Merge round 39: shared UI controls and setup link checks #1561

Closed
opened 2026-10-10 20:32:17 +00:00 by kayg · 16 comments
Owner

Merge round 39: shared UI controls (rounds 2 and 3) and setup/invite link checks (#1553).

Branches:

  • job/ui-chrome3 35829e1ee (contains job/ui-chrome2 404e18e59): FileCollection widths at 820, PDF icons, Inspector material over bright photos, plain menu shortcuts, QuickLook label and phone sheet chrome, Undo toast above the tray with Notifications open, ModeHeader action edge, shared sidebar long-press menu, compact Pill actions in Notifications, single-line middle ellipsis in public share folders, design-rules offset fix.
  • job/autherr-1553 e81252ef0: field in the Admin add-User 400 error, display-name limit in characters, Voice model job label, setup and invite links checked before the passkey form.

Accept: READY from the merge job, gates green, no new e2e failures against production 4ebeba0b8, perf ratchet not raised, screenshots reviewed by the orchestrator.

Merge round 39: shared UI controls (rounds 2 and 3) and setup/invite link checks (#1553). Branches: - job/ui-chrome3 35829e1ee (contains job/ui-chrome2 404e18e59): FileCollection widths at 820, PDF icons, Inspector material over bright photos, plain menu shortcuts, QuickLook label and phone sheet chrome, Undo toast above the tray with Notifications open, ModeHeader action edge, shared sidebar long-press menu, compact Pill actions in Notifications, single-line middle ellipsis in public share folders, design-rules offset fix. - job/autherr-1553 e81252ef0: `field` in the Admin add-User 400 error, display-name limit in characters, Voice model job label, setup and invite links checked before the passkey form. Accept: READY from the merge job, gates green, no new e2e failures against production 4ebeba0b8, perf ratchet not raised, screenshots reviewed by the orchestrator.
Author
Owner

Started merge39 on branch job/merge39, base 4ebeba0b8e13b06223bc2b24ee7a398a0933bda0 (production). Will merge 35829e1ee then e81252ef0, run the specified gates, compare browser checks against production, and run one bounded defensive audit. No push or deploy. Screenshots use Chromium with macOS platform emulation.

Started merge39 on branch `job/merge39`, base `4ebeba0b8e13b06223bc2b24ee7a398a0933bda0` (production). Will merge `35829e1ee` then `e81252ef0`, run the specified gates, compare browser checks against production, and run one bounded defensive audit. No push or deploy. Screenshots use Chromium with macOS platform emulation.
Author
Owner

Merged both requested tips in order. Merge commits: 8e305dc02, a8acb7ce0. Refreshed origin/dev once: Already up to date. Source merges needed no conflict resolution. OpenAPI used a structural three-way merge to preserve both branches; it will be checked against the generated server contract. Perf pins were regenerated once after stale generated hash conflicts; result: perf-lint: PASS; 0 violations; 22128 scoped exceptions. contracts/perf/ratchet.json is unchanged. Corrected one stale Admin comment about server field identifiers. Editor gate: Test Files 43 passed (43); Tests 529 passed (529). Remaining gates and production/release comparisons are running.

Merged both requested tips in order. Merge commits: `8e305dc02`, `a8acb7ce0`. Refreshed origin/dev once: `Already up to date.` Source merges needed no conflict resolution. OpenAPI used a structural three-way merge to preserve both branches; it will be checked against the generated server contract. Perf pins were regenerated once after stale generated hash conflicts; result: `perf-lint: PASS; 0 violations; 22128 scoped exceptions`. `contracts/perf/ratchet.json` is unchanged. Corrected one stale Admin comment about server field identifiers. Editor gate: `Test Files 43 passed (43)`; `Tests 529 passed (529)`. Remaining gates and production/release comparisons are running.
Author
Owner

Auth verification: cargo test -p calternal-auth -- --test-threads=4 passed: test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 95.93s. Both app_password_revoke_rejects_queued_verification and share_invites_serialize_the_last_slot passed. The command started with load5 5.48 on 12 cores; load increased during builds. The explicit Auth audit passed: PASS: 59 bounded local requests; malformed/oversized, path-like and Unicode grant checks were safely refused; token and concurrent limits returned HTTP 429; 16 admitted flows; capacity HTTP 429. Added ADVERSARIAL_AUTH_CEREMONY_ONLY=1 to run.sh to invoke its existing ignored real-TCP-listener regression without consuming its admission budgets in unrelated plugin setup (5ecd27995). Correction to the prior editor summary: Test Files 30 passed (30), Tests 529 passed (529). Initial web check reached svelte-check found 0 errors and 0 warnings but correctly failed the stale perf ledger check before regenerated pins; the final check will use the refreshed ledger.

