switchroom 0.20.10 → 0.20.12

package/telegram-plugin/gateway/self-improve-proposal-wiring.ts

@@ -0,0 +1,176 @@
+/**
+ * Self-improvement proposal IPC handlers, lifted out of gateway.ts.
+ *
+ * Both `post_skill_proposal` (#2670 one-tap self-improvement) and
+ * `post_eval_case_proposal` (RFC amendment §"corrections as eval cases")
+ * arrive over the per-agent gateway socket, are chat-fenced via
+ * `assertAllowedChat`, persisted to their respective store, and rendered as
+ * an Approve/Dismiss card. The store transition + apply on Approve are owned
+ * by the callback handlers (so a gateway restart between post and tap still
+ * resolves), NOT here.
+ *
+ * These live in a module (not inline in gateway.ts) so the gateway anti-
+ * inflation line ratchet stays flat and the handler bodies are unit-testable
+ * against a stubbed `bot` / `swallowingApiCall`. gateway.ts keeps only a thin
+ * delegate per handler.
+ *
+ * The `bot.api.sendMessage` calls are wrapped in the injected
+ * `swallowingApiCall` exactly as they were in gateway.ts — the bot-api-wrapping
+ * lint recognises the wrapper by name in the surrounding context.
+ */
+
+import type { Bot, Context } from 'grammy'
+import type { RetryCallOpts } from '../retry-api-call.js'
+import type { PostSkillProposalMessage, PostEvalCaseProposalMessage } from './ipc-protocol.js'
+import { renderSkillProposalCard, skillProposalKeyboard } from './skill-proposal-card.js'
+import { renderEvalCaseProposalCard, evalCaseProposalKeyboard } from './eval-case-proposal-card.js'
+import {
+  enqueueProposal as enqueueSkillProposal,
+  isSuppressed as isSkillProposalSuppressed,
+} from '../../src/self-improve/skill-proposals.js'
+import { enqueueEvalCaseProposal } from '../../src/self-improve/eval-case-proposals.js'
+
+/** Collaborators the gateway injects into each handler. */
+export interface ProposalWiringDeps {
+  bot: Bot<Context>
+  assertAllowedChat: (chatId: string) => void
+  swallowingApiCall: <T>(fn: () => Promise<T>, opts?: RetryCallOpts) => Promise<T | undefined>
+}
+
+/**
+ * #2670 one-tap self-improvement — persist a skill-improvement proposal and
+ * post its Approve/Dismiss card. Dedups against still-live rejection
+ * fingerprints so a dismissed proposal never re-surfaces.
+ */
+export function handlePostSkillProposal(
+  msg: PostSkillProposalMessage,
+  deps: ProposalWiringDeps,
+): void {
+  const { bot, assertAllowedChat, swallowingApiCall } = deps
+  const self = process.env.SWITCHROOM_AGENT_NAME
+  if (self && msg.agentName !== self) {
+    process.stderr.write(
+      `telegram gateway: post_skill_proposal rejected — agent mismatch (${msg.agentName} != ${self})\n`,
+    )
+    return
+  }
+  try {
+    assertAllowedChat(msg.chatId)
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: post_skill_proposal rejected — ${(err as Error).message}\n`,
+    )
+    return
+  }
+  const stateDir = process.env.TELEGRAM_STATE_DIR
+  if (stateDir == null || stateDir.length === 0) {
+    process.stderr.write(`telegram gateway: post_skill_proposal: TELEGRAM_STATE_DIR unset, skipping\n`)
+    return
+  }
+  // Dedup against still-live rejection fingerprints — never re-surface a
+  // proposal the operator already dismissed.
+  if (isSkillProposalSuppressed(stateDir, {
+    lesson: msg.lesson,
+    draft: msg.draft,
+    skill_slug: msg.skillSlug,
+  })) {
+    process.stderr.write(
+      `telegram gateway: post_skill_proposal suppressed (rejected before) slug=${msg.skillSlug}\n`,
+    )
+    return
+  }
