switchroom 0.19.30 → 0.19.31

package/telegram-plugin/tests/inbound-spool-progress.test.ts

@@ -60,6 +60,8 @@ function fakeFs(): InboundSpoolFsSeam {
     },
     existsSync: (p) => files.has(p),
     statSizeSync: (p) => Buffer.byteLength(files.get(p) ?? ''),
+    fsyncFileSync: () => {},
+    fsyncDirSync: () => {},
   }
 }
 

package/telegram-plugin/tests/inbound-spool.test.ts

@@ -33,20 +33,33 @@ function msg(over: Partial<InboundMessage> = {}): InboundMessage {
 }
 
 /** In-memory fake fs keyed by path. Models append, full rewrite, and
- *  atomic rename (so the tmp→rename compaction path is exercised). */
-function fakeFs(): InboundSpoolFsSeam & { dump(p?: string): string } {
+ *  atomic rename (so the tmp→rename compaction path is exercised).
+ *  `ops` records the mutating/durability calls in order, so tests can pin
+ *  the fsync ORDERING the crash-durability guarantee depends on. */
+function fakeFs(): InboundSpoolFsSeam & { dump(p?: string): string; ops: string[] } {
   const files = new Map<string, string>()
+  const ops: string[] = []
   return {
-    appendFileSync: (p, d) => files.set(p, (files.get(p) ?? '') + d),
+    appendFileSync: (p, d) => {
+      ops.push(`append:${p}`)
+      files.set(p, (files.get(p) ?? '') + d)
+    },
     readFileSync: (p) => files.get(p) ?? '',
-    writeFileSync: (p, d) => files.set(p, d),
+    writeFileSync: (p, d) => {
+      ops.push(`write:${p}`)
+      files.set(p, d)
+    },
     renameSync: (from, to) => {
+      ops.push(`rename:${from}->${to}`)
       files.set(to, files.get(from) ?? '')
       files.delete(from)
     },
     existsSync: (p) => files.has(p),
     statSizeSync: (p) => Buffer.byteLength(files.get(p) ?? ''),
+    fsyncFileSync: (p) => ops.push(`fsyncFile:${p}`),
+    fsyncDirSync: (p) => ops.push(`fsyncDir:${p}`),
     dump: (p = PATH) => files.get(p) ?? '',
+    ops,
   }
 }
 
@@ -478,6 +491,92 @@ describe('inbound-spool — robustness', () => {
   })
 })
 
