Bug bash: files

kayg commented

2026-10-06 19:01:29 +00:00

Owner

AREA: Files and Photos Tabs. Upload (drag, picker, folder, 2 GB file, 5k small files, cancel, resume), extensionless and odd files, previews/QuickLook, rename/move/copy/delete/trash/restore, pinned, smart folders, sharing, sort/filter, Photos grid scroll with 20k photos, albums, EXIF/HEIC/video, Copy link for files/folders/photos/albums; the WebDAV view of the same tree stays consistent.

Tracking issue for the 2026-10-07 bug bash. Every bug found gets its own issue, linked here.

AREA: Files and Photos Tabs. Upload (drag, picker, folder, 2 GB file, 5k small files, cancel, resume), extensionless and odd files, previews/QuickLook, rename/move/copy/delete/trash/restore, pinned, smart folders, sharing, sort/filter, Photos grid scroll with 20k photos, albums, EXIF/HEIC/video, Copy link for files/folders/photos/albums; the WebDAV view of the same tree stays consistent. Tracking issue for the 2026-10-07 bug bash. Every bug found gets its own issue, linked here.

photos-direct-link-inspector-1440-paper-white.png

222 KiB

photos-direct-link-inspector-1440-tokyo-night.png

225 KiB

photos-direct-link-inspector-390-paper-white.png

174 KiB

photos-direct-link-inspector-390-tokyo-night.png

131 KiB

photos-direct-link-inspector-820-paper-white.png

263 KiB

photos-direct-link-inspector-820-tokyo-night.png

201 KiB

pdf-quicklook-1440-dark.png

47 KiB

pdf-quicklook-1440-light.png

36 KiB

pdf-quicklook-390-dark.png

40 KiB

pdf-quicklook-390-light.png

36 KiB

pdf-quicklook-820-dark.png

41 KiB

pdf-quicklook-820-light.png

32 KiB

photos-arrow-navigation-actual.png

172 KiB

photos-tags-not-persisted-actual.png

161 KiB

kayg commented

2026-10-06 22:38:14 +00:00

Author

Owner

Starting the Files and Photos bug bash on branch job/bash-files, based on origin/dev at ff53d7b8b4da5a21f862d57dcc3496f8c019f647. I have read CLAUDE.md, docs/DESIGN.md and CONTEXT.md. I am building the app locally and will attach evidence for each finding here.

Starting the Files and Photos bug bash on branch `job/bash-files`, based on `origin/dev` at `ff53d7b8b4da5a21f862d57dcc3496f8c019f647`. I have read CLAUDE.md, docs/DESIGN.md and CONTEXT.md. I am building the app locally and will attach evidence for each finding here.

kayg commented

2026-10-06 23:34:27 +00:00

Author

Owner

Finding filed as #1252: the existing Files e2e thumbnail fixture uses PDF bytes for both .pdf and .txt, but expects kind=text-card for the .txt path. The Index reports application/pdf, which selects the PDF cache family; the run times out after 120 seconds. Evidence: artifacts/bash-files/files-thumbnail-kind-timeout.txt. No product defect or test expectation change was made.

Finding filed as #1252: the existing Files e2e thumbnail fixture uses PDF bytes for both `.pdf` and `.txt`, but expects `kind=text-card` for the `.txt` path. The Index reports `application/pdf`, which selects the PDF cache family; the run times out after 120 seconds. Evidence: `artifacts/bash-files/files-thumbnail-kind-timeout.txt`. No product defect or test expectation change was made.

kayg commented

2026-10-06 23:37:04 +00:00

Author

Owner

Finding filed as #1253: the Photos e2e empty-state check stops because its exact Upload photos role query resolves both the centered empty-state action and the top-row Upload action (also named Upload photos, Cmd+N). The harness failure output is recorded at artifacts/bash-files/photos-empty-state-selector-failure.txt. No user-facing action failure was established, and no test expectation was changed.

Finding filed as #1253: the Photos e2e empty-state check stops because its exact `Upload photos` role query resolves both the centered empty-state action and the top-row Upload action (also named `Upload photos`, Cmd+N). The harness failure output is recorded at `artifacts/bash-files/photos-empty-state-selector-failure.txt`. No user-facing action failure was established, and no test expectation was changed.

kayg commented

2026-10-06 23:40:12 +00:00

Author

Owner

Finding filed as #1255: the hidden-files e2e uploads hidden-proof.png.aae, but the shared sidecar contract pairs Apple AAE files as <photo stem>.aae/.AAE; for hidden-proof.png, that is hidden-proof.aae. The invalid name remains visible, so the existing assertion fails. Evidence: artifacts/bash-files/files-aae-fixture-failure.txt. I will correct only the fixture path and keep its assertion.

Finding filed as #1255: the hidden-files e2e uploads `hidden-proof.png.aae`, but the shared sidecar contract pairs Apple AAE files as `<photo stem>.aae`/`.AAE`; for `hidden-proof.png`, that is `hidden-proof.aae`. The invalid name remains visible, so the existing assertion fails. Evidence: `artifacts/bash-files/files-aae-fixture-failure.txt`. I will correct only the fixture path and keep its assertion.

kayg commented

2026-10-06 23:42:36 +00:00

Author

Owner

Finding filed as #1257: after the valid paired AAE hidden-by-default assertion passes, the hidden-files e2e waits for exact heading Hidden files; the SettingsCard's shared Title Case rule renders Hidden Files (#474), so the flow times out at apps/web/e2e/files.mjs:1352. Evidence: artifacts/bash-files/files-settings-title-expectation.txt. I left the existing expectation unchanged.

Finding filed as #1257: after the valid paired AAE hidden-by-default assertion passes, the hidden-files e2e waits for exact heading `Hidden files`; the SettingsCard's shared Title Case rule renders `Hidden Files` (#474), so the flow times out at `apps/web/e2e/files.mjs:1352`. Evidence: `artifacts/bash-files/files-settings-title-expectation.txt`. I left the existing expectation unchanged.

kayg commented

2026-10-06 23:46:38 +00:00

Author

Owner

Fixed on branch job/bash-files in commit 91b5fed63d5370522ef6d53369b8ed4843620959. The e2e fixture now uses the shared matcher’s <photo stem>.aae spelling; its hidden-by-default assertion passed in the focused production-browser verification. The full legacy flow then stopped on the separate stale heading expectation filed as #1257.

