fix(world-lab): archive large exports compactly

apps/game-api/src/app.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
+import { createHash } from 'node:crypto';
 import {
   AgentProviderError,
   BrowserTestAgentProvider,
@@ -1143,6 +1144,99 @@ describe('game API simulation boundary', () => {
     ).toMatchObject({ inserted: 3, idempotent: false });
   });
 
+  it('regenerates and verifies an exact artifact from a compact archive request', async () => {
+    const archiveExperimentExport = vi.fn(
+      (document: ExperimentExportDocument) => ({
+        experimentId: document.experiment.id,
+        inserted: 3,
+        existing: 0,
+        skipped: 0,
+        rejected: 0,
+        idempotent: false,
+      }),
+    );
+    const app = createApp({ archiveExperimentExport });
+    const request = {
+      agents: { mode: 'all' as const },
+      turns: { mode: 'entire-retained' as const },
+      outcomes: ['accepted' as const],
+      actions: ['wait' as const],
+      level: 'full-safe' as const,
+    };
+    const generatedResponse = await app.request(
+      '/api/simulation/experiment/export',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(request),
+      },
+    );
+    const generated = experimentExportResponseSchema.parse(
+      await generatedResponse.json(),
+    );
+    const response = await app.request(
+      '/api/simulation/experiment/export/archive',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          request,
+          generatedAt: generated.document.generatedAt,
+          sha256: createHash('sha256')
+            .update(JSON.stringify(generated.document))
+            .digest('hex'),
+        }),
+      },
+    );
+    expect(response.status).toBe(200);
+    expect(archiveExperimentExport).toHaveBeenCalledWith(generated.document);
+  });
+
+  it('rejects a compact archive request when the generated artifact changed', async () => {
+    const archiveExperimentExport = vi.fn();
+    const app = createApp({ archiveExperimentExport });
+    const exportRequest = {
+      agents: { mode: 'all' as const },
+      turns: { mode: 'entire-retained' as const },
+      outcomes: ['accepted' as const],
+      actions: ['wait' as const],
+      level: 'full-safe' as const,
+    };
+    const generatedResponse = await app.request(
+      '/api/simulation/experiment/export',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(exportRequest),
+      },
+    );
+    expect(generatedResponse.status).toBe(200);
+    const generated = experimentExportResponseSchema.parse(
+      await generatedResponse.json(),
+    );
+    const response = await app.request(
+      '/api/simulation/experiment/export/archive',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          request: generated.document.filters,
+          generatedAt: generated.document.generatedAt,
+          sha256: '0'.repeat(64),
+        }),
+      },
+    );
+    expect(response.status).toBe(409);
+    await expect(response.json()).resolves.toEqual({
+      error: {
+        code: 'artifact_changed',
+        message:
+          'The experiment changed after this export was generated. Generate it again before saving.',
+      },
+    });
+    expect(archiveExperimentExport).not.toHaveBeenCalled();
+  });
+
   it('rejects invalid archive artifacts before invoking persistence', async () => {
     const archiveExperimentExport = vi.fn();
     const app = createApp({ archiveExperimentExport });

apps/game-api/src/app.ts

@@ -1,5 +1,6 @@
 import { Hono, type Context } from 'hono';
 import { cors } from 'hono/cors';
+import { createHash } from 'node:crypto';
 import {
   BrowserTestAgentProvider,
   AgentProviderError,
@@ -865,9 +866,31 @@ export function createApp(options: AppOptions = {}) {
         400,
       );
     try {
+      const document =
+        'document' in request.data
+          ? request.data.document
+          : service.generateExperimentExport(
+              request.data.request,
+              request.data.generatedAt,
+            );
+      if (
+        'sha256' in request.data &&
+        createHash('sha256').update(JSON.stringify(document)).digest('hex') !==
+          request.data.sha256
+      )
+        return context.json(
+          apiErrorSchema.parse({
+            error: {
+              code: 'artifact_changed',
+              message:
+                'The experiment changed after this export was generated. Generate it again before saving.',
+            },
+          }),
+          409,
+        );
       return context.json(
         archiveExperimentExportResponseSchema.parse(
-          await archiveExperimentExport(request.data.document),
+          await archiveExperimentExport(document),
         ),
       );
     } catch (error) {

apps/game-api/src/simulation-service.ts

@@ -845,13 +845,16 @@ export class SimulationService {
     );
   }
 
-  generateExperimentExport(request: unknown): ExperimentExportDocument {
+  generateExperimentExport(
+    request: unknown,
+    generatedAt = this.#now(),
+  ): ExperimentExportDocument {
     if (this.#busy || this.#verificationBusy)
       throw new SimulationConflictError(
         'Export is unavailable while model execution is in progress.',
       );
     return experimentExportDocumentSchema.parse(
-      createExperimentExport(this.#experimentSource(), request, this.#now()),
+      createExperimentExport(this.#experimentSource(), request, generatedAt),
     );
   }
 

apps/world-lab/src/components/world-lab.test.tsx

@@ -1023,6 +1023,15 @@ async function openOverflow(user: ReturnType<typeof userEvent.setup>) {
   if (!menu.closest('details')?.hasAttribute('open')) await user.click(menu);
 }
 
