fix(#12265): deep fallback-slop sweep slice 0/1 — providers + access fail-fast

[lalalune]

What

Deep re-sweep of the remaining fallback-slop in packages/agent (issue #12265, slice 0/1), after the headline files (media-store.ts, page-scoped-context.ts, boot empty catches) were handled by the already-merged #12766 / #12921. Empty-catch count in this slice is already 0, so this pass targets the residual log-and-return-empty catches that make a broken pipeline read as a legitimately-empty result, plus a fail-closed security swallow. Uses the #12263 foundation (runtime.reportError → ERROR_REPORTED → RECENT_ERRORS provider).

Per-category tally

Category	Count	Sites
empty-catch converted	0	none remain in slice (prior PRs)
fabricated-default / log-and-return-empty converted → fail-fast	3	providers/recent-conversations.ts, providers/relevant-conversations.ts, security/access.ts
promise-swallow converted	0	(see "kept" — the two candidates self-degrade)
J-annotated (evaluated, kept)	3	api/views-registry.ts ×2 (J5), providers/relevant-conversations.ts inner room-lookup (J4)
ambiguous-deferred	—	bare return null/[]/false catches + ?? <lit> where absence-vs-failure can't be cleanly told apart

Converted (behavior-changing, fail-fast)

• providers/recent-conversations.ts + relevant-conversations.ts — on a recall failure both providers returned the identical empty context ({ text: "", values: {}, data: {} }) as a legit-empty recall — the banned "not loaded reads as empty" conflation. Now runtime.reportError(...) surfaces the broken pipeline to the agent (RECENT_ERRORS / owner escalation) while the provider still degrades to empty rather than aborting the turn (// error-policy:J4). Removed the now-unused logger imports (reportError logs).
• security/access.ts hasPrivateAccess — a throw from the core private-access check was silently swallowed to return false. Fail-closed is correct (a missing world returns null upstream, not a throw — so a throw here is a broken role/world-resolution pipeline), but a silently-denying broken check would deny forever with no signal. Now reports via runtime.reportError and stays fail-closed (// error-policy:J4).

Kept + annotated (not slop)

• api/views-registry.ts ×2 — void viewSearchIndex.indexView(entry, runtime).catch(() => {}). indexView self-degrades (its own catch logs at debug and falls back to keyword search), so the call-site catch only suppresses a stray rejection from a synchronous pre-embed throw so a background setImmediate task cannot crash the loop → // error-policy:J5. Converting to reportError here would double-report a designed degrade — deliberately not converted.

Deferred (this wave = clear-slop only)

Bare return null/[]/false catches (e.g. network-policy.ts IPv6 parse → J3, update-checker.ts net-fail → null, whichSync → null) and ?? <lit> / || <lit> defaults where legitimate-absence cannot be cleanly distinguished from masking-a-failure. These need per-site judgment.

Ratchet — bun run audit:error-policy-ratchet

base origin/develop (511d1a0a84); 4 changed production source file(s)
  api/views-registry.ts:          emptyCatch 2->2, serverConsole 0->0
  providers/recent-conversations.ts:   emptyCatch 0->0, serverConsole 0->0
  providers/relevant-conversations.ts: emptyCatch 0->0, serverConsole 0->0
  security/access.ts:             emptyCatch 0->0, serverConsole 0->0
no new fallback-slop in touched files

emptyCatch in touched files: 2 → 2 (equal, never up; the views-registry .catch(() => {}) pair is now J5-annotated).

Tests — all green

6 new fast-fail assertions across 3 files, each asserting reportError fires on the real induced failure (stubbed collaborator throws a real error) AND that a legit-absence path does not report:

• providers/recent-conversations.test.ts (new) — 2 tests
• providers/relevant-conversations.faildast.test.ts (new) — 2 tests
• security/access.test.ts (new) — 2 tests

Test Files  3 passed (3)
     Tests  6 passed (6)

Typecheck: 0 errors in the 4 touched source files (remaining packages/agent typecheck errors are pre-existing trimmed-tree module-resolution noise: @elizaos/auth, drizzle-orm, etc. — unrelated).

Evidence

• N/A — real-LLM trajectory / screenshots: this is a server-side error-handling refactor with no UI surface; the behavior change is "a swallowed failure now calls runtime.reportError", proven by the 6 fail-fast unit tests that drive the real provider/access code with a throwing collaborator (no mock stands in for the code under test).

Refs #12265 · parent #12182 · foundation #12263.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3b1c8b48-6d5e-4c38-9b65-7403224892c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fallback/12265-deep-s0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[lalalune]

Validated rebased head 3513018 locally. I also fixed the new access test so it drives the real core role path instead of using a vi.mock factory unsupported by this Bun runner, and renamed relevant-conversations.faildast.test.ts to relevant-conversations.fastfail.test.ts.

Checks run:

• bun test packages/agent/src/providers/recent-conversations.test.ts packages/agent/src/providers/relevant-conversations.fastfail.test.ts packages/agent/src/security/access.test.ts -> pass (6 tests).
• bunx @biomejs/biome check on all touched Agent files -> pass.
• git diff --check github/develop...HEAD -> pass.
• ERROR_POLICY_BASE_REF=github/develop node packages/scripts/error-policy-ratchet.mjs -> pass; no new empty-catch/server-console slop in touched production files.
• bun run --cwd packages/agent typecheck filtered for touched files / TS errors -> no output for touched files after the access test fixture correction.

[lalalune]

Reviewed (adversarial): #12265 slop sweep: recent/relevant-conversations providers + security/access hasPrivateAccess now reportError on failure while preserving degrade (empty context / fail-closed false). reportError is never-throwing per core types. Tested. No failing CI. Queuing auto-merge on green.