kayg/calternal-v0
Archived
Watch
1
0
Fork
You've already forked calternal-v0
 0
Code Issues 1.1k Pull requests Projects Releases Packages Wiki Activity Actions

PERF: Money rule 2 — bound lists by rows and bytes with signed keyset pages (#663) #688

Closed
opened 2026-10-02 05:36:39 +00:00 by kayg · 112 comments
kayg commented 2026-10-02 05:36:39 +00:00
Owner
Copy link

Context: #663 matrix and DESIGN §58 rule 2. Scope: Money must bound lists by rows and bytes with signed keyset pages. Shared client machinery belongs only to #665–#668.

Evidence at c4a61e8cf0:

  • Endpoint: GET /api/v1/money/budgets/{id}/transactions.
  • Source: crates/plugins/money/src/routes.rs:916. Returns all matching transactions; no cursor/row/byte bound. Budgets (:338) and accounts (:612) also return complete sets.
  • Representative endpoint numbers, server/client revisions, fixture size, lock/HDD qualification and limits are in the #663 production/HDD table. Those numbers do not prove this rule passes; the structural gap above is separate evidence.

Expected and regression tests:
At 10k items (and largest realistic plugin data), every response has ≤100 item rows and an explicit total byte cap; nested arrays count toward both. Signed cursors bind User, view/filter/sort/zone and keyset position. Edits between pages do not skip or repeat unchanged items; malformed/cross-User/replayed scope cursors cannot change authorization. No OFFSET and no startup whole-corpus drain. Client retains first page plus one lookahead and a bounded resident row/byte window. Preserve deep links, selection, Copy link and current list order. Test large values and variable row size at the byte boundary, empty pages, filter switches, deleted cursor anchor and cache eviction.

Performance test:
Extend the existing bench profile for this hot path and the #549/#641 harness. Use production builds on root@10.69.69.63, bench/hdd-emu.sh and flock -w 14400 /root/perf.lock. Record load inside the lock; ≥5 samples, median/p95/max, average CPU/RSS and one realistic large-data/burst case. Separate warm, cold, accepted and durable boundaries. First usable 10k view ≤1.5 s; cached open/warm return ≤100 ms and accepted action ≤150 ms where applicable. Compare only a matching baseline in docs/perf/baseline.json; missing profiles require a new recorded baseline, not a made-up comparison.

Reuse/ownership:
Preserve lossless Markdown and exact integer arithmetic (DESIGN §48). Do not print amounts, costs or transaction contents in issue evidence, logs or artifacts. #641 owns active account traversal; coordinate after it lands.
Reuse #555 userStorage, #549 route caches, Files signed keysets/change feed and the existing Db reader_pool. #641 owns blaze measurements; #642 owns Settings opening; #640 owns Mail layouts; #639 owns linked Note opening. Integrate their active/completed branches before changing related code.

Acceptance:
Existing tests and status expectations stay intact. Run the per-crate gates (and calternal-server for route/contract changes), web gates if changed, and one time-boxed real-server regression/adversarial round for any new API contract. Preserve calternal-fs as the only filesystem interface and the server as the only writer. UI changes need pointer/touch/keyboard/screen-reader coverage and real-production captures at 390/820/1440 in both themes. Do not change shared motion for keyboard input.

Representative measurement from the audit (not a full-view budget result):
/api/v1/money/budgets/{id}/accounts, five serial requests after fixture readiness, all HTTP 200. Median/p95/max 44.7/50.8/50.8 ms; five-request burst median/p95/max 45.1/45.4/45.4 ms. Serial window server CPU 80 ms, RSS 444309504 bytes; no ETag on these sampled responses. Load inside lock 3.66/2.1/0.93.
Shared release server source cc25c441b7a974185622a1dee853cf38686d2b67, binary SHA-256 2f3567d91c34839851247bc0acbc25a56aaacd14dca269b8f0342ddf83447ed9; embedded production SPA; Chromium browser on the build host through SSH/HTTPS. Server/Home/Index on perf VM HDD emulator: direct-I/O loop, 8 ms read/write dm-delay, 200 IOPS and 150 MiB/s caps. Every measured phase held flock -w 14400 /root/perf.lock. Qualification QD1 115.3 IOPS/8.028 ms median, QD16 200.7 IOPS/96.993 ms. Fixture: 366 Daily notes, 10,980 Logs, 100 Files/Photos, 20 Notes/Tasks, three Budgets and 100 transactions; Mail empty, Admin one User.
Structural source evidence above is the newer audit base, not the measured binary revision. No claim that these revisions are equivalent. The baseline in docs/perf/baseline.json uses another fixture/build/transport; no regression ratio is valid here. See #663 for matching baseline endpoint values and coverage gaps.

Context: #663 matrix and DESIGN §58 rule 2. Scope: Money must bound lists by rows and bytes with signed keyset pages. Shared client machinery belongs only to #665–#668. Evidence at c4a61e8cf090170f35b1bed3350d9de20c83ecd5: - Endpoint: `GET /api/v1/money/budgets/{id}/transactions`. - Source: `crates/plugins/money/src/routes.rs:916`. Returns all matching transactions; no cursor/row/byte bound. Budgets (:338) and accounts (:612) also return complete sets. - Representative endpoint numbers, server/client revisions, fixture size, lock/HDD qualification and limits are in the #663 production/HDD table. Those numbers do not prove this rule passes; the structural gap above is separate evidence. Expected and regression tests: At 10k items (and largest realistic plugin data), every response has ≤100 item rows and an explicit total byte cap; nested arrays count toward both. Signed cursors bind User, view/filter/sort/zone and keyset position. Edits between pages do not skip or repeat unchanged items; malformed/cross-User/replayed scope cursors cannot change authorization. No OFFSET and no startup whole-corpus drain. Client retains first page plus one lookahead and a bounded resident row/byte window. Preserve deep links, selection, Copy link and current list order. Test large values and variable row size at the byte boundary, empty pages, filter switches, deleted cursor anchor and cache eviction. Performance test: Extend the existing bench profile for this hot path and the #549/#641 harness. Use production builds on root@10.69.69.63, bench/hdd-emu.sh and flock -w 14400 /root/perf.lock. Record load inside the lock; ≥5 samples, median/p95/max, average CPU/RSS and one realistic large-data/burst case. Separate warm, cold, accepted and durable boundaries. First usable 10k view ≤1.5 s; cached open/warm return ≤100 ms and accepted action ≤150 ms where applicable. Compare only a matching baseline in docs/perf/baseline.json; missing profiles require a new recorded baseline, not a made-up comparison. Reuse/ownership: Preserve lossless Markdown and exact integer arithmetic (DESIGN §48). Do not print amounts, costs or transaction contents in issue evidence, logs or artifacts. #641 owns active account traversal; coordinate after it lands. Reuse #555 userStorage, #549 route caches, Files signed keysets/change feed and the existing Db reader_pool. #641 owns blaze measurements; #642 owns Settings opening; #640 owns Mail layouts; #639 owns linked Note opening. Integrate their active/completed branches before changing related code. Acceptance: Existing tests and status expectations stay intact. Run the per-crate gates (and calternal-server for route/contract changes), web gates if changed, and one time-boxed real-server regression/adversarial round for any new API contract. Preserve calternal-fs as the only filesystem interface and the server as the only writer. UI changes need pointer/touch/keyboard/screen-reader coverage and real-production captures at 390/820/1440 in both themes. Do not change shared motion for keyboard input. Representative measurement from the audit (not a full-view budget result): `/api/v1/money/budgets/{id}/accounts`, five serial requests after fixture readiness, all HTTP 200. Median/p95/max 44.7/50.8/50.8 ms; five-request burst median/p95/max 45.1/45.4/45.4 ms. Serial window server CPU 80 ms, RSS 444309504 bytes; no ETag on these sampled responses. Load inside lock 3.66/2.1/0.93. Shared release server source `cc25c441b7a974185622a1dee853cf38686d2b67`, binary SHA-256 `2f3567d91c34839851247bc0acbc25a56aaacd14dca269b8f0342ddf83447ed9`; embedded production SPA; Chromium browser on the build host through SSH/HTTPS. Server/Home/Index on perf VM HDD emulator: direct-I/O loop, 8 ms read/write dm-delay, 200 IOPS and 150 MiB/s caps. Every measured phase held `flock -w 14400 /root/perf.lock`. Qualification QD1 115.3 IOPS/8.028 ms median, QD16 200.7 IOPS/96.993 ms. Fixture: 366 Daily notes, 10,980 Logs, 100 Files/Photos, 20 Notes/Tasks, three Budgets and 100 transactions; Mail empty, Admin one User. Structural source evidence above is the newer audit base, not the measured binary revision. No claim that these revisions are equivalent. The baseline in docs/perf/baseline.json uses another fixture/build/transport; no regression ratio is valid here. See #663 for matching baseline endpoint values and coverage gaps.
register-1440-dark.png
631 KiB
register-1440-light.png
761 KiB
register-390-dark.png
191 KiB
register-390-light.png
216 KiB
register-820-dark.png
370 KiB
register-820-light.png
430 KiB
register-1440-dark.png
812 KiB
register-1440-light.png
931 KiB
register-390-dark.png
274 KiB
register-390-light.png
283 KiB
register-820-dark.png
425 KiB
short-pages-1440-dark.png
825 KiB
short-pages-1440-light.png
919 KiB
short-pages-390-dark.png
261 KiB
short-pages-820-dark.png
395 KiB
short-pages-820-light.png
314 KiB
register-1440-dark.png
634 KiB
register-1440-light.png
778 KiB
register-390-dark.png
191 KiB
register-390-light.png
215 KiB
register-820-dark.png
372 KiB
short-pages-1440-dark.png
825 KiB
short-pages-390-light.png
263 KiB
short-pages-820-dark.png
395 KiB
short-pages-820-light.png
314 KiB
budget-comparison-1440-dark.png
640 KiB
budget-comparison-1440-light.png
751 KiB
budget-comparison-390-dark.png
263 KiB
budget-comparison-390-light.png
264 KiB
budget-comparison-820-dark.png
389 KiB
keyboard-open-1440-light.png
726 KiB
keyboard-open-390-dark.png
214 KiB
keyboard-open-390-light.png
228 KiB
keyboard-open-820-dark.png
341 KiB
keyboard-open-820-light.png
287 KiB
mouse-open-1440-dark.png
600 KiB
mouse-open-1440-light.png
725 KiB
mouse-open-390-dark.png
214 KiB
mouse-open-390-light.png
228 KiB
mouse-open-820-dark.png
341 KiB
register-1440-dark.png
630 KiB
register-1440-light.png
766 KiB
register-390-dark.png
275 KiB
register-390-light.png
282 KiB
budget-comparison-1440-dark.png
640 KiB
budget-comparison-1440-light.png
751 KiB
budget-comparison-390-dark.png
263 KiB
budget-comparison-390-light.png
264 KiB
budget-comparison-820-dark.png
389 KiB
budget-comparison-820-light.png
303 KiB
keyboard-open-1440-dark.png
600 KiB
keyboard-open-1440-light.png
726 KiB
keyboard-open-390-dark.png
214 KiB
keyboard-open-390-light.png
228 KiB
keyboard-open-820-dark.png
341 KiB
keyboard-open-820-light.png
287 KiB
mouse-open-1440-dark.png
600 KiB
mouse-open-1440-light.png
725 KiB
mouse-open-390-dark.png
214 KiB
mouse-open-390-light.png
228 KiB
mouse-open-820-dark.png
341 KiB
mouse-open-820-light.png
287 KiB
register-1440-dark.png
630 KiB
register-1440-light.png
766 KiB
register-390-dark.png
275 KiB
register-390-light.png
282 KiB
register-820-dark.png
423 KiB
budget-comparison-1440-dark.png
700 KiB
budget-comparison-1440-light.png
842 KiB
budget-comparison-390-dark.png
262 KiB
budget-comparison-390-light.png
263 KiB
budget-comparison-820-dark.png
390 KiB
budget-comparison-820-light.png
308 KiB
keyboard-open-1440-dark.png
720 KiB
keyboard-open-1440-light.png
847 KiB
keyboard-open-390-dark.png
243 KiB
keyboard-open-390-light.png
259 KiB
keyboard-open-820-dark.png
398 KiB
keyboard-open-820-light.png
349 KiB
mouse-open-1440-dark.png
716 KiB
mouse-open-1440-light.png
846 KiB
mouse-open-390-dark.png
243 KiB
mouse-open-390-light.png
259 KiB
mouse-open-820-light.png
349 KiB
register-1440-dark.png
848 KiB
register-1440-light.png
916 KiB
register-390-dark.png
340 KiB
register-390-light.png
350 KiB
register-820-dark.png
529 KiB
register-820-light.png
464 KiB
budget-comparison-1440-dark.png
637 KiB
budget-comparison-1440-light.png
745 KiB
budget-comparison-390-dark.png
262 KiB
budget-comparison-390-light.png
263 KiB
budget-comparison-820-dark.png
390 KiB
budget-comparison-820-light.png
306 KiB
keyboard-open-1440-dark.png
720 KiB
keyboard-open-1440-light.png
848 KiB
keyboard-open-390-dark.png
243 KiB
keyboard-open-390-light.png
259 KiB
keyboard-open-820-dark.png
398 KiB
keyboard-open-820-light.png
349 KiB
mouse-open-1440-dark.png
719 KiB
mouse-open-1440-light.png
846 KiB
mouse-open-390-dark.png
243 KiB
mouse-open-820-dark.png
398 KiB
mouse-open-820-light.png
349 KiB
register-1440-dark.png
780 KiB
register-1440-light.png
917 KiB
register-390-dark.png
340 KiB
register-390-light.png
350 KiB
register-820-dark.png
601 KiB
register-820-light.png
464 KiB
short-pages-1440-light.png
919 KiB
mouse-open-820-light.png
287 KiB
register-820-light.png
353 KiB
mouse-open-820-dark.png
398 KiB
budget-comparison-820-light.png
303 KiB
register-820-light.png
349 KiB
short-pages-390-light.png
263 KiB
register-820-light.png
392 KiB
mouse-open-390-light.png
259 KiB
short-pages-390-dark.png
261 KiB
keyboard-open-1440-dark.png
600 KiB
register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png register-820-dark.png register-820-light.png register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png register-820-dark.png short-pages-1440-dark.png short-pages-1440-light.png short-pages-390-dark.png short-pages-820-dark.png short-pages-820-light.png register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png register-820-dark.png short-pages-1440-dark.png short-pages-390-light.png short-pages-820-dark.png short-pages-820-light.png budget-comparison-1440-dark.png budget-comparison-1440-light.png budget-comparison-390-dark.png budget-comparison-390-light.png budget-comparison-820-dark.png keyboard-open-1440-light.png keyboard-open-390-dark.png keyboard-open-390-light.png keyboard-open-820-dark.png keyboard-open-820-light.png mouse-open-1440-dark.png mouse-open-1440-light.png mouse-open-390-dark.png mouse-open-390-light.png mouse-open-820-dark.png register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png budget-comparison-1440-dark.png budget-comparison-1440-light.png budget-comparison-390-dark.png budget-comparison-390-light.png budget-comparison-820-dark.png budget-comparison-820-light.png keyboard-open-1440-dark.png keyboard-open-1440-light.png keyboard-open-390-dark.png keyboard-open-390-light.png keyboard-open-820-dark.png keyboard-open-820-light.png mouse-open-1440-dark.png mouse-open-1440-light.png mouse-open-390-dark.png mouse-open-390-light.png mouse-open-820-dark.png mouse-open-820-light.png register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png register-820-dark.png budget-comparison-1440-dark.png budget-comparison-1440-light.png budget-comparison-390-dark.png budget-comparison-390-light.png budget-comparison-820-dark.png budget-comparison-820-light.png keyboard-open-1440-dark.png keyboard-open-1440-light.png keyboard-open-390-dark.png keyboard-open-390-light.png keyboard-open-820-dark.png keyboard-open-820-light.png mouse-open-1440-dark.png mouse-open-1440-light.png mouse-open-390-dark.png mouse-open-390-light.png mouse-open-820-light.png register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png register-820-dark.png register-820-light.png budget-comparison-1440-dark.png budget-comparison-1440-light.png budget-comparison-390-dark.png budget-comparison-390-light.png budget-comparison-820-dark.png budget-comparison-820-light.png keyboard-open-1440-dark.png keyboard-open-1440-light.png keyboard-open-390-dark.png keyboard-open-390-light.png keyboard-open-820-dark.png keyboard-open-820-light.png mouse-open-1440-dark.png mouse-open-1440-light.png mouse-open-390-dark.png mouse-open-820-dark.png mouse-open-820-light.png register-1440-dark.png register-1440-light.png register-390-dark.png register-390-light.png register-820-dark.png register-820-light.png short-pages-1440-light.png mouse-open-820-light.png register-820-light.png mouse-open-820-dark.png budget-comparison-820-light.png register-820-light.png short-pages-390-light.png register-820-light.png mouse-open-390-light.png short-pages-390-dark.png keyboard-open-1440-dark.png
kayg commented 2026-10-07 01:20:11 +00:00
Author
Owner
Copy link

#1219 Money bug-bash evidence, measured locally on the production web build and local server with a synthetic 50,000-transaction Actual import:

  • Import completed in 86.4 s.
  • The transactions API returned 50,000 raw rows in 13.0 s. BigInt recomputation from those rows matched the account working, cleared and uncleared balances.
  • Opening the Account route made a transaction-list API request that returned in 21.6 s, but the accessible Transactions table did not become visible during a 240 s wait. The probe stopped before its register screenshot and heap sample.

This is one local run under shared-host load, not a baseline comparison or a perf-VM benchmark. Probe: target/tmp/money-50000-probe.mjs. No transaction values were logged. The #641 owner scope remains unchanged.

#1219 Money bug-bash evidence, measured locally on the production web build and local server with a synthetic 50,000-transaction Actual import: - Import completed in 86.4 s. - The transactions API returned 50,000 raw rows in 13.0 s. BigInt recomputation from those rows matched the account working, cleared and uncleared balances. - Opening the Account route made a transaction-list API request that returned in 21.6 s, but the accessible Transactions table did not become visible during a 240 s wait. The probe stopped before its register screenshot and heap sample. This is one local run under shared-host load, not a baseline comparison or a perf-VM benchmark. Probe: `target/tmp/money-50000-probe.mjs`. No transaction values were logged. The #641 owner scope remains unchanged.
kayg commented 2026-10-07 10:23:43 +00:00
Author
Owner
Copy link

Started #688 on job/money-688, base 3601719b80a39f712daf07b37879b22929dfffa0. Merged job/bash-money at cc161522a. Reads rebuild the complete Ledger; accounts replay it; the client waits for all context before rendering all transactions. I will add revision-bound register pages and reuse the existing Money arithmetic and controls. No financial contents will be logged.

Started #688 on `job/money-688`, base `3601719b80a39f712daf07b37879b22929dfffa0`. Merged `job/bash-money` at `cc161522a`. Reads rebuild the complete Ledger; accounts replay it; the client waits for all context before rendering all transactions. I will add revision-bound register pages and reuse the existing Money arithmetic and controls. No financial contents will be logged.
kayg commented 2026-10-07 10:40:02 +00:00
Author
Owner
Copy link

The new focused property test passed: 48 random sets, each tested before and after amount/date/cleared edits and deletions. It traverses every page for two Accounts and all/cleared/uncleared filters, checks each running balance and Account summary against raw BigInt postings, and checks page row/byte caps. Splits and both transfer legs are included. Cursor tests reject forged, cross-User and filter-replayed tokens.

The implementation reuses Money posting views and exact core replay. Page reads select bounded metadata before payloads, so oversized imported Notes cannot expand a page request working set. The current projection is revision-local; persistent incremental projection maintenance and cold-start costs still need assessment. The perf VM became occupied before a measured run started.

The new focused property test passed: 48 random sets, each tested before and after amount/date/cleared edits and deletions. It traverses every page for two Accounts and all/cleared/uncleared filters, checks each running balance and Account summary against raw BigInt postings, and checks page row/byte caps. Splits and both transfer legs are included. Cursor tests reject forged, cross-User and filter-replayed tokens. The implementation reuses Money posting views and exact core replay. Page reads select bounded metadata before payloads, so oversized imported Notes cannot expand a page request working set. The current projection is revision-local; persistent incremental projection maintenance and cold-start costs still need assessment. The perf VM became occupied before a measured run started.
kayg commented 2026-10-07 11:11:01 +00:00
Author
Owner
Copy link

Money #688 progress

Branch job/money-688. Commits ce80df382 and b89ccd4be. Merged job/bash-money, then fetched and merged origin/dev once (344a40dd4).

The API now returns signed bidirectional keyset pages, with SQL filters and exact unfiltered per-Account running balances. Each response is capped at 100 nested items and 256 KiB. The browser retains at most four pages and renders a virtual row window. Stable deep links request the linked row directly. Inline drafts stay mounted outside the moving window.

Important remaining gap: the SQL projection is revision-local and immutable. It rebuilds the complete Ledger after a source change. This does not yet implement persistent incremental aggregates updated with every write, so this is not READY FOR MERGE for the full brief. I will report cold and post-write cost separately.

Focused web tests: 2 files passed, 42 tests passed. A prior full-suite run had one Composer timeout; that file passed the focused rerun. Money and final web gates are running. The perf VM reports another lock holder (calternal tabswitch-1233); no unlocked measurements have run.

Money #688 progress Branch job/money-688. Commits ce80df382 and b89ccd4be. Merged job/bash-money, then fetched and merged origin/dev once (344a40dd4). The API now returns signed bidirectional keyset pages, with SQL filters and exact unfiltered per-Account running balances. Each response is capped at 100 nested items and 256 KiB. The browser retains at most four pages and renders a virtual row window. Stable deep links request the linked row directly. Inline drafts stay mounted outside the moving window. Important remaining gap: the SQL projection is revision-local and immutable. It rebuilds the complete Ledger after a source change. This does not yet implement persistent incremental aggregates updated with every write, so this is not READY FOR MERGE for the full brief. I will report cold and post-write cost separately. Focused web tests: 2 files passed, 42 tests passed. A prior full-suite run had one Composer timeout; that file passed the focused rerun. Money and final web gates are running. The perf VM reports another lock holder (calternal tabswitch-1233); no unlocked measurements have run.
kayg commented 2026-10-07 13:03:14 +00:00
Author
Owner
Copy link

Committed cursor preflight and expiry at 2829bc799. Malformed or expired cursors return 400 before Budget loading. Focused Money register tests: test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 123 filtered out; finished in 105.88s; import oracle tests: test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 28 filtered out; finished in 10.90s.

The production release build completed. A small rebuild is in progress for the last cursor change. The perf VM is free; 50k/200k qualification is next. UI fixes in progress cover short pages with no scroll overflow and canonical Transaction links older than page one.

Not ready for merge: revision-local rebuilds still do not provide persistent incremental aggregates updated with each write.

Committed cursor preflight and expiry at `2829bc799`. Malformed or expired cursors return 400 before Budget loading. Focused Money register tests: `test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 123 filtered out; finished in 105.88s`; import oracle tests: `test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 28 filtered out; finished in 10.90s`. The production release build completed. A small rebuild is in progress for the last cursor change. The perf VM is free; 50k/200k qualification is next. UI fixes in progress cover short pages with no scroll overflow and canonical Transaction links older than page one. Not ready for merge: revision-local rebuilds still do not provide persistent incremental aggregates updated with each write.
kayg commented 2026-10-07 14:39:27 +00:00
Author
Owner
Copy link

Starting #688 work on branch job/money-688, from base 0419170fe456b58614befcb12d9c9d255118f1c0 (origin/dev). The worktree already contains earlier committed #688 paging, projection, virtualization and profiling slices. I am merging origin/job/bash-money first to include its latest Money fixes before continuing.

Starting #688 work on branch `job/money-688`, from base `0419170fe456b58614befcb12d9c9d255118f1c0` (`origin/dev`). The worktree already contains earlier committed #688 paging, projection, virtualization and profiling slices. I am merging `origin/job/bash-money` first to include its latest Money fixes before continuing.
kayg commented 2026-10-07 15:08:35 +00:00
Author
Owner
Copy link

Finding from the existing #688 perf profile: at 50,000 transactions, the prior cold register page took 5.7 s and first rows appeared after 6.68 s. At 200,000 rows, four concurrent cold reads caused the server to be OOM-killed at about 7 GiB RSS. The previous projection retained a full TransactionView vector and a second full JSON response while building. This change streams rows into bounded SQL batches and serializes cold builds so waiters reuse the committed generation. Amounts and account data were not included in the profile or this comment.

Finding from the existing #688 perf profile: at 50,000 transactions, the prior cold register page took 5.7 s and first rows appeared after 6.68 s. At 200,000 rows, four concurrent cold reads caused the server to be OOM-killed at about 7 GiB RSS. The previous projection retained a full TransactionView vector and a second full JSON response while building. This change streams rows into bounded SQL batches and serializes cold builds so waiters reuse the committed generation. Amounts and account data were not included in the profile or this comment.
kayg commented 2026-10-07 16:20:29 +00:00
Author
Owner
Copy link

Decision for #688: Money Markdown files remain authoritative. A durable Index generation is keyed by the directory-relative kernel fingerprints of every source file, and its transaction rows, per-row exact prefixes, category/search indexes and AccountList aggregate publish in one SQLite transaction. Import builds this generation before confirmation succeeds. A later file change invalidates the prior generation; the first register/account read rebuilds it, with concurrent misses coalesced. The bounded read cost is an indexed keyset lookup plus at most 100 rows and 256 KiB of payload. A cold rebuild sorts the transaction references once and projects O(N) rows with a 128-row working batch; source ledger memory remains necessary for validation and import.

Decision for #688: Money Markdown files remain authoritative. A durable Index generation is keyed by the directory-relative kernel fingerprints of every source file, and its transaction rows, per-row exact prefixes, category/search indexes and AccountList aggregate publish in one SQLite transaction. Import builds this generation before confirmation succeeds. A later file change invalidates the prior generation; the first register/account read rebuilds it, with concurrent misses coalesced. The bounded read cost is an indexed keyset lookup plus at most 100 rows and 256 KiB of payload. A cold rebuild sorts the transaction references once and projects O(N) rows with a 128-row working batch; source ledger memory remains necessary for validation and import.
kayg commented 2026-10-07 18:13:00 +00:00
Author
Owner
Copy link

Real production-build probe finding for #688: a synthetic 50,000-row import completed in 10,938 ms. The register rendered meaningful content with no framework overlay, console errors, or uncaught page errors. Keyboard paging, draft retention, stable identity, touch targets, and keyboard menu probes passed; 9 hostile reads were rejected and a 16-request burst completed. The oversized-row probe accepted the transaction write (201) but the register page returned 413. This is tracked separately by #1365; it remains a known gap for this job. Twelve 1x macOS-emulated screenshots cover the register at 390/820/1440 px in light and dark, plus the short-page interactions.

Real production-build probe finding for #688: a synthetic 50,000-row import completed in 10,938 ms. The register rendered meaningful content with no framework overlay, console errors, or uncaught page errors. Keyboard paging, draft retention, stable identity, touch targets, and keyboard menu probes passed; 9 hostile reads were rejected and a 16-request burst completed. The oversized-row probe accepted the transaction write (201) but the register page returned 413. This is tracked separately by #1365; it remains a known gap for this job. Twelve 1x macOS-emulated screenshots cover the register at 390/820/1440 px in light and dark, plus the short-page interactions.
kayg commented 2026-10-07 18:17:45 +00:00
Author
Owner
Copy link

Perf-VM finding for #688, revision 5b8b736f3. The locked run recorded load average [0.71, 0.42, 0.47]. On 50k transactions: import 10.23 s; warm page p95 29.1 ms; account summary p95 4.1 ms; warm first rows p95 508.61 ms; scroll-frame p95 100.1 ms. On 200k: import 59.06 s; warm page p95 90.5 ms; account summary p95 18.1 ms; warm first rows p95 2,794.2 ms; scroll-frame p95 66.7 ms; server RSS after profile 3,142,860,800 bytes. The page and summary APIs meet their targets, while 200k first rows and both scroll profiles miss the targets. The complete report is in the worktree artifacts; I’m investigating client render and page-prefetch cost before finalizing the post-change baseline.

Perf-VM finding for #688, revision 5b8b736f3. The locked run recorded load average [0.71, 0.42, 0.47]. On 50k transactions: import 10.23 s; warm page p95 29.1 ms; account summary p95 4.1 ms; warm first rows p95 508.61 ms; scroll-frame p95 100.1 ms. On 200k: import 59.06 s; warm page p95 90.5 ms; account summary p95 18.1 ms; warm first rows p95 2,794.2 ms; scroll-frame p95 66.7 ms; server RSS after profile 3,142,860,800 bytes. The page and summary APIs meet their targets, while 200k first rows and both scroll profiles miss the targets. The complete report is in the worktree artifacts; I’m investigating client render and page-prefetch cost before finalizing the post-change baseline.
kayg commented 2026-10-07 19:46:05 +00:00
Author
Owner
Copy link

Perf update on job/money-688, head 74ce2f0aaf631361e18b2687015694030802d7a9:

  • Added the final 50k/200k perf-VM profile to docs/perf/baseline.json. Warm page API p95 was 50.2 ms / 26 ms; account summary p95 was 6.5 ms / 5.3 ms. First-row p95 was 833.67 ms / 2696.04 ms, scroll-frame p95 was 116.7 ms / 100.1 ms, and final 200k server RSS was 3,110,117,376 bytes.
  • The first page request after import took 19.2 s / 89.4 s. The cold generation path is still O(N); transaction and account aggregates are not yet maintained in the same transaction as every source write.
  • Four parallel warm reads returned at 31 ms / 30.1 ms p95. A separate bounded adversarial round ran; an earlier 16-read Unicode-search/concurrency probe remained CPU-bound for nearly eight minutes and did not finish in its timebox. The cause was not isolated.
  • Refreshed existing exact perf pins and Svelte syntax pins without changing limits or the ratchet. A fresh scripts/perf-lint --check still reports 368 unpinned Money findings (342 in register.rs, 26 in routes.rs) and exits perf-lint: FAIL; 368 violations; 22441 scoped exceptions. Most are the cold projection builder call graph. I have not hidden those calls behind generic exceptions.
Perf update on `job/money-688`, head `74ce2f0aaf631361e18b2687015694030802d7a9`: - Added the final 50k/200k perf-VM profile to `docs/perf/baseline.json`. Warm page API p95 was 50.2 ms / 26 ms; account summary p95 was 6.5 ms / 5.3 ms. First-row p95 was 833.67 ms / 2696.04 ms, scroll-frame p95 was 116.7 ms / 100.1 ms, and final 200k server RSS was 3,110,117,376 bytes. - The first page request after import took 19.2 s / 89.4 s. The cold generation path is still O(N); transaction and account aggregates are not yet maintained in the same transaction as every source write. - Four parallel warm reads returned at 31 ms / 30.1 ms p95. A separate bounded adversarial round ran; an earlier 16-read Unicode-search/concurrency probe remained CPU-bound for nearly eight minutes and did not finish in its timebox. The cause was not isolated. - Refreshed existing exact perf pins and Svelte syntax pins without changing limits or the ratchet. A fresh `scripts/perf-lint --check` still reports 368 unpinned Money findings (342 in `register.rs`, 26 in `routes.rs`) and exits `perf-lint: FAIL; 368 violations; 22441 scoped exceptions`. Most are the cold projection builder call graph. I have not hidden those calls behind generic exceptions.
kayg commented 2026-10-07 20:43:31 +00:00
Author
Owner
Copy link

#688 job report

Head: 2e10473cc68b3b8a93b5b6fad055fc7a6cd5ad2e (job/money-688). This is not ready to merge: the persistent projection still rebuilds from the full Ledger after a source change, and the 200k first-row and scroll-frame targets are missed.

Built

  • Added durable SQLite register pages with keyset cursors ordered by (date, id, account), SQL filters, bounded page rows and bytes, exact running-balance columns, account summaries, and search/category indexes.
  • Added a shared virtual-row primitive and wired the Money register to load pages on scroll while retaining keyboard selection, inline edits, optimistic cleared-state edits, stable links, and row semantics.
  • Added BigInt property coverage for paged balances with same-day rows, splits, transfers, edits, deletes, and cleared states.
  • Added the Money 688 profile to docs/perf/baseline.json and updated the upgrade receipt for migration money/0001.

Perf VM profile

Measured with perf-run calternal money688; VM load average was [1.89, 2.08, 1.64]. Profile binary revision: 5e6beee4f05e4c67ea8f4ff799f80d9a50924ad.

Transactions Warm page API p95 Account summary p95 First rows p95 Scroll frame p95 Final server RSS
50k 50.2 ms 6.5 ms 833.67 ms 116.7 ms 549 MB
200k 26 ms 5.3 ms 2696.04 ms 100.1 ms 3.11 GB

Cold projection page build was 19.2 s at 50k and 89.45 s at 200k. The warm API page and account summary targets pass. The 200k first-row target and both scroll-frame targets fail. Import measured 16.3 s at 50k and 64.8 s at 200k.

Gates

  • cargo fmt --check: exit 0, no output.
  • cargo clippy -p calternal-plugin-money --all-targets -- -D warnings: passed.
  • cargo test -p calternal-plugin-money: passed (130 unit tests and 27 integration tests; 2 and 3 ignored respectively).
  • cargo clippy -p calternal-money --all-targets -- -D warnings: passed.
  • cargo test -p calternal-money: passed.
  • cargo clippy -p calternal-server --all-targets -- -D warnings: passed.
  • cargo test -p calternal-server -- --test-threads=4: the Money migration expectations pass; the full run fails in deterministic_performance_guards because the Money register adds 368 perf-lint findings.
  • bun run check: fails at perf-lint: perf-lint: FAIL; 368 violations; 22441 scoped exceptions. Svelte reports 0 errors and one existing empty-ruleset warning.
  • bun run test: passed, 290 files and 2,045 tests.

No broad perf exceptions were added to hide the findings. The remaining call graph includes a cold projection build and SQL writes during a list request, so classifying it as an index read would be inaccurate. The durable register and account aggregates are not updated in the same transaction as each source write. That work is required to remove the O(N) rebuild and meet the cold-path target.

Screenshots

macOS platform emulation, scale 1, light and dark themes:

## #688 job report Head: `2e10473cc68b3b8a93b5b6fad055fc7a6cd5ad2e` (`job/money-688`). This is not ready to merge: the persistent projection still rebuilds from the full Ledger after a source change, and the 200k first-row and scroll-frame targets are missed. ### Built - Added durable SQLite register pages with keyset cursors ordered by `(date, id, account)`, SQL filters, bounded page rows and bytes, exact running-balance columns, account summaries, and search/category indexes. - Added a shared virtual-row primitive and wired the Money register to load pages on scroll while retaining keyboard selection, inline edits, optimistic cleared-state edits, stable links, and row semantics. - Added BigInt property coverage for paged balances with same-day rows, splits, transfers, edits, deletes, and cleared states. - Added the Money 688 profile to `docs/perf/baseline.json` and updated the upgrade receipt for migration `money/0001`. ### Perf VM profile Measured with `perf-run calternal money688`; VM load average was `[1.89, 2.08, 1.64]`. Profile binary revision: `5e6beee4f05e4c67ea8f4ff799f80d9a50924ad`. | Transactions | Warm page API p95 | Account summary p95 | First rows p95 | Scroll frame p95 | Final server RSS | | ---: | ---: | ---: | ---: | ---: | ---: | | 50k | 50.2 ms | 6.5 ms | 833.67 ms | 116.7 ms | 549 MB | | 200k | 26 ms | 5.3 ms | 2696.04 ms | 100.1 ms | 3.11 GB | Cold projection page build was 19.2 s at 50k and 89.45 s at 200k. The warm API page and account summary targets pass. The 200k first-row target and both scroll-frame targets fail. Import measured 16.3 s at 50k and 64.8 s at 200k. ### Gates - `cargo fmt --check`: exit 0, no output. - `cargo clippy -p calternal-plugin-money --all-targets -- -D warnings`: passed. - `cargo test -p calternal-plugin-money`: passed (130 unit tests and 27 integration tests; 2 and 3 ignored respectively). - `cargo clippy -p calternal-money --all-targets -- -D warnings`: passed. - `cargo test -p calternal-money`: passed. - `cargo clippy -p calternal-server --all-targets -- -D warnings`: passed. - `cargo test -p calternal-server -- --test-threads=4`: the Money migration expectations pass; the full run fails in `deterministic_performance_guards` because the Money register adds 368 perf-lint findings. - `bun run check`: fails at perf-lint: `perf-lint: FAIL; 368 violations; 22441 scoped exceptions`. Svelte reports 0 errors and one existing empty-ruleset warning. - `bun run test`: passed, 290 files and 2,045 tests. No broad perf exceptions were added to hide the findings. The remaining call graph includes a cold projection build and SQL writes during a list request, so classifying it as an index read would be inaccurate. The durable register and account aggregates are not updated in the same transaction as each source write. That work is required to remove the O(N) rebuild and meet the cold-path target. ### Screenshots macOS platform emulation, scale 1, light and dark themes: - [390 light](https://git.kayg.org/attachments/ac227738-ed33-4c83-b316-6bf9a1197f52), [390 dark](https://git.kayg.org/attachments/a442b525-582d-43af-b0e0-f48aa3ec30a8) - [820 light](https://git.kayg.org/attachments/b3af0b61-9367-498d-99f9-9102735d4f7b), [820 dark](https://git.kayg.org/attachments/167972de-3bb1-4ce8-b5c4-3445abbbe3a7) - [1440 light](https://git.kayg.org/attachments/843a901e-03b9-48f7-ad91-9ffb8c2b8df3), [1440 dark](https://git.kayg.org/attachments/eaa86f55-f8f0-461d-8851-e68a550832fb)
kayg commented 2026-10-08 04:17:08 +00:00
Author
Owner
Copy link

Started money688b on job/money-688, base 2e10473cc68b3b8a93b5b6fad055fc7a6cd5ad2e. Read the predecessor report. First priority is source-write projection consistency and exact balances. Existing cold read rebuilds, perf-lint violations, first-row/scroll latency and RSS remain blocking until measured and verified. No financial contents will be logged.

Started money688b on `job/money-688`, base `2e10473cc68b3b8a93b5b6fad055fc7a6cd5ad2e`. Read the predecessor report. First priority is source-write projection consistency and exact balances. Existing cold read rebuilds, perf-lint violations, first-row/scroll latency and RSS remain blocking until measured and verified. No financial contents will be logged.
kayg commented 2026-10-08 04:37:59 +00:00
Author
Owner
Copy link

money688b findings and first slice:

  • Source fingerprints were also the per-row SQL index key. Added a separate stable row signature (migration money/0002; origin/dev currently has no Money migrations). Supported Money create/edit/delete/cleared, Account/Category creation and Assignment writes now publish row deltas and summaries before returning. Unchanged SQL row identities are preserved.
  • Found a stale-builder race: the cold builder released its source read lock before SQL publication. It now holds that lock through publication. Page metadata and payload reads use one WAL snapshot and refuse a replaced generation.
  • The new independent BigInt property test passed 16 random operation sequences (inserts, backdated edits, deletes, small import batches, split/transfer shape changes and month moves), checking every prefix, Account summary and the cash conservation invariant after each operation. The persistent production-route mutation test also passed.
  • The first full Money suite exposed a Rust test-thread stack overflow after the larger SQLx mutation future was nested into routes. Heap-pinned transaction futures fix the focused failing existing regression; the full suite is being rerun. Existing assertions were preserved.
  • Important remaining limits: source file publication and SQLite publication remain separate crash checkpoints; missing/mismatched projections still rebuild on read, and source validation/summary calculation still replay the Ledger on writes. These are not claimed as solved. Separate number review remains required before merge.
  • Perf VM currently reports holder calternal apiaudit2-bulk. No unlocked or local timing run was made.
money688b findings and first slice: - Source fingerprints were also the per-row SQL index key. Added a separate stable row signature (migration money/0002; origin/dev currently has no Money migrations). Supported Money create/edit/delete/cleared, Account/Category creation and Assignment writes now publish row deltas and summaries before returning. Unchanged SQL row identities are preserved. - Found a stale-builder race: the cold builder released its source read lock before SQL publication. It now holds that lock through publication. Page metadata and payload reads use one WAL snapshot and refuse a replaced generation. - The new independent BigInt property test passed 16 random operation sequences (inserts, backdated edits, deletes, small import batches, split/transfer shape changes and month moves), checking every prefix, Account summary and the cash conservation invariant after each operation. The persistent production-route mutation test also passed. - The first full Money suite exposed a Rust test-thread stack overflow after the larger SQLx mutation future was nested into routes. Heap-pinned transaction futures fix the focused failing existing regression; the full suite is being rerun. Existing assertions were preserved. - Important remaining limits: source file publication and SQLite publication remain separate crash checkpoints; missing/mismatched projections still rebuild on read, and source validation/summary calculation still replay the Ledger on writes. These are not claimed as solved. Separate number review remains required before merge. - Perf VM currently reports holder calternal apiaudit2-bulk. No unlocked or local timing run was made.
kayg commented 2026-10-08 05:06:45 +00:00
Author
Owner
Copy link

money688b follow-up findings

  • ce33395d5 makes metadata-only edits preserve row identity and running-balance prefixes. A persistent SQLite trigger rejects any prefix update while marking a middle-history posting cleared. The focused register suite passes: test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 124 filtered out; finished in 384.59s; import review filter: test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 30 filtered out; finished in 9.62s.
  • Found oversized-generation duplication: UserMoney::load retains the complete Budget only when the projection byte permit is admitted. Denied requests therefore rebuild separate Ledgers even while another request owns the same generation. Added an active weak snapshot, validated by the same source fingerprints, to share overlapping requests without idle retention. The regression uses a zero-byte admission limit and checks shared identity, release at idle, and external source invalidation; verification is pending.
  • Found the Account register starts Month replay before the first transaction request. Changed the order to publish first rows to the DOM before requesting context. No new numeric formula or UI primitive.
  • Source-file writes and SQLite are still separate durable commit points; old-database cold reads still block on full projection construction. Neither blocker is claimed fixed. Separate number review remains required before merge.
# money688b follow-up findings - `ce33395d5` makes metadata-only edits preserve row identity and running-balance prefixes. A persistent SQLite trigger rejects any prefix update while marking a middle-history posting cleared. The focused register suite passes: `test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 124 filtered out; finished in 384.59s`; import review filter: `test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 30 filtered out; finished in 9.62s`. - Found oversized-generation duplication: `UserMoney::load` retains the complete Budget only when the projection byte permit is admitted. Denied requests therefore rebuild separate Ledgers even while another request owns the same generation. Added an active weak snapshot, validated by the same source fingerprints, to share overlapping requests without idle retention. The regression uses a zero-byte admission limit and checks shared identity, release at idle, and external source invalidation; verification is pending. - Found the Account register starts Month replay before the first transaction request. Changed the order to publish first rows to the DOM before requesting context. No new numeric formula or UI primitive. - Source-file writes and SQLite are still separate durable commit points; old-database cold reads still block on full projection construction. Neither blocker is claimed fixed. Separate number review remains required before merge.
kayg commented 2026-10-08 06:35:16 +00:00
Author
Owner
Copy link

Money688b verification finding (current committed head 132279b51):

  • Money core and plugin tests pass. The new random-operation property test compares each prefix and Account summary with BigInt recomputation after each write and checks the DESIGN §48 conservation invariant. A separate number review remains required before merge.
  • The server upgrade test expected one Money migration receipt. #688 adds migration 2, so the receipt count must include both. I changed that count only; the checks that old receipts stay unchanged remain. The focused upgrade test passes. The private Index permissions integration test passes.
  • The deterministic performance guard and web check still fail: perf-lint: FAIL; 393 violations; 22441 scoped exceptions. No waiver was added to hide this result. The cold builder and incremental query loops still need work.
  • The full web test run ended with 5 failed files / 6 failed tests, all 5000 ms timeouts outside Money. The focused Money and shared-focus tests pass. I did not change those expectations or timeouts.
  • The focused real production UI walk passed Older/Arrow navigation, stable deep links and retained inline drafts without capture contexts. It then failed the unchanged 44 px row-action assertion. Register icon actions overrode Pill with the compact size. I removed those overrides and used the shared glyphSize prop. The 32 focused control/form tests pass. Fresh production captures and the UI probe are next.
  • The perf VM run is queued through perf-run; its lock is held by another calternal job. The copied release server and baseline have verified hashes. An earlier setup attempt stopped before measurement because its media runtime lacked vips links; those links now point to the installed VM tools. No benchmark numbers are available yet.

Remaining blocking architecture gap: source Markdown writes precede the SQLite transaction. Register rows and summaries publish together, but source files and the Index still have two durability points. Normal writes still replay source totals, and a missing generation still blocks the first page on a full build.

Money688b verification finding (current committed head 132279b51): - Money core and plugin tests pass. The new random-operation property test compares each prefix and Account summary with BigInt recomputation after each write and checks the DESIGN §48 conservation invariant. A separate number review remains required before merge. - The server upgrade test expected one Money migration receipt. #688 adds migration 2, so the receipt count must include both. I changed that count only; the checks that old receipts stay unchanged remain. The focused upgrade test passes. The private Index permissions integration test passes. - The deterministic performance guard and web check still fail: `perf-lint: FAIL; 393 violations; 22441 scoped exceptions`. No waiver was added to hide this result. The cold builder and incremental query loops still need work. - The full web test run ended with 5 failed files / 6 failed tests, all 5000 ms timeouts outside Money. The focused Money and shared-focus tests pass. I did not change those expectations or timeouts. - The focused real production UI walk passed Older/Arrow navigation, stable deep links and retained inline drafts without capture contexts. It then failed the unchanged 44 px row-action assertion. Register icon actions overrode Pill with the compact size. I removed those overrides and used the shared glyphSize prop. The 32 focused control/form tests pass. Fresh production captures and the UI probe are next. - The perf VM run is queued through `perf-run`; its lock is held by another calternal job. The copied release server and baseline have verified hashes. An earlier setup attempt stopped before measurement because its media runtime lacked vips links; those links now point to the installed VM tools. No benchmark numbers are available yet. Remaining blocking architecture gap: source Markdown writes precede the SQLite transaction. Register rows and summaries publish together, but source files and the Index still have two durability points. Normal writes still replay source totals, and a missing generation still blocks the first page on a full build.
kayg commented 2026-10-08 06:44:06 +00:00
Author
Owner
Copy link

Focused production probe result (2000 synthetic rows, local correctness only, release binary SHA-256 e7ec2b191c2e58f5a9649b136e3bf1eb6b185c33d6fb397dee60fec838a76d8a):

  • 9 malformed or replayed inputs rejected; 16 burst reads passed the status and byte bounds.
  • Older/Arrow navigation, retained draft, old stable identity, 44 px touch targets and Shift+F10 menu checks passed.
  • No browser console errors or uncaught page exceptions.
  • Blocking finding retained in #688: a valid 100-Tag transaction returns 201, then the register returns 413 because one row exceeds its nested-item page cap. A source row accepted by the write API must not make its register unreadable. This needs admission or a bounded child-read contract; the current branch does neither. The probe records the real statuses and does not weaken a test.
  • The opening-focus assertions passed at 390/820/1440 in light and dark. The captures still showed the update toast because the review server and web build IDs differed. Those captures are not final evidence. I am building the matching review server and will recapture with an explicit clean-build assertion.

The five web files that timed out in the full run passed the focused retry unchanged: Test Files 5 passed (5), Tests 71 passed (71), Duration 76.04s. The full-run failure remains in the gate record.

Focused production probe result (2000 synthetic rows, local correctness only, release binary SHA-256 e7ec2b191c2e58f5a9649b136e3bf1eb6b185c33d6fb397dee60fec838a76d8a): - 9 malformed or replayed inputs rejected; 16 burst reads passed the status and byte bounds. - Older/Arrow navigation, retained draft, old stable identity, 44 px touch targets and Shift+F10 menu checks passed. - No browser console errors or uncaught page exceptions. - Blocking finding retained in #688: a valid 100-Tag transaction returns 201, then the register returns 413 because one row exceeds its nested-item page cap. A source row accepted by the write API must not make its register unreadable. This needs admission or a bounded child-read contract; the current branch does neither. The probe records the real statuses and does not weaken a test. - The opening-focus assertions passed at 390/820/1440 in light and dark. The captures still showed the update toast because the review server and web build IDs differed. Those captures are not final evidence. I am building the matching review server and will recapture with an explicit clean-build assertion. The five web files that timed out in the full run passed the focused retry unchanged: `Test Files 5 passed (5)`, `Tests 71 passed (71)`, `Duration 76.04s`. The full-run failure remains in the gate record.
kayg commented 2026-10-08 06:57:24 +00:00
Author
Owner
Copy link

Clean production evidence for #688. These 24 original PNGs use macOS platform emulation, real synthetic fixtures and matching web/server build IDs. The harness asserts real rows and no update toast. Mouse and Enter opening both assert that programmatic focus has no ring. Arrow navigation still uses the shared keyboard flag. The adjacent Budget screen is the comparison; Claude remains the visual reviewer.

