Merge round 35b #1479

Closed
opened 2026-10-08 18:42:36 +00:00 by kayg · 33 comments
Owner

Merge round 35b into dev from production cc1af3c12: Mail cluster (#1390 #1427 #1368 #1372), Notifications (#1363 #1414), directory shares (#1199), Task ticks (#1446 #1447), Task Undo guard (#1430), Calendar fling (#1362), moved recurrence exception (#1333), Photo Tags (#1370), Markdown paste (#1431), Tab return (#1460), Settings/public preview (#1459), cold Note retry (#1451), tests (#1441 #1443 #1445 #1473). Gates, e2e, one adversarial round, xuser matrix, upgrade test, screenshots. Ends READY/NOT READY.

Merge round 35b into dev from production cc1af3c12: Mail cluster (#1390 #1427 #1368 #1372), Notifications (#1363 #1414), directory shares (#1199), Task ticks (#1446 #1447), Task Undo guard (#1430), Calendar fling (#1362), moved recurrence exception (#1333), Photo Tags (#1370), Markdown paste (#1431), Tab return (#1460), Settings/public preview (#1459), cold Note retry (#1451), tests (#1441 #1443 #1445 #1473). Gates, e2e, one adversarial round, xuser matrix, upgrade test, screenshots. Ends READY/NOT READY.
Author
Owner

Started merge35b on branch job/merge35b at production base cc1af3c12. Worktree is clean. Will merge the 21 specified commits in order, resolve shared behavior conflicts, then run the merge-round gates and verification. No push or deploy. CARGO_TARGET_DIR preset is /home/kayg/build/targets/merge35b; retained per the instruction not to override it.

Started merge35b on branch job/merge35b at production base cc1af3c12. Worktree is clean. Will merge the 21 specified commits in order, resolve shared behavior conflicts, then run the merge-round gates and verification. No push or deploy. CARGO_TARGET_DIR preset is /home/kayg/build/targets/merge35b; retained per the instruction not to override it.
Author
Owner

Merged all 21 requested commits in order, one merge commit each. origin/dev refresh: Already up to date.

Conflict resolutions preserve shared MailReaderActions with Keep, row-backed Mail headers, production focus modality, Task checkbox Undo isolation, Markdown linkPicker plus paste, and one Quick Look clearance variable. Upgrade expectations include Core 16, Calendar 6, Mail 21, Auth 17–19 and Files 29–31.

Found a missing xuser identity classification for the new Mail body endpoint; added the same owner-scoped message identity as the existing detail endpoint. Offline preflight now classifies 435 operations and 1221 generated tools.

Perf guard findings: the incoming Mail body adoption record used an unsupported reason; corrected it to the existing rule-specific reason. Current combined ledger exceeds the lower retained ratchet. No ratchet increase or new waiver has been accepted. Checking exact live hashes before the one authorized regeneration.

Merged all 21 requested commits in order, one merge commit each. origin/dev refresh: `Already up to date.` Conflict resolutions preserve shared MailReaderActions with Keep, row-backed Mail headers, production focus modality, Task checkbox Undo isolation, Markdown linkPicker plus paste, and one Quick Look clearance variable. Upgrade expectations include Core 16, Calendar 6, Mail 21, Auth 17–19 and Files 29–31. Found a missing xuser identity classification for the new Mail body endpoint; added the same owner-scoped message identity as the existing detail endpoint. Offline preflight now classifies 435 operations and 1221 generated tools. Perf guard findings: the incoming Mail body adoption record used an unsupported reason; corrected it to the existing rule-specific reason. Current combined ledger exceeds the lower retained ratchet. No ratchet increase or new waiver has been accepted. Checking exact live hashes before the one authorized regeneration.
Author
Owner

All 21 requested commits are merged, in order, with separate merge commits. Current head: b3923e6fb.

Finding: the combined performance ledger has 22,576 exact entries, but the retained ratchet permits 22,494. Production permits 22,544. The combined count is 32 above production. I ran the authorized hash refresh once: 258 changed pins were refreshed and 11 stale entries were removed. I restored the lower ratchet and added no new exception scopes. bun run check still fails on cache.raw-read, coverage, io.unresolved-call and sql.limit counts. This blocks READY; I will not raise the ratchet or add a waiver.

The full web suite passed: 2,209 tests. The editor suite passed: 509 tests. Rust compilation is in progress. The production Home copy contains 12 Notes, 12 inline Tasks and one Log entry for the upgrade check. Three duplicate migration receipts in merged test expectations were corrected in b3923e6fb; migration counts were not reduced.

All 21 requested commits are merged, in order, with separate merge commits. Current head: b3923e6fb. Finding: the combined performance ledger has 22,576 exact entries, but the retained ratchet permits 22,494. Production permits 22,544. The combined count is 32 above production. I ran the authorized hash refresh once: 258 changed pins were refreshed and 11 stale entries were removed. I restored the lower ratchet and added no new exception scopes. `bun run check` still fails on cache.raw-read, coverage, io.unresolved-call and sql.limit counts. This blocks READY; I will not raise the ratchet or add a waiver. The full web suite passed: 2,209 tests. The editor suite passed: 509 tests. Rust compilation is in progress. The production Home copy contains 12 Notes, 12 inline Tasks and one Log entry for the upgrade check. Three duplicate migration receipts in merged test expectations were corrected in b3923e6fb; migration counts were not reduced.
Author
Owner

Merged head release build passed (20m 03s). The production-shaped Home copy starts in 6615.5 ms, preserves 13 Note records and 3 Calendar Events, and installs calendar_events_uid(owner_id,calendar_id,uid). All 26 Home source files have identical hashes before and after upgrade.

The full Rust test gate found Collab fixtures which apply Files migrations before defining Auth users. Files migration 0031 resolves grant foreign keys during cleanup even on an empty fixture. Fixing fixture setup only; no assertions change. Collab unit tests pass after the schema fix.

Browser integration found a missing phone Keep action and a lost readerx narrow-pane header rule after combining Mail branches. Restoring both behaviors in the shared reader. The phone screenshot focus probe also needs to target the Keep button specifically now that the header contains four actions.

Calendar e2e (Week link timeout) and notifications-1194 (theme identity mismatch) reproduce on production cc1af3c12. The share request review test raced optimistic removal against the grant commit; adding a response wait while retaining its assertions.

The release split-directory adversarial round is running with a 60-minute limit. Cross-User preflight: 435 operations and 1224 generated tools classified. Perf ratchets remain unchanged; guard failure remains a blocker.

Merged head release build passed (20m 03s). The production-shaped Home copy starts in 6615.5 ms, preserves 13 Note records and 3 Calendar Events, and installs calendar_events_uid(owner_id,calendar_id,uid). All 26 Home source files have identical hashes before and after upgrade. The full Rust test gate found Collab fixtures which apply Files migrations before defining Auth users. Files migration 0031 resolves grant foreign keys during cleanup even on an empty fixture. Fixing fixture setup only; no assertions change. Collab unit tests pass after the schema fix. Browser integration found a missing phone Keep action and a lost readerx narrow-pane header rule after combining Mail branches. Restoring both behaviors in the shared reader. The phone screenshot focus probe also needs to target the Keep button specifically now that the header contains four actions. Calendar e2e (Week link timeout) and notifications-1194 (theme identity mismatch) reproduce on production cc1af3c12. The share request review test raced optimistic removal against the grant commit; adding a response wait while retaining its assertions. The release split-directory adversarial round is running with a 60-minute limit. Cross-User preflight: 435 operations and 1224 generated tools classified. Perf ratchets remain unchanged; guard failure remains a blocker.
Author
Owner

The adversarial server starts normally with the disposable Home on /mnt/hdd; the earlier /readyz 503 deadlines were filesystem journal waits on the build disk. The actual <=60-minute round is running.

Non-SLOW findings to classify against cc1af3c12: Search chaos misses one canonical Unicode filename and loses the second User's committed Search hit during rebuild/overflow recovery. Mail attachment Save to Files cannot be clicked: the selected attachment li intercepts the pointer. Editor browser probe cannot find the Copy link to block menu action. Concurrency, offline reconciliation, deletion/edit, one-megabyte paragraphs and 10,000-block editor checks pass. No unexpected crash has been observed; the Search SIGKILL was the requested recovery probe.

The new Photo Tags xuser extension initially wrote Tags before the original create-only XMP upload. Tag writing creates that sidecar, so the fixture collided with its own Tus upload (412). Corrected order in d2247f9fc: create the Live Photo sidecars first, then add the owner-only Tag. Assertions and original fixture identities are retained.

Calendar unit fixtures also need Auth before Files migration 0031. Correcting schema setup, while retaining all assertions.

Mac real-GPU A/B is pending: /tmp/mac-bench.lock is held by calternal intlfmt-1461-820, started 2026-10-08T20:17:52Z, expected 15 minutes. The lock remains held at 21:09 UTC. I have not removed another job's lock or changed its session.

The adversarial server starts normally with the disposable Home on /mnt/hdd; the earlier /readyz 503 deadlines were filesystem journal waits on the build disk. The actual <=60-minute round is running. Non-SLOW findings to classify against cc1af3c12: Search chaos misses one canonical Unicode filename and loses the second User's committed Search hit during rebuild/overflow recovery. Mail attachment Save to Files cannot be clicked: the selected attachment li intercepts the pointer. Editor browser probe cannot find the Copy link to block menu action. Concurrency, offline reconciliation, deletion/edit, one-megabyte paragraphs and 10,000-block editor checks pass. No unexpected crash has been observed; the Search SIGKILL was the requested recovery probe. The new Photo Tags xuser extension initially wrote Tags before the original create-only XMP upload. Tag writing creates that sidecar, so the fixture collided with its own Tus upload (412). Corrected order in d2247f9fc: create the Live Photo sidecars first, then add the owner-only Tag. Assertions and original fixture identities are retained. Calendar unit fixtures also need Auth before Files migration 0031. Correcting schema setup, while retaining all assertions. Mac real-GPU A/B is pending: /tmp/mac-bench.lock is held by calternal intlfmt-1461-820, started 2026-10-08T20:17:52Z, expected 15 minutes. The lock remains held at 21:09 UTC. I have not removed another job's lock or changed its session.
Author
Owner

The adversarial server starts normally with the disposable Home on /mnt/hdd; the earlier /readyz 503 deadlines were filesystem journal waits on the build disk. The actual <=60-minute round is running.

Non-SLOW findings to classify against cc1af3c12: Search chaos misses one canonical Unicode filename and loses the second User's committed Search hit during rebuild/overflow recovery. Mail attachment Save to Files cannot be clicked: the selected attachment li intercepts the pointer. Editor browser probe cannot find the Copy link to block menu action. Concurrency, offline reconciliation, deletion/edit, one-megabyte paragraphs and 10,000-block editor checks pass. No unexpected crash has been observed; the Search SIGKILL was the requested recovery probe.

The new Photo Tags xuser extension initially wrote Tags before the original create-only XMP upload. Tag writing creates that sidecar, so the fixture collided with its own Tus upload (412). Corrected order in d2247f9fc: create the Live Photo sidecars first, then add the owner-only Tag. Assertions and original fixture identities are retained.

Calendar unit fixtures also need Auth before Files migration 0031. Correcting schema setup, while retaining all assertions.

Mac real-GPU A/B is pending: /tmp/mac-bench.lock is held by calternal intlfmt-1461-820, started 2026-10-08T20:17:52Z, expected 15 minutes. The lock remains held at 21:09 UTC. I have not removed another job's lock or changed its session.

