@oneuptime/common 11.7.4 → 12.0.1

package/Tests/Server/Services/UpdateOneByIdKeepsRowId.test.ts

@@ -9,20 +9,24 @@ import { afterEach, describe, expect, test } from "@jest/globals";
  * find's select columns — is covered in
  * DatabaseServiceSanitizeUpdateData.test.ts).
  *
- * DatabaseService._updateBy builds the row it saves as a merge of the
- * located row's _id and the caller's update data. With the old merge order
+ * DatabaseService._updateBy targets the write at the located row's _id and
+ * the caller's update data. With the old save-payload merge order
  * `{ _id: item._id, ...data }`, update data carrying an own `_id: undefined`
  * property (a fresh model instance before sanitizeUpdateData existed, or a
  * plain object that spells it out) clobbered the located row's id — TypeORM
  * save() saw no primary key, INSERTed a new row instead of updating, and
  * died on the first NOT NULL column.
  *
- * These tests pin the fixed merge order: the located row's _id must win no
- * matter what shape the update data takes. _findBy is mocked out, so this
- * exercises the save-payload merge in isolation.
+ * Scalar-only updates now go through repository.update() (never inserts, so
+ * it cannot resurrect a concurrently-deleted row), which takes the located
+ * row's _id as its WHERE clause and the sanitized columns as the SET. These
+ * tests pin that down: the located row's _id must target the write no matter
+ * what shape the update data takes, and _id must never leak into the SET
+ * payload. _findBy is mocked out, so this exercises the write in isolation.
  */
 
-type SavedRow = { _id?: string; status?: string; startedAt?: Date };
+type WhereClause = { _id?: string };
+type UpdatePayload = { _id?: string; status?: string; startedAt?: Date };
 
 function mockPersistence(existingRowId: string): jest.Mock {
   const existing: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
@@ -32,27 +36,27 @@ function mockPersistence(existingRowId: string): jest.Mock {
     .spyOn(NetworkDeviceDiscoveryScanService as any, "_findBy")
     .mockResolvedValue([existing] as never);
 
-  const save: jest.Mock = jest
+  const update: jest.Mock = jest
     .fn()
-    .mockImplementation(async (row: unknown): Promise<unknown> => {
-      return row;
+    .mockImplementation(async (): Promise<unknown> => {
+      return { affected: 1 };
     });
 
   jest
     .spyOn(NetworkDeviceDiscoveryScanService, "getRepository")
-    .mockReturnValue({ save } as any);
+    .mockReturnValue({ update } as any);
 
-  return save;
+  return update;
 }
 
-describe("DatabaseService.updateOneById — saved row keeps the located row's _id", () => {
+describe("DatabaseService.updateOneById — the write targets the located row's _id", () => {
   afterEach(() => {
     jest.restoreAllMocks();
   });
 
   test("when data is a fresh model instance (own undefined _id property)", async () => {
     const rowId: string = ObjectID.generate().toString();
-    const save: jest.Mock = mockPersistence(rowId);
+    const update: jest.Mock = mockPersistence(rowId);
 
     const data: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
     data.status = "In Progress";
@@ -67,15 +71,18 @@ describe("DatabaseService.updateOneById — saved row keeps the located row's _i
       props: { isRoot: true },
     });
 
-    expect(save).toHaveBeenCalledTimes(1);
-    const saved: SavedRow = save.mock.calls[0]![0] as SavedRow;
-    expect(saved._id).toBe(rowId);
-    expect(saved.status).toBe("In Progress");
+    expect(update).toHaveBeenCalledTimes(1);
+    const where: WhereClause = update.mock.calls[0]![0] as WhereClause;
+    const payload: UpdatePayload = update.mock.calls[0]![1] as UpdatePayload;
+    expect(where._id).toBe(rowId);
+    expect(payload.status).toBe("In Progress");
+    // _id must never leak into the SET payload — it is the WHERE, not a column.
+    expect(payload._id).toBeUndefined();
   });
 
   test("when data is a plain partial object", async () => {
     const rowId: string = ObjectID.generate().toString();
-    const save: jest.Mock = mockPersistence(rowId);
+    const update: jest.Mock = mockPersistence(rowId);
 
     await NetworkDeviceDiscoveryScanService.updateOneById({
       id: new ObjectID(rowId),
@@ -83,15 +90,17 @@ describe("DatabaseService.updateOneById — saved row keeps the located row's _i
       props: { isRoot: true },
     });
 