+describe('inbound-spool — power-cut durability (fsync)', () => {
+  it('fsyncs the spool file on every appended record', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    s.put('a', msg({ messageId: 1 }))
+    s.ack(msg({ messageId: 1 }))
+    // Both the put record and the ack tombstone are durability-critical:
+    // an un-synced ack replays an already-answered message after a power
+    // cut, an un-synced put loses it entirely.
+    expect(fs.ops).toEqual([
+      `append:${PATH}`,
+      `fsyncFile:${PATH}`,
+      `append:${PATH}`,
+      `fsyncFile:${PATH}`,
+    ])
+  })
+
+  it('compaction fsyncs the tmp file BEFORE the rename and the directory AFTER', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, compactAtBytes: 200, log: () => {} })
+    for (let i = 1; i <= 10; i++) s.put('a', msg({ messageId: i, text: 'y'.repeat(50) }))
+    // The bound triggers several compactions across the 10 puts; each one
+    // must follow the same four-step sequence, so pin the last.
+    expect(fs.ops.slice(-4)).toEqual([
+      `write:${PATH}.compact.tmp`,
+      `fsyncFile:${PATH}.compact.tmp`,
+      `rename:${PATH}.compact.tmp->${PATH}`,
+      'fsyncDir:/state/agent/telegram',
+    ])
+  })
+
+  it('a failed compaction directory fsync is not reported as a failed compaction', () => {
+    // The rename already landed, so the compacted log IS on disk; only the
+    // power-cut upgrade is missing. Calling it "compact FAILED" would send an
+    // operator hunting a rewrite that actually worked.
+    const fs = fakeFs()
+    const logs: string[] = []
+    fs.fsyncDirSync = () => {
+      throw new Error('EIO: i/o error, fsync dir')
+    }
+    const s = createInboundSpool({ path: PATH, fs, compactAtBytes: 200, log: (l) => logs.push(l) })
+    for (let i = 1; i <= 10; i++) s.put('a', msg({ messageId: i, text: 'y'.repeat(50) }))
+    expect(logs.join('')).toContain('compact directory fsync FAILED')
+    expect(logs.join('')).toContain('compacted path=')
+    // And the compacted log is intact and readable — nothing was rolled back.
+    const s2 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(s2.liveCount()).toBe(10)
+  })
+
+  it('an un-acked entry survives a POWER CUT, not just a process kill', () => {
+    // Models the distinction the fsync exists for: `appendFileSync` returning
+    // puts the bytes in the page cache (enough to survive SIGKILL — the
+    // process dies, the kernel still holds them), but only fsync puts them on
+    // stable storage. `powerCut()` discards everything not fsync'd, which is
+    // what a host power loss actually does.
+    const cache = new Map<string, string>()
+    const platter = new Map<string, string>()
+    const fs: InboundSpoolFsSeam = {
+      appendFileSync: (p, d) => cache.set(p, (cache.get(p) ?? '') + d),
+      readFileSync: (p) => cache.get(p) ?? '',
+      writeFileSync: (p, d) => cache.set(p, d),
+      renameSync: (from, to) => {
+        cache.set(to, cache.get(from) ?? '')
+        cache.delete(from)
+      },
+      existsSync: (p) => cache.has(p),
+      statSizeSync: (p) => Buffer.byteLength(cache.get(p) ?? ''),
+      fsyncFileSync: (p) => {
+        if (cache.has(p)) platter.set(p, cache.get(p)!)
+      },
+      fsyncDirSync: () => {},
+    }
+    const powerCut = (): void => {
+      cache.clear()
+      for (const [p, d] of platter) cache.set(p, d)
+    }
+
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    s.put('a', msg({ messageId: 7, text: 'answer me' }))
+    powerCut()
+
+    const rebooted = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(rebooted.liveEntries().map((e) => e.msg.messageId)).toEqual([7])
+  })
+})
+
 describe('inbound-spool — #2789 C: multi-message drop notice reports the real count', () => {
   it('passes the true per-chat dropped count to the coalesced notice', () => {
     const fs = fakeFs()
@@ -549,10 +648,14 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
   // An fs whose appendFileSync can be toggled to fail, modelling a full /
   // unwritable persistent volume. The append swallows the error (delivery
   // must not break) but the degradation must be SURFACED, not silent.
-  function toggleableFs(): InboundSpoolFsSeam & { fail: boolean } {
+  function toggleableFs(): InboundSpoolFsSeam & { fail: boolean; failFsync: boolean } {
     const files = new Map<string, string>()
     const seam = {
       fail: false,
+      // A failing fsync is its own degradation mode: the bytes reached the
+      // page cache but NOT stable storage, so the durable promise is gone
+      // even though appendFileSync returned cleanly.
+      failFsync: false,
       appendFileSync(p: string, d: string) {
         if (seam.fail) throw new Error('ENOSPC: no space left on device')
         files.set(p, (files.get(p) ?? '') + d)
@@ -565,6 +668,10 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
       },
       existsSync: (p: string) => files.has(p),
       statSizeSync: (p: string) => Buffer.byteLength(files.get(p) ?? ''),
+      fsyncFileSync: (_p: string) => {
+        if (seam.failFsync) throw new Error('EIO: i/o error, fsync')
+      },
+      fsyncDirSync: (_p: string) => {},
     }
     return seam
   }
@@ -588,6 +695,28 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
     expect(events).toEqual([{ degraded: true, consecutiveFailures: 1 }])
   })
 
