switchroom 0.20.5 → 0.20.7

package/telegram-plugin/gateway/pending-inbound-buffer.ts

@@ -49,6 +49,16 @@ export interface PendingInboundBuffer {
   depth: (agent: string) => number
   /** Test-only: total depth across all agents. */
   totalDepth: () => number
+  /**
+   * Delivery-time gate consulted by `redeliverBufferedInbound` for EVERY message
+   * it is about to hand to the bridge. Returns TRUE to proceed, FALSE to RETRACT
+   * (drop) the message (the spool entry is acked so it is not boot-replayed, and
+   * it is NOT re-buffered). The gateway wires this to the represent delivery
+   * re-check (represent-delivery-guard.ts): a represent buffered while its
+   * obligation was open must be re-evaluated at drain time, since a reply may have
+   * landed between the sweep's decision and this drain. Undefined ⇒ never retract.
+   */
+  beforeRedeliver?: (msg: InboundMessage) => boolean
 }
 
 export interface PendingInboundBufferOptions {
@@ -94,6 +104,13 @@ export interface PendingInboundBufferOptions {
    * breaks the push hot path.
    */
   onHandbackEnqueue?: (chatId: string, threadId: number | undefined, ts: number) => void
+  /**
+   * Delivery-time retract gate — see `PendingInboundBuffer.beforeRedeliver`. The
+   * gateway supplies the represent delivery re-check here so EVERY drain path
+   * (idle-drain, bridge re-register, silence-poke fallback, turn-end) inherits it
+   * by construction rather than by per-call-site discipline.
+   */
+  beforeRedeliver?: (msg: InboundMessage) => boolean
 }
 
 /**
@@ -123,16 +140,38 @@ export function redeliverBufferedInbound(
   // silently dropped (clerk 2026-06-03). `send` returning true only means
   // the bytes reached the bridge, NOT that claude consumed them.
   onDelivered?: (merged: InboundMessage, originals: InboundMessage[]) => void,
-): { drained: number; redelivered: number; rebuffered: number } {
+): { drained: number; redelivered: number; rebuffered: number; retracted: number } {
   const pending = buffer.drain(agent)
   let redelivered = 0
   let rebuffered = 0
+  let retracted = 0
   // Collapse consecutive same-sender Telegram user messages into one turn
   // (see planBufferedRedelivery) so a forwarded burst that spanned a turn
   // boundary doesn't fan out into N sequential replies. System inbounds
   // (vault grants, approvals, cron, handbacks — anything with meta.source)
   // are never merged and are delivered individually exactly as before.
   for (const { merged, originals } of planBufferedRedelivery(pending)) {
+    // Delivery-time retract (F1): a buffered `obligation_represent` whose reply
+    // has landed since the sweep decided it is stale — drop it rather than hand
+    // a duplicate to the CLI queue. Ack the spool so it is not boot-replayed and
+    // do NOT re-buffer. The gateway closure closes the ledger + logs the retract.
+    // FAIL-OPEN: a throwing predicate must never silence or lose a real message,
+    // nor abort the drain loop (which would strand every following message and
+    // crash the setInterval tick). On throw we treat it as "deliver".
+    let proceed = true
+    if (buffer.beforeRedeliver != null) {
+      try {
+        proceed = buffer.beforeRedeliver(merged)
+      } catch (e) {
+        proceed = true
+        process.stderr.write(`redeliver beforeRedeliver threw — failing open (deliver): ${String(e)}\n`)
+      }
+    }
+    if (!proceed) {
+      for (const o of originals) spool?.ack(o)
+      retracted += originals.length
+      continue
+    }
     let delivered = false
     try {
       delivered = send(merged)
@@ -157,7 +196,7 @@ export function redeliverBufferedInbound(
       rebuffered += originals.length
     }
   }
-  return { drained: pending.length, redelivered, rebuffered }
+  return { drained: pending.length, redelivered, rebuffered, retracted }
 }
 
