WIP: open/subscribe repos before anchored cold-start reads (branche, non mergée)

Défaut visé : sur une session verifier fraîche (reconnexion), la lecture ancrée
tape des repos pas encore ouverts dans self.repos → 0 ligne. Nouveau module
`open-repo.ts` : `ensureReposOpen`/`ensureRepoOpen` ouvrent/souscrivent un repo
via la primitive existante `subscribeDoc` (doc_subscribe) et attendent le push
d'état initial (borné, sans polling) AVANT la lecture ancrée. Câblé en amont de
`readUnion` (read-model) et `readScopeIndex` (store-registry). Idempotent par
session (Set des NURI ouverts + Map in-flight ; ré-ouverture si la session
injectée change). No-op si le `ng` injecté n'a pas doc_subscribe (fake unitaire).

État — NON MERGÉ, incomplet :
- AIDE le PROTECTED : la participation remonte au cold-start (mesuré app, timing
  un peu bruité).
- N'ADRESSE PAS l'accueil PUBLIC : `readScopeIndex` de l'index public rend 0 même
  côté écrivain même-session — le fix ouvre le repo mais l'index reste vide. Le
  code d'index lib est prouvé scope-symétrique, donc la cause du public est
  ailleurs (broker/store ou chemin app), À MESURER SOUS BROKER (actuellement
  injoignable). Nécessité du fix elle-même non prouvée en e2e lib (broker down).

gate broker-indépendant : tsc --noEmit propre ; bun test 91 pass (worker).
Inclut le scaffolding e2e de repro reconnexion (broker/run/sdk-entry).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/e2e/broker.ts

@@ -13,6 +13,7 @@ import { chromium, type BrowserContext, type Page, type Frame } from "playwright
 import { execSync } from "node:child_process";
 import * as http from "node:http";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -139,6 +140,46 @@ export async function launchWalletContext(): Promise<BrowserContext> {
   });
 }
 
+/**
+ * Launch a persistent context on a FRESH, EMPTY profile dir (its own userDataDir).
+ * Empty local storage ⇒ empty verifier repo cache ⇒ the reconnection cold-start:
+ * the same wallet's repos are on the broker but NOT in this profile's IndexedDB, so
+ * a session over it starts with an empty `self.repos`. Caller must import the wallet
+ * (see {@link importWalletViaFile}) before opening the SDK page. Returns the context
+ * and the dir so the caller can clean it up.
+ */
+export async function launchCleanProfileContext(): Promise<{ ctx: BrowserContext; dir: string }> {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ng-eventually-clean-"));
+  const ctx = await chromium.launchPersistentContext(dir, {
+    headless: true,
+    executablePath: resolveChromePath(),
+    args: LAUNCH_ARGS,
+  });
+  return { ctx, dir };
+}
+
+/**
+ * Import a `.ngw` wallet FILE into the current (clean) profile via the standalone
+ * nextgraph.eu "Import a Wallet File" flow, then unlock it with the password. After
+ * this the profile holds the wallet — but NOT the repos' local cache — so the next
+ * SDK session over it hits the broker-only cold-start. Adapted from the Festipod
+ * app's `importWalletViaFile` (the proven real-broker wallet-file import).
+ */
+export async function importWalletViaFile(page: Page, ngwPath: string): Promise<void> {
+  await page.goto("https://nextgraph.eu/#/wallet/login", { waitUntil: "domcontentloaded" });
+  // Let the SPA render + attach the file input (uploading too early → EncryptionError).
+  await page.waitForTimeout(3000);
+  await page.locator('input[type=file]').waitFor({ state: "attached", timeout: 15000 });
+  await page.setInputFiles('input[type=file]', ngwPath);
+  const passwordInput = page.locator('input[type=password]').first();
+  await passwordInput.waitFor({ state: "visible", timeout: 15000 });
+  await passwordInput.fill(WALLET_PASSWORD);
+  await passwordInput.press("Enter");
+  const confirm = page.getByRole("button", { name: /Confirm/i });
+  if (await confirm.isVisible({ timeout: 2000 }).catch(() => false)) await confirm.click().catch(() => {});
+  await page.waitForTimeout(8000); // unlock + verifier bootstrap from the broker
+}
+
 /**
  * Navigate through the broker (nextgraph.net redirect) to load `appUrl` in the
  * broker iframe; unlock the dedicated wallet if a login is shown; return the app

packages/client/e2e/run.ts

@@ -12,12 +12,17 @@
  * (waitForFunction on a counter), never a blind sleep.
  */
 
