@genesislcap/ai-assistant 15.15.1 → 15.15.2

package/src/main/main.ts

@@ -220,6 +220,20 @@ const SESSION_MENU_CLOSE_MS = 200;
  */
 const LEDGER_FLUSH_DEBOUNCE_MS = 2000;
 
+/**
+ * Reporter id for this element's OWN session persister in `brokenSources` (GENC-1511).
+ *
+ * Named rather than inline so the report and the recovery cannot drift apart — a typo in one of
+ * the two strings would silently make the session's recovery unable to withdraw its own warning,
+ * leaving the modal up for good.
+ */
+const SESSION_PERSISTENCE_SOURCE = 'session';
+/**
+ * What a host gets if it reports a failure without naming a source. Fine for a host with a single
+ * store; a host owning several should name each, so one recovering does not withdraw the others.
+ */
+const DEFAULT_PERSISTENCE_SOURCE = 'host';
+
 /** Drag-to-resize bounds for the chat input (composer), in px. */
 const COMPOSER_MIN_HEIGHT_PX = 48;
 const COMPOSER_MAX_HEIGHT_PX = 400;
@@ -2139,6 +2153,123 @@ export class FoundationAiAssistant extends GenesisElement {
   @observable settingsModalTab: SettingsModalTab = 'settings';
   /** Bound to the design-system modal via the template ref. */
   settingsModal?: Modal;
+
+  /**
+   * GENC-1511 — persistence has failed repeatedly and it is no longer saving. Drives a BLOCKING
+   * modal with a single Reload action: the whole failure class this ticket exists for is one the
+   * user cannot see, and a passive indicator is close to invisible (Will worked for 3h17m past
+   * the point his session stopped saving, with nothing on screen to tell him).
+   *
+   * Set only at a moment when reloading is SAFE — the persister gates it on the active agent
+   * being resumable, so we never advise a reload while an agent's in-flight work would be lost.
+   */
+  @observable persistenceBroken = false;
+  /**
+   * Which reporters currently consider persistence broken, newest last, each with the copy it
+   * asked for. {@link FoundationAiAssistant.persistenceBroken} is DERIVED from this (`size > 0`) rather than being the
+   * source of truth.
+   *
+   * A plain boolean was wrong the moment there was more than one reporter, and review caught it:
+   * this element's own persister covers `sessions/<key>`, while a host reports its own keyspaces
+   * (Create's `projects/<id>.json`). With one flag, a SESSION save landing after its own broken
+   * episode called `reportPersistenceRecovered()` and closed the modal while the PROJECT store
+   * was still refusing writes — and because Create's own re-entry guard only clears on a
+   * successful project write, the warning could then never be raised again for the life of the
+   * page. The user carried on against a dead store with the warning cancelled by an unrelated
+   * subsystem: the exact failure this modal exists to prevent, on the keyspace that holds the app
+   * rather than the transcript.
+   *
+   * A `Map` and not a `Set` because the copy has to survive the same collision. The winner is the
+   * most recently reported still-broken source (insertion order, so it is deterministic), and when
+   * one recovers the copy falls back to whoever is left instead of reverting to the session
+   * default — which would otherwise state something untrue of the failure still in progress.
+   */
+  private readonly brokenSources = new Map<string, { message?: string; detail?: string }>();
+  /**
+   * Showing and hiding the modal hangs off the PROPERTY, so `persistenceBroken` is the single
+   * entry point — for this element's own persister callback and for a host reporting a failure in
+   * a keyspace this element knows nothing about (Create's project payload, GENC-1511 §17).
+   *
+   * It has to be here rather than at the call site because of the `cancel` listener: `cancel`
+   * does not bubble, so it cannot be bound from the template, and a caller that shows the modal
+   * without attaching it gets a modal Escape closes — which defeats the whole point. Routing
+   * every path through one place makes a dismissible variant unreachable.