+async function selectMinimalFixtureExport(
+  user: ReturnType<typeof userEvent.setup>,
+) {
+  await user.click(screen.getByRole('button', { name: 'Clear' }));
+  await user.click(screen.getByRole('checkbox', { name: /Ember/ }));
+  await user.click(screen.getByRole('checkbox', { name: 'lost tick' }));
+  await user.click(screen.getByRole('checkbox', { name: 'operator skipped' }));
+}
+
 async function openAgentsWorkspace(user: ReturnType<typeof userEvent.setup>) {
   await user.click(await screen.findByRole('button', { name: 'Agents' }));
 }
@@ -3216,6 +3225,7 @@ describe('WorldLab', () => {
     render(<WorldLab />);
     await openOverflow(user);
     await user.click(screen.getByRole('button', { name: 'Export' }));
+    await selectMinimalFixtureExport(user);
     expect(screen.getByRole('button', { name: 'Copy JSON' })).toBeDisabled();
     expect(
       screen.getByRole('button', { name: 'Download JSON' }),
@@ -3254,7 +3264,9 @@ describe('WorldLab', () => {
     const requestsBeforeArchive = fetchMock.mock.calls.length;
     fireEvent.click(archiveButton);
     fireEvent.click(archiveButton);
-    expect(fetchMock.mock.calls).toHaveLength(requestsBeforeArchive + 1);
+    await waitFor(() =>
+      expect(fetchMock.mock.calls).toHaveLength(requestsBeforeArchive + 1),
+    );
     expect(screen.getByRole('button', { name: 'Saving…' })).toBeDisabled();
     resolveArchive(
       await jsonResponse({
@@ -3266,13 +3278,24 @@ describe('WorldLab', () => {
         idempotent: false,
       }),
     );
-    expect(fetchMock.mock.calls.at(-1)).toEqual([
+    const [archiveUrl, archiveInit] = fetchMock.mock.calls.at(-1)!;
+    expect(archiveUrl).toEqual(
       expect.stringMatching(/\/experiment\/export\/archive$/),
+    );
+    expect(archiveInit).toEqual(
       expect.objectContaining({
         method: 'POST',
-        body: JSON.stringify({ document: validatedDocument }),
+        signal: expect.any(AbortSignal),
       }),
-    ]);
+    );
+    const archiveBody = JSON.parse(String(archiveInit?.body));
+    expect(archiveBody).toMatchObject({
+      request: validatedDocument.filters,
+      generatedAt: validatedDocument.generatedAt,
+      sha256: expect.stringMatching(/^[a-f0-9]{64}$/),
+    });
+    expect(archiveBody).not.toHaveProperty('document');
+    expect(String(archiveInit?.body).length).toBeLessThan(10_000);
     expect(await screen.findByText(/saved to SQLite/)).toBeInTheDocument();
     fetchMock.mockRejectedValueOnce(new Error('archive unavailable'));
     await user.click(screen.getByRole('button', { name: 'Save to SQLite' }));
@@ -3302,6 +3325,102 @@ describe('WorldLab', () => {
     click.mockRestore();
   });
 