Width / theme Register Mouse opening Enter opening Budget comparison
390 / light PNG PNG PNG PNG
390 / dark PNG PNG PNG PNG
820 / light PNG PNG PNG PNG
820 / dark PNG PNG PNG PNG
1440 / light PNG PNG PNG PNG
1440 / dark PNG PNG PNG PNG
Clean production evidence for #688. These 24 original PNGs use macOS platform emulation, real synthetic fixtures and matching web/server build IDs. The harness asserts real rows and no update toast. Mouse and Enter opening both assert that programmatic focus has no ring. Arrow navigation still uses the shared keyboard flag. The adjacent Budget screen is the comparison; Claude remains the visual reviewer. | Width / theme | Register | Mouse opening | Enter opening | Budget comparison | | --- | --- | --- | --- | --- | | 390 / light | [PNG](https://git.kayg.org/attachments/3d529600-8e49-4974-b7b9-db0d95ce3163) | [PNG](https://git.kayg.org/attachments/0cf23545-6d7a-4e98-842f-56d2e43933a3) | [PNG](https://git.kayg.org/attachments/f46a8ca6-9323-4274-95b6-4f8849122b6f) | [PNG](https://git.kayg.org/attachments/7daf2424-0c62-496c-a60f-c30c80b4886b) | | 390 / dark | [PNG](https://git.kayg.org/attachments/91f9d46d-561d-4b84-9949-0c4c028491cc) | [PNG](https://git.kayg.org/attachments/79a16db0-0946-444d-b547-8c920826c48d) | [PNG](https://git.kayg.org/attachments/92adaf90-d1f6-4cc1-b0ac-592fea81ba1f) | [PNG](https://git.kayg.org/attachments/9a94c392-c6a1-41d8-85e5-dbd7c925d2f6) | | 820 / light | [PNG](https://git.kayg.org/attachments/858e3397-bb43-4d1b-ad16-72d225db02a2) | [PNG](https://git.kayg.org/attachments/8b734b35-d655-4487-b00f-5dd2024356d5) | [PNG](https://git.kayg.org/attachments/a69af889-362a-499d-85f4-7c8beb075554) | [PNG](https://git.kayg.org/attachments/09ea6186-e770-4371-923a-beac824988d8) | | 820 / dark | [PNG](https://git.kayg.org/attachments/fa04d5f5-09ac-43db-95eb-7cae88f830eb) | [PNG](https://git.kayg.org/attachments/bdc81e32-1ef8-4cb0-86b9-efd3ba26675c) | [PNG](https://git.kayg.org/attachments/e9d9ed55-72b3-4d63-b7e6-6ab34b2c15aa) | [PNG](https://git.kayg.org/attachments/50800eed-0a14-422d-a72d-6a056fcb4ba2) | | 1440 / light | [PNG](https://git.kayg.org/attachments/841d0d72-838e-4f3c-89e5-8bc86f66b0ec) | [PNG](https://git.kayg.org/attachments/227a9bc8-abc5-47fe-b1e7-63f468fd55bb) | [PNG](https://git.kayg.org/attachments/a16abea9-399d-4fb0-bda6-863a7a855dcd) | [PNG](https://git.kayg.org/attachments/e6534e29-c6e0-4214-99b3-a048a222aebb) | | 1440 / dark | [PNG](https://git.kayg.org/attachments/1526f45e-9b4e-4859-ab09-88e8e5658817) | [PNG](https://git.kayg.org/attachments/c35d19f1-b0cb-4a22-9479-24599fd7f748) | [PNG](https://git.kayg.org/attachments/681f0b03-f3b3-480f-8d63-b9211c04bfda) | [PNG](https://git.kayg.org/attachments/eb639302-7832-4460-a603-9f5900a08159) |
kayg commented 2026-10-08 07:19:46 +00:00
Author
Owner
Copy link

Source-write memory finding and fix, committed as d3ce900eb9:

The first locked 50k run reused the import projection (both receipt checks true). Cold API page: 52.7 ms. Page p50/p95: 10.2/26.4 ms. Account summary p50/p95: 6.2/8.1 ms. Full-route first-row p95: 1131.52 ms. Scroll p95: 83.4 ms; matched-server baseline scroll p95 was also 83.4 ms. The V8 sample was mostly idle. These UI targets are not met.

Cleared-mark edits still peaked at 1450024960 bytes RSS. A source change rejected the complete snapshot, then reparsed unchanged files that could not enter the idle parse cache. The new generation now reuses each previous immutable document only when its kernel fingerprint matches. This keeps both idle caps unchanged. It also releases the snapshot mutex before filesystem checks. The regression disables both idle caches, proves unchanged document identity, proves changed-file invalidation, and retains the idle-release checks.

Gate output:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 57.63s
test result: ok. 135 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 352.64s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 70.20s

The final release build and server gates are running. The next locked 50k/200k runs will measure this change. The earlier 50k run is retained as before-reuse evidence, not final-head evidence. A separate no-scroll frame-clock control and renderer metadata now distinguish slow rendering from row scripting; the diagnostic scroll pass resets its position before sampling.

The source write still validates a full Ledger and replays totals. The source files and SQLite still have separate durability points. The missing-generation path still builds before first rows. Performance guard violations remain. #1365 and #1366 remain open and unresolved; no issue is closed.

Source-write memory finding and fix, committed as d3ce900eb95b8d81519702b27aeb44005170e9ab: The first locked 50k run reused the import projection (both receipt checks true). Cold API page: 52.7 ms. Page p50/p95: 10.2/26.4 ms. Account summary p50/p95: 6.2/8.1 ms. Full-route first-row p95: 1131.52 ms. Scroll p95: 83.4 ms; matched-server baseline scroll p95 was also 83.4 ms. The V8 sample was mostly idle. These UI targets are not met. Cleared-mark edits still peaked at 1450024960 bytes RSS. A source change rejected the complete snapshot, then reparsed unchanged files that could not enter the idle parse cache. The new generation now reuses each previous immutable document only when its kernel fingerprint matches. This keeps both idle caps unchanged. It also releases the snapshot mutex before filesystem checks. The regression disables both idle caches, proves unchanged document identity, proves changed-file invalidation, and retains the idle-release checks. Gate output: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 57.63s test result: ok. 135 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 352.64s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 70.20s ``` The final release build and server gates are running. The next locked 50k/200k runs will measure this change. The earlier 50k run is retained as before-reuse evidence, not final-head evidence. A separate no-scroll frame-clock control and renderer metadata now distinguish slow rendering from row scripting; the diagnostic scroll pass resets its position before sampling. The source write still validates a full Ledger and replays totals. The source files and SQLite still have separate durability points. The missing-generation path still builds before first rows. Performance guard violations remain. #1365 and #1366 remain open and unresolved; no issue is closed.
kayg commented 2026-10-08 08:18:16 +00:00
Author
Owner
Copy link

money688b final report

NOT READY. Branch job/money-688, base 2e10473cc, head cb59bdef35c7524f4f996061e53614556f133570. The job reached its four-hour limit. Changes are in small atomic commits. No push, deploy, merge into dev/main, or issue closure was performed. The required origin/dev integration was done once in 465ea43c1.

Built

  • Register deltas, exact integer suffix balances, account summaries, search rows and generation metadata now publish in one SQLite transaction. Stable row signatures preserve untouched rows. Metadata-only changes do not rewrite balance prefixes. Managed source-write paths call projection maintenance.
  • Random operation property tests compare every running balance and account summary with independent BigInt recomputation after inserts, back-dated edits, deletes, batch imports, transfers and splits. They check DESIGN §48 conservation after each operation.
  • Active oversized Ledger readers share a weak snapshot. Unchanged source documents retain their Arc across a changed Month or Accounts document. Idle cache limits remain unchanged.
  • First register rows publish before Month context is requested. Programmatic editor focus explicitly suppresses rings; keyboard navigation retains them. Shared Pill sizing supplies touch targets.
  • The profile compares the shared release baseline with the job server; measures reads, mutations, CPU/RSS and client frames; samples client stacks; records generation reuse; captures real production UI at all required widths and themes.

Files

Main changes: crates/plugins/money/src/{register,register_contract_tests,routes,store,views,lib}.rs, crates/plugins/money/migrations/0002_register_row_generation.sql, crates/calternal-server/src/upgrade_tests.rs, apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte, apps/web/src/lib/components/money/TransactionForm.svelte, apps/web/src/lib/a11y/inputModality.{ts,test.ts}, bench/money-register-688.mjs, tests/adversarial/money_register_688.mjs, docs/perf/baseline.json, and exact existing performance-rule pins. No new dependency or broad exception was added.

Performance evidence

One successful locked perf-VM 50k run compared the shared baseline (REV d395b6e25) against job revision 6a7e72457. This predates the final document-reuse change. The retained JSON explicitly labels that limitation. Each VM measurement used perf-run calternal, which owns the shared perf lock; no builds ran there. Load average was 3.45 / 3.62 / 3.75.

Metric Baseline Before final document reuse
Register API p50 / p95 ms 1206.3 / 1901.8 10.2 / 26.4
Account summaries p50 / p95 ms 747.4 / 790.5 6.2 / 8.1
First rows p50 / p95 ms 6793.97 / 8223.53 917.05 / 1131.52
Scroll frames p50 / p95 ms 66.6 / 83.4 66.7 / 83.4
Steady server RSS bytes 1272295424 527364096

Baseline API samples: five; job register/account samples: fifty; first-row samples: five each. The job cold API returned 100 rows in 52.7 ms. Five cleared-state flips plus restore measured 2244.7 / 3203.3 ms p50 / p95, 46.47 CPU seconds, and peak RSS 1450024960 bytes. Generation receipts existed after import and were reused on the first read. The separate client stack sample was mostly idle; it does not establish a row-render cause. The profile now resets scroll and records an idle frame control and renderer details, but that version has not been measured.

The final release build passed in 55m 50s. It is copied to /root/calternal-money688b/bin/after-server-source-reuse; local and remote SHA256 both equal 11773aa274aff27fa146051efbc0ce345873fcabb0a0a729c809e64c76a015c2. No final-code 50k run or 200k run completed. First-row and scroll targets are NOT met by the existing measurements.

Expected cost: a warm page checks source-file fingerprints and reads at most 101 indexed keys plus bounded nested payloads. Normal writes still validate/replay the full Ledger, O(N), and serialize the changed Month. Metadata projection maintenance is O(changed postings); amount/date/account changes update the affected Account suffix. The full cold build remains O(N log N). Client rows remain bounded to the viewport and overscan with one editor.

Known blocking gaps

  1. Source files finish writing before the SQLite transaction. Source and Index still have two durability points. There is no transactional recovery journal that joins them.
  2. Normal writes still validate/replay the full Ledger. Cold missing/mismatched projections still block the first page on a full build. The requested progressive cold build is not implemented.
  3. perf-lint and deterministic_performance_guards still fail with 393 violations. Exact existing syntax pins were refreshed; these violations were not waived or fixed.
  4. Final-code 50k/200k qualification, bounded 200k burst RSS and the latency/frame targets remain open.
  5. A separate number review is required before merge. artifacts/money688b/number-review.md supplies the review handoff; it is not approval. The reviewer must also check intermediate SQLite integer overflow in arbitrary multi-delta batches, in addition to final-range checks.
  6. #1365 remains: an accepted 100-Tag posting can make a register page return 413. #1366 remains: expired/replaced cursor recovery loses keyboard focus/paging intent. No expectations were weakened.

The final server suite also failed because startup_search_reconciliation_keeps_calendar_writes_responsive_on_large_home did not finish startup reconciliation. Its 20k-file / 32-write latency check measured p50 7027 ms and p95 7567 ms against a 10000 ms budget, then timed out waiting for reconciliation. The test was left unchanged.

UX gaps closed

First rows no longer wait for Month context. Editor opening focus uses the shared quiet-focus API. Row action controls use shared default Pill sizing, including touch targets. The focused probe covered Older paging, arrow navigation, stable item links, draft behavior, touch targets and menus; nine malformed/replay requests were rejected and sixteen concurrent reads passed. No console or page errors occurred in that round.

UX gaps left

#1365 payload handling and #1366 recovery focus remain. Month context still does full replay. Exact opening-focus behavior during context recovery needs further work. Claude visual review is pending.

Twenty-four actual-size macOS-emulated production captures were attached to #688 in the earlier screenshot comment: register, mouse-open editor, Enter-open editor and adjacent Budget view; 390 / 820 / 1440 px, light and dark. Captures asserted loaded real API rows, no update toast, and quiet opening focus. They precede only backend document reuse; the pictured UI is unchanged. No screenshots were committed. Visible controls reuse Card, Pill, MetricCard, Menu, TagPill, Checkbox and shared fields. No new one-off control styling was introduced.

Decisions

  • Separate stable row signature from source revision; migration 0002 backfills the existing signature.
  • Read the exact prefix column into returned row payloads instead of rewriting unchanged row JSON. Reserve 32 KiB in the page envelope.
  • Detect unplanned external changes by fingerprints and retain the full-build fallback. This does not satisfy progressive cold loading.
  • Share only active oversized snapshots and unchanged document Arcs rather than increase idle retention.
  • Publish initial rows before context and opt into explicit quiet focus without changing root input flags or motion durations.
  • Refresh existing exact rule pins without new exceptions or higher bounds. No new crate/package versions were introduced.

Gates, verbatim

cargo fmt --check: exit 0; no output.

artifacts/money688b-final-core-clippy.log

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 53.83s

artifacts/money688b-final-core-test.log

    Finished `test` profile [unoptimized + debuginfo] target(s) in 41.77s
test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.41s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.76s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 3.63s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.58s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

artifacts/money688b-final-plugin-clippy-reuse.log

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 57.63s

artifacts/money688b-final-plugin-test-reuse.log

    Finished `test` profile [unoptimized + debuginfo] target(s) in 4.68s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 136 filtered out; finished in 194.48s
test result: ok. 135 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 352.64s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 70.20s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s

artifacts/money688b-final-server-clippy-reuse.log

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 12m 16s

artifacts/money688b-final-server-test-reuse.log

    Finished `test` profile [unoptimized + debuginfo] target(s) in 29m 12s
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 283 filtered out; finished in 214.85s
test result: FAILED. 271 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 415.55s
error: test failed, to rerun pass `-p calternal-server --bin calternal-server`

artifacts/money688b-final-server-integration.log

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 33s
perf-lint: FAIL; 393 violations; 22441 scoped exceptions
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 79.85s
error: test failed, to rerun pass `-p calternal-server --test perf_guards`

artifacts/money688b-final-web-check-reuse.log

perf-lint: FAIL; 393 violations; 22441 scoped exceptions
svelte-check found 0 errors and 4 warnings in 2 files
error: script "check" exited with code 1

artifacts/money688b-final-web-test.log

 Test Files  5 failed | 294 passed (299)
      Tests  6 failed | 2116 passed (2122)
   Duration  1126.94s (transform 45%, import 20%, environment 16%, tests 15%, setup 5%)
error: script "test" exited with code 1

artifacts/money688b-touch-controls-test.log

 Test Files  3 passed (3)
      Tests  32 passed (32)
   Duration  22.33s (transform 75%, environment 13%, import 6%, setup 4%, tests 2%)

artifacts/money688b-timeout-diagnostic.log

 Test Files  5 passed (5)
      Tests  71 passed (71)
   Duration  76.04s (transform 71%, tests 12%, import 9%, environment 7%, setup 1%)

The five unchanged web files whose six tests timed out at 5000 ms all passed in a focused diagnostic run (71 tests). This does not turn the failed full-suite gate into a pass. The only existing assertion change was the upgrade migration count (+26 instead of +25), because this job adds Money migration 0002; existing receipt assertions remain.

Remaining verification and merge round

After the blocking implementation work: repeat locked, interleaved baseline/final 50k and 200k profile runs with MONEY688_ROWS=50000 and MONEY688_ROWS=200000 using bun bench/money-register-688.mjs and the existing VM harness scripts, with the final copied binary and matching web build. Record the idle frame control, scroll stack profile, burst RSS and all latency targets. Do not build on the VM.

Before merge, obtain the separate number review and Claude screenshot review. Run cargo fmt --check, per-crate clippy/test for calternal-money, calternal-plugin-money and calternal-server, cd apps/web && bun run check, and bun run test --maxWorkers=2. The combined merge round must run its full e2e/adversarial matrices, including #1365/#1366 and cross-plugin source/Index recovery. The profile and focused adversarial script are extended; broader matrices were not run in this job.

Cleanup completed. Web build output was removed. cargo clean output:

     Removed 28168 files, 17.2GiB total

NOT READY cb59bdef35

# money688b final report NOT READY. Branch `job/money-688`, base `2e10473cc`, head `cb59bdef35c7524f4f996061e53614556f133570`. The job reached its four-hour limit. Changes are in small atomic commits. No push, deploy, merge into dev/main, or issue closure was performed. The required origin/dev integration was done once in `465ea43c1`. ## Built - Register deltas, exact integer suffix balances, account summaries, search rows and generation metadata now publish in one SQLite transaction. Stable row signatures preserve untouched rows. Metadata-only changes do not rewrite balance prefixes. Managed source-write paths call projection maintenance. - Random operation property tests compare every running balance and account summary with independent BigInt recomputation after inserts, back-dated edits, deletes, batch imports, transfers and splits. They check DESIGN §48 conservation after each operation. - Active oversized Ledger readers share a weak snapshot. Unchanged source documents retain their Arc across a changed Month or Accounts document. Idle cache limits remain unchanged. - First register rows publish before Month context is requested. Programmatic editor focus explicitly suppresses rings; keyboard navigation retains them. Shared Pill sizing supplies touch targets. - The profile compares the shared release baseline with the job server; measures reads, mutations, CPU/RSS and client frames; samples client stacks; records generation reuse; captures real production UI at all required widths and themes. ## Files Main changes: `crates/plugins/money/src/{register,register_contract_tests,routes,store,views,lib}.rs`, `crates/plugins/money/migrations/0002_register_row_generation.sql`, `crates/calternal-server/src/upgrade_tests.rs`, `apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte`, `apps/web/src/lib/components/money/TransactionForm.svelte`, `apps/web/src/lib/a11y/inputModality.{ts,test.ts}`, `bench/money-register-688.mjs`, `tests/adversarial/money_register_688.mjs`, `docs/perf/baseline.json`, and exact existing performance-rule pins. No new dependency or broad exception was added. ## Performance evidence One successful locked perf-VM 50k run compared the shared baseline (REV `d395b6e25`) against job revision `6a7e72457`. This predates the final document-reuse change. The retained JSON explicitly labels that limitation. Each VM measurement used `perf-run calternal`, which owns the shared perf lock; no builds ran there. Load average was 3.45 / 3.62 / 3.75. | Metric | Baseline | Before final document reuse | |---|---:|---:| | Register API p50 / p95 ms | 1206.3 / 1901.8 | 10.2 / 26.4 | | Account summaries p50 / p95 ms | 747.4 / 790.5 | 6.2 / 8.1 | | First rows p50 / p95 ms | 6793.97 / 8223.53 | 917.05 / 1131.52 | | Scroll frames p50 / p95 ms | 66.6 / 83.4 | 66.7 / 83.4 | | Steady server RSS bytes | 1272295424 | 527364096 | Baseline API samples: five; job register/account samples: fifty; first-row samples: five each. The job cold API returned 100 rows in 52.7 ms. Five cleared-state flips plus restore measured 2244.7 / 3203.3 ms p50 / p95, 46.47 CPU seconds, and peak RSS 1450024960 bytes. Generation receipts existed after import and were reused on the first read. The separate client stack sample was mostly idle; it does not establish a row-render cause. The profile now resets scroll and records an idle frame control and renderer details, but that version has not been measured. The final release build passed in 55m 50s. It is copied to `/root/calternal-money688b/bin/after-server-source-reuse`; local and remote SHA256 both equal `11773aa274aff27fa146051efbc0ce345873fcabb0a0a729c809e64c76a015c2`. No final-code 50k run or 200k run completed. First-row and scroll targets are NOT met by the existing measurements. Expected cost: a warm page checks source-file fingerprints and reads at most 101 indexed keys plus bounded nested payloads. Normal writes still validate/replay the full Ledger, O(N), and serialize the changed Month. Metadata projection maintenance is O(changed postings); amount/date/account changes update the affected Account suffix. The full cold build remains O(N log N). Client rows remain bounded to the viewport and overscan with one editor. ## Known blocking gaps 1. Source files finish writing before the SQLite transaction. Source and Index still have two durability points. There is no transactional recovery journal that joins them. 2. Normal writes still validate/replay the full Ledger. Cold missing/mismatched projections still block the first page on a full build. The requested progressive cold build is not implemented. 3. `perf-lint` and `deterministic_performance_guards` still fail with 393 violations. Exact existing syntax pins were refreshed; these violations were not waived or fixed. 4. Final-code 50k/200k qualification, bounded 200k burst RSS and the latency/frame targets remain open. 5. A separate number review is required before merge. `artifacts/money688b/number-review.md` supplies the review handoff; it is not approval. The reviewer must also check intermediate SQLite integer overflow in arbitrary multi-delta batches, in addition to final-range checks. 6. #1365 remains: an accepted 100-Tag posting can make a register page return 413. #1366 remains: expired/replaced cursor recovery loses keyboard focus/paging intent. No expectations were weakened. The final server suite also failed because `startup_search_reconciliation_keeps_calendar_writes_responsive_on_large_home` did not finish startup reconciliation. Its 20k-file / 32-write latency check measured p50 7027 ms and p95 7567 ms against a 10000 ms budget, then timed out waiting for reconciliation. The test was left unchanged. ## UX gaps closed First rows no longer wait for Month context. Editor opening focus uses the shared quiet-focus API. Row action controls use shared default Pill sizing, including touch targets. The focused probe covered Older paging, arrow navigation, stable item links, draft behavior, touch targets and menus; nine malformed/replay requests were rejected and sixteen concurrent reads passed. No console or page errors occurred in that round. ## UX gaps left #1365 payload handling and #1366 recovery focus remain. Month context still does full replay. Exact opening-focus behavior during context recovery needs further work. Claude visual review is pending. Twenty-four actual-size macOS-emulated production captures were attached to #688 in the earlier screenshot comment: register, mouse-open editor, Enter-open editor and adjacent Budget view; 390 / 820 / 1440 px, light and dark. Captures asserted loaded real API rows, no update toast, and quiet opening focus. They precede only backend document reuse; the pictured UI is unchanged. No screenshots were committed. Visible controls reuse Card, Pill, MetricCard, Menu, TagPill, Checkbox and shared fields. No new one-off control styling was introduced. ## Decisions - Separate stable row signature from source revision; migration 0002 backfills the existing signature. - Read the exact prefix column into returned row payloads instead of rewriting unchanged row JSON. Reserve 32 KiB in the page envelope. - Detect unplanned external changes by fingerprints and retain the full-build fallback. This does not satisfy progressive cold loading. - Share only active oversized snapshots and unchanged document Arcs rather than increase idle retention. - Publish initial rows before context and opt into explicit quiet focus without changing root input flags or motion durations. - Refresh existing exact rule pins without new exceptions or higher bounds. No new crate/package versions were introduced. ## Gates, verbatim `cargo fmt --check`: exit 0; no output. artifacts/money688b-final-core-clippy.log ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 53.83s ``` artifacts/money688b-final-core-test.log ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 41.77s test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.41s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.76s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 3.63s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.58s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` artifacts/money688b-final-plugin-clippy-reuse.log ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 57.63s ``` artifacts/money688b-final-plugin-test-reuse.log ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 4.68s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 136 filtered out; finished in 194.48s test result: ok. 135 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 352.64s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 70.20s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s ``` artifacts/money688b-final-server-clippy-reuse.log ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 12m 16s ``` artifacts/money688b-final-server-test-reuse.log ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 29m 12s test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 283 filtered out; finished in 214.85s test result: FAILED. 271 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 415.55s error: test failed, to rerun pass `-p calternal-server --bin calternal-server` ``` artifacts/money688b-final-server-integration.log ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 33s perf-lint: FAIL; 393 violations; 22441 scoped exceptions test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 79.85s error: test failed, to rerun pass `-p calternal-server --test perf_guards` ``` artifacts/money688b-final-web-check-reuse.log ``` perf-lint: FAIL; 393 violations; 22441 scoped exceptions svelte-check found 0 errors and 4 warnings in 2 files error: script "check" exited with code 1 ``` artifacts/money688b-final-web-test.log ``` Test Files 5 failed | 294 passed (299) Tests 6 failed | 2116 passed (2122) Duration 1126.94s (transform 45%, import 20%, environment 16%, tests 15%, setup 5%) error: script "test" exited with code 1 ``` artifacts/money688b-touch-controls-test.log ``` Test Files 3 passed (3) Tests 32 passed (32) Duration 22.33s (transform 75%, environment 13%, import 6%, setup 4%, tests 2%) ``` artifacts/money688b-timeout-diagnostic.log ``` Test Files 5 passed (5) Tests 71 passed (71) Duration 76.04s (transform 71%, tests 12%, import 9%, environment 7%, setup 1%) ``` The five unchanged web files whose six tests timed out at 5000 ms all passed in a focused diagnostic run (71 tests). This does not turn the failed full-suite gate into a pass. The only existing assertion change was the upgrade migration count (+26 instead of +25), because this job adds Money migration 0002; existing receipt assertions remain. ## Remaining verification and merge round After the blocking implementation work: repeat locked, interleaved baseline/final 50k and 200k profile runs with `MONEY688_ROWS=50000` and `MONEY688_ROWS=200000` using `bun bench/money-register-688.mjs` and the existing VM harness scripts, with the final copied binary and matching web build. Record the idle frame control, scroll stack profile, burst RSS and all latency targets. Do not build on the VM. Before merge, obtain the separate number review and Claude screenshot review. Run `cargo fmt --check`, per-crate clippy/test for `calternal-money`, `calternal-plugin-money` and `calternal-server`, `cd apps/web && bun run check`, and `bun run test --maxWorkers=2`. The combined merge round must run its full e2e/adversarial matrices, including #1365/#1366 and cross-plugin source/Index recovery. The profile and focused adversarial script are extended; broader matrices were not run in this job. Cleanup completed. Web build output was removed. `cargo clean` output: ``` Removed 28168 files, 17.2GiB total ``` NOT READY cb59bdef35c7524f4f996061e53614556f133570
kayg commented 2026-10-08 15:18:15 +00:00
Author
Owner
Copy link

money688c started on job/money-688 at cb59bdef35. Step 1 first: add durable source-to-projection recovery and crash regression evidence. Steps 2–5 will remain pending until the step 1 report and gates.

money688c started on job/money-688 at cb59bdef35c7524f4f996061e53614556f133570. Step 1 first: add durable source-to-projection recovery and crash regression evidence. Steps 2–5 will remain pending until the step 1 report and gates.
kayg commented 2026-10-08 15:34:40 +00:00
Author
Owner
Copy link

Step 1 evidence: the production Money router served real TCP writes in child processes. SIGKILL at pre-source, post-source/pre-SQLite, post-SQLite and post-acknowledgement passed for creates, edits, deletes, cleared changes and cross-month moves (20 cases). Reopened calternal-fs Root and SQLite converged; independent BigInt sums matched every prefix and Account total; recovery was idempotent. Focused gate: test result: ok. 2 passed; 0 failed; 1 ignored; 0 measured; 138 filtered out; finished in 54.19s. The ignored test is the child server invoked by the parent. Full step 1 gates are running. The required origin/dev merge is 87ea273fe; Money migration 0003 was free on origin/dev. No latency qualification is claimed.

Step 1 evidence: the production Money router served real TCP writes in child processes. SIGKILL at pre-source, post-source/pre-SQLite, post-SQLite and post-acknowledgement passed for creates, edits, deletes, cleared changes and cross-month moves (20 cases). Reopened calternal-fs Root and SQLite converged; independent BigInt sums matched every prefix and Account total; recovery was idempotent. Focused gate: test result: ok. 2 passed; 0 failed; 1 ignored; 0 measured; 138 filtered out; finished in 54.19s. The ignored test is the child server invoked by the parent. Full step 1 gates are running. The required origin/dev merge is 87ea273fe; Money migration 0003 was free on origin/dev. No latency qualification is claimed.
kayg commented 2026-10-08 15:45:05 +00:00
Author
Owner
Copy link

Step 1 committed: 264dfc4d0 joins source writes to projection recovery with durable folder-only intent and FULL projection commits. The real HTTP SIGKILL matrix now passes 25 cases, including both the first cross-month source write and all-source/pre-SQLite completion. test result: ok. 2 passed; 0 failed; 1 ignored; 0 measured; 138 filtered out; finished in 58.18s. The random intermediate-i64 batch regression passes: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 0.71s. calternal-plugin-money clippy: Finished dev profile [unoptimized + debuginfo] target(s) in 2m 07s. Head 967d257a4d includes the separate one-site exact create-contract pin refresh; no new exception or ratchet change. Decisions: recover only pending Budgets at startup; existing source signatures protect same-process reads; invalid or missing source invalidates Derived data without changing source bytes. Final requested gates are running. Steps 2–5 have not started.

Step 1 committed: 264dfc4d0 joins source writes to projection recovery with durable folder-only intent and FULL projection commits. The real HTTP SIGKILL matrix now passes 25 cases, including both the first cross-month source write and all-source/pre-SQLite completion. test result: ok. 2 passed; 0 failed; 1 ignored; 0 measured; 138 filtered out; finished in 58.18s. The random intermediate-i64 batch regression passes: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 0.71s. calternal-plugin-money clippy: Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 07s. Head 967d257a4d3dd525db1be252f95460e4fb35a879 includes the separate one-site exact create-contract pin refresh; no new exception or ratchet change. Decisions: recover only pending Budgets at startup; existing source signatures protect same-process reads; invalid or missing source invalidates Derived data without changing source bytes. Final requested gates are running. Steps 2–5 have not started.
kayg commented 2026-10-08 16:01:01 +00:00
Author
Owner
Copy link

Step 1 gate finding: calternal-money tests pass; clippy passes for calternal-money, calternal-plugin-money and calternal-server. The full Money plugin suite has one failure: publication_and_inverse_authority_use_full_commits expects authority row changes of 2, but the new FULL projection/intent path produces 12. Result: test result: FAILED. 137 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 208.51s. I have kept that existing expectation unchanged under the owner rule. It counts all rows changed on the authority connection during the fixture/publication; previously register projection rows used the NORMAL writer. The new durability path deliberately uses FULL. This needs an orchestrator decision on the test scope/expectation; I am not weakening it. The focused 25-case SIGKILL and intermediate-i64 tests pass. Perf-lint is back to the predecessor count (393); test-only migration setup was removed from the production builder. Full server tests are compiling. No step 2 optimisation has started.

Step 1 gate finding: calternal-money tests pass; clippy passes for calternal-money, calternal-plugin-money and calternal-server. The full Money plugin suite has one failure: publication_and_inverse_authority_use_full_commits expects authority row changes of 2, but the new FULL projection/intent path produces 12. Result: test result: FAILED. 137 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 208.51s. I have kept that existing expectation unchanged under the owner rule. It counts all rows changed on the authority connection during the fixture/publication; previously register projection rows used the NORMAL writer. The new durability path deliberately uses FULL. This needs an orchestrator decision on the test scope/expectation; I am not weakening it. The focused 25-case SIGKILL and intermediate-i64 tests pass. Perf-lint is back to the predecessor count (393); test-only migration setup was removed from the production builder. Full server tests are compiling. No step 2 optimisation has started.
kayg commented 2026-10-08 16:12:35 +00:00
Author
Owner
Copy link

The import durability gate regression is fixed without changing its expectation. Rebuildable projections retain their NORMAL writer; FULL intent deletion fences preceding WAL frames before a managed source write is acknowledged or recovery finishes. Delta publication still uses FULL. The original import durability test passes: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 5.24s. The corrected code also passes the 25-case real-HTTP SIGKILL matrix: test result: ok. 2 passed; 0 failed; 1 ignored; 0 measured; 138 filtered out; finished in 68.76s. Plugin/server clippy passes: Finished dev profile [unoptimized + debuginfo] target(s) in 42.98s. Test-only schema setup was removed from the production builder; perf-lint remains at 393, with no extra debt or waiver. Server tests are still finishing; one migration-receipt assertion failure needs inspection.

The import durability gate regression is fixed without changing its expectation. Rebuildable projections retain their NORMAL writer; FULL intent deletion fences preceding WAL frames before a managed source write is acknowledged or recovery finishes. Delta publication still uses FULL. The original import durability test passes: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 5.24s. The corrected code also passes the 25-case real-HTTP SIGKILL matrix: test result: ok. 2 passed; 0 failed; 1 ignored; 0 measured; 138 filtered out; finished in 68.76s. Plugin/server clippy passes: Finished `dev` profile [unoptimized + debuginfo] target(s) in 42.98s. Test-only schema setup was removed from the production builder; perf-lint remains at 393, with no extra debt or waiver. Server tests are still finishing; one migration-receipt assertion failure needs inspection.
kayg commented 2026-10-08 16:32:07 +00:00
Author
Owner
Copy link

money688c — step 1 checkpoint (#688)

Step 1 is implemented. Steps 2–5 have not started, as requested. This branch is not ready for merge: perf-lint and deterministic_performance_guards still fail with 393 violations. No exceptions were added and no ratchet was raised.

Built

Money source writes now commit an owner-bound folder intent before writing a source file. Projection publication finishes with a FULL SQLite WAL commit before the HTTP acknowledgement. On startup, recovery settles the existing file-move journal and rebuilds only pending Budgets from source. It deletes the intent only after publication. Repeating recovery cannot apply an amount twice. Missing or invalid source files retain their bytes and invalidate their old Derived data.

SQLite triggers reject intermediate integer overflow in register suffix updates. A property test checks random multi-delta batches with an independent i128 oracle; a later delta cannot hide an earlier overflow.

The real HTTP crash test runs the production Money router in a child process with the standard authenticated test User. It sends SIGKILL at five boundaries for each of five operations: create, edit, delete, cleared state and cross-month move. Boundaries cover intent-before-source, first source write, all source writes before SQLite, SQLite-before-completion, and an acknowledged response. It reopens Root and SQLite, runs startup recovery twice, compares source postings with projection postings and checks exact serial prefixes and Account totals. This is 25 cases. It uses a real TCP listener, not a full calternal-server executable. It does not simulate hardware power loss.

The existing import authority-row expectation remains unchanged and passes after preserving NORMAL cold projection builds. The migration preservation fixture now expects one additional receipt for Money 0003; its deployed receipt checks remain unchanged.

Files

  • crates/plugins/money/migrations/0003_register_intents.sql
  • crates/plugins/money/src/lib.rs
  • crates/plugins/money/src/store.rs
  • crates/plugins/money/src/register.rs
  • crates/plugins/money/src/routes.rs
  • crates/plugins/money/src/register_recovery_tests.rs
  • crates/calternal-server/src/wire.rs
  • crates/calternal-server/src/upgrade_tests.rs
  • contracts/perf/exceptions.json and contracts/perf/adoption-1058.json: refresh one existing exact create-budget contract pin after the completion fence. No new waiver.

Decisions

  • Store pending folder identities, not transaction deltas or source content. Recovery uses source files. The server stays the single writer.
  • Run recovery before the live router is installed. Do not add recovery IO to every request.
  • Keep cold Derived data builds on the NORMAL writer pool. The final FULL intent deletion flushes their earlier WAL frames before acknowledgement. SQLite documents this WAL commit behaviour: synchronous.
  • Treat invalid pending source as unavailable Derived data. Preserve source files. Keep intents on IO or Index failure so startup fails safely and can retry.
  • Reject SQLite INTEGER-to-REAL promotion inside the existing suffix update pass. Do not add a separate validation scan.

Cost and qualification

A managed write adds one FULL intent insert per dirty folder, the projection commit, and a FULL intent deletion. Pending recovery costs O(source rows in pending Budgets), not O(all Home files). Suffix update costs are unchanged. No performance qualification was run in this step. The remaining full-Ledger validation cost belongs to step 3. Steps 2, 3, 4 and 5 remain open; no 50k/200k, first-row p95, scroll p95 or burst RSS result is claimed.

UX gaps

No UI changed. Crash recovery closes the data-safety gap for interrupted Money source writes. #1365 and #1366 remain open for step 4. No screenshots were required for this step.

Gates

The full crate suites ran once. The plugin suite found one import durability regression; code was corrected and the original focused test passed. The server suite found the migration receipt count needed the new migration; the focused preservation test passed after that correction. Full suites were not repeated. Integration targets that the initial failures prevented from running were run separately. The server performance guard and web check remain red and are step 2 work. Web tests passed.

cargo fmt --check

(exit 0; no output)

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings (initial complete run)

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 00s

cargo test -p calternal-money

    Finished `test` profile [unoptimized + debuginfo] target(s) in 26.62s
test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.18s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.36s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 3.80s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.56s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-money (initial library run; original import expectation failed)

    Finished `test` profile [unoptimized + debuginfo] target(s) in 33.80s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 32.42s
test result: FAILED. 137 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 208.51s

cargo test -p calternal-server (initial library run; new receipt count failed)

    Finished `test` profile [unoptimized + debuginfo] target(s) in 9m 57s
test result: FAILED. 271 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 241.11s

Final focused SIGKILL source-oracle regression (25 cases)

    Finished `test` profile [unoptimized + debuginfo] target(s) in 52.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 79.53s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

Intermediate overflow property regression

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 06s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 0.71s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

Original import durability regression after code correction

    Finished `test` profile [unoptimized + debuginfo] target(s) in 4m 57s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 5.24s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

Upgrade receipt preservation after new migration count correction

    Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 19s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 283 filtered out; finished in 4.45s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s

cargo test -p calternal-plugin-money --test import_review -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 49.87s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 9.24s

cargo test -p calternal-server --test perf_guards -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 36s
perf-lint: FAIL; 393 violations; 22441 scoped exceptions
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 53.38s

cd apps/web && bun run check

perf-lint: FAIL; 393 violations; 22441 scoped exceptions
svelte-check found 0 errors and 4 warnings in 2 files
error: script "check" exited with code 1

cd apps/web && bun run test --maxWorkers=2

 Test Files  299 passed (299)
      Tests  2127 passed (2127)

cargo test -p calternal-server --test private_index_permissions -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 45s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s

Final combined clippy, after the last test changes:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 30.72s

Head and cleanup

Branch: job/money-688. Head: c60500f406. Base: cb59bdef35. origin/dev was fetched and merged once before final gates. Migration 0003 was checked against origin/dev. No push, deployment or merge into dev/main.

The report and verbatim gate logs are in artifacts/money688c/. They remain untracked review artifacts. The job runs cargo clean and removes its generated web build output before exit.

Next checkpoint

Step 2: classify the 393 perf-lint violations against origin/dev and fix branch-owned violations without waivers or ratchet changes. Then run the requested gates and stop to report. Steps 3–5 remain after that checkpoint. The full branch cannot be approved from this step alone.

# money688c — step 1 checkpoint (#688) Step 1 is implemented. Steps 2–5 have not started, as requested. This branch is not ready for merge: perf-lint and deterministic_performance_guards still fail with 393 violations. No exceptions were added and no ratchet was raised. ## Built Money source writes now commit an owner-bound folder intent before writing a source file. Projection publication finishes with a FULL SQLite WAL commit before the HTTP acknowledgement. On startup, recovery settles the existing file-move journal and rebuilds only pending Budgets from source. It deletes the intent only after publication. Repeating recovery cannot apply an amount twice. Missing or invalid source files retain their bytes and invalidate their old Derived data. SQLite triggers reject intermediate integer overflow in register suffix updates. A property test checks random multi-delta batches with an independent i128 oracle; a later delta cannot hide an earlier overflow. The real HTTP crash test runs the production Money router in a child process with the standard authenticated test User. It sends SIGKILL at five boundaries for each of five operations: create, edit, delete, cleared state and cross-month move. Boundaries cover intent-before-source, first source write, all source writes before SQLite, SQLite-before-completion, and an acknowledged response. It reopens Root and SQLite, runs startup recovery twice, compares source postings with projection postings and checks exact serial prefixes and Account totals. This is 25 cases. It uses a real TCP listener, not a full calternal-server executable. It does not simulate hardware power loss. The existing import authority-row expectation remains unchanged and passes after preserving NORMAL cold projection builds. The migration preservation fixture now expects one additional receipt for Money 0003; its deployed receipt checks remain unchanged. ## Files - crates/plugins/money/migrations/0003_register_intents.sql - crates/plugins/money/src/lib.rs - crates/plugins/money/src/store.rs - crates/plugins/money/src/register.rs - crates/plugins/money/src/routes.rs - crates/plugins/money/src/register_recovery_tests.rs - crates/calternal-server/src/wire.rs - crates/calternal-server/src/upgrade_tests.rs - contracts/perf/exceptions.json and contracts/perf/adoption-1058.json: refresh one existing exact create-budget contract pin after the completion fence. No new waiver. ## Decisions - Store pending folder identities, not transaction deltas or source content. Recovery uses source files. The server stays the single writer. - Run recovery before the live router is installed. Do not add recovery IO to every request. - Keep cold Derived data builds on the NORMAL writer pool. The final FULL intent deletion flushes their earlier WAL frames before acknowledgement. SQLite documents this WAL commit behaviour: [synchronous](https://sqlite.org/pragma.html#pragma_synchronous). - Treat invalid pending source as unavailable Derived data. Preserve source files. Keep intents on IO or Index failure so startup fails safely and can retry. - Reject SQLite INTEGER-to-REAL promotion inside the existing suffix update pass. Do not add a separate validation scan. ## Cost and qualification A managed write adds one FULL intent insert per dirty folder, the projection commit, and a FULL intent deletion. Pending recovery costs O(source rows in pending Budgets), not O(all Home files). Suffix update costs are unchanged. No performance qualification was run in this step. The remaining full-Ledger validation cost belongs to step 3. Steps 2, 3, 4 and 5 remain open; no 50k/200k, first-row p95, scroll p95 or burst RSS result is claimed. ## UX gaps No UI changed. Crash recovery closes the data-safety gap for interrupted Money source writes. #1365 and #1366 remain open for step 4. No screenshots were required for this step. ## Gates The full crate suites ran once. The plugin suite found one import durability regression; code was corrected and the original focused test passed. The server suite found the migration receipt count needed the new migration; the focused preservation test passed after that correction. Full suites were not repeated. Integration targets that the initial failures prevented from running were run separately. The server performance guard and web check remain red and are step 2 work. Web tests passed. cargo fmt --check ```text (exit 0; no output) ``` cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings (initial complete run) ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 00s ``` cargo test -p calternal-money ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 26.62s test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.18s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.36s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 3.80s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.56s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo test -p calternal-plugin-money (initial library run; original import expectation failed) ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 33.80s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 32.42s test result: FAILED. 137 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 208.51s ``` cargo test -p calternal-server (initial library run; new receipt count failed) ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 9m 57s test result: FAILED. 271 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 241.11s ``` Final focused SIGKILL source-oracle regression (25 cases) ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 52.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 79.53s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` Intermediate overflow property regression ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 06s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 0.71s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` Original import durability regression after code correction ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 4m 57s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 140 filtered out; finished in 5.24s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` Upgrade receipt preservation after new migration count correction ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 19s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 283 filtered out; finished in 4.45s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s ``` cargo test -p calternal-plugin-money --test import_review -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 49.87s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 9.24s ``` cargo test -p calternal-server --test perf_guards -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 36s perf-lint: FAIL; 393 violations; 22441 scoped exceptions test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 53.38s ``` cd apps/web && bun run check ```text perf-lint: FAIL; 393 violations; 22441 scoped exceptions svelte-check found 0 errors and 4 warnings in 2 files error: script "check" exited with code 1 ``` cd apps/web && bun run test --maxWorkers=2 ```text Test Files 299 passed (299) Tests 2127 passed (2127) ``` cargo test -p calternal-server --test private_index_permissions -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 45s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s ``` Final combined clippy, after the last test changes: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 30.72s ``` ## Head and cleanup Branch: job/money-688. Head: c60500f40635cb7156c738423b0e5df68975dea6. Base: cb59bdef35c7524f4f996061e53614556f133570. origin/dev was fetched and merged once before final gates. Migration 0003 was checked against origin/dev. No push, deployment or merge into dev/main. The report and verbatim gate logs are in artifacts/money688c/. They remain untracked review artifacts. The job runs cargo clean and removes its generated web build output before exit. ## Next checkpoint Step 2: classify the 393 perf-lint violations against origin/dev and fix branch-owned violations without waivers or ratchet changes. Then run the requested gates and stop to report. Steps 3–5 remain after that checkpoint. The full branch cannot be approved from this step alone.
kayg commented 2026-10-08 18:05:33 +00:00
Author
Owner
Copy link

money688d starts step 2 on job/money-688, head c60500f40635cb7156c738423b0e5df68975dea6, base af202e1514955ddf0f8b4b3d2503c780d807ed84. Step 1 remains complete. I will classify perf-lint findings against origin/dev, fix branch-owned findings without waivers or ratchet increases, run the step gates and stop to report. Steps 3–5 are not started.

money688d starts step 2 on `job/money-688`, head `c60500f40635cb7156c738423b0e5df68975dea6`, base `af202e1514955ddf0f8b4b3d2503c780d807ed84`. Step 1 remains complete. I will classify perf-lint findings against origin/dev, fix branch-owned findings without waivers or ratchet increases, run the step gates and stop to report. Steps 3–5 are not started.
kayg commented 2026-10-08 18:10:04 +00:00
Author
Owner
Copy link

Step 2 classification: origin/dev at af202e1514955ddf0f8b4b3d2503c780d807ed84 passes perf-lint with zero violations. The job head has 393: 383 io.unresolved-call, six sql.unresolved, four sql.query-in-loop. All are in the new register code (register.rs: 370, routes.rs: 23), so none can be left as inherited debt. Logs and JSON reports are retained in artifacts/money688d/. The read handler synchronously reaches cold Register::build_for, including batch writes and derived totals. I am fixing bounded cached reads and adding source-free read evidence. Cold builder writes will not be called pure or index-read to hide these findings. No new exception or ratchet increase.

Step 2 classification: `origin/dev` at `af202e1514955ddf0f8b4b3d2503c780d807ed84` passes perf-lint with zero violations. The job head has 393: 383 `io.unresolved-call`, six `sql.unresolved`, four `sql.query-in-loop`. All are in the new register code (`register.rs`: 370, `routes.rs`: 23), so none can be left as inherited debt. Logs and JSON reports are retained in `artifacts/money688d/`. The read handler synchronously reaches cold `Register::build_for`, including batch writes and derived totals. I am fixing bounded cached reads and adding source-free read evidence. Cold builder writes will not be called pure or index-read to hide these findings. No new exception or ratchet increase.
kayg commented 2026-10-08 18:36:30 +00:00
Author
Owner
Copy link

Step 2 progress: perf-lint is reduced from 393 to 70 violations (68 unresolved IO calls, two cold-builder batch-loop findings). All six unresolved SQL findings and both fixed filter-index loop findings are removed. No exception or ratchet change. Exact typed bindings cover only arithmetic, JSON conversion, SQL construction, retained-generation reads and synchronization. 63 inactive Money bindings were removed. Cold projection initialization, SQLite execution/fences and source fingerprints remain visible. origin/dev has zero violations, so the remaining 70 are branch-owned.

Web tests passed verbatim:

 Test Files  299 passed (299)
      Tests  2127 passed (2127)

Web check remains red: perf-lint: FAIL; 70 violations; 22441 scoped exceptions; svelte-check found 0 errors and 4 warnings in 2 files. Rust gates continue in the fresh job target. Step 2 is partial; steps 3–5 are not started.

Step 2 progress: perf-lint is reduced from 393 to 70 violations (68 unresolved IO calls, two cold-builder batch-loop findings). All six unresolved SQL findings and both fixed filter-index loop findings are removed. No exception or ratchet change. Exact typed bindings cover only arithmetic, JSON conversion, SQL construction, retained-generation reads and synchronization. 63 inactive Money bindings were removed. Cold projection initialization, SQLite execution/fences and source fingerprints remain visible. `origin/dev` has zero violations, so the remaining 70 are branch-owned. Web tests passed verbatim: ```text Test Files 299 passed (299) Tests 2127 passed (2127) ``` Web check remains red: `perf-lint: FAIL; 70 violations; 22441 scoped exceptions`; `svelte-check found 0 errors and 4 warnings in 2 files`. Rust gates continue in the fresh job target. Step 2 is partial; steps 3–5 are not started.
kayg commented 2026-10-08 19:00:17 +00:00
Author
Owner
Copy link

Atomic step-2 slices are committed on job/money-688:

  • d6b14d031: bounded cached generation reads, source-free/read-only regression and exact read/decode evidence.
  • 5c6fa7cae: two fixed scoped filter-index statements, explicit cold metadata bound, split/scoped-update regression.
  • 01f61862b7bff3d8f81708eea81230e5922a2e47: exact typed capability evidence and removal of 63 inactive bindings.

The corrected new filter test passes. Its initial assertion incorrectly compared the edited row as unchanged; clearing already adds #cleared to its search text. The final test compares untouched rows and checks updated-row search separately. No pre-existing expectation was changed. The full plugin suite has 139 passes, only that new-test failure, and 3 ignores; the focused correction passes. SIGKILL recovery (25 cases), intermediate i64 multi-delta overflow and independent BigInt properties passed in that suite. Web tests passed 299 files / 2127 tests. Server compilation initially lacked the generated web assets; the production web build is now complete and the combined check resumes. No exception or ratchet changes. Perf-lint remains 70 branch-owned violations; step 2 is partial and steps 3–5 are not started.

Atomic step-2 slices are committed on `job/money-688`: - `d6b14d031`: bounded cached generation reads, source-free/read-only regression and exact read/decode evidence. - `5c6fa7cae`: two fixed scoped filter-index statements, explicit cold metadata bound, split/scoped-update regression. - `01f61862b7bff3d8f81708eea81230e5922a2e47`: exact typed capability evidence and removal of 63 inactive bindings. The corrected new filter test passes. Its initial assertion incorrectly compared the edited row as unchanged; clearing already adds `#cleared` to its search text. The final test compares untouched rows and checks updated-row search separately. No pre-existing expectation was changed. The full plugin suite has 139 passes, only that new-test failure, and 3 ignores; the focused correction passes. SIGKILL recovery (25 cases), intermediate i64 multi-delta overflow and independent BigInt properties passed in that suite. Web tests passed 299 files / 2127 tests. Server compilation initially lacked the generated web assets; the production web build is now complete and the combined check resumes. No exception or ratchet changes. Perf-lint remains 70 branch-owned violations; step 2 is partial and steps 3–5 are not started.
kayg commented 2026-10-08 19:40:53 +00:00
Author
Owner
Copy link

money688d — step 2 checkpoint (#688)

NOT READY FOR MERGE. Step 1 stays complete: its 25 SIGKILL cases pass. Step 2 is partial: perf-lint falls from 393 to 70 branch-owned violations. Steps 3–5 are not started. No exception or ratchet was changed.

Built

  • Cached generation reads now use an explicit LIMIT 1. A source-free regression makes both single-connection writer pools read-only. It checks the retained page, owner isolation and missing identities after all Budget source files are removed.
  • Filter indexes use two fixed SQL statements. Four numbered parameters are reused across all UNION arms. The regression checks split Category membership, untouched search rows, and the edited row's cleared-state search.
  • 170 exact call bindings identify checked arithmetic, JSON conversion, SQL construction, synchronization and retained Index reads. Their tests are enabled. Execution and transaction fences remain visible to the guard. 63 inactive Money bindings were removed.
  • Module comments now describe the shared read-only pool and page WAL snapshot.

Files and commits

  • crates/plugins/money/src/register.rs
  • crates/plugins/money/src/register_contract_tests.rs
  • contracts/perf/registry.json

Commits: d6b14d031 (cached reads), 5c6fa7cae (fixed filter writes), 01f61862b (typed guard evidence).

Head: 01f61862b7bff3d8f81708eea81230e5922a2e47. Base checked: af202e1514955ddf0f8b4b3d2503c780d807ed84. Branch: job/money-688. git fetch origin && git merge origin/dev ran once; it was already up to date. No push, deployment, merge into dev/main or issue closure was done. No dependency or migration was added.

