kayg/calternal-v0

Archived

Watch

Fork 0

Bug bash round 3: settings #1399

Open

opened 2026-10-07 19:01:35 +00:00 by kayg · 4 comments

kayg commented

2026-10-07 19:01:35 +00:00

Owner

AREA: Settings and Admin. Every Settings section and Admin page: account, appearance, Connected Accounts, Apps (app passwords), notifications, plugins on/off, users and invites, quotas, backups, licence, update flow, search inside Settings, deep links to every section, sign-in/sign-out/passkey flows (including the Safari "Create your passkey"-only prompt seen on the Mac VM; find whether password sign-in is reachable there).

Tracking issue for the 2026-10-08 night bug bash round 3. Every bug found gets its own issue, linked here.

kayg commented

2026-10-08 03:27:24 +00:00

Author

Owner

Started bug bash round 3 on branch job/bash3-settings.
Starting HEAD/base SHA: 0419170fe456b58614befcb12d9c9d255118f1c0.

Started bug bash round 3 on branch `job/bash3-settings`. Starting HEAD/base SHA: `0419170fe456b58614befcb12d9c9d255118f1c0`.

kayg commented

2026-10-08 04:50:33 +00:00

Author

Owner

Found one new minor Settings bug and filed it as #1442: changing the Colour scheme to Dark in one Appearance tab leaves a second open tab in System mode after 1.5 seconds. The second tab remains light and reports Dark as unselected. Evidence: artifacts/bash3-settings/cross-tab/appearance-source-dark.png and artifacts/bash3-settings/cross-tab/appearance-stale-tab.png. No product code has been changed yet.

Found one new minor Settings bug and filed it as #1442: changing the Colour scheme to Dark in one Appearance tab leaves a second open tab in System mode after 1.5 seconds. The second tab remains light and reports Dark as unselected. Evidence: `artifacts/bash3-settings/cross-tab/appearance-source-dark.png` and `artifacts/bash3-settings/cross-tab/appearance-stale-tab.png`. No product code has been changed yet.

kayg commented

2026-10-08 05:50:56 +00:00

Author

Owner

bash3-settings round 3 — complete

Branch: job/bash3-settings
Base after the one origin/dev merge: d395b6e25da20d8c67b8b9fc1a593b813939c8a7
Head: 6a616002d4513c7c1979d718a8f6c5cdf09606bb

Built

Fixed #1442. The Settings store listens for a storage event on the exact active User settings key, checks that the active User still matches the server-provided User hint, and applies the stored value without echoing a write. This keeps another open Tab current without a request. It reads and parses one small settings value per matching event.

Files: apps/web/src/lib/stores/settings-store.ts, apps/web/src/lib/stores/settings-store.test.ts, apps/web/e2e/settings-appearance-cross-tab.mjs.

Findings

Issue	Symptom	Severity	Result
#1442	Colour scheme stayed stale in another open Tab for the same User.	Minor	Fixed in `6a616002d`. The new e2e failed when the listener was removed and passed with the fix.

Known findings from earlier rounds were not re-filed: #1392 Settings selection latency; #1404 missing Admin Users delete action (major); #1416 bottom Settings sidebar Copy link is blocked (minor); #1145 signed licence-key fixture unavailable; #1194 Notifications Undo behavior; #1276 stale open-signup toast expectation; #1296 Connected Accounts review selector.

