switchroom 0.19.25 → 0.19.26

package/telegram-plugin/tests/status-pin-retarget.test.ts

@@ -0,0 +1,216 @@
+import { describe, it, expect } from "vitest";
+import { runStatusPinReconcile } from "../gateway/status-pin-retarget.js";
+import type { DesiredPin, PinState } from "../status-pin.js";
+
+/**
+ * The orchestrator the gateway's `reconcileStatusPinInner` delegates to.
+ *
+ * The defect it closes: a RETARGET (the caller wants a DIFFERENT message pinned
+ * for a key it already holds a claim on) used to be reported as a bare `unpin`
+ * and stopped there, on the assumption a later reconcile would pin the new
+ * message. The FOREGROUND activity card reconciles `fg:<statusKey>` exactly
+ * once (narrative-lane.ts, the `activityMessageId == null` OPEN branch), so an
+ * ack-first mid-turn reopen left the live card unpinned for the rest of the
+ * turn AND deleted the durable row, putting it out of reach of both the
+ * mid-session reaper and the next boot's sweep.
+ *
+ * These tests drive the module with a fake leg runner and assert the LEG
+ * SEQUENCE — the thing that was wrong — plus the registry bookkeeping.
+ */
+
+/** Records every leg and returns a scripted outcome for it. */
+function legRecorder(outcomes: Array<PinState | null>) {
+  const legs: Array<{ from: PinState | null; want: DesiredPin }> = [];
+  let i = 0;
+  const runPin = async (from: PinState | null, want: DesiredPin) => {
+    legs.push({ from, want });
+    const out = outcomes[i];
+    i += 1;
+    return out ?? null;
+  };
+  return { legs, runPin };
+}
+
+function registries(seed?: { key: string; state: PinState; chatId: string; at: number }) {
+  const r = {
+    state: new Map<string, PinState>(),
+    chatIds: new Map<string, string>(),
+    pinnedAt: new Map<string, number>(),
+  };
+  if (seed) {
+    r.state.set(seed.key, seed.state);
+    r.chatIds.set(seed.key, seed.chatId);
+    r.pinnedAt.set(seed.key, seed.at);
+  }
+  return r;
+}
+
+const KEY = "fg:c:7";
+const CHAT = "-100123";
+
+describe("runStatusPinReconcile — RETARGET", () => {
+  it("runs BOTH legs: unpins the stale claim, then pins the new message", async () => {
+    const { legs, runPin } = legRecorder([null, { messageId: 901 }]);
+    const reg = registries({ key: KEY, state: { messageId: 900 }, chatId: CHAT, at: 1000 });
+
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+
+    // The pre-fix behaviour was legs === [unpin] and nothing pinned.
+    expect(legs).toEqual([
+      { from: { messageId: 900 }, want: { pinned: false } },
+      { from: null, want: { pinned: true, messageId: 901 } },
+    ]);
+    expect(reg.state.get(KEY)).toEqual({ messageId: 901 });
+    expect(reg.chatIds.get(KEY)).toBe(CHAT);
+  });
+
+  it("leg 2 starts from a NULL claim, so it decides a real `pin` (not a noop)", async () => {
+    const { legs, runPin } = legRecorder([null, { messageId: 901 }]);
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      registries: registries(),
+    });
+    expect(legs[1].from).toBeNull();
+  });
+
+  it("re-stamps pinnedAt for the NEW card, so the reaper ages the live message", async () => {
+    const { runPin } = legRecorder([null, { messageId: 901 }]);
+    const reg = registries({ key: KEY, state: { messageId: 900 }, chatId: CHAT, at: 1000 });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+    // Leg 1 cleared the claim (dropping the old stamp), leg 2 took a fresh one.
+    expect(reg.pinnedAt.get(KEY)).toBeGreaterThan(1000);
+  });
+
