agent-yes 1.290.7 → 1.291.0

package/ts/globalPidIndex.ts

@@ -1,4 +1,5 @@
-import { appendFile, mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
+import type { Dirent } from "fs";
+import { appendFile, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from "fs/promises";
 import { homedir } from "os";
 import type { AgentPermissions } from "./agentPermissions.ts";
 import path from "path";
@@ -246,6 +247,33 @@ function logSiblings(logFile: string | null): string[] {
   return [`${base}.raw.log`, `${base}.log`, `${base}.lines.log`, `${base}.debug.log`];
 }
 
+export interface LogGcResult {
+  /** Absolute paths of the log files that were removed. */
+  removed: string[];
+  /** Total bytes reclaimed (0 for files whose size could not be read). */
+  freedBytes: number;
+}
+
+/**
+ * Delete one log file, reporting the bytes it held. Returns null when nothing
+ * was removed (already gone, or not ours to delete) so callers can count only
+ * real deletions.
+ */
+async function removeLogFile(file: string): Promise<number | null> {
+  let size = 0;
+  try {
+    size = (await stat(file)).size;
+  } catch {
+    // Unreadable/missing — unlink below still decides whether it counted.
+  }
+  try {
+    await unlink(file);
+    return size;
+  } catch {
+    return null; // missing / already gone — ignore
+  }
+}
+
 /**
  * Index-driven retention sweep: delete the log files of sessions whose process
  * is gone (exited or dead pid) and that started longer ago than the retention
@@ -254,30 +282,143 @@ function logSiblings(logFile: string | null): string[] {
  * Best-effort; never throws. Returns the number of files removed.
  */
 export async function pruneOldLogs(maxAgeMs: number = retentionMs()): Promise<number> {
+  const { removed } = await pruneOldLogsDetailed(maxAgeMs);
+  return removed.length;
+}
+
+async function pruneOldLogsDetailed(maxAgeMs: number = retentionMs()): Promise<LogGcResult> {
+  const result: LogGcResult = { removed: [], freedBytes: 0 };
   let records: GlobalPidRecord[];
   try {
     records = await readGlobalPidsRaw();
   } catch {
-    return 0;
+    return result;
   }
   const now = Date.now();
-  let removed = 0;
   for (const r of records) {
     const dead = r.status === "exited" || !isProcessAlive(r.pid);
     const old = now - (r.started_at ?? now) > maxAgeMs;
     if (!dead || !old) continue;
     for (const f of logSiblings(r.log_file)) {
+      const freed = await removeLogFile(f);
+      if (freed === null) continue;
+      result.removed.push(f);
+      result.freedBytes += freed;
+    }
+  }
+  if (result.removed.length > 0) {
+    logger.debug(`[globalPidIndex] pruned ${result.removed.length} stale log file(s)`);
+    await maybeCompactGlobalPids();
+  }
+  return result;
+}
+
+/** `<pid>.log`, `<pid>.raw.log`, `<pid>.lines.log`, `<pid>.debug.log` — nothing else. */
+const PID_LOG_FILE = /^(\d+)\.(?:raw\.log|lines\.log|debug\.log|log)$/;
+
+/**
+ * Every `.agent-yes/` dir that might hold logs: this process's cwd plus the
+ * dir of each path the index knows about. Records are the only breadcrumb to
+ * *other* projects, so a pid whose record is gone is still reachable as long
+ * as some sibling record points at the same dir.
+ */
+function candidateLogDirs(records: GlobalPidRecord[]): string[] {
+  const dirs = new Set<string>([path.resolve(process.cwd(), ".agent-yes")]);
+  for (const r of records) {
+    if (r.log_file) dirs.add(path.resolve(path.dirname(r.log_file)));
+    if (r.cwd) dirs.add(path.resolve(r.cwd, ".agent-yes"));
+  }
+  return [...dirs];
+}
+
+/**
+ * Directory-driven sweep for **orphaned** logs — the ones `pruneOldLogs` can
