feat(inbox): record disconnect reason and add reconcile safety limits (#1115)

* feat(inbox): record disconnect reason and add reconcile safety limits

Adds `disconnectedAt`/`disconnectReason` columns to Inbox so a channel
disconnect (manual, workspace purge, trial expiry, tenant suspension) has
a forensic trail on every edition, not just where audit logging is
enabled. Threads the reason through inboxService, workspaceLifecycleService,
and every disconnect call site (channel actions, workspace purge, tenant
suspend, trial teardown).

Also adds circuit breakers to reconcileTenants and unsubscribeExpiredTrials
that abort the destructive branch when a batch looks abnormally large,
since that pattern is far more consistent with a quota-worker bug than
real churn.

* fix(inbox): drop reconcile circuit breakers and duplicate audit dispatch

The trial-teardown breaker returned before re-enqueueing its scan cursor,
so it stalled that job permanently once a batch tripped it; the reconcile
breaker's own tests never actually exercised the threshold and were red
on HEAD. Both are removed rather than retuned. The disconnect audit call
in inboxService duplicated each caller's own richer audit entry and
clobbered `source` with `withAuditContext`'s value, so it's deleted in
favor of the callers' records and the disconnectReason column. Reconnect
now clears disconnectedAt/disconnectReason, workspace teardown resolves
`token_revoked` from provider errors instead of leaving it dead, and the
routine per-inbox teardown log is demoted from error to info.

Author: realcodesiman

apps/builder/__tests__/disconnect-meta-actions.test.ts

@@ -192,6 +192,7 @@ describe("Meta disconnect actions", () => {
       inboxId: "inbox-1",
       ownerId: "owner-1",
       workspaceId: "workspace-1",
+      reason: "manual",
       tx: mocks.tx,
     })
   })
@@ -227,6 +228,7 @@ describe("Meta disconnect actions", () => {
       inboxId: "inbox-2",
       ownerId: "owner-1",
       workspaceId: "workspace-1",
+      reason: "manual",
       tx: mocks.tx,
     })
   })
@@ -275,6 +277,7 @@ describe("Meta disconnect actions", () => {
       inboxId: "inbox-1",
       ownerId: "owner-1",
       workspaceId: "workspace-1",
+      reason: "manual",
       tx: mocks.tx,
     })
     expect(mocks.auditRecord).toHaveBeenCalled()

apps/builder/__tests__/disconnect-whatsapp-action.test.ts

@@ -127,6 +127,7 @@ describe("disconnectWhatsappAction", () => {
       inboxId: "inbox-1",
       ownerId: "owner-1",
       workspaceId: "workspace-1",
+      reason: "manual",
       tx: mocks.tx,
     })
   })

apps/builder/src/features/integration-instagram/actions/disconnect-instagram.ts

@@ -99,6 +99,7 @@ export const disconnectInstagram = async (ctx: {
       inboxId: integrationInstagram.inboxId,
       ownerId: workspace.ownerId,
       workspaceId: ctx.workspaceId,
+      reason: "manual",
       tx,
     })
   })

apps/builder/src/features/integration-messenger/actions/disconnect-messenger.ts

@@ -119,6 +119,7 @@ export const disconnectMessenger = async (ctx: {
       inboxId: integrationMessenger.inboxId,
       ownerId: workspace.ownerId,
       workspaceId: ctx.workspaceId,
+      reason: "manual",
       tx,
     })
   })

apps/builder/src/features/integration-smtp/services/smtp.service.ts

@@ -185,6 +185,7 @@ export async function deleteSmtp(workspaceId: string, id: string) {
       inboxId: integration.inboxId,
       ownerId: workspace.ownerId,
       workspaceId,
+      reason: "manual",
       tx,
     })
   })

apps/builder/src/features/integration-telegram/actions/disconnect.action.ts

@@ -49,6 +49,7 @@ export const disconnectTelegramAction = workspaceActionClientAllowExpired
           inboxId: integrationTelegram.inboxId,
           ownerId: workspace.ownerId,
           workspaceId,
+          reason: "manual",
           tx,
         })
       })

apps/builder/src/features/integration-tiktok/actions/disconnect.action.ts

@@ -35,6 +35,7 @@ export const disconnectTiktokAction = workspaceActionClientAllowExpired
           inboxId: integrationTiktok.inboxId,
           ownerId: workspace.ownerId,
           workspaceId,
+          reason: "manual",
           tx,
         })
       })

apps/builder/src/features/integration-whatsapp/actions/disconnect.action.ts

@@ -90,6 +90,7 @@ async function purgeWhatsappIntegration(
     inboxId: integrationWhatsapp.inboxId,
     ownerId,
     workspaceId,
+    reason: "manual",
     tx,
   })
 }

apps/builder/src/features/integration-zalo/actions/disconnect.action.ts

@@ -65,6 +65,7 @@ export const disconnectZaloAction = workspaceActionClientAllowExpired
         inboxId: integrationZalo.inboxId,
         ownerId: workspace.ownerId,
         workspaceId,
+        reason: "manual",
         tx,
       })
     })

apps/worker/__tests__/purge-workspaces.test.ts

@@ -21,6 +21,18 @@ vi.mock("@chatbotx.io/logger", () => ({
 vi.mock("../src/services/integrations", () => ({
   allIntegrations: ["integration"],
 }))
+// Real AsyncLocalStorage context, isolated from the audit dispatcher's
+// Snowflake id generator — this handler only needs the wrapped call to run.
+vi.mock("@chatbotx.io/business/audit", async () => {
+  const { AsyncLocalStorage } = await import("node:async_hooks")
+  const storage = new AsyncLocalStorage<Record<string, unknown>>()
+  return {
+    SYSTEM_ACTOR: "system",
+    withAuditContext: (actor: Record<string, unknown>, fn: () => unknown) =>
+      storage.run(actor, fn),
+    getAuditActor: () => storage.getStore(),
+  }
+})
 
 const { purgeWorkspaces } = await import(
   "../src/schedule/handlers/purge-workspaces"