+  const proposal = enqueueSkillProposal(stateDir, {
+    skill_slug: msg.skillSlug,
+    is_new: msg.isNew,
+    lesson: msg.lesson,
+    draft: msg.draft,
+    evidence: msg.evidence,
+    chat_id: Number(msg.chatId),
+    // Provenance — absent ⇒ the store's back-compat default (skill-synthesis).
+    ...(msg.origin != null ? { origin: msg.origin } : {}),
+  })
+  const cardText = renderSkillProposalCard({
+    id: proposal.id,
+    skill_slug: proposal.skill_slug,
+    is_new: proposal.is_new,
+    lesson: proposal.lesson,
+    evidence: proposal.evidence,
+    skill_md: proposal.draft['SKILL.md'],
+  })
+  const threadId = msg.threadId
+  void swallowingApiCall(
+    () =>
+      bot.api.sendMessage(msg.chatId, cardText, {
+        parse_mode: 'HTML',
+        reply_markup: skillProposalKeyboard(proposal.id),
+        ...(threadId != null && threadId !== 1 ? { message_thread_id: threadId } : {}),
+      }),
+    { chat_id: msg.chatId, verb: 'skill-proposal-card', ...(threadId != null ? { threadId } : {}) },
+  )
+  process.stderr.write(
+    `telegram gateway: post_skill_proposal agent=${msg.agentName} chat=${msg.chatId} ` +
+    `proposal=${proposal.id} slug=${proposal.skill_slug} new=${proposal.is_new}\n`,
+  )
+}
+
+/**
+ * RFC amendment §"corrections as eval cases" — persist an eval-case proposal
+ * and post its Approve/Dismiss card. On Approve the callback runs the
+ * DETERMINISTIC applier (handleEvalCaseProposalCallback), NOT a model turn, so
+ * the case lands byte-exact. Same per-agent-socket / chat-fenced trust model
+ * as handlePostSkillProposal.
+ */
+export function handlePostEvalCaseProposal(
+  msg: PostEvalCaseProposalMessage,
+  deps: ProposalWiringDeps,
+): void {
+  const { bot, assertAllowedChat, swallowingApiCall } = deps
+  const self = process.env.SWITCHROOM_AGENT_NAME
+  if (self && msg.agentName !== self) {
+    process.stderr.write(
+      `telegram gateway: post_eval_case_proposal rejected — agent mismatch (${msg.agentName} != ${self})\n`,
+    )
+    return
+  }
+  try {
+    assertAllowedChat(msg.chatId)
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: post_eval_case_proposal rejected — ${(err as Error).message}\n`,
+    )
+    return
+  }
+  const stateDir = process.env.TELEGRAM_STATE_DIR
+  if (stateDir == null || stateDir.length === 0) {
+    process.stderr.write(`telegram gateway: post_eval_case_proposal: TELEGRAM_STATE_DIR unset, skipping\n`)
+    return
+  }
+  const proposal = enqueueEvalCaseProposal(stateDir, {
+    skill_slug: msg.skillSlug,
+    skill_dir: msg.skillDir,
+    case: msg.case,
+    fingerprint: msg.fingerprint,
+    held_out: msg.heldOut === true,
+    chat_id: Number(msg.chatId),
+  })
+  const cardText = renderEvalCaseProposalCard({
+    id: proposal.id,
+    skill_slug: proposal.skill_slug,
+    held_out: proposal.held_out,
+    case: proposal.case,
+  })
+  const threadId = msg.threadId
+  void swallowingApiCall(
+    () =>
+      bot.api.sendMessage(msg.chatId, cardText, {
+        parse_mode: 'HTML',
+        reply_markup: evalCaseProposalKeyboard(proposal.id),
+        ...(threadId != null && threadId !== 1 ? { message_thread_id: threadId } : {}),
+      }),
+    { chat_id: msg.chatId, verb: 'eval-case-proposal-card', ...(threadId != null ? { threadId } : {}) },
+  )
+  process.stderr.write(
+    `telegram gateway: post_eval_case_proposal agent=${msg.agentName} chat=${msg.chatId} ` +
+    `proposal=${proposal.id} slug=${proposal.skill_slug} held_out=${proposal.held_out}\n`,
+  )
+}

