switchroom 0.19.30 → 0.19.32

package/telegram-plugin/tests/boot-pin-sweep-wiring.test.ts

@@ -19,17 +19,17 @@ import { resolve } from 'node:path'
 const gatewaySrc = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8')
 
 describe('boot pin sweep wiring (#3664)', () => {
-  it('never dispatches runBootPinCleanupAndDmSweep() directly — only through the gate', () => {
+  it('never dispatches runBootPinCleanupAndStalePinSweep() directly — only through the gate', () => {
     // The original bug shape, verbatim: a fire-and-forget call at module-eval
     // time. Any direct invocation (voided or awaited) bypasses the bot-ready
     // half of the precondition.
     const directCalls =
-      gatewaySrc.match(/(?<!function\s)(?<![.\w])runBootPinCleanupAndDmSweep\s*\(/g) ?? []
+      gatewaySrc.match(/(?<!function\s)(?<![.\w])runBootPinCleanupAndStalePinSweep\s*\(/g) ?? []
     expect(directCalls).toEqual([])
   })
 
   it('passes the sweep to the gate as a reference, and arms it at both mutex sites', () => {
-    expect(gatewaySrc).toContain('createBootSweepGate({ run: runBootPinCleanupAndDmSweep')
+    expect(gatewaySrc).toContain('createBootSweepGate({ run: runBootPinCleanupAndStalePinSweep')
     // Both startup-lock outcomes (mutex acquired, and the non-atomic
     // writePidFile fallback) arm — neither may dispatch on its own.
     const armSites = gatewaySrc.match(/bootPinSweepGate\.arm\(\)/g) ?? []
@@ -63,15 +63,15 @@ describe('boot pin sweep wiring (#3664)', () => {
       expect(inlineAwaits).toEqual([])
     }
     // The DM-eligibility flip is what a throw used to strand, so it must live
-    // INSIDE the enableDmSweep step callback — not as a statement sequenced
+    // INSIDE the enableSweep step callback — not as a statement sequenced
     // after the reapers, where one rejection skips it for the whole session.
     const lines = gatewaySrc.split('\n')
     const flipIdxs = lines
       .map((l, i) => ({ l, i }))
-      .filter(({ l }) => /^\s*dmPinSweepEligible = true\s*$/.test(l))
+      .filter(({ l }) => /^\s*stalePinSweepEligible = true\s*$/.test(l))
       .map(({ i }) => i)
     expect(flipIdxs.length).toBe(1)
-    expect(lines[flipIdxs[0] - 1]).toContain('enableDmSweep: () => {')
+    expect(lines[flipIdxs[0] - 1]).toContain('enableSweep: () => {')
   })
 
   it('routes the pin API through the asserting seam, never a raw lockedBot.api pin', () => {