Auth verification: `cargo test -p calternal-auth -- --test-threads=4` passed: `test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 95.93s`. Both `app_password_revoke_rejects_queued_verification` and `share_invites_serialize_the_last_slot` passed. The command started with load5 5.48 on 12 cores; load increased during builds. The explicit Auth audit passed: `PASS: 59 bounded local requests; malformed/oversized, path-like and Unicode grant checks were safely refused; token and concurrent limits returned HTTP 429; 16 admitted flows; capacity HTTP 429`. Added `ADVERSARIAL_AUTH_CEREMONY_ONLY=1` to run.sh to invoke its existing ignored real-TCP-listener regression without consuming its admission budgets in unrelated plugin setup (`5ecd27995`). Correction to the prior editor summary: `Test Files 30 passed (30)`, `Tests 529 passed (529)`. Initial web check reached `svelte-check found 0 errors and 0 warnings` but correctly failed the stale perf ledger check before regenerated pins; the final check will use the refreshed ledger.
Author
Owner

Merge integration finding: production added settings/admin/userCreate.ts in 650392fea after the auth branch base. Its newUserProblem still used a 128-byte display-name limit, so the combined form rejected 129 ASCII characters, 65 accented characters, and many valid emoji names before reaching the new 160-scalar server validation. Fixed the helper to count Unicode scalar values and updated its stale module comment. Focused regression: Test Files 1 passed (1), Tests 5 passed (5). Changed two pre-existing length expectations because #1553 explicitly changes this behavior: their invalid boundary is now 161 scalar values. Added acceptance at 160 and refusal at 161 for ASCII, accented text, and supplementary-plane emoji. No status, field-error, or unrelated expectation changed. No new perf scope or ratchet change.

Merge integration finding: production added `settings/admin/userCreate.ts` in `650392fea` after the auth branch base. Its `newUserProblem` still used a 128-byte display-name limit, so the combined form rejected 129 ASCII characters, 65 accented characters, and many valid emoji names before reaching the new 160-scalar server validation. Fixed the helper to count Unicode scalar values and updated its stale module comment. Focused regression: `Test Files 1 passed (1)`, `Tests 5 passed (5)`. Changed two pre-existing length expectations because #1553 explicitly changes this behavior: their invalid boundary is now 161 scalar values. Added acceptance at 160 and refusal at 161 for ASCII, accented text, and supplementary-plane emoji. No status, field-error, or unrelated expectation changed. No new perf scope or ratchet change.
Author
Owner

Workspace Clippy passed: Finished dev profile [unoptimized + debuginfo] target(s) in 16m 51s (cargo clippy --all-targets -- -D warnings, CARGO_BUILD_JOBS=4). The workspace test build has started. The refreshed exact pins pass: perf-lint: PASS; 0 violations; 22128 scoped exceptions; the twelve Admin list hashes were refreshed from the same compiler facts after its documentation correction, with every rule, owner, expiry, reason, and limit unchanged. The ratchet stays at 22128. Production comparison so far: QuickLook clearance PASS; Files fails waiting for the text-card renderer on a PDF-content fixture; long public-folder name fails 36 px vs 18 px; Kbd fails because production has the old menu cap representation. Header sweep first failed before UI execution because the Bun native runtime could not find libstdc++.so.6; a local directory of links to the installed compiler libraries fixes it, and the repaired production sweep is running. No product or dependency change was made for the native runtime.

Workspace Clippy passed: `Finished `dev` profile [unoptimized + debuginfo] target(s) in 16m 51s` (cargo clippy --all-targets -- -D warnings, CARGO_BUILD_JOBS=4). The workspace test build has started. The refreshed exact pins pass: `perf-lint: PASS; 0 violations; 22128 scoped exceptions`; the twelve Admin list hashes were refreshed from the same compiler facts after its documentation correction, with every rule, owner, expiry, reason, and limit unchanged. The ratchet stays at 22128. Production comparison so far: QuickLook clearance PASS; Files fails waiting for the text-card renderer on a PDF-content fixture; long public-folder name fails 36 px vs 18 px; Kbd fails because production has the old menu cap representation. Header sweep first failed before UI execution because the Bun native runtime could not find libstdc++.so.6; a local directory of links to the installed compiler libraries fixes it, and the repaired production sweep is running. No product or dependency change was made for the native runtime.
Author
Owner

The generated contracts now come from the merged release server. scripts/action_registry.py --check passes with 436 operations and 408 tools; API client tests pass (24 tests). The extra registry unit suite fails the same three assertions on merged code and production 4ebeba0b8. Filed #1562 for the missing Admin smoke cases and two scope metadata mismatches. No expectations changed.

Web gates now pass: svelte-check found 0 errors and 0 warnings; Test Files 318 passed (318) / Tests 2320 passed (2320). The ledger remains at 22128; no ratchet increase.

