switchroom 0.19.19 → 0.19.23

package/telegram-plugin/tests/backstop-delivery.test.ts

@@ -10,6 +10,7 @@ import {
 } from '../gateway/backstop-delivery.js'
 import {
   backstopSendOutcomeGated,
+  buildTurnRecord,
   finalizeBackstopSendGated,
   computeTurnStatus,
 } from '../gateway/turn-record-status.js'
@@ -348,25 +349,29 @@ describe('#3278 runBackstopDelivery — read-back drives the delivery outcome',
     expect(ledger.hasConfirmedChunk('#drop', 0)).toBe(true)
   })
 
-  it('429/ambiguous probe ⇒ NOT re-sent, stays landed-unconfirmed, delivered=false', async () => {
+  it('429/ambiguous probe ⇒ NOT re-sent, stays landed-unconfirmed, still DELIVERED', async () => {
     const ledger = new BackstopDeliveryLedger()
     const sendChunk = vi.fn(async () => [950])
     const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
     const res = await runBackstopDelivery(ledger, '#amb', ['answer'], null, { sendChunk, readBack }, 3)
     expect(sendChunk).toHaveBeenCalledTimes(1) // never re-sent on ambiguous
-    expect(res.delivered).toBe(false)
-    expect(res.exhausted).toBe(true)
+    // An inconclusive probe establishes nothing, so the landed-id evidence
+    // stands: the answer IS in the chat and the turn is not a failure.
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false) // landed-unconfirmed, honestly reported
+    expect(res.exhausted).toBe(false)
     expect(ledger.hasConfirmedChunk('#amb', 0)).toBe(false)
     expect(ledger.landedUnconfirmedIndices('#amb', 1)).toEqual([0]) // still landed-unconfirmed
   })
 
-  it('a read-back adapter THAT THROWS is treated as ambiguous — never re-sent', async () => {
+  it('a read-back adapter THAT THROWS is ambiguous — never re-sent, never a failure', async () => {
     const ledger = new BackstopDeliveryLedger()
     const sendChunk = vi.fn(async () => [951])
     const readBack = vi.fn(async () => { throw new Error('boom') })
     const res = await runBackstopDelivery(ledger, '#throw', ['answer'], null, { sendChunk, readBack }, 3)
     expect(sendChunk).toHaveBeenCalledTimes(1)
-    expect(res.delivered).toBe(false)
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false)
   })
 
   it('#3278 CORE: API-ack fresh id but read-back ABSENT ⇒ send_failed, NOT complete', async () => {
@@ -403,15 +408,207 @@ describe('#3278 runBackstopDelivery — read-back drives the delivery outcome',
     expect(ledger.hasConfirmedChunk('#noprobe', 0)).toBe(true)
   })
 
-  it('partial: chunk 0 confirmed, chunk 1 ambiguous ⇒ delivered=false, chunk 0 not re-sent', async () => {
+  it('partial: chunk 0 confirmed, chunk 1 ambiguous ⇒ both landed ⇒ delivered, chunk 0 not re-sent', async () => {
     const ledger = new BackstopDeliveryLedger()
     const calls: number[] = []
     const sendChunk = vi.fn(async (i: number) => { calls.push(i); return [700 + i] })
     const readBack = vi.fn(async (i: number): Promise<ReadBackResult> => (i === 0 ? 'exists' : 'ambiguous'))
     const res = await runBackstopDelivery(ledger, '#part', ['c0', 'c1'], null, { sendChunk, readBack }, 3)
-    expect(res.delivered).toBe(false)
+    expect(res.delivered).toBe(true) // every chunk landed a fresh id
+    expect(res.confirmed).toBe(false) // ...but chunk 1 was never corroborated
     expect(calls.filter(i => i === 0)).toHaveLength(1) // confirmed chunk never re-sent
     expect(ledger.hasConfirmedChunk('#part', 0)).toBe(true)
     expect(ledger.hasConfirmedChunk('#part', 1)).toBe(false)
   })
+
+  // ── The measurement bug this PR fixes ────────────────────────────────────
+  //
+  // The probe is issued at cosmetic priority in the same millisecond as the
+  // send it probes, so the per-chat token bucket (1/sec, just consumed by that
+  // very send) sheds it: in production it resolved `ambiguous` 146 times in two
+  // weeks and `absent` ZERO times. Under the old confirmation-gated verdict each
+  // of those became `delivered:false` → `send_failed` on a turn whose answer the
+  // user had received, plus an error reaction and a still-OPEN obligation.