-    expect(save).toHaveBeenCalledTimes(1);
-    const saved: SavedRow = save.mock.calls[0]![0] as SavedRow;
-    expect(saved._id).toBe(rowId);
-    expect(saved.status).toBe("In Progress");
+    expect(update).toHaveBeenCalledTimes(1);
+    const where: WhereClause = update.mock.calls[0]![0] as WhereClause;
+    const payload: UpdatePayload = update.mock.calls[0]![1] as UpdatePayload;
+    expect(where._id).toBe(rowId);
+    expect(payload.status).toBe("In Progress");
+    expect(payload._id).toBeUndefined();
   });
 
   test("when data is a plain object that spells out _id: undefined", async () => {
     const rowId: string = ObjectID.generate().toString();
-    const save: jest.Mock = mockPersistence(rowId);
+    const update: jest.Mock = mockPersistence(rowId);
 
     await NetworkDeviceDiscoveryScanService.updateOneById({
       id: new ObjectID(rowId),
@@ -99,9 +108,11 @@ describe("DatabaseService.updateOneById — saved row keeps the located row's _i
       props: { isRoot: true },
     });
 
-    expect(save).toHaveBeenCalledTimes(1);
-    const saved: SavedRow = save.mock.calls[0]![0] as SavedRow;
-    expect(saved._id).toBe(rowId);
-    expect(saved.status).toBe("In Progress");
+    expect(update).toHaveBeenCalledTimes(1);
+    const where: WhereClause = update.mock.calls[0]![0] as WhereClause;
+    const payload: UpdatePayload = update.mock.calls[0]![1] as UpdatePayload;
+    expect(where._id).toBe(rowId);
+    expect(payload.status).toBe("In Progress");
+    expect(payload._id).toBeUndefined();
   });
 });

package/Tests/Server/Utils/AI/AIConfidenceSignal.test.ts

@@ -214,6 +214,50 @@ describe("per-consumer fail directions", () => {
   });
 });
 
+describe("AIConfidenceSignal.shouldAutoEnqueueCodeFixTask", () => {
+  test("only a POSITIVE confident classification enqueues an automatic fix PR", () => {
+    expect(
+      AIConfidenceSignal.shouldAutoEnqueueCodeFixTask({
+        confident: true,
+        source: "classification",
+      }),
+    ).toBe(true);
+    expect(
+      AIConfidenceSignal.shouldAutoEnqueueCodeFixTask({
+        confident: false,
+        source: "classification",
+      }),
+    ).toBe(false);
+  });
+
+  test("the deterministic floor (no server-minted evidence) never enqueues", () => {
+    expect(
+      AIConfidenceSignal.shouldAutoEnqueueCodeFixTask({
+        confident: false,
+        source: "deterministic-floor",
+      }),
+    ).toBe(false);
+  });
+
+  test("fails toward DOING NOTHING: classification-failed → no fix PR", () => {
+    expect(
+      AIConfidenceSignal.shouldAutoEnqueueCodeFixTask({
+        confident: false,
+        source: "classification-failed",
+      }),
+    ).toBe(false);
+  });
+
+  test("the placeholder boolean on classification-failed must not leak into the decision", () => {
+    expect(
+      AIConfidenceSignal.shouldAutoEnqueueCodeFixTask({
+        confident: true,
+        source: "classification-failed",
+      }),
+    ).toBe(false);
+  });
+});
+
 describe("AIConfidenceSignal.computeConfidenceSignal", () => {
   afterEach(() => {
     jest.restoreAllMocks();

