@jskit-ai/assistant-runtime 0.1.198 → 0.1.199

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/assistant-runtime",
-  "version": "0.1.198",
+  "version": "0.1.199",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"
@@ -12,19 +12,19 @@
     "./server": "./src/server/index.js"
   },
   "dependencies": {
-    "@jskit-ai/assistant-core": "0.1.205",
+    "@jskit-ai/assistant-core": "0.1.206",
     "json-rest-schema": "^1.0.17"
   },
   "peerDependencies": {
-    "@jskit-ai/http-runtime": "0.1.225",
-    "@jskit-ai/http-web": "0.1.72",
-    "@jskit-ai/kernel": "0.1.227",
-    "@jskit-ai/realtime": "0.1.224",
-    "@jskit-ai/shell-web": "0.1.231",
+    "@jskit-ai/http-runtime": "0.1.226",
+    "@jskit-ai/http-web": "0.1.73",
+    "@jskit-ai/kernel": "0.1.228",
+    "@jskit-ai/realtime": "0.1.225",
+    "@jskit-ai/shell-web": "0.1.232",
     "@tanstack/vue-query": "^5.90.5",
     "vue": "^3.5.13",
     "vuetify": "^4.0.0",
-    "@jskit-ai/database-runtime": "0.1.227"
+    "@jskit-ai/database-runtime": "0.1.228"
   },
   "description": "Capability-based assistant runtime with per-surface chat, transcripts, settings, and action tools.",
   "jskit": {

package/src/client/components/AssistantConversationClientElement.vue

@@ -50,7 +50,6 @@ defineExpose({ focus: () => conversation.value?.focus(), runtime: binding.runtim
       <slot :name="name" v-bind="scope" :runtime="binding.runtime.value" />
     </template>
     <template #composer-feedback>
-      <p v-if="binding.error.value" role="status" class="assistant-client-conversation__error">{{ binding.error.value }}</p>
       <slot name="composer-feedback" :runtime="binding.runtime.value" />
     </template>
   </AssistantConversationElement>
@@ -58,5 +57,4 @@ defineExpose({ focus: () => conversation.value?.focus(), runtime: binding.runtim
 
 <style scoped>
 .assistant-client-conversation { flex: 1 1 auto; height: 100%; min-height: 0; min-width: 0; }
-.assistant-client-conversation__error { color: rgb(var(--v-theme-error)); font-size: .85rem; margin: .25rem 0; overflow-wrap: anywhere; }
 </style>

package/src/client/composables/useAssistantConversation.js

@@ -579,7 +579,7 @@ function createConversation(identity, { api, socket, actorKey, placement, reader
 
   const runtime = { identity, current, active, editable, available, canSubmit, steerable, queueWhileSending: queueing,
     snapshot, draft, draftMessageId, draftAttachments, draftRetry, draftRetryMatches, settleDraftRetry,
-    error, loading, stopping, delivery, turns,
+    error, accessDenied, loading, stopping, delivery, turns,
     hasMoreBefore, loadingMore, loadMoreError, loadMore,
     send, submitPrepared, submitDraft, cancel, cancelMessage, inspectDelivery, changeGoal, refreshGoal, goalState, goalView, goalLoadError, questions,
     reload() { const job = subscription?.reload(); void refreshGoal(); return job; } };
@@ -624,7 +624,7 @@ function useBoundedTask({ command, endpoint, scope, input, result, onResult }, {
       conversation: {
         turns: conversationTurnsFromMessages(messages.value.map(message => ({ ...message, text: message.content }))),
         assistantLabel: display.assistantLabel || "Assistant", welcomeMessage: display.welcomeMessage,
-        visible: display.visible, variant: display.variant, scrollKey: toValue(scope)
+        visible: display.visible, retainWhenHidden: display.retainWhenHidden, variant: display.variant, scrollKey: toValue(scope)
       },
       composer: {
         draft: draft.value, disabled: busy.value, pending: busy.value,
@@ -862,12 +862,13 @@ function createConversationBinding({ conversationId, endpoint = "", surfaceId =
       models: current?.available.value ? modelOwner.value : null, questions: prompts,
       goal: (toValue(goal) === true ? null : toValue(goal)) || current?.goalState.value || null,
       conversation: { turns: current?.turns.value || [], interimReply: state?.interimReply || null,
+        error: current?.error.value || state?.error || "", errorReloadable: Boolean(current) && !current.accessDenied.value,
         scrollKey: JSON.stringify(identity.value),
         hasMoreBefore: current?.hasMoreBefore.value || false,
         loadingMore: current?.loadingMore.value || false, loadMoreError: current?.loadMoreError.value || "",
-        loading: current?.loading.value || false, working: state?.status === "working" && !current.delivery.state.sending,
+        loading: current?.loading.value || false, working: !current?.error.value && state?.status === "working" && !current.delivery.state.sending,
         assistantLabel: display.assistantLabel || "Assistant", welcomeMessage: display.welcomeMessage ?? "What would you like to do?",
-        systemLabel: display.systemLabel, variant: display.variant, visible: display.visible,
+        systemLabel: display.systemLabel, variant: display.variant, visible: display.visible, retainWhenHidden: display.retainWhenHidden,
         userMessageFormat: display.userMessageFormat, progressPreviewLimit: display.progressPreviewLimit,
         previewMessage: current?.available.value ? display.previewMessage : null },
       composer: { draft, disabled: !editable ||