package/telegram-plugin/gateway/stale-pin-sweep-wiring.ts

@@ -51,9 +51,7 @@ export interface StalePinSweepBotSeam {
       ) => Promise<unknown>
       unpinChatMessage: (chatId: string, messageId: number) => Promise<unknown>
       unpinAllForumTopicMessages: (chatId: string, threadId: number) => Promise<unknown>
-      getChatMember: (chatId: string, userId: number) => Promise<unknown>
     }
-    botInfo?: { id?: number }
   }
   /** The gateway's retry/telemetry envelope (`robustApiCall`). */
   call: <T>(fn: () => Promise<T>, meta: { chat_id: string; verb: string }) => Promise<T>
@@ -68,6 +66,14 @@ export interface StalePinSweepWiring {
   loadPinRows: () => PersistedStatusPin[]
   /** Mutex-won AND bot-constructed. False ⇒ the drain must not write. */
   eligible: () => boolean
+  /**
+   * The SHARED per-process pin-rights negative cache (status-pin.ts
+   * `PinRightsCache`), unifying the sweep and the live status-pin path on which
+   * chats are rights-less. Only `isBlocked`/`block` are used here; the live
+   * path owns `clear` (on a successful explicit pin) and boot owns the reset.
+   * Optional — undefined ⇒ the sweep relies purely on its reactive classifier.
+   */
+  rightsCache?: { isBlocked: (chatId: string) => boolean; block: (chatId: string) => boolean }
   store: { path: string; fs: SweepStoreFsSeam }
   /** Per-deployment override of `UNPIN_ALL_FORUM_TOPIC_ENABLED`; undefined =
    *  take the standing policy (the wholesale topic drain stays OFF). */
@@ -168,18 +174,16 @@ export function createGatewayStalePinSweeper(w: StalePinSweepWiring): StalePinSw
         chat_id: chatId,
         verb: 'stale-pin-sweep.unpin-all-topic',
       }),
-    // Rights are checked before ANY write in a group. Telegram is HONEST about
-    // missing pin rights (400 "not enough rights to manage pinned messages"),
-    // but the precheck keeps a rights-less bot from emitting doomed traffic.
-    canPinInChat: async (chatId) => {
-      const self = bot().botInfo?.id
-      if (self == null) return false
-      const member = (await call(() => bot().api.getChatMember(chatId, self), {
-        chat_id: chatId,
-        verb: 'stale-pin-sweep.get-chat-member',
-      })) as { status?: string; can_pin_messages?: boolean } | undefined
-      return member?.status === 'administrator' && member.can_pin_messages === true
-    },
+    // No proactive rights precheck. The old `getChatMember` precheck read
+    // `bot().botInfo?.id`, but the sweep runs against the chat-lock-wrapped bot
+    // (`wrapBot({ api: bot.api })`), which carries only `.api` — `.botInfo` was
+    // always undefined, so `self` was always null and every group precheck
+    // returned false, forfeiting every group cursor without a single unpin. The
+    // sweep now relies SOLELY on its reactive classifier: it attempts the unpin
+    // and classifies Telegram's honest `400 "not enough rights"` via
+    // `isPinRightsError`. Telegram is authoritative about pin rights; a precheck
+    // could only ever be redundant with (and, wired against the wrong bot,
+    // wrong about) that answer.
     recordedPinIds: (chatId, threadId) => {
       try {
         return recordedPinIdsFor(w.loadPinRows(), chatId, threadId)
@@ -200,6 +204,12 @@ export function createGatewayStalePinSweeper(w: StalePinSweepWiring): StalePinSw
         log,
       }),
     eligible: w.eligible,
+    rightsBlocked: w.rightsCache ? (chatId) => w.rightsCache!.isBlocked(chatId) : undefined,
+    recordRightsBlock: w.rightsCache
+      ? (chatId) => {
+          w.rightsCache!.block(chatId)
+        }
+      : undefined,
     sleep: w.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
     now,
     store: w.store,

package/telegram-plugin/gateway/stale-pin-sweep.test.ts

@@ -22,7 +22,6 @@ import {
   createStalePinSweeper,
   isNothingToUnpinError,
   isPeerFloodError,
-  isPinRightsError,
   mayUnpinAllForumTopic,
   retryAfterSeconds,
   unexpiredStoreRepinIds,
@@ -38,6 +37,10 @@ import {
   type SweepCursor,
   type SweepStoreFsSeam,
 } from './stale-pin-sweep-store.js'
+// The sweep now imports its rights detector from the single source of truth
+// (status-pin.ts) — no second copy. The negative cache it shares with the live
+// pin path is that module's `PinRightsCache` (D3).
+import { isPinRightsError, PinRightsCache } from '../status-pin.js'
 