+   */
+  persistenceBrokenChanged(_old: boolean, broken: boolean): void {
+    if (!broken) {
+      this.detachPersistenceEscapeGuard();
+      this.persistenceModal?.close();
+      return;
+    }
+    DOM.queueUpdate(() => {
+      const modal = this.persistenceModal;
+      // Re-read `persistenceBroken`: this callback is DEFERRED, so the state it exists to act on
+      // may have changed since it was queued. A `true → false` landing in the same batch runs the
+      // `!broken` branch above against a modal that was never shown — both statements no-op — and
+      // this callback would then raise a blocking, deliberately NON-DISMISSIBLE "your work isn't
+      // being saved" modal for a problem that had already fixed itself, with no further change
+      // event coming to close it. The only way out would be a reload nobody needed, which is a
+      // worse outcome than the missed warning this defer exists to avoid.
+      //
+      // Reachable because `maybeReportBroken` fires BEFORE `provider.save` in `persistSession`, so
+      // a report and the successful write that withdraws it can share a tick — and per-source
+      // recovery makes `true → false` far more common than it was (PR #2472 review).
+      if (!modal || modal.open || !this.persistenceBroken) return;
+      this.attachPersistenceEscapeGuard(modal);
+      modal.show();
+    });
+  }
+
+  /** Swallows the native dialog's Escape route. Stored, not inline, so it can be removed again. */
+  private readonly onPersistenceModalCancel = (e: Event): void => e.preventDefault();
+  /** The node the guard above is bound to, so removal targets the same one it was added to. */
+  private persistenceEscapeGuardTarget?: HTMLDialogElement;
+
+  /**
+   * Make the modal survive Escape. Bound imperatively because `cancel` does not bubble.
+   *
+   * Attach/detach rather than fire-and-forget: a broken → recovered → broken cycle is reachable
+   * (that is what {@link FoundationAiAssistant.reportPersistenceRecovered} is for), and re-showing previously added a
+   * fresh anonymous closure each time, accumulating duplicate listeners on the dialog.
+   *
+   * A missing `mainElement` is LOGGED rather than ignored. `Dialog` declares it non-optional, so
+   * if it is ever absent the old optional-chain quietly produced an Escape-dismissible modal —
+   * failing open on the one property this modal must never lose.
+   */
+  private attachPersistenceEscapeGuard(modal: Modal): void {
+    const dialog = modal.mainElement;
+    if (!dialog) {
+      logger.error(
+        'Persistence modal has no dialog element — Escape cannot be blocked, so the blocking ' +
+          'warning is dismissible. The user may close it and carry on against a dead store.',
+      );
+      return;
+    }
+    this.detachPersistenceEscapeGuard();
+    dialog.addEventListener('cancel', this.onPersistenceModalCancel);
+    this.persistenceEscapeGuardTarget = dialog;
+  }
+
+  /** Remove the Escape guard, if one is bound. Safe to call when there is none. */
+  private detachPersistenceEscapeGuard(): void {
+    this.persistenceEscapeGuardTarget?.removeEventListener('cancel', this.onPersistenceModalCancel);
+    this.persistenceEscapeGuardTarget = undefined;
+  }
+
+  /**
+   * Body copy for the modal; `undefined` uses the session-oriented default in the template. A
+   * host reporting a different keyspace overrides it — "this session has stopped saving" is
+   * simply untrue of a failed project write.
+   */
+  @observable persistenceBrokenMessage?: string;
+  /**
+   * Optional second line, already composed. A STRING rather than the message-count fields it
+   * replaces: quantifying is caller-specific ("N messages", "your last N changes"), and keeping
+   * the template ignorant of what is being counted is what makes it reusable.
