@spooky-sync/core 0.0.1-canary.102 → 0.0.1-canary.104

package/src/services/database/local.ts

@@ -6,50 +6,88 @@ import type { Logger } from '../logger/index';
 import { AbstractDatabaseService } from './database';
 import { createDatabaseEventSystem, DatabaseEventTypes } from './events/index';
 import { encodeRecordId } from '../../utils/index';
+import { ANON_USER_ID } from '../../modules/ref-tables';
+import type { SealedQuery } from '../../utils/surql';
+
+/** Thrown when a query carries an `epoch` from before a bucket switch. The
+ *  caller's chain read from the previous user's store; its write must be
+ *  dropped, not applied to the new bucket. */
+export class StaleEpochError extends Error {
+  constructor() {
+    super('Local store epoch changed (bucket switch); stale write dropped');
+    this.name = 'StaleEpochError';
+  }
+}
+
+/** Store URL for a local bucket. One IndexedDB store per user (`anon` for
+ *  signed-out) so cached rows never leak across accounts on a shared device. */
+export function bucketStoreUrl(bucketId: string): string {
+  return `indxdb://${bucketStoreName(bucketId)}`;
+}
+
+/** The IndexedDB database name SurrealDB-WASM derives from the store URL. */
+export function bucketStoreName(bucketId: string): string {
+  return `sp00ky-${bucketId}`;
+}
+
+function createLocalSurrealClient(logger: Logger): Surreal {
+  return new Surreal({
+    codecOptions: {
+      valueDecodeVisitor(value) {
+        if (value instanceof RecordId) {
+          return encodeRecordId(value);
+        }
+
+        if (value instanceof DateTime) {
+          return value.toDate();
+        }
+
+        return value;
+      },
+    },
+    engines: applyDiagnostics(
+      createWasmWorkerEngines(),
+      ({ key, type, phase, ...other }: Diagnostic) => {
+        if (phase === 'progress' || phase === 'after') {
+          logger.trace(
+            {
+              ...other,
+              key,
+              type,
+              phase,
+              service: 'surrealdb:local',
+              Category: 'sp00ky-client::LocalDatabaseService::diagnostics',
+            },
+            `Local SurrealDB diagnostics captured ${type}:${phase}`
+          );
+        }
+      }
+    ),
+  });
+}
 
 export class LocalDatabaseService extends AbstractDatabaseService {
   private config: Sp00kyConfig<any>['database'];
   protected eventType = DatabaseEventTypes.LocalQuery;
 
+  /** Bucket currently open. Set by `connect`/`switchStore`. */
+  private bucketId: string = ANON_USER_ID;
+  /**
+   * Monotonic store generation. Bumped on every `switchStore`. Async chains
+   * that read from the store, await something remote, and then write back
+   * (sync poll, SSP stream updates) capture this at chain start and drop
+   * their write when it no longer matches — a stale-epoch write would land
+   * another user's data in the new bucket.
+   */
+  private storeEpoch = 0;
+  /** Gate that `query()`/`execute()` await; closed for the switch window. */
+  private gate: Promise<void> = Promise.resolve();
+  /** The incoming client while a switch is in flight (for unload cleanup). */
+  private pendingSwitchClient: Surreal | null = null;
+
   constructor(config: Sp00kyConfig<any>['database'], logger: Logger) {
     const events = createDatabaseEventSystem();
-    super(
-      new Surreal({
-        codecOptions: {
-          valueDecodeVisitor(value) {
-            if (value instanceof RecordId) {
-              return encodeRecordId(value);
-            }
-
-            if (value instanceof DateTime) {
-              return value.toDate();
-            }
-
-            return value;
-          },
-        },
-        engines: applyDiagnostics(
-          createWasmWorkerEngines(),
-          ({ key, type, phase, ...other }: Diagnostic) => {
-            if (phase === 'progress' || phase === 'after') {
-              logger.trace(
-                {
-                  ...other,
-                  key,
-                  type,
-                  phase,
-                  service: 'surrealdb:local',
-                  Category: 'sp00ky-client::LocalDatabaseService::diagnostics',
-                },
-                `Local SurrealDB diagnostics captured ${type}:${phase}`
-              );
-            }
-          }
-        ),
-      }),
-      logger,
-      events
-    );
+    super(createLocalSurrealClient(logger), logger, events);
     this.config = config;
   }
 