 // Synthetic ids (check-no-pii-secrets): DMs positive, groups negative.
 const DM = '900000001'
@@ -84,7 +87,10 @@ interface FakeOpts {
    * call-counted `popped` and an observation-counted `popped` disagree.
    */
   unpinAllTopicRemoves?: number[]
-  canPin?: boolean
+  /** Errors to throw from `unpinChatMessage`, consumed in order (null = normal).
+   *  The sweep classifies pin rights REACTIVELY from a real Telegram 400 here —
+   *  there is no proactive precheck to model. */
+  unpinErrors?: (unknown | null)[]
   /** Throws from `getChat`, consumed in order (null = normal read). */
   getChatErrors?: (unknown | null)[]
 }
@@ -93,6 +99,7 @@ function fakeChat(o: FakeOpts) {
   const stack = [...o.stack]
   const calls: string[] = []
   const pinErrors = [...(o.pinErrors ?? [])]
+  const unpinErrors = [...(o.unpinErrors ?? [])]
   const unpinAllErrors = [...(o.unpinAllErrors ?? [])]
   const getChatErrors = [...(o.getChatErrors ?? [])]
   return {
@@ -115,6 +122,10 @@ function fakeChat(o: FakeOpts) {
     },
     unpin: async (_chatId: string, messageId: number) => {
       calls.push(`unpin:${messageId}`)
+      // A real Telegram rejection (e.g. `400 not enough rights`) is injected
+      // here so the sweep's REACTIVE rights classifier is what gets exercised.
+      const err = unpinErrors.shift()
+      if (err != null) throw err
       // ALWAYS resolves ok:true — the whole point.
       if (o.unpinIsSilentNoop === true) return { ok: true }
       const at = stack.indexOf(messageId)
@@ -135,10 +146,6 @@ function fakeChat(o: FakeOpts) {
       }
       return { ok: true }
     },
-    canPinInChat: async () => {
-      calls.push('getChatMember')
-      return o.canPin !== false
-    },
   }
 }
 
@@ -165,6 +172,9 @@ function harness(
     allowUnpinAllForumTopic?: boolean
     /** Ids the gateway is on record as having pinned (the group drain's list). */
     recordedPinIds?: number[]
+    /** D3: shared per-process pin-rights negative cache seam. */
+    rightsBlocked?: (chatId: string) => boolean
+    recordRightsBlock?: (chatId: string) => void
   },
 ): Harness {
   const fake = fakeChat(o)
@@ -183,10 +193,11 @@ function harness(
     pinSilent: costed(fake.pinSilent),
     unpin: costed(fake.unpin),
     unpinAllForumTopicMessages: costed(fake.unpinAllForumTopicMessages),
-    canPinInChat: costed(fake.canPinInChat),
     protectedMessageIds: () => o.protectedMessageIds ?? [],
     recordedPinIds: () => o.recordedPinIds ?? [],
     eligible: () => o.eligible !== false,
+    rightsBlocked: o.rightsBlocked,
+    recordRightsBlock: o.recordRightsBlock,
     sleep: async (ms) => {
       sleeps.push(ms)
       if (o.clockAdvances !== false) clock += ms
@@ -552,8 +563,22 @@ describe('stale-pin sweep — forum topics', () => {
 // ─── group safety: rights + service-message spam ─────────────────────────────
 
 describe('stale-pin sweep — group safety', () => {
-  it('skips a group without pin rights WITHOUT writing anything', async () => {
-    const h = harness({ stack: [151, 152], canPin: false })
+  // The honest Telegram rejection a rights-less bot gets from EVERY pin verb.
+  const RIGHTS_400 = {
+    error_code: 400,
+    description: 'Bad Request: not enough rights to manage pinned messages in the chat',
+  }
+
+  it('ATTEMPTS the drain (no proactive precheck) and classifies a real 400 as rights', async () => {
+    // The pre-fix bug: a proactive getChatMember precheck against the wrapped
+    // (botInfo-less) bot always returned false, so a group forfeited WITHOUT a
+    // single unpin ever going out. The sweep must instead ATTEMPT the unpin and
+    // read Telegram's honest 400 — so `unpin:151` MUST appear in the call log.
+    const h = harness({
+      stack: [151, 152],
+      recordedPinIds: [151],
+      unpinErrors: [RIGHTS_400],
+    })
     const res = await createStalePinSweeper(h.deps).sweepTarget({
       chatId: GROUP,
       threadId: 5,
@@ -561,22 +586,31 @@ describe('stale-pin sweep — group safety', () => {
     })
 