The generated contracts now come from the merged release server. `scripts/action_registry.py --check` passes with 436 operations and 408 tools; API client tests pass (24 tests). The extra registry unit suite fails the same three assertions on merged code and production 4ebeba0b8. Filed #1562 for the missing Admin smoke cases and two scope metadata mismatches. No expectations changed. Web gates now pass: `svelte-check found 0 errors and 0 warnings`; `Test Files 318 passed (318)` / `Tests 2320 passed (2320)`. The ledger remains at 22128; no ratchet increase.
kayg referenced this issue from a commit 2026-10-10 21:10:00 +00:00
kayg referenced this issue from a commit 2026-10-10 21:10:00 +00:00
Author
Owner

Production comparison on 4ebeba0b8: Quick Look clearance passes; the current long-name assertion finds a two-line public row (36 px versus 18 px); the current Kbd script cannot find the new plain shortcut markup on the old production menu. These are expected behavior changes to compare against merged results. Files stops at the text-card thumbnail cache fixture; that result still needs merged classification.

The full production header sweep hit its 30-minute deadline during break-it. It did not complete. Added phase progress logs only (342af89de); no assertions or scenarios changed. Both builds will run the same script with a 45-minute deadline.

The Auth comparison on production fails explicitly at the new setup validity endpoint: HTTP 404 instead of 200. This endpoint is absent before #1553.

Final release build passes: Finished release profile [optimized] target(s) in 15m 35s (full output is retained). The cross-User live round is running against that binary.

Production comparison on 4ebeba0b8: Quick Look clearance passes; the current long-name assertion finds a two-line public row (36 px versus 18 px); the current Kbd script cannot find the new plain shortcut markup on the old production menu. These are expected behavior changes to compare against merged results. Files stops at the text-card thumbnail cache fixture; that result still needs merged classification. The full production header sweep hit its 30-minute deadline during break-it. It did not complete. Added phase progress logs only (342af89de); no assertions or scenarios changed. Both builds will run the same script with a 45-minute deadline. The Auth comparison on production fails explicitly at the new setup validity endpoint: HTTP 404 instead of 200. This endpoint is absent before #1553. Final release build passes: `Finished `release` profile [optimized] target(s) in 15m 35s` (full output is retained). The cross-User live round is running against that binary.
Author
Owner

The live XUser preflight and agent-download phase passed (0 findings, 0 SLOW; server alive). The full matrix then stopped fail-closed before replay because setup_check and invite_check lacked explicit capability classifications. This is a merge-only verification integration gap.

Fixed in 5ed2b4c3e: the checks inherit the same reviewed authority as setup_start and invite_start. The original #1402 39-route inventory and all its expectations remain intact. Added a regression that plans the two real check routes without treating their tokens as private item IDs. Ran 29 tests in 0.584s / OK. The finite Auth TCP probe already proves one-bit bodies and shared rate limits. A focused live matrix rerun will finish this bounded defensive round.

The live XUser preflight and agent-download phase passed (0 findings, 0 SLOW; server alive). The full matrix then stopped fail-closed before replay because setup_check and invite_check lacked explicit capability classifications. This is a merge-only verification integration gap. Fixed in 5ed2b4c3e: the checks inherit the same reviewed authority as setup_start and invite_start. The original #1402 39-route inventory and all its expectations remain intact. Added a regression that plans the two real check routes without treating their tokens as private item IDs. `Ran 29 tests in 0.584s` / `OK`. The finite Auth TCP probe already proves one-bit bodies and shared rate limits. A focused live matrix rerun will finish this bounded defensive round.
Author
Owner

Owner captures completed on the merged release server and production web build: 1440, 820, 390; light/dark; Chromium with macOS emulation. Files list/menu, file Inspector, bright-photo Inspector after click and shortcut, real minute-job Log reminder, Admin add-User conflict, bad setup token and genuinely consumed invitation all pass. Opening click/shortcut checks leave no focus outline. Quick Look clearance passes for all four file kinds at all widths/themes with click and shortcut; public long-name rows pass at 390 light/dark. Captures are in artifacts/merge39/owner and will be attached as a zip.

Filed confirmed pre-existing findings:

  • #1563: Files text-card cache fixture contains PDF bytes; identical timeout and metadata on production and merged builds.
  • #1564: Kbd phone Search-footer assertion expects caps that the unchanged footer hides. Same focused assertion fails on both builds. No existing expectations changed; only a surface selector was added. The merged full run passes plain menu shortcuts and tooltip geometry before the old footer failure.
  • #1565: opening a fresh Photo before its thumbnail decodes can retain a failed preview. The same real-server diagnostic fails on both builds: early thumbnail 404 then 200, undecoded image, full-size stage. Clean capture waits for the tile image to decode first.

Head 7f25472086. The corrected live XUser replay is running, and the two completed header sweeps remain to run with phase logging. Rust workspace tests are still running without a reported failure. No pushes or deploys.

