kayg/calternal-v0
Archived
Watch
1
0
Fork
You've already forked calternal-v0
 0
Code Issues 1.1k Pull requests Projects Releases Packages Wiki Activity Actions

DATA LOSS: live Note edits not saved ('could not map edited Markdown to the loaded Note source') #1197

Open
opened 2026-10-06 09:31:10 +00:00 by kayg · 75 comments
kayg commented 2026-10-06 09:31:10 +00:00
Owner
Copy link

DATA LOSS (production, 2026-10-06): live Note edits not saved

Production log (calternal-cloud, build f5fbced3c then 5301e0208), times CEST:

  • 10:04:15 first WARN calternal_collab::session: live Note flush retry failed error=could not map edited Markdown to the loaded Note source
  • 10:52:39 last-client Note flush failed error=could not map edited Markdown to the loaded Note source
  • every minute until 11:28:24 live Note not saved at shutdown error=could not map edited Markdown to the loaded Note source (43 occurrences)
    Merge round 28 went live 08:35 CEST and its Note date backfill (#1148) added date:/last edited: to 60/55 Notes at 08:40 CEST; #1110 tag rewrites, #1152 block anchors, #1151 link cards also landed. Owner edits Notes and Journal entries daily.

Do, in priority order:

  1. Recover: determine whether the unsaved edits survive anywhere (collab Yrs state/journal under /srv/calternal/data/.system — journal/, cache/, tmp/ — or the browser's local draft store). Read-only on production: copy the relevant files to a scratch dir on production (never print Note content in logs or issues; report counts, Note IDs and byte sizes only). If recoverable, write a recovery tool that saves the recovered text as a NEW sibling Note "
## DATA LOSS (production, 2026-10-06): live Note edits not saved Production log (calternal-cloud, build f5fbced3c then 5301e0208), times CEST: - 10:04:15 first `WARN calternal_collab::session: live Note flush retry failed error=could not map edited Markdown to the loaded Note source` - 10:52:39 `last-client Note flush failed error=could not map edited Markdown to the loaded Note source` - every minute until 11:28:24 `live Note not saved at shutdown error=could not map edited Markdown to the loaded Note source` (43 occurrences) Merge round 28 went live 08:35 CEST and its Note date backfill (#1148) added `date:`/`last edited:` to 60/55 Notes at 08:40 CEST; #1110 tag rewrites, #1152 block anchors, #1151 link cards also landed. Owner edits Notes and Journal entries daily. Do, in priority order: 1. **Recover:** determine whether the unsaved edits survive anywhere (collab Yrs state/journal under /srv/calternal/data/.system — journal/, cache/, tmp/ — or the browser's local draft store). Read-only on production: copy the relevant files to a scratch dir on production (never print Note content in logs or issues; report counts, Note IDs and byte sizes only). If recoverable, write a recovery tool that saves the recovered text as a NEW sibling Note "<title> (recovered 2026-10-06)" through the checked writer, never overwriting the current file; leave running it to the orchestrator. 2. **Root cause:** reproduce: open a Note in the live editor, change its file on disk underneath (date backfill / tag rewrite / block anchor write / external edit), keep typing, close the last client. Find why the bridge cannot map and why it drops instead of preserving. 3. **Fix (data safety first):** a live room must never lose edits. On a source mismatch: rebase the edits onto the current file (three-way merge on blocks), and if that fails, save the room's text as a conflict copy Note and tell the User (notification with Open), never only log a warning. Server-side writers (backfills, tag rewrites, anchors) must go through the collab room when one is open for that Note (apply as a room transaction) instead of writing the file underneath it. 4. Tests: every server-side writer × open live room × concurrent typing; restart with unsaved room state; zero loss. Gates per crate + `bun run check` + `bun run test` quoted. Commit. Do not push. Comment findings on this issue as you go (no Note content).
1197-final-abrupt-desktop-dark.png
385 KiB
1197-final-clean-phone-dark.png
257 KiB
1197-final-clean-phone-light.png
261 KiB
1197-final-clean-tablet-dark.png
436 KiB
1197-final-clean-tablet-light.png
454 KiB
1197-final-pending-desktop-dark.png
387 KiB
1197-final-pending-phone-dark.png
260 KiB
1197-final-pending-phone-light.png
264 KiB
1197-final-pending-tablet-dark.png
440 KiB
1197-final-pending-tablet-light.png
456 KiB
copy-desktop-dark.png
391 KiB
copy-desktop-light.png
515 KiB
inbox-desktop-dark.png
118 KiB
inbox-desktop-light.png
135 KiB
copy-phone-dark.png
255 KiB
copy-tablet-dark.png
441 KiB
copy-tablet-light.png
457 KiB
inbox-phone-light.png
52 KiB
inbox-tablet-dark.png
98 KiB
inbox-tablet-light.png
116 KiB
inbox-phone-dark.png
54 KiB
1197-collabloss2-copy-desktop-dark.png
398 KiB
1197-collabloss2-inbox-desktop-light.png
135 KiB
1197-final-abrupt-desktop-light.png
513 KiB
1197-final-abrupt-phone-dark.png
257 KiB
1197-final-abrupt-phone-light.png
262 KiB
1197-final-abrupt-tablet-dark.png
437 KiB
1197-final-abrupt-tablet-light.png
455 KiB
1197-final-clean-desktop-dark.png
385 KiB
1197-final-clean-desktop-light.png
512 KiB
1197-final-pending-desktop-light.png
514 KiB
1197-final-pending-tablet-light.png
457 KiB
1197-final-capacity-1440-dark.png
424 KiB
1197-final-capacity-1440-light.png
536 KiB
1197-final-capacity-390-dark.png
268 KiB
1197-final-capacity-1440-dark.png
424 KiB
1197-final-capacity-820-dark.png
450 KiB
1197-collabloss2-copy-desktop-light.png
522 KiB
1197-collabloss2-copy-phone-light.png
268 KiB
1197-collabloss2-copy-tablet-dark.png
444 KiB
1197-collabloss2-copy-tablet-light.png
465 KiB
1197-collabloss2-inbox-desktop-dark.png
118 KiB
1197-collabloss2-inbox-phone-dark.png
54 KiB
1197-collabloss2-inbox-phone-light.png
52 KiB
1197-collabloss2-inbox-tablet-dark.png
98 KiB
1197-collabloss2-inbox-tablet-light.png
116 KiB
1197-final-abrupt-desktop-dark.png
385 KiB
1197-final-abrupt-desktop-light.png
512 KiB
1197-final-abrupt-phone-dark.png
257 KiB
1197-final-abrupt-phone-light.png
262 KiB
1197-final-abrupt-tablet-dark.png
438 KiB
1197-final-abrupt-tablet-light.png
455 KiB
1197-final-copy-desktop-dark.png
396 KiB
1197-final-copy-desktop-light.png
519 KiB
1197-final-copy-phone-dark.png
259 KiB
1197-final-copy-phone-light.png
268 KiB
1197-final-copy-tablet-dark.png
441 KiB
1197-final-copy-tablet-light.png
463 KiB
1197-final-inbox-desktop-dark.png
118 KiB
1197-final-inbox-desktop-light.png
135 KiB
1197-final-inbox-phone-dark.png
54 KiB
1197-final-inbox-phone-light.png
52 KiB
1197-final-inbox-tablet-dark.png
98 KiB
1197-final-clean-desktop-dark.png
384 KiB
1197-final-clean-desktop-light.png
511 KiB
1197-final-clean-phone-dark.png
257 KiB
1197-final-clean-phone-light.png
261 KiB
1197-final-clean-tablet-dark.png
438 KiB
1197-final-clean-tablet-light.png
455 KiB
1197-final-inbox-tablet-light.png
116 KiB
1197-final-pending-desktop-dark.png
387 KiB
1197-final-pending-desktop-light.png
514 KiB
1197-final-pending-phone-dark.png
259 KiB
1197-final-pending-tablet-dark.png
440 KiB
1197-final-verification-1197.tar.gz
486 KiB
1197-final-capacity-390-light.png
272 KiB
1197-final-capacity-820-dark.png
450 KiB
1197-final-capacity-820-light.png
464 KiB
1197-final-capacity-1440-light.png
536 KiB
1197-final-capacity-390-dark.png
268 KiB
1197-final-capacity-390-light.png
272 KiB
1197-final-capacity-820-light.png
464 KiB
copy-phone-light.png
262 KiB
1197-collabloss2-copy-phone-dark.png
259 KiB
1197-final-pending-phone-light.png
264 KiB
1197-final-abrupt-desktop-dark.png 1197-final-clean-phone-dark.png 1197-final-clean-phone-light.png 1197-final-clean-tablet-dark.png 1197-final-clean-tablet-light.png 1197-final-pending-desktop-dark.png 1197-final-pending-phone-dark.png 1197-final-pending-phone-light.png 1197-final-pending-tablet-dark.png 1197-final-pending-tablet-light.png copy-desktop-dark.png copy-desktop-light.png inbox-desktop-dark.png inbox-desktop-light.png copy-phone-dark.png copy-tablet-dark.png copy-tablet-light.png inbox-phone-light.png inbox-tablet-dark.png inbox-tablet-light.png inbox-phone-dark.png 1197-collabloss2-copy-desktop-dark.png 1197-collabloss2-inbox-desktop-light.png 1197-final-abrupt-desktop-light.png 1197-final-abrupt-phone-dark.png 1197-final-abrupt-phone-light.png 1197-final-abrupt-tablet-dark.png 1197-final-abrupt-tablet-light.png 1197-final-clean-desktop-dark.png 1197-final-clean-desktop-light.png 1197-final-pending-desktop-light.png 1197-final-pending-tablet-light.png 1197-final-capacity-1440-dark.png 1197-final-capacity-1440-light.png 1197-final-capacity-390-dark.png 1197-final-capacity-1440-dark.png 1197-final-capacity-820-dark.png 1197-collabloss2-copy-desktop-light.png 1197-collabloss2-copy-phone-light.png 1197-collabloss2-copy-tablet-dark.png 1197-collabloss2-copy-tablet-light.png 1197-collabloss2-inbox-desktop-dark.png 1197-collabloss2-inbox-phone-dark.png 1197-collabloss2-inbox-phone-light.png 1197-collabloss2-inbox-tablet-dark.png 1197-collabloss2-inbox-tablet-light.png 1197-final-abrupt-desktop-dark.png 1197-final-abrupt-desktop-light.png 1197-final-abrupt-phone-dark.png 1197-final-abrupt-phone-light.png 1197-final-abrupt-tablet-dark.png 1197-final-abrupt-tablet-light.png 1197-final-copy-desktop-dark.png 1197-final-copy-desktop-light.png 1197-final-copy-phone-dark.png 1197-final-copy-phone-light.png 1197-final-copy-tablet-dark.png 1197-final-copy-tablet-light.png 1197-final-inbox-desktop-dark.png 1197-final-inbox-desktop-light.png 1197-final-inbox-phone-dark.png 1197-final-inbox-phone-light.png 1197-final-inbox-tablet-dark.png 1197-final-clean-desktop-dark.png 1197-final-clean-desktop-light.png 1197-final-clean-phone-dark.png 1197-final-clean-phone-light.png 1197-final-clean-tablet-dark.png 1197-final-clean-tablet-light.png 1197-final-inbox-tablet-light.png 1197-final-pending-desktop-dark.png 1197-final-pending-desktop-light.png 1197-final-pending-phone-dark.png 1197-final-pending-tablet-dark.png 1197-final-capacity-390-light.png 1197-final-capacity-820-dark.png 1197-final-capacity-820-light.png 1197-final-capacity-1440-light.png 1197-final-capacity-390-dark.png 1197-final-capacity-390-light.png 1197-final-capacity-820-light.png copy-phone-light.png 1197-collabloss2-copy-phone-dark.png 1197-final-pending-phone-light.png
kayg commented 2026-10-06 09:31:32 +00:00
Author
Owner
Copy link

Forensics snapshot taken at 15:01 IST: /srv/calternal/forensics-1197-20261006-1131 (journal, cache, tmp). All deploys held until this is fixed.

Forensics snapshot taken at 15:01 IST: /srv/calternal/forensics-1197-20261006-1131 (journal, cache, tmp). All deploys held until this is fixed.
kayg commented 2026-10-06 09:32:17 +00:00
Author
Owner
Copy link

Started on job/collabloss-1197, base 5301e020859c1d61b4a7f812a5049a64241203e8. First inspect production recovery sources read-only, then reproduce source mapping failure and add loss-preserving regression coverage. No Note content will be included in reports. No push or deploy.

Started on `job/collabloss-1197`, base `5301e020859c1d61b4a7f812a5049a64241203e8`. First inspect production recovery sources read-only, then reproduce source mapping failure and add loss-preserving regression coverage. No Note content will be included in reports. No push or deploy.
kayg commented 2026-10-06 09:41:40 +00:00
Author
Owner
Copy link

Recovery evidence: production .system/journal and .system/tmp contain zero files. The copied Index has 18 clean collaboration states and 25 history points across 13 identities; the copied Home histories contain 39 files / 29,548 bytes. Preserved privately at /srv/calternal/recovery-1197-20261006; production source files remain unchanged. Twelve current Notes (13,021 bytes) were copied for comparison. The web Note provider is memory-only; no persistent Note Yjs draft store exists.

Code evidence: flush_document_locked calls patch_source_lines, which rejects a save when the raw body line count differs from its canonical serializer output. Valid adjacent blocks and following-line anchors can change this count. The TypeScript writer already maps source spans by blocks; the Rust flush still assumes aligned lines. A failed flush retains a dirty room in memory, but store_locked explicitly skips dirty rooms and shutdown only logs a failure. Durable collaboration history may retain edits; it needs inspection before a recovery result can be claimed.

Recovery evidence: production `.system/journal` and `.system/tmp` contain zero files. The copied Index has 18 clean collaboration states and 25 history points across 13 identities; the copied Home histories contain 39 files / 29,548 bytes. Preserved privately at `/srv/calternal/recovery-1197-20261006`; production source files remain unchanged. Twelve current Notes (13,021 bytes) were copied for comparison. The web Note provider is memory-only; no persistent Note Yjs draft store exists. Code evidence: `flush_document_locked` calls `patch_source_lines`, which rejects a save when the raw body line count differs from its canonical serializer output. Valid adjacent blocks and following-line anchors can change this count. The TypeScript writer already maps source spans by blocks; the Rust flush still assumes aligned lines. A failed flush retains a dirty room in memory, but `store_locked` explicitly skips dirty rooms and shutdown only logs a failure. Durable collaboration history may retain edits; it needs inspection before a recovery result can be claimed.
kayg commented 2026-10-06 09:54:27 +00:00
Author
Owner
Copy link

Private recovery inspection completed and committed as 2d1da0759. The tool decoded all 25 preserved points without changing production. Latest durable text differs from current canonical Markdown for two existing Note IDs: 2f9eb5e8-bf12-4be6-b71b-5284e266d069 (7,416 durable bytes; 7,401 raw source bytes), and 31511de1-24b4-4441-a2f3-3fe4c81e821d (761 durable bytes; 762 raw source bytes). Identity d2909aed-47be-49ba-b4da-78537c7e3e9e has three recoverable historical points of 12 / 18 / 12 bytes but no current source. Earlier points remain available for selecting a recovery copy. A difference is a recovery candidate, not proof that it belongs to today's incident. No recovery copy has been written to production.

The focused live-room regression failed with the exact production error: Other("could not map edited Markdown to the loaded Note source"). It used valid adjacent Markdown blocks, an external date-field update, and a subsequent live edit. This confirms the line-count assumption as a flush-failure trigger without needing an external body rewrite. The source-span fix is now under test.

Private recovery inspection completed and committed as `2d1da0759`. The tool decoded all 25 preserved points without changing production. Latest durable text differs from current canonical Markdown for two existing Note IDs: `2f9eb5e8-bf12-4be6-b71b-5284e266d069` (7,416 durable bytes; 7,401 raw source bytes), and `31511de1-24b4-4441-a2f3-3fe4c81e821d` (761 durable bytes; 762 raw source bytes). Identity `d2909aed-47be-49ba-b4da-78537c7e3e9e` has three recoverable historical points of 12 / 18 / 12 bytes but no current source. Earlier points remain available for selecting a recovery copy. A difference is a recovery candidate, not proof that it belongs to today's incident. No recovery copy has been written to production. The focused live-room regression failed with the exact production error: `Other("could not map edited Markdown to the loaded Note source")`. It used valid adjacent Markdown blocks, an external date-field update, and a subsequent live edit. This confirms the line-count assumption as a flush-failure trigger without needing an external body rewrite. The source-span fix is now under test.
kayg commented 2026-10-06 10:45:09 +00:00
Author
Owner
Copy link

A second corruption case is confirmed with a synthetic fixture: a heading adds one canonical separator while a following-line block anchor removes one line. Equal raw/canonical line counts can still have different offsets. The old line patch duplicated unchanged prose. Fast patches now validate the requested projection and fall back to source block spans. Focused output:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 96 filtered out; finished in 0.00s

Independent read-only review also identified missing durable capture on checkpoint rebase, Task writer publication, and unstable copy paths after partial Index publication. These are being fixed with regressions. No production Note content has been posted.

A second corruption case is confirmed with a synthetic fixture: a heading adds one canonical separator while a following-line block anchor removes one line. Equal raw/canonical line counts can still have different offsets. The old line patch duplicated unchanged prose. Fast patches now validate the requested projection and fall back to source block spans. Focused output: ``` test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 96 filtered out; finished in 0.00s ``` Independent read-only review also identified missing durable capture on checkpoint rebase, Task writer publication, and unstable copy paths after partial Index publication. These are being fixed with regressions. No production Note content has been posted.
kayg commented 2026-10-06 11:12:02 +00:00
Author
Owner
Copy link

Implementation committed through e839f4508 (room safety: 4eb73ce4d; recovery selector: 143cb726f).

Root cause: the live Markdown bridge assumed that normalized editor lines matched source lines. Date metadata changes left a stale source base. Body changes from Tags, anchors, link cards and external writes could invalidate line/block mapping. The old failed flush path logged an error without a durable pending checkpoint or a conflict copy. Last-client close and shutdown could therefore leave the only complete edits in process memory.

The bridge now validates line patches and uses source block spans. Checked Note, Task and Tag writers publish their committed source as a room transaction before acknowledgement. Flush checks current source and rebases disjoint changes. An unmappable edit creates a checked sibling Note and a durable Inbox notification with Open. Failed saves retain the edited Yrs snapshot plus its source base for restart. Recovered browser updates keep their verified author identities.

Focused verification:

test result: ok. 100 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 66.68s

This includes concurrent typing during date backfill, Tag rewrite and undo, anchor writes, link-card writes, Task writes and external writes; quota failure and restart; two successive restarts; and unmappable-source conflict copies. The writer matrix uses a 4 MiB test thread, equal to the real server worker stack budget. The initial default 2 MiB test thread overflowed while polling the existing Tag reconcile path; no production stack limit was raised.

Recovery inspection remains read-only for production source data. The private snapshot now contains 18 cached states, 25 history points across 13 Note IDs, 39 history files (29,548 bytes), and 16 current Note files (21,331 bytes). The old incident process has restarted. The browser live provider has no persistent local Note draft store.

Differences worth review include cached Note 46b85435-6b39-47a4-9db6-4fd84b805add (27 text bytes), cached and durable Note 31511de1-24b4-4441-a2f3-3fe4c81e821d (761 bytes), and durable Note 2f9eb5e8-bf12-4be6-b71b-5284e266d069 (7,416 bytes, versus the current 7,414-byte editor projection). Note d2909aed-47be-49ba-b4da-78537c7e3e9e has 12/18/12-byte history points without a current source file. One legacy cached key also differs (368 bytes versus 369 current bytes); its path is kept private. These are candidates, not proof that the text was typed during today's incident.

The recovery example can select a durable point, a cached UUID state, or a hashed legacy cached key. It creates a new sibling through the checked writer, with a retry-stable recovery plan. It refuses a destination identical to the copied snapshot. No recovery has been applied. The orchestrator must choose the candidate and an offline destination before running it.

Decisions: use the existing SyncConflict Inbox kind and its Open action; use the existing bounded note_collab_state row for marked pending checkpoints rather than add a migration; retain a private retry plan to avoid duplicate or overwritten recovery Notes after partial Index failure. The opt-in benchmark profile extends the existing Note editor series; measurement is deferred to the merge round under the latest verification policy.

Final gates will follow the single origin/dev merge.

Implementation committed through e839f4508 (room safety: 4eb73ce4d; recovery selector: 143cb726f). Root cause: the live Markdown bridge assumed that normalized editor lines matched source lines. Date metadata changes left a stale source base. Body changes from Tags, anchors, link cards and external writes could invalidate line/block mapping. The old failed flush path logged an error without a durable pending checkpoint or a conflict copy. Last-client close and shutdown could therefore leave the only complete edits in process memory. The bridge now validates line patches and uses source block spans. Checked Note, Task and Tag writers publish their committed source as a room transaction before acknowledgement. Flush checks current source and rebases disjoint changes. An unmappable edit creates a checked sibling Note and a durable Inbox notification with Open. Failed saves retain the edited Yrs snapshot plus its source base for restart. Recovered browser updates keep their verified author identities. Focused verification: ``` test result: ok. 100 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 66.68s ``` This includes concurrent typing during date backfill, Tag rewrite and undo, anchor writes, link-card writes, Task writes and external writes; quota failure and restart; two successive restarts; and unmappable-source conflict copies. The writer matrix uses a 4 MiB test thread, equal to the real server worker stack budget. The initial default 2 MiB test thread overflowed while polling the existing Tag reconcile path; no production stack limit was raised. Recovery inspection remains read-only for production source data. The private snapshot now contains 18 cached states, 25 history points across 13 Note IDs, 39 history files (29,548 bytes), and 16 current Note files (21,331 bytes). The old incident process has restarted. The browser live provider has no persistent local Note draft store. Differences worth review include cached Note 46b85435-6b39-47a4-9db6-4fd84b805add (27 text bytes), cached and durable Note 31511de1-24b4-4441-a2f3-3fe4c81e821d (761 bytes), and durable Note 2f9eb5e8-bf12-4be6-b71b-5284e266d069 (7,416 bytes, versus the current 7,414-byte editor projection). Note d2909aed-47be-49ba-b4da-78537c7e3e9e has 12/18/12-byte history points without a current source file. One legacy cached key also differs (368 bytes versus 369 current bytes); its path is kept private. These are candidates, not proof that the text was typed during today's incident. The recovery example can select a durable point, a cached UUID state, or a hashed legacy cached key. It creates a new sibling through the checked writer, with a retry-stable recovery plan. It refuses a destination identical to the copied snapshot. No recovery has been applied. The orchestrator must choose the candidate and an offline destination before running it. Decisions: use the existing SyncConflict Inbox kind and its Open action; use the existing bounded note_collab_state row for marked pending checkpoints rather than add a migration; retain a private retry plan to avoid duplicate or overwritten recovery Notes after partial Index failure. The opt-in benchmark profile extends the existing Note editor series; measurement is deferred to the merge round under the latest verification policy. Final gates will follow the single origin/dev merge.
kayg commented 2026-10-06 11:57:13 +00:00
Author
Owner
Copy link

Recovery retry finding fixed in 23278a584: after file commit with lost Index publication, a parent-folder rename moved the unindexed recovery file. Retry previously recreated the old folder and a second file with the same identity. The new bounded probe checks the original plan and the current source folder plus the frozen basename. Existing identity and exact-body checks still apply; no Home scan or overwrite is added.

The regression failed at assertion failed: moved.path.starts_with("Archive/") before the fix. After it:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 308 filtered out; finished in 1.64s

A read-only review confirms the reported case is resolved.

Final-gate findings: the first full Notes run had 303 passes, two failures and four ignored tests. Both failures came from the shared root filesystem falling below calternal-fs's unchanged free-space reserve. Test fixtures now use this job's private HDD directory through the prescribed worktree target/tmp path. TMPDIR and CARGO_TARGET_DIR values remain unchanged. Those failures will be rerun; no reserve or assertion is weakened.

The collaboration writer matrix also exposed a fixture scheduling race: a timed live save can legitimately make exact Tag Undo refuse its changed source (#1111). The successful-Undo case now pauses that timer before any writer lock, retains its original assertions, and types during Undo publication too. Production timing is unchanged. Focused and final verification are in progress.

The full web gates passed: 274 files and 1,907 tests; svelte-check has zero errors and two existing CSS warnings. Plugin and Tags Clippy/tests passed. Server Clippy passed. The remaining Rust reruns and real-server UI proof are not yet complete.

Recovery retry finding fixed in 23278a584: after file commit with lost Index publication, a parent-folder rename moved the unindexed recovery file. Retry previously recreated the old folder and a second file with the same identity. The new bounded probe checks the original plan and the current source folder plus the frozen basename. Existing identity and exact-body checks still apply; no Home scan or overwrite is added. The regression failed at `assertion failed: moved.path.starts_with("Archive/")` before the fix. After it: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 308 filtered out; finished in 1.64s ``` A read-only review confirms the reported case is resolved. Final-gate findings: the first full Notes run had 303 passes, two failures and four ignored tests. Both failures came from the shared root filesystem falling below calternal-fs's unchanged free-space reserve. Test fixtures now use this job's private HDD directory through the prescribed worktree target/tmp path. TMPDIR and CARGO_TARGET_DIR values remain unchanged. Those failures will be rerun; no reserve or assertion is weakened. The collaboration writer matrix also exposed a fixture scheduling race: a timed live save can legitimately make exact Tag Undo refuse its changed source (#1111). The successful-Undo case now pauses that timer before any writer lock, retains its original assertions, and types during Undo publication too. Production timing is unchanged. Focused and final verification are in progress. The full web gates passed: 274 files and 1,907 tests; svelte-check has zero errors and two existing CSS warnings. Plugin and Tags Clippy/tests passed. Server Clippy passed. The remaining Rust reruns and real-server UI proof are not yet complete.
kayg commented 2026-10-06 12:17:42 +00:00
Author
Owner
Copy link

The first production UI walk passed preserved text, unchanged source, durable Inbox and Open with pointer, touch and keyboard at 390/820/1440 in light and dark (macOS platform). It exposed a copy-title gap: an original H1 remained the editor title despite the new conflict metadata. A new browser assertion fails against that earlier binary. The fix adds the new managed Note heading and appends the exact room body, including any edited original title. The checked-copy retry test passes. Existing pre-fix plans remain unchanged to avoid overwriting an already-created copy. New final screenshots will replace the earlier review set.

The initial server gate passed 262 tests but timed out after 15 seconds in startup_serves_http_while_upgrade_backfills_wait. That test builds a full app while a Home guard is held. Investigation is focused on the existing startup path and temporary-storage timing; no timeout or assertion was weakened. The Collab library passed all 100 tests; its subsequent cross-language process was terminated before a result. Final crate suites remain in progress.

The first production UI walk passed preserved text, unchanged source, durable Inbox and Open with pointer, touch and keyboard at 390/820/1440 in light and dark (macOS platform). It exposed a copy-title gap: an original H1 remained the editor title despite the new conflict metadata. A new browser assertion fails against that earlier binary. The fix adds the new managed Note heading and appends the exact room body, including any edited original title. The checked-copy retry test passes. Existing pre-fix plans remain unchanged to avoid overwriting an already-created copy. New final screenshots will replace the earlier review set. The initial server gate passed 262 tests but timed out after 15 seconds in startup_serves_http_while_upgrade_backfills_wait. That test builds a full app while a Home guard is held. Investigation is focused on the existing startup path and temporary-storage timing; no timeout or assertion was weakened. The Collab library passed all 100 tests; its subsequent cross-language process was terminated before a result. Final crate suites remain in progress.
kayg commented 2026-10-06 12:54:26 +00:00
Author
Owner
Copy link

Finding: delayed browser update during server adoption (#1197)

A deterministic regression creates an insert against a live block, holds its update in flight, saves the room as a conflict copy, then delivers the update after the server adopts disk. Before the fix the update vanished into deleted Yrs blocks:

late insert vanished into deleted blocks
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 100 filtered out; finished in 1.18s

Commit 992000f97a retains the pre-delete mirror before a server body delta. Ordinary typing and metadata-only commits do not allocate it. The same regression now verifies the complete insert in the live room and a checked durable save:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 100 filtered out; finished in 1.48s

The first full Collab gate also found that initial clean checkpoints changed the no-history crash epoch contract. The fix stores an initial clean base only when durable history needs it; failed saves still checkpoint independently. Existing restart expectations remain unchanged. The full Collab gate is running again because these are new code changes. Notes passed its full gate: 305 unit tests passed, 4 ignored; both integration tests passed. No production recovery has been applied.

Finding: delayed browser update during server adoption (#1197) A deterministic regression creates an insert against a live block, holds its update in flight, saves the room as a conflict copy, then delivers the update after the server adopts disk. Before the fix the update vanished into deleted Yrs blocks: ``` late insert vanished into deleted blocks test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 100 filtered out; finished in 1.18s ``` Commit 992000f97ace335c86692e9bb6486b2c3ead11cd retains the pre-delete mirror before a server body delta. Ordinary typing and metadata-only commits do not allocate it. The same regression now verifies the complete insert in the live room and a checked durable save: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 100 filtered out; finished in 1.48s ``` The first full Collab gate also found that initial clean checkpoints changed the no-history crash epoch contract. The fix stores an initial clean base only when durable history needs it; failed saves still checkpoint independently. Existing restart expectations remain unchanged. The full Collab gate is running again because these are new code changes. Notes passed its full gate: 305 unit tests passed, 4 ignored; both integration tests passed. No production recovery has been applied.
kayg commented 2026-10-06 13:10:58 +00:00
Author
Owner
Copy link

Finding: consecutive source writes and bounded preservation (#1197)

A second regression showed that keeping only the initial mirror was insufficient. A server write created a block, another deleted it, and a delayed browser insert targeted that intermediate block. Before the extension:

new server branch was absent from the retained mirror
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 101 filtered out; finished in 0.53s

The mirror now retains missing structs from each prepared server revision before live mutation, omits deletes there, and advances its comparison base. The live document receives the exact admitted update. The existing 16 MiB encoded-state budget bounds retained branches; exceeding it refuses adoption before either document changes and keeps the existing branches. Its regression checks both trees remain intact.

Both delayed-update cases now pass. The two-write case also checks the durable source and a replay from the real history segment store:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 100 filtered out; finished in 2.29s

Final Collab Clippy passed. The full suite is running for this last code change; both delayed tests and the budget-refusal test passed within it. The full suite before this extension passed, including all unchanged restart-epoch expectations. The real production UI regression passed and its 12 macOS fixture screenshots have been attached. No production recovery, push, merge or deploy was done.

Finding: consecutive source writes and bounded preservation (#1197) A second regression showed that keeping only the initial mirror was insufficient. A server write created a block, another deleted it, and a delayed browser insert targeted that intermediate block. Before the extension: ``` new server branch was absent from the retained mirror test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 101 filtered out; finished in 0.53s ``` The mirror now retains missing structs from each prepared server revision before live mutation, omits deletes there, and advances its comparison base. The live document receives the exact admitted update. The existing 16 MiB encoded-state budget bounds retained branches; exceeding it refuses adoption before either document changes and keeps the existing branches. Its regression checks both trees remain intact. Both delayed-update cases now pass. The two-write case also checks the durable source and a replay from the real history segment store: ``` test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 100 filtered out; finished in 2.29s ``` Final Collab Clippy passed. The full suite is running for this last code change; both delayed tests and the budget-refusal test passed within it. The full suite before this extension passed, including all unchanged restart-epoch expectations. The real production UI regression passed and its 12 macOS fixture screenshots have been attached. No production recovery, push, merge or deploy was done.
kayg commented 2026-10-06 13:17:01 +00:00
Author
Owner
Copy link

Job collabloss-1197 — final report

Built

  • Source-span Note mapping with reparsed-output validation. The permanent save failure and the equal-line-count corruption case both have regression tests.
  • Checked Note, Task and Tag commits enter an open live room before acknowledgement, under the same User writer guard as room flushes. External revisions use a three-way block merge. Unmappable edits become a checked sibling with a durable Inbox Open action.
  • Failed flushes retain a marked Yrs checkpoint and source base. Restart restores pending edits, rebases disk changes and keeps verified browser author identities.
  • A pre-delete Yrs mirror retains late browser updates across server body adoption. It retains later server/client branches from the prepared source update before live mutation. Two before/after regressions check the complete edit, durable source and history replay. A third regression checks that the 16 MiB retention budget refuses adoption without changing either tree. Initial clean checkpoints are restricted to history-backed rooms so the existing no-history crash epoch contract stays unchanged.
  • Retry-stable recovery copies survive partial Index publication, retitles, midnight and a moved source folder. A new managed heading identifies the copy; the full edited room text remains after it.
  • A private history/cache inspection and recovery example. It writes only new siblings when the orchestrator applies a selected state to an offline destination.
  • A focused real-server production UI regression and an opt-in concurrent-write benchmark profile.

Recovery

Production inspection was read-only for source data. A private production scratch copy and a private local snapshot contain 18 cached Yrs states, 25 history points across 13 Note IDs, 39 history files (29,548 bytes; eight of the 25 points dated 2026-10-06), and 16 current Note files (21,331 bytes). Candidate differences were posted as IDs and byte counts in earlier findings. They cannot yet be attributed to the incident. No recovery has been applied. The private copies have mode 0700. The old incident process has restarted; its RAM state is gone. The live browser provider has no persistent local Note draft store. Export any still-open affected tab before reloading it.

The orchestrator must select a candidate from the private snapshot and stop the destination server before applying:

cargo run -p calternal-collab --example recover_note -- artifacts/recovery-1197 --apply <User UUID> <current Note UUID> <point|cached|cached:<legacy-key-hash>> <destination Home root> <destination Index file>

Files

  • calternal-collab: Cargo.toml, examples/recover_note.rs, src/history/write.rs, src/markdown.rs, src/session.rs, src/stored.rs.
  • calternal-plugin: src/notes_writer.rs.
  • calternal-tags: Cargo.toml, src/lib.rs, src/rewrite.rs.
  • calternal-plugin-notes: src/lib.rs, src/recovery.rs, src/store.rs, src/tasks_store.rs.
  • bench/notes-editor-series.mjs and apps/web/e2e/notes-preservation-1197.mjs. No dependency versions or migration numbers changed.

