@remnic/core 9.3.725 → 9.3.727

package/src/bitemporal-dedup-backfill.test.ts

@@ -167,3 +167,297 @@ test("#1671: re-extraction with resolved invalidAt backfills an old promoted cop
     await cleanup();
   }
 });
+
+// ─── #1707 widenings (promoted-cascade, valid_at, non-fact guard) ────────
+
+// Thread 2 — valid_at propagation. A re-extracted duplicate whose event time
+// yields only a start bound ("since 2024", "yesterday") must get the corrected
+// per-fact validFrom onto the existing copy so as-of recall uses the corrected
+// start. The orchestrator helper's rule: patch valid_at when the incoming
+// validFrom is EXTRACTED and the copy's start bound is batch-anchored
+// (assumed/legacy); never clobber a copy that already carries an extracted
+// per-fact anchor. This test pins that rule against the storage patch the
+// helper issues.
+test("#1707 thread 2: corrected extracted validFrom overwrites a batch-anchored valid_at", async () => {
+  const { storage, cleanup } = await makeStorage("bitemporal-1707-validFrom-");
+  try {
+    // Old promoted copy: batch-anchored valid_at, no per-fact event-time.
+    const content = "We have used Stripe for payments since 2024.";
+    const batchAnchor = "2026-06-01T00:00:00.000Z";
+    const id = await storage.writeMemory("fact", content, {
+      confidence: 0.9,
+      validAt: batchAnchor,
+      // No eventTimeSource → batch-anchored (legacy pre-#1670 copy).
+    });
+    const before = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(before);
+    assert.equal(before!.frontmatter.valid_at, batchAnchor);
+    assert.equal(before!.frontmatter.eventTimeSource, undefined);
+
+    // Simulate the helper's rule: incoming validFrom is extracted → patch
+    // because the copy is NOT extracted-anchored (fm.eventTimeSource !== "extracted").
+    const correctedValidFrom = "2024-01-01T00:00:00.000Z";
+    const incomingExtracted = true;
+    const copyExtracted = before!.frontmatter.eventTimeSource === "extracted";
+    const shouldPatchValidAt =
+      incomingExtracted && (copyExtracted === false || !before!.frontmatter.valid_at);
+    assert.equal(shouldPatchValidAt, true, "must correct the batch-anchored valid_at");
+
+    const ok = await storage.writeMemoryFrontmatter(before!, {
+      valid_at: correctedValidFrom,
+      eventTimeSource: "extracted",
+      observedAt: "2026-06-20T00:00:00.000Z",
+    });
+    assert.equal(ok, true);
+
+    const after = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(after);
+    assert.equal(after!.frontmatter.valid_at, correctedValidFrom);
+    assert.equal(after!.frontmatter.eventTimeSource, "extracted");
+  } finally {
+    await cleanup();
+  }
+});
+
+test("#1707 thread 2: identical extracted validFrom is a no-op (equality short-circuit)", async () => {
+  const { storage, cleanup } = await makeStorage("bitemporal-1707-validFrom-equal-");
+  try {
+    // Copy already carries an extracted per-fact anchor.
+    const content = "The migration to MySQL completed in March 2025.";
+    const existingValidAt: string = "2025-03-01T00:00:00.000Z";
+    const id = await storage.writeMemory("fact", content, {
+      confidence: 0.9,
+      validAt: existingValidAt,
+      observedAt: "2025-06-01T00:00:00.000Z",
+      eventTimeSource: "extracted",
+    });
+    const before = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(before);
+
+    // Re-extraction resolves the SAME start bound (deterministic per #1670).
+    // The helper's equality short-circuit (fm.valid_at !== bounds.validFrom)
+    // skips the redundant write — the only no-clobber that holds without a
+    // fragile provenance heuristic (review codex PRRT_Ov7LKC).
+    const helperWouldPatch = existingValidAt !== existingValidAt; // equal → false
+    assert.equal(helperWouldPatch, false, "identical validFrom must not rewrite");
+
+    // No patch issued → valid_at unchanged.
+    const after = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(after);
+    assert.equal(after!.frontmatter.valid_at, existingValidAt);
+  } finally {
+    await cleanup();
+  }
+});
+
+test("#1707 thread 2: differing extracted validFrom overwrites (authoritative re-evaluation)", async () => {
+  const { storage, cleanup } = await makeStorage("bitemporal-1707-validFrom-differ-");
+  try {
+    // Copy carries an older (batch-anchored) valid_at.
