@genesislcap/ai-assistant 15.15.1 → 15.15.2

package/dist/dts/state/persistence/session-persister.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-persister.d.ts","sourceRoot":"","sources":["../../../../src/state/persistence/session-persister.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAWrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAsCnG;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,cAAc,EAAE,MAAM,wBAAwB,CAAC;IAC/C,+EAA+E;IAC/E,aAAa,EAAE,MAAM,MAAM,EAAE,CAAC;IAC9B,oEAAoE;IACpE,SAAS,EAAE,MAAM,QAAQ,GAAG,SAAS,CAAC;IACtC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,kBAAkB,GAAG,SAAS,CAAC;IAC/C;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,eAAe,EAAE,CAAC;CAC/C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;IA0Bf,OAAO,CAAC,IAAI;IAzBxB,OAAO,CAAC,UAAU,CAAC,CAAgC;IACnD,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,kBAAkB,CAAK;IAC/B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAA+B;IAC7C;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB,CAAS;gBAEpB,IAAI,EAAE,oBAAoB;IAE9C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAI5C,0FAA0F;IAC1F,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,IAAI,CAEjD;IAED,uFAAuF;IACvF,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAapB;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAOzB;;;;OAIG;YACW,cAAc;IAsJ5B;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoK9B;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBvC;;;;OAIG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAatC;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAchD;;;;;;OAMG;IACH,mBAAmB,IAAI,IAAI;IAiB3B;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uBAAuB;IA+C/B,sEAAsE;IACtE,OAAO,IAAI,IAAI;CAMhB"}
+{"version":3,"file":"session-persister.d.ts","sourceRoot":"","sources":["../../../../src/state/persistence/session-persister.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAWrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA8CnG;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,cAAc,EAAE,MAAM,wBAAwB,CAAC;IAC/C,+EAA+E;IAC/E,aAAa,EAAE,MAAM,MAAM,EAAE,CAAC;IAC9B,oEAAoE;IACpE,SAAS,EAAE,MAAM,QAAQ,GAAG,SAAS,CAAC;IACtC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,kBAAkB,GAAG,SAAS,CAAC;IAC/C;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,eAAe,EAAE,CAAC;IAC9C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE;QAC7B,oEAAoE;QACpE,eAAe,EAAE,MAAM,CAAC;QACxB,mEAAmE;QACnE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,+DAA+D;QAC/D,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,IAAI,CAAC;IACX,uFAAuF;IACvF,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;CACrC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;IAkDf,OAAO,CAAC,IAAI;IAjDxB,OAAO,CAAC,UAAU,CAAC,CAAgC;IACnD,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,kBAAkB,CAAK;IAC/B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAA+B;IAC7C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAAK;IAC/B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAS;IACpC,iEAAiE;IACjE,OAAO,CAAC,aAAa,CAAK;IAC1B,iGAAiG;IACjG,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,yEAAyE;IACzE,OAAO,CAAC,eAAe,CAAS;IAChC,mFAAmF;IACnF,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB,CAAM;IAChC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB,CAAS;gBAEpB,IAAI,EAAE,oBAAoB;IAE9C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAI5C,0FAA0F;IAC1F,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,IAAI,CAEjD;IAED,uFAAuF;IACvF,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAapB;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAOzB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;;;OASG;YACW,gBAAgB;IAsB9B;;;;OAIG;YACW,cAAc;IA2N5B;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAuK9B;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBvC;;;;OAIG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAatC;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAchD;;;;;;OAMG;IACH,mBAAmB,IAAI,IAAI;IAiB3B;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uBAAuB;IA+C/B,sEAAsE;IACtE,OAAO,IAAI,IAAI;CAMhB"}

package/dist/esm/main/main.js

@@ -107,6 +107,19 @@ const SESSION_MENU_CLOSE_MS = 200;
  * assistant is running — the Usage tab renders the in-memory list — so the delay is invisible.