package/src/client/support/subscribeAssistantConversation.js

@@ -59,6 +59,7 @@ function subscribeAssistantConversation({
     publishState({ ...options, canonical: true });
   }
   function reload() {
+    if (!listening) return subscribe();
     if (reloadInFlight) {
       reloadQueued = true;
       return reloadInFlight;
@@ -82,7 +83,24 @@ function subscribeAssistantConversation({
       for (const [id, entry] of completed) if (settled.has(entry.turnId)) completed.delete(id);
       receiveState(snapshot);
     }).catch(error => {
-      if (current()) onError(error);
+      if (current()) {
+        if ([401, 403].includes(Number(error.status || error.statusCode))) {
+          if (epoch === null) {
+            disconnected();
+            if (socket.connected) socket.emit(ASSISTANT_CONVERSATION_UNSUBSCRIBE, { subscriptionId });
+          } else {
+            // Retain invalidation notifications for a fresh authorized read, not cached content.
+            generation += 1;
+            reloadInFlight = null;
+            reloadQueued = false;
+          }
+          state = null;
+          streaming = null;
+          completed.clear();
+          settledTurns.clear();
+        }
+        onError(error);
+      }
     }).finally(() => {
       pendingReads.delete(pendingRead);
       if (reloadInFlight !== job) return;
@@ -100,6 +118,10 @@ function subscribeAssistantConversation({
     if (payload.streamEpoch !== epoch || !Number.isSafeInteger(payload.streamRevision) || payload.streamRevision <= revision) return;
     revision = payload.streamRevision;
     const event = payload.event;
+    if (!state) {
+      if (SNAPSHOT_EVENTS.has(event.type)) reload();
+      return;
+    }
     let changedPresentation = Object.hasOwn(event, "interimReply");
     if (changedPresentation && state) state = { ...state, interimReply: event.interimReply };
     if (event.type === "transcript") {
@@ -164,7 +186,9 @@ function subscribeAssistantConversation({
         listening = false;
         pending = [];
         if (socket.connected) socket.emit(ASSISTANT_CONVERSATION_UNSUBSCRIBE, { subscriptionId });
-        onError(error || Object.assign(new Error(response?.error || "Conversation subscription failed."), {
+        onError(error ? Object.assign(new Error("Chat updates could not reconnect. Reload chat to try again.", { cause: error }), {
+          code: "assistant_subscription_transport_failed"
+        }) : Object.assign(new Error(response?.error || "Conversation subscription failed."), {
           code: response?.code, statusCode: response?.status
         }));
         return;

package/src/server/AssistantProvider.js

@@ -15,6 +15,7 @@ const AssistantFeature = defineFeature({
     http: "runtime.http"
   },
   optional: {
+    logger: "runtime.logger",
     conversationRuntime: "assistant.conversations",
     conversationAccess: "assistant.conversation.access",
     assistantConfigService: "assistant.settings",
@@ -97,11 +98,11 @@ const AssistantFeature = defineFeature({
       config
     });
   },
-  boot({ conversationRuntime, conversationAccess, realtime, events, config, workspaces }, { outputs }) {
+  boot({ conversationRuntime, conversationAccess, realtime, events, config, workspaces, logger }, { outputs }) {
     if (!conversationRuntime || !realtime) return;
     const state = subscriptionLifecycle.get(outputs.assistant);
     state.release = registerConversationSubscriptions({
-      realtime, events, actions: state.actions, config, workspaceScopeSupport: workspaces?.scope || null,
+      realtime, events, actions: state.actions, config, logger, workspaceScopeSupport: workspaces?.scope || null,
       ...(conversationAccess ? {
         subscribeActionId: conversationAccess.subscribeActionId,
         requestPolicy: conversationAccess.requestPolicy

package/src/server/actions.js

@@ -201,10 +201,13 @@ function createConversationActions({ conversationRuntime, conversationDataSchema
         if (typeof deps?.onEvent !== "function" || typeof deps?.onRelease !== "function") {
           throw new TypeError("Conversation subscriptions require their server-owned event and cleanup callbacks.");
         }
+        deps.onStage?.("conversation-open");
         const conversation = await openConversation(input, context);
+        deps.onStage?.("observer-attach");
         const release = await conversation.subscribe(deps.onEvent);
         try {
           deps.onRelease(release);
+          deps.onStage?.("snapshot-read");
           return await conversation.read();
         } catch (error) {
           release();