+ * never see.
+ *
+ * `maybeCompactGlobalPids` drops records that are dead AND exited, but
+ * `pruneOldLogs` only deletes a log once its record is older than the
+ * retention window. A session that exits cleanly is therefore compacted out of
+ * the index long before its log ages out, and with the record goes the only
+ * record of the `log_file` path — the file is then unreclaimable by any
+ * index-driven pass. Left alone, those accumulate for as long as a machine
+ * keeps running agents, and a single long-lived session's raw log can reach
+ * hundreds of MiB on its own.
+ *
+ * So this pass ignores the index for *what* to delete and trusts the
+ * filesystem: in each candidate dir, any `<pid>.*.log` whose pid is no longer
+ * running and whose mtime is outside the retention window. Guards:
+ *
+ * - the name must parse as a pid log (never `inbox.jsonl`, `pid.sqlite`, …);
+ * - `isProcessAlive(pid)` must be false — pid reuse can only make a dead pid
+ *   look alive, which keeps a file that a later run collects, never the
+ *   reverse;
+ * - mtime, not `started_at`, bounds the age, so a log still being appended to
+ *   is safe even when its session started long ago.
+ *
+ * Best-effort; never throws.
+ */
+export async function sweepOrphanLogs(maxAgeMs: number = retentionMs()): Promise<LogGcResult> {
+  const result: LogGcResult = { removed: [], freedBytes: 0 };
+  let records: GlobalPidRecord[] = [];
+  try {
+    records = await readGlobalPidsRaw();
+  } catch {
+    // No index at all — the cwd is still worth sweeping.
+  }
+  const now = Date.now();
+
+  for (const dir of candidateLogDirs(records)) {
+    let entries: Dirent[];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      continue; // dir gone / unreadable — nothing to collect here
+    }
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      const match = PID_LOG_FILE.exec(entry.name);
+      if (!match) continue;
+      const pid = Number(match[1]);
+      if (!Number.isInteger(pid) || pid <= 0 || isProcessAlive(pid)) continue;
+
+      const file = path.join(dir, entry.name);
+      let mtimeMs: number;
       try {
-        await unlink(f);
-        removed++;
+        mtimeMs = (await stat(file)).mtimeMs;
       } catch {
-        // missing / already gone — ignore
+        continue; // raced with deletion
       }
+      if (now - mtimeMs <= maxAgeMs) continue; // still inside the window
+
+      const freed = await removeLogFile(file);
+      if (freed === null) continue;
+      result.removed.push(file);
+      result.freedBytes += freed;
     }
   }
-  if (removed > 0) {
-    logger.debug(`[globalPidIndex] pruned ${removed} stale log file(s)`);
-    await maybeCompactGlobalPids();
+
+  if (result.removed.length > 0) {
+    logger.debug(`[globalPidIndex] swept ${result.removed.length} orphaned log file(s)`);
+  }
+  return result;
+}
+
+/**
+ * The full log reclaim `ay gc` runs: the index-driven retention pass first
+ * (it also compacts the index), then the directory sweep for whatever the
+ * index no longer remembers. Paths are deduped, so a file both passes could
+ * claim is only counted once.
+ */
+export async function gcLogs(maxAgeMs: number = retentionMs()): Promise<LogGcResult> {
+  const pruned = await pruneOldLogsDetailed(maxAgeMs);
+  const swept = await sweepOrphanLogs(maxAgeMs);
+  const seen = new Set(pruned.removed);
+  const result: LogGcResult = { ...pruned };
+  for (const f of swept.removed) {
+    if (seen.has(f)) continue;
+    seen.add(f);
+    result.removed.push(f);
   }
-  return removed;
+  result.freedBytes = pruned.freedBytes + swept.freedBytes;
+  return result;
 }

