fix(purchases): record partial success and stamp target account on history (closes #642, #646) (#650)

* fix(purchases): record partial success and stamp target account on history

Partial-failure runs (some recs commit, others fail) were marked the whole
execution "failed" and skipped the success notification despite real
commitments written to purchase_history with Purchased=true, inviting a
re-approve that double-buys the already-purchased recs (#642). The
single-account path also stamped the ambient AWS host account on history
regardless of the resolved target account or provider (#646).

- #642: introduce a "partially_completed" outcome. When at least one rec
  committed, never mark the row "failed"; record partially_completed, send
  the confirmation for the recs that purchased, and surface the row in
  History (flagged IsAuditGap so its execution-level dollars are excluded -
  the committed dollars come from the per-rec purchase_history rows). Applies
  to both the single-account path (via a partialPurchaseError sentinel that
  finalizeExecution maps) and the multi-account fan-out path.
- #642 frontend: on a partial fan-out failure, name the buckets that created
  pending executions so the still-actionable requests are not silent orphans;
  add a distinct "Partial" history badge.
- #646: resolve the target account's ExternalID from the resolved account and
  stamp that on purchase_history, falling back to the ambient AWS STS identity
  only when no target account can be identified. Fixes assume-role AWS and
  direct-execute Azure/GCP stamping.

Regression tests: single-account + multi-account partial success
(partially_completed status + notification sent), correct account stamping
for AWS and Azure, History row synthesis with dollar-exclusion, and the
fan-out partial toast naming submitted buckets.

Closes #642
Closes #646

* fix(purchases): error when target account is unresolved, never fall back to ambient

When a single-account purchase resolves a concrete cloudAccountID but
GetCloudAccount returns a nil account (the account does not exist),
resolveSingleAccountProvider returned (nil, "", nil). The caller then
treated the empty target ID as "truly ambient" and fell back to the host
AWS STS identity, purchasing and stamping purchase_history against the
wrong account (#646).

Surface a descriptive error instead so the caller's no-ambient-fallback
contract holds once a target account is known. Add a regression test
covering the not-found path.

Author: cristim

frontend/src/__tests__/purchase-execution-toast.test.ts

@@ -361,6 +361,8 @@ describe('handleFanOutExecute — fan-out path', () => {
     return {
       key: `key-${id}`,
       label: `Bucket ${id}`,
+      provider: 'aws',
+      service: `svc-${id}`,
       recs: [buildMinimalRec()],
       payment: 'all-upfront',
       capacityPercent,
@@ -414,6 +416,38 @@ describe('handleFanOutExecute — fan-out path', () => {
     expect(lastToastKind()).toBe('warning');
   });
 
+  test('#642 — partial fan-out failure names the submitted (still-actionable) buckets', async () => {
+    (recs.getFanOutBuckets as jest.Mock).mockReturnValue([
+      buildBucket('a'),
+      buildBucket('b'),
+    ]);
+
+    // Bucket a submits cleanly (creates a pending execution); bucket b fails.
+    (api.executePurchase as jest.Mock)
+      .mockResolvedValueOnce({
+        execution_id: 'exec-a',
+        status: 'queued',
+        email_sent: true,
+        approval_recipient: 'alice@example.com',
+      })
+      .mockRejectedValueOnce(new Error('network down'));
+
+    const btn = setup();
+    btn.click();
+    await new Promise((r) => setTimeout(r, 0));
+
+    const msg = lastToastMessage();
+    expect(msg).toContain('1 of 2');
+    expect(msg).toContain('failed');
+    // The orphaned-but-actionable pending execution must be surfaced by name so
+    // the user knows which request is live (issue #642).
+    expect(msg).toContain('Submitted (awaiting approval)');
+    expect(msg).toContain('AWS svc-a@100%');
+    // The failed bucket must NOT be listed as submitted.
+    expect(msg).not.toContain('svc-b');
+    expect(lastToastKind()).toBe('warning');
+  });
+
   test('Finding 2 — status === "failed" also counts as failure, recipient excluded', async () => {
     (recs.getFanOutBuckets as jest.Mock).mockReturnValue([
       buildBucket('a'),

frontend/src/app.ts

@@ -398,6 +398,20 @@ async function handleExecutePurchase(): Promise<void> {
   }
 }
 