Fixed on branch `job/bash-files` in commit `91b5fed63d5370522ef6d53369b8ed4843620959`. The e2e fixture now uses the shared matcher’s `<photo stem>.aae` spelling; its hidden-by-default assertion passed in the focused production-browser verification. The full legacy flow then stopped on the separate stale heading expectation filed as #1257.

kayg commented

2026-10-06 23:52:40 +00:00

Author

Owner

Found and filed #1260: Photos Quick Look opens correctly, but the E2E test waits for obsolete .ql-title h2 markup. The current accessible title is a heading (role=heading, aria-level=2). Evidence: artifacts/bash-files/photos/photos-viewer-title-timeout.png. I will update the app-owned test selector to the accessible heading and continue the viewer flow; no shared UI code is changed.

Found and filed #1260: Photos Quick Look opens correctly, but the E2E test waits for obsolete `.ql-title h2` markup. The current accessible title is a heading (`role=heading`, `aria-level=2`). Evidence: `artifacts/bash-files/photos/photos-viewer-title-timeout.png`. I will update the app-owned test selector to the accessible heading and continue the viewer flow; no shared UI code is changed.

kayg commented

2026-10-06 23:59:04 +00:00

Author

Owner

Found and filed #1263 (major): opening a GPS-tagged photo via /p/<id> then pressing i leaves Quick Look's info inspector closed, while the same shortcut worked for a photo opened from the timeline. Evidence: artifacts/bash-files/photos/photos-inspector-place-timeout.png. This is in shared Quick Look code, outside this job's edit scope; filed for the shared UI owner.

Found and filed #1263 (major): opening a GPS-tagged photo via `/p/<id>` then pressing `i` leaves Quick Look's info inspector closed, while the same shortcut worked for a photo opened from the timeline. Evidence: `artifacts/bash-files/photos/photos-inspector-place-timeout.png`. This is in shared Quick Look code, outside this job's edit scope; filed for the shared UI owner.

kayg commented

2026-10-07 00:00:49 +00:00

Author

Owner

Fixed the #1253 Photos empty-state E2E collision on branch in commit 0f53cde29: the test scopes the centered CTA to the “No photos” region, checks the top-row action separately, and verifies pointer/keyboard opening plus picker cancellation. The existing Upload photos accessible-name behavior remains unchanged.

Fixed the #1253 Photos empty-state E2E collision on branch in commit `0f53cde29`: the test scopes the centered CTA to the “No photos” region, checks the top-row action separately, and verifies pointer/keyboard opening plus picker cancellation. The existing `Upload photos` accessible-name behavior remains unchanged.

kayg commented

2026-10-07 00:05:03 +00:00

Author

Owner

Found and filed #1265 (minor): the Files PDF Quick Look accessibility run loaded text for all 16 pages in a 16-page document while at the first page. The existing near-page loading assertion failed twice; the diagnostic run printed PDF text layers loaded: 16/16. Evidence: artifacts/bash-files/files/pdf-text-overfetch.png. This is in shared packages/ui PDF viewer code, so this job will not edit it.

Found and filed #1265 (minor): the Files PDF Quick Look accessibility run loaded text for all 16 pages in a 16-page document while at the first page. The existing near-page loading assertion failed twice; the diagnostic run printed `PDF text layers loaded: 16/16`. Evidence: `artifacts/bash-files/files/pdf-text-overfetch.png`. This is in shared `packages/ui` PDF viewer code, so this job will not edit it.

kayg commented

2026-10-07 00:05:18 +00:00

Author

Owner

Fixed the Quick Look test markup mismatch on branch in commit 44179feb8: apps/web/e2e/harness.mjs now exposes one accessible-heading locator, and Files/Photos E2E checks use it instead of .ql-title h2. Filename and whitespace expectations are unchanged. The Photos flow passed the first Quick Look title read and deep-link title read before surfacing separate issue #1263. Files' --pdf-a11y-only passed the new title lookup before reaching separate shared PDF issue #1265.

Fixed the Quick Look test markup mismatch on branch in commit `44179feb8`: `apps/web/e2e/harness.mjs` now exposes one accessible-heading locator, and Files/Photos E2E checks use it instead of `.ql-title h2`. Filename and whitespace expectations are unchanged. The Photos flow passed the first Quick Look title read and deep-link title read before surfacing separate issue #1263. Files' `--pdf-a11y-only` passed the new title lookup before reaching separate shared PDF issue #1265.

kayg commented

2026-10-07 00:32:41 +00:00

Author

Owner

Retested #1263 after merging origin/dev; the direct-link i shortcut failure remains. The production Photos flow passes the timeline Quick Look info shortcut, but after navigating to /p/<id> it does not open the inspector. Updated screenshot: artifacts/bash-files/photos/post-merge-inspector-shortcut-timeout.png.

Retested #1263 after merging `origin/dev`; the direct-link `i` shortcut failure remains. The production Photos flow passes the timeline Quick Look info shortcut, but after navigating to `/p/<id>` it does not open the inspector. Updated screenshot: `artifacts/bash-files/photos/post-merge-inspector-shortcut-timeout.png`.

kayg commented

2026-10-07 00:36:14 +00:00

Author

Owner

Retested #1252 after merging origin/dev; the Files test still stops before selection capture on thumbnail-cache-547.txt (application/pdf, has_thumbnail=true) while waiting for text-card. Existing expectation is unchanged. Evidence: artifacts/bash-files/files/files-thumbnail-fixture-postmerge.txt.

Retested #1252 after merging `origin/dev`; the Files test still stops before selection capture on `thumbnail-cache-547.txt` (`application/pdf`, `has_thumbnail=true`) while waiting for `text-card`. Existing expectation is unchanged. Evidence: `artifacts/bash-files/files/files-thumbnail-fixture-postmerge.txt`.

kayg commented

2026-10-07 00:38:21 +00:00

Author

Owner

Found and filed #1281 (minor): after the extensionless Photos checks, the legacy-index test fixture deletes Files migrations 26/27 and asserts max=25, but current source includes migration 0028. The restart test stops before exercising migration behavior. I left the existing fixture/assertions unchanged. Evidence: artifacts/bash-files/photos/photos-legacy-migration-fixture-postmerge.txt.