package/Tests/Server/Utils/AI/AIIncidentGating.test.ts

@@ -0,0 +1,475 @@
+import AIIncidentInvestigationRunner, {
+  DEFAULT_INCIDENT_DEDUPE_WINDOW_MINUTES,
+  IncidentGateDecision,
+} from "../../../../Server/Utils/AI/SRE/IncidentInvestigationRunner";
+import AIInvestigationEngine from "../../../../Server/Utils/AI/SRE/AIInvestigationEngine";
+import AIInvestigationQueue from "../../../../Server/Utils/AI/SRE/InvestigationQueue";
+import AIRunService from "../../../../Server/Services/AIRunService";
+import IncidentService from "../../../../Server/Services/IncidentService";
+import IncidentSeverityService from "../../../../Server/Services/IncidentSeverityService";
+import ProjectService from "../../../../Server/Services/ProjectService";
+import Incident from "../../../../Models/DatabaseModels/Incident";
+import IncidentSeverity from "../../../../Models/DatabaseModels/IncidentSeverity";
+import Project from "../../../../Models/DatabaseModels/Project";
+import AIRunType from "../../../../Types/AI/AIRunType";
+import ObjectID from "../../../../Types/ObjectID";
+import PositiveNumber from "../../../../Types/PositiveNumber";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Cost gates for autonomous INCIDENT investigations.
+ *
+ * Alerts have had a severity floor and a per-monitor cooldown since Phase 1;
+ * incidents had neither, so every incident in an enabled project enqueued a
+ * run. These tests lock in the gates AND the one deliberate asymmetry:
+ *
+ *   - the severity floor is UNSET by default, so an existing project's
+ *     coverage does not silently shrink on deploy (an incident already
+ *     cleared a human-authored threshold to exist, unlike an alert firing
+ *     straight off a monitor);
+ *   - the cooldown IS on by default at 30 minutes, because it only suppresses
+ *     repeat work on a monitor that was just investigated;
+ *   - an incident affects a SET of monitors, so the dedupe key is "any of
+ *     them" — a storm that opens several incidents is the case this exists
+ *     for.
+ *
+ * Fail directions are asserted explicitly: an incident whose severity order is
+ * unknown PASSES the severity gate (it only filters known-low severities), and
+ * a deleted floor severity falls back to no floor rather than to
+ * investigate-nothing.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const INCIDENT_ID: ObjectID = new ObjectID(
+  "cccccccc-cccc-4ccc-8ccc-cccccccccccc",
+);
+const MONITOR_A: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const MONITOR_B: ObjectID = new ObjectID(
+  "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+);
+const SEVERITY_ID: ObjectID = new ObjectID(
+  "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee",
+);
+
+function fakeIncident(data: {
+  monitorIds?: Array<ObjectID>;
+  severityOrder?: number | undefined;
+}): Incident {
+  return {
+    id: INCIDENT_ID,
+    monitors: (data.monitorIds || []).map((id: ObjectID) => {
+      return { _id: id.toString() };
+    }),
+    incidentSeverity:
+      data.severityOrder !== undefined
+        ? ({ order: data.severityOrder } as IncidentSeverity)
+        : undefined,
+  } as unknown as Incident;
+}
+
+function mockProject(
+  overrides: {
+    minimumSeverityId?: ObjectID | undefined;
+    dedupeWindowMinutes?: number | undefined;
+  } = {},
+): void {
+  jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
+    id: PROJECT_ID,
+    incidentInvestigationMinimumSeverityId: overrides.minimumSeverityId,
+    incidentInvestigationDedupeWindowMinutes: overrides.dedupeWindowMinutes,
+  } as unknown as Project);
+}
+
+function mockRecentRunCount(count: number): jest.SpyInstance {
+  return jest
+    .spyOn(AIRunService, "countBy")
+    .mockResolvedValue(new PositiveNumber(count));
+}
+
+function gate(): Promise<IncidentGateDecision> {
+  return AIIncidentInvestigationRunner.shouldInvestigateIncident({
+    incidentId: INCIDENT_ID,
+    projectId: PROJECT_ID,