  */
 const LEDGER_FLUSH_DEBOUNCE_MS = 2000;
+/**
+ * Reporter id for this element's OWN session persister in `brokenSources` (GENC-1511).
+ *
+ * Named rather than inline so the report and the recovery cannot drift apart — a typo in one of
+ * the two strings would silently make the session's recovery unable to withdraw its own warning,
+ * leaving the modal up for good.
+ */
+const SESSION_PERSISTENCE_SOURCE = 'session';
+/**
+ * What a host gets if it reports a failure without naming a source. Fine for a host with a single
+ * store; a host owning several should name each, so one recovering does not withdraw the others.
+ */
+const DEFAULT_PERSISTENCE_SOURCE = 'host';
 /** Drag-to-resize bounds for the chat input (composer), in px. */
 const COMPOSER_MIN_HEIGHT_PX = 48;
 const COMPOSER_MAX_HEIGHT_PX = 400;
@@ -312,6 +325,39 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         this.downloadingDebugLog = false;
         /** Active tab inside the settings modal. */
         this.settingsModalTab = 'settings';
+        /**
+         * GENC-1511 — persistence has failed repeatedly and it is no longer saving. Drives a BLOCKING
+         * modal with a single Reload action: the whole failure class this ticket exists for is one the
+         * user cannot see, and a passive indicator is close to invisible (Will worked for 3h17m past
+         * the point his session stopped saving, with nothing on screen to tell him).
+         *
+         * Set only at a moment when reloading is SAFE — the persister gates it on the active agent
+         * being resumable, so we never advise a reload while an agent's in-flight work would be lost.
+         */
+        this.persistenceBroken = false;
+        /**
+         * Which reporters currently consider persistence broken, newest last, each with the copy it
+         * asked for. {@link FoundationAiAssistant.persistenceBroken} is DERIVED from this (`size > 0`) rather than being the
+         * source of truth.
+         *
+         * A plain boolean was wrong the moment there was more than one reporter, and review caught it:
+         * this element's own persister covers `sessions/<key>`, while a host reports its own keyspaces
+         * (Create's `projects/<id>.json`). With one flag, a SESSION save landing after its own broken
+         * episode called `reportPersistenceRecovered()` and closed the modal while the PROJECT store
+         * was still refusing writes — and because Create's own re-entry guard only clears on a
+         * successful project write, the warning could then never be raised again for the life of the
+         * page. The user carried on against a dead store with the warning cancelled by an unrelated
+         * subsystem: the exact failure this modal exists to prevent, on the keyspace that holds the app
+         * rather than the transcript.
+         *
+         * A `Map` and not a `Set` because the copy has to survive the same collision. The winner is the
+         * most recently reported still-broken source (insertion order, so it is deterministic), and when
+         * one recovers the copy falls back to whoever is left instead of reverting to the session
+         * default — which would otherwise state something untrue of the failure still in progress.
+         */
+        this.brokenSources = new Map();
+        /** Swallows the native dialog's Escape route. Stored, not inline, so it can be removed again. */
+        this.onPersistenceModalCancel = (e) => e.preventDefault();
         /** Light-DOM nodes assigned to settings modal slots (via `slotted()` bindings). */
         this.settingsModelSlotted = [];
         this.settingsAppSlotted = [];
@@ -2053,6 +2099,70 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         var _a;
         (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setInputValue(value);
     }
+    /**
+     * Showing and hiding the modal hangs off the PROPERTY, so `persistenceBroken` is the single
+     * entry point — for this element's own persister callback and for a host reporting a failure in
+     * a keyspace this element knows nothing about (Create's project payload, GENC-1511 §17).
+     *
+     * It has to be here rather than at the call site because of the `cancel` listener: `cancel`
+     * does not bubble, so it cannot be bound from the template, and a caller that shows the modal
+     * without attaching it gets a modal Escape closes — which defeats the whole point. Routing
+     * every path through one place makes a dismissible variant unreachable.