Decisions

  • Keep the checked source writer authoritative. Publish its committed revision into the live room before releasing the User guard or acknowledging the operation. The room uses that same guard and rebases blocks before saving.
  • Use the existing SyncConflict Inbox kind and stable /n/ links. Reuse InboxPanel, OverlaySurface, Menu, CopyLink, Pill/PillGroup and the existing Note editor/Card surfaces. No shared primitive was restyled.
  • Keep a bounded mirror of old branches across source adoption. Replay missing structs without deletes; refuse growth before mirror or live mutation when the 16 MiB budget is reached. Keep the existing branches and checkpoints.
  • Store the initial clean merge base only for history-backed rooms; no-history clean crashes retain their prior fresh-epoch behavior.
  • Use the existing bounded note_collab_state row for pending checkpoints; add no database migration. A pending envelope includes the source base and is not discarded on an ETag mismatch.
  • Freeze a private copy plan before the checked create. Reuse only an exact identity/body match. Probe the moved source folder once; never scan Home for a recovery retry.
  • Give a new copy its managed heading, then preserve the exact room text after it. Pre-fix copy plans stay unchanged rather than overwrite an existing sibling.

Expected cost

One touched Note requires one source read/hash, bounded parse/block merge and the existing checked write/Index publication. Metadata-only writes skip the body merge. A history-backed server body delta already prepares a cloned live document. The first such delta retains one complete Yrs mirror; later deltas add only its missing structs. Retained encoded bytes are capped at 16 MiB. Metadata and ordinary typing do not allocate a new mirror. Failed saves add a checkpoint and, when needed, one copy plan, sibling write and Inbox item. Recovery retry probes at most the planned path and the current sibling path. No new per-request Home scan or unbounded IO loop was added.

Performance measurement is deferred under the latest verification policy because this issue concerns data safety. The existing profile adds a 64-block average case and a 900-block worst case, samples and bursts while typing, p50/p95, CPU and RSS, and last-client durability. There is no existing live-source-write baseline; the older source-locate number is a different operation.

UX gaps closed

  • Failed mapping now gives the User a saved copy and Open instead of only a log warning.
  • A copy has a stable new identity and a distinct managed title while retaining all edited text.
  • Open is checked with pointer, touch and keyboard. Original source bytes remain unchanged in the conflict case. Final macOS screenshots cover 390/820/1440 in light and dark for both Inbox and the saved Note.

UX gaps left / known gaps

  • The calternal-server gate remains red: wire::tests::live_apps_run_in_separate_processes fails because its startup_serves_http_while_upgrade_backfills_wait child exceeds the unchanged 15-second timeout. It also fails with SSD-backed temporary files. No assertion or timeout was weakened; the cause is not established. The real-server UI fixture starts and completes. This report does not claim all gates passed.

  • The source-write performance profile is added but unmeasured in this job; the latest policy reserves performance runs for the perf VM and performance issues. The combined release needs the queued measurement.

  • An unsaved old-process RAM state cannot be reconstructed after that process restarts. Historical candidates need owner review before application.

  • Existing pre-fix copy plans retain their earlier heading; they need a separate checked repair if their displayed title must change. None of this job's recovery copies were applied to production.

  • A simultaneous failure of source storage and durable history/checkpoint storage still requires restoring storage; a software retry cannot make unavailable storage durable.

For the merge round

  • Resolve or verify the startup gate on the combined build with cargo test -p calternal-server wire::tests::startup_serves_http_while_upgrade_backfills_wait -- --exact --ignored --test-threads=4, then cargo test -p calternal-server -- --test-threads=4. It must prove HTTP starts while the Home writer guard remains held.
  • Full E2E, adversarial matrices, release/staging checks and real Mac interop remain merge-round work under the verification policy. Run ADVERSARIAL_SERVER_BIN=<combined binary> tests/adversarial/run.sh and cd apps/web && NOTES_E2E_EXTERNAL_ONLY=1 NOTES_E2E_MACOS=1 CALTERNAL_SERVER_BIN=<combined binary> bun e2e/notes.mjs --screenshots ../../artifacts/1197-merge-notes to check authorization, protocol abuse, source writers and existing Note actions.
  • Run cd apps/web && CALTERNAL_SERVER_BIN=<combined binary> bun e2e/notes-preservation-1197.mjs ../../artifacts/1197-merge-preservation on the combined binary if the merge changes its dependencies.
  • Measure the opt-in bench/notes-editor-series.mjs live-write profile on the perf VM with the shared release binary. Use flock /root/perf.lock bash -c 'uptime; NOTES_EDITOR_PROFILE_LIVE_WRITES=1 CALTERNAL_SERVER_BIN=<shared release binary> bun bench/notes-editor-series.mjs' from the repository on the perf VM; never compile there.

Head: 3f2ec50604. No push, merge or deploy was done. Final gate output and screenshot links follow below. Screenshots use the job server with the managed-copy title implementation and the real production SPA; later branch-mirror changes are covered by the focused and full Rust gates.

Gate output (verbatim)

cargo fmt --check: exit 0; no output. git diff --check: exit 0; no output.

cargo clippy -p calternal-plugin --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 44s

cargo clippy -p calternal-tags --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 28s

cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 31.90s

cargo clippy -p calternal-collab --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 16.63s

cargo clippy -p calternal-server --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 09s

cargo test -p calternal-plugin -- --test-threads=4

test result: ok. 48 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.01s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-tags -- --test-threads=4

test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 92.12s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-notes -- --test-threads=4

test result: ok. 305 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 658.19s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.70s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-server -- --test-threads=4 (SSD-backed comparison; failed)

HTTP startup waited for an upgrade backfill: Elapsed(())
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 272 filtered out; finished in 28.35s
test result: FAILED. 262 passed; 1 failed; 10 ignored; 0 measured; 0 filtered out; finished in 158.64s

cd apps/web && bun run check

perf-lint: PASS; 0 violations; 22359 scoped exceptions
svelte-check found 0 errors and 2 warnings in 2 files

cd apps/web && bun run test

Ran 136 tests in 0.071s
OK
 8 pass
 0 fail
 Test Files  274 passed (274)
      Tests  1907 passed (1907)

CALTERNAL_SERVER_BIN=<job binary> bun e2e/notes-preservation-1197.mjs

PASS #1197 live edit preserved, original unchanged, durable notice, pointer/touch/keyboard Open; 12 macOS screenshots

cargo test -p calternal-collab -- --test-threads=4 (final head, exit 0)

test result: ok. 103 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 40.92s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.69s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.62s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 83.57s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.71s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.78s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.57s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.95s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.70s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.66s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.31s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.13s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.06s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.73s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Screenshot evidence (synthetic fixture only; 12 macOS screenshots)

copy-desktop-dark

copy-desktop-light

copy-phone-dark

copy-phone-light

copy-tablet-dark

copy-tablet-light

inbox-desktop-dark

inbox-desktop-light

inbox-phone-dark

inbox-phone-light

inbox-tablet-dark

inbox-tablet-light

Cleanup

cargo clean completed:

Removed 23785 files, 27.4GiB total

Owned web build output and temporary test data were deleted. The worktree is clean. Private recovery snapshots and review artifacts remain; the local recovery directory is mode 0700.

Job collabloss-1197 — final report Built - Source-span Note mapping with reparsed-output validation. The permanent save failure and the equal-line-count corruption case both have regression tests. - Checked Note, Task and Tag commits enter an open live room before acknowledgement, under the same User writer guard as room flushes. External revisions use a three-way block merge. Unmappable edits become a checked sibling with a durable Inbox Open action. - Failed flushes retain a marked Yrs checkpoint and source base. Restart restores pending edits, rebases disk changes and keeps verified browser author identities. - A pre-delete Yrs mirror retains late browser updates across server body adoption. It retains later server/client branches from the prepared source update before live mutation. Two before/after regressions check the complete edit, durable source and history replay. A third regression checks that the 16 MiB retention budget refuses adoption without changing either tree. Initial clean checkpoints are restricted to history-backed rooms so the existing no-history crash epoch contract stays unchanged. - Retry-stable recovery copies survive partial Index publication, retitles, midnight and a moved source folder. A new managed heading identifies the copy; the full edited room text remains after it. - A private history/cache inspection and recovery example. It writes only new siblings when the orchestrator applies a selected state to an offline destination. - A focused real-server production UI regression and an opt-in concurrent-write benchmark profile. Recovery Production inspection was read-only for source data. A private production scratch copy and a private local snapshot contain 18 cached Yrs states, 25 history points across 13 Note IDs, 39 history files (29,548 bytes; eight of the 25 points dated 2026-10-06), and 16 current Note files (21,331 bytes). Candidate differences were posted as IDs and byte counts in earlier findings. They cannot yet be attributed to the incident. No recovery has been applied. The private copies have mode 0700. The old incident process has restarted; its RAM state is gone. The live browser provider has no persistent local Note draft store. Export any still-open affected tab before reloading it. The orchestrator must select a candidate from the private snapshot and stop the destination server before applying: ``` cargo run -p calternal-collab --example recover_note -- artifacts/recovery-1197 --apply <User UUID> <current Note UUID> <point|cached|cached:<legacy-key-hash>> <destination Home root> <destination Index file> ``` Files - calternal-collab: Cargo.toml, examples/recover_note.rs, src/history/write.rs, src/markdown.rs, src/session.rs, src/stored.rs. - calternal-plugin: src/notes_writer.rs. - calternal-tags: Cargo.toml, src/lib.rs, src/rewrite.rs. - calternal-plugin-notes: src/lib.rs, src/recovery.rs, src/store.rs, src/tasks_store.rs. - bench/notes-editor-series.mjs and apps/web/e2e/notes-preservation-1197.mjs. No dependency versions or migration numbers changed. Decisions - Keep the checked source writer authoritative. Publish its committed revision into the live room before releasing the User guard or acknowledging the operation. The room uses that same guard and rebases blocks before saving. - Use the existing SyncConflict Inbox kind and stable /n/<Note ID> links. Reuse InboxPanel, OverlaySurface, Menu, CopyLink, Pill/PillGroup and the existing Note editor/Card surfaces. No shared primitive was restyled. - Keep a bounded mirror of old branches across source adoption. Replay missing structs without deletes; refuse growth before mirror or live mutation when the 16 MiB budget is reached. Keep the existing branches and checkpoints. - Store the initial clean merge base only for history-backed rooms; no-history clean crashes retain their prior fresh-epoch behavior. - Use the existing bounded note_collab_state row for pending checkpoints; add no database migration. A pending envelope includes the source base and is not discarded on an ETag mismatch. - Freeze a private copy plan before the checked create. Reuse only an exact identity/body match. Probe the moved source folder once; never scan Home for a recovery retry. - Give a new copy its managed heading, then preserve the exact room text after it. Pre-fix copy plans stay unchanged rather than overwrite an existing sibling. Expected cost One touched Note requires one source read/hash, bounded parse/block merge and the existing checked write/Index publication. Metadata-only writes skip the body merge. A history-backed server body delta already prepares a cloned live document. The first such delta retains one complete Yrs mirror; later deltas add only its missing structs. Retained encoded bytes are capped at 16 MiB. Metadata and ordinary typing do not allocate a new mirror. Failed saves add a checkpoint and, when needed, one copy plan, sibling write and Inbox item. Recovery retry probes at most the planned path and the current sibling path. No new per-request Home scan or unbounded IO loop was added. Performance measurement is deferred under the latest verification policy because this issue concerns data safety. The existing profile adds a 64-block average case and a 900-block worst case, samples and bursts while typing, p50/p95, CPU and RSS, and last-client durability. There is no existing live-source-write baseline; the older source-locate number is a different operation. UX gaps closed - Failed mapping now gives the User a saved copy and Open instead of only a log warning. - A copy has a stable new identity and a distinct managed title while retaining all edited text. - Open is checked with pointer, touch and keyboard. Original source bytes remain unchanged in the conflict case. Final macOS screenshots cover 390/820/1440 in light and dark for both Inbox and the saved Note. UX gaps left / known gaps - The calternal-server gate remains red: `wire::tests::live_apps_run_in_separate_processes` fails because its `startup_serves_http_while_upgrade_backfills_wait` child exceeds the unchanged 15-second timeout. It also fails with SSD-backed temporary files. No assertion or timeout was weakened; the cause is not established. The real-server UI fixture starts and completes. This report does not claim all gates passed. - The source-write performance profile is added but unmeasured in this job; the latest policy reserves performance runs for the perf VM and performance issues. The combined release needs the queued measurement. - An unsaved old-process RAM state cannot be reconstructed after that process restarts. Historical candidates need owner review before application. - Existing pre-fix copy plans retain their earlier heading; they need a separate checked repair if their displayed title must change. None of this job's recovery copies were applied to production. - A simultaneous failure of source storage and durable history/checkpoint storage still requires restoring storage; a software retry cannot make unavailable storage durable. For the merge round - Resolve or verify the startup gate on the combined build with `cargo test -p calternal-server wire::tests::startup_serves_http_while_upgrade_backfills_wait -- --exact --ignored --test-threads=4`, then `cargo test -p calternal-server -- --test-threads=4`. It must prove HTTP starts while the Home writer guard remains held. - Full E2E, adversarial matrices, release/staging checks and real Mac interop remain merge-round work under the verification policy. Run `ADVERSARIAL_SERVER_BIN=<combined binary> tests/adversarial/run.sh` and `cd apps/web && NOTES_E2E_EXTERNAL_ONLY=1 NOTES_E2E_MACOS=1 CALTERNAL_SERVER_BIN=<combined binary> bun e2e/notes.mjs --screenshots ../../artifacts/1197-merge-notes` to check authorization, protocol abuse, source writers and existing Note actions. - Run `cd apps/web && CALTERNAL_SERVER_BIN=<combined binary> bun e2e/notes-preservation-1197.mjs ../../artifacts/1197-merge-preservation` on the combined binary if the merge changes its dependencies. - Measure the opt-in bench/notes-editor-series.mjs live-write profile on the perf VM with the shared release binary. Use `flock /root/perf.lock bash -c 'uptime; NOTES_EDITOR_PROFILE_LIVE_WRITES=1 CALTERNAL_SERVER_BIN=<shared release binary> bun bench/notes-editor-series.mjs'` from the repository on the perf VM; never compile there. Head: 3f2ec50604361d6002e73a566b87f4b5bde0eb9e. No push, merge or deploy was done. Final gate output and screenshot links follow below. Screenshots use the job server with the managed-copy title implementation and the real production SPA; later branch-mirror changes are covered by the focused and full Rust gates. Gate output (verbatim) `cargo fmt --check`: exit 0; no output. `git diff --check`: exit 0; no output. `cargo clippy -p calternal-plugin --all-targets -- -D warnings` ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 44s ``` `cargo clippy -p calternal-tags --all-targets -- -D warnings` ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 28s ``` `cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings` ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 31.90s ``` `cargo clippy -p calternal-collab --all-targets -- -D warnings` ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 16.63s ``` `cargo clippy -p calternal-server --all-targets -- -D warnings` ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 09s ``` `cargo test -p calternal-plugin -- --test-threads=4` ``` test result: ok. 48 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.01s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-tags -- --test-threads=4` ``` test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 92.12s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-notes -- --test-threads=4` ``` test result: ok. 305 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 658.19s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.70s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-server -- --test-threads=4` (SSD-backed comparison; failed) ``` HTTP startup waited for an upgrade backfill: Elapsed(()) test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 272 filtered out; finished in 28.35s test result: FAILED. 262 passed; 1 failed; 10 ignored; 0 measured; 0 filtered out; finished in 158.64s ``` `cd apps/web && bun run check` ``` perf-lint: PASS; 0 violations; 22359 scoped exceptions svelte-check found 0 errors and 2 warnings in 2 files ``` `cd apps/web && bun run test` ``` Ran 136 tests in 0.071s OK 8 pass 0 fail Test Files 274 passed (274) Tests 1907 passed (1907) ``` `CALTERNAL_SERVER_BIN=<job binary> bun e2e/notes-preservation-1197.mjs` ``` PASS #1197 live edit preserved, original unchanged, durable notice, pointer/touch/keyboard Open; 12 macOS screenshots ``` `cargo test -p calternal-collab -- --test-threads=4` (final head, exit 0) ``` test result: ok. 103 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 40.92s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.69s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.62s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 83.57s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.71s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.78s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.57s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.95s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.70s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.66s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.31s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.13s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.06s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.73s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Screenshot evidence (synthetic fixture only; 12 macOS screenshots) ![copy-desktop-dark](https://git.kayg.org/attachments/17f338f1-d1bc-4bfe-b319-6de8539a162c) ![copy-desktop-light](https://git.kayg.org/attachments/1e6415be-a9c7-410b-b9d1-3ce62f1f5740) ![copy-phone-dark](https://git.kayg.org/attachments/8e333aaf-9767-4903-8910-c2dda22935a4) ![copy-phone-light](https://git.kayg.org/attachments/19594e75-c429-4f5a-bf66-897f273be1ec) ![copy-tablet-dark](https://git.kayg.org/attachments/37f48b14-4e04-4d2c-af8b-da5164ecfddd) ![copy-tablet-light](https://git.kayg.org/attachments/55a53ef1-6da4-4345-83d5-81ee268e05e3) ![inbox-desktop-dark](https://git.kayg.org/attachments/9738cab3-d780-4cf9-ae79-656214f9fe1c) ![inbox-desktop-light](https://git.kayg.org/attachments/9cd52f61-d984-4b9b-92c5-fdfe8e03dee8) ![inbox-phone-dark](https://git.kayg.org/attachments/f7b49ca4-7a24-4a75-ae8c-7c4997277dc7) ![inbox-phone-light](https://git.kayg.org/attachments/60883005-0d7a-453e-83c5-06a16a14a7c2) ![inbox-tablet-dark](https://git.kayg.org/attachments/d1a28cf1-ae90-4a17-b0bc-616f7c1e588b) ![inbox-tablet-light](https://git.kayg.org/attachments/5482fd20-05c2-4143-bfae-357207cafcf7) Cleanup `cargo clean` completed: ``` Removed 23785 files, 27.4GiB total ``` Owned web build output and temporary test data were deleted. The worktree is clean. Private recovery snapshots and review artifacts remain; the local recovery directory is mode 0700.
kayg commented 2026-10-06 13:19:46 +00:00
Author
Owner
Copy link

Independent review started on branch job/collabloss-1197 at 3f2ec50604. Base origin/dev: 5301e02085. Reviewing the diff and executable failure paths before reading the author report. No push or deployment.

Independent review started on branch job/collabloss-1197 at 3f2ec50604361d6002e73a566b87f4b5bde0eb9e. Base origin/dev: 5301e020859c1d61b4a7f812a5049a64241203e8. Reviewing the diff and executable failure paths before reading the author report. No push or deployment.
kayg commented 2026-10-06 13:27:16 +00:00
Author
Owner
Copy link

Independent review findings at 3f2ec5060 (before the author report):

  1. Pending recovery cache state begins with CNP1197 plus a Markdown base, but examples/recover_note.rs decodes selected cached rows as raw Yrs V1 bytes. The query also excludes valid pending envelopes above 16 MiB although the writer accepts a 16 MiB update plus a 10 MiB base. Adding shared-envelope decoding and bounded selection tests.
  2. The branch mirror for in-flight browser edits is only in Room.conflict_shadow. store_locked stores only the live Yrs state and baseline. load_room initializes conflict_shadow to None while restoring the prior epoch. A delayed edit to a deleted branch can therefore pass lineage checks after restart without a surviving mirror. A focused regression is compiling to verify the loss.
  3. The offline recovery reader uses SegmentHistoryStore::open on its input copy. That store repairs torn tails by truncating segments and initializes the copied Index. It is not a read-only input reader. The tool documents using a separate private copy, which protects production only when the operator follows that instruction.

Rust build is compiling in the job target with four build workers. Web check finished: svelte-check found 0 errors and 2 warnings in 2 files. No production data, credentials, push or deployment used.

Independent review findings at 3f2ec5060 (before the author report): 1. Pending recovery cache state begins with CNP1197 plus a Markdown base, but examples/recover_note.rs decodes selected cached rows as raw Yrs V1 bytes. The query also excludes valid pending envelopes above 16 MiB although the writer accepts a 16 MiB update plus a 10 MiB base. Adding shared-envelope decoding and bounded selection tests. 2. The branch mirror for in-flight browser edits is only in Room.conflict_shadow. store_locked stores only the live Yrs state and baseline. load_room initializes conflict_shadow to None while restoring the prior epoch. A delayed edit to a deleted branch can therefore pass lineage checks after restart without a surviving mirror. A focused regression is compiling to verify the loss. 3. The offline recovery reader uses SegmentHistoryStore::open on its input copy. That store repairs torn tails by truncating segments and initializes the copied Index. It is not a read-only input reader. The tool documents using a separate private copy, which protects production only when the operator follows that instruction. Rust build is compiling in the job target with four build workers. Web check finished: svelte-check found 0 errors and 2 warnings in 2 files. No production data, credentials, push or deployment used.
kayg commented 2026-10-06 13:33:45 +00:00
Author
Owner
Copy link

Provisional verdict on reviewed head 3f2ec50604: SAFE TO MERGE: NO.

The branch mirror is not checkpointed across a clean last-client unload or restart. Both restore the prior room epoch but initialize conflict_shadow=None. A browser update authored in a branch deleted by a checked server write is accepted into a collected parent and disappears from visible Markdown.

An independent Yjs wire-format probe (synthetic fixture) reproduced the checkpoint behavior: {"sameEpochCheckpoint":true,"delayedUpdateBytes":29,"delayedInsertRetained":false}. The preservation assertion fails. The Rust regression exercises the actual Hub loader and a quota-failed checkpoint; a second regression exercises the actual checked writer and clean last-client unload. Both are queued behind the fresh dependency build, not yet claimed as executed.

The fix needs to preserve and restore the branch mirror with its comparison tree, or provide a recovery path for stale-epoch browser drafts before changing lineage. Persisting only the already-collected live Yrs state cannot recover those branches. Do not deploy this head based on the passing ordinary typing/restart tests.

Web gates completed independently: svelte-check found 0 errors and 2 warnings in 2 files; Test Files 274 passed (274); Tests 1907 passed (1907). The author report was read after the independent diff assessment and protocol probe design.

Provisional verdict on reviewed head 3f2ec50604361d6002e73a566b87f4b5bde0eb9e: SAFE TO MERGE: NO. The branch mirror is not checkpointed across a clean last-client unload or restart. Both restore the prior room epoch but initialize conflict_shadow=None. A browser update authored in a branch deleted by a checked server write is accepted into a collected parent and disappears from visible Markdown. An independent Yjs wire-format probe (synthetic fixture) reproduced the checkpoint behavior: {"sameEpochCheckpoint":true,"delayedUpdateBytes":29,"delayedInsertRetained":false}. The preservation assertion fails. The Rust regression exercises the actual Hub loader and a quota-failed checkpoint; a second regression exercises the actual checked writer and clean last-client unload. Both are queued behind the fresh dependency build, not yet claimed as executed. The fix needs to preserve and restore the branch mirror with its comparison tree, or provide a recovery path for stale-epoch browser drafts before changing lineage. Persisting only the already-collected live Yrs state cannot recover those branches. Do not deploy this head based on the passing ordinary typing/restart tests. Web gates completed independently: svelte-check found 0 errors and 2 warnings in 2 files; Test Files 274 passed (274); Tests 1907 passed (1907). The author report was read after the independent diff assessment and protocol probe design.
kayg commented 2026-10-06 13:50:11 +00:00
Author
Owner
Copy link

LIVE REPRO (orchestrator, 2026-10-06 19:14 IST / 15:44 CEST, production 5301e0208): the owner saved a Note; the UI reported "save failed" although the file was written; the server then logged live Note flush deferred ×2, last-client Note flush failed, and live Note flush retry failed every minute since (could not map edited Markdown to the loaded Note source). Second forensics snapshot: /srv/calternal/forensics-1197b-20261006-1549 (journal, cache, tmp; room states also live in note_collab_state.state). Please confirm the fix covers this exact sequence (UI whole-body save succeeds while the live room cannot map → room must rebase onto the saved file, and the UI must not report a failure for a save that committed). Add a regression for it.

LIVE REPRO (orchestrator, 2026-10-06 19:14 IST / 15:44 CEST, production 5301e0208): the owner saved a Note; the UI reported "save failed" although the file was written; the server then logged `live Note flush deferred` ×2, `last-client Note flush failed`, and `live Note flush retry failed` every minute since (could not map edited Markdown to the loaded Note source). Second forensics snapshot: /srv/calternal/forensics-1197b-20261006-1549 (journal, cache, tmp; room states also live in note_collab_state.state). Please confirm the fix covers this exact sequence (UI whole-body save succeeds while the live room cannot map → room must rebase onto the saved file, and the UI must not report a failure for a save that committed). Add a regression for it.
kayg commented 2026-10-06 13:51:10 +00:00
Author
Owner
Copy link

Owner confirmed nothing was lost (note edd525e5…, 475 bytes, file written 13:45:45 UTC). The write came through a WebDAV upload at that exact second (log: calternal_webdav::profile: WebDAV upload stage), i.e. an external WebDAV write while a live room was open — confirm WebDAV PUT/MOVE writes are routed through the open room (or the room rebases onto them) and that the UI never reports a failed save for a committed write. Regression: open live room → WebDAV PUT of the same Note → no warning loop, no failure message, room converges to the file.

Owner confirmed nothing was lost (note edd525e5…, 475 bytes, file written 13:45:45 UTC). The write came through a WebDAV upload at that exact second (log: `calternal_webdav::profile: WebDAV upload stage`), i.e. an external WebDAV write while a live room was open — confirm WebDAV PUT/MOVE writes are routed through the open room (or the room rebases onto them) and that the UI never reports a failed save for a committed write. Regression: open live room → WebDAV PUT of the same Note → no warning loop, no failure message, room converges to the file.
kayg commented 2026-10-06 13:52:23 +00:00
Author
Owner
Copy link

CORRECTION (orchestrator): the 13:45:45 UTC write was NOT an external WebDAV client. uploads::profile_stage logs every Files change-event publish (crates/plugins/files/src/lib.rs publish_inner → target calternal_webdav::profile, message "WebDAV upload stage") for ANY writer, including the app's own Note save. So this is the app's own whole-body save landing while its own live room could not map — the same #1197 mismatch, triggered by the app itself. The regression to add: live room open + the app's fallback/whole-body save of the same Note → no warning loop, no "save failed" message, room converges.

CORRECTION (orchestrator): the 13:45:45 UTC write was NOT an external WebDAV client. `uploads::profile_stage` logs every Files change-event publish (crates/plugins/files/src/lib.rs publish_inner → target calternal_webdav::profile, message "WebDAV upload stage") for ANY writer, including the app's own Note save. So this is the app's own whole-body save landing while its own live room could not map — the same #1197 mismatch, triggered by the app itself. The regression to add: live room open + the app's fallback/whole-body save of the same Note → no warning loop, no "save failed" message, room converges.
kayg commented 2026-10-06 13:53:15 +00:00
Author
Owner
Copy link

Recovery fix committed: d9cac748ca. The recovery example now shares the runtime pending-envelope decoder and the 16 MiB update + 10 MiB source-base selection bound. It streams cached states rather than loading every state at once; legacy-key selection reads identities first and only loads the matching state. Durable history points keep their separate frame limits. No dependency or migration change.

The exact Rust envelope-parser function was tested independently while the full crate dependency build runs. Before: test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s. After: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s. cargo fmt --check and git diff --check exit 0 with no output. Full crate validation is still pending; this comment does not claim its gates passed.

The merge verdict remains NO: this commit does not persist the branch mirror across room unload/restart. The actual Hub preservation regressions and same-block anchor test are in the working tree and queued for execution. No push, deploy or source-data recovery has been performed.

Recovery fix committed: d9cac748cafe1d9fc8bf1dac59fb621a17f07ea6. The recovery example now shares the runtime pending-envelope decoder and the 16 MiB update + 10 MiB source-base selection bound. It streams cached states rather than loading every state at once; legacy-key selection reads identities first and only loads the matching state. Durable history points keep their separate frame limits. No dependency or migration change. The exact Rust envelope-parser function was tested independently while the full crate dependency build runs. Before: test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s. After: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s. cargo fmt --check and git diff --check exit 0 with no output. Full crate validation is still pending; this comment does not claim its gates passed. The merge verdict remains NO: this commit does not persist the branch mirror across room unload/restart. The actual Hub preservation regressions and same-block anchor test are in the working tree and queued for execution. No push, deploy or source-data recovery has been performed.
kayg commented 2026-10-06 14:16:19 +00:00
Author
Owner
Copy link

Independent same-block finding for requirement (3): assigning a Block ID while the User types in that paragraph duplicates the prose in the three-way plan.

I compiled the exact plan_block_edits / merge_chunk / align / diff functions from calternal-collab/src/lib.rs against the current similar dependency. The fixture has one changed live paragraph and an anchor-only source change in that same paragraph. The preservation assertion reports 2 prose copies instead of 1:

assertion `left == right` failed: anchor-only source change duplicated prose
  left: 2
 right: 1
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

The actual Hub regression uses the checked Note writer, live typing in the first block and an added Block ID. It is queued in the crate build. Existing each_source_writer_keeps_concurrent_typing types in another block and does not cover this case. Anchor-only changes need to update the live block metadata; they are not a conflicting prose version. No existing test expectation has been changed.

Verdict remains SAFE TO MERGE: NO at 150c5075d6. The recovery-format fix is committed; branch-mirror persistence and same-block source adoption remain defects. Rust gates remain in progress within the 90-minute review limit.

Independent same-block finding for requirement (3): assigning a Block ID while the User types in that paragraph duplicates the prose in the three-way plan. I compiled the exact plan_block_edits / merge_chunk / align / diff functions from calternal-collab/src/lib.rs against the current similar dependency. The fixture has one changed live paragraph and an anchor-only source change in that same paragraph. The preservation assertion reports 2 prose copies instead of 1: ``` assertion `left == right` failed: anchor-only source change duplicated prose left: 2 right: 1 test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` The actual Hub regression uses the checked Note writer, live typing in the first block and an added Block ID. It is queued in the crate build. Existing each_source_writer_keeps_concurrent_typing types in another block and does not cover this case. Anchor-only changes need to update the live block metadata; they are not a conflicting prose version. No existing test expectation has been changed. Verdict remains SAFE TO MERGE: NO at 150c5075d62890b0077ac82718e3a555a6a302cf. The recovery-format fix is committed; branch-mirror persistence and same-block source adoption remain defects. Rust gates remain in progress within the 90-minute review limit.
kayg commented 2026-10-06 14:43:00 +00:00
Author
Owner
Copy link

SAFE TO MERGE: NO

Independent data-safety review of job/collabloss-1197, original head 3f2ec50604. Final reviewed head: 150c5075d6. origin/dev base 5301e02085; the required fetch and merge found it already up to date. No push, deployment or issue closure.

Blocking findings (actual Hub regression tests, not only model simulations):

  1. Clean room unload/reload silently loses a delayed browser insert into a source block deleted by a server writer. The conflict_shadow holds the pre-delete lineage only in memory; reload initializes it to None while retaining the cached room epoch. The accepted browser update then targets garbage-collected content.
  2. Pending-checkpoint restart has the same loss. Existing restart tests do not cover this deleted-parent update. Both new tests reach apply_client_message and fail their edit-retention assertion.
  3. An anchor-only checked writer during typing in that same paragraph duplicates prose. The merge compares the source block including metadata and retains both variants. The existing writer matrix edits another block and misses this case.

Exact focused output:
clean unload silently discarded the delayed browser edit
restart silently discarded the delayed browser edit
test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 107 filtered out; finished in 2.07s
assertion left == right failed: anchor publication duplicated the original prose
left: 2
right: 1
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 108 filtered out; finished in 1.10s

Fix built in two atomic commits:

  • d9cac748ca: shared bounded clean/pending checkpoint decoder; recovery reads failed-save envelopes rather than raw Yrs, includes the full valid envelope limit (16 MiB update plus 10 MiB source base plus header), rejects missing lineage, streams cache candidates and loads only the selected legacy state. Durable history keeps its separate frame bounds. The decoder does not mutate input bytes.
  • 150c5075d6: documents private recovery input, inactive destination and sibling-only application invariants.
    Files: crates/calternal-collab/src/stored.rs, crates/calternal-collab/src/lib.rs, crates/calternal-collab/examples/recover_note.rs. Re-read their changed comments before reporting.

Gate output, verbatim excerpts from this job:

  • cargo fmt --check: no output, exit 0 (including final clean worktree).
  • cargo clippy -p calternal-collab --all-targets -- -D warnings:
    Finished dev profile [unoptimized + debuginfo] target(s) in 57m 09s
  • cargo test -p calternal-collab --lib -- --test-threads=4, with review regression patch:
    test result: FAILED. 106 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 47.18s
    error: test failed, to rerun pass -p calternal-collab --lib
  • Recovery regressions, including a valid pending state above 16 MiB:
    test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 107 filtered out; finished in 0.82s
  • BOM/CRLF, anchors and repeated prose:
    test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 108 filtered out; finished in 1.59s
  • cargo clippy -p calternal-plugin --all-targets -- -D warnings:
    Finished dev profile [unoptimized + debuginfo] target(s) in 58m 17s
  • cd apps/web && bun run check:
    perf-lint: PASS; 0 violations; 22359 scoped exceptions
    svelte-check found 0 errors and 2 warnings in 2 files
  • cd apps/web && bun run test -- --maxWorkers=2:
    Test Files 274 passed (274)
    Tests 1907 passed (1907)

Known gaps:

  • The two edit-loss paths and anchor duplication are NOT fixed. They block this merge.
  • Strict recovery input read-only behavior is NOT established: SegmentHistoryStore::open is writable and can repair a torn segment in the copied input; opening the Index can initialize it. The documented private-copy requirement protects production only if followed. New sibling creation is checked, but do not treat the input opener as read-only.
  • Per-User conflict-copy/changed-receipt test was prepared but not successfully executed; do not count it as evidence. The passing 106 collab tests include existing failed-flush, quota, consecutive-write, retry and conflict-shadow coverage. They do not prove the entire requested cross-plugin/starvation matrix.
  • The initial fresh cargo build took 59m 14s. At the 90-minute boundary, plugin tests and tags/notes/server explicit clippy/test gates remained incomplete; stopped the job's queued runner instead of exceeding the cap. Dependencies being checked by collab Clippy are not substitute per-crate gates. Full collab integration/doc-test gate also remains incomplete. No unrelated expectation was weakened.
  • Regression source and logs are in worktree artifacts/review-regressions.patch, room-loss-focused.log, anchor-focused.log, source-prose-focused.log, recovery-focused.log, review-collab-tests.log, review-collab-clippy.log and web-test.log. The temporary red regression patch was removed from tracked files after execution; it is preserved for application and repair. No screenshot or review artifact was committed.

For the next verification round, after fixes: apply the saved patch, retain all three retention assertions, then cargo fmt --check; cargo clippy -p --all-targets -- -D warnings and cargo test -p -- --test-threads=4 for calternal-collab, calternal-plugin, calternal-tags, calternal-plugin-notes, calternal-server. Re-run web check/test if dependencies change. Finish focused per-User retry/Open-Inbox receipt proof, fault injection for quota/IO/mapping, server-writer lock order/starvation, and real-server WebDAV/Files overlap. Deployment must remain held.