+  it('a failing fsync degrades too — a cached-but-unsynced append is NOT durable', () => {
+    // The subtle one: appendFileSync succeeds, so the old code would have
+    // reported a healthy spool while the record was one power cut from gone.
+    const fs = toggleableFs()
+    const events: { degraded: boolean }[] = []
+    const logs: string[] = []
+    const s = createInboundSpool({
+      path: PATH,
+      fs,
+      log: (l) => logs.push(l),
+      onDegraded: (info) => events.push({ degraded: info.degraded }),
+    })
+    fs.failFsync = true
+    expect(() => s.put('a', msg({ messageId: 1, ts: 1 }))).not.toThrow()
+    expect(s.isDegraded()).toBe(true)
+    expect(events).toEqual([{ degraded: true }])
+    expect(logs.join('')).toContain('durability degraded')
+    // Live delivery is unaffected — degradation is a durability claim, not a
+    // delivery failure.
+    expect(s.liveCount()).toBe(1)
+  })
+
   it('does not re-fire the degraded signal on every failing append (latched)', () => {
     const fs = toggleableFs()
     const events: boolean[] = []

package/telegram-plugin/tests/narrative-lane-golden.test.ts

@@ -211,6 +211,34 @@ describe('narrative-lane golden — SHOW path opens then edits ONE feed card', (
     expect(final!).toMatch(/3 steps/)
     expect(live!).not.toMatch(/3 steps/)
   })
+
+  it('composeTurnActivity: the FINAL render ends with the ✅ + delivered-answer footer', () => {
+    // Parity with the 🛠 worker card, which has always closed on `✅ <summary>`.
+    // The agent card's analogue of the worker's `latestSummary` is the answer
+    // the turn actually delivered (`turn.lastReplyText`); the lane threads it
+    // into the header as `resultText` and the SHARED `deriveCardResult` renders
+    // it. Fails on the pre-fix lane, which passed no result text at all.
+    const { lane } = makeLane()
+    const turn = makeLaneTurn(lane, { labeledToolCount: 2 })
+    turn.mirrorLines.push('Read the file', 'Ran the tests')
+    turn.lastReplyText = 'Standing by for the background merge waiter to complete.'
+    const live = lane.composeTurnActivity(turn)
+    const final = lane.composeTurnActivity(turn, true)
+    expect(final!).toContain('─────')
+    expect(final!.endsWith('✅ _Standing by for the background merge waiter to complete._')).toBe(true)
+    // The LIVE render must not leak the footer — the turn is not finished.
+    expect(live!).not.toContain('✅')
+  })
+
+  it('composeTurnActivity: a turn that delivered no answer renders NO footer (no fabrication)', () => {
+    const { lane } = makeLane()
+    const turn = makeLaneTurn(lane, { labeledToolCount: 2 })
+    turn.mirrorLines.push('Read the file', 'Ran the tests')
+    turn.lastReplyText = ''
+    const final = lane.composeTurnActivity(turn, true)
+    expect(final!).not.toContain('─────')
+    expect(final!).not.toContain('✅')
+  })
 })
 
 describe('narrative-lane golden — the narrative-dedup gate at turn end', () => {

package/telegram-plugin/tests/obligation-determinism.test.ts

@@ -64,6 +64,8 @@ function memStore(): { fs: ObligationStoreFsSeam } {
         files.delete(a);
       },
       existsSync: (p) => files.has(p),
+      fsyncFileSync: () => {},
+      fsyncDirSync: () => {},
     },
   };
 }