 /** True when `msg` is an ordinary Telegram user message eligible to be
@@ -312,7 +351,7 @@ export function idleDrainTick(
   // enrols redelivered inbounds in the deliver-until-acked queue (parity with
   // the bridgeUp drain — clerk lost-message incident, 2026-06-03).
   onDelivered?: (merged: InboundMessage, originals: InboundMessage[]) => void,
-): { drained: number; redelivered: number; rebuffered: number } | null {
+): { drained: number; redelivered: number; rebuffered: number; retracted: number } | null {
   if (!agent) return null
   if (buffer.depth(agent) === 0) return null
   if (!isBridgeAlive()) return null
@@ -412,5 +451,6 @@ export function createPendingInboundBuffer(
       for (const q of queues.values()) n += q.length
       return n
     },
+    beforeRedeliver: opts.beforeRedeliver,
   }
 }

package/telegram-plugin/gateway/represent-delivery-guard.ts

@@ -0,0 +1,157 @@
+/**
+ * represent-delivery-guard.ts — the DELIVERY-time half of the duplicate-represent
+ * defence (fix/represent-double-send-delivery-recheck).
+ *
+ * Background — the race this closes (verified from history.db, 2026):
+ *   1. A ~5-min silence poke fires the framework fallback, which clears the
+ *      machine turn (`turnInFlightForGate()` → false) while the CLI session is
+ *      STILL producing the answer (it lands ~17s later). stream-render's live-turn
+ *      mirror (`currentTurn`/`parkedTurnStarts`) still knows the session is busy.
+ *   2. With the machine turn cleared, `obligationSweep` runs; `shouldSuppressRepresent`
+ *      correctly returns false (nothing has been sent YET) and the represent is
+ *      buffered; the idle-drain flushes it into the live CLI queue.
+ *   3. ~13s later the real answer is delivered + recorded (ledger closed by the
+ *      normal path). Then the model consumes the already-queued represent and
+ *      answers a SECOND time → the duplicate.
+ *
+ * The represent guard never FAILED — it was consulted BEFORE the reply existed,
+ * and there was no re-check between decision → delivery → model consumption. This
+ * module adds that missing re-check (F1) plus the bounded busy-defer for the
+ * idle-drain gate (F2). Layer F2 (obligation-wiring's sweep + this drain defer)
+ * keeps the represent BUFFERED while the session is busy so that, by the time a
+ * drain actually hands it to the bridge, the real answer has landed and been
+ * recorded — at which point F1 retracts the now-stale represent. `recordOutbound`
+ * is a synchronous SQLite write that completes before the reply tool result
+ * returns, so a post-reply drain observes the row.
+ *
+ * Both halves are PURE-ish factories (no Telegram, no SQLite) so the whole
+ * decision is executable in a unit test; the gateway injects the ledger accessor,
+ * the outbound-history predicate, and the logger.
+ */
+
+import type { InboundMessage } from './ipc-protocol.js'
+import { shouldSuppressRepresent, type RepresentGuardObligation } from './represent-guard.js'
+
+/** The minimal ledger surface the delivery re-check needs. */
+export interface RepresentDeliveryLedger {
+  /** The CURRENTLY-open obligation for `originTurnId`, or undefined if none is
+   *  open (already closed — answered or cancelled — since the represent was
+   *  buffered). */
+  get(originTurnId: string): RepresentGuardObligation | undefined
+  /** Close the obligation. Idempotent; returns whether an entry was removed. */
+  close(originTurnId: string | null | undefined): boolean
+}
+
+export interface RepresentRedeliveryGuardDeps {
+  /** OBLIGATION_LEDGER_ENABLED — when off, never retract (nothing is tracked). */
+  enabled: boolean
+  /** HISTORY_ENABLED — forwarded to the pure guard (no history ⇒ never suppress). */
+  historyEnabled: boolean
+  ledger: RepresentDeliveryLedger
+  /** history.hasOutboundDeliveredSince, already curried with the chat query. */
+  hasOutboundDeliveredSince: (
+    chatId: string,
+    sinceMs: number,
+    threadId?: number,
+    minChars?: number,
+  ) => boolean
+  /** The represent guard's OWN low reply-length threshold (a terse-but-real reply
+   *  must still suppress the duplicate — #2472/#2474). */
+  minReplyChars: number
+  log: (line: string) => void
+}
+
+/**
+ * Build the `beforeRedeliver` predicate the pending-inbound buffer consults for
