refactor(review): address PR #186 review (#183 — recency sweep, #174 export, tests, cleanups)

15-point review of the persistent-history PR. Architecture decisions: crash
recovery = recency threshold; tool-label duplication = leave as-is.

Must-fix:
1. Boot-sweep bounded by recency. sweepStreaming now also requires
   `updatedAt < now() - SWEEP_STREAMING_STALE_MS` (10 min), so a fresh replica's
   startup sweep can't abort a turn another replica is actively streaming
   (multi-instance deploy). Int-spec: a FRESH 'streaming' row is NOT swept, a
   STALE one IS.
2. Restore export during the FIRST streaming turn of a new chat (#174). The
   server chatId is now adopted EARLY (in-place, on the start-chunk metadata) via
   a new `onServerChatId` callback wired through use-chat-session → chat-thread,
   so `activeChatId` is set at turn start and the Copy button is live mid-first-
   turn (canExport = !!activeChatId). Hook tests for early/in-place/no-op adopt.
3. Cover finalizeAssistant's fallback-insert branch: extracted pure
   `planFinalizeAssistant(assistantId)` (update when id present, insert when the
   upfront insert failed) + a dispatch harness test for both arms.

Tests: onModuleInit lifecycle spec (sweep called; throw → resolves + warns);
int-spec updatedAt assertion → toBeGreaterThan.

Cleanups: cap findAllByChat at 5000 rows; upfront-insert-failure log carries
chatId+workspaceId; removed the now-dead buildPartialAssistantRecord (only the
spec consumed it; shapes still pinned by the flushAssistant suite); controller
passes `lang: dto.lang` (normalizeLang handles undefined); dropped a no-op
`?? undefined` in errorOf; documented the content-column semantics change
(concatenated step text, UI renders from metadata.parts); CHANGELOG [Unreleased]
entry (#183, #174); reworded the stale LABELS parity comment.

Verified: server build + 323 ai-chat unit + 5 integration; client tsc + 160
ai-chat unit; prettier clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/server/src/database/repos/ai-chat/ai-chat-message.repo.ts

@@ -9,6 +9,20 @@ import {
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 
+// Crash-recovery sweep recency threshold (#183 review): a 'streaming' row is
+// only swept to 'aborted' once it has been UNTOUCHED for this long. A live turn
+// bumps `updatedAt` on every step (well under this window), so its row never
+// matches; only a turn whose process truly died (no step update for >threshold)
+// is swept. Chosen safely ABOVE the longest realistic turn so a fresh replica's
+// boot-sweep can never abort a turn another replica is actively streaming
+// (multi-instance deploy).
+const SWEEP_STREAMING_STALE_MS = 10 * 60 * 1000; // 10 minutes
+
+// Hard upper bound on the rows materialized by `findAllByChat` (export path).
+// A generous cap so a pathologically huge chat cannot load an unbounded result
+// into memory; far above any realistic transcript length.
+const FIND_ALL_BY_CHAT_LIMIT = 5000;
+
 @Injectable()
 export class AiChatMessageRepo {
   constructor(@InjectKysely() private readonly db: KyselyDB) {}
@@ -66,6 +80,10 @@ export class AiChatMessageRepo {
   // (#183), where the DB is the single source of truth and the whole transcript
   // must be rendered in one pass (findByChat is cursor-paginated and would only
   // return the first page).
+  //
+  // Hard-capped at FIND_ALL_BY_CHAT_LIMIT rows (a generous bound, far above any
+  // realistic transcript) so exporting a pathologically huge chat cannot
+  // materialize an unbounded result set in memory.
   async findAllByChat(
     chatId: string,
     workspaceId: string,
@@ -78,6 +96,7 @@ export class AiChatMessageRepo {
       .where('deletedAt', 'is', null)
       .orderBy('createdAt', 'asc')
       .orderBy('id', 'asc')
+      .limit(FIND_ALL_BY_CHAT_LIMIT)
       .execute();
   }
 
@@ -162,13 +181,21 @@ export class AiChatMessageRepo {
    * status) to 'aborted'. Run once on server start. Returns the number of rows
    * swept so the caller can log it. Workspace-wide on purpose — a crash can have
    * dangling streaming rows across any workspace.
+   *
+   * Bounded by recency (#183 review): only rows UNTOUCHED for
+   * SWEEP_STREAMING_STALE_MS are swept. A live turn bumps `updatedAt` on every
+   * step, so an actively-streaming row never matches; this prevents a fresh
+   * replica's boot-sweep from aborting a turn another replica is still streaming
+   * in a multi-instance deploy.
    */
   async sweepStreaming(trx?: KyselyTransaction): Promise<number> {
     const db = dbOrTx(this.db, trx);
+    const staleBefore = new Date(Date.now() - SWEEP_STREAMING_STALE_MS);
     const rows = await db
       .updateTable('aiChatMessages')
       .set({ status: 'aborted', updatedAt: new Date() })
       .where('status', '=', 'streaming')
+      .where('updatedAt', '<', staleBefore)
       .returning('id')
       .execute();
     return rows.length;