     expect(res.status).toBe('skipped-no-rights')
-    expect(h.fake.calls).toEqual(['getChatMember']) // the precheck and nothing else
-    expect(h.fake.stack).toEqual([151, 152])
+    expect(h.fake.calls).toContain('unpin:151') // the drain was ATTEMPTED
+    expect(h.fake.stack).toEqual([151, 152]) // the rejected unpin popped nothing
   })
 
-  it('treats a throwing rights check as "no rights"', async () => {
-    const h = harness({ stack: [161] })
-    h.deps.canPinInChat = async () => {
-      throw new Error('Bad Request: chat not found')
+  it('increments attempts and eventually FORFEITS a rights-less group via the reactive path (no infinite retry)', async () => {
+    const fs = memFs()
+    const path = '/state/stale-pin-sweep.json'
+    // Every boot: a fresh process attempts the recorded unpin, Telegram answers
+    // 400 not enough rights, the sweep records skipped-no-rights and bumps
+    // attempts. After SWEEP_MAX_ATTEMPTS boots the cursor forfeits and stops
+    // re-burning the pin-op budget — the bounded reactive path, no precheck.
+    let last = ''
+    for (let boot = 0; boot < SWEEP_MAX_ATTEMPTS + 1; boot++) {
+      const chat = fakeChat({ stack: [161], unpinErrors: [RIGHTS_400] })
+      const res = await sweeperOver(fs, path, chat, { recordedPinIds: [161] }).sweepTarget({
+        chatId: GROUP,
+      })
+      last = res.status
     }
-    const res = await createStalePinSweeper(h.deps).sweepTarget({
-      chatId: GROUP,
-      threadId: 5,
-      isForum: true,
-    })
-    expect(res.status).toBe('skipped-no-rights')
-    expect(h.fake.calls).toEqual([])
+    // The final boot is past the attempt budget: it forfeits instead of
+    // attempting yet another doomed unpin.
+    expect(last).toBe('forfeited')
+    const cursor = loadSweepCursors(path, fs).find((c) => c.chatId === GROUP)
+    expect(cursor?.attempts).toBe(SWEEP_MAX_ATTEMPTS)
+    expect(cursor?.done).toBe(false)
   })
 
   it('NEVER pins in a group — a pin is the only op that emits a service message', async () => {
@@ -623,10 +657,74 @@ describe('stale-pin sweep — group safety', () => {
     expect(h.cursors().find((c) => c.chatId === GROUP)?.done).toBe(false)
   })
 