Findings and known gaps

A detached checkout of origin/dev at the stated base passed perf-lint with zero violations. The initial 393 findings were all in the branch's register code. The final 70 contain 68 unresolved calls and two cold-builder batch-loop findings. They cover cold initialization, SQLite execution and fences, plus source fingerprints. The read path can still build the whole projection. Step 2 cannot be called complete.

Writes still validate/replay the full Ledger (step 3). #1365 and #1366 remain for step 4. No final 50k/200k qualification, first-row p95, scroll p95 or burst RSS result is claimed (step 5). The independent number review remains pending from the prior report.

Decisions

Use SQLite $1–$4 parameters in the two fixed statements. The locked SQLx binder supports them and the SQL guard parses them. Keep actual execution sites unclassified until the cold read path is fixed. A capability binding proves the exact typed call; it does not prove a latency budget.

Compare stable page content and cursor availability in the new cached-read regression. Signed cursor bytes contain wall-clock expiry and can differ across a clock tick.

The new scoped-update test initially compared the edited row as unchanged. Clearing already adds #cleared to its search text. The final test checks unchanged rows and checks the selected row's new search state separately. No pre-existing test expectation was changed.

Cost and measurements

The metadata query selects at most one generation row by its owner-bound key. Filter maintenance executes two set-based statements; work scales with affected postings and split memberships. Cold building and full-Ledger write validation costs remain. No runtime performance measurement was made in this step. The existing bench/money-register-688.mjs profile and docs/perf/baseline.json qualification remain for step 5.

UX gaps closed / UX gaps left

No UI changed and no visible control was added. No new screenshot set is needed for this SQL/guard slice. #1365 and #1366 stay open. Prior visual review remains pending.

Verification notes

The full crate suites ran once. The plugin suite's only failure was the new test's edited-row comparison. The corrected focused regression passed. The full plugin suite was not repeated. Its SIGKILL recovery, intermediate i64 overflow and independent BigInt properties passed. Integration targets prevented by that failure run separately.

The first combined clippy attempt was interrupted to prioritize a tested atomic commit. The next attempt found the generated web build missing. The production web build was then made. The final combined clippy check passed with those assets. Server library tests also passed; only deterministic_performance_guards failed with the remaining 70 violations.

Verbatim gate summaries and cleanup follow.

Gates, verbatim

cargo fmt --check

(exit 0; no output)

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 19m 22s

cargo test -p calternal-money -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 20m 42s
test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 24.57s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.24s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 5.20s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-money -- --test-threads=4 (initial full library run; new-test assertion corrected below)

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 55s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 142 filtered out; finished in 76.88s
test result: FAILED. 139 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 336.53s
error: test failed, to rerun pass `-p calternal-plugin-money --lib`

Focused final scoped filter-index regression

    Finished `test` profile [unoptimized + debuginfo] target(s) in 9m 46s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 142 filtered out; finished in 10.75s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

SIGKILL, intermediate overflow and source-free cached-read regressions in the full plugin run

test register::tests::suffix_batches_never_promote_integer_balances_to_real ... ok
test routes::register_contract_tests::cached_register_reads_without_source_or_projection_writes ... ok
test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok

cargo test -p calternal-plugin-money --test import_review -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 19m 25s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.25s

cargo test -p calternal-server -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 31m 57s
test result: ok. 272 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 141.45s
perf-lint: FAIL; 70 violations; 22441 scoped exceptions
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 31.59s
error: test failed, to rerun pass `-p calternal-server --test perf_guards`

cargo test -p calternal-server --test private_index_permissions -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s

cd apps/web && bun run check

perf-lint: FAIL; 70 violations; 22441 scoped exceptions
svelte-check found 0 errors and 4 warnings in 2 files
error: script "check" exited with code 1

cd apps/web && bun run test --maxWorkers=2

Ran 140 tests in 0.466s
OK
 Test Files  299 passed (299)
      Tests  2127 passed (2127)

For the merge round

After the blocking steps are fixed, run tests/adversarial/run.sh on the combined server. It must check User isolation, authorization, hostile payloads and concurrent writes. The Money-specific exported probes are exercised by bench/money-register-688.mjs during step 5. Run its 50k/200k qualification on the perf VM through perf-run calternal money688c <minutes> -- bun bench/money-register-688.mjs, with copied release binaries and an interleaved origin/dev baseline. No build runs on that VM. Renderer timing must also be confirmed on the locked macOS VM. These are later steps, not results of this checkpoint.

All gate logs and JSON classification reports stay in artifacts/money688d/. They are not committed. The report does not claim READY FOR MERGE.

Cleanup

cargo clean completed:

Removed 18339 files, 12.4GiB total

Removed the verified ignored apps/web/build and apps/web/.svelte-kit/output directories. The worktree is clean. Reports and logs remain in artifacts/money688d/.

# money688d — step 2 checkpoint (#688) NOT READY FOR MERGE. Step 1 stays complete: its 25 SIGKILL cases pass. Step 2 is partial: perf-lint falls from 393 to 70 branch-owned violations. Steps 3–5 are not started. No exception or ratchet was changed. ## Built - Cached generation reads now use an explicit `LIMIT 1`. A source-free regression makes both single-connection writer pools read-only. It checks the retained page, owner isolation and missing identities after all Budget source files are removed. - Filter indexes use two fixed SQL statements. Four numbered parameters are reused across all UNION arms. The regression checks split Category membership, untouched search rows, and the edited row's cleared-state search. - 170 exact call bindings identify checked arithmetic, JSON conversion, SQL construction, synchronization and retained Index reads. Their tests are enabled. Execution and transaction fences remain visible to the guard. 63 inactive Money bindings were removed. - Module comments now describe the shared read-only pool and page WAL snapshot. ## Files and commits - `crates/plugins/money/src/register.rs` - `crates/plugins/money/src/register_contract_tests.rs` - `contracts/perf/registry.json` Commits: `d6b14d031` (cached reads), `5c6fa7cae` (fixed filter writes), `01f61862b` (typed guard evidence). Head: `01f61862b7bff3d8f81708eea81230e5922a2e47`. Base checked: `af202e1514955ddf0f8b4b3d2503c780d807ed84`. Branch: `job/money-688`. `git fetch origin && git merge origin/dev` ran once; it was already up to date. No push, deployment, merge into dev/main or issue closure was done. No dependency or migration was added. ## Findings and known gaps A detached checkout of `origin/dev` at the stated base passed perf-lint with zero violations. The initial 393 findings were all in the branch's register code. The final 70 contain 68 unresolved calls and two cold-builder batch-loop findings. They cover cold initialization, SQLite execution and fences, plus source fingerprints. The read path can still build the whole projection. Step 2 cannot be called complete. Writes still validate/replay the full Ledger (step 3). #1365 and #1366 remain for step 4. No final 50k/200k qualification, first-row p95, scroll p95 or burst RSS result is claimed (step 5). The independent number review remains pending from the prior report. ## Decisions Use SQLite `$1`–`$4` parameters in the two fixed statements. The locked SQLx binder supports them and the SQL guard parses them. Keep actual execution sites unclassified until the cold read path is fixed. A capability binding proves the exact typed call; it does not prove a latency budget. Compare stable page content and cursor availability in the new cached-read regression. Signed cursor bytes contain wall-clock expiry and can differ across a clock tick. The new scoped-update test initially compared the edited row as unchanged. Clearing already adds `#cleared` to its search text. The final test checks unchanged rows and checks the selected row's new search state separately. No pre-existing test expectation was changed. ## Cost and measurements The metadata query selects at most one generation row by its owner-bound key. Filter maintenance executes two set-based statements; work scales with affected postings and split memberships. Cold building and full-Ledger write validation costs remain. No runtime performance measurement was made in this step. The existing `bench/money-register-688.mjs` profile and `docs/perf/baseline.json` qualification remain for step 5. ## UX gaps closed / UX gaps left No UI changed and no visible control was added. No new screenshot set is needed for this SQL/guard slice. #1365 and #1366 stay open. Prior visual review remains pending. ## Verification notes The full crate suites ran once. The plugin suite's only failure was the new test's edited-row comparison. The corrected focused regression passed. The full plugin suite was not repeated. Its SIGKILL recovery, intermediate i64 overflow and independent BigInt properties passed. Integration targets prevented by that failure run separately. The first combined clippy attempt was interrupted to prioritize a tested atomic commit. The next attempt found the generated web build missing. The production web build was then made. The final combined clippy check passed with those assets. Server library tests also passed; only deterministic_performance_guards failed with the remaining 70 violations. Verbatim gate summaries and cleanup follow. ## Gates, verbatim cargo fmt --check ```text (exit 0; no output) ``` cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 19m 22s ``` cargo test -p calternal-money -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 20m 42s test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 24.57s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.24s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 5.20s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo test -p calternal-plugin-money -- --test-threads=4 (initial full library run; new-test assertion corrected below) ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 55s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 142 filtered out; finished in 76.88s test result: FAILED. 139 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 336.53s error: test failed, to rerun pass `-p calternal-plugin-money --lib` ``` Focused final scoped filter-index regression ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 9m 46s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 142 filtered out; finished in 10.75s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` SIGKILL, intermediate overflow and source-free cached-read regressions in the full plugin run ```text test register::tests::suffix_batches_never_promote_integer_balances_to_real ... ok test routes::register_contract_tests::cached_register_reads_without_source_or_projection_writes ... ok test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok ``` cargo test -p calternal-plugin-money --test import_review -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 19m 25s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.25s ``` cargo test -p calternal-server -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 31m 57s test result: ok. 272 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 141.45s perf-lint: FAIL; 70 violations; 22441 scoped exceptions test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 31.59s error: test failed, to rerun pass `-p calternal-server --test perf_guards` ``` cargo test -p calternal-server --test private_index_permissions -- --test-threads=4 ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s ``` cd apps/web && bun run check ```text perf-lint: FAIL; 70 violations; 22441 scoped exceptions svelte-check found 0 errors and 4 warnings in 2 files error: script "check" exited with code 1 ``` cd apps/web && bun run test --maxWorkers=2 ```text Ran 140 tests in 0.466s OK Test Files 299 passed (299) Tests 2127 passed (2127) ``` ## For the merge round After the blocking steps are fixed, run `tests/adversarial/run.sh` on the combined server. It must check User isolation, authorization, hostile payloads and concurrent writes. The Money-specific exported probes are exercised by `bench/money-register-688.mjs` during step 5. Run its 50k/200k qualification on the perf VM through `perf-run calternal money688c <minutes> -- bun bench/money-register-688.mjs`, with copied release binaries and an interleaved origin/dev baseline. No build runs on that VM. Renderer timing must also be confirmed on the locked macOS VM. These are later steps, not results of this checkpoint. All gate logs and JSON classification reports stay in `artifacts/money688d/`. They are not committed. The report does not claim READY FOR MERGE. ## Cleanup `cargo clean` completed: ```text Removed 18339 files, 12.4GiB total ``` Removed the verified ignored `apps/web/build` and `apps/web/.svelte-kit/output` directories. The worktree is clean. Reports and logs remain in `artifacts/money688d/`.
kayg commented 2026-10-08 20:41:26 +00:00
Author
Owner
Copy link

Continuing #688 on job/money-688 at 01f61862b7bff3d8f81708eea81230e5922a2e47, based on af202e1514955ddf0f8b4b3d2503c780d807ed84. Step 1 remains complete; step 2 has 70 remaining perf-lint findings from the prior checkpoint. I am classifying those against the current origin/dev before code changes, then I will continue in the requested order and report each completed step with its gates.

Continuing #688 on `job/money-688` at `01f61862b7bff3d8f81708eea81230e5922a2e47`, based on `af202e1514955ddf0f8b4b3d2503c780d807ed84`. Step 1 remains complete; step 2 has 70 remaining perf-lint findings from the prior checkpoint. I am classifying those against the current `origin/dev` before code changes, then I will continue in the requested order and report each completed step with its gates.
kayg commented 2026-10-08 20:50:30 +00:00
Author
Owner
Copy link

Merge audit finding: scripts/perf-lint --check returned perf-lint: INVALID because the merged contracts/perf/exceptions.json had 22,544 entries while the branch ratchet remained at 22,441. The merge parent cc1af3c12b68ad26c8403adde1be39c096b9ddea has the same 22,544-entry ledger and ratchet. I am syncing the ratchet to that exact origin/dev value so inherited scopes stay at the fetched baseline; no new exception or higher-than-baseline limit is added.

Merge audit finding: `scripts/perf-lint --check` returned `perf-lint: INVALID` because the merged `contracts/perf/exceptions.json` had 22,544 entries while the branch ratchet remained at 22,441. The merge parent `cc1af3c12b68ad26c8403adde1be39c096b9ddea` has the same 22,544-entry ledger and ratchet. I am syncing the ratchet to that exact `origin/dev` value so inherited scopes stay at the fetched baseline; no new exception or higher-than-baseline limit is added.
kayg commented 2026-10-08 20:56:58 +00:00
Author
Owner
Copy link

Perf-lint source-graph comparison against both merge parents: 22,511 live findings were found. The union of the pre-merge branch and fetched origin/dev ledgers covers all but 70, and the 70 are exactly 68 io.unresolved-call sites plus two sql.query-in-loop sites in branch-owned crates/plugins/money/src/register.rs and the branch's register_for/cached_register paths in routes.rs. The combined source has 120 stale upstream scopes and 106 still-live scopes whose syntax hashes changed; all live limits are unchanged. I will keep only already-existing scopes, refresh their exact hashes and remove stale scopes. No new exception or limit increase is needed.

Perf-lint source-graph comparison against both merge parents: 22,511 live findings were found. The union of the pre-merge branch and fetched `origin/dev` ledgers covers all but 70, and the 70 are exactly 68 `io.unresolved-call` sites plus two `sql.query-in-loop` sites in branch-owned `crates/plugins/money/src/register.rs` and the branch's `register_for`/`cached_register` paths in `routes.rs`. The combined source has 120 stale upstream scopes and 106 still-live scopes whose syntax hashes changed; all live limits are unchanged. I will keep only already-existing scopes, refresh their exact hashes and remove stale scopes. No new exception or limit increase is needed.
kayg commented 2026-10-08 20:59:00 +00:00
Author
Owner
Copy link

The reconciled source ledger now has 22,441 live scopes and no new scopes, but the #1058 adoption checkpoint still contains hashes from the pre-merge source. The runner rejects this with adoption checkpoint differs from its exact live ledger entry. I am refreshing only previously approved #1058 entries that still exist in the merged ledger and dropping stale checkpoint entries; this adds no adoption or exception scope.

The reconciled source ledger now has 22,441 live scopes and no new scopes, but the #1058 adoption checkpoint still contains hashes from the pre-merge source. The runner rejects this with `adoption checkpoint differs from its exact live ledger entry`. I am refreshing only previously approved #1058 entries that still exist in the merged ledger and dropping stale checkpoint entries; this adds no adoption or exception scope.
kayg commented 2026-10-08 21:25:55 +00:00
Author
Owner
Copy link

Step 2 finding after the origin/dev sync: scripts/perf-lint --check reports 70 live Money findings: 68 io.unresolved-call and 2 sql.query-in-loop. They are all branch-owned. register.rs contributes 64 through the cold projection build reachable from both register list routes; routes.rs contributes six through the request-time source fingerprint and fallback build. The fetched origin/dev has no crates/plugins/money/src/register.rs and has none of these register route helpers. I am removing the cold build and source fingerprint from the interactive read call graph, with a bounded background build for missing projections. No exception or ratchet increase is planned.

Step 2 finding after the origin/dev sync: `scripts/perf-lint --check` reports 70 live Money findings: 68 `io.unresolved-call` and 2 `sql.query-in-loop`. They are all branch-owned. `register.rs` contributes 64 through the cold projection build reachable from both register list routes; `routes.rs` contributes six through the request-time source fingerprint and fallback build. The fetched `origin/dev` has no `crates/plugins/money/src/register.rs` and has none of these register route helpers. I am removing the cold build and source fingerprint from the interactive read call graph, with a bounded background build for missing projections. No exception or ratchet increase is planned.
kayg commented 2026-10-08 22:14:29 +00:00
Author
Owner
Copy link

Step 2 update: the 70 register-read perf-lint findings are resolved without new exceptions.

Evidence and changes:

  • A cold register miss now queues one bounded background build and returns retryable 503. Warm requests read the persisted Index generation. The worker rechecks the cache and uses a same-transaction missing-row fence, so it cannot replace a generation published by a concurrent server write.
  • The bounded-queue regression covers invalid IDs, duplicate coalescing, and saturation. The cached-read regression covers the owner-bound Index row without source reads or projection writes.
  • A lexical scope releases the read guard without an explicit drop call. The conservative call graph no longer pulls unrelated Drop implementations into the read route.
  • Added 25 exact, test-backed capability bindings for the bounded queue, cached metadata read, and stable-ID regex. Removed two obsolete money.find pins. No exception was added; the perf ratchet fell from 22,441 to 22,439.
  • The GET accounts and GET transactions contracts now describe the retryable 503 response.

Verification: perf-lint: PASS; 0 violations; 22439 scoped exceptions. cargo fmt --check and git diff --check passed. The focused queue regression passed. Full step 2 crate gates are still running.

Step 2 update: the 70 register-read perf-lint findings are resolved without new exceptions. Evidence and changes: - A cold register miss now queues one bounded background build and returns retryable 503. Warm requests read the persisted Index generation. The worker rechecks the cache and uses a same-transaction missing-row fence, so it cannot replace a generation published by a concurrent server write. - The bounded-queue regression covers invalid IDs, duplicate coalescing, and saturation. The cached-read regression covers the owner-bound Index row without source reads or projection writes. - A lexical scope releases the read guard without an explicit `drop` call. The conservative call graph no longer pulls unrelated `Drop` implementations into the read route. - Added 25 exact, test-backed capability bindings for the bounded queue, cached metadata read, and stable-ID regex. Removed two obsolete `money.find` pins. No exception was added; the perf ratchet fell from 22,441 to 22,439. - The GET accounts and GET transactions contracts now describe the retryable 503 response. Verification: `perf-lint: PASS; 0 violations; 22439 scoped exceptions`. `cargo fmt --check` and `git diff --check` passed. The focused queue regression passed. Full step 2 crate gates are still running.
kayg commented 2026-10-08 22:34:33 +00:00
Author
Owner
Copy link

Step 2 test-fix finding: the first full calternal-plugin-money run hit a stack overflow in the new stale_cold_builder_does_not_replace_a_newer_generation regression. This was a test-future stack issue, not a product crash. The test combined SQLx and filesystem futures on the stack, while neighboring Money route tests heap-box this state. I wrapped the test body in Box::pin; the focused regression then passed. The full plugin suite is being rerun. No existing expectation changed.

Step 2 test-fix finding: the first full `calternal-plugin-money` run hit a stack overflow in the new `stale_cold_builder_does_not_replace_a_newer_generation` regression. This was a test-future stack issue, not a product crash. The test combined SQLx and filesystem futures on the stack, while neighboring Money route tests heap-box this state. I wrapped the test body in `Box::pin`; the focused regression then passed. The full plugin suite is being rerun. No existing expectation changed.
kayg commented 2026-10-08 23:00:15 +00:00
Author
Owner
Copy link

Step 2 server-gate findings:

cargo test -p calternal-server -- --test-threads=4 completed with 271 passed, 2 failed and 12 ignored.

  1. wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts expected no Money migrations, while the branch's existing migration registry returned money migrations 1–3. Step 2 did not change migration files. I kept the existing expectation unchanged, as required; the orchestrator should decide how the earlier durability migration set is represented in this fixture.
  2. wire::tests::live_apps_run_in_separate_processes failed through its child timing probe: startup_search_reconciliation_keeps_calendar_writes_responsive_on_large_home measured 20,000 files / 32 writes at p95 12.196760347s against a 10s budget. This is a timing-only failure in the Calendar probe, unrelated to the Money route. I did not rerun it.

The same server run passed the other 271 tests. The Money plugin suite passed, including SIGKILL recovery at every durability point. Perf-lint independently reports zero violations.

Step 2 server-gate findings: `cargo test -p calternal-server -- --test-threads=4` completed with 271 passed, 2 failed and 12 ignored. 1. `wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts` expected no Money migrations, while the branch's existing migration registry returned `money` migrations 1–3. Step 2 did not change migration files. I kept the existing expectation unchanged, as required; the orchestrator should decide how the earlier durability migration set is represented in this fixture. 2. `wire::tests::live_apps_run_in_separate_processes` failed through its child timing probe: `startup_search_reconciliation_keeps_calendar_writes_responsive_on_large_home` measured 20,000 files / 32 writes at p95 12.196760347s against a 10s budget. This is a timing-only failure in the Calendar probe, unrelated to the Money route. I did not rerun it. The same server run passed the other 271 tests. The Money plugin suite passed, including SIGKILL recovery at every durability point. Perf-lint independently reports zero violations.
kayg commented 2026-10-08 23:07:37 +00:00
Author
Owner
Copy link

Step 2 checkpoint — perf-lint

Step 2 is complete at 249a05f4c0b565465eb3c49ef4691458c0832bd2 on job/money-688.

The 70 remaining branch-owned perf-lint violations were reviewed against origin/dev; the request-path cold register build caused them. Cold register builds now run on a bounded, deduplicating worker queue. Warm reads use the durable cached Index, and a cold read returns retryable 503 while the queue builds the missing generation. Concurrent writes fence publication so an old build cannot replace a newer generation. No perf exception was added; the exact call bindings were refreshed and stale bindings removed.

Gate evidence:

  • cargo fmt --check: no output; exit 0.
  • cargo clippy -p calternal-money --all-targets -- -D warnings: Finished dev profile [unoptimized + debuginfo] target(s) in 3m 11s.
  • cargo test -p calternal-money -- --test-threads=4: all test groups passed (16, 4, 13, 12, 1, 4, and 2 passed; one ignored; doc tests had 0 tests).
  • cargo clippy -p calternal-plugin-money --all-targets -- -D warnings: Finished dev profile [unoptimized + debuginfo] target(s) in 13.39s.
  • cargo test -p calternal-plugin-money -- --test-threads=4: test result: ok. 143 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 309.90s; integration tests: test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 9.86s.
  • cargo clippy -p calternal-server --all-targets -- -D warnings: Finished dev profile [unoptimized + debuginfo] target(s) in 12m 28s.
  • cargo test -p calternal-server -- --test-threads=4: test result: FAILED. 271 passed; 2 failed; 12 ignored; 0 measured; 0 filtered out; finished in 140.92s. One failure is the pre-existing schema-upgrade expectation that no Money migrations exist, while this branch's step 1 adds migrations 1–3. The other is the timing-only 20,000-file search-reconciliation profile (p95 12.196s vs 10s). I left the existing expectation unchanged. Evidence and details are in the earlier issue comment.
  • cd apps/web && bun run check: perf-lint: PASS; 0 violations; 22439 scoped exceptions; svelte-check found 0 errors and 4 warnings in 2 files (existing warnings; no web source changed).
  • Full bun run test is deferred by the shared verification policy; the merge-round command is cd apps/web && bun run test --maxWorkers=2.

The step 2 benchmark profile now checks that a missing projection returns promptly and that the bounded worker rebuilds it. Its required local measurement is still pending. No UI files changed.

Decision where DESIGN was silent: return retryable HTTP 503 for a cold projection read, and build it asynchronously with a process-local bounded queue. This keeps the request path independent of full register reconstruction while the durable source remains authoritative.

## Step 2 checkpoint — perf-lint Step 2 is complete at `249a05f4c0b565465eb3c49ef4691458c0832bd2` on `job/money-688`. The 70 remaining branch-owned perf-lint violations were reviewed against `origin/dev`; the request-path cold register build caused them. Cold register builds now run on a bounded, deduplicating worker queue. Warm reads use the durable cached Index, and a cold read returns retryable 503 while the queue builds the missing generation. Concurrent writes fence publication so an old build cannot replace a newer generation. No perf exception was added; the exact call bindings were refreshed and stale bindings removed. Gate evidence: - `cargo fmt --check`: no output; exit 0. - `cargo clippy -p calternal-money --all-targets -- -D warnings`: `Finished dev profile [unoptimized + debuginfo] target(s) in 3m 11s`. - `cargo test -p calternal-money -- --test-threads=4`: all test groups passed (16, 4, 13, 12, 1, 4, and 2 passed; one ignored; doc tests had 0 tests). - `cargo clippy -p calternal-plugin-money --all-targets -- -D warnings`: `Finished dev profile [unoptimized + debuginfo] target(s) in 13.39s`. - `cargo test -p calternal-plugin-money -- --test-threads=4`: `test result: ok. 143 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 309.90s`; integration tests: `test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 9.86s`. - `cargo clippy -p calternal-server --all-targets -- -D warnings`: `Finished dev profile [unoptimized + debuginfo] target(s) in 12m 28s`. - `cargo test -p calternal-server -- --test-threads=4`: `test result: FAILED. 271 passed; 2 failed; 12 ignored; 0 measured; 0 filtered out; finished in 140.92s`. One failure is the pre-existing schema-upgrade expectation that no Money migrations exist, while this branch's step 1 adds migrations 1–3. The other is the timing-only 20,000-file search-reconciliation profile (p95 12.196s vs 10s). I left the existing expectation unchanged. Evidence and details are in the earlier issue comment. - `cd apps/web && bun run check`: `perf-lint: PASS; 0 violations; 22439 scoped exceptions`; `svelte-check found 0 errors and 4 warnings in 2 files` (existing warnings; no web source changed). - Full `bun run test` is deferred by the shared verification policy; the merge-round command is `cd apps/web && bun run test --maxWorkers=2`. The step 2 benchmark profile now checks that a missing projection returns promptly and that the bounded worker rebuilds it. Its required local measurement is still pending. No UI files changed. Decision where DESIGN was silent: return retryable HTTP 503 for a cold projection read, and build it asynchronously with a process-local bounded queue. This keeps the request path independent of full register reconstruction while the durable source remains authoritative.
kayg commented 2026-10-08 23:20:18 +00:00
Author
Owner
Copy link

Step 3 progress — account posting deltas

Committed e674e9c38633cde9b277d31497ca944bb713707f on job/money-688.

The register updater now adjusts Account balance, cleared balance and aggregate totals from the changed register rows for cash-only Budgets whose Assignments did not change. The temporary batch uses i128; the final Account values are checked against the exact Minor range before the SQLite transaction publishes. Card funding and Assignment changes retain the checked replay path because reserve FIFO and rollover state depend on other rows and months. The randomized register history now compares the incrementally maintained AccountList to the full replay result after edits, deletes, split postings, transfer legs and month moves.

This is a partial step 3 checkpoint, not completion: transaction write validation still calls project_with and replays the proposed whole Ledger, and Card or Assignment changes still use full replay. I am continuing step 3 before starting #1365/#1366.

Gates for this slice:

  • cargo fmt --check: exit 0; no output.
  • cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: Finished dev profile [unoptimized + debuginfo] target(s) in 12.53s.
  • cargo test -p calternal-money: test groups passed (16, 4, 13, 12, 1, 4 and 2 passed; one ignored; doc tests had 0 tests).
  • cargo test -p calternal-plugin-money -- --test-threads=4: test result: ok. 143 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 258.44s; integration tests: test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.15s.
## Step 3 progress — account posting deltas Committed `e674e9c38633cde9b277d31497ca944bb713707f` on `job/money-688`. The register updater now adjusts Account balance, cleared balance and aggregate totals from the changed register rows for cash-only Budgets whose Assignments did not change. The temporary batch uses `i128`; the final Account values are checked against the exact `Minor` range before the SQLite transaction publishes. Card funding and Assignment changes retain the checked replay path because reserve FIFO and rollover state depend on other rows and months. The randomized register history now compares the incrementally maintained AccountList to the full replay result after edits, deletes, split postings, transfer legs and month moves. This is a partial step 3 checkpoint, not completion: transaction write validation still calls `project_with` and replays the proposed whole Ledger, and Card or Assignment changes still use full replay. I am continuing step 3 before starting #1365/#1366. Gates for this slice: - `cargo fmt --check`: exit 0; no output. - `cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings`: `Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.53s`. - `cargo test -p calternal-money`: test groups passed (16, 4, 13, 12, 1, 4 and 2 passed; one ignored; doc tests had 0 tests). - `cargo test -p calternal-plugin-money -- --test-threads=4`: `test result: ok. 143 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 258.44s`; integration tests: `test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.15s`.
kayg commented 2026-10-08 23:48:09 +00:00
Author
Owner
Copy link

Real-server finding from the #1366 cursor fixture, on job/money-688 before its latest changes: five concurrent valid synthetic transaction creates with 94 distinct inline Tags returned statuses 500,500,500,201,201. The fixture used one 201-row synthetic Budget. This is a reproducible non-SLOW 5xx candidate; I am rerunning the fixture with sequential writes to isolate the paging probe and will investigate the concurrent result before final gates.

Real-server finding from the #1366 cursor fixture, on job/money-688 before its latest changes: five concurrent valid synthetic transaction creates with 94 distinct inline Tags returned statuses `500,500,500,201,201`. The fixture used one 201-row synthetic Budget. This is a reproducible non-SLOW 5xx candidate; I am rerunning the fixture with sequential writes to isolate the paging probe and will investigate the concurrent result before final gates.
kayg commented 2026-10-08 23:49:08 +00:00
Author
Owner
Copy link

Update to the real-server finding: a sequential reproduction on a 201-row synthetic Budget returned 201,500,500,500,500 for five valid creates with the same 94 distinct inline Tags. The earlier concurrent attempt returned 500,500,500,201,201. This confirms the 5xx is not limited to concurrent writes. The probe currently records only status codes; I am narrowing the server error class before final gates.

Update to the real-server finding: a sequential reproduction on a 201-row synthetic Budget returned `201,500,500,500,500` for five valid creates with the same 94 distinct inline Tags. The earlier concurrent attempt returned `500,500,500,201,201`. This confirms the 5xx is not limited to concurrent writes. The probe currently records only status codes; I am narrowing the server error class before final gates.
kayg commented 2026-10-09 00:15:30 +00:00
Author
Owner
Copy link

#688 checkpoint — money688e

Branch: job/money-688
Head: 7f062abc80e295f742e066b595af9bf19f9de7f9
Not ready for merge: Steps 3 and 4 are incomplete.

Step status

  1. Durability — done. The source/Index intent journal remains intact. The final SIGKILL rerun passed at every durability point.
  2. perf-lint — done. Branch-owned violations were fixed and exact existing pins were refreshed without changing limits. Final result: 0 violations.
  3. Incremental writes — partial. Cash-only Account summaries use posting deltas when Assignments are unchanged. The randomized test compares these summaries to full replay over edits, deletes, split postings, transfer legs and month moves. Transaction writes still call project_with over the whole Ledger; Card and Assignment changes still replay.
  4. #1366 — done for the tested paths. #1365 — open. The real-server UI probe passed expired-cursor and stale-revision recovery, paging, focus, retained draft, stable link, touch target and keyboard-menu checks. The same run reproduced #1365: the valid 100-Tag write returned 201 and the next register read returned 413. The item/byte caps remain unchanged; no fields were dropped.
  5. 50k / 200k qualification — not run. No perf-VM first-row p95, scroll p95 or burst RSS is claimed.

Files

  • Money projection and durability: Cargo.lock; crates/calternal-money/src/ledger.rs; crates/calternal-server/src/upgrade_tests.rs; crates/calternal-server/src/wire.rs; crates/plugins/money/Cargo.toml; crates/plugins/money/migrations/0001_register_projection.sql; crates/plugins/money/migrations/0002_register_row_generation.sql; crates/plugins/money/migrations/0003_register_intents.sql; crates/plugins/money/src/durable_import.rs; crates/plugins/money/src/durable_import_tests.rs; crates/plugins/money/src/import.rs; crates/plugins/money/src/lib.rs; crates/plugins/money/src/register.rs; crates/plugins/money/src/register_contract_tests.rs; crates/plugins/money/src/register_recovery_tests.rs; crates/plugins/money/src/review_1140.rs; crates/plugins/money/src/routes.rs; crates/plugins/money/src/store.rs; crates/plugins/money/src/tests.rs; crates/plugins/money/src/views.rs; docs/upgrade.md.
  • Web and shared UI: apps/web/src/lib/components/money/TransactionForm.svelte; apps/web/src/lib/money/api.ts; apps/web/src/lib/money/register-display.ts; apps/web/src/lib/money/register-display.test.ts; apps/web/src/lib/money/virtual-rows.test.ts; apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte; apps/web/src/routes/money/[budget]/transactions/[transaction]/+page.svelte; packages/ui/src/components/files/FileCollection.svelte; packages/ui/src/index.ts; packages/ui/src/virtualRows.ts.
  • Contracts, generated assets, profiles and probes: bench/money-import-462.mjs; bench/money-register-688.mjs; contracts/action-policy.json; contracts/openapi.json; contracts/perf/adoption-1058.json; contracts/perf/exceptions.json; contracts/perf/ratchet.json; contracts/perf/registry.json; docs/perf/baseline.json; packages/api-client/src/generated.ts; tests/adversarial/money_register_688.mjs.

Gates and probe output

Step 3 Rust gates (the changed Rust packages):

cargo fmt --check: exit 0; no output.
cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.53s.
cargo test -p calternal-money: test groups passed (16, 4, 13, 12, 1, 4 and 2 passed; one ignored; doc tests had 0 tests).
cargo test -p calternal-plugin-money -- --test-threads=4: test result: ok. 143 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 258.44s.
Integration tests: test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.15s.

Final durability rerun:

Finished `test` profile [unoptimized + debuginfo] target(s) in 1.81s
running 1 test
test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 145 filtered out; finished in 42.20s

Final web checks:

perf-lint: PASS; 0 violations; 22439 scoped exceptions
svelte-check found 0 errors and 4 warnings in 2 files
 Test Files  1 passed (1)
      Tests  3 passed (3)
   Duration  9.12s (transform 91%, import 8%)

Focused production-server probe on a 201-row synthetic Budget:

paging_keyboard: true
expired_cursor_recovery_kept_focus: true
revision_recovery_kept_focus: true
draft_retained: true
old_identity_resolved: true
touch_targets: true
keyboard_menu: true
100-Tag write_status: 201
following register_status: 413
malformed/replayed requests rejected: 9
concurrent reads: 16 passed
console_errors: 1 (the injected expired-cursor 400); page_errors: 0

cargo test -p calternal-server -- --test-threads=4 previously had 271 passed, 2 failed and 12 ignored: the upgrade test expects no Money migrations although migrations 1–3 exist, and a SLOW Calendar search probe measured p95 12.196760347s against its 10s timing budget. Existing expectations were not changed.

A separate real-server 94-Tag write probe also found an unresolved non-SLOW 5xx: five sequential creates returned 201,500,500,500,500; the response error was internal / “The register could not be read.” This finding was reported on #688 and was not fixed in this job.

UX gaps and decisions

Closed for #1366: a cursor or revision conflict reloads one page around the visible stable identity, retries the same paging action once, and keeps focus intent. A deleted anchor falls back to the current head. A repeated conflict shows Retry. These recovery choices were not specified in DESIGN.

Open: #1365 still returns 413 for a valid 100-Tag row, and repeated 94-Tag writes can return 500. A bounded full-field endpoint and UI access are not implemented. Step 3 route-level replay removal and Step 5 qualification are also open.

The focused probe adds five synthetic 94-Tag rows only when MONEY688_PROBE_ONLY=1; its Plan totals include those rows. No such rows ship in the UI. The stale-revision test mutates one real-server page response to exercise recovery without adding a source write.

Thirty actual-size macOS-platform-emulated production screenshots (390 / 820 / 1440 px, light and dark) are in artifacts/money688e/screenshots/; they are not committed. scripts/fj issue comment --help supports text comments only, so this job could not attach the PNG files to Forgejo.

cargo clean output: Removed 18830 files, 13.8GiB total. Web build output was deleted. No push, merge, deploy or issue closure was done.

# #688 checkpoint — money688e Branch: `job/money-688` Head: `7f062abc80e295f742e066b595af9bf19f9de7f9` Not ready for merge: Steps 3 and 4 are incomplete. ## Step status 1. **Durability — done.** The source/Index intent journal remains intact. The final SIGKILL rerun passed at every durability point. 2. **perf-lint — done.** Branch-owned violations were fixed and exact existing pins were refreshed without changing limits. Final result: 0 violations. 3. **Incremental writes — partial.** Cash-only Account summaries use posting deltas when Assignments are unchanged. The randomized test compares these summaries to full replay over edits, deletes, split postings, transfer legs and month moves. Transaction writes still call `project_with` over the whole Ledger; Card and Assignment changes still replay. 4. **#1366 — done for the tested paths. #1365 — open.** The real-server UI probe passed expired-cursor and stale-revision recovery, paging, focus, retained draft, stable link, touch target and keyboard-menu checks. The same run reproduced #1365: the valid 100-Tag write returned 201 and the next register read returned 413. The item/byte caps remain unchanged; no fields were dropped. 5. **50k / 200k qualification — not run.** No perf-VM first-row p95, scroll p95 or burst RSS is claimed. ## Files - Money projection and durability: `Cargo.lock`; `crates/calternal-money/src/ledger.rs`; `crates/calternal-server/src/upgrade_tests.rs`; `crates/calternal-server/src/wire.rs`; `crates/plugins/money/Cargo.toml`; `crates/plugins/money/migrations/0001_register_projection.sql`; `crates/plugins/money/migrations/0002_register_row_generation.sql`; `crates/plugins/money/migrations/0003_register_intents.sql`; `crates/plugins/money/src/durable_import.rs`; `crates/plugins/money/src/durable_import_tests.rs`; `crates/plugins/money/src/import.rs`; `crates/plugins/money/src/lib.rs`; `crates/plugins/money/src/register.rs`; `crates/plugins/money/src/register_contract_tests.rs`; `crates/plugins/money/src/register_recovery_tests.rs`; `crates/plugins/money/src/review_1140.rs`; `crates/plugins/money/src/routes.rs`; `crates/plugins/money/src/store.rs`; `crates/plugins/money/src/tests.rs`; `crates/plugins/money/src/views.rs`; `docs/upgrade.md`. - Web and shared UI: `apps/web/src/lib/components/money/TransactionForm.svelte`; `apps/web/src/lib/money/api.ts`; `apps/web/src/lib/money/register-display.ts`; `apps/web/src/lib/money/register-display.test.ts`; `apps/web/src/lib/money/virtual-rows.test.ts`; `apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte`; `apps/web/src/routes/money/[budget]/transactions/[transaction]/+page.svelte`; `packages/ui/src/components/files/FileCollection.svelte`; `packages/ui/src/index.ts`; `packages/ui/src/virtualRows.ts`. - Contracts, generated assets, profiles and probes: `bench/money-import-462.mjs`; `bench/money-register-688.mjs`; `contracts/action-policy.json`; `contracts/openapi.json`; `contracts/perf/adoption-1058.json`; `contracts/perf/exceptions.json`; `contracts/perf/ratchet.json`; `contracts/perf/registry.json`; `docs/perf/baseline.json`; `packages/api-client/src/generated.ts`; `tests/adversarial/money_register_688.mjs`. ## Gates and probe output Step 3 Rust gates (the changed Rust packages): ```text cargo fmt --check: exit 0; no output. cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.53s. cargo test -p calternal-money: test groups passed (16, 4, 13, 12, 1, 4 and 2 passed; one ignored; doc tests had 0 tests). cargo test -p calternal-plugin-money -- --test-threads=4: test result: ok. 143 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 258.44s. Integration tests: test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.15s. ``` Final durability rerun: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1.81s running 1 test test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 145 filtered out; finished in 42.20s ``` Final web checks: ```text perf-lint: PASS; 0 violations; 22439 scoped exceptions svelte-check found 0 errors and 4 warnings in 2 files Test Files 1 passed (1) Tests 3 passed (3) Duration 9.12s (transform 91%, import 8%) ``` Focused production-server probe on a 201-row synthetic Budget: ```text paging_keyboard: true expired_cursor_recovery_kept_focus: true revision_recovery_kept_focus: true draft_retained: true old_identity_resolved: true touch_targets: true keyboard_menu: true 100-Tag write_status: 201 following register_status: 413 malformed/replayed requests rejected: 9 concurrent reads: 16 passed console_errors: 1 (the injected expired-cursor 400); page_errors: 0 ``` `cargo test -p calternal-server -- --test-threads=4` previously had 271 passed, 2 failed and 12 ignored: the upgrade test expects no Money migrations although migrations 1–3 exist, and a SLOW Calendar search probe measured p95 12.196760347s against its 10s timing budget. Existing expectations were not changed. A separate real-server 94-Tag write probe also found an unresolved non-SLOW 5xx: five sequential creates returned `201,500,500,500,500`; the response error was `internal` / “The register could not be read.” This finding was reported on #688 and was not fixed in this job. ## UX gaps and decisions Closed for #1366: a cursor or revision conflict reloads one page around the visible stable identity, retries the same paging action once, and keeps focus intent. A deleted anchor falls back to the current head. A repeated conflict shows Retry. These recovery choices were not specified in DESIGN. Open: #1365 still returns 413 for a valid 100-Tag row, and repeated 94-Tag writes can return 500. A bounded full-field endpoint and UI access are not implemented. Step 3 route-level replay removal and Step 5 qualification are also open. The focused probe adds five synthetic 94-Tag rows only when `MONEY688_PROBE_ONLY=1`; its Plan totals include those rows. No such rows ship in the UI. The stale-revision test mutates one real-server page response to exercise recovery without adding a source write. Thirty actual-size macOS-platform-emulated production screenshots (390 / 820 / 1440 px, light and dark) are in `artifacts/money688e/screenshots/`; they are not committed. `scripts/fj issue comment --help` supports text comments only, so this job could not attach the PNG files to Forgejo. `cargo clean` output: `Removed 18830 files, 13.8GiB total`. Web build output was deleted. No push, merge, deploy or issue closure was done.
kayg commented 2026-10-09 00:17:02 +00:00
Author
Owner
Copy link

money688f started on job/money-688 at base 7f062abc80. Investigating repeated Tag-heavy writes, then bounded register pages and scoped incremental projections. No push or deploy.

money688f started on job/money-688 at base 7f062abc80e295f742e066b595af9bf19f9de7f9. Investigating repeated Tag-heavy writes, then bounded register pages and scoped incremental projections. No push or deploy.
kayg commented 2026-10-09 00:30:45 +00:00
Author
Owner
Copy link

Finding: register page admission counts 1 + Tags + splits + source rows, so 100 Tags produce 101 items and HTTP 413 despite a small byte payload. Decision for #1365: keep the 256 KiB byte cap; permit one byte-bounded row to exceed the nested-item target so paging progresses. API writes accept at most 100 distinct Tags and reject 101 with 422 and a clear message before writing. Tests cover first-row inclusion, continuation, payload bytes and source unchanged on rejection. Repeated 94-Tag route tests pass for ordinary and imported Budgets; the original production-only 500 is still being isolated.

Finding: register page admission counts 1 + Tags + splits + source rows, so 100 Tags produce 101 items and HTTP 413 despite a small byte payload. Decision for #1365: keep the 256 KiB byte cap; permit one byte-bounded row to exceed the nested-item target so paging progresses. API writes accept at most 100 distinct Tags and reject 101 with 422 and a clear message before writing. Tests cover first-row inclusion, continuation, payload bytes and source unchanged on rejection. Repeated 94-Tag route tests pass for ordinary and imported Budgets; the original production-only 500 is still being isolated.
kayg commented 2026-10-09 00:33:10 +00:00
Author
Owner
Copy link

Root cause isolated on the exact production-server 201-row imported fixture: repeated 94-Tag creates produced HTTP 500 and SQLite code 5 (database is locked). Projection publication starts a deferred transaction and reads its generation before its first write. Background Index writes can make that read snapshot impossible to upgrade; the SQLite busy timeout does not retry this promotion. Fix: BEGIN IMMEDIATE before generation reads, for mutation and rebuild publication. A controlled competing-writer regression checks that publication waits, then succeeds after the competing commit. No Tag content or transaction values are logged.

Root cause isolated on the exact production-server 201-row imported fixture: repeated 94-Tag creates produced HTTP 500 and SQLite code 5 (database is locked). Projection publication starts a deferred transaction and reads its generation before its first write. Background Index writes can make that read snapshot impossible to upgrade; the SQLite busy timeout does not retry this promotion. Fix: BEGIN IMMEDIATE before generation reads, for mutation and rebuild publication. A controlled competing-writer regression checks that publication waits, then succeeds after the competing commit. No Tag content or transaction values are logged.
kayg commented 2026-10-09 00:41:17 +00:00
Author
Owner
Copy link

Committed writer-reservation fix as 355493ad0. The controlled competing-writer test passed in the crate run; clippy for calternal-money and calternal-plugin-money passed. The crate run also exposed a scoped-delta bug in multiple Assignment rows: comparison retained the last row rather than the sum. That selector is fixed, and the unchanged multiple-assignment route test now passes. No budget.rs conservation code was changed.

Committed writer-reservation fix as 355493ad0. The controlled competing-writer test passed in the crate run; clippy for calternal-money and calternal-plugin-money passed. The crate run also exposed a scoped-delta bug in multiple Assignment rows: comparison retained the last row rather than the sum. That selector is fixed, and the unchanged multiple-assignment route test now passes. No budget.rs conservation code was changed.
kayg commented 2026-10-09 01:02:11 +00:00
Author
Owner
Copy link

Step 3 is implemented in c85afe0d7: proposed mutations replay the old and new affected Category/Card dependency components and apply their deltas to cached Month snapshots. Splits connect their actual Categories, Cards connect their purchase/refund/payment history, and cash transfers contribute Account deltas. Assignment comparisons sum all rows for each Category/Month. Unchanged month sources reuse checked projected rows. A final follow-up also reuses those rows for Assignment-only source edits.

The independent scoped-versus-full replay test passed over random Card, cash, Assignment, split, transfer, reorder, edit, delete and month-move histories. The existing register property now also compares full Month snapshots with the independent full replay. Cost is one linear comparison/dependency pass over the Budget history, two replays of the affected component, and Month snapshot deltas. Structural metadata or source-range changes use full replay; arithmetic range cancellation can also require it. No changes were made to budget.rs conservation rules. The accepted bulkwrite-1393 branch may conflict in routes.rs project_with and Assignment handling, store.rs Budget caching/load, or the ledger projection helper; its budget.rs rules stay authoritative.

Full web checks passed: perf-lint: PASS; 0 violations; 22439 scoped exceptions; svelte-check found 0 errors and 4 warnings in 2 files. Full Vitest: 303 files and 2175 tests passed. Final Rust gates and the focused real-server regression round are in progress.

Step 3 is implemented in c85afe0d7: proposed mutations replay the old and new affected Category/Card dependency components and apply their deltas to cached Month snapshots. Splits connect their actual Categories, Cards connect their purchase/refund/payment history, and cash transfers contribute Account deltas. Assignment comparisons sum all rows for each Category/Month. Unchanged month sources reuse checked projected rows. A final follow-up also reuses those rows for Assignment-only source edits. The independent scoped-versus-full replay test passed over random Card, cash, Assignment, split, transfer, reorder, edit, delete and month-move histories. The existing register property now also compares full Month snapshots with the independent full replay. Cost is one linear comparison/dependency pass over the Budget history, two replays of the affected component, and Month snapshot deltas. Structural metadata or source-range changes use full replay; arithmetic range cancellation can also require it. No changes were made to budget.rs conservation rules. The accepted bulkwrite-1393 branch may conflict in routes.rs project_with and Assignment handling, store.rs Budget caching/load, or the ledger projection helper; its budget.rs rules stay authoritative. Full web checks passed: perf-lint: PASS; 0 violations; 22439 scoped exceptions; svelte-check found 0 errors and 4 warnings in 2 files. Full Vitest: 303 files and 2175 tests passed. Final Rust gates and the focused real-server regression round are in progress.
kayg commented 2026-10-09 01:14:32 +00:00
Author
Owner
Copy link

Final server gate at head 1466803522:

test result: FAILED. 272 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 144.33s

The sole failure is wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts at upgrade_tests.rs:110. The actual pending list includes (money, 1), (money, 2), (money, 3) from #688; the fixed expected list omits all three. No runtime migration failure was reported; the other upgrade tests pass. The existing expectation was kept under the job rule. The orchestrator must decide and review its update. This branch is not READY FOR MERGE while that gate fails. The prior SLOW Calendar failure did not recur.

Final server gate at head 1466803522fdabfd229d337c6e0e7940e34f83d0: ```text test result: FAILED. 272 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 144.33s ``` The sole failure is `wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts` at upgrade_tests.rs:110. The actual pending list includes `(money, 1)`, `(money, 2)`, `(money, 3)` from #688; the fixed expected list omits all three. No runtime migration failure was reported; the other upgrade tests pass. The existing expectation was kept under the job rule. The orchestrator must decide and review its update. This branch is not READY FOR MERGE while that gate fails. The prior SLOW Calendar failure did not recur.
kayg commented 2026-10-09 01:18:35 +00:00
Author
Owner
Copy link

#688 money688f report

Branch: job/money-688. Base: 7f062abc80e295f742e066b595af9bf19f9de7f9.
Head: 1466803522fdabfd229d337c6e0e7940e34f83d0.

Not ready for merge: the server migration expectation gate fails. It needs orchestrator review; its existing assertion was kept.

Steps

  1. Repeated 94-Tag HTTP 500: fixed. The real server returned SQLite code 5, database locked. A deferred read transaction could not become a writer after a background writer committed. Register publication now reserves the writer with BEGIN IMMEDIATE before reading its generation. Cold-build CPU work runs before the reservation. A controlled competing-writer test checks the wait and successful publication. This matches SQLite snapshot isolation rules.
  2. #1365: fixed for the 100-Tag case. The API accepts at most 100 distinct Tags and returns 422 with A transaction can have at most 100 Tags. for 101. Register pages retain the 256 KiB limit and envelope reserve. The first row can exceed the nested-item target if it fits the byte limit. Later rows still obey both targets. Tests cover repeated 94-Tag writes, 100 and 101 Tags, continuation, and large Notes spread across byte-bounded pages without field loss.
  3. Scoped incremental writes: implemented. Changes compare affected source months and Assignment sums, connect actual split Categories and Card reserve dependencies, replay only the affected old/new components, and apply deltas to cached Month snapshots. Unchanged month rows are reused. Assignment-only edits reuse them too. Structural metadata and source-range changes use full replay. A scoped arithmetic range error can also require full replay to preserve cancellation. The independent random-history property compares the whole snapshot with full replay, including Cards, Assignments, transfers, splits, edits, deletes, reordering and month moves. No conservation logic was changed in budget.rs.
  4. Final SIGKILL durability rerun: passed at every durability point.
  5. 50k/200k performance qualification: not run. The profile now includes repeated Tag-heavy writes and reads. No VM timing or RSS result is claimed.