+     */
+    persistenceBrokenChanged(_old, broken) {
+        var _a;
+        if (!broken) {
+            this.detachPersistenceEscapeGuard();
+            (_a = this.persistenceModal) === null || _a === void 0 ? void 0 : _a.close();
+            return;
+        }
+        DOM.queueUpdate(() => {
+            const modal = this.persistenceModal;
+            // Re-read `persistenceBroken`: this callback is DEFERRED, so the state it exists to act on
+            // may have changed since it was queued. A `true → false` landing in the same batch runs the
+            // `!broken` branch above against a modal that was never shown — both statements no-op — and
+            // this callback would then raise a blocking, deliberately NON-DISMISSIBLE "your work isn't
+            // being saved" modal for a problem that had already fixed itself, with no further change
+            // event coming to close it. The only way out would be a reload nobody needed, which is a
+            // worse outcome than the missed warning this defer exists to avoid.
+            //
+            // Reachable because `maybeReportBroken` fires BEFORE `provider.save` in `persistSession`, so
+            // a report and the successful write that withdraws it can share a tick — and per-source
+            // recovery makes `true → false` far more common than it was (PR #2472 review).
+            if (!modal || modal.open || !this.persistenceBroken)
+                return;
+            this.attachPersistenceEscapeGuard(modal);
+            modal.show();
+        });
+    }
+    /**
+     * Make the modal survive Escape. Bound imperatively because `cancel` does not bubble.
+     *
+     * Attach/detach rather than fire-and-forget: a broken → recovered → broken cycle is reachable
+     * (that is what {@link FoundationAiAssistant.reportPersistenceRecovered} is for), and re-showing previously added a
+     * fresh anonymous closure each time, accumulating duplicate listeners on the dialog.
+     *
+     * A missing `mainElement` is LOGGED rather than ignored. `Dialog` declares it non-optional, so
+     * if it is ever absent the old optional-chain quietly produced an Escape-dismissible modal —
+     * failing open on the one property this modal must never lose.
+     */
+    attachPersistenceEscapeGuard(modal) {
+        const dialog = modal.mainElement;
+        if (!dialog) {
+            logger.error('Persistence modal has no dialog element — Escape cannot be blocked, so the blocking ' +
+                'warning is dismissible. The user may close it and carry on against a dead store.');
+            return;
+        }
+        this.detachPersistenceEscapeGuard();
+        dialog.addEventListener('cancel', this.onPersistenceModalCancel);
+        this.persistenceEscapeGuardTarget = dialog;
+    }
+    /** Remove the Escape guard, if one is bound. Safe to call when there is none. */
+    detachPersistenceEscapeGuard() {
+        var _a;
+        (_a = this.persistenceEscapeGuardTarget) === null || _a === void 0 ? void 0 : _a.removeEventListener('cancel', this.onPersistenceModalCancel);
+        this.persistenceEscapeGuardTarget = undefined;
+    }
     syncShowHalo() {
         if (!this.busy) {
             this.showHalo = 'no';
@@ -3995,8 +4105,94 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             getDriver: () => getDriver(key),
             getStore: () => (hasSessionStore(key) ? getSessionStore(key) : undefined),
             getDiagnosticEntries: () => this.buildDiagnosticEntries(),
+            onPersistenceBroken: (d) => this.onPersistenceBroken(d),
+            onPersistenceRecovered: () => this.onPersistenceRecovered(),
         };
     }
+    /**
+     * Tell the user their work is no longer being saved, and block until they reload (GENC-1511).
+     *
+     * Public because the assistant is not the only thing that persists. Its own persister covers
+     * `sessions/<key>`; a host may own other keyspaces whose failure is just as costly — Create's
+     * `projects/<id>.json` holds the entity model, handlers and VFS, i.e. the app itself — and had
+     * no way to reach this modal (§17 of the GENC-1511 plan).