The adversarial server starts normally with the disposable Home on /mnt/hdd; the earlier /readyz 503 deadlines were filesystem journal waits on the build disk. The actual <=60-minute round is running. Non-SLOW findings to classify against cc1af3c12: Search chaos misses one canonical Unicode filename and loses the second User's committed Search hit during rebuild/overflow recovery. Mail attachment Save to Files cannot be clicked: the selected attachment li intercepts the pointer. Editor browser probe cannot find the Copy link to block menu action. Concurrency, offline reconciliation, deletion/edit, one-megabyte paragraphs and 10,000-block editor checks pass. No unexpected crash has been observed; the Search SIGKILL was the requested recovery probe. The new Photo Tags xuser extension initially wrote Tags before the original create-only XMP upload. Tag writing creates that sidecar, so the fixture collided with its own Tus upload (412). Corrected order in d2247f9fc: create the Live Photo sidecars first, then add the owner-only Tag. Assertions and original fixture identities are retained. Calendar unit fixtures also need Auth before Files migration 0031. Correcting schema setup, while retaining all assertions. Mac real-GPU A/B is pending: /tmp/mac-bench.lock is held by calternal intlfmt-1461-820, started 2026-10-08T20:17:52Z, expected 15 minutes. The lock remains held at 21:09 UTC. I have not removed another job's lock or changed its session.
Author
Owner

Integration finding: #1445 creates and awaits a detached Money preview in create_fixtures. #1443 then tried to admit a second preview before testing foreign cancellation. The server correctly returned 429 because a pending preview already exists. This prevented the actual cross-User operation matrix from running.

The cancellation probe now reuses the fixture already admitted with HTTP 202. It retains every foreign/missing status and body comparison, confirms that the owner preview is unchanged, and leaves that same identity available for the later replay. The existing admission assertion is still in create_money_import_fixture. No server behavior or test expectation is weakened.

Mail layouts now pass with selectors naming the real collapsed fixture Cards. Share request verification is running with response waits before reading committed grants. Photos fixture Auth-before-Files gates are running. Search recovery findings are filed as #1482; readiness remains blocked by the exact performance ratchet.

Integration finding: #1445 creates and awaits a detached Money preview in create_fixtures. #1443 then tried to admit a second preview before testing foreign cancellation. The server correctly returned 429 because a pending preview already exists. This prevented the actual cross-User operation matrix from running. The cancellation probe now reuses the fixture already admitted with HTTP 202. It retains every foreign/missing status and body comparison, confirms that the owner preview is unchanged, and leaves that same identity available for the later replay. The existing admission assertion is still in create_money_import_fixture. No server behavior or test expectation is weakened. Mail layouts now pass with selectors naming the real collapsed fixture Cards. Share request verification is running with response waits before reading committed grants. Photos fixture Auth-before-Files gates are running. Search recovery findings are filed as #1482; readiness remains blocked by the exact performance ratchet.
Author
Owner

Head 79e584eaa. No push or deploy.

Photos focused Rust gates pass: clippy completed in 1m 18s; test result: ok. 59 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.90s. The Calendar fixture fix also passed its focused gates. A second whole-workspace clippy printed Finished dev profile ... in 2m 02s; the enclosing session then exited 143 before running tests. The final whole-workspace tests are now a separate command.

Mail layouts and Mail Morph production regressions pass after the shared reader actions, phone Keep and narrow-pane fixes. The Photos Tags flow and statusmark #1457 real edit/save/reload flow pass. Twenty-eight actual-size macOS-emulated captures are attached to this issue: Mail/Notifications comparison, reader pointer/shortcut states, Files requests, pasted Markdown, Photos Tags and Calendar Day. Calendar Week and the remaining HTML-reader evidence are still being collected.

The corrected xuser cancellation probe now preserves the one real admitted preview through the broader identifier replay. Owner cancellation stays asserted at cleanup. No status assertion has been removed or weakened. Focused live xuser, directory visibility, subscription and Task tick probes are queued behind the current local UI browser.

The cold-note test was stopped by our 150-second harness cap after 46 successful opens; open 47 had a direct and route HTTP 200, then the closing browser produced the final error. This is an incomplete run, not evidence of a server 5xx. Authflash's initial redirect, cold Note, cold File, cold Settings and first worker-signout Note checks passed before the same cap closed its browser. Neither incomplete test is reported as passed.

The full adversarial run ended with signal 143 during its Tag upload burst, before the later matrix phases. Its prior health, writes, Undo, import, Files/Share, Notes dates, Calendar, Mail network policy, integration and scripted DAV checks passed. Search differences are filed as #1482. The deterministic perf ratchet blocker is #1483. Mac A/B remains queued for the shared lock; another job's lock has not been removed.

Head 79e584eaa. No push or deploy. Photos focused Rust gates pass: clippy completed in 1m 18s; `test result: ok. 59 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.90s`. The Calendar fixture fix also passed its focused gates. A second whole-workspace clippy printed `Finished dev profile ... in 2m 02s`; the enclosing session then exited 143 before running tests. The final whole-workspace tests are now a separate command. Mail layouts and Mail Morph production regressions pass after the shared reader actions, phone Keep and narrow-pane fixes. The Photos Tags flow and statusmark #1457 real edit/save/reload flow pass. Twenty-eight actual-size macOS-emulated captures are attached to this issue: Mail/Notifications comparison, reader pointer/shortcut states, Files requests, pasted Markdown, Photos Tags and Calendar Day. Calendar Week and the remaining HTML-reader evidence are still being collected. The corrected xuser cancellation probe now preserves the one real admitted preview through the broader identifier replay. Owner cancellation stays asserted at cleanup. No status assertion has been removed or weakened. Focused live xuser, directory visibility, subscription and Task tick probes are queued behind the current local UI browser. The cold-note test was stopped by our 150-second harness cap after 46 successful opens; open 47 had a direct and route HTTP 200, then the closing browser produced the final error. This is an incomplete run, not evidence of a server 5xx. Authflash's initial redirect, cold Note, cold File, cold Settings and first worker-signout Note checks passed before the same cap closed its browser. Neither incomplete test is reported as passed. The full adversarial run ended with signal 143 during its Tag upload burst, before the later matrix phases. Its prior health, writes, Undo, import, Files/Share, Notes dates, Calendar, Mail network policy, integration and scripted DAV checks passed. Search differences are filed as #1482. The deterministic perf ratchet blocker is #1483. Mac A/B remains queued for the shared lock; another job's lock has not been removed.
Author
Owner

Fixed #1486 in 4ccb91bfb: the existing Photos read_xmp reader now reads RDF attributes and scalar child elements through one value setter. It keeps its indexed Sidecar path, directory-handle-relative read and one-MiB cap. Work is one bounded read plus O(XML bytes) parsing; it does not scan the Home or add per-request IO.

Verbatim focused gates:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.16s
test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.67s

cargo fmt --check exited 0. The new regression verifies identical pairing, key-photo and burst values across attribute and element encodings, including escaped values. Existing expectations remain unchanged. A matching real-server rerun is still pending the updated binary build.

Directory visibility #1199 and the Notification subscription #1445 probes both passed on the release server. Money cancellation isolation passed before the separate Photo Stack failure in the full xuser attempt. The broad identifier replay is still incomplete.

Fixed #1486 in 4ccb91bfb: the existing Photos read_xmp reader now reads RDF attributes and scalar child elements through one value setter. It keeps its indexed Sidecar path, directory-handle-relative read and one-MiB cap. Work is one bounded read plus O(XML bytes) parsing; it does not scan the Home or add per-request IO. Verbatim focused gates: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.16s test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.67s ``` `cargo fmt --check` exited 0. The new regression verifies identical pairing, key-photo and burst values across attribute and element encodings, including escaped values. Existing expectations remain unchanged. A matching real-server rerun is still pending the updated binary build. Directory visibility #1199 and the Notification subscription #1445 probes both passed on the release server. Money cancellation isolation passed before the separate Photo Stack failure in the full xuser attempt. The broad identifier replay is still incomplete.
Author
Owner

Head 4ccb91bfb5. The rebuilt release server now passes the previously failing live Photo Stack path after Tags change XMP property representation. Verbatim probe result:

Photos Share contracts: timeline, buckets, day, search, item, stack, Calendar, Files ID, original, thumbnail and Public link pass before/after revoke

The broad cross-User replay is still running. Native Photos tests: 60 passed, 0 failed, 4 ignored. No source Photo files were changed by the parser fix.

Head 4ccb91bfb5ea6bed94d5a33666d16d92afb3239a. The rebuilt release server now passes the previously failing live Photo Stack path after Tags change XMP property representation. Verbatim probe result: ```text Photos Share contracts: timeline, buckets, day, search, item, stack, Calendar, Files ID, original, thumbnail and Public link pass before/after revoke ``` The broad cross-User replay is still running. Native Photos tests: 60 passed, 0 failed, 4 ignored. No source Photo files were changed by the parser fix.
Author
Owner

Head 16250888dd. The full cross-User replay reached all routes and found eight control failures: four Mail Thread reads sent before_id without before_received_ms and returned 400 for both known and missing IDs; four Log repair comparisons used an invalid missing date and compared 409 with 400. Both route handler bodies are byte-identical to cc1af3c12. Commit 16250888d fixes request construction only: read the Thread first page without a cursor, and use a valid absent date for Log repair. Original status and profile assertions remain unchanged. Offline regression tests: 25 passed. One fresh full replay is running against the release server.

Head 16250888dd2b7ef5c7a0e4df9986abac9194ab35. The full cross-User replay reached all routes and found eight control failures: four Mail Thread reads sent before_id without before_received_ms and returned 400 for both known and missing IDs; four Log repair comparisons used an invalid missing date and compared 409 with 400. Both route handler bodies are byte-identical to cc1af3c12. Commit 16250888d fixes request construction only: read the Thread first page without a cursor, and use a valid absent date for Log repair. Original status and profile assertions remain unchanged. Offline regression tests: 25 passed. One fresh full replay is running against the release server.
Author
Owner

NOT READY: the retained deterministic perf ratchets fail. Search recovery and two UI suite failures remain unresolved or unclassified.

Head: 16250888dd2b7ef5c7a0e4df9986abac9194ab35. Base: cc1af3c12. All 21 requested tips were merged in order, with one --no-ff merge commit each. No item was skipped. One fetch and merge of origin/dev completed before final gates. No push or deploy was performed.

Built: shared Mail reader integration, Keep on phone and thread readers, shared Card insets and narrow-pane sizing, MIME fixture parity, schema fixture startup order, generated API/action docs, and cross-User guard coverage. Fixed the live Photo Stack regression caused by XMP RDF attributes becoming elements after Tags edits (#1486). Native and live sharing tests confirm the fix.

Files: 225 changed files. Main integration files are apps/web/src/lib/mail/MailView.svelte, MailReaderActions.svelte, MailMorphCard.svelte; crates/plugins/photos/src/index.rs; tests/adversarial/xuser_matrix.py; related e2e fixtures; contracts and generated docs; existing perf hash pins. The full manifest is attached. Screenshots are review artifacts only and are not committed.

Decisions: keep one reader header row and put Keep in shared MailReaderActions. Reuse shared Pill and Card variants. Keep production's --ql-head-clearance and quiet programmatic focus behavior. Keep item 19's PublicLinkPage MIME comment. Read both legal XMP RDF property forms with the existing 1 MiB bound and indexed Sidecar path. No new feature or dependency was added. Never raise a ratchet or add a waiver. One --adopt-7c pass ran; later fixes refreshed existing hashes only, with limits and scopes unchanged.

UX gaps closed: phone Keep; reader action reuse; Card clipping/insets; plain MIME cache fixture; optimistic Share review test race; Live Photo pairing after Tags. UX gaps left: Notes cached Files editor while identity waits (#1487), Mail wheel pagination (#1488), inherited attachment Save hit target (#1485). Calendar local first-frame timing is filed separately (#1489).

Upgrade: first production-copy migration startup 6615.5 ms. Calendar UID index and migration receipt 6 exist after upgrade. All 26 source files retain identical hashes. Later release restart: 3574.5 ms.