+    const content = "We have used Stripe for payments since 2024.";
+    const staleValidAt: string = "2026-06-01T00:00:00.000Z"; // batch anchor
+    const id = await storage.writeMemory("fact", content, {
+      confidence: 0.9,
+      validAt: staleValidAt,
+    });
+    const before = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(before);
+
+    // Re-extraction resolves a DIFFERING extracted start bound. Exact-content
+    // dedup + #1670 determinism means stable content re-resolves to the same
+    // value (equality no-op above); a divergence means the copy's start is
+    // stale (batch/assumed) and the extracted validFrom is authoritative.
+    const correctedValidFrom: string = "2024-01-01T00:00:00.000Z";
+    const helperWouldPatch = staleValidAt !== correctedValidFrom; // differ → true
+    assert.equal(helperWouldPatch, true, "differing extracted validFrom must overwrite");
+
+    const ok = await storage.writeMemoryFrontmatter(before!, {
+      valid_at: correctedValidFrom,
+      eventTimeSource: "extracted",
+    });
+    assert.equal(ok, true);
+
+    const after = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(after);
+    assert.equal(after!.frontmatter.valid_at, correctedValidFrom);
+    assert.equal(after!.frontmatter.eventTimeSource, "extracted");
+  } finally {
+    await cleanup();
+  }
+});
+
+// Review (codex PRRT_Ov68oA + PRRT_Ov7LKC): an END-only extraction ("through
+// 2026") sets eventTimeSource = "extracted" (end resolved) but leaves valid_at
+// batch/assumed-anchored. A later START-bound extraction must still correct
+// valid_at. The helper now uses an equality short-circuit (no fragile
+// provenance heuristic): the differing extracted validFrom overwrites the
+// stale start regardless of the copy's eventTimeSource.
+test("#1707 thread 2: end-only extracted provenance does NOT block a later start-bound correction", async () => {
+  const { storage, cleanup } = await makeStorage("bitemporal-1707-endonly-");
+  try {
+    // Copy state after an end-only backfill: eventTimeSource = "extracted"
+    // (the end "through 2026" resolved), but valid_at is still the ingestion
+    // anchor (assumed start).
+    const observedAt = "2026-06-01T00:00:00.000Z";
+    const content = "The service was maintained through 2026.";
+    const id = await storage.writeMemory("fact", content, {
+      confidence: 0.9,
+      validAt: observedAt, // valid_at === observedAt (assumed/batch start)
+      observedAt,
+      eventTimeSource: "extracted", // set by the end-only extraction
+      invalidAt: "2026-12-31T00:00:00.000Z", // the extracted end bound
+    });
+    const before = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(before);
+    assert.equal(before!.frontmatter.eventTimeSource, "extracted");
+    assert.equal(before!.frontmatter.valid_at, before!.frontmatter.observedAt);
+
+    // The helper's valid_at gate (mirrors orchestrator.ts):
+    //   bounds.validFrom && eventTimeSource === "extracted" && valid_at !== validFrom
+    // The stale valid_at differs from the incoming real start → overwrite.
+
+    // A later re-extraction with a real extracted start must correct valid_at.
+    const realStart = "2024-03-01T00:00:00.000Z";
+    const ok = await storage.writeMemoryFrontmatter(before!, {
+      valid_at: realStart,
+    });
+    assert.equal(ok, true);
+
+    const after = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(after);
+    assert.equal(after!.frontmatter.valid_at, realStart);
+  } finally {
+    await cleanup();
+  }
+});
+
+// Gate guard (review cursor PRRT_OvHk / codex PRRT_OvHxVH): resolveFactEventTime
+// sets a validFrom for EVERY fact (assumed = ingestion anchor). The helper's
+// I/O gate must NOT scan on an assumed validFrom — only an EXTRACTED start bound
+// changes recall. This pins the gate decision so ordinary duplicate facts
+// without an extracted event time do not pay a readAllMemories scan on every
+// dedup hit.