+  it('AMBIGUOUS probe ⇒ turn record `complete`, NOT send_failed (the fixed bug)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 500
+    const sendChunk = vi.fn(async () => [971]) // a fresh, non-card chat id
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#shed', ['answer'], cardId, { sendChunk, readBack }, 3)
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: cardId,
+    })
+    expect(computeTurnStatus(turn)).toBe('complete')
+  })
+
+  it('an ambiguous probe on a CARD-ONLY delivery is still send_failed (guard 7 holds)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 501
+    // The only id that landed IS the progress card — swept ~60-90s later, so
+    // the user receives nothing. Ambiguity must not rescue this.
+    const sendChunk = vi.fn(async () => [cardId])
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#cardonly', ['answer'], cardId, { sendChunk, readBack }, 3)
+    expect(res.delivered).toBe(false)
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: cardId,
+    })
+    expect(computeTurnStatus(turn)).toBe('send_failed')
+  })
+
+  it('an ambiguous probe on a chunk that never landed is still NOT delivered', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    // chunk 0 lands; chunk 1 throws on every attempt → never landed.
+    const sendChunk = vi.fn(async (i: number) => {
+      if (i === 1) throw new Error('flood')
+      return [800 + i]
+    })
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#gap', ['c0', 'c1'], null, { sendChunk, readBack }, 2)
+    expect(res.delivered).toBe(false)
+    expect(res.exhausted).toBe(true)
+  })
+
+  // Mixed sequence: the two probe states that MOVE the verdict, composed in one
+  // run. Chunk 0's first send is silently discarded (`absent` ⇒ demote ⇒
+  // re-send) and the probe on the RE-SEND is shed (`ambiguous`). Under the old
+  // confirmation-gated verdict the re-sent chunk was never `landed-confirmed`,
+  // so the whole turn came out `delivered:false` — a `send_failed` for an answer
+  // that had just been successfully re-sent. Demote-and-re-send and
+  // ambiguity-is-not-failure must compose.
+  it('absent ⇒ demote ⇒ re-send, then AMBIGUOUS on the re-send ⇒ delivered, sent exactly twice', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    let sends = 0
+    const sendChunk = vi.fn(async () => { sends++; return [990 + sends] })
+    let probes = 0
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => {
+      probes++
+      return probes === 1 ? 'absent' : 'ambiguous'
+    })
+    const res = await runBackstopDelivery(ledger, '#mixed', ['answer'], null, { sendChunk, readBack }, 3)
+    expect(sendChunk).toHaveBeenCalledTimes(2) // initial + exactly one re-send
+    expect(readBack).toHaveBeenCalledTimes(2) // probed once per landing
+    expect(res.delivered).toBe(true) // the re-send landed a fresh id; ambiguity proves nothing
+    expect(res.confirmed).toBe(false) // ...and is honestly reported as uncorroborated
+    expect(res.sentIds).toEqual([992]) // the demoted first id is gone; the re-send's id stands
+    expect(res.landedUnconfirmedIds).toEqual([992])
+    // The outcome the user actually experiences: a `complete` turn record.
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: null,
+    })
+    expect(computeTurnStatus(turn)).toBe('complete')
+  })
+})
+
+// ── The observability of the new optimism (#3702 L2/L5/L6a) ─────────────────
+//
+// Counting an inconclusive probe as delivered is a BET. These pin the two
+// artifacts that let the fleet find out if it is ever wrong: the per-delivery
+// stderr line, and the `landed_unconfirmed` field on the turns.jsonl row.