+  });
+}
+
+describe("AIIncidentInvestigationRunner.shouldInvestigateIncident — severity floor", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * The behaviour-preservation invariant. Before this gate existed every
+   * incident was investigated; with no configured floor that must still be
+   * true, or upgrading silently removes analysis someone relied on.
+   */
+  test("no configured floor investigates every severity, including the lowest", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 99 }));
+    mockProject({});
+    mockRecentRunCount(0);
+
+    const decision: IncidentGateDecision = await gate();
+
+    expect(decision.investigate).toBe(true);
+  });
+
+  test("an incident above the floor is investigated", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 1 }));
+    mockProject({ minimumSeverityId: SEVERITY_ID });
+    jest
+      .spyOn(IncidentSeverityService, "findOneById")
+      .mockResolvedValue({ order: 2 } as unknown as IncidentSeverity);
+    mockRecentRunCount(0);
+
+    expect((await gate()).investigate).toBe(true);
+  });
+
+  // Lower order = higher severity, so equal order still qualifies.
+  test("an incident exactly at the floor is investigated", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 2 }));
+    mockProject({ minimumSeverityId: SEVERITY_ID });
+    jest
+      .spyOn(IncidentSeverityService, "findOneById")
+      .mockResolvedValue({ order: 2 } as unknown as IncidentSeverity);
+    mockRecentRunCount(0);
+
+    expect((await gate()).investigate).toBe(true);
+  });
+
+  test("an incident below the floor is skipped, and says why", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 5 }));
+    mockProject({ minimumSeverityId: SEVERITY_ID });
+    jest
+      .spyOn(IncidentSeverityService, "findOneById")
+      .mockResolvedValue({ order: 2 } as unknown as IncidentSeverity);
+
+    const decision: IncidentGateDecision = await gate();
+
+    expect(decision.investigate).toBe(false);
+    expect(decision.reason).toContain("below the investigation floor");
+  });
+
+  /*
+   * The severity gate only filters KNOWN-low severities. An incident with no
+   * severity set must not be silently dropped.
+   */
+  test("an incident with no severity passes the floor", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({}));
+    mockProject({ minimumSeverityId: SEVERITY_ID });
+    jest
+      .spyOn(IncidentSeverityService, "findOneById")
+      .mockResolvedValue({ order: 1 } as unknown as IncidentSeverity);
+    mockRecentRunCount(0);
+
+    expect((await gate()).investigate).toBe(true);
+  });
+
+  /*
+   * A configured floor severity that was later deleted must fall back to "no
+   * floor" — the opposite fallback would quietly stop investigating
+   * everything, which is the worst possible failure for a safety gate.
+   */
+  test("a deleted floor severity falls back to no floor", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 99 }));
+    mockProject({ minimumSeverityId: SEVERITY_ID });
+    jest.spyOn(IncidentSeverityService, "findOneById").mockResolvedValue(null);
+    mockRecentRunCount(0);
+
+    expect((await gate()).investigate).toBe(true);
+  });
+
+  test("a floor severity with no order falls back to no floor", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 99 }));
+    mockProject({ minimumSeverityId: SEVERITY_ID });
+    jest
+      .spyOn(IncidentSeverityService, "findOneById")
+      .mockResolvedValue({} as unknown as IncidentSeverity);
+    mockRecentRunCount(0);
+
+    expect((await gate()).investigate).toBe(true);
+  });
+
+  test("no severity lookup happens when no floor is configured", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ severityOrder: 99 }));
+    mockProject({});
+    mockRecentRunCount(0);
+    const severityLookup: jest.SpyInstance = jest.spyOn(
+      IncidentSeverityService,
+      "findOneById",
+    );
+
+    await gate();
+
+    expect(severityLookup).not.toHaveBeenCalled();