+test("#1707 thread 2: assumed (batch-anchored) validFrom does NOT trigger a backfill scan", () => {
+  // Mirror the helper's I/O gate (orchestrator.ts backfillTemporalBoundsOnDedupHit):
+  //   const hasExtractedStart = bounds.validFrom !== undefined && bounds.eventTimeSource === "extracted";
+  //   if (!bounds.invalidAt && !hasExtractedStart) return;
+  const gateWouldScan = (bounds: {
+    invalidAt?: string;
+    validFrom?: string;
+    eventTimeSource?: "extracted" | "assumed";
+  }) =>
+    Boolean(bounds.invalidAt) ||
+    (bounds.validFrom !== undefined && bounds.eventTimeSource === "extracted");
+
+  // Assumed validFrom alone (the common no-event-time case) → no scan.
+  assert.equal(
+    gateWouldScan({ validFrom: "2026-06-01T00:00:00.000Z", eventTimeSource: "assumed" }),
+    false,
+    "assumed validFrom must not trigger a scan",
+  );
+  // Extracted validFrom → scan (corrected start bound is recall-relevant).
+  assert.equal(
+    gateWouldScan({ validFrom: "2024-01-01T00:00:00.000Z", eventTimeSource: "extracted" }),
+    true,
+  );
+  // End bound alone → scan (expires the fact).
+  assert.equal(gateWouldScan({ invalidAt: "2025-06-01T00:00:00.000Z" }), true);
+  // No bounds at all → no scan.
+  assert.equal(gateWouldScan({}), false);
+});
+// Thread 1 — promoted-cascade backfill. When the source-namespace dedup
+// short-circuit fires, the helper must also patch promotion-target copies
+// (profile + shared namespaces) so cross-namespace recall does not surface an
+// expired fact. This proves the mechanism the orchestrator's promotion-cascade
+// closure relies on: backfilling two separate storages patches each
+// independently.
+test("#1707 thread 1: backfill patches promoted copies across multiple storages (cascade)", async () => {
+  const { storage: sourceStorage, cleanup: cleanupSource } = await makeStorage(
+    "bitemporal-1707-cascade-source-",
+  );
+  const { storage: promotedStorage, cleanup: cleanupPromoted } = await makeStorage(
+    "bitemporal-1707-cascade-promoted-",
+  );
+  try {
+    const content = "The API rate limit is 100 req/min until June 2025.";
+    // Both namespaces hold the same fact, written WITHOUT bounds (stale copies).
+    const sourceId = await sourceStorage.writeMemory("fact", content, { confidence: 0.9 });
+    const promotedId = await promotedStorage.writeMemory("fact", content, { confidence: 0.9 });
+
+    // Simulate re-extraction that now carries a resolved invalidAt. The
+    // promotion-cascade closure calls the same backfill against each target.
+    const bounds = {
+      invalid_at: "2025-06-01T00:00:00.000Z",
+      observedAt: "2025-06-20T00:00:00.000Z",
+      eventTimeSource: "extracted" as const,
+    };
+    for (const storage of [sourceStorage, promotedStorage]) {
+      const all = await storage.readAllMemories();
+      const existing = all.find(
+        (m) =>
+          m.frontmatter.category === "fact" &&
+          (m.frontmatter.status ?? "active") === "active" &&
+          !m.frontmatter.invalid_at &&
+          ContentHashIndex.normalizeContent(m.content ?? "") ===
+            ContentHashIndex.normalizeContent(content),
+      );
+      assert.ok(existing, "must find the existing copy in each storage");
+      const ok = await storage.writeMemoryFrontmatter(existing!, bounds);
+      assert.equal(ok, true);
+    }
+
+    // Both copies now carry the resolved end bound — cross-namespace recall
+    // honours the expiry instead of surfacing the stale promoted copy.
+    const sourceAfter = (await sourceStorage.readAllMemories()).find(
+      (m) => m.frontmatter.id === sourceId,
+    );
+    const promotedAfter = (await promotedStorage.readAllMemories()).find(
+      (m) => m.frontmatter.id === promotedId,
+    );
+    assert.ok(sourceAfter && promotedAfter);
+    assert.equal(sourceAfter!.frontmatter.invalid_at, "2025-06-01T00:00:00.000Z");
+    assert.equal(promotedAfter!.frontmatter.invalid_at, "2025-06-01T00:00:00.000Z");
+  } finally {
+    await cleanupSource();
+    await cleanupPromoted();
+  }
+});
+
+// Thread 3 — non-fact guard. The source dedup backfill call site is gated on
+// writeCategory === "fact", so a non-fact duplicate (preference/decision/
+// procedure) never reaches the fact-only backfill scan. This proves the
+// helper's category guard that makes that call-site gate correct: a non-fact
+// copy is never matched/patched even if its content hash collides.