package/src/server/registerConversationSubscriptions.js

@@ -30,7 +30,7 @@ function subscriptionError(error) {
 // Register one conversation subscription owner per shared realtime runtime.
 // A host may select its fixed action/request policy at composition; clients
 // never choose either. The selected action remains the authorization boundary.
-function registerConversationSubscriptions({ realtime, events, actions, config = {}, workspaceScopeSupport = null,
+function registerConversationSubscriptions({ realtime, events, actions, config = {}, logger = null, workspaceScopeSupport = null,
   subscribeActionId = actionIds.conversationSubscribe, requestPolicy = "authenticated" } = {}) {
   if (typeof realtime?.onConnection !== "function" || typeof events?.publish !== "function") {
     throw new TypeError("Conversation subscriptions require the shared realtime connection and event runtime.");
@@ -63,14 +63,34 @@ function registerConversationSubscriptions({ realtime, events, actions, config =
       if (typeof acknowledge !== "function" || closed) return;
       let subscription;
       let subscriptionId;
+      const startedAt = performance.now();
+      let stageStartedAt = startedAt;
+      let stage = "request-admission";
+      let observedConversationId;
+      function onStage(next, fields = {}) {
+        const now = performance.now();
+        // Only a successfully opened, authorized conversation may enter diagnostics.
+        if (next === "observer-attach") observedConversationId = input.conversationId;
+        try {
+          logger?.info?.({ event: "assistant.conversation.subscription", subscriptionEpoch: subscription?.epoch,
+            ...(typeof observedConversationId === "string" ? { conversationId: observedConversationId } : {}),
+            stage: next, previousStage: stage,
+            durationMs: now - stageStartedAt, elapsedMs: now - startedAt, ...fields },
+          "Assistant conversation subscription stage");
+        } catch { /* Diagnostics must not change conversation admission or cleanup. */ }
+        stage = next;
+        stageStartedAt = now;
+      }
       try {
         subscriptionId = requireSubscriptionId(input);
         release(subscriptionId);
         subscription = { pending: new Map(), revision: 0, epoch: randomUUID(), queue: Promise.resolve() };
         subscriptions.set(subscriptionId, subscription);
         const current = () => !closed && socket.connected && subscriptions.get(subscriptionId) === subscription;
+        onStage("authentication");
         const request = await (requestPolicy === "host" ? readRequest() : authenticate());
-        if (!current()) return;
+        if (!current()) { onStage("abandoned"); return; }
+        onStage("action-admission");
         const assistantSurface = resolveAssistantSurfaceConfig(config, input.targetSurfaceId);
         if (!assistantSurface) throw new AppError(404, "Assistant not found.");
         const requiresWorkspace = assistantSurface.runtimeSurfaceRequiresWorkspace;
@@ -127,15 +147,24 @@ function registerConversationSubscriptions({ realtime, events, actions, config =
           input: { ...routeState.actionInput, conversationId: input.conversationId },
           deps: {
             onEvent,
+            onStage,
             onRelease(detach) {
               if (!current()) detach();
               else subscription.release = detach;
             }
           }
         });
-        if (!current()) return;
+        if (!current()) { onStage("abandoned"); return; }
+        onStage("acknowledgement", {
+          ...(Array.isArray(state?.conversationLog) ? { snapshotTurns: state.conversationLog.length } : {}),
+          ...(Number.isSafeInteger(state?.pagination?.limit) ? { snapshotLimit: state.pagination.limit } : {})
+        });
         acknowledge({ ok: true, subscriptionId, streamEpoch: subscription.epoch, state });
+        // Sending an acknowledgement does not prove that a timed-out client received it.
+        onStage("acknowledgement-sent");
       } catch (error) {
+        onStage("failed", { code: String(error?.code || "assistant_subscription_failed"),
+          status: Number(error?.status || error?.statusCode || 500) });
         if (subscriptions.get(subscriptionId) === subscription) release(subscriptionId);
         if (!closed && socket.connected) acknowledge(subscriptionError(error));
       }