-  it('runs a DM sweep with NO rights precheck (getChatMember is meaningless there)', async () => {
+  it('runs a DM sweep straight into a drain (no rights gating whatsoever)', async () => {
     const h = harness({ stack: [181] })
-    await createStalePinSweeper(h.deps).sweepTarget({ chatId: DM })
+    const res = await createStalePinSweeper(h.deps).sweepTarget({ chatId: DM })
+    // No proactive precheck anywhere: the DM goes straight to the repin+unpin
+    // drain and clears the orphan.
     expect(h.fake.calls).not.toContain('getChatMember')
+    expect(res.status).toBe('drained')
+    expect(h.fake.stack).toEqual([])
+  })
+})
+
+// ─── D3: shared per-process pin-rights negative cache ─────────────────────────
+
+describe('stale-pin sweep — shared PinRightsCache (D3)', () => {
+  const RIGHTS_400 = {
+    error_code: 400,
+    description: 'Bad Request: not enough rights to manage pinned messages in the chat',
+  }
+
+  it('SKIPS a group the live path already blocked, without issuing any unpin', async () => {
+    const cache = new PinRightsCache()
+    cache.block(GROUP) // the live status-pin path already proved this chat rights-less
+    const h = harness({
+      stack: [201],
+      recordedPinIds: [201],
+      rightsBlocked: (c) => cache.isBlocked(c),
+      recordRightsBlock: (c) => {
+        cache.block(c)
+      },
+    })
+    const res = await createStalePinSweeper(h.deps).sweepTarget({ chatId: GROUP })
+
+    expect(res.status).toBe('skipped-no-rights')
+    // No doomed traffic: the shared cache short-circuited BEFORE any unpin.
+    expect(h.fake.calls.filter((c) => c.startsWith('unpin'))).toEqual([])
+  })
+
+  it('FEEDS the cache from its own reactive rights discovery so the live path skips too', async () => {
+    const cache = new PinRightsCache()
+    const h = harness({
+      stack: [202],
+      recordedPinIds: [202],
+      unpinErrors: [RIGHTS_400],
+      rightsBlocked: (c) => cache.isBlocked(c),
+      recordRightsBlock: (c) => {
+        cache.block(c)
+      },
+    })
+    const res = await createStalePinSweeper(h.deps).sweepTarget({ chatId: GROUP })
+
+    expect(res.status).toBe('skipped-no-rights')
+    expect(h.fake.calls).toContain('unpin:202') // it ATTEMPTED before classifying
+    expect(cache.isBlocked(GROUP)).toBe(true) // and recorded the block for the live path
+  })
+
+  it('does NOT skip a DM even when its chat id is in the cache (DMs are never rights-gated)', async () => {
+    const cache = new PinRightsCache()
+    cache.block(DM)
+    const h = harness({
+      stack: [203],
+      rightsBlocked: (c) => cache.isBlocked(c),
+      recordRightsBlock: (c) => {
+        cache.block(c)
+      },
+    })
+    const res = await createStalePinSweeper(h.deps).sweepTarget({ chatId: DM })
+    expect(res.status).toBe('drained')
+    expect(h.fake.stack).toEqual([])
   })
 })
 
@@ -945,7 +1043,6 @@ function sweeperOver(
     pinSilent: fake.pinSilent,
     unpin: fake.unpin,
     unpinAllForumTopicMessages: fake.unpinAllForumTopicMessages,
-    canPinInChat: fake.canPinInChat,
     protectedMessageIds: () => [],
     recordedPinIds: () => opts.recordedPinIds ?? [],
     eligible: () => true,
@@ -1045,7 +1142,7 @@ describe('stale-pin sweep — re-drain after the boot-seed prune (#3953)', () =>
     const path = '/state/stale-pin-sweep.json'
 
     // Session 1: the one recorded orphan is reaped, obligation discharged.
-    const s1 = await sweeperOver(fs, path, fakeChat({ stack: [77], canPin: true }), {
+    const s1 = await sweeperOver(fs, path, fakeChat({ stack: [77] }), {
       recordedPinIds: [77],
     }).sweepTarget({ chatId: GROUP })
     expect(s1.status).toBe('drained')

package/telegram-plugin/gateway/stale-pin-sweep.ts

@@ -132,6 +132,12 @@ import {
   upsertSweepCursor,
   SWEEP_MAX_ATTEMPTS,
 } from './stale-pin-sweep-store.js'
+// The single source of truth for the pin-rights concept. The sweep classifies
+// a rights failure REACTIVELY — it attempts the unpin and reads Telegram's
+// honest `400 "not enough rights"` — using the same detector the live status-pin
+// path uses, so the two paths can never disagree on what "no pin rights" means
+// (this file must stay Telegram-import-free; status-pin.ts is dependency-free).
+import { isPinRightsError } from '../status-pin.js'
 
 // ─── Rate gates (operator-mandated; do not inline these numbers) ─────────────
 
@@ -346,9 +352,10 @@ export function collectSweepTargets(input: {
 
 /**
  * The messageIds in `chatId` that must SURVIVE a drain because they belong to
- * deliberately-retained store rows: unexpired time-scoped `tool:` pins (the
- * `pin_message` MCP tool, #3001), which `runStatusPinBootCleanup` intentionally
- * KEEPS across restarts. Work-scoped rows (no `expiresAt`) are stale by
+ * deliberately-retained store rows: unexpired time-scoped `tool:` pins (legacy
+ * rows from the retired `pin_message` MCP tool, #3001 / #4452 — no new ones are
+ * written), which `runStatusPinBootCleanup` intentionally KEEPS across restarts
+ * until they expire. Work-scoped rows (no `expiresAt`) are stale by
  * definition after a restart and are NOT re-pin candidates; expired
  * time-scoped rows are due for sweeping.
  */
@@ -400,17 +407,6 @@ export function isPeerFloodError(err: unknown): boolean {
   return description(err).includes('peer_flood')
 }
 