+describe('#3702 landed-unconfirmed is MEASURED, not silently assumed', () => {
+  it('a delivered-but-unconfirmed turn writes the diagnostic stderr line', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const lines: string[] = []
+    const res = await runBackstopDelivery(
+      ledger, '#obs', ['answer'], null,
+      {
+        sendChunk: async () => [1001],
+        readBack: async (): Promise<ReadBackResult> => 'ambiguous',
+        stderr: (s) => lines.push(s),
+      },
+      3,
+    )
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false)
+    const diag = lines.filter(l => l.includes('backstop delivery landed-unconfirmed'))
+    expect(diag).toHaveLength(1)
+    expect(diag[0]).toContain('#obs')
+    expect(diag[0]).toContain('1 of 1 landed id(s)') // the measured quantity, not just a warning
+  })
+
+  it('a fully CONFIRMED delivery writes NO landed-unconfirmed line (no false alarm)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const lines: string[] = []
+    const res = await runBackstopDelivery(
+      ledger, '#conf', ['answer'], null,
+      {
+        sendChunk: async () => [1002],
+        readBack: async (): Promise<ReadBackResult> => 'exists',
+        stderr: (s) => lines.push(s),
+      },
+      3,
+    )
+    expect(res.confirmed).toBe(true)
+    expect(res.landedUnconfirmedIds).toEqual([])
+    expect(lines.filter(l => l.includes('backstop delivery landed-unconfirmed'))).toHaveLength(0)
+  })
+
+  it('landedUnconfirmedIds is exactly the uncorroborated subset of sentIds', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    // chunk 0 confirmed, chunk 1 landed-unconfirmed (shed probe).
+    const res = await runBackstopDelivery(
+      ledger, '#subset', ['c0', 'c1'], null,
+      {
+        sendChunk: async (i: number) => [1100 + i],
+        readBack: async (i: number): Promise<ReadBackResult> => (i === 0 ? 'exists' : 'ambiguous'),
+      },
+      3,
+    )
+    expect(res.sentIds).toEqual([1100, 1101])
+    expect(res.landedUnconfirmedIds).toEqual([1101]) // c0 is corroborated; c1 is the bet
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false)
+  })
+
+  it('the count reaches turns.jsonl: a complete turn carries `landed_unconfirmed`', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const res = await runBackstopDelivery(
+      ledger, '#row', ['c0', 'c1'], null,
+      {
+        sendChunk: async (i: number) => [1200 + i],
+        readBack: async (): Promise<ReadBackResult> => 'ambiguous',
+      },
+      3,
+    )
+    const turn = {
+      agent: 'test-agent',
+      startedAt: 1_000_000,
+      toolCallCount: 0,
+      turnId: '#row',
+      finalAnswerDelivered: true,
+      deliveryOutcome: 'delivered' as const,
+      landedUnconfirmed: res.landedUnconfirmedIds.length,
+    }
+    const row = buildTurnRecord(turn, 1_002_000)
+    // The status is honest AND the bet is visible on the same row — that pairing
+    // is the point: a `complete` we could not corroborate is countable.
+    expect(row.status).toBe('complete')
+    expect(row.landed_unconfirmed).toBe(2)
+  })
+
+  it('an ordinary confirmed turn omits the field entirely (row shape unchanged)', () => {
+    const row = buildTurnRecord(
+      {
+        agent: 'test-agent',
+        startedAt: 1_000_000,
+        toolCallCount: 0,
+        turnId: '#plain',
+        finalAnswerDelivered: true,
+        deliveryOutcome: 'delivered',
+        landedUnconfirmed: 0,
+      },
+      1_002_000,
+    )
+    expect(row.status).toBe('complete')
+    expect('landed_unconfirmed' in row).toBe(false)
+  })
 })

package/telegram-plugin/tests/backstop-readback-probe.test.ts

@@ -141,4 +141,16 @@ describe('#3278 createBackstopReadBack — full gate+edit+classify wiring', () =
     const readBack = createBackstopReadBack(wiring({ gate, editMessageText }))
     expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
   })
+
+  test('gate NO-OP drop (resolves undefined) ⇒ ambiguous, NOT a false exists', async () => {
+    // The gate's edit path drops a repeat of the last payload it actually sent
+    // (`counters.dropped`) and drops an expired queue entry, resolving
+    // `undefined` in both cases. Nothing reached Telegram, so nothing was
+    // proven — classifying it `exists` would fabricate a confirmation from a
+    // call that never happened.