Found and filed #1281 (minor): after the extensionless Photos checks, the legacy-index test fixture deletes Files migrations 26/27 and asserts max=25, but current source includes migration 0028. The restart test stops before exercising migration behavior. I left the existing fixture/assertions unchanged. Evidence: `artifacts/bash-files/photos/photos-legacy-migration-fixture-postmerge.txt`.

kayg commented

2026-10-07 00:41:03 +00:00

Author

Owner

Retested #1265 after merging origin/dev; the PDF viewer still loads all 16/16 text layers at the first page, and the near-page assertion fails. Updated evidence: artifacts/bash-files/files/pdf-text-overfetch-postmerge.png. The test passed the new Quick Look accessible-heading lookup before failing.

Retested #1265 after merging `origin/dev`; the PDF viewer still loads all 16/16 text layers at the first page, and the near-page assertion fails. Updated evidence: `artifacts/bash-files/files/pdf-text-overfetch-postmerge.png`. The test passed the new Quick Look accessible-heading lookup before failing.

kayg commented

2026-10-07 00:46:11 +00:00

Author

Owner

Found and filed #1285 (minor): Photos screenshot-only E2E fails when it sets the theme because its context never installs the existing installUserStorageTestSeam helper. It stops at window.__userStorageTest.getItem; no production UI failure was observed. Evidence: artifacts/bash-files/photos/photos-screenshot-theme-seam-failure.txt. I will add the missing harness setup and rerun the screenshot path.

Found and filed #1285 (minor): Photos screenshot-only E2E fails when it sets the theme because its context never installs the existing `installUserStorageTestSeam` helper. It stops at `window.__userStorageTest.getItem`; no production UI failure was observed. Evidence: `artifacts/bash-files/photos/photos-screenshot-theme-seam-failure.txt`. I will add the missing harness setup and rerun the screenshot path.

kayg commented

2026-10-07 00:55:10 +00:00

Author

Owner

Fixed on branch in commit 0c61c0ed3: install installUserStorageTestSeam in desktop, tablet and phone contexts before theme evidence writes User-scoped preferences. A focused Playwright check passed the seam in all three contexts. The screenshot-only rerun advanced past the earlier missing-seam failure, then timed out in the extensionless Live Photo pairing poll under slow DB load; the same pairing check passed in an earlier run. Evidence of the original harness failure remains at artifacts/bash-files/photos/photos-screenshot-theme-seam-failure.txt.

Fixed on branch in commit `0c61c0ed3`: install `installUserStorageTestSeam` in desktop, tablet and phone contexts before theme evidence writes User-scoped preferences. A focused Playwright check passed the seam in all three contexts. The screenshot-only rerun advanced past the earlier missing-seam failure, then timed out in the extensionless Live Photo pairing poll under slow DB load; the same pairing check passed in an earlier run. Evidence of the original harness failure remains at `artifacts/bash-files/photos/photos-screenshot-theme-seam-failure.txt`.

kayg commented

2026-10-07 00:55:54 +00:00

Author

Owner

The #1252 thumbnail fixture also prevents --selection-only from reaching the Files selection matrix because its branch appears after that unrelated check. I am making the explicit selection-only path independent, keeping the default full E2E thumbnail assertion unchanged.

The #1252 thumbnail fixture also prevents `--selection-only` from reaching the Files selection matrix because its branch appears after that unrelated check. I am making the explicit selection-only path independent, keeping the default full E2E thumbnail assertion unchanged.

kayg referenced this issue from a commit

2026-10-07 01:03:01 +00:00

Document Files and Photos bug bash entry points (#1217)

kayg commented

2026-10-07 01:03:02 +00:00

Author

Owner

Finished

Branch: job/bash-files
Base used: origin/dev at 3601719b80a39f712daf07b37879b22929dfffa0; merged once as 7e14f71818a50b0cc2313b5218af34d7160ecfc2.
Head: 2c15229a4725d0f26a87482b9fa5d9cae8bfc893.

Findings

Issue	Symptom	Severity	Result
#1252	Files PDF thumbnail fixture asks for `text-card` although indexed MIME is PDF.	Minor	Filed only; kept existing expectation.
#1253	Photos empty-state upload assertion matches both the empty CTA and top-row action.	Minor	Fixed in `0f53cde29`; scope each action and verify pointer/Enter opens a cancellable picker.
#1255	AAE fixture used `hidden-proof.png.aae`, which is not paired with `hidden-proof.png`.	Minor	Fixed in `91b5fed63`; use `hidden-proof.aae`.
#1257	Files test asks for `Hidden files`; visible Settings heading is `Hidden Files`.	Minor	Filed only; kept existing expectation.
#1260	Files and Photos Quick Look checks wait for obsolete `.ql-title h2`.	Minor	Fixed in `44179feb8`; use the accessible level-two heading role.
#1263	`i` does not open the Photos info inspector after directly opening `/p/<id>`.	Major	Filed only; shared Quick Look UI is outside this job's ownership.
#1265	A 16-page PDF loads all 16 text layers at the first page.	Minor	Filed only; shared viewer is outside this job's ownership.
#1281	Photos legacy-index fixture expects migration 25 after removing rows 26/27, but current source also has migration 28.	Minor	Filed only; kept existing expectation.
#1285	Photos screenshot contexts do not install the existing User storage theme seam.	Minor	Fixed in `0c61c0ed3`; install it in desktop, tablet and phone contexts.

Checks and evidence

Post-merge gates ran before the final E2E-only updates. Verbatim result lines captured:

cargo fmt --check
(no output; exit 0)

bun run check
NOTE Bun skipped 1 lock package(s) not installed in this production environment
svelte-check found 0 errors and 1 warning in 1 file

bun run test
Test Files 287 passed (287)
Tests 2035 passed (2035)
Duration 391.78s

The one Svelte warning is an empty CSS rule in packages/ui/src/components/calendar/AttachmentDeck.svelte:1055. No Rust source changed, so per-crate clippy/test gates were not applicable. node --check passed for the three changed E2E modules; git diff --check passed. The production server build and web production build passed before cleanup. cargo clean removed 8660 files (7.9GiB), and apps/web/build was removed.