package/test/assistantConversationBinding.browser.test.js

@@ -2105,3 +2105,70 @@ test("acceptance settles a voice-retained conversation after its text view retar
   await expect(f.input).toHaveValue("The next conversation's draft stays.");
   assert.equal((await f.sent()).length, 1);
 });
+
+test("transient subscription errors keep loaded history and recover through the banner while denial clears private content", options, async t => {
+  const f = await fixture(t, 390, { acceptedDraft: true });
+  await f.input.fill("Start a controlled ongoing answer.");
+  await f.input.press("Enter");
+  const stop = f.primary.getByRole("button", { name: "Stop", exact: true });
+  await expect(stop).toBeVisible();
+  const sentBeforeRecovery = (await f.sent()).length;
+  assert.equal(sentBeforeRecovery, 1);
+  const workingHint = f.primary.locator(".assistant-composer-support__assistant-status");
+  await expect(workingHint).toHaveText("Assistant is working…");
+  const turns = Array.from({ length: 30 }, (_, index) => ({
+    turnId: `saved-${index}`,
+    user: { messageId: `question-${index}`, role: "user", text: `Private saved question ${index}. ` + "Keep the original discussion. ".repeat(8) },
+    assistant: { messageId: `answer-${index}`, role: "assistant", text: `Private saved answer ${index}. ` + "Read the saved answer without losing your place. ".repeat(8) }
+  }));
+  await f.command("history", { id: "chat:1", turns, limit: 30 });
+  await f.notify("chat:1");
+  const body = f.primary.locator(".assistant-transcript__body");
+  await expect(body.locator(".assistant-transcript__turn")).toHaveCount(turns.length * 2);
+  await expect(f.primary.locator(".assistant-transcript__settling")).toHaveCount(0);
+  await f.input.fill("Keep my newer private draft.");
+  await body.hover();
+  await f.page.mouse.wheel(0, -1000);
+  await expect.poll(() => body.evaluate(element => element.scrollHeight - element.clientHeight - element.scrollTop)).toBeGreaterThan(50);
+  await body.evaluate(element => { element.scrollTop = 420; window.loadedUpdateBody = element; });
+  await expect.poll(() => body.evaluate(element => element.scrollTop)).toBe(420);
+  await f.input.evaluate(element => { element.focus({ preventScroll: true }); element.setSelectionRange(2, 7); });
+  const reads = "**/api/assistant/home/conversations/*";
+  await f.page.route(reads, route => route.fulfill({ status: 503, json: { error: "Chat updates are temporarily unavailable." } }));
+  await f.page.evaluate(() => window.conversationFixture.current().reload());
+  const banner = f.primary.locator(".assistant-transcript__error");
+  await expect(banner).toContainText("Chat updates are temporarily unavailable.");
+  await expect(workingHint).toHaveCount(0);
+  await expect(stop).toBeVisible();
+  await expect(f.primary.getByText("Chat updates are temporarily unavailable.", { exact: true })).toHaveCount(1);
+  await expect(body.locator(".assistant-transcript__turn")).toHaveCount(turns.length * 2);
+  assert.equal(await body.evaluate(element => element === window.loadedUpdateBody), true);
+  await expect.poll(() => body.evaluate(element => element.scrollTop)).toBe(420);
+  await expect(f.input).toBeFocused();
+  assert.deepEqual(await f.input.evaluate(element => [element.selectionStart, element.selectionEnd]), [2, 7]);
+  await expect(f.input).toHaveValue("Keep my newer private draft.");
+  await f.page.evaluate(() => window.conversationFixture.socket.reconnect());
+  await expect.poll(() => f.page.evaluate(() => window.conversationFixture.socket.inspect().active)).toBe(0);
+  await expect(body.locator(".assistant-transcript__turn")).toHaveCount(turns.length * 2);
+  await f.page.unroute(reads);
+  await banner.getByRole("button", { name: "Reload chat", exact: true }).click();
+  await expect(banner).toHaveCount(0);
+  await expect(workingHint).toHaveText("Assistant is working…");
+  await expect(stop).toBeVisible();
+  await expect.poll(() => f.page.evaluate(() => window.conversationFixture.socket.inspect().active)).toBe(1);
+  assert.equal(await body.evaluate(element => element === window.loadedUpdateBody), true);
+  await expect.poll(() => body.evaluate(element => element.scrollTop)).toBe(420);
+  await expect(f.input).toHaveValue("Keep my newer private draft.");
+  await expect(body.locator(".assistant-transcript__turn")).toHaveCount(turns.length * 2);
+  assert.equal((await f.sent()).length, sentBeforeRecovery, "Subscription recovery never sends the retained draft");
+  await f.command("deny", { denied: true });
+  await f.page.evaluate(() => window.conversationFixture.current().reload());
+  await expect(banner).toContainText("Access denied.");
+  await expect(banner.getByRole("button", { name: "Reload chat", exact: true })).toHaveCount(0);
+  await expect(body.locator(".assistant-transcript__turn")).toHaveCount(0);
+  await expect(f.input).toHaveValue("");
+  await expect(f.input).toBeDisabled();
+  await expect.poll(() => f.page.evaluate(() => window.conversationFixture.socket.inspect().active)).toBe(1);
+  assert.equal((await f.sent()).length, sentBeforeRecovery);
+  assert.ok(await f.page.evaluate(() => document.documentElement.scrollWidth <= innerWidth));
+});

package/test/assistantConversationSubscriptions.test.js

@@ -52,6 +52,7 @@ async function fixture(t) {
   const fetches = [];
   const runtimeEvents = [];
   const authRequests = [];
+  const subscriptionTimings = [];
   const nextReadBarriers = new Map();
   const clientSessions = new WeakMap();
   const context = { actor: { id: "42" }, surface: "home", channel: "internal" };
@@ -140,7 +141,8 @@ async function fixture(t) {
     serverSockets.add(socket);
     return () => { serverSockets.delete(socket); notify(); };
   });
-  const stopSubscriptions = registerConversationSubscriptions({ realtime, events, actions, config });
+  const stopSubscriptions = registerConversationSubscriptions({ realtime, events, actions, config,
+    logger: { info(record) { subscriptionTimings.push(record); notify(); } } });
   const published = [];
   events.register({ id: "test.assistant.published", handle(event) { published.push(event); notify(); } });
   http.listen(0, "127.0.0.1");
@@ -201,9 +203,113 @@ async function fixture(t) {
     return barrier;
   }
   return { ids, connect, view, changes, sessions, revoked, fetches, conversations, runtimeEvents,
-    realtime, transport, serverSockets, published, events, stopSubscriptions, authRequests, holdNextRead, active: () => active };
+    realtime, transport, serverSockets, published, events, stopSubscriptions, authRequests, subscriptionTimings,
+    holdNextRead, active: () => active };
 }
 