+    const gate = vi.fn(async () => undefined)
+    const editMessageText = vi.fn(async () => true)
+    const readBack = createBackstopReadBack(wiring({ gate, editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
+  })
 })

package/telegram-plugin/tests/boot-pin-sweep-wiring.test.ts

@@ -0,0 +1,101 @@
+/**
+ * Boot pin sweep WIRING fence (#3664 Defect A).
+ *
+ * The behaviour lives in `boot-sweep-gate.test.ts`; this file pins the gateway
+ * WIRING, because the regression was a wiring regression: `caa4d7568` (#3310)
+ * moved the `lockedBot` assignment into `initGatewayBot()` and left the sweep's
+ * kick-off at module-eval time. `tsc` stayed green (the `!` definite-assignment
+ * assertion on `lockedBot` suppresses the error) and no test noticed, so every
+ * boot-cleanup unpin threw `undefined is not an object` for a month.
+ *
+ * These are STRUCTURAL assertions (the gateway module can't be instantiated
+ * in-process — same pattern as silence-liveness-wiring.test.ts) that fail if a
+ * future refactor re-introduces a module-eval-time dispatch of the sweep.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
+
+describe('boot pin sweep wiring (#3664)', () => {
+  it('never dispatches runBootPinCleanupAndDmSweep() directly — only through the gate', () => {
+    // The original bug shape, verbatim: a fire-and-forget call at module-eval
+    // time. Any direct invocation (voided or awaited) bypasses the bot-ready
+    // half of the precondition.
+    const directCalls =
+      gatewaySrc.match(/(?<!function\s)(?<![.\w])runBootPinCleanupAndDmSweep\s*\(/g) ?? []
+    expect(directCalls).toEqual([])
+  })
+
+  it('passes the sweep to the gate as a reference, and arms it at both mutex sites', () => {
+    expect(gatewaySrc).toContain('createBootSweepGate({ run: runBootPinCleanupAndDmSweep')
+    // Both startup-lock outcomes (mutex acquired, and the non-atomic
+    // writePidFile fallback) arm — neither may dispatch on its own.
+    const armSites = gatewaySrc.match(/bootPinSweepGate\.arm\(\)/g) ?? []
+    expect(armSites.length).toBe(2)
+  })
+
+  it('signals botReady() only from initGatewayBot, AFTER lockedBot is assigned', () => {
+    const readySites = gatewaySrc.match(/bootPinSweepGate\.botReady\(\)/g) ?? []
+    expect(readySites.length).toBe(1)
+
+    const initStart = gatewaySrc.indexOf('async function initGatewayBot()')
+    const assignIdx = gatewaySrc.indexOf('lockedBot = chatLock.wrapBot(')
+    const readyIdx = gatewaySrc.indexOf('bootPinSweepGate.botReady()')
+    expect(initStart).toBeGreaterThan(-1)
+    expect(assignIdx).toBeGreaterThan(initStart)
+    expect(readyIdx).toBeGreaterThan(assignIdx)
+  })
+
+  it('runs the sweep steps through runBootPinSweepSteps, not a bare await chain', () => {
+    // Salvage S2. The BEHAVIOUR (a throwing step must not strand the steps
+    // behind it, and must never strand the DM-eligibility flip) is proven in
+    // boot-sweep-gate.test.ts. This fence is what makes that proof apply to the
+    // gateway: the reapers must reach the runner as injected steps, and nothing
+    // may reintroduce the bare sequential chain that skipped the isolation.
+    expect(gatewaySrc).toContain('return runBootPinSweepSteps({')
+    const stepFns = ['statusPinBootCleanup', 'activityCardBootReaper', 'queuedCardBootReaper']
+    for (const stepFn of stepFns) {
+      // Passed BY REFERENCE as a step, never invoked inline in the sweep.
+      expect(gatewaySrc).toContain(`: ${stepFn},`)
+      const inlineAwaits = gatewaySrc.match(new RegExp(`await\\s+${stepFn}\\s*\\(`, 'g')) ?? []
+      expect(inlineAwaits).toEqual([])
+    }
+    // The DM-eligibility flip is what a throw used to strand, so it must live
+    // INSIDE the enableDmSweep step callback — not as a statement sequenced
+    // after the reapers, where one rejection skips it for the whole session.