+  });
+});
+
+describe("AIIncidentInvestigationRunner.shouldInvestigateIncident — dedupe window", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a monitor investigated inside the window skips the incident", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A] }));
+    mockProject({});
+    mockRecentRunCount(1);
+
+    const decision: IncidentGateDecision = await gate();
+
+    expect(decision.investigate).toBe(false);
+    expect(decision.reason).toContain("already investigated");
+  });
+
+  test("no recent run investigates", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A] }));
+    mockProject({});
+    mockRecentRunCount(0);
+
+    expect((await gate()).investigate).toBe(true);
+  });
+
+  /*
+   * The multi-monitor case is why this differs from the alert lane: any
+   * affected monitor having been investigated is enough, because a storm
+   * opening several overlapping incidents is the repeat work being suppressed.
+   */
+  test("the window covers EVERY monitor the incident affects", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A, MONITOR_B] }));
+    mockProject({});
+    const countBy: jest.SpyInstance = mockRecentRunCount(0);
+
+    await gate();
+
+    const query: Record<string, unknown> = (
+      countBy.mock.calls[0]![0] as { query: Record<string, unknown> }
+    ).query;
+
+    expect(query["runType"]).toBe(AIRunType.Investigation);
+    expect(query["projectId"]).toBe(PROJECT_ID);
+    // Both monitors reach the query, not just the first.
+    expect(JSON.stringify(query["monitorId"])).toContain(MONITOR_A.toString());
+    expect(JSON.stringify(query["monitorId"])).toContain(MONITOR_B.toString());
+  });
+
+  test("an incident affecting no monitor skips the dedupe query entirely", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [] }));
+    mockProject({});
+    const countBy: jest.SpyInstance = mockRecentRunCount(0);
+
+    const decision: IncidentGateDecision = await gate();
+
+    expect(decision.investigate).toBe(true);
+    expect(countBy).not.toHaveBeenCalled();
+    expect(decision.monitorId).toBeUndefined();
+  });
+
+  test("a zero window disables the cooldown", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A] }));
+    mockProject({ dedupeWindowMinutes: 0 });
+    const countBy: jest.SpyInstance = mockRecentRunCount(5);
+
+    expect((await gate()).investigate).toBe(true);
+    expect(countBy).not.toHaveBeenCalled();
+  });
+
+  test("a negative window is clamped to disabled rather than inverting the query", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A] }));
+    mockProject({ dedupeWindowMinutes: -30 });
+    const countBy: jest.SpyInstance = mockRecentRunCount(5);
+
+    expect((await gate()).investigate).toBe(true);
+    expect(countBy).not.toHaveBeenCalled();
+  });
+
+  test("an absurd window is clamped to a day", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A] }));
+    mockProject({ dedupeWindowMinutes: 60 * 24 * 365 });
+    mockRecentRunCount(1);
+
+    const decision: IncidentGateDecision = await gate();
+
+    expect(decision.investigate).toBe(false);
+    expect(decision.reason).toContain(`${60 * 24} minutes`);
+  });
+
+  test("the default window is used when the project sets none", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A] }));
+    mockProject({});
+    mockRecentRunCount(1);
+
+    expect((await gate()).reason).toContain(
+      `${DEFAULT_INCIDENT_DEDUPE_WINDOW_MINUTES} minutes`,
+    );
+  });
+});
+
+describe("AIIncidentInvestigationRunner.shouldInvestigateIncident — subject resolution", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a missing incident is not investigated", async () => {
+    jest.spyOn(IncidentService, "findOneById").mockResolvedValue(null);
+
+    const decision: IncidentGateDecision = await gate();
+
+    expect(decision.investigate).toBe(false);
+    expect(decision.reason).toBe("incident not found");
+  });
+
+  /*