@@ -57,19 +95,153 @@ export class LocalDatabaseService extends AbstractDatabaseService {
     return this.config;
   }
 
-  async connect(): Promise<void> {
+  get currentBucketId(): string {
+    return this.bucketId;
+  }
+
+  get epoch(): number {
+    return this.storeEpoch;
+  }
+
+  /**
+   * Close the query gate for a bucket switch. Every `query()`/`execute()`
+   * issued after this waits until the returned release fn runs — so work
+   * triggered mid-switch (sibling auth subscribers registering queries)
+   * lands on the NEW bucket instead of racing the swap. The migrator uses
+   * `queryUngated()` to provision the new bucket while the gate is closed.
+   */
+  beginSwitch(): () => void {
+    let release!: () => void;
+    this.gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    return release;
+  }
+
+  override async query<T extends unknown[]>(
+    query: string,
+    vars?: Record<string, unknown>,
+    opts?: { epoch?: number }
+  ): Promise<T> {
+    await this.gate;
+    // A write whose async chain started before a bucket switch must not land
+    // in the new bucket — that would be another user's data. Callers on such
+    // chains pass the epoch they captured at chain start; mismatches throw.
+    if (opts?.epoch !== undefined && opts.epoch !== this.storeEpoch) {
+      throw new StaleEpochError();
+    }
+    return super.query(query, vars);
+  }
+
+  override async execute<T>(
+    query: SealedQuery<T>,
+    vars?: Record<string, unknown>,
+    opts?: { epoch?: number }
+  ): Promise<T> {
+    const raw = await this.query<unknown[]>(query.sql, vars, opts);
+    return query.extract(raw);
+  }
+
+  /** Gate-bypassing query — ONLY for the switch path itself (schema
+   *  provisioning must run while the gate is closed, or it deadlocks). */
+  queryUngated<T extends unknown[]>(query: string, vars?: Record<string, unknown>): Promise<T> {
+    return super.query(query, vars);
+  }
+
+  async connect(bucketId: string = ANON_USER_ID): Promise<void> {
     const { namespace, database } = this.getConfig();
     const store = this.getConfig().store ?? 'memory';
-    const storeUrl = store === 'memory' ? 'mem://' : 'indxdb://sp00ky';
+    this.bucketId = bucketId;
+    const storeUrl = store === 'memory' ? 'mem://' : bucketStoreUrl(bucketId);
     this.logger.info(
       { namespace, database, storeUrl, Category: 'sp00ky-client::LocalDatabaseService::connect' },
       'Connecting to local database'
     );
 
     this.registerUnloadClose();
+    await this.openWithRecovery(this.client, storeUrl, namespace, database, bucketId, store);
+  }
+
+  /**
+   * Switch the local store to another user's bucket. Opens the NEW bucket on a
+   * second client first (with the same 3-tier recovery), then atomically swaps
+   * `this.client` and closes the old one — a failed open never leaves the
+   * service on a dead client. Bumps the store epoch so in-flight old-bucket
+   * async chains can detect they're stale.
+   *
+   * Callers own the drain/rebind choreography (close the gate, quiesce sync +
+   * timers BEFORE calling this; re-provision + rebind AFTER).
+   */
+  async switchStore(bucketId: string): Promise<void> {
+    if (bucketId === this.bucketId) return;
+    const { namespace, database } = this.getConfig();
+    const store = this.getConfig().store ?? 'memory';
+    this.storeEpoch++;
 