Files changed in this continuation

  • crates/calternal-money/src/ledger.rs: public helper to reuse checked month rows for source edits.
  • crates/plugins/money/src/projection.rs, lib.rs, store.rs, routes.rs: scoped projections, immutable snapshot caching, source reuse, mutation validation and cached event comparisons.
  • crates/plugins/money/src/register.rs, register_contract_tests.rs: writer reservation, byte-bounded paging and focused regressions.
  • tests/adversarial/money_register_688.mjs, bench/money-register-688.mjs: focused Tag/write/read probes and profile extension.
  • contracts/perf/exceptions.json: three exact existing mutation pins. Limits and ratchets are unchanged.

Gates

cargo fmt --check: exit 0; no output.

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 37.58s

cargo test -p calternal-money -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 5.16s
test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.08s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.33s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.97s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.39s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-money -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 23.70s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 151 filtered out; finished in 39.78s
test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok
test result: ok. 149 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 240.54s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 9.18s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-server -- --test-threads=4

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 32s
test result: FAILED. 272 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 144.33s

cargo test -p calternal-plugin-money register_recovery_survives_sigkill_at_every_durability_point -- --test-threads=1

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.59s
test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 151 filtered out; finished in 25.45s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

cd apps/web && bun run check

perf-lint: PASS; 0 violations; 22439 scoped exceptions
svelte-check found 0 errors and 4 warnings in 2 files

cd apps/web && bun run test --maxWorkers=2

 Test Files  303 passed (303)
      Tests  2175 passed (2175)
   Duration  424.05s (transform 28%, environment 27%, import 21%, tests 17%, setup 6%)

The sole server failure is wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts at upgrade_tests.rs:110. Its actual pending list includes (money, 1), (money, 2), (money, 3). The expected list omits all three. Other upgrade tests passed. The old Calendar SLOW finding did not recur. No existing Rust test expectation was changed. The focused probe assertion permits the first-row nested-item exception because the latest #688 prompt explicitly changes that behavior.

Focused production-server round

The server was built from the final head. The fresh local Home used syntheticCsv(201, 5) as a test fixture. Five initial 94-Tag writes and ten probe writes (five each at 94 and 100 Tags) returned 201. All following reads returned 200. The ten probe reads returned every Tag. The 101-Tag write returned 422 with the exact message; the first page held one row and continuation returned 200. Nine malformed or replayed requests returned 400. All 16 concurrent reads returned 200. No new non-SLOW finding was observed. The SIGKILL test above ran again after this round.

94-Tag probe payload_bytes: 1660
100-Tag probe payload_bytes: 1726
register page_bytes: 2093
first_page_rows: 1
max_plus_one_status: 422
clear_limit_message: true
register_status: 200
continuation_status: 200
rejected: 9
burst_reads: 16

UX gaps closed

A valid 100-Tag Transaction no longer blocks the register. Continuation can reach older Transactions. Repeated Tag-heavy writes no longer fail during projection writer promotion. Over-limit API Tags get a clear 422 before a source write.

Known gaps

The server migration expectation failure prevents a green full gate. The orchestrator must review its expected Money receipts. An imported single row whose serialized payload exceeds the page byte budget still returns 413. A bounded full-field access path is not added here. No UI source changed in this continuation; no new screenshot set is claimed. The prior money688e screenshots cover its UI changes. 50k/200k performance qualification remains open.

Decisions

The write bound is 100 distinct Tags; the existing 500-character payee bound still applies. Pages use byte limits as the hard bound and permit one first row above the nested-item target. Scoped replay uses the existing Money oracle for connected dependencies instead of copying conservation rules. Expected cost is one linear comparison/dependency pass over the Budget history, two affected-component replays and Month snapshot deltas. No per-request full-Home scan was added. These costs have not been qualified on the perf VM.

Integration with bulkwrite-1393

The accepted branch 74c58b72f changes conservation rules in budget.rs. This continuation does not edit that file. The branch was inspected. Conflict points are routes.rs::create_transaction (its bounded create queue versus durable register publication), store_assignment/new assignment_text (its CAS retry versus our checked scoped totals), and store.rs::UserMoney::load (its legacy-Card document repair versus our unchanged-month reuse). Integrate its ledger.rs::project_with_check Card repair with our project_month_edits helper. Budget::cached_totals must retain the new generation caching. Preserve its conservation rules and run the scoped-versus-full property after integration.

For the merge round

On the perf VM, set CALTERNAL_SERVER_RELEASE_BIN to the copied release binary. Run perf-run calternal money688-50k 60 -- env CALTERNAL_SERVER_BIN="$CALTERNAL_SERVER_RELEASE_BIN" MONEY688_ROWS=50000 bun bench/money-register-688.mjs and perf-run calternal money688-200k 60 -- env CALTERNAL_SERVER_BIN="$CALTERNAL_SERVER_RELEASE_BIN" MONEY688_ROWS=200000 bun bench/money-register-688.mjs in separate locked runs. These must qualify first-row p50/p95, write latency, burst CPU/RSS and the largest register. Compare against docs/perf/baseline.json. Run the requested full adversarial matrices and UI acceptance on the combined branch. No release build, staging deploy or Mac interop was run in this continuation.

Commits and cleanup

Five atomic commits were made: 355493ad0, 27a3c372a, c85afe0d7, c5e2acae1, 146680352. git fetch origin && git merge origin/dev ran once before final gates and returned Already up to date. The fetched dev was cc1af3c12b68ad26c8403adde1be39c096b9ddea. No migration was added or renumbered in this continuation. No push, deploy, merge into dev, or issue closure was done.

cargo clean output:

Removed 18752 files, 13.9GiB total

Web build output was deleted. The worktree is clean. Test logs and the focused probe results remain under artifacts/money688f/; they are not committed.

# #688 money688f report Branch: `job/money-688`. Base: `7f062abc80e295f742e066b595af9bf19f9de7f9`. Head: `1466803522fdabfd229d337c6e0e7940e34f83d0`. **Not ready for merge:** the server migration expectation gate fails. It needs orchestrator review; its existing assertion was kept. ## Steps 1. Repeated 94-Tag HTTP 500: fixed. The real server returned SQLite code 5, database locked. A deferred read transaction could not become a writer after a background writer committed. Register publication now reserves the writer with `BEGIN IMMEDIATE` before reading its generation. Cold-build CPU work runs before the reservation. A controlled competing-writer test checks the wait and successful publication. This matches [SQLite snapshot isolation rules](https://sqlite.org/isolation.html). 2. #1365: fixed for the 100-Tag case. The API accepts at most 100 distinct Tags and returns 422 with `A transaction can have at most 100 Tags.` for 101. Register pages retain the 256 KiB limit and envelope reserve. The first row can exceed the nested-item target if it fits the byte limit. Later rows still obey both targets. Tests cover repeated 94-Tag writes, 100 and 101 Tags, continuation, and large Notes spread across byte-bounded pages without field loss. 3. Scoped incremental writes: implemented. Changes compare affected source months and Assignment sums, connect actual split Categories and Card reserve dependencies, replay only the affected old/new components, and apply deltas to cached Month snapshots. Unchanged month rows are reused. Assignment-only edits reuse them too. Structural metadata and source-range changes use full replay. A scoped arithmetic range error can also require full replay to preserve cancellation. The independent random-history property compares the whole snapshot with full replay, including Cards, Assignments, transfers, splits, edits, deletes, reordering and month moves. No conservation logic was changed in `budget.rs`. 4. Final SIGKILL durability rerun: passed at every durability point. 5. 50k/200k performance qualification: not run. The profile now includes repeated Tag-heavy writes and reads. No VM timing or RSS result is claimed. ## Files changed in this continuation - `crates/calternal-money/src/ledger.rs`: public helper to reuse checked month rows for source edits. - `crates/plugins/money/src/projection.rs`, `lib.rs`, `store.rs`, `routes.rs`: scoped projections, immutable snapshot caching, source reuse, mutation validation and cached event comparisons. - `crates/plugins/money/src/register.rs`, `register_contract_tests.rs`: writer reservation, byte-bounded paging and focused regressions. - `tests/adversarial/money_register_688.mjs`, `bench/money-register-688.mjs`: focused Tag/write/read probes and profile extension. - `contracts/perf/exceptions.json`: three exact existing mutation pins. Limits and ratchets are unchanged. ## Gates `cargo fmt --check`: exit 0; no output. `cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 37.58s ``` `cargo test -p calternal-money -- --test-threads=4` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 5.16s test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.08s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.33s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.97s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.39s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-money -- --test-threads=4` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 23.70s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 151 filtered out; finished in 39.78s test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok test result: ok. 149 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 240.54s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 9.18s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-server -- --test-threads=4` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 32s test result: FAILED. 272 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 144.33s ``` `cargo test -p calternal-plugin-money register_recovery_survives_sigkill_at_every_durability_point -- --test-threads=1` ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 0.59s test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 151 filtered out; finished in 25.45s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` `cd apps/web && bun run check` ```text perf-lint: PASS; 0 violations; 22439 scoped exceptions svelte-check found 0 errors and 4 warnings in 2 files ``` `cd apps/web && bun run test --maxWorkers=2` ```text Test Files 303 passed (303) Tests 2175 passed (2175) Duration 424.05s (transform 28%, environment 27%, import 21%, tests 17%, setup 6%) ``` The sole server failure is `wire::upgrade_tests::production_round_9_schema_upgrades_once_with_original_receipts` at `upgrade_tests.rs:110`. Its actual pending list includes `(money, 1)`, `(money, 2)`, `(money, 3)`. The expected list omits all three. Other upgrade tests passed. The old Calendar SLOW finding did not recur. No existing Rust test expectation was changed. The focused probe assertion permits the first-row nested-item exception because the latest #688 prompt explicitly changes that behavior. ## Focused production-server round The server was built from the final head. The fresh local Home used `syntheticCsv(201, 5)` as a test fixture. Five initial 94-Tag writes and ten probe writes (five each at 94 and 100 Tags) returned 201. All following reads returned 200. The ten probe reads returned every Tag. The 101-Tag write returned 422 with the exact message; the first page held one row and continuation returned 200. Nine malformed or replayed requests returned 400. All 16 concurrent reads returned 200. No new non-SLOW finding was observed. The SIGKILL test above ran again after this round. ```text 94-Tag probe payload_bytes: 1660 100-Tag probe payload_bytes: 1726 register page_bytes: 2093 first_page_rows: 1 max_plus_one_status: 422 clear_limit_message: true register_status: 200 continuation_status: 200 rejected: 9 burst_reads: 16 ``` ## UX gaps closed A valid 100-Tag Transaction no longer blocks the register. Continuation can reach older Transactions. Repeated Tag-heavy writes no longer fail during projection writer promotion. Over-limit API Tags get a clear 422 before a source write. ## Known gaps The server migration expectation failure prevents a green full gate. The orchestrator must review its expected Money receipts. An imported single row whose serialized payload exceeds the page byte budget still returns 413. A bounded full-field access path is not added here. No UI source changed in this continuation; no new screenshot set is claimed. The prior money688e screenshots cover its UI changes. 50k/200k performance qualification remains open. ## Decisions The write bound is 100 distinct Tags; the existing 500-character payee bound still applies. Pages use byte limits as the hard bound and permit one first row above the nested-item target. Scoped replay uses the existing Money oracle for connected dependencies instead of copying conservation rules. Expected cost is one linear comparison/dependency pass over the Budget history, two affected-component replays and Month snapshot deltas. No per-request full-Home scan was added. These costs have not been qualified on the perf VM. ## Integration with bulkwrite-1393 The accepted branch `74c58b72f` changes conservation rules in `budget.rs`. This continuation does not edit that file. The branch was inspected. Conflict points are `routes.rs::create_transaction` (its bounded create queue versus durable register publication), `store_assignment`/new `assignment_text` (its CAS retry versus our checked scoped totals), and `store.rs::UserMoney::load` (its legacy-Card document repair versus our unchanged-month reuse). Integrate its `ledger.rs::project_with_check` Card repair with our `project_month_edits` helper. `Budget::cached_totals` must retain the new generation caching. Preserve its conservation rules and run the scoped-versus-full property after integration. ## For the merge round On the perf VM, set `CALTERNAL_SERVER_RELEASE_BIN` to the copied release binary. Run `perf-run calternal money688-50k 60 -- env CALTERNAL_SERVER_BIN="$CALTERNAL_SERVER_RELEASE_BIN" MONEY688_ROWS=50000 bun bench/money-register-688.mjs` and `perf-run calternal money688-200k 60 -- env CALTERNAL_SERVER_BIN="$CALTERNAL_SERVER_RELEASE_BIN" MONEY688_ROWS=200000 bun bench/money-register-688.mjs` in separate locked runs. These must qualify first-row p50/p95, write latency, burst CPU/RSS and the largest register. Compare against `docs/perf/baseline.json`. Run the requested full adversarial matrices and UI acceptance on the combined branch. No release build, staging deploy or Mac interop was run in this continuation. ## Commits and cleanup Five atomic commits were made: `355493ad0`, `27a3c372a`, `c85afe0d7`, `c5e2acae1`, `146680352`. `git fetch origin && git merge origin/dev` ran once before final gates and returned `Already up to date.` The fetched dev was `cc1af3c12b68ad26c8403adde1be39c096b9ddea`. No migration was added or renumbered in this continuation. No push, deploy, merge into dev, or issue closure was done. `cargo clean` output: ```text Removed 18752 files, 13.9GiB total ``` Web build output was deleted. The worktree is clean. Test logs and the focused probe results remain under `artifacts/money688f/`; they are not committed.
kayg commented 2026-10-09 01:19:58 +00:00
Author
Owner
Copy link

Starting #688 continuation on job/money-688. Head: 1466803522. Base origin/dev: cc1af3c12b. Continuing the two documented defects and 50k/200k qualification; no API contract changes beyond oversized first-row paging.

Starting #688 continuation on job/money-688. Head: 1466803522fdabfd229d337c6e0e7940e34f83d0. Base origin/dev: cc1af3c12b68ad26c8403adde1be39c096b9ddea. Continuing the two documented defects and 50k/200k qualification; no API contract changes beyond oversized first-row paging.
kayg commented 2026-10-09 01:46:21 +00:00
Author
Owner
Copy link

Two fixes are committed.

  • Upgrade inventory: production_round_9_schema_upgrades_once_with_original_receipts reported pending Money receipts (money, 1), (money, 2) and (money, 3). Added all three to the strict pending list, asserted the final Money frontier, and updated the exact receipt count after checking the prior migration-test commits. Commit 5770733af.
  • Oversized imported row: a YNAB import with one Memo larger than PAGE_BYTES previewed and confirmed, but the first register GET returned 413. The page now returns that whole first row and applies its existing row and byte targets before each later row. A regression test proved the row exceeds the target and retains imported bytes. Commit be3a11eda.

Verification so far:

  • cargo test -p calternal-server -- --test-threads=4: test result: ok. 273 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 133.90s
  • cargo clippy -p calternal-plugin-money --all-targets -- -D warnings: passed.
  • cargo test -p calternal-plugin-money -- --test-threads=4: unit tests 149 passed; 0 failed; 3 ignored; import review 29 passed; 0 failed; 3 ignored.
Two fixes are committed. - Upgrade inventory: `production_round_9_schema_upgrades_once_with_original_receipts` reported pending Money receipts `(money, 1)`, `(money, 2)` and `(money, 3)`. Added all three to the strict pending list, asserted the final Money frontier, and updated the exact receipt count after checking the prior migration-test commits. Commit `5770733af`. - Oversized imported row: a YNAB import with one Memo larger than `PAGE_BYTES` previewed and confirmed, but the first register GET returned 413. The page now returns that whole first row and applies its existing row and byte targets before each later row. A regression test proved the row exceeds the target and retains imported bytes. Commit `be3a11eda`. Verification so far: - `cargo test -p calternal-server -- --test-threads=4`: `test result: ok. 273 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 133.90s` - `cargo clippy -p calternal-plugin-money --all-targets -- -D warnings`: passed. - `cargo test -p calternal-plugin-money -- --test-threads=4`: unit tests `149 passed; 0 failed; 3 ignored`; import review `29 passed; 0 failed; 3 ignored`.
kayg commented 2026-10-09 02:21:41 +00:00
Author
Owner
Copy link

50k paired qualification completed under perf-run at load5 1.29. It ran three alternating current/origin-dev pairs against the same imported fixture (current 304ce457acdf9b88225c936ad516aefd2eb78858; origin/dev cc1af3c12b68ad26c8403adde1be39c096b9ddea). The profile records first-row, scroll-frame, single cleared-mark write and four-read burst RSS p95/peak values without transaction contents.

Current/origin-dev single-write p95 by pair was 26,553.9/3,962.5 ms, 33,081.8/2,940.7 ms, and 4,929.8/4,125.4 ms. First-row p95 was 1,740.67/8,952.14 ms, 1,733.13/7,572.16 ms, and 1,641.28/10,457.02 ms. This is evidence of a current-side write-latency regression candidate; I am checking the 200k qualification before deciding whether to file it separately.

50k paired qualification completed under `perf-run` at load5 1.29. It ran three alternating current/origin-dev pairs against the same imported fixture (current `304ce457acdf9b88225c936ad516aefd2eb78858`; origin/dev `cc1af3c12b68ad26c8403adde1be39c096b9ddea`). The profile records first-row, scroll-frame, single cleared-mark write and four-read burst RSS p95/peak values without transaction contents. Current/origin-dev single-write p95 by pair was 26,553.9/3,962.5 ms, 33,081.8/2,940.7 ms, and 4,929.8/4,125.4 ms. First-row p95 was 1,740.67/8,952.14 ms, 1,733.13/7,572.16 ms, and 1,641.28/10,457.02 ms. This is evidence of a current-side write-latency regression candidate; I am checking the 200k qualification before deciding whether to file it separately.
kayg commented 2026-10-09 02:27:28 +00:00
Author
Owner
Copy link

The first 200k qualification attempt did not produce a valid pair: on the current-side first sample, the final marker restore received HTTP 503 and the profile stopped. The harness did not retain the response error code or Retry-After header, so the source of the response is not yet confirmed. I added content-free status-code diagnostics to the bench and will rerun the 200k qualification; no timing from the failed attempt is being counted.

The first 200k qualification attempt did not produce a valid pair: on the current-side first sample, the final marker restore received HTTP 503 and the profile stopped. The harness did not retain the response error code or Retry-After header, so the source of the response is not yet confirmed. I added content-free status-code diagnostics to the bench and will rerun the 200k qualification; no timing from the failed attempt is being counted.
kayg commented 2026-10-09 02:51:13 +00:00
Author
Owner
Copy link

The 200k current-side write probe exposed a non-SLOW HTTP failure. Five logical idempotent cleared-mark writes ended with statuses 500, 200, 200, 200, 500; the benchmark observed seven Retry-After: 1 503 responses across those writes before the final statuses. Two writes still ended with error_code=internal. The probe restored the original mark before returning. This is not a valid successful-write p95 and the run stopped before origin/dev sampling. I am filing a follow-up issue with these data-free reproduction details.

The 200k current-side write probe exposed a non-SLOW HTTP failure. Five logical idempotent cleared-mark writes ended with statuses `500, 200, 200, 200, 500`; the benchmark observed seven `Retry-After: 1` 503 responses across those writes before the final statuses. Two writes still ended with `error_code=internal`. The probe restored the original mark before returning. This is not a valid successful-write p95 and the run stopped before origin/dev sampling. I am filing a follow-up issue with these data-free reproduction details.
kayg commented 2026-10-09 03:16:07 +00:00
Author
Owner
Copy link

#688 final report

Branch: job/money-688
Head: 1f5d40b42767587b14f7ac1498ef555aaac951de
Base: origin/dev at cc1af3c12b68ad26c8403adde1be39c096b9ddea.

What changed

  • Added Money migrations 1–3 to the production upgrade fixture's pending inventory, final frontier and receipt count. The existing inventory assertion stays intact.
  • Changed byte-bounded register paging to return one first row when that row alone exceeds the page target. Added a regression test for an imported oversized row; the read returns HTTP 200.
  • Completed the scoped register projection work from steps 1–4: writer reservation for publication, checked incremental replay of affected components, bounded paging, recovery coverage and focused large-Tag probes. The SIGKILL durability test passed at every durability point.
  • Extended bench/money-register-688.mjs to alternate three current/origin-dev pairs and report first-row p95, scroll-frame p95, cleared-mark write p95 and four-read burst RSS. Added bounded startup waits and content-free write error/retry reporting.
  • Recorded the completed 50k comparison and incomplete 200k run in docs/perf/baseline.json.

Performance qualification

The 50k profile completed three interleaved pairs on the perf VM. The table gives the p95 from each pair in order, followed by the median of those three p95 values. Load average at start was 0.19, 1.29, 0.93. The current release binary was built locally from server source at 304ce457acdf9b88225c936ad516aefd2eb78858 (SHA-256 6c271a456c102e6faee599698b669e5ec7d4e112c61f151e22a76557a331dad0); origin/dev was cc1af3c12b68ad26c8403adde1be39c096b9ddea (SHA-256 6c25a4023cebe0e6baf1230270af5d864c9931b8bda9eec9d4bca77178357fb2).

Measure Current branch: pair 1 / 2 / 3 (median) origin/dev: pair 1 / 2 / 3 (median)
First-row p95 (ms) 1,740.67 / 1,733.13 / 1,641.28 (1,733.13) 8,952.14 / 7,572.16 / 10,457.02 (8,952.14)
Scroll-frame p95 (ms) 133.3 / 100 / 100 (100) 99.9 / 116.6 / 133.4 (116.6)
Single-write p95 (ms) 26,553.9 / 33,081.8 / 4,929.8 (26,553.9) 3,962.5 / 2,940.7 / 4,125.4 (3,962.5)
Four-read burst peak RSS (bytes) 835,612,672 / 682,131,456 / 723,107,840 (723,107,840) 2,117,128,192 / 2,468,065,280 / 2,485,051,392 (2,468,065,280)

All 50k single-write samples returned HTTP 200. The current median write p95 is 6.7× the matched origin/dev median; follow-up #1496 records this regression. First-row latency and burst RSS were lower on the current branch in this run.

The 200k fixture imported in 66,460.725 ms; load average at start was 1.70, 2.04, 2.25. The current-side restore failed with HTTP 500 (error_code=internal, retries=2). The profile stopped before saving a completed pair or starting origin/dev. No 200k p95 or burst-RSS comparison is claimed. Follow-up #1495 records the write failures. The temporary fixture was removed after the perf lock was released.

UX gaps closed

  • Valid 100-Tag transactions remain readable; continuation reaches older transactions; over-limit API writes return 422 before source write.
  • Repeated Tag-heavy writes no longer fail during projection writer promotion.
  • An imported register row above the page target is now returned alone instead of failing the register read with 413.

No UI source changed in this continuation. Existing money688e screenshots remain the visual evidence for the earlier UI work; no new screenshot set is claimed.

UX gaps left

  • Cleared-mark writes can return internal 500s under the 200k synthetic Home load (#1495).
  • The 50k cleared-mark write p95 regression needs investigation (#1496).
  • The requested 200k interleaved qualification is incomplete and must be rerun after #1495 is addressed.

Expected cost and decisions

Warm register paging reads at most 101 keys and 100 nested items within the page byte target. A source edit performs one linear comparison/dependency pass over the Budget history, replays the affected old/new components and applies Month snapshot deltas. These 50k measurements qualify the current register profile only; they do not qualify the 200k write path.

The first oversized row is allowed to exceed the page target by itself, as requested, while later rows remain bounded. For the reported performance comparison, I use the median of three paired p95 values and retain each pair's value and order in the baseline. No other design choice beyond DESIGN is introduced.

Files

  • Rust core/server/plugin: crates/calternal-money/src/ledger.rs; crates/calternal-server/src/{wire.rs,upgrade_tests.rs}; crates/plugins/money/Cargo.toml, migrations/0001_register_projection.sql, migrations/0002_register_row_generation.sql, migrations/0003_register_intents.sql, and src/{durable_import.rs,durable_import_tests.rs,import.rs,lib.rs,projection.rs,register.rs,register_contract_tests.rs,register_recovery_tests.rs,review_1140.rs,routes.rs,store.rs,tests.rs,views.rs}.
  • Web/UI: apps/web/src/lib/components/money/TransactionForm.svelte; apps/web/src/lib/money/{api.ts,register-display.ts,register-display.test.ts,virtual-rows.test.ts}; Money account and transaction routes; packages/ui/src/{components/files/FileCollection.svelte,index.ts,virtualRows.ts}; packages/api-client/src/generated.ts.
  • Contracts, tests and performance: Cargo.lock; contracts/{action-policy.json,openapi.json,perf/{adoption-1058.json,exceptions.json,ratchet.json,registry.json}}; bench/{money-import-462.mjs,money-register-688.mjs}; tests/adversarial/money_register_688.mjs; docs/{perf/baseline.json,upgrade.md}.

Gates

cargo fmt --check: exit 0; stdout was empty.

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 47s

cargo test -p calternal-money -- --test-threads=4:

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.60s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.23s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.35s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-money -- --test-threads=4:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 151 filtered out; finished in 32.76s
test result: ok. 149 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 174.94s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.38s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-server -- --test-threads=4:

test result: ok. 273 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 109.53s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 27.63s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s

cd apps/web && bun run check:

svelte-check found 0 errors and 4 warnings in 2 files

cd apps/web && bun run test --maxWorkers=2:

 Test Files  303 passed (303)
      Tests  2175 passed (2175)
   Duration  223.06s (environment 29%, transform 25%, import 23%, tests 18%, setup 5%)

The Rust and web gates ran after their source changes. Later changes touched only the benchmark script and performance baseline. cargo clean output was Removed 27587 files, 15.8GiB total; apps/web/build was removed. The final worktree is clean.

# #688 final report Branch: `job/money-688` Head: `1f5d40b42767587b14f7ac1498ef555aaac951de` Base: `origin/dev` at `cc1af3c12b68ad26c8403adde1be39c096b9ddea`. ## What changed - Added Money migrations 1–3 to the production upgrade fixture's pending inventory, final frontier and receipt count. The existing inventory assertion stays intact. - Changed byte-bounded register paging to return one first row when that row alone exceeds the page target. Added a regression test for an imported oversized row; the read returns HTTP 200. - Completed the scoped register projection work from steps 1–4: writer reservation for publication, checked incremental replay of affected components, bounded paging, recovery coverage and focused large-Tag probes. The SIGKILL durability test passed at every durability point. - Extended `bench/money-register-688.mjs` to alternate three current/origin-dev pairs and report first-row p95, scroll-frame p95, cleared-mark write p95 and four-read burst RSS. Added bounded startup waits and content-free write error/retry reporting. - Recorded the completed 50k comparison and incomplete 200k run in `docs/perf/baseline.json`. ## Performance qualification The 50k profile completed three interleaved pairs on the perf VM. The table gives the p95 from each pair in order, followed by the median of those three p95 values. Load average at start was `0.19, 1.29, 0.93`. The current release binary was built locally from server source at `304ce457acdf9b88225c936ad516aefd2eb78858` (SHA-256 `6c271a456c102e6faee599698b669e5ec7d4e112c61f151e22a76557a331dad0`); origin/dev was `cc1af3c12b68ad26c8403adde1be39c096b9ddea` (SHA-256 `6c25a4023cebe0e6baf1230270af5d864c9931b8bda9eec9d4bca77178357fb2`). | Measure | Current branch: pair 1 / 2 / 3 (median) | origin/dev: pair 1 / 2 / 3 (median) | | --- | --- | --- | | First-row p95 (ms) | 1,740.67 / 1,733.13 / 1,641.28 (1,733.13) | 8,952.14 / 7,572.16 / 10,457.02 (8,952.14) | | Scroll-frame p95 (ms) | 133.3 / 100 / 100 (100) | 99.9 / 116.6 / 133.4 (116.6) | | Single-write p95 (ms) | 26,553.9 / 33,081.8 / 4,929.8 (26,553.9) | 3,962.5 / 2,940.7 / 4,125.4 (3,962.5) | | Four-read burst peak RSS (bytes) | 835,612,672 / 682,131,456 / 723,107,840 (723,107,840) | 2,117,128,192 / 2,468,065,280 / 2,485,051,392 (2,468,065,280) | All 50k single-write samples returned HTTP 200. The current median write p95 is 6.7× the matched origin/dev median; follow-up #1496 records this regression. First-row latency and burst RSS were lower on the current branch in this run. The 200k fixture imported in `66,460.725 ms`; load average at start was `1.70, 2.04, 2.25`. The current-side restore failed with `HTTP 500 (error_code=internal, retries=2)`. The profile stopped before saving a completed pair or starting origin/dev. **No 200k p95 or burst-RSS comparison is claimed.** Follow-up #1495 records the write failures. The temporary fixture was removed after the perf lock was released. ## UX gaps closed - Valid 100-Tag transactions remain readable; continuation reaches older transactions; over-limit API writes return 422 before source write. - Repeated Tag-heavy writes no longer fail during projection writer promotion. - An imported register row above the page target is now returned alone instead of failing the register read with 413. No UI source changed in this continuation. Existing `money688e` screenshots remain the visual evidence for the earlier UI work; no new screenshot set is claimed. ## UX gaps left - Cleared-mark writes can return internal 500s under the 200k synthetic Home load (#1495). - The 50k cleared-mark write p95 regression needs investigation (#1496). - The requested 200k interleaved qualification is incomplete and must be rerun after #1495 is addressed. ## Expected cost and decisions Warm register paging reads at most 101 keys and 100 nested items within the page byte target. A source edit performs one linear comparison/dependency pass over the Budget history, replays the affected old/new components and applies Month snapshot deltas. These 50k measurements qualify the current register profile only; they do not qualify the 200k write path. The first oversized row is allowed to exceed the page target by itself, as requested, while later rows remain bounded. For the reported performance comparison, I use the median of three paired p95 values and retain each pair's value and order in the baseline. No other design choice beyond DESIGN is introduced. ## Files - Rust core/server/plugin: `crates/calternal-money/src/ledger.rs`; `crates/calternal-server/src/{wire.rs,upgrade_tests.rs}`; `crates/plugins/money/Cargo.toml`, `migrations/0001_register_projection.sql`, `migrations/0002_register_row_generation.sql`, `migrations/0003_register_intents.sql`, and `src/{durable_import.rs,durable_import_tests.rs,import.rs,lib.rs,projection.rs,register.rs,register_contract_tests.rs,register_recovery_tests.rs,review_1140.rs,routes.rs,store.rs,tests.rs,views.rs}`. - Web/UI: `apps/web/src/lib/components/money/TransactionForm.svelte`; `apps/web/src/lib/money/{api.ts,register-display.ts,register-display.test.ts,virtual-rows.test.ts}`; Money account and transaction routes; `packages/ui/src/{components/files/FileCollection.svelte,index.ts,virtualRows.ts}`; `packages/api-client/src/generated.ts`. - Contracts, tests and performance: `Cargo.lock`; `contracts/{action-policy.json,openapi.json,perf/{adoption-1058.json,exceptions.json,ratchet.json,registry.json}}`; `bench/{money-import-462.mjs,money-register-688.mjs}`; `tests/adversarial/money_register_688.mjs`; `docs/{perf/baseline.json,upgrade.md}`. ## Gates `cargo fmt --check`: exit 0; stdout was empty. `cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 47s ``` `cargo test -p calternal-money -- --test-threads=4`: ```text test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.60s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.23s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.35s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-money -- --test-threads=4`: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 151 filtered out; finished in 32.76s test result: ok. 149 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 174.94s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.38s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-server -- --test-threads=4`: ```text test result: ok. 273 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 109.53s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 27.63s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s ``` `cd apps/web && bun run check`: ```text svelte-check found 0 errors and 4 warnings in 2 files ``` `cd apps/web && bun run test --maxWorkers=2`: ```text Test Files 303 passed (303) Tests 2175 passed (2175) Duration 223.06s (environment 29%, transform 25%, import 23%, tests 18%, setup 5%) ``` The Rust and web gates ran after their source changes. Later changes touched only the benchmark script and performance baseline. `cargo clean` output was `Removed 27587 files, 15.8GiB total`; `apps/web/build` was removed. The final worktree is clean.
kayg commented 2026-10-09 03:18:38 +00:00
Author
Owner
Copy link

Continuing #688 as money688h on job/money-688. Base/head: 1f5d40b427. Read prior report and #1495/#1496. Trace cleared-mark phases, remove unrelated projection work, test row-touch bounds and durability, then run requested paired qualification and gates. No UI design changes planned.

Continuing #688 as money688h on job/money-688. Base/head: 1f5d40b42767587b14f7ac1498ef555aaac951de. Read prior report and #1495/#1496. Trace cleared-mark phases, remove unrelated projection work, test row-touch bounds and durability, then run requested paired qualification and gates. No UI design changes planned.
kayg commented 2026-10-09 03:29:27 +00:00
Author
Owner
Copy link

Finding: the bounded filter-index writer uses ($4 IS NULL OR transaction_id IN (...)). EXPLAIN QUERY PLAN selects money_register_identity only through (user_id, budget_id, source_signature), so it walks the entire generation. With transaction_id IN (...) alone it uses the transaction_id index column too. The mark route also loads all Budget history and the updater prepares Month totals before this SQL. I will separate the full-generation and selected-ID SQL predicates and use the Index plus one Month for cleared marks.

Finding: the bounded filter-index writer uses `($4 IS NULL OR transaction_id IN (...))`. EXPLAIN QUERY PLAN selects money_register_identity only through `(user_id, budget_id, source_signature)`, so it walks the entire generation. With `transaction_id IN (...)` alone it uses the transaction_id index column too. The mark route also loads all Budget history and the updater prepares Month totals before this SQL. I will separate the full-generation and selected-ID SQL predicates and use the Index plus one Month for cleared marks.
kayg commented 2026-10-09 03:42:13 +00:00
Author
Owner
Copy link

Traced old cleared-write path on perf VM with content-free phase logs. At 50k, p95 was 17,850.3 ms including retries; a successful 9,200.2 ms sample spent 4,311 ms between validation and source durability and 4,358 ms waiting for the projection writer, versus 86 ms validation, 14 ms totals/comparison/Account work and 163 ms SQL. These are separate tracing runs, not the earlier paired 26,554 ms sample. At 200k, an HTTP 500 is confirmed as SQLite busy (driver code 5) at BEGIN IMMEDIATE after its five-second busy timeout. A later stale-generation fallback rebuilt 200k rows: the accounts phase jumped from 83 ms to 128,415 ms. The mark-only path avoids that full replay/rewrite; transient Index errors now return 503 and retain the durable intent, with a real competing-writer regression. The suspected Tag batch is small in this synthetic fixture; no Tag code was changed. A remaining contender is the generic Notes projection of Budget Markdown; the fast-path measurement will decide whether further work is needed.

Commits: 76cf4b899 (bounded mark path), next commit adds transient-response regression. Row-write regression and SIGKILL durability-point test passed.

Traced old cleared-write path on perf VM with content-free phase logs. At 50k, p95 was 17,850.3 ms including retries; a successful 9,200.2 ms sample spent 4,311 ms between validation and source durability and 4,358 ms waiting for the projection writer, versus 86 ms validation, 14 ms totals/comparison/Account work and 163 ms SQL. These are separate tracing runs, not the earlier paired 26,554 ms sample. At 200k, an HTTP 500 is confirmed as SQLite busy (driver code 5) at BEGIN IMMEDIATE after its five-second busy timeout. A later stale-generation fallback rebuilt 200k rows: the accounts phase jumped from 83 ms to 128,415 ms. The mark-only path avoids that full replay/rewrite; transient Index errors now return 503 and retain the durable intent, with a real competing-writer regression. The suspected Tag batch is small in this synthetic fixture; no Tag code was changed. A remaining contender is the generic Notes projection of Budget Markdown; the fast-path measurement will decide whether further work is needed. Commits: 76cf4b899 (bounded mark path), next commit adds transient-response regression. Row-write regression and SIGKILL durability-point test passed.
kayg commented 2026-10-09 04:03:00 +00:00
Author
Owner
Copy link

The fast Money publisher alone reduces selected-row SQL work to 1–2 ms, but a 50k trace still records multi-second SQLite writer checkout waits. The ordinary Notes projection writer indexes the Markdown references in Money files and repeats resolution queries and inserts for every Account/Category link. I batched existing backlinks, anchors, blocks and reference inserts and bounded a transaction-local repeated-target resolution cache. This preserves the same stored reference rows and their resolution rules; it changes no Notes API or exclusion rule. A 1536-reference regression checks ordinals, aliases, lines, owner isolation and fresh resolution after an anchor is removed. The focused test passes. This small implementation addition in Notes is required to address the measured cross-plugin writer contention in #1495/#1496.

The request-local Month publisher also now returns the committed Index row, preserving the running balance from earlier Months. A regression includes an earlier Month and compares each mark response to its persisted prefix.

The fast Money publisher alone reduces selected-row SQL work to 1–2 ms, but a 50k trace still records multi-second SQLite writer checkout waits. The ordinary Notes projection writer indexes the Markdown references in Money files and repeats resolution queries and inserts for every Account/Category link. I batched existing backlinks, anchors, blocks and reference inserts and bounded a transaction-local repeated-target resolution cache. This preserves the same stored reference rows and their resolution rules; it changes no Notes API or exclusion rule. A 1536-reference regression checks ordinals, aliases, lines, owner isolation and fresh resolution after an anchor is removed. The focused test passes. This small implementation addition in Notes is required to address the measured cross-plugin writer contention in #1495/#1496. The request-local Month publisher also now returns the committed Index row, preserving the running balance from earlier Months. A regression includes an earlier Month and compares each mark response to its persisted prefix.
kayg commented 2026-10-09 04:43:35 +00:00
Author
Owner
Copy link

Head 389db55a0. All Rust gates and web gates pass. Money plugin: test result: ok. 151 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 203.42s; integration: test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.92s. Both incremental property tests and the SIGKILL durability parent pass. Server: 273 passed / 12 ignored, plus both integration tests. Notes: 318 passed / 4 ignored, plus 2 integration tests. Web: 303 test files and 2175 tests pass; svelte-check 0 errors / 4 existing warnings. Final report will quote the complete gate summaries verbatim.

The focused real-server API round passes: 9 rejected read inputs, 4 rejected mark inputs, 16 concurrent reads, 8 concurrent marks and restore, and repeated Tag-heavy / oversized-row writes and paging. The UI probe finishes its action assertions but its browser-exception assertion fails with each_key_duplicate; filed #1498 with reproduction and evidence. No web/UI source changed in this continuation, and the zero-exception expectation is unchanged.

The immediate post-import 50k trace improves mark p95 from the old traced 17,850 ms to 753 ms: five successful writes, zero retries, 2 ms selected-row SQL, 7–10 ms projection commit. Warm successful samples are 173–228 ms. Two slow samples spend about 600 ms in the source-durability phase. Existing server durability spans are now enabled to identify that remaining time. This does not yet establish the 300 ms target. Three-pair 50k qualification is queued under perf-run, behind the shared perf VM lock; 200k follows.

Head 389db55a0. All Rust gates and web gates pass. Money plugin: `test result: ok. 151 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 203.42s`; integration: `test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.92s`. Both incremental property tests and the SIGKILL durability parent pass. Server: 273 passed / 12 ignored, plus both integration tests. Notes: 318 passed / 4 ignored, plus 2 integration tests. Web: 303 test files and 2175 tests pass; svelte-check 0 errors / 4 existing warnings. Final report will quote the complete gate summaries verbatim. The focused real-server API round passes: 9 rejected read inputs, 4 rejected mark inputs, 16 concurrent reads, 8 concurrent marks and restore, and repeated Tag-heavy / oversized-row writes and paging. The UI probe finishes its action assertions but its browser-exception assertion fails with `each_key_duplicate`; filed #1498 with reproduction and evidence. No web/UI source changed in this continuation, and the zero-exception expectation is unchanged. The immediate post-import 50k trace improves mark p95 from the old traced 17,850 ms to 753 ms: five successful writes, zero retries, 2 ms selected-row SQL, 7–10 ms projection commit. Warm successful samples are 173–228 ms. Two slow samples spend about 600 ms in the source-durability phase. Existing server durability spans are now enabled to identify that remaining time. This does not yet establish the 300 ms target. Three-pair 50k qualification is queued under perf-run, behind the shared perf VM lock; 200k follows.
kayg commented 2026-10-09 05:02:08 +00:00
Author
Owner
Copy link

Correction to the earlier writer-batching hypothesis: the traced Notes projection had zero items and zero references. That experiment has been reverted. The post-restart regression instead comes from the Note date migration: its whole-Home scan rewrites Money Markdown with Note dates, changing source fingerprints despite preserving mtime. A cleared-mark request then takes the full-history fallback; concurrent migration causes source CAS conflicts. The first incomplete qualification run reproduced 23,314 ms cleared p95 and one HTTP 409. It is diagnostic evidence, not a completed A/B result.

The server now supplies the existing Plugin ownership registry to Note date backfill. The shared scan skips foreign directories before opening files and retries keep the same exclusions. A focused regression passes with a Money file larger than the 2 MiB Note migration limit; its bytes and fingerprint stay identical while Notes, Tasks and unclaimed Markdown get their dates. This is a small necessary cross-plugin repair for #1495. No Notes projection batching remains.

A stale/missing Money generation now queues repair in the existing bounded worker and returns a retryable response instead of replaying Budget history inside a cleared-mark request. The worker serializes stale repair against server writes. Focused stale-generation regression and final gates are running. Final release measurements will replace the incomplete qualification run.

Correction to the earlier writer-batching hypothesis: the traced Notes projection had zero items and zero references. That experiment has been reverted. The post-restart regression instead comes from the Note date migration: its whole-Home scan rewrites Money Markdown with Note dates, changing source fingerprints despite preserving mtime. A cleared-mark request then takes the full-history fallback; concurrent migration causes source CAS conflicts. The first incomplete qualification run reproduced 23,314 ms cleared p95 and one HTTP 409. It is diagnostic evidence, not a completed A/B result. The server now supplies the existing Plugin ownership registry to Note date backfill. The shared scan skips foreign directories before opening files and retries keep the same exclusions. A focused regression passes with a Money file larger than the 2 MiB Note migration limit; its bytes and fingerprint stay identical while Notes, Tasks and unclaimed Markdown get their dates. This is a small necessary cross-plugin repair for #1495. No Notes projection batching remains. A stale/missing Money generation now queues repair in the existing bounded worker and returns a retryable response instead of replaying Budget history inside a cleared-mark request. The worker serializes stale repair against server writes. Focused stale-generation regression and final gates are running. Final release measurements will replace the incomplete qualification run.
kayg commented 2026-10-09 05:19:12 +00:00
Author
Owner
Copy link

Head 0ceec8ff05. The ownership fix, bounded stale-generation repair, missing-anchor guard and cross-Month transfer response fix are committed. The transfer regression proves that the selected destination leg returns its own later date and whole-history balance.

Final clippy for calternal-money, calternal-plugin-money, calternal-server and calternal-plugin-notes passes: Finished \dev` profile [unoptimized + debuginfo] target(s) in 2m 09s. Final Money plugin suite: test result: ok. 153 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 312.71s; integration: test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.62s`. SIGKILL durability, process-exit recovery and both incremental/full replay properties pass. An earlier process-exit test could not spawn its executable because my overlapping rebuild replaced that executable; the final complete rerun passes with compilation finished. Existing test expectations were not changed.

Notes: test result: ok. 318 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 413.03s; 2 integration tests pass. Web check: perf-lint: PASS; 0 violations; 22439 scoped exceptions and svelte-check found 0 errors and 4 warnings in 2 files. Existing pure queue call proofs were rebound to their extracted shared policy helper; no rule or exception ceiling changed. The completed full web run has 303 passing files / 2175 passing tests. Final server tests are running.

The final release real-server API probe passes: 9 rejected read inputs, 4 rejected mark inputs, 16 concurrent reads, 8 concurrent marks and restore; repeated 94/100-Tag writes and paging pass, 101 Tags rejects with 422, and an oversized imported row keeps working with a continuation. Three-pair 50k and 200k measurements are queued under perf-run with the copied final release build. No completed qualification numbers are claimed yet.

Head 0ceec8ff05d6209f5696be093b00a8c21eb8712a. The ownership fix, bounded stale-generation repair, missing-anchor guard and cross-Month transfer response fix are committed. The transfer regression proves that the selected destination leg returns its own later date and whole-history balance. Final clippy for calternal-money, calternal-plugin-money, calternal-server and calternal-plugin-notes passes: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 2m 09s`. Final Money plugin suite: `test result: ok. 153 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 312.71s`; integration: `test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.62s`. SIGKILL durability, process-exit recovery and both incremental/full replay properties pass. An earlier process-exit test could not spawn its executable because my overlapping rebuild replaced that executable; the final complete rerun passes with compilation finished. Existing test expectations were not changed. Notes: `test result: ok. 318 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 413.03s`; 2 integration tests pass. Web check: `perf-lint: PASS; 0 violations; 22439 scoped exceptions` and `svelte-check found 0 errors and 4 warnings in 2 files`. Existing pure queue call proofs were rebound to their extracted shared policy helper; no rule or exception ceiling changed. The completed full web run has 303 passing files / 2175 passing tests. Final server tests are running. The final release real-server API probe passes: 9 rejected read inputs, 4 rejected mark inputs, 16 concurrent reads, 8 concurrent marks and restore; repeated 94/100-Tag writes and paging pass, 101 Tags rejects with 422, and an oversized imported row keeps working with a continuation. Three-pair 50k and 200k measurements are queued under perf-run with the copied final release build. No completed qualification numbers are claimed yet.
kayg commented 2026-10-09 05:26:32 +00:00
Author
Owner
Copy link

All requested gates pass. Runtime code is 0ceec8ff05; head 37daf4be3 adds comment-only corrections. Final server output:

test result: ok. 273 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 112.90s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 23.11s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s

Final focused real-server API probe also passes. The paired perf job is waiting for the shared VM lock; no substitute/local qualification is claimed. The final report will retain every completed pair, status, retry count, binary hash and load average. #1498 remains the filed browser-exception gap from the production UI probe.

All requested gates pass. Runtime code is 0ceec8ff05d6209f5696be093b00a8c21eb8712a; head 37daf4be3 adds comment-only corrections. Final server output: ``` test result: ok. 273 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 112.90s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 23.11s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s ``` Final focused real-server API probe also passes. The paired perf job is waiting for the shared VM lock; no substitute/local qualification is claimed. The final report will retain every completed pair, status, retry count, binary hash and load average. #1498 remains the filed browser-exception gap from the production UI probe.
kayg commented 2026-10-09 06:14:53 +00:00
Author
Owner
Copy link

The loaded/restarted 50k trace changes the earlier conclusion about Notes projection. Post-import had zero Note rows, but after restart and the real Account screen/scroll workload the perf VM had 14 Note items and 58,340 references from Money Markdown. Local reproduction had 16 items and 66,672 references. Money totals/compare were 0 ms and selected-row SQL 2–6 ms; the local marks instead spent 0.7–1.7 s before source durability and up to 1.3 s waiting for the projection writer. The VM traced mark p95 was 5,739 ms.

The first complete 50k qualification (before the final projection ownership repair) retains three pairs in baseline.json: current median first-row p95 2,014 ms vs origin/dev 11,719 ms; mark p95 4,873 vs 3,690 ms; amount p95 5,880 vs 3,203 ms; burst RSS 1.07 vs 2.47 GB. Every mark returned 200. This is an improvement from #1496's 26,554 ms, but it still fails the 300 ms target and the no-regression comparison. It is retained under qualification_before_projection_ownership_2026_10_09, not claimed as the final result.

Root cause: full Notes scans and Files/live adoption accept foreign Money Markdown, despite the Notes UI hiding those Plugin-owned paths. Each Month produces thousands of link rows and repeats that work on a mark. The final fix supplies the existing ownership registry before Notes subscriptions start and uses one immutable process policy in scans and live adoption. It skips Money before reading/parsing. It preserves Notes-owned Tasks and unclaimed Markdown. Reference batching is no longer needed for these foreign sources.

The isolated-process regression passes with 2000 foreign checkbox/link rows: full reconcile, direct adoption and the live Files event produce zero Note, Task or link rows; real Notes remain indexed; Money bytes and fingerprint stay unchanged. Final clippy passes. Final Notes tests: 319 passed / 5 ignored plus 2 integration tests. Web check has zero performance-lint violations and unchanged exception count. Final server checks are running. Runtime code is 3ea25dc4b. The fresh final 50k/200k paired qualification is queued under one perf-run lock with the replacement release build. An obsolete pending 200k run was stopped before measuring the replacement code; only the fresh run will qualify it.

The loaded/restarted 50k trace changes the earlier conclusion about Notes projection. Post-import had zero Note rows, but after restart and the real Account screen/scroll workload the perf VM had 14 Note items and 58,340 references from Money Markdown. Local reproduction had 16 items and 66,672 references. Money totals/compare were 0 ms and selected-row SQL 2–6 ms; the local marks instead spent 0.7–1.7 s before source durability and up to 1.3 s waiting for the projection writer. The VM traced mark p95 was 5,739 ms. The first complete 50k qualification (before the final projection ownership repair) retains three pairs in baseline.json: current median first-row p95 2,014 ms vs origin/dev 11,719 ms; mark p95 4,873 vs 3,690 ms; amount p95 5,880 vs 3,203 ms; burst RSS 1.07 vs 2.47 GB. Every mark returned 200. This is an improvement from #1496's 26,554 ms, but it still fails the 300 ms target and the no-regression comparison. It is retained under qualification_before_projection_ownership_2026_10_09, not claimed as the final result. Root cause: full Notes scans and Files/live adoption accept foreign Money Markdown, despite the Notes UI hiding those Plugin-owned paths. Each Month produces thousands of link rows and repeats that work on a mark. The final fix supplies the existing ownership registry before Notes subscriptions start and uses one immutable process policy in scans and live adoption. It skips Money before reading/parsing. It preserves Notes-owned Tasks and unclaimed Markdown. Reference batching is no longer needed for these foreign sources. The isolated-process regression passes with 2000 foreign checkbox/link rows: full reconcile, direct adoption and the live Files event produce zero Note, Task or link rows; real Notes remain indexed; Money bytes and fingerprint stay unchanged. Final clippy passes. Final Notes tests: 319 passed / 5 ignored plus 2 integration tests. Web check has zero performance-lint violations and unchanged exception count. Final server checks are running. Runtime code is 3ea25dc4b. The fresh final 50k/200k paired qualification is queued under one perf-run lock with the replacement release build. An obsolete pending 200k run was stopped before measuring the replacement code; only the fresh run will qualify it.
kayg commented 2026-10-09 06:34:01 +00:00
Author
Owner
Copy link

During #688 money688h's 200,000-row perf-VM comparison, origin/dev cc1af3c12b was OOM-killed during the cleared-mark phase. The current candidate 3ea25dc4b had completed its entire first run with zero failed marks, cleared p95 992.8 ms, amount-edit p95 15,970.8 ms, and burst RSS 5,763,231,744 bytes. This is a server crash, not a SLOW-only observation.

