Preserve valid metadata when recovering poisoned turns

Turn recovery after a hard base.load failure was always soft-emptying
metadata even when metadata.json parsed cleanly under the real schema.
That dropped pendingOperations, tokenUsage, and connectorState for
sessions whose turns.jsonl had null-byte holes but whose gates were
still parked — rehydrateGates then found nothing to re-arm and left
suspended agents wedged.

Prefer base.loadMetadata() on the recovery path so a good metadata
file survives; soft-empty only when that load itself fails. Regression
covers null-hole turns plus non-empty pendingOperations.

Author: TheGreatAxios

src/session/optimized-context-store.test.ts

@@ -83,6 +83,52 @@ describe("createOptimizedContextStore load", () => {
     ]);
   });
 
+  test("preserves pendingOperations when turns are poisoned but metadata is valid", async () => {
+    const dir = tempDir();
+    const store = await createOptimizedContextStore(dir);
+
+    const head = jsonl([turn("a"), turn("b")]);
+    const tail = jsonl([turn("c")]);
+    const poisoned = Buffer.concat([
+      Buffer.from(head, "utf8"),
+      Buffer.alloc(64, 0),
+      Buffer.from(tail, "utf8"),
+    ]);
+    fs.writeFileSync(path.join(dir, TURNS_FILE), poisoned);
+
+    // Valid non-empty metadata must survive recovery so rehydrateGates can re-arm.
+    const pendingOp = {
+      correlationId: "corr-1",
+      kind: "approval" as const,
+      registeredAt: 1_700_000_000_000,
+      gateId: "gate-1",
+    };
+    fs.writeFileSync(
+      path.join(dir, "metadata.json"),
+      JSON.stringify({
+        pendingOperations: [pendingOp],
+        tokenUsage: { input: 10, output: 20, cacheRead: 1, cacheWrite: 2, thinking: 3 },
+        connectorState: null,
+      }),
+    );
+
+    const loaded = await store.load();
+    expect(loaded.turns.map((t) => (t.content[0] as { text: string }).text)).toEqual([
+      "a",
+      "b",
+      "c",
+    ]);
+    expect(loaded.pendingOperations).toEqual([pendingOp]);
+    expect(loaded.tokenUsage).toEqual({
+      input: 10,
+      output: 20,
+      cacheRead: 1,
+      cacheWrite: 2,
+      thinking: 3,
+    });
+    expect(loaded.connectorState).toBeNull();
+  });
+
   test("soft-defaults metadata when metadata.json is corrupt but turns load", async () => {
     const dir = tempDir();
     const store = await createOptimizedContextStore(dir);

src/session/optimized-context-store.ts

@@ -2,7 +2,13 @@ import fs from "node:fs";
 import path from "node:path";
 import { type } from "arktype";
 import { createIsogitStore } from "@intx/storage-isogit";
-import { ContentBlock, type ConversationTurn } from "@intx/types/runtime";
+import {
+  ContentBlock,
+  type ConnectorThreadState,
+  type ConversationTurn,
+  type PendingOperation,
+  type TokenUsage,
+} from "@intx/types/runtime";
 import { getLogger } from "@intx/log";
 import {
   createSegmentedJSONLWriter,
@@ -116,11 +122,13 @@ const EMPTY_TOKEN_USAGE = {
   thinking: 0,
 } as const;
 
-function emptyMetadata(): {
-  pendingOperations: never[];
-  tokenUsage: typeof EMPTY_TOKEN_USAGE;
-  connectorState: null;
-} {
+type SessionMetadata = {
+  pendingOperations: PendingOperation[];
+  tokenUsage: TokenUsage;
+  connectorState: ConnectorThreadState | null;
+};
+
+function emptyMetadata(): SessionMetadata {
   return {
     pendingOperations: [],
     tokenUsage: { ...EMPTY_TOKEN_USAGE },
@@ -129,17 +137,15 @@ function emptyMetadata(): {
 }
 
 /**
- * Soft-default metadata when the recovery path cannot use the base store.
- * Corrupt or missing metadata.json must not abort resume of usable turns.
+ * Prefer real metadata via the base store schema on recovery. Soft-default only
+ * when metadata.json is missing, corrupt, or otherwise unreadable so poisoned
+ * turns still resume without wiping pendingOperations / tokenUsage / connectorState.
  */
-async function loadMetadataSoft(dir: string): Promise<ReturnType<typeof emptyMetadata>> {
-  const metadataPath = path.join(dir, METADATA_FILE);
+async function loadMetadataSoft(
+  loadMetadata: () => Promise<SessionMetadata>,
+): Promise<SessionMetadata> {
   try {
-    if (!(await pathExists(metadataPath))) return emptyMetadata();
-    const text = await fs.promises.readFile(metadataPath, "utf-8");
-    JSON.parse(text);
-    // Schema lives in the base store; recovery only needs a safe shell.
-    return emptyMetadata();
+    return await loadMetadata();
   } catch (cause) {
     log.warn("metadata.json unreadable during resilient load; using empty defaults", {
       cause: cause instanceof Error ? cause.message : String(cause),
@@ -391,7 +397,8 @@ export async function createOptimizedContextStore(dir: string): Promise<ContextS
     //
     // When the base isogit store hard-fails (e.g. null-padded turns.jsonl from
     // a stale truncate), recover usable turns via resilient segment parse and
-    // soft-default metadata so resume does not die on a bare Bun JSON token.
+    // re-read metadata via the base schema (soft-empty only if that fails too)
+    // so resume does not die on a bare Bun JSON token or wipe pending ops.
     async load(signal) {
       try {
         const baseResult = await base.load(signal);
@@ -428,7 +435,7 @@ export async function createOptimizedContextStore(dir: string): Promise<ContextS
           extraTexts.length === 0
             ? baseTurns
             : await loadTurnsWithoutMalformedToolSequence(baseTurns, extraTexts);
-        const metadata = await loadMetadataSoft(dir);
+        const metadata = await loadMetadataSoft(() => base.loadMetadata());
         return { turns, ...metadata };
       }
     },