+test("subscription timings identify a blocked snapshot and abandoned observation without stopping work", { timeout: 20_000 }, async t => {
+  const f = await fixture(t);
+  const socket = await f.connect();
+  const id = f.ids[0];
+  await f.conversations.get(id).send({ messageId: "measured-once", text: "Continue while history is being read" });
+  await until(f.changes, () => f.fetches.length === 1);
+  const barrier = f.holdNextRead(id);
+  const view = f.view(socket, id);
+  await until(f.changes, () => barrier.started);
+  assert.deepEqual(f.subscriptionTimings.map(record => record.stage), [
+    "authentication", "action-admission", "conversation-open", "observer-attach", "snapshot-read"
+  ]);
+  assert.equal(f.active(), 1);
+  assert.equal(view.states.length, 0);
+  view.dispose();
+  await until(f.changes, () => f.active() === 0);
+  barrier.resolve();
+  await until(f.changes, () => f.subscriptionTimings.at(-1)?.stage === "abandoned");
+  const abandoned = f.subscriptionTimings.at(-1);
+  assert.equal(abandoned.previousStage, "snapshot-read");
+  assert.equal(abandoned.conversationId, id);
+  assert.equal(f.fetches[0].signal.aborted, false);
+  assert.equal(f.fetches.length, 1);
+  assert.equal(view.states.length, 0, "An abandoned read never acknowledges stale conversation content");
+
+  const recovered = f.view(socket, id);
+  await until(f.changes, () => recovered.states.length === 1);
+  const records = f.subscriptionTimings.filter(record => record.subscriptionEpoch !== abandoned.subscriptionEpoch);
+  assert.deepEqual(records.map(record => record.stage), ["authentication", "action-admission", "conversation-open",
+    "observer-attach", "snapshot-read", "acknowledgement", "acknowledgement-sent"]);
+  assert.ok(records.every(record => record.event === "assistant.conversation.subscription" &&
+    Number.isFinite(record.durationMs) && record.durationMs >= 0 &&
+    Number.isFinite(record.elapsedMs) && record.elapsedMs >= record.durationMs));
+  assert.ok(records.slice(1).every((record, index) => record.elapsedMs >= records[index].elapsedMs));
+  assert.ok(records.slice(0, 3).every(record => !Object.hasOwn(record, "conversationId")),
+    "Unvalidated request identity is never copied into diagnostics");
+  assert.ok(records.slice(3).every(record => record.conversationId === id));
+  assert.ok(records.every(record => !Object.hasOwn(record, "subscriptionId")),
+    "Correlation uses the server epoch rather than arbitrary client subscription text");
+  assert.equal(records.find(record => record.stage === "acknowledgement").snapshotTurns, 1);
+  assert.equal(recovered.states[0].conversationLog[0].user.messageId, "measured-once");
+  assert.equal(f.active(), 1);
+  assert.equal(f.fetches.length, 1);
+  assert.equal(f.fetches[0].signal.aborted, false);
+  recovered.dispose();
+  await until(f.changes, () => f.active() === 0);
+});
+
+test("the real ten-second subscription deadline releases its late observer and Reload never repeats work", { timeout: 25_000 }, async t => {
+  const f = await fixture(t);
+  const socket = await f.connect();
+  const socketId = socket.id;
+  const id = f.ids[0];
+  await f.conversations.get(id).send({ messageId: "survives-timeout", text: "Keep working through a slow snapshot" });
+  await until(f.changes, () => f.fetches.length === 1);
+  const barrier = f.holdNextRead(id);
+  const view = f.view(socket, id);
+  await until(f.changes, () => barrier.started);
+  const firstSubscriptionEpoch = f.subscriptionTimings.at(-1).subscriptionEpoch;
+  while (!view.errors.length || f.active() !== 0) {
+    await once(f.changes, "change", { signal: AbortSignal.timeout(12_000) });
+  }
+  assert.equal(view.errors[0].message, "Chat updates could not reconnect. Reload chat to try again.");
+  assert.equal(view.errors[0].cause.message, "operation has timed out");
+  assert.equal(socket.id, socketId);
+  assert.equal(socket.connected, true);
+  assert.equal(view.states.length, 0);
+  assert.equal(f.fetches[0].signal.aborted, false);
+  view.dispose.reload();
+  await until(f.changes, () => view.states.length === 1 && f.active() === 1);
+  assert.equal(view.states[0].conversationLog[0].user.messageId, "survives-timeout");
+  const statesBeforeLateRead = view.states.length;
+  barrier.resolve();
+  await until(f.changes, () => f.subscriptionTimings.some(record =>
+    record.subscriptionEpoch === firstSubscriptionEpoch && record.stage === "abandoned"));
+  assert.equal(view.states.length, statesBeforeLateRead, "The obsolete server read never acknowledges into the recovered view");
+  assert.equal(f.active(), 1, "The late read cannot release the recovered observer");
+  assert.equal(f.fetches.length, 1);
+  assert.equal(f.fetches[0].signal.aborted, false);
+  assert.equal(socket.listeners(ASSISTANT_CONVERSATION_EVENT).length, 1);
+  f.fetches[0].text("Still running after the timed-out observation.");
+  await until(f.changes, () => view.received.some(event => event.text?.includes("timed-out observation")));
+  view.dispose();
+  await until(f.changes, () => f.active() === 0);
+});
+
+test("subscription diagnostics never serialize unvalidated client identifiers", async t => {
+  const f = await fixture(t);
+  const socket = await f.connect();
+  const privateText = "unvalidated-client-content-must-not-enter-logs";
+  const result = await requestSubscription(socket, {
+    subscriptionId: privateText, conversationId: { text: privateText }, targetSurfaceId: "home", hostSurfaceId: "home"
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.status, 400);
+  assert.equal(f.active(), 0);
+  assert.equal(f.subscriptionTimings.at(-1).stage, "failed");
+  assert.ok(f.subscriptionTimings.every(record => /^[0-9a-f-]{36}$/.test(record.subscriptionEpoch)));
+  assert.ok(f.subscriptionTimings.every(record => !Object.hasOwn(record, "conversationId") &&
+    !Object.hasOwn(record, "subscriptionId")));
+  assert.equal(JSON.stringify(f.subscriptionTimings).includes(privateText), false);
+});
+
 test("five chats share one authenticated socket and release independently without stopping turns", { timeout: 20_000 }, async t => {
   const f = await fixture(t);
   const socket = await f.connect();
@@ -237,6 +343,95 @@ test("five chats share one authenticated socket and release independently withou
   assert.ok(views.every(view => view.errors.length === 0));
 });
 