Adversarial: the <=60-minute full round ended by runner SIGTERM after about 45 minutes, before every matrix finished; it is incomplete. No unexpected server crash was established. Search Unicode misses reproduce on production; loss of a second User's Search hit during recovery is filed in #1482 and remains unclassified/new. Source files remain intact. Focused release xuser, directory visibility, subscription isolation and 1,000-Task tick/Undo checks passed. No cross-User content leak was found in the corrected matrix.

Known gaps: full adversarial round incomplete; full Files, Notes, Calendar and Mail sync UI suites are not green. Files MIME fixture, Calendar Week-link selector and Notifications theme/ring expectations reproduce on production or conflict with the current owner focus rule (#1484). Keep their assertions. Some changed e2e scripts were time-boxed or not completed; the final status manifest lists them. No acceptance pass is claimed for those scripts.

Release verification: directory visibility #1199 and subscription isolation #1445 passed. Xuser classified 435 operations, replayed 226 operations, and passed 1,053 A-ID versus missing-ID comparisons plus 127 Job/Mail/quota ownership checks. Photo timeline, buckets, day, search, item, Stack, Calendar, Files ID, original, thumbnail and Public link passed before and after revocation.

Task burst (LOCAL, shared host): 1,000 Tasks in one Note, eight concurrent workers. Tick and Undo each return 1,000 HTTP 200 responses and 1,000 intended states. Tick p50/p95 1352.15/3863.19 ms, CPU 382.82 s, peak RSS 573304 KiB. Undo p50/p95 1175.07/2517.58 ms, CPU 360.32 s, peak RSS 488964 KiB. The docs/perf/baseline.json after-burst values are 1871.75/3461.38 ms and 1917.83/3466.30 ms; that VM fixture also has 2,000 unrelated Notes and 5,000 Files. This is not a controlled regression comparison. Cost is 1,000 edits of a 1,000-Task Note; the existing batcher coalesces durable writes.

Mail body: real TLS provider, 3 MiB HTML, opaque sanitizer sandbox, no sender URL escape, no Seen flag on BODY.PEEK, plain-text error/Retry, and all six width/theme captures passed with zero CSP reports. Local cold large-body p50/p95 4614.6/5899.1 ms; warm 304 p50/p95 20.3/21.6 ms. The body budget and cache are bounded.

Gate output (verbatim extracts; full logs attached):

fmt-head.log
(no output; exit 0)

clippy-head.log
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 02s

web-check-after-xmp.log
perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.stale: 7 exceptions exceed the ratchet ceiling 6; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16613 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22576 exceptions; ratchet total is 22494
svelte-check found 0 errors and 3 warnings in 1 file

web-test-merged-final.log
 Test Files  305 passed (305)
      Tests  2209 passed (2209)
   Duration  416.30s (transform 33%, environment 23%, import 21%, tests 17%, setup 5%)

editor-test.log
 Test Files  26 passed (26)
      Tests  509 passed (509)
   Duration  38.74s (transform 4.92s, setup 619ms, import 15.49s, tests 17.40s, environment 34.76s)

photo-xmp-test.log
test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.67s


error: 1 target failed:
    `-p calternal-server --test perf_guards`

The full Rust test run began before the XMP parser fix and used the 59-test Photos binary. The final Photos crate run has 60 passing tests and includes the new regression. Final whole-workspace Clippy ran after the fix. The final web test run used the final product sources. Last commit changes only Python ownership controls.

Evidence attachments:

Follow-up verification commands: cd apps/web && bun run check and cargo test -p calternal-server --test perf_guards must pass after the static perf findings are fixed without a new waiver or ceiling. Re-run tests/adversarial/run.sh against the release build to finish the full campaign, and compare the Search recovery case with cc1af3c12. Run NOTES_E2E_606_ONLY=1 bun e2e/notes.mjs for #1487, bun e2e/mail-sync-613.mjs for #1488, and the full bun e2e/photos.mjs. The e2e status attachment lists the other incomplete scripts. Keep original expectations unless the owner decides to change behavior.

Mac GPU A/B: NOT RUN. The shared VM lock remained held by calternal notifread-1387 (holder start 22:01:55 UTC, expected 60 minutes). Our queue was cancelled near the four-hour job limit without changing the other job's lock. No synthetic or Linux timings replace this gate. The prepared local mac-run.sh/mac-tabs.cjs artifacts perform three alternating rounds and main-view/per-Tab p50/p95 checks; re-run them under the shared lock with the paired servers.

Browser soak: INCOMPLETE (exit 124). Completed 30-minute navigation and 20/100 overlay/preview/Composer cycles. The deadline interrupted the Quick Look heading wait. No full cycle or heap-growth pass is claimed.

Final focused Mail API probe: blocked by the same selected attachment li intercepting Save to Files pointer events, reproduced on production and filed as #1485. It is not reported as a full Mail API pass. Soak follow-up: #1490.

Deep links final suite: all passed, zero CSP reports across 46 pages. No additional product decisions were required. No UI aesthetic approval is claimed; Claude reviews the attached real-build screenshots.

NOT READY: retained static perf ratchets fail; Search recovery remains unresolved/unclassified, full UI suites are not green, the full adversarial and soak campaigns are incomplete, and the Mac GPU comparison did not run.

NOT READY: the retained deterministic perf ratchets fail. Search recovery and two UI suite failures remain unresolved or unclassified. Head: `16250888dd2b7ef5c7a0e4df9986abac9194ab35`. Base: `cc1af3c12`. All 21 requested tips were merged in order, with one `--no-ff` merge commit each. No item was skipped. One fetch and merge of origin/dev completed before final gates. No push or deploy was performed. Built: shared Mail reader integration, Keep on phone and thread readers, shared Card insets and narrow-pane sizing, MIME fixture parity, schema fixture startup order, generated API/action docs, and cross-User guard coverage. Fixed the live Photo Stack regression caused by XMP RDF attributes becoming elements after Tags edits (#1486). Native and live sharing tests confirm the fix. Files: 225 changed files. Main integration files are apps/web/src/lib/mail/MailView.svelte, MailReaderActions.svelte, MailMorphCard.svelte; crates/plugins/photos/src/index.rs; tests/adversarial/xuser_matrix.py; related e2e fixtures; contracts and generated docs; existing perf hash pins. The full manifest is attached. Screenshots are review artifacts only and are not committed. Decisions: keep one reader header row and put Keep in shared MailReaderActions. Reuse shared Pill and Card variants. Keep production's --ql-head-clearance and quiet programmatic focus behavior. Keep item 19's PublicLinkPage MIME comment. Read both legal XMP RDF property forms with the existing 1 MiB bound and indexed Sidecar path. No new feature or dependency was added. Never raise a ratchet or add a waiver. One --adopt-7c pass ran; later fixes refreshed existing hashes only, with limits and scopes unchanged. UX gaps closed: phone Keep; reader action reuse; Card clipping/insets; plain MIME cache fixture; optimistic Share review test race; Live Photo pairing after Tags. UX gaps left: Notes cached Files editor while identity waits (#1487), Mail wheel pagination (#1488), inherited attachment Save hit target (#1485). Calendar local first-frame timing is filed separately (#1489). Upgrade: first production-copy migration startup 6615.5 ms. Calendar UID index and migration receipt 6 exist after upgrade. All 26 source files retain identical hashes. Later release restart: 3574.5 ms. Adversarial: the <=60-minute full round ended by runner SIGTERM after about 45 minutes, before every matrix finished; it is incomplete. No unexpected server crash was established. Search Unicode misses reproduce on production; loss of a second User's Search hit during recovery is filed in #1482 and remains unclassified/new. Source files remain intact. Focused release xuser, directory visibility, subscription isolation and 1,000-Task tick/Undo checks passed. No cross-User content leak was found in the corrected matrix. Known gaps: full adversarial round incomplete; full Files, Notes, Calendar and Mail sync UI suites are not green. Files MIME fixture, Calendar Week-link selector and Notifications theme/ring expectations reproduce on production or conflict with the current owner focus rule (#1484). Keep their assertions. Some changed e2e scripts were time-boxed or not completed; the final status manifest lists them. No acceptance pass is claimed for those scripts. Release verification: directory visibility #1199 and subscription isolation #1445 passed. Xuser classified 435 operations, replayed 226 operations, and passed 1,053 A-ID versus missing-ID comparisons plus 127 Job/Mail/quota ownership checks. Photo timeline, buckets, day, search, item, Stack, Calendar, Files ID, original, thumbnail and Public link passed before and after revocation. Task burst (LOCAL, shared host): 1,000 Tasks in one Note, eight concurrent workers. Tick and Undo each return 1,000 HTTP 200 responses and 1,000 intended states. Tick p50/p95 1352.15/3863.19 ms, CPU 382.82 s, peak RSS 573304 KiB. Undo p50/p95 1175.07/2517.58 ms, CPU 360.32 s, peak RSS 488964 KiB. The docs/perf/baseline.json after-burst values are 1871.75/3461.38 ms and 1917.83/3466.30 ms; that VM fixture also has 2,000 unrelated Notes and 5,000 Files. This is not a controlled regression comparison. Cost is 1,000 edits of a 1,000-Task Note; the existing batcher coalesces durable writes. Mail body: real TLS provider, 3 MiB HTML, opaque sanitizer sandbox, no sender URL escape, no Seen flag on BODY.PEEK, plain-text error/Retry, and all six width/theme captures passed with zero CSP reports. Local cold large-body p50/p95 4614.6/5899.1 ms; warm 304 p50/p95 20.3/21.6 ms. The body budget and cache are bounded. Gate output (verbatim extracts; full logs attached): ```text fmt-head.log (no output; exit 0) clippy-head.log Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 02s web-check-after-xmp.log perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.stale: 7 exceptions exceed the ratchet ceiling 6; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16613 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22576 exceptions; ratchet total is 22494 svelte-check found 0 errors and 3 warnings in 1 file web-test-merged-final.log Test Files 305 passed (305) Tests 2209 passed (2209) Duration 416.30s (transform 33%, environment 23%, import 21%, tests 17%, setup 5%) editor-test.log Test Files 26 passed (26) Tests 509 passed (509) Duration 38.74s (transform 4.92s, setup 619ms, import 15.49s, tests 17.40s, environment 34.76s) photo-xmp-test.log test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 10.67s error: 1 target failed: `-p calternal-server --test perf_guards` ``` The full Rust test run began before the XMP parser fix and used the 59-test Photos binary. The final Photos crate run has 60 passing tests and includes the new regression. Final whole-workspace Clippy ran after the fix. The final web test run used the final product sources. Last commit changes only Python ownership controls. Evidence attachments: - [merge35b-clippy-head.log](https://git.kayg.org/attachments/6f739f61-307e-406a-bb56-43fc7ea47e78) - [merge35b-cargo-test-merged-final.log](https://git.kayg.org/attachments/5d430563-5f79-4512-a6c2-c83b2a6fb3b3) - [merge35b-web-test-merged-final.log](https://git.kayg.org/attachments/a6223b2b-beed-4015-a7f8-4f0ef03c2e14) - [merge35b-web-check-after-xmp.log](https://git.kayg.org/attachments/3dad08f2-47a8-49cb-87ae-1f521d0e518f) - [merge35b-editor-test.log](https://git.kayg.org/attachments/6911e9db-33e9-461f-9fcd-cd9b04a2253f) - [merge35b-xuser-valid-controls.log](https://git.kayg.org/attachments/16df4dbc-21ae-415c-9415-84410c5e77d3) - [merge35b-tasks-tick-final.log](https://git.kayg.org/attachments/e3d1cf7a-9277-4a4a-9aa1-c7cea886b6db) - [merge35b-mailhtml-1372-cached.log](https://git.kayg.org/attachments/69cf3e65-7b6d-45b5-b144-959e33d6c0e3) - [merge35b-changed-files-final.txt](https://git.kayg.org/attachments/d24549d6-3c67-4a0d-8b79-3db5bd022874) - [merge35b-screenshot-manifest.json](https://git.kayg.org/attachments/6d2bf498-30ea-4a3b-b4a0-948c8312d1c7) - [merge35b-gate-manifest.json](https://git.kayg.org/attachments/5a9c0a84-5a22-4e76-b75a-c897b1d74f43) Follow-up verification commands: `cd apps/web && bun run check` and `cargo test -p calternal-server --test perf_guards` must pass after the static perf findings are fixed without a new waiver or ceiling. Re-run `tests/adversarial/run.sh` against the release build to finish the full campaign, and compare the Search recovery case with cc1af3c12. Run `NOTES_E2E_606_ONLY=1 bun e2e/notes.mjs` for #1487, `bun e2e/mail-sync-613.mjs` for #1488, and the full `bun e2e/photos.mjs`. The e2e status attachment lists the other incomplete scripts. Keep original expectations unless the owner decides to change behavior. Mac GPU A/B: NOT RUN. The shared VM lock remained held by calternal notifread-1387 (holder start 22:01:55 UTC, expected 60 minutes). Our queue was cancelled near the four-hour job limit without changing the other job's lock. No synthetic or Linux timings replace this gate. The prepared local mac-run.sh/mac-tabs.cjs artifacts perform three alternating rounds and main-view/per-Tab p50/p95 checks; re-run them under the shared lock with the paired servers. Browser soak: INCOMPLETE (exit 124). Completed 30-minute navigation and 20/100 overlay/preview/Composer cycles. The deadline interrupted the Quick Look heading wait. No full cycle or heap-growth pass is claimed. Final focused Mail API probe: blocked by the same selected attachment li intercepting Save to Files pointer events, reproduced on production and filed as #1485. It is not reported as a full Mail API pass. Soak follow-up: #1490. Deep links final suite: all passed, zero CSP reports across 46 pages. No additional product decisions were required. No UI aesthetic approval is claimed; Claude reviews the attached real-build screenshots. NOT READY: retained static perf ratchets fail; Search recovery remains unresolved/unclassified, full UI suites are not green, the full adversarial and soak campaigns are incomplete, and the Mac GPU comparison did not run.
Author
Owner