package/telegram-plugin/tests/boot-sweep-gate.test.ts

@@ -133,23 +133,23 @@ describe('createBootSweepGate (#3664 Defect A)', () => {
  * Per-step isolation (#3664 salvage S2).
  *
  * The steps used to be a bare sequential `await` chain in gateway.ts. A throw
- * from either card reaper skipped `dmPinSweepEligible = true`, which authorises
- * the DM unpin-all path for the WHOLE SESSION — so one throwing reaper silently
- * disabled DM stale-pin cleanup, including every later lazy first-inbound
+ * from either card reaper skipped `stalePinSweepEligible = true`, which
+ * authorises the stale-pin drain for the WHOLE SESSION — so one throwing reaper
+ * silently disabled stale-pin cleanup, including every later lazy first-inbound
  * sweep. That became newly reachable the moment #3664 made the sweep actually
  * run for the first time.
  *
- * The outcome asserted is "was the DM path enabled and were the DM chats
- * swept", not "was a wrapper called".
+ * The outcome asserted is "was the drain enabled and were the recorded
+ * (chat, thread) targets swept", not "was a wrapper called".
  */
 describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
   function deps(over: Partial<BootPinSweepSteps> = {}) {
     const order: string[] = []
     const logs: string[] = []
     const base: BootPinSweepSteps = {
-      scanDmChatIds: () => {
+      scanSweepTargets: () => {
         order.push('scan')
-        return ['12345']
+        return [{ chatId: '900000001' }]
       },
       statusPinCleanup: async () => {
         order.push('status-pins')
@@ -160,9 +160,9 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       queuedCardReaper: async () => {
         order.push('queued-cards')
       },
-      enableDmSweep: () => order.push('enable-dm'),
-      sweepDm: async (id) => {
-        order.push(`dm:${id}`)
+      enableSweep: () => order.push('enable-sweep'),
+      sweepTarget: async (t) => {
+        order.push(`sweep:${t.chatId}:${t.threadId ?? '-'}`)
       },
       log: (l) => logs.push(l),
     }
@@ -177,8 +177,8 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       'status-pins',
       'activity-cards',
       'queued-cards',
-      'enable-dm',
-      'dm:12345',
+      'enable-sweep',
+      'sweep:900000001:-',
     ])
   })
 
@@ -190,7 +190,13 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
     })
     await runBootPinSweepSteps(d.deps)
     // The DM path is still enabled and the recorded DM chat is still swept.
-    expect(d.order).toEqual(['scan', 'status-pins', 'queued-cards', 'enable-dm', 'dm:12345'])
+    expect(d.order).toEqual([
+      'scan',
+      'status-pins',
+      'queued-cards',
+      'enable-sweep',
+      'sweep:900000001:-',
+    ])
     expect(d.logs.join('')).toContain("step 'activity-card-reaper' failed: boom")
   })
 
@@ -204,32 +210,37 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       queuedCardReaper: boom,
     })
     await runBootPinSweepSteps(d.deps)
-    expect(d.order).toEqual(['scan', 'enable-dm', 'dm:12345'])
+    expect(d.order).toEqual(['scan', 'enable-sweep', 'sweep:900000001:-'])
   })
 
   it('a failing store scan still lets the reapers and the DM enable run', async () => {
     const d = deps({
-      scanDmChatIds: () => {
+      scanSweepTargets: () => {
         throw new Error('ENOENT')
       },
     })
     await runBootPinSweepSteps(d.deps)
-    // No DM ids to sweep, but nothing behind the scan is stranded.
-    expect(d.order).toEqual(['status-pins', 'activity-cards', 'queued-cards', 'enable-dm'])
-    expect(d.logs.join('')).toContain("step 'dm-chat-scan' failed: ENOENT")
+    // No targets to sweep, but nothing behind the scan is stranded.
+    expect(d.order).toEqual(['status-pins', 'activity-cards', 'queued-cards', 'enable-sweep'])
+    expect(d.logs.join('')).toContain("step 'sweep-target-scan' failed: ENOENT")
   })
 
-  it('one failing DM chat does not block the next one', async () => {
+  it('one failing target does not block the next one, and topics stay distinct', async () => {
     const swept: string[] = []
     const d = deps({
-      scanDmChatIds: () => ['1', '2'],
-      sweepDm: async (id) => {
-        if (id === '1') throw new Error('kicked')
-        swept.push(id)
+      scanSweepTargets: () => [
+        { chatId: '-1009000000001', threadId: 5 },
+        { chatId: '-1009000000001', threadId: 9 },
+      ],
+      sweepTarget: async (t) => {
+        if (t.threadId === 5) throw new Error('kicked')
+        swept.push(`${t.chatId}:${t.threadId}`)
       },
     })
     await runBootPinSweepSteps(d.deps)
-    expect(swept).toEqual(['2'])
+    expect(swept).toEqual(['-1009000000001:9'])
+    // Each target gets its own named step, keyed by (chat, thread).
+    expect(d.logs.join('')).toContain("step 'stale-pin-sweep:-1009000000001:5' failed: kicked")
   })
 