+ * EVERY message it is about to hand to the CLI bridge. Returns TRUE to proceed
+ * with delivery, FALSE to RETRACT (drop) the message.
+ *
+ * Only `obligation_represent` inbounds are ever retracted; everything else always
+ * proceeds. A represent is retracted when, AT DELIVERY TIME:
+ *   - the obligation is no longer open (a reply landed and the normal close path
+ *     fired, or it was cancelled) — re-delivering would duplicate / re-ask a
+ *     resolved question; OR
+ *   - it IS still open but `shouldSuppressRepresent` now returns true against the
+ *     obligation's CURRENT cutoff (a reply landed since decision, but the normal
+ *     close path missed it because its routing did not resolve back to the origin
+ *     — the exact #2472 gap, now caught at delivery instead of only at decision).
+ *
+ * The cutoff is the obligation's own (`openedAt` for the first represent,
+ * `lastRepresentedAt` thereafter) — encoded inside `shouldSuppressRepresent`, so
+ * an OLD reply to a DIFFERENT earlier question does not suppress a legitimate new
+ * represent (#2472 second-represent semantics). The genuine plain-text-no-reply
+ * case (#2788) records NO outbound row, so the predicate reports false at BOTH
+ * decision and here ⇒ the represent still fires exactly once.
+ */
+export function makeRepresentRedeliveryGuard(
+  deps: RepresentRedeliveryGuardDeps,
+): (msg: InboundMessage) => boolean {
+  return (msg) => {
+    if (!deps.enabled) return true
+    if (msg.meta?.source !== 'obligation_represent') return true
+    const originTurnId = msg.meta?.origin_turn_id
+    if (originTurnId == null) return true
+
+    const o = deps.ledger.get(originTurnId)
+    if (o == null) {
+      // Closed since this represent was buffered — a reply landed (normal close)
+      // or the turn was cancelled/interrupted. Either way the buffered represent
+      // is stale: drop it rather than re-ask an already-resolved obligation.
+      deps.log(
+        `telegram gateway: represent retracted at delivery — obligation already ` +
+          `closed since decision (no re-fire) origin=${originTurnId}\n`,
+      )
+      return false
+    }
+
+    const suppress = shouldSuppressRepresent(o, {
+      historyEnabled: deps.historyEnabled,
+      hasOutboundDeliveredSince: (chatId, sinceMs, threadId) =>
+        deps.hasOutboundDeliveredSince(chatId, sinceMs, threadId, deps.minReplyChars),
+    })
+    if (suppress) {
+      // A reply landed since this obligation's cutoff but the normal close path
+      // missed it. Close the ledger entry ourselves and drop the represent.
+      deps.ledger.close(originTurnId)
+      deps.log(
+        `telegram gateway: represent retracted at delivery — reply landed since ` +
+          `decision (no re-fire) origin=${originTurnId}\n`,
+      )
+      return false
+    }
+    return true
+  }
+}
+
+/**
+ * Build the BOUNDED busy-defer predicate for the idle-drain gate (F2, drain
+ * half). Returns TRUE while the drain should be DEFERRED because the session is
+ * busy (stream-render's live-turn mirror), FALSE once it is safe to drain.
+ *
+ * Why bounded: the drain must not hand a buffered represent to a session that is
+ * mid-answer (that re-queues it BEHIND the real answer → the duplicate). But a
+ * session that is WEDGED busy forever must not silence a buffered represent
+ * forever (red-team #2). So the deferral is capped: once the session has been
+ * continuously busy for longer than `boundMs`, the drain proceeds regardless. The
+ * clock resets to "not deferring" the moment the session reads idle, so an
+ * ordinary busy turn (which ends well within the bound) defers cleanly and never
+ * consumes the wedge budget.
+ *
+ * `boundMs <= 0` disables the busy-defer entirely (kill switch / parity with the
+ * background-work grace being disabled).
+ */
+export function makeSessionBusyDrainDeferral(
+  boundMs: number,
+): (busy: boolean, now: number) => boolean {
+  let deferringSince: number | null = null
+  return (busy, now) => {
+    if (!busy || boundMs <= 0) {
+      deferringSince = null
+      return false
+    }
+    if (deferringSince == null) deferringSince = now
+    // Bounded: stop deferring once we have been busy past the ceiling, so a
+    // wedged/hung session still eventually drains the buffered represent.
+    return now - deferringSince < boundMs
+  }
+}