Owner captures completed on the merged release server and production web build: 1440, 820, 390; light/dark; Chromium with macOS emulation. Files list/menu, file Inspector, bright-photo Inspector after click and shortcut, real minute-job Log reminder, Admin add-User conflict, bad setup token and genuinely consumed invitation all pass. Opening click/shortcut checks leave no focus outline. Quick Look clearance passes for all four file kinds at all widths/themes with click and shortcut; public long-name rows pass at 390 light/dark. Captures are in artifacts/merge39/owner and will be attached as a zip. Filed confirmed pre-existing findings: - #1563: Files text-card cache fixture contains PDF bytes; identical timeout and metadata on production and merged builds. - #1564: Kbd phone Search-footer assertion expects caps that the unchanged footer hides. Same focused assertion fails on both builds. No existing expectations changed; only a surface selector was added. The merged full run passes plain menu shortcuts and tooltip geometry before the old footer failure. - #1565: opening a fresh Photo before its thumbnail decodes can retain a failed preview. The same real-server diagnostic fails on both builds: early thumbnail 404 then 200, undecoded image, full-size stage. Clean capture waits for the tile image to decode first. Head 7f254720864abf953b6abd145aa50c1ca2eab6e3. The corrected live XUser replay is running, and the two completed header sweeps remain to run with phase logging. Rust workspace tests are still running without a reported failure. No pushes or deploys.
Author
Owner

Defensive blocker confirmed and filed as #1566. The full corrected XUser matrix replayed 227 operations / 1058 A-ID versus missing-ID comparisons, with 127 Job/Mail/quota comparisons and 0 denial failures. One Money cleared operation reported a server failure.

The same focused operation replay on merged release code and production 4ebeba0b8 returns HTTP 503/503 for User B’s foreign and missing IDs (not transport timeouts). No cross-User data/state change was reported. Source evidence: set_cleared’s cold/stale branch queues register repair without the owned-Budget header guard used by register_for/enqueue_owned_register_build. Money source is unchanged by this merge.

The brief explicitly makes 5xx a defensive blocker, so this head is NOT READY while #1566 remains. The defensive round ended within 45 minutes; no full matrix loop was run after the focused production comparison. I am completing both header comparisons and the final gate/evidence report. Current head 9f77f7a12.

Defensive blocker confirmed and filed as #1566. The full corrected XUser matrix replayed 227 operations / 1058 A-ID versus missing-ID comparisons, with 127 Job/Mail/quota comparisons and 0 denial failures. One Money cleared operation reported a server failure. The same focused operation replay on merged release code and production 4ebeba0b8 returns HTTP 503/503 for User B’s foreign and missing IDs (not transport timeouts). No cross-User data/state change was reported. Source evidence: set_cleared’s cold/stale branch queues register repair without the owned-Budget header guard used by register_for/enqueue_owned_register_build. Money source is unchanged by this merge. The brief explicitly makes 5xx a defensive blocker, so this head is NOT READY while #1566 remains. The defensive round ended within 45 minutes; no full matrix loop was run after the focused production comparison. I am completing both header comparisons and the final gate/evidence report. Current head 9f77f7a12.
Author
Owner

Owner evidence is attached: merge39-owner-evidence.zip. It contains 108 actual-size Chromium captures with macOS platform emulation, light and dark, at 390/820/1440 CSS pixels. The manifest records dimensions, the source head and the matching build identity. Diagnostic crops are outside this archive. No macOS VM was used.

Workspace tests and the production header sweep remain in progress. The defensive HTTP 503 finding in #1566 still blocks READY.

Owner evidence is attached: [merge39-owner-evidence.zip](https://git.kayg.org/attachments/72e39471-ce69-4b51-8375-f8b21264315c). It contains 108 actual-size Chromium captures with macOS platform emulation, light and dark, at 390/820/1440 CSS pixels. The manifest records dimensions, the source head and the matching build identity. Diagnostic crops are outside this archive. No macOS VM was used. Workspace tests and the production header sweep remain in progress. The defensive HTTP 503 finding in #1566 still blocks READY.
Author
Owner

The first workspace cargo test completed the server unit suite (277 passed; 0 failed; 12 ignored) and then stopped at the deterministic perf guard. Canonical OpenAPI regeneration restored production Money source Month and file-local Transaction descriptions, so eight contract-derived hashes were stale. Commit 769ef5cc100285e5fcbcf7069fe27d6034a16d22 updates only those hashes. No rule, limit, owner, reason, count or ratchet changed; the ratchet remains 22128. The one full adoption command was not repeated.

The original failure was:

perf-lint: INVALID: ('contract.mutation', 'crates/plugins/money/src/routes.rs', 'money_delete_transaction:mutation'): unused or changed exception

The existing workspace regression binary now reports, verbatim:

test deterministic_performance_guards ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 40.84s

cd apps/web && bun run check passed:

svelte-check found 0 errors and 0 warnings

A standalone-target guard rebuild was interrupted because its feature selection caused redundant compilation. No test failure came from it. The full workspace cargo test -- --test-threads=4 is being rerun on the committed head; both full-run logs will be retained. Production header sweep completed with 166 findings; the same merged sweep is now running. The HTTP 503 finding in #1566 still blocks READY.

