@statorjs/stator 2.9.1 → 2.10.0-next.1

package/src/server/create-app.ts

@@ -18,6 +18,7 @@ import { discoverMiddleware } from './middleware.ts'
 import { discoverRoutes } from './route-discovery.ts'
 import { setSessionSameSite } from './session.ts'
 import { InMemoryStore, type Store } from './store.ts'
+import { persistencePosture } from './store-intent.ts'
 
 export interface CreateAppConfig extends DeprecatedFlatConfig {
   machinesDir: string
@@ -169,7 +170,23 @@ export async function createApp(config: CreateAppConfig): Promise<StatorApp> {
       return new Promise((resolveFn) => {
         const server = serve({ fetch: app.fetch, port, hostname: resolved.host }, async () => {
           // Always-on (level-independent) so `warn` prod still confirms boot.
-          printStartupNotice({ port, machines: defs.length, routes: routes.length })
+          // Persistence posture in the notice, and a warning for anything
+          // actually at risk. Silence about in-memory storage is the defect
+          // this closes: the app runs, looks healthy, and loses every session
+          // on restart.
+          const posture = persistencePosture({
+            session: sessionStore,
+            app: store.appStore,
+            machines: defs,
+            production: process.env.NODE_ENV === 'production',
+          })
+          printStartupNotice({
+            port,
+            machines: defs.length,
+            routes: routes.length,
+            persistence: posture.label,
+          })
+          for (const warning of posture.warnings) logger.warn({}, `stator: ${warning}`)
           // Run boot.ts once the server is up — its long-lived work (a poll, a
           // subscription) starts here, not during createApp, so tests that only
           // `app.fetch` never trigger it.

package/src/server/http.ts

@@ -22,7 +22,7 @@ import { isStatorQueryRoute, type RouteDefinition } from './routing.ts'
 import { CLAIMS_KEY, getOrCreateSessionId, getSessionState } from './session.ts'
 import { withSessionLock } from './session-lock.ts'
 import { SessionRuntime } from './session-runtime.ts'
-import { fanOut, registerConnection, unregisterConnection } from './sse.ts'
+import { enqueue, fanOut, registerConnection, unregisterConnection } from './sse.ts'
 
 const httpLog = scopedLogger('http')
 
@@ -423,7 +423,7 @@ export async function buildHonoApp(config: HttpConfig): Promise<Hono> {
       // otherwise never reach this page.
       const sync = initialSyncPatches(renderState, runtime)
       if (sync.length > 0) {
-        await conn.send(JSON.stringify({ patches: sync }))
+        enqueue(conn, JSON.stringify({ patches: sync }))
       }
 
       // Heartbeat every 25s. This is a real DATA message, not a comment, on
@@ -433,9 +433,11 @@ export async function buildHonoApp(config: HttpConfig): Promise<Hono> {
       // ever arrives, no error fires) unless liveness is OBSERVABLE. The
       // runtime tracks last-message time and reconnects when pings stop.
       const keepAlive = setInterval(() => {
-        void conn.send('{"ping":true}').catch(() => {
-          // Stream closed; the abort handler cleans up.
-        })
+        // Through the same queue fan-out uses, so it is bounded like any other
+        // write: a half-open socket never settles its writes, and the heartbeat
+        // is what reaps it when the app is otherwise idle and no dispatch would
+        // ever notice.
+        enqueue(conn, '{"ping":true}')
       }, config.ssePingMs ?? 25_000)
 
       try {
@@ -547,7 +549,9 @@ export async function buildHonoApp(config: HttpConfig): Promise<Hono> {
         // `touched`) — so it isn't re-created and re-fired next request.
         await runtime.persistTouched(new Set([...touched, ...runtime.entryFiredMachines()]))
 
-        await fanOut(touched, {
+        // Queues patches on every affected channel and returns; no socket is
+        // awaited under the lock.
+        const { originatorQueued } = await fanOut(touched, {
           sessionId,
           originClientId: c.req.header('X-Stator-Client'),
         })
@@ -557,7 +561,15 @@ export async function buildHonoApp(config: HttpConfig): Promise<Hono> {
         // normal event path in server/effects.ts.
         scheduleSessionEffects(runtime, config.store, sessionId)
 
