[Juliusolsson05]

Closes #770, #771. Both found by auditing the open-issue table against main.

src/main/storage/feedDebugLog.ts had no test file at all, which is how #771 survived while its own comment described the opposite behaviour.

#771 — the branch written to preserve entries was the branch that discarded them

When stat fails with anything other than ENOENT, the writer refuses to append on an unknown baseline. Its comment:

Fail CLOSED: un-prime so the next batch re-stats, and return WITHOUT advancing the cursor so the renderer resends these entries.

It returned — which resolves the IPC. The renderer advances its durable cursor in .then and retains only in .catch, so every entry in that batch was marked persisted and thrown away. The one branch that exists to protect entries was the one losing them.

It now throws. The renderer's retry path already existed and is already covered ("retries rejected rows on the next tick"), which is what makes a one-word change the complete fix rather than half of one.

#770 — a soft reload made a session stop persisting for the rest of the run

Reload rebuilds the runtime, so feedDebugNextId restarts at 1 and feedDebugEpochMs is minted fresh on the next entry. Three cursors survived that:

• the renderer's persistedFeedDebugIdRef and inFlightFeedDebugIdRef — which live outside the runtime on purpose, so a busy agent does not re-render the workspace on every persisted batch, and which therefore nothing in the reset reaches;
• main's process-local lastWrittenFeedDebugId.

With the renderer's at 4,812, selectFeedDebugAppendBatch filters every new entry as id <= lastPersistedId and sends nothing, ever again. If anything did get through, main's cursor drops it as already-written. The diagnostic trail disappeared at exactly the moment someone was reloading because the feed had gone wrong.

The renderer refs are cleared at the reload site. Main's cannot be — an explicit "reset" message would race an append already in flight — so the batch now carries the generation that numbered it, and main resets its id cursor when that changes. The epoch travels with the data, so it cannot get out of order with it.

Two deliberate non-resets, both tested:

• Cap state is not reset. The file is the same file and its byte count is still true; a reload must not re-open a capped log.
• The no-durable-transcript arm of soft reload does not clear. That arm is deliberately non-destructive — it keeps the runtime and only marks the transcript disconnected — so the ids keep counting and the cursors are still true. Clearing there would make the renderer re-send everything it had already persisted. There is a test named for that distinction, specifically so the fix cannot degrade into "delete the cursors on anything called soft reload".

Version skew degrades to the old behaviour rather than a new one: an absent epochMs from an older renderer is treated as "same generation", which is what main did before.

Verification

Six mutations, each applied individually against a verified-clean tree, all killed:

Mutation	Result
fail-closed returns instead of throwing	2/14 fail
epoch change does not reset the cursor	1/14
epoch resets unconditionally	1/14
soft reload does not clear the refs	1/14
it clears only the in-flight ref	1/14
the batch stops carrying the epoch	3/14

npx tsc -b clean on Node 24. src/main + src/renderer, unit + renderer projects: 3919 passed, 0 failed.

The three existing payload assertions in useFeedDebugPersist.renderer.test.tsx were updated to name epochMs explicitly rather than relaxed to toMatchObject — a payload that quietly stops carrying the generation is precisely the bug.

🤖 Generated with Claude Code

Review (two rounds, one Codex reviewer): MERGE-READY

Finding	Verdict	Disposition
A write from before a soft reload moved the new generation's cursor (from a cross-agent read)	valid	fixed in 31bc9188, fail-first test
Epoch = first entry's timestamp, so same-millisecond or clock-rollback resets reused it and lost entries	valid, major	fixed in 1ae9b60e (strictly increasing mint); 4 tests fail without it
Catch-side guard, IPC epoch forwarding and cap preservation were each removable with tests green	valid	each pinned by a test that fails under that mutation (1ae9b60e)
Per-session maps resurrected by an append queued before forget	valid, minor, predates this PR	follow-up #1207
Round 2: after a clock rollback, tMs reads 0 until wall time catches up	valid, cosmetic	accepted: only the debug panel's relative column, only after a rollback; absolute ts is intact