+  it("NEVER-CONFIRMED unpin (#3664 Defect B): SKIPS the pin leg and retains the OLD claim", async () => {
+    // A non-null leg-1 result means reconcilePin deliberately kept the claim —
+    // the old message is provably still pinned. Pinning the new one now would
+    // leave TWO pins in the chat with a durable record of one.
+    const { legs, runPin } = legRecorder([{ messageId: 900 }]);
+    const reg = registries({ key: KEY, state: { messageId: 900 }, chatId: CHAT, at: 1000 });
+
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+
+    expect(legs).toHaveLength(1);
+    expect(reg.state.get(KEY)).toEqual({ messageId: 900 });
+    expect(reg.chatIds.get(KEY)).toBe(CHAT);
+    expect(reg.pinnedAt.get(KEY)).toBe(1000); // original age preserved for the TTL gate
+  });
+
+  it("a FAILED pin leg drops the claim entirely (nothing is pinned, nothing is tracked)", async () => {
+    // reconcilePin returns its `from` on a failed pin — here `null`.
+    const { runPin } = legRecorder([null, null]);
+    const reg = registries({ key: KEY, state: { messageId: 900 }, chatId: CHAT, at: 1000 });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+    expect(reg.state.has(KEY)).toBe(false);
+    expect(reg.chatIds.has(KEY)).toBe(false);
+    expect(reg.pinnedAt.has(KEY)).toBe(false);
+  });
+});
+
+describe("runStatusPinReconcile — single-leg actions are unchanged", () => {
+  it("first pin: one leg, claim + chat + age recorded", async () => {
+    const { legs, runPin } = legRecorder([{ messageId: 900 }]);
+    const reg = registries();
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: null,
+      desired: { pinned: true, messageId: 900 },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+    expect(legs).toEqual([{ from: null, want: { pinned: true, messageId: 900 } }]);
+    expect(reg.state.get(KEY)).toEqual({ messageId: 900 });
+    expect(reg.pinnedAt.has(KEY)).toBe(true);
+  });
+
+  it("turn-end unpin: one leg, all three registries cleared", async () => {
+    const { legs, runPin } = legRecorder([null]);
+    const reg = registries({ key: KEY, state: { messageId: 900 }, chatId: CHAT, at: 1000 });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: false },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+    expect(legs).toEqual([{ from: { messageId: 900 }, want: { pinned: false } }]);
+    expect(reg.state.has(KEY)).toBe(false);
+    expect(reg.chatIds.has(KEY)).toBe(false);
+    expect(reg.pinnedAt.has(KEY)).toBe(false);
+  });
+
+  it("steady-state re-pin of the SAME id: still one leg, and the ORIGINAL age is kept", async () => {
+    // 20 edits/turn each re-drive this; the reaper's TTL must measure from the
+    // first pin, not be reset by every edit.
+    const { legs, runPin } = legRecorder([{ messageId: 900 }]);
+    const reg = registries({ key: KEY, state: { messageId: 900 }, chatId: CHAT, at: 1000 });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 900 },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+    expect(legs).toHaveLength(1);
+    expect(reg.pinnedAt.get(KEY)).toBe(1000);
+  });
+
+  it("unpin with no claim: one no-op leg, registries stay empty", async () => {
+    const { legs, runPin } = legRecorder([null]);
+    const reg = registries();
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: null,
+      desired: { pinned: false },
+      persist: null,
+      runPin,
+      registries: reg,
+    });
+    expect(legs).toHaveLength(1);
+    expect(reg.state.size).toBe(0);
+  });
+});

