Merge branch 'release/8.10.1'

# Conflicts:
#	.forgejo/workflows/ci.yml

tests/unit/brainy/maintenance-debt.test.ts

@@ -0,0 +1,122 @@
+/**
+ * @module tests/unit/brainy/maintenance-debt
+ * @description Coverage for `brain.maintenanceDebt()` (8.10.1) — the
+ * observability seam so an operator sees a provider's outstanding background
+ * maintenance work (compaction, deferred writes, a build-new→verify→swap in
+ * flight, ...) BEFORE it grinds a transaction into a budget-busting op, the
+ * same failure class documented on `TransactionTimeoutError`
+ * (src/transaction/errors.ts). Sibling to tests/unit/brainy/warm.test.ts,
+ * which establishes this file's technique: shape the probe points brain.ts
+ * reads (`typeof provider.maintenanceDebt === 'function'`) directly on the
+ * REAL, live provider instances rather than hand-rolling full fakes for the
+ * larger `MetadataIndexProvider` / `GraphIndexProvider` interfaces.
+ *
+ * `brain.maintenanceDebt()` is a PURE PASSTHROUGH: no thresholds, no
+ * polling, no JS-side estimation — these tests pin exactly that by asserting
+ * the returned payload is the provider's object, verbatim.
+ */
+import { describe, it, expect } from 'vitest'
+import { Brainy } from '../../../src/brainy.js'
+import { NounType } from '../../../src/types/graphTypes.js'
+import type { ProviderMaintenanceDebt } from '../../../src/plugin.js'
+
+// Brainy's ValidationConfig fixes vectors at exactly 384 dimensions
+// (src/utils/paramValidation.ts) — match it so add() doesn't reject test data.
+const DIM = 384
+const V = (seed = 1): number[] => Array.from({ length: DIM }, (_, i) => Math.sin(seed + i))
+
+async function freshBrain(): Promise<Brainy<any>> {
+  const brain = new Brainy({
+    requireSubtype: false,
+    storage: { type: 'memory' },
+    silent: true
+  })
+  await brain.init()
+  await brain.add({ data: 'a', type: NounType.Thing, vector: V(1) })
+  return brain
+}
+
+describe('brain.maintenanceDebt()', () => {
+  it('reports "unavailable" for every surface when no active provider implements maintenanceDebt() (the built-in JS stack today)', async () => {
+    const brain = await freshBrain()
+
+    const report = await brain.maintenanceDebt()
+
+    expect(report.vector.outcome).toBe('unavailable')
+    expect(report.vector.debt).toBeUndefined()
+    expect(report.metadata.outcome).toBe('unavailable')
+    expect(report.metadata.debt).toBeUndefined()
+    expect(report.graph.outcome).toBe('unavailable')
+    expect(report.graph.debt).toBeUndefined()
+
+    await brain.close()
+  })
+
+  it('reports "reported" + the exact payload when the active provider implements maintenanceDebt() (verbatim passthrough, no thresholding)', async () => {
+    const brain = await freshBrain()
+
+    const vectorDebt: ProviderMaintenanceDebt = {
+      pendingBytes: 4_096,
+      pendingItems: 12,
+      lastPassCompletedAt: 1_700_000_000_000,
+      lastPassOutcome: 'completed',
+      converging: true
+    }
+    ;(brain as any).index.maintenanceDebt = async () => vectorDebt
+
+    const report = await brain.maintenanceDebt()
+
+    expect(report.vector.outcome).toBe('reported')
+    // Verbatim passthrough — the exact object, not a re-derived copy.
+    expect(report.vector.debt).toBe(vectorDebt)
+    // Untouched surfaces stay honestly 'unavailable'.
+    expect(report.metadata.outcome).toBe('unavailable')
+    expect(report.graph.outcome).toBe('unavailable')
+
+    await brain.close()
+  })
+
+  it('mixed surfaces: each surface\'s outcome depends ONLY on its OWN active provider — one surface reporting never leaks into another', async () => {
+    const brain = await freshBrain()
+
+    const metadataDebt: ProviderMaintenanceDebt = {
+      pendingItems: 3,
+      lastPassOutcome: 'partial',
+      converging: false
+    }
+    const graphDebt: ProviderMaintenanceDebt = {
+      pendingBytes: 0,
+      converging: true
+    }
+    ;(brain as any).metadataIndex.maintenanceDebt = async () => metadataDebt
+    ;(brain as any).graphIndex.maintenanceDebt = async () => graphDebt
+    // Vector is deliberately left unpatched.
+
+    const report = await brain.maintenanceDebt()
+
+    expect(report.vector.outcome).toBe('unavailable')
+    expect(report.vector.debt).toBeUndefined()
+
+    expect(report.metadata.outcome).toBe('reported')
+    expect(report.metadata.debt).toBe(metadataDebt)
+
+    expect(report.graph.outcome).toBe('reported')
+    expect(report.graph.debt).toBe(graphDebt)
+
+    await brain.close()
+  })
+
+  it('an empty ProviderMaintenanceDebt object (every field omitted) is still honestly "reported" — presence of the hook, not the payload\'s richness, drives the outcome', async () => {
+    const brain = await freshBrain()
+
+    const emptyDebt: ProviderMaintenanceDebt = {}
+    ;(brain as any).graphIndex.maintenanceDebt = async () => emptyDebt
+
+    const report = await brain.maintenanceDebt()
+
+    expect(report.graph.outcome).toBe('reported')
+    expect(report.graph.debt).toEqual({})
+
+    await brain.close()
+  })
+})