Head 16250888dd. Final late checks: deep links all passed (zero CSP reports across 46 pages); focused Mail API is blocked by the known production Save hit target (#1485). Cleanup completed; web build output removed, remaining servers stopped, working tree clean. Verbatim cleanup output:

cargo clean exit 0
     Removed 39602 files, 53.9GiB total

NOT READY: retained static perf ratchets fail; full adversarial and soak rounds are incomplete, the Mac GPU comparison did not run, and unresolved/unclassified Search and UI findings remain.

Head 16250888dd2b7ef5c7a0e4df9986abac9194ab35. Final late checks: deep links all passed (zero CSP reports across 46 pages); focused Mail API is blocked by the known production Save hit target (#1485). Cleanup completed; web build output removed, remaining servers stopped, working tree clean. Verbatim cleanup output: ```text cargo clean exit 0 Removed 39602 files, 53.9GiB total ``` NOT READY: retained static perf ratchets fail; full adversarial and soak rounds are incomplete, the Mac GPU comparison did not run, and unresolved/unclassified Search and UI findings remain.
Author
Owner

Starting m35btriage on job/merge35b, base/head 16250888dd; production cc1af3c12. Read the merge35b findings and final gate output. Search second-User recovery and the 22,576/22,494 static ratchet remain blocking. Will alternate five release Search probes per build and run two comparisons per UI finding. No push or deploy. No dependency changes planned.

Starting m35btriage on job/merge35b, base/head 16250888dd2b7ef5c7a0e4df9986abac9194ab35; production cc1af3c12. Read the merge35b findings and final gate output. Search second-User recovery and the 22,576/22,494 static ratchet remain blocking. Will alternate five release Search probes per build and run two comparisons per UI finding. No push or deploy. No dependency changes planned.
Author
Owner

Exact pin audit: production has 22,544 ledger entries; the merged ledger had 22,576. Merge deltas: Task ticks -48; recurrence -2; Photo Tags +13; Mail morph +2; Mail HTML +7; directory-1199 +71; contract reconciliation -11. The retained ceiling is 22,494 from the reduced branch.

Found 34 retained call bindings with unchanged exact call syntax but changed enclosing-function hashes: list_shares 25, Photo item_detail 8, ServerSettings::default 1. Refreshed those existing bindings only. No new capability, test reference, call identity, exception or ceiling was added. Removed the 34 exceptions that those existing proofs now resolve. Ledger: 22,542; ceiling: 22,494. This remains blocking. Static guard regressions: 140 tests pass. Search focused selector now exists and runs the same existing phase before unrelated reliability probes. Search result matching: 4 tests pass with a disposable fixture.

Production Notes: both runs reproduce the exact cached editor timeout at notes.mjs:623 while /auth/me is pending. Merged comparisons remain pending until the release build completes.

Exact pin audit: production has 22,544 ledger entries; the merged ledger had 22,576. Merge deltas: Task ticks -48; recurrence -2; Photo Tags +13; Mail morph +2; Mail HTML +7; directory-1199 +71; contract reconciliation -11. The retained ceiling is 22,494 from the reduced branch. Found 34 retained call bindings with unchanged exact call syntax but changed enclosing-function hashes: list_shares 25, Photo item_detail 8, ServerSettings::default 1. Refreshed those existing bindings only. No new capability, test reference, call identity, exception or ceiling was added. Removed the 34 exceptions that those existing proofs now resolve. Ledger: 22,542; ceiling: 22,494. This remains blocking. Static guard regressions: 140 tests pass. Search focused selector now exists and runs the same existing phase before unrelated reliability probes. Search result matching: 4 tests pass with a disposable fixture. Production Notes: both runs reproduce the exact cached editor timeout at notes.mjs:623 while /auth/me is pending. Merged comparisons remain pending until the release build completes.
Author
Owner

Further static audit at 72e95497b: removed the obsolete Files /shares/{id} DELETE-only router record and the removed MailReaderContent each-loop record. The live discovery already reported both as coverage.stale. Removed their two ledger/checkpoint entries; added no binding or exception. The stale-rule count is now 5, so its ceiling falls from 6 to 5 and the retained total ceiling falls from 22,494 to 22,493 under the shrink rule. Current ledger: 22,540. It remains 47 above that total ceiling. Performance guard regressions remain 140/140 passing.

First alternating release Search pair: neither production nor merged lost the second User's hit. Both reported Unicode upload-marker misses. Four pairs remain. The first one-minute Quick Look run reached 30 cycles before I stopped it to keep one browser at a time. It is exploratory output only. The final Quick Look comparisons keep the original 30-minute navigation, 100-cycle target and 2,250-second runner deadline, with opt-in wait-boundary logging. Existing assertions are unchanged.

Further static audit at 72e95497b: removed the obsolete Files /shares/{id} DELETE-only router record and the removed MailReaderContent each-loop record. The live discovery already reported both as coverage.stale. Removed their two ledger/checkpoint entries; added no binding or exception. The stale-rule count is now 5, so its ceiling falls from 6 to 5 and the retained total ceiling falls from 22,494 to 22,493 under the shrink rule. Current ledger: 22,540. It remains 47 above that total ceiling. Performance guard regressions remain 140/140 passing. First alternating release Search pair: neither production nor merged lost the second User's hit. Both reported Unicode upload-marker misses. Four pairs remain. The first one-minute Quick Look run reached 30 cycles before I stopped it to keep one browser at a time. It is exploratory output only. The final Quick Look comparisons keep the original 30-minute navigation, 100-cycle target and 2,250-second runner deadline, with opt-in wait-boundary logging. Existing assertions are unchanged.
Author
Owner

The first Rust gate attempt passed cargo fmt and calternal-auth clippy, then stopped before tests could execute. Shared sccache used a temporary root that another job deleted. Verbatim error:

error: error writing dependencies to `/home/kayg/Developer/calternal-wt/bulkwrite-1393/target/tmp/sccacheBp7ZEO/deps.d`: No such file or directory (os error 2)

The same missing-root error prevented subsequent Rust gates from running. Retained the logs in artifacts/m35btriage/gates-infrastructure-attempt/. The job now sets RUSTC_WRAPPER='' for the failed commands only. CARGO_TARGET_DIR stays at the assigned value; TMPDIR stays in this worktree. The shared daemon and the other worktree are unchanged. This is a verification infrastructure failure, not a test assertion result. The failed commands are being retried; passed format and Auth clippy are not repeated.

Two completed Search pairs: second-User hit misses remain 0/2 on production and 0/2 on merged. Unicode marker failures occur on both builds. Three pairs remain.

The first Rust gate attempt passed cargo fmt and calternal-auth clippy, then stopped before tests could execute. Shared sccache used a temporary root that another job deleted. Verbatim error: ``` error: error writing dependencies to `/home/kayg/Developer/calternal-wt/bulkwrite-1393/target/tmp/sccacheBp7ZEO/deps.d`: No such file or directory (os error 2) ``` The same missing-root error prevented subsequent Rust gates from running. Retained the logs in artifacts/m35btriage/gates-infrastructure-attempt/. The job now sets RUSTC_WRAPPER='' for the failed commands only. CARGO_TARGET_DIR stays at the assigned value; TMPDIR stays in this worktree. The shared daemon and the other worktree are unchanged. This is a verification infrastructure failure, not a test assertion result. The failed commands are being retried; passed format and Auth clippy are not repeated. Two completed Search pairs: second-User hit misses remain 0/2 on production and 0/2 on merged. Unicode marker failures occur on both builds. Three pairs remain.
Author
Owner

Focused Search comparison complete (#1479): five runs per exact release build, alternating production cc1af3c12 and merged 16250888d application code. Original overflow barriers and four SIGKILL/restart phases are unchanged. Second User committed-hit loss: production 0/5, merged 0/5. The original one-off loss is not reproduced; this bounded sample gives no merged-only failure to bisect and does not prove a timing cause. Keep this issue open for the original loss.

The whole Search probe is not green: both builds fail Unicode checks in 5/5 runs. Exact findings and per-run comparison are retained in artifacts/m35btriage/search-summary.json and search-{prod,merged}-{1..5}.log. The four Search result-matching unit tests pass in each run. Separate the pre-existing Unicode result from the unreproduced second-User loss. No Search application code or assertion changed.

Focused Search comparison complete (#1479): five runs per exact release build, alternating production cc1af3c12 and merged 16250888d application code. Original overflow barriers and four SIGKILL/restart phases are unchanged. Second User committed-hit loss: production 0/5, merged 0/5. The original one-off loss is not reproduced; this bounded sample gives no merged-only failure to bisect and does not prove a timing cause. Keep this issue open for the original loss. The whole Search probe is not green: both builds fail Unicode checks in 5/5 runs. Exact findings and per-run comparison are retained in artifacts/m35btriage/search-summary.json and search-{prod,merged}-{1..5}.log. The four Search result-matching unit tests pass in each run. Separate the pre-existing Unicode result from the unreproduced second-User loss. No Search application code or assertion changed.
Author
Owner

Final source/pin verification has started. The full web check confirms the remaining blocker after 36 justified removals (34 unchanged-call proofs plus two obsolete records). No ceiling was raised; the stale ceiling and total ceiling shrink by one. Exact output:

perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16579 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22540 exceptions; ratchet total is 22493
svelte-check found 0 errors and 3 warnings in 1 file
error: script "check" exited with code 1

Ledger 22,540; ceiling 22,493; excess 47. Active per-rule debt is listed in docs/perf/merge35b-triage.md. Existing Search application code is unchanged. Comparison evidence: 0/5 committed-hit losses on production and merged, Unicode misses 5/5 on both; #1482 records the bounded result. Final Rust, web tests, editor tests, XUser and other production comparisons are running.