Focused real-server checks passed for Files upload/rename/Recent, the corrected hidden-sidecar preference flow and its 390/820/1440 light/dark screenshots, Photos empty-state upload by pointer and Enter, Quick Look accessible heading checks, and the theme-seam helper in desktop/tablet/phone contexts. Photos exercised 45 groups across 11 days before stopping at #1263. The screenshot-only Photos rerun passed the missing-seam point but later timed out pairing extensionless HEIC/MOV under slow database load; the same pairing had passed in an earlier run. Files thumbnail checks stop at #1252. These are recorded as evidence, not treated as new product findings.

Screenshots and text evidence are in ignored artifacts/bash-files/. The fj CLI exposes no issue attachment/upload command, so the files remain local and were not uploaded to Forgejo.

Performance

No performance numbers were captured. perf-run was unavailable in this environment, and no local timing profile was collected. No performance regression is claimed.

UX gaps closed / left

Closed: the Photos test now distinguishes the two intentionally same-named Upload actions and checks pointer and keyboard activation plus picker cancellation; Quick Look title checks use the accessible heading; theme evidence contexts install the existing User storage seam; the AAE fixture uses the paired filename.

Left: the major direct-deep-link i shortcut issue (#1263), PDF text overfetch (#1265), and stale test fixtures/expectations (#1252, #1257, #1281) remain open. The full area matrix did not finish: 2 GB uploads, 5k-file bursts, cancel/resume, broad file operations, 20k-photo scrolling, album/share/deep-link coverage, two-tab edits, and complete slow/offline/back-forward combinations were not completed. No product UI code changed.

Decisions and merge round

No product design decision changed. For tests, use Quick Look's accessible heading role, scope the two Upload buttons by their surfaces, and keep disputed existing expectations unchanged pending owner review. No new visible controls or shared primitives were added.

For the merge round, run on the combined branch:

cd apps/web && bun run check and cd apps/web && bun run test -- --maxWorkers=2 — prove web checks and the complete Vitest suite pass together.
cd apps/web && bun run test:e2e:files and cd apps/web && bun run test:e2e:photos — rerun complete Files/Photos flows after the listed fixture and product findings are resolved or triaged.
cd apps/web && bun run test:e2e -- --maxWorkers=2 — prove the app shell E2E flow on the combined branch.
bash tests/adversarial/run.sh — run the full XUser, authz and robustness matrices against a real local server.

## Finished Branch: `job/bash-files` Base used: `origin/dev` at `3601719b80a39f712daf07b37879b22929dfffa0`; merged once as `7e14f71818a50b0cc2313b5218af34d7160ecfc2`. Head: `2c15229a4725d0f26a87482b9fa5d9cae8bfc893`. ### Findings | Issue | Symptom | Severity | Result | |---|---|---:|---| | #1252 | Files PDF thumbnail fixture asks for `text-card` although indexed MIME is PDF. | Minor | Filed only; kept existing expectation. | | #1253 | Photos empty-state upload assertion matches both the empty CTA and top-row action. | Minor | Fixed in `0f53cde29`; scope each action and verify pointer/Enter opens a cancellable picker. | | #1255 | AAE fixture used `hidden-proof.png.aae`, which is not paired with `hidden-proof.png`. | Minor | Fixed in `91b5fed63`; use `hidden-proof.aae`. | | #1257 | Files test asks for `Hidden files`; visible Settings heading is `Hidden Files`. | Minor | Filed only; kept existing expectation. | | #1260 | Files and Photos Quick Look checks wait for obsolete `.ql-title h2`. | Minor | Fixed in `44179feb8`; use the accessible level-two heading role. | | #1263 | `i` does not open the Photos info inspector after directly opening `/p/<id>`. | Major | Filed only; shared Quick Look UI is outside this job's ownership. | | #1265 | A 16-page PDF loads all 16 text layers at the first page. | Minor | Filed only; shared viewer is outside this job's ownership. | | #1281 | Photos legacy-index fixture expects migration 25 after removing rows 26/27, but current source also has migration 28. | Minor | Filed only; kept existing expectation. | | #1285 | Photos screenshot contexts do not install the existing User storage theme seam. | Minor | Fixed in `0c61c0ed3`; install it in desktop, tablet and phone contexts. | ### Checks and evidence Post-merge gates ran before the final E2E-only updates. Verbatim result lines captured: ```text cargo fmt --check (no output; exit 0) bun run check NOTE Bun skipped 1 lock package(s) not installed in this production environment svelte-check found 0 errors and 1 warning in 1 file bun run test Test Files 287 passed (287) Tests 2035 passed (2035) Duration 391.78s ``` The one Svelte warning is an empty CSS rule in `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. No Rust source changed, so per-crate clippy/test gates were not applicable. `node --check` passed for the three changed E2E modules; `git diff --check` passed. The production server build and web production build passed before cleanup. `cargo clean` removed 8660 files (7.9GiB), and `apps/web/build` was removed. Focused real-server checks passed for Files upload/rename/Recent, the corrected hidden-sidecar preference flow and its 390/820/1440 light/dark screenshots, Photos empty-state upload by pointer and Enter, Quick Look accessible heading checks, and the theme-seam helper in desktop/tablet/phone contexts. Photos exercised 45 groups across 11 days before stopping at #1263. The screenshot-only Photos rerun passed the missing-seam point but later timed out pairing extensionless HEIC/MOV under slow database load; the same pairing had passed in an earlier run. Files thumbnail checks stop at #1252. These are recorded as evidence, not treated as new product findings. Screenshots and text evidence are in ignored `artifacts/bash-files/`. The `fj` CLI exposes no issue attachment/upload command, so the files remain local and were not uploaded to Forgejo. ### Performance No performance numbers were captured. `perf-run` was unavailable in this environment, and no local timing profile was collected. No performance regression is claimed. ### UX gaps closed / left Closed: the Photos test now distinguishes the two intentionally same-named Upload actions and checks pointer and keyboard activation plus picker cancellation; Quick Look title checks use the accessible heading; theme evidence contexts install the existing User storage seam; the AAE fixture uses the paired filename. Left: the major direct-deep-link `i` shortcut issue (#1263), PDF text overfetch (#1265), and stale test fixtures/expectations (#1252, #1257, #1281) remain open. The full area matrix did not finish: 2 GB uploads, 5k-file bursts, cancel/resume, broad file operations, 20k-photo scrolling, album/share/deep-link coverage, two-tab edits, and complete slow/offline/back-forward combinations were not completed. No product UI code changed. ### Decisions and merge round No product design decision changed. For tests, use Quick Look's accessible heading role, scope the two Upload buttons by their surfaces, and keep disputed existing expectations unchanged pending owner review. No new visible controls or shared primitives were added. For the merge round, run on the combined branch: - `cd apps/web && bun run check` and `cd apps/web && bun run test -- --maxWorkers=2` — prove web checks and the complete Vitest suite pass together. - `cd apps/web && bun run test:e2e:files` and `cd apps/web && bun run test:e2e:photos` — rerun complete Files/Photos flows after the listed fixture and product findings are resolved or triaged. - `cd apps/web && bun run test:e2e -- --maxWorkers=2` — prove the app shell E2E flow on the combined branch. - `bash tests/adversarial/run.sh` — run the full XUser, authz and robustness matrices against a real local server.