+test("Reload recovers a failed initial subscription on the same connected socket without repeating native work", { timeout: 20_000 }, async t => {
+  const f = await fixture(t);
+  const socket = await f.connect();
+  const socketId = socket.id;
+  const barrier = f.holdNextRead(f.ids[0]);
+  const view = f.view(socket, f.ids[0]);
+  await until(f.changes, () => barrier.started);
+  barrier.reject(new Error("The initial history read failed."));
+  await until(f.changes, () => view.errors.length === 1 && f.active() === 0);
+  assert.equal(socket.connected, true);
+  assert.equal(view.states.length, 0);
+
+  await f.conversations.get(f.ids[0]).send({ messageId: "accepted-once", text: "Keep this admitted turn" });
+  await until(f.changes, () => f.fetches.length === 1);
+  f.revoked.add(f.ids[0]);
+  const authBeforeRetry = f.authRequests.length;
+  view.dispose.reload();
+  await until(f.changes, () => view.errors.length === 2);
+  assert.equal(view.errors.at(-1).statusCode, 403, "Reload must authorize again rather than reuse failed subscription authority");
+  assert.ok(f.authRequests.length > authBeforeRetry);
+  assert.equal(f.active(), 0);
+  assert.equal(view.states.length, 0);
+  assert.equal(socket.id, socketId);
+
+  f.revoked.delete(f.ids[0]);
+  view.dispose.reload();
+  await until(f.changes, () => view.states.length === 1 && f.active() === 1);
+  assert.equal(view.states[0].conversationLog[0].user.messageId, "accepted-once");
+  assert.equal(socket.id, socketId, "Recovery does not need a reconnect or replacement socket");
+  assert.equal(socket.listeners(ASSISTANT_CONVERSATION_EVENT).length, 1);
+  assert.equal([...f.serverSockets][0].listenerCount(ASSISTANT_CONVERSATION_SUBSCRIBE), 1);
+  await view.dispose.reload();
+  assert.equal(f.active(), 1, "A healthy Reload reads without adding another observer");
+  f.fetches[0].text("Output continues after recovery.");
+  await until(f.changes, () => view.received.some(event => event.text?.includes("after recovery")));
+  assert.equal(f.fetches.length, 1, "Reload never repeats the accepted model request");
+  assert.equal(f.fetches[0].signal.aborted, false);
+  view.dispose();
+  await until(f.changes, () => f.active() === 0);
+  view.dispose.reload();
+  assert.equal(socket.listeners(ASSISTANT_CONVERSATION_EVENT).length, 0);
+  assert.equal(f.fetches[0].signal.aborted, false, "Disposing presentation does not stop admitted work");
+});
+
+for (const failure of ["rejection", "timeout"]) {
+  test(`Reload after initial ${failure} retains subscription identity and ignores stale or disposed acknowledgements`, () => {
+    const socket = new EventEmitter();
+    socket.connected = true;
+    const requests = [], states = [], errors = [];
+    let reads = 0;
+    socket.timeout = timeout => ({ emit(name, input, acknowledge) {
+      assert.equal(timeout, 10_000);
+      assert.equal(name, ASSISTANT_CONVERSATION_SUBSCRIBE);
+      requests.push({ input, acknowledge });
+    } });
+    const dispose = subscribeAssistantConversation({ socket, conversationId: "exact-chat", targetSurfaceId: "target", hostSurfaceId: "host",
+      workspaceSlug: "workspace", read() { reads += 1; }, onState: state => states.push(state), onError: error => errors.push(error) });
+    requests[0].acknowledge(failure === "timeout" ? new Error("operation has timed out") : null,
+      { ok: false, error: "Temporary subscription failure.", status: 500 });
+    assert.equal(errors.length, 1);
+    dispose.reload();
+    dispose.reload();
+    assert.equal(requests.length, 2, "An acknowledgement already pending is not another subscription");
+    assert.deepEqual(requests[1].input, requests[0].input);
+    assert.deepEqual(requests[1].input, { subscriptionId: requests[0].input.subscriptionId, conversationId: "exact-chat",
+      targetSurfaceId: "target", hostSurfaceId: "host", workspaceSlug: "workspace" });
+    const state = { id: "exact-chat", conversationLog: [], streaming: { revision: 0, messages: [] } };
+    requests[0].acknowledge(null, { ok: true, streamEpoch: "old", state });