Decisions: use one shared checkpoint decoder and the existing runtime limits, rather than a second recovery format or weaker bounds. Keep durable-history limits separate. Preserve failing review tests as an artifact rather than commit a knowingly red suite. No new UI or user-visible operation; no UI controls, UX changes, screenshots or performance profile were added. No performance measurement was claimed.

SAFE TO MERGE: NO Independent data-safety review of job/collabloss-1197, original head 3f2ec50604361d6002e73a566b87f4b5bde0eb9e. Final reviewed head: 150c5075d62890b0077ac82718e3a555a6a302cf. origin/dev base 5301e020859c1d61b4a7f812a5049a64241203e8; the required fetch and merge found it already up to date. No push, deployment or issue closure. Blocking findings (actual Hub regression tests, not only model simulations): 1. Clean room unload/reload silently loses a delayed browser insert into a source block deleted by a server writer. The conflict_shadow holds the pre-delete lineage only in memory; reload initializes it to None while retaining the cached room epoch. The accepted browser update then targets garbage-collected content. 2. Pending-checkpoint restart has the same loss. Existing restart tests do not cover this deleted-parent update. Both new tests reach apply_client_message and fail their edit-retention assertion. 3. An anchor-only checked writer during typing in that same paragraph duplicates prose. The merge compares the source block including metadata and retains both variants. The existing writer matrix edits another block and misses this case. Exact focused output: clean unload silently discarded the delayed browser edit restart silently discarded the delayed browser edit test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 107 filtered out; finished in 2.07s assertion `left == right` failed: anchor publication duplicated the original prose left: 2 right: 1 test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 108 filtered out; finished in 1.10s Fix built in two atomic commits: - d9cac748cafe1d9fc8bf1dac59fb621a17f07ea6: shared bounded clean/pending checkpoint decoder; recovery reads failed-save envelopes rather than raw Yrs, includes the full valid envelope limit (16 MiB update plus 10 MiB source base plus header), rejects missing lineage, streams cache candidates and loads only the selected legacy state. Durable history keeps its separate frame bounds. The decoder does not mutate input bytes. - 150c5075d62890b0077ac82718e3a555a6a302cf: documents private recovery input, inactive destination and sibling-only application invariants. Files: crates/calternal-collab/src/stored.rs, crates/calternal-collab/src/lib.rs, crates/calternal-collab/examples/recover_note.rs. Re-read their changed comments before reporting. Gate output, verbatim excerpts from this job: - cargo fmt --check: no output, exit 0 (including final clean worktree). - cargo clippy -p calternal-collab --all-targets -- -D warnings: Finished `dev` profile [unoptimized + debuginfo] target(s) in 57m 09s - cargo test -p calternal-collab --lib -- --test-threads=4, with review regression patch: test result: FAILED. 106 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 47.18s error: test failed, to rerun pass `-p calternal-collab --lib` - Recovery regressions, including a valid pending state above 16 MiB: test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 107 filtered out; finished in 0.82s - BOM/CRLF, anchors and repeated prose: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 108 filtered out; finished in 1.59s - cargo clippy -p calternal-plugin --all-targets -- -D warnings: Finished `dev` profile [unoptimized + debuginfo] target(s) in 58m 17s - cd apps/web && bun run check: perf-lint: PASS; 0 violations; 22359 scoped exceptions svelte-check found 0 errors and 2 warnings in 2 files - cd apps/web && bun run test -- --maxWorkers=2: Test Files 274 passed (274) Tests 1907 passed (1907) Known gaps: - The two edit-loss paths and anchor duplication are NOT fixed. They block this merge. - Strict recovery input read-only behavior is NOT established: SegmentHistoryStore::open is writable and can repair a torn segment in the copied input; opening the Index can initialize it. The documented private-copy requirement protects production only if followed. New sibling creation is checked, but do not treat the input opener as read-only. - Per-User conflict-copy/changed-receipt test was prepared but not successfully executed; do not count it as evidence. The passing 106 collab tests include existing failed-flush, quota, consecutive-write, retry and conflict-shadow coverage. They do not prove the entire requested cross-plugin/starvation matrix. - The initial fresh cargo build took 59m 14s. At the 90-minute boundary, plugin tests and tags/notes/server explicit clippy/test gates remained incomplete; stopped the job's queued runner instead of exceeding the cap. Dependencies being checked by collab Clippy are not substitute per-crate gates. Full collab integration/doc-test gate also remains incomplete. No unrelated expectation was weakened. - Regression source and logs are in worktree artifacts/review-regressions.patch, room-loss-focused.log, anchor-focused.log, source-prose-focused.log, recovery-focused.log, review-collab-tests.log, review-collab-clippy.log and web-test.log. The temporary red regression patch was removed from tracked files after execution; it is preserved for application and repair. No screenshot or review artifact was committed. For the next verification round, after fixes: apply the saved patch, retain all three retention assertions, then cargo fmt --check; cargo clippy -p <crate> --all-targets -- -D warnings and cargo test -p <crate> -- --test-threads=4 for calternal-collab, calternal-plugin, calternal-tags, calternal-plugin-notes, calternal-server. Re-run web check/test if dependencies change. Finish focused per-User retry/Open-Inbox receipt proof, fault injection for quota/IO/mapping, server-writer lock order/starvation, and real-server WebDAV/Files overlap. Deployment must remain held. Decisions: use one shared checkpoint decoder and the existing runtime limits, rather than a second recovery format or weaker bounds. Keep durable-history limits separate. Preserve failing review tests as an artifact rather than commit a knowingly red suite. No new UI or user-visible operation; no UI controls, UX changes, screenshots or performance profile were added. No performance measurement was claimed.
kayg commented 2026-10-06 14:45:25 +00:00
Author
Owner
Copy link

Started collabloss2-1197 on job/collabloss-1197 at 150c5075d6. Base origin/dev: 5301e02085. Applied artifacts/review-regressions.patch unchanged before implementation. Verifying delayed-update lineage, same-block anchor adoption, strict read-only recovery input, receipt/lock order and the app whole-body-save case. No production data, push or deployment.

Started collabloss2-1197 on job/collabloss-1197 at 150c5075d62890b0077ac82718e3a555a6a302cf. Base origin/dev: 5301e020859c1d61b4a7f812a5049a64241203e8. Applied artifacts/review-regressions.patch unchanged before implementation. Verifying delayed-update lineage, same-block anchor adoption, strict read-only recovery input, receipt/lock order and the app whole-body-save case. No production data, push or deployment.
kayg commented 2026-10-06 15:33:28 +00:00
Author
Owner
Copy link

collabloss2-1197: supplied regressions reproduced unchanged. Clean reload and pending restart both fail with the delayed-edit assertions at review head. A room restores its epoch and live Yrs tree but previously dropped the only surviving pre-delete tree. The checkpoint now stores the bounded pre-delete tree and its comparison point atomically with the live tree; restart source rebases retain that tree before deleting roots. Both supplied reload assertions now pass (2 passed; 0 failed). Anchor regression separately reproduces (original prose count 2, expected 1); anchor-only publication needs an in-place metadata delta, not a root replacement. No assertions weakened. App save path is the production case to verify (not WebDAV). Crate validation is running before the first fix commit.

collabloss2-1197: supplied regressions reproduced unchanged. Clean reload and pending restart both fail with the delayed-edit assertions at review head. A room restores its epoch and live Yrs tree but previously dropped the only surviving pre-delete tree. The checkpoint now stores the bounded pre-delete tree and its comparison point atomically with the live tree; restart source rebases retain that tree before deleting roots. Both supplied reload assertions now pass (2 passed; 0 failed). Anchor regression separately reproduces (original prose count 2, expected 1); anchor-only publication needs an in-place metadata delta, not a root replacement. No assertions weakened. App save path is the production case to verify (not WebDAV). Crate validation is running before the first fix commit.
kayg commented 2026-10-06 15:42:39 +00:00
Author
Owner
Copy link

Fix commits: 475e5a340 (reload branches), 4efc2c407 (anchor metadata), fbd49f6ed (strict recovery input reads). Supplied anchor assertion now passes unchanged. Recovery segment test passes with a writer lock held, a torn tail, and a staging file: inspection preserves bytes/inode/mode/mtime/ctime and refuses append/truncate/replace/materialized writes. Input Index test also passes with a WAL-only row; writes are refused and the input file set, bytes and identities remain unchanged.

Decision: immutable SQLite alone omitted the WAL-only row in a focused test (RowNotFound). Recovery therefore streams the fixed Index and WAL names through calternal-fs into private scratch, and reads that scratch copy; history and Notes stay in the read-only input. Memory is bounded; copy IO is linear in Index plus WAL size. The input must be an inactive coherent copy. No production input was modified. The Notes addition only exposes the existing identity lookup/read through a supplied reader pool, so recovery does not construct a writable Db on input.

Fix commits: 475e5a340 (reload branches), 4efc2c407 (anchor metadata), fbd49f6ed (strict recovery input reads). Supplied anchor assertion now passes unchanged. Recovery segment test passes with a writer lock held, a torn tail, and a staging file: inspection preserves bytes/inode/mode/mtime/ctime and refuses append/truncate/replace/materialized writes. Input Index test also passes with a WAL-only row; writes are refused and the input file set, bytes and identities remain unchanged. Decision: immutable SQLite alone omitted the WAL-only row in a focused test (RowNotFound). Recovery therefore streams the fixed Index and WAL names through calternal-fs into private scratch, and reads that scratch copy; history and Notes stay in the read-only input. Memory is bounded; copy IO is linear in Index plus WAL size. The input must be an inactive coherent copy. No production input was modified. The Notes addition only exposes the existing identity lookup/read through a supplied reader pool, so recovery does not construct a writable Db on input.
kayg commented 2026-10-06 15:55:59 +00:00
Author
Owner
Copy link

58b6d6391 commits the production-route and receipt/lock tests. The real local HTTP app-body PUT passes with an unmappable live source projection: HTTP 200, exact saved body, room convergence, three later successful flushes, clean dirty flag, no copy allocated, last-client unload completed with no retry room. The matrix passed 96 cases (8 writer families × 12 locks: User; Hub map/init; room flush/awareness/persisted/baseline/pending Index; bindings/branch mirror/block Index/timezone), with a simultaneous room flush in each case. Real Tag rewrite and Undo, date backfill, Tasks, anchors, link cards, whole-body and recovery-copy writers ran. Source locks were released in a bounded window; no deadlock occurred. Per-User changed-receipt regression passes unchanged.

Nested anchor and replay tests found an extra case: a Block ID belongs to the paragraph inside a quote, rather than its enclosing root. d2602fee8 handles nested carriers, marked prose, delayed inserts and idempotent replay in place. The supplied three blocker assertions remain unchanged.

Recovery was simplified further: its disposable scratch Index now uses the existing Db/Notes reader implementation, so live Notes helpers and their exact performance exceptions are unchanged. Input still uses confined reads only. No ratchet or rule was weakened. One fetch/merge of origin/dev completed (already up to date); final gates are running.

58b6d6391 commits the production-route and receipt/lock tests. The real local HTTP app-body PUT passes with an unmappable live source projection: HTTP 200, exact saved body, room convergence, three later successful flushes, clean dirty flag, no copy allocated, last-client unload completed with no retry room. The matrix passed 96 cases (8 writer families × 12 locks: User; Hub map/init; room flush/awareness/persisted/baseline/pending Index; bindings/branch mirror/block Index/timezone), with a simultaneous room flush in each case. Real Tag rewrite and Undo, date backfill, Tasks, anchors, link cards, whole-body and recovery-copy writers ran. Source locks were released in a bounded window; no deadlock occurred. Per-User changed-receipt regression passes unchanged. Nested anchor and replay tests found an extra case: a Block ID belongs to the paragraph inside a quote, rather than its enclosing root. d2602fee8 handles nested carriers, marked prose, delayed inserts and idempotent replay in place. The supplied three blocker assertions remain unchanged. Recovery was simplified further: its disposable scratch Index now uses the existing Db/Notes reader implementation, so live Notes helpers and their exact performance exceptions are unchanged. Input still uses confined reads only. No ratchet or rule was weakened. One fetch/merge of origin/dev completed (already up to date); final gates are running.
kayg commented 2026-10-06 16:28:42 +00:00
Author
Owner
Copy link

Final gates at a74d3f60e: collab, fs, plugin and tags clippy/tests passed; Notes clippy passed. Both web gates passed (274 Vitest files, 1907 tests; perf-lint has zero violations). The Notes test log reports tests::daily_log_projection_rebuild_resumes_without_markdown_writes ... FAILED; the crate runner is still completing its 700-Note fixture and has not printed the panic yet. I will inspect that diagnostic and run the unchanged test in isolation before reporting completion. The six supplied review functions remain structurally unchanged. The 96-case writer/lock matrix and production browser checks passed; twelve macOS screenshots are attached.

Final gates at a74d3f60e: collab, fs, plugin and tags clippy/tests passed; Notes clippy passed. Both web gates passed (274 Vitest files, 1907 tests; perf-lint has zero violations). The Notes test log reports `tests::daily_log_projection_rebuild_resumes_without_markdown_writes ... FAILED`; the crate runner is still completing its 700-Note fixture and has not printed the panic yet. I will inspect that diagnostic and run the unchanged test in isolation before reporting completion. The six supplied review functions remain structurally unchanged. The 96-case writer/lock matrix and production browser checks passed; twelve macOS screenshots are attached.
kayg commented 2026-10-06 16:30:06 +00:00
Author
Owner
Copy link

The Notes gate finished with 305 passed, 1 failed, 4 ignored. Its only failure was before the rebuild assertion, in the fixture-index loop at crates/plugins/notes/src/lib.rs:16938: ApiError(503, ErrorEnvelope { error: ApiError { code: ServiceUnavailable, message: "Index is busy; retry shortly", details: None } }, true). No changed production path is called by that fixture loop. I started the unchanged 650-file test in isolation, followed by one serial Notes gate rerun and the remaining server gates. The original failed output is retained; no fixture count, assertion, timeout or application behavior is changed.

The Notes gate finished with 305 passed, 1 failed, 4 ignored. Its only failure was before the rebuild assertion, in the fixture-index loop at crates/plugins/notes/src/lib.rs:16938: `ApiError(503, ErrorEnvelope { error: ApiError { code: ServiceUnavailable, message: "Index is busy; retry shortly", details: None } }, true)`. No changed production path is called by that fixture loop. I started the unchanged 650-file test in isolation, followed by one serial Notes gate rerun and the remaining server gates. The original failed output is retained; no fixture count, assertion, timeout or application behavior is changed.
kayg commented 2026-10-06 16:36:58 +00:00
Author
Owner
Copy link

The unchanged isolated 650-file test reached the rebuild but returned the same transient busy error there (JobError at lib.rs:17006; 237.74 s). I found target/tmp was an inherited symlink into /mnt/hdd/targets/jobs/collabrev-1197-tmp, rather than this job's own worktree directory. The target was on /dev/sda (/mnt/hdd); the worktree is on /dev/sdb1. I replaced only the symlink with a private directory (mode 0700), preserving the old review directory and all contents. TMPDIR remains the required worktree/target/tmp and CARGO_TARGET_DIR is unchanged. The server gates are running; one serial full Notes gate will use the worktree directory next. No assertions, fixture sizes, timeouts or application code changed for this environment correction.

The unchanged isolated 650-file test reached the rebuild but returned the same transient busy error there (JobError at lib.rs:17006; 237.74 s). I found `target/tmp` was an inherited symlink into `/mnt/hdd/targets/jobs/collabrev-1197-tmp`, rather than this job's own worktree directory. The target was on /dev/sda (/mnt/hdd); the worktree is on /dev/sdb1. I replaced only the symlink with a private directory (mode 0700), preserving the old review directory and all contents. TMPDIR remains the required worktree/target/tmp and CARGO_TARGET_DIR is unchanged. The server gates are running; one serial full Notes gate will use the worktree directory next. No assertions, fixture sizes, timeouts or application code changed for this environment correction.
kayg commented 2026-10-06 17:04:01 +00:00
Author
Owner
Copy link

The serial Notes run found a second infrastructure limit: later fixtures returned 507 because the root volume fell below its unchanged 31,695,649,792-byte free-space reserve (one captured availability was 31,257,993,216 bytes). Assertions and the reserve stay unchanged. The inherited CARGO_TARGET_DIR is on that volume and owns about 23 GiB of this job's build output; I paused my gate shell, let its active Clippy build finish, and am relocating only that owned cache to /mnt/hdd with the preset path retained through a symlink. No other job's cache or old review directory is removed.

A new focused writer-lock test separately reproduced a real Notes projection failure in 1.23 s: while an authority writer holds its transaction for 1 s, the deferred projection reads a base and exhausts the existing 300 ms snapshot retry budget with ApiError(503, ... "Index is busy; retry shortly" ..., true). The regression covers both Notes and Tasks projection paths. Those paths now reuse the existing BEGIN IMMEDIATE writer-admission policy before reading dependencies. This changes neither SQLite configuration nor an existing test expectation. The fixture sizes and all six review functions remain unchanged.

Exact performance pins were refreshed only for these two live functions and their changed transaction call sites: 433 function hashes in exceptions, 63 matching adoption hashes, 2 exact call-site identities. Rule counts and ratchet are unchanged: perf-lint: PASS; 0 violations; 22359 scoped exceptions. Green confirmation and final gates follow after cache relocation.

The serial Notes run found a second infrastructure limit: later fixtures returned 507 because the root volume fell below its unchanged 31,695,649,792-byte free-space reserve (one captured availability was 31,257,993,216 bytes). Assertions and the reserve stay unchanged. The inherited CARGO_TARGET_DIR is on that volume and owns about 23 GiB of this job's build output; I paused my gate shell, let its active Clippy build finish, and am relocating only that owned cache to /mnt/hdd with the preset path retained through a symlink. No other job's cache or old review directory is removed. A new focused writer-lock test separately reproduced a real Notes projection failure in 1.23 s: while an authority writer holds its transaction for 1 s, the deferred projection reads a base and exhausts the existing 300 ms snapshot retry budget with `ApiError(503, ... "Index is busy; retry shortly" ..., true)`. The regression covers both Notes and Tasks projection paths. Those paths now reuse the existing `BEGIN IMMEDIATE` writer-admission policy before reading dependencies. This changes neither SQLite configuration nor an existing test expectation. The fixture sizes and all six review functions remain unchanged. Exact performance pins were refreshed only for these two live functions and their changed transaction call sites: 433 function hashes in exceptions, 63 matching adoption hashes, 2 exact call-site identities. Rule counts and ratchet are unchanged: `perf-lint: PASS; 0 violations; 22359 scoped exceptions`. Green confirmation and final gates follow after cache relocation.
kayg commented 2026-10-06 17:21:53 +00:00
Author
Owner
Copy link

be618e64ff commits the separate Notes/Tasks projection-admission correction and its contention regression. The old implementation failed that test with a transient 503 in 1.23 s. Both corrected projection paths pass: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 310 filtered out; finished in 2.57s. Notes Clippy completed: Finished dev profile [unoptimized + debuginfo] target(s) in 1m 21s. The original 650-file rebuild test now reports ... ok unchanged in the full Notes run; that full run is still in progress.

Both web gates pass on this source state: perf-lint: PASS; 0 violations; 22359 scoped exceptions, svelte-check found 0 errors and 2 warnings in 2 files, Test Files 274 passed (274), Tests 1907 passed (1907). The build cache relocation completed with the preset CARGO_TARGET_DIR string unchanged; the root volume has 48 GiB free rather than the failing 29 GiB. No reserve, timeout, assertion, fixture size, rule count or ratchet was lowered. The worktree is clean. Remaining Rust consumers, final browser proof and cleanup follow.

be618e64fff50126a2fce3d25c1bc11fbadd77e6 commits the separate Notes/Tasks projection-admission correction and its contention regression. The old implementation failed that test with a transient 503 in 1.23 s. Both corrected projection paths pass: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 310 filtered out; finished in 2.57s`. Notes Clippy completed: `Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s`. The original 650-file rebuild test now reports `... ok` unchanged in the full Notes run; that full run is still in progress. Both web gates pass on this source state: `perf-lint: PASS; 0 violations; 22359 scoped exceptions`, `svelte-check found 0 errors and 2 warnings in 2 files`, `Test Files 274 passed (274)`, `Tests 1907 passed (1907)`. The build cache relocation completed with the preset CARGO_TARGET_DIR string unchanged; the root volume has 48 GiB free rather than the failing 29 GiB. No reserve, timeout, assertion, fixture size, rule count or ratchet was lowered. The worktree is clean. Remaining Rust consumers, final browser proof and cleanup follow.
kayg commented 2026-10-06 18:34:00 +00:00
Author
Owner
Copy link

#1197 follow-up: fixes and verification

NOT READY FOR MERGE: the required server test gate is incomplete.

Head: be618e64fff50126a2fce3d25c1bc11fbadd77e6 on job/collabloss-1197. Base: 150c5075d62890b0077ac82718e3a555a6a302cf. One fetch/merge of origin/dev completed before the final gates: Already up to date. No push, deployment or production recovery was done.

Built

  • Store the retained pre-delete Yrs branches and their comparison tree in the same checkpoint row as the live room. Clean reload and pending restart now retain delayed browser edits. Both supplied regressions pass. Invalid branch envelopes fail without deleting the row.
  • Publish source Block IDs on surviving XML elements. Typing keeps its element identity. Prose stays single, including marked text, nested quote paragraphs, delayed edits and replay. The supplied anchor regression passes.
  • Inspect history with read-only confined handles. Inspection does not take a writer lock, repair a torn segment, remove staging files or create absent history. Index and WAL input are copied through calternal-fs to private scratch. SQLite can recover WAL-only commits there without input writes.
  • Add permanent receipt and concurrency checks. All six functions supplied in review-regressions.patch have unchanged assertions. Receipt retries remain User-bound and refuse an edited sibling without changing either source. Eight writer families run against twelve User/Hub/room locks, with a concurrent room flush in each of 96 cases. No deadlock or retry room occurred.
  • Prove the app's own whole-body save on an unmappable live room. The real HTTP route returns 200, converges, and completes later flushes and room unload. The production browser check also returns 200, keeps the saved text and finds no failed-flush warning loop.
  • Reserve the existing SQLite write slot before Notes and Tasks projection reads. A new authority-lock regression failed the old code with 503 in 1.23 s and passes both corrected paths in 2.57 s. The original 650-file rebuild test passes unchanged. No SQLite setting or test expectation changed.

Files

  • contracts/perf/adoption-1058.json
  • contracts/perf/exceptions.json
  • crates/calternal-collab/examples/recover_note.rs
  • crates/calternal-collab/src/history/mod.rs
  • crates/calternal-collab/src/history/store.rs
  • crates/calternal-collab/src/lib.rs
  • crates/calternal-collab/src/markdown.rs
  • crates/calternal-collab/src/session.rs
  • crates/calternal-collab/src/stored.rs
  • crates/calternal-fs/src/history.rs
  • crates/calternal-fs/src/write.rs
  • crates/plugins/notes/src/recovery.rs
  • crates/plugins/notes/src/store.rs
  • crates/plugins/notes/src/tasks_store.rs

UX gaps closed

Delayed text survives both reload paths. Anchor publication does not duplicate prose. Successful app saves converge. A preserved sibling opens by pointer, touch and keyboard from its durable notification in each tested viewport/theme. No new UI controls or styles were added; the existing Note screen and Inbox were used. Twelve production-build screenshots use macOS platform emulation at 390, 820 and 1440 px, in light and dark. Claude reviews visual quality.

Decisions

Use a versioned outer envelope around the existing clean/pending cache format. This keeps old rows readable without a migration. Freeze the mirror and its comparison point with the live state in one row. Treat new Block IDs as metadata on surviving elements.

Use the existing Db and Notes reader on a disposable Index/WAL copy. An immutable SQLite test omitted a WAL-only commit. Scratch retains that data and confines SQLite sidecar writes away from input. Recovery requires an inactive coherent input copy and a separate inactive application destination.

Cost

Projection query counts are unchanged. Each projection reserves one transaction before dependency reads and uses the existing bounded SQLite wait. No new scan or per-item query is added.

Source rebase work grows with Note blocks and changed Yrs structs. Checkpoint serialization grows with live and retained state bytes, at unload/failure checkpoints, not per keystroke. Each Yrs state is bounded at 16 MiB; the complete envelope is bounded at 58 MiB plus 32 bytes. Recovery streams Index plus WAL bytes with bounded copy memory and caches one decoded history item. This correctness job did not run a performance benchmark, per the current verification policy. Existing bench/notes-external-write.sh covers the source-write path.

Verification retries

The first Notes run and isolated test returned transient SQLite busy errors. A focused authority-lock test established the deferred read-upgrade failure; the writer reservation fix addresses it. A later run hit the unchanged filesystem reserve as other build output filled the root volume. Only this job's build cache and temporary directory moved to private HDD directories; both required environment paths remain unchanged. An earlier temporary-directory change during Clippy invalidated a compiler temporary path; the compiler was restarted. All failed logs are retained.

The exact performance pins moved with two function bodies and two transaction call sites. Refreshes keep all 22,359 exceptions, their owners, reasons and expiry dates. The ratchet and rules are unchanged.

Known gaps / UX gaps left

No unresolved correctness blocker was found in the completed scoped checks. The required final server test gate did not finish: both final linkers remained in disk sleep at the approximately four-hour job limit. Only this job's process tree was stopped (exit 143); no server test result was produced. Server Clippy is green. The final-head server build and production-browser repeat did not run. The earlier production browser check passed on a74d3f60e. These gaps prevent a READY FOR MERGE report. Older checkpoints that already discarded a deleted parent cannot reconstruct that parent; this fix preserves it in new checkpoints. Source production data was not altered. The second independent review is pending. Existing explicitly ignored worker/profile tests stay ignored. No test expectation, performance rule or ratchet was weakened. No secrets were displayed.

For the merge round

  • tests/adversarial/run-split.sh: run the full real-server XUser/authz/robustness matrices on the combined branch.
  • cd apps/web && bun e2e/notes-preservation-1197.mjs and bun run test:e2e:notes: repeat Note acceptance on the combined branch. Run the other e2e scripts required by the merge round. The focused #1197 production browser scenarios have already passed in this job.
  • Run the staging and real Mac interop checks under their required locks. This job supplied macOS-emulated production screenshots.

Browser evidence (verbatim)

The production browser check used head a74d3f60e. The final commit changes only Notes/Tasks projection transaction admission and exact performance pins; all collaboration/recovery source is the same. The repeat against the final server binary is pending its link step.

app whole-body save: HTTP 200, one heading, saved text, no failed-flush loop
PASS #1197 live edit preserved, original unchanged, durable notice, pointer/touch/keyboard Open; 12 macOS screenshots

Final gates

Completed commands below exited 0. Output is verbatim.

cargo clippy -p calternal-collab --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 37s

cargo test -p calternal-collab -- --test-threads=4
    Finished `test` profile [unoptimized + debuginfo] target(s) in 5m 43s
test result: ok. 114 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 161.78s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.22s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.45s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 138.05s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.50s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.65s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.12s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.74s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.27s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.86s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.96s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 30.61s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.86s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.88s

cargo test -p calternal-plugin -- --test-threads=4
    Finished `test` profile [unoptimized + debuginfo] target(s) in 3.94s
test result: ok. 48 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 48.16s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-tags --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.03s

cargo test -p calternal-tags -- --test-threads=4
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.82s
test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 370.45s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s

cargo test -p calternal-plugin-notes -- --test-threads=1
    Finished `test` profile [unoptimized + debuginfo] target(s) in 2.58s
test result: ok. 307 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 759.04s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.82s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-fs --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.11s

cargo test -p calternal-fs -- --test-threads=4
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.73s
test result: ok. 95 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 163.37s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.54s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.88s
test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 65.12s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo fmt --check
(no output; exit 0)

cd apps/web && bun run check
perf-lint: PASS; 0 violations; 22359 scoped exceptions
svelte-check found 0 errors and 2 warnings in 2 files

cd apps/web && bun run test -- --maxWorkers=2
Ran 136 tests in 0.043s
OK
Ran 8 tests across 1 file. [411.00ms]
 Test Files  274 passed (274)
      Tests  1907 passed (1907)
   Duration  350.68s (transform 31%, environment 26%, import 23%, tests 15%, setup 5%)
cargo clippy -p calternal-server --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 37s

Incomplete: cargo test -p calternal-server -- --test-threads=4 was stopped during final linking; exit 143. No tests started.

Remaining job verification

  • cargo test -p calternal-server -- --test-threads=4: complete the required consumer gate.
  • cargo test -p calternal-collab --example recover_note: repeat the focused Index-input check against final head. Its unchanged recovery implementation passed earlier: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.96s.
  • cargo build -p calternal-server, then rebuild the web production output and run bun artifacts/collabloss2-production-proof.mjs artifacts/collabloss2-production-screens with CALTERNAL_SERVER_BIN set to the new binary. This repeats the app whole-body save and screenshot evidence on the final head.

Screenshots

copy-desktop-dark

copy-desktop-light

copy-phone-dark

copy-phone-light

copy-tablet-dark

copy-tablet-light

inbox-desktop-dark

inbox-desktop-light

inbox-phone-dark

inbox-phone-light

inbox-tablet-dark

inbox-tablet-light

Cleanup

cargo clean completed with verbatim output:

     Removed 1 file, 38B total

Cargo removed the preset-path symlink. The remaining owned HDD build cache was removed separately. Web build and SvelteKit output were removed. Screenshots, review input and gate logs remain in artifacts/. git status --short and git diff --check have no output.