tests/unit/brainy/warm.test.ts

@@ -307,4 +307,92 @@ describe('brain.warm()', () => {
     expect(report.totalDurationMs).toBeGreaterThanOrEqual(0)
     await brain.close()
   })
+
+  // --- Metadata leg routes through the ACTIVE provider (8.10.1) -----------
+  //
+  // `MetadataIndexProvider` is a ~50-method interface (src/plugin.ts) — far
+  // too large to hand-write a compliant fake class the way `FakeVectorProvider`
+  // fakes the ~8-method `VectorIndexProvider` above. Test (c) already
+  // establishes this file's pattern for the metadata leg: exercise the REAL
+  // `MetadataIndexManager` instance and shape just the probe points brain.ts
+  // reads (`typeof provider.warm === 'function'` /
+  // `typeof provider.hydrateAll === 'function'`) directly on that instance.
+  // Shadowing an own property on the live object stands in for "a different
+  // provider implementation" without needing a hand-rolled full fake — the
+  // rest of the real manager (used by add()/init() above) is untouched.
+  describe('metadata leg — warm() routes through the active provider', () => {
+    it('(f) calls the ACTIVE metadata provider\'s warm() when present and reports "warmed", never falling back to hydrateAll', async () => {
+      const brain = new Brainy({
+        requireSubtype: false,
+        storage: { type: 'memory' },
+        silent: true
+      })
+      await brain.init()
+      await brain.add({ data: 'a', type: NounType.Thing, vector: V(1) })
+
+      const metadataIndex = (brain as any).metadataIndex
+      let warmCalls = 0
+      let hydrateAllCalls = 0
+      const origHydrateAll = metadataIndex.hydrateAll.bind(metadataIndex)
+      metadataIndex.hydrateAll = async (...args: unknown[]) => {
+        hydrateAllCalls++
+        return origHydrateAll(...args)
+      }
+      // Simulates a native metadata provider declaring the optional `warm()`
+      // hook added to `MetadataIndexProvider` (src/plugin.ts) in 8.10.1.
+      metadataIndex.warm = async () => {
+        warmCalls++
+      }
+
+      const report = await brain.warm()
+
+      expect(warmCalls).toBe(1)
+      expect(hydrateAllCalls).toBe(0) // warm() ran — no hydrateAll fallback
+      expect(report.metadata.outcome).toBe('warmed')
+      await brain.close()
+    })
+
+    it('reports "unavailable" when the active metadata provider implements neither warm() nor hydrateAll() (the honest branch a native provider without either hook must hit)', async () => {
+      const brain = new Brainy({
+        requireSubtype: false,
+        storage: { type: 'memory' },
+        silent: true
+      })
+      await brain.init()
+      await brain.add({ data: 'a', type: NounType.Thing, vector: V(1) })
+
+      const metadataIndex = (brain as any).metadataIndex
+      // Shadow away BOTH optional hooks — models a genuinely native provider
+      // that (unlike the built-in JS manager) offers neither seam. This must
+      // never fall back to calling init() as a stand-in for warmth.
+      metadataIndex.warm = undefined
+      metadataIndex.hydrateAll = undefined
+
+      const report = await brain.warm()
+
+      expect(report.metadata.outcome).toBe('unavailable')
+      await brain.close()
+    })
+
+    it('the built-in JS manager (no warm()) still reports "warmed" via its existing hydrateAll() duck-type — unchanged by the new provider hook', async () => {
+      const brain = new Brainy({
+        requireSubtype: false,
+        storage: { type: 'memory' },
+        silent: true
+      })
+      await brain.init()
+      await brain.add({ data: 'a', type: NounType.Thing, vector: V(1) })
+
+      // No patching at all — the default built-in MetadataIndexManager has
+      // hydrateAll() but no warm(), exactly as it did before this change.
+      const metadataIndex = (brain as any).metadataIndex
+      expect(typeof metadataIndex.warm).not.toBe('function')
+      expect(typeof metadataIndex.hydrateAll).toBe('function')
+
+      const report = await brain.warm()
+
+      expect(report.metadata.outcome).toBe('warmed')
+      await brain.close()
+    })
+  })
 })