package/ts/messageLog.bun.spec.ts

@@ -14,6 +14,7 @@ import {
   shouldRecord,
   type MessageRecord,
 } from "./messageLog.ts";
+import { envelopeAttribution } from "./subcommands.ts";
 
 function makeRecord(over: Partial<MessageRecord> = {}): MessageRecord {
   return {
@@ -540,3 +541,35 @@ describe("messageLog sender provenance — derived vs asserted", () => {
     ).toBe(true);
   });
 });
+
+describe("unverifiable is not contradicted", () => {
+  // The direction matters more than the fact. Collapsing UNKNOWN into SUSPICIOUS
+  // trains every reader to dismiss the marker on legitimate traffic, so when a
+  // real contradiction arrives it reads as more of the same — the alarm is spent
+  // before its first true positive. The reverse error would merely miss one.
+  it("stays SILENT in the envelope when there is nothing to disagree with", () => {
+    expect(envelopeAttribution("env-unverified")).toBe("");
+  });
+
+  it("keeps the loud marker for a genuine contradiction only", () => {
+    expect(envelopeAttribution("env-uncorroborated")).toContain("UNCORROBORATED");
+  });
+
+  it("still records the distinction for a reader who wants it", () => {
+    // Silent in the body is not the same as thrown away: `ay msgs` shows it,
+    // and from_via carries it for anything that wants to weigh it.
+    const from = { pid: 1111, cli: "claude", cwd: "/repo/alpha", agent_id: "agent-A" };
+    expect(senderLabel(makeRecord({ from, from_via: "env-unverified" }))).toBe(
+      "claude #1111 (unverified)",
+    );
+    expect(senderLabel(makeRecord({ from, from_via: "env-uncorroborated" }))).toBe(
+      "claude #1111 (UNCORROBORATED)",
+    );
+  });
+
+  it("does not weaken the honest path", () => {
+    const from = { pid: 1111, cli: "claude", cwd: "/repo/alpha", agent_id: "agent-A" };
+    expect(senderLabel(makeRecord({ from, from_via: "env" }))).toBe("claude #1111");
+    expect(envelopeAttribution("env")).toBe("");
+  });
+});

package/ts/messageLog.spec.ts

@@ -14,6 +14,7 @@ import {
   shouldRecord,
   type MessageRecord,
 } from "./messageLog.ts";
+import { envelopeAttribution } from "./subcommands.ts";
 
 function makeRecord(over: Partial<MessageRecord> = {}): MessageRecord {
   return {
@@ -540,3 +541,35 @@ describe("messageLog sender provenance — derived vs asserted", () => {
     ).toBe(true);
   });
 });
+
+describe("unverifiable is not contradicted", () => {
+  // The direction matters more than the fact. Collapsing UNKNOWN into SUSPICIOUS
+  // trains every reader to dismiss the marker on legitimate traffic, so when a
+  // real contradiction arrives it reads as more of the same — the alarm is spent
+  // before its first true positive. The reverse error would merely miss one.
+  it("stays SILENT in the envelope when there is nothing to disagree with", () => {
+    expect(envelopeAttribution("env-unverified")).toBe("");
+  });
+
+  it("keeps the loud marker for a genuine contradiction only", () => {
+    expect(envelopeAttribution("env-uncorroborated")).toContain("UNCORROBORATED");
+  });
+
+  it("still records the distinction for a reader who wants it", () => {
+    // Silent in the body is not the same as thrown away: `ay msgs` shows it,
+    // and from_via carries it for anything that wants to weigh it.
+    const from = { pid: 1111, cli: "claude", cwd: "/repo/alpha", agent_id: "agent-A" };
+    expect(senderLabel(makeRecord({ from, from_via: "env-unverified" }))).toBe(
+      "claude #1111 (unverified)",
+    );
+    expect(senderLabel(makeRecord({ from, from_via: "env-uncorroborated" }))).toBe(
+      "claude #1111 (UNCORROBORATED)",
+    );
+  });
+
+  it("does not weaken the honest path", () => {
+    const from = { pid: 1111, cli: "claude", cwd: "/repo/alpha", agent_id: "agent-A" };
+    expect(senderLabel(makeRecord({ from, from_via: "env" }))).toBe("claude #1111");
+    expect(envelopeAttribution("env")).toBe("");
+  });
+});

package/ts/messageLog.ts

@@ -183,6 +183,9 @@ export function senderLabel(record: MessageRecord): string {
     // The one attributed value that is only a claim — say so, since a receiver
     // weighing whether to act on it cannot otherwise tell it from a fact.
     if (record.from_via === "env-uncorroborated") return `${name} (UNCORROBORATED)`;
+    // Visible in a listing, where a human is reading deliberately, but never in
+    // the envelope — see envelopeAttribution.
+    if (record.from_via === "env-unverified") return `${name} (unverified)`;
     return name;
   }
   // No agent identified. Say what WAS measured rather than "unattributed" —