package/telegram-plugin/gateway/stale-pin-sweep-store.ts

@@ -221,7 +221,44 @@ export function pendingSweepCursors(cursors: readonly SweepCursor[]): SweepCurso
   return cursors.filter((c) => !c.done && c.attempts < SWEEP_MAX_ATTEMPTS)
 }
 
-/** Drop discharged and forfeited rows — called once the ledger is reseeded. */
+/**
+ * Boot seed pass: drop DISCHARGED (`done: true`) rows ONLY, so a chat that
+ * drained in a prior session is re-evaluated LIVE on the next sweep instead of
+ * short-circuiting forever on a stale `done` (#3953 regression — the seed pass
+ * was never wired, so `done` was effectively permanent).
+ *
+ * FORFEITED rows (`attempts >= SWEEP_MAX_ATTEMPTS`, still `!done`) are
+ * deliberately RETAINED. Their whole purpose is to remember that a chat's
+ * attempt budget is spent (bot kicked, pin rights revoked, a chat that
+ * flood-waits forever). Pruning one would let the next boot re-seed it from the
+ * pin stores and re-burn the full 8-attempt budget on every boot for the rest
+ * of time — precisely the Telegram flood the attempt cap exists to prevent. So
+ * this filters on `done` ALONE; it must NOT also gate on `attempts`.
+ */
 export function pruneSweepCursors(cursors: readonly SweepCursor[]): SweepCursor[] {
-  return cursors.filter((c) => !c.done && c.attempts < SWEEP_MAX_ATTEMPTS)
+  return cursors.filter((c) => !c.done)
+}
+
+/**
+ * BOOT-SEED reseed of the durable ledger (#3953): drop discharged (`done:true`)
+ * rows so a `(chat, thread)` that drained in a prior session is re-evaluated
+ * LIVE on the next sweep instead of short-circuiting forever on a stale `done`.
+ * Forfeited rows are retained (see {@link pruneSweepCursors}).
+ *
+ * Writes ONLY when the prune changed the ledger, so a no-op boot never churns
+ * the durable file. Never throws — a reseed failure degrades to the pre-fix
+ * behaviour (the stale `done` survives one more boot), it must not break boot.
+ *
+ * BOOT-SCOPED BY CONTRACT: the caller must invoke this once at boot, never on
+ * the per-inbound path (which fires on every message — re-arming a full re-drain
+ * per message is a Telegram flood).
+ */
+export function reseedSweepLedger(
+  path: string,
+  fs: SweepStoreFsSeam,
+  log: (line: string) => void = (l) => process.stderr.write(l),
+): void {
+  const rows = loadSweepCursors(path, fs)
+  const pruned = pruneSweepCursors(rows)
+  if (pruned.length !== rows.length) persistSweepCursors(path, fs, pruned, log)
 }