+/**
+ * fanOutBucketLabel renders a short human identifier for a fan-out bucket so a
+ * partial-failure toast can name which buckets created pending executions
+ * (issue #642). Uses the (provider/service @ capacity%) tuple — the same
+ * fields the user chose in the modal — so the orphaned-but-actionable pending
+ * requests are identifiable rather than hidden behind a bare count.
+ */
+function fanOutBucketLabel(b: FanOutBucket): string {
+  const provider = (b.provider || '').toString().toUpperCase();
+  const service = b.service || 'commitment';
+  const cap = Number.isFinite(b.capacityPercent) ? `@${b.capacityPercent}%` : '';
+  return `${provider} ${service}${cap}`.trim();
+}
+
 /**
  * handleFanOutExecute submits one executePurchase POST per bucket.
  *
@@ -503,8 +517,28 @@ async function handleFanOutExecute(buckets: FanOutBucket[]): Promise<void> {
     ]
       .slice(0, 3)
       .join('; ');
+    // #642: on a partial fan-out failure the succeeded buckets created real
+    // pending executions an approver can still act on. Name them so the user
+    // knows which requests are live (and which to re-submit) rather than
+    // leaving them as silent orphans behind a bare count.
+    let submittedNote = '';
+    if (succeeded > 0 && succeeded < results.length) {
+      const submittedLabels: string[] = [];
+      results.forEach((r, i) => {
+        const ok =
+          r.status === 'fulfilled' &&
+          r.value.email_sent !== false &&
+          r.value.status !== 'failed';
+        if (ok && buckets[i]) submittedLabels.push(fanOutBucketLabel(buckets[i]));
+      });
+      if (submittedLabels.length > 0) {
+        submittedNote = ` Submitted (awaiting approval): ${submittedLabels.slice(0, 5).join(', ')}${
+          submittedLabels.length > 5 ? ` +${submittedLabels.length - 5} more` : ''
+        }.`;
+      }
+    }
     showToast({
-      message: `${succeeded} of ${results.length} submitted · ${failed} failed: ${failureMsgs}${failed > 3 ? ' (…)' : ''}`,
+      message: `${succeeded} of ${results.length} submitted · ${failed} failed: ${failureMsgs}${failed > 3 ? ' (…)' : ''}${submittedNote}`,
       kind: failed === results.length ? 'error' : 'warning',
       timeout: null,
     });

frontend/src/history.ts

@@ -277,6 +277,11 @@ function statusBadgeHTML(status: string): string {
       return '<span class="badge badge-warning">In Progress</span>';
     case 'cancelled':
       return '<span class="badge badge-muted">Cancelled</span>';
+    case 'partially_completed':
+      // #642: some commitments succeeded, some failed. Not a clean success
+      // and never "failed" (real commitments exist) — a distinct warning badge
+      // so the user knows to read the description and reconcile the failures.
+      return '<span class="badge badge-warning">Partial</span>';
     case 'failed':
       return '<span class="badge badge-danger">Failed</span>';
     case 'expired':

internal/api/handler_history.go

@@ -82,7 +82,14 @@ func (h *Handler) getHistory(ctx context.Context, req *events.LambdaFunctionURLR
 // purchase_history rows (no duplicate). The execution row's PurchaseID is
 // the ExecutionID while a purchase_history row's is the CommitmentID, so
 // the keys never collide even when both happen to render.
-var historyExecutionStatuses = []string{"pending", "notified", "approved", "running", "paused", "completed", "failed", "expired", "cancelled"}
+//
+// "partially_completed" (issue #642) is loaded and ALWAYS synthesised: a
+// partial run committed some recs to purchase_history (those render from the
+// DB rows) and failed others. The synthesised execution row carries the
+// partial-failure marker and is flagged IsAuditGap so its execution-level
+// dollars are excluded from the dashboard totals — the committed dollars are
+// already counted via the per-rec purchase_history rows that succeeded.
+var historyExecutionStatuses = []string{"pending", "notified", "approved", "running", "paused", "completed", "partially_completed", "failed", "expired", "cancelled"}
 