-/**
- * The bot is not allowed to manage pins here. Verified live: a bot without
- * `can_pin_messages` gets `400 "not enough rights to manage pinned messages in
- * the chat"` from EVERY pin method — an honest, stable rejection, unlike the
- * silent-success unpin. So a rights failure is terminal for the chat, not a
- * retry.
- */
-export function isPinRightsError(err: unknown): boolean {
-  return description(err).includes('not enough rights')
-}
-
 /**
  * `unpinChatMessage` with NO `message_id` on an EMPTY stack answers `400
  * "message to unpin not found"`. That is a real, positive termination signal —
@@ -566,10 +562,18 @@ export interface StalePinSweepDeps {
   /** `unpinAllForumTopicMessages(chat, thread)` — the one topic-scoped verb. */
   unpinAllForumTopicMessages: (chatId: string, threadId: number) => Promise<unknown>
   /**
-   * `getChatMember(chat, self)` folded to "is administrator AND can_pin_messages".
-   * Consulted BEFORE any write in a group. A throw is treated as "no rights".
+   * The SHARED per-process pin-rights negative cache (status-pin.ts
+   * `PinRightsCache`), so the sweep and the live status-pin path agree on which
+   * chats are rights-less. `rightsBlocked` is TRUE only when a REAL Telegram
+   * `400 "not enough rights"` was already observed (by the live pin path or an
+   * earlier sweep) — never a proactive network probe — so consulting it cannot
+   * resurrect the deleted `getChatMember` precheck. When it returns true the
+   * sweep skips the doomed group drain; `recordRightsBlock` feeds the cache from
+   * the sweep's OWN reactive rights discoveries. Both optional: undefined ⇒ the
+   * sweep relies purely on its reactive classifier.
    */
-  canPinInChat: (chatId: string) => Promise<boolean>
+  rightsBlocked?: (chatId: string) => boolean
+  recordRightsBlock?: (chatId: string) => void
   /**
    * Message ids in this chat that must be RE-PINNED once the drain finishes:
    * live in-memory claims plus the deliberately-retained store rows (unexpired
@@ -1126,24 +1130,32 @@ export function createStalePinSweeper(deps: StalePinSweepDeps): StalePinSweeper
       }
     }
 
-    // RIGHTS PRECHECK, before ANY write, in every group. A bot without
-    // can_pin_messages is honestly rejected by Telegram, but burning a rejected
-    // write per orphan against the flood ledger is pointless. DMs need no
-    // precheck — getChatMember is not meaningful there.
-    if (kind !== 'dm') {
-      let allowed = false
-      try {
-        allowed = await deps.canPinInChat(target.chatId)
-      } catch {
-        allowed = false
-      }
-      if (!allowed) {
-        cursor.attempts++
-        cursor.lastStatus = 'skipped-no-rights'
-        cursor.updatedAt = deps.now()
-        commit(cursor)
-        return { status: 'skipped-no-rights', popped: 0, issued: 0 }
-      }
+    // NO proactive rights precheck. A `getChatMember`-based precheck was
+    // DELETED (see below): the sweep runs against the chat-lock-wrapped bot,
+    // which carries only `.api` and no `.botInfo`, so `self` was always null,
+    // the precheck always returned false, and every group target forfeited at
+    // SWEEP_MAX_ATTEMPTS without a single unpin ever going out
+    // (`getChatMember` appeared 0× in a 35MB live gateway log). Rights are now
+    // classified REACTIVELY and only from a real Telegram `400 "not enough
+    // rights"`: each drain primitive attempts the unpin and folds that error to
+    // `{ kind: 'rights' }` via `classify`, returning `skipped-no-rights`. The
+    // attempt is counted below BEFORE the drain, so a genuinely rights-less
+    // chat still increments `attempts` on every boot and forfeits at
+    // SWEEP_MAX_ATTEMPTS — no infinite retry — while a chat the bot CAN pin in
+    // is no longer wrongly skipped.
+    //
+    // Same-process negative cache (D3): if the LIVE status-pin path (or an
+    // earlier sweep) already observed a REAL `400 not enough rights` for this
+    // chat, skip the doomed group drain rather than re-attempting it. This is
+    // NOT a network probe — it is fed only by observed rights failures — so it
+    // does not resurrect the deleted precheck. DMs are never rights-gated. The
+    // attempt is still counted so the cursor forfeits at SWEEP_MAX_ATTEMPTS.
+    if (kind !== 'dm' && deps.rightsBlocked?.(target.chatId) === true) {
+      cursor.attempts++
+      cursor.lastStatus = 'skipped-no-rights'
+      cursor.updatedAt = deps.now()
+      commit(cursor)
+      return { status: 'skipped-no-rights', popped: 0, issued: 0 }
     }
 