-        const envelope = { patches, directives: [], committed: touched.size > 0 }
+        // This page's patches normally ride the response. When its live
+        // channel already had a backlog, fan-out queued them behind it instead
+        // (two channels to one page must not reorder a positional list op), so
+        // the response carries none.
+        const envelope = {
+          patches: originatorQueued ? [] : patches,
+          directives: [],
+          committed: touched.size > 0,
+        }
         if (body.eventId) record(sessionId, body.eventId, JSON.stringify(envelope))
         return c.json(envelope)
       } finally {

package/src/server/index.ts

@@ -136,3 +136,5 @@ export {
 } from './sse.ts'
 export type { Store } from './store.ts'
 export { InMemoryStore } from './store.ts'
+export type { StoreFromEnvOptions } from './store-intent.ts'
+export { appStore, sessionStore } from './store-intent.ts'

package/src/server/sse.ts

@@ -17,13 +17,21 @@ const sseLog = scopedLogger('sse')
  * recompute will diff against when fan-out fires. Each push updates
  * `lastValue` for the bindings touched by the push, so subsequent pushes
  * only emit deltas.
+ *
+ * Writes never happen inline. Everything outbound — fan-out patches, the
+ * initial sync, the heartbeat, the dev broadcast — goes through `enqueue`,
+ * and one drain loop per connection owns the socket. A request or a lock is
+ * therefore never held across a socket write, and per-connection order is a
+ * property of the queue rather than of who awaited what.
  */
 export interface Connection {
   id: string
   sessionId: string
   /** The browser page-load identity (client-generated). Lets fan-out
-   *  recognize a dispatch's OWN connection: its baseline is advanced but
-   *  nothing is sent — the POST response already delivered those patches. */
+   *  recognize a dispatch's OWN connection: its baseline is advanced and,
+   *  when nothing is queued for it, nothing is sent — the POST response
+   *  delivers those patches. With a backlog they ride the queue instead, so
+   *  the two channels cannot reorder a positional list op. */
   clientId?: string
   routeKey: string
   route: RouteDefinition
@@ -39,14 +47,29 @@ export interface Connection {
    *  transport; absent in tests that register a bare connection. */
   close?: () => void
   closed: boolean
+  /** Outbound writes waiting for the drain loop, oldest first. */
+  queue: string[]
+  /** Bytes waiting in `queue`. The item being written is not counted. */
+  queuedBytes: number
+  /** True while the drain loop owns the socket — an item is in flight. */
+  draining: boolean
 }
 
+type ConnectionInit = Omit<Connection, 'id' | 'closed' | 'queue' | 'queuedBytes' | 'draining'>
+
 const connections = new Map<string, Connection>()
 let nextId = 0
 
-export function registerConnection(init: Omit<Connection, 'id' | 'closed'>): Connection {
+export function registerConnection(init: ConnectionInit): Connection {
   const id = `sse${nextId++}`
-  const conn: Connection = { ...init, id, closed: false }
+  const conn: Connection = {
+    ...init,
+    id,
+    closed: false,
+    queue: [],
+    queuedBytes: 0,
+    draining: false,
+  }
   // A page-load holds at most one channel per route, so an existing
   // connection with the same (clientId, routeKey) is a corpse whose abort we
   // never observed — a half-open socket, or a reconnect that raced its own
@@ -73,21 +96,16 @@ export function registerConnection(init: Omit<Connection, 'id' | 'closed'>): Con
 }
 
 /**
- * Push a pre-serialized envelope to every open connection, bypassing the
+ * Queue a pre-serialized envelope for every open connection, bypassing the
  * recompute path. The dev server's rebuild/error signals ride this so a dev
  * page holds ONE event-stream instead of two — see `dev-native.ts`. Not a
  * fan-out: no diffing, no baseline advance, no per-connection filtering.
  */
-export async function broadcastEnvelope(payload: unknown): Promise<void> {
+export function broadcastEnvelope(payload: unknown): void {
   if (connections.size === 0) return
   const data = JSON.stringify(payload)
   for (const conn of connections.values()) {
-    if (conn.closed) continue
-    try {
-      await conn.send(data)
-    } catch (err) {
-      sseLog.warn({ id: conn.id, err: String(err) }, 'broadcast failed')
-    }
+    if (!conn.closed) enqueue(conn, data)
   }
 }
 