package/ts/rawInputDeclared.bun.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it } from "bun:test";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+// #453 made the PRODUCER declare a terminal wire (`raw: true`), because no
+// byte-level predicate on the server may claim a keystroke or a mouse report —
+// those shapes are indistinguishable from a short message. A declaration only
+// works if every producer makes it, and #453 landed it on one of three: the
+// other two kept flooding capacity-capped inboxes, where a mouse scrolled over
+// a pane evicts the real messages behind it.
+//
+// So this is the guard the design needs: any `/api/send` write that declines to
+// submit (`code: "none"`) is raw terminal input and must say so.
+const ROOTS = ["ts", "lab/ui"];
+const SKIP = new Set(["node_modules", "cf", "dist", "public"]);
+const RAW_SEND = /code:\s*"none"/;
+
+function sources(dir: string, out: string[] = []): string[] {
+  for (const e of readdirSync(dir)) {
+    if (SKIP.has(e)) continue;
+    const p = join(dir, e);
+    if (statSync(p).isDirectory()) sources(p, out);
+    else if (/\.(ts|js)$/.test(e) && !/\.spec\./.test(e)) out.push(p);
+  }
+  return out;
+}
+
+/**
+ * Call sites only — prose in a comment describing the protocol is not one.
+ *
+ * Line comments are stripped; block comments deliberately are not. Tracking
+ * them needs a lexer, and getting it wrong wedges the scan silently. Prose
+ * inside a block comment can only ever ADD a false offender, which fails
+ * loudly and is fixed by rewording; it can never hide a real producer. The
+ * count assertion below covers the opposite slip, a scan that stops matching.
+ *
+ * Split on /\r?\n/, not "\n": on a CRLF checkout every line would keep a
+ * trailing \r, and `.` does not match \r in JS, so `//.*$` silently stops
+ * stripping comments and every line of prose about the protocol becomes a
+ * false offender. This test failed on Windows only, for exactly that.
+ */
+function callSites(file: string): { line: number; window: string }[] {
+  const lines = readFileSync(file, "utf-8").split(/\r?\n/);
+  const hits: { line: number; window: string }[] = [];
+  lines.forEach((raw, i) => {
+    const code = raw.replace(/\/\/.*$/, "");
+    if (RAW_SEND.test(code)) hits.push({ line: i + 1, window: code + (lines[i + 1] ?? "") });
+  });
+  return hits;
+}
+
+describe("every raw-input producer declares itself", () => {
+  const files = ROOTS.flatMap((r) => sources(r));
+
+  it('no /api/send call uses code:"none" without raw:true', () => {
+    const offenders = files.flatMap((f) =>
+      callSites(f)
+        .filter((h) => !/raw:\s*true/.test(h.window))
+        .map((h) => `${f}:${h.line}`),
+    );
+    expect(offenders).toEqual([]);
+  });
+
+  it("still finds the producers (a scan that matches nothing passes forever)", () => {
+    const total = files.reduce((n, f) => n + callSites(f).length, 0);
+    expect(total).toBeGreaterThanOrEqual(3);
+  });
+});