The VM has 7,879 MiB RAM and no swap. Both binaries used the same synthetic Home and production web build, under a single perf-run lock; the raw candidate run and partial pair are retained in docs/perf/baseline.json. The comparison aborted with browser TypeError: Failed to fetch, so no origin/dev p95 or completed 200k pair is claimed.

Kernel evidence, 2026-10-09 08:30:48 CEST:

oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=user.slice,mems_allowed=0,global_oom,task_memcg=/user.slice/user-0.slice/session-c14938.scope,task=origin-dev-serv,pid=2214522,uid=0
Out of memory: Killed process 2214522 (origin-dev-serv) total-vm:9385148kB, anon-rss:5634884kB, file-rss:28kB, shmem-rss:0kB, UID:0 pgtables:12212kB oom_score_adj:0

Reproduce with bench/money-register-688.mjs, MONEY688_ROWS=200000, MONEY688_PAIRS=3, the origin/dev and candidate release binaries, Chromium on the perf VM. Build elsewhere and hold perf-run's shared lock. No test expectation or memory budget was changed. The owner must review the crash before claiming that origin/dev handles the 200k workload.

During #688 money688h's 200,000-row perf-VM comparison, origin/dev cc1af3c12b68ad26c8403adde1be39c096b9ddea was OOM-killed during the cleared-mark phase. The current candidate 3ea25dc4b had completed its entire first run with zero failed marks, cleared p95 992.8 ms, amount-edit p95 15,970.8 ms, and burst RSS 5,763,231,744 bytes. This is a server crash, not a SLOW-only observation. The VM has 7,879 MiB RAM and no swap. Both binaries used the same synthetic Home and production web build, under a single perf-run lock; the raw candidate run and partial pair are retained in docs/perf/baseline.json. The comparison aborted with browser TypeError: Failed to fetch, so no origin/dev p95 or completed 200k pair is claimed. Kernel evidence, 2026-10-09 08:30:48 CEST: ``` oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=user.slice,mems_allowed=0,global_oom,task_memcg=/user.slice/user-0.slice/session-c14938.scope,task=origin-dev-serv,pid=2214522,uid=0 Out of memory: Killed process 2214522 (origin-dev-serv) total-vm:9385148kB, anon-rss:5634884kB, file-rss:28kB, shmem-rss:0kB, UID:0 pgtables:12212kB oom_score_adj:0 ``` Reproduce with bench/money-register-688.mjs, MONEY688_ROWS=200000, MONEY688_PAIRS=3, the origin/dev and candidate release binaries, Chromium on the perf VM. Build elsewhere and hold perf-run's shared lock. No test expectation or memory budget was changed. The owner must review the crash before claiming that origin/dev handles the 200k workload.
kayg commented 2026-10-09 07:01:03 +00:00
Author
Owner
Copy link

money688h — #688

Head: a5aaf55009efafc6a77239124375a74769fc8620. Measured runtime build: 3ea25dc4b. Later commits retain measurement records only. Origin/dev comparison: cc1af3c12b68ad26c8403adde1be39c096b9ddea. Origin/dev was fetched and merged once; it was already an ancestor. No push, deploy or branch merge was performed beyond that authorized origin/dev merge.

Built

Cleared marks read one Month and publish a transaction/Account delta. They skip Budget totals, dependency comparison, Category rewrites and prefix changes. The route reuses its checked edited document and returns the committed Index balance, including earlier Months. A cross-Month transfer response returns the selected leg's own date.

Selected-row SQL now uses the transaction index. SQLite BUSY and checkout timeouts are retryable and retain their durable intent. Recovery of an already-published generation only completes its FULL fence. Stale generations queue repair in the bounded worker; unknown transaction anchors return 404 without scheduling repair.

The server gives Note date backfill the existing Plugin ownership policy. The walker skips foreign paths before reading, including oversized Money files, and retains the exclusions on retry. Full Note/Task scans, direct adoption and Files-event queues also exclude foreign plugin paths before parsing. This prevents Money source metadata rewrites, unrelated reference projections and their stale-generation/CAS races.

Trace findings

The old traced 50k successful 9,200 ms mark spent 4,311 ms before source durability and 4,358 ms waiting for the projection writer; validation was 86 ms and SQL 163 ms. This does not reclassify the earlier paired 26,554 ms p95. At 200k the 500 was SQLite BUSY, code 5, at BEGIN IMMEDIATE. A later stale-generation fallback took 128,415 ms in the Account/rebuild phase and 6,085 ms to commit. Note date migration changed Money source fingerprints after restart, causing that fallback and CAS races. The immediate post-import trace had zero Note rows, but restart plus real Account navigation produced 14 Money Note items and 58,340 references. This accounted for source publication and shared-writer contention. The final plugin ownership policy removes that work; the isolated regression and local restarted-server trace retain zero foreign projections. The reference batching experiment was reverted.

Measurements

Median of completed per-side p95 values; the allocator-contained environment also applies to the harness and Chromium; each size explicitly states its complete-pair count; raw pairs, statuses, retries, CPU/RSS and binary hashes remain in baseline.json. Each size runs under one perf-run lock. First-row/scroll figures use Chromium on the perf VM with macOS platform emulation; these are not real-Mac timing claims.

50000 (default allocator): 3 complete interleaved pairs.

money688: first-row p95 1960.9 ms; scroll p95 100.1 ms; cleared p95 299.8 ms; amount p95 1192.7 ms; burst RSS 0.95 GiB; failed marks 0; load5 [5.21, 4.43, 4.19].

origin_dev: first-row p95 10119.4 ms; scroll p95 116.7 ms; cleared p95 3228.5 ms; amount p95 3277.2 ms; burst RSS 2.31 GiB; failed marks 0; load5 [4.71, 4.62, 4.41].

200000 (default allocator): 0 complete interleaved pairs.

money688: first-row p95 2284.7 ms; scroll p95 116.6 ms; cleared p95 992.8 ms; amount p95 15970.8 ms; burst RSS 5.37 GiB; failed marks 0; load5 [3.28].

200000 (MALLOC_ARENA_MAX=2; MALLOC_TRIM_THRESHOLD_=131072, both binaries): 3 complete interleaved pairs.

money688: first-row p95 1981.6 ms; scroll p95 116.7 ms; cleared p95 963.3 ms; amount p95 12942.8 ms; burst RSS 2.49 GiB; failed marks 0; load5 [3.33, 3.68, 3.48].

origin_dev: first-row p95 46044.8 ms; scroll p95 166.7 ms; cleared p95 14401.6 ms; amount p95 13707.0 ms; burst RSS 2.69 GiB; failed marks 0; load5 [3.69, 4.01, 4.05].

Expected warm mark cost: one Month's parse/encode, metadata and Month-file fingerprints, one or two selected transaction/Search rows, Account cleared summary, and the existing source journal plus FULL intent fence. SQL projection rows are O(1) in total history size. Amount edits retain affected Account-prefix updates and checked Budget replay. No durability fence was removed.

Gates — verbatim summaries

cargo fmt --check: exit 0, empty output.

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server -p calternal-plugin-notes --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 18s

calternal-money

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 13.88s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.37s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 4.14s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.75s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

calternal-plugin-money

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 62.73s
test result: ok. 153 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 312.71s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.62s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

calternal-plugin-notes

test result: ok. 319 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 546.88s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.09s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

calternal-server

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 284 filtered out; finished in 63.31s
test result: FAILED. 272 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 382.62s

server focused retry

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 284 filtered out; finished in 204.34s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s

server integration targets

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 28.21s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s

Web check

perf-lint: PASS; 0 violations; 22439 scoped exceptions
svelte-check found 0 errors and 4 warnings in 2 files

Web test --maxWorkers=2

 Test Files  303 passed (303)
      Tests  2175 passed (2175)
   Duration  554.70s (transform 27%, environment 26%, import 23%, tests 17%, setup 6%)

The full server run had one SLOW-only failure: the existing 20,000-file Calendar responsiveness child measured p50 14,176 ms / p95 14,749 ms against its unchanged 10,000 ms budget. Its isolated parent retry and integration-target outputs are quoted above. All other 272 unit tests passed. No latency budget or test expectation was changed.

The final Money run passes both replay property tests, SIGKILL checkpoints and process-exit recovery. An earlier process-exit run failed to spawn its executable because my overlapping rebuild replaced that executable; the full rerun passed after compilation. Existing test expectations were not changed.

UX gaps closed

Cleared responses retain whole-history balances and cross-Month transfer dates. Missing anchors do not trigger expensive repair. Stale generations return a calm retryable response. Foreign Note metadata migration cannot race Money source writes.

Known gaps

At 50k the median of the three candidate cleared-mark p95s is 299.8 ms; individual runs are 340.0, 299.8 and 277.3 ms. The first run exceeds the 300 ms target. This is not a claim that every run or the combined-sample p95 is below 300 ms. The profile's existing first-row 300 ms and frame 16.7 ms targets remain unmet on this software-rendering VM; real-Mac timing is left for the merge round.

The default-allocator 200k comparison is incomplete: origin/dev was OOM-killed during its first mark workload (#1502). The candidate completed that run, but no paired origin/dev percentile exists. A separately labelled bounded comparison with MALLOC_ARENA_MAX=2 and MALLOC_TRIM_THRESHOLD_=131072 applies the same allocator policy to both binaries; it does not erase the default-settings crash.

The production UI probe finishes its action assertions but reports Svelte each_key_duplicate browser exceptions. Filed #1498; no UI source changed and the zero-exception expectation is unchanged. No new visible controls were added. Actual Mac timing was not run for this backend continuation.

UX gaps left

The browser exceptions in #1498 remain. No new visible control was added by this backend continuation.

Decisions

Use the existing Plugin ownership registry for both Note migration and projection eligibility; keep its immutable per-process namespace policy consistent with the existing single configured Home root; Notes-owned Tasks and unclaimed Markdown still receive dates. Keep the selected transaction's Search update because existing #cleared search behavior is tested; Category membership is retained. Queue stale generation repair instead of rebuilding within a mark request. Retain NORMAL derived-projection publication plus FULL intent-completion fencing, as proved by the durability tests.

Files

bench/money-register-688.mjs; tests/adversarial/money_register_688.mjs; crates/plugins/money/src/{register.rs,register_contract_tests.rs,routes.rs,store.rs}; crates/plugins/notes/src/{lib.rs,store.rs}; crates/calternal-server/src/wire.rs; contracts/perf/{exceptions.json,registry.json}; docs/perf/baseline.json.

Cleanup

Job Cargo output was cleaned and the local production web build output removed after verification. Review artifacts remain ignored in the worktree.

Focused real-server round

Final API probe: 9 rejected reads, 4 rejected mark inputs, 16 concurrent reads, 8 concurrent marks and restore. Repeated 94/100-Tag writes and paging pass; 101 Tags rejects with 422. An oversized imported row returns alone with a working continuation. Source and projection invariants remain covered by SQL-trigger regressions with 200 and 2200 additional history rows.

# money688h — #688 Head: `a5aaf55009efafc6a77239124375a74769fc8620`. Measured runtime build: `3ea25dc4b`. Later commits retain measurement records only. Origin/dev comparison: `cc1af3c12b68ad26c8403adde1be39c096b9ddea`. Origin/dev was fetched and merged once; it was already an ancestor. No push, deploy or branch merge was performed beyond that authorized origin/dev merge. ## Built Cleared marks read one Month and publish a transaction/Account delta. They skip Budget totals, dependency comparison, Category rewrites and prefix changes. The route reuses its checked edited document and returns the committed Index balance, including earlier Months. A cross-Month transfer response returns the selected leg's own date. Selected-row SQL now uses the transaction index. SQLite BUSY and checkout timeouts are retryable and retain their durable intent. Recovery of an already-published generation only completes its FULL fence. Stale generations queue repair in the bounded worker; unknown transaction anchors return 404 without scheduling repair. The server gives Note date backfill the existing Plugin ownership policy. The walker skips foreign paths before reading, including oversized Money files, and retains the exclusions on retry. Full Note/Task scans, direct adoption and Files-event queues also exclude foreign plugin paths before parsing. This prevents Money source metadata rewrites, unrelated reference projections and their stale-generation/CAS races. ## Trace findings The old traced 50k successful 9,200 ms mark spent 4,311 ms before source durability and 4,358 ms waiting for the projection writer; validation was 86 ms and SQL 163 ms. This does not reclassify the earlier paired 26,554 ms p95. At 200k the 500 was SQLite BUSY, code 5, at BEGIN IMMEDIATE. A later stale-generation fallback took 128,415 ms in the Account/rebuild phase and 6,085 ms to commit. Note date migration changed Money source fingerprints after restart, causing that fallback and CAS races. The immediate post-import trace had zero Note rows, but restart plus real Account navigation produced 14 Money Note items and 58,340 references. This accounted for source publication and shared-writer contention. The final plugin ownership policy removes that work; the isolated regression and local restarted-server trace retain zero foreign projections. The reference batching experiment was reverted. ## Measurements Median of completed per-side p95 values; the allocator-contained environment also applies to the harness and Chromium; each size explicitly states its complete-pair count; raw pairs, statuses, retries, CPU/RSS and binary hashes remain in baseline.json. Each size runs under one perf-run lock. First-row/scroll figures use Chromium on the perf VM with macOS platform emulation; these are not real-Mac timing claims. 50000 (default allocator): 3 complete interleaved pairs. money688: first-row p95 1960.9 ms; scroll p95 100.1 ms; cleared p95 299.8 ms; amount p95 1192.7 ms; burst RSS 0.95 GiB; failed marks 0; load5 [5.21, 4.43, 4.19]. origin_dev: first-row p95 10119.4 ms; scroll p95 116.7 ms; cleared p95 3228.5 ms; amount p95 3277.2 ms; burst RSS 2.31 GiB; failed marks 0; load5 [4.71, 4.62, 4.41]. 200000 (default allocator): 0 complete interleaved pairs. money688: first-row p95 2284.7 ms; scroll p95 116.6 ms; cleared p95 992.8 ms; amount p95 15970.8 ms; burst RSS 5.37 GiB; failed marks 0; load5 [3.28]. 200000 (MALLOC_ARENA_MAX=2; MALLOC_TRIM_THRESHOLD_=131072, both binaries): 3 complete interleaved pairs. money688: first-row p95 1981.6 ms; scroll p95 116.7 ms; cleared p95 963.3 ms; amount p95 12942.8 ms; burst RSS 2.49 GiB; failed marks 0; load5 [3.33, 3.68, 3.48]. origin_dev: first-row p95 46044.8 ms; scroll p95 166.7 ms; cleared p95 14401.6 ms; amount p95 13707.0 ms; burst RSS 2.69 GiB; failed marks 0; load5 [3.69, 4.01, 4.05]. Expected warm mark cost: one Month's parse/encode, metadata and Month-file fingerprints, one or two selected transaction/Search rows, Account cleared summary, and the existing source journal plus FULL intent fence. SQL projection rows are O(1) in total history size. Amount edits retain affected Account-prefix updates and checked Budget replay. No durability fence was removed. ## Gates — verbatim summaries cargo fmt --check: exit 0, empty output. cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-server -p calternal-plugin-notes --all-targets -- -D warnings ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 18s ``` calternal-money ``` test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 13.88s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.37s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 4.14s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.75s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` calternal-plugin-money ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 62.73s test result: ok. 153 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 312.71s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.62s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` calternal-plugin-notes ``` test result: ok. 319 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 546.88s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.09s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` calternal-server ``` test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 284 filtered out; finished in 63.31s test result: FAILED. 272 passed; 1 failed; 12 ignored; 0 measured; 0 filtered out; finished in 382.62s ``` server focused retry ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 284 filtered out; finished in 204.34s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s ``` server integration targets ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 28.21s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s ``` Web check ``` perf-lint: PASS; 0 violations; 22439 scoped exceptions svelte-check found 0 errors and 4 warnings in 2 files ``` Web test --maxWorkers=2 ``` Test Files 303 passed (303) Tests 2175 passed (2175) Duration 554.70s (transform 27%, environment 26%, import 23%, tests 17%, setup 6%) ``` The full server run had one SLOW-only failure: the existing 20,000-file Calendar responsiveness child measured p50 14,176 ms / p95 14,749 ms against its unchanged 10,000 ms budget. Its isolated parent retry and integration-target outputs are quoted above. All other 272 unit tests passed. No latency budget or test expectation was changed. The final Money run passes both replay property tests, SIGKILL checkpoints and process-exit recovery. An earlier process-exit run failed to spawn its executable because my overlapping rebuild replaced that executable; the full rerun passed after compilation. Existing test expectations were not changed. ## UX gaps closed Cleared responses retain whole-history balances and cross-Month transfer dates. Missing anchors do not trigger expensive repair. Stale generations return a calm retryable response. Foreign Note metadata migration cannot race Money source writes. ## Known gaps At 50k the median of the three candidate cleared-mark p95s is 299.8 ms; individual runs are 340.0, 299.8 and 277.3 ms. The first run exceeds the 300 ms target. This is not a claim that every run or the combined-sample p95 is below 300 ms. The profile's existing first-row 300 ms and frame 16.7 ms targets remain unmet on this software-rendering VM; real-Mac timing is left for the merge round. The default-allocator 200k comparison is incomplete: origin/dev was OOM-killed during its first mark workload (#1502). The candidate completed that run, but no paired origin/dev percentile exists. A separately labelled bounded comparison with MALLOC_ARENA_MAX=2 and MALLOC_TRIM_THRESHOLD_=131072 applies the same allocator policy to both binaries; it does not erase the default-settings crash. The production UI probe finishes its action assertions but reports Svelte each_key_duplicate browser exceptions. Filed #1498; no UI source changed and the zero-exception expectation is unchanged. No new visible controls were added. Actual Mac timing was not run for this backend continuation. ## UX gaps left The browser exceptions in #1498 remain. No new visible control was added by this backend continuation. ## Decisions Use the existing Plugin ownership registry for both Note migration and projection eligibility; keep its immutable per-process namespace policy consistent with the existing single configured Home root; Notes-owned Tasks and unclaimed Markdown still receive dates. Keep the selected transaction's Search update because existing #cleared search behavior is tested; Category membership is retained. Queue stale generation repair instead of rebuilding within a mark request. Retain NORMAL derived-projection publication plus FULL intent-completion fencing, as proved by the durability tests. ## Files bench/money-register-688.mjs; tests/adversarial/money_register_688.mjs; crates/plugins/money/src/{register.rs,register_contract_tests.rs,routes.rs,store.rs}; crates/plugins/notes/src/{lib.rs,store.rs}; crates/calternal-server/src/wire.rs; contracts/perf/{exceptions.json,registry.json}; docs/perf/baseline.json. ## Cleanup Job Cargo output was cleaned and the local production web build output removed after verification. Review artifacts remain ignored in the worktree. ## Focused real-server round Final API probe: 9 rejected reads, 4 rejected mark inputs, 16 concurrent reads, 8 concurrent marks and restore. Repeated 94/100-Tag writes and paging pass; 101 Tags rejects with 422. An oversized imported row returns alone with a working continuation. Source and projection invariants remain covered by SQL-trigger regressions with 200 and 2200 additional history rows.
kayg commented 2026-10-09 11:12:39 +00:00
Author
Owner
Copy link

money688i started on job/money-688 at a5aaf55009. Will merge origin/dev once and preserve #1393 conservation and payment-Category repair alongside #688 durability, bounded paging, incremental projection, and cleared-mark writes. Will run the requested regression scenarios and gates. No push or deploy.

money688i started on job/money-688 at a5aaf55009efafc6a77239124375a74769fc8620. Will merge origin/dev once and preserve #1393 conservation and payment-Category repair alongside #688 durability, bounded paging, incremental projection, and cleared-mark writes. Will run the requested regression scenarios and gates. No push or deploy.
kayg commented 2026-10-09 11:20:36 +00:00
Author
Owner
Copy link

money688i merge findings at origin/dev 5a2c02c130:

  • budget.rs merged without conflict and retains #1393 positive Card credit and refund conservation.
  • Resolved routes.rs by preserving the dev bounded FIFO create batch and Assignment CAS retries, then maintaining the register and FULL intent fence after successful source writes. Batch overspend events compare already checked proposal totals.
  • Resolved store.rs by keeping predecessor parse reuse and mark-only reads, plus dev read-only payment-Category repair. The Category-first repair write now records register intent before its source CAS.
  • Resolved views.rs by retaining the streaming register row renderer and using it for dev single-item replies.
  • Resolved upgrade_tests.rs with both migration sets; Money 1–3 add three receipts to dev's count. origin/dev has no Money migrations, so these numbers remain free.
  • Contracts and performance records retain both branches' semantic entries. Exact syntax pins are being validated without changing rule limits.
  • Expanded scoped_histories_equal_full_replay to 256 seeded histories with signed Card openings, omitted payment links, two Cards, split purchases/refunds, both Card transfer directions, six months and empty rollover months.
  • Initial compilation found one old Assignment retry helper call in dev's test. Updated its state argument; assertions are unchanged. Validation is still running.

Decisions: no new product decision; use the shared row renderer for single-item replies and one journal intent for each Category-first repair save, under DESIGN §§2 and 48.

money688i merge findings at origin/dev 5a2c02c1300dd2f591b177395e0d8c94fc2f8df9: - budget.rs merged without conflict and retains #1393 positive Card credit and refund conservation. - Resolved routes.rs by preserving the dev bounded FIFO create batch and Assignment CAS retries, then maintaining the register and FULL intent fence after successful source writes. Batch overspend events compare already checked proposal totals. - Resolved store.rs by keeping predecessor parse reuse and mark-only reads, plus dev read-only payment-Category repair. The Category-first repair write now records register intent before its source CAS. - Resolved views.rs by retaining the streaming register row renderer and using it for dev single-item replies. - Resolved upgrade_tests.rs with both migration sets; Money 1–3 add three receipts to dev's count. origin/dev has no Money migrations, so these numbers remain free. - Contracts and performance records retain both branches' semantic entries. Exact syntax pins are being validated without changing rule limits. - Expanded scoped_histories_equal_full_replay to 256 seeded histories with signed Card openings, omitted payment links, two Cards, split purchases/refunds, both Card transfer directions, six months and empty rollover months. - Initial compilation found one old Assignment retry helper call in dev's test. Updated its state argument; assertions are unchanged. Validation is still running. Decisions: no new product decision; use the shared row renderer for single-item replies and one journal intent for each Category-first repair save, under DESIGN §§2 and 48.
kayg commented 2026-10-09 11:33:20 +00:00
Author
Owner
Copy link

The expanded incremental/full replay property found a non-SLOW merge defect: after an Assignment source edit, predecessor metadata reuse passed an unsaved repaired Account link into a raw Budget document. Reload failed with unknown payment category block id: card-payment-card. The raw source files remained unchanged.

Root cause: #688 reuses predecessor ParsedFile documents; #1393 replaces the loaded editable metadata view with repaired documents. Those views must not be reused as raw source parses.

Fix: repaired ParsedFile views retain the original source Document Arc. Fingerprint-matched predecessor reuse restores that Arc before repair. No source re-read or full-history replay is added, and CAS hashes remain the original source hashes. The expanded six-month, 256-case generator is the regression; its fixed run is queued. Gate outputs before this fix will be rerun for the changed crate.

The expanded incremental/full replay property found a non-SLOW merge defect: after an Assignment source edit, predecessor metadata reuse passed an unsaved repaired Account link into a raw Budget document. Reload failed with `unknown payment category block id: card-payment-card`. The raw source files remained unchanged. Root cause: #688 reuses predecessor ParsedFile documents; #1393 replaces the loaded editable metadata view with repaired documents. Those views must not be reused as raw source parses. Fix: repaired ParsedFile views retain the original source Document Arc. Fingerprint-matched predecessor reuse restores that Arc before repair. No source re-read or full-history replay is added, and CAS hashes remain the original source hashes. The expanded six-month, 256-case generator is the regression; its fixed run is queued. Gate outputs before this fix will be rerun for the changed crate.
kayg commented 2026-10-09 11:39:10 +00:00
Author
Owner
Copy link

Validation findings:

  • cargo test -p calternal-money -- --test-threads=4 passes, including random_histories_conserve_money_after_every_rollover.
  • Web check passes: perf-lint: PASS; 0 violations; 22133 scoped exceptions and svelte-check found 0 errors and 3 warnings in 1 file.
  • Initial full web suite: Test Files 5 failed | 306 passed (311) / Tests 6 failed | 2261 passed (2267). All six failures were Error: Test timed out in 5000ms. The five affected files then pass separately with the original timeout: Test Files 5 passed (5) / Tests 26 passed (26). A full run with a 30-second runner timeout is in progress; test assertions and product latency budgets are unchanged.
  • The new foreign-cancel import test reproduced a 500 at owner publication instead of its unchanged expected 201. Its fixture applied only core migrations. It now also applies Money 1–3, as the real server and other durable import fixtures do.
  • The first full Money plugin process became stale when an overlapping rebuild replaced its executable (/proc/<pid>/exe ended in (deleted)). Its durability children use current_exe, so that run cannot prove crash recovery. Stopped the stale process; will rerun the Money suite after its final compilation. This was a verification scheduling error, not evidence of source loss.
  • The fixed 256-case property run is still active. It emits no panic; its current time is dominated by real source-file fsyncs, not CPU. No success claim yet.
Validation findings: - `cargo test -p calternal-money -- --test-threads=4` passes, including `random_histories_conserve_money_after_every_rollover`. - Web check passes: `perf-lint: PASS; 0 violations; 22133 scoped exceptions` and `svelte-check found 0 errors and 3 warnings in 1 file`. - Initial full web suite: `Test Files 5 failed | 306 passed (311)` / `Tests 6 failed | 2261 passed (2267)`. All six failures were `Error: Test timed out in 5000ms.` The five affected files then pass separately with the original timeout: `Test Files 5 passed (5)` / `Tests 26 passed (26)`. A full run with a 30-second runner timeout is in progress; test assertions and product latency budgets are unchanged. - The new foreign-cancel import test reproduced a 500 at owner publication instead of its unchanged expected 201. Its fixture applied only core migrations. It now also applies Money 1–3, as the real server and other durable import fixtures do. - The first full Money plugin process became stale when an overlapping rebuild replaced its executable (`/proc/<pid>/exe` ended in `(deleted)`). Its durability children use current_exe, so that run cannot prove crash recovery. Stopped the stale process; will rerun the Money suite after its final compilation. This was a verification scheduling error, not evidence of source loss. - The fixed 256-case property run is still active. It emits no panic; its current time is dominated by real source-file fsyncs, not CPU. No success claim yet.
kayg commented 2026-10-09 11:49:36 +00:00
Author
Owner
Copy link

Merge reconciliation committed on job/money-688: 4231ca30d4. Both parents are retained; origin/dev is 5a2c02c130.

Fresh final Rust checks:

Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 53s

cargo fmt --check: exit 0, no output. Core Money tests pass, including the #1393 conservation property. Notes:

test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 356.19s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.82s

Final full web run, bun run test --maxWorkers=2 --testTimeout=30000:

 Test Files  311 passed (311)
      Tests  2267 passed (2267)

The original five-second runner run and its six timeout failures remain recorded; all 26 tests in the five affected files also pass separately with their original timeout. No test assertion or product timing budget changed.

Legacy payment repair and the migration-complete foreign-cancel fixture regression pass. The expanded property generator remains uncommitted while its 256-case run finishes; it is a separate test concern. The final server gate and stable full Money durability rerun are still pending. No readiness claim yet.

Merge reconciliation committed on job/money-688: 4231ca30d4447098b0269f34347dcab74116ecf2. Both parents are retained; origin/dev is 5a2c02c1300dd2f591b177395e0d8c94fc2f8df9. Fresh final Rust checks: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 53s ``` `cargo fmt --check`: exit 0, no output. Core Money tests pass, including the #1393 conservation property. Notes: ``` test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 356.19s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.82s ``` Final full web run, `bun run test --maxWorkers=2 --testTimeout=30000`: ``` Test Files 311 passed (311) Tests 2267 passed (2267) ``` The original five-second runner run and its six timeout failures remain recorded; all 26 tests in the five affected files also pass separately with their original timeout. No test assertion or product timing budget changed. Legacy payment repair and the migration-complete foreign-cancel fixture regression pass. The expanded property generator remains uncommitted while its 256-case run finishes; it is a separate test concern. The final server gate and stable full Money durability rerun are still pending. No readiness claim yet.
kayg commented 2026-10-09 12:01:55 +00:00
Author
Owner
Copy link

Server gate finding: 275 unit tests passed and one failed. The round-9 upgrade inventory contained exactly the right receipts, but my conflict resolution inserted Money 1–3 before Calendar 6 while the registered migration plan has Calendar first.

Fix: move only the three new Money expected entries after the existing Calendar entry. No dev receipt, checksum, frontier or expected total changes; the total remains before.len() + 43. This is a correction to the merge resolution, not a weakened migration check. The server crate gates are queued again for this test change.

The expanded property keeps 256 seeded histories and all arithmetic assertions. Its fixture now skips writes when source bytes are unchanged. This checks retained parse reuse and avoids repeated durability work on empty months. The former all-file-write run was stopped without claiming a pass; the updated run is active.

Server gate finding: 275 unit tests passed and one failed. The round-9 upgrade inventory contained exactly the right receipts, but my conflict resolution inserted Money 1–3 before Calendar 6 while the registered migration plan has Calendar first. Fix: move only the three new Money expected entries after the existing Calendar entry. No dev receipt, checksum, frontier or expected total changes; the total remains before.len() + 43. This is a correction to the merge resolution, not a weakened migration check. The server crate gates are queued again for this test change. The expanded property keeps 256 seeded histories and all arithmetic assertions. Its fixture now skips writes when source bytes are unchanged. This checks retained parse reuse and avoids repeated durability work on empty months. The former all-file-write run was stopped without claiming a pass; the updated run is active.
kayg commented 2026-10-09 12:12:59 +00:00
Author
Owner
Copy link

money688i progress: commits 4231ca30d and dedbd101e preserve dev and correct the upgrade receipt order. The server suite passes: 276 unit tests, two integration tests, 12 ignored. The Money API adversarial probe passes (malformed and oversized requests, import ownership, concurrent writes). The 256-history incremental/full test is running. The remaining Money suite runs with only that separately running test excluded, to verify each test once. No push or deploy.

money688i progress: commits 4231ca30d and dedbd101e preserve dev and correct the upgrade receipt order. The server suite passes: 276 unit tests, two integration tests, 12 ignored. The Money API adversarial probe passes (malformed and oversized requests, import ownership, concurrent writes). The 256-history incremental/full test is running. The remaining Money suite runs with only that separately running test excluded, to verify each test once. No push or deploy.
kayg commented 2026-10-09 12:21:18 +00:00
Author
Owner
Copy link

money688i findings: the register API and production UI probes pass on the merged debug server with the real web build (200-row fixture). Paging rejected nine hostile inputs; cleared-mark writes rejected four hostile inputs; 16 concurrent reads and eight marks completed. Oversized rows remain byte-bounded and continuation works. Keyboard paging, touch targets, context menus, retained drafts, stable old identities and cursor/revision recovery pass. Zero uncaught browser errors; the one console diagnostic is the expected expired-cursor request. OpenAPI generation found only three stale Search descriptions in the JSON merge; commit 1eb2f14b1 regenerates them from the merged server. The SIGKILL durability test passes. Remaining Money suite and 256-history scoped/full comparison are running.

money688i findings: the register API and production UI probes pass on the merged debug server with the real web build (200-row fixture). Paging rejected nine hostile inputs; cleared-mark writes rejected four hostile inputs; 16 concurrent reads and eight marks completed. Oversized rows remain byte-bounded and continuation works. Keyboard paging, touch targets, context menus, retained drafts, stable old identities and cursor/revision recovery pass. Zero uncaught browser errors; the one console diagnostic is the expected expired-cursor request. OpenAPI generation found only three stale Search descriptions in the JSON merge; commit 1eb2f14b1 regenerates them from the merged server. The SIGKILL durability test passes. Remaining Money suite and 256-history scoped/full comparison are running.
kayg commented 2026-10-09 12:32:55 +00:00
Author
Owner
Copy link

money688i — #688

Built

Merged origin/dev 5a2c02c130 into job/money-688. Kept #1393 conservation and editable Card payment-Category repair with the #688 durability journal, byte-bounded signed register paging, scoped incremental projection and O(1) cleared-mark writes. The full calculation is still the oracle.

Added signed Card openings, positive credit, omitted payment Categories, underfunded and overspent months, mixed payments and later refunds to the 256-case fixed-seed incremental/full property. It compares every persisted generation across six months, including empty rollover months.

Fixed predecessor parse reuse: retain raw source documents separately from repaired editable documents. Reloading an Assignment cannot pair an unsaved repaired Account link with raw Budget metadata. Both views reuse immutable Arcs. Preserve one register maintenance/fence per successful create batch, journal Category-first repair writes, and retain CAS retry maintenance.

Conflicts

  • routes.rs: combine dev FIFO create batching/CAS retries with #688 cached projections and durable register maintenance. Each queued create carries its MoneyState; successful batch storage updates the register before acknowledgement.
  • store.rs: keep mark-only writes and predecessor parsing alongside dev editable payment repair and managed file dates. Journal the repair's direct metadata replacement.
  • views.rs: keep streaming bounded register rows; reuse the single-row renderer for dev transaction_view.
  • upgrade_tests.rs: retain dev receipts and add Money 1–3 after Calendar in registry order; total is 43. A separate fix preserves the exact expected order.
  • openapi.json: combine schemas and regenerate from the merged server. Generation corrected three stale Search descriptions. No API shape was lost.
  • perf/adoption-1058.json, exceptions.json, ratchet.json, registry.json: union independent entries, retain live exact proofs, refresh unchanged-limit hashes and remove dead entries. No limit was increased.
  • docs/perf/baseline.json: retain both branches' profile records. No new performance timing is claimed.
  • budget.rs merged without conflict; retain dev #1393 arithmetic.

Files

crates/plugins/money/src/{routes,store,views,projection,durable_import_tests}.rs; crates/calternal-server/src/upgrade_tests.rs; contracts/openapi.json; contracts/perf/{registry,exceptions,adoption-1058,ratchet}.json; docs/perf/baseline.json. Other incoming changes are origin/dev.

Probes

Real local merged server plus production web build: Money API adversarial probe passed malformed/oversized payloads, import ownership and single-use confirmation, bounded preview bursts and concurrent writes. Register fixture: 200 rows; nine hostile paging inputs and four hostile marks rejected, 16 concurrent reads and eight marks passed, oversized rows bounded and continuation works. Production register UI probe passed keyboard paging, cursor/revision recovery, retained drafts, old stable identity, touch targets and keyboard menus. Zero uncaught browser errors. Its one console diagnostic is the intentional expired-cursor response.

Decisions

No new product design. Raw and repaired document Arcs must be separate until repaired sources are saved (DESIGN §48). Reuse dev full arithmetic for each selected dependency component. Property fixtures write only changed bytes to cover predecessor reuse without redundant fsyncs. Run the long property separately, then exclude only that same test from the remaining complete Money suite to verify each test once.

Known gaps / verification notes

The first default web test run hit six 5-second timeouts under shared-host load. All five affected files pass with the original timeout on focused rerun. The complete suite passes with an explicit 30-second runner timeout; assertions and product timing limits are unchanged. An earlier Money suite was stopped because a concurrent rebuild replaced its executable, which invalidated child-process tests. Use only the final stable-executable results below. An earlier redundant-write property run was stopped without claiming a pass.

No web UI implementation changed. The UI probe uses macOS platform emulation; no new real-Mac timing or visual review is claimed. No benchmark timing was requested or run. Broad cross-plugin adversarial matrices, staging and real-Mac checks remain merge-round work. No push or deploy.

UX gaps closed

An unlinked Card's repaired payment Category remains valid across later Assignment reloads. Import-owner regression fixtures now use the complete production Money schema; existing expectations are unchanged. No new visible controls.

UX gaps left

None found in the focused register probe.

Head and commits

Head: 39e1f00d3d

  • 4231ca30d: merge dev and preserve durable projection/conservation.
  • dedbd101e: preserve upgrade receipt registry order.
  • 1eb2f14b1: regenerate merged OpenAPI descriptions.
  • 39e1f00d3: extend incremental/full histories for #1393.

Gate output (verbatim summaries)

cargo fmt --check

(no output; exit 0)

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes -p calternal-server --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 53s

cargo clippy -p calternal-plugin-money --all-targets -- -D warnings (after generator changes)

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 58.43s

cargo clippy -p calternal-server --all-targets -- -D warnings (after receipt-order fix)

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 13s

cargo test -p calternal-money -- --test-threads=4

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.51s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.47s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.88s
test random_histories_conserve_money_after_every_rollover ... ok
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.50s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

cargo test -p calternal-plugin-money scoped_histories_equal_full_replay

test projection::tests::scoped_histories_equal_full_replay ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 168 filtered out; finished in 1836.61s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

cargo test -p calternal-plugin-notes -- --test-threads=4

test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 356.19s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.82s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-server -- --test-threads=4

test result: ok. 276 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 167.22s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 31.41s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s

cd apps/web && bun run check

perf-lint: PASS; 0 violations; 22133 scoped exceptions
svelte-check found 0 errors and 3 warnings in 1 file

cd apps/web && bun run test --maxWorkers=2 --testTimeout=30000

 Test Files  311 passed (311)
      Tests  2267 passed (2267)
   Duration  489.13s (transform 29%, environment 26%, import 24%, tests 16%, setup 5%)

cargo test -p calternal-plugin-money -- --test-threads=4 --skip scoped_histories_equal_full_replay (only the separately passed property is excluded)

test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 168 filtered out; finished in 92.83s
test tests::durable_import_tests::operation_recovery_survives_process_exit_at_every_phase ... ok
test tests::card_models_ignore_arrival_batch_and_timezone ... ok
test result: ok. 165 passed; 0 failed; 3 ignored; 0 measured; 1 filtered out; finished in 1027.24s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 6.06s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

For the merge round

bash tests/adversarial/run.sh: prove the broad XUser, authorization, robustness and cross-plugin matrices on the combined branch. The focused Money API and register probes requested for this job already passed. Full combined-branch e2e, staging deployment and real-Mac checks remain the orchestrator's merge-round gates.

All existing assertions were preserved except the upgrade migration inventory, which now combines dev and Money receipts in actual registry order. No pushes or deploys. No credentials displayed.

Cleanup

cargo clean completed; web build output removed; worktree clean.

Removed 20457 files, 17.0GiB total
# money688i — #688 ## Built Merged origin/dev 5a2c02c1300dd2f591b177395e0d8c94fc2f8df9 into job/money-688. Kept #1393 conservation and editable Card payment-Category repair with the #688 durability journal, byte-bounded signed register paging, scoped incremental projection and O(1) cleared-mark writes. The full calculation is still the oracle. Added signed Card openings, positive credit, omitted payment Categories, underfunded and overspent months, mixed payments and later refunds to the 256-case fixed-seed incremental/full property. It compares every persisted generation across six months, including empty rollover months. Fixed predecessor parse reuse: retain raw source documents separately from repaired editable documents. Reloading an Assignment cannot pair an unsaved repaired Account link with raw Budget metadata. Both views reuse immutable Arcs. Preserve one register maintenance/fence per successful create batch, journal Category-first repair writes, and retain CAS retry maintenance. ## Conflicts - routes.rs: combine dev FIFO create batching/CAS retries with #688 cached projections and durable register maintenance. Each queued create carries its MoneyState; successful batch storage updates the register before acknowledgement. - store.rs: keep mark-only writes and predecessor parsing alongside dev editable payment repair and managed file dates. Journal the repair's direct metadata replacement. - views.rs: keep streaming bounded register rows; reuse the single-row renderer for dev transaction_view. - upgrade_tests.rs: retain dev receipts and add Money 1–3 after Calendar in registry order; total is 43. A separate fix preserves the exact expected order. - openapi.json: combine schemas and regenerate from the merged server. Generation corrected three stale Search descriptions. No API shape was lost. - perf/adoption-1058.json, exceptions.json, ratchet.json, registry.json: union independent entries, retain live exact proofs, refresh unchanged-limit hashes and remove dead entries. No limit was increased. - docs/perf/baseline.json: retain both branches' profile records. No new performance timing is claimed. - budget.rs merged without conflict; retain dev #1393 arithmetic. ## Files crates/plugins/money/src/{routes,store,views,projection,durable_import_tests}.rs; crates/calternal-server/src/upgrade_tests.rs; contracts/openapi.json; contracts/perf/{registry,exceptions,adoption-1058,ratchet}.json; docs/perf/baseline.json. Other incoming changes are origin/dev. ## Probes Real local merged server plus production web build: Money API adversarial probe passed malformed/oversized payloads, import ownership and single-use confirmation, bounded preview bursts and concurrent writes. Register fixture: 200 rows; nine hostile paging inputs and four hostile marks rejected, 16 concurrent reads and eight marks passed, oversized rows bounded and continuation works. Production register UI probe passed keyboard paging, cursor/revision recovery, retained drafts, old stable identity, touch targets and keyboard menus. Zero uncaught browser errors. Its one console diagnostic is the intentional expired-cursor response. ## Decisions No new product design. Raw and repaired document Arcs must be separate until repaired sources are saved (DESIGN §48). Reuse dev full arithmetic for each selected dependency component. Property fixtures write only changed bytes to cover predecessor reuse without redundant fsyncs. Run the long property separately, then exclude only that same test from the remaining complete Money suite to verify each test once. ## Known gaps / verification notes The first default web test run hit six 5-second timeouts under shared-host load. All five affected files pass with the original timeout on focused rerun. The complete suite passes with an explicit 30-second runner timeout; assertions and product timing limits are unchanged. An earlier Money suite was stopped because a concurrent rebuild replaced its executable, which invalidated child-process tests. Use only the final stable-executable results below. An earlier redundant-write property run was stopped without claiming a pass. No web UI implementation changed. The UI probe uses macOS platform emulation; no new real-Mac timing or visual review is claimed. No benchmark timing was requested or run. Broad cross-plugin adversarial matrices, staging and real-Mac checks remain merge-round work. No push or deploy. ## UX gaps closed An unlinked Card's repaired payment Category remains valid across later Assignment reloads. Import-owner regression fixtures now use the complete production Money schema; existing expectations are unchanged. No new visible controls. ## UX gaps left None found in the focused register probe. ## Head and commits Head: 39e1f00d3d86fc4f73ddf9715b7e9bc9605c9ff1 - 4231ca30d: merge dev and preserve durable projection/conservation. - dedbd101e: preserve upgrade receipt registry order. - 1eb2f14b1: regenerate merged OpenAPI descriptions. - 39e1f00d3: extend incremental/full histories for #1393. ## Gate output (verbatim summaries) `cargo fmt --check` ```text (no output; exit 0) ``` `cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes -p calternal-server --all-targets -- -D warnings` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 53s ``` `cargo clippy -p calternal-plugin-money --all-targets -- -D warnings (after generator changes)` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 58.43s ``` `cargo clippy -p calternal-server --all-targets -- -D warnings (after receipt-order fix)` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 13s ``` `cargo test -p calternal-money -- --test-threads=4` ```text test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.51s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.47s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.88s test random_histories_conserve_money_after_every_rollover ... ok test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.50s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ``` `cargo test -p calternal-plugin-money scoped_histories_equal_full_replay` ```text test projection::tests::scoped_histories_equal_full_replay ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 168 filtered out; finished in 1836.61s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-notes -- --test-threads=4` ```text test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 356.19s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.82s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-server -- --test-threads=4` ```text test result: ok. 276 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 167.22s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 31.41s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s ``` `cd apps/web && bun run check` ```text perf-lint: PASS; 0 violations; 22133 scoped exceptions svelte-check found 0 errors and 3 warnings in 1 file ``` `cd apps/web && bun run test --maxWorkers=2 --testTimeout=30000` ```text Test Files 311 passed (311) Tests 2267 passed (2267) Duration 489.13s (transform 29%, environment 26%, import 24%, tests 16%, setup 5%) ``` `cargo test -p calternal-plugin-money -- --test-threads=4 --skip scoped_histories_equal_full_replay` (only the separately passed property is excluded) ```text test register_recovery_tests::register_recovery_survives_sigkill_at_every_durability_point ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 168 filtered out; finished in 92.83s test tests::durable_import_tests::operation_recovery_survives_process_exit_at_every_phase ... ok test tests::card_models_ignore_arrival_batch_and_timezone ... ok test result: ok. 165 passed; 0 failed; 3 ignored; 0 measured; 1 filtered out; finished in 1027.24s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 6.06s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` ## For the merge round `bash tests/adversarial/run.sh`: prove the broad XUser, authorization, robustness and cross-plugin matrices on the combined branch. The focused Money API and register probes requested for this job already passed. Full combined-branch e2e, staging deployment and real-Mac checks remain the orchestrator's merge-round gates. All existing assertions were preserved except the upgrade migration inventory, which now combines dev and Money receipts in actual registry order. No pushes or deploys. No credentials displayed. ## Cleanup `cargo clean` completed; web build output removed; worktree clean. ```text Removed 20457 files, 17.0GiB total ```
kayg commented 2026-10-10 08:59:16 +00:00
Author
Owner
Copy link

Independent money688rev review started on branch job/money-688, head 39e1f00d3d, comparison base origin/dev 5a2c02c13. Read-mostly review: only failing regression tests for real defects may be committed. Scope: per-write projection equivalence, cleared marks, SIGKILL recovery, paging, Notes interaction and User isolation. Author reports and result files will not be read.

Independent money688rev review started on branch job/money-688, head 39e1f00d3d86fc4f73ddf9715b7e9bc9605c9ff1, comparison base origin/dev 5a2c02c13. Read-mostly review: only failing regression tests for real defects may be committed. Scope: per-write projection equivalence, cleared marks, SIGKILL recovery, paging, Notes interaction and User isolation. Author reports and result files will not be read.
kayg commented 2026-10-10 09:08:55 +00:00
Author
Owner
Copy link

Independent money688rev findings

Review head: 39e1f00d3d. Requested comparison: origin/dev 5a2c02c13.

  • Read binding contract, glossary, DESIGN Money source/arithmetic/isolation decisions and issue body. Did not read author reports or result files.

  • Existing independent generators exercise scoped/full replay and register BigInt prefixes; review will extend their coverage transiently and retain only regressions that fail for real defects.

  • Static candidate BLOCK: register_view_rows_for sorts by the parent transaction date. The cold fill_projection consumes the secondary transfer leg in that order even when its retained source date differs. The delta publisher instead sorts actual visible legs. Added a test against independent chronological BigInt prefixes.

  • Static candidate BLOCK: cached_register returns persisted numbers without source validation or dirty-intent checks. No Money subscriber consumes Files change events. Added a shared-Index route probe that publishes the actual Files event after a source change and requires Account totals to converge.

  • Candidate nonblocking inconsistencies: Category membership keys omit the date/month for file-local IDs; a legacy cleared tag in mid-memo moves after a two-toggle round trip. Added exact tests; the cleared helper and its behavior predate this branch.

  • Scope decision: User authorization uses the production router with the shared Index and test-authenticated principals. Existing SIGKILL tests use real TCP production handlers. No product code or user data is changed.

Confirmed focused results

Focused command: cargo test -p calternal-plugin-money review688_ -- --test-threads=2

test result: FAILED. 2 passed; 4 failed; 0 ignored; 0 measured; 169 filtered out; finished in 7.06s
  • BLOCK B1: review688_transfer_leg_prefix_uses_its_own_date fails against an independent BigInt prefix. A transfer's destination date precedes an ordinary destination posting, while its parent date follows that posting. Cold publication accumulates in parent order and returns the wrong running balances. New in #688. No amounts or transaction contents are recorded here.
  • BLOCK B2: review688_file_change_invalidates_retained_numbers fails. A rooted source write plus the exact Files adoption event leaves GET /budgets/home/accounts at its former totals throughout 20 bounded checks. The source Ledger and full replay have already changed. Money has no Files-event invalidation subscriber and warm reads do not check source signatures or intents. New in #688. The probe uses the production Money router and shared persistent Index; it simulates the Files write/event boundary rather than invoking the whole Files HTTP route.
  • Nonblocking N1: review688_category_filter_keeps_file_local_identity fails. Two legal month files reuse one Account/transaction ID in different Categories. The Category index/query joins only transaction ID and Account, so both rows appear for one Category. New in #688; incorrect filtering, no write corruption observed.
  • Nonblocking N2: review688_cleared_round_trip_restores_source_bytes fails. A legacy mid-memo cleared marker is removed and reappended at the end. Exact bytes do not return, but numbers remain unchanged. The helper and old route already had this behavior on origin/dev; label as inherited and cosmetic.
  • Passing independent probes: shared-Index cross-User cursor rejection, no-data-scope refusal, foreign mark writes leave owner sources and Index rows unchanged; paging after deleted anchor plus edits on both sides reaches every unchanged ID exactly once.
  • First fixture attempts had AsyncRead compile errors and a test-only stack overflow. Corrected by using byte slices and boxing large filesystem/route futures. Those attempts are not product findings.
# Independent money688rev findings Review head: 39e1f00d3d86fc4f73ddf9715b7e9bc9605c9ff1. Requested comparison: origin/dev 5a2c02c13. - Read binding contract, glossary, DESIGN Money source/arithmetic/isolation decisions and issue body. Did not read author reports or result files. - Existing independent generators exercise scoped/full replay and register BigInt prefixes; review will extend their coverage transiently and retain only regressions that fail for real defects. - Static candidate BLOCK: register_view_rows_for sorts by the parent transaction date. The cold fill_projection consumes the secondary transfer leg in that order even when its retained source date differs. The delta publisher instead sorts actual visible legs. Added a test against independent chronological BigInt prefixes. - Static candidate BLOCK: cached_register returns persisted numbers without source validation or dirty-intent checks. No Money subscriber consumes Files change events. Added a shared-Index route probe that publishes the actual Files event after a source change and requires Account totals to converge. - Candidate nonblocking inconsistencies: Category membership keys omit the date/month for file-local IDs; a legacy cleared tag in mid-memo moves after a two-toggle round trip. Added exact tests; the cleared helper and its behavior predate this branch. - Scope decision: User authorization uses the production router with the shared Index and test-authenticated principals. Existing SIGKILL tests use real TCP production handlers. No product code or user data is changed. ## Confirmed focused results Focused command: cargo test -p calternal-plugin-money review688_ -- --test-threads=2 ``` test result: FAILED. 2 passed; 4 failed; 0 ignored; 0 measured; 169 filtered out; finished in 7.06s ``` - BLOCK B1: `review688_transfer_leg_prefix_uses_its_own_date` fails against an independent BigInt prefix. A transfer's destination date precedes an ordinary destination posting, while its parent date follows that posting. Cold publication accumulates in parent order and returns the wrong running balances. New in #688. No amounts or transaction contents are recorded here. - BLOCK B2: `review688_file_change_invalidates_retained_numbers` fails. A rooted source write plus the exact Files adoption event leaves `GET /budgets/home/accounts` at its former totals throughout 20 bounded checks. The source Ledger and full replay have already changed. Money has no Files-event invalidation subscriber and warm reads do not check source signatures or intents. New in #688. The probe uses the production Money router and shared persistent Index; it simulates the Files write/event boundary rather than invoking the whole Files HTTP route. - Nonblocking N1: `review688_category_filter_keeps_file_local_identity` fails. Two legal month files reuse one Account/transaction ID in different Categories. The Category index/query joins only transaction ID and Account, so both rows appear for one Category. New in #688; incorrect filtering, no write corruption observed. - Nonblocking N2: `review688_cleared_round_trip_restores_source_bytes` fails. A legacy mid-memo cleared marker is removed and reappended at the end. Exact bytes do not return, but numbers remain unchanged. The helper and old route already had this behavior on origin/dev; label as inherited and cosmetic. - Passing independent probes: shared-Index cross-User cursor rejection, no-data-scope refusal, foreign mark writes leave owner sources and Index rows unchanged; paging after deleted anchor plus edits on both sides reaches every unchanged ID exactly once. - First fixture attempts had AsyncRead compile errors and a test-only stack overflow. Corrected by using byte slices and boxing large filesystem/route futures. Those attempts are not product findings.
kayg commented 2026-10-10 09:30:15 +00:00
Author
Owner
Copy link

Independent money688rev: B1 now has a direct incremental/full regression. It publishes the dated transfer with Register::update_for, checks the incremental prefixes against independent BigInt sums, then cold-builds the exact same source generation. The independent sums pass; cold and incremental prefixes differ.

incremental and cold register prefixes differ for the same source generation
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 172 filtered out; finished in 1.66s

Committed only the stronger failing test on job/money-688, commit d044c5df1. Product code remains unchanged. The required three-crate gate run is still in progress, with the extended real-file generator. Notes will run despite the expected Money failures (--no-fail-fast).