     cursor.attempts++
@@ -1196,6 +1208,11 @@ export function createStalePinSweeper(deps: StalePinSweepDeps): StalePinSweeper
     cursor.updatedAt = deps.now()
     commit(cursor)
 
+    // Feed the shared negative cache (D3): a reactive `skipped-no-rights` is a
+    // real observed `400 not enough rights`, so record it so the live pin path
+    // and later sweeps of this chat skip the doomed attempt too.
+    if (result.status === 'skipped-no-rights') deps.recordRightsBlock?.(target.chatId)
+
     // Restore the deliberately-retained pins the blind DM drain cleared.
     // Rate-gated like any other write; a failure is logged and never fatal.
     //

package/telegram-plugin/gateway/status-pin-store.ts

@@ -17,7 +17,8 @@
  * — the turn it represented is over or crashed), dropping rows only after a
  * successful unpin (failed ones are retained with an attempt counter for a
  * next-boot retry — see runStatusPinBootCleanup). Time-scoped `tool:` rows
- * (the `pin_message` MCP tool, #3001) survive boots until their `expiresAt`.
+ * (legacy pins from the retired `pin_message` MCP tool, #3001 / #4452 — no new
+ * ones are written) survive boots until their `expiresAt`.
  * It does NOT re-adopt or re-pin — it only cleans up.
  *
  * Shape choice — SNAPSHOT, not append-log, mirroring obligation-store.ts. The
@@ -78,10 +79,10 @@ export interface PersistedStatusPin {
   /** Wall-clock ms after which this pin is stale and boot cleanup unpins it.
    *  Rows WITHOUT this field are work-scoped (fg:/wk:/banner:) — stale the
    *  moment their owning session dies, so boot cleanup unpins them
-   *  unconditionally. Rows WITH it (the `tool:` pins written by the
-   *  `pin_message` MCP tool, #3001) represent deliberate agent pins that have
-   *  no "work finished" event: they SURVIVE restarts and are only swept once
-   *  expired. */
+   *  unconditionally. Rows WITH it (legacy `tool:` pins from the retired
+   *  `pin_message` MCP tool, #3001 / #4452 — no new ones are written)
+   *  represented deliberate agent pins with no "work finished" event: they
+   *  SURVIVE restarts and are only swept once expired. */
   expiresAt?: number
   /** Boot-cleanup unpin retry counter (#3001). Incremented each boot the
    *  unpin fails (flood-wait exhausted / transient 5xx); the row is retained
@@ -282,10 +283,10 @@ export function pinnedMessageIsOurs(
  * record whose pin MAY have landed in Telegram, so we must treat it exactly
  * like a confirmed one and unpin it.
  *
- * TIME-SCOPED rows (`tool:` pins from the `pin_message` MCP tool, carrying
- * `expiresAt`) have no "work finished" event, so a restart does NOT reset
- * them: an unexpired row is RETAINED untouched across boots and only unpinned
- * once `now >= expiresAt`.
+ * TIME-SCOPED rows (legacy `tool:` pins from the retired `pin_message` MCP
+ * tool, #4452, carrying `expiresAt`) have no "work finished" event, so a
+ * restart does NOT reset them: an unexpired row is RETAINED untouched across
+ * boots and only unpinned once `now >= expiresAt`.
  *
  * RETRY-SAFETY (#3001): a row is dropped only AFTER its unpin resolves. A
  * failing unpin (flood-wait exhausted / transient 5xx) retains the row with an