+     *
+     * Both copy fields are optional and default to the session wording in the template, so the
+     * common case stays a bare call. Idempotent per source while already broken: re-reporting the
+     * same source refreshes its copy, and the property change only shows a modal that is not open.
+     *
+     * @param overrides - `message` replaces the body; `detail` adds/replaces the second line;
+     *   `source` identifies the reporter so its own recovery withdraws only its own warning. Give
+     *   each independent keyspace its own id — see `brokenSources` for what sharing one costs.
+     */
+    reportPersistenceBroken(overrides) {
+        var _a;
+        const source = (_a = overrides === null || overrides === void 0 ? void 0 : overrides.source) !== null && _a !== void 0 ? _a : DEFAULT_PERSISTENCE_SOURCE;
+        // Delete before set so a repeat report moves this source to the END of the insertion order:
+        // the newest failure is the one whose copy shows.
+        this.brokenSources.delete(source);
+        this.brokenSources.set(source, { message: overrides === null || overrides === void 0 ? void 0 : overrides.message, detail: overrides === null || overrides === void 0 ? void 0 : overrides.detail });
+        this.syncPersistenceBrokenCopy();
+    }
+    /**
+     * Withdraw one reporter's warning — its save landed, or the host's own store recovered.
+     *
+     * Only `source`'s entry is removed, so a session recovery cannot cancel a host's still-live
+     * project failure (GENC-1511, caught in review; see `brokenSources`). The modal closes
+     * only once nothing is broken; while anything remains, the copy falls back to the newest
+     * survivor.
+     *
+     * @param source - must match the id the failure was reported under.
+     */
+    reportPersistenceRecovered(source = DEFAULT_PERSISTENCE_SOURCE) {
+        if (!this.brokenSources.delete(source))
+            return;
+        this.syncPersistenceBrokenCopy();
+    }
+    /**
+     * Recompute the derived flag and the displayed copy from `brokenSources`.
+     *
+     * Copy order is last-in-wins, which is both deterministic (`Map` iterates in insertion order)
+     * and the behaviour a reader expects — the most recent failure is the one described. Setting
+     * `persistenceBroken` last means the modal is only ever shown or closed once the copy backing
+     * it is already correct.
+     */
+    syncPersistenceBrokenCopy() {
+        const newest = [...this.brokenSources.values()].pop();
+        this.persistenceBrokenMessage = newest === null || newest === void 0 ? void 0 : newest.message;
+        this.persistenceBrokenDetail = newest === null || newest === void 0 ? void 0 : newest.detail;
+        this.persistenceBroken = this.brokenSources.size > 0;
+    }
+    /** This element's own persister said the session snapshot is not landing (GENC-1511). */
+    onPersistenceBroken(d) {
+        logger.error('Persistence is not saving — prompting the user to reload:', d.reason);
+        // Composed here, not in the template: the count and the timestamp are facts about the CHAT
+        // session, and a host reporting a different keyspace has its own sentence to write.
+        const when = d.lastSavedAt
+            ? ` — the last successful save was at ${new Date(d.lastSavedAt).toLocaleTimeString()}`
+            : '';
+        const detail = d.unsavedMessages > 0
+            ? `${d.unsavedMessages} message${d.unsavedMessages === 1 ? '' : 's'} ` +
+                `have not been saved${when}.`
+            : undefined;
+        this.reportPersistenceBroken({ detail, source: SESSION_PERSISTENCE_SOURCE });
+    }
+    /**
+     * A session save landed after a broken episode — withdraw OUR warning only (GENC-1511).
+     *
+     * The explicit source is the whole point: a host's project store may still be failing, and
+     * before this was per-source a session recovery closed that modal too.
+     */
+    onPersistenceRecovered() {
+        this.reportPersistenceRecovered(SESSION_PERSISTENCE_SOURCE);
+    }
+    /**
+     * The modal's only action. A reload re-reads the stored snapshot, which is plain data parsed
+     * from the server, so it also clears the serialisation fault that is the most likely cause.