Independent money688rev: B1 now has a direct incremental/full regression. It publishes the dated transfer with Register::update_for, checks the incremental prefixes against independent BigInt sums, then cold-builds the exact same source generation. The independent sums pass; cold and incremental prefixes differ. ``` incremental and cold register prefixes differ for the same source generation test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 172 filtered out; finished in 1.66s ``` Committed only the stronger failing test on job/money-688, commit d044c5df1. Product code remains unchanged. The required three-crate gate run is still in progress, with the extended real-file generator. Notes will run despite the expected Money failures (`--no-fail-fast`).
kayg commented 2026-10-10 09:48:55 +00:00
Author
Owner
Copy link

Started money688j on job/money-688 at base d044c5df1. Read contract, glossary, DESIGN §§48 and 59, issue and independent findings. Fixing the retained failing regressions without changing their expectations. No pushes or deploys.

Started money688j on job/money-688 at base d044c5df1. Read contract, glossary, DESIGN §§48 and 59, issue and independent findings. Fixing the retained failing regressions without changing their expectations. No pushes or deploys.
kayg commented 2026-10-10 09:56:44 +00:00
Author
Owner
Copy link

Fixes committed as separate slices: a40566257 (visible-leg prefix ordering), ed7d9de14 (Category row identity), 69037b7a0 (Files adoption refresh and invalid-source recovery), and the latest cleared-marker fix. All five review688 regressions now pass unchanged: test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 169 filtered out; finished in 4.53s.

Evidence: Files adoption goes through the same bounded worker as cold register builds. Unchanged warm reads still use one Index lookup, without source fingerprints or parsing. Directory sources remain untouched and startup records a content-free owner-scoped failed Money source Job. A new Derived-data migration replaces Category ID joins with exact register-row membership and invalidates old projections once. Legacy mid-memo cleared marks retain their original bytes and use a removable non-posting override.

Decisions: lost Files events invalidate retained metadata, with view-driven bounded repair instead of a whole-Home scan. No dependencies or UI changes. Final integration and all requested gates follow.

Fixes committed as separate slices: a40566257 (visible-leg prefix ordering), ed7d9de14 (Category row identity), 69037b7a0 (Files adoption refresh and invalid-source recovery), and the latest cleared-marker fix. All five review688 regressions now pass unchanged: `test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 169 filtered out; finished in 4.53s`. Evidence: Files adoption goes through the same bounded worker as cold register builds. Unchanged warm reads still use one Index lookup, without source fingerprints or parsing. Directory sources remain untouched and startup records a content-free owner-scoped failed Money source Job. A new Derived-data migration replaces Category ID joins with exact register-row membership and invalidates old projections once. Legacy mid-memo cleared marks retain their original bytes and use a removable non-posting override. Decisions: lost Files events invalidate retained metadata, with view-driven bounded repair instead of a whole-Home scan. No dependencies or UI changes. Final integration and all requested gates follow.
kayg commented 2026-10-10 09:59:00 +00:00
Author
Owner
Copy link

Merged origin/dev once at e0dc732d1. Kept both Money and Tags pending migrations and both sets of performance measurements. Origin/dev has no Money migrations; Money 0004 is free. The upgrade fixture now includes Tags 0007 and Money 0001–0004, with the exact combined pending count. This changes the migration expectation because this job adds one migration; no review regression expectation changed. Shared exception JSON retains both branches' exact live entries; the ratchet is the exact combined count (22131), below either branch total. All five review tests passed before integration. Final gates are running.

Merged origin/dev once at e0dc732d1. Kept both Money and Tags pending migrations and both sets of performance measurements. Origin/dev has no Money migrations; Money 0004 is free. The upgrade fixture now includes Tags 0007 and Money 0001–0004, with the exact combined pending count. This changes the migration expectation because this job adds one migration; no review regression expectation changed. Shared exception JSON retains both branches' exact live entries; the ratchet is the exact combined count (22131), below either branch total. All five review tests passed before integration. Final gates are running.
kayg commented 2026-10-10 10:13:18 +00:00
Author
Owner
Copy link

Post-merge gates: cargo fmt --check exits 0 with no output. Required four-crate clippy passes after building the required real web assets: Finisheddev profile [unoptimized + debuginfo] target(s) in 59.63s. Full calternal-money tests pass, including #1393. Plugin Money SIGKILL recovery and the strengthened directory-source regression pass; the rest of the crate run continues. Web check passes: svelte-check found 0 errors and 3 warnings in 1 file; perf-lint passes with 0 violations and 22131 exact exceptions. One exact mutation hash was refreshed without changing its rule or count. The fresh full web run hit a 30-second timeout in the merged 1,000-Note NotesExplorer test; its focused reproduction is running, with all assertions unchanged.

Post-merge gates: cargo fmt --check exits 0 with no output. Required four-crate clippy passes after building the required real web assets: ` Finished `dev` profile [unoptimized + debuginfo] target(s) in 59.63s`. Full calternal-money tests pass, including #1393. Plugin Money SIGKILL recovery and the strengthened directory-source regression pass; the rest of the crate run continues. Web check passes: `svelte-check found 0 errors and 3 warnings in 1 file`; perf-lint passes with 0 violations and 22131 exact exceptions. One exact mutation hash was refreshed without changing its rule or count. The fresh full web run hit a 30-second timeout in the merged 1,000-Note NotesExplorer test; its focused reproduction is running, with all assertions unchanged.
kayg commented 2026-10-10 11:06:40 +00:00
Author
Owner
Copy link

Confirmed an additional invalid-source defect: replacing Accounts.md with a directory through rooted Files adoption returned a server failure on the accounts route. The focused regression failed before the fix and now passes for both Accounts.md and a Month file. Source loading and signature comparison reject recognized non-file sources before cache reuse; read-time type races use the existing invalid-file conflict response. Directory fingerprints remain unchanged. This also prevents a monthly directory from silently dropping history.

The existing full Rust and web gates passed. The focused regression passed with: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 174 filtered out; finished in 1.95s. Final affected-crate verification is running.

Nonblocking Background Work retry/label gap filed as kayg/calternal#1534. No source bytes or file labels enter diagnostic payloads.

Confirmed an additional invalid-source defect: replacing Accounts.md with a directory through rooted Files adoption returned a server failure on the accounts route. The focused regression failed before the fix and now passes for both Accounts.md and a Month file. Source loading and signature comparison reject recognized non-file sources before cache reuse; read-time type races use the existing invalid-file conflict response. Directory fingerprints remain unchanged. This also prevents a monthly directory from silently dropping history. The existing full Rust and web gates passed. The focused regression passed with: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 174 filtered out; finished in 1.95s`. Final affected-crate verification is running. Nonblocking Background Work retry/label gap filed as https://git.kayg.org/kayg/calternal/issues/1534. No source bytes or file labels enter diagnostic payloads.
kayg commented 2026-10-10 11:34:27 +00:00
Author
Owner
Copy link

money688j final report — head 5ca53435f0

Built: B1 FIXED (shared visible-leg date/ID/Account ordering); B2 FIXED (bounded Files event refresh, unchanged O(1) warm reads); N1 FIXED (Category membership joins exact register row identity); N2 FIXED (lossless legacy mid-memo cleared toggles); directory-source startup FIXED (preserve invalid source, invalidate old Derived data, report a content-free failed Background Work Job, continue recovery).

Product files: crates/plugins/money/src/views.rs, register.rs, routes.rs, lib.rs, register_recovery_tests.rs, register_contract_tests.rs, store.rs; crates/plugins/money/migrations/0004_register_category_identity.sql; crates/calternal-money/src/edit.rs. Integration: crates/calternal-server/src/upgrade_tests.rs; contracts/perf/adoption-1058.json, exceptions.json, ratchet.json and registry.json; docs/perf/baseline.json. The dev merge supplied registry changes; the only authored perf pin change is the exact cleared mutation hash. Profile: bench/money-register-688.mjs.

Decisions: use the existing bounded register worker for Files adoption; a lost Files feed invalidates retained metadata and lets requested views rebuild, without a Home scan. Category membership uses exact row identity instead of combining file-local transaction IDs. A legacy mid-memo cleared mark keeps its text; a removable explicit property supplies its changed state. Invalid source structure has an owner-scoped failed Money source Job with no file names or contents in its payload. Migration 0004 clears only Derived data once. Source directories now use the existing invalid-file conflict response; recognized Month names cannot silently disappear from history. No dependencies, API schema or UI change.

UX gaps closed: Accounts converge after Files edits; transfer prefixes agree across cold and incremental publication; Category filters do not alias another file; toggles keep legacy memo bytes; one invalid source does not stop Instance startup and is visible in Background Work. UX gaps left: all requested regressions are fixed. Source diagnostic Jobs lack a supported Background Work retry handler and use the generic Money Job label. Filed nonblocking #1534 (kayg/calternal#1534); repairing the source and opening Money rebuilds normally.

Expected cost: a normal retained read remains one O(1) WAL metadata lookup plus a bounded indexed page. Files adoption rebuilds only an affected retained Budget: O(N log N) lightweight leg sorting and O(N) streamed payload publication in batches of 128. The source-refresh benchmark extends the existing 50k/200k fixture with five serial replacements and a four-write burst, generation convergence, exact unchanged Account summaries, p50/p95/max, CPU and RSS. It passed node --check. No new source-refresh timing was measured; no matching source-refresh baseline exists. Previous register measurements remain in docs/perf/baseline.json and are not claimed for this head.

For the merge round: build the combined release server elsewhere, then on the perf VM run perf-run calternal money688j-refresh 20 -- env MONEY688_SOURCE_REFRESH_ONLY=1 CALTERNAL_SERVER_BIN=<combined-release-binary> MONEY688_REVISION=<combined-head> MONEY688_QUALIFICATION=perf-vm bun bench/money-register-688.mjs. This must prove Files adoption convergence and report its rebuild cost on both large fixtures. Run the normal profile with the same release binary to execute its one bounded Money adversarial round: perf-run calternal money688j-register 20 -- env CALTERNAL_SERVER_BIN=<combined-release-binary> MONEY688_REVISION=<combined-head> MONEY688_QUALIFICATION=perf-vm bun bench/money-register-688.mjs. Full server authz/robustness matrices, release qualification and staging checks stay with the merge round under the shared verification policy. No macOS VM was used.

Known gaps: Background Work source diagnostics need the supported retry/label work filed in #1534. No new source-refresh timing or baseline was recorded; the merge-round commands above supply that evidence. The web checker retains three warnings in the existing MailMorphCard file.

Gate notes: origin/dev was fetched and merged once (dbd621434d). The combined migration inventory preserves Tags 7 and Money 1–4. The upgrade fixture expectation changed only to include the added migration. Review regressions and other existing expectations were not changed. Initial server clippy needed the real embedded web build; it passed after bun run build. The first web run crossed the merge; TagRow passed fresh in isolation. A subsequent full web run timed out on the 1,000-Note NotesExplorer test; that test passed in isolation and the whole suite passed with file parallelism disabled, keeping all assertions and the 30-second timeout. No files from a credential store were read or printed.

Gate output (verbatim result lines; full logs are retained in artifacts):

cargo fmt --check: exit 0, no output.

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes -p calternal-server --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 42.70s

cargo test -p calternal-money -- --test-threads=4:

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 15.83s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.18s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 5.37s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.67s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.11s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-plugin-notes -- --test-threads=4:

test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 330.50s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.41s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cd apps/web && bun run check:

perf-lint: PASS; 0 violations; 22131 scoped exceptions
svelte-check found 0 errors and 3 warnings in 1 file

cd apps/web && bun run test --maxWorkers=2 --no-file-parallelism:

 Test Files  312 passed (312)
      Tests  2277 passed (2277)
   Duration  335.23s (environment 27%, transform 23%, import 22%, tests 22%, setup 5%)

cargo test -p calternal-plugin-money -- --test-threads=4:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 174 filtered out; finished in 55.83s
test result: ok. 172 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1262.94s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.55s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo test -p calternal-server -- --test-threads=4:

test result: ok. 276 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 118.20s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 31.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.13s

Cleanup complete. cargo clean exited 0:

     Removed 19174 files, 15.4GiB total

Removed apps/web/build, apps/web/.svelte-kit/output and target/tmp with worktree-bound cleanup. Working tree is clean.

money688j final report — head 5ca53435f0a2f6e8ba12d94d4986c0302c81f042 Built: B1 FIXED (shared visible-leg date/ID/Account ordering); B2 FIXED (bounded Files event refresh, unchanged O(1) warm reads); N1 FIXED (Category membership joins exact register row identity); N2 FIXED (lossless legacy mid-memo cleared toggles); directory-source startup FIXED (preserve invalid source, invalidate old Derived data, report a content-free failed Background Work Job, continue recovery). Product files: crates/plugins/money/src/views.rs, register.rs, routes.rs, lib.rs, register_recovery_tests.rs, register_contract_tests.rs, store.rs; crates/plugins/money/migrations/0004_register_category_identity.sql; crates/calternal-money/src/edit.rs. Integration: crates/calternal-server/src/upgrade_tests.rs; contracts/perf/adoption-1058.json, exceptions.json, ratchet.json and registry.json; docs/perf/baseline.json. The dev merge supplied registry changes; the only authored perf pin change is the exact cleared mutation hash. Profile: bench/money-register-688.mjs. Decisions: use the existing bounded register worker for Files adoption; a lost Files feed invalidates retained metadata and lets requested views rebuild, without a Home scan. Category membership uses exact row identity instead of combining file-local transaction IDs. A legacy mid-memo cleared mark keeps its text; a removable explicit property supplies its changed state. Invalid source structure has an owner-scoped failed Money source Job with no file names or contents in its payload. Migration 0004 clears only Derived data once. Source directories now use the existing invalid-file conflict response; recognized Month names cannot silently disappear from history. No dependencies, API schema or UI change. UX gaps closed: Accounts converge after Files edits; transfer prefixes agree across cold and incremental publication; Category filters do not alias another file; toggles keep legacy memo bytes; one invalid source does not stop Instance startup and is visible in Background Work. UX gaps left: all requested regressions are fixed. Source diagnostic Jobs lack a supported Background Work retry handler and use the generic Money Job label. Filed nonblocking #1534 (https://git.kayg.org/kayg/calternal/issues/1534); repairing the source and opening Money rebuilds normally. Expected cost: a normal retained read remains one O(1) WAL metadata lookup plus a bounded indexed page. Files adoption rebuilds only an affected retained Budget: O(N log N) lightweight leg sorting and O(N) streamed payload publication in batches of 128. The source-refresh benchmark extends the existing 50k/200k fixture with five serial replacements and a four-write burst, generation convergence, exact unchanged Account summaries, p50/p95/max, CPU and RSS. It passed node --check. No new source-refresh timing was measured; no matching source-refresh baseline exists. Previous register measurements remain in docs/perf/baseline.json and are not claimed for this head. For the merge round: build the combined release server elsewhere, then on the perf VM run `perf-run calternal money688j-refresh 20 -- env MONEY688_SOURCE_REFRESH_ONLY=1 CALTERNAL_SERVER_BIN=<combined-release-binary> MONEY688_REVISION=<combined-head> MONEY688_QUALIFICATION=perf-vm bun bench/money-register-688.mjs`. This must prove Files adoption convergence and report its rebuild cost on both large fixtures. Run the normal profile with the same release binary to execute its one bounded Money adversarial round: `perf-run calternal money688j-register 20 -- env CALTERNAL_SERVER_BIN=<combined-release-binary> MONEY688_REVISION=<combined-head> MONEY688_QUALIFICATION=perf-vm bun bench/money-register-688.mjs`. Full server authz/robustness matrices, release qualification and staging checks stay with the merge round under the shared verification policy. No macOS VM was used. Known gaps: Background Work source diagnostics need the supported retry/label work filed in #1534. No new source-refresh timing or baseline was recorded; the merge-round commands above supply that evidence. The web checker retains three warnings in the existing MailMorphCard file. Gate notes: origin/dev was fetched and merged once (dbd621434d0a1133f16230cca5c6a83af0d8aed3). The combined migration inventory preserves Tags 7 and Money 1–4. The upgrade fixture expectation changed only to include the added migration. Review regressions and other existing expectations were not changed. Initial server clippy needed the real embedded web build; it passed after bun run build. The first web run crossed the merge; TagRow passed fresh in isolation. A subsequent full web run timed out on the 1,000-Note NotesExplorer test; that test passed in isolation and the whole suite passed with file parallelism disabled, keeping all assertions and the 30-second timeout. No files from a credential store were read or printed. Gate output (verbatim result lines; full logs are retained in artifacts): `cargo fmt --check`: exit 0, no output. `cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes -p calternal-server --all-targets -- -D warnings`: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 42.70s ``` `cargo test -p calternal-money -- --test-threads=4`: ``` test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 15.83s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.18s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 5.37s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.67s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.11s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-notes -- --test-threads=4`: ``` test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 330.50s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.41s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cd apps/web && bun run check`: ``` perf-lint: PASS; 0 violations; 22131 scoped exceptions svelte-check found 0 errors and 3 warnings in 1 file ``` `cd apps/web && bun run test --maxWorkers=2 --no-file-parallelism`: ``` Test Files 312 passed (312) Tests 2277 passed (2277) Duration 335.23s (environment 27%, transform 23%, import 22%, tests 22%, setup 5%) ``` `cargo test -p calternal-plugin-money -- --test-threads=4`: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 174 filtered out; finished in 55.83s test result: ok. 172 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1262.94s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.55s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo test -p calternal-server -- --test-threads=4`: ``` test result: ok. 276 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 118.20s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 31.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.13s ``` Cleanup complete. `cargo clean` exited 0: ``` Removed 19174 files, 15.4GiB total ``` Removed apps/web/build, apps/web/.svelte-kit/output and target/tmp with worktree-bound cleanup. Working tree is clean.
kayg commented 2026-10-10 11:37:08 +00:00
Author
Owner
Copy link

Independent Money number-correctness and data-safety review (round 2) started on job/money-688 at 5ca53435f, compared with requested base 5a2c02c13. Read-mostly: product code stays unchanged; only confirmed failing regressions will be committed. Review focuses on the first-review fixes and Category identity migration, then incremental/full equivalence, cleared writes, crash recovery, paging, Notes interaction and User isolation. Evidence is recorded in artifacts/money688rev2-findings.md; no source contents or amounts will be posted.

Independent Money number-correctness and data-safety review (round 2) started on job/money-688 at 5ca53435f, compared with requested base 5a2c02c13. Read-mostly: product code stays unchanged; only confirmed failing regressions will be committed. Review focuses on the first-review fixes and Category identity migration, then incremental/full equivalence, cleared writes, crash recovery, paging, Notes interaction and User isolation. Evidence is recorded in artifacts/money688rev2-findings.md; no source contents or amounts will be posted.
kayg commented 2026-10-10 11:42:46 +00:00
Author
Owner
Copy link

Round-2 independent review: existing first-review transfer ordering, Files refresh, Category identity, cleared-byte and directory-startup regressions pass. A new populated legacy-projection upgrade test passes through the production migration runner, including SIGKILL during its transaction, rollback, clean retry, retained recovery intent and source-byte preservation. Added transient stronger per-physical-write/full-replay histories, publication SIGKILL, keyset/edit and shared-Index isolation probes. Required three-crate tests are running. No product changes or confirmed blocker so far. New-probe corrections affected only test assumptions; existing expectations remain intact.

Round-2 independent review: existing first-review transfer ordering, Files refresh, Category identity, cleared-byte and directory-startup regressions pass. A new populated legacy-projection upgrade test passes through the production migration runner, including SIGKILL during its transaction, rollback, clean retry, retained recovery intent and source-byte preservation. Added transient stronger per-physical-write/full-replay histories, publication SIGKILL, keyset/edit and shared-Index isolation probes. Required three-crate tests are running. No product changes or confirmed blocker so far. New-probe corrections affected only test assumptions; existing expectations remain intact.
kayg commented 2026-10-10 12:06:59 +00:00
Author
Owner
Copy link

Round-2 evidence: the 48-history incremental register BigInt generator and randomized destination-date paging generator pass. The existing 25 SIGKILL durability cases and a new SIGKILL during actual SQL projection INSERT pass; recovery matches cold replay and is idempotent. New populated legacy migration, deleted-anchor paging, shared-Index User isolation and real TCP adversarial probes pass in a corrected focused run:

test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 175 filtered out; finished in 5.27s

The full three-crate run retains two earlier transient probe-assumption failures: Tag labels exceeded the payee limit before the Tag-count check, and a cold foreign mark first needs the bounded repair worker before returning 404. Corrected only those new probe fixtures; no existing expectation or product behavior changed. All passing transient edits are restored; worktree is clean and cargo fmt --check passes with no output. The stronger 512-history per-physical-write/full-replay generator is still running in real durable filesystem writes; a stack sample shows fsync, not failure shrinking. No product blocker found so far. Notes will run after Money completes.

Round-2 evidence: the 48-history incremental register BigInt generator and randomized destination-date paging generator pass. The existing 25 SIGKILL durability cases and a new SIGKILL during actual SQL projection INSERT pass; recovery matches cold replay and is idempotent. New populated legacy migration, deleted-anchor paging, shared-Index User isolation and real TCP adversarial probes pass in a corrected focused run: ``` test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 175 filtered out; finished in 5.27s ``` The full three-crate run retains two earlier transient probe-assumption failures: Tag labels exceeded the payee limit before the Tag-count check, and a cold foreign mark first needs the bounded repair worker before returning 404. Corrected only those new probe fixtures; no existing expectation or product behavior changed. All passing transient edits are restored; worktree is clean and cargo fmt --check passes with no output. The stronger 512-history per-physical-write/full-replay generator is still running in real durable filesystem writes; a stack sample shows fsync, not failure shrinking. No product blocker found so far. Notes will run after Money completes.
kayg commented 2026-10-10 12:19:17 +00:00
Author
Owner
Copy link

BLOCK B3 confirmed in round 2: a live projection publication failure leaves warm Accounts reads serving stale numbers.

Reproduction uses the production Money router and persistent shared Index. A test-only SQLite trigger rejects projection publication after a valid transaction edit durably changes the Month source. The failed request retains its durable intent. After the fault is removed, a warm Accounts GET returns HTTP 200 with old numbers that disagree with independent full replay of the current source. The bounded build worker is running. The injected SQL error is deliberate; the defect is the stale successful read after the Index is healthy again.

maintain_register returns the publication error with intent retained. cached_register / Register::cached do not fence reads against pending intents, and this failure path does not enqueue live recovery. The journal repairs the source after startup recovery, but does not protect current warm reads. New in the retained-register branch.

Focused evidence:

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 175 filtered out; finished in 4.19s

I will commit only this failing regression, strengthened with a bounded persistence check and proof that explicit recovery restores the correct model without source changes. Product code stays unchanged. Earlier first-review fixes, migration/SIGKILL probes, paging and User-isolation probes pass. The larger generator and Notes gate are still running.

BLOCK B3 confirmed in round 2: a live projection publication failure leaves warm Accounts reads serving stale numbers. Reproduction uses the production Money router and persistent shared Index. A test-only SQLite trigger rejects projection publication after a valid transaction edit durably changes the Month source. The failed request retains its durable intent. After the fault is removed, a warm Accounts GET returns HTTP 200 with old numbers that disagree with independent full replay of the current source. The bounded build worker is running. The injected SQL error is deliberate; the defect is the stale successful read after the Index is healthy again. `maintain_register` returns the publication error with intent retained. `cached_register` / `Register::cached` do not fence reads against pending intents, and this failure path does not enqueue live recovery. The journal repairs the source after startup recovery, but does not protect current warm reads. New in the retained-register branch. Focused evidence: ``` test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 175 filtered out; finished in 4.19s ``` I will commit only this failing regression, strengthened with a bounded persistence check and proof that explicit recovery restores the correct model without source changes. Product code stays unchanged. Earlier first-review fixes, migration/SIGKILL probes, paging and User-isolation probes pass. The larger generator and Notes gate are still running.
kayg commented 2026-10-10 12:21:55 +00:00
Author
Owner
Copy link

BLOCK B3 regression committed as c3f08b292c. Only crates/plugins/money/src/register_contract_tests.rs changes; product code and all existing expectations stay unchanged.

The strengthened probe retains stale HTTP 200 Account numbers through 20 bounded reads after the Index fault is removed. Explicit recovery then restores exact full-source-replay numbers and preserves committed source bytes. Final assertion fails for the missing live read fence:

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 175 filtered out; finished in 3.37s

cargo fmt --check: exit 0, no output. Money clippy exits 0:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 11s

No push, deploy or product change. The original three-crate run continues with the extended generator; Notes is not skipped.

BLOCK B3 regression committed as c3f08b292cd18b4c6ecf79537d0ab059f0723ef2. Only `crates/plugins/money/src/register_contract_tests.rs` changes; product code and all existing expectations stay unchanged. The strengthened probe retains stale HTTP 200 Account numbers through 20 bounded reads after the Index fault is removed. Explicit recovery then restores exact full-source-replay numbers and preserves committed source bytes. Final assertion fails for the missing live read fence: ``` test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 175 filtered out; finished in 3.37s ``` `cargo fmt --check`: exit 0, no output. Money clippy exits 0: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 11s ``` No push, deploy or product change. The original three-crate run continues with the extended generator; Notes is not skipped.
kayg commented 2026-10-10 12:47:29 +00:00
Author
Owner
Copy link

BLOCK B4 confirmed and committed: 77a46a0dd9 (test(money): expose startup failure from visible-leg identity collisions). No product changes.

Two valid Month files reuse one file-local transaction block ID. A transfer in the later file retains a destination date that matches the earlier ordinary row's date and Account. Parsing and full Money arithmetic succeed. The production source writer saves its FULL intent and valid source, but startup recovery fails when publishing the register. This test has no injected Index error.

money_register_rows uniquely keys rows by owner, Budget, source signature and visible (date, transaction_id, account_id). Visible destination date does not identify the original Month file. Two legitimate rows therefore collide. Migration 0004 repairs Category memberships but leaves this row identity unchanged. Server initialization propagates recover_register_writes(...).await? before plugins/auth, so one pending valid source set can prevent Instance startup.

Focused final regression:

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 176 filtered out; finished in 1.65s

Formatting exits 0 with no output. Money clippy exits 0:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 10.62s

Current outcome: BLOCK (B3 stale warm numbers after a failed live publication; B4 valid visible-leg collision stops startup). The extended generator/Notes gate continues; final report will include their actual completion state.

BLOCK B4 confirmed and committed: 77a46a0dd91a74bed12fb6e5f14f0471a140a1af (`test(money): expose startup failure from visible-leg identity collisions`). No product changes. Two valid Month files reuse one file-local transaction block ID. A transfer in the later file retains a destination date that matches the earlier ordinary row's date and Account. Parsing and full Money arithmetic succeed. The production source writer saves its FULL intent and valid source, but startup recovery fails when publishing the register. This test has no injected Index error. `money_register_rows` uniquely keys rows by owner, Budget, source signature and visible `(date, transaction_id, account_id)`. Visible destination date does not identify the original Month file. Two legitimate rows therefore collide. Migration 0004 repairs Category memberships but leaves this row identity unchanged. Server initialization propagates `recover_register_writes(...).await?` before plugins/auth, so one pending valid source set can prevent Instance startup. Focused final regression: ``` test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 176 filtered out; finished in 1.65s ``` Formatting exits 0 with no output. Money clippy exits 0: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 10.62s ``` Current outcome: BLOCK (B3 stale warm numbers after a failed live publication; B4 valid visible-leg collision stops startup). The extended generator/Notes gate continues; final report will include their actual completion state.
kayg commented 2026-10-10 12:59:35 +00:00
Author
Owner
Copy link

BLOCK — B3 and B4. Independent round-2 review of #688; no product code changed.

Built and committed two failing regression tests in crates/plugins/money/src/register_contract_tests.rs:

  • c3f08b292c: expose stale warm summaries after publication errors.
  • 77a46a0dd9: expose startup failure from visible-leg identity collisions.
    Final head: 77a46a0dd9. Working tree is clean. No push or deploy. The required origin/dev merge ran once and returned “Already up to date.”

B3 — stale successful reads after a committed source write fails projection publication.
A test-only SQLite insert trigger makes publication fail after a valid production PUT durably changes a Month source. After removing the trigger, twenty bounded Accounts reads still return HTTP 200 with old numbers, different from independent source replay. A pending FULL recovery intent remains. The running build worker does not repair this warm generation. Explicit recovery restores correct numbers and preserves committed source bytes. Warm cached reads do not fence on pending intents. This is a stale-number BLOCK, not a claim that the intentional injected publication error itself is a defect.

B4 — valid source identities can stop Instance startup.
An ordinary row and a later-Month transfer reuse the same legal file-local transaction ID. The transfer destination retains an earlier-Month date and matches the ordinary row’s date and Account. Both sources parse and full Money arithmetic succeeds. A real source replacement records a pending intent, but recovery fails on the register row UNIQUE identity (User, Budget, source signature, visible date, transaction ID, Account). It omits the source Month identity. Startup propagates that recovery failure in calternal-server/src/wire.rs before plugin startup. Migration 0004 fixes Category row membership, but does not fix this visible-leg collision. No artificial Index fault is used for B4.

Checks completed:

  1. The expanded fixed-seed generator passed 512 histories, with comparisons against full replay after every changed physical Budget or Month write. It includes signed Card openings, unlinked Cards, credits, refunds, splits, transfers, assignments, edits, deletes and underfunded/overspent Months. Forty-eight independent BigInt register histories and forty-eight transfer-date paging histories also passed.
  2. Cleared-only number invariants, constant SQL write counts and exact two-toggle source-byte restoration passed.
  3. Twenty-five source-write/publication SIGKILL points passed, including killing after acknowledged writes. A separate kill while the actual projection transaction held the writer lock recovered correctly and idempotently. B3 remains the live-read failure case.
  4. Byte-bounded pages, an oversized single row, deleted anchors and concurrent inserts passed; unchanged transactions remained reachable exactly once.
  5. Notes crate tests passed: Money sources stayed unchanged and ordinary Notes in the same Home were processed.
  6. Shared-Index User isolation passed for reads, writes and signed cursors, including bounded cold repair. A real TCP handler round passed malformed/oversized inputs, traversal/Unicode probes, the 101-Tag rejection and a concurrent read burst.

Prior fixes B1, B2, N1, N2 and directory-source rejection all passed. Migration 0004 upgrade from populated legacy register projections passed. A kill during migration rolled back rows and receipt; retry retained the pending intent and sources, rebuilt correctly and remained idempotent.

Gate provenance:
The requested three-crate run used transient expanded review probes. All original tests passed. Two new probe assumptions failed: overlong synthetic Tag labels hit an existing length guard first, and a cold foreign cleared route needed the build worker before its final 404. Corrected focused probes passed; these transient probes were then removed. No existing expectation changed. The two retained real defects were tested separately and together at final HEAD. The full three-crate command therefore returned nonzero; it is not reported as a green gate.

Commands:

  • cargo test -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes --no-fail-fast -- --test-threads=4
  • cargo fmt --check (exit 0, no output)
  • cargo clippy -p calternal-plugin-money --all-targets -- -D warnings
  • cargo test -p calternal-plugin-money review688rev2_ -- --test-threads=1
    All used CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0 and the worktree target/tmp. No web code changed.

Verbatim three-crate result lines (full log: artifacts/rev2-three-crate-gate.log):

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.31s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.17s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.89s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.40s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 180 filtered out; finished in 40.26s
test result: FAILED. 175 passed; 2 failed; 4 ignored; 0 measured; 0 filtered out; finished in 3649.87s
error: test failed, to rerun pass `-p calternal-plugin-money --lib`
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 5.64s
test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 185.31s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.92s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
error: 1 target failed:

Verbatim corrected transient probe result:

test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 175 filtered out; finished in 5.27s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s

Verbatim final HEAD focused gate:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.40s
     Running unittests src/lib.rs (/home/kayg/build/targets/money688rev2/debug/deps/calternal_plugin_money-369d9e0370502d5a)

running 2 tests
test routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers ... FAILED
test routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup ... FAILED

failures:

---- routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers stdout ----

thread 'routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers' (1826788) panicked at crates/plugins/money/src/register_contract_tests.rs:1168:9:
warm reads kept stale Account numbers after source committed and projection publication failed
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup stdout ----

thread 'routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup' (1826866) panicked at crates/plugins/money/src/register_contract_tests.rs:1218:9:
valid file-local IDs with colliding visible transfer legs stopped startup recovery


failures:
    routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers
    routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup

test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 175 filtered out; finished in 3.01s

error: test failed, to rerun pass `-p calternal-plugin-money --lib`

Verbatim final clippy completion:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 10.62s

Known gaps: physical power loss was not simulated. User principals were supplied by the test harness; full sign-in middleware was not retested. Files refresh probes used rooted source changes and actual adoption events rather than the full Files HTTP pipeline. Finite generators are not exhaustive. No wrong arithmetic, lost acknowledged write or cross-User effect was found in the passing scenarios. B3 and B4 remain unfixed because this job is read-mostly.

Decisions: no new product design decisions. Retained only failing defect regressions; removed passing exploratory probes as required. Existing file-local identity and retained transfer-leg date contracts determine B4’s expected behavior.

Cleanup: cargo clean completed; web build output removed if present. Verbatim cleanup:

     Removed 8680 files, 6.0GiB total

Evidence: artifacts/money688rev2-findings.md. No secrets or real financial data are included. No review artifacts committed.

BLOCK — B3 and B4. Independent round-2 review of #688; no product code changed. Built and committed two failing regression tests in crates/plugins/money/src/register_contract_tests.rs: - c3f08b292cd18b4c6ecf79537d0ab059f0723ef2: expose stale warm summaries after publication errors. - 77a46a0dd91a74bed12fb6e5f14f0471a140a1af: expose startup failure from visible-leg identity collisions. Final head: 77a46a0dd91a74bed12fb6e5f14f0471a140a1af. Working tree is clean. No push or deploy. The required origin/dev merge ran once and returned “Already up to date.” B3 — stale successful reads after a committed source write fails projection publication. A test-only SQLite insert trigger makes publication fail after a valid production PUT durably changes a Month source. After removing the trigger, twenty bounded Accounts reads still return HTTP 200 with old numbers, different from independent source replay. A pending FULL recovery intent remains. The running build worker does not repair this warm generation. Explicit recovery restores correct numbers and preserves committed source bytes. Warm cached reads do not fence on pending intents. This is a stale-number BLOCK, not a claim that the intentional injected publication error itself is a defect. B4 — valid source identities can stop Instance startup. An ordinary row and a later-Month transfer reuse the same legal file-local transaction ID. The transfer destination retains an earlier-Month date and matches the ordinary row’s date and Account. Both sources parse and full Money arithmetic succeeds. A real source replacement records a pending intent, but recovery fails on the register row UNIQUE identity (User, Budget, source signature, visible date, transaction ID, Account). It omits the source Month identity. Startup propagates that recovery failure in calternal-server/src/wire.rs before plugin startup. Migration 0004 fixes Category row membership, but does not fix this visible-leg collision. No artificial Index fault is used for B4. Checks completed: 1. The expanded fixed-seed generator passed 512 histories, with comparisons against full replay after every changed physical Budget or Month write. It includes signed Card openings, unlinked Cards, credits, refunds, splits, transfers, assignments, edits, deletes and underfunded/overspent Months. Forty-eight independent BigInt register histories and forty-eight transfer-date paging histories also passed. 2. Cleared-only number invariants, constant SQL write counts and exact two-toggle source-byte restoration passed. 3. Twenty-five source-write/publication SIGKILL points passed, including killing after acknowledged writes. A separate kill while the actual projection transaction held the writer lock recovered correctly and idempotently. B3 remains the live-read failure case. 4. Byte-bounded pages, an oversized single row, deleted anchors and concurrent inserts passed; unchanged transactions remained reachable exactly once. 5. Notes crate tests passed: Money sources stayed unchanged and ordinary Notes in the same Home were processed. 6. Shared-Index User isolation passed for reads, writes and signed cursors, including bounded cold repair. A real TCP handler round passed malformed/oversized inputs, traversal/Unicode probes, the 101-Tag rejection and a concurrent read burst. Prior fixes B1, B2, N1, N2 and directory-source rejection all passed. Migration 0004 upgrade from populated legacy register projections passed. A kill during migration rolled back rows and receipt; retry retained the pending intent and sources, rebuilt correctly and remained idempotent. Gate provenance: The requested three-crate run used transient expanded review probes. All original tests passed. Two new probe assumptions failed: overlong synthetic Tag labels hit an existing length guard first, and a cold foreign cleared route needed the build worker before its final 404. Corrected focused probes passed; these transient probes were then removed. No existing expectation changed. The two retained real defects were tested separately and together at final HEAD. The full three-crate command therefore returned nonzero; it is not reported as a green gate. Commands: - cargo test -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes --no-fail-fast -- --test-threads=4 - cargo fmt --check (exit 0, no output) - cargo clippy -p calternal-plugin-money --all-targets -- -D warnings - cargo test -p calternal-plugin-money review688rev2_ -- --test-threads=1 All used CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0 and the worktree target/tmp. No web code changed. Verbatim three-crate result lines (full log: artifacts/rev2-three-crate-gate.log): ``` test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.31s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.17s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.89s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.40s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 180 filtered out; finished in 40.26s test result: FAILED. 175 passed; 2 failed; 4 ignored; 0 measured; 0 filtered out; finished in 3649.87s error: test failed, to rerun pass `-p calternal-plugin-money --lib` test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 5.64s test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 185.31s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.92s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s error: 1 target failed: ``` Verbatim corrected transient probe result: ``` test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 175 filtered out; finished in 5.27s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 32 filtered out; finished in 0.00s ``` Verbatim final HEAD focused gate: ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 0.40s Running unittests src/lib.rs (/home/kayg/build/targets/money688rev2/debug/deps/calternal_plugin_money-369d9e0370502d5a) running 2 tests test routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers ... FAILED test routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup ... FAILED failures: ---- routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers stdout ---- thread 'routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers' (1826788) panicked at crates/plugins/money/src/register_contract_tests.rs:1168:9: warm reads kept stale Account numbers after source committed and projection publication failed note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace ---- routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup stdout ---- thread 'routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup' (1826866) panicked at crates/plugins/money/src/register_contract_tests.rs:1218:9: valid file-local IDs with colliding visible transfer legs stopped startup recovery failures: routes::register_contract_tests::review688rev2_failed_publication_cannot_serve_stale_numbers routes::register_contract_tests::review688rev2_visible_leg_collision_cannot_stop_startup test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 175 filtered out; finished in 3.01s error: test failed, to rerun pass `-p calternal-plugin-money --lib` ``` Verbatim final clippy completion: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 10.62s ``` Known gaps: physical power loss was not simulated. User principals were supplied by the test harness; full sign-in middleware was not retested. Files refresh probes used rooted source changes and actual adoption events rather than the full Files HTTP pipeline. Finite generators are not exhaustive. No wrong arithmetic, lost acknowledged write or cross-User effect was found in the passing scenarios. B3 and B4 remain unfixed because this job is read-mostly. Decisions: no new product design decisions. Retained only failing defect regressions; removed passing exploratory probes as required. Existing file-local identity and retained transfer-leg date contracts determine B4’s expected behavior. Cleanup: cargo clean completed; web build output removed if present. Verbatim cleanup: ``` Removed 8680 files, 6.0GiB total ``` Evidence: artifacts/money688rev2-findings.md. No secrets or real financial data are included. No review artifacts committed.
kayg commented 2026-10-10 13:01:18 +00:00
Author
Owner
Copy link

money688k started on job/money-688 at 77a46a0dd9. Read the binding project rules, DESIGN §§48,58,59, issue and round-2 findings. Scope: fix B3 pending-intent read fencing and B4 file-local register identity; preserve committed review regressions. No UI or dependency changes planned.

money688k started on job/money-688 at 77a46a0dd91a74bed12fb6e5f14f0471a140a1af. Read the binding project rules, DESIGN §§48,58,59, issue and round-2 findings. Scope: fix B3 pending-intent read fencing and B4 file-local register identity; preserve committed review regressions. No UI or dependency changes planned.
kayg commented 2026-10-10 13:08:30 +00:00
Author
Owner
Copy link

B3 FIXED in 66126a9ee: route reads check the existing FULL intent joined to retained Budget metadata. Pending reads reuse the bounded worker, which settles journal recovery before warm generation reuse. Page reads fence intent in their WAL snapshot. The committed B3 regression passes.

B4 FIXED in 68dcab19a: source Month is part of SQL uniqueness, all keyset positions and payload joins, chronological prefix queries, and incremental mutation maps. Migration 0005 discards only Derived data and preserves sources and intents. Both original round-2 tests and all prior review688_* tests pass; new populated-0004 upgrade and colliding forward/backward paging plus incremental/full equivalence tests pass.

Focused result (verbatim):

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 170 filtered out; finished in 4.54s

Final refresh: git fetch origin and git merge origin/dev returned Already up to date. Origin/dev is dbd621434d; it has no Money register migrations, so 0005 is free. Required four-crate and web gates are running.

Decisions: use source Month as the final tie breaker after visible date, transaction ID and Account; add source_month to row replies and signed cursors. Older cursor encodings without file scope are rejected. Migration 0005 rebuilds obsolete Derived data lazily, except existing pending intents recover at startup. Expected cost: healthy warm read adds one indexed owner/Budget intent lookup; missing/unpublished generations rebuild from source with the existing bounded worker. No source scan on a healthy warm read. No UI or dependencies changed.

B3 FIXED in 66126a9ee: route reads check the existing FULL intent joined to retained Budget metadata. Pending reads reuse the bounded worker, which settles journal recovery before warm generation reuse. Page reads fence intent in their WAL snapshot. The committed B3 regression passes. B4 FIXED in 68dcab19a: source Month is part of SQL uniqueness, all keyset positions and payload joins, chronological prefix queries, and incremental mutation maps. Migration 0005 discards only Derived data and preserves sources and intents. Both original round-2 tests and all prior review688_* tests pass; new populated-0004 upgrade and colliding forward/backward paging plus incremental/full equivalence tests pass. Focused result (verbatim): ``` test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 170 filtered out; finished in 4.54s ``` Final refresh: git fetch origin and git merge origin/dev returned `Already up to date.` Origin/dev is dbd621434d0a1133f16230cca5c6a83af0d8aed3; it has no Money register migrations, so 0005 is free. Required four-crate and web gates are running. Decisions: use source Month as the final tie breaker after visible date, transaction ID and Account; add source_month to row replies and signed cursors. Older cursor encodings without file scope are rejected. Migration 0005 rebuilds obsolete Derived data lazily, except existing pending intents recover at startup. Expected cost: healthy warm read adds one indexed owner/Budget intent lookup; missing/unpublished generations rebuild from source with the existing bounded worker. No source scan on a healthy warm read. No UI or dependencies changed.
kayg commented 2026-10-10 13:26:13 +00:00
Author
Owner
Copy link

Head 8b6c24d4cb. B3/B4 focused regressions, all prior review688_* checks, the new upgrade/paging tests, source-free retained reads, incremental BigInt and real TCP SIGKILL recovery pass in the full Money test run. Two property tests still run: scoped_histories_equal_full_replay and card_models_ignore_arrival_batch_and_timezone. No failure reported; Notes and server tests remain queued, one crate at a time.

Completed gates (verbatim):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 36.64s
perf-lint: PASS; 0 violations; 22131 scoped exceptions
svelte-check found 0 errors and 3 warnings in 1 file
 Test Files  312 passed (312)
      Tests  2277 passed (2277)
   Duration  321.20s (transform 29%, environment 25%, import 21%, tests 19%, setup 6%)

The initial clippy attempt needed missing real production web assets; bun run build supplied them and the final four-crate command passed. The initial web check needed exact capability pins for the new intent lookup; refreshed pins pass with no guard, debt or ratchet change. A static client identity finding is filed as #1537, separate from the retained SQL/startup B4 fix. No UI code changed.

Head 8b6c24d4cb01de7c65939d029c9b518591cc613d. B3/B4 focused regressions, all prior review688_* checks, the new upgrade/paging tests, source-free retained reads, incremental BigInt and real TCP SIGKILL recovery pass in the full Money test run. Two property tests still run: scoped_histories_equal_full_replay and card_models_ignore_arrival_batch_and_timezone. No failure reported; Notes and server tests remain queued, one crate at a time. Completed gates (verbatim): ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 36.64s perf-lint: PASS; 0 violations; 22131 scoped exceptions svelte-check found 0 errors and 3 warnings in 1 file Test Files 312 passed (312) Tests 2277 passed (2277) Duration 321.20s (transform 29%, environment 25%, import 21%, tests 19%, setup 6%) ``` The initial clippy attempt needed missing real production web assets; bun run build supplied them and the final four-crate command passed. The initial web check needed exact capability pins for the new intent lookup; refreshed pins pass with no guard, debt or ratchet change. A static client identity finding is filed as #1537, separate from the retained SQL/startup B4 fix. No UI code changed.
kayg commented 2026-10-10 13:59:06 +00:00
Author
Owner
Copy link

Additional B4 finding confirmed and fixed in 83c2d4416. The request-local mark updater selected register rows by transaction ID across all files while its Ledger contained one Month. The new review688k_partial_marks_preserve_other_file_identities regression failed because a different Month's retained row disappeared. This is an internal updater regression; the existing public cleared route rejects globally ambiguous primary IDs and that status behavior is unchanged.

The fix binds source Month in partial row selection and search publication, uses source_month for source lookup, and orders the identity index for ID+Month seeks. The current partial Month cannot delete, shift or reindex another file's local ID. Existing Category memberships remain. The test checks preserved row identity/payload/prefix, search, Categories and full replay equivalence.

Verbatim focused completion:

test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 170 filtered out; finished in 5.60s
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 9.55s

First full server gate found an exact upgrade-inventory mismatch from the requested Money 0005 migration: fixture inventory/frontier/total still expected 0004. Updating only the pending 0005 entry, Money frontier and total +1 is required by this issue's explicit schema change. Deployed fixture SQL and all receipt/data preservation assertions stay unchanged. Focused upgrade validation is running. The same full server run also reported a 90-second eventual Notes backfill completion timeout; that expectation and timeout remain unchanged. The necessary server rerun will retain that failure in its provenance.

Additional B4 finding confirmed and fixed in 83c2d4416. The request-local mark updater selected register rows by transaction ID across all files while its Ledger contained one Month. The new review688k_partial_marks_preserve_other_file_identities regression failed because a different Month's retained row disappeared. This is an internal updater regression; the existing public cleared route rejects globally ambiguous primary IDs and that status behavior is unchanged. The fix binds source Month in partial row selection and search publication, uses source_month for source lookup, and orders the identity index for ID+Month seeks. The current partial Month cannot delete, shift or reindex another file's local ID. Existing Category memberships remain. The test checks preserved row identity/payload/prefix, search, Categories and full replay equivalence. Verbatim focused completion: ``` test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 170 filtered out; finished in 5.60s Finished `dev` profile [unoptimized + debuginfo] target(s) in 9.55s ``` First full server gate found an exact upgrade-inventory mismatch from the requested Money 0005 migration: fixture inventory/frontier/total still expected 0004. Updating only the pending 0005 entry, Money frontier and total +1 is required by this issue's explicit schema change. Deployed fixture SQL and all receipt/data preservation assertions stay unchanged. Focused upgrade validation is running. The same full server run also reported a 90-second eventual Notes backfill completion timeout; that expectation and timeout remain unchanged. The necessary server rerun will retain that failure in its provenance.
kayg commented 2026-10-10 14:16:58 +00:00
Author
Owner
Copy link

Final gate progress at 3a02e560f6:

  • cargo fmt --check: exit 0, no output.
  • Four-crate clippy: Finished dev profile [unoptimized + debuginfo] target(s) in 22.19s.
  • Web check: perf-lint: PASS; 0 violations; 22131 scoped exceptions; svelte-check found 0 errors and 3 warnings in 1 file.
  • The exact cleared-action syntax hash changed after source Month lookup. The existing exception count, debt limit, expiry and owner are unchanged. No guard rule or ratchet changed.
  • Full Money rerun includes successful B3/B4, populated-0004 upgrade, colliding-leg paging, partial-Month mark isolation and SIGKILL recovery regressions. Large-data tests are still running; the full server suite follows.
  • Server upgrade inventory, frontier and exact receipt count now explicitly include Money 0005. Deployed fixture data and original review assertions are unchanged. The first server run also exceeded an unchanged 90-second Notes backfill deadline; the final run will determine its status.
Final gate progress at 3a02e560f6fc84164b7b41fbfdf7928f4c31c660: - cargo fmt --check: exit 0, no output. - Four-crate clippy: `Finished `dev` profile [unoptimized + debuginfo] target(s) in 22.19s`. - Web check: `perf-lint: PASS; 0 violations; 22131 scoped exceptions`; `svelte-check found 0 errors and 3 warnings in 1 file`. - The exact cleared-action syntax hash changed after source Month lookup. The existing exception count, debt limit, expiry and owner are unchanged. No guard rule or ratchet changed. - Full Money rerun includes successful B3/B4, populated-0004 upgrade, colliding-leg paging, partial-Month mark isolation and SIGKILL recovery regressions. Large-data tests are still running; the full server suite follows. - Server upgrade inventory, frontier and exact receipt count now explicitly include Money 0005. Deployed fixture data and original review assertions are unchanged. The first server run also exceeded an unchanged 90-second Notes backfill deadline; the final run will determine its status.
kayg commented 2026-10-10 14:26:58 +00:00
Author
Owner
Copy link

B3 FIXED. B4 FIXED. Head: 3a02e560f6. Branch: job/money-688.