tests/unit/transaction/timeout-never-internally-retried.test.ts

@@ -0,0 +1,141 @@
+/**
+ * @module tests/unit/transaction/timeout-never-internally-retried
+ * @description Regression pin for the no-hot-retry contract (8.10.1).
+ *
+ * A production incident: a native-provider op ground 38-40s inside a
+ * transaction, blew the ~32s budget, was rolled back, and a CONSUMER pipeline
+ * hot-retried the identical operation into a 6-minute 100%-CPU storm.
+ * Investigation established brainy itself never auto-retries a
+ * `TransactionTimeoutError` — the storm was entirely the consumer's hot-retry
+ * loop, driven by a "retryable" doc-prose claim with no machine-readable
+ * contract. This file pins the brainy-side half of that story so it can never
+ * regress silently:
+ *
+ * (i)  the underlying engine (`TransactionManager.executeTransaction()` →
+ *      `Transaction.execute()`) — the exact machinery every single-record
+ *      write (`add`/`update`/`remove`/...) drives via
+ *      `Brainy.persistSingleOp()` — never internally re-executes a timed-out
+ *      operation, and the error it surfaces carries `retryable === true` and
+ *      `hotRetryUnsafe === true` (see `src/transaction/errors.ts`).
+ *
+ *      Constructed directly (mirrors the existing
+ *      `tests/unit/transaction/timeout-rollback.test.ts` pattern) rather than
+ *      through a real `brain.add()` call: `transactTimeoutBudget()` floors
+ *      every single-op write's budget at `opCount * 2000`ms with NO override
+ *      seam (`transactionBudgetFloorMs` only RAISES that floor — it cannot
+ *      lower it below the per-op-count term), so getting a real `add()` to
+ *      time out requires a multi-second sleep. The engine-level
+ *      `options.timeout` override used here is the exact same
+ *      `TransactionManager`/`Transaction` code `persistSingleOp` calls —
+ *      pinning it here pins add()'s guarantee without paying that wall-clock
+ *      cost.
+ *
+ * (ii) `Brainy.add()`'s upsert-race retry loop (src/brainy.ts,
+ *      `MAX_UPSERT_ATTEMPTS = 10`) — proving the loop's `catch` treats a
+ *      `TransactionTimeoutError` as terminal (immediate rethrow) rather than
+ *      the `InsertPreconditionExistsSignal` it retries on, so a mid-flight
+ *      timeout can never be silently swallowed and re-attempted up to 10
+ *      times.
+ */
+import { describe, it, expect } from 'vitest'
+import { TransactionManager } from '../../../src/transaction/TransactionManager.js'
+import type { Operation, RollbackAction } from '../../../src/transaction/types.js'
+import { TransactionTimeoutError } from '../../../src/transaction/errors.js'
+import { Brainy } from '../../../src/brainy.js'
+import { NounType } from '../../../src/types/graphTypes.js'
+
+const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))
+
+// Brainy's ValidationConfig fixes vectors at exactly 384 dimensions
+// (src/utils/paramValidation.ts) — match it so add() doesn't reject test data.
+const DIM = 384
+const V = (): number[] => Array(DIM).fill(0.1)
+
+/** An operation that counts every `execute()` invocation — the re-drive detector. */
+function countingOp(opts: { delayMs?: number; name: string }): Operation & { calls: number } {
+  const op = {
+    name: opts.name,
+    calls: 0,
+    async execute(): Promise<RollbackAction | undefined> {