package/telegram-plugin/tests/obligation-store.test.ts

@@ -27,6 +27,12 @@ function memFs(seed: Record<string, string> = {}) {
       files.delete(a);
     },
     existsSync: (p) => files.has(p),
+    fsyncFileSync: (p) => {
+      calls.push(`fsyncFile:${p}`);
+    },
+    fsyncDirSync: (p) => {
+      calls.push(`fsyncDir:${p}`);
+    },
   };
   return { fs, files, calls };
 }
@@ -63,7 +69,12 @@ describe("obligation-store", () => {
   it("persists atomically: writes a sibling .tmp then renames over the path", () => {
     const { fs, calls, files } = memFs();
     persistObligations(PATH, fs, [ob("c:3#1")]);
-    expect(calls).toEqual([`write:${PATH}.tmp`, `rename:${PATH}.tmp->${PATH}`]);
+    expect(calls).toEqual([
+      `write:${PATH}.tmp`,
+      `fsyncFile:${PATH}.tmp`,
+      `rename:${PATH}.tmp->${PATH}`,
+      "fsyncDir:/state/agent/telegram",
+    ]);
     // The tmp is gone (renamed); only the real path remains.
     expect(files.has(PATH)).toBe(true);
     expect(files.has(`${PATH}.tmp`)).toBe(false);
@@ -170,8 +181,63 @@ describe("obligation-store", () => {
       },
       renameSync: () => {},
       existsSync: () => false,
+      fsyncFileSync: () => {},
+      fsyncDirSync: () => {},
     };
     expect(() => persistObligations(PATH, fs, [ob("c:3#1")], (l) => logs.push(l))).not.toThrow();
     expect(logs.join("")).toContain("persist FAILED");
   });
 });
+
+describe("obligation-store — power-cut durability (fsync ordering)", () => {
+  it("fsyncs the tmp file BEFORE the rename and the directory AFTER it", () => {
+    const { fs, calls } = memFs();
+    persistObligations(PATH, fs, [ob("c:3#1")]);
+    // The exact sequence IS the guarantee: syncing the directory before the
+    // rename, or renaming before the tmp file's data is on stable storage,
+    // publishes a name that can point at bytes that were never written.
+    expect(calls).toEqual([
+      `write:${PATH}.tmp`,
+      `fsyncFile:${PATH}.tmp`,
+      `rename:${PATH}.tmp->${PATH}`,
+      "fsyncDir:/state/agent/telegram",
+    ]);
+  });
+
+  it("a failed tmp fsync aborts BEFORE the rename — the previous snapshot is left intact", () => {
+    // Publishing an unsynced tmp over a good snapshot would be strictly worse
+    // than not writing at all, so the rename must not happen.
+    const prior = JSON.stringify({ v: 1, obligations: [ob("c:3#1")] });
+    const { fs, files } = memFs({ [PATH]: prior });
+    const logs: string[] = [];
+    const failing: ObligationStoreFsSeam = {
+      ...fs,
+      fsyncFileSync: () => {
+        throw new Error("EIO: i/o error, fsync");
+      },
+    };
+    expect(() => persistObligations(PATH, failing, [ob("c:3#2")], (l) => logs.push(l))).not.toThrow();
+    expect(logs.join("")).toContain("persist FAILED");
+    expect(files.get(PATH)).toBe(prior);
+    expect(loadObligations(PATH, fs)[0]!.originTurnId).toBe("c:3#1");
+  });
+
+  it("a failed DIRECTORY fsync keeps the written snapshot and is not reported as a failed persist", () => {
+    // The rename already landed, so the snapshot is correct for a process
+    // crash; only the power-cut upgrade is missing. Mislabelling it
+    // "persist FAILED" would send an operator hunting a write that worked.
+    const { fs, files } = memFs();
+    const logs: string[] = [];
+    const failing: ObligationStoreFsSeam = {
+      ...fs,
+      fsyncDirSync: () => {
+        throw new Error("EIO: i/o error, fsync dir");
+      },
+    };
+    expect(() => persistObligations(PATH, failing, [ob("c:3#1")], (l) => logs.push(l))).not.toThrow();
+    expect(logs.join("")).toContain("directory fsync FAILED");
+    expect(logs.join("")).not.toContain("persist FAILED");
+    expect(files.has(PATH)).toBe(true);
+    expect(loadObligations(PATH, fs)).toHaveLength(1);
+  });
+});

package/telegram-plugin/tests/status-pin-boot-recovery.test.ts

@@ -311,7 +311,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
 
   it("every boot pin-cleanup call site follows the won-lock check", () => {
     // #3026: boot cleanup is now invoked via the mutex-gated orchestrator
-    // runBootPinCleanupAndDmSweep(), which awaits statusPinBootCleanup()
+    // runBootPinCleanupAndStalePinSweep(), which awaits statusPinBootCleanup()
     // (+ the other reapers) and then runs the DM stale-pin sweep. The
     // invariant is unchanged: cleanup must only run after the lock is won.
     const lines = gatewaySrc.split("\n");
@@ -344,7 +344,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
     );
     expect(declIdx).toBeGreaterThan(-1);
     const orchestratorIdx = lines.findIndex((l) =>
-      /function runBootPinCleanupAndDmSweep/.test(l),
+      /function runBootPinCleanupAndStalePinSweep/.test(l),
     );
     expect(orchestratorIdx).toBeGreaterThan(-1);
     const invocationIdxs = lines
@@ -365,7 +365,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
 