Coverage

Flow	Coverage	Width, theme and input methods	Bugs or limits
Account	Partial: route and deep-link inventory; account/auth surfaces inspected.	390, 820 and 1440 px; Light and Dark route captures; pointer and keyboard navigation.	Not every Account edit was exercised.
Appearance	Yes: Light/Dark choice, server confirmation, reload persistence, and two-Tab propagation.	390, 820 and 1440 px; Light and Dark; real pointer and keyboard interactions; macOS platform emulation.	#1442 fixed. Six actual-size captures are in `artifacts/bash3-settings/cross-tab-after/`.
Connected Accounts	Partial: Other provider dialog opened; invalid input returned the expected 424; Escape closed it.	One desktop/default-theme interaction; pointer and Escape.	Successful provider authorization needs credentials and was not tested. Existing #1296 is a stale review selector.
Apps / app passwords	Partial: created Sync and AI Assistant credentials and confirmed the one-time reveal.	One local UI session; pointer.	Revocation was not exercised; no secret was printed or retained in the report.
Notifications	Partial: quiet hours persisted; this-device push subscription created and deleted through the real service worker/API.	One local browser session; UI and API.	Existing #1194 affected the older Undo assertion.
Plugins	Yes: toggled User and Instance Money settings, confirmed API state and reload, then restored original values.	One local session; pointer.	No new issue.
Users and invites	Partial: created an invite, accepted one in the auth flow, revoked an invite, and exercised user creation.	Local real-server sessions; pointer and keyboard where the flow exposed Undo.	User deletion was not retested; existing major #1404 remains.
Quotas	Yes: set a User quota to 1.5 GB and restored it with Undo; created a 1.25 GB invite quota and confirmed it through the API.	One local Admin session; pointer.	No new issue.
Backups	Partial: Back up now created a real local backup; File Integrity frequency changed to Daily and survived reload.	One local session; pointer.	Restore was not tested.
Licence	Partial: free policy and six-active-User limit exercised at the page boundary.	390, 820 and 1440 px; Light and Dark.	Signed-key flow was unavailable because the shared server has no test signing key; existing #1145.
Update flow	Partial: exchanged old/current web builds, replayed old Log/Event requests, and verified long-pull reload; 18 review captures.	Local real server; screenshots cover the review states.	The existing e2e stopped on a stale “Refreshed” toast assertion; the actual update flow was checked separately.
Search in Settings	Yes: Cmd+K search for “First day of week” opened the matching setting.	Keyboard shortcut; one interactive session.	No new issue.
Deep links to Settings/Admin sections	Partial: 32 live sections and 26 legacy redirects restored the requested route.	390, 820 and 1440 px; Light and Dark route captures; direct URL and keyboard navigation.	Every Copy link action was not rechecked; known #1416 still blocks the bottom sidebar action.
Sign-in, sign-out and passkeys	Partial: setup, add/rename passkey, recovery-key regeneration, nameless-passkey sign-in, invite create/accept, sign-out, and protected deep-link redirect were exercised.	390, 820 and 1440 px; Light and Dark captures; keyboard/pointer; macOS platform emulation.	Existing #1276 is a stale toast assertion.
Safari passkey prompt and password reachability	No real Safari prompt check. The Mac VM reported “No main display detected” and exposed a blank WebArea. Source inspection found passkey, SSO and recovery-key sign-in choices, with no password field; password sign-in is not reachable in the current UI.	Actual Safari/macOS VM unavailable for usable interaction evidence.	No product change made.

Performance

Local Appearance exercise, shared host: one cold data_ready sample was 1964 ms. The route baseline is p50 1584 ms / p95 2069 ms, so this sample is within p95 and is not a statistically comparable A/B. First ten theme-change confirmations took 597–1446 ms; the next 18 took 220–748 ms. Over a five-minute exercise, heap was 8.2 MB at start and 11.0 MB at end; 38 long tasks were observed, with a 492 ms maximum. Event duration p95 was 1064 ms, maximum 1192 ms. The existing perf finding #1392 covers slow Settings selection paths.

UX gaps closed

Another open Tab now applies the same User's Appearance setting immediately from its storage event, without an echo write or network request.
The regression test exercises pointer changes in a real two-Tab production build and captures Light and Dark at all three widths.

UX gaps left

#1404 Admin Users delete action and #1416 bottom sidebar Copy link remain open.
Connected Account success authorization, app-password revocation, backup restore, signed licence-key entry and the Safari-specific passkey prompt were not verified.
Password sign-in is not reachable from the current sign-in page.

Decisions

DESIGN §§21 and 35 define User-scoped storage isolation. I used the existing storage event and exact User-scoped key, then refreshed the initialized store without persisting again. No new UI or design decision was needed.

Gates

bun run check passed. Verbatim output excerpts:

perf-lint: PASS; 0 violations; 22544 scoped exceptions
User browser caches use userStorage; only documented device/public-link exceptions remain.
Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css.
Text sizes and UI shape values use shared role tokens.
Keyboard focus rings use the shared focus tokens.
UI transitions and animation options use shared motion tokens or documented exceptions.
====================================
svelte-check found 0 errors and 4 warnings in 2 files

The four Svelte warnings are unused CSS selectors in MailView and the Money route. The full bun run test passed on the merged base before the final Settings fix:

Test Files  297 passed (297)
Tests  2116 passed (2116)
Start at  06:30:44
Duration  554.31s (environment 28%, import 26%, transform 24%, tests 16%, setup 5%)