+     */
+    reloadForPersistence() {
+        window.location.reload();
+    }
     /**
      * First-load persistence init for a freshly created store (GENC-1351). Restores
      * the user's remembered persistence-toggle choice — kept independently of the
@@ -4585,6 +4781,15 @@ __decorate([
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "settingsModalTab", void 0);
+__decorate([
+    observable
+], FoundationAiAssistant.prototype, "persistenceBroken", void 0);
+__decorate([
+    observable
+], FoundationAiAssistant.prototype, "persistenceBrokenMessage", void 0);
+__decorate([
+    observable
+], FoundationAiAssistant.prototype, "persistenceBrokenDetail", void 0);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "settingsModelSlotted", void 0);

package/dist/esm/main/main.template.js

@@ -352,6 +352,94 @@ const blockedBannerTemplate = html `
 `;
 // ─── Public factory ───────────────────────────────────────────────────────────
 /** @internal */
+/**
+ * GENC-1511 — blocking "not saving" modal.
+ *
+ * Deliberately has NO way out but Reload. The failure it reports is invisible by nature — a
+ * prod session wrote nothing for 3h17m with a normal-looking UI throughout — and anything the
+ * user can dismiss is an invitation to carry on producing work that will be lost. So:
+ * `show-close-icon` off, our own `bottom` slot replacing the default close button, and the
+ * native dialog's Escape route cancelled on `mainElement` in `persistenceBrokenChanged`.
+ *
+ * It is only ever shown at a point where reloading is SAFE — the persister gates on the active
+ * agent being resumable — so the advice cannot cost the user in-flight work it is unable to carry.
+ *
+ * ⚠ `showCloseIcon` is set as a PROPERTY (`:showCloseIcon`), not via the `?show-close-icon`
+ * boolean attribute. It is an `@attr({ mode: 'boolean' })` whose FIELD default is `true`, so the
+ * property reflects the attribute ON at construction and the boolean binding's "absent means
+ * false" never wins. Measured live 2026-08-20: the close icon rendered anyway
+ * (`showCloseIcon=true`, `hasAttribute=true`) until the property was set directly. Do not
+ * "simplify" it back to `?show-close-icon` — this modal must not be dismissible.
+ */
+const persistenceBrokenModalTemplate = (designSystemPrefix) => {
+    const modalTag = `${designSystemPrefix}-modal`;
+    const buttonTag = `${designSystemPrefix}-button`;
+    const iconTag = `${designSystemPrefix}-icon`;
+    return html `
+    <${modalTag}
+      class="persistence-broken-modal"
+      part="persistence-broken-modal"
+      ${ref('persistenceModal')}
+      initial-width="480"
+      :showCloseIcon=${() => false}
+    >
+      <div slot="top" class="persistence-broken-header" part="persistence-broken-header">
+        <h2 class="persistence-broken-title">
+          <${iconTag} name="triangle-exclamation"></${iconTag}> Your work isn't being saved
+        </h2>
+      </div>
+      <div class="persistence-broken-content" part="persistence-broken-content">
+        <p>
+          ${(x) => {
+        var _a;
+        return (_a = x.persistenceBrokenMessage) !== null && _a !== void 0 ? _a : "We've encountered a problem and this session has stopped saving to the server. " +
+            'Anything you do from here will be lost, so please reload before carrying on.';
+    }}
+        </p>
+        <!--
+          Quantified where the reporter can manage it, because "some work" is not actionable.
+          Composed by the CALLER, not here: the assistant's persister counts unsaved messages, a
+          host counting something else has its own sentence, and a template that knew about
+          "messages" could only ever serve the first. Omitted entirely when nobody supplied one.