   it('logs a non-Error throw honestly instead of "undefined"', async () => {
@@ -250,7 +261,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
     const order: string[] = []
     await expect(
       runBootPinSweepSteps({
-        scanDmChatIds: () => [],
+        scanSweepTargets: () => [],
         statusPinCleanup: async () => {
           throw new Error('boom')
         },
@@ -260,14 +271,14 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
         queuedCardReaper: async () => {
           order.push('queued-cards')
         },
-        enableDmSweep: () => order.push('enable-dm'),
-        sweepDm: async () => {},
+        enableSweep: () => order.push('enable-sweep'),
+        sweepTarget: async () => {},
         log: () => {
           throw new Error('EPIPE')
         },
       }),
     ).resolves.toBeUndefined()
-    expect(order).toEqual(['activity-cards', 'queued-cards', 'enable-dm'])
+    expect(order).toEqual(['activity-cards', 'queued-cards', 'enable-sweep'])
   })
 
   it('never rejects — the caller fire-and-forgets it', async () => {
@@ -276,16 +287,16 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
     }
     await expect(
       runBootPinSweepSteps({
-        scanDmChatIds: () => {
+        scanSweepTargets: () => {
           throw new Error('boom')
         },
         statusPinCleanup: boom,
         activityCardReaper: boom,
         queuedCardReaper: boom,
-        enableDmSweep: () => {
+        enableSweep: () => {
           throw new Error('boom')
         },
-        sweepDm: boom,
+        sweepTarget: boom,
         log: () => {},
       }),
     ).resolves.toBeUndefined()

package/telegram-plugin/tests/inbound-delivery-machine-dispatch.test.ts

@@ -245,6 +245,8 @@ describe('dispatchEffects — inbound-routing effects (PR3c wiring)', () => {
       },
       existsSync: (p: string) => files.has(p),
       statSizeSync: (p: string) => Buffer.byteLength(files.get(p) ?? ''),
+      fsyncFileSync: () => {},
+      fsyncDirSync: () => {},
     }
     const spool = createInboundSpool({ path: spoolPath, fs, log: () => {} })
     const buffer = createPendingInboundBuffer({ spool, log: () => {} })

package/telegram-plugin/tests/inbound-spool-progress.test.ts

@@ -60,6 +60,8 @@ function fakeFs(): InboundSpoolFsSeam {
     },
     existsSync: (p) => files.has(p),
     statSizeSync: (p) => Buffer.byteLength(files.get(p) ?? ''),
+    fsyncFileSync: () => {},
+    fsyncDirSync: () => {},
   }
 }
 

package/telegram-plugin/tests/inbound-spool.test.ts

@@ -33,20 +33,33 @@ function msg(over: Partial<InboundMessage> = {}): InboundMessage {
 }
 
 /** In-memory fake fs keyed by path. Models append, full rewrite, and
- *  atomic rename (so the tmp→rename compaction path is exercised). */
-function fakeFs(): InboundSpoolFsSeam & { dump(p?: string): string } {
+ *  atomic rename (so the tmp→rename compaction path is exercised).
+ *  `ops` records the mutating/durability calls in order, so tests can pin
+ *  the fsync ORDERING the crash-durability guarantee depends on. */
+function fakeFs(): InboundSpoolFsSeam & { dump(p?: string): string; ops: string[] } {
   const files = new Map<string, string>()
+  const ops: string[] = []
   return {
-    appendFileSync: (p, d) => files.set(p, (files.get(p) ?? '') + d),
+    appendFileSync: (p, d) => {
+      ops.push(`append:${p}`)
+      files.set(p, (files.get(p) ?? '') + d)
+    },
     readFileSync: (p) => files.get(p) ?? '',
-    writeFileSync: (p, d) => files.set(p, d),
+    writeFileSync: (p, d) => {
+      ops.push(`write:${p}`)
+      files.set(p, d)
+    },
     renameSync: (from, to) => {
+      ops.push(`rename:${from}->${to}`)
       files.set(to, files.get(from) ?? '')
       files.delete(from)
     },
     existsSync: (p) => files.has(p),
     statSizeSync: (p) => Buffer.byteLength(files.get(p) ?? ''),
+    fsyncFileSync: (p) => ops.push(`fsyncFile:${p}`),
+    fsyncDirSync: (p) => ops.push(`fsyncDir:${p}`),
     dump: (p = PATH) => files.get(p) ?? '',
+    ops,
   }
 }
 
