@genesislcap/ai-assistant 15.15.1 → 15.15.2

package/src/state/persistence/session-persister.test.ts

@@ -1,5 +1,6 @@
 import type { ChatMessage } from '@genesislcap/foundation-ai';
 import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { clearMetaEventRegistry, getMetaEvents } from '../debug-event-log';
 import type { DiagnosticEntry } from './diagnostics';
 import { clearDiagnosticsCursorRegistry } from './diagnostics-cursors';
 import { clearPersisterRegistry } from './persister-registry';
@@ -42,6 +43,12 @@ interface Fakes {
   loadPrefsResult: SessionPreferences | undefined;
   /** Set false to omit `appendDiagnostics`/`savePreferences` from the provider. */
   diagnosticsCapable: boolean;
+  /** When set, `provider.save` rejects with it (GENC-1511 save-failure telemetry). */
+  saveError: Error | undefined;
+  /** Details passed to `onPersistenceBroken` (GENC-1511 user-facing warning). */
+  brokenReports: { unsavedMessages: number; lastSavedAt?: string; reason: string }[];
+  /** How many times `onPersistenceRecovered` fired. */
+  recovered: number;
 }
 
 function makePersister(over: Partial<Fakes> = {}): { p: SessionPersister; f: Fakes } {
@@ -62,12 +69,16 @@ function makePersister(over: Partial<Fakes> = {}): { p: SessionPersister; f: Fak
     savedPrefs: [],
     loadPrefsResult: undefined,
     diagnosticsCapable: true,
+    saveError: undefined,
+    brokenReports: [],
+    recovered: 0,
     ...over,
   };
   const provider = {
     saveDebounceMs: 0,
     diagnosticsDebounceMs: 0,
     save: async (_k: string, snap: PersistedSession) => {
+      if (f.saveError) throw f.saveError;
       f.saved.push(snap);
     },
     load: async () => f.loadResult,
@@ -130,6 +141,10 @@ function makePersister(over: Partial<Fakes> = {}): { p: SessionPersister; f: Fak
     getDriver: () => driver as never,
     getStore: () => store as never,
     getDiagnosticEntries: () => f.diagnosticEntries,
+    onPersistenceBroken: (d) => f.brokenReports.push(d),
+    onPersistenceRecovered: () => {
+      f.recovered += 1;
+    },
   };
   return { p: new SessionPersister(deps), f };
 }
@@ -139,6 +154,7 @@ const Suite = createLogicSuite('SessionPersister');
 Suite.before.each(() => {
   clearPersisterRegistry();
   clearDiagnosticsCursorRegistry();
+  clearMetaEventRegistry();
 });
 
 Suite('restore() hydrates the store + driver and appends a "Restored" divider', async () => {
@@ -280,42 +296,110 @@ Suite('scheduleSave() is a no-op when persistence is disabled', async () => {
   assert.is(f.saved.length, 0);
 });
 