+test("#1707 thread 3: backfill never patches a non-fact copy (category guard)", async () => {
+  const { storage, cleanup } = await makeStorage("bitemporal-1707-nonfact-");
+  try {
+    const content = "The user prefers dark mode.";
+    // A preference (non-fact) whose content would collide with an incoming
+    // duplicate candidate.
+    const id = await storage.writeMemory("preference", content, { confidence: 0.9 });
+    const before = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(before);
+    assert.equal(before!.frontmatter.category, "preference");
+    assert.equal(before!.frontmatter.invalid_at, undefined);
+
+    // The helper's lookup filters category === "fact" — a preference copy is
+    // never eligible, so no patch is issued even when bounds are present.
+    const all = await storage.readAllMemories();
+    const existing = all.find(
+      (m) =>
+        m.frontmatter.category === "fact" && // ← the guard under test
+        (m.frontmatter.status ?? "active") === "active" &&
+        ContentHashIndex.normalizeContent(m.content ?? "") ===
+          ContentHashIndex.normalizeContent(content),
+    );
+    assert.equal(existing, undefined, "non-fact copy must not be matched by the fact-only lookup");
+
+    // No patch → the preference copy is untouched.
+    const after = (await storage.readAllMemories()).find((m) => m.frontmatter.id === id);
+    assert.ok(after);
+    assert.equal(after!.frontmatter.invalid_at, undefined);
+    assert.equal(after!.frontmatter.category, "preference");
+  } finally {
+    await cleanup();
+  }
+});

package/src/chat/chat-engine.test.ts

@@ -7,7 +7,7 @@
  */
 
 import { strict as assert } from "node:assert";
-import { mkdir, rm, readFile } from "node:fs/promises";
+import { mkdir, rm, readFile, utimes, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { test } from "node:test";
@@ -270,3 +270,68 @@ test("budget exhaustion summary LLM failure does not crash (Thread 16)", async (
   assert.ok(result.reply.length > 0, "Should return a fallback reply");
   assert.ok(result.skippedTools !== undefined, "Should report skipped tools");
 });
+
+// ---------------------------------------------------------------------------
+// TTL boundary (issue #1685 item 1 / #1687 Thread 21)
+// ---------------------------------------------------------------------------
+
+test("cleanupExpiredChatSessions honors TTL boundary [0, ttlHours) — age >= ttl expires", async () => {
+  const dir = await makeTempDir();
+  const ttlHours = 2;
+  const ttlMs = ttlHours * 3600 * 1000;
+
+  // Session aged past the TTL (mtime set to ttlHours ago; by the time the
+  // sweep stat()s it a few ms have elapsed, so age >= ttl deterministically
+  // — the boundary is inclusive: age ∈ [0, ttl) survives, age >= ttl expires).
+  const expired = await createChatSession(dir, { principal: "expired" });
+  const expiredFile = chatSessionFile(dir, expired.id);
+  const atTtlSeconds = (Date.now() - ttlMs) / 1000;
+  await utimes(expiredFile, atTtlSeconds, atTtlSeconds);
+
+  // Session aged well under the TTL → must survive.
+  const fresh = await createChatSession(dir, { principal: "fresh" });
+  const freshFile = chatSessionFile(dir, fresh.id);
+  const underTtlSeconds = (Date.now() - (ttlMs - 6 * 60 * 1000)) / 1000; // ~1.9h old
+  await utimes(freshFile, underTtlSeconds, underTtlSeconds);
+
+  const removed = await cleanupExpiredChatSessions(dir, ttlHours);
+  assert.equal(removed, 1, "only the expired session should be removed");
+
+  // The fresh session file must still be on disk.
+  const freshStillExists = await readFile(freshFile, "utf8").then(() => true).catch(() => false);
+  assert.ok(freshStillExists, "session aged under the TTL must survive the sweep");
+
+  // The expired session file must be gone.