   it("the blocked (losing) boot exits before reaching cleanup", () => {
     // In the mutex block, `outcome.status === 'blocked'` must lead to
-    // process.exit(1) BEFORE the winner's runBootPinCleanupAndDmSweep() call
+    // process.exit(1) BEFORE the winner's runBootPinCleanupAndStalePinSweep() call
     // in that block — so a loser never touches the shared store.
     const blockedIdx = gatewaySrc.indexOf("outcome.status === 'blocked'");
     expect(blockedIdx).toBeGreaterThan(-1);

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -117,8 +117,8 @@ describe("status-pin-store", () => {
   });
 
   it("fail-open: wrong envelope version / shape loads as []", () => {
-    // v4 is an unknown FUTURE version (v1–v3 are the supported set).
-    const { fs: f1 } = memFs({ [PATH]: JSON.stringify({ v: 4, pins: [pin()] }) });
+    // v5 is an unknown FUTURE version (v1–v4 are the supported set).
+    const { fs: f1 } = memFs({ [PATH]: JSON.stringify({ v: 5, pins: [pin()] }) });
     expect(loadStatusPins(PATH, f1)).toEqual([]);
     const { fs: f2 } = memFs({ [PATH]: JSON.stringify({ v: 1, pins: "nope" }) });
     expect(loadStatusPins(PATH, f2)).toEqual([]);
@@ -548,13 +548,34 @@ describe("status-pin-store — envelope version compat", () => {
     expect(loaded[0].messageId).toBe(715);
   });
 
-  it("round-trips a v2 pending flag and writes v3 envelopes", () => {
+  it("round-trips a v2 pending flag and writes v4 envelopes", () => {
     const { fs, files } = memFs();
     persistStatusPins(PATH, fs, [pin({ pending: true })]);
-    expect(JSON.parse(files.get(PATH)!).v).toBe(3);
+    expect(JSON.parse(files.get(PATH)!).v).toBe(4);
     expect(loadStatusPins(PATH, fs)[0].pending).toBe(true);
   });
 
+  it("v4 persists the forum topic a pin lives in, so a later sweep can aim at it", () => {
+    // Telegram's pin stack is chat-wide and `unpinChatMessage` takes no
+    // message_thread_id, so `unpinAllForumTopicMessages(chat, thread)` is the
+    // only topic-scoped drain a bot has — and it needs this field. Without it a
+    // boot after a crash knows a forum chat has orphans but not where.
+    const { fs, files } = memFs();
+    persistStatusPins(PATH, fs, [pin({ threadId: 77 })]);
+    expect(JSON.parse(files.get(PATH)!).v).toBe(4);
+    expect(loadStatusPins(PATH, fs)[0].threadId).toBe(77);
+  });
+
+  it("drops a row with a non-numeric threadId", () => {
+    const { fs } = memFs({
+      [PATH]: JSON.stringify({
+        v: 4,
+        pins: [pin({ messageId: 715 }), { pinKey: "k", chatId: "c", messageId: 1, threadId: "5" }],
+      }),
+    });
+    expect(loadStatusPins(PATH, fs)).toHaveLength(1);
+  });
+
   it("#3810: a v3 row round-trips its pinnedAt claim age; a v1/v2 row loads without one", () => {
     const { fs } = memFs({
       [PATH]: JSON.stringify({
@@ -584,7 +605,7 @@ describe("status-pin-store — envelope version compat", () => {
   });
 
   it("rejects an unknown future envelope version (fail-open [])", () => {
-    const { fs } = memFs({ [PATH]: JSON.stringify({ v: 4, pins: [pin()] }) });
+    const { fs } = memFs({ [PATH]: JSON.stringify({ v: 5, pins: [pin()] }) });
     expect(idOnly(loadStatusPins(PATH, fs))).toEqual([]);
   });
 