Final source/pin verification has started. The full web check confirms the remaining blocker after 36 justified removals (34 unchanged-call proofs plus two obsolete records). No ceiling was raised; the stale ceiling and total ceiling shrink by one. Exact output: ```text perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16579 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22540 exceptions; ratchet total is 22493 svelte-check found 0 errors and 3 warnings in 1 file error: script "check" exited with code 1 ``` Ledger 22,540; ceiling 22,493; excess 47. Active per-rule debt is listed in docs/perf/merge35b-triage.md. Existing Search application code is unchanged. Comparison evidence: 0/5 committed-hit losses on production and merged, Unicode misses 5/5 on both; #1482 records the bounded result. Final Rust, web tests, editor tests, XUser and other production comparisons are running.
Author
Owner

Final web and editor tests passed. Web check fails only at the retained performance ratchet (22,540 / 22,493); Svelte check has 0 errors and 3 warnings. Output verbatim:

bun run check exit=1
bun run test --maxWorkers=2 exit=0
editor bun run test --maxWorkers=2 exit=0
 Test Files  305 passed (305)
      Tests  2209 passed (2209)
   Duration  443.85s (transform 29%, environment 25%, import 23%, tests 17%, setup 5%)
 Test Files  26 passed (26)
      Tests  509 passed (509)
   Duration  38.61s (transform 7.21s, setup 523ms, import 17.31s, tests 18.62s, environment 33.32s)

The web command also passed the 140 performance-guard regression tests, 8 performance-source tests and design-rule tests. Rust and the serialized real-server comparisons continue. No failed expectation, ceiling or deadline was weakened.

Final web and editor tests passed. Web check fails only at the retained performance ratchet (22,540 / 22,493); Svelte check has 0 errors and 3 warnings. Output verbatim: ```text bun run check exit=1 bun run test --maxWorkers=2 exit=0 editor bun run test --maxWorkers=2 exit=0 Test Files 305 passed (305) Tests 2209 passed (2209) Duration 443.85s (transform 29%, environment 25%, import 23%, tests 17%, setup 5%) Test Files 26 passed (26) Tests 509 passed (509) Duration 38.61s (transform 7.21s, setup 523ms, import 17.31s, tests 18.62s, environment 33.32s) ``` The web command also passed the 140 performance-guard regression tests, 8 performance-source tests and design-rule tests. Rust and the serialized real-server comparisons continue. No failed expectation, ceiling or deadline was weakened.
Author
Owner

The first full production comparison on cc1af3c12 reproduces the same deadline symptom: exit 124 at the unchanged 2,250-second runner limit, after the 30-minute navigation phase, while waiting for Quick Look's level-2 heading. Last heading wait: cycle 26; last visible heading: cycle 25; last complete ten-cycle batch: 20. Cycle 20's heading is visible and the run continues beyond it. No overall 100-cycle or heap-growth pass is claimed.

This is production evidence for the runner-budget symptom, not evidence of a new server crash. The remaining production and merged runs retain the full original conditions and are pending. Logs: artifacts/m35btriage/soak-prod-1.log and ui-status.txt. Opt-in trace logging changes no assertion or deadline (#1479).

The first full production comparison on cc1af3c12 reproduces the same deadline symptom: exit 124 at the unchanged 2,250-second runner limit, after the 30-minute navigation phase, while waiting for Quick Look's level-2 heading. Last heading wait: cycle 26; last visible heading: cycle 25; last complete ten-cycle batch: 20. Cycle 20's heading is visible and the run continues beyond it. No overall 100-cycle or heap-growth pass is claimed. This is production evidence for the runner-budget symptom, not evidence of a new server crash. The remaining production and merged runs retain the full original conditions and are pending. Logs: artifacts/m35btriage/soak-prod-1.log and ui-status.txt. Opt-in trace logging changes no assertion or deadline (#1479).
Author
Owner

Final Rust/web/editor gate commands are complete. All 12 crate clippy commands pass. Tests pass for the other 11 crates; server unit tests and private-Index permissions pass. The sole failing test target is deterministic_performance_guards, which reports the retained 22,540 / 22,493 ratchet blocker. Web check fails at the same ratchet. Full web and editor tests pass. No product assertion, ceiling or waiver changed. The XUser retry and remaining production comparisons are still pending.

Gate output excerpts (#1479)

These excerpts retain the command statuses and test summaries verbatim.
Full logs remain in artifacts/m35btriage/gates/.

cargo fmt --check exit=0
cargo clippy -p calternal-auth --all-targets -- -D warnings exit=0
cargo test -p calternal-auth -- --test-threads=4 exit=0
cargo clippy -p calternal-collab --all-targets -- -D warnings exit=0
cargo test -p calternal-collab -- --test-threads=4 exit=0
cargo clippy -p calternal-fs --all-targets -- -D warnings exit=0
cargo test -p calternal-fs -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-calendar --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-calendar -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-files --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-files -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-mail -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-money --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-money -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-notes -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-notifications --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-notifications -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-photos --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-photos -- --test-threads=4 exit=0
cargo clippy -p calternal-server --all-targets -- -D warnings exit=0
cargo test -p calternal-server -- --test-threads=4 exit=101
cargo test -p calternal-server --test private_index_permissions -- --test-threads=4 exit=0
bun run check exit=1
bun run test --maxWorkers=2 exit=0
editor bun run test --maxWorkers=2 exit=0

calternal-auth

test result: ok. 137 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 81.82s

calternal-collab

test result: ok. 141 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 171.92s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.56s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.43s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.63s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.29s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.84s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.93s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.87s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.96s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.47s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.39s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.86s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 30.96s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 17.98s

calternal-fs

test result: ok. 99 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 21.55s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s
test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 203.78s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

calternal-plugin

test result: ok. 63 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.54s

calternal-plugin-calendar

test result: ok. 106 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 27.67s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s

calternal-plugin-files

test result: ok. 268 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 207.39s

calternal-plugin-mail

test result: ok. 136 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 20.22s

calternal-plugin-money

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 126 filtered out; finished in 32.54s
test result: ok. 125 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 98.55s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 6.15s

calternal-plugin-notes

test result: ok. 324 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 296.26s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s

calternal-plugin-notifications

test result: ok. 45 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s

calternal-plugin-photos

test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 9.70s

calternal-server

test result: ok. 274 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 193.19s
perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16579 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22540 exceptions; ratchet total is 22493
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.62s

Web

Ran 140 tests in 0.079s
OK
 8 pass
 0 fail
 Test Files  305 passed (305)
      Tests  2209 passed (2209)
   Duration  443.85s (transform 29%, environment 25%, import 23%, tests 17%, setup 5%)

Editor

 Test Files  26 passed (26)
      Tests  509 passed (509)
   Duration  38.61s (transform 7.21s, setup 523ms, import 17.31s, tests 18.62s, environment 33.32s)

Remaining server permissions target

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s
Final Rust/web/editor gate commands are complete. All 12 crate clippy commands pass. Tests pass for the other 11 crates; server unit tests and private-Index permissions pass. The sole failing test target is deterministic_performance_guards, which reports the retained 22,540 / 22,493 ratchet blocker. Web check fails at the same ratchet. Full web and editor tests pass. No product assertion, ceiling or waiver changed. The XUser retry and remaining production comparisons are still pending. # Gate output excerpts (#1479) These excerpts retain the command statuses and test summaries verbatim. Full logs remain in artifacts/m35btriage/gates/. ```text cargo fmt --check exit=0 cargo clippy -p calternal-auth --all-targets -- -D warnings exit=0 cargo test -p calternal-auth -- --test-threads=4 exit=0 cargo clippy -p calternal-collab --all-targets -- -D warnings exit=0 cargo test -p calternal-collab -- --test-threads=4 exit=0 cargo clippy -p calternal-fs --all-targets -- -D warnings exit=0 cargo test -p calternal-fs -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-calendar --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-calendar -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-files --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-files -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-mail -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-money --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-money -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-notes -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-notifications --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-notifications -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-photos --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-photos -- --test-threads=4 exit=0 cargo clippy -p calternal-server --all-targets -- -D warnings exit=0 cargo test -p calternal-server -- --test-threads=4 exit=101 cargo test -p calternal-server --test private_index_permissions -- --test-threads=4 exit=0 ``` ```text bun run check exit=1 bun run test --maxWorkers=2 exit=0 editor bun run test --maxWorkers=2 exit=0 ``` ## calternal-auth ```text test result: ok. 137 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 81.82s ``` ## calternal-collab ```text test result: ok. 141 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 171.92s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.56s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.43s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.63s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.29s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.84s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.93s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.87s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.96s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.47s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.39s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.86s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 30.96s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 17.98s ``` ## calternal-fs ```text test result: ok. 99 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 21.55s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 203.78s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s ``` ## calternal-plugin ```text test result: ok. 63 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.54s ``` ## calternal-plugin-calendar ```text test result: ok. 106 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 27.67s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s ``` ## calternal-plugin-files ```text test result: ok. 268 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 207.39s ``` ## calternal-plugin-mail ```text test result: ok. 136 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 20.22s ``` ## calternal-plugin-money ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 126 filtered out; finished in 32.54s test result: ok. 125 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 98.55s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 6.15s ``` ## calternal-plugin-notes ```text test result: ok. 324 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 296.26s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s ``` ## calternal-plugin-notifications ```text test result: ok. 45 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s ``` ## calternal-plugin-photos ```text test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 9.70s ``` ## calternal-server ```text test result: ok. 274 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 193.19s perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16579 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22540 exceptions; ratchet total is 22493 test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.62s ``` ## Web ```text Ran 140 tests in 0.079s OK 8 pass 0 fail Test Files 305 passed (305) Tests 2209 passed (2209) Duration 443.85s (transform 29%, environment 25%, import 23%, tests 17%, setup 5%) ``` ## Editor ```text Test Files 26 passed (26) Tests 509 passed (509) Duration 38.61s (transform 7.21s, setup 523ms, import 17.31s, tests 18.62s, environment 33.32s) ``` ## Remaining server permissions target ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s ```
Author
Owner

The first full pair reproduces the original runner-budget finding on both releases. Both run the 30-minute navigation phase, target all 100 cycles and retain the 2,250-second deadline. Production exits 124 with the last complete ten-cycle batch at 20 (last heading visible 25, next heading wait 26). Merged exits 124 with the last complete batch at 40; its interrupted wait is for the Quick Look close button, not the original cycle-20 heading. Both runs show cycle 20's heading and continue beyond it. No completed 100-cycle or final heap-growth result is claimed.

This pair gives no merged-only stall at cycle 20. These are local shared-host deadline observations, not controlled GPU throughput measurements. The second pair remains scheduled. Evidence: artifacts/m35btriage/soak-{prod,merged}-1.log and comparison-summary.json. All original assertions and deadlines remain unchanged.