+        -->
+        ${when((x) => !!x.persistenceBrokenDetail, html `
+            <p class="persistence-broken-detail">${(x) => x.persistenceBrokenDetail}</p>
+          `)}
+        <p class="persistence-broken-detail">
+          Reloading restores the last saved point.${when((x) => { var _a; return ((_a = x.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.allowDebugDownload) === true; }, html `
+              You can download a record of this conversation first.
+            `)}
+        </p>
+      </div>
+      <div slot="bottom" class="persistence-broken-actions" part="persistence-broken-actions">
+        <!--
+          The download lives HERE, not in Settings. The copy used to point at the Settings panel,
+          which this modal makes unreachable by design — offering a record the user cannot get to.
+          Gated on the host's own allowDebugDownload flag, same as the Settings entry, so a host
+          that turned it off does not get it smuggled back in through the failure path; the
+          sentence above is gated on the same flag so the copy never promises a missing button.
+        -->
+        ${when((x) => { var _a; return ((_a = x.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.allowDebugDownload) === true; }, html `
+            <${buttonTag}
+              appearance="outline"
+              part="persistence-broken-download"
+              ?disabled=${(x) => x.downloadingDebugLog}
+              @click=${(x) => x.downloadDebugLog()}
+            >
+              ${(x) => (x.downloadingDebugLog ? 'Preparing…' : 'Download agent log')}
+            </${buttonTag}>
+          `)}
+        <${buttonTag}
+          appearance="accent"
+          part="persistence-broken-reload"
+          @click=${(x) => x.reloadForPersistence()}
+        >
+          Reload the page
+        </${buttonTag}>
+      </div>
+    </${modalTag}>
+  `;
+};
 export const FoundationAiAssistantTemplate = (designSystemPrefix) => {
     const buttonTag = `${designSystemPrefix}-button`;
     const textareaTag = `${designSystemPrefix}-text-area`;
@@ -761,5 +849,6 @@ ${(tc) => { var _a; return (((_a = tc.foldPath) === null || _a === void 0 ? void
       ></ai-halo-overlay>
     </div>
     ${SettingsModalTemplate(designSystemPrefix)}
+    ${persistenceBrokenModalTemplate(designSystemPrefix)}
   `;
 };

package/dist/esm/main/persistence-broken-sources.test.js

@@ -0,0 +1,180 @@
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { DOM } from '@genesislcap/web-core';
+import { FoundationAiAssistant } from './main';
+// Hold a reference so the custom-element registration isn't tree-shaken.
+FoundationAiAssistant;
+// GENC-1511 — the blocking "not saving" modal has MORE THAN ONE reporter: this element's own
+// session persister (`sessions/<key>`), and a host reporting its own keyspaces through the public
+// API (Create's `projects/<id>.json`, which holds the app rather than the transcript).
+//
+// It was first built on a single `persistenceBroken` boolean, and review caught what that costs:
+// whichever reporter recovered FIRST closed the modal for both, and the host's own re-entry guard
+// then kept it from ever being raised again. This suite pins the per-source behaviour so that
+// collision cannot come back.
+//
+// Like `blocked-state.test.ts`, this exercises the METHODS the template bindings read rather than
+// the rendered DOM: `document.createElement` upgrades the element (constructor) without connecting
+// it, so `connectedCallback` never runs and nothing subscribes to `agenticActivityBus` — which
+// would otherwise hold the test runner's event loop open.