package/telegram-plugin/tests/tg-post-logger-error-shape.test.ts

@@ -0,0 +1,161 @@
+/**
+ * Wire-level outcome tests for the `tg-post` logger's error shape (#3927).
+ *
+ * The bug: grammY resolves its transformer chain with the raw `ApiResponse`
+ * and only converts `{ok:false}` into a thrown `GrammyError` AFTER the chain
+ * returns (grammy `out/core/client.js`, `callApi`). Every Telegram-level
+ * rejection — 429 flood-wait, 400, 403 — therefore reached
+ * `installTgPostLogger` as a RESOLVED value and was logged
+ * `status=ok err=- code=- desc=-`. Only transport `HttpError`s ever hit the
+ * `catch`. A rate-limited `unpinAllChatMessages` on clerk logged as SUCCESS
+ * 3ms before the retry policy logged `429 rate limited, waiting 3s`.
+ *
+ * These tests MUST go through a REAL grammy `Bot` with a stubbed transport
+ * (the same reason `rich-markdown-guard-transformer.test.ts` does): the
+ * mock-`api` harnesses sit ABOVE the transformer layer, so `api.config.use`
+ * transformers never run there and a test written through them would be a
+ * false guard. Stubbing `client.fetch` with an `ok:false` envelope is the
+ * only way to reproduce the exact resolved-rejection path.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { Bot } from 'grammy'
+import { installTgPostLogger } from '../shared/bot-runtime.js'
+
+/**
+ * A real Bot whose transport always answers with the given Telegram
+ * envelope. HTTP status stays 200 — a Bot API rejection is a 200 response
+ * carrying `ok:false`, which is precisely why it resolves the chain.
+ */
+function makeBot(envelope: Record<string, unknown>): Bot {
+  const fakeFetch = (async () =>
+    ({
+      ok: true,
+      status: 200,
+      json: async () => envelope,
+    }) as unknown as Response) as unknown as typeof fetch
+
+  const bot = new Bot('123456:TEST_TOKEN', {
+    botInfo: {
+      id: 123456,
+      is_bot: true,
+      first_name: 'Test',
+      username: 'test_bot',
+      can_join_groups: false,
+      can_read_all_group_messages: false,
+      supports_inline_queries: false,
+      can_connect_to_business: false,
+      has_main_web_app: false,
+    },
+    client: { fetch: fakeFetch },
+  })
+  installTgPostLogger(bot)
+  return bot
+}
+
+/** Run one API call against the stub and return every tg-post line emitted. */
+async function tgPostLinesFor(envelope: Record<string, unknown>): Promise<string[]> {
+  const written: string[] = []
+  const spy = vi
+    .spyOn(process.stderr, 'write')
+    .mockImplementation(((chunk: unknown) => {
+      written.push(String(chunk))
+      return true
+    }) as unknown as typeof process.stderr.write)
+  try {
+    const bot = makeBot(envelope)
+    // grammy converts the ok:false envelope into a thrown GrammyError once
+    // the transformer chain has returned — expected, and not what we assert.
+    await bot.api.sendMessage(4242, 'hello').catch(() => undefined)
+  } finally {
+    spy.mockRestore()
+  }
+  return written.filter(l => l.startsWith('tg-post '))
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('tg-post logger — resolved ok:false responses (#3927)', () => {
+  it('logs a 429 flood-wait as status=err code=429 (FAILS before the fix: logged status=ok)', async () => {
+    const lines = await tgPostLinesFor({
+      ok: false,
+      error_code: 429,
+      description: 'Too Many Requests: retry after 3',
+      parameters: { retry_after: 3 },
+    })
+
+    expect(lines).toHaveLength(1)
+    const line = lines[0]
+    expect(line).toContain('status=err')
+    expect(line).toContain('code=429')
+    expect(line).toContain('err=telegram_429')
+    expect(line).toContain('desc=Too Many Requests: retry after 3')
+    // The precise regression: it must NOT claim success.
+    expect(line).not.toContain('status=ok')
+  })
+
+  it('logs a non-benign 400 as status=err carrying the rejection reason', async () => {
+    const lines = await tgPostLinesFor({
+      ok: false,
+      error_code: 400,
+      description: "Bad Request: can't parse entities: unsupported start tag",
+    })
+
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('status=err')
+    expect(lines[0]).toContain('code=400')
+    expect(lines[0]).toContain("desc=Bad Request: can't parse entities")
+  })
+
+  it('logs a 403 as status=err', async () => {
+    const lines = await tgPostLinesFor({
+      ok: false,
+      error_code: 403,
+      description: 'Forbidden: bot was blocked by the user',
+    })
+
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('status=err')
+    expect(lines[0]).toContain('code=403')
+  })
+})
+
+describe('tg-post logger — benign 400s do not become error noise (#3927)', () => {
+  // Promoting every ok:false to status=err would flood the log with the
+  // high-volume no-ops the retry policy already swallows, burying the signal
+  // this change exists to create. They get their own `benign` tier instead:
+  // still logged (same volume as the status=ok line they replace), never
+  // matched by `grep status=err`.
+  const benign: Array<[string, string]> = [
+    ['not modified', 'Bad Request: message is not modified'],
+    ['edit target gone', 'Bad Request: message to edit not found'],
+    ['delete target gone', 'Bad Request: message to delete not found'],
+  ]
+
+  for (const [label, description] of benign) {
+    it(`logs "${label}" as status=benign, never status=err`, async () => {
+      const lines = await tgPostLinesFor({ ok: false, error_code: 400, description })
+
+      expect(lines).toHaveLength(1)
+      expect(lines[0]).toContain('status=benign')
+      expect(lines[0]).not.toContain('status=err')
+      // Still honest about what happened — the reason is on the line.
+      expect(lines[0]).toContain('code=400')
+      expect(lines[0]).toContain('desc=Bad Request: message')
+    })
+  }
+})
+
+describe('tg-post logger — success is unchanged', () => {
+  it('still logs a genuine ok:true response as status=ok with empty error fields', async () => {
+    const lines = await tgPostLinesFor({
+      ok: true,
+      result: { message_id: 7, date: 0, chat: { id: 4242, type: 'private' } },
+    })
+
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('status=ok')
+    expect(lines[0]).toContain('err=- code=- desc=-')
+  })
+})