+    const lines = gatewaySrc.split('\n')
+    const flipIdxs = lines
+      .map((l, i) => ({ l, i }))
+      .filter(({ l }) => /^\s*dmPinSweepEligible = true\s*$/.test(l))
+      .map(({ i }) => i)
+    expect(flipIdxs.length).toBe(1)
+    expect(lines[flipIdxs[0] - 1]).toContain('enableDmSweep: () => {')
+  })
+
+  it('routes the pin API through the asserting seam, never a raw lockedBot.api pin', () => {
+    // Salvage S1/S3: `statusPinApi()` must build on `createStatusPinApi`, which
+    // asserts the bot exists and converts a send-gate SHED into a throw. A
+    // hand-rolled `robustApiCall(() => lockedBot.api.pinChatMessage(...))`
+    // anywhere in the gateway would bypass both invariants.
+    expect(gatewaySrc).toContain('return createStatusPinApi(')
+    // Every `status-pin.*` verb is now issued from status-pin-api.ts. A raw
+    // `robustApiCall(() => lockedBot.api.unpinChatMessage(…), { verb:
+    // 'status-pin.unpin' })` reappearing here would be a driver call that
+    // skips assertBotReady + assertLanded.
+    const statusPinVerbs = gatewaySrc.match(/verb:\s*['"`]status-pin\.(?:un)?pin['"`]/g) ?? []
+    expect(statusPinVerbs).toEqual([])
+  })
+
+  it('arms only from inside the startup-mutex block, never at bare module scope', () => {
+    // Every arm() site must be indented (i.e. nested inside the
+    // `if (isGatewayMain) { … }` startup-lock block), never a top-level
+    // statement that would run unconditionally on import.
+    for (const line of gatewaySrc.split('\n')) {
+      if (line.includes('bootPinSweepGate.arm()')) {
+        expect(line.startsWith(' ')).toBe(true)
+      }
+    }
+  })
+})

package/telegram-plugin/tests/boot-sweep-gate.test.ts

@@ -0,0 +1,293 @@
+/**
+ * boot-sweep-gate — the deterministic ordering fence for #3664 Defect A.
+ *
+ * The regression these assertions exist to catch: the boot orphan sweep was
+ * dispatched the moment the gateway won the startup mutex, which happens at
+ * module-eval time — thousands of lines before `initGatewayBot()` assigns
+ * `lockedBot`. Every boot-cleanup unpin therefore threw
+ * `undefined is not an object (evaluating 'lockedBot.api')` before reaching
+ * Telegram (14/14 fleet-wide failures since #3310, zero clean successes).
+ *
+ * The behavioural assertion is "arming ALONE must not dispatch the sweep" —
+ * a test that would have failed on the original bug shape.
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  createBootSweepGate,
+  runBootPinSweepSteps,
+  type BootPinSweepSteps,
+} from '../gateway/boot-sweep-gate.js'
+
+/** A fake sweep that records whether it ran and what the bot handle looked
+ *  like at that moment — the thing the original bug got wrong. */
+function fakeSweep() {
+  const observed: (string | undefined)[] = []
+  let bot: string | undefined
+  return {
+    run: async () => {
+      observed.push(bot)
+    },
+    setBot: (b: string) => {
+      bot = b
+    },
+    get observed() {
+      return observed
+    },
+  }
+}
+
+describe('createBootSweepGate (#3664 Defect A)', () => {
+  it('does NOT dispatch on arm() alone — the bot handle does not exist yet', async () => {
+    const sweep = fakeSweep()
+    const gate = createBootSweepGate({ run: sweep.run })
+
+    gate.arm()
+    await Promise.resolve()
+
+    expect(gate.hasRun()).toBe(false)
+    expect(sweep.observed).toEqual([])
+  })
+
+  it('does NOT dispatch on botReady() alone — this boot may not own the pin state', async () => {
+    const sweep = fakeSweep()
+    const gate = createBootSweepGate({ run: sweep.run })
+
+    gate.botReady()
+    await Promise.resolve()
+
+    expect(gate.hasRun()).toBe(false)
+    expect(sweep.observed).toEqual([])
+  })
+
+  it('dispatches once BOTH signals arrive, and the bot handle is live when it does', async () => {
+    const sweep = fakeSweep()
+    const gate = createBootSweepGate({ run: sweep.run })
+
+    gate.arm() // startup mutex won (module-eval time)
+    await Promise.resolve()
+    expect(sweep.observed).toEqual([])
+
+    sweep.setBot('lockedBot') // initGatewayBot() assigns lockedBot …
+    gate.botReady() // … and signals the gate
+    await Promise.resolve()
+
+    // The sweep ran, and it saw a live bot handle — never `undefined`.