Built:

  • B3: pending FULL source intent fences warm route reads and page snapshots. The bounded worker settles recovery before using retained numbers.
  • B4: source Month scopes row uniqueness, indexes, prefix order, delta maps, cursor positions and payload joins. Migration 0005 removes obsolete Derived data and preserves source files and intents.
  • Scoped partial-Month mark publication and search/category indexing to the selected source file. Other files with the same ID retain their rows and prefixes.
  • Added populated-0004 upgrade and colliding-leg forward/backward paging plus incremental/full and partial-Month mark regression tests. Both committed round-2 regressions and their expectations stay unchanged.
  • Extended the existing benchmark with serial and 32-read Account burst CPU/RSS. Refreshed exact performance capability bindings. No guard rule, exception count, limit or ratchet changed. The existing cleared-handler exception retains its debt limit; only its exact syntax hash is refreshed.

Files:

  • crates/plugins/money/src/{register.rs,routes.rs,views.rs,lib.rs,register_contract_tests.rs}
  • crates/plugins/money/migrations/0005_register_file_identity.sql
  • crates/calternal-server/src/upgrade_tests.rs
  • contracts/perf/{registry.json,exceptions.json}
  • bench/money-register-688.mjs

Atomic commits: 66126a9ee (B3), 68dcab19a (B4 and upgrade/paging tests), 8b6c24d4c (performance bindings/profile), 83c2d4416 (partial-Month mark isolation), c71186701 (server upgrade receipt inventory), 3a02e560f (exact mutation pin).

Final refresh: git fetch origin and git merge origin/dev ran once. Output: Already up to date. Origin/dev: dbd621434d. Origin/dev has no Money register migrations; 0005 is free.

Gates used CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0, CARGO_BUILD_JOBS=4 and TMPDIR=/target/tmp. Rust tests ran one crate at a time with --test-threads=4. No target override.

Gate provenance: the first web check failed on exact capability pins for the new source-intent read. Pins were refreshed with enabled regressions as evidence; the final check passes. Initial server clippy failed because apps/web/build was absent. A real production web build supplied the embedded assets; final clippy passes. These failures are retained in artifacts/money688k-final-web-check.log and artifacts/money688k-final-clippy.log. The new partial-Month regression failed before the fix and passes after it. Initial server tests found the exact upgrade inventory, frontier and receipt count still expected four Money migrations; they now explicitly include the authorized fifth migration. Original review regressions and deployed-data assertions are unchanged. The first full server run also exceeded an unchanged 90-second Notes backfill deadline; the final rerun is reported below.

cargo fmt --check: exit 0, no output.

cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes -p calternal-server --all-targets -- -D warnings (verbatim completion output):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 22.19s

Full log: artifacts/money688k-final-clippy-last.log

cargo test -p calternal-money -- --test-threads=4 (verbatim completion output):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 14.49s
test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.25s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.18s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.87s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.36s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.50s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Full log: artifacts/money688k-final-calternal-money-test.log

cargo test -p calternal-plugin-money -- --test-threads=4 (verbatim completion output):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 24.05s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 179 filtered out; finished in 33.24s
test result: ok. 177 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1254.48s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 5.05s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Full log: artifacts/money688k-final-calternal-plugin-money-test-last.log

cargo test -p calternal-plugin-notes -- --test-threads=4 (verbatim completion output):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 27s
test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 196.43s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.75s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Full log: artifacts/money688k-final-calternal-plugin-notes-test.log

cargo test -p calternal-server -- --test-threads=4 (verbatim completion output):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 21s
test result: ok. 276 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 104.39s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 25.98s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s

Full log: artifacts/money688k-final-calternal-server-test-last.log

cd apps/web && bun run check (verbatim completion output):

perf-lint: PASS; 0 violations; 22131 scoped exceptions
svelte-check found 0 errors and 3 warnings in 1 file

Full log: artifacts/money688k-final-web-check-last-retry.log

cd apps/web && bun run test --maxWorkers=2 (verbatim completion output):

 8 pass
 0 fail
Ran 8 tests across 1 file. [401.00ms]
 Test Files  312 passed (312)
      Tests  2277 passed (2277)
   Duration  321.20s (transform 29%, environment 25%, import 21%, tests 19%, setup 6%)

Full log: artifacts/money688k-final-web-test.log

Regression evidence: all review688_* and review688rev2_* tests pass, including B3/B4, prior transfer-date, Files invalidation, Category membership, cleared-byte restoration and directory-source recovery tests. The new review688k_* upgrade and collision tests pass. Source-free reads, incremental BigInt prefixes, full replay, #1393 and real TCP SIGKILL recovery are included in the crate suites. This is the focused real-server regression round; no new endpoint was added.

UX gaps closed: successful warm reads cannot retain old Account numbers after failed publication; legal file-local visible-leg collisions cannot stop startup recovery or collapse retained SQL paging/update identities.

Known gaps / UX gaps left: static client identity assumptions were filed separately as #1537 (kayg/calternal#1537). The Account screen still uses ID+Account row keys and ID-only action/link addressing. No browser crash or wrong client write was reproduced in this backend round. No UI code changed. Physical power loss was not simulated. Finite property generators are not exhaustive. No production timing run was performed in this repair round.

Decisions: add source Month as the final tie breaker after visible date, transaction ID and Account. Return source_month in transaction replies and sign it into cursors. Reject old cursor payloads without file scope. Use a new 0005 migration; keep deployed 0004 unchanged. Rebuild old Derived data lazily; startup drains only retained pending intents. Reuse the durability journal and existing bounded worker instead of adding a separate dirty-state mechanism.

Expected cost: a healthy warm route adds one indexed owner/Budget EXISTS lookup, independent of source row count. A retained page adds one intent check in its WAL snapshot. Recovery reuses O(N log N) lightweight leg ordering and O(N) projection writes in 128-row batches. No healthy warm source scan was added. Existing benchmark fixtures cover 50,000 and 200,000 rows; the new phase measures serial and 32-read summary bursts. Partial mark publication seeks by transaction ID and source Month; it preserves rows and search/category memberships in other files. No matching measured baseline or regression ratio is claimed.

For the merge round: production release builds, full e2e/adversarial matrices and production performance runs remain there under the verification policy. Run cd apps/web && bun run test:e2e:money against the merged build to confirm Account navigation and Money interactions. After copying the merged release binary to perf-test, run perf-run calternal money688k 20 -- env MONEY688_ROWS=50000,200000 bun bench/money-register-688.mjs with CALTERNAL_SERVER_BIN and MONEY688_REVISION set to that copied build. It must measure p50/p95, CPU/RSS and the 32-read burst, retaining failed samples and comparing only a matching docs/perf/baseline.json fixture. For the focused real-server API probe, use perf-run calternal money688k-api 10 -- env MONEY688_ROWS=10000 MONEY688_API_PROBE_ONLY=1 bun bench/money-register-688.mjs with the same copied build. No macOS VM was used.

Re-read module and changed function comments before this report. No dependencies changed, so no version update was needed. No secrets, real financial data, screenshots or review artifacts committed. No push, deploy or merge other than the authorized origin/dev refresh.

Cleanup (verbatim):

     Removed 20080 files, 15.6GiB total

Web build output removed. Working tree clean.

B3 FIXED. B4 FIXED. Head: 3a02e560f6fc84164b7b41fbfdf7928f4c31c660. Branch: job/money-688. Built: - B3: pending FULL source intent fences warm route reads and page snapshots. The bounded worker settles recovery before using retained numbers. - B4: source Month scopes row uniqueness, indexes, prefix order, delta maps, cursor positions and payload joins. Migration 0005 removes obsolete Derived data and preserves source files and intents. - Scoped partial-Month mark publication and search/category indexing to the selected source file. Other files with the same ID retain their rows and prefixes. - Added populated-0004 upgrade and colliding-leg forward/backward paging plus incremental/full and partial-Month mark regression tests. Both committed round-2 regressions and their expectations stay unchanged. - Extended the existing benchmark with serial and 32-read Account burst CPU/RSS. Refreshed exact performance capability bindings. No guard rule, exception count, limit or ratchet changed. The existing cleared-handler exception retains its debt limit; only its exact syntax hash is refreshed. Files: - crates/plugins/money/src/{register.rs,routes.rs,views.rs,lib.rs,register_contract_tests.rs} - crates/plugins/money/migrations/0005_register_file_identity.sql - crates/calternal-server/src/upgrade_tests.rs - contracts/perf/{registry.json,exceptions.json} - bench/money-register-688.mjs Atomic commits: 66126a9ee (B3), 68dcab19a (B4 and upgrade/paging tests), 8b6c24d4c (performance bindings/profile), 83c2d4416 (partial-Month mark isolation), c71186701 (server upgrade receipt inventory), 3a02e560f (exact mutation pin). Final refresh: git fetch origin and git merge origin/dev ran once. Output: `Already up to date.` Origin/dev: dbd621434d0a1133f16230cca5c6a83af0d8aed3. Origin/dev has no Money register migrations; 0005 is free. Gates used CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0, CARGO_BUILD_JOBS=4 and TMPDIR=<worktree>/target/tmp. Rust tests ran one crate at a time with --test-threads=4. No target override. Gate provenance: the first web check failed on exact capability pins for the new source-intent read. Pins were refreshed with enabled regressions as evidence; the final check passes. Initial server clippy failed because apps/web/build was absent. A real production web build supplied the embedded assets; final clippy passes. These failures are retained in artifacts/money688k-final-web-check.log and artifacts/money688k-final-clippy.log. The new partial-Month regression failed before the fix and passes after it. Initial server tests found the exact upgrade inventory, frontier and receipt count still expected four Money migrations; they now explicitly include the authorized fifth migration. Original review regressions and deployed-data assertions are unchanged. The first full server run also exceeded an unchanged 90-second Notes backfill deadline; the final rerun is reported below. cargo fmt --check: exit 0, no output. cargo clippy -p calternal-money -p calternal-plugin-money -p calternal-plugin-notes -p calternal-server --all-targets -- -D warnings (verbatim completion output): ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 22.19s ``` Full log: artifacts/money688k-final-clippy-last.log cargo test -p calternal-money -- --test-threads=4 (verbatim completion output): ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 14.49s test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.25s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.18s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.87s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.36s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.50s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Full log: artifacts/money688k-final-calternal-money-test.log cargo test -p calternal-plugin-money -- --test-threads=4 (verbatim completion output): ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 24.05s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 179 filtered out; finished in 33.24s test result: ok. 177 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1254.48s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 5.05s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Full log: artifacts/money688k-final-calternal-plugin-money-test-last.log cargo test -p calternal-plugin-notes -- --test-threads=4 (verbatim completion output): ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 27s test result: ok. 326 passed; 0 failed; 5 ignored; 0 measured; 0 filtered out; finished in 196.43s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.75s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Full log: artifacts/money688k-final-calternal-plugin-notes-test.log cargo test -p calternal-server -- --test-threads=4 (verbatim completion output): ``` Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 21s test result: ok. 276 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 104.39s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 25.98s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s ``` Full log: artifacts/money688k-final-calternal-server-test-last.log cd apps/web && bun run check (verbatim completion output): ``` perf-lint: PASS; 0 violations; 22131 scoped exceptions svelte-check found 0 errors and 3 warnings in 1 file ``` Full log: artifacts/money688k-final-web-check-last-retry.log cd apps/web && bun run test --maxWorkers=2 (verbatim completion output): ``` 8 pass 0 fail Ran 8 tests across 1 file. [401.00ms] Test Files 312 passed (312) Tests 2277 passed (2277) Duration 321.20s (transform 29%, environment 25%, import 21%, tests 19%, setup 6%) ``` Full log: artifacts/money688k-final-web-test.log Regression evidence: all review688_* and review688rev2_* tests pass, including B3/B4, prior transfer-date, Files invalidation, Category membership, cleared-byte restoration and directory-source recovery tests. The new review688k_* upgrade and collision tests pass. Source-free reads, incremental BigInt prefixes, full replay, #1393 and real TCP SIGKILL recovery are included in the crate suites. This is the focused real-server regression round; no new endpoint was added. UX gaps closed: successful warm reads cannot retain old Account numbers after failed publication; legal file-local visible-leg collisions cannot stop startup recovery or collapse retained SQL paging/update identities. Known gaps / UX gaps left: static client identity assumptions were filed separately as #1537 (https://git.kayg.org/kayg/calternal/issues/1537). The Account screen still uses ID+Account row keys and ID-only action/link addressing. No browser crash or wrong client write was reproduced in this backend round. No UI code changed. Physical power loss was not simulated. Finite property generators are not exhaustive. No production timing run was performed in this repair round. Decisions: add source Month as the final tie breaker after visible date, transaction ID and Account. Return source_month in transaction replies and sign it into cursors. Reject old cursor payloads without file scope. Use a new 0005 migration; keep deployed 0004 unchanged. Rebuild old Derived data lazily; startup drains only retained pending intents. Reuse the durability journal and existing bounded worker instead of adding a separate dirty-state mechanism. Expected cost: a healthy warm route adds one indexed owner/Budget EXISTS lookup, independent of source row count. A retained page adds one intent check in its WAL snapshot. Recovery reuses O(N log N) lightweight leg ordering and O(N) projection writes in 128-row batches. No healthy warm source scan was added. Existing benchmark fixtures cover 50,000 and 200,000 rows; the new phase measures serial and 32-read summary bursts. Partial mark publication seeks by transaction ID and source Month; it preserves rows and search/category memberships in other files. No matching measured baseline or regression ratio is claimed. For the merge round: production release builds, full e2e/adversarial matrices and production performance runs remain there under the verification policy. Run `cd apps/web && bun run test:e2e:money` against the merged build to confirm Account navigation and Money interactions. After copying the merged release binary to perf-test, run `perf-run calternal money688k 20 -- env MONEY688_ROWS=50000,200000 bun bench/money-register-688.mjs` with CALTERNAL_SERVER_BIN and MONEY688_REVISION set to that copied build. It must measure p50/p95, CPU/RSS and the 32-read burst, retaining failed samples and comparing only a matching docs/perf/baseline.json fixture. For the focused real-server API probe, use `perf-run calternal money688k-api 10 -- env MONEY688_ROWS=10000 MONEY688_API_PROBE_ONLY=1 bun bench/money-register-688.mjs` with the same copied build. No macOS VM was used. Re-read module and changed function comments before this report. No dependencies changed, so no version update was needed. No secrets, real financial data, screenshots or review artifacts committed. No push, deploy or merge other than the authorized origin/dev refresh. Cleanup (verbatim): ``` Removed 20080 files, 15.6GiB total ``` Web build output removed. Working tree clean.
kayg commented 2026-10-10 14:29:26 +00:00
Author
Owner
Copy link

Independent number-correctness and data-safety review, round 3. Branch job/money-688; head 3a02e560f6; base origin/dev dbd621434d. Read-mostly; retain only failing defect tests. Checking B3/B4, migration 0005 interruption, full replay, SIGKILL and User isolation. Time box 90 minutes. No push, deploy or product-code changes.

Independent number-correctness and data-safety review, round 3. Branch job/money-688; head 3a02e560f6fc84164b7b41fbfdf7928f4c31c660; base origin/dev dbd621434d0a1133f16230cca5c6a83af0d8aed3. Read-mostly; retain only failing defect tests. Checking B3/B4, migration 0005 interruption, full replay, SIGKILL and User isolation. Time box 90 minutes. No push, deploy or product-code changes.
kayg commented 2026-10-10 14:36:44 +00:00
Author
Owner
Copy link

Round-3 finding B5 / incomplete B4 mutation surface: two valid Month sources reuse a file-local transaction ID. The production register lists the September source first with source_month=2026-09. A normal ID-only PUT backdating that displayed row into July returns HTTP 200, but moves the August source row; the selected September file stays byte-identical. editable() still takes the first matching ID across the whole Ledger; edit input has no selected source Month. This is inherited on origin/dev, but fails the requested file-local mutation data-safety acceptance. Retaining a failing regression only; no product change. Actual migration-0005 SIGKILL/rollback/retry and signed legacy cursor rejection passed. No source contents or amounts included.

Round-3 finding B5 / incomplete B4 mutation surface: two valid Month sources reuse a file-local transaction ID. The production register lists the September source first with source_month=2026-09. A normal ID-only PUT backdating that displayed row into July returns HTTP 200, but moves the August source row; the selected September file stays byte-identical. editable() still takes the first matching ID across the whole Ledger; edit input has no selected source Month. This is inherited on origin/dev, but fails the requested file-local mutation data-safety acceptance. Retaining a failing regression only; no product change. Actual migration-0005 SIGKILL/rollback/retry and signed legacy cursor rejection passed. No source contents or amounts included.
kayg commented 2026-10-10 14:47:26 +00:00
Author
Owner
Copy link

Round-3 additional finding N1 (error class, no wrong-number claim): on the linked production Plugin, an INSERT ABORT after a durable source PUT leaves pending intent. An Account GET queues repair and returns 503. After the worker fails and the SQL fault trigger is dropped, the next healthy Account GET returns 500 Internal Server Error from the queued Failure. Explicit recovery then returns source-correct 200. This fails the brief’s strict explicit-retryable-read requirement; no stale successful model or source loss occurred. B5 remains the data-safety BLOCK and is committed as 2d03ef517c. B5 also reproduced over real production TCP. Three-file colliding-ID paging and fresh-Index traversal passed. Product code remains unchanged.

Round-3 additional finding N1 (error class, no wrong-number claim): on the linked production Plugin, an INSERT ABORT after a durable source PUT leaves pending intent. An Account GET queues repair and returns 503. After the worker fails and the SQL fault trigger is dropped, the next healthy Account GET returns 500 Internal Server Error from the queued Failure. Explicit recovery then returns source-correct 200. This fails the brief’s strict explicit-retryable-read requirement; no stale successful model or source loss occurred. B5 remains the data-safety BLOCK and is committed as 2d03ef517c337150b1bb7a52b8193af4b172eb3f. B5 also reproduced over real production TCP. Three-file colliding-ID paging and fresh-Index traversal passed. Product code remains unchanged.
kayg commented 2026-10-10 15:12:39 +00:00
Author
Owner
Copy link

BLOCK — B5 (wrong-source transaction edit). N1 also fails the strict retryable-read status requirement. Independent number-correctness and data-safety review of #688, round 3. No product code changed.

Built: one failing mutation-identity regression, committed atomically as 2d03ef517c (test(money): expose wrong-source edits for file-local IDs).
Files: crates/plugins/money/src/register_contract_tests.rs; ignored evidence and transient probes in artifacts/money688rev3-findings.md and artifacts/money688rev3-*.log/.rs. Existing test expectations, dependencies and migrations are unchanged.
Head: 2d03ef517c. Branch job/money-688. The one required origin/dev refresh/merge returned Already up to date. No push or deploy.

B5 — a successful edit moves the wrong source row.
Two valid Month files reuse one transaction ID. A register GET returns both source identities, with the September row first. A normal ID-only PUT backdating that selected row into July returns 200 but moves the August row; the September file stays byte-identical. Reproduced with same and different Accounts, then independently over real TCP using the linked production Plugin. Ambiguous cleared and delete requests return clean 4xx and preserve both files. editable() still chooses the first ID match across the Ledger; edit input does not bind the selected source Month. The resolver also exists on origin/dev: this is an inherited data-safety defect that fails the requested B4 mutation acceptance, not a new register SQL identity defect. The retained regression allows safe ambiguity refusal.

N1 — a healthy read can surface a queued 500 after the fault clears.
A deliberate SQLite INSERT ABORT happens after a source PUT is durable. The first Account GET queues repair and returns 503. After the worker fails and the trigger is dropped, the next healthy Account GET returns 500 Internal Server Error from the queued Failure. Explicit recovery returns current source-correct 200. No stale successful numbers or source loss occurred. This is an error-class gap in the requested explicit-retryable-read requirement; the deliberate source-write error itself is expected fault instrumentation. Filed on #688.

Completed focused checks:

  • B3 successful-number fencing: production Account and register successes equal current source values; Month and Ready to Assign equal independent full replay during the publication fault. After explicit recovery, source bytes stay unchanged and Account/register values match replay. The production integration probe avoids the cfg(test) cold-build shim. The strict retryable-status outcome has the N1 gap above.
  • Original B3/B4 regressions, file-scoped visible-leg paging/update and partial-Month marks pass.
  • Independent three-file collision paging: every identity appears once in All accounts and both Account registers, including an ordinary row and a transfer destination with the same visible date/ID/Account. A fresh linked Plugin/MoneyIndex reaches the same identities.
  • Actual migration 0005 API transaction killed with SIGKILL after old search and Category deletes. Two busy-writer observations 100 ms apart establish the kill point. Rollback retains committed 0004 rows, pending FULL intent and no version-5 receipt. Retry rebuilds exact Account/page models versus cold replay and preserves source bytes; repeated migration/recovery stays inert. A correctly signed, reconstructed pre-0005 cursor is rejected with HTTP 400. Its payload shape was checked against pre-fix code.
  • Twenty-five production source/publication SIGKILL points across create/edit/delete/cleared/cross-month moves pass, including acknowledged writes and repeated recovery.
  • Independent BigInt register sequences and paging pass.
  • Expanded fixed-seed generator passes 128 histories, 24–39 operations each, comparing all six Months to full source replay after every changed physical Budget or Month write, including intermediate writes within a logical operation. It covers #1393 signed Card openings, missing payment links, positive credit, refunds, splits, transfers, Assignments, edits, deletes, underfunding and rollover.
  • Shared-Index User isolation passes for Account/register/Month reads, signed foreign cursor rejection, no-data-scope refusals, and another User's same-ID cleared write. Owner source files and foreign models remain unchanged as required. Test principals supply identity; full sign-in middleware is not retested.

Gate provenance: an initial gate attempt compiled a temporary probe while it was being edited and failed on the new probe's incorrect month_view argument order. That probe was removed and replaced with a production-linked integration probe. A new oracle initially used the month string as the Budget name; corrected it to the real source title. A temporary paging probe needed an explicit Option cursor type. No existing expectation or product behavior changed. The final main gate runs only original tests and the committed failing B5 regression. Passing transient probes are removed from tracked sources and retained under ignored artifacts.

Known gaps: no physical power-loss experiment; migration used populated synthetic legacy projections and a reconstructed signed old cursor, not an old server binary; production HTTP probes used test principals and do not retest the full sign-in layer; finite histories are not exhaustive. B5 and N1 remain unfixed because this review is read-mostly. No UI change, screenshot or performance claim is made.

Decisions: no product design decisions. Use safe refusal as an acceptable result for ambiguous legacy ID-only writes; a successful write must bind its intended source identity. Retain only a failing real-defect regression, and restore passing exploratory probes.

Final gate result: the original 256-history scoped generator passes. The only failing test in the completed two-crate gate is the committed B5 regression. Exit 101 is expected for this retained defect test; this is not a green gate. All original tests pass.

Commands (preset CARGO_TARGET_DIR was preserved; all cargo commands use CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0, TMPDIR=/target/tmp):

  • cargo fmt --check: exit 0, no output.
  • cargo clippy -p calternal-plugin-money --all-targets -- -D warnings: exit 0.
  • cargo test -p calternal-money -p calternal-plugin-money --no-fail-fast -- --test-threads=4: exit 101, B5 only.

Verbatim clippy completion:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 02s

Verbatim completed two-crate gate result lines (includes one child-run result):

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.88s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.56s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.85s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.04s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 180 filtered out; finished in 28.60s
test result: FAILED. 177 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1695.89s
error: test failed, to rerun pass `-p calternal-plugin-money --lib`
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.45s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
error: 1 target failed:
    `-p calternal-plugin-money --lib`

Focused probe result lines, verbatim:

  • Main regression:
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 180 filtered out; finished in 4.20s
  • Expanded per-source-write generator plus migration and known regression:
test result: FAILED. 2 passed; 1 failed; 1 ignored; 0 measured; 180 filtered out; finished in 1613.32s
  • Production successful-number fencing and User isolation:
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.97s
  • Independent colliding-file production paging/restart:
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 2.85s
  • Twenty-five SIGKILL durability cases:
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 183 filtered out; finished in 56.22s

Cleanup: cargo clean succeeded; web build/output directories were already absent. Working tree is clean. No review artifacts committed. No secrets or real financial data are included. Review completed within the 90-minute time box.

     Removed 5849 files, 2.4GiB total

Evidence: artifacts/money688rev3-findings.md; complete gate log artifacts/money688rev3-final-gates.log.

BLOCK — B5 (wrong-source transaction edit). N1 also fails the strict retryable-read status requirement. Independent number-correctness and data-safety review of #688, round 3. No product code changed. Built: one failing mutation-identity regression, committed atomically as 2d03ef517c337150b1bb7a52b8193af4b172eb3f (`test(money): expose wrong-source edits for file-local IDs`). Files: crates/plugins/money/src/register_contract_tests.rs; ignored evidence and transient probes in artifacts/money688rev3-findings.md and artifacts/money688rev3-*.log/.rs. Existing test expectations, dependencies and migrations are unchanged. Head: 2d03ef517c337150b1bb7a52b8193af4b172eb3f. Branch job/money-688. The one required origin/dev refresh/merge returned `Already up to date.` No push or deploy. B5 — a successful edit moves the wrong source row. Two valid Month files reuse one transaction ID. A register GET returns both source identities, with the September row first. A normal ID-only PUT backdating that selected row into July returns 200 but moves the August row; the September file stays byte-identical. Reproduced with same and different Accounts, then independently over real TCP using the linked production Plugin. Ambiguous cleared and delete requests return clean 4xx and preserve both files. editable() still chooses the first ID match across the Ledger; edit input does not bind the selected source Month. The resolver also exists on origin/dev: this is an inherited data-safety defect that fails the requested B4 mutation acceptance, not a new register SQL identity defect. The retained regression allows safe ambiguity refusal. N1 — a healthy read can surface a queued 500 after the fault clears. A deliberate SQLite INSERT ABORT happens after a source PUT is durable. The first Account GET queues repair and returns 503. After the worker fails and the trigger is dropped, the next healthy Account GET returns 500 Internal Server Error from the queued Failure. Explicit recovery returns current source-correct 200. No stale successful numbers or source loss occurred. This is an error-class gap in the requested explicit-retryable-read requirement; the deliberate source-write error itself is expected fault instrumentation. Filed on #688. Completed focused checks: - B3 successful-number fencing: production Account and register successes equal current source values; Month and Ready to Assign equal independent full replay during the publication fault. After explicit recovery, source bytes stay unchanged and Account/register values match replay. The production integration probe avoids the cfg(test) cold-build shim. The strict retryable-status outcome has the N1 gap above. - Original B3/B4 regressions, file-scoped visible-leg paging/update and partial-Month marks pass. - Independent three-file collision paging: every identity appears once in All accounts and both Account registers, including an ordinary row and a transfer destination with the same visible date/ID/Account. A fresh linked Plugin/MoneyIndex reaches the same identities. - Actual migration 0005 API transaction killed with SIGKILL after old search and Category deletes. Two busy-writer observations 100 ms apart establish the kill point. Rollback retains committed 0004 rows, pending FULL intent and no version-5 receipt. Retry rebuilds exact Account/page models versus cold replay and preserves source bytes; repeated migration/recovery stays inert. A correctly signed, reconstructed pre-0005 cursor is rejected with HTTP 400. Its payload shape was checked against pre-fix code. - Twenty-five production source/publication SIGKILL points across create/edit/delete/cleared/cross-month moves pass, including acknowledged writes and repeated recovery. - Independent BigInt register sequences and paging pass. - Expanded fixed-seed generator passes 128 histories, 24–39 operations each, comparing all six Months to full source replay after every changed physical Budget or Month write, including intermediate writes within a logical operation. It covers #1393 signed Card openings, missing payment links, positive credit, refunds, splits, transfers, Assignments, edits, deletes, underfunding and rollover. - Shared-Index User isolation passes for Account/register/Month reads, signed foreign cursor rejection, no-data-scope refusals, and another User's same-ID cleared write. Owner source files and foreign models remain unchanged as required. Test principals supply identity; full sign-in middleware is not retested. Gate provenance: an initial gate attempt compiled a temporary probe while it was being edited and failed on the new probe's incorrect month_view argument order. That probe was removed and replaced with a production-linked integration probe. A new oracle initially used the month string as the Budget name; corrected it to the real source title. A temporary paging probe needed an explicit Option<String> cursor type. No existing expectation or product behavior changed. The final main gate runs only original tests and the committed failing B5 regression. Passing transient probes are removed from tracked sources and retained under ignored artifacts. Known gaps: no physical power-loss experiment; migration used populated synthetic legacy projections and a reconstructed signed old cursor, not an old server binary; production HTTP probes used test principals and do not retest the full sign-in layer; finite histories are not exhaustive. B5 and N1 remain unfixed because this review is read-mostly. No UI change, screenshot or performance claim is made. Decisions: no product design decisions. Use safe refusal as an acceptable result for ambiguous legacy ID-only writes; a successful write must bind its intended source identity. Retain only a failing real-defect regression, and restore passing exploratory probes. Final gate result: the original 256-history scoped generator passes. The only failing test in the completed two-crate gate is the committed B5 regression. Exit 101 is expected for this retained defect test; this is not a green gate. All original tests pass. Commands (preset CARGO_TARGET_DIR was preserved; all cargo commands use CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0, TMPDIR=<worktree>/target/tmp): - cargo fmt --check: exit 0, no output. - cargo clippy -p calternal-plugin-money --all-targets -- -D warnings: exit 0. - cargo test -p calternal-money -p calternal-plugin-money --no-fail-fast -- --test-threads=4: exit 101, B5 only. Verbatim clippy completion: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 02s ``` Verbatim completed two-crate gate result lines (includes one child-run result): ``` test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.88s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.56s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.85s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.04s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 180 filtered out; finished in 28.60s test result: FAILED. 177 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1695.89s error: test failed, to rerun pass `-p calternal-plugin-money --lib` test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 8.45s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s error: 1 target failed: `-p calternal-plugin-money --lib` ``` Focused probe result lines, verbatim: - Main regression: ``` test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 180 filtered out; finished in 4.20s ``` - Expanded per-source-write generator plus migration and known regression: ``` test result: FAILED. 2 passed; 1 failed; 1 ignored; 0 measured; 180 filtered out; finished in 1613.32s ``` - Production successful-number fencing and User isolation: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.97s ``` - Independent colliding-file production paging/restart: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 2 filtered out; finished in 2.85s ``` - Twenty-five SIGKILL durability cases: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 183 filtered out; finished in 56.22s ``` Cleanup: cargo clean succeeded; web build/output directories were already absent. Working tree is clean. No review artifacts committed. No secrets or real financial data are included. Review completed within the 90-minute time box. ``` Removed 5849 files, 2.4GiB total ``` Evidence: artifacts/money688rev3-findings.md; complete gate log artifacts/money688rev3-final-gates.log.
kayg commented 2026-10-10 15:18:52 +00:00
Author
Owner
Copy link

money688l started on job/money-688. Head 2d03ef517c; origin/dev base dbd621434d. Scope: B5 file-scoped mutation addresses and N1 queued repair failures. Migrations 0004/0005 remain unchanged. No dependency changes planned.

money688l started on job/money-688. Head 2d03ef517c337150b1bb7a52b8193af4b172eb3f; origin/dev base dbd621434d0a1133f16230cca5c6a83af0d8aed3. Scope: B5 file-scoped mutation addresses and N1 queued repair failures. Migrations 0004/0005 remain unchanged. No dependency changes planned.
kayg commented 2026-10-10 15:27:09 +00:00
Author
Owner
Copy link

B5 fix committed as ee019f850: every transaction write requires x-money-source-month and x-money-account-id from the selected register identity. ID-only requests return 409 before source writes. Edit/delete validation, cleared lookup/reply and client edit/Undo/optimistic marks use the same file scope. The retained round-3 regression passes unchanged; the new edit/delete/cleared collision regression passes and checks byte and projection preservation on refused addresses.

N1 fix committed as 14ed1ed37: queued source-validation failures remain explicit; a queued server failure is consumed as a prior attempt and schedules another bounded repair instead of returning its stale 500. The deterministic injected-publication/queued-worker regression passes, then Account numbers equal full source replay without source changes. No migration or dependency change. Required origin/dev refresh is underway before final gates.

B5 fix committed as ee019f850: every transaction write requires x-money-source-month and x-money-account-id from the selected register identity. ID-only requests return 409 before source writes. Edit/delete validation, cleared lookup/reply and client edit/Undo/optimistic marks use the same file scope. The retained round-3 regression passes unchanged; the new edit/delete/cleared collision regression passes and checks byte and projection preservation on refused addresses. N1 fix committed as 14ed1ed37: queued source-validation failures remain explicit; a queued server failure is consumed as a prior attempt and schedules another bounded repair instead of returning its stale 500. The deterministic injected-publication/queued-worker regression passes, then Account numbers equal full source replay without source changes. No migration or dependency change. Required origin/dev refresh is underway before final gates.
kayg commented 2026-10-10 16:20:47 +00:00
Author
Owner
Copy link

B5 FIXED / N1 FIXED — money688l, branch job/money-688, head d740d3cedf.

Built:

  • Transaction writes require the selected source Month, file-local transaction ID and Account leg. The client sends x-money-source-month and x-money-account-id separately from replacement fields. Edit, delete and cleared routes refuse incomplete or ambiguous addresses with 409 before a source or projection change. Splits and transfer amount edits still follow the existing unsupported-edit policy after address validation. Transfer cleared replies retain the selected leg and source identity.
  • Register keys, focus targets, editor selection, optimistic marks and Undo retain the full identity. Undo after a Month move addresses the saved destination row. No UI style changed.
  • A retained worker server error schedules bounded repair on the next read. Pending reads return the existing retryable 503 fence. They do not replay a stale queued 500. Source-validation errors retain their existing behavior.
  • Added collision edit/delete/cleared regressions and deterministic publication-fault recovery checks, including linked production Plugin checks over real TCP. The committed round-3 B5 regression is byte-identical to 2d03ef517. Existing test expectations were not changed. Test transports now send the selected row address; raw incomplete-address probes remain raw.
  • Updated OpenAPI, generated client/action contracts, exact perf allowance pins, the existing register benchmark and its adversarial write probes. No dependency or migration change; 0004 and 0005 remain unchanged.

Files:

  • apps/web/src/lib/money/api.test.ts
  • apps/web/src/lib/money/api.ts
  • apps/web/src/lib/money/register-display.test.ts
  • apps/web/src/lib/money/register-display.ts
  • apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte
  • bench/money-register-688.mjs
  • contracts/actions.json
  • contracts/openapi.json
  • contracts/perf/adoption-1058.json
  • contracts/perf/exceptions.json
  • contracts/perf/registry.json
  • crates/plugins/money/src/register.rs
  • crates/plugins/money/src/register_contract_tests.rs
  • crates/plugins/money/src/register_recovery_tests.rs
  • crates/plugins/money/src/routes.rs
  • crates/plugins/money/src/tests.rs
  • crates/plugins/money/src/views.rs
  • crates/plugins/money/tests/write_addresses.rs
  • packages/api-client/src/generated.ts
  • tests/adversarial/money_register_688.mjs

Verification:
One required origin/dev fetch and merge returned Already up to date. All Cargo commands used CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0 and the worktree target/tmp. The preset CARGO_TARGET_DIR was preserved.

cargo fmt --check: exit 0, no output.

cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: exit 0. Verbatim:

    Checking calternal-api v0.0.1 (/home/kayg/Developer/calternal-wt/money-688/crates/calternal-api)
    Checking calternal-plugin v0.0.1 (/home/kayg/Developer/calternal-wt/money-688/crates/calternal-plugin)
    Checking calternal-plugin-money v0.0.1 (/home/kayg/Developer/calternal-wt/money-688/crates/plugins/money)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.93s

cargo test -p calternal-money -p calternal-plugin-money -- --test-threads=4: exit 0. Verbatim result lines (includes one child-run result):

test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.08s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.52s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.08s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.96s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 182 filtered out; finished in 27.79s
test result: ok. 180 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1523.47s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.38s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.42s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cd apps/web && bun run check: exit 0. Verbatim final check lines:

perf-lint: PASS; 0 violations; 22131 scoped exceptions
svelte-check found 0 errors and 3 warnings in 1 file

The three warnings are unused selectors in the unchanged MailMorphCard.svelte.

cd apps/web && bun run test -- --maxWorkers=2 src/lib/money: exit 0. Verbatim:

 Test Files  13 passed (13)
      Tests  117 passed (117)
   Start at  17:42:30
   Duration  11.60s (transform 68%, environment 15%, import 8%, tests 4%, setup 4%)

Focused production TCP regressions, rerun after the final comment change: exit 0. Verbatim:

test production_account_read_retries_after_publication_fault_clears ... ok
test production_file_scoped_writes_refuse_hostile_or_incomplete_addresses ... ok
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.64s

The final two-crate run includes the incremental-versus-full fixed-seed generator and the 25 SIGKILL source/publication boundaries. Both passed after the fix. The independent BigInt register sequence check also passed.

UX gaps closed: wrong-Month writes, colliding delete/cleared selection, transfer-leg replies, moved-row Undo, duplicate DOM identities, scoped optimistic marks, and queued-error recovery.

UX gaps left: split/transfer amount edits remain unsupported, as before. Delete Undo and the existing transaction deep-link grammar are outside this two-defect fix.

Visual evidence:
Production web build, Chromium with macOS platform emulation, 390/820/1440 px, light and dark. Each set includes loaded register, mouse-open form, shortcut-open form and the existing Budget screen. Shared Button, Card, Checkbox, Menu, MetricCard, Pill, TagPill and TransactionForm controls retain their existing styles. Twenty-four actual-size captures are attached below for Claude review; no visual quality claim is made here. The native :focus-visible selector assertion in the existing capture helper also matches text fields after a pointer open. The ignored capture helper records computed outline-style none and box-shadow none instead; the existing input border style was not changed. Screenshots use the shared origin/dev server with the new production SPA. The changed API is separately covered by the production-linked TCP tests. No Mac VM was used.

Expected work:
The client adds no request and uses constant work per selected identity; the resident register stays bounded to 400 rows. A cleared write uses one indexed source-scoped lookup plus the selected Month and Account update. Edit/delete selection scans the selected Month rather than guessing the first whole-Ledger ID. Existing arithmetic dependency work is unchanged. The source filter uses the existing 0005 file identity index.

Known gaps:

  • Full browser/API acceptance on a combined server build and performance measurements are left to the merge round under the verification policy. This job makes no new p50/p95, CPU or RSS claim.
  • Histories are finite; no physical power-loss experiment. TCP tests use test principals and do not retest the full sign-in middleware.
  • An extra 30-test Python action-registry suite has three failures. The exact same failures occur with the starting revision's OpenAPI: smoke-plan admin operations, notification account scope and plugin admin scope. Money action generation passes scripts/action_registry.py --check. No unrelated scope or test expectation was changed.

Decisions:

  • Use required source headers to preserve existing mutation URLs and keep source address fields separate from replacement fields. Refuse ID-only requests even when a current snapshot has one match; never infer a future write target from a read.
  • Treat queued server failures as prior repair attempts. Retry through the existing bounded worker and pending 503 response; retain source-validation errors.
  • No storage change is needed, so there is no migration 0006.

For the merge round:

  • cd apps/web && bun run test -- --maxWorkers=2: full web suite.
  • cd apps/web && CALTERNAL_SERVER_BIN=<combined-server> bun run test:e2e:money: real client writes, Undo and duplicate identities on the combined build.
  • perf-run calternal money688l 20 -- env CALTERNAL_SERVER_BIN=<copied-combined-release-server> MONEY688_ROWS=50000,200000 MONEY688_REVISION=<combined-sha> bun bench/money-register-688.mjs: updated real-server hostile-address probe and register hot-path p50/p95, CPU/RSS, realistic largest fixture and bursts. Compare with docs/perf/baseline.json; build here, copy the binary, and measure only under the perf VM lock.

Cleanup: cargo clean exited 0; web build and .svelte-kit output were deleted. Verbatim clean output:

     Removed 5911 files, 2.5GiB total

Working tree is clean. No push, deploy or merge into dev/main.

B5 FIXED / N1 FIXED — head d740d3cedf.

B5 FIXED / N1 FIXED — money688l, branch job/money-688, head d740d3cedf919dd4541c664d6c74db948e096c32. Built: - Transaction writes require the selected source Month, file-local transaction ID and Account leg. The client sends x-money-source-month and x-money-account-id separately from replacement fields. Edit, delete and cleared routes refuse incomplete or ambiguous addresses with 409 before a source or projection change. Splits and transfer amount edits still follow the existing unsupported-edit policy after address validation. Transfer cleared replies retain the selected leg and source identity. - Register keys, focus targets, editor selection, optimistic marks and Undo retain the full identity. Undo after a Month move addresses the saved destination row. No UI style changed. - A retained worker server error schedules bounded repair on the next read. Pending reads return the existing retryable 503 fence. They do not replay a stale queued 500. Source-validation errors retain their existing behavior. - Added collision edit/delete/cleared regressions and deterministic publication-fault recovery checks, including linked production Plugin checks over real TCP. The committed round-3 B5 regression is byte-identical to 2d03ef517. Existing test expectations were not changed. Test transports now send the selected row address; raw incomplete-address probes remain raw. - Updated OpenAPI, generated client/action contracts, exact perf allowance pins, the existing register benchmark and its adversarial write probes. No dependency or migration change; 0004 and 0005 remain unchanged. Files: - `apps/web/src/lib/money/api.test.ts` - `apps/web/src/lib/money/api.ts` - `apps/web/src/lib/money/register-display.test.ts` - `apps/web/src/lib/money/register-display.ts` - `apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte` - `bench/money-register-688.mjs` - `contracts/actions.json` - `contracts/openapi.json` - `contracts/perf/adoption-1058.json` - `contracts/perf/exceptions.json` - `contracts/perf/registry.json` - `crates/plugins/money/src/register.rs` - `crates/plugins/money/src/register_contract_tests.rs` - `crates/plugins/money/src/register_recovery_tests.rs` - `crates/plugins/money/src/routes.rs` - `crates/plugins/money/src/tests.rs` - `crates/plugins/money/src/views.rs` - `crates/plugins/money/tests/write_addresses.rs` - `packages/api-client/src/generated.ts` - `tests/adversarial/money_register_688.mjs` Verification: One required origin/dev fetch and merge returned `Already up to date.` All Cargo commands used CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0 and the worktree target/tmp. The preset CARGO_TARGET_DIR was preserved. cargo fmt --check: exit 0, no output. cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: exit 0. Verbatim: ``` Checking calternal-api v0.0.1 (/home/kayg/Developer/calternal-wt/money-688/crates/calternal-api) Checking calternal-plugin v0.0.1 (/home/kayg/Developer/calternal-wt/money-688/crates/calternal-plugin) Checking calternal-plugin-money v0.0.1 (/home/kayg/Developer/calternal-wt/money-688/crates/plugins/money) Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.93s ``` cargo test -p calternal-money -p calternal-plugin-money -- --test-threads=4: exit 0. Verbatim result lines (includes one child-run result): ``` test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.08s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.52s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.08s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.96s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 182 filtered out; finished in 27.79s test result: ok. 180 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 1523.47s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 7.38s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.42s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cd apps/web && bun run check: exit 0. Verbatim final check lines: ``` perf-lint: PASS; 0 violations; 22131 scoped exceptions svelte-check found 0 errors and 3 warnings in 1 file ``` The three warnings are unused selectors in the unchanged MailMorphCard.svelte. cd apps/web && bun run test -- --maxWorkers=2 src/lib/money: exit 0. Verbatim: ``` Test Files 13 passed (13) Tests 117 passed (117) Start at 17:42:30 Duration 11.60s (transform 68%, environment 15%, import 8%, tests 4%, setup 4%) ``` Focused production TCP regressions, rerun after the final comment change: exit 0. Verbatim: ``` test production_account_read_retries_after_publication_fault_clears ... ok test production_file_scoped_writes_refuse_hostile_or_incomplete_addresses ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.64s ``` The final two-crate run includes the incremental-versus-full fixed-seed generator and the 25 SIGKILL source/publication boundaries. Both passed after the fix. The independent BigInt register sequence check also passed. UX gaps closed: wrong-Month writes, colliding delete/cleared selection, transfer-leg replies, moved-row Undo, duplicate DOM identities, scoped optimistic marks, and queued-error recovery. UX gaps left: split/transfer amount edits remain unsupported, as before. Delete Undo and the existing transaction deep-link grammar are outside this two-defect fix. Visual evidence: Production web build, Chromium with macOS platform emulation, 390/820/1440 px, light and dark. Each set includes loaded register, mouse-open form, shortcut-open form and the existing Budget screen. Shared Button, Card, Checkbox, Menu, MetricCard, Pill, TagPill and TransactionForm controls retain their existing styles. Twenty-four actual-size captures are attached below for Claude review; no visual quality claim is made here. The native :focus-visible selector assertion in the existing capture helper also matches text fields after a pointer open. The ignored capture helper records computed outline-style none and box-shadow none instead; the existing input border style was not changed. Screenshots use the shared origin/dev server with the new production SPA. The changed API is separately covered by the production-linked TCP tests. No Mac VM was used. - [budget-comparison-1440-dark.png](https://git.kayg.org/attachments/53aee264-8e0a-4069-bea5-6ff592eabbd4) - [budget-comparison-1440-light.png](https://git.kayg.org/attachments/2e8bba08-eda2-4fa7-94bb-9d8482d989cd) - [budget-comparison-390-dark.png](https://git.kayg.org/attachments/1c7797f5-b966-47ae-bb10-4b56ffd676a2) - [budget-comparison-390-light.png](https://git.kayg.org/attachments/843ce26c-a14e-4184-aec9-65d702baef23) - [budget-comparison-820-dark.png](https://git.kayg.org/attachments/78265c92-df07-4c64-9b5e-297095aa94fd) - [budget-comparison-820-light.png](https://git.kayg.org/attachments/6395c095-b96d-4291-a5ca-45c56c346896) - [keyboard-open-1440-dark.png](https://git.kayg.org/attachments/6b96e645-e5f0-4de4-b622-2b1ae73de484) - [keyboard-open-1440-light.png](https://git.kayg.org/attachments/4bcc329c-2179-466f-964c-67acfc5d9917) - [keyboard-open-390-dark.png](https://git.kayg.org/attachments/460b0738-d6d6-47a3-9f60-49ec146c85ac) - [keyboard-open-390-light.png](https://git.kayg.org/attachments/1c4dcf31-7dc7-462c-a112-cd071a0aeaa3) - [keyboard-open-820-dark.png](https://git.kayg.org/attachments/2ff52c1c-0dd1-408d-830d-12dc350f3db5) - [keyboard-open-820-light.png](https://git.kayg.org/attachments/dc0e54ee-38f1-43de-a804-d028cddb8a47) - [mouse-open-1440-dark.png](https://git.kayg.org/attachments/6cd514ef-3252-4b9e-b00f-7eab41efb81f) - [mouse-open-1440-light.png](https://git.kayg.org/attachments/43018391-f954-431e-b7e4-4fb95c4e94f1) - [mouse-open-390-dark.png](https://git.kayg.org/attachments/d3c0769f-0f1d-43b1-af9c-32d35cd3c2b9) - [mouse-open-390-light.png](https://git.kayg.org/attachments/427d8ec1-4c00-4727-99b9-3824f367ae07) - [mouse-open-820-dark.png](https://git.kayg.org/attachments/59791b1a-697a-4772-af45-e639db745b8f) - [mouse-open-820-light.png](https://git.kayg.org/attachments/27e6aefd-fffa-413d-b38d-53bcfd9a92e4) - [register-1440-dark.png](https://git.kayg.org/attachments/91fa170b-b875-4834-84fc-1a259bc5ef83) - [register-1440-light.png](https://git.kayg.org/attachments/2a2da687-c183-4b37-8f4e-10083036d28a) - [register-390-dark.png](https://git.kayg.org/attachments/4dca8a2b-d963-4e9f-a83c-1c2aba3daef1) - [register-390-light.png](https://git.kayg.org/attachments/c8beb630-6c0a-4f74-9cb4-072845b2c460) - [register-820-dark.png](https://git.kayg.org/attachments/13f23576-a6f4-4baa-a8ae-a7e0dd8d8894) - [register-820-light.png](https://git.kayg.org/attachments/4aae75ec-f924-413e-b4c7-42dc919fa443) Expected work: The client adds no request and uses constant work per selected identity; the resident register stays bounded to 400 rows. A cleared write uses one indexed source-scoped lookup plus the selected Month and Account update. Edit/delete selection scans the selected Month rather than guessing the first whole-Ledger ID. Existing arithmetic dependency work is unchanged. The source filter uses the existing 0005 file identity index. Known gaps: - Full browser/API acceptance on a combined server build and performance measurements are left to the merge round under the verification policy. This job makes no new p50/p95, CPU or RSS claim. - Histories are finite; no physical power-loss experiment. TCP tests use test principals and do not retest the full sign-in middleware. - An extra 30-test Python action-registry suite has three failures. The exact same failures occur with the starting revision's OpenAPI: smoke-plan admin operations, notification account scope and plugin admin scope. Money action generation passes scripts/action_registry.py --check. No unrelated scope or test expectation was changed. Decisions: - Use required source headers to preserve existing mutation URLs and keep source address fields separate from replacement fields. Refuse ID-only requests even when a current snapshot has one match; never infer a future write target from a read. - Treat queued server failures as prior repair attempts. Retry through the existing bounded worker and pending 503 response; retain source-validation errors. - No storage change is needed, so there is no migration 0006. For the merge round: - `cd apps/web && bun run test -- --maxWorkers=2`: full web suite. - `cd apps/web && CALTERNAL_SERVER_BIN=<combined-server> bun run test:e2e:money`: real client writes, Undo and duplicate identities on the combined build. - `perf-run calternal money688l 20 -- env CALTERNAL_SERVER_BIN=<copied-combined-release-server> MONEY688_ROWS=50000,200000 MONEY688_REVISION=<combined-sha> bun bench/money-register-688.mjs`: updated real-server hostile-address probe and register hot-path p50/p95, CPU/RSS, realistic largest fixture and bursts. Compare with docs/perf/baseline.json; build here, copy the binary, and measure only under the perf VM lock. Cleanup: cargo clean exited 0; web build and .svelte-kit output were deleted. Verbatim clean output: ``` Removed 5911 files, 2.5GiB total ``` Working tree is clean. No push, deploy or merge into dev/main. B5 FIXED / N1 FIXED — head d740d3cedf919dd4541c664d6c74db948e096c32.
kayg commented 2026-10-10 16:22:44 +00:00
Author
Owner
Copy link

Started independent number-correctness and data-safety review money688rev4. Branch job/money-688; head d740d3cedf; local origin/dev ac7fda1a8c. Focus: B5 file-scoped writes and Undo, N1 queued publication failure, then migration/recovery/paging/User isolation. Read-mostly; only a failing real-defect regression may be committed. 75-minute time box. No product code changes, push or deploy.