+      op.calls++
+      if (opts.delayMs) await sleep(opts.delayMs)
+      return async () => {}
+    }
+  }
+  return op
+}
+
+describe('transaction timeouts are never internally re-driven (8.10.1 no-hot-retry contract)', () => {
+  it('(i) the single-op engine (TransactionManager.executeTransaction / Transaction.execute — what add() drives via persistSingleOp) runs the overrun operation EXACTLY once and surfaces ONE retryable+hotRetryUnsafe error', async () => {
+    const manager = new TransactionManager()
+    const op0 = countingOp({ name: 'op0-overruns-budget', delayMs: 30 })
+    const op1 = countingOp({ name: 'op1-must-never-start' })
+
+    let caught: unknown
+    try {
+      await manager.executeTransaction(
+        async (tx) => {
+          tx.addOperation(op0)
+          tx.addOperation(op1)
+        },
+        // Tiny explicit override — the same override seam `transact()`
+        // exposes as `options.timeoutMs`; wins outright over the
+        // opCount*2000 floor that gates every real single-op write
+        // (transactTimeoutBudget()'s override semantics).
+        { timeout: 5 }
+      )
+    } catch (err) {
+      caught = err
+    }
+
+    expect(caught).toBeInstanceOf(TransactionTimeoutError)
+    const err = caught as TransactionTimeoutError
+    // The machine-readable contract callers branch on instead of parsing
+    // message text (src/transaction/errors.ts).
+    expect(err.retryable).toBe(true)
+    expect(err.hotRetryUnsafe).toBe(true)
+
+    // The re-drive assertion: op0 (the one that overran) executed EXACTLY
+    // once — nothing inside TransactionManager/Transaction looped back and
+    // re-ran it — and op1 never started at all (the budget gate stopped it
+    // before it began, per Transaction.execute()'s per-operation loop).
+    expect(op0.calls).toBe(1)
+    expect(op1.calls).toBe(0)
+  })
+
+  it('(ii) add()\'s upsert-race retry loop (MAX_UPSERT_ATTEMPTS=10) exits on the FIRST TransactionTimeoutError — attempt counter stays at 1, never mistaken for the lost-insert-race signal it retries on', async () => {
+    const brain = new Brainy({
+      requireSubtype: false,
+      storage: { type: 'memory' },
+      silent: true
+    })
+    await brain.init()
+
+    let persistSingleOpCalls = 0
+    const timeoutError = new TransactionTimeoutError(5, 1, {
+      elapsedMs: 6,
+      totalOperations: 2,
+      operationName: 'SaveNounMetadata'
+    })
+    // Stub the private commit seam add() drives (persistSingleOp) to throw
+    // the exact error type the real engine surfaces on a mid-flight timeout.
+    // This test pins the upsert loop's EXCEPTION-HANDLING contract (does it
+    // retry a TransactionTimeoutError like it retries
+    // InsertPreconditionExistsSignal?), not the timing mechanics of a real
+    // timeout — those are pinned by test (i) and by
+    // tests/unit/transaction/timeout-rollback.test.ts.
+    ;(brain as any).persistSingleOp = async (): Promise<never> => {
+      persistSingleOpCalls++
+      throw timeoutError
+    }
+
+    await expect(
+      brain.add({ data: 'a', type: NounType.Thing, vector: V() })
+    ).rejects.toBe(timeoutError)
+
+    // The loop's attempt counter: exactly one call, never retried up to
+    // MAX_UPSERT_ATTEMPTS.
+    expect(persistSingleOpCalls).toBe(1)
+    await brain.close()
+  })
+})