kayg commented

2026-10-07 10:24:24 +00:00

Author

Owner

Round 2 started on job/bash-files after merging origin/dev. Fetched base SHA: pending exact confirmation from the merge parent. I am tracing #1263 and #1265 first, then will cover the listed Files and Photos flows against a local production build. No product flows were tested in round 1.

kayg commented

2026-10-07 10:24:47 +00:00

Author

Owner

Correction: the fetched origin/dev base SHA is 0419170fe4 (the second parent of the merge commit).

Correction: the fetched origin/dev base SHA is 0419170fe456b58614befcb12d9c9d255118f1c0 (the second parent of the merge commit).

kayg commented

2026-10-07 11:05:02 +00:00

Author

Owner

Round 2 production findings now reproduced:

#1263: cold Photos direct link /p/<item-id> does not open the Inspector after i; evidence is artifacts/bash-files/photos/inspector-direct-link-before.png. See #1263 for command and failure details.
#1265: opening the 16-page PDF loads all 16 text layers at page one; evidence is artifacts/bash-files/files/pdf-text-overfetch.png. See #1265 for command and assertion details.

Both fixes and regression tests are in progress on this branch.

Round 2 production findings now reproduced: - #1263: cold Photos direct link `/p/<item-id>` does not open the Inspector after `i`; evidence is `artifacts/bash-files/photos/inspector-direct-link-before.png`. See #1263 for command and failure details. - #1265: opening the 16-page PDF loads all 16 text layers at page one; evidence is `artifacts/bash-files/files/pdf-text-overfetch.png`. See #1265 for command and assertion details. Both fixes and regression tests are in progress on this branch.

kayg commented

2026-10-07 11:53:08 +00:00

Author

Owner

Round 2 fixes committed:

#1263 fixed in 0d991f6f3f057c1b481874ca6c84e432b7d9d5c5: cold Photos direct links focus Quick Look so i opens the Inspector. Production regression passed through the EXIF/GPS/Camera checks. The later existing tag-save toast expectation does not match the product's explicit toast({ policy: 'drop' }); I preserved the expectation and did not change that behavior.
#1265 fixed in 43692647c8d17c559a49d478a59134ddd72fbef5: PDF pages no longer overlap, canvas pre-rendering stays near the viewport, and text/structure/links load only for visible pages. The 16-page production regression, scroll-to-page-16, PDF link, image-only state, and 390/820/1440 light/dark screenshots passed.

Full #1217 flow coverage is still in progress.

Round 2 fixes committed: - #1263 fixed in `0d991f6f3f057c1b481874ca6c84e432b7d9d5c5`: cold Photos direct links focus Quick Look so `i` opens the Inspector. Production regression passed through the EXIF/GPS/Camera checks. The later existing tag-save toast expectation does not match the product's explicit `toast({ policy: 'drop' })`; I preserved the expectation and did not change that behavior. - #1265 fixed in `43692647c8d17c559a49d478a59134ddd72fbef5`: PDF pages no longer overlap, canvas pre-rendering stays near the viewport, and text/structure/links load only for visible pages. The 16-page production regression, scroll-to-page-16, PDF link, image-only state, and 390/820/1440 light/dark screenshots passed. Full #1217 flow coverage is still in progress.

kayg commented

2026-10-07 12:11:58 +00:00

Author

Owner

#1263 now has a production matrix commit, 400e3dfbfa1443b442c38a2b86cf816d75e54404. The cold direct-link Inspector passed at 390, 820 and 1440 px in light and dark with Mac emulation; screenshots are under artifacts/bash-files/photos/.

The focused #1265 production test and six 1x screenshots passed in 43692647c8d17c559a49d478a59134ddd72fbef5.

The full existing bun e2e/files.mjs --screenshots ... run stopped before the main Files interaction flow. Its existing #547 fixture times out waiting for text-card thumbnail for a .txt file whose bytes and indexed MIME are PDF (application/pdf); the file entry reports has_thumbnail: true. I did not change this expectation. I will continue the requested Files flows with separate real-server UI probes.

The full existing Photos run passed the direct-link Inspector, then stopped at the tag success-toast expectation. PhotosView.svelte calls toast({ policy: 'drop' }), which intentionally suppresses the toast. That expectation remains unchanged.

#1263 now has a production matrix commit, `400e3dfbfa1443b442c38a2b86cf816d75e54404`. The cold direct-link Inspector passed at 390, 820 and 1440 px in light and dark with Mac emulation; screenshots are under `artifacts/bash-files/photos/`. The focused #1265 production test and six 1x screenshots passed in `43692647c8d17c559a49d478a59134ddd72fbef5`. The full existing `bun e2e/files.mjs --screenshots ...` run stopped before the main Files interaction flow. Its existing #547 fixture times out waiting for `text-card` thumbnail for a `.txt` file whose bytes and indexed MIME are PDF (`application/pdf`); the file entry reports `has_thumbnail: true`. I did not change this expectation. I will continue the requested Files flows with separate real-server UI probes. The full existing Photos run passed the direct-link Inspector, then stopped at the tag success-toast expectation. `PhotosView.svelte` calls `toast({ policy: 'drop' })`, which intentionally suppresses the toast. That expectation remains unchanged.

kayg commented

2026-10-07 12:43:29 +00:00

Author

Owner

Files keyboard Inspector check: a focused real-server probe confirms Meta+I opens the Inspector for the selected file. The dialog's accessible name is the file name (probe.txt), and its close button is Close probe.txt. The full Files E2E stops because it still expects dialog name Info and button Close Info; the product presents the selected item name under DESIGN §34. I left the existing expectation unchanged. I will continue the Files flow with the temporary probe asserting the visible .inspector-surface and the current item-specific close name.