Started independent number-correctness and data-safety review money688rev4. Branch job/money-688; head d740d3cedf919dd4541c664d6c74db948e096c32; local origin/dev ac7fda1a8c49e902e1b246bea9d167d64e92d58f. Focus: B5 file-scoped writes and Undo, N1 queued publication failure, then migration/recovery/paging/User isolation. Read-mostly; only a failing real-defect regression may be committed. 75-minute time box. No product code changes, push or deploy.
kayg commented 2026-10-10 16:27:56 +00:00
Author
Owner
Copy link

Money #688 independent review, round 4

Started 2026-10-10T16:22:43.402676+00:00. Branch job/money-688. Head d740d3cedf; local origin/dev ac7fda1a8c. 75-minute time box. Product code stays unchanged. Author reports and result files are not read. Synthetic fixtures only; no amounts or transaction contents in evidence.

Contract and refresh

Read CLAUDE.md, CONTEXT.md, DESIGN §48 and the relevant durability, link and instant-interaction rules, plus #688 and allowed round-2/3 findings. Start head d740d3ced. Required fetch/merge used origin/dev ac7fda1a8; merge commit fa093fb59. Three performance JSON conflicts were resolved semantically: preserve independent additions and deletions from both sides, retain branch Money pins where both edited the same live site. Product source merged automatically. No independent product edits. No author reports/result files read.

The web sends source Month and Account in real request headers for edits, deletes and marks. Undo addresses the saved destination after a move. Split/transfer amount edits and deletes remain deliberately unsupported (422); review requires safe refusal and unchanged bytes for those actions, plus supported leg-specific cleared writes and Undo. No new dependencies. Gates started with the prescribed Cargo environment and preset target directory.

Independent production checks

Three focused production-linked tests pass (15.19s): real TCP addressed write/Undo matrix in same-Account and different-Account collisions; publication-fault read-model fencing and User isolation; three-file collision paging and restart with retained transfer destination dates. No stale successful Account/register/Month/Ready to Assign values; healthy reads return only 200/503/409 and recover without manual repair. Signed User-A cursor is rejected for User B with 400. No-data-scope reads return 403. All rows reached exactly once in All accounts and individual registers after restart.

The write matrix sends the same headers/body as the web API. Missing scope for edit/delete/marks returns 409, with both Month files and full-replay numbers unchanged. Supported ordinary cross-Month/Account edit and destination-addressed Undo preserve the colliding other source. Primary and destination cleared toggles for ordinary/split/transfer rows return the selected full identity and correct state, and Undo restores numbers. Split/transfer edit/delete returns 422 and preserves both sources. One exploratory byte-roundtrip assertion was too strict for a destination mark, which adds source-leg metadata; fixed only this new probe to retain numerical and other-source invariants. No existing expectations changed.

Web-check merge finding: exact adoption pins differ from the merged ledger (49 stale entries); prune only pins absent from the exact live ledger, then check the merged live syntax. This is merge-contract housekeeping, not a product behavior change.

# Money #688 independent review, round 4 Started 2026-10-10T16:22:43.402676+00:00. Branch job/money-688. Head d740d3cedf919dd4541c664d6c74db948e096c32; local origin/dev ac7fda1a8c49e902e1b246bea9d167d64e92d58f. 75-minute time box. Product code stays unchanged. Author reports and result files are not read. Synthetic fixtures only; no amounts or transaction contents in evidence. ## Contract and refresh Read CLAUDE.md, CONTEXT.md, DESIGN §48 and the relevant durability, link and instant-interaction rules, plus #688 and allowed round-2/3 findings. Start head d740d3ced. Required fetch/merge used origin/dev ac7fda1a8; merge commit fa093fb59. Three performance JSON conflicts were resolved semantically: preserve independent additions and deletions from both sides, retain branch Money pins where both edited the same live site. Product source merged automatically. No independent product edits. No author reports/result files read. The web sends source Month and Account in real request headers for edits, deletes and marks. Undo addresses the saved destination after a move. Split/transfer amount edits and deletes remain deliberately unsupported (422); review requires safe refusal and unchanged bytes for those actions, plus supported leg-specific cleared writes and Undo. No new dependencies. Gates started with the prescribed Cargo environment and preset target directory. ## Independent production checks Three focused production-linked tests pass (15.19s): real TCP addressed write/Undo matrix in same-Account and different-Account collisions; publication-fault read-model fencing and User isolation; three-file collision paging and restart with retained transfer destination dates. No stale successful Account/register/Month/Ready to Assign values; healthy reads return only 200/503/409 and recover without manual repair. Signed User-A cursor is rejected for User B with 400. No-data-scope reads return 403. All rows reached exactly once in All accounts and individual registers after restart. The write matrix sends the same headers/body as the web API. Missing scope for edit/delete/marks returns 409, with both Month files and full-replay numbers unchanged. Supported ordinary cross-Month/Account edit and destination-addressed Undo preserve the colliding other source. Primary and destination cleared toggles for ordinary/split/transfer rows return the selected full identity and correct state, and Undo restores numbers. Split/transfer edit/delete returns 422 and preserves both sources. One exploratory byte-roundtrip assertion was too strict for a destination mark, which adds source-leg metadata; fixed only this new probe to retain numerical and other-source invariants. No existing expectations changed. Web-check merge finding: exact adoption pins differ from the merged ledger (49 stale entries); prune only pins absent from the exact live ledger, then check the merged live syntax. This is merge-contract housekeeping, not a product behavior change.
kayg commented 2026-10-10 16:36:30 +00:00
Author
Owner
Copy link

Money #688 independent review, round 4

Started 2026-10-10T16:22:43.402676+00:00. Branch job/money-688. Head d740d3cedf; local origin/dev ac7fda1a8c. 75-minute time box. Product code stays unchanged. Author reports and result files are not read. Synthetic fixtures only; no amounts or transaction contents in evidence.

Contract and refresh

Read CLAUDE.md, CONTEXT.md, DESIGN §48 and the relevant durability, link and instant-interaction rules, plus #688 and allowed round-2/3 findings. Start head d740d3ced. Required fetch/merge used origin/dev ac7fda1a8; merge commit fa093fb59. Three performance JSON conflicts were resolved semantically: preserve independent additions and deletions from both sides, retain branch Money pins where both edited the same live site. Product source merged automatically. No independent product edits. No author reports/result files read.

The web sends source Month and Account in real request headers for edits, deletes and marks. Undo addresses the saved destination after a move. Split/transfer amount edits and deletes remain deliberately unsupported (422); review requires safe refusal and unchanged bytes for those actions, plus supported leg-specific cleared writes and Undo. No new dependencies. Gates started with the prescribed Cargo environment and preset target directory.

Independent production checks

Three focused production-linked tests pass (15.19s): real TCP addressed write/Undo matrix in same-Account and different-Account collisions; publication-fault read-model fencing and User isolation; three-file collision paging and restart with retained transfer destination dates. No stale successful Account/register/Month/Ready to Assign values; healthy reads return only 200/503/409 and recover without manual repair. Signed User-A cursor is rejected for User B with 400. No-data-scope reads return 403. All rows reached exactly once in All accounts and individual registers after restart.

The write matrix sends the same headers/body as the web API. Missing scope for edit/delete/marks returns 409, with both Month files and full-replay numbers unchanged. Supported ordinary cross-Month/Account edit and destination-addressed Undo preserve the colliding other source. Primary and destination cleared toggles for ordinary/split/transfer rows return the selected full identity and correct state, and Undo restores numbers. Split/transfer edit/delete returns 422 and preserves both sources. One exploratory byte-roundtrip assertion was too strict for a destination mark, which adds source-leg metadata; fixed only this new probe to retain numerical and other-source invariants. No existing expectations changed.

Web-check merge finding: exact adoption pins differ from the merged ledger (49 stale entries); prune only pins absent from the exact live ledger, then check the merged live syntax. This is merge-contract housekeeping, not a product behavior change.

Migration, crash and original regressions

Round-3 B5 regression now passes unchanged. Original B3/B4 regressions pass. N1 completed-worker-failure regression passes. All 25 real TCP source/publication SIGKILL cases (create/edit/delete/cleared/cross-Month moves at five boundaries) pass. Actual 0005 migration killed during its SQL transaction rolls back populated 0004 projections and preserves the FULL intent; retry rebuilds exact source-replay Account and register values, including colliding IDs. Repeating migration and recovery preserves bytes. A correctly signed reconstructed pre-0005 cursor returns 400, not 500.

Fresh fixed-seed 139304 generator passes 32 histories of 24–39 operations, comparing all six Months with full calculation after every changed physical Budget or Month write, including intermediate source sets. Shapes include signed Card openings, omitted payment links, positive Card credit, refunds, splits, transfers, Assignments, edits, deletes, overspending and rollover. Original 256-history generator and other long gates continue.

Extra same-visible-identity probe passes (3.96s): an October transfer destination uses the same August visible date, transaction ID and Account as an ordinary August source row. Headers select the October leg for cleared and Undo. August source stays byte-identical, full-replay Account/Month/Ready to Assign matches, destination evidence returns byte-identically, and all identities remain reachable once after restart.

Scoped foreign writes pass (2.93s): another User has matching file-local IDs and applies cleared, edit and delete in its own Home. Owner bytes, Account and register models stay unchanged; the other User's numbers equal full replay and recovery preserves isolation.

All passing exploratory probes restored out of tracked sources and retained under ignored artifacts. No failing real-defect regression to commit. Clippy passes; final web check passes after frozen-lockfile install and merged exact pin refresh. No limits, rules or ratchets raised. No dependencies changed.

Merge housekeeping is folded into the one required refresh commit: final merge head 98982153c9 replaces fa093fb59. No independent product behavior changed. Web check exit 0 was confirmed from its finished child; full web tests run with --maxWorkers=2. Migration numbers were checked on fetched origin/dev: that branch has no Money register migration set yet; this review adds or renumbers none, and 0004 stays unchanged.

# Money #688 independent review, round 4 Started 2026-10-10T16:22:43.402676+00:00. Branch job/money-688. Head d740d3cedf919dd4541c664d6c74db948e096c32; local origin/dev ac7fda1a8c49e902e1b246bea9d167d64e92d58f. 75-minute time box. Product code stays unchanged. Author reports and result files are not read. Synthetic fixtures only; no amounts or transaction contents in evidence. ## Contract and refresh Read CLAUDE.md, CONTEXT.md, DESIGN §48 and the relevant durability, link and instant-interaction rules, plus #688 and allowed round-2/3 findings. Start head d740d3ced. Required fetch/merge used origin/dev ac7fda1a8; merge commit fa093fb59. Three performance JSON conflicts were resolved semantically: preserve independent additions and deletions from both sides, retain branch Money pins where both edited the same live site. Product source merged automatically. No independent product edits. No author reports/result files read. The web sends source Month and Account in real request headers for edits, deletes and marks. Undo addresses the saved destination after a move. Split/transfer amount edits and deletes remain deliberately unsupported (422); review requires safe refusal and unchanged bytes for those actions, plus supported leg-specific cleared writes and Undo. No new dependencies. Gates started with the prescribed Cargo environment and preset target directory. ## Independent production checks Three focused production-linked tests pass (15.19s): real TCP addressed write/Undo matrix in same-Account and different-Account collisions; publication-fault read-model fencing and User isolation; three-file collision paging and restart with retained transfer destination dates. No stale successful Account/register/Month/Ready to Assign values; healthy reads return only 200/503/409 and recover without manual repair. Signed User-A cursor is rejected for User B with 400. No-data-scope reads return 403. All rows reached exactly once in All accounts and individual registers after restart. The write matrix sends the same headers/body as the web API. Missing scope for edit/delete/marks returns 409, with both Month files and full-replay numbers unchanged. Supported ordinary cross-Month/Account edit and destination-addressed Undo preserve the colliding other source. Primary and destination cleared toggles for ordinary/split/transfer rows return the selected full identity and correct state, and Undo restores numbers. Split/transfer edit/delete returns 422 and preserves both sources. One exploratory byte-roundtrip assertion was too strict for a destination mark, which adds source-leg metadata; fixed only this new probe to retain numerical and other-source invariants. No existing expectations changed. Web-check merge finding: exact adoption pins differ from the merged ledger (49 stale entries); prune only pins absent from the exact live ledger, then check the merged live syntax. This is merge-contract housekeeping, not a product behavior change. ## Migration, crash and original regressions Round-3 B5 regression now passes unchanged. Original B3/B4 regressions pass. N1 completed-worker-failure regression passes. All 25 real TCP source/publication SIGKILL cases (create/edit/delete/cleared/cross-Month moves at five boundaries) pass. Actual 0005 migration killed during its SQL transaction rolls back populated 0004 projections and preserves the FULL intent; retry rebuilds exact source-replay Account and register values, including colliding IDs. Repeating migration and recovery preserves bytes. A correctly signed reconstructed pre-0005 cursor returns 400, not 500. Fresh fixed-seed 139304 generator passes 32 histories of 24–39 operations, comparing all six Months with full calculation after every changed physical Budget or Month write, including intermediate source sets. Shapes include signed Card openings, omitted payment links, positive Card credit, refunds, splits, transfers, Assignments, edits, deletes, overspending and rollover. Original 256-history generator and other long gates continue. Extra same-visible-identity probe passes (3.96s): an October transfer destination uses the same August visible date, transaction ID and Account as an ordinary August source row. Headers select the October leg for cleared and Undo. August source stays byte-identical, full-replay Account/Month/Ready to Assign matches, destination evidence returns byte-identically, and all identities remain reachable once after restart. Scoped foreign writes pass (2.93s): another User has matching file-local IDs and applies cleared, edit and delete in its own Home. Owner bytes, Account and register models stay unchanged; the other User's numbers equal full replay and recovery preserves isolation. All passing exploratory probes restored out of tracked sources and retained under ignored artifacts. No failing real-defect regression to commit. Clippy passes; final web check passes after frozen-lockfile install and merged exact pin refresh. No limits, rules or ratchets raised. No dependencies changed. Merge housekeeping is folded into the one required refresh commit: final merge head 98982153c934be3d340937644aed02fd3f82c38a replaces fa093fb59. No independent product behavior changed. Web check exit 0 was confirmed from its finished child; full web tests run with --maxWorkers=2. Migration numbers were checked on fetched origin/dev: that branch has no Money register migration set yet; this review adds or renumbers none, and 0004 stays unchanged.
kayg commented 2026-10-10 16:42:48 +00:00
Author
Owner
Copy link

Money #688 independent review, round 4

Started 2026-10-10T16:22:43.402676+00:00. Branch job/money-688. Head d740d3cedf; local origin/dev ac7fda1a8c. 75-minute time box. Product code stays unchanged. Author reports and result files are not read. Synthetic fixtures only; no amounts or transaction contents in evidence.

Contract and refresh

Read CLAUDE.md, CONTEXT.md, DESIGN §48 and the relevant durability, link and instant-interaction rules, plus #688 and allowed round-2/3 findings. Start head d740d3ced. Required fetch/merge used origin/dev ac7fda1a8; merge commit fa093fb59. Three performance JSON conflicts were resolved semantically: preserve independent additions and deletions from both sides, retain branch Money pins where both edited the same live site. Product source merged automatically. No independent product edits. No author reports/result files read.

The web sends source Month and Account in real request headers for edits, deletes and marks. Undo addresses the saved destination after a move. Split/transfer amount edits and deletes remain deliberately unsupported (422); review requires safe refusal and unchanged bytes for those actions, plus supported leg-specific cleared writes and Undo. No new dependencies. Gates started with the prescribed Cargo environment and preset target directory.

Independent production checks

Three focused production-linked tests pass (15.19s): real TCP addressed write/Undo matrix in same-Account and different-Account collisions; publication-fault read-model fencing and User isolation; three-file collision paging and restart with retained transfer destination dates. No stale successful Account/register/Month/Ready to Assign values; healthy reads return only 200/503/409 and recover without manual repair. Signed User-A cursor is rejected for User B with 400. No-data-scope reads return 403. All rows reached exactly once in All accounts and individual registers after restart.

The write matrix sends the same headers/body as the web API. Missing scope for edit/delete/marks returns 409, with both Month files and full-replay numbers unchanged. Supported ordinary cross-Month/Account edit and destination-addressed Undo preserve the colliding other source. Primary and destination cleared toggles for ordinary/split/transfer rows return the selected full identity and correct state, and Undo restores numbers. Split/transfer edit/delete returns 422 and preserves both sources. One exploratory byte-roundtrip assertion was too strict for a destination mark, which adds source-leg metadata; fixed only this new probe to retain numerical and other-source invariants. No existing expectations changed.

Web-check merge finding: exact adoption pins differ from the merged ledger (49 stale entries); prune only pins absent from the exact live ledger, then check the merged live syntax. This is merge-contract housekeeping, not a product behavior change.

Migration, crash and original regressions

Round-3 B5 regression now passes unchanged. Original B3/B4 regressions pass. N1 completed-worker-failure regression passes. All 25 real TCP source/publication SIGKILL cases (create/edit/delete/cleared/cross-Month moves at five boundaries) pass. Actual 0005 migration killed during its SQL transaction rolls back populated 0004 projections and preserves the FULL intent; retry rebuilds exact source-replay Account and register values, including colliding IDs. Repeating migration and recovery preserves bytes. A correctly signed reconstructed pre-0005 cursor returns 400, not 500.

Fresh fixed-seed 139304 generator passes 32 histories of 24–39 operations, comparing all six Months with full calculation after every changed physical Budget or Month write, including intermediate source sets. Shapes include signed Card openings, omitted payment links, positive Card credit, refunds, splits, transfers, Assignments, edits, deletes, overspending and rollover. Original 256-history generator and other long gates continue.

Extra same-visible-identity probe passes (3.96s): an October transfer destination uses the same August visible date, transaction ID and Account as an ordinary August source row. Headers select the October leg for cleared and Undo. August source stays byte-identical, full-replay Account/Month/Ready to Assign matches, destination evidence returns byte-identically, and all identities remain reachable once after restart.

Scoped foreign writes pass (2.93s): another User has matching file-local IDs and applies cleared, edit and delete in its own Home. Owner bytes, Account and register models stay unchanged; the other User's numbers equal full replay and recovery preserves isolation.

All passing exploratory probes restored out of tracked sources and retained under ignored artifacts. No failing real-defect regression to commit. Clippy passes; final web check passes after frozen-lockfile install and merged exact pin refresh. No limits, rules or ratchets raised. No dependencies changed.

Merge housekeeping is folded into the one required refresh commit: final merge head 98982153c9 replaces fa093fb59. No independent product behavior changed. Web check exit 0 was confirmed from its finished child; full web tests run with --maxWorkers=2. Migration numbers were checked on fetched origin/dev: that branch has no Money register migration set yet; this review adds or renumbers none, and 0004 stays unchanged.

Web gates complete

bun run check exit 0 after frozen-lockfile workspace relink and exact merged Money pins. bun run test -- --maxWorkers=2 exit 0. Verbatim completion:

svelte-check found 0 errors and 0 warnings
 Test Files  316 passed (316)
      Tests  2309 passed (2309)

The suite includes the web API header transport and TransactionForm tests. No UI changes or screenshots are claimed. Early pre-install focused tests had no collected tests because the newly merged workspace package was not linked; the final full suite proves their actual passing state.

# Money #688 independent review, round 4 Started 2026-10-10T16:22:43.402676+00:00. Branch job/money-688. Head d740d3cedf919dd4541c664d6c74db948e096c32; local origin/dev ac7fda1a8c49e902e1b246bea9d167d64e92d58f. 75-minute time box. Product code stays unchanged. Author reports and result files are not read. Synthetic fixtures only; no amounts or transaction contents in evidence. ## Contract and refresh Read CLAUDE.md, CONTEXT.md, DESIGN §48 and the relevant durability, link and instant-interaction rules, plus #688 and allowed round-2/3 findings. Start head d740d3ced. Required fetch/merge used origin/dev ac7fda1a8; merge commit fa093fb59. Three performance JSON conflicts were resolved semantically: preserve independent additions and deletions from both sides, retain branch Money pins where both edited the same live site. Product source merged automatically. No independent product edits. No author reports/result files read. The web sends source Month and Account in real request headers for edits, deletes and marks. Undo addresses the saved destination after a move. Split/transfer amount edits and deletes remain deliberately unsupported (422); review requires safe refusal and unchanged bytes for those actions, plus supported leg-specific cleared writes and Undo. No new dependencies. Gates started with the prescribed Cargo environment and preset target directory. ## Independent production checks Three focused production-linked tests pass (15.19s): real TCP addressed write/Undo matrix in same-Account and different-Account collisions; publication-fault read-model fencing and User isolation; three-file collision paging and restart with retained transfer destination dates. No stale successful Account/register/Month/Ready to Assign values; healthy reads return only 200/503/409 and recover without manual repair. Signed User-A cursor is rejected for User B with 400. No-data-scope reads return 403. All rows reached exactly once in All accounts and individual registers after restart. The write matrix sends the same headers/body as the web API. Missing scope for edit/delete/marks returns 409, with both Month files and full-replay numbers unchanged. Supported ordinary cross-Month/Account edit and destination-addressed Undo preserve the colliding other source. Primary and destination cleared toggles for ordinary/split/transfer rows return the selected full identity and correct state, and Undo restores numbers. Split/transfer edit/delete returns 422 and preserves both sources. One exploratory byte-roundtrip assertion was too strict for a destination mark, which adds source-leg metadata; fixed only this new probe to retain numerical and other-source invariants. No existing expectations changed. Web-check merge finding: exact adoption pins differ from the merged ledger (49 stale entries); prune only pins absent from the exact live ledger, then check the merged live syntax. This is merge-contract housekeeping, not a product behavior change. ## Migration, crash and original regressions Round-3 B5 regression now passes unchanged. Original B3/B4 regressions pass. N1 completed-worker-failure regression passes. All 25 real TCP source/publication SIGKILL cases (create/edit/delete/cleared/cross-Month moves at five boundaries) pass. Actual 0005 migration killed during its SQL transaction rolls back populated 0004 projections and preserves the FULL intent; retry rebuilds exact source-replay Account and register values, including colliding IDs. Repeating migration and recovery preserves bytes. A correctly signed reconstructed pre-0005 cursor returns 400, not 500. Fresh fixed-seed 139304 generator passes 32 histories of 24–39 operations, comparing all six Months with full calculation after every changed physical Budget or Month write, including intermediate source sets. Shapes include signed Card openings, omitted payment links, positive Card credit, refunds, splits, transfers, Assignments, edits, deletes, overspending and rollover. Original 256-history generator and other long gates continue. Extra same-visible-identity probe passes (3.96s): an October transfer destination uses the same August visible date, transaction ID and Account as an ordinary August source row. Headers select the October leg for cleared and Undo. August source stays byte-identical, full-replay Account/Month/Ready to Assign matches, destination evidence returns byte-identically, and all identities remain reachable once after restart. Scoped foreign writes pass (2.93s): another User has matching file-local IDs and applies cleared, edit and delete in its own Home. Owner bytes, Account and register models stay unchanged; the other User's numbers equal full replay and recovery preserves isolation. All passing exploratory probes restored out of tracked sources and retained under ignored artifacts. No failing real-defect regression to commit. Clippy passes; final web check passes after frozen-lockfile install and merged exact pin refresh. No limits, rules or ratchets raised. No dependencies changed. Merge housekeeping is folded into the one required refresh commit: final merge head 98982153c934be3d340937644aed02fd3f82c38a replaces fa093fb59. No independent product behavior changed. Web check exit 0 was confirmed from its finished child; full web tests run with --maxWorkers=2. Migration numbers were checked on fetched origin/dev: that branch has no Money register migration set yet; this review adds or renumbers none, and 0004 stays unchanged. ## Web gates complete `bun run check` exit 0 after frozen-lockfile workspace relink and exact merged Money pins. `bun run test -- --maxWorkers=2` exit 0. Verbatim completion: ``` svelte-check found 0 errors and 0 warnings Test Files 316 passed (316) Tests 2309 passed (2309) ``` The suite includes the web API header transport and TransactionForm tests. No UI changes or screenshots are claimed. Early pre-install focused tests had no collected tests because the newly merged workspace package was not linked; the final full suite proves their actual passing state.
kayg commented 2026-10-10 16:56:24 +00:00
Author
Owner
Copy link

READY — independent number-correctness and data-safety review of #688, round 4. No blocker found. B3, B4, B5 and N1 acceptance checks pass. Completed within the 75-minute time box.

Built: independent production-linked TCP probes for collision-safe writes/Undo, retryable publication recovery, full source replay, paging and User isolation; transient migration-SIGKILL and fresh-seed per-physical-write history probes. All pass. No independent product code change and no failing real-defect regression to retain. Passing probes are restored out of tracked source.

Files: ignored artifacts/money688rev4-findings.md, artifacts/money688rev4-independent-probes.rs, artifacts/money688rev4-probes-register_contract_tests.rs, artifacts/money688rev4-probes-projection.rs, plus gate/probe logs. Tracked changes from this review are only the required origin/dev merge and conflict resolution in contracts/perf/adoption-1058.json, contracts/perf/exceptions.json and contracts/perf/registry.json. Merge retains both branches' independent changes, removes stale exact checkpoint pins and refreshes 48 existing Money live-site hashes; no rule, limit or ratchet grows. Frozen-lockfile install relinks the new workspace package without a dependency or lockfile change.

Head: 98982153c9. Branch job/money-688. Reviewed start d740d3ced against fetched origin/dev ac7fda1a8 (the original brief baseline was dbd621434). One fetch and merge only. No push or deploy. Working tree is clean.

Verified:

  • B5: same-Account and different-Account files reuse local IDs. Actual client-shaped headers select edit/delete/cleared writes. Missing/incomplete scope returns 409 and leaves bytes and full-replay numbers unchanged. Ordinary edits can move Month and Account; Undo addresses the saved destination and restores correct numbers. Split/transfer edit/delete remains the existing safe 422 refusal. Supported cleared/Undo works for split and both transfer legs, leaving the colliding other source unchanged.
  • Stronger collision: an October transfer destination has the same August visible date, local ID and Account as an ordinary August row. October source scope selects only the destination leg. Its cleared response retains the exact identity/date, Undo restores existing evidence bytes, other-source bytes stay unchanged and numbers equal full recomputation.
  • B3/N1: deliberate SQLite publication ABORT follows a durable source PUT. Successful Account/register/Month/Ready to Assign reads match new source numbers; pending reads return explicit retryable 503/409. After fault clearing, bounded-worker retries recover without queued 500 or manual recovery. The deterministic N1 unit test observes a completed queued failure before clearing the fault. The original round-3 B5 regression now passes unchanged.
  • B4: three-file collisions, including two identical visible date/ID/Account identities, page exactly once in All accounts and each Account. Fresh linked Plugin/Index and restart recovery retain all identities. Original file-scoped visible-leg and partial-Month update tests pass.
  • Migration 0005: actual migration API is killed with SIGKILL during the SQL transaction over populated 0004 projection rows with colliding local IDs. Rollback preserves committed rows and FULL intent, restart/retry matches cold full replay, repeated recovery preserves source bytes, and a correctly signed reconstructed pre-0005 cursor returns 400. No migration changes; 0004 is unchanged.
  • Twenty-five real TCP SIGKILL cases cover create, edit, delete, cleared and cross-Month moves at five durability boundaries, including acknowledged responses and repeated recovery. All pass.
  • Fresh seed 139304: 32 histories, 24–39 operations, all six Months compared after each changed physical Budget or Month write, including intermediate logical-operation source sets. #1393 shapes include signed Card openings, missing payment links, credit, refunds, splits, transfers, Assignments, edits/deletes, overspending and rollover. Original 256-history replay, BigInt register sequences/paging and Card arrival/batch/time-zone suites also pass.
  • User isolation: User-A cursor is rejected for User B with 400; no-data-scope reads return 403; another User's same-ID cleared/edit/delete changes only that Home. Owner bytes and read models stay unchanged, and foreign numbers equal their own full replay.
  • Web: full suite includes actual request-header transport, row identities and TransactionForm coverage. No UI implementation or visual claim.

Gate commands (CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0, TMPDIR=/target/tmp; preset CARGO_TARGET_DIR preserved):

  • cargo fmt --check: exit 0, no output.
  • cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: exit 0.
  • cargo test -p calternal-money -p calternal-plugin-money --no-fail-fast -- --test-threads=4: exit 0.
  • cd apps/web && bun run check: exit 0.
  • cd apps/web && bun run test -- --maxWorkers=2: exit 0.

Verbatim Rust completion output:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 4m 00s
test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.42s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.38s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.75s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.83s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.39s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 185 filtered out; finished in 33.43s
test result: ok. 182 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 1736.61s
test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 10.01s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

The main Rust binary includes two passing transient review tests and their ignored child. Their sources were restored after compilation. Existing expectations are unchanged. Clippy runs on restored tracked sources.

Verbatim web completion output:

perf-lint: PASS; 0 violations; 22131 scoped exceptions
svelte-check found 0 errors and 0 warnings
 Test Files  316 passed (316)
      Tests  2309 passed (2309)

Early web checks needed the frozen-lockfile workspace relink and exact merged pin repair. An initial new exploratory byte-roundtrip assertion incorrectly required removing newly created transfer-leg metadata on Undo; corrected only that new probe to check exact numbers/state and other-source safety. No existing expectation or product behavior changed. These early harness/merge failures are not hidden by the final passing gates.

Known gaps: finite synthetic histories; no physical power-loss test; synthetic populated legacy projections and reconstructed old cursor rather than an old server binary; authenticated test principals do not retest full sign-in middleware. Split/transfer amount edit/delete is still unsupported and safely refused. No screenshots or performance measurement; no UI feature changed. No Mac VM used.

UX gaps closed: no product changes in this review; verified the claimed file-scoped writes/Undo and calm retryable-read behavior. UX gaps left: existing unsupported split/transfer amount editing.

Decisions: no new product design decisions. Accept the documented unsupported-write refusal; permit transfer source-leg metadata to persist after destination Undo while requiring exact numbers, restored state and other-file safety. Retain only failing real-defect regressions; none found. Required merge housekeeping refreshes exact existing pins without broader adoption.

For the merge round: run the combined full server/adversarial matrices and deployed checks under the normal merge policy. This review's requested focused reliability scenarios ran here; none are deferred.

Cleanup: cargo clean exit 0; web build/output directories absent. No artifacts committed, secrets displayed or real financial data used. Verbatim cleanup:

     Removed 5909 files, 2.5GiB total

Evidence: artifacts/money688rev4-findings.md; artifacts/money688rev4-gates.log; artifacts/money688rev4-independent.log; artifacts/money688rev4-write-isolation.log; artifacts/money688rev4-visible-collision.log; artifacts/money688rev4-web-check-final.log; artifacts/money688rev4-web-tests-final.log.

READY — independent number-correctness and data-safety review of #688, round 4. No blocker found. B3, B4, B5 and N1 acceptance checks pass. Completed within the 75-minute time box. Built: independent production-linked TCP probes for collision-safe writes/Undo, retryable publication recovery, full source replay, paging and User isolation; transient migration-SIGKILL and fresh-seed per-physical-write history probes. All pass. No independent product code change and no failing real-defect regression to retain. Passing probes are restored out of tracked source. Files: ignored artifacts/money688rev4-findings.md, artifacts/money688rev4-independent-probes.rs, artifacts/money688rev4-probes-register_contract_tests.rs, artifacts/money688rev4-probes-projection.rs, plus gate/probe logs. Tracked changes from this review are only the required origin/dev merge and conflict resolution in contracts/perf/adoption-1058.json, contracts/perf/exceptions.json and contracts/perf/registry.json. Merge retains both branches' independent changes, removes stale exact checkpoint pins and refreshes 48 existing Money live-site hashes; no rule, limit or ratchet grows. Frozen-lockfile install relinks the new workspace package without a dependency or lockfile change. Head: 98982153c934be3d340937644aed02fd3f82c38a. Branch job/money-688. Reviewed start d740d3ced against fetched origin/dev ac7fda1a8 (the original brief baseline was dbd621434). One fetch and merge only. No push or deploy. Working tree is clean. Verified: - B5: same-Account and different-Account files reuse local IDs. Actual client-shaped headers select edit/delete/cleared writes. Missing/incomplete scope returns 409 and leaves bytes and full-replay numbers unchanged. Ordinary edits can move Month and Account; Undo addresses the saved destination and restores correct numbers. Split/transfer edit/delete remains the existing safe 422 refusal. Supported cleared/Undo works for split and both transfer legs, leaving the colliding other source unchanged. - Stronger collision: an October transfer destination has the same August visible date, local ID and Account as an ordinary August row. October source scope selects only the destination leg. Its cleared response retains the exact identity/date, Undo restores existing evidence bytes, other-source bytes stay unchanged and numbers equal full recomputation. - B3/N1: deliberate SQLite publication ABORT follows a durable source PUT. Successful Account/register/Month/Ready to Assign reads match new source numbers; pending reads return explicit retryable 503/409. After fault clearing, bounded-worker retries recover without queued 500 or manual recovery. The deterministic N1 unit test observes a completed queued failure before clearing the fault. The original round-3 B5 regression now passes unchanged. - B4: three-file collisions, including two identical visible date/ID/Account identities, page exactly once in All accounts and each Account. Fresh linked Plugin/Index and restart recovery retain all identities. Original file-scoped visible-leg and partial-Month update tests pass. - Migration 0005: actual migration API is killed with SIGKILL during the SQL transaction over populated 0004 projection rows with colliding local IDs. Rollback preserves committed rows and FULL intent, restart/retry matches cold full replay, repeated recovery preserves source bytes, and a correctly signed reconstructed pre-0005 cursor returns 400. No migration changes; 0004 is unchanged. - Twenty-five real TCP SIGKILL cases cover create, edit, delete, cleared and cross-Month moves at five durability boundaries, including acknowledged responses and repeated recovery. All pass. - Fresh seed 139304: 32 histories, 24–39 operations, all six Months compared after each changed physical Budget or Month write, including intermediate logical-operation source sets. #1393 shapes include signed Card openings, missing payment links, credit, refunds, splits, transfers, Assignments, edits/deletes, overspending and rollover. Original 256-history replay, BigInt register sequences/paging and Card arrival/batch/time-zone suites also pass. - User isolation: User-A cursor is rejected for User B with 400; no-data-scope reads return 403; another User's same-ID cleared/edit/delete changes only that Home. Owner bytes and read models stay unchanged, and foreign numbers equal their own full replay. - Web: full suite includes actual request-header transport, row identities and TransactionForm coverage. No UI implementation or visual claim. Gate commands (CARGO_BUILD_JOBS=4, CARGO_PROFILE_DEV_DEBUG=line-tables-only, CARGO_INCREMENTAL=0, TMPDIR=<worktree>/target/tmp; preset CARGO_TARGET_DIR preserved): - cargo fmt --check: exit 0, no output. - cargo clippy -p calternal-money -p calternal-plugin-money --all-targets -- -D warnings: exit 0. - cargo test -p calternal-money -p calternal-plugin-money --no-fail-fast -- --test-threads=4: exit 0. - cd apps/web && bun run check: exit 0. - cd apps/web && bun run test -- --maxWorkers=2: exit 0. Verbatim Rust completion output: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 4m 00s test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.42s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.38s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.75s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.83s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.39s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 185 filtered out; finished in 33.43s test result: ok. 182 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 1736.61s test result: ok. 29 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 10.01s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` The main Rust binary includes two passing transient review tests and their ignored child. Their sources were restored after compilation. Existing expectations are unchanged. Clippy runs on restored tracked sources. Verbatim web completion output: ``` perf-lint: PASS; 0 violations; 22131 scoped exceptions svelte-check found 0 errors and 0 warnings Test Files 316 passed (316) Tests 2309 passed (2309) ``` Early web checks needed the frozen-lockfile workspace relink and exact merged pin repair. An initial new exploratory byte-roundtrip assertion incorrectly required removing newly created transfer-leg metadata on Undo; corrected only that new probe to check exact numbers/state and other-source safety. No existing expectation or product behavior changed. These early harness/merge failures are not hidden by the final passing gates. Known gaps: finite synthetic histories; no physical power-loss test; synthetic populated legacy projections and reconstructed old cursor rather than an old server binary; authenticated test principals do not retest full sign-in middleware. Split/transfer amount edit/delete is still unsupported and safely refused. No screenshots or performance measurement; no UI feature changed. No Mac VM used. UX gaps closed: no product changes in this review; verified the claimed file-scoped writes/Undo and calm retryable-read behavior. UX gaps left: existing unsupported split/transfer amount editing. Decisions: no new product design decisions. Accept the documented unsupported-write refusal; permit transfer source-leg metadata to persist after destination Undo while requiring exact numbers, restored state and other-file safety. Retain only failing real-defect regressions; none found. Required merge housekeeping refreshes exact existing pins without broader adoption. For the merge round: run the combined full server/adversarial matrices and deployed checks under the normal merge policy. This review's requested focused reliability scenarios ran here; none are deferred. Cleanup: cargo clean exit 0; web build/output directories absent. No artifacts committed, secrets displayed or real financial data used. Verbatim cleanup: ``` Removed 5909 files, 2.5GiB total ``` Evidence: artifacts/money688rev4-findings.md; artifacts/money688rev4-gates.log; artifacts/money688rev4-independent.log; artifacts/money688rev4-write-isolation.log; artifacts/money688rev4-visible-collision.log; artifacts/money688rev4-web-check-final.log; artifacts/money688rev4-web-tests-final.log.
kayg commented 2026-10-10 20:31:59 +00:00
Author
Owner
Copy link

Deployed to production in merge38 4ebeba0b8 (backup /srv/calternal/backup-pre-merge38-20261010-2214). Prod ready after 42 s; served-check true.

Deployed to production in merge38 4ebeba0b8 (backup /srv/calternal/backup-pre-merge38-20261010-2214). Prod ready after 42 s; served-check true.
kayg closed this issue 2026-10-10 20:32:00 +00:00
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
dev
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/blocks-1125
wip/allday-1107
wip/agenda-1086
wip/trayicons2-1095
wip/trayicons-1095
wip/sidebar3-1094
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/nlpchip-1127
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/delete-1119
job/txentry-1198
job/rev1586
job/rev2-money-ident
job/rev2-webperf
job/morph-1104
job/previewcard-1098
job/importhang-1121
job/kanban-1092
job/merge-round-7b
job/merge-round-7c
job/calcards-1115
job/collabrev3-1197
job/e2e-b-1071
job/agenda-1086
job/agenda-decks
job/allday-1107
job/browserfix
job/calact9
job/adv7c-1105
wip/collabrev3-1197
wip/calcards-1115
wip/calact9
wip/calact10
wip/browserfix
wip/agenda-decks
wip/adv7c-1105
wip/txentry-1198
wip/rev2-webperf
wip/rev2-money-ident
wip/rev1586
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/importhang-1121
wip/fix1586
wip/e2e-b2-1071
wip/e2e-b-1071
job/noncanon-1618
wip/noncanon-1618
job/edrevert-1616
job/partial-1605
wip/partial-1605
job/calact6
job/cold-1586
job/perfvm-1587
wip/cold-1586
job/cal404-1581
wip/calact6
wip/cal404-1581
job/dname-1584
wip/dname-1584
job/merge41
wip/merge41b
wip/merge41
job/rev1573c
job/hscroll-1579
wip/rev1573c
job/rev1573b
job/rev1573
wip/fix1573
wip/hscroll2
wip/hscroll-1579
job/rev1574
wip/fix1574
wip/rev1574
job/startup-1573c
job/merge40
wip/startup-1573d
wip/startup-1573c
job/calact5
wip/remtext2
wip/merge40c
wip/merge40b
wip/merge40
job/calact4
job/startup-1573
job/calprof
wip/calprof
wip/startup-1573
job/fs1575
job/fix1570
job/calact3
job/rec1540c
wip/fix1570
job/rev1570-review
wip/calact3
job/calact2
wip/calact2
job/calcold-1560
wip/calcold-1560
wip/rec1540c
job/fix1569
wip/fix1569
job/calact-1557
wip/calact-1557
job/remtext-1568
wip/remtext-1568
job/fix1566
wip/fix1566
job/rec1540b
job/reconcile-1540
job/money2rev
wip/money2rev
job/merge39
wip/merge39
wip/reconcile-1540
job/tabswitch2
job/merge38
wip/merge38
job/autherr-1553
wip/autherr-1553
job/money-688
wip/money688rev3
wip/money688rev2
wip/money688rev
wip/money688l
wip/money688k
wip/money688j
wip/money688i
wip/money688h
wip/money688g
wip/money688f
wip/money688e
wip/money688d
wip/money688c
wip/money688b
wip/money-688
wip/tabswitch2
wip/merge37
job/merge37
job/jobnames-1538
wip/jobnames-1538
job/tabcomp-perf
job/calscript-1492
wip/tabcomp-perf
wip/calscript-1492
job/mailbody-1533
wip/mailbody-1533
job/intlfmt-1461
job/merge36
wip/intlfmt2
wip/intlfmt-1461
wip/merge36
job/merge35c
job/tagperf-1186
wip/tagrev2
wip/tagrev
wip/tagperf4
wip/tagperf2-1186
wip/tagperf-1186
wip/tagfix5
wip/tagfix3
wip/tagfast2
wip/tagfast
wip/merge35c
job/notesel-1493
wip/notesel2
wip/notesel-1493
job/merge35b
wip/merge35b
wip/m35btriage
wip/m35bratchet
wip/calsel-1491
job/calsel-1491
job/notifread-1387
job/bulkwrite-1393
wip/notifread2
wip/notifread-1387
job/slowsel-1392
wip/bulkwrite-1393
wip/bulkrev4
wip/bulkrev3
wip/bulkrev2
wip/bulkrev
wip/bulkfix4
wip/bulkfix3
wip/bulkfix2
wip/bulkfix
job/mail7-1340
job/bigscroll-1481
job/searchperf-1425
wip/mailrev4
wip/mailrev3
wip/mailrev2
wip/mailrev
wip/mail7f
wip/mail7e
wip/mail7d
wip/searchperf2
wip/searchperf-1425
wip/mail7c
wip/mail7b
wip/mail7-1340
job/photoopen-1367
job/mailsel-1449
wip/bigscroll-1481
wip/slowsel3
wip/slowsel2
wip/slowsel-1392
wip/selroot
job/journaldup
wip/journaldup8
wip/journaldup7
wip/journaldup6
wip/journaldup5
wip/journaldup4
wip/journaldup3
wip/journaldup2
wip/journaldup
wip/jdrev5
wip/jdrev4
wip/jdrev3
wip/jdrev2
wip/jdrev
wip/jdfix9
job/bignote-1349
wip/mailsel-1449
wip/bignote3
wip/bignote2
wip/bignote-1349
job/statusmark-1457
wip/statusmark-1457
wip/photoopen4
wip/photoopen3
wip/photoopen2
wip/photoopen-1367
job/authflash-1473
job/merge35
wip/authflash-1473
job/phototags-1370
wip/phototags-1370
wip/merge35
wip/m35triage
job/tick-1446
wip/tick-1446
job/restartidx-1450
job/exmove-1333
job/coldnote-1451
wip/restartidx-1450
wip/exmove-1333
wip/coldnote-1451
job/undo412-1430
wip/undo412-1430
job/calwrite-1441
job/xcancel-1443
job/calscroll-1362
wip/xcancel-1443
wip/calwrite-1441
job/xsub-1445
wip/calscroll3
wip/calscroll2
wip/calscroll-1362
wip/xsub-1445
job/linkdup-1440
wip/linkdup2
wip/linkdup-1440
wip/tabswitch4
wip/tabswitch3
wip/tabswitch-1233
wip/navrev
job/tabswitch-1233
job/mdpaste-1431
job/taskundo-1433
job/directory-1199
wip/taskundo-1433
job/remind-1432
job/nfd-1411
wip/remind-1432
wip/dirfix4
wip/dirfix3
wip/dirfix2
wip/dirfix-1199
wip/directory-1199-r
wip/directory-1199
job/readerx-1427
wip/readerx-1427
job/scrollfade-1416
job/tipphone-1439
wip/nfd-1411
job/purge-1420
job/notifrow-1414
wip/purge-1420
wip/notifrow-1414
job/slop-1385
wip/slop2
wip/slop-1385
job/tbover-1409
job/qltitle-1408
job/grantlive-1405
job/taskclick-1434
wip/tbover-1409
wip/taskclick-1434
wip/qltitle-1408
job/scrub-1422
job/hotfix35
job/ticks-1361
wip/scrub-1422
job/taskprev-1401
wip/grantlive-1405
job/ghost-1323
wip/ticks3
wip/ticks2
wip/ticks-1361
wip/taskprev-1401
job/bash3-settings
wip/ghost-1323
job/mailmorph-1368
wip/bash3-settings
job/apiaudit-1374
wip/bash3-filesphotos
job/bash3-filesphotos
job/xuser39-1402
job/bash3-money
job/mailhtml-1372
wip/mailhtml2
wip/mailhtml-1372
job/bash3-interop
job/bash3-calendar
wip/bash3-money
wip/bash3-interop
wip/bash3-calendar
wip/mailmorph2
wip/mailmorph-1368
wip/bash3-tasks
job/outro-1391
job/linkpick-1379
job/linkdel-1384
wip/linkpick2
wip/linkpick-1379
wip/linkdel3
wip/linkdel2
wip/linkdel-1384
job/mailrows-1390
wip/mailrows-1390
wip/apiaudit2
wip/apiaudit-1374
job/bash-core
wip/outro-1391
wip/bash-core2
wip/bash-core
job/bash3-notes
job/bash3-tasks
job/merge34
job/notifdel-1363
wip/merge34
wip/notifdel2
wip/notifdel-1363
job/wklink-1371
wip/wklink-1371
job/searchbar-1360
wip/searchbar2
wip/searchbar-1360
job/merge33-1122
wip/merge33c
wip/merge33b
wip/merge33-1122
job/bash-security
job/mailglass-1373
wip/bash-security2
wip/bash-security
wip/mailglass-1373
job/instaudit-1369
wip/instaudit-1369
job/tabstorm-1338
wip/tabstorm2
wip/tabstorm-1338
wip/bash-files2
wip/bash-files
job/bash-files
job/bash-money
job/editfuzz-1335
wip/bash-money
wip/moneyrev
job/tasksperf-1286
wip/tasksperf3
wip/tasksperf2
wip/tasksperf-1286
wip/editfuzz2
wip/editfuzz-1335
review/dirrev-1199
job/merge32
wip/merge32b
wip/merge32
job/bash-chrome
job/tagdnd-1187
job/bash-notes
wip/bash-notes2
wip/bash-notes
wip/bash-chrome
wip/reconcile-c1
wip/adv-c1
wip/tagdnd2-1187
wip/tagdnd-1187
job/bash-calendar
job/deploy-c1
job/editbreak-1334
job/bash-perf
wip/bash-calendar2
wip/bash-calendar
wip/bash-perf
job/hunt-20261006
job/bash-interop
job/collabloss-1197
wip/collabrev-1197
wip/collabloss5-1197
wip/collabloss4-1197
wip/collabloss3-1197
wip/collabloss2-1197
wip/collabloss-1197
wip/bash-interop
job/bash-mail
wip/bash-mail
job/vis-1293
wip/vis-1293
wip/restyle-search-r
wip/restyle-search-fix2
wip/restyle-search-fix
wip/restyle-search
job/restyle-settings
job/restyle-search
wip/restyle-settings-fix
wip/restyle-settings
job/adv31
wip/advfix-a
wip/adv31
job/bash-tasks
wip/bash-tasks
job/restyle-files
wip/restyle-files-fix
wip/restyle-files
job/fmtbar-1210
wip/fmtbar2-1210
wip/fmtbar-1210
job/perf2-1124
wip/perf2-1124
job/proflog-1204
job/merge31
wip/restyle-notes
wip/merge31
wip/proflog-1204
job/restyle-notes
job/fix-1213
wip/fix-1213
job/hide-1153
job/restyle-mailmoney
job/notestatus-1209
wip/hide-1153
wip/hiderev2-1153
wip/hiderev-1153
wip/hide5-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
job/sidebarblur-1208
wip/notestatus-1209
wip/sidebarblur-1208
wip/restyle-mailmoney
job/onboard-1141
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
job/adv-1202
job/segmented-1200
wip/segmented-1200
job/merge30
job/notifloop-1194
job/toastmorph-1201
wip/notifloop-1194
job/perf-1124
job/tocrail-1191
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/perf-1124
wip/merge30j
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
fixbatch-25
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
fixbatch-23
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
hotfix-sidebar2
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
wip/e2e-a2-1071
wip/e2e-a-1071
backup/canvas-visual-before-reconcile
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/staging-imap
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/theme-detail
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
job/merge-round-3-pre-rebuild
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
backup/doc-stack-r3-reset-source
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
job/dedup-375-clean
job/dedup-375-before-rebase
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
backup/doc-stack-round3-before-rebuild
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#688
No description provided.