+    if (store === 'memory') {
+      // mem:// has no per-user persistence; close + reopen the same client
+      // yields a fresh empty store, which is exactly the reset we want.
+      try {
+        await this.client.close();
+      } catch {
+        /* ignore */
+      }
+      await this.openStore(this.client, 'mem://', namespace, database);
+      this.bucketId = bucketId;
+      this.logger.info(
+        { bucketId, Category: 'sp00ky-client::LocalDatabaseService::switchStore' },
+        'Reset in-memory local store for bucket switch'
+      );
+      return;
+    }
+
+    const next = createLocalSurrealClient(this.logger);
+    this.pendingSwitchClient = next;
     try {
-      await this.openStore(storeUrl, namespace, database);
+      await this.openWithRecovery(
+        next,
+        bucketStoreUrl(bucketId),
+        namespace,
+        database,
+        bucketId,
+        store
+      );
+    } finally {
+      this.pendingSwitchClient = null;
+    }
+
+    const old = this.client;
+    this.client = next;
+    this.bucketId = bucketId;
+    try {
+      await old.close();
+    } catch {
+      /* best-effort — the old store's handle is released on unload regardless */
+    }
+    this.logger.info(
+      { bucketId, Category: 'sp00ky-client::LocalDatabaseService::switchStore' },
+      'Switched local store bucket'
+    );
+  }
+
+  /**
+   * Open `storeUrl` on `client` with tiered recovery:
+   * tier 1 retries the same store (transient idb-handle races — preserves the
+   * cache), tier 2 drops THIS bucket's IndexedDB store and reconnects fresh,
+   * tier 3 falls back to `mem://` for the session. Only ever drops the bucket
+   * being opened — other users' buckets hold their own caches AND un-pushed
+   * mutation outboxes, which must survive another bucket's corruption.
+   */
+  private async openWithRecovery(
+    client: Surreal,
+    storeUrl: string,
+    namespace: string,
+    database: string,
+    bucketId: string,
+    store: string
+  ): Promise<void> {
+    try {
+      await this.openStore(client, storeUrl, namespace, database);
       this.logger.info(
         { Category: 'sp00ky-client::LocalDatabaseService::connect' },
         'Connected to local database'
@@ -101,13 +273,13 @@ export class LocalDatabaseService extends AbstractDatabaseService {
     // the cache on every reload, making warm loads as slow as cold ones.
     for (let attempt = 1; attempt <= 2; attempt++) {
       try {
-        await this.client.close();
+        await client.close();
       } catch {
         /* ignore */
       }
       await delay(150 * attempt);
       try {
-        await this.openStore(storeUrl, namespace, database);
+        await this.openStore(client, storeUrl, namespace, database);
         this.logger.info(
           { attempt, Category: 'sp00ky-client::LocalDatabaseService::connect' },
           'Connected to local database on retry (cache preserved)'
@@ -121,18 +293,18 @@ export class LocalDatabaseService extends AbstractDatabaseService {
       }
     }
 
-    // Tier 2 — the store is genuinely unopenable; drop it and reconnect fresh.
-    // This loses the cache (re-syncs from the server), so it's the last resort
-    // before in-memory.
+    // Tier 2 — the store is genuinely unopenable; drop THIS bucket and reconnect
+    // fresh. This loses the bucket's cache (re-syncs from the server), so it's
+    // the last resort before in-memory.
     try {
-      await this.client.close();
+      await client.close();
     } catch {
       /* ignore — closing a half-open connection is best-effort */
     }
-    await dropLocalIndexedDbStores(this.logger);
+    await dropLocalIndexedDbStores(this.logger, bucketStoreName(bucketId));
 
     try {
-      await this.openStore(storeUrl, namespace, database);
+      await this.openStore(client, storeUrl, namespace, database);
       this.logger.info(
         { Category: 'sp00ky-client::LocalDatabaseService::connect' },
         'Reconnected to local database after clearing the corrupt store'
@@ -146,11 +318,11 @@ export class LocalDatabaseService extends AbstractDatabaseService {
         'Local store still failing after clear; falling back to in-memory'
       );
       try {
-        await this.client.close();
+        await client.close();
       } catch {
         /* ignore */
       }
-      await this.openStore('mem://', namespace, database);
+      await this.openStore(client, 'mem://', namespace, database);
       this.logger.warn(
         { Category: 'sp00ky-client::LocalDatabaseService::connect' },
         'Connected to local database (in-memory fallback)'
@@ -169,6 +341,7 @@ export class LocalDatabaseService extends AbstractDatabaseService {
    * reload, making warm loads as slow as cold ones. `pagehide` is the reliable
    * unload signal (fires on bfcache + normal navigation); `close()` is async but
    * the WASM worker initiates the IndexedDB connection teardown synchronously.
+   * Also closes a mid-switch incoming client so its fresh handle doesn't linger.
    */
   private registerUnloadClose(): void {
     if (this.unloadCloseRegistered || typeof window === 'undefined') return;
@@ -179,22 +352,32 @@ export class LocalDatabaseService extends AbstractDatabaseService {
       } catch {
         /* best-effort */
       }
+      try {
+        void this.pendingSwitchClient?.close();
+      } catch {
+        /* best-effort */
+      }
     };
     window.addEventListener('pagehide', close);
     window.addEventListener('beforeunload', close);
   }
 