+   */
+  @observable persistenceBrokenDetail?: string;
+  /** The modal itself, so it can be shown and made non-dismissible. */
+  persistenceModal?: Modal;
   /** Bound to the settings modal tab bar — used to resync selection after reopen. */
   settingsTabsEl?: SettingsModalTabsElement;
   /** Light-DOM nodes assigned to settings modal slots (via `slotted()` bindings). */
@@ -4348,9 +4479,108 @@ export class FoundationAiAssistant extends GenesisElement {
       getDriver: () => getDriver(key),
       getStore: () => (hasSessionStore(key) ? getSessionStore(key) : undefined),
       getDiagnosticEntries: () => this.buildDiagnosticEntries(),
+      onPersistenceBroken: (d) => this.onPersistenceBroken(d),
+      onPersistenceRecovered: () => this.onPersistenceRecovered(),
     };
   }
 
+  /**
+   * Tell the user their work is no longer being saved, and block until they reload (GENC-1511).
+   *
+   * Public because the assistant is not the only thing that persists. Its own persister covers
+   * `sessions/<key>`; a host may own other keyspaces whose failure is just as costly — Create's
+   * `projects/<id>.json` holds the entity model, handlers and VFS, i.e. the app itself — and had
+   * no way to reach this modal (§17 of the GENC-1511 plan).
+   *
+   * Both copy fields are optional and default to the session wording in the template, so the
+   * common case stays a bare call. Idempotent per source while already broken: re-reporting the
+   * same source refreshes its copy, and the property change only shows a modal that is not open.
+   *
+   * @param overrides - `message` replaces the body; `detail` adds/replaces the second line;
+   *   `source` identifies the reporter so its own recovery withdraws only its own warning. Give
+   *   each independent keyspace its own id — see `brokenSources` for what sharing one costs.
+   */
+  reportPersistenceBroken(overrides?: {
+    message?: string;
+    detail?: string;
+    source?: string;
+  }): void {
+    const source = overrides?.source ?? DEFAULT_PERSISTENCE_SOURCE;
+    // Delete before set so a repeat report moves this source to the END of the insertion order:
+    // the newest failure is the one whose copy shows.
+    this.brokenSources.delete(source);
+    this.brokenSources.set(source, { message: overrides?.message, detail: overrides?.detail });
+    this.syncPersistenceBrokenCopy();
+  }
+
+  /**
+   * Withdraw one reporter's warning — its save landed, or the host's own store recovered.
+   *
+   * Only `source`'s entry is removed, so a session recovery cannot cancel a host's still-live
+   * project failure (GENC-1511, caught in review; see `brokenSources`). The modal closes
+   * only once nothing is broken; while anything remains, the copy falls back to the newest
+   * survivor.
+   *
+   * @param source - must match the id the failure was reported under.
+   */
+  reportPersistenceRecovered(source: string = DEFAULT_PERSISTENCE_SOURCE): void {
+    if (!this.brokenSources.delete(source)) return;
+    this.syncPersistenceBrokenCopy();
+  }
+
+  /**
+   * Recompute the derived flag and the displayed copy from `brokenSources`.
+   *
+   * Copy order is last-in-wins, which is both deterministic (`Map` iterates in insertion order)
+   * and the behaviour a reader expects — the most recent failure is the one described. Setting
+   * `persistenceBroken` last means the modal is only ever shown or closed once the copy backing
+   * it is already correct.
+   */
+  private syncPersistenceBrokenCopy(): void {
+    const newest = [...this.brokenSources.values()].pop();
+    this.persistenceBrokenMessage = newest?.message;
+    this.persistenceBrokenDetail = newest?.detail;
+    this.persistenceBroken = this.brokenSources.size > 0;
+  }
+
+  /** This element's own persister said the session snapshot is not landing (GENC-1511). */
+  private onPersistenceBroken(d: {
+    unsavedMessages: number;
+    lastSavedAt?: string;
+    reason: string;
+  }): void {
+    logger.error('Persistence is not saving — prompting the user to reload:', d.reason);
+    // Composed here, not in the template: the count and the timestamp are facts about the CHAT
+    // session, and a host reporting a different keyspace has its own sentence to write.