Post-fix focused checks:

Test Files  1 passed (1)
Tests  14 passed (14)
Start at  07:38:31
Duration  11.11s (transform 91%, import 9%)
PASS Appearance cross-tab 390px Dark
PASS Appearance cross-tab 390px Light
PASS Appearance cross-tab 820px Dark
PASS Appearance cross-tab 820px Light
PASS Appearance cross-tab 1440px Dark
PASS Appearance cross-tab 1440px Light

cargo fmt --check passed with no output. No Rust crate changed, so clippy and Rust tests were not run. cargo clean output: Removed 1 file, 356B total. The web build output was removed after the production-build e2e.

For the merge round

cd apps/web && bun run test — run the full web suite on the combined branch after this fix.
cd apps/web && bun run test:e2e — run the full e2e suite on the combined branch.
node apps/web/e2e/settings-appearance-cross-tab.mjs — the focused two-Tab regression already passed here; retain it in the merged suite.

# bash3-settings round 3 — complete Branch: `job/bash3-settings` Base after the one `origin/dev` merge: `d395b6e25da20d8c67b8b9fc1a593b813939c8a7` Head: `6a616002d4513c7c1979d718a8f6c5cdf09606bb` ## Built Fixed #1442. The Settings store listens for a storage event on the exact active User settings key, checks that the active User still matches the server-provided User hint, and applies the stored value without echoing a write. This keeps another open Tab current without a request. It reads and parses one small settings value per matching event. Files: `apps/web/src/lib/stores/settings-store.ts`, `apps/web/src/lib/stores/settings-store.test.ts`, `apps/web/e2e/settings-appearance-cross-tab.mjs`. ## Findings | Issue | Symptom | Severity | Result | |---|---|---|---| | #1442 | Colour scheme stayed stale in another open Tab for the same User. | Minor | Fixed in `6a616002d`. The new e2e failed when the listener was removed and passed with the fix. | Known findings from earlier rounds were not re-filed: #1392 Settings selection latency; #1404 missing Admin Users delete action (major); #1416 bottom Settings sidebar Copy link is blocked (minor); #1145 signed licence-key fixture unavailable; #1194 Notifications Undo behavior; #1276 stale open-signup toast expectation; #1296 Connected Accounts review selector. ## Coverage | Flow | Coverage | Width, theme and input methods | Bugs or limits | |---|---|---|---| | Account | Partial: route and deep-link inventory; account/auth surfaces inspected. | 390, 820 and 1440 px; Light and Dark route captures; pointer and keyboard navigation. | Not every Account edit was exercised. | | Appearance | Yes: Light/Dark choice, server confirmation, reload persistence, and two-Tab propagation. | 390, 820 and 1440 px; Light and Dark; real pointer and keyboard interactions; macOS platform emulation. | #1442 fixed. Six actual-size captures are in `artifacts/bash3-settings/cross-tab-after/`. | | Connected Accounts | Partial: Other provider dialog opened; invalid input returned the expected 424; Escape closed it. | One desktop/default-theme interaction; pointer and Escape. | Successful provider authorization needs credentials and was not tested. Existing #1296 is a stale review selector. | | Apps / app passwords | Partial: created Sync and AI Assistant credentials and confirmed the one-time reveal. | One local UI session; pointer. | Revocation was not exercised; no secret was printed or retained in the report. | | Notifications | Partial: quiet hours persisted; this-device push subscription created and deleted through the real service worker/API. | One local browser session; UI and API. | Existing #1194 affected the older Undo assertion. | | Plugins | Yes: toggled User and Instance Money settings, confirmed API state and reload, then restored original values. | One local session; pointer. | No new issue. | | Users and invites | Partial: created an invite, accepted one in the auth flow, revoked an invite, and exercised user creation. | Local real-server sessions; pointer and keyboard where the flow exposed Undo. | User deletion was not retested; existing major #1404 remains. | | Quotas | Yes: set a User quota to 1.5 GB and restored it with Undo; created a 1.25 GB invite quota and confirmed it through the API. | One local Admin session; pointer. | No new issue. | | Backups | Partial: Back up now created a real local backup; File Integrity frequency changed to Daily and survived reload. | One local session; pointer. | Restore was not tested. | | Licence | Partial: free policy and six-active-User limit exercised at the page boundary. | 390, 820 and 1440 px; Light and Dark. | Signed-key flow was unavailable because the shared server has no test signing key; existing #1145. | | Update flow | Partial: exchanged old/current web builds, replayed old Log/Event requests, and verified long-pull reload; 18 review captures. | Local real server; screenshots