package/telegram-plugin/tests/status-pin-shutdown-wiring.test.ts

@@ -0,0 +1,94 @@
+/**
+ * Status-pin SHUTDOWN + REAPER-DISPATCH wiring fence.
+ *
+ * Both defects here are wiring defects, and gateway.ts cannot be instantiated
+ * in-process (module-eval side effects), so — same pattern as
+ * `boot-pin-sweep-wiring.test.ts` and `silence-liveness-wiring.test.ts` — these
+ * are structural assertions over the source. The BEHAVIOUR they make apply to
+ * the gateway is proven in `status-pin-retarget.test.ts`,
+ * `periodic-sweep-guard.test.ts` and `status-pin.test.ts`.
+ *
+ * D2: `shutdown()` never unpinned. `sweepBeforeSelfRestart()` covered the
+ *     gateway's own restart verbs, but SIGTERM/SIGINT — `docker restart`,
+ *     `switchroom agent restart`, a compose bounce, a host reboot — reached
+ *     `process.exit(0)` with every live pin still pinned (empirically: overlord
+ *     logged `status-pin: cleared 1/1 orphaned pin(s) from a prior session` on
+ *     a routine 2026-07-27 restart, i.e. the NEXT boot had to clean it up).
+ *
+ * D3: the mid-session reaper interval dispatched `void runMidSessionCardReaper()`
+ *     with no single-flight guard, while the pass awaits flood-wait-prone
+ *     Telegram calls.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const gatewaySrc = readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8");
+
+/** Body of `async function shutdown(...)` up to the next top-level `\nasync function`/`\nfunction`. */
+function shutdownBody(): string {
+  const start = gatewaySrc.indexOf("async function shutdown(signal: string)");
+  expect(start).toBeGreaterThan(-1);
+  const rest = gatewaySrc.slice(start + 1);
+  const end = rest.search(/\n(?:async )?function /);
+  return end === -1 ? rest : rest.slice(0, end);
+}
+
+describe("status-pin shutdown wiring (D2)", () => {
+  it("shutdown() unpins the live status pins before exiting", () => {
+    expect(shutdownBody()).toContain("unpinAllStatusPins()");
+  });
+
+  it("the shutdown unpin is guarded, so a throw cannot skip the rest of shutdown", () => {
+    const body = shutdownBody();
+    const idx = body.indexOf("unpinAllStatusPins()");
+    // The nearest preceding statement must open a try — the sweep is
+    // best-effort and must never abort the drain/cleanup that follows it.
+    expect(body.slice(0, idx)).toMatch(/try\s*\{\s*\n\s*await withDeadline\($/);
+  });
+
+  it("the sweep is deadline-bounded, so it cannot push shutdown into force-exit", () => {
+    // forceExitTimer fires at budget+5s and deliberately SKIPS
+    // releaseStartupLock; an unbounded flood-wait-parked unpin here would turn
+    // a clean restart into a stale-lock recovery on the next boot.
+    expect(shutdownBody()).toMatch(/await withDeadline\(unpinAllStatusPins\(\), \d[\d_]*,/);
+  });
+
+  it("runs AFTER the drain and BEFORE the coalescer reset (bot.api still usable)", () => {
+    const body = shutdownBody();
+    const drain = body.indexOf("drainShutdown");
+    const unpin = body.indexOf("unpinAllStatusPins()");
+    const reset = body.indexOf("\n  inboundCoalescer.reset()"); // the statement, not the comment above it
+    expect(drain).toBeGreaterThan(-1);
+    expect(unpin).toBeGreaterThan(drain);
+    expect(reset).toBeGreaterThan(unpin);
+  });
+});
+
+describe("mid-session card reaper dispatch wiring (D3)", () => {
+  it("the interval never calls runMidSessionCardReaper() directly", () => {
+    // The pre-fix shape, verbatim: `void runMidSessionCardReaper()` on a timer.
+    // Only the declaration and the guard's `run:` reference may name it.
+    const invocations =
+      gatewaySrc.match(/(?<!function\s)(?<![.\w])runMidSessionCardReaper\s*\(/g) ?? [];
+    expect(invocations).toEqual([]);
+  });
+
+  it("dispatches through the single-flight guard instead", () => {
+    expect(gatewaySrc).toContain("createPeriodicSweepGuard({");
+    expect(gatewaySrc).toContain("run: runMidSessionCardReaper,");
+    expect(gatewaySrc).toContain("void midSessionReaperGuard.tick()");
+  });
+});
+
+describe("status-pin reconcile wiring (D1)", () => {
+  it("reconcileStatusPinInner delegates to the retarget-aware orchestrator", () => {
+    const start = gatewaySrc.indexOf("async function reconcileStatusPinInner(");
+    expect(start).toBeGreaterThan(-1);
+    const body = gatewaySrc.slice(start, gatewaySrc.indexOf("\n}", start));
+    // A single-leg `reconcileAndPersistStatusPin(...)` call here is exactly the
+    // shape that dropped the pin leg of a retarget on the floor.
+    expect(body).toContain("await runStatusPinReconcile({");
+    expect(body).not.toContain("reconcileAndPersistStatusPin({");
+  });
+});

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -14,6 +14,8 @@ import {
 } from "../gateway/status-pin-store.js";
 import { decidePinAction, type PinState, type DesiredPin } from "../status-pin.js";
 import { reconcilePin, type PinBotApi } from "../status-pin-driver.js";
+import { runStatusPinReconcile } from "../gateway/status-pin-retarget.js";
+import { makeFloodWaitActiveError } from "../retry-api-call.js";
 