package/telegram-plugin/gateway/stale-pin-sweep.test.ts

@@ -32,6 +32,8 @@ import {
 import {
   SWEEP_MAX_ATTEMPTS,
   loadSweepCursors,
+  pruneSweepCursors,
+  reseedSweepLedger,
   upsertSweepCursor,
   type SweepCursor,
   type SweepStoreFsSeam,
@@ -907,3 +909,163 @@ describe('stale-pin sweep — classification and seeding', () => {
     expect(isNothingToUnpinError(new Error('something else'))).toBe(false)
   })
 })
+
+// ─── #3953: the boot-seed prune reseeds a discharged obligation ───────────────
+//
+// Regression #3953 replaced the per-boot DM self-heal with a cursor-gated stack
+// drain, but the boot "seed pass" that clears discharged cursors was never
+// wired — so `done:true` was effectively PERMANENT and every later boot /
+// first-inbound sweep short-circuited on `already-drained`, orphaning any pin
+// that leaked AFTER the first drain. These tests pin the reseed contract:
+//   1. `pruneSweepCursors` drops `done` rows ONLY and RETAINS forfeited
+//      (attempts-exhausted) rows — a store-level test that FAILS on the pre-fix
+//      filter (which also dropped forfeited rows, re-burning the attempt budget
+//      every boot = flood risk).
+//   2. Running that prune between two fresh-process sweeps re-arms the drain, so
+//      a pin leaked after a prior discharge is reaped — for a DM AND a
+//      supergroup (channel-class) target alike.
+
+/** The boot-seed reseed exactly as the gateway wires it (`gateway.ts`
+ *  `seedPruneSweepCursors` → `reseedSweepLedger`). */
+function bootSeedPrune(fs: SweepStoreFsSeam, path: string): void {
+  reseedSweepLedger(path, fs, () => {})
+}
+
+/** A sweeper over a SHARED durable store — a distinct instance models a fresh
+ *  process (reboot), so the only state carried across is the on-disk ledger. */
+function sweeperOver(
+  fs: SweepStoreFsSeam,
+  path: string,
+  fake: ReturnType<typeof fakeChat>,
+  opts: { recordedPinIds?: number[] } = {},
+) {
+  let clock = 1_000_000
+  const deps: StalePinSweepDeps = {
+    getTopPinnedMessageId: fake.getTopPinnedMessageId,
+    pinSilent: fake.pinSilent,
+    unpin: fake.unpin,
+    unpinAllForumTopicMessages: fake.unpinAllForumTopicMessages,
+    canPinInChat: fake.canPinInChat,
+    protectedMessageIds: () => [],
+    recordedPinIds: () => opts.recordedPinIds ?? [],
+    eligible: () => true,
+    sleep: async (ms) => {
+      clock += ms
+    },
+    now: () => clock,
+    store: { path, fs },
+    log: () => {},
+  }
+  return createStalePinSweeper(deps)
+}
+
+describe('pruneSweepCursors — boot-seed reseed (#3953)', () => {
+  const now = 1_000_000
+
+  it('drops discharged rows but RETAINS forfeited (attempts-exhausted) rows', () => {
+    const discharged: SweepCursor = {
+      chatId: DM,
+      kind: 'dm',
+      popped: 3,
+      done: true,
+      attempts: 1,
+      updatedAt: now,
+    }
+    // A no-rights group that spent its whole attempt budget: `done` is false,
+    // but re-seeding it would re-burn all 8 attempts on the NEXT boot, and every
+    // boot after — the exact Telegram flood the attempt cap exists to stop.
+    const forfeited: SweepCursor = {
+      chatId: GROUP,
+      kind: 'supergroup',
+      popped: 0,
+      done: false,
+      attempts: SWEEP_MAX_ATTEMPTS,
+      lastStatus: 'skipped-no-rights',
+      updatedAt: now,
+    }
+    const stillOwed: SweepCursor = {
+      chatId: '900000002',
+      kind: 'dm',
+      popped: 0,
+      done: false,
+      attempts: 2,
+      updatedAt: now,
+    }
+
+    const keys = pruneSweepCursors([discharged, forfeited, stillOwed]).map((c) => c.chatId)
+