+    const when = d.lastSavedAt
+      ? ` — the last successful save was at ${new Date(d.lastSavedAt).toLocaleTimeString()}`
+      : '';
+    const detail =
+      d.unsavedMessages > 0
+        ? `${d.unsavedMessages} message${d.unsavedMessages === 1 ? '' : 's'} ` +
+          `have not been saved${when}.`
+        : undefined;
+    this.reportPersistenceBroken({ detail, source: SESSION_PERSISTENCE_SOURCE });
+  }
+
+  /**
+   * A session save landed after a broken episode — withdraw OUR warning only (GENC-1511).
+   *
+   * The explicit source is the whole point: a host's project store may still be failing, and
+   * before this was per-source a session recovery closed that modal too.
+   */
+  private onPersistenceRecovered(): void {
+    this.reportPersistenceRecovered(SESSION_PERSISTENCE_SOURCE);
+  }
+
+  /**
+   * The modal's only action. A reload re-reads the stored snapshot, which is plain data parsed
+   * from the server, so it also clears the serialisation fault that is the most likely cause.
+   */
+  reloadForPersistence(): void {
+    window.location.reload();
+  }
+
   /**
    * First-load persistence init for a freshly created store (GENC-1351). Restores
    * the user's remembered persistence-toggle choice — kept independently of the

package/src/main/persistence-broken-sources.test.ts

@@ -0,0 +1,219 @@
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { DOM } from '@genesislcap/web-core';
+import { FoundationAiAssistant } from './main';
+
+// Hold a reference so the custom-element registration isn't tree-shaken.
+FoundationAiAssistant;
+
+// GENC-1511 — the blocking "not saving" modal has MORE THAN ONE reporter: this element's own
+// session persister (`sessions/<key>`), and a host reporting its own keyspaces through the public
+// API (Create's `projects/<id>.json`, which holds the app rather than the transcript).
+//
+// It was first built on a single `persistenceBroken` boolean, and review caught what that costs:
+// whichever reporter recovered FIRST closed the modal for both, and the host's own re-entry guard
+// then kept it from ever being raised again. This suite pins the per-source behaviour so that
+// collision cannot come back.
+//
+// Like `blocked-state.test.ts`, this exercises the METHODS the template bindings read rather than
+// the rendered DOM: `document.createElement` upgrades the element (constructor) without connecting
+// it, so `connectedCallback` never runs and nothing subscribes to `agenticActivityBus` — which
+// would otherwise hold the test runner's event loop open.
+const Suite = createLogicSuite('FoundationAiAssistant persistence-broken sources');
+
+/** A fresh, unconnected element. Nothing here needs a session store. */
+const element = (): FoundationAiAssistant =>
+  document.createElement('foundation-ai-assistant') as FoundationAiAssistant;
+
+/** The modal's visible copy, as the template bindings read it. */
+const copy = (el: FoundationAiAssistant) => ({
+  broken: el.persistenceBroken,
+  message: el.persistenceBrokenMessage,
+  detail: el.persistenceBrokenDetail,
+});
+
+const SESSION = 'session';
+const PROJECT = 'project';
+
+Suite('a single reporter raises and withdraws its own warning', () => {
+  const el = element();
+  assert.is(el.persistenceBroken, false);
+
+  el.reportPersistenceBroken({ detail: '2 messages have not been saved.', source: SESSION });
+  assert.is(el.persistenceBroken, true);
+  assert.is(el.persistenceBrokenDetail, '2 messages have not been saved.');
+
+  el.reportPersistenceRecovered(SESSION);
+  assert.is(el.persistenceBroken, false);
+  assert.is(el.persistenceBrokenMessage, undefined);
+  assert.is(el.persistenceBrokenDetail, undefined);
+});
+
+Suite('one source recovering does NOT withdraw another still-broken source', () => {
+  const el = element();
+  el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+  el.reportPersistenceBroken({ message: 'project copy', source: PROJECT });
+
+  // The session's own save lands. Its warning goes; the project's must not.