# #1197 follow-up: fixes and verification **NOT READY FOR MERGE: the required server test gate is incomplete.** Head: `be618e64fff50126a2fce3d25c1bc11fbadd77e6` on `job/collabloss-1197`. Base: `150c5075d62890b0077ac82718e3a555a6a302cf`. One fetch/merge of `origin/dev` completed before the final gates: `Already up to date.` No push, deployment or production recovery was done. ## Built - Store the retained pre-delete Yrs branches and their comparison tree in the same checkpoint row as the live room. Clean reload and pending restart now retain delayed browser edits. Both supplied regressions pass. Invalid branch envelopes fail without deleting the row. - Publish source Block IDs on surviving XML elements. Typing keeps its element identity. Prose stays single, including marked text, nested quote paragraphs, delayed edits and replay. The supplied anchor regression passes. - Inspect history with read-only confined handles. Inspection does not take a writer lock, repair a torn segment, remove staging files or create absent history. Index and WAL input are copied through calternal-fs to private scratch. SQLite can recover WAL-only commits there without input writes. - Add permanent receipt and concurrency checks. All six functions supplied in review-regressions.patch have unchanged assertions. Receipt retries remain User-bound and refuse an edited sibling without changing either source. Eight writer families run against twelve User/Hub/room locks, with a concurrent room flush in each of 96 cases. No deadlock or retry room occurred. - Prove the app's own whole-body save on an unmappable live room. The real HTTP route returns 200, converges, and completes later flushes and room unload. The production browser check also returns 200, keeps the saved text and finds no failed-flush warning loop. - Reserve the existing SQLite write slot before Notes and Tasks projection reads. A new authority-lock regression failed the old code with 503 in 1.23 s and passes both corrected paths in 2.57 s. The original 650-file rebuild test passes unchanged. No SQLite setting or test expectation changed. ## Files - `contracts/perf/adoption-1058.json` - `contracts/perf/exceptions.json` - `crates/calternal-collab/examples/recover_note.rs` - `crates/calternal-collab/src/history/mod.rs` - `crates/calternal-collab/src/history/store.rs` - `crates/calternal-collab/src/lib.rs` - `crates/calternal-collab/src/markdown.rs` - `crates/calternal-collab/src/session.rs` - `crates/calternal-collab/src/stored.rs` - `crates/calternal-fs/src/history.rs` - `crates/calternal-fs/src/write.rs` - `crates/plugins/notes/src/recovery.rs` - `crates/plugins/notes/src/store.rs` - `crates/plugins/notes/src/tasks_store.rs` ## UX gaps closed Delayed text survives both reload paths. Anchor publication does not duplicate prose. Successful app saves converge. A preserved sibling opens by pointer, touch and keyboard from its durable notification in each tested viewport/theme. No new UI controls or styles were added; the existing Note screen and Inbox were used. Twelve production-build screenshots use macOS platform emulation at 390, 820 and 1440 px, in light and dark. Claude reviews visual quality. ## Decisions Use a versioned outer envelope around the existing clean/pending cache format. This keeps old rows readable without a migration. Freeze the mirror and its comparison point with the live state in one row. Treat new Block IDs as metadata on surviving elements. Use the existing Db and Notes reader on a disposable Index/WAL copy. An immutable SQLite test omitted a WAL-only commit. Scratch retains that data and confines SQLite sidecar writes away from input. Recovery requires an inactive coherent input copy and a separate inactive application destination. ## Cost Projection query counts are unchanged. Each projection reserves one transaction before dependency reads and uses the existing bounded SQLite wait. No new scan or per-item query is added. Source rebase work grows with Note blocks and changed Yrs structs. Checkpoint serialization grows with live and retained state bytes, at unload/failure checkpoints, not per keystroke. Each Yrs state is bounded at 16 MiB; the complete envelope is bounded at 58 MiB plus 32 bytes. Recovery streams Index plus WAL bytes with bounded copy memory and caches one decoded history item. This correctness job did not run a performance benchmark, per the current verification policy. Existing bench/notes-external-write.sh covers the source-write path. ## Verification retries The first Notes run and isolated test returned transient SQLite busy errors. A focused authority-lock test established the deferred read-upgrade failure; the writer reservation fix addresses it. A later run hit the unchanged filesystem reserve as other build output filled the root volume. Only this job's build cache and temporary directory moved to private HDD directories; both required environment paths remain unchanged. An earlier temporary-directory change during Clippy invalidated a compiler temporary path; the compiler was restarted. All failed logs are retained. The exact performance pins moved with two function bodies and two transaction call sites. Refreshes keep all 22,359 exceptions, their owners, reasons and expiry dates. The ratchet and rules are unchanged. ## Known gaps / UX gaps left No unresolved correctness blocker was found in the completed scoped checks. The required final server test gate did not finish: both final linkers remained in disk sleep at the approximately four-hour job limit. Only this job's process tree was stopped (exit 143); no server test result was produced. Server Clippy is green. The final-head server build and production-browser repeat did not run. The earlier production browser check passed on a74d3f60e. These gaps prevent a READY FOR MERGE report. Older checkpoints that already discarded a deleted parent cannot reconstruct that parent; this fix preserves it in new checkpoints. Source production data was not altered. The second independent review is pending. Existing explicitly ignored worker/profile tests stay ignored. No test expectation, performance rule or ratchet was weakened. No secrets were displayed. ## For the merge round - `tests/adversarial/run-split.sh`: run the full real-server XUser/authz/robustness matrices on the combined branch. - `cd apps/web && bun e2e/notes-preservation-1197.mjs` and `bun run test:e2e:notes`: repeat Note acceptance on the combined branch. Run the other e2e scripts required by the merge round. The focused #1197 production browser scenarios have already passed in this job. - Run the staging and real Mac interop checks under their required locks. This job supplied macOS-emulated production screenshots. ## Browser evidence (verbatim) The production browser check used head a74d3f60e. The final commit changes only Notes/Tasks projection transaction admission and exact performance pins; all collaboration/recovery source is the same. The repeat against the final server binary is pending its link step. ```text app whole-body save: HTTP 200, one heading, saved text, no failed-flush loop PASS #1197 live edit preserved, original unchanged, durable notice, pointer/touch/keyboard Open; 12 macOS screenshots ``` ## Final gates Completed commands below exited 0. Output is verbatim. ```text cargo clippy -p calternal-collab --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 37s cargo test -p calternal-collab -- --test-threads=4 Finished `test` profile [unoptimized + debuginfo] target(s) in 5m 43s test result: ok. 114 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 161.78s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.22s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.45s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 138.05s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.50s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.65s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.12s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.74s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.27s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.86s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.96s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 30.61s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.86s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo clippy -p calternal-plugin --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.88s cargo test -p calternal-plugin -- --test-threads=4 Finished `test` profile [unoptimized + debuginfo] target(s) in 3.94s test result: ok. 48 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 48.16s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo clippy -p calternal-tags --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.03s cargo test -p calternal-tags -- --test-threads=4 Finished `test` profile [unoptimized + debuginfo] target(s) in 0.82s test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 370.45s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s cargo test -p calternal-plugin-notes -- --test-threads=1 Finished `test` profile [unoptimized + debuginfo] target(s) in 2.58s test result: ok. 307 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 759.04s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.82s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo clippy -p calternal-fs --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.11s cargo test -p calternal-fs -- --test-threads=4 Finished `test` profile [unoptimized + debuginfo] target(s) in 0.73s test result: ok. 95 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 163.37s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.54s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.88s test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 65.12s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo fmt --check (no output; exit 0) cd apps/web && bun run check perf-lint: PASS; 0 violations; 22359 scoped exceptions svelte-check found 0 errors and 2 warnings in 2 files cd apps/web && bun run test -- --maxWorkers=2 Ran 136 tests in 0.043s OK Ran 8 tests across 1 file. [411.00ms] Test Files 274 passed (274) Tests 1907 passed (1907) Duration 350.68s (transform 31%, environment 26%, import 23%, tests 15%, setup 5%) cargo clippy -p calternal-server --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 37s ``` Incomplete: `cargo test -p calternal-server -- --test-threads=4` was stopped during final linking; exit 143. No tests started. ## Remaining job verification - `cargo test -p calternal-server -- --test-threads=4`: complete the required consumer gate. - `cargo test -p calternal-collab --example recover_note`: repeat the focused Index-input check against final head. Its unchanged recovery implementation passed earlier: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.96s`. - `cargo build -p calternal-server`, then rebuild the web production output and run `bun artifacts/collabloss2-production-proof.mjs artifacts/collabloss2-production-screens` with `CALTERNAL_SERVER_BIN` set to the new binary. This repeats the app whole-body save and screenshot evidence on the final head. ## Screenshots ![copy-desktop-dark](https://git.kayg.org/attachments/78465848-4dc8-4944-8c95-6a94aba83d53) ![copy-desktop-light](https://git.kayg.org/attachments/06c7c8ed-6516-4423-83dc-cd429c7a825c) ![copy-phone-dark](https://git.kayg.org/attachments/9a2064f7-2f50-4f81-8321-17ee13819aaa) ![copy-phone-light](https://git.kayg.org/attachments/ec01d3df-df12-4ac6-a6c6-c2fff1a4ad6a) ![copy-tablet-dark](https://git.kayg.org/attachments/a2cf9b92-8764-4f0b-ae7f-6ec13f8bf3fd) ![copy-tablet-light](https://git.kayg.org/attachments/84a3f016-4eae-4b01-b404-4b42a171d688) ![inbox-desktop-dark](https://git.kayg.org/attachments/3259b169-aa07-4baf-a012-a7c317d1c918) ![inbox-desktop-light](https://git.kayg.org/attachments/2b682358-81c9-4ab6-bfb8-316ba3ae49b6) ![inbox-phone-dark](https://git.kayg.org/attachments/622a341e-53db-4c54-9252-20d8a576bdfd) ![inbox-phone-light](https://git.kayg.org/attachments/3d460502-9747-4733-99a2-b531acc70430) ![inbox-tablet-dark](https://git.kayg.org/attachments/b0ce8c1b-3f23-4c13-9301-15310349be3d) ![inbox-tablet-light](https://git.kayg.org/attachments/a58f279d-41b9-4fe1-bc67-ea5f86ad74c2) ## Cleanup `cargo clean` completed with verbatim output: ```text Removed 1 file, 38B total ``` Cargo removed the preset-path symlink. The remaining owned HDD build cache was removed separately. Web build and SvelteKit output were removed. Screenshots, review input and gate logs remain in artifacts/. `git status --short` and `git diff --check` have no output.
kayg commented 2026-10-06 18:36:52 +00:00
Author
Owner
Copy link

Independent collabrev2 review started at detached be618e64ff, origin/dev base 5301e02085. Findings only; no fixes or commits. Review includes the three prior blockers, source writer races, recovery input immutability, lock order, and rollback framing. Author artifacts have not been read. Focused builds use /mnt/hdd/targets/collabrev2.

Independent collabrev2 review started at detached be618e64fff50126a2fce3d25c1bc11fbadd77e6, origin/dev base 5301e020859c1d61b4a7f812a5049a64241203e8. Findings only; no fixes or commits. Review includes the three prior blockers, source writer races, recovery input immutability, lock order, and rollback framing. Author artifacts have not been read. Focused builds use /mnt/hdd/targets/collabrev2.
kayg commented 2026-10-06 18:57:01 +00:00
Author
Owner
Copy link

Independent collabrev2 finding at be618e64ff: abrupt-restart data loss remains.

A checked server writer deletes a root and its history append becomes durable before the branch mirror is checkpointed (session.rs:1030, :2556). A new Hub loader restores the initial cached epoch with no mirror (:1317); because durable history and Markdown agree, no restart rebase runs (:1526). A delayed browser insert into the deleted root passes the actual client validator but disappears. The scratch regression uses real checked storage, SegmentHistoryStore replay and Hub load; it suppresses only the future debounce and never calls shutdown.

Verbatim output:

abrupt restart silently discarded the delayed browser edit
test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 107 filtered out; finished in 19.38s

Both original clean-reload and pending-restart regressions pass in that run. They cover checkpointed mirrors, not the crash window above. Findings-only; no fix or commit. The remaining focused tests are running. Deployment must remain held.

Independent collabrev2 finding at be618e64fff50126a2fce3d25c1bc11fbadd77e6: abrupt-restart data loss remains. A checked server writer deletes a root and its history append becomes durable before the branch mirror is checkpointed (session.rs:1030, :2556). A new Hub loader restores the initial cached epoch with no mirror (:1317); because durable history and Markdown agree, no restart rebase runs (:1526). A delayed browser insert into the deleted root passes the actual client validator but disappears. The scratch regression uses real checked storage, SegmentHistoryStore replay and Hub load; it suppresses only the future debounce and never calls shutdown. Verbatim output: ``` abrupt restart silently discarded the delayed browser edit test result: FAILED. 12 passed; 1 failed; 0 ignored; 0 measured; 107 filtered out; finished in 19.38s ``` Both original clean-reload and pending-restart regressions pass in that run. They cover checkpointed mirrors, not the crash window above. Findings-only; no fix or commit. The remaining focused tests are running. Deployment must remain held.
kayg commented 2026-10-06 18:59:03 +00:00
Author
Owner
Copy link

Continuing #1197 on job/collabloss-1197, base/head be618e64fff50126a2fce3d25c1bc11fbadd77e6. Deployment remains held. Wiring all five independent scratch probes against this head before behavior changes. No production content is read.

Continuing #1197 on `job/collabloss-1197`, base/head `be618e64fff50126a2fce3d25c1bc11fbadd77e6`. Deployment remains held. Wiring all five independent scratch probes against this head before behavior changes. No production content is read.
kayg commented 2026-10-06 19:16:16 +00:00
Author
Owner
Copy link

Baseline on be618e64fff50126a2fce3d25c1bc11fbadd77e6. All five scratch files were wired without behavior changes. All fixtures are synthetic.

Library command: cargo test -p calternal-collab --lib collabrev2 -- --test-threads=4 --nocapture (exit 101). Four scratch files, six tests; every test failed. Verbatim runtime output follows.

running 6 tests
checked_writer_status=500 Internal Server Error file_changed=true

thread 'session::collabrev2_committed_error::saturated_mirror_cannot_report_failed_save_after_commit' (2865654) panicked at crates/calternal-collab/src/session.rs:7537:9:
checked save returned an error after changing the file at the mirror budget boundary
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
test session::collabrev2_committed_error::saturated_mirror_cannot_report_failed_save_after_commit ... FAILED
same_epoch=true restored_shadow=false validator_accepted=true visible_delayed_edit=false

thread 'session::collabrev2_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit' (2865655) panicked at crates/calternal-collab/src/session.rs:7510:9:
abrupt restart silently discarded the delayed browser edit
test session::collabrev2_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... FAILED
new_reader_restores_pending=true rollback_reader_restores_pending=false checkpoint_rows_after_rollback=0

thread 'stored::collabrev2_rollback::rollback_reader_retains_pending_checkpoint' (2866042) panicked at crates/calternal-collab/src/stored.rs:574:5:
assertion `left == right` failed: rollback reader deleted the pending recovery checkpoint on source mismatch
  left: 0
 right: 1
test stored::collabrev2_rollback::rollback_reader_retains_pending_checkpoint ... FAILED
writer=hide resulting_items=2 typed_count=1

thread 'session::collabrev2_same_block::same_log_hide_joins_typing_once' (2865656) panicked at crates/calternal-collab/src/session.rs:7579:9:
assertion `left == right` failed: hide writer duplicated the item instead of joining its metadata to typed prose
  left: 2
 right: 1
test session::collabrev2_same_block::same_log_hide_joins_typing_once ... FAILED
writer=tag resulting_items=2 typed_count=1

thread 'session::collabrev2_same_block::same_tag_rewrite_joins_typing_once' (2865657) panicked at crates/calternal-collab/src/session.rs:7579:9:
assertion `left == right` failed: tag writer duplicated the item instead of joining its metadata to typed prose
  left: 2
 right: 1
test session::collabrev2_same_block::same_tag_rewrite_joins_typing_once ... FAILED
writer=task resulting_items=2 typed_count=1

thread 'session::collabrev2_same_block::same_task_completion_joins_typing_once' (2866007) panicked at crates/calternal-collab/src/session.rs:7579:9:
assertion `left == right` failed: task writer duplicated the item instead of joining its metadata to typed prose
  left: 2
 right: 1
test session::collabrev2_same_block::same_task_completion_joins_typing_once ... FAILED

failures:

failures:
    session::collabrev2_committed_error::saturated_mirror_cannot_report_failed_save_after_commit
    session::collabrev2_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit
    session::collabrev2_same_block::same_log_hide_joins_typing_once
    session::collabrev2_same_block::same_tag_rewrite_joins_typing_once
    session::collabrev2_same_block::same_task_completion_joins_typing_once
    stored::collabrev2_rollback::rollback_reader_retains_pending_checkpoint

test result: FAILED. 0 passed; 6 failed; 0 ignored; 0 measured; 114 filtered out; finished in 10.48s

error: test failed, to rerun pass `-p calternal-collab --lib`

Recovery command: cargo test -p calternal-collab --example recover_note collabrev2 -- --test-threads=4 --nocapture (exit 101). Verbatim runtime output follows.

running 1 test
Note 71ef6706-859b-4817-858b-9cec2660d951 point cached recovered_id a314aa9b-1598-4a89-8c4f-b861f94b4517 recovered_bytes 54
input_index_changed=true application_succeeded=true

thread 'collabrev2_recovery_alias::apply_rejects_input_index_as_destination' (2869668) panicked at crates/calternal-collab/examples/recover_note.rs:553:5:
recovery apply modified its input Index via the destination argument
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
test collabrev2_recovery_alias::apply_rejects_input_index_as_destination ... FAILED

failures:

failures:
    collabrev2_recovery_alias::apply_rejects_input_index_as_destination

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 1 filtered out; finished in 5.36s

error: test failed, to rerun pass `-p calternal-collab --example recover_note`

All five scratch files expose real failures (seven failing cases). The recovery command accepted its input Index as the writable destination and changed it. Deployment remains held while these paths are fixed.

Decisions: checkpoint retained parents before history capture; use a preflight on the shared source observer to refuse the branch budget before rename; protect recovery input by held inode identities; protect pending/branch rows from legacy reader deletion and replacement; join source metadata into retained Yrs elements while keeping prose conflicts visible.

Baseline on `be618e64fff50126a2fce3d25c1bc11fbadd77e6`. All five scratch files were wired without behavior changes. All fixtures are synthetic. Library command: `cargo test -p calternal-collab --lib collabrev2 -- --test-threads=4 --nocapture` (exit 101). Four scratch files, six tests; every test failed. Verbatim runtime output follows. ```text running 6 tests checked_writer_status=500 Internal Server Error file_changed=true thread 'session::collabrev2_committed_error::saturated_mirror_cannot_report_failed_save_after_commit' (2865654) panicked at crates/calternal-collab/src/session.rs:7537:9: checked save returned an error after changing the file at the mirror budget boundary note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace test session::collabrev2_committed_error::saturated_mirror_cannot_report_failed_save_after_commit ... FAILED same_epoch=true restored_shadow=false validator_accepted=true visible_delayed_edit=false thread 'session::collabrev2_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit' (2865655) panicked at crates/calternal-collab/src/session.rs:7510:9: abrupt restart silently discarded the delayed browser edit test session::collabrev2_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... FAILED new_reader_restores_pending=true rollback_reader_restores_pending=false checkpoint_rows_after_rollback=0 thread 'stored::collabrev2_rollback::rollback_reader_retains_pending_checkpoint' (2866042) panicked at crates/calternal-collab/src/stored.rs:574:5: assertion `left == right` failed: rollback reader deleted the pending recovery checkpoint on source mismatch left: 0 right: 1 test stored::collabrev2_rollback::rollback_reader_retains_pending_checkpoint ... FAILED writer=hide resulting_items=2 typed_count=1 thread 'session::collabrev2_same_block::same_log_hide_joins_typing_once' (2865656) panicked at crates/calternal-collab/src/session.rs:7579:9: assertion `left == right` failed: hide writer duplicated the item instead of joining its metadata to typed prose left: 2 right: 1 test session::collabrev2_same_block::same_log_hide_joins_typing_once ... FAILED writer=tag resulting_items=2 typed_count=1 thread 'session::collabrev2_same_block::same_tag_rewrite_joins_typing_once' (2865657) panicked at crates/calternal-collab/src/session.rs:7579:9: assertion `left == right` failed: tag writer duplicated the item instead of joining its metadata to typed prose left: 2 right: 1 test session::collabrev2_same_block::same_tag_rewrite_joins_typing_once ... FAILED writer=task resulting_items=2 typed_count=1 thread 'session::collabrev2_same_block::same_task_completion_joins_typing_once' (2866007) panicked at crates/calternal-collab/src/session.rs:7579:9: assertion `left == right` failed: task writer duplicated the item instead of joining its metadata to typed prose left: 2 right: 1 test session::collabrev2_same_block::same_task_completion_joins_typing_once ... FAILED failures: failures: session::collabrev2_committed_error::saturated_mirror_cannot_report_failed_save_after_commit session::collabrev2_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit session::collabrev2_same_block::same_log_hide_joins_typing_once session::collabrev2_same_block::same_tag_rewrite_joins_typing_once session::collabrev2_same_block::same_task_completion_joins_typing_once stored::collabrev2_rollback::rollback_reader_retains_pending_checkpoint test result: FAILED. 0 passed; 6 failed; 0 ignored; 0 measured; 114 filtered out; finished in 10.48s error: test failed, to rerun pass `-p calternal-collab --lib` ``` Recovery command: `cargo test -p calternal-collab --example recover_note collabrev2 -- --test-threads=4 --nocapture` (exit 101). Verbatim runtime output follows. ```text running 1 test Note 71ef6706-859b-4817-858b-9cec2660d951 point cached recovered_id a314aa9b-1598-4a89-8c4f-b861f94b4517 recovered_bytes 54 input_index_changed=true application_succeeded=true thread 'collabrev2_recovery_alias::apply_rejects_input_index_as_destination' (2869668) panicked at crates/calternal-collab/examples/recover_note.rs:553:5: recovery apply modified its input Index via the destination argument note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace test collabrev2_recovery_alias::apply_rejects_input_index_as_destination ... FAILED failures: failures: collabrev2_recovery_alias::apply_rejects_input_index_as_destination test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 1 filtered out; finished in 5.36s error: test failed, to rerun pass `-p calternal-collab --example recover_note` ``` All five scratch files expose real failures (seven failing cases). The recovery command accepted its input Index as the writable destination and changed it. Deployment remains held while these paths are fixed. Decisions: checkpoint retained parents before history capture; use a preflight on the shared source observer to refuse the branch budget before rename; protect recovery input by held inode identities; protect pending/branch rows from legacy reader deletion and replacement; join source metadata into retained Yrs elements while keeping prose conflicts visible.
kayg commented 2026-10-06 19:19:30 +00:00
Author
Owner
Copy link

Recovery alias path fixed in b7c4d9146498d89eb2cc4070540aabf118bdd5a8. The scratch assertion now calls the real command through a shared async entry point. Direct input Index reuse, hard links to Index/WAL/SHM, symlink leaves and directory aliases are refused before opening a writable Index. A small Root::root_fingerprint addition exposes held directory identity without changing filesystem behavior. Input bytes remain unchanged.

Focused regression output (verbatim):

running 3 tests
test destination_tests::destination_identity_checks_cover_aliases_and_a_separate_index ... ok
test tests::input_index_is_read_only_including_wal ... ok
test destination_tests::apply_rejects_input_index_as_destination ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.59s

cargo fmt --check exited 0 with no output. Final crate gates will run after all fixes and the one origin/dev merge.

Recovery alias path fixed in `b7c4d9146498d89eb2cc4070540aabf118bdd5a8`. The scratch assertion now calls the real command through a shared async entry point. Direct input Index reuse, hard links to Index/WAL/SHM, symlink leaves and directory aliases are refused before opening a writable Index. A small `Root::root_fingerprint` addition exposes held directory identity without changing filesystem behavior. Input bytes remain unchanged. Focused regression output (verbatim): ```text running 3 tests test destination_tests::destination_identity_checks_cover_aliases_and_a_separate_index ... ok test tests::input_index_is_read_only_including_wal ... ok test destination_tests::apply_rejects_input_index_as_destination ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.59s ``` `cargo fmt --check` exited 0 with no output. Final crate gates will run after all fixes and the one origin/dev merge.
kayg commented 2026-10-06 19:30:34 +00:00
Author
Owner
Copy link

Branch durability and checked-write ordering fixed in a53a18d5c8596ecd29a15580e80c2ba5a5abc4b7. The branch checkpoint commits before a deleting update enters history, covering checked sources, client root deletion/conflict repair and history restore/undo. Preview-only server IDs enter the mirror only after live integration, with no await before queue capture. Reload seeds a missing mirror from an older cached lineage even when history and Markdown agree.

The shared source observer now has a read-only preflight. Notes, Tasks and Tag rewrites call it before rename. At the branch budget boundary the original regression now refuses with unchanged file bytes. Post-rename reconciliation failures retain a pending room and retry; they do not falsely report a failed source save.

The crash test keeps its delayed-edit assertion. Its old mirror.is_none() setup check now expects a persisted mirror, as this issue explicitly changes that ordering. A second case explicitly installs the older clean row and retains the original missing-mirror scenario. No existing test expectations changed.

Expected cost: one bounded Note/mirror checkpoint per structural source or root-deleting update; ordinary typing keeps the existing update-log path. No Home scan and no independent-IO await loop was added.

Focused regression output (verbatim):

running 13 tests
test markdown::source_patch_tests::source_patch_refuses_unaligned_line_counts ... ok
test markdown::source_patch_tests::changed_line_keeps_unedited_crlf_tabs_and_trailing_spaces ... ok
test markdown::source_patch_tests::source_patch_maps_blocks_when_serialization_adds_separators ... ok
test markdown::source_patch_tests::equal_line_counts_do_not_mean_equal_source_offsets ... ok
test session::external_persistence_race_tests::pending_restart_keeps_delayed_insert_into_deleted_source_block ... ok
test session::external_persistence_race_tests::clean_reload_keeps_delayed_insert_into_deleted_source_block ... ok
test session::external_persistence_race_tests::live_edit_survives_unaligned_source_after_external_metadata ... ok
test session::external_persistence_race_tests::source_rebase_keeps_bom_crlf_anchors_and_repeated_prose ... ok
test session::external_persistence_race_tests::unmappable_source_keeps_edits_in_conflict_copy ... ok
test session::source_budget_tests::saturated_mirror_cannot_report_failed_save_after_commit ... ok
test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok
test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok
test session::external_persistence_race_tests::each_source_writer_keeps_concurrent_typing ... ok

test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 104 filtered out; finished in 38.47s

cargo fmt --check exited 0 with no output. Remaining baseline failures: rollback retention and the three metadata joins.

Branch durability and checked-write ordering fixed in `a53a18d5c8596ecd29a15580e80c2ba5a5abc4b7`. The branch checkpoint commits before a deleting update enters history, covering checked sources, client root deletion/conflict repair and history restore/undo. Preview-only server IDs enter the mirror only after live integration, with no await before queue capture. Reload seeds a missing mirror from an older cached lineage even when history and Markdown agree. The shared source observer now has a read-only preflight. Notes, Tasks and Tag rewrites call it before rename. At the branch budget boundary the original regression now refuses with unchanged file bytes. Post-rename reconciliation failures retain a pending room and retry; they do not falsely report a failed source save. The crash test keeps its delayed-edit assertion. Its old `mirror.is_none()` setup check now expects a persisted mirror, as this issue explicitly changes that ordering. A second case explicitly installs the older clean row and retains the original missing-mirror scenario. No existing test expectations changed. Expected cost: one bounded Note/mirror checkpoint per structural source or root-deleting update; ordinary typing keeps the existing update-log path. No Home scan and no independent-IO await loop was added. Focused regression output (verbatim): ```text running 13 tests test markdown::source_patch_tests::source_patch_refuses_unaligned_line_counts ... ok test markdown::source_patch_tests::changed_line_keeps_unedited_crlf_tabs_and_trailing_spaces ... ok test markdown::source_patch_tests::source_patch_maps_blocks_when_serialization_adds_separators ... ok test markdown::source_patch_tests::equal_line_counts_do_not_mean_equal_source_offsets ... ok test session::external_persistence_race_tests::pending_restart_keeps_delayed_insert_into_deleted_source_block ... ok test session::external_persistence_race_tests::clean_reload_keeps_delayed_insert_into_deleted_source_block ... ok test session::external_persistence_race_tests::live_edit_survives_unaligned_source_after_external_metadata ... ok test session::external_persistence_race_tests::source_rebase_keeps_bom_crlf_anchors_and_repeated_prose ... ok test session::external_persistence_race_tests::unmappable_source_keeps_edits_in_conflict_copy ... ok test session::source_budget_tests::saturated_mirror_cannot_report_failed_save_after_commit ... ok test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok test session::external_persistence_race_tests::each_source_writer_keeps_concurrent_typing ... ok test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 104 filtered out; finished in 38.47s ``` `cargo fmt --check` exited 0 with no output. Remaining baseline failures: rollback retention and the three metadata joins.
kayg commented 2026-10-06 19:38:26 +00:00
Author
Owner
Copy link

Rollback retention fixed in 5dbd741d16d97d403d981fd4f450a8e363ef40f4. The real Notes migration installs SQLite guards for pending and branch rows. The copied legacy reader remains behaviorally unchanged. Its ETag-mismatch DELETE no longer removes pending bytes; fresh-epoch UPSERT, UPDATE and INSERT OR REPLACE also keep them. Same-epoch recovery can finish as clean, and that clean row remains disposable. The new writer checks affected-row count and reports a refused epoch instead of claiming a checkpoint was stored. User purge removes the private User Index, including these guards and rows.

Decision: protect checkpoints in SQLite, not only in the new reader, because an older binary does not contain a new reader-side guard. Migration 0036 is provisional until the required final origin/dev fetch; it will be renumbered if needed. The existing exact last-migration assertion advances 35→36 because the issue adds this schema behavior; no API or content assertion was weakened.

Focused regression output (verbatim):

running 1 test
test stored::rollback_tests::rollback_reader_retains_pending_checkpoint ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 117 filtered out; finished in 0.54s

cargo fmt --check exited 0 with no output. Remaining baseline failures: the three metadata joins.

Rollback retention fixed in `5dbd741d16d97d403d981fd4f450a8e363ef40f4`. The real Notes migration installs SQLite guards for pending and branch rows. The copied legacy reader remains behaviorally unchanged. Its ETag-mismatch DELETE no longer removes pending bytes; fresh-epoch UPSERT, UPDATE and INSERT OR REPLACE also keep them. Same-epoch recovery can finish as clean, and that clean row remains disposable. The new writer checks affected-row count and reports a refused epoch instead of claiming a checkpoint was stored. User purge removes the private User Index, including these guards and rows. Decision: protect checkpoints in SQLite, not only in the new reader, because an older binary does not contain a new reader-side guard. Migration 0036 is provisional until the required final origin/dev fetch; it will be renumbered if needed. The existing exact last-migration assertion advances 35→36 because the issue adds this schema behavior; no API or content assertion was weakened. Focused regression output (verbatim): ```text running 1 test test stored::rollback_tests::rollback_reader_retains_pending_checkpoint ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 117 filtered out; finished in 0.54s ``` `cargo fmt --check` exited 0 with no output. Remaining baseline failures: the three metadata joins.
kayg commented 2026-10-06 20:08:28 +00:00
Author
Owner
Copy link

Task, Hide and Tag source changes now join concurrent typing in the existing Yrs parents. The original three same-block regressions keep their item-count and text-count assertions. Added cases check the actual checkbox/Hide/Tag change, formatted runs, Unicode, stable parent IDs, further typing after a source change, and restart with durable history. Overlapping prose and code still produce visible conflict blocks.

The retained branch mirror applies only new text/attribute deletions when current roots survive. Root deletion sets stay out of the mirror. This distinction prevents old Tag characters from returning during later typing or history reload.

Decisions: in-place joins apply only to pure metadata changes with unchanged node shapes and marks. Inline character diffs are limited to 64 KiB and a 200 ms deadline. Uncertain or larger joins use the existing visible block-conflict path. No Home scan was added. Work is linear in the affected Note tree plus bounded inline diffs, and it runs at source/restart boundaries, not on ordinary typing.

Focused output follows verbatim.

Commit: 3381f64187

   Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 33.90s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-4ac7daa99a6d214a)

running 10 tests
test block_merge_tests::metadata_join_does_not_hide_prose_or_code_conflicts ... ok
test block_merge_tests::metadata_joins_keep_parent_identity_and_unicode_text ... ok
test session::source_metadata_tests::same_log_hide_joins_typing_once ... ok
test session::source_metadata_tests::same_tag_rewrite_joins_typing_once ... ok
test session::source_metadata_tests::formatted_task_completion_joins_typing_once ... ok
test session::source_metadata_tests::formatted_tag_rewrite_joins_typing_once ... ok
test session::source_metadata_tests::same_task_completion_joins_typing_once ... ok
test session::source_metadata_tests::tag_writer_keeps_following_typing_once ... ok
test session::source_metadata_tests::tag_writer_restart_keeps_following_typing_once ... ok
test session::source_metadata_tests::tag_writer_history_restart_keeps_following_typing_once ... ok

test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 118 filtered out; finished in 9.57s

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1.42s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-4ac7daa99a6d214a)

running 21 tests
test markdown::source_patch_tests::source_patch_refuses_unaligned_line_counts ... ok
test markdown::source_patch_tests::changed_line_keeps_unedited_crlf_tabs_and_trailing_spaces ... ok
test markdown::source_patch_tests::equal_line_counts_do_not_mean_equal_source_offsets ... ok
test markdown::source_patch_tests::source_patch_maps_blocks_when_serialization_adds_separators ... ok
test session::external_persistence_race_tests::clean_reload_keeps_delayed_insert_into_deleted_source_block ... ok
test session::external_persistence_race_tests::pending_restart_keeps_delayed_insert_into_deleted_source_block ... ok
test session::external_persistence_race_tests::live_edit_survives_unaligned_source_after_external_metadata ... ok
test session::external_persistence_race_tests::source_rebase_keeps_bom_crlf_anchors_and_repeated_prose ... ok
test session::source_budget_tests::saturated_mirror_cannot_report_failed_save_after_commit ... ok
test session::external_persistence_race_tests::unmappable_source_keeps_edits_in_conflict_copy ... ok
test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok
test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok
test session::source_metadata_tests::formatted_tag_rewrite_joins_typing_once ... ok
test session::source_metadata_tests::formatted_task_completion_joins_typing_once ... ok
test session::source_metadata_tests::same_log_hide_joins_typing_once ... ok
test session::source_metadata_tests::same_tag_rewrite_joins_typing_once ... ok
test session::source_metadata_tests::same_task_completion_joins_typing_once ... ok
test session::source_metadata_tests::tag_writer_keeps_following_typing_once ... ok
test session::source_metadata_tests::tag_writer_history_restart_keeps_following_typing_once ... ok
test session::source_metadata_tests::tag_writer_restart_keeps_following_typing_once ... ok
test session::external_persistence_race_tests::each_source_writer_keeps_concurrent_typing ... ok

test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 107 filtered out; finished in 37.96s

cargo fmt --check exited 0 with no output. All seven baseline failures now have passing focused regressions.

Task, Hide and Tag source changes now join concurrent typing in the existing Yrs parents. The original three same-block regressions keep their item-count and text-count assertions. Added cases check the actual checkbox/Hide/Tag change, formatted runs, Unicode, stable parent IDs, further typing after a source change, and restart with durable history. Overlapping prose and code still produce visible conflict blocks. The retained branch mirror applies only new text/attribute deletions when current roots survive. Root deletion sets stay out of the mirror. This distinction prevents old Tag characters from returning during later typing or history reload. Decisions: in-place joins apply only to pure metadata changes with unchanged node shapes and marks. Inline character diffs are limited to 64 KiB and a 200 ms deadline. Uncertain or larger joins use the existing visible block-conflict path. No Home scan was added. Work is linear in the affected Note tree plus bounded inline diffs, and it runs at source/restart boundaries, not on ordinary typing. Focused output follows verbatim. Commit: 3381f6418711e1fca8c95ae42858c0cd3c147f2c ```text Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Finished `test` profile [unoptimized + debuginfo] target(s) in 33.90s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-4ac7daa99a6d214a) running 10 tests test block_merge_tests::metadata_join_does_not_hide_prose_or_code_conflicts ... ok test block_merge_tests::metadata_joins_keep_parent_identity_and_unicode_text ... ok test session::source_metadata_tests::same_log_hide_joins_typing_once ... ok test session::source_metadata_tests::same_tag_rewrite_joins_typing_once ... ok test session::source_metadata_tests::formatted_task_completion_joins_typing_once ... ok test session::source_metadata_tests::formatted_tag_rewrite_joins_typing_once ... ok test session::source_metadata_tests::same_task_completion_joins_typing_once ... ok test session::source_metadata_tests::tag_writer_keeps_following_typing_once ... ok test session::source_metadata_tests::tag_writer_restart_keeps_following_typing_once ... ok test session::source_metadata_tests::tag_writer_history_restart_keeps_following_typing_once ... ok test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 118 filtered out; finished in 9.57s Finished `test` profile [unoptimized + debuginfo] target(s) in 1.42s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-4ac7daa99a6d214a) running 21 tests test markdown::source_patch_tests::source_patch_refuses_unaligned_line_counts ... ok test markdown::source_patch_tests::changed_line_keeps_unedited_crlf_tabs_and_trailing_spaces ... ok test markdown::source_patch_tests::equal_line_counts_do_not_mean_equal_source_offsets ... ok test markdown::source_patch_tests::source_patch_maps_blocks_when_serialization_adds_separators ... ok test session::external_persistence_race_tests::clean_reload_keeps_delayed_insert_into_deleted_source_block ... ok test session::external_persistence_race_tests::pending_restart_keeps_delayed_insert_into_deleted_source_block ... ok test session::external_persistence_race_tests::live_edit_survives_unaligned_source_after_external_metadata ... ok test session::external_persistence_race_tests::source_rebase_keeps_bom_crlf_anchors_and_repeated_prose ... ok test session::source_budget_tests::saturated_mirror_cannot_report_failed_save_after_commit ... ok test session::external_persistence_race_tests::unmappable_source_keeps_edits_in_conflict_copy ... ok test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok test session::source_metadata_tests::formatted_tag_rewrite_joins_typing_once ... ok test session::source_metadata_tests::formatted_task_completion_joins_typing_once ... ok test session::source_metadata_tests::same_log_hide_joins_typing_once ... ok test session::source_metadata_tests::same_tag_rewrite_joins_typing_once ... ok test session::source_metadata_tests::same_task_completion_joins_typing_once ... ok test session::source_metadata_tests::tag_writer_keeps_following_typing_once ... ok test session::source_metadata_tests::tag_writer_history_restart_keeps_following_typing_once ... ok test session::source_metadata_tests::tag_writer_restart_keeps_following_typing_once ... ok test session::external_persistence_race_tests::each_source_writer_keeps_concurrent_typing ... ok test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 107 filtered out; finished in 37.96s ``` `cargo fmt --check` exited 0 with no output. All seven baseline failures now have passing focused regressions.
kayg commented 2026-10-06 20:11:18 +00:00
Author
Owner
Copy link

Merged origin/dev once at ff53d7b8b4. Head: 1b5478824. Both sides already use BEGIN IMMEDIATE for Note and Task projections; the resolved code keeps that behavior and the current dev comments. Root module documentation keeps both recovery invariants.

Notes migration 0036 is free on origin/dev, so its number stays unchanged. The generated performance pins now match the merged live code. The exact ratchet count stays at 22615; no rule was weakened and no ceiling was increased.