Files keyboard Inspector check: a focused real-server probe confirms Meta+I opens the Inspector for the selected file. The dialog's accessible name is the file name (`probe.txt`), and its close button is `Close probe.txt`. The full Files E2E stops because it still expects dialog name `Info` and button `Close Info`; the product presents the selected item name under DESIGN §34. I left the existing expectation unchanged. I will continue the Files flow with the temporary probe asserting the visible `.inspector-surface` and the current item-specific close name.

kayg commented

2026-10-07 13:09:10 +00:00

Author

Owner

New product finding filed as #1355 (major): Quick Look opened by a file double-click remains visible after Escape. Focus returns to the Files listbox, but the Quick Look: escape.txt dialog and .ql surface remain; the close button still works. Evidence and reproduction are in artifacts/bash-files/files/quicklook-escape-repro.txt. A full production Files run also timed out after 30 seconds waiting for the surface to detach. I am fixing this in the shared Quick Look owner area and will add a regression check.

New product finding filed as #1355 (major): Quick Look opened by a file double-click remains visible after Escape. Focus returns to the Files listbox, but the `Quick Look: escape.txt` dialog and `.ql` surface remain; the close button still works. Evidence and reproduction are in `artifacts/bash-files/files/quicklook-escape-repro.txt`. A full production Files run also timed out after 30 seconds waiting for the surface to detach. I am fixing this in the shared Quick Look owner area and will add a regression check.

kayg commented

2026-10-07 13:54:07 +00:00

Author

Owner

Round 2 finding: #1357, Photos: ArrowRight can be lost when Quick Look opens (major). The production Photos E2E opened the first item in a 45-item timeline, pressed ArrowRight, and stayed on the same title and 1 of 45 counter for 60 seconds. Evidence: artifacts/bash-files/photos/photos-arrow-navigation-actual.png. The initial E2E run bypassed only the stale toast wait for IMG_1003.JPG now has #paris #trip/lisbon-2026; it did not change any product assertion. I am checking focus timing and will fix this viewer issue if the reproduction holds.

Round 2 finding: #1357, **Photos: ArrowRight can be lost when Quick Look opens** (major). The production Photos E2E opened the first item in a 45-item timeline, pressed ArrowRight, and stayed on the same title and `1 of 45` counter for 60 seconds. Evidence: `artifacts/bash-files/photos/photos-arrow-navigation-actual.png`. The initial E2E run bypassed only the stale toast wait for `IMG_1003.JPG now has #paris #trip/lisbon-2026`; it did not change any product assertion. I am checking focus timing and will fix this viewer issue if the reproduction holds.

kayg commented

2026-10-07 14:14:43 +00:00

Author

Owner

Round 2 findings:

#1357 (major): ArrowRight did not advance Quick Look in the unmodified Photos test run after the production build. A diagnostic run passed only after an added DOM-focus read allowed the initial focus handoff to settle. The attempted window fallback did not make the immediate-key run pass, so I am leaving #1357 filed only rather than committing an ineffective change.
#1370 (major): after adding #paris and trip/lisbon 2026 in the Photos Tags editor, the item API returned an empty tags array immediately after Save. Evidence: artifacts/bash-files/photos/photos-tags-not-persisted-actual.png.

The stale toast assertion was skipped only in temporary test copies. No product or test expectation was changed.

Round 2 findings: - #1357 (major): ArrowRight did not advance Quick Look in the unmodified Photos test run after the production build. A diagnostic run passed only after an added DOM-focus read allowed the initial focus handoff to settle. The attempted window fallback did not make the immediate-key run pass, so I am leaving #1357 filed only rather than committing an ineffective change. - #1370 (major): after adding `#paris` and `trip/lisbon 2026` in the Photos Tags editor, the item API returned an empty `tags` array immediately after Save. Evidence: `artifacts/bash-files/photos/photos-tags-not-persisted-actual.png`. The stale toast assertion was skipped only in temporary test copies. No product or test expectation was changed.

kayg commented

2026-10-07 14:20:18 +00:00

Author

Owner

Round 2 complete. Branch: job/bash-files. Base merge: 5a5923b88cd6a43e52d59df03d4576cd1ed94383 (origin/dev). Head: f64aeef85130a0913801a6d6fcd9f9afaffadc37.

Bugs

Issue	Symptom	Severity	Status
#1263	`i` did not open the Inspector from a cold photo deep link	major	Fixed: `0d991f6f`, matrix test `400e3df`
#1265	PDF Quick Look rendered all 16 text layers at page one	major	Fixed: `4369264`; exact live perf pins refreshed without count/limit changes in `402c943`
#1355	Escape did not close file Quick Look opened by double-click	major	Fixed: `704af29`; 390/820/1440 light/dark/reduced-motion regression matrix in `f64aeef`
#1357	ArrowRight can be lost while Photos Quick Look opens	major	Filed only; an immediate-key production run still failed. A diagnostic passed after focus settled, so no ineffective fix was committed.
#1370	Photo tag Save was followed by an empty `tags` array from the item API	major	Filed only; no product change in this branch

The Files/Photos source commits use the existing shared Quick Look controls and OverlaySurface; I added no visible control or local styling.