+    expect(sweep.observed).toEqual(['lockedBot'])
+    expect(gate.hasRun()).toBe(true)
+  })
+
+  it('is order-independent: botReady() before arm() still dispatches exactly once', async () => {
+    const sweep = fakeSweep()
+    const gate = createBootSweepGate({ run: sweep.run })
+
+    sweep.setBot('lockedBot')
+    gate.botReady()
+    await Promise.resolve()
+    expect(sweep.observed).toEqual([])
+
+    gate.arm()
+    await Promise.resolve()
+    expect(sweep.observed).toEqual(['lockedBot'])
+  })
+
+  it('dispatches at most once however many times the signals repeat', async () => {
+    const sweep = fakeSweep()
+    const gate = createBootSweepGate({ run: sweep.run })
+
+    sweep.setBot('lockedBot')
+    gate.arm()
+    gate.botReady()
+    gate.arm() // e.g. the mutex path AND the mutex-fallback path
+    gate.botReady()
+    await Promise.resolve()
+
+    expect(sweep.observed).toEqual(['lockedBot'])
+  })
+
+  it('routes a rejecting sweep to onError instead of leaking an unhandled rejection', async () => {
+    const rejections: unknown[] = []
+    const onUnhandled = (err: unknown) => rejections.push(err)
+    process.on('unhandledRejection', onUnhandled)
+    try {
+      const errs: unknown[] = []
+      const gate = createBootSweepGate({
+        run: async () => {
+          throw new Error('boom')
+        },
+        onError: (err) => errs.push(err),
+      })
+
+      gate.arm()
+      gate.botReady()
+      await new Promise((r) => setTimeout(r, 10))
+
+      expect((errs[0] as Error).message).toBe('boom')
+      expect(rejections).toEqual([])
+    } finally {
+      process.off('unhandledRejection', onUnhandled)
+    }
+  })
+})
+
+/**
+ * Per-step isolation (#3664 salvage S2).
+ *
+ * The steps used to be a bare sequential `await` chain in gateway.ts. A throw
+ * from either card reaper skipped `dmPinSweepEligible = true`, which authorises
+ * the DM unpin-all path for the WHOLE SESSION — so one throwing reaper silently
+ * disabled DM stale-pin cleanup, including every later lazy first-inbound
+ * sweep. That became newly reachable the moment #3664 made the sweep actually
+ * run for the first time.
+ *
+ * The outcome asserted is "was the DM path enabled and were the DM chats
+ * swept", not "was a wrapper called".
+ */
+describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
+  function deps(over: Partial<BootPinSweepSteps> = {}) {
+    const order: string[] = []
+    const logs: string[] = []
+    const base: BootPinSweepSteps = {
+      scanDmChatIds: () => {
+        order.push('scan')
+        return ['12345']
+      },
+      statusPinCleanup: async () => {
+        order.push('status-pins')
+      },
+      activityCardReaper: async () => {
+        order.push('activity-cards')
+      },
+      queuedCardReaper: async () => {
+        order.push('queued-cards')
+      },
+      enableDmSweep: () => order.push('enable-dm'),
+      sweepDm: async (id) => {
+        order.push(`dm:${id}`)
+      },
+      log: (l) => logs.push(l),
+    }
+    return { order, logs, deps: { ...base, ...over } }
+  }
+
+  it('runs the store scan first, then the reapers, then enables + runs the DM sweep', async () => {
+    const d = deps()
+    await runBootPinSweepSteps(d.deps)
+    expect(d.order).toEqual([
+      'scan',
+      'status-pins',
+      'activity-cards',
+      'queued-cards',
+      'enable-dm',
+      'dm:12345',
+    ])
+  })
+
+  it('a throwing reaper does not strand the steps behind it', async () => {
+    const d = deps({
+      activityCardReaper: async () => {
+        throw new Error('boom')
+      },
+    })
+    await runBootPinSweepSteps(d.deps)
+    // The DM path is still enabled and the recorded DM chat is still swept.