+  it('invalidates a generated artifact when compact SQLite archival reports it changed', async () => {
+    const user = userEvent.setup();
+    const progressed = afterInfection();
+    const fetchMock = vi.fn<typeof fetch>(async () => jsonResponse(progressed));
+    vi.stubGlobal('fetch', fetchMock);
+    render(<WorldLab />);
+    await openOverflow(user);
+    await user.click(screen.getByRole('button', { name: 'Export' }));
+    await selectMinimalFixtureExport(user);
+    const document = minimalExportDocument(progressed);
+    fetchMock.mockImplementationOnce(() => jsonResponse({ document }));
+    await user.click(screen.getByRole('button', { name: 'Generate export' }));
+    expect(
+      await screen.findByRole('button', { name: 'Save to SQLite' }),
+    ).toBeEnabled();
+    fetchMock.mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          error: {
+            code: 'artifact_changed',
+            message:
+              'The experiment changed after this export was generated. Generate it again before saving.',
+          },
+        }),
+        {
+          status: 409,
+          headers: { 'Content-Type': 'application/json' },
+        },
+      ),
+    );
+    await user.click(screen.getByRole('button', { name: 'Save to SQLite' }));
+    expect(
+      await screen.findByText(
+        'The experiment changed after this export was generated. Generate it again before saving.',
+      ),
+    ).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: 'Copy JSON' })).toBeDisabled();
+    expect(
+      screen.getByRole('button', { name: 'Download JSON' }),
+    ).toBeDisabled();
+    expect(
+      screen.getByRole('button', { name: 'Save to SQLite' }),
+    ).toBeDisabled();
+    expect(
+      screen.getByRole('button', { name: 'Generate export' }),
+    ).toBeEnabled();
+    expect(screen.queryByText(/saved to SQLite/)).not.toBeInTheDocument();
+  });
+
+  it('aborts a stalled compact SQLite archive request after ten seconds', async () => {
+    const user = userEvent.setup();
+    const progressed = afterInfection();
+    const fetchMock = vi.fn<typeof fetch>(async () => jsonResponse(progressed));
+    vi.stubGlobal('fetch', fetchMock);
+    render(<WorldLab />);
+    await openOverflow(user);
+    await user.click(screen.getByRole('button', { name: 'Export' }));
+    await selectMinimalFixtureExport(user);
+    const document = minimalExportDocument(progressed);
+    fetchMock.mockImplementationOnce(() => jsonResponse({ document }));
+    await user.click(screen.getByRole('button', { name: 'Generate export' }));
+
+    let archiveStarted!: () => void;
+    const started = new Promise<void>((resolve) => {
+      archiveStarted = resolve;
+    });
+    fetchMock.mockImplementationOnce(
+      (_input, init) =>
+        new Promise<Response>((_resolve, reject) => {
+          archiveStarted();
+          init?.signal?.addEventListener(
+            'abort',
+            () => reject(new DOMException('Aborted', 'AbortError')),
+            { once: true },
+          );
+        }),
+    );
+    vi.useFakeTimers();
+    try {
+      fireEvent.click(screen.getByRole('button', { name: 'Save to SQLite' }));
+      await started;
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(10_000);
+      });
+      expect(
+        screen.getByText(/Could not confirm the SQLite save/),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole('button', { name: 'Save to SQLite' }),
+      ).toBeEnabled();
+      expect(screen.queryByText(/saved to SQLite/)).not.toBeInTheDocument();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('auto-pauses a fully infected world and disables automatic Start only', async () => {
     const infected = simulationSnapshotSchema.parse({
       ...initial,

apps/world-lab/src/components/world-lab.tsx

@@ -4796,19 +4796,36 @@ function ExperimentExportPanel({
     if (
       !document ||
       !documentIsCurrent ||
+      !parsedRequest.success ||
       operation !== null ||
       sqlitePendingRef.current
     )
       return;
     sqlitePendingRef.current = true;
     setOperation('sqlite');
     setNotice(null);
+    const controller = new AbortController();
+    const timeout = window.setTimeout(() => controller.abort(), 10_000);
     try {
+      const sha256 = await sha256Hex(JSON.stringify(document));
       const response = await fetch(`${apiBase}/experiment/export/archive`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ document }),
+        body: JSON.stringify({
+          request: parsedRequest.data,
+          generatedAt: document.generatedAt,
+          sha256,
+        }),
+        signal: controller.signal,
       });
+      if (response.status === 409) {
+        setDocument(null);
+        setGeneratedRequestJson(null);
+        setNotice(
+          'The experiment changed after this export was generated. Generate it again before saving.',
+        );
+        return;
+      }
       if (!response.ok) throw new Error('archive request failed');
       const result = archiveExperimentExportResponseSchema.parse(
         await response.json(),
@@ -4823,6 +4840,7 @@ function ExperimentExportPanel({
         'Could not confirm the SQLite save. Retry safely with the same generated export.',
       );
     } finally {
+      window.clearTimeout(timeout);
       sqlitePendingRef.current = false;
       setOperation(null);
     }
@@ -5248,6 +5266,16 @@ function serializeExportDocument(document: ExperimentExportDocument): string {
     : JSON.stringify(document);
 }
 
+async function sha256Hex(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(value),
+  );
+  return Array.from(new Uint8Array(digest), (byte) =>
+    byte.toString(16).padStart(2, '0'),
+  ).join('');
+}
+
 function EventLog({
   snapshot,
   turns,