-Suite('freeze: a non-resumable agent stamps the PRIOR snapshot, never an empty one', async () => {
-  // Prior persisted (resumable) snapshot with real conversation.
-  const prior = createPersistedSession({
-    sessionKey: KEY,
-    host: HOST,
-    messages: [
-      msg({ role: 'user', content: 'earlier' }),
-      msg({ role: 'assistant', content: 'ok' }),
-    ],
-    pinnedAgentName: 'Trade Ops',
-    flowOwnerAgentName: null,
-    sessionCostUsd: 0,
-  });
-  const { p, f } = makePersister({
-    loadResult: prior,
-    // in-flight transcript has extra agent work we must NOT persist
-    history: [
-      msg({ role: 'user', content: 'earlier' }),
-      msg({ role: 'assistant', content: 'ok' }),
-      msg({ role: 'assistant', content: 'in-flight work' }),
-    ],
-    activeAgent: {
-      name: 'Trade Ops',
-      resumable: async () => false,
-      notResumableMessage: 'start again',
-      serialize: () => ({}),
-    },
-  });
+Suite(
+  'freeze: a non-resumable agent keeps the conversation and drops only in-flight work',
+  async () => {
+    // Prior persisted (resumable) snapshot with real conversation.
+    const prior = createPersistedSession({
+      sessionKey: KEY,
+      host: HOST,
+      messages: [
+        msg({ role: 'user', content: 'earlier' }),
+        msg({ role: 'assistant', content: 'ok' }),
+      ],
+      pinnedAgentName: 'Trade Ops',
+      flowOwnerAgentName: null,
+      sessionCostUsd: 0,
+    });
+    const { p, f } = makePersister({
+      loadResult: prior,
+      // in-flight transcript has extra agent work we must NOT persist
+      history: [
+        msg({ role: 'user', content: 'earlier' }),
+        msg({ role: 'assistant', content: 'ok' }),
+        msg({ role: 'assistant', content: 'in-flight work' }),
+      ],
+      activeAgent: {
+        name: 'Trade Ops',
+        resumable: async () => false,
+        notResumableMessage: 'start again',
+        serialize: () => ({}),
+      },
+    });
+    p.scheduleSave();
+    await tick();
+    await tick();
+    assert.is(f.saved.length, 1, 'one freeze-stamp write');
+    const written = f.saved[0];
+    assert.ok(written.interrupted, 'stamped with an interrupted marker');
+    assert.is(written.interrupted?.message, 'start again');
+    // GENC-1511: the boundary is the LIVE transcript through the last user message, floored
+    // at whatever was already persisted — never the stored blob, which is what silently
+    // rolled a session back three hours. Here the last user message is index 0, so the floor
+    // (nothing persisted by this persister yet) leaves 1; the in-flight assistant turn is
+    // dropped either way, which is the property that matters.
+    assert.is(written.messages.length, 1, 'in-flight agent work is not persisted');
+    assert.is(written.messages[0].content, 'earlier', 'the conversation itself is kept');
+    assert.is(written.flowOwnerAgentName, null, 'flow ownership dropped');
+    assert.equal(written.agentSnapshots, {}, 'flow state dropped');
+  },
+);
+
+Suite('freeze: the boundary never regresses below what was already persisted', async () => {
+  // A resumable save lands the full transcript; the agent then goes non-resumable WITHOUT
+  // a new user prompt (auto-advance, a resumed journey step). `keepThroughLastUserMessage`
+  // alone would rewind to message 1 and drop the completed exchange — the floor stops it.
+  const history = [
+    msg({ role: 'user', content: 'earlier' }),
+    msg({ role: 'assistant', content: 'ok' }),
+  ];
+  const agent = { name: 'Trade Ops', resumable: async () => true, serialize: () => ({}) };
+  const { p, f } = makePersister({ history, activeAgent: agent });
+  p.scheduleSave();
+  await tick();
+  assert.is(f.saved.length, 1, 'the resumable save landed');
+  assert.is(f.saved[0].messages.length, 2, 'full transcript persisted');
+
+  agent.resumable = async () => false;
+  history.push(msg({ role: 'assistant', content: 'in-flight work' }));
+  p.scheduleSave();
+  await tick();
+  await tick();
+  assert.is(f.saved.length, 2, 'the freeze wrote');
+  assert.is(f.saved[1].messages.length, 2, 'floored at the already-persisted length');
+  assert.ok(f.saved[1].interrupted, 'and stamped interrupted');
+});
+
+Suite('freeze: an unmoved boundary skips the write, and never latches', async () => {
+  const history = [
+    msg({ role: 'user', content: 'do it' }),
+    msg({ role: 'assistant', content: 'working' }),
+  ];
+  const agent = {
+    name: 'Trade Ops',
+    resumable: async () => false,
+    serialize: () => ({}),
+  };
+  const { p, f } = makePersister({ history, activeAgent: agent });
   p.scheduleSave();
   await tick();
   await tick();
-  assert.is(f.saved.length, 1, 'one freeze-stamp write');
-  const written = f.saved[0];
-  assert.ok(written.interrupted, 'stamped with an interrupted marker');
-  assert.is(written.interrupted?.message, 'start again');
-  assert.is(written.messages.length, 2, 'froze at the PRIOR transcript, not the in-flight one');
+  assert.is(f.saved.length, 1, 'first freeze writes the boundary');
+
+  // More in-flight turns, same last user message → nothing new to freeze, no write.
+  history.push(msg({ role: 'assistant', content: 'still working' }));
+  p.scheduleSave();
+  await tick();
+  await tick();
+  assert.is(f.saved.length, 1, 'unmoved boundary does not re-write');
+
+  // The old `interrupted` latch made that state permanent. A new prompt must still land.
+  history.push(msg({ role: 'user', content: 'next thing' }));
+  p.scheduleSave();
+  await tick();
+  await tick();
+  assert.is(f.saved.length, 2, 'a moved boundary writes again — the skip is not a latch');
+  assert.is(f.saved[1].messages.length, 4, 'frozen through the new user message');
 });
 