@@ -478,6 +491,92 @@ describe('inbound-spool — robustness', () => {
   })
 })
 
+describe('inbound-spool — power-cut durability (fsync)', () => {
+  it('fsyncs the spool file on every appended record', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    s.put('a', msg({ messageId: 1 }))
+    s.ack(msg({ messageId: 1 }))
+    // Both the put record and the ack tombstone are durability-critical:
+    // an un-synced ack replays an already-answered message after a power
+    // cut, an un-synced put loses it entirely.
+    expect(fs.ops).toEqual([
+      `append:${PATH}`,
+      `fsyncFile:${PATH}`,
+      `append:${PATH}`,
+      `fsyncFile:${PATH}`,
+    ])
+  })
+
+  it('compaction fsyncs the tmp file BEFORE the rename and the directory AFTER', () => {
+    const fs = fakeFs()
+    const s = createInboundSpool({ path: PATH, fs, compactAtBytes: 200, log: () => {} })
+    for (let i = 1; i <= 10; i++) s.put('a', msg({ messageId: i, text: 'y'.repeat(50) }))
+    // The bound triggers several compactions across the 10 puts; each one
+    // must follow the same four-step sequence, so pin the last.
+    expect(fs.ops.slice(-4)).toEqual([
+      `write:${PATH}.compact.tmp`,
+      `fsyncFile:${PATH}.compact.tmp`,
+      `rename:${PATH}.compact.tmp->${PATH}`,
+      'fsyncDir:/state/agent/telegram',
+    ])
+  })
+
+  it('a failed compaction directory fsync is not reported as a failed compaction', () => {
+    // The rename already landed, so the compacted log IS on disk; only the
+    // power-cut upgrade is missing. Calling it "compact FAILED" would send an
+    // operator hunting a rewrite that actually worked.
+    const fs = fakeFs()
+    const logs: string[] = []
+    fs.fsyncDirSync = () => {
+      throw new Error('EIO: i/o error, fsync dir')
+    }
+    const s = createInboundSpool({ path: PATH, fs, compactAtBytes: 200, log: (l) => logs.push(l) })
+    for (let i = 1; i <= 10; i++) s.put('a', msg({ messageId: i, text: 'y'.repeat(50) }))
+    expect(logs.join('')).toContain('compact directory fsync FAILED')
+    expect(logs.join('')).toContain('compacted path=')
+    // And the compacted log is intact and readable — nothing was rolled back.
+    const s2 = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(s2.liveCount()).toBe(10)
+  })
+
+  it('an un-acked entry survives a POWER CUT, not just a process kill', () => {
+    // Models the distinction the fsync exists for: `appendFileSync` returning
+    // puts the bytes in the page cache (enough to survive SIGKILL — the
+    // process dies, the kernel still holds them), but only fsync puts them on
+    // stable storage. `powerCut()` discards everything not fsync'd, which is
+    // what a host power loss actually does.
+    const cache = new Map<string, string>()
