Test-suite gaps: persistence/delete/folder-routing bugs ship undetected (meta)

[iduartgomez]

Why a batch of user-facing bugs (#286, #287) got past CI

Testing (Ivvor, 2026-06-01) surfaced sent→Drafts, deleted-returns, and one-sided-threads bugs against fresh nodes. None were caught by the suite. This issue documents why and what to change. Not a feature bug — a coverage/process bug.

Root causes

1. Offline suite has no persistence layer — can't catch round-trip bugs

example-data,no-sync keeps messages in an in-memory inbox.messages borrow (ui/src/app.rs). On page.reload() the WASM app restarts, memory wipes, and load_example_messages reseeds from scratch — there is no localStorage/IndexedDB/contract round-trip. Logout even explicitly .clear()s the cache to force a reseed.

Consequence: every offline page.reload() test asserts identity-list survival only (#36). A sent/deleted/draft message cannot be meaningfully re-asserted after reload offline. Sent→Drafts and deleted-returns are contract-state round-trip bugs and live exactly where offline is blind.

2. Iso (real-node) suite reloads but never re-asserts folder state

live-node.spec.ts is the only suite with real contracts. It reloads in two places — create identity → reload persists (asserts identity row) and multi-round + read + archive (asserts round one stays visible, the #113 read-state regression). Neither checks the Sent folder still holds a sent message, Drafts is empty after reload, or a deleted message stays deleted.

3. QA matrix marked uncovered behaviors as auto (false-greens)

• 'Sent doesn't leak into Drafts (Sent messages leaking into Drafts folder after cross-node send #107)' → auto, evidence 'implicit via Send removes the draft'. Reality: that test only checks the draft row vanishes in-session, no reload; repro-106-107.spec.ts (Sent messages leaking into Drafts folder after cross-node send #107) asserts 'the draft persists' — the inverse — and contains no reload. The row described coverage that did not exist. This was precisely Ivvor's sent→Drafts bug, marked green.
• 'Recipient fingerprint badge resolves' → auto (implicit / covered transitively), unlinked.

4. Known data-model weakness documented, not tracked

live-node.spec.ts documents that a sent message is 'stashed only to the Sent folder — never folded back into the sender's own inbox Vec' and each side's inbox holds 'exactly ONE half of the conversation' — the root of one-sided-threads (#287), filed as an inline known-limitation annotation rather than a tracked issue.

What changed already (this sweep)

• QA matrix (docs/qa/manual-test-inventory.md): added §"Persistence is iso-only" + the rule that across-reload auto requires a real iso reload test; split sent/delete rows into honest in-session vs across-reload; removed implicit/transitive false-greens.
• New iso test sent message stays in Sent (not Drafts) across reload (#286) — sends, reloads, asserts Sent survives + Drafts empty.

Remaining work

Tests (iso — the only place these reproduce)

• Delete survives reload: receive → delete → reload → assert stays gone, no resurrection from contract re-fetch. (Persistence layer: sent/deleted messages don't survive refresh or session #286 deleted-returns) — live-node.spec.ts → deleted message stays deleted across reload (#286).
• Draft survives reload (inverse guard): save draft → reload → still in Drafts, not Sent. (iso — no offline persistence; still open)
• Delete+regen identity isolation: create alias X → send/recv → delete identity → recreate alias X → assert fresh inbox empty, no old-message bleed. (bug Phase 1: Testability & dev loop #5) (test.fixme in live-node.spec.ts; blocked on wiring the cross-node delivery step)
• Both sides of a thread render once the sent↔inbox data-model gap is fixed (couples Threaded/nested view only shows one side of the conversation #287). — Mail threads: group back-and-forth between two users #270/Threaded/nested view only shows one side of the conversation #287 closed (grouping key normalized to subject-only); guarded by threads.spec.ts → Legacy two-party thread shows both sides (#287). (iso multi-arrival fold still deferred — see comment.)

Offline

• In-session folder-routing assert: send → lands in Sent, not Drafts. — PR test(qa): offline send-routing guard + refresh stale thread annotations (#291) #304, email-app.spec.ts → send routes the message into Sent, not Drafts (#291).
• Do NOT add offline 'persists after reload' tests — architecturally impossible; documented in matrix to prevent future false-greens.

