switchroom 0.19.25 → 0.19.27

package/telegram-plugin/tests/status-pin-retarget.test.ts

@@ -0,0 +1,244 @@
+import { describe, it, expect } from "vitest";
+import {
+  runStatusPinReconcile,
+  type StatusPinClaim,
+} from "../gateway/status-pin-retarget.js";
+import type { PinLegAction, PinState } from "../status-pin.js";
+
+/**
+ * The orchestrator the gateway's `reconcileStatusPinInner` delegates to.
+ *
+ * The defect it closes: a RETARGET (the caller wants a DIFFERENT message pinned
+ * for a key it already holds a claim on) used to be reported as a bare `unpin`
+ * and stopped there, on the assumption a later reconcile would pin the new
+ * message. The FOREGROUND activity card reconciles `fg:<statusKey>` exactly
+ * once (narrative-lane.ts, the `activityMessageId == null` OPEN branch), so an
+ * ack-first mid-turn reopen left the live card unpinned for the rest of the
+ * turn AND deleted the durable row, putting it out of reach of both the
+ * mid-session reaper and the next boot's sweep.
+ *
+ * #3831: the expansion ALSO existed inside `status-pin-driver.ts`, decided from
+ * the driver's own `decidePinAction` call and lacking the per-leg persistence.
+ * That copy is gone — the driver now takes a `PinLegAction`, which cannot
+ * express a repin — so this module is the only decider. These tests assert the
+ * LEG SEQUENCE the driver now receives, plus the claim bookkeeping.
+ */
+
+/** Records every leg and returns a scripted outcome for it. */
+function legRecorder(outcomes: Array<PinState | null>) {
+  const legs: Array<{ from: PinState | null; action: PinLegAction }> = [];
+  let i = 0;
+  const runPin = async (action: PinLegAction, from: PinState | null) => {
+    legs.push({ from, action });
+    const out = outcomes[i];
+    i += 1;
+    return out ?? null;
+  };
+  return { legs, runPin };
+}
+
+function claimsOf(seed?: { key: string; claim: StatusPinClaim }) {
+  const claims = new Map<string, StatusPinClaim>();
+  if (seed) claims.set(seed.key, seed.claim);
+  return claims;
+}
+
+const KEY = "fg:c:7";
+const CHAT = "-100123";
+
+describe("runStatusPinReconcile — RETARGET", () => {
+  it("runs BOTH legs: unpins the stale claim, then pins the new message", async () => {
+    const { legs, runPin } = legRecorder([null, { messageId: 901 }]);
+    const claims = claimsOf({
+      key: KEY,
+      claim: { messageId: 900, chatId: CHAT, pinnedAt: 1000 },
+    });
+
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      claims,
+    });
+
+    // The pre-fix behaviour was legs === [unpin] and nothing pinned.
+    expect(legs).toEqual([
+      { from: { messageId: 900 }, action: { kind: "unpin", messageId: 900 } },
+      { from: null, action: { kind: "pin", messageId: 901 } },
+    ]);
+    expect(claims.get(KEY)?.messageId).toBe(901);
+    expect(claims.get(KEY)?.chatId).toBe(CHAT);
+  });
+
+  it("leg 2 starts from a NULL claim, so the driver pins rather than no-opping", async () => {
+    const { legs, runPin } = legRecorder([null, { messageId: 901 }]);
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      claims: claimsOf(),
+    });
+    expect(legs[1].from).toBeNull();
+    expect(legs[1].action).toEqual({ kind: "pin", messageId: 901 });
+  });
+
+  it("re-stamps pinnedAt for the NEW card, so the reaper ages the live message", async () => {
+    const { runPin } = legRecorder([null, { messageId: 901 }]);
+    const claims = claimsOf({
+      key: KEY,
+      claim: { messageId: 900, chatId: CHAT, pinnedAt: 1000 },
+    });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      claims,
+      now: () => 5000,
+    });
+    // Leg 1 cleared the claim (dropping the old stamp), leg 2 took a fresh one.
+    expect(claims.get(KEY)?.pinnedAt).toBe(5000);
+  });
+
+  it("NEVER-CONFIRMED unpin (#3664 Defect B): SKIPS the pin leg and retains the OLD claim", async () => {
+    // A non-null leg-1 result means executePinLeg deliberately kept the claim —
+    // the old message is provably still pinned. Pinning the new one now would
+    // leave TWO pins in the chat with a durable record of one.
+    const { legs, runPin } = legRecorder([{ messageId: 900 }]);
+    const claims = claimsOf({
+      key: KEY,
+      claim: { messageId: 900, chatId: CHAT, pinnedAt: 1000 },
+    });
+
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      claims,
+    });
+
+    expect(legs).toHaveLength(1);
+    expect(claims.get(KEY)).toEqual({
+      messageId: 900,
+      chatId: CHAT,
+      pinnedAt: 1000, // original age preserved for the TTL gate
+    });
+  });
+
+  it("a FAILED pin leg drops the claim entirely (nothing is pinned, nothing is tracked)", async () => {
+    // executePinLeg returns its `from` on a failed pin — here `null`.
+    const { runPin } = legRecorder([null, null]);
+    const claims = claimsOf({
+      key: KEY,
+      claim: { messageId: 900, chatId: CHAT, pinnedAt: 1000 },
+    });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 901 },
+      persist: null,
+      runPin,
+      claims,
+    });
+    expect(claims.has(KEY)).toBe(false);
+  });
+});
+
+describe("runStatusPinReconcile — single-leg actions are unchanged", () => {
+  it("first pin: one leg, claim + chat + age recorded together", async () => {
+    const { legs, runPin } = legRecorder([{ messageId: 900 }]);
+    const claims = claimsOf();
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: null,
+      desired: { pinned: true, messageId: 900 },
+      persist: null,
+      runPin,
+      claims,
+      now: () => 4242,
+    });
+    expect(legs).toEqual([
+      { from: null, action: { kind: "pin", messageId: 900 } },
+    ]);
+    // #3809: the claim is ONE record — a chat-less claim cannot be represented.
+    expect(claims.get(KEY)).toEqual({
+      messageId: 900,
+      chatId: CHAT,
+      pinnedAt: 4242,
+    });
+  });
+
+  it("turn-end unpin: one leg, the whole claim is cleared", async () => {
+    const { legs, runPin } = legRecorder([null]);
+    const claims = claimsOf({
+      key: KEY,
+      claim: { messageId: 900, chatId: CHAT, pinnedAt: 1000 },
+    });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: false },
+      persist: null,
+      runPin,
+      claims,
+    });
+    expect(legs).toEqual([
+      { from: { messageId: 900 }, action: { kind: "unpin", messageId: 900 } },
+    ]);
+    expect(claims.has(KEY)).toBe(false);
+  });
+
+  it("steady-state re-pin of the SAME id: still one leg, and the ORIGINAL age is kept", async () => {
+    // 20 edits/turn each re-drive this; the reaper's TTL must measure from the
+    // first pin, not be reset by every edit.
+    const { legs, runPin } = legRecorder([{ messageId: 900 }]);
+    const claims = claimsOf({
+      key: KEY,
+      claim: { messageId: 900, chatId: CHAT, pinnedAt: 1000 },
+    });
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: { messageId: 900 },
+      desired: { pinned: true, messageId: 900 },
+      persist: null,
+      runPin,
+      claims,
+      now: () => 9_999_999,
+    });
+    expect(legs).toHaveLength(1);
+    expect(legs[0].action.kind).toBe("noop");
+    expect(claims.get(KEY)?.pinnedAt).toBe(1000);
+  });
+
+  it("unpin with no claim: one no-op leg, the registry stays empty", async () => {
+    const { legs, runPin } = legRecorder([null]);
+    const claims = claimsOf();
+    await runStatusPinReconcile({
+      pinKey: KEY,
+      chatId: CHAT,
+      prev: null,
+      desired: { pinned: false },
+      persist: null,
+      runPin,
+      claims,
+    });
+    expect(legs).toHaveLength(1);
+    expect(legs[0].action.kind).toBe("noop");
+    expect(claims.size).toBe(0);
+  });
+});