 Suite('clearRestoreCore() drops the snapshot', async () => {
@@ -515,4 +599,189 @@ Suite(
   },
 );
 
+// GENC-1511: the save telemetry has to describe what HAPPENED, not what was attempted.
+// `persistence.saved` used to be emitted before `provider.save` was awaited and the
+// rejection was swallowed into `logger.error`, so a session whose writes had been
+// failing for hours reported nothing but successful saves — in the debug log, in Loki
+// and in Sentry alike.
+Suite('a save that lands emits persistence.saved and no failure event', async () => {
+  const { p, f } = makePersister({ history: [msg({ content: 'hi' })] });
+  p.scheduleSave();
+  await tick();
+  assert.is(f.saved.length, 1, 'the write landed');
+  const types = getMetaEvents(KEY).map((e) => e.type);
+  assert.ok(types.includes('persistence.saved'), 'success is recorded');
+  assert.not.ok(types.includes('persistence.save-failed'), 'no failure recorded');
+});
+
+Suite('a save that throws emits persistence.save-failed and NOT persistence.saved', async () => {
+  const { p, f } = makePersister({
+    history: [msg({ content: 'hi' })],
+    saveError: Object.assign(new TypeError('Converting circular structure to JSON'), {}),
+  });
+  p.scheduleSave();
+  await tick();
+  assert.is(f.saved.length, 0, 'nothing was written');
+  const events = getMetaEvents(KEY);
+  const types = events.map((e) => e.type);
+  assert.not.ok(
+    types.includes('persistence.saved'),
+    'a failed write must never report itself as saved',
+  );
+  const failed = events.find((e) => e.type === 'persistence.save-failed');
+  assert.ok(failed, 'the failure is recorded');
+  // `name` is what separates a transport rejection from a serialisation fault: a
+  // TypeError means the body never reached the wire, so there is no server-side trace.
+  assert.is((failed?.detail as Record<string, unknown>)?.error, 'TypeError');
+  assert.is((failed?.detail as Record<string, unknown>)?.messages, 1);
+});
+
+// GENC-1511 — the user-facing warning. The gate is `resumable`, not `busy`: a bootstrap journey
+// is ONE turn (measured at 2817 s with 82 widget interactions inside it), so a turn-boundary gate
+// would hold the warning for 47 minutes.
+Suite('a single failed save does NOT report broken — one blip is not an outage', async () => {
+  const { p, f } = makePersister({
+    history: [msg({ content: 'hi' })],
+    saveError: new Error('transient'),
+  });
+  p.scheduleSave();
+  await tick();
+  assert.is(f.brokenReports.length, 0, 'a modal about a self-healing blip trains dismissal');
+});
+
+Suite('two consecutive failures report broken when the agent is resumable', async () => {
+  const history = [msg({ content: 'one' })];
+  const { p, f } = makePersister({ history, saveError: new Error('boom') });
+  p.scheduleSave();
+  await tick();
+  history.push(msg({ content: 'two' }));
+  p.scheduleSave();
+  await tick();
+  assert.is(f.brokenReports.length, 1, 'reported once, at the second failure');
+  assert.is(f.brokenReports[0].reason, 'boom');
+  assert.is(f.brokenReports[0].unsavedMessages, 2, 'counts what the store does not have');
+
+  // ...and only once per episode, however many more saves fail.
+  history.push(msg({ content: 'three' }));
+  p.scheduleSave();
+  await tick();
+  assert.is(f.brokenReports.length, 1, 'not re-reported while still broken');
+});
+
+Suite('a NON-resumable agent holds the report back until it is safe to reload', async () => {
+  const history = [msg({ content: 'one' }), msg({ content: 'two' })];
+  const agent = {
+    name: 'UI Builder',
+    resumable: async () => false,
+    serialize: () => ({}),
+  };
+  const { p, f } = makePersister({ history, activeAgent: agent, saveError: new Error('boom') });
+  // Unrolled deliberately: these saves must happen in ORDER, so the lint rule's suggested
+  // Promise.all would change what is being tested.
+  history.push(msg({ role: 'assistant', content: 'turn 0' }));
+  p.scheduleSave();
+  await tick();
+  history.push(msg({ role: 'assistant', content: 'turn 1' }));
+  p.scheduleSave();
+  await tick();
+  history.push(msg({ role: 'assistant', content: 'turn 2' }));
+  p.scheduleSave();
+  await tick();