package/ts/rawInputDeclared.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+// #453 made the PRODUCER declare a terminal wire (`raw: true`), because no
+// byte-level predicate on the server may claim a keystroke or a mouse report —
+// those shapes are indistinguishable from a short message. A declaration only
+// works if every producer makes it, and #453 landed it on one of three: the
+// other two kept flooding capacity-capped inboxes, where a mouse scrolled over
+// a pane evicts the real messages behind it.
+//
+// So this is the guard the design needs: any `/api/send` write that declines to
+// submit (`code: "none"`) is raw terminal input and must say so.
+const ROOTS = ["ts", "lab/ui"];
+const SKIP = new Set(["node_modules", "cf", "dist", "public"]);
+const RAW_SEND = /code:\s*"none"/;
+
+function sources(dir: string, out: string[] = []): string[] {
+  for (const e of readdirSync(dir)) {
+    if (SKIP.has(e)) continue;
+    const p = join(dir, e);
+    if (statSync(p).isDirectory()) sources(p, out);
+    else if (/\.(ts|js)$/.test(e) && !/\.spec\./.test(e)) out.push(p);
+  }
+  return out;
+}
+
+/**
+ * Call sites only — prose in a comment describing the protocol is not one.
+ *
+ * Line comments are stripped; block comments deliberately are not. Tracking
+ * them needs a lexer, and getting it wrong wedges the scan silently. Prose
+ * inside a block comment can only ever ADD a false offender, which fails
+ * loudly and is fixed by rewording; it can never hide a real producer. The
+ * count assertion below covers the opposite slip, a scan that stops matching.
+ *
+ * Split on /\r?\n/, not "\n": on a CRLF checkout every line would keep a
+ * trailing \r, and `.` does not match \r in JS, so `//.*$` silently stops
+ * stripping comments and every line of prose about the protocol becomes a
+ * false offender. This test failed on Windows only, for exactly that.
+ */
+function callSites(file: string): { line: number; window: string }[] {
+  const lines = readFileSync(file, "utf-8").split(/\r?\n/);
+  const hits: { line: number; window: string }[] = [];
+  lines.forEach((raw, i) => {
+    const code = raw.replace(/\/\/.*$/, "");
+    if (RAW_SEND.test(code)) hits.push({ line: i + 1, window: code + (lines[i + 1] ?? "") });
+  });
+  return hits;
+}
+
+describe("every raw-input producer declares itself", () => {
+  const files = ROOTS.flatMap((r) => sources(r));
+
+  it('no /api/send call uses code:"none" without raw:true', () => {
+    const offenders = files.flatMap((f) =>
+      callSites(f)
+        .filter((h) => !/raw:\s*true/.test(h.window))
+        .map((h) => `${f}:${h.line}`),
+    );
+    expect(offenders).toEqual([]);
+  });
+
+  it("still finds the producers (a scan that matches nothing passes forever)", () => {
+    const total = files.reduce((n, f) => n + callSites(f).length, 0);
+    expect(total).toBeGreaterThanOrEqual(3);
+  });
+});