package/telegram-plugin/tests/status-pin-service-message-suppression.test.ts

@@ -43,13 +43,17 @@ describe('status-pin service-message suppression', () => {
     // message (which would nuke manual/operator pins too) — AND it must be
     // chat-scoped (pinnedMessageIsOurs requires chatId + messageId), never a
     // messageId-only match.
-    expect(MODULE_SRC).toContain('deps.statusPinState')
+    expect(MODULE_SRC).toContain('deps.statusPinClaims')
     expect(MODULE_SRC).toMatch(/pinned_message\?\.message_id/)
     expect(MODULE_SRC).toContain('pinnedMessageIsOurs(')
     // The chatId computed from the update must be fed to the guard.
     expect(MODULE_SRC).toMatch(/pinnedMessageIsOurs\(trackedPins\(\), chatId, pinnedId\)/)
-    // And the tracked entries must carry their chat association.
-    expect(MODULE_SRC).toContain('deps.statusPinChatIds.get(pinKey)')
+    // And the tracked entries must carry their chat association. Since #3809
+    // that association is STRUCTURAL — one claim record per key carrying both
+    // messageId and chatId — so the guard reads it off the claim itself and a
+    // chat-less tracked pin can no longer be constructed.
+    expect(MODULE_SRC).toMatch(/chatId: c\.chatId/)
+    expect(MODULE_SRC).toMatch(/messageId: c\.messageId/)
   })
 