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
 import type { Frame, Page, BrowserContext } from "playwright";
 import {
   buildBundle,
   serveHarness,
   ensureWallet,
   launchWalletContext,
+  launchCleanProfileContext,
+  importWalletViaFile,
   setupBrokerPage,
 } from "./broker";
 
@@ -280,6 +285,80 @@ async function main(): Promise<void> {
       const cleared = await sdk<string | null>(frame, "identityClear");
       check("IdentityStore set→get→clear", setr === "@ident-user" && got === "@ident-user" && cleared === null, `set=${setr} get=${got} cleared=${cleared}`);
     });
+
+    // ── reconnection cold-start (real-broker regression) ─────────────────────
+    // Phase 1 (THIS session): seed — create a per-entity doc under (id, protected)
+    // and write a marker triple (`protected` carries participations). Also EXPORT the
+    // wallet `.ngw` so phase 2 can re-import the SAME wallet into a CLEAN browser
+    // profile.
+    //
+    // Phase 2 (the faithful reconnect): import the wallet into a BRAND-NEW empty
+    // profile dir (no local IndexedDB copy of the repos) and open a fresh SDK session
+    // over it — the repos exist on the BROKER but NOT in this profile's local cache,
+    // so this is a true reconnect (not a same-profile relaunch, which masks the gap by
+    // eagerly rehydrating repos from local storage). Then re-read purely from the
+    // wallet and assert the marker comes back.
+    //
+    // FINDING (recorded, see the digest): on THIS SDK/broker version the marker also
+    // comes back WITHOUT the open-before-read heal — the broker-login bootstrap opens
+    // the user's repos before the read (the `rawAnchoredNoOpen` detail below shows the
+    // bare anchored query already resolves rows). So this test is a real-broker
+    // REGRESSION guard for reconnection reads, NOT a fail-without-the-fix proof; the
+    // cold-start the fix targets was diagnosed in the app and does not reproduce
+    // through this harness's login path.
+    console.log("\n── reconnection cold-start (real-broker regression) ──");
+    await step("fresh session (clean profile, same wallet) re-reads a persisted entity doc", async () => {
+      const reconId = "@recon-" + Date.now();
+      const scope = "protected";
+      const seed = await sdk<any>(frame, "reconnectSeed", reconId, scope);
+      check(
+        "seed: entity doc created + listed in the seeding session",
+        seed.listedInSeed.includes(seed.entityNuri),
+        `entity=${String(seed.entityNuri).slice(0, 24)}… listedInSeed=${seed.listedInSeed.length} origSession=${info?.session_id}`,
+      );
+
+      // Export the wallet file and materialize it for the clean-profile import.
+      const exp = await sdk<any>(frame, "exportWalletFile");
+      const ngwPath = path.join(os.tmpdir(), `ng-eventually-recon-${Date.now()}.ngw`);
+      fs.writeFileSync(ngwPath, Buffer.from(exp.b64, "base64"));
+
+      let cleanCtx: BrowserContext | null = null;
+      let cleanDir: string | null = null;
+      let cleanPage: Page | null = null;
+      try {
+        const launched = await launchCleanProfileContext();
+        cleanCtx = launched.ctx;
+        cleanDir = launched.dir;
+        cleanPage = await cleanCtx.newPage();
+        cleanPage.on("pageerror", (e) => console.error("[iframe error:clean]", e.message));
+        cleanPage.on("console", (m) => { if (m.type() === "error") console.error("[iframe console:clean]", m.text()); });
+
+        // Import the SAME wallet into the empty profile (broker-only repos), then open
+        // the SDK page in a fresh broker session over it.
+        await importWalletViaFile(cleanPage, ngwPath);
+        const cleanFrame = await setupBrokerPage(cleanPage, url);
+        await cleanFrame.waitForFunction(() => (window as any).__sdk !== undefined, { timeout: 30000 });
+        await cleanFrame.waitForFunction(() => (window as any).__sdk.status() === "connected", { timeout: 60000 });
+        const cleanInfo = await sdkGet<any>(cleanFrame, "sessionInfo");
+        check(
+          "clean-profile session connected (fresh verifier, broker-only repos)",
+          cleanInfo?.session_id !== undefined && cleanInfo?.session_id !== null,
+          `session=${cleanInfo?.session_id}`,
+        );
+
+        const r = await sdk<any>(cleanFrame, "reconnectRead", reconId, scope, seed.entityNuri, seed.marker);
+        check(
+          "fresh clean-profile session re-reads the persisted marker (reconnection regression)",
+          r.markerPresent === true,
+          `rawAnchoredNoOpen=${r.rawRowCount} listed=${r.listedCount} foundEntity=${r.foundEntity} subjects=${r.subjectCount} markerPresent=${r.markerPresent}`,
+        );
+      } finally {
+        try { if (cleanPage) await cleanPage.close(); } catch { /* ignore */ }
+        try { if (cleanCtx) await cleanCtx.close(); } catch { /* ignore */ }
+        try { if (cleanDir) fs.rmSync(cleanDir, { recursive: true, force: true }); } catch { /* ignore */ }
+        try { fs.rmSync(ngwPath, { force: true }); } catch { /* ignore */ }
+      }
+    });
   } finally {
     try { if (page) await page.close(); } catch { /* ignore */ }
     try { if (ctx) await ctx.close(); } catch { /* ignore */ }