 /** In-memory fs seam with an atomic rename, so the store's tmp→rename
  *  crash-safety contract is exercised without touching the real disk. */
@@ -806,32 +808,24 @@ describe("status-pin-store — F2 per-key reconcile serialization", () => {
         unpinCalls.push(id);
       },
     };
-    async function core(
-      pinKey: string,
-      chatId: string,
-      desired: DesiredPin,
-      gate?: Promise<void>,
-    ) {
-      const prev = claims.get(pinKey) ?? null; // read BEFORE the store op (the F2 window)
-      const action = decidePinAction(prev, desired);
-      const op =
-        action.kind === "pin"
-          ? ({ kind: "pin", messageId: action.messageId } as const)
-          : ({ kind: "clear" } as const);
-      const next = await reconcileAndPersistStatusPin({
-        path: PATH,
-        fs,
+    const chatIds = new Map<string, string>();
+    const pinnedAt = new Map<string, number>();
+    // Drives the REAL production orchestrator the gateway calls, so the persist
+    // ordering and the RETARGET two-leg expansion under test are the shipped
+    // ones — not a copy that could drift out from under this suite.
+    function core(pinKey: string, chatId: string, desired: DesiredPin, gate?: Promise<void>) {
+      return runStatusPinReconcile({
         pinKey,
         chatId,
-        op,
-        applyPin: async () => {
+        prev: claims.get(pinKey) ?? null, // read BEFORE the store op (the F2 window)
+        desired,
+        persist: { path: PATH, fs },
+        runPin: async (from, want) => {
           if (gate) await gate; // hold the pin open inside the store lock
-          return reconcilePin({ api, chatId, prevState: prev, desired });
+          return reconcilePin({ api, chatId, prevState: from, desired: want });
         },
-        log: () => {},
+        registries: { state: claims, chatIds, pinnedAt },
       });
-      if (next == null) claims.delete(pinKey);
-      else claims.set(pinKey, next);
     }
     function reconcile(
       pinKey: string,
@@ -916,4 +910,76 @@ describe("status-pin-store — F2 per-key reconcile serialization", () => {
       { pinKey: "wk:group:g1", chatId: "-100123", messageId: 900 },
     ]);
   });
+
+  // ── RETARGET: a single reconcile must leave the NEW surface pinned ────────
+  // The foreground activity card reconciles its `fg:` pin exactly once, when a
+  // card OPENs (narrative-lane.ts). The ack-first reopen path nulls
+  // `activityMessageId` mid-turn, so a fresh card opens and that ONE reconcile
+  // is the only chance to move the pin. It used to emit an unpin and stop:
+  // nothing pinned, and a durable row that had been deleted — so neither the
+  // mid-session reaper nor the next boot's sweep had anything to work from.
+  it("RETARGET: one reconcile unpins the old card, pins the NEW one, and leaves the durable row on the new id", async () => {
+    const { fs } = memFs();
+    const r = makeReconciler(fs, { serialize: true });
+
+    await r.reconcile("fg:c:7", "-100123", { pinned: true, messageId: 900 });
+    expect(r.pinCalls).toEqual([900]);
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "fg:c:7", chatId: "-100123", messageId: 900 },
+    ]);
+
+    // The card is re-posted mid-turn — ONE reconcile, new message id.
+    await r.reconcile("fg:c:7", "-100123", { pinned: true, messageId: 901 });
+
+    expect(r.unpinCalls).toEqual([900]); // stale card unpinned
+    expect(r.pinCalls).toEqual([900, 901]); // …AND the new card pinned
+    expect(r.claims.get("fg:c:7")).toEqual({ messageId: 901 });
+    // The durable row tracks the message that is genuinely pinned, so the
+    // mid-session reaper and the boot sweep can both still reach it.
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "fg:c:7", chatId: "-100123", messageId: 901 },
+    ]);
+  });
+
+  it("RETARGET: a never-confirmed unpin keeps the OLD id in the durable row (no unreapable orphan)", async () => {
+    // #3664 Defect B composed with the retarget: the old message is provably
+    // still pinned, so we must NOT pin the new one and must NOT lose the row —
+    // otherwise the chat holds a pin nothing on disk names.
+    const { fs } = memFs();
+    const claims = new Map<string, PinState>();
+    const pinCalls: number[] = [];
+    const unpinCalls: number[] = [];
+    let floodTheUnpin = false;
+    const api: PinBotApi = {
+      pinChatMessage: async (_c, id) => {
+        pinCalls.push(id);
+      },
+      unpinChatMessage: async (_c, id) => {
+        unpinCalls.push(id);
+        if (floodTheUnpin) throw makeFloodWaitActiveError(300, Date.now() + 300_000, null);
+      },
+    };
+    const reconcile = (desired: DesiredPin) =>
+      runStatusPinReconcile({
+        pinKey: "fg:c:8",
+        chatId: "-100123",
+        prev: claims.get("fg:c:8") ?? null,
+        desired,
+        persist: { path: PATH, fs },
+        runPin: (from, want) =>
+          reconcilePin({ api, chatId: "-100123", prevState: from, desired: want }),
+        registries: { state: claims, chatIds: new Map(), pinnedAt: new Map() },
+      });
+
+    await reconcile({ pinned: true, messageId: 900 });
+    floodTheUnpin = true;
+    await reconcile({ pinned: true, messageId: 901 });
+
+    expect(unpinCalls).toEqual([900]); // attempted…
+    expect(pinCalls).toEqual([900]); // …and the pin leg was correctly SKIPPED
+    expect(claims.get("fg:c:8")).toEqual({ messageId: 900 }); // claim retained
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "fg:c:8", chatId: "-100123", messageId: 900 },
+    ]);
+  });
 });