+    assert.equal(states.length, 0, "The earlier generation cannot replace a pending recovery");
+    socket.connected = false;
+    socket.emit("disconnect");
+    dispose.reload();
+    assert.equal(requests.length, 2, "Disconnected Reload cannot create a subscription");
+    requests[1].acknowledge(null, { ok: true, streamEpoch: "late", state });
+    assert.equal(states.length, 0);
+    socket.connected = true;
+    dispose.reload();
+    assert.equal(requests.length, 3);
+    dispose();
+    requests[2].acknowledge(null, { ok: true, streamEpoch: "disposed", state });
+    dispose.reload();
+    assert.equal(requests.length, 3);
+    assert.equal(states.length, 0);
+    assert.equal(errors.length, 1);
+    assert.equal(reads, 0, "Recovery subscribes rather than reading under missing subscription authority");
+    for (const event of [ASSISTANT_CONVERSATION_EVENT, "connect", "disconnect"]) assert.equal(socket.listenerCount(event), 0);
+  });
+}
+
 test("reconnect reauthorizes and reads current state without repeating an admitted submission", { timeout: 20_000 }, async t => {
   const f = await fixture(t);
   const socket = await f.connect("owner-session", { recovery: true });
@@ -690,3 +885,108 @@ test("host subscription policy retains authenticated actor metadata and per-even
   assert.ok(cookies.length >= 5);
   assert.ok(cookies.every(value => value === "host-session"));
 });
+
+for (const status of [401, 403, 503]) {
+  test(`subscription read failure ${status} fences denied updates but retains transient history`, async t => {
+    const changes = new EventEmitter();
+    const socket = new EventEmitter();
+    socket.connected = true;
+    const requests = [], states = [], errors = [], unsubscribed = [], events = [];
+    socket.on(ASSISTANT_CONVERSATION_UNSUBSCRIBE, input => unsubscribed.push(input));
+    socket.timeout = () => ({ emit(name, input, acknowledge) {
+      assert.equal(name, ASSISTANT_CONVERSATION_SUBSCRIBE);
+      requests.push({ input, acknowledge });
+    } });
+    const user = { messageId: "question", role: "user", text: "Private saved question" };
+    const initial = { id: "chat", status: "working", conversationLog: [{ turnId: "turn", user }],
+      streaming: { revision: 0, messages: [] } };
+    const recovered = { id: "chat", status: "ready", conversationLog: [], streaming: { revision: 0, messages: [] } };
+    const failure = Object.assign(new Error(status === 503 ? "Updates unavailable." : "Access denied."), { statusCode: status });
+    let reads = 0;
+    let denied = true;
+    const dispose = subscribeAssistantConversation({ socket, conversationId: "chat", targetSurfaceId: "home", hostSurfaceId: "home",
+      read() { reads += 1; if (denied) throw failure; return recovered; },
+      onState(state) { states.push(state); changes.emit("change"); },
+      onError(error) { errors.push(error); changes.emit("change"); }, onEvent: event => events.push(event) });
+    t.after(dispose);
+    requests[0].acknowledge(null, { ok: true, streamEpoch: "old", state: initial });
+    const subscriptionId = requests[0].input.subscriptionId;
+    await dispose.reload();
+    assert.deepEqual(errors, [failure]);
+    assert.equal(reads, 1);
+    assert.equal(states.length, 1, "A failed read cannot replace the loaded snapshot");
+    function deliver(event, revision) {
+      socket.emit(ASSISTANT_CONVERSATION_EVENT, { subscriptionId, conversationId: "chat", streamEpoch: "old",
+        streamRevision: revision, event });
+    }
+    const message = { messageId: "answer", turnId: "turn", role: "assistant", status: "inProgress", text: "Late private output" };
+    deliver({ type: "message", ...message, streaming: { revision: 1, messages: [message] } }, 1);
+    assert.equal(unsubscribed.length, 0, "The original notification observer remains available for authorized recovery");
+    if (status === 503) {
+      assert.equal(states.length, 2);
+      assert.equal(states.at(-1).turns[0].user.text, user.text);
+      assert.equal(states.at(-1).turns[0].assistant.text, message.text);