@@ -95,6 +113,10 @@ export function unregisterConnection(id: string): void {
   const conn = connections.get(id)
   if (!conn) return
   conn.closed = true
+  // Whatever was waiting is discarded with the socket: the client reconnects
+  // and resyncs. The drain loop, if mid-write, sees `closed` and exits.
+  conn.queue.length = 0
+  conn.queuedBytes = 0
   conn.runtime.dispose()
   connections.delete(id)
   sseLog.debug(
@@ -107,6 +129,133 @@ export function activeConnectionCount(): number {
   return connections.size
 }
 
+/** How long one write to one connection may take before the connection is
+ *  treated as dead. `STATOR_SSE_WRITE_TIMEOUT_MS` overrides it. */
+const DEFAULT_WRITE_TIMEOUT_MS = 5_000
+
+function writeTimeoutMs(): number {
+  const raw = process.env.STATOR_SSE_WRITE_TIMEOUT_MS
+  if (raw === undefined || raw === '') return DEFAULT_WRITE_TIMEOUT_MS
+  const ms = Number(raw)
+  return Number.isFinite(ms) && ms > 0 ? ms : DEFAULT_WRITE_TIMEOUT_MS
+}
+
+/** Bytes a connection may hold WAITING behind an in-flight write before it is
+ *  treated as dead. The item being written is covered by the write deadline,
+ *  not by this, and a single waiting item never trips it however large — an
+ *  initial sync of a big table is one item. `STATOR_SSE_QUEUE_MAX_BYTES`
+ *  overrides it. */
+const DEFAULT_QUEUE_MAX_BYTES = 1_048_576
+
+function queueMaxBytes(): number {
+  const raw = process.env.STATOR_SSE_QUEUE_MAX_BYTES
+  if (raw === undefined || raw === '') return DEFAULT_QUEUE_MAX_BYTES
+  const bytes = Number(raw)
+  return Number.isFinite(bytes) && bytes > 0 ? bytes : DEFAULT_QUEUE_MAX_BYTES
+}
+
+/** Whether anything is queued or in flight for this connection. */
+export function hasBacklog(conn: Connection): boolean {
+  return conn.draining || conn.queue.length > 0
+}
+
+/**
+ * Queue one envelope for a connection and return at once. The drain loop
+ * writes it when everything ahead of it has been written, so order per
+ * connection is FIFO by construction. Overflow drops the connection, the
+ * same policy as a write that times out: the client reconnects and resyncs.
+ */
+export function enqueue(conn: Connection, data: string): void {
+  if (conn.closed) return
+  conn.queue.push(data)
+  conn.queuedBytes += Buffer.byteLength(data)
+  if (conn.queue.length > 1 && conn.queuedBytes > queueMaxBytes()) {
+    sseLog.warn(
+      {
+        id: conn.id,
+        sid: conn.sessionId,
+        route: conn.routeKey,
+        waiting: conn.queue.length,
+        bytes: conn.queuedBytes,
+        max: queueMaxBytes(),
+      },
+      'sse queue overflowed — dropping the connection',
+    )
+    unregisterConnection(conn.id)
+    conn.close?.()
+    return
+  }
+  if (!conn.draining) void drain(conn)
+}
+
+/** The one writer per connection. Runs until the queue is empty or the
+ *  connection closes under it (a timed-out write, an overflow, an abort). */
+async function drain(conn: Connection): Promise<void> {
+  conn.draining = true
+  try {
+    while (!conn.closed && conn.queue.length > 0) {
+      const data = conn.queue.shift()!
+      conn.queuedBytes -= Buffer.byteLength(data)
+      await pushToConnection(conn, data)
+    }
+  } finally {
+    conn.draining = false
+  }
+}
+
+/**
+ * Write one envelope to one connection, bounded. The drain loop's single
+ * write; nothing else touches the socket.
+ *
+ * A write to a live socket resolves; a write to a closed one rejects. A write
+ * to a HALF-OPEN one does neither once its buffer is full — when a remote
+ * laptop sleeps or a NAT drops the mapping, no FIN ever arrives, the socket
+ * still looks writable, and the promise simply never settles. Fan-out used to
+ * await these serially with no deadline, so one such connection stalled the
+ * loop and every connection registered after it received nothing until the
+ * kernel gave up on the socket (minutes) or the same page reconnected and
+ * evicted it. Under the session lock the same stall ran into the lock's 30s
+ * backstop, failing the dispatching request each time.
+ *
+ * On a timeout the connection is dropped rather than retried: the client
+ * reconnects and gets a full resync, which is cheap by design. Note what the
+ * deadline measures: a write to a socket with buffer space resolves at once
+ * regardless of the peer, so this fires only when the buffer has stayed full
+ * for the whole window — not on a merely slow client. And because the clock
+ * starts when the drain loop issues the write, not when the item was queued,
+ * a burst behind a slow but healthy socket cannot trip it.
+ */
+export async function pushToConnection(conn: Connection, data: string): Promise<Outcome> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    const outcome = await Promise.race<Outcome>([
+      conn.send(data).then((): Outcome => 'sent'),
+      new Promise<Outcome>((settle) => {
+        timer = setTimeout(() => settle('timeout'), writeTimeoutMs())
+        timer.unref?.()
+      }),
+    ])
+    if (outcome === 'timeout') {
+      sseLog.warn(
+        { id: conn.id, sid: conn.sessionId, route: conn.routeKey, ms: writeTimeoutMs() },
+        'sse write timed out — dropping the connection',
+      )
+      unregisterConnection(conn.id)
+      conn.close?.()
+    }
+    return outcome
+  } catch (err) {
+    // Bumped from debug to warn — silent push failures were why "30-50%
+    // delivery" was invisible in production logs.
+    sseLog.warn({ id: conn.id, sid: conn.sessionId, err: String(err) }, 'sse push failed')
+    return 'failed'
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+type Outcome = 'sent' | 'timeout' | 'failed'
+
 /**
  * Hang up every open connection — the shutdown path. A live response never ends
  * on its own, so `server.close()` cannot complete until these do; see
@@ -125,24 +274,31 @@ export function closeLiveConnections(): number {
 /**
  * After a state-changing dispatch settles, iterate every open connection
  * whose route's `reads:` intersects `touched`, recompute against that
- * connection's slot map, and push any resulting patches over its event
+ * connection's slot map, and queue any resulting patches on its event
  * stream. Recompute mutates the connection's `renderState.lastValue`s so
- * the next push is correctly diffed.
+ * the next push is correctly diffed. Returns as soon as everything is
+ * queued: no socket is awaited here, so a dispatch never waits on another
+ * page's network.
  *
  * Connections from any session receive pushes — that's the point: an
  * admin tab on session C sees updates triggered by session A's POSTs.
+ *
+ * `originatorQueued` tells the dispatch path whether the acting page's own
+ * patches were queued on its channel (because it already had a backlog)
+ * rather than left to the POST response. When true, the response must carry
+ * none, or the same positional list op lands twice.
  */
 export async function fanOut(
   touched: ReadonlySet<string>,
   source?: { sessionId?: string; originClientId?: string },
-): Promise<void> {
-  if (touched.size === 0 || connections.size === 0) return
+): Promise<{ originatorQueued: boolean }> {
+  if (touched.size === 0 || connections.size === 0) return { originatorQueued: false }
 