-  private async openStore(storeUrl: string, namespace: string, database: string): Promise<void> {
+  private async openStore(
+    client: Surreal,
+    storeUrl: string,
+    namespace: string,
+    database: string
+  ): Promise<void> {
     this.logger.debug(
       { storeUrl, Category: 'sp00ky-client::LocalDatabaseService::connect' },
       '[LocalDatabaseService] Calling client.connect'
     );
-    await this.client.connect(storeUrl, {});
+    await client.connect(storeUrl, {});
     this.logger.debug(
       { namespace, database, Category: 'sp00ky-client::LocalDatabaseService::connect' },
       '[LocalDatabaseService] client.connect returned. Calling client.use'
     );
-    await this.client.use({ namespace, database });
+    await client.use({ namespace, database });
     this.logger.debug(
       { Category: 'sp00ky-client::LocalDatabaseService::connect' },
       '[LocalDatabaseService] client.use returned'
@@ -218,34 +401,25 @@ export function isLocalStoreOpenError(err: unknown): boolean {
   );
 }
 
-/** Best-effort delete of this client's IndexedDB store(s). The persistent local
- *  DB lives at `indxdb://sp00ky`; SurrealDB-WASM backs it with one or more
- *  IndexedDB databases whose names include `sp00ky`. Resolves even on
- *  error/blocked so startup can proceed. No-op outside a browser. */
-async function dropLocalIndexedDbStores(logger: Logger): Promise<void> {
+/** Best-effort delete of ONE bucket's IndexedDB store(s). SurrealDB-WASM backs
+ *  `indxdb://<name>` with one or more IndexedDB databases whose names include
+ *  `<name>`. Scoped to the given store name — never wipe by the bare `sp00ky`
+ *  substring, that would take every user's bucket (and their un-pushed mutation
+ *  outboxes) down with one corrupt store. Resolves even on error/blocked so
+ *  startup can proceed. No-op outside a browser. Exported for unit tests. */
+export async function dropLocalIndexedDbStores(logger: Logger, storeName: string): Promise<void> {
   if (typeof indexedDB === 'undefined') return;
-  const remove = (name: string): Promise<void> =>
-    new Promise((resolve) => {
-      try {
-        const req = indexedDB.deleteDatabase(name);
-        req.onsuccess = () => resolve();
-        req.onerror = () => resolve();
-        req.onblocked = () => resolve();
-      } catch {
-        resolve();
-      }
-    });
   try {
     let names: string[] = [];
     if (typeof indexedDB.databases === 'function') {
       const dbs = await indexedDB.databases();
       names = dbs
         .map((d) => d.name)
-        .filter((n): n is string => !!n && n.toLowerCase().includes('sp00ky'));
+        .filter((n): n is string => !!n && matchesBucketStore(n, storeName));
     }
     // Fall back to the known store name if enumeration is unavailable/empty.
-    if (names.length === 0) names = ['sp00ky'];
-    await Promise.all(names.map(remove));
+    if (names.length === 0) names = [storeName];
+    await Promise.all(names.map(deleteIndexedDb));
     logger.info(
       { names, Category: 'sp00ky-client::LocalDatabaseService::connect' },
       'Cleared local IndexedDB store(s)'
@@ -257,3 +431,55 @@ async function dropLocalIndexedDbStores(logger: Logger): Promise<void> {
     );
   }
 }
+
+/** True when idb database `name` belongs to the bucket store `storeName` —
+ *  exact match or a derived name (`<storeName>`, `<storeName>-*`, `*<storeName>*`
+ *  with a non-alphanumeric boundary so `sp00ky-abc` never matches
+ *  `sp00ky-abcdef`'s store). Exported for unit tests. */
+export function matchesBucketStore(name: string, storeName: string): boolean {
+  const lower = name.toLowerCase();
+  const target = storeName.toLowerCase();
+  const idx = lower.indexOf(target);
+  if (idx === -1) return false;
+  const after = lower[idx + target.length];
+  return after === undefined || !/[a-z0-9_]/.test(after);
+}
+
+/** Nuke EVERY sp00ky local bucket on this device (manual full reset only —
+ *  the automated corruption recovery is scoped to one bucket). */
+export async function dropAllSp00kyIndexedDbStores(logger: Logger): Promise<void> {
+  if (typeof indexedDB === 'undefined') return;
+  try {
+    let names: string[] = [];
+    if (typeof indexedDB.databases === 'function') {
+      const dbs = await indexedDB.databases();
+      names = dbs
+        .map((d) => d.name)
+        .filter((n): n is string => !!n && n.toLowerCase().includes('sp00ky'));
+    }
+    if (names.length === 0) names = ['sp00ky'];
+    await Promise.all(names.map(deleteIndexedDb));
+    logger.info(
+      { names, Category: 'sp00ky-client::LocalDatabaseService::reset' },
+      'Cleared ALL sp00ky IndexedDB stores'
+    );
+  } catch (e) {
+    logger.warn(
+      { err: e, Category: 'sp00ky-client::LocalDatabaseService::reset' },
+      'Failed to enumerate/clear IndexedDB; proceeding anyway'
+    );
+  }
+}
+
+function deleteIndexedDb(name: string): Promise<void> {
+  return new Promise((resolve) => {
+    try {
+      const req = indexedDB.deleteDatabase(name);
+      req.onsuccess = () => resolve();
+      req.onerror = () => resolve();
+      req.onblocked = () => resolve();
+    } catch {
+      resolve();
+    }
+  });
+}

