[schlessera]

Closes #2893
Closes #2889

Fixes the main-red regression from #2830. The failing cell is turn-journal-runtime.test.ts "persisted external memory uses the existing reader and authenticated recovery".

What changed

This PR fixes two things.

1. The test. The journal runtime fixture now awaits the memory copy-out before it ends the memory turn. Since CONTRACT: fix(ui-server): commit journal, Activity and native-lease SQLite off the event loop #2830, persistClaudeMemory may return a promise. The fixture still called memoryState.persist(...) as if it were synchronous and then called finish at once. In production, the Claude backend awaits copy-out before its turn ends: releaseTerminal/emitTerminal → finishWorker → worker.finish() → completions, which include state.persist (packages/ui-backend-claude/src/turn-runner.ts, worker-spawn.ts). The ui-react: the journal runtime test finishes its memory turn before the awaited memory record, failing two cells #2889 hypothesis is therefore correct about the trigger. This is a test-ordering bug, and production's Claude path does not strand a save at finish. Awaiting does not weaken the test. It now models the production order exactly.
2. The journal. CONTRACT: fix(ui-server): commit journal, Activity and native-lease SQLite off the event loop #2830 introduced a product defect that production can reach. persistClaudeMemory and recordClaudeMemory now run in the journal's serialize order, beside observations and finish (packages/ui-server/src/brain/turn-journal.ts:514-544, plus the internal recordClaudeMemory).

The product defect: memory records reuse an observed sequence

observe() reads turn.sequence before its recordObservation commit and assigns the result after it. Before #2830 those steps were synchronous. Now a commit sits between them. A recordClaudeMemory that lands in that window takes ++turn.sequence from the stale base. It reuses an observed change's sequence and the ${turnId}:${sequence} steering_change dedupe key, so the journal UI and version(…, sequence, side) can resolve the wrong change.

Production reaches this window. A Claude memory save is recorded at worker exit, while the 15 s scope timer or another active turn's toolEnded observation can be committing. Revert recovery is a second caller (turn-revert.ts, const target).

Journal-API hardening (same change, not reachable through the Claude backend)

The same ordering also makes the journal API safe for a caller that does not await:

• A save already in flight when finish runs is recorded before the turn ends.
• A save requested after finish is refused before save() writes the external note. Before, it passed the up-front active check, wrote the note, and was refused only at the record step.

The refusal for an inactive turn and its message are unchanged.

Why this shape

• Test-only fix. Awaiting in the test alone makes the main-red pass (receipt below), but it leaves the sequence-reuse defect.
• Letting recordClaudeMemory accept inactive turns. This would hide genuinely late observations, so I did not do it.
• Why serialize. It is the order that begin, finish and observations already share. Memory persistence never waits on a held operation: its writes go through call/retain, not tail. So it cannot deadlock. The public recordClaudeMemory serializes the internal function. Persistence, which is already serialized, calls the internal function directly.
• Other CONTRACT: fix(ui-server): commit journal, Activity and native-lease SQLite off the event loop #2830 await sites checked in turn-journal.ts. bindSession, bindModel, toolStarted/toolEnded, coverPaths, finishReserved, retainBefore, observeUserPolicy, attachWorktree and observe are either synchronous before their first await or already ordered. The Activity recorder has its own orderedWrites order.
• Docs. The ordering is recorded in docs/decisions/sqlite-write-worker.md. Citations moved by the edit are refreshed. The public signatures are unchanged: the API report is identical, and no CONTRACT: change was needed.

Proof

Started from origin/main d9f4405. Merged origin/main 5322d30 (citation-only conflicts, re-pointed). Final head a10edb3.

Failing-first. The three new tests in packages/ui-server/tests/claude-memory-journal.test.ts were run on unfixed origin/main, and again on b192ca0c0 itself in a temporary detached worktree. All three fail for the claimed reason in both runs:

• a memory record made while an observation of its turn commits takes the next free sequence fails with MEMORY_RECORD_NEVER_REUSES_AN_OBSERVED_SEQUENCE. It received [["claude-memory://counsel.md",1],["harbour.md",1]]. This is the product defect.
• a memory save in flight when its turn finishes is recorded before the turn ends fails with … memory observation requires an active turn at recordClaudeMemory ← persistClaudeMemory. This is the main-red stack.
• a memory save requested after its turn's finish is refused before it saves fails with Received message: "… memory observation requires an active turn". The late save had passed the guard and written the note.

The runtime cell. Before either change, -t 'persisted external memory' failed 2/2 locally. With only the test await, on the unfixed origin/main journal, it passes 2/2. With only the journal fix, on the unawaited test, it passes 2/2. With both, the full file passes 24/24.

Mutations (restored after each run):

• M1: persistClaudeMemory unserialized, as (async …)(). The in-flight test fails with memory observation requires an active turn, and the late-save test fails with toThrow(expected).
• M2: the public recordClaudeMemory not serialized. The sequence test fails with MEMORY_RECORD_NEVER_REUSES_AN_OBSERVED_SEQUENCE.

Final head a10edb3 (after merging main):

• bun run test packages/ui-server: 3955 tests in 331 files, exit 0.
• bun run test ./tests: 1954 tests in 177 files, exit 0.
• turn-journal-runtime.test.ts: 24/24.
• bun run check:pr --base origin/main: exit 0.
• Draft CI: CI and contract both success.
• tsc --noEmit, bun run lint, and the citation, api-surface and memory tests (105/105) are clean.

Before the merge:

• bun run test packages/ui-server: 3939 pass, 0 fail (on ebe204d; later commits change only the inline type, docs, the changeset and the ui-react test).
• claude-memory-journal.test.ts: 9/9. tests/api-surface.test.ts plus memory tests: 61/61. decision-citations: 44/44.
• ui-backend-claude memory tests (provider-denied-memory, worker-save-refused) plus the ui-react runtime file: 33/33.
• bun run test ./tests on c8e7c17: exit 0, 1954 tests in 177 files. Penelope/Odysseus … admission appear only as output from an inner planned-failure fixture, and they appear the same way on main.
  • An earlier run also failed api-report/ui-server.txt, because my type alias leaked into the report. Fixed in c8e7c17 by spelling the type inline.
  • That run also failed policy-write-boundary "claude governed". This failure is intermittent on clean origin/main too: 1 of 2 isolated runs failed there, while 2 isolated runs on this head passed. Filed as tests: policy-write-boundary claude governed native Write intermittently refused as not governed #2899.
• tsc --noEmit and bun run lint are clean. bun run check:pr --base origin/main: exit 0 on c8e7c17 and on the final head 8de2ab3.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only (docs/decisions/provider-history.md): the provider-history guard passes, or nothing on a turn's path changed.

Anything left open

• tests: policy-write-boundary claude governed native Write intermittently refused as not governed #2899: the policy-write-boundary flake. It is pre-existing and needs a reproduction.
• docs/process/evidence/test-wait-review-partition.json cites turn-journal.ts:297-301 for the 15 000 ms scope interval. That citation was already off on main; the interval is at begin, now lines 367-370. It is evidence data rather than a docs/ citation, so I left it unchanged.

🤖 Generated with Claude Code