message gone / rights). Dropping is correct.
     const errors: string[] = []
-    const { api, calls } = fakeApi({ unpinThrows: true })
+    const calls: { verb: string; messageId: number }[] = []
+    const api: PinBotApi = {
+      pinChatMessage: async () => {},
+      unpinChatMessage: async (_chat, message_id) => {
+        calls.push({ verb: 'unpin', messageId: message_id })
+        throw grammyError(400, 'Bad Request: message to unpin not found')
+      },
+    }
     const next = await reconcilePin({
       api,
       chatId: '123',
@@ -98,12 +108,75 @@ describe('reconcilePin (driver)', () => {
       desired: { pinned: false },
       onError: (phase) => errors.push(phase),
     })
-    // State MUST be cleared even though the API threw — never stay stuck pinned.
     expect(next).toBeNull()
     expect(calls).toEqual([{ verb: 'unpin', messageId: 42 }])
     expect(errors).toEqual(['unpin'])
   })
 
+  it('#3664 Defect B: a FLOOD_WAIT_ACTIVE unpin failure RETAINS the claim (no API call was made)', async () => {
+    // FLOOD_WAIT_ACTIVE is a purely LOCAL fail-fast: the send gate refused to
+    // issue the call, so the message is provably STILL PINNED. Dropping the
+    // claim here erased the in-memory claim AND the durable store row, leaving
+    // an orphan nothing could ever find again.
+    const errors: string[] = []
+    const prev: PinState = { messageId: 42 }
+    const next = await reconcilePin({
+      api: {
+        pinChatMessage: async () => {},
+        unpinChatMessage: async () => {
+          throw makeFloodWaitActiveError(16739, Date.now() + 16739_000, null)
+        },
+      },
+      chatId: '123',
+      prevState: prev,
+      desired: { pinned: false },
+      onError: (phase) => errors.push(phase),
+    })
+    // The claim SURVIVES so the next reconcile / reaper / boot sweep retries.
+    expect(next).toEqual({ messageId: 42 })
+    expect(errors).toEqual(['unpin'])
+  })
+
+  it('#3664 Defect B: retains the claim on a never-confirmed transport failure (retries exhausted / network / 5xx)', async () => {
+    for (const err of [
+      new Error(GIVE_UP_MESSAGE),
+      new Error('fetch failed'),
+      grammyError(500, 'Internal Server Error'),
+    ]) {
+      const next = await reconcilePin({
+        api: {
+          pinChatMessage: async () => {},
+          unpinChatMessage: async () => {
+            throw err
+          },
+        },
+        chatId: '123',
+        prevState: { messageId: 42 },
+        desired: { pinned: false },
+      })
+      expect(next).toEqual({ messageId: 42 })
+    }
+  })
+
+  it('#3664 Defect B: a retained claim retries the unpin and clears once it lands', async () => {
+    let attempts = 0
+    const api: PinBotApi = {
+      pinChatMessage: async () => {},
+      unpinChatMessage: async () => {
+        attempts += 1
+        if (attempts === 1) throw makeFloodWaitActiveError(300, Date.now() + 300_000, null)
+      },
+    }
+    const common = { api, chatId: '123', desired: { pinned: false } as const }
+
+    const first = await reconcilePin({ ...common, prevState: { messageId: 42 } })
+    expect(first).toEqual({ messageId: 42 }) // retained
+
+    const second = await reconcilePin({ ...common, prevState: first })
+    expect(second).toBeNull() // flood window closed; unpin landed; claim cleared
+    expect(attempts).toBe(2)
+  })
+
   it('does NOT claim a message whose pin failed (retries next reconcile)', async () => {
     const errors: string[] = []
     const { api } = fakeApi({ pinThrows: true })
@@ -423,7 +496,7 @@ describe('reconcilePin — rights-aware negative cache (#3024)', () => {
     }
 
     const first = await reconcilePin({ ...common, prevState: { messageId: 21 } })
-    expect(first).toBeNull() // claim dropped regardless (drop-on-unpin contract)
+    expect(first).toBeNull() // rights 400 is TERMINAL — claim dropped (#3664)
     expect(unpinCalls).toBe(1) // it did try once
     expect(disabled).toEqual(['-1009000000007']) // logged exactly once
     expect(unpinFails).toEqual([]) // NOT routed through per-attempt onError
@@ -474,3 +547,31 @@ describe('reconcilePin — rights-aware negative cache (#3024)', () => {
     }
   })
 })
+
+describe('isUnpinTerminalError (#3664 Defect B classifier)', () => {
+  it('treats a stable 4xx as terminal — Telegram answered, retrying cannot help', () => {
+    expect(isUnpinTerminalError(grammyError(400, 'Bad Request: message to unpin not found'))).toBe(true)
+    expect(isUnpinTerminalError(grammyError(400, 'Bad Request: chat not found'))).toBe(true)
+    expect(isUnpinTerminalError(grammyError(403, 'Forbidden: bot was kicked'))).toBe(true)
+    expect(
+      isUnpinTerminalError(
+        grammyError(400, 'Bad Request: not enough rights to manage pinned messages in the chat'),
+      ),
+    ).toBe(true)
+  })
+
+  it('treats FLOOD_WAIT_ACTIVE as NON-terminal even though it carries the 429 duck-type shape', () => {
+    const err = makeFloodWaitActiveError(16739, Date.now() + 16739_000, null)
+    expect(err.error_code).toBe(429) // the shape other cooldown gates duck-type on
+    expect(isUnpinTerminalError(err)).toBe(false)
+  })
+
+  it('treats transport failures as NON-terminal (the unpin may never have landed)', () => {
+    expect(isUnpinTerminalError(new Error(GIVE_UP_MESSAGE))).toBe(false)
+    expect(isUnpinTerminalError(new Error('fetch failed'))).toBe(false)
+    expect(isUnpinTerminalError(grammyError(500, 'Internal Server Error'))).toBe(false)
+    expect(isUnpinTerminalError(grammyError(429, 'Too Many Requests'))).toBe(false)
+    expect(isUnpinTerminalError(undefined)).toBe(false)
+    expect(isUnpinTerminalError('boom')).toBe(false)
+  })
+})