+    const platter = new Map<string, string>()
+    const fs: InboundSpoolFsSeam = {
+      appendFileSync: (p, d) => cache.set(p, (cache.get(p) ?? '') + d),
+      readFileSync: (p) => cache.get(p) ?? '',
+      writeFileSync: (p, d) => cache.set(p, d),
+      renameSync: (from, to) => {
+        cache.set(to, cache.get(from) ?? '')
+        cache.delete(from)
+      },
+      existsSync: (p) => cache.has(p),
+      statSizeSync: (p) => Buffer.byteLength(cache.get(p) ?? ''),
+      fsyncFileSync: (p) => {
+        if (cache.has(p)) platter.set(p, cache.get(p)!)
+      },
+      fsyncDirSync: () => {},
+    }
+    const powerCut = (): void => {
+      cache.clear()
+      for (const [p, d] of platter) cache.set(p, d)
+    }
+
+    const s = createInboundSpool({ path: PATH, fs, log: () => {} })
+    s.put('a', msg({ messageId: 7, text: 'answer me' }))
+    powerCut()
+
+    const rebooted = createInboundSpool({ path: PATH, fs, log: () => {} })
+    expect(rebooted.liveEntries().map((e) => e.msg.messageId)).toEqual([7])
+  })
+})
+
 describe('inbound-spool — #2789 C: multi-message drop notice reports the real count', () => {
   it('passes the true per-chat dropped count to the coalesced notice', () => {
     const fs = fakeFs()
@@ -549,10 +648,14 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
   // An fs whose appendFileSync can be toggled to fail, modelling a full /
   // unwritable persistent volume. The append swallows the error (delivery
   // must not break) but the degradation must be SURFACED, not silent.
-  function toggleableFs(): InboundSpoolFsSeam & { fail: boolean } {
+  function toggleableFs(): InboundSpoolFsSeam & { fail: boolean; failFsync: boolean } {
     const files = new Map<string, string>()
     const seam = {
       fail: false,
+      // A failing fsync is its own degradation mode: the bytes reached the
+      // page cache but NOT stable storage, so the durable promise is gone
+      // even though appendFileSync returned cleanly.
+      failFsync: false,
       appendFileSync(p: string, d: string) {
         if (seam.fail) throw new Error('ENOSPC: no space left on device')
         files.set(p, (files.get(p) ?? '') + d)
@@ -565,6 +668,10 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
       },
       existsSync: (p: string) => files.has(p),
       statSizeSync: (p: string) => Buffer.byteLength(files.get(p) ?? ''),
+      fsyncFileSync: (_p: string) => {
+        if (seam.failFsync) throw new Error('EIO: i/o error, fsync')
+      },
+      fsyncDirSync: (_p: string) => {},
     }
     return seam
   }
@@ -588,6 +695,28 @@ describe('inbound-spool — #2789 B: spool write failure surfaces a health signa
     expect(events).toEqual([{ degraded: true, consecutiveFailures: 1 }])
   })
 