Verbatim:

perf-lint: PASS; 0 violations; 22615 scoped exceptions

cargo fmt --check exited 0 with no output. Final web and per-crate Rust gates are running.

Merged origin/dev once at ff53d7b8b4da5a21f862d57dcc3496f8c019f647. Head: 1b5478824. Both sides already use BEGIN IMMEDIATE for Note and Task projections; the resolved code keeps that behavior and the current dev comments. Root module documentation keeps both recovery invariants. Notes migration 0036 is free on origin/dev, so its number stays unchanged. The generated performance pins now match the merged live code. The exact ratchet count stays at 22615; no rule was weakened and no ceiling was increased. Verbatim: ```text perf-lint: PASS; 0 violations; 22615 scoped exceptions ``` `cargo fmt --check` exited 0 with no output. Final web and per-crate Rust gates are running.
kayg commented 2026-10-06 20:20:13 +00:00
Author
Owner
Copy link

Head 3a82c977f extends the existing Notes editor benchmark with same-paragraph metadata joins. Average: 64 blocks, 20 checked writes, burst of 8. Worst case: 900 blocks, 20 checked writes, burst of 32. It reports p50/p95, CPU and RSS and asserts that the saved Tag and live typing each occur once. node --check bench/notes-editor-series.mjs exited 0 with no output.

Expected cost: source actions process one Note tree and its retained branches, plus bounded inline diffs. They do not scan the Home. Ordinary typing keeps its existing history path; root deletion/conflict repair also saves a bounded branch checkpoint. The regression cases include the 16 MiB branch-budget boundary.

Measurements are deferred by the current verification policy: perf VM runs are for performance issues only. No matching live-write baseline exists in docs/perf/baseline.json. The opt-in command is NOTES_EDITOR_PROFILE_LIVE_WRITES=1 bun bench/notes-editor-series.mjs; a later perf run must use perf-run calternal collabloss3-1197 20 -- env NOTES_EDITOR_PROFILE_LIVE_WRITES=1 bun bench/notes-editor-series.mjs, with prebuilt binaries and no VM compilation.

Final gate progress: web production build passed; bun run check reports svelte-check found 0 errors and 2 warnings in 2 files. Full web tests and per-crate Rust gates are running. No push or deploy was made.

Head 3a82c977f extends the existing Notes editor benchmark with same-paragraph metadata joins. Average: 64 blocks, 20 checked writes, burst of 8. Worst case: 900 blocks, 20 checked writes, burst of 32. It reports p50/p95, CPU and RSS and asserts that the saved Tag and live typing each occur once. `node --check bench/notes-editor-series.mjs` exited 0 with no output. Expected cost: source actions process one Note tree and its retained branches, plus bounded inline diffs. They do not scan the Home. Ordinary typing keeps its existing history path; root deletion/conflict repair also saves a bounded branch checkpoint. The regression cases include the 16 MiB branch-budget boundary. Measurements are deferred by the current verification policy: perf VM runs are for performance issues only. No matching live-write baseline exists in docs/perf/baseline.json. The opt-in command is `NOTES_EDITOR_PROFILE_LIVE_WRITES=1 bun bench/notes-editor-series.mjs`; a later perf run must use `perf-run calternal collabloss3-1197 20 -- env NOTES_EDITOR_PROFILE_LIVE_WRITES=1 bun bench/notes-editor-series.mjs`, with prebuilt binaries and no VM compilation. Final gate progress: web production build passed; `bun run check` reports `svelte-check found 0 errors and 2 warnings in 2 files`. Full web tests and per-crate Rust gates are running. No push or deploy was made.
kayg commented 2026-10-06 20:29:22 +00:00
Author
Owner
Copy link

Merged collab gate: 126 passed; 2 failed during fixture Db::connect, before either test executed a history operation. Both errors are Sqlx(PoolTimedOut). The 96-case writer/room-lock matrix completed. All promoted #1197 regressions passed.

Verbatim full-run output:

failures:

---- history::store::tests::concurrent_appends_have_unique_points_and_index_rows stdout ----

thread 'history::store::tests::concurrent_appends_have_unique_points_and_index_rows' (3225927) panicked at crates/calternal-collab/src/history/store.rs:1704:10:
called `Result::unwrap()` on an `Err` value: Sqlx(PoolTimedOut)

---- history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points stdout ----

thread 'history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points' (3225925) panicked at crates/calternal-collab/src/history/store.rs:1667:10:
called `Result::unwrap()` on an `Err` value: Sqlx(PoolTimedOut)
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points
    history::store::tests::concurrent_appends_have_unique_points_and_index_rows

test result: FAILED. 126 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 305.31s

error: test failed, to rerun pass `-p calternal-collab --lib`

Each failed case was run once in isolation against the same test binary, with no source or expectation changes. Both passed in 0.02s. These are SLOW-only startup findings under the job policy; the full gate is not described as a pass.


running 1 test
test history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 127 filtered out; finished in 0.02s


running 1 test
test history::store::tests::concurrent_appends_have_unique_points_and_index_rows ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 127 filtered out; finished in 0.02s

For the merge round: cargo test -p calternal-collab -- --test-threads=4, once on the combined branch. Do not change assertions or fixtures to hide the timing failures.

Merged collab gate: 126 passed; 2 failed during fixture Db::connect, before either test executed a history operation. Both errors are Sqlx(PoolTimedOut). The 96-case writer/room-lock matrix completed. All promoted #1197 regressions passed. Verbatim full-run output: ```text failures: ---- history::store::tests::concurrent_appends_have_unique_points_and_index_rows stdout ---- thread 'history::store::tests::concurrent_appends_have_unique_points_and_index_rows' (3225927) panicked at crates/calternal-collab/src/history/store.rs:1704:10: called `Result::unwrap()` on an `Err` value: Sqlx(PoolTimedOut) ---- history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points stdout ---- thread 'history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points' (3225925) panicked at crates/calternal-collab/src/history/store.rs:1667:10: called `Result::unwrap()` on an `Err` value: Sqlx(PoolTimedOut) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points history::store::tests::concurrent_appends_have_unique_points_and_index_rows test result: FAILED. 126 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 305.31s error: test failed, to rerun pass `-p calternal-collab --lib` ``` Each failed case was run once in isolation against the same test binary, with no source or expectation changes. Both passed in 0.02s. These are SLOW-only startup findings under the job policy; the full gate is not described as a pass. ```text running 1 test test history::store::tests::cache_evicts_idle_rooms_and_reopens_durable_points ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 127 filtered out; finished in 0.02s running 1 test test history::store::tests::concurrent_appends_have_unique_points_and_index_rows ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 127 filtered out; finished in 0.02s ``` For the merge round: cargo test -p calternal-collab -- --test-threads=4, once on the combined branch. Do not change assertions or fixtures to hide the timing failures.
kayg commented 2026-10-06 20:58:06 +00:00
Author
Owner
Copy link

A further real loss path was confirmed and fixed in 9a578cb1b8. The checked-source path already retains current parents. The socket path used an existing mirror without adding parents created by conflict repair. A second browser could delete that repaired block, checkpoint and stop; reload then accepted a delayed edit into its newer parent but discarded it.

Before fix, verbatim:

   Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 42.52s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41)

running 4 tests
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::abrupt_restart_after_repaired_parent_delete_keeps_delayed_edit ... ok
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=false

thread 'session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit' (3374719) panicked at crates/calternal-collab/src/session.rs:8029:9:
abrupt restart silently discarded the delayed browser edit
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
test session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit ... FAILED

failures:

failures:
    session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit

test result: FAILED. 3 passed; 1 failed; 0 ignored; 0 measured; 126 filtered out; finished in 15.38s

error: test failed, to rerun pass `-p calternal-collab --lib`

The shared pre-delete preparation now retains current live parents in an existing mirror before the client update applies. Capacity refusal precedes live deletion. A new mirror remains pending until client validation succeeds. The tests capture the first client update and server repair through real history admission before testing the second deletion.

After fix, verbatim:

   Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 37.43s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41)

running 4 tests
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::abrupt_restart_after_repaired_parent_delete_keeps_delayed_edit ... ok
same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true
test session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 126 filtered out; finished in 5.84s

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.90s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41)

running 9 tests
test session::conflict_shadow_tests::history_delete_with_local_and_room_blocks_is_local ... ok
test session::conflict_shadow_tests::edit_reaching_server_before_stale_peer_delete_survives ... ok
test session::conflict_shadow_tests::edit_that_reaches_server_before_delete_survives_shadow_merge ... ok
test session::conflict_shadow_tests::local_undo_that_opens_conflict_shadow_does_not_replay_its_paste ... ok
test session::conflict_shadow_tests::external_writes_then_typing_do_not_replay_the_live_keystroke ... ok
test session::conflict_shadow_tests::second_client_edit_to_deleted_block_survives_shadow_merge ... ok
test session::conflict_shadow_tests::stale_edit_survives_after_same_connection_deleted_another_block ... ok
test session::conflict_shadow_tests::local_history_marker_is_consumed_before_yrs_protocol_handling ... ok
test session::conflict_shadow_tests::paste_undo_redo_from_deleting_connection_is_not_a_conflict ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s

Final gates will resume on this change; the partial dependency-check run was interrupted for this focused regression.

A further real loss path was confirmed and fixed in 9a578cb1b87d5d83b8f195aadd04f2aa340e5b7c. The checked-source path already retains current parents. The socket path used an existing mirror without adding parents created by conflict repair. A second browser could delete that repaired block, checkpoint and stop; reload then accepted a delayed edit into its newer parent but discarded it. Before fix, verbatim: ```text Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Finished `test` profile [unoptimized + debuginfo] target(s) in 42.52s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41) running 4 tests same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::abrupt_restart_after_repaired_parent_delete_keeps_delayed_edit ... ok same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=false thread 'session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit' (3374719) panicked at crates/calternal-collab/src/session.rs:8029:9: abrupt restart silently discarded the delayed browser edit note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace test session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit ... FAILED failures: failures: session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit test result: FAILED. 3 passed; 1 failed; 0 ignored; 0 measured; 126 filtered out; finished in 15.38s error: test failed, to rerun pass `-p calternal-collab --lib` ``` The shared pre-delete preparation now retains current live parents in an existing mirror before the client update applies. Capacity refusal precedes live deletion. A new mirror remains pending until client validation succeeds. The tests capture the first client update and server repair through real history admission before testing the second deletion. After fix, verbatim: ```text Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Finished `test` profile [unoptimized + debuginfo] target(s) in 37.43s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41) running 4 tests same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::abrupt_restart_after_repaired_parent_delete_keeps_delayed_edit ... ok same_epoch=true restored_shadow=true validator_accepted=true visible_delayed_edit=true test session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 126 filtered out; finished in 5.84s Finished `test` profile [unoptimized + debuginfo] target(s) in 0.90s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41) running 9 tests test session::conflict_shadow_tests::history_delete_with_local_and_room_blocks_is_local ... ok test session::conflict_shadow_tests::edit_reaching_server_before_stale_peer_delete_survives ... ok test session::conflict_shadow_tests::edit_that_reaches_server_before_delete_survives_shadow_merge ... ok test session::conflict_shadow_tests::local_undo_that_opens_conflict_shadow_does_not_replay_its_paste ... ok test session::conflict_shadow_tests::external_writes_then_typing_do_not_replay_the_live_keystroke ... ok test session::conflict_shadow_tests::second_client_edit_to_deleted_block_survives_shadow_merge ... ok test session::conflict_shadow_tests::stale_edit_survives_after_same_connection_deleted_another_block ... ok test session::conflict_shadow_tests::local_history_marker_is_consumed_before_yrs_protocol_handling ... ok test session::conflict_shadow_tests::paste_undo_redo_from_deleting_connection_is_not_a_conflict ... ok test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s ``` Final gates will resume on this change; the partial dependency-check run was interrupted for this focused regression.
kayg commented 2026-10-06 21:41:25 +00:00
Author
Owner
Copy link

Committed 7fde81c2a: a stale peer root deletion can silently remove typing already accepted by a room with an existing mirror. Yrs adds implicit child clocks to the delete set; the peer did not request those clocks. Capture the requested root identities and delete set before integration, then preserve accepted unseen children through the existing visible conflict join. Module and helper comments state this causal rule. The original survivor/content/count expectations remain; the repair now combines the normal and causal repair deltas.

Before fix (new regression):

   Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 31.62s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41)

running 1 test
test session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror ... existing_mirror=true unseen_deleted_clocks=true

thread 'session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror' (3444766) panicked at crates/calternal-collab/src/session.rs:4556:9:
the stale delete must emit a survivor
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
FAILED

failures:

failures:
    session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 130 filtered out; finished in 0.00s

error: test failed, to rerun pass `-p calternal-collab --lib`

After fix (all existing conflict/Undo cases and the new regression):

   Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 25.60s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41)

running 10 tests
existing_mirror=true unseen_deleted_clocks=true
test session::conflict_shadow_tests::edit_that_reaches_server_before_delete_survives_shadow_merge ... ok
test session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror ... ok
existing_mirror=false unseen_deleted_clocks=true
test session::conflict_shadow_tests::local_history_marker_is_consumed_before_yrs_protocol_handling ... ok
test session::conflict_shadow_tests::edit_reaching_server_before_stale_peer_delete_survives ... ok
test session::conflict_shadow_tests::local_undo_that_opens_conflict_shadow_does_not_replay_its_paste ... ok
test session::conflict_shadow_tests::external_writes_then_typing_do_not_replay_the_live_keystroke ... ok
test session::conflict_shadow_tests::second_client_edit_to_deleted_block_survives_shadow_merge ... ok
test session::conflict_shadow_tests::stale_edit_survives_after_same_connection_deleted_another_block ... ok
test session::conflict_shadow_tests::history_delete_with_local_and_room_blocks_is_local ... ok
test session::conflict_shadow_tests::paste_undo_redo_from_deleting_connection_is_not_a_conflict ... ok

test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s

Final gates are running on the already merged branch. No deployment or push was made.

Committed 7fde81c2a: a stale peer root deletion can silently remove typing already accepted by a room with an existing mirror. Yrs adds implicit child clocks to the delete set; the peer did not request those clocks. Capture the requested root identities and delete set before integration, then preserve accepted unseen children through the existing visible conflict join. Module and helper comments state this causal rule. The original survivor/content/count expectations remain; the repair now combines the normal and causal repair deltas. Before fix (new regression): ```text Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Finished `test` profile [unoptimized + debuginfo] target(s) in 31.62s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41) running 1 test test session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror ... existing_mirror=true unseen_deleted_clocks=true thread 'session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror' (3444766) panicked at crates/calternal-collab/src/session.rs:4556:9: the stale delete must emit a survivor note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace FAILED failures: failures: session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 130 filtered out; finished in 0.00s error: test failed, to rerun pass `-p calternal-collab --lib` ``` After fix (all existing conflict/Undo cases and the new regression): ```text Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Finished `test` profile [unoptimized + debuginfo] target(s) in 25.60s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41) running 10 tests existing_mirror=true unseen_deleted_clocks=true test session::conflict_shadow_tests::edit_that_reaches_server_before_delete_survives_shadow_merge ... ok test session::conflict_shadow_tests::earlier_edit_survives_stale_peer_delete_with_existing_mirror ... ok existing_mirror=false unseen_deleted_clocks=true test session::conflict_shadow_tests::local_history_marker_is_consumed_before_yrs_protocol_handling ... ok test session::conflict_shadow_tests::edit_reaching_server_before_stale_peer_delete_survives ... ok test session::conflict_shadow_tests::local_undo_that_opens_conflict_shadow_does_not_replay_its_paste ... ok test session::conflict_shadow_tests::external_writes_then_typing_do_not_replay_the_live_keystroke ... ok test session::conflict_shadow_tests::second_client_edit_to_deleted_block_survives_shadow_merge ... ok test session::conflict_shadow_tests::stale_edit_survives_after_same_connection_deleted_another_block ... ok test session::conflict_shadow_tests::history_delete_with_local_and_room_blocks_is_local ... ok test session::conflict_shadow_tests::paste_undo_redo_from_deleting_connection_is_not_a_conflict ... ok test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s ``` Final gates are running on the already merged branch. No deployment or push was made.
kayg commented 2026-10-06 21:53:40 +00:00
Author
Owner
Copy link

Final head is dfa094c0cc. The complete collaboration test command now passes. The earlier two Db::connect PoolTimedOut failures did not recur. All crash, rollback, source-budget, metadata, conflict/Undo, hostile-client and integration tests passed.

cargo test -p calternal-collab -- --test-threads=4, verbatim summary lines:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 34s
test result: ok. 131 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 261.71s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.37s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.69s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 88.70s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.63s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.80s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.75s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.24s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.04s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.38s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.44s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 45.37s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.94s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 23.12s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
collab exit=0

Final web check:

svelte-check found 0 errors and 2 warnings in 2 files
bun run check exit=0

The full web test run already passed 282 files / 1978 tests. Requested Clippy and the remaining per-crate tests are running. Deployment stays held with the orchestrator.

Final head is dfa094c0cc6caeea48c92fc50d5d213d09620ca6. The complete collaboration test command now passes. The earlier two Db::connect PoolTimedOut failures did not recur. All crash, rollback, source-budget, metadata, conflict/Undo, hostile-client and integration tests passed. `cargo test -p calternal-collab -- --test-threads=4`, verbatim summary lines: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 34s test result: ok. 131 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 261.71s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.37s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.69s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 88.70s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.63s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.80s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.75s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.24s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.04s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.38s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.44s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 45.37s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.94s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 23.12s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s collab exit=0 ``` Final web check: ```text svelte-check found 0 errors and 2 warnings in 2 files bun run check exit=0 ``` The full web test run already passed 282 files / 1978 tests. Requested Clippy and the remaining per-crate tests are running. Deployment stays held with the orchestrator.
kayg commented 2026-10-06 22:01:42 +00:00
Author
Owner
Copy link

Final Clippy first found one cloned_ref_to_slice_refs lint in the new repaired-parent crash fixture. Replace the one-item clone with std::slice::from_ref. No assertion or fixture behavior changes.

Requested combined Clippy rerun:

    Blocking waiting for file lock on build directory
    Checking calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
   Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-server)
    Checking calternal-fs v0.1.0 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-fs)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 54s

clippy-final exit=0

Focused fixture recheck:

    Blocking waiting for file lock on build directory
   Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 15s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41)

running 4 tests
test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok
test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok
test session::source_crash_tests::abrupt_restart_after_repaired_parent_delete_keeps_delayed_edit ... ok
test session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 127 filtered out; finished in 9.46s

The whole collaboration suite and web check/test passed. Remaining per-crate test builds are running.

Final Clippy first found one cloned_ref_to_slice_refs lint in the new repaired-parent crash fixture. Replace the one-item clone with std::slice::from_ref. No assertion or fixture behavior changes. Requested combined Clippy rerun: ```text Blocking waiting for file lock on build directory Checking calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-server) Checking calternal-fs v0.1.0 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-fs) Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 54s clippy-final exit=0 ``` Focused fixture recheck: ```text Blocking waiting for file lock on build directory Compiling calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-collab) Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 15s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_collab-ed6b47ba1cc9da41) running 4 tests test session::source_crash_tests::legacy_clean_cache_after_durable_source_delete_keeps_delayed_edit ... ok test session::source_crash_tests::abrupt_restart_after_durable_source_delete_keeps_delayed_edit ... ok test session::source_crash_tests::abrupt_restart_after_repaired_parent_delete_keeps_delayed_edit ... ok test session::source_crash_tests::abrupt_restart_after_client_deletes_repaired_parent_keeps_delayed_edit ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 127 filtered out; finished in 9.46s ``` The whole collaboration suite and web check/test passed. Remaining per-crate test builds are running.
kayg commented 2026-10-06 22:11:22 +00:00
Author
Owner
Copy link

The full Notes run found an existing migration assertion that expected exactly versions 1 through 35. This continuation intentionally adds 0036 to protect pending/branch checkpoints from a legacy reader. Update only the two latest-schema ranges to 36; keep the old input schema assertion at 24. Add a stronger upgrade assertion that all three named checkpoint guards exist. Comments state #1197 / DESIGN §61. This is the schema change that requires the expectation update, rather than a weakened assertion.

Focused migration result, verbatim:

   Compiling calternal-plugin-notes v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/plugins/notes)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 03s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_plugin_notes-7e7f68fe6b04e193)

running 1 test
test tasks_dav::edit_tests::notes_migrations_apply_fresh_and_from_a_dev_schema_copy ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 312 filtered out; finished in 1.28s

     Running tests/apple_replay.rs (/mnt/hdd/targets/collabloss3/debug/deps/apple_replay-67a714ce29bfc18a)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 0.00s

Latest requested Clippy rerun, verbatim:

   Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-server)
    Checking calternal-plugin-notes v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/plugins/notes)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s

clippy-final exit=0

The full Notes run is finishing. Remaining gates follow.

The full Notes run found an existing migration assertion that expected exactly versions 1 through 35. This continuation intentionally adds 0036 to protect pending/branch checkpoints from a legacy reader. Update only the two latest-schema ranges to 36; keep the old input schema assertion at 24. Add a stronger upgrade assertion that all three named checkpoint guards exist. Comments state #1197 / DESIGN §61. This is the schema change that requires the expectation update, rather than a weakened assertion. Focused migration result, verbatim: ```text Compiling calternal-plugin-notes v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/plugins/notes) Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 03s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss3/debug/deps/calternal_plugin_notes-7e7f68fe6b04e193) running 1 test test tasks_dav::edit_tests::notes_migrations_apply_fresh_and_from_a_dev_schema_copy ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 312 filtered out; finished in 1.28s Running tests/apple_replay.rs (/mnt/hdd/targets/collabloss3/debug/deps/apple_replay-67a714ce29bfc18a) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 0.00s ``` Latest requested Clippy rerun, verbatim: ```text Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/calternal-server) Checking calternal-plugin-notes v0.0.1 (/home/kayg/Developer/calternal-wt/collabloss-1197/crates/plugins/notes) Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s clippy-final exit=0 ``` The full Notes run is finishing. Remaining gates follow.
kayg commented 2026-10-06 22:32:52 +00:00
Author
Owner
Copy link

Head be8fb9c3b0; clean worktree. The full collaboration command passes; final combined Clippy, shared plugin/Tags Clippy, format and web build/check/test pass. All five original probes and both additional loss regressions pass in their committed replacements.

The first full Notes run had only the deliberately added schema version missing from its old test expectation:

test result: FAILED. 308 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 618.05s

The exact latest-schema assertions now require 0036 and all three protection triggers. The focused regression passed:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 312 filtered out; finished in 1.28s

The full Notes rerun has no failure reported and is still finishing large-Home cases. Server test compilation is running in parallel with those filesystem-heavy tests. Filesystem, Tags, plugin, server and recovery-command gates remain queued. I have not released the deployment hold or pushed the branch.

Head be8fb9c3b0bb5aaa35c7b59ca78cb62c6cd7c266; clean worktree. The full collaboration command passes; final combined Clippy, shared plugin/Tags Clippy, format and web build/check/test pass. All five original probes and both additional loss regressions pass in their committed replacements. The first full Notes run had only the deliberately added schema version missing from its old test expectation: ```text test result: FAILED. 308 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 618.05s ``` The exact latest-schema assertions now require 0036 and all three protection triggers. The focused regression passed: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 312 filtered out; finished in 1.28s ``` The full Notes rerun has no failure reported and is still finishing large-Home cases. Server test compilation is running in parallel with those filesystem-heavy tests. Filesystem, Tags, plugin, server and recovery-command gates remain queued. I have not released the deployment hold or pushed the branch.
kayg commented 2026-10-06 23:04:17 +00:00
Author
Owner
Copy link

#1197 Note content loss — continuation report

NOT READY FOR MERGE. The four-hour time box is reached. Three server upgrade fixture pins must include Notes migration 0036. The full server gate was interrupted during its isolated live-app cases, and the final recovery-command gate was not reached.

Branch: job/collabloss-1197. Base: be618e64ff. Origin/dev was fetched and merged once at ff53d7b8b4. No push, deployment or issue closure was made.

Built

  • Save the retained pre-delete parents before a deleting update enters durable history. This covers checked source writes, client root deletion/conflict repair, and history Restore/Undo. Reload also seeds a missing mirror from an older cached lineage when history already agrees with Markdown.
  • Refuse branch-capacity failures before source rename. Notes, Tasks and Tag rewrites use the shared preflight hook. If reconciliation fails after rename, keep the pending room and retry, while reporting the committed source as successful.
  • Protect pending and branch checkpoints inside SQLite from legacy DELETE and fresh-epoch writes. Same-epoch completion can still produce a clean cache. Notes migration 0036 is free on origin/dev. User deletion removes the private User Index.
  • Refuse recovery destinations that alias the copied input directory, Index, WAL or SHM. The real recovery command is shared with its tests.
  • Join pure Task completion, Hide and Tag changes with concurrent typing in the same Yrs parents. Apply new text/attribute deletions to the retained mirror while keeping historical root deletions out. This prevents duplicate items and old Tag characters after further typing or restart.
  • Retain parents created by conflict repair before a later client deletion. Detect implicit child deletions from stale peers and preserve already accepted unseen typing as a visible conflict copy.
  • Promote all five scratch probes into regression tests. Add legacy-cache, formatted-text, Unicode, parent-identity, genuine-conflict and follow-up typing cases.
  • Extend the existing Notes benchmark for metadata joins: 64/900 blocks, 20 checked writes and bursts of 8/32, with p50/p95, CPU/RSS and saved-content assertions.

Files changed in this continuation

  • crates/calternal-collab/src/{lib,session,stored}.rs
  • crates/calternal-collab/examples/recover_note.rs
  • crates/calternal-fs/src/root.rs
  • crates/calternal-plugin/src/notes_writer.rs
  • crates/calternal-tags/src/rewrite.rs
  • crates/plugins/notes/src/{lib,store,tasks_store,reminders_tests}.rs
  • crates/plugins/notes/migrations/0036_note_checkpoint_protection.sql
  • bench/notes-editor-series.mjs
  • contracts/perf/{adoption-1058,exceptions}.json: refresh exact live pins after the merge. The ratchet remains 22615, as on origin/dev. No rule or ceiling was weakened.

The continuation adds no dependency version. Cargo.lock changes come from origin/dev. The exact schema assertions now require versions 1–36 instead of 1–35 because this job adds migration 0036; the older input still requires 1–24, and the upgrade must contain all three named protection guards. Module and changed function comments were checked for the recovery, merge and lock invariants. No review artifact is committed.

Decisions

  • Use a write-ahead branch checkpoint before history capture. History segments and the Index have different durable stores; ordering the retained parents first covers process stops without a cross-store transaction. Keep the reload fallback for older caches as well.
  • Protect legacy rollback at the database boundary, because the older binary does not understand pending or branch envelopes. A fresh epoch cannot replace their bytes. An ignored save is an error to the current writer.
  • Join only pure metadata deltas with fixed node shapes and marks. Character diffs have a 64 KiB bound and a 200 ms deadline. An uncertain or larger join uses the existing visible block-conflict path. Prose and code conflicts keep both versions.
  • Keep whole affected root blocks when a peer deletion implicitly removes unseen child clocks. This uses existing conflict identities and preserves accepted content; normal local Undo tests still pass.
  • Refuse recovery aliases by held directory and file identity before opening a writable destination. A separate Home does not make an aliased Index safe. Recovery still requires an inactive destination.

Expected cost and measurement gap

One source action processes one Note tree and its retained branches, plus bounded inline diffs and a bounded checkpoint. A client root deletion scans the current and retained root blocks once to compare identities and causal delete sets. It does not scan the Home. Ordinary typing keeps the existing history path; root deletion/conflict repair also saves a branch checkpoint. Regression coverage includes the 16 MiB branch-budget boundary.

No matching live-write metric exists in docs/perf/baseline.json. The current verification policy restricts perf VM measurements to performance issues, so this continuation does not claim measured latency/CPU/RSS. The extended opt-in profile is ready for a later locked perf run with prebuilt binaries.

UX gaps closed

The Task checkbox, Hide marker and Tag change now apply once beside live typing. Following typing still works, including after durable-history restart. A genuine conflict keeps visible content. Checked writes no longer report failure after their source was committed. Recovery cannot change its copied input through an alias.

Known gaps

The server upgrade fixture pins still omit 0036. No server assertion was weakened or edited. The focused current binary confirms the three failures below. The full server gate has no final summary because the time box stopped it. The final recovery-command run and the performance/browser checks remain above. The web gates pass with two existing empty-CSS-rule warnings; Vitest also emitted worker-shutdown timeout warnings with exit 0.

UX gaps left

No additional UI controls or layout were built. Existing Note/Task/Hide/Tag controls are reused. Browser acceptance and performance measurement remain merge-round work below.

For the next job and merge round

  • Update crates/calternal-server/src/upgrade_tests.rs exact pending receipt lists, latest Notes frontiers and added-receipt counts for 0036. Keep the independently pinned production prefixes, original receipt/checksum and source-preservation assertions. Update its module/function comments in the same commit. The confirmed failures are at lines 107, 338 and 576; follow-on latest frontier pins at lines 160 and 349 also need 36.

  • After that fix: (cd apps/web && bun install && bun run build), then cargo clippy -p calternal-server --all-targets -- -D warnings, cargo test -p calternal-server wire::upgrade_tests:: -- --test-threads=4, and cargo test -p calternal-server -- --test-threads=4. Prove deployed receipt preservation and complete the isolated live-app and integration cases.

  • cargo test -p calternal-collab --example recover_note -- --test-threads=4. The three promoted alias/real-command tests passed earlier in this job, but this final merged-head command was not reached.

  • With a build of this head: cd apps/web && bun e2e/notes-preservation-1197.mjs. Prove the real browser preserves typing across checked source changes, conflict recovery and last-client disconnect.

  • bash tests/adversarial/run.sh. Run the combined branch's real-server hostile-input, authorization and cross-User matrices once.

  • Deployment and o2 checks remain with the orchestrator. This job does not deploy or release the hold.

  • If a performance issue is scheduled: perf-run calternal collabloss3-1197 20 -- env NOTES_EDITOR_PROFILE_LIVE_WRITES=1 bun bench/notes-editor-series.mjs. Use copied prebuilt binaries and web assets; never compile on the VM.

The five scratch probes were all run against the original head. Each result was posted verbatim on this issue before fixes. The baseline had seven failures: crash 1, rollback 1, recovery alias 1, committed-error 1, same-block writers 3. Their focused replacement regressions passed before the final merge. Two further confirmed loss paths now have committed regression tests: a client deletion of a repaired parent after restart, and an unaware peer deletion after accepted typing with an existing mirror. The latter focused conflict/Undo set passed all 10 tests.

Final gates

Head: be8fb9c3b0. Selected gate summary lines are quoted below verbatim. Complete logs stay in artifacts/collabloss3/. The first Notes run passed 308 tests and had one old latest-schema assertion failure (1–35 versus the installed 1–36). The corrected focused migration test passed, including the new trigger check. The complete Notes rerun passed 309 unit tests, both integration tests, and doc tests; four existing profiles are ignored. The first Clippy lint was fixed with a borrowed test slice; the final combined Clippy command passes. An earlier collaboration run had two Db::connect PoolTimedOut failures before operations; both focused retries passed and the final complete collaboration run passes.

cargo fmt --check:

cargo fmt --check exit=0

cargo clippy -p calternal-collab -p calternal-plugin-notes -p calternal-fs -p calternal-server --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s

cargo clippy -p calternal-tags -p calternal-plugin --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 58.70s

cargo test -p calternal-collab -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 34s
test result: ok. 131 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 261.71s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.37s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.69s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 88.70s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.63s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.80s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.75s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.24s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.04s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.38s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.44s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 45.37s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.94s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 23.12s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-notes -- --test-threads=4 (corrected full run):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 34s
test result: ok. 309 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 1029.37s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.97s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-fs -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 19.38s
test result: ok. 97 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 54.26s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.20s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.03s
test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 66.05s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-tags -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 38s
test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 171.49s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 40.18s
test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 17.31s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-server -- --test-threads=4: interrupted during the isolated live-app cases after three upgrade fixture failures. Focused current binary output, verbatim:


running 4 tests
test wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations ... 
thread 'wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations' (4042728) panicked at crates/calternal-server/src/upgrade_tests.rs:338:9:
assertion `left == right` failed: combined additions follow production 7b
  left: 21
 right: 20
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
FAILED
test wire::upgrade_tests::production_7c_upgrades_content_types_once ... 
thread 'wire::upgrade_tests::production_7c_upgrades_content_types_once' (4042889) panicked at crates/calternal-server/src/upgrade_tests.rs:576:5:
assertion `left == right` failed
  left: 150
 right: 149
FAILED
test wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts ... 
thread 'wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts' (4043161) panicked at crates/calternal-server/src/upgrade_tests.rs:107:5:
assertion `left == right` failed
  left: [("calternal-auth", 15), ("calternal-auth", 16), ("calternal-plugin-files", 25), ("calternal-plugin-files", 26), ("calternal-plugin-files", 27), ("calternal-plugin-files", 28), ("calternal-plugin-notes", 33), ("calternal-plugin-notes", 34), ("calternal-plugin-notes", 35), ("calternal-plugin-notes", 36), ("calternal-plugin-mail", 18), ("calternal-plugin-mail", 19), ("calternal-plugin-mail", 20), ("calternal-plugin-notifications", 5), ("calternal-plugin-notifications", 6), ("calternal-plugin-notifications", 7), ("calternal-plugin-notifications", 8), ("calternal-search", 5)]
 right: [("calternal-auth", 15), ("calternal-auth", 16), ("calternal-plugin-files", 25), ("calternal-plugin-files", 26), ("calternal-plugin-files", 27), ("calternal-plugin-files", 28), ("calternal-plugin-notes", 33), ("calternal-plugin-notes", 34), ("calternal-plugin-notes", 35), ("calternal-plugin-mail", 18), ("calternal-plugin-mail", 19), ("calternal-plugin-mail", 20), ("calternal-plugin-notifications", 5), ("calternal-plugin-notifications", 6), ("calternal-plugin-notifications", 7), ("calternal-plugin-notifications", 8), ("calternal-search", 5)]
FAILED
test wire::upgrade_tests::production_schema_copy_upgrades_once_without_reinterpreting_notes_0028 ... ok

failures:

failures:
    wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations
    wire::upgrade_tests::production_7c_upgrades_content_types_once
    wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts

test result: FAILED. 1 passed; 3 failed; 0 ignored; 0 measured; 273 filtered out; finished in 7.94s

Web build/check/test summary lines, verbatim:

Checked 922 installs across 1021 packages (no changes) [3.08s]
Compressed 917 static variants; saved 21367980 bytes.
svelte-check found 0 errors and 2 warnings in 2 files
 Test Files  282 passed (282)
      Tests  1978 passed (1978)
   Duration  595.96s (transform 38%, import 23%, environment 21%, tests 13%, setup 5%)
bun run check exit=0
bun run check exit=0 bun run test --maxWorkers=2 exit=0

Cleanup, verbatim:

     Removed 22055 files, 23.0GiB total
Target /mnt/hdd/targets/collabloss3, web build/output, and job test temporary data are removed.