+    expect(d.order).toEqual(['scan', 'status-pins', 'queued-cards', 'enable-dm', 'dm:12345'])
+    expect(d.logs.join('')).toContain("step 'activity-card-reaper' failed: boom")
+  })
+
+  it('enables the DM sweep even when EVERY earlier step throws', async () => {
+    const boom = async () => {
+      throw new Error('boom')
+    }
+    const d = deps({
+      statusPinCleanup: boom,
+      activityCardReaper: boom,
+      queuedCardReaper: boom,
+    })
+    await runBootPinSweepSteps(d.deps)
+    expect(d.order).toEqual(['scan', 'enable-dm', 'dm:12345'])
+  })
+
+  it('a failing store scan still lets the reapers and the DM enable run', async () => {
+    const d = deps({
+      scanDmChatIds: () => {
+        throw new Error('ENOENT')
+      },
+    })
+    await runBootPinSweepSteps(d.deps)
+    // No DM ids to sweep, but nothing behind the scan is stranded.
+    expect(d.order).toEqual(['status-pins', 'activity-cards', 'queued-cards', 'enable-dm'])
+    expect(d.logs.join('')).toContain("step 'dm-chat-scan' failed: ENOENT")
+  })
+
+  it('one failing DM chat does not block the next one', async () => {
+    const swept: string[] = []
+    const d = deps({
+      scanDmChatIds: () => ['1', '2'],
+      sweepDm: async (id) => {
+        if (id === '1') throw new Error('kicked')
+        swept.push(id)
+      },
+    })
+    await runBootPinSweepSteps(d.deps)
+    expect(swept).toEqual(['2'])
+  })
+
+  it('logs a non-Error throw honestly instead of "undefined"', async () => {
+    const d = deps({
+      queuedCardReaper: async () => {
+        // A non-Error throw: `(err as Error).message` would log "undefined".
+        throw 'not an Error'
+      },
+    })
+    await runBootPinSweepSteps(d.deps)
+    expect(d.logs.join('')).toContain("step 'queued-card-reaper' failed: not an Error")
+    expect(d.logs.join('')).not.toContain('failed: undefined')
+  })
+
+  it('survives a log sink that itself throws', async () => {
+    // stderr can be gone on a dying process; the one function whose job is
+    // "a step must not take the sweep down" must not take the sweep down.
+    const order: string[] = []
+    await expect(
+      runBootPinSweepSteps({
+        scanDmChatIds: () => [],
+        statusPinCleanup: async () => {
+          throw new Error('boom')
+        },
+        activityCardReaper: async () => {
+          order.push('activity-cards')
+        },
+        queuedCardReaper: async () => {
+          order.push('queued-cards')
+        },
+        enableDmSweep: () => order.push('enable-dm'),
+        sweepDm: async () => {},
+        log: () => {
+          throw new Error('EPIPE')
+        },
+      }),
+    ).resolves.toBeUndefined()
+    expect(order).toEqual(['activity-cards', 'queued-cards', 'enable-dm'])
+  })
+
+  it('never rejects — the caller fire-and-forgets it', async () => {
+    const boom = async () => {
+      throw new Error('boom')
+    }
+    await expect(
+      runBootPinSweepSteps({
+        scanDmChatIds: () => {
+          throw new Error('boom')
+        },
+        statusPinCleanup: boom,
+        activityCardReaper: boom,
+        queuedCardReaper: boom,
+        enableDmSweep: () => {
+          throw new Error('boom')
+        },
+        sweepDm: boom,
+        log: () => {},
+      }),
+    ).resolves.toBeUndefined()
+  })
+})