+  el.reportPersistenceRecovered(SESSION);
+
+  assert.is(el.persistenceBroken, true, 'modal must stay up while the project store is failing');
+  assert.is(el.persistenceBrokenMessage, 'project copy', 'and must still describe THAT failure');
+
+  el.reportPersistenceRecovered(PROJECT);
+  assert.is(el.persistenceBroken, false, 'only once nothing is broken');
+});
+
+Suite('a later report does not overwrite an earlier source with its own copy', () => {
+  const el = element();
+  el.reportPersistenceBroken({
+    message: 'project copy',
+    detail: 'project detail',
+    source: PROJECT,
+  });
+
+  // The session reports with NO message override — it wants the template's session default.
+  // Before per-source tracking this assigned `undefined` over the project wording, so the modal
+  // claimed "this session has stopped saving" about a failed PROJECT write.
+  el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+  assert.is(el.persistenceBrokenMessage, undefined, 'newest source wins while it is broken');
+  assert.is(el.persistenceBrokenDetail, 'session detail');
+
+  // ...and when the newest recovers, the copy falls BACK to the survivor rather than staying
+  // on the recovered source's wording (or reverting to the default).
+  el.reportPersistenceRecovered(SESSION);
+  assert.is(el.persistenceBrokenMessage, 'project copy');
+  assert.is(el.persistenceBrokenDetail, 'project detail');
+  assert.is(el.persistenceBroken, true);
+});
+
+Suite('recovering an unknown or already-recovered source is a no-op', () => {
+  const el = element();
+  el.reportPersistenceBroken({ message: 'project copy', source: PROJECT });
+
+  el.reportPersistenceRecovered(SESSION); // never reported
+  assert.equal(copy(el), { broken: true, message: 'project copy', detail: undefined });
+
+  el.reportPersistenceRecovered(PROJECT);
+  el.reportPersistenceRecovered(PROJECT); // twice
+  assert.equal(copy(el), { broken: false, message: undefined, detail: undefined });
+});
+
+Suite('re-reporting the same source refreshes its copy without duplicating it', () => {
+  const el = element();
+  el.reportPersistenceBroken({ detail: '2 messages have not been saved.', source: SESSION });
+  el.reportPersistenceBroken({ detail: '5 messages have not been saved.', source: SESSION });
+  assert.is(el.persistenceBrokenDetail, '5 messages have not been saved.');
+
+  // One recovery must clear it — a second entry for the same source would leave it stuck on.
+  el.reportPersistenceRecovered(SESSION);
+  assert.is(el.persistenceBroken, false);
+});
+
+Suite('a host that omits the source gets a default it can still recover', () => {
+  const el = element();
+  el.reportPersistenceBroken({ message: 'host copy' });
+  assert.is(el.persistenceBroken, true);
+
+  el.reportPersistenceRecovered();
+  assert.is(el.persistenceBroken, false);
+});
+
+Suite("a host's default source is independent of the session's", () => {
+  const el = element();
+  el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+  el.reportPersistenceBroken({ message: 'host copy' });
+
+  el.reportPersistenceRecovered(); // the host's
+  assert.is(el.persistenceBroken, true, 'the session failure is still live');
+  assert.is(el.persistenceBrokenDetail, 'session detail');
+});
+
+// GENC-1511 (PR #2472 review) — the deferred show is a separate race from the source tracking.
+// `persistenceBrokenChanged` queues the show via `DOM.queueUpdate`, and the queued callback used
+// not to re-read the flag. A `true → false` inside the same batch runs the `!broken` branch against
+// a modal that was never shown (both statements no-op), and the callback then raised a blocking,
+// NON-DISMISSIBLE modal for a problem that had already fixed itself — with no further change event
+// left to close it, so the only way out was a reload nobody needed.