-  let pushedCount = 0
+  let enqueued = 0
   let skippedNoIntersect = 0
   let skippedNoPatches = 0
   let skippedOriginator = 0
-  let failed = 0
+  let originatorQueued = false
 
   // Expand through the reverse-reads graph once per fan-out: machines whose
   // SELECTORS derive from a touched machine must re-diff even though their
@@ -188,42 +344,43 @@ export async function fanOut(
       continue
     }
 
-    // The dispatching page's own connection: the POST response already
-    // delivered this diff. The recompute above advanced the baseline (so the
-    // NEXT push diffs correctly); sending would double-apply — and keyed
-    // insert/remove/move ops are not idempotent.
-    if (
+    // The dispatching page's own connection. With nothing queued for it, the
+    // POST response delivers this diff: the recompute above advanced the
+    // baseline (so the NEXT push diffs correctly) and sending would
+    // double-apply — keyed insert/remove/move ops are not idempotent. With a
+    // backlog, the response would overtake what is still queued, and a
+    // positional op applied out of order corrupts a list rather than merely
+    // staling it — so the diff rides the queue and the response carries none.
+    const isOriginator =
       source?.originClientId !== undefined &&
       conn.clientId !== undefined &&
       conn.clientId === source.originClientId
-    ) {
-      skippedOriginator++
-      continue
+    if (isOriginator) {
+      if (!hasBacklog(conn)) {
+        skippedOriginator++
+        continue
+      }
+      originatorQueued = true
     }
 