package/ts/remoteHealth.bun.spec.ts

@@ -0,0 +1,130 @@
+import { describe, expect, it } from "bun:test";
+import {
+  REMOTE_BACKOFF_BASE_MS,
+  REMOTE_BACKOFF_MAX_MS,
+  noteRemoteResult,
+  pruneRemoteHealth,
+  remoteBackoffMs,
+  shouldSkipRemote,
+} from "./remoteHealth.ts";
+
+describe("remoteHealth.remoteBackoffMs", () => {
+  it("doubles from the base and then holds at the cap", () => {
+    expect(remoteBackoffMs(1)).toBe(REMOTE_BACKOFF_BASE_MS);
+    expect(remoteBackoffMs(2)).toBe(REMOTE_BACKOFF_BASE_MS * 2);
+    expect(remoteBackoffMs(3)).toBe(REMOTE_BACKOFF_BASE_MS * 4);
+    expect(remoteBackoffMs(99)).toBe(REMOTE_BACKOFF_MAX_MS);
+  });
+
+  it("is zero for a host that has not failed — and this GUARDS the clause below", () => {
+    // A streak of 0 must never produce a wait: that is the difference between
+    // "healthy" and "failed once", and getting it wrong skips a live host.
+    expect(remoteBackoffMs(0)).toBe(0);
+    expect(remoteBackoffMs(-1)).toBe(0);
+
+    // This is also the tripwire for `shouldSkipRemote`'s `streak <= 0` clause.
+    // That clause is UNREACHABLE while this holds, which is why no test can
+    // redden it directly — but change the curve so a non-positive streak yields
+    // a non-zero wait and the clause goes LIVE, with nothing behind it, at the
+    // exact moment someone is editing the thing it guards. So the invariant is
+    // pinned HERE, where it is reachable and can fail loudly, instead.
+  });
+
+  it("does not overflow on an absurd streak", () => {
+    // 2 ** 5000 is Infinity; the shift clamp is what keeps this finite.
+    expect(Number.isFinite(remoteBackoffMs(5000))).toBe(true);
+  });
+});
+
+describe("remoteHealth.shouldSkipRemote", () => {
+  const NOW = 1_000_000_000;
+
+  it("never skips a host with no record — the control that matters", () => {
+    // Wrongly skipping makes an agent silently vanish from `ay ls`; wrongly
+    // probing costs one slow list. Those are not symmetric, so the tie goes to
+    // probing, and an unknown host is always probed.
+    expect(shouldSkipRemote(undefined, NOW)).toBe(false);
+    // A cleared host carrying a stale timestamp — what `noteRemoteResult`
+    // produces on success — must also never be skipped. This asserts the
+    // BEHAVIOUR; it does not isolate the `streak <= 0` clause, which is
+    // redundant with `remoteBackoffMs(0) === 0` and cannot be reddened on its
+    // own. Said plainly rather than left looking like coverage it is not.
+    expect(shouldSkipRemote({ streak: 0, lastFailedAt: NOW - 1 }, NOW)).toBe(false);
+    expect(shouldSkipRemote({ streak: -3, lastFailedAt: NOW - 1 }, NOW)).toBe(false);
+  });
+
+  it("skips inside the backoff window and probes again once it elapses", () => {
+    const h = { streak: 1, lastFailedAt: NOW };
+    expect(shouldSkipRemote(h, NOW + REMOTE_BACKOFF_BASE_MS - 1)).toBe(true);
+    expect(shouldSkipRemote(h, NOW + REMOTE_BACKOFF_BASE_MS)).toBe(false);
+  });
+
+  it("probes rather than guesses when the clock has moved backwards", () => {
+    // A backwards clock makes `elapsed` negative, which would otherwise read as
+    // "still inside the window" and skip the host until the clock caught up.
+    expect(shouldSkipRemote({ streak: 3, lastFailedAt: NOW }, NOW - 60_000)).toBe(false);
+  });
+});
+
+describe("remoteHealth.readRemoteHealth validation", () => {
+  it("ignores an entry whose shape it cannot trust", async () => {
+    // The file is derived data in a writable path. A valid-JSON record with a
+    // plausible-looking streak must not be able to hide a live agent, so
+    // anything that is not two finite numbers is dropped rather than trusted.
+    const { mkdtemp, writeFile } = await import("fs/promises");
+    const { tmpdir } = await import("os");
+    const path = (await import("path")).default;
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-health-"));
+    const saved = process.env.AGENT_YES_HOME;
+    process.env.AGENT_YES_HOME = dir;
+    try {
+      await writeFile(
+        path.join(dir, "remote-health.json"),
+        JSON.stringify({
+          good: { streak: 2, lastFailedAt: 123 },
+          missingField: { streak: 2 },
+          wrongType: { streak: "9", lastFailedAt: 1 },
+          notFinite: { streak: Number.POSITIVE_INFINITY, lastFailedAt: 1 },
+          notAnObject: 7,
+        }),
+      );
+      const { readRemoteHealth } = await import("./remoteHealth.ts");
+      expect(await readRemoteHealth()).toEqual({ good: { streak: 2, lastFailedAt: 123 } });
+    } finally {
+      if (saved === undefined) delete process.env.AGENT_YES_HOME;
+      else process.env.AGENT_YES_HOME = saved;
+    }
+  });
+});
+
+describe("remoteHealth.pruneRemoteHealth", () => {
+  it("drops aliases no longer configured, so the file cannot grow forever", () => {
+    const h = {
+      live: { streak: 1, lastFailedAt: 5 },
+      removed: { streak: 9, lastFailedAt: 5 },
+    };
+    expect(pruneRemoteHealth(h, ["live"])).toEqual({ live: { streak: 1, lastFailedAt: 5 } });
+    expect(pruneRemoteHealth(h, [])).toEqual({});
+  });
+});
+
+describe("remoteHealth.noteRemoteResult", () => {
+  const NOW = 1_000_000_000;
+
+  it("clears the streak completely on success", () => {
+    // A host that comes back must return to full speed immediately, not decay
+    // through the backoff it earned while it was down.
+    expect(noteRemoteResult({ streak: 9, lastFailedAt: NOW }, true, NOW + 1)).toEqual({
+      streak: 0,
+      lastFailedAt: 0,
+    });
+  });
+
+  it("extends the streak on failure, from no record and from an existing one", () => {
+    expect(noteRemoteResult(undefined, false, NOW)).toEqual({ streak: 1, lastFailedAt: NOW });
+    expect(noteRemoteResult({ streak: 2, lastFailedAt: 1 }, false, NOW)).toEqual({
+      streak: 3,
+      lastFailedAt: NOW,
+    });
+  });
+});