+const Suite = createLogicSuite('FoundationAiAssistant persistence-broken sources');
+/** A fresh, unconnected element. Nothing here needs a session store. */
+const element = () => document.createElement('foundation-ai-assistant');
+/** The modal's visible copy, as the template bindings read it. */
+const copy = (el) => ({
+    broken: el.persistenceBroken,
+    message: el.persistenceBrokenMessage,
+    detail: el.persistenceBrokenDetail,
+});
+const SESSION = 'session';
+const PROJECT = 'project';
+Suite('a single reporter raises and withdraws its own warning', () => {
+    const el = element();
+    assert.is(el.persistenceBroken, false);
+    el.reportPersistenceBroken({ detail: '2 messages have not been saved.', source: SESSION });
+    assert.is(el.persistenceBroken, true);
+    assert.is(el.persistenceBrokenDetail, '2 messages have not been saved.');
+    el.reportPersistenceRecovered(SESSION);
+    assert.is(el.persistenceBroken, false);
+    assert.is(el.persistenceBrokenMessage, undefined);
+    assert.is(el.persistenceBrokenDetail, undefined);
+});
+Suite('one source recovering does NOT withdraw another still-broken source', () => {
+    const el = element();
+    el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+    el.reportPersistenceBroken({ message: 'project copy', source: PROJECT });
+    // The session's own save lands. Its warning goes; the project's must not.
+    el.reportPersistenceRecovered(SESSION);
+    assert.is(el.persistenceBroken, true, 'modal must stay up while the project store is failing');
+    assert.is(el.persistenceBrokenMessage, 'project copy', 'and must still describe THAT failure');
+    el.reportPersistenceRecovered(PROJECT);
+    assert.is(el.persistenceBroken, false, 'only once nothing is broken');
+});
+Suite('a later report does not overwrite an earlier source with its own copy', () => {
+    const el = element();
+    el.reportPersistenceBroken({
+        message: 'project copy',
+        detail: 'project detail',
+        source: PROJECT,
+    });
+    // The session reports with NO message override — it wants the template's session default.
+    // Before per-source tracking this assigned `undefined` over the project wording, so the modal
+    // claimed "this session has stopped saving" about a failed PROJECT write.
+    el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+    assert.is(el.persistenceBrokenMessage, undefined, 'newest source wins while it is broken');
+    assert.is(el.persistenceBrokenDetail, 'session detail');
+    // ...and when the newest recovers, the copy falls BACK to the survivor rather than staying
+    // on the recovered source's wording (or reverting to the default).
+    el.reportPersistenceRecovered(SESSION);
+    assert.is(el.persistenceBrokenMessage, 'project copy');
+    assert.is(el.persistenceBrokenDetail, 'project detail');
+    assert.is(el.persistenceBroken, true);
+});
+Suite('recovering an unknown or already-recovered source is a no-op', () => {
+    const el = element();
+    el.reportPersistenceBroken({ message: 'project copy', source: PROJECT });
+    el.reportPersistenceRecovered(SESSION); // never reported
+    assert.equal(copy(el), { broken: true, message: 'project copy', detail: undefined });
+    el.reportPersistenceRecovered(PROJECT);
+    el.reportPersistenceRecovered(PROJECT); // twice
+    assert.equal(copy(el), { broken: false, message: undefined, detail: undefined });
+});
+Suite('re-reporting the same source refreshes its copy without duplicating it', () => {
+    const el = element();
+    el.reportPersistenceBroken({ detail: '2 messages have not been saved.', source: SESSION });
+    el.reportPersistenceBroken({ detail: '5 messages have not been saved.', source: SESSION });
+    assert.is(el.persistenceBrokenDetail, '5 messages have not been saved.');
+    // One recovery must clear it — a second entry for the same source would leave it stuck on.
+    el.reportPersistenceRecovered(SESSION);
+    assert.is(el.persistenceBroken, false);
+});
+Suite('a host that omits the source gets a default it can still recover', () => {
+    const el = element();
+    el.reportPersistenceBroken({ message: 'host copy' });
+    assert.is(el.persistenceBroken, true);
+    el.reportPersistenceRecovered();
+    assert.is(el.persistenceBroken, false);
+});
+Suite("a host's default source is independent of the session's", () => {
+    const el = element();
+    el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+    el.reportPersistenceBroken({ message: 'host copy' });
+    el.reportPersistenceRecovered(); // the host's
+    assert.is(el.persistenceBroken, true, 'the session failure is still live');
+    assert.is(el.persistenceBrokenDetail, 'session detail');
+});
+// GENC-1511 (PR #2472 review) — the deferred show is a separate race from the source tracking.