The first full pair reproduces the original runner-budget finding on both releases. Both run the 30-minute navigation phase, target all 100 cycles and retain the 2,250-second deadline. Production exits 124 with the last complete ten-cycle batch at 20 (last heading visible 25, next heading wait 26). Merged exits 124 with the last complete batch at 40; its interrupted wait is for the Quick Look close button, not the original cycle-20 heading. Both runs show cycle 20's heading and continue beyond it. No completed 100-cycle or final heap-growth result is claimed. This pair gives no merged-only stall at cycle 20. These are local shared-host deadline observations, not controlled GPU throughput measurements. The second pair remains scheduled. Evidence: artifacts/m35btriage/soak-{prod,merged}-1.log and comparison-summary.json. All original assertions and deadlines remain unchanged.
Author
Owner

The complete XUser matrix passes. The first attempt stopped at the required CLI Search proof because the calternal binary was absent from this job's target. Built the unchanged CLI, selected its immutable copy with ADVERSARIAL_CLI_BIN, and repeated the incomplete matrix with fresh fixtures. All original assertions remain unchanged. The mandatory bounded download phase has zero findings and zero SLOW cases. Output verbatim:

XUSER_MATRIX_ONLY=1 tests/adversarial/run-split.sh exit=0
Cross-User classification gate: 435 operations classified
Generated entry point classification: 1224 tools classified
Admin coverage: 53 reviewed operations; contract and Rust guards agree
==== ROUND 2 FINDINGS 0
==== ROUND 2 SLOW 0
Two-User OpenAPI matrix: 435 operations classified; 226 operations replayed; 1053 A-ID vs missing-ID comparisons across B, C, D and anonymous; 16 #1402 non-private identifier routes reviewed by their own authority class; median absolute timing delta 0.4 ms
Job/Mail/quota ownership checks: 127 comparisons; 0 denial failures
Revoked Share timing control: identical HTTP 404 profiles; median delta 1.1 ms across 12 alternating pairs

All requested Rust/web/editor gate commands and XUser are now complete. The retained static ratchet remains the blocker. Remaining second production comparisons continue.

The complete XUser matrix passes. The first attempt stopped at the required CLI Search proof because the calternal binary was absent from this job's target. Built the unchanged CLI, selected its immutable copy with ADVERSARIAL_CLI_BIN, and repeated the incomplete matrix with fresh fixtures. All original assertions remain unchanged. The mandatory bounded download phase has zero findings and zero SLOW cases. Output verbatim: ```text XUSER_MATRIX_ONLY=1 tests/adversarial/run-split.sh exit=0 Cross-User classification gate: 435 operations classified Generated entry point classification: 1224 tools classified Admin coverage: 53 reviewed operations; contract and Rust guards agree ==== ROUND 2 FINDINGS 0 ==== ROUND 2 SLOW 0 Two-User OpenAPI matrix: 435 operations classified; 226 operations replayed; 1053 A-ID vs missing-ID comparisons across B, C, D and anonymous; 16 #1402 non-private identifier routes reviewed by their own authority class; median absolute timing delta 0.4 ms Job/Mail/quota ownership checks: 127 comparisons; 0 denial failures Revoked Share timing control: identical HTTP 404 profiles; median delta 1.1 ms across 12 alternating pairs ``` All requested Rust/web/editor gate commands and XUser are now complete. The retained static ratchet remains the blocker. Remaining second production comparisons continue.
Author
Owner

Merge35b triage (#1479), application head 16250888d, comparison against production cc1af3c12. The first merged real TLS Dovecot run backfills all 2,000 fixture Messages, then reaches the end of UI pagination with 1,998 Threads instead of the unchanged expected 1,999. data-blaze-has-next is false. The original assertion fails at mail-sync-613.mjs:147. This is distinct from #1488's real-wheel timeout.

The first production run fails earlier at the unchanged 15-second real-wheel wait (original line 155). It does not establish the end-of-list count. Production classification of the one-Thread shortfall is pending; no data deletion or corruption is proved. Keep the original expected count.

Added bounded, read-only metadata counts after observed failures, for both second runs. The diagnostic follows at most 60 dependent cursor pages and logs counts only, then preserves the original assertion or error. It distinguishes API completeness from UI pagination. It logs no Message content or credentials. No product code changed.

Evidence: artifacts/m35btriage/mail-merged-1.log, mail-prod-1.log. Both binaries use the same existing mail-test-provider feature, required for the isolated localhost TLS fixture. Final comparison evidence will follow on #1479 and this issue. Do not close this issue.

Merge35b triage (#1479), application head 16250888d, comparison against production cc1af3c12. The first merged real TLS Dovecot run backfills all 2,000 fixture Messages, then reaches the end of UI pagination with 1,998 Threads instead of the unchanged expected 1,999. `data-blaze-has-next` is false. The original assertion fails at mail-sync-613.mjs:147. This is distinct from #1488's real-wheel timeout. The first production run fails earlier at the unchanged 15-second real-wheel wait (original line 155). It does not establish the end-of-list count. Production classification of the one-Thread shortfall is pending; no data deletion or corruption is proved. Keep the original expected count. Added bounded, read-only metadata counts after observed failures, for both second runs. The diagnostic follows at most 60 dependent cursor pages and logs counts only, then preserves the original assertion or error. It distinguishes API completeness from UI pagination. It logs no Message content or credentials. No product code changed. Evidence: artifacts/m35btriage/mail-merged-1.log, mail-prod-1.log. Both binaries use the same existing mail-test-provider feature, required for the isolated localhost TLS fixture. Final comparison evidence will follow on #1479 and this issue. Do not close this issue.
Author
Owner

m35btriage final report (#1479)

NOT READY: retained performance ratchet fails (22,540 exceptions, ceiling 22,493; +47).

Head: 624eaf6fee8993e643076e387880616276813568 on job/merge35b.

Built and files

No product feature or runtime code changed. Added the missing focused Search chaos selector in tests/adversarial/run.sh, opt-in wait tracing in apps/web/e2e/browser-soak.mjs, and failure-only metadata counts in apps/web/e2e/mail-sync-613.mjs. Refreshed 34 existing exact call-proof hashes and removed two obsolete records in contracts/perf/{registry,exceptions,adoption-1058,ratchet}.json. Recorded evidence in docs/perf/merge35b-triage.md. No existing assertions, expected counts or deadlines changed; no ceiling raise or new waiver.

Static attribution

Production cc1af3c12: 22,544. Initial merge 16250888d: 22,576; original ceiling 22,494. Branch deltas: tick-1446 -48, exmove-1333 -2, phototags-1370 +13, mailmorph-1368 +2, mailhtml-1372 +7, directory-1199 +71, contract reconciliation -11. Net +32 vs production; inherited ceiling was already 50 below production, hence original +82. The exact-proof/stale-record audit removes 36. Removing a stale rule record also shrinks its ceiling by one: final 22,540 / 22,493. Remaining overages are active debt, not duplicate pins.

Search comparison

Five alternating production/merged release pairs completed. The second User's committed Search hit was retained in all five runs on EACH release (0/5 losses vs 0/5). Unicode checks failed on both builds in all five runs. No merged-only hit-loss sample exists to drive the conditional bisect. The original loss is not reproduced; a timing-only cause is NOT proved. Keep #1482 open.

UI classification (two runs per release)

Finding Production cc1af3c12 Merged 16250888d Classification
Cached editor while /auth/me pending Same 20-second timeout 2/2 Same timeout 2/2 Pre-existing, #1487, nonblocking
Real-wheel Mail pagination Timeout 2/2 Timeout 1/2; count assertion 1/2 Pre-existing timeout, #1488, nonblocking
Mail count shortfall Second-run API: 1,998 unique Messages/Threads, no cursor Same API result Pre-existing shortfall, #1494, nonblocking; original expected 1,999 unchanged
Quick Look cycle-20 heading Passed 2/2; full runner deadline 2/2 Passed 2/2; full runner deadline 2/2 Deadline reproduces on production, #1490, nonblocking
Calendar #1362 Passed 2/2 Passed 2/2 Original timing failure not reproduced, #1489, nonblocking

All sixteen comparison runs completed. No full 100-cycle soak or final heap-growth pass is claimed. All four soaks hit the unchanged runner budget; production's last visible Quick Look headings were 25/61, merged 45/66. Calendar first_new_range_ms and blank_frames are zero in all four runs; requests started production 28/13, merged 12/15. On the second Mail pair, both UI lists stop at 250 with hasNext=true while the bounded API reads 40 pages totaling 1,998 unique Messages/Threads. Thus a production wheel failure can hide the separate pre-existing API shortfall. Each finding remains open; #1485 remains untouched.

Known gaps

Static active debt remains 47 over the total ceiling; this alone blocks readiness. No failing merged-only Search hit-loss sample was obtained, so no owning commit was identified or regression fix claimed. Unicode Search failures are present on both releases. Mail's underlying shortfall cause remains open; there is no evidence here of Message deletion. No source behavior fix is claimed for pre-existing failures.

Decisions and limits

The named focused Search environment flag did not exist, so the first attempt ran unrelated probes. That interrupted attempt is excluded; the implemented selector invokes the unchanged Search phase. Each comparison uses release binaries with its own embedded assets; Mail uses the identical test-provider feature for local TLS on both source revisions. Calendar's JSON client_build_id reads the local checkout file; raw JSON is retained and a separate real HTTP byte-hash check confirms production serves the cc1af3c12 entry asset. All timing results are local shared-host measurements, not controlled Mac GPU performance claims. Do not infer Mail data deletion from a list-count assertion.

The full web/Rust/editor gates ran once after the authorized origin/dev merge (already up to date). Only unrun targets or an incomplete fixture attempt were resumed. A later test-only Mail diagnostic passes syntax validation and runs in the final pair; the original 28 assertion lines are unchanged. No product source changed after these gates.

UX gaps

No UI feature added. Pre-existing attachment Save to Files hit target #1485 left unchanged as directed. Other UX gaps are tracked in the findings below.

Verbatim gate output

Gate output excerpts (#1479)

These excerpts retain the command statuses and test summaries verbatim.
Full logs remain in artifacts/m35btriage/gates/.

cargo fmt --check exit=0
cargo clippy -p calternal-auth --all-targets -- -D warnings exit=0
cargo test -p calternal-auth -- --test-threads=4 exit=0
cargo clippy -p calternal-collab --all-targets -- -D warnings exit=0
cargo test -p calternal-collab -- --test-threads=4 exit=0
cargo clippy -p calternal-fs --all-targets -- -D warnings exit=0
cargo test -p calternal-fs -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-calendar --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-calendar -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-files --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-files -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-mail -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-money --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-money -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-notes -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-notifications --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-notifications -- --test-threads=4 exit=0
cargo clippy -p calternal-plugin-photos --all-targets -- -D warnings exit=0
cargo test -p calternal-plugin-photos -- --test-threads=4 exit=0
cargo clippy -p calternal-server --all-targets -- -D warnings exit=0
cargo test -p calternal-server -- --test-threads=4 exit=101
cargo test -p calternal-server --test private_index_permissions -- --test-threads=4 exit=0
bun run check exit=1
bun run test --maxWorkers=2 exit=0
editor bun run test --maxWorkers=2 exit=0

calternal-auth

test result: ok. 137 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 81.82s

calternal-collab

test result: ok. 141 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 171.92s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.56s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.43s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.63s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.29s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.84s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.93s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.87s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.96s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.47s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.39s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.86s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 30.96s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 17.98s

calternal-fs

test result: ok. 99 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 21.55s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s
test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 203.78s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

calternal-plugin

test result: ok. 63 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.54s

calternal-plugin-calendar

test result: ok. 106 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 27.67s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s

calternal-plugin-files

test result: ok. 268 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 207.39s

calternal-plugin-mail

test result: ok. 136 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 20.22s

calternal-plugin-money

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 126 filtered out; finished in 32.54s
test result: ok. 125 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 98.55s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 6.15s

calternal-plugin-notes

test result: ok. 324 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 296.26s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s

calternal-plugin-notifications

test result: ok. 45 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s

calternal-plugin-photos

test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 9.70s

calternal-server

test result: ok. 274 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 193.19s
perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16579 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22540 exceptions; ratchet total is 22493
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.62s

Web

Ran 140 tests in 0.079s
OK
 8 pass
 0 fail
 Test Files  305 passed (305)
      Tests  2209 passed (2209)
   Duration  443.85s (transform 29%, environment 25%, import 23%, tests 17%, setup 5%)

Editor

 Test Files  26 passed (26)
      Tests  509 passed (509)
   Duration  38.61s (transform 7.21s, setup 523ms, import 17.31s, tests 18.62s, environment 33.32s)