package/telegram-plugin/tests/status-pin.test.ts

@@ -37,9 +37,14 @@ describe('decidePinAction (pure)', () => {
     expect(action.kind).toBe('noop')
   })
 
-  it('unpins the stale claim when the wanted message id changed (feed re-posted)', () => {
+  it('RETARGETS (unpin old + pin new) when the wanted message id changed (surface re-posted)', () => {
+    // Regression: this used to report a bare `unpin`, on the assumption that a
+    // later reconcile would pin the new message. Single-shot callers (the
+    // foreground activity card, which reconciles only when a card OPENs) have
+    // no later reconcile, so the new card was left unpinned for the rest of
+    // the turn. The decision must carry BOTH message ids.
     const action = decidePinAction({ messageId: 42 }, { pinned: true, messageId: 99 })
-    expect(action).toEqual({ kind: 'unpin', messageId: 42 })
+    expect(action).toEqual({ kind: 'repin', unpinMessageId: 42, pinMessageId: 99 })
   })
 })
 
@@ -177,6 +182,127 @@ describe('reconcilePin (driver)', () => {
     expect(attempts).toBe(2)
   })
 
+  // ── Retarget (`repin`) — the single-shot-caller leak ──────────────────────
+  // The foreground activity card reconciles its `fg:` pin EXACTLY ONCE, when a
+  // card OPENs (narrative-lane.ts; the edit branch never touches the pin). When
+  // the ack-first reopen path (feed-reopen-gate.ts) nulls `activityMessageId`
+  // and a FRESH card opens mid-turn, that single reconcile must leave the NEW
+  // card pinned. Previously it emitted only an unpin and the turn ran on with
+  // nothing pinned.
+  it('RETARGET: one reconcile unpins the stale message AND pins the new one', async () => {
+    const { api, calls } = fakeApi()
+    const next = await reconcilePin({
+      api,
+      chatId: '123',
+      prevState: { messageId: 42 },
+      desired: { pinned: true, messageId: 99 },
+    })
+    expect(next).toEqual({ messageId: 99 })
+    expect(calls.map((c) => [c.verb, c.messageId])).toEqual([
+      ['unpin', 42],
+      ['pin', 99],
+    ])
+    // The new pin must still be silent.
+    expect((calls[1].opts as Record<string, unknown>).disable_notification).toBe(true)
+  })
+
+  it('RETARGET: a TERMINAL unpin failure still pins the new message', async () => {
+    // "message to unpin not found" means the old surface is already gone — the
+    // retarget must complete, not abort.
+    const calls: { verb: string; messageId: number }[] = []
+    const next = await reconcilePin({
+      api: {
+        pinChatMessage: async (_c, message_id) => {
+          calls.push({ verb: 'pin', messageId: message_id })
+        },
+        unpinChatMessage: async (_c, message_id) => {
+          calls.push({ verb: 'unpin', messageId: message_id })
+          throw grammyError(400, 'Bad Request: message to unpin not found')
+        },
+      },
+      chatId: '123',
+      prevState: { messageId: 42 },
+      desired: { pinned: true, messageId: 99 },
+    })
+    expect(next).toEqual({ messageId: 99 })
+    expect(calls).toEqual([