The first workspace `cargo test` completed the server unit suite (`277 passed; 0 failed; 12 ignored`) and then stopped at the deterministic perf guard. Canonical OpenAPI regeneration restored production Money source Month and file-local Transaction descriptions, so eight contract-derived hashes were stale. Commit `769ef5cc100285e5fcbcf7069fe27d6034a16d22` updates only those hashes. No rule, limit, owner, reason, count or ratchet changed; the ratchet remains 22128. The one full adoption command was not repeated. The original failure was: ```text perf-lint: INVALID: ('contract.mutation', 'crates/plugins/money/src/routes.rs', 'money_delete_transaction:mutation'): unused or changed exception ``` The existing workspace regression binary now reports, verbatim: ```text test deterministic_performance_guards ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 40.84s ``` `cd apps/web && bun run check` passed: ```text svelte-check found 0 errors and 0 warnings ``` A standalone-target guard rebuild was interrupted because its feature selection caused redundant compilation. No test failure came from it. The full workspace `cargo test -- --test-threads=4` is being rerun on the committed head; both full-run logs will be retained. Production header sweep completed with 166 findings; the same merged sweep is now running. The HTTP 503 finding in #1566 still blocks READY.
Author
Owner

The same header sweep completed on both builds (45-minute bound, matching web builds). Production 4ebeba0b8: exit 1, 166 findings. Merge: exit 1, 163 findings. After removing generated Svelte CSS hashes and ANSI formatting only, 160 findings match exactly with the same geometry. Both report Calendar Month CLS 0.084 (budget 0.05). The remaining merged findings are Note/Notes 390 collapse timeouts; the same scenario labels fail on production at earlier navigation/editor waits. Production alone has three additional timeouts. No new merged geometry failure or failure label was found. Filed the baseline findings as #1567. The complete raw logs and normalization output will be in the final evidence attachment. Existing assertions remain unchanged.

The final workspace Auth suite passed, verbatim:

test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 71.44s

Both previously questioned tests passed again. The full workspace run is still proceeding. Head remains 769ef5cc100285e5fcbcf7069fe27d6034a16d22. #1566 still blocks READY.

The same header sweep completed on both builds (45-minute bound, matching web builds). Production `4ebeba0b8`: exit 1, 166 findings. Merge: exit 1, 163 findings. After removing generated Svelte CSS hashes and ANSI formatting only, 160 findings match exactly with the same geometry. Both report Calendar Month CLS 0.084 (budget 0.05). The remaining merged findings are Note/Notes 390 collapse timeouts; the same scenario labels fail on production at earlier navigation/editor waits. Production alone has three additional timeouts. No new merged geometry failure or failure label was found. Filed the baseline findings as #1567. The complete raw logs and normalization output will be in the final evidence attachment. Existing assertions remain unchanged. The final workspace Auth suite passed, verbatim: ```text test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 71.44s ``` Both previously questioned tests passed again. The full workspace run is still proceeding. Head remains `769ef5cc100285e5fcbcf7069fe27d6034a16d22`. #1566 still blocks READY.
Author
Owner

The complete owner screenshot ZIP supersedes the earlier 108-capture set. It contains 120 actual-size images and a manifest. Public folder and public file views now also cover 390/820/1440 in light and dark. The focused public slice passed all 12 captures. Its first phone attempt failed because a locator matched visible text that the middle cut removes; matching the full title fixed the capture without changing the row assertions.

Commits 86a6bf4b7 and 5efdab060 add the width coverage and keep the filename comment precise. Head is 5efdab060e4af761a6d58c81c7a8b73349f1174a. These commits change review code only. UI and API source are unchanged after the committed perf-pin correction. The final full Rust suite is still running through Money property tests with no reported failure. #1566 still blocks READY.

The complete [owner screenshot ZIP](https://git.kayg.org/attachments/a084b193-691b-4b0e-8360-7ecffad471af) supersedes the earlier 108-capture set. It contains 120 actual-size images and a manifest. Public folder and public file views now also cover 390/820/1440 in light and dark. The focused public slice passed all 12 captures. Its first phone attempt failed because a locator matched visible text that the middle cut removes; matching the full `title` fixed the capture without changing the row assertions. Commits `86a6bf4b7` and `5efdab060` add the width coverage and keep the filename comment precise. Head is `5efdab060e4af761a6d58c81c7a8b73349f1174a`. These commits change review code only. UI and API source are unchanged after the committed perf-pin correction. The final full Rust suite is still running through Money property tests with no reported failure. #1566 still blocks READY.
Author
Owner

NOT READY — #1566 blocks this round. The Money cleared cold path returns HTTP 503 for foreign and missing Budgets. The same focused replay returns 503/503 on production 4ebeba0b8 and on the merged release server; neither request timed out. No cross-User data or state effect and no crash was reported. The brief makes 5xx blocking, even when pre-existing.

Head: 5efdab060e4af761a6d58c81c7a8b73349f1174a. Base: 4ebeba0b8e13b06223bc2b24ee7a398a0933bda0. Merged 35829e1ee then e81252ef0, each with --no-ff and the requested message. Fetched and merged origin/dev once before final gates; already up to date. No push or deploy.