+  it('a failing fsync degrades too — a cached-but-unsynced append is NOT durable', () => {
+    // The subtle one: appendFileSync succeeds, so the old code would have
+    // reported a healthy spool while the record was one power cut from gone.
+    const fs = toggleableFs()
+    const events: { degraded: boolean }[] = []
+    const logs: string[] = []
+    const s = createInboundSpool({
+      path: PATH,
+      fs,
+      log: (l) => logs.push(l),
+      onDegraded: (info) => events.push({ degraded: info.degraded }),
+    })
+    fs.failFsync = true
+    expect(() => s.put('a', msg({ messageId: 1, ts: 1 }))).not.toThrow()
+    expect(s.isDegraded()).toBe(true)
+    expect(events).toEqual([{ degraded: true }])
+    expect(logs.join('')).toContain('durability degraded')
+    // Live delivery is unaffected — degradation is a durability claim, not a
+    // delivery failure.
+    expect(s.liveCount()).toBe(1)
+  })
+
   it('does not re-fire the degraded signal on every failing append (latched)', () => {
     const fs = toggleableFs()
     const events: boolean[] = []

package/telegram-plugin/tests/narrative-lane-golden.test.ts

@@ -211,6 +211,34 @@ describe('narrative-lane golden — SHOW path opens then edits ONE feed card', (
     expect(final!).toMatch(/3 steps/)
     expect(live!).not.toMatch(/3 steps/)
   })
+
+  it('composeTurnActivity: the FINAL render ends with the ✅ + delivered-answer footer', () => {
+    // Parity with the 🛠 worker card, which has always closed on `✅ <summary>`.
+    // The agent card's analogue of the worker's `latestSummary` is the answer
+    // the turn actually delivered (`turn.lastReplyText`); the lane threads it
+    // into the header as `resultText` and the SHARED `deriveCardResult` renders
+    // it. Fails on the pre-fix lane, which passed no result text at all.
+    const { lane } = makeLane()
+    const turn = makeLaneTurn(lane, { labeledToolCount: 2 })
+    turn.mirrorLines.push('Read the file', 'Ran the tests')
+    turn.lastReplyText = 'Standing by for the background merge waiter to complete.'
+    const live = lane.composeTurnActivity(turn)
+    const final = lane.composeTurnActivity(turn, true)
+    expect(final!).toContain('─────')
+    expect(final!.endsWith('✅ _Standing by for the background merge waiter to complete._')).toBe(true)
+    // The LIVE render must not leak the footer — the turn is not finished.
+    expect(live!).not.toContain('✅')
+  })
+
+  it('composeTurnActivity: a turn that delivered no answer renders NO footer (no fabrication)', () => {
+    const { lane } = makeLane()
+    const turn = makeLaneTurn(lane, { labeledToolCount: 2 })
+    turn.mirrorLines.push('Read the file', 'Ran the tests')
+    turn.lastReplyText = ''
+    const final = lane.composeTurnActivity(turn, true)
+    expect(final!).not.toContain('─────')
+    expect(final!).not.toContain('✅')
+  })
 })
 
 describe('narrative-lane golden — the narrative-dedup gate at turn end', () => {

package/telegram-plugin/tests/obligation-determinism.test.ts

@@ -64,6 +64,8 @@ function memStore(): { fs: ObligationStoreFsSeam } {
         files.delete(a);
       },
       existsSync: (p) => files.has(p),
+      fsyncFileSync: () => {},
+      fsyncDirSync: () => {},
     },
   };
 }