The branch is clean at the reported head. No push or deployment was performed by this job. The deployment hold stays in place.

# #1197 Note content loss — continuation report NOT READY FOR MERGE. The four-hour time box is reached. Three server upgrade fixture pins must include Notes migration 0036. The full server gate was interrupted during its isolated live-app cases, and the final recovery-command gate was not reached. Branch: job/collabloss-1197. Base: be618e64fff50126a2fce3d25c1bc11fbadd77e6. Origin/dev was fetched and merged once at ff53d7b8b4da5a21f862d57dcc3496f8c019f647. No push, deployment or issue closure was made. ## Built - Save the retained pre-delete parents before a deleting update enters durable history. This covers checked source writes, client root deletion/conflict repair, and history Restore/Undo. Reload also seeds a missing mirror from an older cached lineage when history already agrees with Markdown. - Refuse branch-capacity failures before source rename. Notes, Tasks and Tag rewrites use the shared preflight hook. If reconciliation fails after rename, keep the pending room and retry, while reporting the committed source as successful. - Protect pending and branch checkpoints inside SQLite from legacy DELETE and fresh-epoch writes. Same-epoch completion can still produce a clean cache. Notes migration 0036 is free on origin/dev. User deletion removes the private User Index. - Refuse recovery destinations that alias the copied input directory, Index, WAL or SHM. The real recovery command is shared with its tests. - Join pure Task completion, Hide and Tag changes with concurrent typing in the same Yrs parents. Apply new text/attribute deletions to the retained mirror while keeping historical root deletions out. This prevents duplicate items and old Tag characters after further typing or restart. - Retain parents created by conflict repair before a later client deletion. Detect implicit child deletions from stale peers and preserve already accepted unseen typing as a visible conflict copy. - Promote all five scratch probes into regression tests. Add legacy-cache, formatted-text, Unicode, parent-identity, genuine-conflict and follow-up typing cases. - Extend the existing Notes benchmark for metadata joins: 64/900 blocks, 20 checked writes and bursts of 8/32, with p50/p95, CPU/RSS and saved-content assertions. ## Files changed in this continuation - crates/calternal-collab/src/{lib,session,stored}.rs - crates/calternal-collab/examples/recover_note.rs - crates/calternal-fs/src/root.rs - crates/calternal-plugin/src/notes_writer.rs - crates/calternal-tags/src/rewrite.rs - crates/plugins/notes/src/{lib,store,tasks_store,reminders_tests}.rs - crates/plugins/notes/migrations/0036_note_checkpoint_protection.sql - bench/notes-editor-series.mjs - contracts/perf/{adoption-1058,exceptions}.json: refresh exact live pins after the merge. The ratchet remains 22615, as on origin/dev. No rule or ceiling was weakened. The continuation adds no dependency version. Cargo.lock changes come from origin/dev. The exact schema assertions now require versions 1–36 instead of 1–35 because this job adds migration 0036; the older input still requires 1–24, and the upgrade must contain all three named protection guards. Module and changed function comments were checked for the recovery, merge and lock invariants. No review artifact is committed. ## Decisions - Use a write-ahead branch checkpoint before history capture. History segments and the Index have different durable stores; ordering the retained parents first covers process stops without a cross-store transaction. Keep the reload fallback for older caches as well. - Protect legacy rollback at the database boundary, because the older binary does not understand pending or branch envelopes. A fresh epoch cannot replace their bytes. An ignored save is an error to the current writer. - Join only pure metadata deltas with fixed node shapes and marks. Character diffs have a 64 KiB bound and a 200 ms deadline. An uncertain or larger join uses the existing visible block-conflict path. Prose and code conflicts keep both versions. - Keep whole affected root blocks when a peer deletion implicitly removes unseen child clocks. This uses existing conflict identities and preserves accepted content; normal local Undo tests still pass. - Refuse recovery aliases by held directory and file identity before opening a writable destination. A separate Home does not make an aliased Index safe. Recovery still requires an inactive destination. ## Expected cost and measurement gap One source action processes one Note tree and its retained branches, plus bounded inline diffs and a bounded checkpoint. A client root deletion scans the current and retained root blocks once to compare identities and causal delete sets. It does not scan the Home. Ordinary typing keeps the existing history path; root deletion/conflict repair also saves a branch checkpoint. Regression coverage includes the 16 MiB branch-budget boundary. No matching live-write metric exists in docs/perf/baseline.json. The current verification policy restricts perf VM measurements to performance issues, so this continuation does not claim measured latency/CPU/RSS. The extended opt-in profile is ready for a later locked perf run with prebuilt binaries. ## UX gaps closed The Task checkbox, Hide marker and Tag change now apply once beside live typing. Following typing still works, including after durable-history restart. A genuine conflict keeps visible content. Checked writes no longer report failure after their source was committed. Recovery cannot change its copied input through an alias. ## Known gaps The server upgrade fixture pins still omit 0036. No server assertion was weakened or edited. The focused current binary confirms the three failures below. The full server gate has no final summary because the time box stopped it. The final recovery-command run and the performance/browser checks remain above. The web gates pass with two existing empty-CSS-rule warnings; Vitest also emitted worker-shutdown timeout warnings with exit 0. ## UX gaps left No additional UI controls or layout were built. Existing Note/Task/Hide/Tag controls are reused. Browser acceptance and performance measurement remain merge-round work below. ## For the next job and merge round - Update crates/calternal-server/src/upgrade_tests.rs exact pending receipt lists, latest Notes frontiers and added-receipt counts for 0036. Keep the independently pinned production prefixes, original receipt/checksum and source-preservation assertions. Update its module/function comments in the same commit. The confirmed failures are at lines 107, 338 and 576; follow-on latest frontier pins at lines 160 and 349 also need 36. - After that fix: `(cd apps/web && bun install && bun run build)`, then `cargo clippy -p calternal-server --all-targets -- -D warnings`, `cargo test -p calternal-server wire::upgrade_tests:: -- --test-threads=4`, and `cargo test -p calternal-server -- --test-threads=4`. Prove deployed receipt preservation and complete the isolated live-app and integration cases. - `cargo test -p calternal-collab --example recover_note -- --test-threads=4`. The three promoted alias/real-command tests passed earlier in this job, but this final merged-head command was not reached. - With a build of this head: `cd apps/web && bun e2e/notes-preservation-1197.mjs`. Prove the real browser preserves typing across checked source changes, conflict recovery and last-client disconnect. - `bash tests/adversarial/run.sh`. Run the combined branch's real-server hostile-input, authorization and cross-User matrices once. - Deployment and o2 checks remain with the orchestrator. This job does not deploy or release the hold. - If a performance issue is scheduled: `perf-run calternal collabloss3-1197 20 -- env NOTES_EDITOR_PROFILE_LIVE_WRITES=1 bun bench/notes-editor-series.mjs`. Use copied prebuilt binaries and web assets; never compile on the VM. The five scratch probes were all run against the original head. Each result was posted verbatim on this issue before fixes. The baseline had seven failures: crash 1, rollback 1, recovery alias 1, committed-error 1, same-block writers 3. Their focused replacement regressions passed before the final merge. Two further confirmed loss paths now have committed regression tests: a client deletion of a repaired parent after restart, and an unaware peer deletion after accepted typing with an existing mirror. The latter focused conflict/Undo set passed all 10 tests. ## Final gates Head: be8fb9c3b0bb5aaa35c7b59ca78cb62c6cd7c266. Selected gate summary lines are quoted below verbatim. Complete logs stay in artifacts/collabloss3/. The first Notes run passed 308 tests and had one old latest-schema assertion failure (1–35 versus the installed 1–36). The corrected focused migration test passed, including the new trigger check. The complete Notes rerun passed 309 unit tests, both integration tests, and doc tests; four existing profiles are ignored. The first Clippy lint was fixed with a borrowed test slice; the final combined Clippy command passes. An earlier collaboration run had two Db::connect PoolTimedOut failures before operations; both focused retries passed and the final complete collaboration run passes. `cargo fmt --check`: ```text cargo fmt --check exit=0 ``` `cargo clippy -p calternal-collab -p calternal-plugin-notes -p calternal-fs -p calternal-server --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 21s ``` `cargo clippy -p calternal-tags -p calternal-plugin --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 58.70s ``` `cargo test -p calternal-collab -- --test-threads=4`: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 34s test result: ok. 131 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 261.71s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.37s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.69s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 88.70s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.63s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.80s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.75s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.24s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.04s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.38s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.44s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 45.37s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.94s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 23.12s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-notes -- --test-threads=4 (corrected full run)`: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 34s test result: ok. 309 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 1029.37s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.97s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-fs -- --test-threads=4`: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 19.38s test result: ok. 97 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 54.26s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.20s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.03s test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 66.05s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-tags -- --test-threads=4`: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 38s test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 171.49s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin -- --test-threads=4`: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 40.18s test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 17.31s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-server -- --test-threads=4`: interrupted during the isolated live-app cases after three upgrade fixture failures. Focused current binary output, verbatim: ```text running 4 tests test wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations ... thread 'wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations' (4042728) panicked at crates/calternal-server/src/upgrade_tests.rs:338:9: assertion `left == right` failed: combined additions follow production 7b left: 21 right: 20 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace FAILED test wire::upgrade_tests::production_7c_upgrades_content_types_once ... thread 'wire::upgrade_tests::production_7c_upgrades_content_types_once' (4042889) panicked at crates/calternal-server/src/upgrade_tests.rs:576:5: assertion `left == right` failed left: 150 right: 149 FAILED test wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts ... thread 'wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts' (4043161) panicked at crates/calternal-server/src/upgrade_tests.rs:107:5: assertion `left == right` failed left: [("calternal-auth", 15), ("calternal-auth", 16), ("calternal-plugin-files", 25), ("calternal-plugin-files", 26), ("calternal-plugin-files", 27), ("calternal-plugin-files", 28), ("calternal-plugin-notes", 33), ("calternal-plugin-notes", 34), ("calternal-plugin-notes", 35), ("calternal-plugin-notes", 36), ("calternal-plugin-mail", 18), ("calternal-plugin-mail", 19), ("calternal-plugin-mail", 20), ("calternal-plugin-notifications", 5), ("calternal-plugin-notifications", 6), ("calternal-plugin-notifications", 7), ("calternal-plugin-notifications", 8), ("calternal-search", 5)] right: [("calternal-auth", 15), ("calternal-auth", 16), ("calternal-plugin-files", 25), ("calternal-plugin-files", 26), ("calternal-plugin-files", 27), ("calternal-plugin-files", 28), ("calternal-plugin-notes", 33), ("calternal-plugin-notes", 34), ("calternal-plugin-notes", 35), ("calternal-plugin-mail", 18), ("calternal-plugin-mail", 19), ("calternal-plugin-mail", 20), ("calternal-plugin-notifications", 5), ("calternal-plugin-notifications", 6), ("calternal-plugin-notifications", 7), ("calternal-plugin-notifications", 8), ("calternal-search", 5)] FAILED test wire::upgrade_tests::production_schema_copy_upgrades_once_without_reinterpreting_notes_0028 ... ok failures: failures: wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations wire::upgrade_tests::production_7c_upgrades_content_types_once wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts test result: FAILED. 1 passed; 3 failed; 0 ignored; 0 measured; 273 filtered out; finished in 7.94s ``` Web build/check/test summary lines, verbatim: ```text Checked 922 installs across 1021 packages (no changes) [3.08s] Compressed 917 static variants; saved 21367980 bytes. svelte-check found 0 errors and 2 warnings in 2 files Test Files 282 passed (282) Tests 1978 passed (1978) Duration 595.96s (transform 38%, import 23%, environment 21%, tests 13%, setup 5%) bun run check exit=0 bun run check exit=0 bun run test --maxWorkers=2 exit=0 ``` Cleanup, verbatim: ```text Removed 22055 files, 23.0GiB total Target /mnt/hdd/targets/collabloss3, web build/output, and job test temporary data are removed. ``` The branch is clean at the reported head. No push or deployment was performed by this job. The deployment hold stays in place.
kayg commented 2026-10-06 23:07:48 +00:00
Author
Owner
Copy link

collabloss4 started on job/collabloss-1197, base be8fb9c3b0. Read the collabloss3 report. Fetch confirms origin/dev remains ff53d7b8b (round 30). Will merge the explicitly requested local round-31 commit 139d4378ef, renumber checkpoint protection to 0038 and preserve the deployed migration receipts. No push or deployment.

collabloss4 started on job/collabloss-1197, base be8fb9c3b0bb5aaa35c7b59ca78cb62c6cd7c266. Read the collabloss3 report. Fetch confirms origin/dev remains ff53d7b8b (round 30). Will merge the explicitly requested local round-31 commit 139d4378ef974c9ea3e253f59cf23c02db2bab73, renumber checkpoint protection to 0038 and preserve the deployed migration receipts. No push or deployment.
kayg commented 2026-10-06 23:14:38 +00:00
Author
Owner
Copy link

Round 31 is integrated at dc45b3552. Checkpoint protection is now Notes migration 0038 after Hide 0036/0037; the independently pinned deployed SQL remains unchanged. The production web build passed (Compressed 917 static variants; saved 21486337 bytes.). perf-lint passed with 0 violations and 22548 scoped exceptions. A test-only LD_PRELOAD history witness passed its independent check: durable append, SIGSTOP, arm consumed, SIGKILL. It is committed separately; the production browser scenarios will use this witness with the current server binary. Focused upgrade compilation is in progress in the requested fresh target directory.

Round 31 is integrated at dc45b3552. Checkpoint protection is now Notes migration 0038 after Hide 0036/0037; the independently pinned deployed SQL remains unchanged. The production web build passed (Compressed 917 static variants; saved 21486337 bytes.). perf-lint passed with 0 violations and 22548 scoped exceptions. A test-only LD_PRELOAD history witness passed its independent check: durable append, SIGSTOP, arm consumed, SIGKILL. It is committed separately; the production browser scenarios will use this witness with the current server binary. Focused upgrade compilation is in progress in the requested fresh target directory.
kayg commented 2026-10-06 23:18:53 +00:00
Author
Owner
Copy link

Merged-tree web check passes: svelte-check found 0 errors and 1 warning in 1 file. The production build and dependency licence check also pass. The renamed migration 0038 was exercised directly in SQLite: pending and branch DELETE plus fresh-epoch UPDATE/INSERT OR REPLACE are refused; same-epoch completion remains allowed. Full web tests are running. Rust is compiling into /mnt/hdd/targets/collabloss4 with four build jobs; the host load is about 60. Full Clippy/workspace tests are queued behind focused upgrade compilation. No old receipt or source-preservation assertion was removed.

Merged-tree web check passes: svelte-check found 0 errors and 1 warning in 1 file. The production build and dependency licence check also pass. The renamed migration 0038 was exercised directly in SQLite: pending and branch DELETE plus fresh-epoch UPDATE/INSERT OR REPLACE are refused; same-epoch completion remains allowed. Full web tests are running. Rust is compiling into /mnt/hdd/targets/collabloss4 with four build jobs; the host load is about 60. Full Clippy/workspace tests are queued behind focused upgrade compilation. No old receipt or source-preservation assertion was removed.
kayg commented 2026-10-06 23:25:48 +00:00
Author
Owner
Copy link

Full merged-tree web suite passed, verbatim: Test Files 287 passed (287); Tests 2035 passed (2035); Duration 590.52s (transform 28%, environment 26%, import 22%, tests 18%, setup 5%). bun run test --maxWorkers=2 exit=0. Build and check are also green. Cold Rust compilation was stopped before any upgrade test executed so reusable third-party dependency artifacts can seed the dedicated collabloss4 target. All copied calternal product artifacts will be discarded before compilation resumes; no shared build directory is changed. The initially queued Clippy command was interrupted waiting for the build lock, not during lint execution.

Full merged-tree web suite passed, verbatim: Test Files 287 passed (287); Tests 2035 passed (2035); Duration 590.52s (transform 28%, environment 26%, import 22%, tests 18%, setup 5%). bun run test --maxWorkers=2 exit=0. Build and check are also green. Cold Rust compilation was stopped before any upgrade test executed so reusable third-party dependency artifacts can seed the dedicated collabloss4 target. All copied calternal product artifacts will be discarded before compilation resumes; no shared build directory is changed. The initially queued Clippy command was interrupted waiting for the build lock, not during lint execution.
kayg commented 2026-10-06 23:38:09 +00:00
Author
Owner
Copy link

Checkpoint numbering and upgrade fixture pins are committed atomically. Migration 0038 passed its direct SQLite guard test, and cargo fmt --check passes. The exact pending lists, latest frontiers and added-receipt counts include 0038; original deployed receipts, checksums and source/snapshot assertions remain intact. Focused Rust upgrade compilation is still running; this is a progress commit, not a READY FOR MERGE claim. Recovery command and browser acceptance are separate verification slices.

Checkpoint numbering and upgrade fixture pins are committed atomically. Migration 0038 passed its direct SQLite guard test, and cargo fmt --check passes. The exact pending lists, latest frontiers and added-receipt counts include 0038; original deployed receipts, checksums and source/snapshot assertions remain intact. Focused Rust upgrade compilation is still running; this is a progress commit, not a READY FOR MERGE claim. Recovery command and browser acceptance are separate verification slices.
kayg commented 2026-10-06 23:54:59 +00:00
Author
Owner
Copy link

Focused merged-tree server upgrade tests pass: all four wire::upgrade_tests cases are green, including the three previously failing fixture pins. The fresh server binary built successfully. Full cargo clippy --all-targets -- -D warnings is running. The three production-browser lifecycle scenarios are now running against that current server binary and the production SPA.

Focused merged-tree server upgrade tests pass: all four wire::upgrade_tests cases are green, including the three previously failing fixture pins. The fresh server binary built successfully. Full cargo clippy --all-targets -- -D warnings is running. The three production-browser lifecycle scenarios are now running against that current server binary and the production SPA.
kayg commented 2026-10-07 00:09:18 +00:00
Author
Owner
Copy link

Browser acceptance passed all three requested scenarios against the current production SPA/server: clean reload, pending checkpoint restart, and SIGKILL after the checked writer history segment fdatasync. Each delayed real editor frame retained its original epoch and was saved in the original Note; pending server typing also survived. The crash witness confirmed committed source deletion, segment growth, write-ahead branch checkpoint, whole-process SIGSTOP and SIGKILL exit. Eighteen macOS screenshots at 390/820/1440 px, light/dark, 1x are retained for attachment. Full cargo clippy --all-targets -- -D warnings passed: Finished dev profile [unoptimized + debuginfo] target(s) in 37m 05s; clippy exit=0. Browser fixture setup corrections closed HTTP streams before graceful stop and atomically replaced the inactive read-only content hardlink; no acceptance assertion was weakened. Full workspace tests are starting.

Browser acceptance passed all three requested scenarios against the current production SPA/server: clean reload, pending checkpoint restart, and SIGKILL after the checked writer history segment fdatasync. Each delayed real editor frame retained its original epoch and was saved in the original Note; pending server typing also survived. The crash witness confirmed committed source deletion, segment growth, write-ahead branch checkpoint, whole-process SIGSTOP and SIGKILL exit. Eighteen macOS screenshots at 390/820/1440 px, light/dark, 1x are retained for attachment. Full cargo clippy --all-targets -- -D warnings passed: Finished `dev` profile [unoptimized + debuginfo] target(s) in 37m 05s; clippy exit=0. Browser fixture setup corrections closed HTTP streams before graceful stop and atomically replaced the inactive read-only content hardlink; no acceptance assertion was weakened. Full workspace tests are starting.
kayg commented 2026-10-07 00:11:25 +00:00
Author
Owner
Copy link

Correction to the first browser acceptance claim: screenshot inspection showed the delayed marker appended to SECOND1197, the surviving paragraph. The fixture double-click entered edit mode at document end. Those runs prove restart delivery but do not prove deleted-parent retention. All screenshots from that first set are superseded. Added an explicit pointer caret placement and assertions that the delayed marker belongs to FIRST1197, the deleted paragraph, and is absent from SECOND1197. All three scenarios are being rerun with these stronger assertions; no server assertion is weakened. Rust full Clippy passes, and workspace tests are still compiling/running.

Correction to the first browser acceptance claim: screenshot inspection showed the delayed marker appended to SECOND1197, the surviving paragraph. The fixture double-click entered edit mode at document end. Those runs prove restart delivery but do not prove deleted-parent retention. All screenshots from that first set are superseded. Added an explicit pointer caret placement and assertions that the delayed marker belongs to FIRST1197, the deleted paragraph, and is absent from SECOND1197. All three scenarios are being rerun with these stronger assertions; no server assertion is weakened. Rust full Clippy passes, and workspace tests are still compiling/running.
kayg commented 2026-10-07 00:16:39 +00:00
Author
Owner
Copy link

The corrected production-browser acceptance now passes all three scenarios with the stronger deleted-parent assertions. FIRST1197 contains the held delayed edit and SECOND1197 does not before source deletion; clean reload, pending restart and durable-append SIGKILL each save that edit in the original Note. Pending typing also survives. Fresh screenshots show FIRST1197 with the delayed marker and SECOND1197 unchanged. The earlier surviving-parent screenshots are superseded; corrected attachments follow. The caret assertions are committed separately. The real recovery-command positive regression is also committed; full Clippy compiled it successfully, and its execution remains queued after workspace tests. No push or deployment.

The corrected production-browser acceptance now passes all three scenarios with the stronger deleted-parent assertions. FIRST1197 contains the held delayed edit and SECOND1197 does not before source deletion; clean reload, pending restart and durable-append SIGKILL each save that edit in the original Note. Pending typing also survives. Fresh screenshots show FIRST1197 with the delayed marker and SECOND1197 unchanged. The earlier surviving-parent screenshots are superseded; corrected attachments follow. The caret assertions are committed separately. The real recovery-command positive regression is also committed; full Clippy compiled it successfully, and its execution remains queued after workspace tests. No push or deployment.
kayg commented 2026-10-07 00:27:14 +00:00
Author
Owner
Copy link

abrupt-desktop-dark

abrupt-desktop-light

abrupt-phone-dark

abrupt-phone-light

abrupt-tablet-dark

abrupt-tablet-light

clean-desktop-dark

clean-desktop-light

clean-phone-dark

clean-phone-light

clean-tablet-dark

clean-tablet-light

pending-desktop-dark

pending-desktop-light

pending-phone-dark

pending-phone-light

pending-tablet-dark

pending-tablet-light

![abrupt-desktop-dark](https://git.kayg.org/attachments/18e7cc17-708f-47f3-ae71-8d4b6d5ebb52) ![abrupt-desktop-light](https://git.kayg.org/attachments/b2c7efbf-f479-4938-985c-54f6fa5f889e) ![abrupt-phone-dark](https://git.kayg.org/attachments/a8416cd4-719f-406a-9eea-c19a9e28340c) ![abrupt-phone-light](https://git.kayg.org/attachments/b704d0f7-ff11-469c-9397-b4f304a69e7a) ![abrupt-tablet-dark](https://git.kayg.org/attachments/b1d5030a-8d8e-4b6a-ab36-505a95f11b06) ![abrupt-tablet-light](https://git.kayg.org/attachments/d67886bc-f5e9-4a11-afb1-98cd9709f667) ![clean-desktop-dark](https://git.kayg.org/attachments/51630921-feca-4e0d-b776-86c841361ec3) ![clean-desktop-light](https://git.kayg.org/attachments/0f7a4d16-1144-40a7-8086-a96f9cb19d3f) ![clean-phone-dark](https://git.kayg.org/attachments/981b8999-f7a1-4ecf-95ba-3144231dd179) ![clean-phone-light](https://git.kayg.org/attachments/32cf8c22-a05f-46ad-bc07-ee0f88f70dac) ![clean-tablet-dark](https://git.kayg.org/attachments/8ecff5b0-21c2-416c-b573-4659a096a4cd) ![clean-tablet-light](https://git.kayg.org/attachments/9c536e58-f26b-48df-baaa-1deb178d4c4d) ![pending-desktop-dark](https://git.kayg.org/attachments/c59d7f21-bce4-4c1f-91db-74c94c38e1f2) ![pending-desktop-light](https://git.kayg.org/attachments/3c771f33-5695-407b-bb84-a70740256354) ![pending-phone-dark](https://git.kayg.org/attachments/9cb8086c-702f-4f52-9335-821eafae554a) ![pending-phone-light](https://git.kayg.org/attachments/54cd1a6c-07d8-4190-a2d7-87405c6a4fc7) ![pending-tablet-dark](https://git.kayg.org/attachments/1ddc83b7-7660-4fab-a694-7d7772a0e58b) ![pending-tablet-light](https://git.kayg.org/attachments/dc1578d1-7c94-4eeb-bf7f-c434ff95a771)
kayg commented 2026-10-07 01:11:13 +00:00
Author
Owner
Copy link

Full workspace gate stopped on the Search failure below. Filed as kayg/calternal#1293; no Search behavior or assertion changed. One isolated diagnostic pass does not replace workspace exit 101. Server and other unrun test binaries are continuing, using the already-compiled workspace artifacts. Recovery-command gate is running.

Observed during #1197 integration at 86ed8e4ad6, which contains round 31 (139d4378ef).

Command: cargo test --workspace -- --test-threads=4, with CARGO_BUILD_JOBS=4, CARGO_INCREMENTAL=0, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_TARGET_DIR=/mnt/hdd/targets/collabloss4 and worktree-local TMPDIR.

The Search indexer integration binary returned:

---- rebuild_matches_incremental_results stdout ----

thread 'rebuild_matches_incremental_results' (743594) panicked at crates/calternal-search/tests/indexer.rs:93:10:
called `Result::unwrap()` on an `Err` value: Background("Item visibility settings unavailable")
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

failures:
    rebuild_matches_incremental_results

test result: FAILED. 28 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 635.21s

error: test failed, to rerun pass `-p calternal-search --test indexer`

One isolated diagnostic run of the same compiled binary, with unchanged source and assertions, passed:

running 1 test
test rebuild_matches_incremental_results ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 28 filtered out; finished in 5.36s

The failed message maps from user_settings::hidden_items through Indexer::search_grouped_with_visibility. The helper hides the underlying SQL error as UserSettingsError::Unavailable; no evidence identifies which SQL error occurred. The visibility pool has two read-only connections. The integration fixture uses a file-backed SQLite pool with one writer connection and the default journal mode. Concurrent indexing and shared-host load may contribute, but this is not established as a SLOW-only finding.

No Search behavior or test expectation was changed by #1197. Its scope is checkpoint integration, upgrade pins and reload/recovery verification. Investigate the visibility read under concurrent indexing and preserve fail-closed hidden-item filtering. Do not remove the query or weaken the equality/assertion. Complete gate logs will be attached to #1197. The workspace command retains exit 101; the focused pass does not replace that result.

Full workspace gate stopped on the Search failure below. Filed as kayg/calternal#1293; no Search behavior or assertion changed. One isolated diagnostic pass does not replace workspace exit 101. Server and other unrun test binaries are continuing, using the already-compiled workspace artifacts. Recovery-command gate is running. Observed during #1197 integration at 86ed8e4ad69f31738b533af373675659becaa653, which contains round 31 (139d4378ef974c9ea3e253f59cf23c02db2bab73). Command: `cargo test --workspace -- --test-threads=4`, with `CARGO_BUILD_JOBS=4`, `CARGO_INCREMENTAL=0`, `CARGO_PROFILE_DEV_DEBUG=line-tables-only`, `CARGO_TARGET_DIR=/mnt/hdd/targets/collabloss4` and worktree-local `TMPDIR`. The Search indexer integration binary returned: ```text ---- rebuild_matches_incremental_results stdout ---- thread 'rebuild_matches_incremental_results' (743594) panicked at crates/calternal-search/tests/indexer.rs:93:10: called `Result::unwrap()` on an `Err` value: Background("Item visibility settings unavailable") note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: rebuild_matches_incremental_results test result: FAILED. 28 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 635.21s error: test failed, to rerun pass `-p calternal-search --test indexer` ``` One isolated diagnostic run of the same compiled binary, with unchanged source and assertions, passed: ```text running 1 test test rebuild_matches_incremental_results ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 28 filtered out; finished in 5.36s ``` The failed message maps from `user_settings::hidden_items` through `Indexer::search_grouped_with_visibility`. The helper hides the underlying SQL error as `UserSettingsError::Unavailable`; no evidence identifies which SQL error occurred. The visibility pool has two read-only connections. The integration fixture uses a file-backed SQLite pool with one writer connection and the default journal mode. Concurrent indexing and shared-host load may contribute, but this is not established as a SLOW-only finding. No Search behavior or test expectation was changed by #1197. Its scope is checkpoint integration, upgrade pins and reload/recovery verification. Investigate the visibility read under concurrent indexing and preserve fail-closed hidden-item filtering. Do not remove the query or weaken the equality/assertion. Complete gate logs will be attached to #1197. The workspace command retains exit 101; the focused pass does not replace that result.
kayg commented 2026-10-07 01:28:47 +00:00
Author
Owner
Copy link

#1197 collabloss4 integration and verification

Head: 86ed8e4ad6.
NOT READY FOR MERGE: the full workspace gate fails on Search #1293.

Branch: job/collabloss-1197. Start: be8fb9c3b0.
Fetched origin/dev once (ff53d7b8b); merged requested local round 31
139d4378ef at dc45b3552.
No push, deployment, production write or issue closure.

Built:

  • Integrate round 31 while preserving Hide and the checked Note writer work.
  • Move checkpoint protection from undeployed job migration 0036 to 0038,
    after Hide 0036/0037. Preserve all deployed migration SQL and receipts.
  • Require receipt 0038 in all three server upgrade fixtures. Keep checksum,
    source/security state preservation, snapshot and second-start assertions.
  • Run the real recovery command on a disposable Index copy and separate
    destination; require a new sibling and unchanged Index/current sources.
  • Add production-browser reload/restart checks that delay and replay a real
    editor-generated frame with its original epoch. The fsync witness stops the
    server after its exact history segment append, then the harness uses SIGKILL.

Files:

  • crates/plugins/notes/migrations/0038_note_checkpoint_protection.sql
  • crates/plugins/notes/src/{lib,store,reminders_tests}.rs
  • crates/calternal-server/src/upgrade_tests.rs
  • crates/calternal-collab/examples/recover_note.rs
  • apps/web/e2e/notes-reload-1197.mjs
  • apps/web/e2e/support/history-stop-1197.c
  • bench/notes-editor-series.mjs: merge retains both #1171 and #1197 profiles.
  • docs/upgrade.md

Decisions:

  • The repository has no existing docs/upgrade file or folder. Add
    docs/upgrade.md to record the 0038 numbering and independently pinned
    deployed fixture prefix. No deployed migration was renumbered.
  • Use a test-only LD_PRELOAD witness instead of a production fault-injection
    branch. It is armed for one exact disposable segment. It stops the whole
    process after successful fdatasync; SIGKILL cannot run shutdown handlers.
  • Reuse third-party artifacts from the shared server cache to reduce cold
    compilation on the loaded host. Copy into the requested private target and
    remove all calternal product artifacts. Cargo validates dependency reuse.

UX gaps closed:

  • Acceptance requires delayed edits to appear in persisted Notes or a visible
    conflict sibling, never only in the old browser's local document.
  • No new visual primitive was added. The existing Note editor, Tab Bar, sidebar,
    toolbar and Inbox controls remain in the production app.
  • Fresh macOS-emulated pages at 390, 820 and 1440 px, light/dark, 1x prove the
    persisted result. Existing Note editor and Inbox controls are reused.

Known gaps:

  • NOT READY FOR MERGE: cargo test --workspace -- --test-threads=4 exited 101.
    Search rebuild_matches_incremental_results received
    Background("Item visibility settings unavailable"). Filed #1293. Its one
    unchanged, isolated diagnostic run passed; the full gate remains failed.
    The helper removes the SQL cause, so SLOW-only status is not established.
  • Cargo stopped at that failure. All remaining compiled test targets run
    separately, with the same workspace artifacts and four test threads.
  • Performance profiles did not run. This issue is recovery/integration work;
    the verification policy reserves VM measurements for performance issues.
  • Claude still reviews the attached visual evidence. No real Apple-client
    interoperability run or production recovery application was requested.

Verification corrections:

  • The first browser attempt placed the edit in the surviving paragraph.
    Its screenshots are superseded. The final test explicitly requires the
    marker in FIRST1197 and absent from SECOND1197 before the deletion, and
    all three scenarios pass with those assertions.
  • Initial cold compilation and a Clippy wait were interrupted before tests
    or lint work. The completed full Clippy result is the reported result.

For the merge round:

  • Investigate #1293, then run cargo test --workspace -- --test-threads=4 on
    the combined branch. Prove that concurrent indexing does not make the
    hidden-item visibility read fail. Preserve the original equality and
    fail-closed filtering assertions.

Gate commands and verbatim output

Required commands: cargo fmt --check; cargo clippy --all-targets -- -D warnings; (cd apps/web && bun install && bun run build); cargo test --workspace -- --test-threads=4; (cd apps/web && bun run check); (cd apps/web && bun run test --maxWorkers=2). The complete captured stdout/stderr is attached below. Format had no output and exit 0. Full workspace tests exited 101; the continued targets do not replace that result.

Rust gate runner and continuation results (verbatim):

fmt exit=0
clippy exit=0
workspace-test exit=101
search-failure-focused exit=0
recover-command exit=0
server-full-continuation exit=0
remaining-operators exit=0
remaining-query_properties exit=0
remaining-relevance exit=0
remaining-retrieval exit=0
remaining-perf_guards exit=0
remaining-private_index_permissions exit=0
remaining-calternal_sync exit=0
remaining-calternald exit=0
test-artifacts-build exit=0
remaining-calternal_tags exit=0
server-build exit=0
workspace-doc-tests exit=0
cargo-clean exit=0

Full Clippy (verbatim):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 37m 05s

Bun install (verbatim):

bun install v1.4.2 (744846f84)
Resolving dependencies
Resolved, downloaded and extracted [20]

Checked 922 installs across 1021 packages (no changes) [6.04s]

Production web build (verbatim):

> Using @sveltejs/adapter-static
Compressed 917 static variants; saved 21486337 bytes.