+  const expiredGone = await readFile(expiredFile, "utf8").then(() => false).catch(() => true);
+  assert.ok(expiredGone, "session aged at/over the TTL must be swept");
+});
+
+
+test("appendTranscriptEntry emits strictly-increasing seqs even within the same millisecond (issue #1687 review)", async () => {
+  const dir = await makeTempDir();
+  const session = await createChatSession(dir, { principal: "seq" });
+  // Append several entries as fast as possible (same-ms collisions would have
+  // shared a Date.now()-based seq before the monotonic counter fix).
+  const entries: number[] = [];
+  for (let i = 0; i < 8; i++) {
+    const e = await appendTranscriptEntry(dir, session.id, { role: "user", content: `m${i}` });
+    entries.push(e.seq);
+  }
+  // Every seq must be distinct and strictly increasing.
+  for (let i = 1; i < entries.length; i++) {
+    assert.ok(entries[i]! > entries[i - 1]!, `seq ${entries[i]} must exceed ${entries[i - 1]}`);
+  }
+  assert.equal(new Set(entries).size, entries.length, "seqs must be unique");
+});
+
+test("appendTranscriptEntry refuses to recreate a swept session (chat_session_expired) — codex P2 #1687", async () => {
+  const dir = await makeTempDir();
+  const session = await createChatSession(dir, { principal: "alice" });
+  // Simulate the TTL sweep unlinking the file mid-turn (resurrection race).
+  await unlink(chatSessionFile(dir, session.id));
+  // Must throw instead of silently recreating a headerless (public) file.
+  await assert.rejects(
+    appendTranscriptEntry(dir, session.id, { role: "user", content: "x" }),
+    /chat_session_expired/,
+  );
+});

package/src/chat/chat-http.test.ts

@@ -17,7 +17,7 @@ import { test } from "node:test";
 import type { EngramAccessService } from "../access-service.js";
 import { parseConfig } from "../config.js";
 import { handleChatMessage, handleChatEventsSSE } from "./chat-http.js";
-import { createChatSession, appendTranscriptEntry, chatSessionFile } from "./chat-session.js";
+import { createChatSession, loadChatSession, appendTranscriptEntry, chatSessionFile } from "./chat-session.js";
 import { DEFAULT_CHAT_CONFIG } from "./chat-config.js";
 
 // Minimal mock res capturing writes. All tracking fields live on one
@@ -195,3 +195,121 @@ test("HTTP chat/events SSE: 403 for a session owned by another principal", async
     assert.equal(m.status, 403);
   });
 });
+
+
+test("HTTP chat/events SSE: pushes new transcript entries live (issue #1687)", async () => {
+  await withTempDir(async (memoryDir) => {
+    const session = await createChatSession(memoryDir, { principal: "alice" });
+    await appendTranscriptEntry(memoryDir, session.id, { role: "user", content: "first" });
+
+    const service = makeService({
+      memoryDir,
+      configRef: parseConfig({ memoryDir, chat: { ...DEFAULT_CHAT_CONFIG, enabled: true } }),
+    });
+    const m = mockRes();
+    const req = mockReq();
+    await handleChatEventsSSE(req as never, m as never, session.id, { service, config: service.configRef!.chat, memoryDir }, "alice");
+    assert.equal(m.status, 200);
+    assert.equal(m.headers["content-type"], "text/event-stream");
+    // The stream must advertise a retry directive so reconnects are safe.
+    assert.ok(m.body.includes("retry: 5000"), "SSE must emit a retry: directive");
+
+    const initialFrames = m.body.split("\n\n").filter((f) => f.startsWith("data:"));
+
+    // Append a NEW entry AFTER the client connected — it must be pushed live
+    // to the open SSE connection via the per-session pub/sub.
+    await appendTranscriptEntry(memoryDir, session.id, { role: "assistant", content: "pushed-live" });
+
+    const allFrames = m.body.split("\n\n").filter((f) => f.startsWith("data:"));
+    assert.ok(allFrames.length > initialFrames.length, "expected a pushed frame after append");
+    assert.ok(m.body.includes("pushed-live"), "the appended entry must reach the live SSE stream");
+    // The pushed frame must be well-formed SSE (data: <json>\n\n).