cover the review states. | The existing e2e stopped on a stale “Refreshed” toast assertion; the actual update flow was checked separately. | | Search in Settings | Yes: Cmd+K search for “First day of week” opened the matching setting. | Keyboard shortcut; one interactive session. | No new issue. | | Deep links to Settings/Admin sections | Partial: 32 live sections and 26 legacy redirects restored the requested route. | 390, 820 and 1440 px; Light and Dark route captures; direct URL and keyboard navigation. | Every Copy link action was not rechecked; known #1416 still blocks the bottom sidebar action. | | Sign-in, sign-out and passkeys | Partial: setup, add/rename passkey, recovery-key regeneration, nameless-passkey sign-in, invite create/accept, sign-out, and protected deep-link redirect were exercised. | 390, 820 and 1440 px; Light and Dark captures; keyboard/pointer; macOS platform emulation. | Existing #1276 is a stale toast assertion. | | Safari passkey prompt and password reachability | No real Safari prompt check. The Mac VM reported “No main display detected” and exposed a blank WebArea. Source inspection found passkey, SSO and recovery-key sign-in choices, with no password field; password sign-in is not reachable in the current UI. | Actual Safari/macOS VM unavailable for usable interaction evidence. | No product change made. | ## Performance Local Appearance exercise, shared host: one cold `data_ready` sample was 1964 ms. The route baseline is p50 1584 ms / p95 2069 ms, so this sample is within p95 and is not a statistically comparable A/B. First ten theme-change confirmations took 597–1446 ms; the next 18 took 220–748 ms. Over a five-minute exercise, heap was 8.2 MB at start and 11.0 MB at end; 38 long tasks were observed, with a 492 ms maximum. Event duration p95 was 1064 ms, maximum 1192 ms. The existing perf finding #1392 covers slow Settings selection paths. ## UX gaps closed - Another open Tab now applies the same User's Appearance setting immediately from its storage event, without an echo write or network request. - The regression test exercises pointer changes in a real two-Tab production build and captures Light and Dark at all three widths. ## UX gaps left - #1404 Admin Users delete action and #1416 bottom sidebar Copy link remain open. - Connected Account success authorization, app-password revocation, backup restore, signed licence-key entry and the Safari-specific passkey prompt were not verified. - Password sign-in is not reachable from the current sign-in page. ## Decisions DESIGN §§21 and 35 define User-scoped storage isolation. I used the existing storage event and exact User-scoped key, then refreshed the initialized store without persisting again. No new UI or design decision was needed. ## Gates `bun run check` passed. Verbatim output excerpts: ```text perf-lint: PASS; 0 violations; 22544 scoped exceptions User browser caches use userStorage; only documented device/public-link exceptions remain. Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css. Text sizes and UI shape values use shared role tokens. Keyboard focus rings use the shared focus tokens. UI transitions and animation options use shared motion tokens or documented exceptions. ==================================== svelte-check found 0 errors and 4 warnings in 2 files ``` The four Svelte warnings are unused CSS selectors in MailView and the Money route. The full `bun run test` passed on the merged base before the final Settings fix: ```text Test Files 297 passed (297) Tests 2116 passed (2116) Start at 06:30:44 Duration 554.31s (environment 28%, import 26%, transform 24%, tests 16%, setup 5%) ``` Post-fix focused checks: ```text Test Files 1 passed (1) Tests 14 passed (14) Start at 07:38:31 Duration 11.11s (transform 91%, import 9%) PASS Appearance cross-tab 390px Dark PASS Appearance cross-tab 390px Light PASS Appearance cross-tab 820px Dark PASS Appearance cross-tab 820px Light PASS Appearance cross-tab 1440px Dark PASS Appearance cross-tab 1440px Light ``` `cargo fmt --check` passed with no output. No Rust crate changed, so clippy and Rust tests were not run. `cargo clean` output: `Removed 1 file, 356B total`. The web build output was removed after the production-build e2e. ## For the merge round - `cd apps/web && bun run test` — run the full web suite on the combined branch after this fix. - `cd apps/web && bun run test:e2e` — run the full e2e suite on the combined branch. - `node apps/web/e2e/settings-appearance-cross-tab.mjs` — the focused two-Tab regression already passed here; retain it in the merged suite.

kayg commented

2026-10-08 06:04:23 +00:00

Author

Owner

Follow-up: I extended bench/appearance.mjs for #1442 in commit ac3114e4578291193e4546c88c6cac57882d821e. Final branch head is now ac3114e4578291193e4546c88c6cac57882d821e.