 // approvalExpiryWindow is how long a pending approval stays actionable
 // before the History view flips it to "expired". Aligns with the
@@ -231,6 +238,16 @@ func annotateHistoryRowByStatus(row *config.PurchaseHistoryRecord, exec config.P
 	case "paused":
 		row.Approver = approver
 		row.StatusDescription = "purchase paused — resume or cancel from the plan"
+	case "partially_completed":
+		// #642: some recs committed, some failed. The committed recs are
+		// surfaced via their own purchase_history rows; this synthesised row
+		// is the audit flag for the failures. Flag IsAuditGap so the dashboard
+		// excludes its execution-level dollars (the committed dollars are
+		// counted on the per-rec purchase_history rows, not here) — same
+		// double-count guard as the audit-gap completed case below.
+		row.IsAuditGap = true
+		annotateApproved(row, exec, approver)
+		row.StatusDescription = "partially completed — some commitments succeeded, others failed: " + exec.Error
 	case "completed":
 		// Only audit-gap completed executions reach here (fetchExecutionsAsHistory
 		// skips clean completed rows). exec.Error carries why the history write

internal/api/handler_history_test.go

@@ -534,6 +534,51 @@ func TestHandler_getHistory_AuditGapCompletedVisible(t *testing.T) {
 	assert.Equal(t, 0.0, resp.Summary.TotalMonthlySavings)
 }
 
+// TestHandler_getHistory_PartiallyCompletedVisible is the issue #642 regression
+// guard. A "partially_completed" execution (some recs committed, some failed)
+// must be surfaced in History as a non-failed row carrying a clear description,
+// count as completed (money was committed), and have its execution-level
+// dollars excluded via IsAuditGap (the committed dollars are counted on the
+// per-rec purchase_history rows that actually saved, not here).
+func TestHandler_getHistory_PartiallyCompletedVisible(t *testing.T) {
+	ctx := context.Background()
+	mockStore := new(MockConfigStore)
+
+	partial := []config.PurchaseExecution{
+		{
+			ExecutionID:      "partial-1",
+			Status:           "partially_completed",
+			Error:            "some purchases failed (partial success): c5.xlarge: offering not available",
+			ScheduledDate:    time.Now(),
+			TotalUpfrontCost: 900.0,
+			EstimatedSavings: 140.0,
+			Recommendations:  []config.RecommendationRecord{{Provider: "aws", Service: "ec2", Region: "us-east-1"}},
+		},
+	}
+	approver := "ops@example.com"
+	mockStore.On("GetAllPurchaseHistory", ctx, 100).Return([]config.PurchaseHistoryRecord{}, nil)
+	mockStore.On("GetExecutionsByStatuses", ctx, mock.Anything, mock.Anything).Return(partial, nil)
+	mockStore.On("GetGlobalConfig", ctx).Return(&config.GlobalConfig{NotificationEmail: &approver}, nil)
+
+	mockAuth, req := adminHistoryReq(ctx)
+	handler := &Handler{auth: mockAuth, config: mockStore}
+
+	result, err := handler.getHistory(ctx, req, map[string]string{})
+	require.NoError(t, err)
+	resp := result.(HistoryResponse)
+
+	require.Len(t, resp.Purchases, 1, "partially_completed execution must be surfaced in History (issue #642)")
+	row := resp.Purchases[0]
+	assert.Equal(t, "partial-1", row.PurchaseID)
+	assert.Equal(t, "partially_completed", row.Status)
+	assert.NotEqual(t, "failed", row.Status, "a partial run with real commitments must never read as failed (double-spend hazard)")
+	assert.Contains(t, row.StatusDescription, "partially completed", "the partial outcome must be surfaced to the user")
+	assert.True(t, row.IsAuditGap, "partial row must carry IsAuditGap so its execution-level dollars are excluded")
+	assert.Equal(t, 1, resp.Summary.TotalCompleted, "money was committed, so it counts as completed")
+	assert.Equal(t, 0.0, resp.Summary.TotalUpfront, "partial row must not contribute execution-level dollars (committed dollars come from purchase_history rows)")
+	assert.Equal(t, 0.0, resp.Summary.TotalMonthlySavings)
+}
+
 // TestHandler_getHistory_CompletedDBRowWithDescriptionStillCounts guards the
 // financial invariant that dollar exclusion keys off the explicit IsAuditGap
 // marker, NOT off StatusDescription being set. A real purchase_history row