Built and files: imported the shared UI chrome and Auth error/link-check slices. The merge integration fix is in apps/web/src/routes/settings/admin/userCreate.ts and its test: the newer production helper used 128 UTF-8 bytes, while #1553 uses 160 Unicode scalar values. ASCII, accented and emoji boundary cases pass. Regenerated contracts/openapi.json, action contracts and packages/api-client/src/generated.ts; retained production Money file-scoped descriptions. Updated exact perf ledgers only. The ratchet remains 22128. Added apps/web/e2e/merge39-review.mjs, progress markers and focused comparison selectors in the existing regression scripts. Extended tests/adversarial/run.sh, xuser_matrix.py and its classification test without changing existing denial expectations or the #1402 route inventory.

Owner evidence: 120 actual-size screenshots and manifest. Chromium with macOS platform emulation; 390/820/1440, light/dark. Files list, shortcut menu, Inspector over a bright photo, real reminder, Admin add failure, bad setup grant, used invite, Quick Look text/Markdown/PDF/image and long public folder name. Pointer and opening-shortcut captures assert no focus outline. No macOS VM used. Visual approval remains with the orchestrator.

UX gaps closed: valid long Unicode display names now reach the server; unusable setup and invite links show the calm failure state without a registration form; Admin validation identifies its field. Shared controls used: FileCollection, FileName, Pill, Inspector, Menu/MenuItem/Kbd, QuickLook/OverlaySurface, AppToaster, ModeHeader, FloatingSidebar/SidebarLinks/ItemActionMenu, TextInput and the existing Settings controls. No new visual primitive.

UX gaps left: pre-existing fresh Photo preview race (#1565), Files PDF-backed text-card fixture timeout (#1563), phone Search shortcut-cap expectation (#1564), and action-registry unit-test drift (#1562), and baseline header/layout findings (#1567). Existing assertions and fixtures were retained. The new capture runner waits for the real thumbnail to decode; it does not fix the preview race. The full failing Files and Kbd scripts stop at their first assertion, so later cases in those scripts are not covered.

Decisions: resolved generated-file conflicts by regenerating from Rust, not by selecting a stale generated contract. Used the existing finite Auth TCP probe separately so unrelated fixture setup could not consume its admission budgets. Classified the new read-only link checks under the same registration-grant authority as their start routes. Used the same current script on production and the merged build for comparisons. Filed the pre-existing Money behavior as #1566 instead of changing an unrelated plugin's behavior during this merge.

Expected cost: each new grant check uses one indexed read and fixed bounded limiter lookups. Display-name validation is linear in the input's Unicode scalar count, with a 160-character accepted bound. This is a verification issue; no performance benchmark or deployment was run.

Comparison results:

Check Production 4ebeba0b8 Merge Classification
Files Text-card thumbnail fixture timeout Same timeout #1563; later cases do not run
Long public-folder name Wraps at 390 PASS, one line and middle ellipsis Intended fix; extra public views pass all widths/themes
Quick Look clearance PASS PASS Four kinds, three widths, two themes, click and shortcut
Kbd New plain-menu assertion fails on old caps Plain menu and tooltip pass; phone palette assertion fails Same focused palette assertion fails on production (#1564)
Early Auth validity New endpoint absent (404) Exact {valid:false} and unusable forms suppressed Intended endpoint addition; field errors and 54 original captures pass
Headers 166 findings, completed 163 findings, completed 160 identical after CSS hash/ANSI normalization; same CLS; same timeout scenarios (#1567)
Money cleared Focused 503/503, no transport timeout Full matrix and focused 503/503 Pre-existing but blocking #1566

Gate results and limitation: cargo fmt --check exited 0 with no output. Workspace Clippy exited 0. The first full cargo test -- --test-threads=4 exited 101 at the stale exact contract pin; it was fixed in 769ef5cc1. The final full run emitted 126 passing result blocks and completed 27 doc-test sections through calternal_tags, with no failed result or error summary. No Cargo/test process remains. The outer session returned 143 before its wrapper printed the Cargo status. The exact Cargo exit code is unconfirmed; this is not reported as exit 0. No latency assertion failed, so no latency-only rerun was needed. Web check, all web tests and all editor tests exited 0.

Verbatim gate output excerpts (full stdout is attached):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 16m 51s
test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 71.44s
test result: ok. 141 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 173.79s
test result: ok. 181 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1780.77s
test result: ok. 277 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 127.08s
test deterministic_performance_guards ... ok
perf-lint: PASS; 0 violations; 22128 scoped exceptions
svelte-check found 0 errors and 0 warnings
 Test Files  318 passed (318)
      Tests  2320 passed (2320)
 Test Files  30 passed (30)
      Tests  529 passed (529)
Action registry: 436 operations, 408 generated tools

Both questioned Auth store tests passed in the low-load run (load5 5.48 on 12 cores), the first workspace run and the final workspace run. Low-load output, verbatim:

test store::tests::app_password_revoke_rejects_queued_verification ... ok
test store::tests::share_invites_serialize_the_last_slot ... ok
test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 95.93s