Local focused profile: node bench/appearance.mjs --cross-tab-only. Output is in artifacts/appearance-1442/appearance-cross-tab-perf.json (ignored, not committed). It used a 387-byte real User settings value and made zero Appearance API requests from the receiving Tab.

50 pointer changes: storage event to document theme p50/p95 94.9 / 328.6 ms (50 samples). Playwright action to peer UI p50/p95 1132.2 / 1723.3 ms.
Eight-choice burst: storage event to theme p50/p95 99 / 277 ms (6 observed DOM changes); final-mode update took 768.8 ms end to end.
Average profile browser tree: mean/peak RSS 1,040,358,848 / 1,135,284,224 B; mean/peak CPU 182.03% / 477.17%; 120.74 CPU seconds. Server: mean/peak RSS 292,975,561 / 298,950,656 B; mean/peak CPU 7.39% / 96.65%; 4.90 CPU seconds.
Burst browser tree: mean/peak RSS 1,109,296,555 / 1,148,469,248 B; mean/peak CPU 234.81% / 377.63%; 4.76 CPU seconds. Server: mean/peak RSS 298,934,272 / 298,934,272 B; mean/peak CPU 0.98% / 4.00%; 0.02 CPU seconds.
Host load averages were 24.25, 26.48, 22.65 before and 22.87, 25.54, 22.61 after. These local shared-host numbers are noisy. The existing Appearance route content baseline is p50/p95 1584 / 2069 ms; it measures route readiness, so it is not a direct comparison with cross-Tab event latency.

I also ran the full existing node bench/appearance.mjs profile once. It reached the existing camera_350kb thumbnail step and exited at the assertion camera_350kb versioned thumbnail reads are cacheable; the focused #1442 profile completed separately. No unrelated thumbnail behavior was changed.

Follow-up: I extended `bench/appearance.mjs` for #1442 in commit `ac3114e4578291193e4546c88c6cac57882d821e`. Final branch head is now `ac3114e4578291193e4546c88c6cac57882d821e`. Local focused profile: `node bench/appearance.mjs --cross-tab-only`. Output is in `artifacts/appearance-1442/appearance-cross-tab-perf.json` (ignored, not committed). It used a 387-byte real User settings value and made zero Appearance API requests from the receiving Tab. - 50 pointer changes: storage event to document theme p50/p95 `94.9 / 328.6 ms` (50 samples). Playwright action to peer UI p50/p95 `1132.2 / 1723.3 ms`. - Eight-choice burst: storage event to theme p50/p95 `99 / 277 ms` (6 observed DOM changes); final-mode update took `768.8 ms` end to end. - Average profile browser tree: mean/peak RSS `1,040,358,848 / 1,135,284,224 B`; mean/peak CPU `182.03% / 477.17%`; 120.74 CPU seconds. Server: mean/peak RSS `292,975,561 / 298,950,656 B`; mean/peak CPU `7.39% / 96.65%`; 4.90 CPU seconds. - Burst browser tree: mean/peak RSS `1,109,296,555 / 1,148,469,248 B`; mean/peak CPU `234.81% / 377.63%`; 4.76 CPU seconds. Server: mean/peak RSS `298,934,272 / 298,934,272 B`; mean/peak CPU `0.98% / 4.00%`; 0.02 CPU seconds. - Host load averages were `24.25, 26.48, 22.65` before and `22.87, 25.54, 22.61` after. These local shared-host numbers are noisy. The existing Appearance route content baseline is p50/p95 `1584 / 2069 ms`; it measures route readiness, so it is not a direct comparison with cross-Tab event latency. I also ran the full existing `node bench/appearance.mjs` profile once. It reached the existing `camera_350kb` thumbnail step and exited at the assertion `camera_350kb versioned thumbnail reads are cacheable`; the focused #1442 profile completed separately. No unrelated thumbnail behavior was changed.

Commenting is not possible because the repository is archived.

No labels

No milestone

No project

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/calternal-v0#1399

No description provided.

Rows
Columns