+  assert.is(f.brokenReports.length, 0, 'advising a reload mid-flow would discard the VFS buffer');
+
+  // Back at rest: now a reload is safe, so now the user is told.
+  agent.resumable = async () => true;
+  history.push(msg({ content: 'next' }));
+  p.scheduleSave();
+  await tick();
+  assert.is(f.brokenReports.length, 1, 'reported at the first resumable moment');
+});
+
+Suite('a save that lands withdraws the warning', async () => {
+  const history = [msg({ content: 'one' })];
+  const fakes = { history, saveError: new Error('boom') as Error | undefined };
+  const { p, f } = makePersister(fakes);
+  p.scheduleSave();
+  await tick();
+  history.push(msg({ content: 'two' }));
+  p.scheduleSave();
+  await tick();
+  assert.is(f.brokenReports.length, 1, 'broken');
+
+  f.saveError = undefined; // the store comes back — observed twice in the wild
+  history.push(msg({ content: 'three' }));
+  p.scheduleSave();
+  await tick();
+  assert.is(f.recovered, 1, 'the warning is withdrawn rather than left stale');
+  assert.ok(f.saved.length > 0, 'and the write landed');
+});
+
+Suite('a failed FREEZE write is reported, not swallowed', async () => {
+  // This catch was the one silent failure left after save-failed was added to the resumable
+  // branch: a session breaking while an agent was mid-flow reported nothing at all.
+  const history = [msg({ content: 'do it' }), msg({ role: 'assistant', content: 'working' })];
+  const { p, f } = makePersister({
+    history,
+    activeAgent: { name: 'UI Builder', resumable: async () => false, serialize: () => ({}) },
+    saveError: new Error('freeze write failed'),
+  });
+  p.scheduleSave();
+  await tick();
+  await tick();
+  const failed = getMetaEvents(KEY).filter((e) => e.type === 'persistence.save-failed');
+  assert.is(failed.length, 1, 'the freeze path now emits the failure event');
+  assert.is(
+    (failed[0].detail as Record<string, unknown>)?.frozen,
+    true,
+    'marked as the freeze path',
+  );
+});
+
+// GENC-1511 review [P1]: the failure event must stay serialisable even when the thing that broke
+// the save is the agent snapshot itself. `recordMetaEvent` stores detail BY REFERENCE, so
+// spreading the captured snapshot made the high-importance event circular too — and then
+// `assembleDebugLog` threw while stringifying it, so `downloadDebugLog` could not produce the log
+// the blocking modal tells the user to save. Reproduced by Matt; regression-guarded here.
+Suite('the save-failed event stays serialisable when the agent snapshot is circular', async () => {
+  const circular: Record<string, unknown> = { machine: 'generating' };
+  circular.self = circular;
+  const { p } = makePersister({
+    history: [msg({ content: 'hi' })],
+    activeAgent: { name: 'UI Builder', serialize: () => circular },
+    saveError: new TypeError('Converting circular structure to JSON'),
+  });
+  p.scheduleSave();
+  await tick();
+  const events = getMetaEvents(KEY);
+  const failed = events.find((e) => e.type === 'persistence.save-failed');
+  assert.ok(failed, 'the failure is recorded');
+  assert.not.ok(
+    (failed?.detail as Record<string, unknown>)?.agentSnapshots,
+    'the raw snapshot must NOT be in the failure detail',
+  );
+  // The whole point: the debug log must still be producible.
+  JSON.stringify(events);
+});
+
+Suite('a non-resumable agent is NEVER told to reload, however long it stays broken', async () => {
+  // GENC-1511 review [P1]: an earlier draft bypassed the gate after 90 s. The modal's only action
+  // is a reload, so firing it here forces the user to discard the out-of-band in-flight work the
+  // gate exists to protect.
+  const history = [msg({ content: 'do it' })];
+  const { p, f } = makePersister({
+    history,
+    activeAgent: { name: 'UI Builder', resumable: async () => false, serialize: () => ({}) },
+    saveError: new Error('boom'),
+  });
+  history.push(msg({ role: 'assistant', content: 'a' }));
+  p.scheduleSave();
+  await tick();
+  await tick();
+  history.push(msg({ role: 'assistant', content: 'b' }));
+  p.scheduleSave();
+  await tick();
+  await tick();
+  assert.is(f.brokenReports.length, 0, 'no unsafe reload prompt, no matter how many failures');
+});
+
 Suite.run();