Defensive audit: one bounded Auth round and one XUser campaign, with focused production replay to classify its sole failure. The full matrix classified 438 operations, replayed 227 and made 1058 foreign-versus-missing comparisons. Job/Mail/quota checks made 127 comparisons with zero denial failures. No crash, cross-User data/state change or token disclosure was reported. Money cleared returned real HTTP 503 for foreign and missing Budgets on both builds; neither request timed out. This is #1566 and blocks the round. The new link checks return exactly one validity bit; token and flow admission limits return HTTP 429. Auth probe output, verbatim:

PASS: 59 bounded local requests; malformed/oversized, path-like and Unicode grant checks were safely refused; token and concurrent limits returned HTTP 429; 16 admitted flows; capacity HTTP 429
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 143 filtered out; finished in 0.55s

Evidence: full gate/comparison logs, normalized header comparison, source files and commit list. The separate complete owner screenshot ZIP has 120 actual-size captures. Its manifest records the capture source heads. Later changes are review code, exact pins or comments; UI/API source is unchanged.

Cleanup: cargo clean exited 0. Own web build output, test temporary data and the disposable production worktree were removed. The tracked worktree is clean. No review browser/server or Cargo/test process remains. Cleanup output, verbatim:

     Removed 30399 files, 28.8GiB total

Known gaps: #1566 is unresolved. The final Cargo exit code is unconfirmed because the outer session returned 143, despite complete passing result logs. The pre-existing failures in #1562–#1565 and #1567 remain filed; existing expectations were kept. Visual approval belongs to the orchestrator. No push, deployment or macOS VM use.

NOT READY — #1566: Money cleared returns HTTP 503 for foreign/missing Budgets; the exact final Cargo exit code is also unconfirmed.