+    expect(keys).not.toContain(DM) // discharged → reseeded (dropped)
+    expect(keys).toContain(GROUP) // forfeited no-rights → RETAINED (no re-burn)
+    expect(keys).toContain('900000002') // still owed → retained untouched
+  })
+
+  it('clears discharged rows for EVERY surface — dm, forum-topic, supergroup', () => {
+    // The prune must be kind-agnostic: a stuck `done` on a topic or a channel is
+    // the same regression as on a DM, so none may be left short-circuiting.
+    const rows: SweepCursor[] = [
+      { chatId: '1', kind: 'dm', popped: 1, done: true, attempts: 1, updatedAt: now },
+      { chatId: '2', kind: 'forum-topic', threadId: 5, popped: 1, done: true, attempts: 1, updatedAt: now },
+      { chatId: '3', kind: 'supergroup', popped: 1, done: true, attempts: 1, updatedAt: now },
+    ]
+    expect(pruneSweepCursors(rows)).toEqual([])
+  })
+})
+
+describe('stale-pin sweep — re-drain after the boot-seed prune (#3953)', () => {
+  it('re-drains a DM whose obligation was discharged in a prior session', async () => {
+    const fs = memFs()
+    const path = '/state/stale-pin-sweep.json'
+
+    // Session 1: an orphan bot pin is drained and the obligation discharged.
+    const s1 = await sweeperOver(fs, path, fakeChat({ stack: [11] })).sweepTarget({ chatId: DM })
+    expect(s1.status).toBe('drained')
+    expect(loadSweepCursors(path, fs).find((c) => c.chatId === DM)?.done).toBe(true)
+
+    // A NEW orphan pin leaks in after that drain.
+    // Fresh process, no prune: the sweep short-circuits on the stale `done` —
+    // the #3953 regression, verbatim. The orphan is left pinned.
+    const stuckChat = fakeChat({ stack: [99] })
+    const stuck = await sweeperOver(fs, path, stuckChat).sweepTarget({ chatId: DM })
+    expect(stuck.status).toBe('already-drained')
+    expect(stuck.popped).toBe(0)
+    expect(stuckChat.stack).toEqual([99])
+
+    // Reboot WITH the boot-seed prune: the discharged row is reseeded, so the
+    // next sweep re-evaluates the chat LIVE and reaps the orphan.
+    bootSeedPrune(fs, path)
+    const rebootChat = fakeChat({ stack: [99] })
+    const redrain = await sweeperOver(fs, path, rebootChat).sweepTarget({ chatId: DM })
+    expect(redrain.status).toBe('drained')
+    expect(redrain.popped).toBe(1)
+    expect(rebootChat.stack).toEqual([])
+  })
+
+  it('re-drains a supergroup (channel-class) discharged in a prior session', async () => {
+    const fs = memFs()
+    const path = '/state/stale-pin-sweep.json'
+
+    // Session 1: the one recorded orphan is reaped, obligation discharged.
+    const s1 = await sweeperOver(fs, path, fakeChat({ stack: [77], canPin: true }), {
+      recordedPinIds: [77],
+    }).sweepTarget({ chatId: GROUP })
+    expect(s1.status).toBe('drained')
+    expect(loadSweepCursors(path, fs).find((c) => c.chatId === GROUP)?.done).toBe(true)
+
+    // A fresh recorded orphan leaks in; a fresh process short-circuits on `done`.
+    const stuckChat = fakeChat({ stack: [88], canPin: true })
+    const stuck = await sweeperOver(fs, path, stuckChat, { recordedPinIds: [88] }).sweepTarget({
+      chatId: GROUP,
+    })
+    expect(stuck.status).toBe('already-drained')
+    expect(stuckChat.stack).toEqual([88])
+
+    // Reboot + prune: the supergroup row is reseeded and re-swept.
+    bootSeedPrune(fs, path)
+    const rebootChat = fakeChat({ stack: [88], canPin: true })
+    const redrain = await sweeperOver(fs, path, rebootChat, { recordedPinIds: [88] }).sweepTarget({
+      chatId: GROUP,
+    })
+    expect(redrain.status).toBe('drained')
+    expect(rebootChat.stack).toEqual([])
+  })
+})