packages/client/e2e/sdk-entry.ts

@@ -70,7 +70,11 @@ configureStoreRegistry({
   // The registry (+ subscribe/inbox/discovery/read-model) reach the session
   // through this. It resolves once the broker connects.
   getSession: async () => {
-    const s = await sessionReady;
+    // Read the CURRENT session (mutable): a fresh session (session_stop+session_start
+    // for the reconnection cold-start test) swaps `session` in place, and the SDK must
+    // route reads/opens through the NEW session_id. Fall back to the first-connect
+    // promise until the initial session lands.
+    const s = session ?? (await sessionReady);
     return {
       sessionId: s.session_id,
       privateStoreId: s.private_store_id,
@@ -107,6 +111,23 @@ const identity = new IdentityStore(
         }
       : null,
 
+  /**
+   * Export the CURRENT wallet as a `.ngw` file, base64-encoded so it can cross the
+   * frame.evaluate bridge back to Node. Used by the reconnection cold-start test to
+   * re-import the SAME wallet into a CLEAN browser profile (empty local repo storage)
+   * — the only faithful way to force the broker-only cold-start (a fresh profile has
+   * no local IndexedDB copy of the repos to eagerly rehydrate).
+   */
+  async exportWalletFile() {
+    const ws = await (realNg as any).get_wallets();
+    const walletName = Object.keys(ws ?? {})[0];
+    const file = await (realNg as any).wallet_get_file(walletName);
+    const bytes = file instanceof Uint8Array ? file : new Uint8Array(file);
+    let bin = "";
+    for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]!);
+    return { walletName, b64: btoa(bin), len: bytes.length };
+  },
+
   // ── docs primitives ──────────────────────────────────────────────────────
   async docCreate() {
     const s = await sessionReady;
@@ -443,6 +464,84 @@ const identity = new IdentityStore(
       leaksB: listA.includes(dB1),
     };
   },
+  /**
+   * RECONNECTION cold-start seed (phase 1, run in the FIRST session).
+   *
+   * Create a per-entity document under (id, scope) — which also appends its NURI to
+   * the account's scope-index document — and write a marker triple INTO the entity
+   * doc (anchored default graph, the canonical shape). Poll until listMyEntityDocs
+   * sees it, so the index append has actually landed on the broker before we tear
+   * the session down. Returns everything the FRESH session needs to re-find it
+   * purely from the persistent wallet: only `id` + `scope` are load-bearing (the
+   * fresh session re-resolves the account from the shim); entityNuri/marker are the
+   * expected values to assert against.
+   */
+  async reconnectSeed(id: string, scope: "public" | "protected" | "private") {
+    storeRegistry.resetRegistryCache();
+    const s = await sessionReady;
+    const entityNuri = await storeRegistry.createEntityDoc(id, scope);
+    const marker = "recon-" + Date.now();
+    await docs.sparqlUpdate(
+      s.session_id,
+      `INSERT DATA { <urn:e2e:recon:subject> <urn:e2e:recon:marker> "${marker}" }`,