package/src/services/stream-processor/index.ts

@@ -75,6 +75,16 @@ export class StreamProcessorService {
   // rejecting `$auth`-gated tables; the predicate just degrades to its public
   // branch. Set via `setSessionAuth` on every auth state change.
   private sessionAuth: { authId: string; access: string } = { authId: '', access: '' };
+  // Persisted-state key suffix (the local bucket id) so each user's circuit
+  // snapshot lands in their own key. Only matters for localStorage-backed
+  // persistence — the surrealdb persistence client already writes into the
+  // per-user bucket itself.
+  private stateKeySuffix = '';
+  // Bumped by `reset()`. A `saveState` captured before a reset must not persist
+  // the OLD processor's circuit (holding the previous user's rows) after the
+  // switch — the fire-and-forget calls in `ingest`/`flushCoalescing` can land
+  // late.
+  private stateGeneration = 0;
 
   constructor(
     public events: EventSystem<StreamProcessorEvents>,
@@ -226,10 +236,42 @@ export class StreamProcessorService {
     }
   }
 
+  /** Route the persisted circuit snapshot to a per-bucket key. */
+  setStateKeySuffix(bucketId: string) {
+    this.stateKeySuffix = bucketId;
+  }
+
+  private stateKey(): string {
+    return this.stateKeySuffix
+      ? `_00_stream_processor_state:${this.stateKeySuffix}`
+      : '_00_stream_processor_state';
+  }
+
+  /**
+   * Drop the current WASM processor and start a fresh, empty circuit. Used on
+   * local-bucket switches: the old circuit holds the previous user's rows AND
+   * views registered with the previous `$auth` context, so neither may survive.
+   * Deliberately does NOT `loadState()` — a persisted snapshot references views
+   * under a dead sessionId salt; the DataModule rebind re-registers every live
+   * view against this fresh processor. Caller must re-seed `setPermissions`
+   * afterwards (a fresh circuit default-denies every table).
+   */
+  async reset(): Promise<void> {
+    if (!this.isInitialized) return;
+    this.stateGeneration++;
+    this.batching = false;
+    this.batchBuffer.clear();
+    this.processor = new Sp00kyProcessor() as unknown as WasmProcessor;
+    this.logger.info(
+      { Category: 'sp00ky-client::StreamProcessorService::reset' },
+      'Stream processor reset (fresh circuit)'
+    );
+  }
+
   async loadState() {
     if (!this.processor) return;
     try {
-      const result = await this.persistenceClient.get('_00_stream_processor_state');
+      const result = await this.persistenceClient.get(this.stateKey());
 