Web check (verbatim):

perf-lint: PASS; 0 violations; 22548 scoped exceptions
svelte-check found 0 errors and 1 warning in 1 file

Full web tests (verbatim):

 Test Files  287 passed (287)
      Tests  2035 passed (2035)
   Duration  590.52s (transform 28%, environment 26%, import 22%, tests 18%, setup 5%)

All server tests, including all four upgrade fixtures (verbatim):

test wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations ... ok
test wire::upgrade_tests::production_7c_upgrades_content_types_once ... ok
test wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts ... ok
test wire::upgrade_tests::production_schema_copy_upgrades_once_without_reinterpreting_notes_0028 ... ok
test result: ok. 272 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 334.88s

Actual recovery command tests on disposable Index copies (verbatim):

running 4 tests
test destination_tests::destination_identity_checks_cover_aliases_and_a_separate_index ... ok
test tests::input_index_is_read_only_including_wal ... ok
test destination_tests::apply_rejects_input_index_as_destination ... ok
test destination_tests::apply_copied_checkpoint_creates_sibling_without_changing_input ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.85s

Corrected deleted-parent browser acceptance (verbatim):

PASS clean: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x
PASS pending: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x
PASS abrupt: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x

Real SQLite checkpoint guards (verbatim):

PASS migration 0038: pending/branch DELETE and fresh-epoch UPDATE/REPLACE refused; same-epoch completion allowed

The web check has one existing empty-CSS-ruleset warning in packages/ui/src/components/calendar/AttachmentDeck.svelte:1055. No perf guard was weakened or pin changed. All web commands exited 0.

Workspace failure output and isolated diagnostic output appear in #1293 and the complete log archive. All nine unrun unit/integration targets and workspace documentation tests passed when continued. No existing content, authorization or upgrade preservation assertion was weakened.

Screenshots: 18 corrected production-build PNGs at 1×; macOS emulation; phone 390 px, tablet 820 px, desktop 1440 px; light and dark; clean, pending and abrupt restart. These replace the earlier surviving-parent set.

abrupt-desktop-dark

abrupt-desktop-light

abrupt-phone-dark

abrupt-phone-light

abrupt-tablet-dark

abrupt-tablet-light

clean-desktop-dark

clean-desktop-light

clean-phone-dark

clean-phone-light

clean-tablet-dark

clean-tablet-light

pending-desktop-dark

pending-desktop-light

pending-phone-dark

pending-phone-light

pending-tablet-dark

pending-tablet-light

UX gaps left: none found in the three requested lifecycle scenarios. All three edits appeared in the original persisted Note. The alternative visible-conflict path is covered by the passing Rust suite. Claude visual review remains pending.

Full workspace failure (verbatim):

thread 'rebuild_matches_incremental_results' (743594) panicked at crates/calternal-search/tests/indexer.rs:93:10:
called `Result::unwrap()` on an `Err` value: Background("Item visibility settings unavailable")
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    rebuild_matches_incremental_results

test result: FAILED. 28 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 635.21s

error: test failed, to rerun pass `-p calternal-search --test indexer`

One isolated diagnostic run (verbatim; this does not clear exit 101):


running 1 test
test rebuild_matches_incremental_results ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 28 filtered out; finished in 5.36s

Cleanup (verbatim):

     Removed 24147 files, 32.7GiB total
REMOVED /mnt/hdd/targets/collabloss4
REMOVED /home/kayg/Developer/calternal-wt/collabloss-1197/apps/web/build
REMOVED /home/kayg/Developer/calternal-wt/collabloss-1197/apps/web/.svelte-kit/output
REMOVED /home/kayg/Developer/calternal-wt/collabloss-1197/target/tmp

Screenshots and logs remain in gitignored artifacts/collabloss4/. The worktree is clean. No push, deployment, production write or issue closure occurred.

Complete verification logs (verification-1197.tar.gz)

# #1197 collabloss4 integration and verification Head: 86ed8e4ad69f31738b533af373675659becaa653. NOT READY FOR MERGE: the full workspace gate fails on Search #1293. Branch: job/collabloss-1197. Start: be8fb9c3b0bb5aaa35c7b59ca78cb62c6cd7c266. Fetched origin/dev once (ff53d7b8b); merged requested local round 31 139d4378ef974c9ea3e253f59cf23c02db2bab73 at dc45b3552. No push, deployment, production write or issue closure. Built: - Integrate round 31 while preserving Hide and the checked Note writer work. - Move checkpoint protection from undeployed job migration 0036 to 0038, after Hide 0036/0037. Preserve all deployed migration SQL and receipts. - Require receipt 0038 in all three server upgrade fixtures. Keep checksum, source/security state preservation, snapshot and second-start assertions. - Run the real recovery command on a disposable Index copy and separate destination; require a new sibling and unchanged Index/current sources. - Add production-browser reload/restart checks that delay and replay a real editor-generated frame with its original epoch. The fsync witness stops the server after its exact history segment append, then the harness uses SIGKILL. Files: - crates/plugins/notes/migrations/0038_note_checkpoint_protection.sql - crates/plugins/notes/src/{lib,store,reminders_tests}.rs - crates/calternal-server/src/upgrade_tests.rs - crates/calternal-collab/examples/recover_note.rs - apps/web/e2e/notes-reload-1197.mjs - apps/web/e2e/support/history-stop-1197.c - bench/notes-editor-series.mjs: merge retains both #1171 and #1197 profiles. - docs/upgrade.md Decisions: - The repository has no existing docs/upgrade file or folder. Add docs/upgrade.md to record the 0038 numbering and independently pinned deployed fixture prefix. No deployed migration was renumbered. - Use a test-only LD_PRELOAD witness instead of a production fault-injection branch. It is armed for one exact disposable segment. It stops the whole process after successful fdatasync; SIGKILL cannot run shutdown handlers. - Reuse third-party artifacts from the shared server cache to reduce cold compilation on the loaded host. Copy into the requested private target and remove all calternal product artifacts. Cargo validates dependency reuse. UX gaps closed: - Acceptance requires delayed edits to appear in persisted Notes or a visible conflict sibling, never only in the old browser's local document. - No new visual primitive was added. The existing Note editor, Tab Bar, sidebar, toolbar and Inbox controls remain in the production app. - Fresh macOS-emulated pages at 390, 820 and 1440 px, light/dark, 1x prove the persisted result. Existing Note editor and Inbox controls are reused. Known gaps: - NOT READY FOR MERGE: `cargo test --workspace -- --test-threads=4` exited 101. Search `rebuild_matches_incremental_results` received `Background("Item visibility settings unavailable")`. Filed [#1293](https://git.kayg.org/kayg/calternal/issues/1293). Its one unchanged, isolated diagnostic run passed; the full gate remains failed. The helper removes the SQL cause, so SLOW-only status is not established. - Cargo stopped at that failure. All remaining compiled test targets run separately, with the same workspace artifacts and four test threads. - Performance profiles did not run. This issue is recovery/integration work; the verification policy reserves VM measurements for performance issues. - Claude still reviews the attached visual evidence. No real Apple-client interoperability run or production recovery application was requested. Verification corrections: - The first browser attempt placed the edit in the surviving paragraph. Its screenshots are superseded. The final test explicitly requires the marker in FIRST1197 and absent from SECOND1197 before the deletion, and all three scenarios pass with those assertions. - Initial cold compilation and a Clippy wait were interrupted before tests or lint work. The completed full Clippy result is the reported result. For the merge round: - Investigate #1293, then run `cargo test --workspace -- --test-threads=4` on the combined branch. Prove that concurrent indexing does not make the hidden-item visibility read fail. Preserve the original equality and fail-closed filtering assertions. Gate commands and verbatim output Required commands: `cargo fmt --check`; `cargo clippy --all-targets -- -D warnings`; `(cd apps/web && bun install && bun run build)`; `cargo test --workspace -- --test-threads=4`; `(cd apps/web && bun run check)`; `(cd apps/web && bun run test --maxWorkers=2)`. The complete captured stdout/stderr is attached below. Format had no output and exit 0. Full workspace tests exited 101; the continued targets do not replace that result. Rust gate runner and continuation results (verbatim): ```text fmt exit=0 clippy exit=0 workspace-test exit=101 search-failure-focused exit=0 recover-command exit=0 server-full-continuation exit=0 remaining-operators exit=0 remaining-query_properties exit=0 remaining-relevance exit=0 remaining-retrieval exit=0 remaining-perf_guards exit=0 remaining-private_index_permissions exit=0 remaining-calternal_sync exit=0 remaining-calternald exit=0 test-artifacts-build exit=0 remaining-calternal_tags exit=0 server-build exit=0 workspace-doc-tests exit=0 cargo-clean exit=0 ``` Full Clippy (verbatim): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 37m 05s ``` Bun install (verbatim): ```text bun install v1.4.2 (744846f84) Resolving dependencies Resolved, downloaded and extracted [20] Checked 922 installs across 1021 packages (no changes) [6.04s] ``` Production web build (verbatim): ```text > Using @sveltejs/adapter-static Compressed 917 static variants; saved 21486337 bytes. ``` Web check (verbatim): ```text perf-lint: PASS; 0 violations; 22548 scoped exceptions svelte-check found 0 errors and 1 warning in 1 file ``` Full web tests (verbatim): ```text Test Files 287 passed (287) Tests 2035 passed (2035) Duration 590.52s (transform 28%, environment 26%, import 22%, tests 18%, setup 5%) ``` All server tests, including all four upgrade fixtures (verbatim): ```text test wire::upgrade_tests::production_7b_schema_copy_upgrades_combined_pending_migrations ... ok test wire::upgrade_tests::production_7c_upgrades_content_types_once ... ok test wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts ... ok test wire::upgrade_tests::production_schema_copy_upgrades_once_without_reinterpreting_notes_0028 ... ok test result: ok. 272 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 334.88s ``` Actual recovery command tests on disposable Index copies (verbatim): ```text running 4 tests test destination_tests::destination_identity_checks_cover_aliases_and_a_separate_index ... ok test tests::input_index_is_read_only_including_wal ... ok test destination_tests::apply_rejects_input_index_as_destination ... ok test destination_tests::apply_copied_checkpoint_creates_sibling_without_changing_input ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.85s ``` Corrected deleted-parent browser acceptance (verbatim): ```text PASS clean: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x PASS pending: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x PASS abrupt: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x ``` Real SQLite checkpoint guards (verbatim): ```text PASS migration 0038: pending/branch DELETE and fresh-epoch UPDATE/REPLACE refused; same-epoch completion allowed ``` The web check has one existing empty-CSS-ruleset warning in `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. No perf guard was weakened or pin changed. All web commands exited 0. Workspace failure output and isolated diagnostic output appear in #1293 and the complete log archive. All nine unrun unit/integration targets and workspace documentation tests passed when continued. No existing content, authorization or upgrade preservation assertion was weakened. Screenshots: 18 corrected production-build PNGs at 1×; macOS emulation; phone 390 px, tablet 820 px, desktop 1440 px; light and dark; clean, pending and abrupt restart. These replace the earlier surviving-parent set. [abrupt-desktop-dark](https://git.kayg.org/attachments/18e7cc17-708f-47f3-ae71-8d4b6d5ebb52) [abrupt-desktop-light](https://git.kayg.org/attachments/b2c7efbf-f479-4938-985c-54f6fa5f889e) [abrupt-phone-dark](https://git.kayg.org/attachments/a8416cd4-719f-406a-9eea-c19a9e28340c) [abrupt-phone-light](https://git.kayg.org/attachments/b704d0f7-ff11-469c-9397-b4f304a69e7a) [abrupt-tablet-dark](https://git.kayg.org/attachments/b1d5030a-8d8e-4b6a-ab36-505a95f11b06) [abrupt-tablet-light](https://git.kayg.org/attachments/d67886bc-f5e9-4a11-afb1-98cd9709f667) [clean-desktop-dark](https://git.kayg.org/attachments/51630921-feca-4e0d-b776-86c841361ec3) [clean-desktop-light](https://git.kayg.org/attachments/0f7a4d16-1144-40a7-8086-a96f9cb19d3f) [clean-phone-dark](https://git.kayg.org/attachments/981b8999-f7a1-4ecf-95ba-3144231dd179) [clean-phone-light](https://git.kayg.org/attachments/32cf8c22-a05f-46ad-bc07-ee0f88f70dac) [clean-tablet-dark](https://git.kayg.org/attachments/8ecff5b0-21c2-416c-b573-4659a096a4cd) [clean-tablet-light](https://git.kayg.org/attachments/9c536e58-f26b-48df-baaa-1deb178d4c4d) [pending-desktop-dark](https://git.kayg.org/attachments/c59d7f21-bce4-4c1f-91db-74c94c38e1f2) [pending-desktop-light](https://git.kayg.org/attachments/3c771f33-5695-407b-bb84-a70740256354) [pending-phone-dark](https://git.kayg.org/attachments/9cb8086c-702f-4f52-9335-821eafae554a) [pending-phone-light](https://git.kayg.org/attachments/54cd1a6c-07d8-4190-a2d7-87405c6a4fc7) [pending-tablet-dark](https://git.kayg.org/attachments/1ddc83b7-7660-4fab-a694-7d7772a0e58b) [pending-tablet-light](https://git.kayg.org/attachments/dc1578d1-7c94-4eeb-bf7f-c434ff95a771) UX gaps left: none found in the three requested lifecycle scenarios. All three edits appeared in the original persisted Note. The alternative visible-conflict path is covered by the passing Rust suite. Claude visual review remains pending. Full workspace failure (verbatim): ```text thread 'rebuild_matches_incremental_results' (743594) panicked at crates/calternal-search/tests/indexer.rs:93:10: called `Result::unwrap()` on an `Err` value: Background("Item visibility settings unavailable") note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: rebuild_matches_incremental_results test result: FAILED. 28 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 635.21s error: test failed, to rerun pass `-p calternal-search --test indexer` ``` One isolated diagnostic run (verbatim; this does not clear exit 101): ```text running 1 test test rebuild_matches_incremental_results ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 28 filtered out; finished in 5.36s ``` Cleanup (verbatim): ```text Removed 24147 files, 32.7GiB total REMOVED /mnt/hdd/targets/collabloss4 REMOVED /home/kayg/Developer/calternal-wt/collabloss-1197/apps/web/build REMOVED /home/kayg/Developer/calternal-wt/collabloss-1197/apps/web/.svelte-kit/output REMOVED /home/kayg/Developer/calternal-wt/collabloss-1197/target/tmp ``` Screenshots and logs remain in gitignored `artifacts/collabloss4/`. The worktree is clean. No push, deployment, production write or issue closure occurred. [Complete verification logs (verification-1197.tar.gz)](https://git.kayg.org/attachments/47115333-e6fd-4ff7-b929-7c37a2cd48af)
kayg commented 2026-10-07 01:31:26 +00:00
Author
Owner
Copy link

Independent final defensive data-safety review started on job/collabrev3-1197 at 86ed8e4ad6, baseline job/merge31. Reading the diff and prior independent failures before author artifacts. Findings and test cases only; no product fixes, push or deploy. Partial evidence is retained in artifacts/collabrev3/findings.md. Dedicated target: /mnt/hdd/targets/collabrev3.

Independent final defensive data-safety review started on job/collabrev3-1197 at 86ed8e4ad69f31738b533af373675659becaa653, baseline job/merge31. Reading the diff and prior independent failures before author artifacts. Findings and test cases only; no product fixes, push or deploy. Partial evidence is retained in artifacts/collabrev3/findings.md. Dedicated target: /mnt/hdd/targets/collabrev3.
kayg commented 2026-10-07 01:36:18 +00:00
Author
Owner
Copy link

Independent defensive data-safety finding before reading author artifacts: recovery destination sidecars are not checked. At examples/recover_note.rs:246–267, check_destination compares only the destination main file against input recovery.sqlite/-wal/-shm; a missing main file returns immediately. An existing destination -wal or -shm hard link to input passes these checks. A disposable SQLite probe reports destination_sidecar_alias input_wal_changed=True before_bytes=1900 after_bytes=4152. Two real-helper regression tests are added and await the dedicated Rust build; no execution result is claimed yet. Provisional verdict: NOT SAFE until input mutation is closed. No product fix or production data was used.

Migration 0038 checked independently on a local synthetic Index with 100,000 1-KiB cached states: migration 33.196 ms; indexed primary-key lookup; both envelope types retain bytes across legacy DELETE/UPSERT/REPLACE, and same-epoch clean completion remains disposable. Removing the delete guard loses the checkpoint. This proves retention only, not complete editing parity after rollback.

Required origin/dev fetch/integration completed once; e6c015143 is a no-file-change merge of origin/dev 3601719b8. The reviewed product tree is unchanged.

Independent defensive data-safety finding before reading author artifacts: recovery destination sidecars are not checked. At examples/recover_note.rs:246–267, check_destination compares only the destination main file against input recovery.sqlite/-wal/-shm; a missing main file returns immediately. An existing destination -wal or -shm hard link to input passes these checks. A disposable SQLite probe reports `destination_sidecar_alias input_wal_changed=True before_bytes=1900 after_bytes=4152`. Two real-helper regression tests are added and await the dedicated Rust build; no execution result is claimed yet. Provisional verdict: NOT SAFE until input mutation is closed. No product fix or production data was used. Migration 0038 checked independently on a local synthetic Index with 100,000 1-KiB cached states: migration 33.196 ms; indexed primary-key lookup; both envelope types retain bytes across legacy DELETE/UPSERT/REPLACE, and same-epoch clean completion remains disposable. Removing the delete guard loses the checkpoint. This proves retention only, not complete editing parity after rollback. Required origin/dev fetch/integration completed once; e6c015143 is a no-file-change merge of origin/dev 3601719b8. The reviewed product tree is unchanged.
kayg commented 2026-10-07 02:14:08 +00:00
Author
Owner
Copy link

Defensive #1197 independent review update: NOT SAFE remains the provisional verdict. Two new failing cases executed on the reviewed product tree.

Confirmed F2 — Browser repair can exceed the durable checkpoint budget

Reviewed-head session.rs:4050 (merge_conflict_shadow) integrates browser updates into the retained tree without updating retained_bytes or checking the checkpoint ceiling. A held 8 MiB paste into a deleted 9 MiB parent passes even a 10 MiB pre-repair Markdown validator. Repair then creates a 17 MiB tree. stored.rs:219 refuses that checkpoint; the socket path checkpoints before committing its admitted update to history. This is an accepted post-validation state that cannot be saved by the required durability path. The visible result exceeds the Note size limit; a separate valid-size surviving-parent case is pending to establish its scope without that condition.

Verbatim independent test output:

delayed_paste_validator_accepted=true repaired=true mirror_bytes=17825874 tracked_mirror_bytes=9437244 active_bytes=17825907 checkpoint_limit=16777216
accepted delayed paste outgrew the durable mirror checkpoint limit

Confirmed F3 — Agent root deletion drops a delayed browser edit

Reviewed-head session.rs:2978 (AgentTurn::apply) applies the agent delta directly without the checked source writer's retained parent and branch checkpoint. Real history-enabled Hub fixture: hold an edit to the first paragraph, apply a successful agent turn deleting that paragraph, deliver the original browser update through the client validator, and flush. The persisted original Note has no delayed edit and no retained shadow.

Verbatim independent test output:

agent_delete_validator_accepted=true retained_shadow=false persisted_delayed_edit=false
agent root deletion silently discarded the delayed browser edit

This public library path is not currently called by a non-test product module. It is a confirmed library loss gap, not a proven active deployed route.

First Rust run

All 131 original library tests passed, including the four abrupt/legacy restart cases, same-block anchor preservation, clean/pending reload, whole-body app save, each-source-writer race and the 96-case lock matrix. The two new defensive cases above failed. Verbatim aggregate:

test result: FAILED. 131 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 233.36s
error: test failed, to rerun pass `-p calternal-collab --lib`

cargo fmt --check: exit 0, no output.

Defensive #1197 independent review update: NOT SAFE remains the provisional verdict. Two new failing cases executed on the reviewed product tree. ## Confirmed F2 — Browser repair can exceed the durable checkpoint budget Reviewed-head `session.rs:4050` (`merge_conflict_shadow`) integrates browser updates into the retained tree without updating `retained_bytes` or checking the checkpoint ceiling. A held 8 MiB paste into a deleted 9 MiB parent passes even a 10 MiB pre-repair Markdown validator. Repair then creates a 17 MiB tree. `stored.rs:219` refuses that checkpoint; the socket path checkpoints before committing its admitted update to history. This is an accepted post-validation state that cannot be saved by the required durability path. The visible result exceeds the Note size limit; a separate valid-size surviving-parent case is pending to establish its scope without that condition. Verbatim independent test output: ```text delayed_paste_validator_accepted=true repaired=true mirror_bytes=17825874 tracked_mirror_bytes=9437244 active_bytes=17825907 checkpoint_limit=16777216 accepted delayed paste outgrew the durable mirror checkpoint limit ``` ## Confirmed F3 — Agent root deletion drops a delayed browser edit Reviewed-head `session.rs:2978` (`AgentTurn::apply`) applies the agent delta directly without the checked source writer's retained parent and branch checkpoint. Real history-enabled Hub fixture: hold an edit to the first paragraph, apply a successful agent turn deleting that paragraph, deliver the original browser update through the client validator, and flush. The persisted original Note has no delayed edit and no retained shadow. Verbatim independent test output: ```text agent_delete_validator_accepted=true retained_shadow=false persisted_delayed_edit=false agent root deletion silently discarded the delayed browser edit ``` This public library path is not currently called by a non-test product module. It is a confirmed library loss gap, not a proven active deployed route. ## First Rust run All 131 original library tests passed, including the four abrupt/legacy restart cases, same-block anchor preservation, clean/pending reload, whole-body app save, each-source-writer race and the 96-case lock matrix. The two new defensive cases above failed. Verbatim aggregate: ```text test result: FAILED. 131 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 233.36s error: test failed, to rerun pass `-p calternal-collab --lib` ``` `cargo fmt --check`: exit 0, no output.
kayg commented 2026-10-07 02:19:10 +00:00
Author
Owner
Copy link

Defensive #1197 independent findings: NOT SAFE. The copied-input mutation now reproduces in Rust, and the mirror budget failure also occurs with valid-size visible Markdown.

F1 Rust confirmation

The actual destination helper plus Db::connect reproduced mutation of the copied input WAL. A missing destination main file also bypasses an aliased SHM leaf. Existing input/read-only and non-aliased recovery tests pass. Verbatim:

new_destination_shm_alias_refused=false
recovery destination accepted an input SHM alias
destination_wal_alias_refused=false copied_input_wal_changed=true
recovery destination sidecar overwrote its copied input WAL
test result: FAILED. 4 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.60s

F2 valid-size Note confirmation

Start with a 9 MiB paragraph and a short second paragraph. Retain the initial tree, delete the first paragraph in the live source, then deliver an 8 MiB browser insertion to the surviving paragraph. The visible Note passes the 10 MiB size validator. The mirror grows past its limit without updating its counter. Reconstructing the retained tree through the same retain_with_deletes method used on room restart refuses the accepted edit. This is not limited to an oversized resulting Note. Verbatim:

valid_live_markdown_bytes=8388612 mirror_bytes=17825920 tracked_mirror_bytes=9437293 restart_retained_join_ok=false
accepted valid-size Note cannot reopen its retained checkpoint
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 133 filtered out; finished in 8.72s

A real-Hub restart case is still to be run; the observation above is the real conflict/retention helper path, not an HTTP status assertion.

Defensive #1197 independent findings: NOT SAFE. The copied-input mutation now reproduces in Rust, and the mirror budget failure also occurs with valid-size visible Markdown. ## F1 Rust confirmation The actual destination helper plus `Db::connect` reproduced mutation of the copied input WAL. A missing destination main file also bypasses an aliased SHM leaf. Existing input/read-only and non-aliased recovery tests pass. Verbatim: ```text new_destination_shm_alias_refused=false recovery destination accepted an input SHM alias destination_wal_alias_refused=false copied_input_wal_changed=true recovery destination sidecar overwrote its copied input WAL test result: FAILED. 4 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.60s ``` ## F2 valid-size Note confirmation Start with a 9 MiB paragraph and a short second paragraph. Retain the initial tree, delete the first paragraph in the live source, then deliver an 8 MiB browser insertion to the surviving paragraph. The visible Note passes the 10 MiB size validator. The mirror grows past its limit without updating its counter. Reconstructing the retained tree through the same `retain_with_deletes` method used on room restart refuses the accepted edit. This is not limited to an oversized resulting Note. Verbatim: ```text valid_live_markdown_bytes=8388612 mirror_bytes=17825920 tracked_mirror_bytes=9437293 restart_retained_join_ok=false accepted valid-size Note cannot reopen its retained checkpoint test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 133 filtered out; finished in 8.72s ``` A real-Hub restart case is still to be run; the observation above is the real conflict/retention helper path, not an HTTP status assertion.
kayg commented 2026-10-07 02:24:52 +00:00
Author
Owner
Copy link

Defensive #1197 independent findings: NOT SAFE. The copied-input mutation now reproduces in Rust, and the mirror budget failure also occurs with valid-size visible Markdown.

F1 Rust confirmation

The actual destination helper plus Db::connect reproduced mutation of the copied input WAL. A missing destination main file also bypasses an aliased SHM leaf. Existing input/read-only and non-aliased recovery tests pass. Verbatim:

new_destination_shm_alias_refused=false
recovery destination accepted an input SHM alias
destination_wal_alias_refused=false copied_input_wal_changed=true
recovery destination sidecar overwrote its copied input WAL
test result: FAILED. 4 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.60s

F2 valid-size Note confirmation

Start with a 9 MiB paragraph and a short second paragraph. Retain the initial tree, delete the first paragraph in the live source, then deliver an 8 MiB browser insertion to the surviving paragraph. The visible Note passes the 10 MiB size validator. The mirror grows past its limit without updating its counter. Reconstructing the retained tree through the same retain_with_deletes method used on room restart refuses the accepted edit. This is not limited to an oversized resulting Note. Verbatim:

valid_live_markdown_bytes=8388612 mirror_bytes=17825920 tracked_mirror_bytes=9437293 restart_retained_join_ok=false
accepted valid-size Note cannot reopen its retained checkpoint
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 133 filtered out; finished in 8.72s

A real-Hub restart case is still to be run; the observation above is the real conflict/retention helper path, not an HTTP status assertion.

Defensive #1197 independent findings: NOT SAFE. The copied-input mutation now reproduces in Rust, and the mirror budget failure also occurs with valid-size visible Markdown. ## F1 Rust confirmation The actual destination helper plus `Db::connect` reproduced mutation of the copied input WAL. A missing destination main file also bypasses an aliased SHM leaf. Existing input/read-only and non-aliased recovery tests pass. Verbatim: ```text new_destination_shm_alias_refused=false recovery destination accepted an input SHM alias destination_wal_alias_refused=false copied_input_wal_changed=true recovery destination sidecar overwrote its copied input WAL test result: FAILED. 4 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.60s ``` ## F2 valid-size Note confirmation Start with a 9 MiB paragraph and a short second paragraph. Retain the initial tree, delete the first paragraph in the live source, then deliver an 8 MiB browser insertion to the surviving paragraph. The visible Note passes the 10 MiB size validator. The mirror grows past its limit without updating its counter. Reconstructing the retained tree through the same `retain_with_deletes` method used on room restart refuses the accepted edit. This is not limited to an oversized resulting Note. Verbatim: ```text valid_live_markdown_bytes=8388612 mirror_bytes=17825920 tracked_mirror_bytes=9437293 restart_retained_join_ok=false accepted valid-size Note cannot reopen its retained checkpoint test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 133 filtered out; finished in 8.72s ``` A real-Hub restart case is still to be run; the observation above is the real conflict/retention helper path, not an HTTP status assertion.
kayg commented 2026-10-07 02:25:10 +00:00
Author
Owner
Copy link

Continuing #1197 as collabloss5 on job/collabloss-1197, base/head 86ed8e4ad6. Closing F1/F2/F3 from artifacts/collabrev3-input with separate regression-tested commits. The preceding comment repeats the independent review evidence; it is not a new execution result from this continuation. No production writes, pushes or deploys.

Continuing #1197 as collabloss5 on job/collabloss-1197, base/head 86ed8e4ad69f31738b533af373675659becaa653. Closing F1/F2/F3 from artifacts/collabrev3-input with separate regression-tested commits. The preceding comment repeats the independent review evidence; it is not a new execution result from this continuation. No production writes, pushes or deploys.
kayg commented 2026-10-07 02:29:17 +00:00
Author
Owner
Copy link

Continuation findings: F1 checks destination main only and returns on NotFound, bypassing real SQLite sidecars. Added regression matrix for destination WAL/SHM × input main/WAL/SHM × main present/absent, including symlink refusal and safe real Db::connect. F2 merge_conflict_shadow does not account for browser growth. Added 9 MiB retained-parent delayed-paste coverage for deleted and surviving parents, oversized and valid-size pastes; capacity preflight will include repaired live state and comparison JSON before history admission. F3 AgentTurn::apply bypasses the retained-parent source path; the fix will share it under User → room locks while preserving agent identity. These are code findings; Rust before-fix tests are still compiling dependencies on the shared host. The focused provider rejection regression has failed before its fix (1 failed, 20 passed).

Continuation findings: F1 checks destination main only and returns on NotFound, bypassing real SQLite sidecars. Added regression matrix for destination WAL/SHM × input main/WAL/SHM × main present/absent, including symlink refusal and safe real Db::connect. F2 merge_conflict_shadow does not account for browser growth. Added 9 MiB retained-parent delayed-paste coverage for deleted and surviving parents, oversized and valid-size pastes; capacity preflight will include repaired live state and comparison JSON before history admission. F3 AgentTurn::apply bypasses the retained-parent source path; the fix will share it under User → room locks while preserving agent identity. These are code findings; Rust before-fix tests are still compiling dependencies on the shared host. The focused provider rejection regression has failed before its fix (1 failed, 20 passed).
kayg commented 2026-10-07 02:36:48 +00:00
Author
Owner
Copy link

Committed the F2 client boundary as 148acb632: capacity close 1009 stops replay and retains the local Y.Doc for recovery. Before-fix provider test: 1 failed, 20 passed. After-fix focused provider test: 21 passed. Initial web type check: svelte-check found 0 errors and 1 warning in 1 file; the command exits 1 because the uncommitted NoteView edit moved its exact perf pin, which will be refreshed without widening a rule. Rust before-fix runs continue compiling the dedicated target.

Committed the F2 client boundary as 148acb632: capacity close 1009 stops replay and retains the local Y.Doc for recovery. Before-fix provider test: 1 failed, 20 passed. After-fix focused provider test: 21 passed. Initial web type check: svelte-check found 0 errors and 1 warning in 1 file; the command exits 1 because the uncommitted NoteView edit moved its exact perf pin, which will be refreshed without widening a rule. Rust before-fix runs continue compiling the dedicated target.
kayg commented 2026-10-07 03:07:48 +00:00
Author
Owner
Copy link

F1 committed as 2b275fc95. Before-fix real Db regression refused=false for a destination WAL alias to copied recovery.sqlite-wal (existing main). Fixed guard compares device/inode for destination main/WAL/SHM against all input main/WAL/SHM leaves, including absent destination main, through confined handles; symlinks fail. After-fix recovery example: test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.76s. Final clippy and origin/dev gates remain pending.

F1 committed as 2b275fc95. Before-fix real Db regression refused=false for a destination WAL alias to copied recovery.sqlite-wal (existing main). Fixed guard compares device/inode for destination main/WAL/SHM against all input main/WAL/SHM leaves, including absent destination main, through confined handles; symlinks fail. After-fix recovery example: `test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.76s`. Final clippy and origin/dev gates remain pending.
kayg commented 2026-10-07 03:38:02 +00:00
Author
Owner
Copy link

F2 committed as 5312a23a59.

F2 regression failed before the fix: delayed retained-parent paste reached 17,825,920 tracked bytes from a 9,437,293-byte base; valid growth was not tracked. The new socket preflight checks the retained byte budget, repaired live state, comparison tree and branch join before bindings/history admission. The direct mirror merge also tracks growth and refuses excess. After fix: test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 130 filtered out; finished in 9.66s. Provider: Tests 21 passed (21). Capacity close keeps the client document, stops retries and offers the existing persistent recovery toast/clipboard action, including edits typed after refusal. All six production browser evidence cases passed: capacity recovery screenshots=6 copy_actions_passed=6 platform=macOS client_close_injection=true. These screenshots control the close frame; they do not claim a real server capacity integration run. No new UI primitive or styling.

Exact perf pins refreshed for the moved sites. Counts and limits are unchanged, except the same string conversion now converts the selected close reason.

capacity-1440-dark

capacity-1440-light

capacity-390-dark

capacity-390-light

capacity-820-dark

capacity-820-light

F2 committed as 5312a23a591cf1386be047e6b2a3b50b645a015b. F2 regression failed before the fix: delayed retained-parent paste reached 17,825,920 tracked bytes from a 9,437,293-byte base; valid growth was not tracked. The new socket preflight checks the retained byte budget, repaired live state, comparison tree and branch join before bindings/history admission. The direct mirror merge also tracks growth and refuses excess. After fix: `test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 130 filtered out; finished in 9.66s`. Provider: `Tests 21 passed (21)`. Capacity close keeps the client document, stops retries and offers the existing persistent recovery toast/clipboard action, including edits typed after refusal. All six production browser evidence cases passed: `capacity recovery screenshots=6 copy_actions_passed=6 platform=macOS client_close_injection=true`. These screenshots control the close frame; they do not claim a real server capacity integration run. No new UI primitive or styling. Exact perf pins refreshed for the moved sites. Counts and limits are unchanged, except the same string conversion now converts the selected close reason. ![capacity-1440-dark](https://git.kayg.org/attachments/25d84da3-5def-4c49-b127-31830992ad61) ![capacity-1440-light](https://git.kayg.org/attachments/1158c8d8-370b-41b5-a77d-0d36882814c8) ![capacity-390-dark](https://git.kayg.org/attachments/aa5d0cfe-8588-406c-b3a9-bccf2ab76908) ![capacity-390-light](https://git.kayg.org/attachments/f81c3d4b-8c12-485c-9c22-facfaac9f7ec) ![capacity-820-dark](https://git.kayg.org/attachments/e601d0c3-83e7-4c09-b918-4165d1ac5619) ![capacity-820-light](https://git.kayg.org/attachments/da14cfc7-e7a3-4243-945f-2db95a5f2a86)
kayg commented 2026-10-07 03:39:16 +00:00
Author
Owner
Copy link

F3 committed as 5795aa4744. AgentTurn::apply now calls the checked source writer under the same User/room locks, preserving the agent name and server-issued history author. The retained parent and branch checkpoint precede live integration. Before fix the review regression failed with agent deletion discarded delayed browser edit. After fix: test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 131 filtered out; finished in 0.76s (delayed edit flush/restart, existing history/quota tests). No existing assertion was changed. The independent review found no production caller for begin_agent; this is a verified library-path fix, not a deployed agent-route claim. Final origin/dev gates follow.