Remaining server permissions target

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s

XUser

XUSER_MATRIX_ONLY=1 tests/adversarial/run-split.sh exit=0
Cross-User classification gate: 435 operations classified
Generated entry point classification: 1224 tools classified
Admin coverage: 53 reviewed operations; contract and Rust guards agree
==== ROUND 2 FINDINGS 0
==== ROUND 2 SLOW 0
Two-User OpenAPI matrix: 435 operations classified; 226 operations replayed; 1053 A-ID vs missing-ID comparisons across B, C, D and anonymous; 16 #1402 non-private identifier routes reviewed by their own authority class; median absolute timing delta 0.4 ms
Job/Mail/quota ownership checks: 127 comparisons; 0 denial failures
Revoked Share timing control: identical HTTP 404 profiles; median delta 1.1 ms across 12 alternating pairs
# m35btriage final report (#1479) NOT READY: retained performance ratchet fails (22,540 exceptions, ceiling 22,493; +47). Head: `624eaf6fee8993e643076e387880616276813568` on `job/merge35b`. ## Built and files No product feature or runtime code changed. Added the missing focused Search chaos selector in tests/adversarial/run.sh, opt-in wait tracing in apps/web/e2e/browser-soak.mjs, and failure-only metadata counts in apps/web/e2e/mail-sync-613.mjs. Refreshed 34 existing exact call-proof hashes and removed two obsolete records in contracts/perf/{registry,exceptions,adoption-1058,ratchet}.json. Recorded evidence in docs/perf/merge35b-triage.md. No existing assertions, expected counts or deadlines changed; no ceiling raise or new waiver. ## Static attribution Production cc1af3c12: 22,544. Initial merge 16250888d: 22,576; original ceiling 22,494. Branch deltas: tick-1446 -48, exmove-1333 -2, phototags-1370 +13, mailmorph-1368 +2, mailhtml-1372 +7, directory-1199 +71, contract reconciliation -11. Net +32 vs production; inherited ceiling was already 50 below production, hence original +82. The exact-proof/stale-record audit removes 36. Removing a stale rule record also shrinks its ceiling by one: final 22,540 / 22,493. Remaining overages are active debt, not duplicate pins. ## Search comparison Five alternating production/merged release pairs completed. The second User's committed Search hit was retained in all five runs on EACH release (0/5 losses vs 0/5). Unicode checks failed on both builds in all five runs. No merged-only hit-loss sample exists to drive the conditional bisect. The original loss is not reproduced; a timing-only cause is NOT proved. Keep #1482 open. ## UI classification (two runs per release) | Finding | Production cc1af3c12 | Merged 16250888d | Classification | | --- | --- | --- | --- | | Cached editor while /auth/me pending | Same 20-second timeout 2/2 | Same timeout 2/2 | Pre-existing, #1487, nonblocking | | Real-wheel Mail pagination | Timeout 2/2 | Timeout 1/2; count assertion 1/2 | Pre-existing timeout, #1488, nonblocking | | Mail count shortfall | Second-run API: 1,998 unique Messages/Threads, no cursor | Same API result | Pre-existing shortfall, #1494, nonblocking; original expected 1,999 unchanged | | Quick Look cycle-20 heading | Passed 2/2; full runner deadline 2/2 | Passed 2/2; full runner deadline 2/2 | Deadline reproduces on production, #1490, nonblocking | | Calendar #1362 | Passed 2/2 | Passed 2/2 | Original timing failure not reproduced, #1489, nonblocking | All sixteen comparison runs completed. No full 100-cycle soak or final heap-growth pass is claimed. All four soaks hit the unchanged runner budget; production's last visible Quick Look headings were 25/61, merged 45/66. Calendar first_new_range_ms and blank_frames are zero in all four runs; requests started production 28/13, merged 12/15. On the second Mail pair, both UI lists stop at 250 with hasNext=true while the bounded API reads 40 pages totaling 1,998 unique Messages/Threads. Thus a production wheel failure can hide the separate pre-existing API shortfall. Each finding remains open; #1485 remains untouched. ## Known gaps Static active debt remains 47 over the total ceiling; this alone blocks readiness. No failing merged-only Search hit-loss sample was obtained, so no owning commit was identified or regression fix claimed. Unicode Search failures are present on both releases. Mail's underlying shortfall cause remains open; there is no evidence here of Message deletion. No source behavior fix is claimed for pre-existing failures. ## Decisions and limits The named focused Search environment flag did not exist, so the first attempt ran unrelated probes. That interrupted attempt is excluded; the implemented selector invokes the unchanged Search phase. Each comparison uses release binaries with its own embedded assets; Mail uses the identical test-provider feature for local TLS on both source revisions. Calendar's JSON client_build_id reads the local checkout file; raw JSON is retained and a separate real HTTP byte-hash check confirms production serves the cc1af3c12 entry asset. All timing results are local shared-host measurements, not controlled Mac GPU performance claims. Do not infer Mail data deletion from a list-count assertion. The full web/Rust/editor gates ran once after the authorized origin/dev merge (already up to date). Only unrun targets or an incomplete fixture attempt were resumed. A later test-only Mail diagnostic passes syntax validation and runs in the final pair; the original 28 assertion lines are unchanged. No product source changed after these gates. ## UX gaps No UI feature added. Pre-existing attachment Save to Files hit target #1485 left unchanged as directed. Other UX gaps are tracked in the findings below. ## Verbatim gate output # Gate output excerpts (#1479) These excerpts retain the command statuses and test summaries verbatim. Full logs remain in artifacts/m35btriage/gates/. ```text cargo fmt --check exit=0 cargo clippy -p calternal-auth --all-targets -- -D warnings exit=0 cargo test -p calternal-auth -- --test-threads=4 exit=0 cargo clippy -p calternal-collab --all-targets -- -D warnings exit=0 cargo test -p calternal-collab -- --test-threads=4 exit=0 cargo clippy -p calternal-fs --all-targets -- -D warnings exit=0 cargo test -p calternal-fs -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-calendar --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-calendar -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-files --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-files -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-mail -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-money --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-money -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-notes -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-notifications --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-notifications -- --test-threads=4 exit=0 cargo clippy -p calternal-plugin-photos --all-targets -- -D warnings exit=0 cargo test -p calternal-plugin-photos -- --test-threads=4 exit=0 cargo clippy -p calternal-server --all-targets -- -D warnings exit=0 cargo test -p calternal-server -- --test-threads=4 exit=101 cargo test -p calternal-server --test private_index_permissions -- --test-threads=4 exit=0 ``` ```text bun run check exit=1 bun run test --maxWorkers=2 exit=0 editor bun run test --maxWorkers=2 exit=0 ``` ## calternal-auth ```text test result: ok. 137 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 81.82s ``` ## calternal-collab ```text test result: ok. 141 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 171.92s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.56s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.43s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.63s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.29s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.84s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.93s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.87s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.96s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.47s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.39s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.86s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 30.96s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 17.98s ``` ## calternal-fs ```text test result: ok. 99 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 21.55s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 203.78s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s ``` ## calternal-plugin ```text test result: ok. 63 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.54s ``` ## calternal-plugin-calendar ```text test result: ok. 106 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 27.67s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s ``` ## calternal-plugin-files ```text test result: ok. 268 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 207.39s ``` ## calternal-plugin-mail ```text test result: ok. 136 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 20.22s ``` ## calternal-plugin-money ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 126 filtered out; finished in 32.54s test result: ok. 125 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 98.55s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 6.15s ``` ## calternal-plugin-notes ```text test result: ok. 324 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 296.26s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s ``` ## calternal-plugin-notifications ```text test result: ok. 45 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.20s ``` ## calternal-plugin-photos ```text test result: ok. 60 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 9.70s ``` ## calternal-server ```text test result: ok. 274 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 193.19s perf-lint: INVALID: exception ratchet: cache.raw-read: 387 exceptions exceed the ratchet ceiling 385; fix the new violation instead; coverage.operations: 36 exceptions exceed the ratchet ceiling 31; fix the new violation instead; coverage.routers: 33 exceptions exceed the ratchet ceiling 28; fix the new violation instead; coverage.surfaces: 7 exceptions exceed the ratchet ceiling 5; fix the new violation instead; io.unresolved-call: 16579 exceptions exceed the ratchet ceiling 16541; fix the new violation instead; sql.limit: 89 exceptions exceed the ratchet ceiling 85; fix the new violation instead; total: ledger has 22540 exceptions; ratchet total is 22493 test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.62s ``` ## Web ```text Ran 140 tests in 0.079s OK 8 pass 0 fail Test Files 305 passed (305) Tests 2209 passed (2209) Duration 443.85s (transform 29%, environment 25%, import 23%, tests 17%, setup 5%) ``` ## Editor ```text Test Files 26 passed (26) Tests 509 passed (509) Duration 38.61s (transform 7.21s, setup 523ms, import 17.31s, tests 18.62s, environment 33.32s) ``` ## Remaining server permissions target ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s ``` ## XUser ```text XUSER_MATRIX_ONLY=1 tests/adversarial/run-split.sh exit=0 Cross-User classification gate: 435 operations classified Generated entry point classification: 1224 tools classified Admin coverage: 53 reviewed operations; contract and Rust guards agree ==== ROUND 2 FINDINGS 0 ==== ROUND 2 SLOW 0 Two-User OpenAPI matrix: 435 operations classified; 226 operations replayed; 1053 A-ID vs missing-ID comparisons across B, C, D and anonymous; 16 #1402 non-private identifier routes reviewed by their own authority class; median absolute timing delta 0.4 ms Job/Mail/quota ownership checks: 127 comparisons; 0 denial failures Revoked Share timing control: identical HTTP 404 profiles; median delta 1.1 ms across 12 alternating pairs ```
Author
Owner

Starting m35bratchet on job/merge35b, based on cc1af3c12b68ad26c8403adde1be39c096b9ddea (production base). HEAD is 624eaf6fee8993e643076e387880616276813568. I am auditing each first-parent merge against the perf exception registries, then will fix the covered code and run the requested gates.

Starting m35bratchet on `job/merge35b`, based on `cc1af3c12b68ad26c8403adde1be39c096b9ddea` (production base). HEAD is `624eaf6fee8993e643076e387880616276813568`. I am auditing each first-parent merge against the perf exception registries, then will fix the covered code and run the requested gates.
Author
Owner

First-parent perf exception attribution

Counts compare each merge commit with its first parent. +/- are serialized rows added/removed, so a hash refresh counts as one removal and one addition. The net column is the count change.

Merge exceptions.json + / − (net) adoption-1058.json + / − (net)
#1441 calwrite 0 / 0 (0) 0 / 0 (0)
#1445 xsub 0 / 0 (0) 0 / 0 (0)
#1443 xcancel 0 / 0 (0) 0 / 0 (0)
#1473 authflash 0 / 0 (0) 0 / 0 (0)
#1446/#1447 tick 252 / 300 (−48) 195 / 226 (−31)
#1451 coldnote 0 / 0 (0) 0 / 0 (0)
#1333 exmove 45 / 47 (−2) 0 / 0 (0)
#1430 undo412 30 / 30 (0) 29 / 29 (0)
#1362 calscroll 3 / 3 (0) 3 / 2 (+1)
#1370 phototags 183 / 170 (+13) 183 / 169 (+14)
#1389/#1390 mailrows 48 / 48 (0) 48 / 48 (0)
#1427 readerx 74 / 74 (0) 74 / 74 (0)
#1368 mailmorph 4 / 2 (+2) 4 / 1 (+3)
#1372 mailhtml 52 / 45 (+7) 52 / 28 (+24)
#1363 notifdel 30 / 30 (0) 30 / 30 (0)
#1414 notifrow 24 / 24 (0) 24 / 24 (0)
#1199 directory 288 / 217 (+71) 270 / 134 (+136)
#1431 mdpaste 0 / 0 (0) 0 / 0 (0)
#1459 fix 33 / 33 (0) 33 / 33 (0)
#1460 fix 0 / 0 (0) 0 / 0 (0)
#1457 statusmark 0 / 0 (0) 0 / 0 (0)

The non-merge contract reconciliation commit removed 11 exception rows. I am prioritizing the +71 net from #1199, then will remove at least 47 current exceptions by fixing the covered code without changing the ceilings or adding waivers.