       // Check if we have a valid result from the query
       if (
@@ -319,12 +361,16 @@ export class StreamProcessorService {
 
   async saveState() {
     if (!this.processor) return;
+    const generation = this.stateGeneration;
     try {
       // Assuming processor has a save_state method that returns the state string/bytes
       if (typeof this.processor.save_state === 'function') {
         const state = this.processor.save_state();
+        // A reset raced this snapshot — persisting it would write the previous
+        // user's circuit into the new bucket's key. Drop it.
+        if (generation !== this.stateGeneration) return;
         if (state) {
-          await this.persistenceClient.set('_00_stream_processor_state', state);
+          await this.persistenceClient.set(this.stateKey(), state);
           this.logger.trace(
             { Category: 'sp00ky-client::StreamProcessorService::saveState' },
             'State saved'

package/src/services/stream-processor/stream-processor.reset.test.ts

@@ -0,0 +1,104 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// `StreamProcessorService.reset()` is the SSP half of a local-bucket switch:
+// the old circuit holds the previous user's rows and views registered with the
+// previous `$auth`, so reset must swap in a FRESH processor (no state load),
+// and a `saveState` racing the reset must not persist the old circuit into the
+// new bucket's key.
+
+const processorInstances: any[] = [];
+
+vi.mock('@spooky-sync/ssp-wasm', () => ({
+  default: vi.fn(async () => {}),
+  Sp00kyProcessor: vi.fn(() => {
+    const instance = {
+      ingest: vi.fn(() => []),
+      register_view: vi.fn(() => ({ query_id: 'q1', result_data: [] })),
+      unregister_view: vi.fn(),
+      set_permissions: vi.fn(),
+      save_state: vi.fn(() => 'state-bytes'),
+      load_state: vi.fn(),
+    };
+    processorInstances.push(instance);
+    return instance;
+  }),
+}));
+
+import { StreamProcessorService } from './index';
+
+const silentLogger = {
+  child: () => silentLogger,
+  trace: () => {},
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+} as any;
+
+function makeService() {
+  const persisted: Record<string, unknown> = {};
+  const persistence = {
+    set: vi.fn(async (key: string, value: unknown) => {
+      persisted[key] = value;
+    }),
+    get: vi.fn(async () => null),
+    remove: vi.fn(async () => {}),
+  };
+  const service = new StreamProcessorService({} as any, {} as any, persistence as any, silentLogger);
+  return { service, persistence, persisted };
+}
+
+beforeEach(() => {
+  processorInstances.length = 0;
+});
+
+describe('StreamProcessorService.reset', () => {
+  it('swaps in a fresh processor without loading persisted state', async () => {
+    const { service } = makeService();
+    await service.init();
+    expect(processorInstances).toHaveLength(1);
+    const first = processorInstances[0];
+
+    await service.reset();
+    expect(processorInstances).toHaveLength(2);
+    const second = processorInstances[1];
+    // Fresh circuit: nothing loaded into it (a persisted snapshot references
+    // views under a dead sessionId salt and the previous user's data).
+    expect(second.load_state).not.toHaveBeenCalled();
+
+    // New registrations land on the fresh processor, not the old circuit.
+    service.registerQueryPlan({
+      queryHash: 'q1',
+      surql: 'SELECT * FROM thing;',
+      params: {},
+      ttl: '10m',
+      lastActiveAt: new Date(),
+      localArray: [],
+      remoteArray: [],
+      meta: { tableName: 'thing' },
+    } as any);
+    expect(second.register_view).toHaveBeenCalled();
+    expect(first.register_view).not.toHaveBeenCalled();
+  });
+
+  it('routes persisted state to the per-bucket key', async () => {
+    const { service, persistence } = makeService();
+    await service.init();
+    service.setStateKeySuffix('u1');
+    await service.saveState();
+    expect(persistence.set).toHaveBeenCalledWith('_00_stream_processor_state:u1', 'state-bytes');
+  });
+
+  it('drops a saveState that raced a reset (old circuit never persists into the new key)', async () => {
+    const { service, persistence } = makeService();
+    await service.init();
+    // The snapshot is taken, then a reset lands before the persist step —
+    // simulated by bumping the generation from inside save_state().
+    processorInstances[0].save_state.mockImplementation(() => {
+      void service.reset();
+      return 'stale-circuit';
+    });
+    await service.saveState();
+    expect(persistence.set).not.toHaveBeenCalled();
+  });
+});