Coverage

Flow	Tested	Widths/themes/input	Findings or limits
1. Upload	Partial	One small API-uploaded text file for Quick Look; Escape tested at 390/820/1440, light/dark, macOS emulation, reduced motion	Drag, picker, 300-file folder, sparse 2 GB, 5,000-file burst, cancel, reload/resume and duplicate-name cases were not run. The full Files run first stopped at the existing #547 thumbnail fixture mismatch.
2. Rename/move/copy/delete/trash/restore/undo, 1,000-child folders, Unicode names	Partial	Temporary Files E2E clone: pointer drag, keyboard reorder, pin persistence/unpin, breadcrumb link/drop; desktop	Those pin and breadcrumb checks passed. The full mutation matrix, 255-byte and Unicode names, large folders, undo and trash cases were not reached. No existing expectation was changed in the repo.
3. Extensionless and odd files	No	—	Zero/huge/binary files and WebDAV symlinks were not tested.
4. Photos grid/media/albums/links	Partial	Direct photo deep-link Inspector: 390/820/1440, light/dark, macOS, keyboard `i`; PDF: 390/820/1440, light/dark, keyboard, accessible tree and visible-page loading	The 20k local indexing run reached 1,952/20,000 after about 18 minutes under load; it did not reach grid scroll or frame/memory measurements. Albums remain unbuilt under open issue #592. HEIC/EXIF orientation, video seek, burst controls and album links were not completed. #1357 and #1370 are filed.
5. Sharing	No	—	File/folder User shares, password/expiry/revoke and the `hide_filenames` UI were not exercised.
6. WebDAV/rclone	No	—	`rclone` v1.75.1 was available, but no consistency run was completed.
7. Deep links, tabs, offline, keyboard, accessible names, phone touch	Partial	Photo deep-link `i` matrix and PDF keyboard/screen-reader assertions; Quick Look Escape matrix at 390/820/1440	Two-tab edits, offline/online, item Copy link coverage, screen-reader app checks and 390 px touch interactions were not completed. The Escape matrix used a macOS platform emulation.

Performance

The local 20k Photos setup indexed 1,952 items in about 18 minutes while host load average was about 35. This is an incomplete run: there is no 20k scroll p95, input latency or five-minute memory result. For context, docs/perf/baseline.json records the 5k photo-thumbnail workload at 63,230 ms to index, 63.05% mean CPU, 360,533,602-byte mean RSS and 495,759,360-byte peak RSS. This is not a like-for-like comparison. The perf VM was occupied by another job, so no VM measurement was made.

Gates (verbatim output)

cargo fmt --check: exit 0, no stdout.

bun run check:

perf-lint: PASS; 0 violations; 22544 scoped exceptions
User browser caches use userStorage; only documented device/public-link exceptions remain.
Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css.
Text sizes and UI shape values use shared role tokens.
Keyboard focus rings use the shared focus tokens.
UI transitions and animation options use shared motion tokens or documented exceptions.
Loading svelte-check in workspace: /home/kayg/Developer/calternal-wt/bash-files/apps/web
Getting Svelte diagnostics...
Warn: Do not use empty rulesets (css)
svelte-check found 0 errors and 1 warning in 1 file

The warning is the existing empty .attachment-row:focus ruleset in packages/ui/src/components/calendar/AttachmentDeck.svelte:1055.

Production build completed; final build line: Compressed 917 static variants; saved 21488574 bytes. cargo clean completed: Removed 8650 files, 7.3GiB total.

Focused production checks:

PASS PDF Quick Look text, link, lazy-loading and image-only accessibility
CSP REPORTS files: 0 across 2 pages
PASS Photos direct-link Inspector matrix
CSP REPORTS photos: 0 across 3 pages
PASS Escape closes file Quick Look across Mac 390/820/1440 light/dark and reduced motion (#1355)
CSP REPORTS files: 0 across 1 pages

bun run test was not run; the owner verification policy reserves the full Vitest suite for the merge round. No Rust crate source changed, so Rust clippy/test gates were not applicable.

Screenshot attachments

Direct photo Inspector, macOS, light/dark: 390 light, 390 dark, 820 light, 820 dark, 1440 light, 1440 dark.

PDF Quick Look, light/dark: 390 light, 390 dark, 820 light, 820 dark, 1440 light, 1440 dark.

Failure evidence: Photos ArrowRight, Photos tags API.

Decisions and gaps

DESIGN §28 does not spell out Escape during focus handoff. Quick Look handles Escape from its subtree and uses the window fallback only while focus remains outside; a nested modal or editable/media control keeps key ownership.
DESIGN §32/#1265 did not specify the observer threshold for PDF text. The implementation renders text, structure and links only for visible pages; canvas rendering remains near the viewport.
Albums were not implemented because #592 is still an open owner decision. Other untested rows above are gaps from the four-hour time box, not passes.

For the merge round, run cd apps/web && bun run test to verify the full Vitest suite, then resume the Files/Photos integration matrix after resolving the #547 fixture mismatch and #1370 tag-write finding. bun e2e/files.mjs and bun e2e/photos.mjs must complete without changing their existing product assertions.