+      { verb: 'unpin', messageId: 42 },
+      { verb: 'pin', messageId: 99 },
+    ])
+  })
+
+  it('RETARGET: a NEVER-CONFIRMED unpin retains the OLD claim and does NOT pin the new one', async () => {
+    // The old message is provably still pinned (#3664 Defect B). Pinning the
+    // new one now would leave two pins in the chat with a durable record of
+    // only one — the exact orphan class the retain rule exists to prevent.
+    const calls: { verb: string; messageId: number }[] = []
+    const next = await reconcilePin({
+      api: {
+        pinChatMessage: async (_c, message_id) => {
+          calls.push({ verb: 'pin', messageId: message_id })
+        },
+        unpinChatMessage: async (_c, message_id) => {
+          calls.push({ verb: 'unpin', messageId: message_id })
+          throw makeFloodWaitActiveError(300, Date.now() + 300_000, null)
+        },
+      },
+      chatId: '123',
+      prevState: { messageId: 42 },
+      desired: { pinned: true, messageId: 99 },
+    })
+    expect(next).toEqual({ messageId: 42 })
+    expect(calls).toEqual([{ verb: 'unpin', messageId: 42 }])
+  })
+
+  it('RETARGET: a failed pin leg drops the claim (nothing is pinned, nothing is tracked)', async () => {
+    const calls: { verb: string; messageId: number }[] = []
+    const next = await reconcilePin({
+      api: {
+        pinChatMessage: async (_c, message_id) => {
+          calls.push({ verb: 'pin', messageId: message_id })
+          throw new Error('fetch failed')
+        },
+        unpinChatMessage: async (_c, message_id) => {
+          calls.push({ verb: 'unpin', messageId: message_id })
+        },
+      },
+      chatId: '123',
+      prevState: { messageId: 42 },
+      desired: { pinned: true, messageId: 99 },
+    })
+    // prevState for the pin leg is null (the unpin landed), so a failed pin
+    // returns null — no phantom claim on a message we never pinned.
+    expect(next).toBeNull()
+    expect(calls).toEqual([
+      { verb: 'unpin', messageId: 42 },
+      { verb: 'pin', messageId: 99 },
+    ])
+  })
+
+  it('RETARGET: a pin-rights-blocked chat makes NO API calls and drops the claim', async () => {
+    const calls: string[] = []
+    const cache = new PinRightsCache()
+    cache.block('123')
+    const next = await reconcilePin({
+      api: {
+        pinChatMessage: async () => {
+          calls.push('pin')
+        },
+        unpinChatMessage: async () => {
+          calls.push('unpin')
+        },
+      },
+      chatId: '123',
+      prevState: { messageId: 42 },
+      desired: { pinned: true, messageId: 99 },
+      rightsCache: cache,
+    })
+    expect(calls).toEqual([])
+    // unpin leg returns null (claim dropped, nothing worth tracking); the pin
+    // leg is skipped from a null prev and returns null too.
+    expect(next).toBeNull()
+  })
+
   it('does NOT claim a message whose pin failed (retries next reconcile)', async () => {
     const errors: string[] = []
     const { api } = fakeApi({ pinThrows: true })