package/telegram-plugin/tests/obligation-store.test.ts

@@ -27,6 +27,12 @@ function memFs(seed: Record<string, string> = {}) {
       files.delete(a);
     },
     existsSync: (p) => files.has(p),
+    fsyncFileSync: (p) => {
+      calls.push(`fsyncFile:${p}`);
+    },
+    fsyncDirSync: (p) => {
+      calls.push(`fsyncDir:${p}`);
+    },
   };
   return { fs, files, calls };
 }
@@ -63,7 +69,12 @@ describe("obligation-store", () => {
   it("persists atomically: writes a sibling .tmp then renames over the path", () => {
     const { fs, calls, files } = memFs();
     persistObligations(PATH, fs, [ob("c:3#1")]);
-    expect(calls).toEqual([`write:${PATH}.tmp`, `rename:${PATH}.tmp->${PATH}`]);
+    expect(calls).toEqual([
+      `write:${PATH}.tmp`,
+      `fsyncFile:${PATH}.tmp`,
+      `rename:${PATH}.tmp->${PATH}`,
+      "fsyncDir:/state/agent/telegram",
+    ]);
     // The tmp is gone (renamed); only the real path remains.
     expect(files.has(PATH)).toBe(true);
     expect(files.has(`${PATH}.tmp`)).toBe(false);
@@ -170,8 +181,63 @@ describe("obligation-store", () => {
       },
       renameSync: () => {},
       existsSync: () => false,
+      fsyncFileSync: () => {},
+      fsyncDirSync: () => {},
     };
     expect(() => persistObligations(PATH, fs, [ob("c:3#1")], (l) => logs.push(l))).not.toThrow();
     expect(logs.join("")).toContain("persist FAILED");
   });
 });
+
+describe("obligation-store — power-cut durability (fsync ordering)", () => {
+  it("fsyncs the tmp file BEFORE the rename and the directory AFTER it", () => {
+    const { fs, calls } = memFs();
+    persistObligations(PATH, fs, [ob("c:3#1")]);
+    // The exact sequence IS the guarantee: syncing the directory before the
+    // rename, or renaming before the tmp file's data is on stable storage,
+    // publishes a name that can point at bytes that were never written.
+    expect(calls).toEqual([
+      `write:${PATH}.tmp`,
+      `fsyncFile:${PATH}.tmp`,
+      `rename:${PATH}.tmp->${PATH}`,
+      "fsyncDir:/state/agent/telegram",
+    ]);
+  });
+
+  it("a failed tmp fsync aborts BEFORE the rename — the previous snapshot is left intact", () => {
+    // Publishing an unsynced tmp over a good snapshot would be strictly worse
+    // than not writing at all, so the rename must not happen.
+    const prior = JSON.stringify({ v: 1, obligations: [ob("c:3#1")] });
+    const { fs, files } = memFs({ [PATH]: prior });
+    const logs: string[] = [];
+    const failing: ObligationStoreFsSeam = {
+      ...fs,
+      fsyncFileSync: () => {
+        throw new Error("EIO: i/o error, fsync");
+      },
+    };
+    expect(() => persistObligations(PATH, failing, [ob("c:3#2")], (l) => logs.push(l))).not.toThrow();
+    expect(logs.join("")).toContain("persist FAILED");
+    expect(files.get(PATH)).toBe(prior);
+    expect(loadObligations(PATH, fs)[0]!.originTurnId).toBe("c:3#1");
+  });
+
+  it("a failed DIRECTORY fsync keeps the written snapshot and is not reported as a failed persist", () => {
+    // The rename already landed, so the snapshot is correct for a process
+    // crash; only the power-cut upgrade is missing. Mislabelling it
+    // "persist FAILED" would send an operator hunting a write that worked.
+    const { fs, files } = memFs();
+    const logs: string[] = [];
+    const failing: ObligationStoreFsSeam = {
+      ...fs,
+      fsyncDirSync: () => {
+        throw new Error("EIO: i/o error, fsync dir");
+      },
+    };
+    expect(() => persistObligations(PATH, failing, [ob("c:3#1")], (l) => logs.push(l))).not.toThrow();
+    expect(logs.join("")).toContain("directory fsync FAILED");
+    expect(logs.join("")).not.toContain("persist FAILED");
+    expect(files.has(PATH)).toBe(true);
+    expect(loadObligations(PATH, fs)).toHaveLength(1);
+  });
+});

package/telegram-plugin/tests/status-pin-boot-recovery.test.ts

@@ -311,7 +311,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
 
   it("every boot pin-cleanup call site follows the won-lock check", () => {
     // #3026: boot cleanup is now invoked via the mutex-gated orchestrator
-    // runBootPinCleanupAndDmSweep(), which awaits statusPinBootCleanup()
+    // runBootPinCleanupAndStalePinSweep(), which awaits statusPinBootCleanup()
     // (+ the other reapers) and then runs the DM stale-pin sweep. The
     // invariant is unchanged: cleanup must only run after the lock is won.
     const lines = gatewaySrc.split("\n");
@@ -344,7 +344,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
     );
     expect(declIdx).toBeGreaterThan(-1);
     const orchestratorIdx = lines.findIndex((l) =>
-      /function runBootPinCleanupAndDmSweep/.test(l),
+      /function runBootPinCleanupAndStalePinSweep/.test(l),
     );
     expect(orchestratorIdx).toBeGreaterThan(-1);
     const invocationIdxs = lines
@@ -365,7 +365,7 @@ describe("status-pin boot cleanup is mutex-gated (structural)", () => {
 
