fix: dire le pari comme un pari, et distinguer deux manques d'inbox que rien ne distinguait

packages/polyfill/test/continuous-inbox-observation.test.ts

@@ -31,7 +31,7 @@
 import { test, expect, describe, afterAll, beforeEach } from "bun:test";
 import { inbox as inboxSurface, storeRegistry } from "../src/index";
 import { getCaps, setCurrentUser } from "../src/shared-wallet/bootstrap";
-import { resolveAccount, userInbox } from "../src/shared-wallet/account-registry";
+import { resetRegistryCache, resolveAccount, userInbox } from "../src/shared-wallet/account-registry";
 import { observationSettled } from "../src/emulated-verifier/inbox-observer";
 import { cancelScheduledInboxProcessing } from "../src/emulated-verifier/inbox-processor";
 import { connectedUser } from "../src/emulated-verifier/connect";
@@ -105,6 +105,17 @@ function depositReadsOf(inbox: Nuri): number {
   ).length;
 }
 
+/**
+ * The doc-shim, read off the WALLET — the document the account records live in, and the one
+ * `userInbox` asks "which inbox does this user own". Found by the record it carries rather
+ * than by a minting order, so it is the shim because of what is written in it.
+ */
+function theDocShim(): Nuri {
+  const record = quads.find((q) => q.p === `${SHIM}:id`);
+  if (!record) throw new Error("no account record was written, so there is no doc-shim to name");
+  return record.g as Nuri;
+}
+
 /** The inbox recorded for a note, read off the WALLET — no application can ask the package. */
 function inboxOnTheNote(note: Nuri): Nuri {
   const record = quads.find((q) => q.p === `${SHIM}:inboxCap` && q.o.startsWith(note + " "));
@@ -527,6 +538,37 @@ describe("listing the inboxes when one of the two registers cannot be read", ()
     expect(partial.inboxes).not.toContain(inboxOnTheNote(note));
   });
 
+  /**
+   * The two shortfalls are not degrees of one condition — they are two, and the worse one is
+   * the one this suite exists for. The account record names the user's OWN two inboxes, which
+   * is where a share addressed to a PERSON lands, and it is also what the other half reads
+   * THROUGH; losing it means nothing at all is watched. Losing the User branch means those two
+   * are watched and only the per-document inboxes are missing. A caller handed `error` alone
+   * cannot tell which it is holding.
+   */
+  test("names WHICH register fell short, and the account record is the worse one", async () => {
+    await bobSharesWithAlice();
+    await converge(); // let the depositor's own session finish before the broker breaks
+    const shim = theDocShim();
+    // Another session, so nothing is answered from a warm cache. Her record is read first —
+    // that is what connecting does — and the broker goes away between that read and the one
+    // that names her inboxes. Both live in the doc-shim, so this is one hiccup, mid-list.
+    resetRegistryCache();
+    setCurrentUser("alice");
+    expect(await resolveAccount("alice")).not.toBeNull();
+    fake._failReadsOn.add(shim);
+    const listed = await enumerateMyInboxes();
+    fake._failReadsOn.delete(shim);
+
+    expect(listed.incomplete?.register).toBe("account-record");
+    expect(String(listed.incomplete?.error)).toContain("RepoNotFound");
+    // Nothing came back: not one inbox of hers can be named, so not one can be watched. That
+    // is what makes this shortfall a different report from the other one and not a louder
+    // copy of it — there, her own two are in the list.
+    expect(listed.inboxes).toEqual([]);
+    await converge();
+  });
+
   test("still REJECTS for the caller that cannot use a partial list", async () => {
     await signIn("alice");
     await storeRegistry.openDocumentInbox(await storeRegistry.createEntityDoc("public"));
@@ -596,6 +638,56 @@ describe("a register that stays unreadable", () => {
     expect(reported.filter((l) => /could not all be listed/.test(l))).toHaveLength(1);
   });
 
+  /**
+   * A shortfall is deduplicated per REGISTER, because there are two of them and they are not
+   * the same news.
+   *
+   * The account record failing leaves this identity with NOTHING watched — its own two
+   * inboxes included, which is where a share addressed to a PERSON lands. The User branch
+   * failing leaves those two watched and only the per-document inboxes missing. Remembering
+   * merely that "something was already said" made the second condition arrive in silence: the
+   * log went on describing a state that had stopped being the one the identity was in.
+   */
+  test("a shortfall on the OTHER register is reported, not swallowed as already said", async () => {
+    await bobSharesWithAlice();
+    await converge();
+    const shim = theDocShim();
+    const store = (await resolveAccount("alice"))?.docPrivate;
+    if (store === undefined) throw new Error("the fixture did not give Alice a private store");
+
+    const reported = await whileWatchingTheLog(async () => {
+      // Another session. Connecting reads her account record first, and the doc-shim goes
+      // away right after — so her own two inboxes cannot even be NAMED, and the document
+      // half is never reached. `signIn` taken in its two steps, which is all it is, so the
+      // hiccup can land where a hiccup lands: in the middle.
+      resetRegistryCache();
+      setCurrentUser("alice");
+      expect(await resolveAccount("alice")).not.toBeNull();
+      fake._failReadsOn.add(shim);
+      try {
+        await connectedUser();
+      } catch {
+        // The restore rejects on the unreadable shim; she is connected regardless.
+      }
+      await converge();
+
+      // The doc-shim answers again and the private store stops instead: her own two inboxes
+      // are watched now, and only the ones opened on documents are missing. A milder
+      // condition, a different one — and the application creating something is what makes
+      // the observation look again (`CapRegistry.onChange`).
+      fake._failReadsOn.delete(shim);
+      fake._failReadsOn.add(store);
+      await storeRegistry.createEntityDoc("protected");
+      await converge();
+    });
+    fake._failReadsOn.delete(store);
+
+    const shortfalls = reported.filter((l) => /could not all be listed/.test(l));
+    expect(shortfalls).toHaveLength(2);
+    expect(shortfalls.filter((l) => /the account record/.test(l))).toHaveLength(1);
+    expect(shortfalls.filter((l) => /inboxes opened on documents/.test(l))).toHaveLength(1);
+  });
+
   /**
    * Once per OCCURRENCE, and a second occurrence is a real one.
    *