NOT READY — #1566 blocks this round. The Money cleared cold path returns HTTP 503 for foreign and missing Budgets. The same focused replay returns 503/503 on production 4ebeba0b8 and on the merged release server; neither request timed out. No cross-User data or state effect and no crash was reported. The brief makes 5xx blocking, even when pre-existing. Head: `5efdab060e4af761a6d58c81c7a8b73349f1174a`. Base: `4ebeba0b8e13b06223bc2b24ee7a398a0933bda0`. Merged `35829e1ee` then `e81252ef0`, each with `--no-ff` and the requested message. Fetched and merged origin/dev once before final gates; already up to date. No push or deploy. Built and files: imported the shared UI chrome and Auth error/link-check slices. The merge integration fix is in `apps/web/src/routes/settings/admin/userCreate.ts` and its test: the newer production helper used 128 UTF-8 bytes, while #1553 uses 160 Unicode scalar values. ASCII, accented and emoji boundary cases pass. Regenerated `contracts/openapi.json`, action contracts and `packages/api-client/src/generated.ts`; retained production Money file-scoped descriptions. Updated exact perf ledgers only. The ratchet remains 22128. Added `apps/web/e2e/merge39-review.mjs`, progress markers and focused comparison selectors in the existing regression scripts. Extended `tests/adversarial/run.sh`, `xuser_matrix.py` and its classification test without changing existing denial expectations or the #1402 route inventory. Owner evidence: [120 actual-size screenshots and manifest](https://git.kayg.org/attachments/a084b193-691b-4b0e-8360-7ecffad471af). Chromium with macOS platform emulation; 390/820/1440, light/dark. Files list, shortcut menu, Inspector over a bright photo, real reminder, Admin add failure, bad setup grant, used invite, Quick Look text/Markdown/PDF/image and long public folder name. Pointer and opening-shortcut captures assert no focus outline. No macOS VM used. Visual approval remains with the orchestrator. UX gaps closed: valid long Unicode display names now reach the server; unusable setup and invite links show the calm failure state without a registration form; Admin validation identifies its field. Shared controls used: FileCollection, FileName, Pill, Inspector, Menu/MenuItem/Kbd, QuickLook/OverlaySurface, AppToaster, ModeHeader, FloatingSidebar/SidebarLinks/ItemActionMenu, TextInput and the existing Settings controls. No new visual primitive. UX gaps left: pre-existing fresh Photo preview race (#1565), Files PDF-backed text-card fixture timeout (#1563), phone Search shortcut-cap expectation (#1564), and action-registry unit-test drift (#1562), and baseline header/layout findings (#1567). Existing assertions and fixtures were retained. The new capture runner waits for the real thumbnail to decode; it does not fix the preview race. The full failing Files and Kbd scripts stop at their first assertion, so later cases in those scripts are not covered. Decisions: resolved generated-file conflicts by regenerating from Rust, not by selecting a stale generated contract. Used the existing finite Auth TCP probe separately so unrelated fixture setup could not consume its admission budgets. Classified the new read-only link checks under the same registration-grant authority as their start routes. Used the same current script on production and the merged build for comparisons. Filed the pre-existing Money behavior as #1566 instead of changing an unrelated plugin's behavior during this merge. Expected cost: each new grant check uses one indexed read and fixed bounded limiter lookups. Display-name validation is linear in the input's Unicode scalar count, with a 160-character accepted bound. This is a verification issue; no performance benchmark or deployment was run. Comparison results: | Check | Production 4ebeba0b8 | Merge | Classification | | --- | --- | --- | --- | | Files | Text-card thumbnail fixture timeout | Same timeout | #1563; later cases do not run | | Long public-folder name | Wraps at 390 | PASS, one line and middle ellipsis | Intended fix; extra public views pass all widths/themes | | Quick Look clearance | PASS | PASS | Four kinds, three widths, two themes, click and shortcut | | Kbd | New plain-menu assertion fails on old caps | Plain menu and tooltip pass; phone palette assertion fails | Same focused palette assertion fails on production (#1564) | | Early Auth validity | New endpoint absent (404) | Exact `{valid:false}` and unusable forms suppressed | Intended endpoint addition; field errors and 54 original captures pass | | Headers | 166 findings, completed | 163 findings, completed | 160 identical after CSS hash/ANSI normalization; same CLS; same timeout scenarios (#1567) | | Money cleared | Focused 503/503, no transport timeout | Full matrix and focused 503/503 | Pre-existing but blocking #1566 | Gate results and limitation: `cargo fmt --check` exited 0 with no output. Workspace Clippy exited 0. The first full `cargo test -- --test-threads=4` exited 101 at the stale exact contract pin; it was fixed in `769ef5cc1`. The final full run emitted 126 passing result blocks and completed 27 doc-test sections through `calternal_tags`, with no failed result or error summary. No Cargo/test process remains. The outer session returned 143 before its wrapper printed the Cargo status. The exact Cargo exit code is unconfirmed; this is not reported as exit 0. No latency assertion failed, so no latency-only rerun was needed. Web check, all web tests and all editor tests exited 0. Verbatim gate output excerpts (full stdout is attached): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 16m 51s test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 71.44s test result: ok. 141 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 173.79s test result: ok. 181 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1780.77s test result: ok. 277 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 127.08s test deterministic_performance_guards ... ok perf-lint: PASS; 0 violations; 22128 scoped exceptions svelte-check found 0 errors and 0 warnings Test Files 318 passed (318) Tests 2320 passed (2320) Test Files 30 passed (30) Tests 529 passed (529) Action registry: 436 operations, 408 generated tools ``` Both questioned Auth store tests passed in the low-load run (load5 5.48 on 12 cores), the first workspace run and the final workspace run. Low-load output, verbatim: ```text test store::tests::app_password_revoke_rejects_queued_verification ... ok test store::tests::share_invites_serialize_the_last_slot ... ok test result: ok. 141 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 95.93s ``` Defensive audit: one bounded Auth round and one XUser campaign, with focused production replay to classify its sole failure. The full matrix classified 438 operations, replayed 227 and made 1058 foreign-versus-missing comparisons. Job/Mail/quota checks made 127 comparisons with zero denial failures. No crash, cross-User data/state change or token disclosure was reported. Money cleared returned real HTTP 503 for foreign and missing Budgets on both builds; neither request timed out. This is #1566 and blocks the round. The new link checks return exactly one validity bit; token and flow admission limits return HTTP 429. Auth probe output, verbatim: ```text PASS: 59 bounded local requests; malformed/oversized, path-like and Unicode grant checks were safely refused; token and concurrent limits returned HTTP 429; 16 admitted flows; capacity HTTP 429 test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 143 filtered out; finished in 0.55s ``` Evidence: [full gate/comparison logs, normalized header comparison, source files and commit list](https://git.kayg.org/attachments/37265475-1435-49ca-b6c0-152d778e0864). The separate [complete owner screenshot ZIP](https://git.kayg.org/attachments/a084b193-691b-4b0e-8360-7ecffad471af) has 120 actual-size captures. Its manifest records the capture source heads. Later changes are review code, exact pins or comments; UI/API source is unchanged. Cleanup: `cargo clean` exited 0. Own web build output, test temporary data and the disposable production worktree were removed. The tracked worktree is clean. No review browser/server or Cargo/test process remains. Cleanup output, verbatim: ```text Removed 30399 files, 28.8GiB total ``` Known gaps: #1566 is unresolved. The final Cargo exit code is unconfirmed because the outer session returned 143, despite complete passing result logs. The pre-existing failures in #1562–#1565 and #1567 remain filed; existing expectations were kept. Visual approval belongs to the orchestrator. No push, deployment or macOS VM use. NOT READY — #1566: Money cleared returns HTTP 503 for foreign/missing Budgets; the exact final Cargo exit code is also unconfirmed.
Author
Owner

Deployed to calternal.cloud in merge round 40 (build c0f8da461, 01:38 IST 2026-10-12). Health state ok, /readyz 200, served-page check passed. Pre-deploy backup taken.

Deployed to calternal.cloud in merge round 40 (build c0f8da461, 01:38 IST 2026-10-12). Health state ok, /readyz 200, served-page check passed. Pre-deploy backup taken.
kayg closed this issue 2026-10-11 20:08:39 +00:00
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1561
No description provided.