Process

• Ban auto without a linked literal test("…") title; audit matrix for remaining false-greens.
• freenet-mail-qa skill: any folder-mutating behavior (send/delete/archive/draft) requires a reload-and-reassert iso variant before its row may be auto.
• Convert the live-node.spec.ts known-limitation annotation into a link to Threaded/nested view only shows one side of the conversation #287. — done as PR test(qa): offline send-routing guard + refresh stale thread annotations (#291) #304: Threaded/nested view only shows one side of the conversation #287 is now closed, so the annotation was rewritten to reflect the resolution (correct-by-design) rather than pointing at a closed issue as a live limitation. The stale email-app.spec.ts annotation got the same refresh.

Related

• Persistence layer: sent/deleted messages don't survive refresh or session #286 (persistence epic), Threaded/nested view only shows one side of the conversation #287 (one-sided threads), bug Phase 1: Testability & dev loop #5 delete+regen spillover (fold here or into Persistence layer: sent/deleted messages don't survive refresh or session #286)

[iduartgomez]

Update — repro progress (PR #293):

• Threaded/nested view only shows one side of the conversation #287 (one-side thread): red-guarded offline test landed (test.fail). Root cause: group_into_threads keys legacy mail by subject|SENDER.
• 'Sent' confirmation bubbles don't auto-dismiss #290 (sticky Sent toast): red-guarded offline test landed (test.fail). Root cause: navigate_away before push_toast cancels the spawn()-scoped TTL timer.
• Reply fails when recipient added sender under a different local nickname #289 (reply nickname): pinned with two characterization unit tests (*_289). Deferred: full UI reply round-trip as an iso test in live-node.spec.ts (A sends → B imports A under a different label → B replies → assert To doesn't resolve). Heavy build + same-host relay quarantine on the received-message step; tracked here.

Still open from the original meta:

• Draft-survives-reload inverse-guard (iso)
• Resolve the Phase 1: Testability & dev loop #5 test.fixme (delete+regen identity) — needs an iso run to pin same-key vs stale-cache
• Both-sides-of-thread iso test (couples Threaded/nested view only shows one side of the conversation #287)
• Reply fails when recipient added sender under a different local nickname #289 iso round-trip (above)
• Process: ban auto without a linked test; update the freenet-mail-qa skill

[iduartgomez]

Update — easy coverage gaps closed (PR #304):

• Offline in-session folder-routing assert: new test `send routes the message into Sent, not Drafts (Test-suite gaps: persistence/delete/folder-routing bugs ship undetected (meta) #291)` in `email-app.spec.ts`. The existing `Send removes the draft` test only asserted the Drafts side (row vanishes); this adds the positive half — Sent gains exactly the sent message (count == 1, subject matches) and Drafts stays empty. A regression that drops a sent message with no Sent card now fails. In-session by design; the across-reload variant stays iso-only.
• Stale known-limitation annotations refreshed: both email-app.spec.ts and live-node.spec.ts carried annotations citing Mail threads: group back-and-forth between two users #270/Threaded/nested view only shows one side of the conversation #287 as open data-model gaps. Both are now CLOSED (grouping key normalized to subject-only, guarded by threads.spec.ts). Rewrote both to state the per-side standalone-group rendering is correct-by-design and not blocked on any open issue, dropping the misleading open-issue refs + drifted line numbers. (This subsumes the original "convert the live-node annotation into a link to Threaded/nested view only shows one side of the conversation #287" item — Threaded/nested view only shows one side of the conversation #287 is fixed, so the annotation now reflects the resolution rather than pointing at a closed issue as a live limitation.)

Still open (need iso harness or a separate docs pass — not in #304)

• Draft-survives-reload inverse guard (iso) — architecturally impossible offline (no persistence layer); needs a real-node reload.
• Phase 1: Testability & dev loop #5 delete+regen identity isolation — test.fixme in live-node.spec.ts; blocked on wiring the cross-node delivery step (bob shares → alice imports → bob sends → alice receives) before deletion, under the same same-host core-relay quarantine as the other cross-node tests.
• Both-sides-of-thread iso test — couples the (now-closed) Mail threads: group back-and-forth between two users #270/Threaded/nested view only shows one side of the conversation #287 fix; wants a real-node multi-arrival fold.
• Reply fails when recipient added sender under a different local nickname #289 iso reply round-trip — deferred per the PR test: reproduce #287 / #290 / #289 (Ivvor reports) #293 comment above.
• Process: ban auto without a linked literal test("…") title; update the freenet-mail-qa skill to require a reload-and-reassert iso variant for any folder-mutating behavior before its row may be auto.