Absorb user-DO resets in the Overseer's session capabilities

[ndisidore]

When a user DO resets under an open workspace, the session stays broken until the browser reconnects. Chat sends fail, the model picker and gatekeeper setup wedge until a reload, and pin/title updates stop propagating. The cause is the same one #133 fixed at the Worker layer: the Overseer minted its user-DO stubs once at open() and reused them for the whole session, and a stub is permanently broken once its incarnation dies.

Changes

The session capability classes now store the user ID and create a fresh stub for each call, through the same telemetry wrapper the Worker uses.

Deliberately out of scope

No retries, matching #133. No call deadline either: a user DO wedged behind a stuck input gate hangs newChat silently for an unbounded-but-usually-finite window (i.e. the 30s DO timeout), then rejects (and now recovers). Will add as a followup if we think its necessary

[ask-bonk]

This is consistent. The whitelist matches the USER_DO_ABORT_REASON constant, and the comment cross-reference is accurate.

I've completed a thorough review. Let me summarize my assessment.

Review

This is a clean, well-motivated fix. The change mirrors the existing AuthenticatedApiImpl.#user pattern (server.ts:96) in the Overseer's session capabilities: instead of holding a single user-DO stub captured at open(), each of OverseerClientInterface, UseOverseerInterface, GadgetClientImpl, and UseGadgetClientInterface now stores the user ID and mints a fresh telemetry-wrapped stub per call. That correctly absorbs a user-DO-only reset, which the retained-stub design couldn't.

Verification points I checked:

• All prior this.owner / this.clientUser field references are gone — no dangling uses (grep confirms zero).
• impl.users, impl.ownerId, and impl.logger all exist with matching types (impl.logger is ReturnType<typeof createWorkshopLogger>, matching the new wrapDoStubForTelemetry param).
• The #owner getter's this.impl.ownerId! non-null assertion is no less safe than the old open() code, which used the same ownerId! to mint the stub. deleteSelf reads #owner before nulling ownerId.
• .id.toString() analytics calls still work: .id is a non-function property, returned directly by the proxy.
• The do-telemetry.ts logger-injection change is backward compatible (defaults to the Worker logger) and threads the Overseer's gadget-scoped logger through, satisfying the PR's telemetry-attribution goal.
• The new integration test correctly isolates the user-DO reset via runInDurableObject + state.abort() (rather than abortAllDurableObjects, which would kill the Overseer too), and the onUnhandledError whitelist matches the USER_DO_ABORT_REASON constant.

Observations (non-blocking, no action needed):

• The analytics .id.toString() sites now construct a throwaway stub solely to read the id, which is slightly wasteful but harmless and consistent with the pattern.
• UseOverseerInterface still calls this.#clientUser.whoami() directly for presence while OverseerClientInterface memoizes via #getClientProfile(). This asymmetry predates the PR and is preserved, not introduced.
• The "no call deadline" gap is explicitly and correctly deferred in the PR description.

LGTM!

github run

[ask-bonk]

The #owner getter is used in whoami/metadata paths and setTitle/deleteSelf/getCreatedBy. If ownerId is undefined, the workspace has been deleted, and throwing "Workspace has been deleted." is a correct behavior (previously the ownerId! would have created a stub with idFromString(undefined) which would throw a less meaningful error anyway). This is an improvement.

Note #clientUser getter has no such guard, but clientUserId is a constructor-injected constant that's always set, so no guard is needed. Correct.

I've completed a thorough review. Let me consolidate my findings.

Review Summary

This is a well-motivated, correctly-implemented fix. The core change replaces retained user-DO stubs (captured once at open()) with per-call fresh-stub getters (#owner, #clientUser) across the four session capability classes, mirroring the existing AuthenticatedApiImpl.#user pattern that #133 established at the Worker layer. A broken (dead-incarnation) stub can no longer wedge an open session; the first post-reset call transparently restarts the object.

Points I verified:

• No dangling references: grep confirms zero remaining this.owner / this.clientUser field references. The owner/clientUser locals that remain in open() (overseer.ts:6404-6407, 6458-6477) are one-shot connect-time operations, correctly left out of the retained-stub scope.
• Constructor call sites updated to pass clientUserId: string instead of stubs; GadgetClientImpl/UseGadgetClientInterface likewise threaded the id through.
• deleteSelf ordering is safe (overseer.ts:7360-7365): this.#owner is read at line 7361, and ownerId is nulled at 7364 within the same blockConcurrencyWhile — the getter evaluates before the null.
• #owner deleted-workspace guard (the audit-findings commit) is a strict improvement: it throws a meaningful "Workspace has been deleted." instead of the old ownerId! producing idFromString(undefined).
• .id.toString() analytics sites still work: .id is a non-function property returned directly by the telemetry Proxy (do-telemetry.ts:33), so the throwaway stub is harmless.
• do-telemetry.ts logger injection is backward compatible (defaults to the Worker logger) and threads the gadget-scoped impl.logger (ReturnType<typeof createWorkshopLogger>, matching the param type) for correct attribution.
• Integration test correctly isolates the user-DO reset via runInDurableObject + state.abort() (not abortAllDurableObjects, which would kill the Overseer too); it lives in a new non-skipped describe block, and the onUnhandledError whitelist string matches the USER_DO_ABORT_REASON constant.
• GadgetEditor.tsx in-flight guard is a correct, minimal idempotency hardening (set before the await, cleared in finally) for the now-retriable setTitle.

Non-blocking observations (no action needed):

• The UseOverseerInterface presence path calls this.#clientUser.whoami() directly while OverseerClientInterface memoizes via #getClientProfile(). This asymmetry predates the PR and the fresh-stub cost is one-shot at construction, so it's immaterial.
• The "no call deadline" gap (a user DO wedged behind a stuck input gate hangs until the ~30s DO timeout) is explicitly and reasonably deferred in the PR description.

LGTM!

github run