Round 2 complete. Branch: `job/bash-files`. Base merge: `5a5923b88cd6a43e52d59df03d4576cd1ed94383` (`origin/dev`). Head: `f64aeef85130a0913801a6d6fcd9f9afaffadc37`. ## Bugs | Issue | Symptom | Severity | Status | |---|---|---:|---| | #1263 | `i` did not open the Inspector from a cold photo deep link | major | Fixed: `0d991f6f`, matrix test `400e3df` | | #1265 | PDF Quick Look rendered all 16 text layers at page one | major | Fixed: `4369264`; exact live perf pins refreshed without count/limit changes in `402c943` | | #1355 | Escape did not close file Quick Look opened by double-click | major | Fixed: `704af29`; 390/820/1440 light/dark/reduced-motion regression matrix in `f64aeef` | | #1357 | ArrowRight can be lost while Photos Quick Look opens | major | Filed only; an immediate-key production run still failed. A diagnostic passed after focus settled, so no ineffective fix was committed. | | #1370 | Photo tag Save was followed by an empty `tags` array from the item API | major | Filed only; no product change in this branch | The Files/Photos source commits use the existing shared Quick Look controls and `OverlaySurface`; I added no visible control or local styling. ## Coverage | Flow | Tested | Widths/themes/input | Findings or limits | |---|---|---|---| | 1. Upload | Partial | One small API-uploaded text file for Quick Look; Escape tested at 390/820/1440, light/dark, macOS emulation, reduced motion | Drag, picker, 300-file folder, sparse 2 GB, 5,000-file burst, cancel, reload/resume and duplicate-name cases were not run. The full Files run first stopped at the existing #547 thumbnail fixture mismatch. | | 2. Rename/move/copy/delete/trash/restore/undo, 1,000-child folders, Unicode names | Partial | Temporary Files E2E clone: pointer drag, keyboard reorder, pin persistence/unpin, breadcrumb link/drop; desktop | Those pin and breadcrumb checks passed. The full mutation matrix, 255-byte and Unicode names, large folders, undo and trash cases were not reached. No existing expectation was changed in the repo. | | 3. Extensionless and odd files | No | — | Zero/huge/binary files and WebDAV symlinks were not tested. | | 4. Photos grid/media/albums/links | Partial | Direct photo deep-link Inspector: 390/820/1440, light/dark, macOS, keyboard `i`; PDF: 390/820/1440, light/dark, keyboard, accessible tree and visible-page loading | The 20k local indexing run reached 1,952/20,000 after about 18 minutes under load; it did not reach grid scroll or frame/memory measurements. Albums remain unbuilt under open issue #592. HEIC/EXIF orientation, video seek, burst controls and album links were not completed. #1357 and #1370 are filed. | | 5. Sharing | No | — | File/folder User shares, password/expiry/revoke and the `hide_filenames` UI were not exercised. | | 6. WebDAV/rclone | No | — | `rclone` v1.75.1 was available, but no consistency run was completed. | | 7. Deep links, tabs, offline, keyboard, accessible names, phone touch | Partial | Photo deep-link `i` matrix and PDF keyboard/screen-reader assertions; Quick Look Escape matrix at 390/820/1440 | Two-tab edits, offline/online, item Copy link coverage, screen-reader app checks and 390 px touch interactions were not completed. The Escape matrix used a macOS platform emulation. | ## Performance The local 20k Photos setup indexed 1,952 items in about 18 minutes while host load average was about 35. This is an incomplete run: there is no 20k scroll p95, input latency or five-minute memory result. For context, `docs/perf/baseline.json` records the 5k photo-thumbnail workload at 63,230 ms to index, 63.05% mean CPU, 360,533,602-byte mean RSS and 495,759,360-byte peak RSS. This is not a like-for-like comparison. The perf VM was occupied by another job, so no VM measurement was made. ## Gates (verbatim output) `cargo fmt --check`: exit 0, no stdout. `bun run check`: ```text perf-lint: PASS; 0 violations; 22544 scoped exceptions User browser caches use userStorage; only documented device/public-link exceptions remain. Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css. Text sizes and UI shape values use shared role tokens. Keyboard focus rings use the shared focus tokens. UI transitions and animation options use shared motion tokens or documented exceptions. Loading svelte-check in workspace: /home/kayg/Developer/calternal-wt/bash-files/apps/web Getting Svelte diagnostics... Warn: Do not use empty rulesets (css) svelte-check found 0 errors and 1 warning in 1 file ``` The warning is the existing empty `.attachment-row:focus` ruleset in `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. Production build completed; final build line: `Compressed 917 static variants; saved 21488574 bytes.` `cargo clean` completed: `Removed 8650 files, 7.3GiB total`. Focused production checks: ```text PASS PDF Quick Look text, link, lazy-loading and image-only accessibility CSP REPORTS files: 0 across 2 pages PASS Photos direct-link Inspector matrix CSP REPORTS photos: 0 across 3 pages PASS Escape closes file Quick Look across Mac 390/820/1440 light/dark and reduced motion (#1355) CSP REPORTS files: 0 across 1 pages ``` `bun run test` was not run; the owner verification policy reserves the full Vitest suite for the merge round. No Rust crate source changed, so Rust clippy/test gates were not applicable. ## Screenshot attachments Direct photo Inspector, macOS, light/dark: [390 light](https://git.kayg.org/attachments/c6ef4a6c-bea9-492f-9b03-d9c32281a9c6), [390 dark](https://git.kayg.org/attachments/6195d980-811c-42e5-8a1f-a18defd8971d), [820 light](https://git.kayg.org/attachments/fb44c170-edb6-4e1a-9070-e1a23f4e7b5a), [820 dark](https://git.kayg.org/attachments/ec0a5894-6cc3-47ce-81a5-bd04e5d918e9), [1440 light](https://git.kayg.org/attachments/386c6985-e712-4600-87b1-41dc8ea23e2f), [1440 dark](https://git.kayg.org/attachments/f4f3014c-41e4-4ded-b189-ff711ecd8342). PDF Quick Look, light/dark: [390 light](https://git.kayg.org/attachments/55306190-76cc-430c-a89f-b7cd1bb28fd8), [390 dark](https://git.kayg.org/attachments/08aef2e1-9fba-4f82-9db0-07a9cc3bd6d4), [820 light](https://git.kayg.org/attachments/01643e3f-4319-445e-af57-f9a96a46678c), [820 dark](https://git.kayg.org/attachments/bb714c10-c63c-4ca6-b98a-f8430bb0e37f), [1440 light](https://git.kayg.org/attachments/402d1df2-3383-4bd7-bf6f-04f123d8c429), [1440 dark](https://git.kayg.org/attachments/91a42609-a331-44a9-b3f1-ac86e6a14e77). Failure evidence: [Photos ArrowRight](https://git.kayg.org/attachments/2311c303-5324-4ac7-8183-d0f07fce87b1), [Photos tags API](https://git.kayg.org/attachments/86e1e871-5beb-402d-8e49-1a687a06c6ab). ## Decisions and gaps - DESIGN §28 does not spell out Escape during focus handoff. Quick Look handles Escape from its subtree and uses the window fallback only while focus remains outside; a nested modal or editable/media control keeps key ownership. - DESIGN §32/#1265 did not specify the observer threshold for PDF text. The implementation renders text, structure and links only for visible pages; canvas rendering remains near the viewport. - Albums were not implemented because #592 is still an open owner decision. Other untested rows above are gaps from the four-hour time box, not passes. For the merge round, run `cd apps/web && bun run test` to verify the full Vitest suite, then resume the Files/Photos integration matrix after resolving the #547 fixture mismatch and #1370 tag-write finding. `bun e2e/files.mjs` and `bun e2e/photos.mjs` must complete without changing their existing product assertions.

kayg commented

2026-10-07 14:21:43 +00:00

Author

Owner

Correction to the failure evidence link in the report above: the Photos tags API screenshot is https://git.kayg.org/attachments/86e1c871-5beb-402d-8e49-1a687a06c6ab (the prior link had 86e1e871).

Correction to the failure evidence link in the report above: the Photos tags API screenshot is https://git.kayg.org/attachments/86e1c871-5beb-402d-8e49-1a687a06c6ab (the prior link had `86e1e871`).

Rows
Columns

Bug bash: files #1217

Finished

Findings

Checks and evidence

Performance

UX gaps closed / left

Decisions and merge round

Bugs

Coverage

Performance

Gates (verbatim output)

Screenshot attachments

Decisions and gaps