-    try {
-      await conn.send(JSON.stringify({ patches }))
-      pushedCount++
-    } catch (err) {
-      // Bumped from debug to warn — silent push failures were why "30-50%
-      // delivery" was invisible in production logs.
-      failed++
-      sseLog.warn({ id: conn.id, sid: conn.sessionId, err: String(err) }, 'sse push failed')
-    }
+    enqueue(conn, JSON.stringify({ patches }))
+    enqueued++
   }
 
   // Log every fan-out at debug so the user can see touched-machines flow and
-  // correlate against client-side inspector entries — noisy for prod, so debug.
+  // correlate against client-side inspector entries — noisy for prod, so
+  // debug. Write outcomes are logged by the drain loop as they happen.
   sseLog.debug(
     {
       touched: [...touched],
       total: connections.size,
-      pushed: pushedCount,
+      enqueued,
       skippedNoIntersect,
       skippedNoPatches,
       skippedOriginator,
-      failed,
+      originatorQueued,
     },
     'fan-out',
   )
+  return { originatorQueued }
 }

package/src/server/store-intent.ts

@@ -0,0 +1,175 @@
+import type { AppStore } from './app-store.ts'
+import { InMemoryAppStore } from './app-store.ts'
+import { CachedStore, type CachedStoreOptions } from './cached-store.ts'
+import { RedisAppStore, RedisStore } from './redis-store.ts'
+import { InMemoryStore, type Store } from './store.ts'
+
+/**
+ * Picking a store from the environment, without the silent downgrade.
+ *
+ * Every app that keeps state in Redis writes the same conditional: a URL from
+ * the environment, a durable store when it's there, in-memory when it isn't.
+ * That fallback is right for dev and for CI — a build machine has no business
+ * holding production credentials — and wrong in exactly one place, production,
+ * where it means the app runs, looks healthy, and quietly loses every session
+ * on restart. Written in userland the framework cannot tell that outcome from a
+ * deliberate choice, so it cannot say anything about it.
+ *
+ * Moving the conditional in here changes only that: the returned store carries
+ * whether in-memory was *chosen* or *fallen back to*, so startup can be silent
+ * in development and loud in production, naming the empty variable instead of
+ * reporting a generic posture.
+ *
+ * The environment stays in charge. A URL present means durable, wherever it
+ * comes from — so pointing CI at a test Redis is nothing special, it is just
+ * the variable being set. An empty or whitespace-only value counts as absent,
+ * which is what a CI system that defines every variable as `""` produces.
+ */
+
+/** Recorded on a fallback store so startup can tell it from a deliberate one.
+ *  Non-enumerable and internal: the value still satisfies `Store` exactly. */
+const INTENT = Symbol.for('stator.store.intent')
+
+interface StoreIntent {
+  /** What the app asked for. */
+  wanted: 'durable'
+  /** The config field that was empty, for the message. */
+  from: string
+}
+
+function mark<T extends object>(store: T, intent: StoreIntent): T {
+  Object.defineProperty(store, INTENT, { value: intent, enumerable: false })
+  return store
+}
+
+/** The recorded intent of a store, if it was built by these helpers. */
+export function storeIntent(store: unknown): StoreIntent | undefined {
+  if (store === null || typeof store !== 'object') return undefined
+  return (store as Record<symbol, StoreIntent | undefined>)[INTENT]
+}
+
+/** True for the framework's own in-memory adapters — the ones that do not
+ *  survive a restart. A store the app supplied is assumed durable; the
+ *  framework has no way to ask, and no business guessing. */
+export function isEphemeral(store: unknown): boolean {
+  return store instanceof InMemoryStore || store instanceof InMemoryAppStore
+}
+
+const blank = (url: string | undefined): boolean => url === undefined || url.trim() === ''
+
+export interface StoreFromEnvOptions {
+  /** Redis connection string, typically `process.env.REDIS_URL`. Absent, empty
+   *  or whitespace-only selects in-memory — normal in dev and CI, reported at
+   *  startup in production. */
+  redisUrl?: string
+  /** Wrap Redis in a write-through memory cache. Off by default: caching is a
+   *  performance decision, and this helper's job is the durable-or-not one. */
+  cache?: CachedStoreOptions | true
+  /** Key prefix, passed through to the Redis adapter. */
+  keyPrefix?: string