+   * The returned monitorId becomes AIRun.monitorId, which is the dedupe key
+   * the NEXT incident reads — if it were dropped the cooldown could never
+   * fire for incidents.
+   */
+  test("the first affected monitor is returned as the run's dedupe key", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(fakeIncident({ monitorIds: [MONITOR_A, MONITOR_B] }));
+    mockProject({});
+    mockRecentRunCount(0);
+
+    expect((await gate()).monitorId?.toString()).toBe(MONITOR_A.toString());
+  });
+});
+
+describe("AIIncidentInvestigationRunner.investigateNewIncident — gate wiring", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a gated-out incident is never enqueued", async () => {
+    jest
+      .spyOn(AIInvestigationEngine, "isEnabledForProject")
+      .mockResolvedValue(true);
+    jest
+      .spyOn(AIIncidentInvestigationRunner, "shouldInvestigateIncident")
+      .mockResolvedValue({ investigate: false, reason: "below floor" });
+    const enqueue: jest.SpyInstance = jest
+      .spyOn(AIInvestigationQueue, "enqueue")
+      .mockResolvedValue(null);
+
+    await AIIncidentInvestigationRunner.investigateNewIncident({
+      incidentId: INCIDENT_ID,
+      projectId: PROJECT_ID,
+    });
+
+    expect(enqueue).not.toHaveBeenCalled();
+  });
+
+  test("a passing incident is enqueued carrying its monitor as the dedupe key", async () => {
+    jest
+      .spyOn(AIInvestigationEngine, "isEnabledForProject")
+      .mockResolvedValue(true);
+    jest
+      .spyOn(AIIncidentInvestigationRunner, "shouldInvestigateIncident")
+      .mockResolvedValue({
+        investigate: true,
+        reason: "passed",
+        monitorId: MONITOR_A,
+      });
+    const enqueue: jest.SpyInstance = jest
+      .spyOn(AIInvestigationQueue, "enqueue")
+      .mockResolvedValue(null);
+
+    await AIIncidentInvestigationRunner.investigateNewIncident({
+      incidentId: INCIDENT_ID,
+      projectId: PROJECT_ID,
+    });
+
+    expect(enqueue).toHaveBeenCalledWith(
+      expect.objectContaining({
+        subjectIncidentId: INCIDENT_ID,
+        subjectMonitorId: MONITOR_A,
+      }),
+    );
+  });
+
+  // The project opt-in is still checked before anything else costs a query.
+  test("a project with investigations disabled never reaches the gate", async () => {
+    jest
+      .spyOn(AIInvestigationEngine, "isEnabledForProject")
+      .mockResolvedValue(false);
+    const gateSpy: jest.SpyInstance = jest.spyOn(
+      AIIncidentInvestigationRunner,
+      "shouldInvestigateIncident",
+    );
+    const enqueue: jest.SpyInstance = jest.spyOn(
+      AIInvestigationQueue,
+      "enqueue",
+    );
+
+    await AIIncidentInvestigationRunner.investigateNewIncident({
+      incidentId: INCIDENT_ID,
+      projectId: PROJECT_ID,
+    });
+
+    expect(gateSpy).not.toHaveBeenCalled();
+    expect(enqueue).not.toHaveBeenCalled();
+  });
+
+  /*
+   * A gate failure must never take incident creation down with it — and it
+   * must report "not enqueued", because the create hook reads that answer
+   * to decide whether auto-remediation runs immediately or waits for the
+   * investigation to settle. Returning true here would strand remediation
+   * behind an investigation that never started.
+   */
+  test("a throwing gate is swallowed, enqueues nothing, and reports not-enqueued", async () => {
+    jest
+      .spyOn(AIInvestigationEngine, "isEnabledForProject")
+      .mockResolvedValue(true);
+    jest
+      .spyOn(AIIncidentInvestigationRunner, "shouldInvestigateIncident")
+      .mockRejectedValue(new Error("database unavailable"));
+    const enqueue: jest.SpyInstance = jest.spyOn(
+      AIInvestigationQueue,
+      "enqueue",
+    );
+
+    await expect(
+      AIIncidentInvestigationRunner.investigateNewIncident({
+        incidentId: INCIDENT_ID,
+        projectId: PROJECT_ID,
+      }),
+    ).resolves.toBe(false);
+
+    expect(enqueue).not.toHaveBeenCalled();
+  });
+});