   it("the blocked (losing) boot exits before reaching cleanup", () => {
     // In the mutex block, `outcome.status === 'blocked'` must lead to
-    // process.exit(1) BEFORE the winner's runBootPinCleanupAndDmSweep() call
+    // process.exit(1) BEFORE the winner's runBootPinCleanupAndStalePinSweep() call
     // in that block — so a loser never touches the shared store.
     const blockedIdx = gatewaySrc.indexOf("outcome.status === 'blocked'");
     expect(blockedIdx).toBeGreaterThan(-1);

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -117,8 +117,8 @@ describe("status-pin-store", () => {
   });
 
   it("fail-open: wrong envelope version / shape loads as []", () => {
-    // v4 is an unknown FUTURE version (v1–v3 are the supported set).
-    const { fs: f1 } = memFs({ [PATH]: JSON.stringify({ v: 4, pins: [pin()] }) });
+    // v5 is an unknown FUTURE version (v1–v4 are the supported set).
+    const { fs: f1 } = memFs({ [PATH]: JSON.stringify({ v: 5, pins: [pin()] }) });
     expect(loadStatusPins(PATH, f1)).toEqual([]);
     const { fs: f2 } = memFs({ [PATH]: JSON.stringify({ v: 1, pins: "nope" }) });
     expect(loadStatusPins(PATH, f2)).toEqual([]);
@@ -548,13 +548,34 @@ describe("status-pin-store — envelope version compat", () => {
     expect(loaded[0].messageId).toBe(715);
   });
 
-  it("round-trips a v2 pending flag and writes v3 envelopes", () => {
+  it("round-trips a v2 pending flag and writes v4 envelopes", () => {
     const { fs, files } = memFs();
     persistStatusPins(PATH, fs, [pin({ pending: true })]);
-    expect(JSON.parse(files.get(PATH)!).v).toBe(3);
+    expect(JSON.parse(files.get(PATH)!).v).toBe(4);
     expect(loadStatusPins(PATH, fs)[0].pending).toBe(true);
   });
 
+  it("v4 persists the forum topic a pin lives in, so a later sweep can aim at it", () => {
+    // Telegram's pin stack is chat-wide and `unpinChatMessage` takes no
+    // message_thread_id, so `unpinAllForumTopicMessages(chat, thread)` is the
+    // only topic-scoped drain a bot has — and it needs this field. Without it a
+    // boot after a crash knows a forum chat has orphans but not where.
+    const { fs, files } = memFs();
+    persistStatusPins(PATH, fs, [pin({ threadId: 77 })]);
+    expect(JSON.parse(files.get(PATH)!).v).toBe(4);
+    expect(loadStatusPins(PATH, fs)[0].threadId).toBe(77);
+  });
+
+  it("drops a row with a non-numeric threadId", () => {
+    const { fs } = memFs({
+      [PATH]: JSON.stringify({
+        v: 4,
+        pins: [pin({ messageId: 715 }), { pinKey: "k", chatId: "c", messageId: 1, threadId: "5" }],
+      }),
+    });
+    expect(loadStatusPins(PATH, fs)).toHaveLength(1);
+  });
+
   it("#3810: a v3 row round-trips its pinnedAt claim age; a v1/v2 row loads without one", () => {
     const { fs } = memFs({
       [PATH]: JSON.stringify({
@@ -584,7 +605,7 @@ describe("status-pin-store — envelope version compat", () => {
   });
 
   it("rejects an unknown future envelope version (fail-open [])", () => {
-    const { fs } = memFs({ [PATH]: JSON.stringify({ v: 4, pins: [pin()] }) });
+    const { fs } = memFs({ [PATH]: JSON.stringify({ v: 5, pins: [pin()] }) });
     expect(idOnly(loadStatusPins(PATH, fs))).toEqual([]);
   });