+  /** Name used in the startup report when the URL is empty. Default `REDIS_URL`. */
+  envName?: string
+}
+
+/**
+ * Session-machine storage from the environment: Redis when a URL is set,
+ * in-memory otherwise.
+ *
+ *   persistence: { session: sessionStore({ redisUrl: process.env.REDIS_URL }) }
+ *
+ * Call it with nothing (or omit `persistence.session` entirely) to choose
+ * in-memory deliberately — that is a real choice and is never reported.
+ */
+export function sessionStore(opts: StoreFromEnvOptions = {}): Store {
+  if (blank(opts.redisUrl)) {
+    // In-memory either way, but for two different reasons. Passing the key at
+    // all — `redisUrl: process.env.REDIS_URL` — says the app wants durability
+    // from the environment, so an empty value is worth reporting in production.
+    // Passing no key says in-memory was the choice, which is never reported.
+    return 'redisUrl' in opts
+      ? mark(new InMemoryStore(), { wanted: 'durable', from: opts.envName ?? 'REDIS_URL' })
+      : new InMemoryStore()
+  }
+  const redis = opts.keyPrefix
+    ? new RedisStore(opts.redisUrl as string, opts.keyPrefix)
+    : new RedisStore(opts.redisUrl as string)
+  if (!opts.cache) return redis
+  return new CachedStore(redis, opts.cache === true ? {} : opts.cache)
+}
+
+/**
+ * App-machine storage (`persist: true`) from the environment. Same rule as
+ * `sessionStore`.
+ */
+export function appStore(opts: StoreFromEnvOptions = {}): AppStore {
+  if (blank(opts.redisUrl)) {
+    return 'redisUrl' in opts
+      ? mark(new InMemoryAppStore(), { wanted: 'durable', from: opts.envName ?? 'REDIS_URL' })
+      : new InMemoryAppStore()
+  }
+  return opts.keyPrefix
+    ? new RedisAppStore(opts.redisUrl as string, opts.keyPrefix)
+    : new RedisAppStore(opts.redisUrl as string)
+}
+
+/** One machine's persistence-relevant shape. */
+export interface MachinePersistence {
+  lifecycle: string
+  persist: boolean
+}
+
+/**
+ * What to say about persistence at startup. The posture goes in the notice —
+ * printed at every level, so a deploy log always states whether state survives
+ * a restart — and anything worth alerting on comes back as a warning.
+ *
+ * Warnings fire in production only, and only when something is actually at
+ * risk: an app with no session machines has no session state to lose, and an
+ * app that deliberately chose in-memory made a real choice. Nothing here ever
+ * refuses to start; persistent storage is assumed to be wanted, never required.
+ */
+export function persistencePosture(input: {
+  session: unknown
+  app: unknown
+  machines: readonly MachinePersistence[]
+  production: boolean
+}): { label: string; warnings: string[] } {
+  const name = (store: unknown): string =>
+    isEphemeral(store)
+      ? 'in-memory'
+      : ((store as { constructor?: { name?: string } })?.constructor?.name ?? 'custom')
+
+  const sessionMachines = input.machines.filter((m) => m.lifecycle === 'session').length
+  const persistedApp = input.machines.filter((m) => m.lifecycle === 'app' && m.persist).length
+
+  let label = `sessions ${name(input.session)}`
+  if (persistedApp > 0) label += ` · app ${name(input.app)}`
+
+  const warnings: string[] = []
+  if (input.production) {
+    const sessionIntent = storeIntent(input.session)
+    if (isEphemeral(input.session) && sessionIntent) {
+      // The app configured a durable store and the variable was empty — the
+      // one case the framework can name precisely.
+      warnings.push(
+        `${sessionIntent.from} is empty, so session state is in memory and will not survive a restart`,
+      )
+    } else if (isEphemeral(input.session) && sessionMachines > 0) {
+      warnings.push(
+        `no durable session store is configured, so the state of ${sessionMachines} session machine${
+          sessionMachines === 1 ? '' : 's'
+        } will not survive a restart`,
+      )
+    }
+
+    const appIntent = storeIntent(input.app)
+    if (isEphemeral(input.app) && persistedApp > 0) {
+      warnings.push(
+        appIntent
+          ? `${appIntent.from} is empty, so ${persistedApp} persisted app machine${persistedApp === 1 ? '' : 's'} will not survive a restart`
+          : `no durable app store is configured, so ${persistedApp} persisted app machine${persistedApp === 1 ? '' : 's'} will not survive a restart`,
+      )
+    }
+  }
+  return { label, warnings }
+}