+// `persistenceBrokenChanged` queues the show via `DOM.queueUpdate`, and the queued callback used
+// not to re-read the flag. A `true → false` inside the same batch runs the `!broken` branch against
+// a modal that was never shown (both statements no-op), and the callback then raised a blocking,
+// NON-DISMISSIBLE modal for a problem that had already fixed itself — with no further change event
+// left to close it, so the only way out was a reload nobody needed.
+//
+// Reachable because `maybeReportBroken` fires before `provider.save` in `persistSession`, so a
+// report and the write that withdraws it can share a tick.
+/** Minimal stand-in for the design-system modal, recording what the callback did to it. */
+function modalStub() {
+    const calls = { show: 0, close: 0 };
+    const dialog = document.createElement('dialog');
+    return {
+        calls,
+        modal: {
+            open: false,
+            mainElement: dialog,
+            show() {
+                calls.show += 1;
+                this.open = true;
+            },
+            close() {
+                calls.close += 1;
+                this.open = false;
+            },
+        },
+    };
+}
+/**
+ * Drain the FAST update queue SYNCHRONOUSLY.
+ *
+ * `DOM.processUpdates()` and not an `await setTimeout(0)`: the queue lands on
+ * `requestAnimationFrame`, which a zero-delay timer does not reliably cover. A timer-based flush
+ * made these tests pass or fail on scheduling luck — the "does not show" assertion passed for the
+ * wrong reason, and its positive control passed only because earlier tests had pumped the queue.
+ */
+const flush = () => DOM.processUpdates();
+const withModal = (el, modal) => {
+    el.persistenceModal = modal;
+};
+// POSITIVE CONTROL for the test below. Without it, a queue that never drains in this environment
+// would make the "does not show" assertion pass for entirely the wrong reason.
+Suite('the deferred show DOES raise the modal when the failure is still live', () => {
+    const el = element();
+    const { calls, modal } = modalStub();
+    withModal(el, modal);
+    el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+    flush();
+    assert.is(calls.show, 1, 'precondition: the queued callback runs in this environment');
+    assert.is(modal.open, true);
+});
+Suite('a recovery inside the same batch cancels the deferred show', () => {
+    const el = element();
+    const { calls, modal } = modalStub();
+    withModal(el, modal);
+    el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+    el.reportPersistenceRecovered(SESSION); // lands before the queue flushes
+    flush();
+    assert.is(el.persistenceBroken, false);
+    assert.is(calls.show, 0, 'must not raise a blocking modal for a resolved failure');
+    assert.is(modal.open, false);
+});
+Suite('a recovery of ONE source still shows for the source left broken', () => {
+    const el = element();
+    const { calls, modal } = modalStub();
+    withModal(el, modal);
+    el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+    el.reportPersistenceBroken({ message: 'project copy', source: PROJECT });
+    el.reportPersistenceRecovered(SESSION);
+    flush();
+    assert.is(el.persistenceBroken, true);
+    assert.is(calls.show, 1, 'the project failure still warrants the modal');
+    assert.is(el.persistenceBrokenMessage, 'project copy');
+});
+Suite.run();

package/dist/esm/state/debug-event-log.js

@@ -42,6 +42,9 @@ export const META_EVENT_IMPORTANCE = {
     'context.threshold-crossed': 'high',
     'context.compacted': 'high',
     'persistence.restore-orphan': 'high',
+    // A save that did not land is silent data loss in progress: the transcript on screen
+    // is no longer backed by the store, and every later turn widens the gap. GENC-1511.
+    'persistence.save-failed': 'high',
     'assistant.connected': 'normal',
     'assistant.disconnected': 'normal',
     'assistant.popout': 'normal',