   it('bails out when the pinned message is not one of ours', () => {

package/telegram-plugin/tests/status-pin-shutdown-wiring.test.ts

@@ -0,0 +1,94 @@
+/**
+ * Status-pin SHUTDOWN + REAPER-DISPATCH wiring fence.
+ *
+ * Both defects here are wiring defects, and gateway.ts cannot be instantiated
+ * in-process (module-eval side effects), so — same pattern as
+ * `boot-pin-sweep-wiring.test.ts` and `silence-liveness-wiring.test.ts` — these
+ * are structural assertions over the source. The BEHAVIOUR they make apply to
+ * the gateway is proven in `status-pin-retarget.test.ts`,
+ * `periodic-sweep-guard.test.ts` and `status-pin.test.ts`.
+ *
+ * D2: `shutdown()` never unpinned. `sweepBeforeSelfRestart()` covered the
+ *     gateway's own restart verbs, but SIGTERM/SIGINT — `docker restart`,
+ *     `switchroom agent restart`, a compose bounce, a host reboot — reached
+ *     `process.exit(0)` with every live pin still pinned (empirically: overlord
+ *     logged `status-pin: cleared 1/1 orphaned pin(s) from a prior session` on
+ *     a routine 2026-07-27 restart, i.e. the NEXT boot had to clean it up).
+ *
+ * D3: the mid-session reaper interval dispatched `void runMidSessionCardReaper()`
+ *     with no single-flight guard, while the pass awaits flood-wait-prone
+ *     Telegram calls.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const gatewaySrc = readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8");
+
+/** Body of `async function shutdown(...)` up to the next top-level `\nasync function`/`\nfunction`. */
+function shutdownBody(): string {
+  const start = gatewaySrc.indexOf("async function shutdown(signal: string)");
+  expect(start).toBeGreaterThan(-1);
+  const rest = gatewaySrc.slice(start + 1);
+  const end = rest.search(/\n(?:async )?function /);
+  return end === -1 ? rest : rest.slice(0, end);
+}
+
+describe("status-pin shutdown wiring (D2)", () => {
+  it("shutdown() unpins the live status pins before exiting", () => {
+    expect(shutdownBody()).toContain("unpinAllStatusPins()");
+  });
+
+  it("the shutdown unpin is guarded, so a throw cannot skip the rest of shutdown", () => {
+    const body = shutdownBody();
+    const idx = body.indexOf("unpinAllStatusPins()");
+    // The nearest preceding statement must open a try — the sweep is
+    // best-effort and must never abort the drain/cleanup that follows it.
+    expect(body.slice(0, idx)).toMatch(/try\s*\{\s*\n\s*await withDeadline\($/);
+  });
+
+  it("the sweep is deadline-bounded, so it cannot push shutdown into force-exit", () => {
+    // forceExitTimer fires at budget+5s and deliberately SKIPS
+    // releaseStartupLock; an unbounded flood-wait-parked unpin here would turn
+    // a clean restart into a stale-lock recovery on the next boot.
+    expect(shutdownBody()).toMatch(/await withDeadline\(unpinAllStatusPins\(\), \d[\d_]*,/);
+  });
+
+  it("runs AFTER the drain and BEFORE the coalescer reset (bot.api still usable)", () => {
+    const body = shutdownBody();
+    const drain = body.indexOf("drainShutdown");
+    const unpin = body.indexOf("unpinAllStatusPins()");
+    const reset = body.indexOf("\n  inboundCoalescer.reset()"); // the statement, not the comment above it
+    expect(drain).toBeGreaterThan(-1);
+    expect(unpin).toBeGreaterThan(drain);
+    expect(reset).toBeGreaterThan(unpin);
+  });
+});
+
+describe("mid-session card reaper dispatch wiring (D3)", () => {
+  it("the interval never calls runMidSessionCardReaper() directly", () => {
+    // The pre-fix shape, verbatim: `void runMidSessionCardReaper()` on a timer.
+    // Only the declaration and the guard's `run:` reference may name it.
+    const invocations =
+      gatewaySrc.match(/(?<!function\s)(?<![.\w])runMidSessionCardReaper\s*\(/g) ?? [];
+    expect(invocations).toEqual([]);
+  });
+
+  it("dispatches through the single-flight guard instead", () => {
+    expect(gatewaySrc).toContain("createPeriodicSweepGuard({");
+    expect(gatewaySrc).toContain("run: runMidSessionCardReaper,");
+    expect(gatewaySrc).toContain("void midSessionReaperGuard.tick()");
+  });
+});
+
+describe("status-pin reconcile wiring (D1)", () => {
+  it("reconcileStatusPinInner delegates to the retarget-aware orchestrator", () => {
+    const start = gatewaySrc.indexOf("async function reconcileStatusPinInner(");
+    expect(start).toBeGreaterThan(-1);
+    const body = gatewaySrc.slice(start, gatewaySrc.indexOf("\n}", start));
+    // A single-leg `reconcileAndPersistStatusPin(...)` call here is exactly the
+    // shape that dropped the pin leg of a retarget on the floor.
+    expect(body).toContain("await runStatusPinReconcile({");
+    expect(body).not.toContain("reconcileAndPersistStatusPin({");
+  });
+});