## First-parent perf exception attribution Counts compare each merge commit with its first parent. `+/-` are serialized rows added/removed, so a hash refresh counts as one removal and one addition. The net column is the count change. | Merge | `exceptions.json` + / − (net) | `adoption-1058.json` + / − (net) | |---|---:|---:| | #1441 calwrite | 0 / 0 (0) | 0 / 0 (0) | | #1445 xsub | 0 / 0 (0) | 0 / 0 (0) | | #1443 xcancel | 0 / 0 (0) | 0 / 0 (0) | | #1473 authflash | 0 / 0 (0) | 0 / 0 (0) | | #1446/#1447 tick | 252 / 300 (−48) | 195 / 226 (−31) | | #1451 coldnote | 0 / 0 (0) | 0 / 0 (0) | | #1333 exmove | 45 / 47 (−2) | 0 / 0 (0) | | #1430 undo412 | 30 / 30 (0) | 29 / 29 (0) | | #1362 calscroll | 3 / 3 (0) | 3 / 2 (+1) | | #1370 phototags | 183 / 170 (+13) | 183 / 169 (+14) | | #1389/#1390 mailrows | 48 / 48 (0) | 48 / 48 (0) | | #1427 readerx | 74 / 74 (0) | 74 / 74 (0) | | #1368 mailmorph | 4 / 2 (+2) | 4 / 1 (+3) | | #1372 mailhtml | 52 / 45 (+7) | 52 / 28 (+24) | | #1363 notifdel | 30 / 30 (0) | 30 / 30 (0) | | #1414 notifrow | 24 / 24 (0) | 24 / 24 (0) | | #1199 directory | 288 / 217 (+71) | 270 / 134 (+136) | | #1431 mdpaste | 0 / 0 (0) | 0 / 0 (0) | | #1459 fix | 33 / 33 (0) | 33 / 33 (0) | | #1460 fix | 0 / 0 (0) | 0 / 0 (0) | | #1457 statusmark | 0 / 0 (0) | 0 / 0 (0) | The non-merge contract reconciliation commit removed 11 exception rows. I am prioritizing the +71 net from #1199, then will remove at least 47 current exceptions by fixing the covered code without changing the ceilings or adding waivers.
Author
Owner

Finding from the #1199 Files paths: crates/plugins/files/src/shares.rs::grant_allows fetches matching grants, then calls index::identity_at_path for each row. That helper performs separate upload-intent, pending-namespace and Index reads before checking the filesystem fingerprint. list_virtual and note_share_identity_is_stale repeat identity reads over grant rows. The scanner pins these paths as sql.query-in-loop (including grant_allows and list_virtual); I am replacing the repeated DB reads with one joined snapshot query per route and retaining the fingerprint and pending-operation checks.

Finding from the #1199 Files paths: `crates/plugins/files/src/shares.rs::grant_allows` fetches matching grants, then calls `index::identity_at_path` for each row. That helper performs separate upload-intent, pending-namespace and Index reads before checking the filesystem fingerprint. `list_virtual` and `note_share_identity_is_stale` repeat identity reads over grant rows. The scanner pins these paths as `sql.query-in-loop` (including `grant_allows` and `list_virtual`); I am replacing the repeated DB reads with one joined snapshot query per route and retaining the fingerprint and pending-operation checks.
Author
Owner

The first static pass after the Files identity refactor found 36 existing exact call bindings pinned to the old identity_at_path function hash. With those pins stale, the temporary regenerated ledger counted 285 extra unresolved calls; I restored the generated perf files to the committed baseline. I am updating only proofs whose exact call syntax still exists (or moved into the extracted fingerprint helper), keeping their capability and test references, then I will re-measure the live ledger.

The first static pass after the Files identity refactor found 36 existing exact call bindings pinned to the old `identity_at_path` function hash. With those pins stale, the temporary regenerated ledger counted 285 extra unresolved calls; I restored the generated perf files to the committed baseline. I am updating only proofs whose exact call syntax still exists (or moved into the extracted fingerprint helper), keeping their capability and test references, then I will re-measure the live ledger.
Author
Owner

Finding — share identity checks repeated Index reads per grant. grant_allows fetched grants, then called identity_at_path for each grant; the stale Note check also fetched Index identity per ancestor grant. Both paths now join the Share, Index row and pending-operation flags in one read, then reuse the existing directory-relative fingerprint checks. Existing identity/revoke tests passed; the complete files-plugin suite passed 268 tests with 4 ignored. No assertions changed.

The exception ledger fell from 22,540 to 22,254 (286 fewer). The aggregate ratchet is now 22,254. scripts/perf-lint --check reports 0 violations.

The local share_grant_identity_1479 profile uses 10 matching grants and 100 unrelated grants for the average case, and 100 matching grants among 10,000 unrelated grants for the burst. SQLite statement p50/p95 were 0.168/0.217 ms average and 13.262/21.066 ms burst; process CPU was 339.450/1462.001 ms and RSS was 41,512,960/58,667,008 bytes. The perf VM was held by another job. This profile excludes filesystem fingerprints and server overhead, which remain one identity check per matching grant.

**Finding — share identity checks repeated Index reads per grant.** `grant_allows` fetched grants, then called `identity_at_path` for each grant; the stale Note check also fetched Index identity per ancestor grant. Both paths now join the Share, Index row and pending-operation flags in one read, then reuse the existing directory-relative fingerprint checks. Existing identity/revoke tests passed; the complete files-plugin suite passed 268 tests with 4 ignored. No assertions changed. The exception ledger fell from 22,540 to 22,254 (286 fewer). The aggregate ratchet is now 22,254. `scripts/perf-lint --check` reports 0 violations. The local `share_grant_identity_1479` profile uses 10 matching grants and 100 unrelated grants for the average case, and 100 matching grants among 10,000 unrelated grants for the burst. SQLite statement p50/p95 were 0.168/0.217 ms average and 13.262/21.066 ms burst; process CPU was 339.450/1462.001 ms and RSS was 41,512,960/58,667,008 bytes. The perf VM was held by another job. This profile excludes filesystem fingerprints and server overhead, which remain one identity check per matching grant.
Author
Owner

READY 9dc65437e8

The per-merge attribution table is in my earlier comment. The changes batch Files Index and pending-operation reads for Shared paths and grants, while keeping the existing filesystem identity check for each candidate grant. The static exception total fell from 22,540 to 22,254 (286 fewer); the ratchet was not raised. The final proof refresh changed hashes only and added no exception rows.

Commits:

  • b76c667002c95a6ad2e5ba8baadd15eedc5a2991 Batch live share identity reads
  • 131d6d16a9020ae415b67768ecc1a41c0066f95f Profile batched share grant identity checks
  • 9dc65437e86c74efe92d723f9a99774246e60650 Refresh exact share perf proofs

Performance profile bench/groups-grants.mjs --grant-identity was measured locally because the perf VM was occupied. It measures SQLite only, without filesystem fingerprints or server overhead. Average: 10 matching and 100 unrelated grants, 2,000 queries; p50 0.167746 ms, p95 0.217138 ms, CPU 339.45 ms, RSS 41,512,960 bytes. Burst: 100 matching and 10,000 unrelated grants, 100 queries; p50 13.262413 ms, p95 21.066269 ms, CPU 1,462.001 ms, RSS 58,667,008 bytes. There was no earlier baseline for this profile.

Gate output:

  • cargo fmt --check: exit 0, no output.
  • cargo clippy -p calternal-plugin-files --all-targets -- -D warnings: passed, no diagnostics.
  • cargo test -p calternal-plugin-files: test result: ok. 268 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out in 155.45s.
  • cargo test -p calternal-server --test perf_guards: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 27.24s.
  • bun run check: perf-lint: PASS; 0 violations; 22254 scoped exceptions; Svelte check found 0 errors and 3 existing warnings.
  • bun run test --maxWorkers=2: Test Files 305 passed (305); Tests 2209 passed (2209).
  • cargo build --release -p calternal-server: Finished release profile [optimized] target(s) in 14m 17s.
  • XUSER_MATRIX_ONLY=1 tests/adversarial/run-split.sh: completed with ==== ROUND 2 FINDINGS 0; 226 operations replayed, 1,053 cross-User/anonymous ID comparisons, 0 denial failures. One slow-only fixture cleanup took 14.3s.
  • tests/adversarial/dirrev_1199.py: Defensive review: 90 passed; 0 failed; 90 checks.

Known gap and decision: the joined grant query still has its existing sql.limit exception. It must inspect every matching ancestor grant to preserve access semantics for deeply nested Shares; an arbitrary row cap could deny a valid grant. The exception pins were refreshed to the current exact query hash. No UI changed.

READY 9dc65437e86c74efe92d723f9a99774246e60650 The per-merge attribution table is in my earlier comment. The changes batch Files Index and pending-operation reads for Shared paths and grants, while keeping the existing filesystem identity check for each candidate grant. The static exception total fell from 22,540 to 22,254 (286 fewer); the ratchet was not raised. The final proof refresh changed hashes only and added no exception rows. Commits: - `b76c667002c95a6ad2e5ba8baadd15eedc5a2991` Batch live share identity reads - `131d6d16a9020ae415b67768ecc1a41c0066f95f` Profile batched share grant identity checks - `9dc65437e86c74efe92d723f9a99774246e60650` Refresh exact share perf proofs Performance profile `bench/groups-grants.mjs --grant-identity` was measured locally because the perf VM was occupied. It measures SQLite only, without filesystem fingerprints or server overhead. Average: 10 matching and 100 unrelated grants, 2,000 queries; p50 0.167746 ms, p95 0.217138 ms, CPU 339.45 ms, RSS 41,512,960 bytes. Burst: 100 matching and 10,000 unrelated grants, 100 queries; p50 13.262413 ms, p95 21.066269 ms, CPU 1,462.001 ms, RSS 58,667,008 bytes. There was no earlier baseline for this profile. Gate output: - `cargo fmt --check`: exit 0, no output. - `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings`: passed, no diagnostics. - `cargo test -p calternal-plugin-files`: `test result: ok. 268 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out in 155.45s`. - `cargo test -p calternal-server --test perf_guards`: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 27.24s`. - `bun run check`: `perf-lint: PASS; 0 violations; 22254 scoped exceptions`; Svelte check found 0 errors and 3 existing warnings. - `bun run test --maxWorkers=2`: `Test Files 305 passed (305)`; `Tests 2209 passed (2209)`. - `cargo build --release -p calternal-server`: `Finished `release` profile [optimized] target(s) in 14m 17s`. - `XUSER_MATRIX_ONLY=1 tests/adversarial/run-split.sh`: completed with `==== ROUND 2 FINDINGS 0`; 226 operations replayed, 1,053 cross-User/anonymous ID comparisons, 0 denial failures. One slow-only fixture cleanup took 14.3s. - `tests/adversarial/dirrev_1199.py`: `Defensive review: 90 passed; 0 failed; 90 checks`. Known gap and decision: the joined grant query still has its existing `sql.limit` exception. It must inspect every matching ancestor grant to preserve access semantics for deeply nested Shares; an arbitrary row cap could deny a valid grant. The exception pins were refreshed to the current exact query hash. No UI changed.
Author
Owner

Deployed to calternal.cloud in merge round 35b (build 9dc65437e, live 2026-10-09 ~11:07 IST). Closing.

Deployed to calternal.cloud in merge round 35b (build 9dc65437e, live 2026-10-09 ~11:07 IST). Closing.
kayg closed this issue 2026-10-09 05:37:09 +00:00
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1479
No description provided.