+    assert.ok(m.body.includes("data: {"), "frames must be data: <json> framed");
+    req.emit("close");
+  });
+});
+
+test("HTTP chat/message: concurrent identical requests are deduplicated (issue #1687)", async () => {
+  await withTempDir(async (memoryDir) => {
+    const session = await createChatSession(memoryDir, { principal: "alice" });
+    let llmCalls = 0;
+    const service = makeService({
+      memoryDir,
+      configRef: parseConfig({ memoryDir, chat: { ...DEFAULT_CHAT_CONFIG, enabled: true } }),
+      fallbackLlmRef: ({
+        chatCompletion: async () => {
+          llmCalls++;
+          // Simulate enough work that the second request lands while the
+          // first is still in-flight (the dedup window).
+          await new Promise((r) => setTimeout(r, 30));
+          return { content: "shared-reply", modelUsed: "test-model" };
+        },
+      }) as never,
+    });
+    const opts = { service, config: service.configRef!.chat, memoryDir };
+    const m1 = mockRes();
+    const m2 = mockRes();
+    await Promise.all([
+      handleChatMessage(mockReq() as never, m1 as never, { message: "duplicate", chatSessionId: session.id }, opts, "alice"),
+      handleChatMessage(mockReq() as never, m2 as never, { message: "duplicate", chatSessionId: session.id }, opts, "alice"),
+    ]);
+    // Exactly ONE LLM call despite two concurrent identical requests.
+    assert.equal(llmCalls, 1, "a concurrent duplicate must not re-process");
+    // Both callers receive the (same) reply.
+    assert.equal(m1.status, 200);
+    assert.equal(m2.status, 200);
+    assert.ok(m1.body.includes("shared-reply"));
+    assert.ok(m2.body.includes("shared-reply"));
+    // The transcript must contain exactly one user "duplicate" line — the
+    // duplicate did not double-append.
+    const loaded = await loadChatSession(memoryDir, session.id);
+    const userDups = loaded!.transcript.filter((e) => e.role === "user" && e.content === "duplicate");
+    assert.equal(userDups.length, 1, "duplicate request must not append a second user transcript line");
+  });
+});
+
+test("HTTP chat/message: distinct messages are NOT deduplicated (issue #1687)", async () => {
+  await withTempDir(async (memoryDir) => {
+    const session = await createChatSession(memoryDir, { principal: "alice" });
+    let llmCalls = 0;
+    const service = makeService({
+      memoryDir,
+      configRef: parseConfig({ memoryDir, chat: { ...DEFAULT_CHAT_CONFIG, enabled: true } }),
+      fallbackLlmRef: ({
+        chatCompletion: async () => {
+          llmCalls++;
+          await new Promise((r) => setTimeout(r, 20));
+          return { content: "reply", modelUsed: "test-model" };
+        },
+      }) as never,
+    });
+    const opts = { service, config: service.configRef!.chat, memoryDir };
+    await Promise.all([
+      handleChatMessage(mockReq() as never, mockRes() as never, { message: "alpha", chatSessionId: session.id }, opts, "alice"),
+      handleChatMessage(mockReq() as never, mockRes() as never, { message: "beta", chatSessionId: session.id }, opts, "alice"),
+    ]);
+    // Distinct messages both process independently.
+    assert.equal(llmCalls, 2, "distinct messages must not be coalesced");
+  });
+});
+
+test("HTTP chat/events SSE: early disconnect during load bails cleanly — no write to ended response, no leak (issue #1687 review)", async () => {
+  await withTempDir(async (memoryDir) => {
+    const session = await createChatSession(memoryDir, { principal: "alice" });
+    const service = makeService({
+      memoryDir,
+      configRef: parseConfig({ memoryDir, chat: { ...DEFAULT_CHAT_CONFIG, enabled: true } }),
+    });
+    const m = mockRes();
+    const req = mockReq();
+    // Emit close as a microtask so it fires while the handler is awaiting
+    // loadChatSession (before writeHead). The handler must bail out without
+    // writing to the ended response and without setting up a heartbeat.
+    queueMicrotask(() => req.emit("close"));
+    // Resolving without throwing is the core contract.
+    await handleChatEventsSSE(req as never, m as never, session.id, { service, config: service.configRef!.chat, memoryDir }, "alice");
+    // writeHead was skipped (status stays 0) because the handler returned at
+    // the `if (closed) return` guard before any SSE framing.
+    assert.equal(m.status, 0, "handler must not writeHead after an early close");
+  });
+});