+      assert.equal(events.length, 1);
+      return;
+    }
+    assert.equal(states.length, 1, "Late events cannot restore content cleared by the denied access owner");
+    deliver({ type: "transcript", patch: { type: "upsert-turn", turn: { turnId: "turn", user } } }, 2);
+    assert.equal(states.length, 1, "A late patch cannot create another denied snapshot");
+    assert.deepEqual(events, [], "Denied presentation hooks are not forwarded before a fresh authorized read");
+    requests[0].acknowledge(null, { ok: true, streamEpoch: "old", state: initial });
+    assert.equal(states.length, 1, "An obsolete acknowledgement cannot restore the denied snapshot");
+    denied = false;
+    deliver({ type: "settled", turnId: "turn" }, 3);
+    await until(changes, () => states.length === 2);
+    assert.deepEqual(states.at(-1).turns, [], "Fresh canonical state excludes old buffered output");
+    assert.equal(requests.length, 1, "Recovery uses the original observer and authoritative read");
+    assert.equal(reads, 2);
+    deliver({ type: "message", ...message, text: "Authorized new output",
+      streaming: { revision: 2, messages: [{ ...message, text: "Authorized new output" }] } }, 4);
+    assert.equal(states.length, 3);
+    assert.equal(states.at(-1).turns[0].assistant.text, "Authorized new output");
+    assert.equal(events.length, 1);
+    assert.deepEqual(errors, [failure]);
+    assert.equal(reads, 2, "Presentation after recovery does not issue another read or resend");
+  });
+}
+
+test("denied Reload before the initial acknowledgement retires only that pending observer and recovers on the same socket", async t => {
+  const socket = new EventEmitter();
+  socket.connected = true;
+  const requests = [], states = [], errors = [], unsubscribed = [];
+  socket.on(ASSISTANT_CONVERSATION_UNSUBSCRIBE, input => unsubscribed.push(input));
+  socket.timeout = () => ({ emit(name, input, acknowledge) {
+    assert.equal(name, ASSISTANT_CONVERSATION_SUBSCRIBE);
+    requests.push({ input, acknowledge });
+  } });
+  const failure = Object.assign(new Error("Access denied."), { statusCode: 401 });
+  let reads = 0;
+  const dispose = subscribeAssistantConversation({ socket, conversationId: "chat", targetSurfaceId: "home", hostSurfaceId: "home",
+    read() { reads += 1; throw failure; }, onState: state => states.push(state), onError: error => errors.push(error) });
+  t.after(dispose);
+  const subscriptionId = requests[0].input.subscriptionId;
+  await dispose.reload();
+  assert.deepEqual(errors, [failure]);
+  assert.deepEqual(unsubscribed, [{ subscriptionId }]);
+  assert.equal(reads, 1);
+  assert.equal(socket.connected, true, "Denied admission retires only this observer, not the shared socket");
+  const privateState = { id: "chat", status: "ready", conversationLog: [{ turnId: "private",
+    user: { messageId: "private-question", role: "user", text: "Old private history" } }], streaming: { revision: 0, messages: [] } };
+  requests[0].acknowledge(null, { ok: true, streamEpoch: "old", state: privateState });
+  socket.emit(ASSISTANT_CONVERSATION_EVENT, { subscriptionId, conversationId: "chat", streamEpoch: "old",
+    streamRevision: 1, event: { type: "settled", turnId: "private" } });
+  assert.deepEqual(states, [], "Late old acknowledgements and notifications cannot restore private content");
+  assert.equal(reads, 1);
+  dispose.reload();
+  assert.equal(requests.length, 2);
+  assert.deepEqual(requests[1].input, requests[0].input);
+  requests[0].acknowledge(null, { ok: true, streamEpoch: "old", state: privateState });
+  assert.deepEqual(states, []);
+  const recovered = { id: "chat", status: "ready", conversationLog: [], streaming: { revision: 0, messages: [] } };
+  requests[1].acknowledge(null, { ok: true, streamEpoch: "fresh", state: recovered });
+  assert.equal(states.length, 1);
+  assert.deepEqual(states[0].turns, []);
+  assert.equal(reads, 1, "Recovery uses fresh subscription admission rather than repeating the old read or inference");
+  assert.deepEqual(errors, [failure]);
+});