+      entityNuri,
+    );
+    // Wait until the index append + the triple are visible in THIS session (the
+    // session that created them — where the repos are already open), so we know the
+    // data is persisted before the fresh session tries to read it back.
+    let listed: string[] = [];
+    for (let i = 0; i < 15; i++) {
+      storeRegistry.resetRegistryCache();
+      listed = await storeRegistry.listMyEntityDocs(id, scope);
+      if (listed.includes(entityNuri)) break;
+      await new Promise((r) => setTimeout(r, 1000));
+    }
+    return { id, scope, entityNuri, marker, listedInSeed: listed };
+  },
+  /**
+   * RECONNECTION read (phase 2, run in a FRESH session over the SAME wallet). First a
+   * DIAGNOSTIC raw anchored read with NO open (rawRowCount), then re-resolve the
+   * account's entity docs of `scope` (listMyEntityDocs → readScopeIndex) and readUnion
+   * them, purely from the persistent wallet — nothing from phase 1's session state
+   * carries over. The SDK's open-before-read heal (open-repo.ts) opens each repo via
+   * doc_subscribe before the anchored reads. NB: on the SDK/broker version tested here
+   * the broker-login bootstrap already opens the user's repos, so rawRowCount is
+   * non-zero even without the heal — this is a reconnection REGRESSION guard, not a
+   * fail-without-the-fix proof (see run.ts's reconnection step comment).
+   */
+  async reconnectRead(id: string, scope: "public" | "protected" | "private", entityNuri: string, marker: string) {
+    // DIAGNOSTIC: a RAW anchored read of the entity doc with NO open at all, first
+    // thing in the fresh session — reports how many rows the bare anchored query
+    // resolves for a not-yet-opened repo (the premise: 0 until opened). Uses the
+    // low-level docs primitive directly, bypassing readUnion's open step.
+    const s = session ?? (await sessionReady);
+    let rawRowCount = -1;
+    try {
+      const raw: any = await docs.sparqlQuery(s.session_id, "SELECT ?s ?p ?o WHERE { ?s ?p ?o }", undefined, entityNuri);
+      rawRowCount = Array.isArray(raw) ? raw.length : (raw?.results?.bindings?.length ?? 0);
+    } catch (e: any) {
+      rawRowCount = -2; // threw (e.g. RepoNotFound / InvalidNuri)
+    }
+
+    storeRegistry.resetRegistryCache();
+    const listed = await storeRegistry.listMyEntityDocs(id, scope);
+    const subjects = await readModel.readUnion(listed.length ? listed : [entityNuri]);
+    const markers: string[] = [];
+    for (const subj of subjects) {
+      for (const vals of Object.values(subj.props)) {
+        for (const v of vals) markers.push(v);
+      }
+    }
+    return {
+      rawRowCount,
+      listed,
+      listedCount: listed.length,
+      foundEntity: listed.includes(entityNuri),
+      subjectCount: subjects.length,
+      markerPresent: markers.includes(marker),
+      markers,
+    };
+  },
   async scopeResolvers() {
     const priv = await storeRegistry.resolveScopeGraph("private");
     const prot = await storeRegistry.resolveScopeGraph("protected");