package/telegram-plugin/tests/worker-feed-pin-persistence.test.ts

@@ -217,6 +217,36 @@ function makePersistingPinHarness(path: string) {
 describe('worker-feed pin persistence — durable status-pins.json survives steady-state edits (F1)', () => {
   const PATH = '/state/agent/telegram/status-pins.json'
 
+  it('writes an UNAMBIGUOUS (chat, thread) pin key — no trailing-space topic slot', async () => {
+    // The key is persisted verbatim into status-pins.json. It used to be
+    // `${chatId} ${threadId ?? ''}`, so a topic-less group wrote
+    // `"pinKey": "wk:group:-100123 "` — trailing whitespace that survives a
+    // JSON round-trip and is invisible in every log and grep.
+    const bot = makeFakeBot()
+    const pin = makePersistingPinHarness(PATH)
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    clock = 1000
+    await feed.update('w-topicless', '-100123', view({ elapsedMs: 1000, toolCount: 1 }))
+    await flush()
+    clock = 2000
+    await feed.update('w-topic', '-100123', view({ elapsedMs: 1000, toolCount: 1 }), 7)
+    await flush()
+
+    const keys = pin.rows().map((r) => r.pinKey).sort()
+    expect(keys).toEqual(['wk:group:-100123:-', 'wk:group:-100123:7'])
+    // Same chat, different topic ⇒ genuinely different rows, and no key can be
+    // mistaken for another by an operator or a tool reconciling by chat.
+    for (const k of keys) expect(k).toBe(k.trim())
+  })
+
   it('preserves the wk:group row across many steady-state edits (noop-clear must NOT delete it)', async () => {
     const bot = makeFakeBot()
     const pin = makePersistingPinHarness(PATH)