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -76,7 +76,7 @@ describe('renderWorkerActivity', () => {
 
   it('renders the native header + running status + step feed', () => {
     const out = renderWorkerActivity(view())
-    expect(out).toContain('🛠 **Worker** · _research competitors_')
+    expect(out).toContain('└─ 🛠 **WORKER** · _research competitors_')
     // Unified header: running shows "<elapsed> · N tools" (no "running ·" word).
     expect(out).toContain('_10s · 3 tools_')
     expect(out).toContain('3 tools')
@@ -100,7 +100,7 @@ describe('renderWorkerActivity', () => {
 
   it('shows a "starting…" line when no step has run yet', () => {
     const out = renderWorkerActivity(view({ lastTool: null, latestSummary: '' }))
-    expect(out).toContain('🛠 **Worker**')
+    expect(out).toContain('└─ 🛠 **WORKER**')
     expect(out).toContain('starting…')
     expect(out).not.toContain('→')
   })
@@ -121,7 +121,7 @@ describe('renderWorkerActivity', () => {
     const out = renderWorkerActivity(
       view({ state: 'done', toolCount: 5, latestSummary: 'PR #21 opened' }),
     )
-    expect(out).toContain('🛠 **Worker** · _research competitors_')
+    expect(out).toContain('└─ 🛠 **WORKER** · _research competitors_')
     // Unified done header: "done · N tools · <elapsed>".
     expect(out).toContain('_done · 5 tools · ')
     expect(out).toContain('─────')
@@ -227,7 +227,7 @@ describe('renderWorkerActivity', () => {
         narrativeLines: ['- ran the **full** suite', '`git push`'],
       }),
     )
-    expect(running).toContain('🛠 **Worker** · _Build the sync_')
+    expect(running).toContain('└─ 🛠 **WORKER** · _Build the sync_')
     expect(running).toContain('ran the full suite')
     expect(running).toContain('git push')
     // The CONTENT bold/code markers were stripped — no `**full**`, no backticks.
@@ -298,7 +298,7 @@ describe('createWorkerActivityFeed', () => {
     // #2669: the worker feed body is raw GFM markdown sent through the rich
     // path (the gateway wires sendMessage → sendRichMessage). No parse_mode.
     expect(bot.sent[0].opts?.parse_mode).toBeUndefined()
-    expect(bot.sent[0].text).toContain('🛠 **Worker**')
+    expect(bot.sent[0].text).toContain('└─ 🛠 **WORKER**')
     expect(feed.has('w1')).toBe(true)
   })
 
@@ -932,7 +932,7 @@ describe('createWorkerActivityFeed — heartbeat', () => {
     await drain()
     expect(bot.sent).toHaveLength(1)
     expect(feed.messageIdOf('w1')).toBe(1000)
-    expect(bot.sent[0].text).toContain('🛠 **Worker**')
+    expect(bot.sent[0].text).toContain('└─ 🛠 **WORKER**')
 
     // And it keeps updating: a later heartbeat edits the message with a
     // climbing `· Ns` suffix so the still-alive worker visibly advances.
@@ -1328,7 +1328,7 @@ describe('header row + rolling overflow survive in the unified worker render', (
     )
     const out = renderWorkerActivity(view({ narrativeLines, toolCount: 7 }))
 
-    expect(out).toContain('🛠 **Worker**')
+    expect(out).toContain('└─ 🛠 **WORKER**')
     // Unified running status line.
     expect(out).toContain('_10s · 7 tools_')
     expect(out).toContain('7 tools')
@@ -1344,7 +1344,7 @@ describe('header row + rolling overflow survive in the unified worker render', (
 
     expect(out.length).toBeLessThanOrEqual(4096)
     expect(out).toContain('earlier…')
-    expect(out).toContain('🛠 **Worker**')
+    expect(out).toContain('└─ 🛠 **WORKER**')
     expect(out).toContain('_10s · ')
   })
 
@@ -1359,7 +1359,7 @@ describe('header row + rolling overflow survive in the unified worker render', (
     expect(out.length).toBeLessThanOrEqual(4096)
     const hasBullet = out.includes('→') || out.includes('✓')
     expect(hasBullet).toBe(true)
-    expect(out).toContain('🛠 **Worker**')
+    expect(out).toContain('└─ 🛠 **WORKER**')
     expect(out).toContain('_10s · ')
     expect(isValidWorkerMarkdown(out)).toBe(true)
   })
@@ -1525,7 +1525,7 @@ describe('worker-feed send-gate shed contract', () => {
     await feed.update('w1', 'chat', view({ elapsedMs: clock }))
     expect(bot.sendCalls).toBe(1)
     expect(bot.sent).toHaveLength(1)
-    expect(bot.sent[0].text).toContain('🛠 **Worker**')
+    expect(bot.sent[0].text).toContain('└─ 🛠 **WORKER**')
     expect(feed.has('w1')).toBe(true)
   })