F3 committed as 5795aa4744161d25195cb4dc9d922f4a21104f25. AgentTurn::apply now calls the checked source writer under the same User/room locks, preserving the agent name and server-issued history author. The retained parent and branch checkpoint precede live integration. Before fix the review regression failed with `agent deletion discarded delayed browser edit`. After fix: `test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 131 filtered out; finished in 0.76s` (delayed edit flush/restart, existing history/quota tests). No existing assertion was changed. The independent review found no production caller for begin_agent; this is a verified library-path fix, not a deployed agent-route claim. Final origin/dev gates follow.
kayg commented 2026-10-07 03:55:03 +00:00
Author
Owner
Copy link

Before-first-sync capacity recovery refinement committed as 69976d30df. Capacity refusal is classified before the status callback, so recovery does not reload/destroy the local document even before initial sync. Other incoming shared-room refusals retain their authorization re-read. Regression asserts callback order. Current focused provider: Tests 21 passed (21). Current bun run check: svelte-check found 0 errors and 1 warning in 1 file; exit 0; perf lint has zero violations. Full web gate: Test Files 287 passed (287) / Tests 2036 passed (2036). Final production build: Compressed 917 static variants; saved 21487328 bytes. Final browser set: capacity recovery screenshots=6 copy_actions_passed=6 platform=macOS client_close_injection=true. Rust fmt/clippy pass; Notes/recovery execution and collab test retry after the sccache failure remain pending.

capacity-1440-dark

capacity-1440-light

capacity-390-dark

capacity-390-light

capacity-820-dark

capacity-820-light

Before-first-sync capacity recovery refinement committed as 69976d30df9c357a6014edeb522fc3ce4cab5547. Capacity refusal is classified before the status callback, so recovery does not reload/destroy the local document even before initial sync. Other incoming shared-room refusals retain their authorization re-read. Regression asserts callback order. Current focused provider: `Tests 21 passed (21)`. Current `bun run check`: `svelte-check found 0 errors and 1 warning in 1 file`; exit 0; perf lint has zero violations. Full web gate: `Test Files 287 passed (287)` / `Tests 2036 passed (2036)`. Final production build: `Compressed 917 static variants; saved 21487328 bytes.` Final browser set: `capacity recovery screenshots=6 copy_actions_passed=6 platform=macOS client_close_injection=true`. Rust fmt/clippy pass; Notes/recovery execution and collab test retry after the sccache failure remain pending. ![capacity-1440-dark](https://git.kayg.org/attachments/f93b4e23-247d-4019-8356-71fdd3987c0d) ![capacity-1440-light](https://git.kayg.org/attachments/1d8f5e7e-5ef5-4d23-a853-9bac7b4ca406) ![capacity-390-dark](https://git.kayg.org/attachments/e9860b60-4aaa-4525-9184-2eef31e5ef1b) ![capacity-390-light](https://git.kayg.org/attachments/8e833176-0415-4746-a603-922686662de6) ![capacity-820-dark](https://git.kayg.org/attachments/7405d569-7c00-49fc-a5db-81d033b5cfa4) ![capacity-820-light](https://git.kayg.org/attachments/afdb0a52-d6f6-4b4c-ac0a-3fa813a1508e)
kayg commented 2026-10-07 04:06:38 +00:00
Author
Owner
Copy link

Head: 69976d30df on job/collabloss-1197.
Merged origin/dev once: 3601719b80. No conflict. origin/dev Notes migrations end at 0037; inherited 0038 remains free.

Continuation of #1197 from 86ed8e4ad6.

Built:

  • F1: guard destination main/WAL/SHM against all copied input main/WAL/SHM device/inode identities, even when the destination main is absent. Confined handles refuse symlinks. Real Db regression covers the alias matrix and a safe destination.
  • F2: reserve retained browser growth and preflight the repaired checkpoint before bindings/history admission. Track mirror bytes. Oversized delayed paste is refused with a clear client error; valid paste survives reopening. Keep the local document and use the existing persistent recovery toast and copyText action.
  • F3: apply named agent deltas through the checked source writer, with retained parents and a write-ahead branch checkpoint. The delayed browser edit survives flush and a history-enabled restart. Agent attribution and quota refusal remain tested.

Before-fix failures were reproduced separately. Logs are in artifacts/collabloss5/f1-before.log, f2-before-corrected.log, f3-before-corrected.log and f2-web-before.log. No existing test expectation was weakened.

UX gaps closed: stop replay after capacity refusal; keep current editor text; show Copy unsaved text; copy edits typed after refusal; preserve capacity recovery before first sync while retaining other shared-room authorization reloads. Shared visible controls use the existing ToastBody/Pill recovery action. No new local styling or icon. Six production browser cases use macOS rendering at 390/820/1440 px in light/dark. Pointer/touch and keyboard copy actions passed. Close-frame injection is explicit: the browser evidence does not prove a real server capacity close.

UX gaps left / known gaps: rejected text stays in the current tab, not a durable conflict sibling. Copy before reloading. No production caller of begin_agent was found by the independent review; F3 verifies the library path. Full real-server matrices and e2e belong to the merge round under the verification policy.

Decisions: choose the brief's clear-error option for capacity refusal, use close code 1009 and the existing persistent recovery action. Retained bytes conservatively count eligible encoded batch bytes, including replay, before admission. Only mirrored/root-deleting browser batches copy trees for preflight; ordinary typing without a mirror keeps its existing fast path.

Expected cost: F1 has three input and three destination fingerprint reads, independent of Index size. F2 is O(live state + retained state + batch bytes), within checkpoint bounds, for mirrored/deleting batches; it computes the server repair once and reserves exact repair history bytes. F3 plans one Note and writes one branch checkpoint through the shared writer; no Home scan. No perf VM run: this is not a performance issue, per the final verification policy. The realistic capacity regression uses a 9 MiB base and an 8 MiB delayed paste; the valid case uses 3 MiB + 1 MiB.

For the merge round:

(cd apps/web && bun e2e/notes-preservation-1197.mjs)
cc -shared -fPIC -o artifacts/history-stop-1197.so apps/web/e2e/support/history-stop-1197.c -ldl
(cd apps/web && CALTERNAL_TEST_HISTORY_PRELOAD="$PWD/../../artifacts/history-stop-1197.so" bun e2e/notes-reload-1197.mjs)
bash tests/adversarial/run.sh

These must prove real-editor conflict recovery, restart/abrupt-stop retention, and hostile-input/User-isolation behavior against the combined server.

Files changed in this continuation:

  • apps/web/src/lib/notes/NoteView.svelte
  • apps/web/src/lib/notes/collab.test.ts
  • apps/web/src/lib/notes/collab.ts
  • contracts/perf/adoption-1058.json
  • contracts/perf/exceptions.json
  • crates/calternal-collab/examples/recover_note.rs
  • crates/calternal-collab/src/session.rs

Final screenshot set (production build at 69976d30d):
capacity-1440-dark

capacity-1440-light

capacity-390-dark

capacity-390-light

capacity-820-dark

capacity-820-light

Gates (verbatim result lines; full local logs in artifacts/collabloss5):

cargo fmt --check

fmt: exit 0

cargo clippy -p calternal-collab -p calternal-plugin-notes --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 30.64s

cargo test -p calternal-collab (retry with RUSTC_WRAPPER empty)

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 24s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss5/debug/deps/calternal_collab-ed6b47ba1cc9da41)
test result: ok. 134 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 135.58s
     Running tests/agent_turn_order.rs (/mnt/hdd/targets/collabloss5/debug/deps/agent_turn_order-f38e328c1ce74368)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.84s
     Running tests/block_apply_property.rs (/mnt/hdd/targets/collabloss5/debug/deps/block_apply_property-2eea5f0af40f8e09)
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.50s
     Running tests/canvas_shares.rs (/mnt/hdd/targets/collabloss5/debug/deps/canvas_shares-125da8f07ca9011f)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.09s
     Running tests/cross_language.rs (/mnt/hdd/targets/collabloss5/debug/deps/cross_language-cd25983ea4cefde8)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 49.13s
     Running tests/dav_etag.rs (/mnt/hdd/targets/collabloss5/debug/deps/dav_etag-4729f392e97e1a9b)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.66s
     Running tests/history_restore.rs (/mnt/hdd/targets/collabloss5/debug/deps/history_restore-6998d7ee8fa80129)
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.00s
     Running tests/hostile_clients.rs (/mnt/hdd/targets/collabloss5/debug/deps/hostile_clients-6632ebfb9e1c85ec)
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.85s
     Running tests/journal_race.rs (/mnt/hdd/targets/collabloss5/debug/deps/journal_race-989d917d0ca30852)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.65s
     Running tests/restart_epoch.rs (/mnt/hdd/targets/collabloss5/debug/deps/restart_epoch-69cd7dcf0c8edea7)
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.39s
     Running tests/shared_notes.rs (/mnt/hdd/targets/collabloss5/debug/deps/shared_notes-be20a3034172f2bc)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.84s
     Running tests/two_clients.rs (/mnt/hdd/targets/collabloss5/debug/deps/two_clients-5087f503b0682e1e)
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.38s
     Running tests/untouched_bytes.rs (/mnt/hdd/targets/collabloss5/debug/deps/untouched_bytes-5890e8a6145af8cf)
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 35.64s
     Running tests/vector_bridge.rs (/mnt/hdd/targets/collabloss5/debug/deps/vector_bridge-0cd24c8331bb271e)
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s
     Running tests/voice_memos_review.rs (/mnt/hdd/targets/collabloss5/debug/deps/voice_memos_review-cad0b5c861c597b6)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.91s
     Running tests/wiki_embeds.rs (/mnt/hdd/targets/collabloss5/debug/deps/wiki_embeds-f1dbf62010460721)
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 32.49s
   Doc-tests calternal_collab
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-notes

    Finished `test` profile [unoptimized + debuginfo] target(s) in 7m 50s
     Running unittests src/lib.rs (/mnt/hdd/targets/collabloss5/debug/deps/calternal_plugin_notes-7e7f68fe6b04e193)
test result: ok. 317 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 360.84s
     Running tests/apple_replay.rs (/mnt/hdd/targets/collabloss5/debug/deps/apple_replay-67a714ce29bfc18a)
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.72s
   Doc-tests calternal_plugin_notes
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-collab --example recover_note

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 10s
     Running unittests examples/recover_note.rs (/mnt/hdd/targets/collabloss5/debug/examples/recover_note-f5990dad66c37bba)
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.14s

The first collab test build exited 101 before tests: sccache: caused by: Connection reset by peer (os error 104). The retry disabled only this job's cache wrapper and exited 0. No source change was needed.

bun run check

perf-lint: PASS; 0 violations; 22548 scoped exceptions
svelte-check found 0 errors and 1 warning in 1 file

bun run test -- --maxWorkers=2

 Test Files  287 passed (287)
      Tests  2036 passed (2036)
   Duration  670.04s (transform 46%, import 20%, environment 18%, tests 11%, setup 6%)

Focused latest provider regression (including callback order):

 Test Files  1 passed (1)
      Tests  21 passed (21)
   Duration  627ms (transform 40%, tests 36%, import 23%, worker 2%)

Production build and final browser evidence:

Compressed 917 static variants; saved 21487328 bytes.
capacity recovery screenshots=6 copy_actions_passed=6 platform=macOS client_close_injection=true

Cleanup (verbatim):

Removed 13262 files, 14.1GiB total
cargo clean: exit 0

The job Cargo target no longer exists. Removed apps/web/build and apps/web/.svelte-kit. Review artifacts remain ignored in the worktree. Final worktree is clean. No push or deploy.

Head: 69976d30df9c357a6014edeb522fc3ce4cab5547 on job/collabloss-1197. Merged origin/dev once: 3601719b80a39f712daf07b37879b22929dfffa0. No conflict. origin/dev Notes migrations end at 0037; inherited 0038 remains free. Continuation of #1197 from 86ed8e4ad69f31738b533af373675659becaa653. Built: - F1: guard destination main/WAL/SHM against all copied input main/WAL/SHM device/inode identities, even when the destination main is absent. Confined handles refuse symlinks. Real Db regression covers the alias matrix and a safe destination. - F2: reserve retained browser growth and preflight the repaired checkpoint before bindings/history admission. Track mirror bytes. Oversized delayed paste is refused with a clear client error; valid paste survives reopening. Keep the local document and use the existing persistent recovery toast and copyText action. - F3: apply named agent deltas through the checked source writer, with retained parents and a write-ahead branch checkpoint. The delayed browser edit survives flush and a history-enabled restart. Agent attribution and quota refusal remain tested. Before-fix failures were reproduced separately. Logs are in artifacts/collabloss5/f1-before.log, f2-before-corrected.log, f3-before-corrected.log and f2-web-before.log. No existing test expectation was weakened. UX gaps closed: stop replay after capacity refusal; keep current editor text; show Copy unsaved text; copy edits typed after refusal; preserve capacity recovery before first sync while retaining other shared-room authorization reloads. Shared visible controls use the existing ToastBody/Pill recovery action. No new local styling or icon. Six production browser cases use macOS rendering at 390/820/1440 px in light/dark. Pointer/touch and keyboard copy actions passed. Close-frame injection is explicit: the browser evidence does not prove a real server capacity close. UX gaps left / known gaps: rejected text stays in the current tab, not a durable conflict sibling. Copy before reloading. No production caller of begin_agent was found by the independent review; F3 verifies the library path. Full real-server matrices and e2e belong to the merge round under the verification policy. Decisions: choose the brief's clear-error option for capacity refusal, use close code 1009 and the existing persistent recovery action. Retained bytes conservatively count eligible encoded batch bytes, including replay, before admission. Only mirrored/root-deleting browser batches copy trees for preflight; ordinary typing without a mirror keeps its existing fast path. Expected cost: F1 has three input and three destination fingerprint reads, independent of Index size. F2 is O(live state + retained state + batch bytes), within checkpoint bounds, for mirrored/deleting batches; it computes the server repair once and reserves exact repair history bytes. F3 plans one Note and writes one branch checkpoint through the shared writer; no Home scan. No perf VM run: this is not a performance issue, per the final verification policy. The realistic capacity regression uses a 9 MiB base and an 8 MiB delayed paste; the valid case uses 3 MiB + 1 MiB. For the merge round: ```sh (cd apps/web && bun e2e/notes-preservation-1197.mjs) cc -shared -fPIC -o artifacts/history-stop-1197.so apps/web/e2e/support/history-stop-1197.c -ldl (cd apps/web && CALTERNAL_TEST_HISTORY_PRELOAD="$PWD/../../artifacts/history-stop-1197.so" bun e2e/notes-reload-1197.mjs) bash tests/adversarial/run.sh ``` These must prove real-editor conflict recovery, restart/abrupt-stop retention, and hostile-input/User-isolation behavior against the combined server. Files changed in this continuation: - apps/web/src/lib/notes/NoteView.svelte - apps/web/src/lib/notes/collab.test.ts - apps/web/src/lib/notes/collab.ts - contracts/perf/adoption-1058.json - contracts/perf/exceptions.json - crates/calternal-collab/examples/recover_note.rs - crates/calternal-collab/src/session.rs Final screenshot set (production build at 69976d30d): ![capacity-1440-dark](https://git.kayg.org/attachments/f93b4e23-247d-4019-8356-71fdd3987c0d) ![capacity-1440-light](https://git.kayg.org/attachments/1d8f5e7e-5ef5-4d23-a853-9bac7b4ca406) ![capacity-390-dark](https://git.kayg.org/attachments/e9860b60-4aaa-4525-9184-2eef31e5ef1b) ![capacity-390-light](https://git.kayg.org/attachments/8e833176-0415-4746-a603-922686662de6) ![capacity-820-dark](https://git.kayg.org/attachments/7405d569-7c00-49fc-a5db-81d033b5cfa4) ![capacity-820-light](https://git.kayg.org/attachments/afdb0a52-d6f6-4b4c-ac0a-3fa813a1508e) Gates (verbatim result lines; full local logs in artifacts/collabloss5): `cargo fmt --check` ```text fmt: exit 0 ``` `cargo clippy -p calternal-collab -p calternal-plugin-notes --all-targets -- -D warnings` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 30.64s ``` `cargo test -p calternal-collab (retry with RUSTC_WRAPPER empty)` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 24s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss5/debug/deps/calternal_collab-ed6b47ba1cc9da41) test result: ok. 134 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 135.58s Running tests/agent_turn_order.rs (/mnt/hdd/targets/collabloss5/debug/deps/agent_turn_order-f38e328c1ce74368) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.84s Running tests/block_apply_property.rs (/mnt/hdd/targets/collabloss5/debug/deps/block_apply_property-2eea5f0af40f8e09) test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.50s Running tests/canvas_shares.rs (/mnt/hdd/targets/collabloss5/debug/deps/canvas_shares-125da8f07ca9011f) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.09s Running tests/cross_language.rs (/mnt/hdd/targets/collabloss5/debug/deps/cross_language-cd25983ea4cefde8) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 49.13s Running tests/dav_etag.rs (/mnt/hdd/targets/collabloss5/debug/deps/dav_etag-4729f392e97e1a9b) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.66s Running tests/history_restore.rs (/mnt/hdd/targets/collabloss5/debug/deps/history_restore-6998d7ee8fa80129) test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.00s Running tests/hostile_clients.rs (/mnt/hdd/targets/collabloss5/debug/deps/hostile_clients-6632ebfb9e1c85ec) test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.85s Running tests/journal_race.rs (/mnt/hdd/targets/collabloss5/debug/deps/journal_race-989d917d0ca30852) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.65s Running tests/restart_epoch.rs (/mnt/hdd/targets/collabloss5/debug/deps/restart_epoch-69cd7dcf0c8edea7) test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.39s Running tests/shared_notes.rs (/mnt/hdd/targets/collabloss5/debug/deps/shared_notes-be20a3034172f2bc) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.84s Running tests/two_clients.rs (/mnt/hdd/targets/collabloss5/debug/deps/two_clients-5087f503b0682e1e) test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.38s Running tests/untouched_bytes.rs (/mnt/hdd/targets/collabloss5/debug/deps/untouched_bytes-5890e8a6145af8cf) test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 35.64s Running tests/vector_bridge.rs (/mnt/hdd/targets/collabloss5/debug/deps/vector_bridge-0cd24c8331bb271e) test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s Running tests/voice_memos_review.rs (/mnt/hdd/targets/collabloss5/debug/deps/voice_memos_review-cad0b5c861c597b6) test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.91s Running tests/wiki_embeds.rs (/mnt/hdd/targets/collabloss5/debug/deps/wiki_embeds-f1dbf62010460721) test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 32.49s Doc-tests calternal_collab test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-notes` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 7m 50s Running unittests src/lib.rs (/mnt/hdd/targets/collabloss5/debug/deps/calternal_plugin_notes-7e7f68fe6b04e193) test result: ok. 317 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 360.84s Running tests/apple_replay.rs (/mnt/hdd/targets/collabloss5/debug/deps/apple_replay-67a714ce29bfc18a) test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.72s Doc-tests calternal_plugin_notes test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-collab --example recover_note` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 10s Running unittests examples/recover_note.rs (/mnt/hdd/targets/collabloss5/debug/examples/recover_note-f5990dad66c37bba) test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.14s ``` The first collab test build exited 101 before tests: `sccache: caused by: Connection reset by peer (os error 104)`. The retry disabled only this job's cache wrapper and exited 0. No source change was needed. `bun run check` ```text perf-lint: PASS; 0 violations; 22548 scoped exceptions svelte-check found 0 errors and 1 warning in 1 file ``` `bun run test -- --maxWorkers=2` ```text Test Files 287 passed (287) Tests 2036 passed (2036) Duration 670.04s (transform 46%, import 20%, environment 18%, tests 11%, setup 6%) ``` Focused latest provider regression (including callback order): ```text Test Files 1 passed (1) Tests 21 passed (21) Duration 627ms (transform 40%, tests 36%, import 23%, worker 2%) ``` Production build and final browser evidence: ```text Compressed 917 static variants; saved 21487328 bytes. capacity recovery screenshots=6 copy_actions_passed=6 platform=macOS client_close_injection=true ``` Cleanup (verbatim): ```text Removed 13262 files, 14.1GiB total cargo clean: exit 0 ``` The job Cargo target no longer exists. Removed apps/web/build and apps/web/.svelte-kit. Review artifacts remain ignored in the worktree. Final worktree is clean. No push or deploy.
kayg commented 2026-10-07 09:10:43 +00:00
Author
Owner
Copy link

Round 2 Notes UI finding to check against this live-save issue:

  • I created one Note through the real Notes API. The production editor rendered 5,000 authored blocks (the Note title plus 4,999 paragraphs).
  • I typed 60 distinct round2 sample NN bursts at the end of the Note over five minutes using Playwright keyboard input.
  • After a 1.5 second settle window, GET /api/v1/notes/<id> contained only 6 of the 60 markers. The local profile failed its save assertion (6 !== 60).
  • The browser captured artifacts/bash-notes/big-note-5000-1440.png. The test fixture and data are in the bash-notes worktree; no Note body or credentials were included in the output.

This may be delayed persistence under shared-host load rather than loss. I am running one bounded follow-up with a DOM marker count and up to 60 seconds for API persistence. I have not edited the collaboration or Note writer code.

Round 2 Notes UI finding to check against this live-save issue: - I created one Note through the real Notes API. The production editor rendered 5,000 authored blocks (the Note title plus 4,999 paragraphs). - I typed 60 distinct `round2 sample NN` bursts at the end of the Note over five minutes using Playwright keyboard input. - After a 1.5 second settle window, `GET /api/v1/notes/<id>` contained only 6 of the 60 markers. The local profile failed its save assertion (`6 !== 60`). - The browser captured `artifacts/bash-notes/big-note-5000-1440.png`. The test fixture and data are in the bash-notes worktree; no Note body or credentials were included in the output. This may be delayed persistence under shared-host load rather than loss. I am running one bounded follow-up with a DOM marker count and up to 60 seconds for API persistence. I have not edited the collaboration or Note writer code.
kayg commented 2026-10-07 09:32:44 +00:00
Author
Owner
Copy link

Follow-up result for the 5,000-block profile:

  • All 60 typed markers were present in the editor DOM.
  • All 60 reached GET /api/v1/notes/<id> after 34,316 ms. The earlier 1.5 second read (6/60) was too early to conclude data loss. No data loss was confirmed in this completed run.
  • A second run timed out after reload while waiting for data-editor-ready; that script did not emit the API marker count before the reload, so it is inconclusive. The final instrumented run saved all markers and did not need a reload.
  • Local debug-server profile, about 5,000 blocks / 499,898 body bytes: open 6,910 ms; keyboard keydown-to-paint p50/p95 76.9/171.5 ms over five minutes; scroll-frame p95 16.8 ms; browser heap 27,582,989 → 56,859,661 bytes. Load average at start 27.56 / 31.13 / 37.85, at end 35.52 / 32.01 / 35.42.

These are local measurements under shared-host load, not perf-VM numbers. I made no collaboration or Note writer changes.

Follow-up result for the 5,000-block profile: - All 60 typed markers were present in the editor DOM. - All 60 reached `GET /api/v1/notes/<id>` after 34,316 ms. The earlier 1.5 second read (6/60) was too early to conclude data loss. No data loss was confirmed in this completed run. - A second run timed out after reload while waiting for `data-editor-ready`; that script did not emit the API marker count before the reload, so it is inconclusive. The final instrumented run saved all markers and did not need a reload. - Local debug-server profile, about 5,000 blocks / 499,898 body bytes: open 6,910 ms; keyboard keydown-to-paint p50/p95 76.9/171.5 ms over five minutes; scroll-frame p95 16.8 ms; browser heap 27,582,989 → 56,859,661 bytes. Load average at start 27.56 / 31.13 / 37.85, at end 35.52 / 32.01 / 35.42. These are local measurements under shared-host load, not perf-VM numbers. I made no collaboration or Note writer changes.
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
dev
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/blocks-1125
wip/allday-1107
wip/agenda-1086
wip/trayicons2-1095
wip/trayicons-1095
wip/sidebar3-1094
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/nlpchip-1127
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/delete-1119
job/txentry-1198
job/rev1586
job/rev2-money-ident
job/rev2-webperf
job/morph-1104
job/previewcard-1098
job/importhang-1121
job/kanban-1092
job/merge-round-7b
job/merge-round-7c
job/calcards-1115
job/collabrev3-1197
job/e2e-b-1071
job/agenda-1086
job/agenda-decks
job/allday-1107
job/browserfix
job/calact9
job/adv7c-1105
wip/collabrev3-1197
wip/calcards-1115
wip/calact9
wip/calact10
wip/browserfix
wip/agenda-decks
wip/adv7c-1105
wip/txentry-1198
wip/rev2-webperf
wip/rev2-money-ident
wip/rev1586
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/importhang-1121
wip/fix1586
wip/e2e-b2-1071
wip/e2e-b-1071
job/noncanon-1618
wip/noncanon-1618
job/edrevert-1616
job/partial-1605
wip/partial-1605
job/calact6
job/cold-1586
job/perfvm-1587
wip/cold-1586
job/cal404-1581
wip/calact6
wip/cal404-1581
job/dname-1584
wip/dname-1584
job/merge41
wip/merge41b
wip/merge41
job/rev1573c
job/hscroll-1579
wip/rev1573c
job/rev1573b
job/rev1573
wip/fix1573
wip/hscroll2
wip/hscroll-1579
job/rev1574
wip/fix1574
wip/rev1574
job/startup-1573c
job/merge40
wip/startup-1573d
wip/startup-1573c
job/calact5
wip/remtext2
wip/merge40c
wip/merge40b
wip/merge40
job/calact4
job/startup-1573
job/calprof
wip/calprof
wip/startup-1573
job/fs1575
job/fix1570
job/calact3
job/rec1540c
wip/fix1570
job/rev1570-review
wip/calact3
job/calact2
wip/calact2
job/calcold-1560
wip/calcold-1560
wip/rec1540c
job/fix1569
wip/fix1569
job/calact-1557
wip/calact-1557
job/remtext-1568
wip/remtext-1568
job/fix1566
wip/fix1566
job/rec1540b
job/reconcile-1540
job/money2rev
wip/money2rev
job/merge39
wip/merge39
wip/reconcile-1540
job/tabswitch2
job/merge38
wip/merge38
job/autherr-1553
wip/autherr-1553
job/money-688
wip/money688rev3
wip/money688rev2
wip/money688rev
wip/money688l
wip/money688k
wip/money688j
wip/money688i
wip/money688h
wip/money688g
wip/money688f
wip/money688e
wip/money688d
wip/money688c
wip/money688b
wip/money-688
wip/tabswitch2
wip/merge37
job/merge37
job/jobnames-1538
wip/jobnames-1538
job/tabcomp-perf
job/calscript-1492
wip/tabcomp-perf
wip/calscript-1492
job/mailbody-1533
wip/mailbody-1533
job/intlfmt-1461
job/merge36
wip/intlfmt2
wip/intlfmt-1461
wip/merge36
job/merge35c
job/tagperf-1186
wip/tagrev2
wip/tagrev
wip/tagperf4
wip/tagperf2-1186
wip/tagperf-1186
wip/tagfix5
wip/tagfix3
wip/tagfast2
wip/tagfast
wip/merge35c
job/notesel-1493
wip/notesel2
wip/notesel-1493
job/merge35b
wip/merge35b
wip/m35btriage
wip/m35bratchet
wip/calsel-1491
job/calsel-1491
job/notifread-1387
job/bulkwrite-1393
wip/notifread2
wip/notifread-1387
job/slowsel-1392
wip/bulkwrite-1393
wip/bulkrev4
wip/bulkrev3
wip/bulkrev2
wip/bulkrev
wip/bulkfix4
wip/bulkfix3
wip/bulkfix2
wip/bulkfix
job/mail7-1340
job/bigscroll-1481
job/searchperf-1425
wip/mailrev4
wip/mailrev3
wip/mailrev2
wip/mailrev
wip/mail7f
wip/mail7e
wip/mail7d
wip/searchperf2
wip/searchperf-1425
wip/mail7c
wip/mail7b
wip/mail7-1340
job/photoopen-1367
job/mailsel-1449
wip/bigscroll-1481
wip/slowsel3
wip/slowsel2
wip/slowsel-1392
wip/selroot
job/journaldup
wip/journaldup8
wip/journaldup7
wip/journaldup6
wip/journaldup5
wip/journaldup4
wip/journaldup3
wip/journaldup2
wip/journaldup
wip/jdrev5
wip/jdrev4
wip/jdrev3
wip/jdrev2
wip/jdrev
wip/jdfix9
job/bignote-1349
wip/mailsel-1449
wip/bignote3
wip/bignote2
wip/bignote-1349
job/statusmark-1457
wip/statusmark-1457
wip/photoopen4
wip/photoopen3
wip/photoopen2
wip/photoopen-1367
job/authflash-1473
job/merge35
wip/authflash-1473
job/phototags-1370
wip/phototags-1370
wip/merge35
wip/m35triage
job/tick-1446
wip/tick-1446
job/restartidx-1450
job/exmove-1333
job/coldnote-1451
wip/restartidx-1450
wip/exmove-1333
wip/coldnote-1451
job/undo412-1430
wip/undo412-1430
job/calwrite-1441
job/xcancel-1443
job/calscroll-1362
wip/xcancel-1443
wip/calwrite-1441
job/xsub-1445
wip/calscroll3
wip/calscroll2
wip/calscroll-1362
wip/xsub-1445
job/linkdup-1440
wip/linkdup2
wip/linkdup-1440
wip/tabswitch4
wip/tabswitch3
wip/tabswitch-1233
wip/navrev
job/tabswitch-1233
job/mdpaste-1431
job/taskundo-1433
job/directory-1199
wip/taskundo-1433
job/remind-1432
job/nfd-1411
wip/remind-1432
wip/dirfix4
wip/dirfix3
wip/dirfix2
wip/dirfix-1199
wip/directory-1199-r
wip/directory-1199
job/readerx-1427
wip/readerx-1427
job/scrollfade-1416
job/tipphone-1439
wip/nfd-1411
job/purge-1420
job/notifrow-1414
wip/purge-1420
wip/notifrow-1414
job/slop-1385
wip/slop2
wip/slop-1385
job/tbover-1409
job/qltitle-1408
job/grantlive-1405
job/taskclick-1434
wip/tbover-1409
wip/taskclick-1434
wip/qltitle-1408
job/scrub-1422
job/hotfix35
job/ticks-1361
wip/scrub-1422
job/taskprev-1401
wip/grantlive-1405
job/ghost-1323
wip/ticks3
wip/ticks2
wip/ticks-1361
wip/taskprev-1401
job/bash3-settings
wip/ghost-1323
job/mailmorph-1368
wip/bash3-settings
job/apiaudit-1374
wip/bash3-filesphotos
job/bash3-filesphotos
job/xuser39-1402
job/bash3-money
job/mailhtml-1372
wip/mailhtml2
wip/mailhtml-1372
job/bash3-interop
job/bash3-calendar
wip/bash3-money
wip/bash3-interop
wip/bash3-calendar
wip/mailmorph2
wip/mailmorph-1368
wip/bash3-tasks
job/outro-1391
job/linkpick-1379
job/linkdel-1384
wip/linkpick2
wip/linkpick-1379
wip/linkdel3
wip/linkdel2
wip/linkdel-1384
job/mailrows-1390
wip/mailrows-1390
wip/apiaudit2
wip/apiaudit-1374
job/bash-core
wip/outro-1391
wip/bash-core2
wip/bash-core
job/bash3-notes
job/bash3-tasks
job/merge34
job/notifdel-1363
wip/merge34
wip/notifdel2
wip/notifdel-1363
job/wklink-1371
wip/wklink-1371
job/searchbar-1360
wip/searchbar2
wip/searchbar-1360
job/merge33-1122
wip/merge33c
wip/merge33b
wip/merge33-1122
job/bash-security
job/mailglass-1373
wip/bash-security2
wip/bash-security
wip/mailglass-1373
job/instaudit-1369
wip/instaudit-1369
job/tabstorm-1338
wip/tabstorm2
wip/tabstorm-1338
wip/bash-files2
wip/bash-files
job/bash-files
job/bash-money
job/editfuzz-1335
wip/bash-money
wip/moneyrev
job/tasksperf-1286
wip/tasksperf3
wip/tasksperf2
wip/tasksperf-1286
wip/editfuzz2
wip/editfuzz-1335
review/dirrev-1199
job/merge32
wip/merge32b
wip/merge32
job/bash-chrome
job/tagdnd-1187
job/bash-notes
wip/bash-notes2
wip/bash-notes
wip/bash-chrome
wip/reconcile-c1
wip/adv-c1
wip/tagdnd2-1187
wip/tagdnd-1187
job/bash-calendar
job/deploy-c1
job/editbreak-1334
job/bash-perf
wip/bash-calendar2
wip/bash-calendar
wip/bash-perf
job/hunt-20261006
job/bash-interop
job/collabloss-1197
wip/collabrev-1197
wip/collabloss5-1197
wip/collabloss4-1197
wip/collabloss3-1197
wip/collabloss2-1197
wip/collabloss-1197
wip/bash-interop
job/bash-mail
wip/bash-mail
job/vis-1293
wip/vis-1293
wip/restyle-search-r
wip/restyle-search-fix2
wip/restyle-search-fix
wip/restyle-search
job/restyle-settings
job/restyle-search
wip/restyle-settings-fix
wip/restyle-settings
job/adv31
wip/advfix-a
wip/adv31
job/bash-tasks
wip/bash-tasks
job/restyle-files
wip/restyle-files-fix
wip/restyle-files
job/fmtbar-1210
wip/fmtbar2-1210
wip/fmtbar-1210
job/perf2-1124
wip/perf2-1124
job/proflog-1204
job/merge31
wip/restyle-notes
wip/merge31
wip/proflog-1204
job/restyle-notes
job/fix-1213
wip/fix-1213
job/hide-1153
job/restyle-mailmoney
job/notestatus-1209
wip/hide-1153
wip/hiderev2-1153
wip/hiderev-1153
wip/hide5-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
job/sidebarblur-1208
wip/notestatus-1209
wip/sidebarblur-1208
wip/restyle-mailmoney
job/onboard-1141
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
job/adv-1202
job/segmented-1200
wip/segmented-1200
job/merge30
job/notifloop-1194
job/toastmorph-1201
wip/notifloop-1194
job/perf-1124
job/tocrail-1191
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/perf-1124
wip/merge30j
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
fixbatch-25
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
fixbatch-23
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
hotfix-sidebar2
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
wip/e2e-a2-1071
wip/e2e-a-1071
backup/canvas-visual-before-reconcile
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/staging-imap
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/theme-detail
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
job/merge-round-3-pre-rebuild
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
backup/doc-stack-r3-reset-source
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
job/dedup-375-clean
job/dedup-375-before-rebase
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
backup/doc-stack-round3-before-rebuild
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1197
No description provided.