+//
+// Reachable because `maybeReportBroken` fires before `provider.save` in `persistSession`, so a
+// report and the write that withdraws it can share a tick.
+
+/** Minimal stand-in for the design-system modal, recording what the callback did to it. */
+function modalStub() {
+  const calls = { show: 0, close: 0 };
+  const dialog = document.createElement('dialog');
+  return {
+    calls,
+    modal: {
+      open: false,
+      mainElement: dialog,
+      show() {
+        calls.show += 1;
+        this.open = true;
+      },
+      close() {
+        calls.close += 1;
+        this.open = false;
+      },
+    },
+  };
+}
+
+/**
+ * Drain the FAST update queue SYNCHRONOUSLY.
+ *
+ * `DOM.processUpdates()` and not an `await setTimeout(0)`: the queue lands on
+ * `requestAnimationFrame`, which a zero-delay timer does not reliably cover. A timer-based flush
+ * made these tests pass or fail on scheduling luck — the "does not show" assertion passed for the
+ * wrong reason, and its positive control passed only because earlier tests had pumped the queue.
+ */
+const flush = () => DOM.processUpdates();
+
+const withModal = (el: FoundationAiAssistant, modal: unknown) => {
+  (el as unknown as { persistenceModal: unknown }).persistenceModal = modal;
+};
+
+// POSITIVE CONTROL for the test below. Without it, a queue that never drains in this environment
+// would make the "does not show" assertion pass for entirely the wrong reason.
+Suite('the deferred show DOES raise the modal when the failure is still live', () => {
+  const el = element();
+  const { calls, modal } = modalStub();
+  withModal(el, modal);
+
+  el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+  flush();
+
+  assert.is(calls.show, 1, 'precondition: the queued callback runs in this environment');
+  assert.is(modal.open, true);
+});
+
+Suite('a recovery inside the same batch cancels the deferred show', () => {
+  const el = element();
+  const { calls, modal } = modalStub();
+  withModal(el, modal);
+
+  el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+  el.reportPersistenceRecovered(SESSION); // lands before the queue flushes
+  flush();
+
+  assert.is(el.persistenceBroken, false);
+  assert.is(calls.show, 0, 'must not raise a blocking modal for a resolved failure');
+  assert.is(modal.open, false);
+});
+
+Suite('a recovery of ONE source still shows for the source left broken', () => {
+  const el = element();
+  const { calls, modal } = modalStub();
+  withModal(el, modal);
+
+  el.reportPersistenceBroken({ detail: 'session detail', source: SESSION });
+  el.reportPersistenceBroken({ message: 'project copy', source: PROJECT });
+  el.reportPersistenceRecovered(SESSION);
+  flush();
+
+  assert.is(el.persistenceBroken, true);
+  assert.is(calls.show, 1, 'the project failure still warrants the modal');
+  assert.is(el.persistenceBrokenMessage, 'project copy');
+});
+
+Suite.run();

package/src/state/debug-event-log.ts

@@ -77,6 +77,7 @@ export type MetaEventType =
   | 'session.switch-deferred'
   | 'persistence.toggled'
   | 'persistence.saved'
+  | 'persistence.save-failed'
   | 'persistence.suppressed'
   | 'persistence.not-resumable'
   | 'persistence.restored'
@@ -108,6 +109,9 @@ export const META_EVENT_IMPORTANCE: Record<MetaEventType, MetaEventImportance> =
   'context.threshold-crossed': 'high',
   'context.compacted': 'high',
   'persistence.restore-orphan': 'high',
+  // A save that did not land is silent data loss in progress: the transcript on screen
+  // is no longer backed by the store, and every later turn widens the gap. GENC-1511.
+  'persistence.save-failed': 'high',
 
   'assistant.connected': 'normal',
   'assistant.disconnected': 'normal',