package/telegram-plugin/gateway/stream-render.ts

@@ -279,6 +279,19 @@ export function __resetParkedTurnStartsForTest(): void {
 export function __parkedTurnStartCountForTest(): number {
   return parkedTurnStarts.length
 }
+/**
+ * Production accessor for the parked-turn-start count — the second half of the
+ * stream-render "session busy" signal (the first being a live `currentTurn`
+ * whose `endedAt == null`). A parked turn-start means the CLI has an enqueued
+ * message it is about to turn on, so the session is NOT idle even when the
+ * gateway's machine-turn gate (`turnInFlightForGate`) reads clear — the exact
+ * disagreement a ~5-min silence poke opens (it clears the machine turn while the
+ * CLI is still producing the answer). The obligation sweep and the idle-drain
+ * consult this so they do not treat a poke-cleared-but-busy session as idle.
+ */
+export function parkedTurnStartCount(): number {
+  return parkedTurnStarts.length
+}
 
 /**
  * Silence-fallback unwedge for the parked store (the two-state desync fix).

package/telegram-plugin/tests/boot-sweep-gate.test.ts

@@ -161,6 +161,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
         order.push('queued-cards')
       },
       enableSweep: () => order.push('enable-sweep'),
+      seedPruneSweepCursors: () => order.push('seed-prune'),
       sweepTarget: async (t) => {
         order.push(`sweep:${t.chatId}:${t.threadId ?? '-'}`)
       },
@@ -177,6 +178,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       'status-pins',
       'activity-cards',
       'queued-cards',
+      'seed-prune',
       'enable-sweep',
       'sweep:900000001:-',
     ])
@@ -194,6 +196,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       'scan',
       'status-pins',
       'queued-cards',
+      'seed-prune',
       'enable-sweep',
       'sweep:900000001:-',
     ])
@@ -210,7 +213,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
       queuedCardReaper: boom,
     })
     await runBootPinSweepSteps(d.deps)
-    expect(d.order).toEqual(['scan', 'enable-sweep', 'sweep:900000001:-'])
+    expect(d.order).toEqual(['scan', 'seed-prune', 'enable-sweep', 'sweep:900000001:-'])
   })
 
   it('a failing store scan still lets the reapers and the DM enable run', async () => {
@@ -221,7 +224,13 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
     })
     await runBootPinSweepSteps(d.deps)
     // No targets to sweep, but nothing behind the scan is stranded.
-    expect(d.order).toEqual(['status-pins', 'activity-cards', 'queued-cards', 'enable-sweep'])
+    expect(d.order).toEqual([
+      'status-pins',
+      'activity-cards',
+      'queued-cards',
+      'seed-prune',
+      'enable-sweep',
+    ])
     expect(d.logs.join('')).toContain("step 'sweep-target-scan' failed: ENOENT")
   })
 
@@ -272,6 +281,7 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
           order.push('queued-cards')
         },
         enableSweep: () => order.push('enable-sweep'),
+        seedPruneSweepCursors: () => {},
         sweepTarget: async () => {},
         log: () => {
           throw new Error('EPIPE')
@@ -296,6 +306,9 @@ describe('runBootPinSweepSteps (#3664 salvage S2)', () => {
         enableSweep: () => {
           throw new Error('boom')
         },
+        seedPruneSweepCursors: () => {
+          throw new Error('boom')
+        },
         sweepTarget: boom,
         log: () => {},
       }),